npm - @reason-machines/cli-linux-arm64-musl - Versions diffs - 0.2.277 → 0.2.278 - Mend

@reason-machines/cli-linux-arm64-musl 0.2.277 → 0.2.278

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (55) hide show

package/bin/vm-hands/vm-hands-entry-lite-8wyfep1z.js ADDED Viewed

@@ -0,0 +1,343 @@
+// @bun
+import{t as u0}from"./vm-hands-entry-lite-k4c504n7.js";import{A as t8,B as o8,C as _7,D as F7,E as v3,F as v5,G as J5,H as _0,I as d$,J as l$,K as E0,L as $2,M as g5,N as t0,O as Y6,P as Z3,Q as a5,U as i5,ba as D7,ca as j7,da as z7,ea as O7,fa as u3,y as k6,z as y6}from"./vm-hands-entry-lite-51hcyapr.js";import{Aa as e8,Ba as $5,Ca as H7,Da as N7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as V5,Ka as q7,La as W$,Oa as K4,Pa as V4,Qa as FJ,Ra as WJ,Sa as LJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as x$,Ya as B2,Za as U0,_a as M7,db as Q6,fb as S8,ha as u7,ib as g2,ka as q5,kb as m5,la as M5,lb as T3,nb as P5,oa as K5,qa as j5,rb as T7,sb as N3,ta as z5,ya as C5,za as I5}from"./vm-hands-entry-lite-htn1genx.js";import{Ab as O5,Bb as A5,Ib as R5}from"./vm-hands-entry-lite-c2nrar90.js";import{Nb as Z5}from"./vm-hands-entry-lite-65pbrs1x.js";import{Ub as h5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Cc as d5,Fc as W7,Ic as f6,Jc as h6,mc as a1,nc as K1,oc as T1,pc as L$,qc as JJ,rc as jJ,sc as zJ,tc as D$,uc as OJ,vc as X4,wc as _1,xc as A8,yc as Y4}from"./vm-hands-entry-lite-jwqqfjba.js";import{Fd as e1,Pd as F2,Tc as b2,Xc as K7,Yc as V7,zd as r8}from"./vm-hands-entry-lite-gqncr2j0.js";import{_d as B}from"./vm-hands-entry-lite-sv6xwe0h.js";import{ge as DJ,he as t2,ke as L7,ne as i$,pe as uJ,qe as dJ,ve as s5}from"./vm-hands-entry-lite-5pxbx31d.js";import{$e as k$,Ae as b$,Ce as P0,De as D4,Fe as J1,Ge as z0,He as x9,Ie as TJ,Je as _J,Ke as E2,Le as U2,Me as f3,Ne as z8,Oe as O8,Pe as X$,Qe as m$,Re as X0,Se as T2,Te as C7,Ue as I7,Ve as o1,We as A4,Ye as Q3,Ze as h1,_e as m0,af as X3,df as m1,ze as b0}from"./vm-hands-entry-lite-bfwf82rw.js";import{hf as D5}from"./vm-hands-entry-lite-ptmqg51y.js";import{fg as HJ,ig as u5,jg as h3,lg as Q5}from"./vm-hands-entry-lite-2xas56hm.js";import{Ug as J2,Vg as f5}from"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as V0,Zg as $7}from"./vm-hands-entry-lite-9pmag2qk.js";import{uh as r}from"./vm-hands-entry-lite-y4sjgfqz.js";import{Bh as U7}from"./vm-hands-entry-lite-anaydk9m.js";import{Gh as v0}from"./vm-hands-entry-lite-ffg7rf02.js";import{spawn as AJ,spawnSync as hK}from"child_process";import{closeSync as RJ,mkdirSync as mK,openSync as CJ,readdirSync as vK,realpathSync as V1,rmSync as z$}from"fs";import{hostname as gK}from"os";import{dirname as e3,join as F0,resolve as uK}from"path";var pJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function H9($){let J=typeof $==="string"?pJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as oJ,randomBytes as L9}from"crypto";import{createInterface as eJ}from"readline";import{randomBytes as cJ}from"crypto";import{chmodSync as U9,existsSync as q9,lstatSync as sJ,mkdirSync as aJ,readFileSync as M9,renameSync as iJ,unlinkSync as T9,writeFileSync as _9}from"fs";import{homedir as nJ}from"os";import{dirname as rJ,join as N9}from"path";function Z1($=process.env,J=nJ()){let Z=$.XDG_CONFIG_HOME?.trim()||N9(J,".config"),X=P0({env:$})==="staging"?["staging"]:[];return N9(U2(Z,...X),"credentials.json")}function F9($,J=Z1()){return aJ(rJ(J),{recursive:!0,mode:448}),_9(J,`${JSON.stringify($,null,2)}
+`,{mode:384}),U9(J,384),J}function P$($=Z1()){if(!q9($))return null;try{let J=M9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=J1(Q);if(X!==Q)tJ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function tJ($,J,Z){let Q=`${$}.${process.pid}.${cJ(6).toString("hex")}.tmp`;try{let X=sJ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(_9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
+`,{mode:384,flag:"wx"}),U9(Q,384),M9($,"utf8")!==J)throw Error("credentials_changed");iJ(Q,$)}catch{try{T9(Q)}catch{}}}function W9($=Z1()){if(!q9($))return!1;return T9($),!0}class M2 extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function D9(){let $=L9(48).toString("base64url"),J=oJ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:L9(32).toString("base64url")}}function $Z($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new M2(Q,Z)}async function JZ($,J,Z){let Q=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J}),X=await Q.json().catch(()=>({}));if(!Q.ok)throw $Z(X,`OAuth token request failed (${Q.status})`);return X}async function ZZ($,J={}){let Z=J.fetchImpl??fetch,Q=await JZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z);if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new M2("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return F9(X,J.path??Z1()),X}var q2=new Map;async function b1($={}){let J=$.path??Z1(),Z=P$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=q2.get(Y);if(G)return G;let H;return H=ZZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof M2)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=P$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return b1({fetchImpl:$.fetchImpl,path:J});return W9(J),null}).finally(()=>{if(q2.get(Y)===H)q2.delete(Y)}),q2.set(Y,H),H}function j9($,J){return new Promise((Z)=>{let Q=eJ({input:$}),X=!1,Y=(H)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(H)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(H)=>Y(H)),Q.once("close",()=>Y(null))})}var QZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),XZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function YZ($){let J=XZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var GZ=["minimal","low","medium","high","xhigh","max"],BZ=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),KZ=B.object({devices:B.array(BZ),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),VZ=B.object({id:B.string().min(1),name:B.string()}),HZ=B.object({items:B.array(VZ)}),NZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),UZ=B.object({items:B.array(NZ).default([])}),qZ=B.enum(["linux","macos"]),z9=B.object({id:B.string().min(1),name:B.string().min(1),platform:qZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),MZ=B.object({machines:B.array(z9)}),TZ=B.object({machine:z9}),_Z=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),FZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),O9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),WZ=O9.extend({organization_id:B.string().min(1)}),xV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var EV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function k1($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var LZ=B.object({error:B.object({type:B.string(),message:B.string()})});function A9($,J,Z){let Q=LZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",H=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(H)&&H>=0?H*1000:void 0)}async function R9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw A9(J.status,Z,J.headers.get("retry-after"));return k1(WZ,Z,"invalid_machine_ticket")}class H1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await b1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw A9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return k1(MZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return k1(TZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return k1(_Z,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return k1(FZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return k1(O9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=HZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return k1(UZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=KZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:GZ.filter((H)=>Q.includes(H))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return H9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=QZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=YZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments`)).items??[]}catch(J){if(J instanceof G0&&(J.status===403||J.status===404))return[];throw J}}sendMessage($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return D4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function DZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function j4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function C9($){let J=$.env??process.env,Z=j4(J);if(!Z)return($.getCredentials??b1)({apiOrigin:DZ(J)});let Q=y1(J,$.channel??P0({env:J})),X=await($.fetchImpl??fetch)(Q+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Z,accept:"application/json"}}),Y=await X.json().catch(()=>({})),G=t0(Y)?Y:{};if(!X.ok){let K=typeof G.detail==="string"?G.detail:typeof G.message==="string"?G.message:"API key authentication failed ("+X.status+")";throw new G0(X.status,typeof G.error==="string"?G.error:"api_key_auth_failed",K)}if(typeof G.org_id!=="string"||!G.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let H=Array.isArray(G.scopes)?G.scopes.filter((K)=>typeof K==="string"):[];return{credentialKind:"api_key",apiOrigin:Q,accessToken:Z,orgId:G.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:H}}import{createHash as jZ}from"crypto";import{unlinkSync as zZ}from"fs";import{platform as OZ}from"os";import{join as AZ}from"path";var I9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>AZ($,"api-key.json");function j1($){let J=jZ("sha256").update(`reason-connect-api-key
+${$}`).digest("hex");return new o1(T2(),OZ(),J)}function z4($,J,Z=j1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof X0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=j1($)){if(!u(f1($)))return null;let Z=I9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof X0))throw Q;throw Error("worker_api_key_unreadable")}}function P9($,J=j1($)){if(!u(f1($)))return;if(I9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof X0))throw Z}zZ(f1($))}async function O4($,J){let Z;try{Z=await C9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as lZ,renameSync as pZ,rmSync as v1}from"fs";import{join as q0}from"path";import{createHash as RZ}from"crypto";import{realpathSync as CZ,statSync as IZ,unlinkSync as _2}from"fs";import{platform as PZ}from"os";import{join as y0}from"path";function d($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var xZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max(e1).optional()});function E9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function R4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=xZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?C4($):new A4(g($))}function W2($,J){T0($,!0),wZ($);let Z=J??C4($),Q=new A4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof X0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function C4($){return new o1(T2(),PZ(),EZ($))}function EZ($){let J=I4($);return RZ("sha256").update(`reason-worker
+${J?.directory??g($)}`).digest("hex")}function E$($,J){c(y0(g($),S$),{version:1,directory:I4($)?.directory??g($),devicePublicKey:J})}var S$="keychain-scope.json";function S9($){return u(y0(g($),S$))}var SZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function I4($){let J=y0(g($),S$);if(!u(J))return null;let Z=SZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function wZ($){let J=y0(g($),S$);if(!u(J))return;if(I4($))try{let Z=C4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof X0))throw Z}_2(J)}function N1($){let J=CZ($.workspaceRoot);if(J!==$.workspaceRoot||!IZ(J).isDirectory()||!x$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&x9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var w9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=d($).control;return u(J)?w9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(d($).control,w9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),S$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var bZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),P4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:bZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),kZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),x4=30000;class Q1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function yZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(x4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new Q1(X?.error==="device_revoked")}return Q.json()}async function E4($,J,Z,Q){u0();let X=P4.parse(JSON.parse(s(J)));return X1($,X,Z,Q)}async function X1($,J,Z,Q=(Y,G)=>yZ(Y,G,k0($.proxy)),X=performance.now()){let Y=k9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function b9($,J,Z,Q,X=performance.now()){let Y=k9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function k9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=kZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let V=F2(q.first_heartbeat);try{E9($,q.device_id,{...V?{offer:V}:{},enrollmentMs:Math.min(e1,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as fZ,randomUUID as hZ}from"crypto";import{unlinkSync as mZ}from"fs";import{join as vZ}from"path";var y9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),gZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function S4($){return gZ.parse($)}var uZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function z1($){return Z1(b$("REASON_CLI_CHANNEL",$.channel),V0())}async function O1($,J=z1($)){if(!u(J))return null;let Z=uZ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,H)=>Q(G,{...H,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await b1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function f9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function h9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=A1($),H=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(H){let K=await b9($,G.direct(J.orgId),Q,(N,q)=>H({approval:G.request,code_verifier:q,registration:N}).catch((V)=>{throw dZ(V)}),Y);if(K)return K}return X1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function dZ($){if(!($ instanceof G0))return $;if($.status===409)return new Q1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new Q1(!1);return $}var w$=($)=>vZ(g($),"enrollment-install.json");function m9($){if(u(w$($)))mZ(w$($))}function A1($,{stored:J=!0}={}){u0();let Z=w$($),Q=J&&u(Z)?y9.parse(JSON.parse(s(Z))):{version:1,install_id:hZ(),fingerprint_key:fZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let H=($.folders??[]).map((V)=>{let U=m1([V],X,Y)[0];if(U.path!==V)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=D9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...H.map((V)=>V.path_fingerprint)].map((V)=>({path_fingerprint:V,permissions:X,execution_mode:$.executionMode}))},q=(V)=>({version:1,organization_id:V,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...H.length?{folders:H}:{}});return{request:N,saveInstall(V){e(g(V),!0),c(w$(V),Q)},complete(V,U){let M=S4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(V),enrollment_ticket:M.enrollment_ticket}},direct:q}}function v9($,J,Z){let Q=w$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=y9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,d9=600000,l9=15000,g9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,U1=($)=>q0(g($),"workspaces"),p9="account.json",w4=($)=>u(q0($,p9));function h0($){let J;try{J=lZ(U1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=q0(U1($),Z),X=q0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:w4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(U1($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,p9),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function y$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var b4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function u9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");E$($,Z.devicePublicKey),e(g(J),!0);for(let Y of b4)v1(q0(g(J),Y),{force:!0});for(let Y of b4){let G=q0(g($),Y);if(u(G))pZ(G,q0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function k4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(f4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(V)=>Number(Date.parse(V.worker?.expiresAt??"")>X+60000),H=h0($).flatMap((V)=>{if(!V.account||!V.config)return[];try{if($0(V.config).revoked)return[];let U=t(V.config);return U&&U.orgId.toLowerCase()===V.organizationId&&(!Q||Y(U))?[{...V,config:V.config,state:U}]:[]}catch{return[]}}).sort((V,U)=>Number(U.organizationId===J)-Number(V.organizationId===J)||Y(U.state)-Y(V.state))[0];if(!H)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==H.organizationId){let V=j2($,N);u9($,V.config),c(V.configPath,V.config)}else if(u(g($))){try{if(u(d($).state))f0($)}catch{}for(let V of b4)v1(q0(g($),V),{force:!0})}k4($);let q=J0.parse({...H.config,stateDirectory:$.stateDirectory});return u9(H.config,q),c(q0($.stateDirectory,"worker.json"),q),v1(H.directory,{recursive:!0,force:!0}),q}var y4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)E$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==q0(U1($),Z))continue;let H=J0.parse({...G,stateDirectory:Q}),K=T0(H),N=h1(d(H).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(H)}},d(H).state,{proofStore:K});c(X,H)}catch{}}}},f4=($)=>q0(U1($),"listed.json");function c9($){try{let J=JSON.parse(s(f4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function s9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=c9($),G=Y&&!Y.listed?Y.reason:null,H=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&H.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...H].map(({organizationId:K,config:N,account:q})=>{let V=!1,U=null,M=!1;try{V=N?$0(N).revoked:!1,U=N&&!V?t(N):null,M=J&&!!U&&k$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:V?"removed":M?"connected":"not_running",blocked:!q&&!V&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function a9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,H=null,K=!1,N=c9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...C}=J,P=Z.roots.slice(1).map((R)=>R.path);return J0.parse({...C,...P.length?{folders:P}:{},stateDirectory:q0(U1(J),W)})},V=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let C=new AbortController,P=()=>C.abort();if(X.addEventListener("abort",P,{once:!0}),X.aborted)C.abort();let R={...W,controller:C,claims:0,done:Promise.resolve(),account:L};R.done=$.serve(W,C.signal,(I)=>{R.claims=I}).then(()=>{return},(I)=>{if(L&&I instanceof _0&&I.status===401&&g9.has(I.code)){if(I.code==="device_revoked")try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer
+`)}else if(I instanceof _0&&I.status===401&&g9.has(I.code)){try{f0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
+`)}else if(!C.signal.aborted)Y(`Reason worker: workspace ${W.organizationId} stopped (worker_workspace_failed); it starts again on the next check
+`)}).finally(()=>{if(C.abort(),X.removeEventListener("abort",P),R.claims=0,G.get(W.organizationId)===R)G.delete(W.organizationId);let I=W.config.stateDirectory;if(L&&!w4(I)&&!u(q0(I,"worker.json")))v1(I,{recursive:!0,force:!0})}),G.set(W.organizationId,R)},M=(W,L)=>{if(!L)return null;try{let C=q(W),P=t(L);if(!P||P.orgId!==W||Date.parse(P.worker?.expiresAt??"")<=Date.now()+60000||L.name!==C.name||L.executionMode!==C.executionMode||!z0(L.apiOrigin,C.apiOrigin)||P.roots.map((R)=>R.path).join(`
+`)!==Z.roots.map((R)=>R.path).join(`
+`))return null;return{organizationId:W,config:L,state:P,proofStore:T0(L)}}catch{return null}},T=(W,L)=>{if(!L)return null;try{if($0(L).revoked)return null;let C=t(L);if(!C||C.orgId.toLowerCase()!==W||Date.parse(C.worker?.expiresAt??"")<=Date.now()+60000||L.executionMode!==J.executionMode||!z0(L.apiOrigin,J.apiOrigin))return null;return{organizationId:W,config:L,state:C,proofStore:T0(L)}}catch{return null}},_=(W,L)=>W.deviceId===L.deviceId&&W.devicePublicKey===L.devicePublicKey&&JSON.stringify(W.roots.map((C)=>[C.id,C.path]))===JSON.stringify(L.roots.map((C)=>[C.id,C.path])),D=async(W)=>{for(let[L,C]of W){if(X.aborted)return;let P=G.get(L),R=T(L,C.config);if(P&&R&&_(P.state,R.state))continue;if(P){if(P.claims>0)continue;await V(L)}if(R&&!X.aborted)U(R,!0)}for(let[L,C]of G)if(C.account&&!W.has(L)&&C.claims===0)await V(L)},j=async(W)=>{let L=q(W),C=J0.parse({...L,stateDirectory:J.stateDirectory});if(!u(q0(g(J),"enrollment-install.json")))return null;let P=A1(C),R=await Q.ownerWorkspaceEnrollment(Z,{organization_id:W,install_id:P.request.install_id,code_challenge:P.request.code_challenge},X),I=P.complete(W,R);if(e(g(L),!0),u(d(L).state))f0(L);let E=W2(L);try{let w=await X1(L,I,E,$.enroll);return m0(w,d(L).state,{proofStore:E}),x0(L,{version:1,drained:!1,revoked:!1}),c(q0(L.stateDirectory,"worker.json"),L),{organizationId:W,config:L,state:w,proofStore:E}}catch(w){if(w instanceof Q1&&w.deviceRemoved)return x0(L,{version:1,drained:!0,revoked:!0}),c(q0(L.stateDirectory,"worker.json"),L),null;throw w}},z=async()=>{let W=h0(J),L=new Map(W.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await D(L);let C=new Map(W.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),P=(A)=>L.has(A)||G.get(A)?.account===!0||w4(q0(U1(J),A)),R=(A)=>{let f=C.get(A)?.config;try{return f?$0(f).revoked:!1}catch{return!1}};for(let[A,f]of C){if(G.has(A)||R(A)||N.blocked.includes(A))continue;let b=M(A,f.config);if(b&&!X.aborted)U(b)}let I;try{I=await Q.ownerWorkspaces(Z,X)}catch(A){return N={listed:!1,blocked:N.blocked,...N.names?{names:N.names}:{},reason:A instanceof _0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let E=new Map(I.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>D2.test(A)&&A!==Z.orgId.toLowerCase()&&!P(A))),w=[...E.keys()].filter((A)=>C.has(A)?!R(A):!E.get(A)).slice(0,L2),h=[...G.values()].filter((A)=>!A.account&&A.claims>0&&!w.includes(A.organizationId)).length,l=w.filter((A)=>!C.has(A)),k=l.slice(l.length-Math.min(Math.max(0,w.length+h-L2),l.length)),x=w.filter((A)=>!k.includes(A)),S=Object.fromEntries(I.flatMap((A)=>A.name&&x.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));N={listed:!0,reason:null,blocked:x.filter((A)=>E.get(A)),names:S};for(let A of new Set([...C.keys(),...G.keys()])){if(x.includes(A)||P(A))continue;if(E.has(A)&&R(A))continue;if((G.get(A)?.claims??0)>0)continue;await V(A);let f=C.get(A)?.config;try{if(f&&u(d(f).state))f0(f)}catch{}v1(q0(U1(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
+`)}for(let A of x){if(X.aborted)return!0;if(P(A))continue;try{let f=G.get(A);if(E.get(A)){if(f&&f.claims===0)await V(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
+`);continue}let b=M(A,C.get(A)?.config??null);if(b&&f)continue;if(!b){if(f&&f.claims>0)continue;if(await V(A),b=await j(A),b)Y(`Reason worker: connected in workspace ${A}
+`)}if(b&&!X.aborted)U(b)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
+`)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(U1(J),!0),c(f4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(H)K=!0;else H=O().finally(()=>{H=null});return H},claims:()=>[...G.values()].reduce((W,L)=>W+L.claims,0),async settled(){await H,await Promise.all([...G.values()].map((W)=>W.done))}}}import{dirname as WQ}from"path";import{randomUUID as $$}from"crypto";import{chmodSync as t9,closeSync as J$,constants as Z$,existsSync as tZ,fstatSync as o9,lstatSync as e9,mkdirSync as $8,openSync as J8,readFileSync as Z8,readdirSync as Q8,readlinkSync as _N,realpathSync as FN,renameSync as Q$,rmSync as h4,statSync as X8,symlinkSync as WN,unlinkSync as h$,writeFileSync as m4}from"fs";import{basename as DN,dirname as Y8,isAbsolute as oZ,join as D0,relative as jN,resolve as zN,sep as ON}from"path";import{createRequire as eZ}from"module";var G8=1,B8=1,$Q=128,JQ=65536;var ZQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var i9=/^[a-z0-9_.-]{1,80}$/,QQ=64;var XQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function K8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function V8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&ZQ.test($)}function H8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function g4($){$8($,{recursive:!0,mode:448}),t9($,448)}function YQ($,J){g4(Y8($));let Z=`${$}.${process.pid}.${$$()}.tmp`;try{m4(Z,J,{mode:384,flag:"wx"}),t9(Z,384),Q$(Z,$)}finally{if(tZ(Z))h$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new m$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=b0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?b0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&oZ(X))?null:D0($.home??V0(),"Library","Application Support"),H=$.root??(G?D0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:H,...G?{legacyRoot:D0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(H,"versions"),current:D0(H,"current"),previous:D0(H,"previous"),brokerLock:D0(H,"broker.lock"),transitionLock:D0(H,"transition.lock"),lifecycleEvents:D0(H,"lifecycle-events")}}function GQ($){return K8($)&&V8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===G8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&H8($.started_at)&&R2($.runtime_version)}function N8($,J){try{let Z=e9($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=J8(D0($,J),Z$.O_RDONLY|Z$.O_NOFOLLOW|Z$.O_NONBLOCK);try{let X=o9(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return Z8(Q,"utf8")}finally{J$(Q)}}catch{return null}}function v4($){try{let J=JSON.parse(N8($,"owner.json")??"null");return GQ(J)?J:null}catch{return null}}function U8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var n9="lease",BQ=2,KQ=4,f$;function VQ(){if(f$!==void 0)return f$;if(f$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=eZ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return f$={flock:(G,H)=>X.symbols.flock(G,H),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},f$}catch{}return null}function HQ($){let J=VQ();if(!J)return null;let Z=J8(`${$}.lease`,Z$.O_RDWR|Z$.O_CREAT|Z$.O_NOFOLLOW,384);try{let Q=o9(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return J$(Z),"busy";if(J.flock(Z,BQ|KQ)===0)return Z;let X=J.errno();return J$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw J$(Z),Q}}function Y1($){g4(Y8($.path));let J=HQ($.path);if(J==="busy")return{acquired:!1,owner:v4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=NQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)J$(J)}}function NQ($,J){let Z=$.alive??U8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:G8,pid:$.pid??process.pid,nonce:$.nonce?.()??$$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${$$()}`,H=!1;try{if($8(G,{mode:448}),m4(D0(G,"owner.json"),`${JSON.stringify(Y)}
+`,{mode:384,flag:"wx"}),J!==null)m4(D0(G,n9),`flock
+`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw e9($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}Q$(G,$.path),H=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,v4($.path)?.nonce===Y.nonce)h4($.path,{recursive:!0,force:!0});if(J!==null)J$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=v4($.path),V=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?V-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&N8($.path,n9)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${$$()}`;try{Q$($.path,T),h4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!H)h4(G,{recursive:!0,force:!0})}}throw new m$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function q8($){return K8($)&&V8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===B8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&H8($.occurred_at)&&typeof $.event==="string"&&XQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&i9.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=QQ&&$.capabilities.every((J)=>typeof J==="string"&&i9.test(J)))}var UQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,qQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,MQ=300000,A2=0n;function TQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function M8($){try{return Q8($.lifecycleEvents).filter((J)=>UQ.test(J)).sort()}catch{return[]}}function r9($){try{let J=JSON.parse(Z8($,"utf8"));return q8(J)?J:null}catch{return null}}function _Q($,J=U8,Z=Date.now()){let Q;try{Q=Q8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(qQ);if(!Y)continue;let G=D0($.lifecycleEvents,X),H=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-X8(G).mtimeMs>=MQ}catch{continue}if(!K)continue;try{Q$(G,H)}catch(N){let q=N.code;if(q==="EEXIST")h$(G);else if(q!=="ENOENT")throw N}}}function FQ($){let Z=M8($).flatMap((X)=>{try{return[{name:X,size:X8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>$Q||Q>JQ){let X=Z.shift();if(!X)break;try{h$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function v$($,J,Z={}){let Q={schema_version:B8,event_id:Z.eventId?.()??$$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!q8(Q))throw new m$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return g4($.lifecycleEvents),YQ(D0($.lifecycleEvents,TQ(Q)),`${JSON.stringify(Q)}
+`),FQ($),Q}async function T8($,J,Z){_Q($);let Q=0;for(let X of M8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=r9(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${$$()}`;try{Q$(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let H=r9(G);if(!H){h$(G);continue}try{await J(H),h$(G),Q+=1}catch{try{Q$(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function W8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!LQ($.saved))return J;let Z=$.saved,Q=(G,H)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...H?{code:`worker_api_origin_move_${G}:${H}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?X$():$.native;if(!X)return J;let Y=[];try{let G=X.lock(WQ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let q=Y1({path:d(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let H=J0.parse(JSON.parse(s($.configPath)));if(H.stateDirectory!==Z.stateDirectory)return J;let K=L8(H),N={saved:H,configPath:$.configPath};if(!I2(H)&&K.length===0)return Q("unchanged"),N;if(I2(H)){let q=_8(H);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,_8(q.config))}catch(V){Q("failed",`workspace:${F8(V)}`)}return Q("moved"),N}catch(G){return Q("failed",F8(G)),J}finally{for(let G of Y.reverse())G()}}function I2($){return J1($.apiOrigin)!==$.apiOrigin}function L8($){return h0($).filter((J)=>J.config!==null&&I2(J.config))}function LQ($){return I2($)||L8($).length>0}function _8($){let J=J0.parse({...$,apiOrigin:J1($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)m0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function F8($){if($ instanceof X0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as DQ,lstatSync as l4,readdirSync as R8,readlinkSync as jQ,unlinkSync as zQ}from"fs";import{join as O0,sep as OQ}from"path";var P2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function C8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),G=O0(Z,"reason",...X),H=(V,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:V,...U?{code:`worker_state_rehome_${V}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?X$():$.native,N=$.saved,q=[];try{if(N&&j8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:G};if(!u4(K,G,j,q))return J;return D8(N,j,$.host,H)}if(N&&j8(Q)&&N.stateDirectory===G&&S9(N)&&u4(K,G,N,q))return I8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!Y$(Q)?.isDirectory())return J;if(xQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,P2),{version:r});return H("skipped",j),J},M=[Y];for(let j of RQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!AQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!u4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(z8(Z)!==null)return U("conflicting_identity");if(O8(Z)!==null)return U("conflicting_files");if(Y$(G)&&(!Y$(G).isDirectory()||R8(G).length>0))return U("connection_folder_taken");E$(N,T.devicePublicKey),y4.before(N);let _=p0(Y);if(_&&d4(Y))CQ(G,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&d4(Y))P8(G);return U(D.problem??"config_folder_kept")}return D8(N,{...N,stateDirectory:G},$.host,H)}catch(V){try{if(Y$(Y)?.isDirectory())c(O0(Y,P2),{version:r})}catch{}return H("failed",EQ(V)),PQ(N,Y,G,J)}finally{for(let V of q.reverse())V()}}function D8($,J,Z,Q){let X=l4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)DQ(J.stateDirectory,448);let Y=T0(J),G=h1(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new x2("identity_missing");let H=U0(J);if(G.worker.configDigest===U0($))m0({...G,worker:{...G.worker,configDigest:H}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==H)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),y4.after($,J),I8($,J,Z);let K=O0(J.stateDirectory,P2);if(u(K))zQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function I8($,J,Z){if(A8($,J,Z,"connect"),!d4(J.stateDirectory))return;let Q=IQ(j1($.stateDirectory));if(!Q)return;let X=j1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);P8($.stateDirectory)}function u4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Y1({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function AQ($,J,Z){if(u(g(J))){let X=Y1({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=Y$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function RQ($,J){let Z=[$,...R8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=O0(X,Y);if(G===J||!Y$(O0(G,"worker.json")))continue;let H=x8(G);if(!H||H.stateDirectory===$||H.stateDirectory.startsWith($+OQ))Q.push({directory:G,config:H})}return Q}function d4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function CQ($,J){let Z=j1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function P8($){try{j1($).deleteBinding()}catch(J){if(!(J instanceof X0))throw J}}function IQ($){try{return $.loadBinding()}catch(J){if(J instanceof X0)return null;throw J}}function PQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=x8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function j8($){try{return l4($).isSymbolicLink()&&jQ($)==="reason"}catch{return!1}}function xQ($){try{let J=JSON.parse(s(O0($,P2)));return typeof J.version==="string"?J.version:null}catch{return null}}function x8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function Y$($){try{return l4($)}catch{return null}}function EQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof X0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as SQ}from"fs";function S2($){try{let J=JSON.parse(SQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function E8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as MK}from"crypto";import{readdirSync as TK,realpathSync as ZJ,statSync as _K}from"fs";import{hostname as FK}from"os";import{join as n1,resolve as WK}from"path";var w2="cloud",wQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function g$($){return wQ.test($)&&!S8.test($)}var bQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function G$($){return bQ[$]}import{chmodSync as kQ,lstatSync as k2,mkdtempSync as yQ,realpathSync as y8,rmdirSync as fQ,rmSync as hQ,unlinkSync as mQ}from"fs";import{createConnection as vQ,createServer as gQ}from"net";import{basename as w8,dirname as b8,join as B$}from"path";var uQ=B.enum(["status","drain","resume","stop","reload_roots"]),dQ=B.strictObject({version:B.literal(1),instanceId:B.string(),deviceId:B.string(),phase:B.enum(["starting","running","reconnecting","stopping"]),drained:B.boolean(),activeClaims:B.number().int().nonnegative(),activeSessions:B.number().int().nonnegative().optional(),executionEligible:B.boolean(),supportedOperations:B.array(B.enum(b2)).max(b2.length).optional(),capabilityReadiness:B.partialRecord(B.enum(b2),B.boolean()).optional(),lastHeartbeat:B.string().nullable(),expiresAt:B.string()}),lQ=B.strictObject({nonce:B.string(),action:uQ}),pQ=B.object({nonce:B.uuid()}),f8=B.strictObject({version:B.literal(1),nonce:B.uuid(),socketPath:B.string().max(100)});function h8($){return B$(d($).lock,"control.json")}function p4($){return e(d($).lock),pQ.parse(JSON.parse(s(B$(d($).lock,"owner.json"))))}function k8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function cQ($,J){let Z=h8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return k8(Y)?Y:null}let Q=f8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=b8(Q.socketPath);if(b8(X)!==y8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(w8(X))||w8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),k8(Q.socketPath)?Q.socketPath:null}async function y2($,J,Z){if(p4($).nonce!==J)throw Error("worker_instance_changed");let Q=h8($);if(u(Q))throw Error("worker_control_already_serving");let X=yQ(B$(y8("/tmp"),"ara-worker-")),Y=B$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,H=gQ((V)=>{G.add(V),V.once("close",()=>G.delete(V)),V.setTimeout(2000,()=>V.destroy());let U="",M=!1;V.on("error",()=>V.destroy()),V.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){V.destroy();return}if(!U.includes(`
+`))return;M=!0;try{let _=lQ.parse(JSON.parse(U));if(_.nonce!==J){V.destroy();return}V.end(JSON.stringify(Z(_.action))+`
+`)}catch{V.destroy()}})});H.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let V of G)V.destroy();if(await new Promise((V)=>H.close(()=>V())),K&&u(Q)){let V=k2(Q);if(V.isFile()&&V.dev===K.dev&&V.ino===K.ino)try{let U=f8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)mQ(Q)}catch{}}try{fQ(X)}catch{}};try{if(await new Promise((V,U)=>{H.once("error",U),H.listen(Y,()=>{kQ(Y,384),V()})}),p4($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(V){throw await q(),V}}function m8($,J){try{let Z=JSON.parse(s(B$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function u$($){return m8($,"runtime_version")}function sQ($){return m8($,"nonce")}var aQ=21600000,iQ=B.strictObject({instance:B.string().nullable(),since:B.number().int().nonnegative()});function nQ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=iQ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{hQ(d($).updateDeferral,{force:!0})}catch{}}async function f2($,J,Z=()=>!1){let Q=sQ($),X=nQ($,Q);if(J!==void 0){let N=u$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),H=X;if(H===null){H=G;try{c(d($).updateDeferral,{instance:Q,since:H})}catch{}}let K=G-H;return{state:K<aQ?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=d($);if(!u(B$(Z.lock,"owner.json")))return null;let Q=p4($),X=cQ($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let H=vQ(X),K="",N=!1,q=(V,U)=>{if(N)return;if(N=!0,H.destroy(),U)G(U);else Y(V)};H.setTimeout(2000,()=>H.destroy(Error("worker_control_timeout"))),H.on("connect",()=>H.write(JSON.stringify({nonce:Q.nonce,action:J})+`
+`)),H.on("data",(V)=>{if(K+=V.toString(),Buffer.byteLength(K)>16384)H.destroy(Error("worker_control_oversize"))}),H.on("error",(V)=>{if("code"in V&&["ECONNREFUSED","ENOENT"].includes(String(V.code)))q(null);else q(null,Error("worker_control_unavailable"))}),H.on("end",()=>{try{let V=dQ.parse(JSON.parse(K));if(V.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(V)}catch{q(null,Error("worker_control_invalid_response"))}}),H.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as tG}from"crypto";import{homedir as X7}from"os";import{spawn as rQ}from"child_process";async function v8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),H=(V)=>{if(Q===V)return;Q=V,J.onStatusChange?.(V)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let V=(J.spawn??rQ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=V,V.once("exit",()=>{if(!X&&Z===V)H("failed"),K()}),await new Promise((U,M)=>{V.once("spawn",U),V.once("error",M)}),V.exitCode===null&&V.signalCode===null)H("held")}catch{H("failed"),K()}};G=N(),await G;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await G;let V=Z;if(!V||V.exitCode!==null||V.signalCode!==null||!V.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{V.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);V.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{V.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class h2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as JX}from"fs";import{constants as s4}from"fs";import{open as tQ}from"fs/promises";import{join as oQ}from"path";var eQ={platform:process.platform,home:V0,async openFile($){let J=await tQ($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function g8($=eQ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(oQ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function $X($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((H,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function u8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await $X($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?d$(X.status):l$(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var ZX=1000,QX=250,XX=Q5(JX(process.execPath)),d8=null,l8=null;function X5($){if(process.platform!=="darwin")return{};return l8??=g8().then((J)=>{d8={status:J,checkedAt:$().getTime()}}).finally(()=>{l8=null}),{fullDiskAccess:{...d8??{status:"unknown",checkedAt:$().getTime()},executablePath:XX}}}var p8=8,YX=2000,GX=2000,G3=8000,c8=3,BX=250,s8=1000,a8=30000,KX=0.2,VX=30000,HX=21600000,NX=300000,UX=3600000,qX=0.1,Y5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function MX($){return Math.min(c8,Math.max(1,$??c8))}function TX($){return typeof $.reason_code==="string"&&Y5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof v0&&($.reason.code==="cancelled"||Y5.has($.reason.code))?$.reason.code:"cancelled"}function i8($){return $ instanceof v0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function G5($){return $.capability==="hands.connect"&&($5($.payload)||e8($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*qX)))}function _X($,J=Math.random){let Z=Math.min(a8,s8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*KX*(Q*2-1);return Math.min(a8,Math.max(s8,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function FX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function o0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function WX($){if($ instanceof v2||$ instanceof K$||$ instanceof c$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function p$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(o0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:WX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)p$($,J,Q);throw Q}}class c$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,H=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,V,U=new Promise((_,D)=>{let j=()=>{let F=new c$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(V=()=>z(Math.max(0,Math.min(N-performance.now(),YX))),z(K),$.signal.addEventListener("abort",V,{once:!0}),$.signal.aborted)V()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),U]);break}catch(_){if(G.aborted||$.signal.aborted||E0(_)||o0(_)||!LX(_)||performance.now()>=N)throw p$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw p$($,"completion",_),_;try{await H(D,G)}catch{throw p$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",V),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function LX($){if(E0($))return!1;if(o0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof c$)return!1;return!0}return!1}class v2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function m2($){if($ instanceof v2)return!0;return $ instanceof _0?d$($.status):l$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function DX($,J,Z,Q,X){let Y=new AbortController,G,H=()=>{return},K=new Promise((q,V)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),V(M)};if(H=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,V)=>{G=setTimeout(()=>{let U=new v2;Y.abort(U),V(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);H()}}async function n8($,J,Z,Q,X,Y){let G=MX($.operationHeartbeatMaxAttempts),H=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??BX,N=Y.remainingMs(),q=Math.min(N,G*H+K*G*(G-1)/2);for(let V=0;V<G;V+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(H,Y.remainingMs()),M=await DX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:V},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||V+1>=G||o0(U)||E0(U)||!m2(U)){if(!Q.aborted)p$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(V+1),q*(V+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function jX($,J,Z,Q,X){let Y=G5(J),G=new AbortController,H=new AbortController,K=()=>{G.abort($.signal.reason),H.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,V,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,C={},P=(w)=>{j=!0,D.abort(w),G.abort(w),H.abort(w)},R=(w)=>{if(z)return z;let h=structuredClone(w),l=M;return z=(async()=>{let k=new AbortController,x=k.signal;x.throwIfAborted();let S,A=()=>{},f=new Promise((b,n)=>{if(A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0}),S=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),x.aborted)A()});try{for(let b=0;b<3;b+=1){x.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[h],signal:x,transientRetryOwner:"caller"})),f]);if(x.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(E0(n))X(n);let o=n instanceof _0?d$(n.status):l$(n);if(x.aborted||!o||b===2)throw n;let N0=Math.max(500*2**b,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,x),f])}}}finally{clearTimeout(S),x.removeEventListener("abort",A),k.abort()}})(),z},I=(w,h,l)=>{let k=(S)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:h,events:w,signal:S,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&o0(A))P(A);if(l&&(E0(A)||o0(A))){if(E0(A))X(A);G.abort(A),H.abort(A),D.abort(A)}throw A});if(!l)return async(S)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(S)).next_event_seq;return}S.throwIfAborted();let A=()=>{},f=new Promise((b,n)=>{A=()=>n(S.reason),S.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([k(S),f]);S.throwIfAborted(),M=b.next_event_seq}finally{S.removeEventListener("abort",A)}};let x=u8({send:k,lease:L,sleep:Z,retryAfterMs:(S)=>J3(S,($.now?.()??new Date).getTime())});return async(S)=>{let A=await x(S);if(A.next_event_seq!==h+w.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},E=async(w,h)=>{let l=w??await n8($,J,{controlAckSeq:U,waitMs:h},H.signal,Z,L),k=null,x=!1;for(let S=0;S<10;S+=1){let A=U+1;for(let f of l.controls){if(f.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(f.kind==="cancel"||f.kind==="operation.cancel")k??=TX(f.payload),G.abort(new v0(k,"Reason closed the Device operation."));if(f.kind!=="cancel"&&f.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,o=new Promise((N0,j0)=>{b=N0,n=j0});o.catch(()=>{}),C.current={promise:o,resolve:b,reject:n}}try{x||=!await $.onControl?.(J,f)}catch(b){if(b instanceof v0)q??=i8(b);throw C.current?.reject(b),b}}U=f.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:x}}try{l=await n8($,J,{controlAckSeq:U},H.signal,Z,L),C.current?.resolve()}catch(f){if(C.current?.reject(f),!k||o0(f)||E0(f))throw f;return{cancellationReason:k,unsupported:x}}}throw Error("Reason returned too many Device operation control batches.")};try{let w;try{if(!Y)L=new h2(J.lease_until,()=>($.now?.()??new Date).getTime(),(h)=>{if(!G.signal.aborted)N=h;G.abort(h),H.abort(h)});w=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await E()}catch(h){if(!e4(J)||o0(h)||E0(h))throw h;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(w.cancellationReason||$.signal.aborted){let h=w.cancellationReason??i4($.signal);G.abort(new v0(h,"Reason closed the Device operation.")),V={status:"cancelled",error_code:h}}else if(w.unsupported)G.abort(),V={status:"failed",error_code:"control_unsupported"};else{let h=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?GX:15000),x=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),S=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!H.signal.aborted)try{if(!S){if(await Z(k,H.signal),H.signal.aborted)return}let A=await E(void 0,S?x:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new v0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(E0(A))X(A);if(o0(A))N=A,P(A);if(!H.signal.aborted)N=A,G.abort();return}})();try{if(L?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(L?.remainingMs()??0)>0),V=await $.onClaim(J,G.signal,async(k)=>{if(e4(J))return;let x=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",S=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=S||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,D.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,f={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:S?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:f,settle:(j0)=>j0===void 0?o():N0(j0)})});let b=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(x)await R(f);return}if(F!==null){if(k.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),P1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await I([f],M,!0)(j0),F=null}catch(F1){throw F=F1??Error("Hands stop receipt could not be confirmed."),F1}finally{clearTimeout(P1),N0.abort()}return}if(S&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new h2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{G.abort(j0),H.abort(j0)})}let o=M;if(S)W=I([...b.map((N0)=>N0.wireEvent),f],o,!0),await W(A),W=void 0;else await I([...b.map((N0)=>N0.wireEvent),f],o,!1)(A)});n.then(()=>{for(let o of b)o.settle()},(o)=>{for(let N0 of b)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(E0(o))X(o);if(S){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),H.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await C.current?.promise}catch(k){V=G.signal.aborted?{status:"cancelled",error_code:i4(G.signal)}:{status:"failed",error_code:i8(k)}}finally{Q.authorized=()=>!1,D.abort();for(let k of _.splice(0))k.settle();H.abort(),await h}let l=t8(J.capability)?o8(V.result,J.operation_id):null;if(N){if(E0(N))throw N;V={status:"failed",error_code:q??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&V.status==="succeeded")V={status:"cancelled",error_code:i4(G.signal),...l?{result:l}:{}}}if(L?.close(),E0($.signal.reason))throw $.signal.reason;await $3($,J,V)}finally{L?.close(),D.abort(),H.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??k$,Y=$.statusPath??Q3(),G=J().toISOString(),H=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...X5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...H?{lastUsedAt:H}:{}}),q=0,V,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),Z5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??v8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await zX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;H=F.lastUsedAt??H,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,V=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(E0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=_X(q,$.reconnectRandom);V??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:V},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function zX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??k$,G=J().toISOString(),H=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let V=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(p8,U):p8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,Y0=0;for(let{claim:L1}of z.values()){let i0=L1.capability==="hands.connect"?L1.payload[r8]:void 0;if(typeof i0==="string"){if(v.has(i0))continue;v.add(i0)}Y0+=1}return Y0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),C=K?new Date(G).getTime()+n4(K.initialDelayMs??VX,V):Number.POSITIVE_INFINITY,P=null,R=!1,I=$.firstHeartbeat,E=I?.account_root_metadata_supported===!0,w=I?.workspace_root_metadata_supported===!0,h=I?.account_root_path_supported===!0,l=I?.home_contained_roots_supported===!0,k=I?.root_paths_supported===!0,x=I?.startup_supported===!0,S=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,f,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...X5(J),...H?{lastUsedAt:H}:{},...P?{organizationId:P.organization_id,organizationName:P.organization_name,organizationSlug:P.organization_slug}:{}}),o=()=>{let v=$.claimable?.()!==!1;if(!b)f??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...x&&!b&&f?{startup:f}:{},capabilities:v?J5($.capabilities,{accountRootMetadataSupported:E,workspaceRootMetadataSupported:w,accountRootPathSupported:h,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},N0=()=>{if(R||!$.client.identity)return;R=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;P=v;let Y0=Y(Q);if(!Y0)return;X({...Y0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{E=v.account_root_metadata_supported===!0,w=v.workspace_root_metadata_supported===!0,h=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,x=v.startup_supported===!0,S=!1},P1=(v)=>{if(v.startup)b=!0},F1=(v,Y0)=>{if(!(Y0 instanceof _0&&Y0.status===400&&Y0.code==="invalid_heartbeat")||!v.startup&&!S)throw Y0;if(b=!0,S)E=w=h=!1,l=k=x=S=!1;return null},r1=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},x1=!1,E1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(x1)E1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((Y0)=>F1(v,Y0))).then((Y0)=>{if(!Y0)return;P1(v),j0(Y0),r1(Y0)},()=>{return})});let a0=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let S1=!1,O$=$.maxConsecutiveHeartbeatFailures??3,W1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,Y0=o(),L1=A;A=void 0,x1=!0,E1=!1;try{let a=await V$($,"heartbeat",()=>$.client.heartbeat($.state,Y0,N.signal,...L1?[L1]:[]).catch((M0)=>F1(Y0,M0)));if(x1=!1,!a)continue;v=a,P1(Y0),W1=0}catch(a){if(x1=!1,$.signal.aborted)break;if(!m2(a))throw a;if(W1+=1,W1>=O$&&!W())throw a;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(Y0.capabilities).length)continue;if(E1)continue;if(r1(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))C=Math.min(C,J().getTime());if(K&&J().getTime()>=C)try{let a=new AbortController,M0=()=>a.abort($.signal.reason);if($.signal.aborted)M0();else $.signal.addEventListener("abort",M0,{once:!0});let l0;try{l0=K.check(a.signal)}catch(R0){l0=Promise.reject(R0)}let w1=l0.then((R0)=>({kind:"completed",result:R0}),(R0)=>({kind:"failed",error:R0})),t1;try{while(!0){let R0=await FX(w1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(R0.kind==="failed")throw new r4(R0.error);if(R0.kind==="completed"){t1=R0.result;break}try{let S0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,S0,N.signal).catch((V2)=>F1(S0,V2)));if(!R$)continue;v=R$,P1(S0),r1(v),W1=0}catch(S0){if($.signal.aborted)throw S0;if(!m2(S0))throw S0;if(W1+=1,W1>=O$&&!W())throw S0}}}catch(R0){a.abort(R0);let S0=await w1;if(S0.kind==="completed"&&S0.result==="activated")t1="activated";else throw R0}finally{$.signal.removeEventListener("abort",M0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,t1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}C=J().getTime()+n4(K.intervalMs??HX,V)}catch(a){if(!(a instanceof r4))throw a;T+=1;let M0=K.retryBaseMs??NX,l0=K.retryMaxMs??UX,w1=Math.min(l0,M0*2**Math.min(T-1,8));C=J().getTime()+n4(w1,V)}if($.signal.aborted)break;if(_&&L())break;if(_){await a0($.heartbeatIntervalMs??15000);continue}let i0=$.client.sessionCadence?.($.state)??null,A$=i0?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await a0(A$);continue}if(F()>=M){let a=new AbortController;O=a;try{await Z(A$,AbortSignal.any([$.signal,a.signal]))}catch(M0){if(!a.signal.aborted)throw M0}finally{if(O===a)O=null}continue}let g0,y=i0?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),i=performance.now();try{g0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:y,signal:N.signal}))}catch(a){if($.signal.aborted||!m2(a)||!W())throw a;await a0(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!g0){if(performance.now()-i<y-QX)await a0(ZX);continue}if($.claimable?.()===!1){await $3($,g0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}H=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:g0.operation_id,runId:g0.run_id,attemptId:g0.attempt_id,capability:g0.capability});let B0,I0={authorized:()=>!1,claim:g0};if(B0=jX({...$,signal:N.signal},g0,Z,I0,j).catch((a)=>{if(E0(a))j(a);else if(!o0(a)&&[...z].some(([M0,l0])=>M0!==B0&&l0.authorized())){if(a instanceof c$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!o0(a)&&D===null)D=a}).finally(()=>{z.delete(B0),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(B0,I0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),G5(g0)){if(await B0,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),S1=!0;let Y0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:Y0},Q),$.onEvent?.({type:"error",message:Y0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!S1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as eX}from"child_process";import{constants as w5,existsSync as $Y,mkdtempSync as l5,rmSync as JY}from"fs";import{access as b5,open as ZY,readFile as k5,readlink as QY,readdir as y5,unlink as XY,rmdir as YY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as g1}from"crypto";import{chmodSync as OX,closeSync as AX,fsyncSync as RX,openSync as CX,readFileSync as IX,rmdirSync as B5,unlinkSync as H5,writeFileSync as PX}from"fs";import{createConnection as xX,createServer as EX}from"net";import{dirname as SX,join as wX}from"path";var bX=5000;async function N5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:g1()},X={runId:g1(),deviceId:g1(),rootId:g1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=V5(J,X),G={version:1,snapshot_id:g1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{H5(Y.path)}catch{}}}async function U5($,J,Z=K5){if(J.aborted)return!1;let Q,X,Y=new Set,G=g1(),H=EX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(G)});H.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),V=setTimeout(N,bX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${g1()}`}),X=wX(Q.journalDirectory,"readiness.json");let U=CX(X,"wx",384);try{PX(U,G),RX(U)}finally{AX(U)}if(IX(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{H.once("error",()=>T(!1)),H.listen(Q.socketPath,()=>{try{OX(Q.socketPath,384)}catch{T(!1);return}K=xX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(V),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>H.close(()=>U())),Q?.disposeSocket(),X)try{H5(X)}catch{}if(Q){try{B5(Q.journalDirectory)}catch{}try{B5(SX(Q.journalDirectory))}catch{}}}}import{spawn as kX}from"child_process";import{randomUUID as u1}from"crypto";import{basename as yX}from"path";import{fileURLToPath as fX}from"url";function hX(){let $=yX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",fX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function T5($,J,Z=hX()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=kX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),H=!1,K=new Promise((F)=>G.once("close",()=>{H=!0,F()}));G.on("error",X);let N,q,V=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
+`)){let O=T.indexOf(`
+`),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([V,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=u1(),L={organizationId:u1(),userId:u1(),runId:u1(),deviceId:u1(),rootId:u1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:u1(),port:F.port,expiresAtMs:O},C={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:W}}},P=M5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!H&&!Q.signal.aborted?C:null});j=await q5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:P,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),G.stdin.destroy(),!H)G.kill("SIGKILL");await K}return z&&H}import{execFileSync as u2}from"child_process";import{randomUUID as c0}from"crypto";import{chmodSync as _5,chownSync as x5,closeSync as V3,constants as q1,existsSync as mX,fstatSync as E5,mkdirSync as F5,mkdtempSync as vX,openSync as H3,readFileSync as gX,readSync as uX,realpathSync as dX,rmdirSync as lX,rmSync as pX}from"fs";import{join as d1}from"path";import{fileURLToPath as cX}from"url";var W5=1e4,sX=!1;function d2(){if(process.platform!=="linux")return!1;return sX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=u2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var aX=Buffer.from([0,255,3,4]);function L5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function iX($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function s$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=g2(),{directory:Q,root:X,runtimeDirectory:Y}=tX(Z),G=new AbortController,H=()=>G.abort();$.addEventListener("abort",H,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(H,W5),q={organization_id:c0(),user_id:c0(),device_id:c0()},V=c0(),U=c0(),M=c0(),T=c0(),_=Date.now()+W5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=c0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,C=!1,P=!1,R,I,E,w=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},h=!1;try{K=nX(Q,Z),R=Bun.serve({hostname:"127.0.0.1",port:0,fetch(x,S){let A=new URL(x.url).pathname,f=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(f&&S.upgrade(x,{data:{lane:f}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(x){if(x.data.lane==="pty")z=x},message(x,S){if(x.data.lane!=="pty")return;if(typeof S==="string"){try{if(JSON.parse(S).t==="open")W=!0}catch{H()}return}if(F.length+S.length>8192){H();return}F=Buffer.concat([F,S])}}});let l=`ws://127.0.0.1:${R.port}`;if(I=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:V,operationId:c0(),attemptId:c0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:D5,hands_worker_version:O5,hands_worker_artifact_sha256:R5,hands_worker_entrypoint:A5,target_generation:1,target_fence_id:M,environment_binding:D,[C5]:I5},emitEvent:async(x)=>{if(x==="hands.started")P=!0;if(x==="hands.ready")L=!0;if(x==="hands.stopped")C=!0}},{browserExecutablePath:null,slot:P5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:cX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)H()}),await w(()=>L),j5({root:X,runId:V,payload:{version:1,snapshot_id:T,revision:1,run_id:V,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),E=z5({root:X,runId:V,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${c0()}`,sessionId:"pty-readiness",operationId:c0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${j}`},emit:async(x,S)=>{if(x==="pty.ready")O=S}}).catch(()=>{H()}),await w(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${L5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${L5("foreground")}; ${K.wait("foreground")}'
+`)),await w(()=>mX(d1(X,"foreground.pid"))&&F.includes(aX)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((x)=>rX(d1(X,x)));if(new Set(k).size!==2||k.some((x)=>!Number.isSafeInteger(x)||x<2||x===O.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((x)=>iX(gX(`/proc/${x}/stat`,"utf8"),x,O.job.process.pid)))return!1}else{let S=u2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((A)=>A.trim().split(/\s+/).map(Number));if(S.length!==2||new Set(S.map(([A])=>A)).size!==2||S.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await E,G.signal.aborted)return!1;for(let x of[O.job.process.pid,...k])try{return process.kill(x,0),!1}catch(S){if(!(S instanceof Error&&("code"in S)&&S.code==="ESRCH"))return!1}h=!0}catch{h=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",H),H(),K?.close(),await E,await I,await R?.stop(!0),!P||C)oX({directory:Q,root:X},Z)}return h&&C&&!$.aborted}function nX($,J){let Z={foreground:d1($,"foreground.lifeline"),background:d1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");u2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let G=H3(Y,q1.O_RDONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW);try{if(Q.push(H3(Y,q1.O_WRONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW)),!E5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(G)}if(J)x5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function S5($=(J)=>s$(J)){let J=new AbortController,Z=JSON.stringify(g2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(g2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function rX($){let J;try{J=H3($,q1.O_RDONLY|q1.O_NOFOLLOW|q1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=E5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=uX(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function tX($,J=dX("/tmp")){let Z=vX(d1(J,"reason-pty-probe-")),Q=d1(Z,"workspace"),X=d1(Z,"private");if(F5(Q,{mode:448}),F5(X,{mode:448}),$)_5(Z,493),_5(Q,493),x5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function oX($,J){if(J)try{u2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),lX($.root)}catch{return}pX($.directory,{recursive:!0,force:!0})}var p5=5000,l1="ARA_WORKER_PROBE_READY";function GY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{eX($,J,{cwd:Z,env:Q,signal:X,timeout:p5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,H)=>Y(!G&&!X.aborted&&H===l1))})}function BY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function KY($,J){let Z=h5({home:J,temporaryDirectory:J}),Q=(Y,G,H)=>GY(Y,G,$.workspaceRoot,Z,H),X=async(Y,G,H,K=(q)=>q===l1,N=!1)=>{let q=await i5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:p5,signal:H});return!H.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await b5($.workspaceRoot,w5.R_OK),await y5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await b5($.workspaceRoot,w5.W_OK),Y.aborted)return!1;let G=l5(M3($.workspaceRoot,".ara-worker-probe-")),H=M3(G,"receipt");try{let K=await ZY(H,"wx",384);try{await K.writeFile(l1),await K.sync()}finally{await K.close()}return await k5(H,"utf8")===l1&&!Y.aborted}finally{await XY(H).catch(()=>{}),await YY(G).catch(()=>{})}},confinedShell:(Y)=>X(a5(),["-c",`printf ${l1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
+`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,H,K]=await Promise.all([QY("/proc/self/cwd"),y5("/proc/self/fd"),k5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&H.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${l1}`],Y),jobs:(Y)=>U5($,Y),environment:(Y)=>N5($,J,Y),preview:(Y)=>T5(J,Y),boundPty:(Y)=>s$(Y),desktopDisplay:()=>s5(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
+`);return d5()},desktopBrowser:async()=>i$()?.features.browser===!0,fullControlShell:(Y)=>{let G=g5(),H=BY(G,`printf ${l1}`);return H?Q(G,H,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&i$()?.features.computer===!0?u5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function VY($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return a$($,J,Z,Q,X).final}function a$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,G){let H,K;try{if(N1($),u0(),!J)e(g($),!0),H=l5(M3(g($),"probe-")),J=KY($,H);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",V=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(G).then(()=>Promise.all(q?[N("preview"),V,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,C,P,R,I]=await Promise.all([Promise.resolve(Q).then((E)=>E.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((E)=>E.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!C||!P||!R)&&!G)await U;if(q){if(!C)C=await N("bash");if(!P)P=await N("jobs");if(!R)R=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:C,jobs:P,environment:R,full:I}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:C,processes:P,bash:R,jobs:I,environment:E,full:w}=z,{preview:h,boundPty:l,desktopDisplay:k,desktopAutomation:x,desktopBrowser:S}=F,A=m5(),f=q&&process.platform==="darwin"&&w&&$Y("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&C&&X,"process.list":(process.platform==="linux"||L)&&P,"ports.list":(process.platform==="linux"||L)&&P,"exec.full":R&&w&&X,"hands.connect":O&&W&&R&&I,"jobs.control":O&&W&&R&&I,"pty.start":O&&W&&R&&I&&E&&l,"environment.install":O&&W&&R&&I&&E,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&R&&I&&E,"tunnel.open":O&&W&&R&&I&&E&&h,"tunnel.close":O&&W&&R&&I&&E&&h,"preview.serve.v1":O&&R&&I&&h&&w,"display.stream.v1":k,"automation.call.v1":x,"simulator.call.v1":f,"simulator.stream.v1":f,"browser.pr-proof.v1":x&&S&&f5()===null,"workspace.setup.v1":q&&v5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([V,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,C]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:C})}finally{if(H)JY(H,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await V||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var HY=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],NY=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return HY.filter((Z)=>J[Z]!==!0)}function c5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>VY($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
+`),(async()=>{for(let Y of $.delaysMs??NY){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let H=q3($.config,Q).filter((K)=>G[K]===!0);if(H.length>0)Q=Object.freeze({...Q,...Object.fromEntries(H.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${H.join(", ")}).
+`),$.onReady(Q,H);if(q3($.config,Q).length===0)return}})()}import{execFile as KG}from"child_process";import{createHash as VG,randomUUID as b3}from"crypto";import{lstat as HG,readdir as S6,readFile as m6,realpath as NG,stat as UG}from"fs/promises";import{basename as qG,join as S3}from"path";import{promisify as MG}from"util";import{createConnection as UY}from"net";import{endianness as t5}from"os";var n$=4,W3=1e4;class R1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=UY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=qY({jsonrpc:"2.0",id:Q,method:$,params:X}),H=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(G),await H}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=n$){let J=t5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=n$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(n$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!e0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),e0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class l2{client;cdp;constructor($){this.client="client"in $?$.client:new R1($),this.cdp=new $6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=MY(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new o5(this,$)}getTabs(){return this.client.getTabs()}}class o5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new e5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class e5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class $6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(e0(Q)&&e0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return e0(Q)&&e0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";n5(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(e0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(H)=>{let K=await this.readDocumentState($);if(r5(K,Q))return;throw H}),G}async waitForLoadState($,J={}){let Z=J.state??"load";n5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(r5(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return e0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let G=!1,H=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),H?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),H=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(V){if(N())Y(V instanceof Error?V:Error(String(V)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=TY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function qY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(n$+J.length);if(t5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,n$),Z}function e0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function MY($,J){if(!e0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function n5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function r5($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function TY($,J){if($.method!=="onCDPEvent"||!e0($.params))return null;let Z=$.params.source;if(!e0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as _Y}from"crypto";function J6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${_Y("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as YG}from"async_hooks";import{isDeepStrictEqual as x6}from"util";import{createHash as GG}from"crypto";var FY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var WY=new Set(["png","jpg","jpeg","gif","webp"]),LY=new Set(["webm","mp4"]);function DY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function Z6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=DY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=FY.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),H=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!H||!K||!N)return null;let q=WY.has(N)?"image":LY.has(N)?"video":null;if(!q)return null;let V=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:G,artifactId:H,fileName:`${K}.${N}`,kind:q,phase:V?.[1]==="before"||V?.[1]==="after"?V[1]:null}}var jY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,p2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),p1=()=>{throw Error("cloud_browser_media_request_invalid")};function c2($){if(!p2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!jY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return p1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return p1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!Q6(J.origin,{mode:"public_web"}).allowed)return p1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!p2(Y)||Object.keys(Y).some((H)=>!["url","sourceUrl","kind"].includes(H))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return p1();let G=Z6(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return p1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let H;try{H=new URL(Y.sourceUrl)}catch{return p1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(H.pathname)?.[1];if(Y.kind!=="image"||H.origin!=="https://camo.githubusercontent.com"||H.username||H.password||H.search||H.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return p1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function X6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!p2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!p2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=B.string().uuid(),H$=B.string().regex(/^[a-f0-9]{64}$/),s1=B.iso.datetime({precision:3}),D3=B.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),G6=B.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),s0=B.object({kind:B.literal("primary_mac"),version:B.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:B.string().min(1).max(64),binding:B.enum(["workspace_source","mcp_control"]),targetRevision:B.number().int().nonnegative(),generation:L0,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),zY=B.custom().transform(($,J)=>{try{return Y6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),B.NEVER}}),N$=B.object({version:B.literal(1),owner:s0,contextId:L0,preparedAt:s1,expiresAt:s1,prUrl:G6,headSha:B.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:B.enum(["image","video"]),visualPlan:zY.optional(),uploadOrigin:B.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=B.object({version:B.literal(1),producer:B.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:B.number().int().positive(),startedAt:s1,finishedAt:s1,sha256:H$,media:B.discriminatedUnion("contentType",[B.object({contentType:B.literal("image/png"),sizeBytes:B.number().int().min(24).max(8388608),width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096)}).strict(),B.object({contentType:B.literal("video/webm"),sizeBytes:B.number().int().min(128).max(10485760),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),XM=B.discriminatedUnion("action",[B.object({action:B.literal("screenshot"),context_id:L0,tab_id:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),context_id:L0,tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("stop_video"),recording_operation_id:L0}).strict()]),a2=B.object({login:B.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:B.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),s2=B.string().regex(/^[1-9][0-9]{0,19}$/),r$=B.object({version:B.literal(1),owner:s0,expectedActorId:s2.nullable(),repositoryId:s2,repositoryFullName:B.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),OY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=B.discriminatedUnion("status",[r$.extend({status:B.literal("ready"),observedActor:a2,checkedAt:s1}),r$.extend({status:B.literal("not_ready"),reason:B.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:B.enum(OY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),c1=B.object({version:B.literal(1),owner:s0,expectedActorId:s2.nullable(),authenticatedActor:a2,attemptId:L0,captureId:L0,prUrl:G6,repositoryId:s2,headSha:B.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:B.number().int().min(128).max(10485760),contentType:B.literal("video/webm")}).strict(),B6=B.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=B.discriminatedUnion("status",[c1.extend({status:B.literal("not_attempted"),reason:B.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),c1.extend({status:B.literal("uncertain"),reason:B.literal("upload_outcome_unknown")}),c1.extend({status:B.literal("uploaded"),observedActor:a2,nativeUrl:B6,uploadedAt:s1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),t$=c1.extend({nativeUrl:B6,observedActor:a2,bodySha256:H$}),A3=B.discriminatedUnion("status",[t$.extend({status:B.literal("incomplete"),reason:B.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),t$.extend({status:B.literal("verified"),sourceSha256:H$,width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096),durationSeconds:B.number().positive().max(30),advancedSeconds:B.number().min(0.05).max(10),advancedFrames:B.number().int().positive(),playbackRestored:B.literal(!0),verifiedAt:s1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),AY=B.custom().transform(($,J)=>{try{let Z=c2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),B.NEVER}}),RY=B.discriminatedUnion("action",[B.object({action:B.literal("auth_check"),input:r$}).strict(),B.object({action:B.literal("prepare"),context:N$}).strict(),B.object({action:B.literal("capture_png"),owner:s0,contextId:L0,tabId:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),owner:s0,contextId:L0,tabId:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("inspect_capture"),owner:s0,captureId:L0}).strict(),B.object({action:B.literal("publish_video"),input:c1}).strict(),B.object({action:B.literal("verify_png_media"),owner:s0,media:AY}).strict().refine(($)=>$.media.runId===$.owner.runId),B.object({action:B.literal("verify_saved_media"),input:t$}).strict(),B.object({action:B.literal("publish_png"),owner:s0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:B.number().int().min(24).max(8388608),storagePath:B.string().max(512),uploadUrl:B.string().url().max(8192)}).strict()]);var K6="pr-proof.stop.v1",R3=B.object({requestId:L0,command:RY}).strict();import{createHash as CY,randomUUID as IY}from"crypto";import{isDeepStrictEqual as q$}from"util";var V6=B.object({operationId:B.string().uuid(),attemptId:B.string().uuid(),contextId:B.string().uuid(),tabId:B.number().int().positive()}).strict(),K0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>CY("sha256").update($).digest("hex");function H6($){let J=s0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw K0();if(await $.assertCurrent(),X)throw K0()},G=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw K0();return M},H=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,K0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>H(D)))).some((D)=>D.status==="rejected"))throw K0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function V(U,M){let T=V6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw K0();await Y(),U.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw K0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw K0();let P=await D.completion;if(await Y(),G(T.contextId),D.controller.signal.aborted)throw K0();return structuredClone(P)}if(Q.size>=16||[...Q.values()].some((P)=>!P.receipt&&!P.controller.signal.aborted&&P.claim.tabId===T.tabId))throw K0();let j,z,F=new Promise((P,R)=>{j=P,z=R});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{H(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),G(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},C;try{await L();let P;if(M==="image"){let R=new Date().toISOString();C=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let I=new Date().toISOString();if(await L(),C.length<24||C.length>8388608||!C.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||C.readUInt32BE(8)!==13||C.toString("ascii",12,16)!=="IHDR")throw K0();P=z3.parse({version:1,producer:"primary_mac",context:_,captureId:IY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:R,finishedAt:I,sha256:C3(C),media:{contentType:"image/png",sizeBytes:C.length,width:C.readUInt32BE(16),height:C.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),K0();await O.host.start(),O.started=!0;let R=O.host.completed();if(R.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let I=await R;if(O.stop)await O.stop;await L();let E=await O.host.read(I.captureId);C=E.bytes;let w={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(I,E.capture)||!q$(I.owner,w)||C.length!==I.sizeBytes||C3(C)!==I.sha256||C.length<128||C.readUInt32BE(0)!==440786851)throw K0();await O.host.close(),await L(),P=z3.parse({version:1,producer:"primary_mac",context:_,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((R,I)=>R+(I.bytes?.length??0),C.length)>20971520)throw K0();return O.bytes=Buffer.from(C),O.receipt=P,j(P),structuredClone(P)}catch(P){let R=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&P instanceof Error&&P.message==="mac_recording_worker_failed:no_frames"?new v0("proof_capture_no_frames","The owned tab emitted no recording frames."):K0();throw await H(O).catch(()=>{}),z(R),R}finally{C?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw K0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw K0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw K0();return structuredClone(T)}if(Z.size>=4)throw K0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>V(U,"image"),record:(U)=>V(U,"video"),async stop(U){let M=V6.parse(U);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw K0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw K0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw K0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw K0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(H));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw K0()}}}import{createHash as M6,randomUUID as fY}from"crypto";import{isDeepStrictEqual as o$}from"util";import{realpath as hY}from"fs/promises";var N6=String.raw`async (media) => {
+  const deadline = (promise) => {
+    let timer;
+    return Promise.race([promise, new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("media_decode_timeout")), 12000);
+    })]).finally(() => clearTimeout(timer));
+  };
+  const items = await Promise.all(media.map(async (item) => {
+    const element = document.createElement(item.kind === "image" ? "img" : "video");
+    document.body.append(element);
+    try {
+      if (item.kind === "image") {
+        element.src = item.sourceUrl;
+        await deadline(element.decode());
+        if (!element.complete || !element.naturalWidth || !element.naturalHeight) throw new Error("media_image_not_decoded");
+        return { ...item, width: element.naturalWidth, height: element.naturalHeight };
+      }
+      element.muted = true;
+      element.playsInline = true;
+      element.preload = "auto";
+      const loaded = new Promise((resolve, reject) => {
+        element.addEventListener("loadeddata", resolve, { once: true });
+        element.addEventListener("error", () => reject(new Error("media_video_not_decoded")), { once: true });
+      });
+      element.src = item.sourceUrl;
+      await deadline(loaded);
+      if (!element.videoWidth || !element.videoHeight || !Number.isFinite(element.duration) || element.duration <= 0) throw new Error("media_video_not_decoded");
+      const initial = element.currentTime;
+      await deadline(element.play());
+      await deadline(new Promise((resolve, reject) => {
+        let timer;
+        const check = () => {
+          if (element.error) { clearTimeout(timer); reject(new Error("media_video_not_decoded")); return; }
+          if (element.currentTime - initial >= 0.05) { clearTimeout(timer); resolve(); return; }
+          timer = setTimeout(check, 25);
+        };
+        element.addEventListener("pause", () => { clearTimeout(timer); reject(new Error("media_video_not_advancing")); }, { once: true });
+        check();
+      }));
+      return { ...item, width: element.videoWidth, height: element.videoHeight, advancedSeconds: element.currentTime - initial };
+    } finally {
+      if (item.kind === "video") element.pause();
+      element.removeAttribute("src");
+      element.remove();
+    }
+  }));
+  return { verified: true, items };
+}`;var U6=function($){let J=this??globalThis,Z=10485760,Q=(G,H)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,V={login:K,id:q};if(G.expectedActorId!==null&&q!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||q!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||q!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(H){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:V}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,H=Q(G,!0);if(!H.ok)return{dispatched:!1,reason:H.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let V=J.document.querySelector("#fc-new_comment_field");if(!V)return{dispatched:!1,reason:"attachment_unavailable"};return V.files=q.files,V.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:H.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let H=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=H?.startsWith(K)&&H.endsWith(")")?H.slice(K.length,-1):H;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),H=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(H));if(q.length!==1)throw Error("saved_player_missing");let V=q[0],U={muted:V.muted,volume:V.volume,rate:V.playbackRate,preload:V.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(V.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(V.muted=!0,V.playbackRate=1,V.currentTime=0,V.readyState<2)V.preload="auto",V.load();await D(()=>V.readyState>=2&&V.videoWidth>0&&V.videoHeight>0);let j=V.currentSrc;if(!H(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!H(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let h=await _(O.read());if(h.done)break;if(L+=h.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(h.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let C=new J.Uint8Array(L),P=0;for(let h of W)C.set(h,P),P+=h.length;let R=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",C)))].map((h)=>h.toString(16).padStart(2,"0")).join("");if(R!==X.sha256||V.currentSrc!==j||!N.contains(V))throw Error("source_changed");let I=V.currentTime,E=V.getVideoPlaybackQuality().totalVideoFrames;if(await _(V.play()),await D(()=>V.currentTime-I>=0.05&&V.getVideoPlaybackQuality().totalVideoFrames>E),!Q(X,!1).ok||V.currentSrc!==j||!N.contains(V)||V.error)throw Error("player_changed");return{status:"verified",sourceSha256:R,width:V.videoWidth,height:V.videoHeight,durationSeconds:V.duration,advancedSeconds:V.currentTime-I,advancedFrames:V.getVideoPlaybackQuality().totalVideoFrames-E,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),V.pause(),V.currentTime=0,V.muted=U.muted,V.volume=U.volume,V.playbackRate=U.rate,V.preload=U.preload,!V.paused||V.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as PY}from"child_process";import{lstat as xY,realpath as EY}from"fs/promises";import{join as q6,resolve as SY}from"path";import{promisify as wY}from"util";var bY=wY(PY);async function kY($,J){let Z=await EY($),{stdout:Q}=await bY(q6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return B.array(B.object({browser:B.string(),directory:B.string(),connected:B.boolean().optional(),source:B.string(),socketPath:B.string().optional(),instanceId:B.string().optional(),extensionId:B.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&SY(Y.source)===q6(Z,"Reason Browser Use","manifest.json"))}async function i2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await kY($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await xY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as yY}from"crypto";function M$($){return`reason-browser-${yY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var T6=B.discriminatedUnion("ok",[B.object({ok:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({ok:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),_6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function I3($){let J=s0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await mY($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${fY()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},H=async(q)=>{if(!o$(J,q.owner))throw Z0();await G()},K=async(q)=>{await H(q);let V=await $.readVideo(q.captureId);try{await G();let U=V.capture;if(!o$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||V.bytes.length!==q.sizeBytes||V.bytes.length<128||V.bytes.length>10485760||V.bytes.readUInt32BE(0)!==440786851||M6("sha256").update(V.bytes).digest("hex")!==q.sha256)throw Z0();return V}catch(U){throw V.bytes.fill(0),U}};async function N(q,V,U){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new l2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await G(),D)throw Z0()};try{await F(T.connect());let W=_6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((R)=>{if(D)R.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let P=await F(V(_,async(R)=>{await O();let I=await F(_.evaluate(`(${U6.toString()})(${JSON.stringify(R)})`,{awaitPromise:!0}));return await O(),I},O));return await O(),P}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,C)=>{W=setTimeout(()=>C(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(q,V,U){let M=N$.parse(q);if(await H(M),!Number.isSafeInteger(V)||V<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new l2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=_6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!B.array(B.object({id:B.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===V))throw Z0();await G(),U.throwIfAborted();let F=B.object({data:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(V,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await G(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let V=c2(q);if(V.runId!==J.runId||V.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(V.media.map((R)=>R.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,C=(R,I)=>{if(L.size>=32){F=!0;return}let E=_.executeCdp(U.id,R,I);L.add(E),E.catch(()=>{F=!0}).finally(()=>L.delete(E))},P=_.onNotification((R)=>{if(R.method!=="onCDPEvent"||!t0(R.params)||!t0(R.params.source)||R.params.source.tabId!==U.id||!t0(R.params.params))return;let I=R.params.params;if(++O>512){F=!0;return}if(R.params.method==="Fetch.requestPaused"){let h=typeof I.requestId==="string"&&t0(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&D.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!h)F=!0;C(h?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...h?{}:{errorReason:"BlockedByClient"}})}if(R.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(R.params.method==="Network.loadingFailed")F=!0;if(R.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")z.add(I.requestId);if(R.params.method!=="Network.responseReceived")return;if(!t0(I.response)||typeof I.response.url!=="string"||!D.has(I.response.url)||typeof I.requestId!=="string"||!t0(I.response.headers)||I.type!=="Image"){F=!0;return}let E=Object.fromEntries(Object.entries(I.response.headers).map(([h,l])=>[h.toLowerCase(),l])),w=Number(E["content-length"]);if(j.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof E["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(E["content-length"])||!Number.isSafeInteger(w)||w>8388608||E["content-range"]||E["content-encoding"]&&E["content-encoding"]!=="identity"){F=!0;return}j.set(I.response.url,{id:I.requestId,length:w})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let R=B.object({frameTree:B.object({frame:B.object({id:B.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),I=[...new Set(V.media.map((h)=>new URL(h.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:R.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new v0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let E;try{E=await U.evaluate(`(${N6})(${JSON.stringify(V.media)})`,{awaitPromise:!0})}catch{throw new v0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!t0(E)||!Array.isArray(E.items)||E.items.length!==V.media.length)throw Z0();await Promise.all(L);let w=[];for(let h=0;h<V.media.length;h++){await G();let l=j.get(V.media[h].sourceUrl);if(F||!l||!z.has(l.id))throw Z0();let k=B.object({base64Encoded:B.literal(!0),body:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:l.id})),x=Buffer.from(k.body,"base64");try{let S=E.items[h];if(x.length!==l.length||x.toString("base64")!==k.body||!t0(S))throw Z0();w.push({...S,sourceSha256:M6("sha256").update(x).digest("hex")})}finally{x.fill(0)}}if(F)throw Z0();return X6({verified:!0,items:w},V)}finally{if(P(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new v0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let V=r$.parse(q);await H(V);let U="browser_unavailable";try{return await N(`https://github.com/${V.repositoryFullName}`,async(M,T)=>{let _=T6.parse(await T({operation:"preflight",expected:{...V,prUrl:`https://github.com/${V.repositoryFullName}`}}));return O3.parse(_.ok?{...V,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...V,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...V,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...V,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let V=c1.parse(q);if(await H(V),V.expectedActorId!==null&&V.authenticatedActor.id!==V.expectedActorId)throw Z0();let U=Q.get(V.attemptId);if(U){if(!o$(U.binding,V))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(V),result:U$.parse({...V,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(V.attemptId,M);let T=!1,_="dispatch";try{(await K(V)).bytes.fill(0),M.result=await N(V.prUrl,async(D,j)=>{let z=T6.parse(await j({operation:"identity",expected:V}));if(!z.ok)return U$.parse({...V,status:"not_attempted",reason:z.reason});let F=await K(V),O;try{T=!0,O=B.discriminatedUnion("dispatched",[B.object({dispatched:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({dispatched:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:V,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...V,status:"not_attempted",reason:O.reason});if(!o$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...V,observedActor:z.actor}});if(L!==null){let C=B.object({nativeUrl:B.string(),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await G(),U$.parse({...V,status:"uploaded",nativeUrl:C.nativeUrl,observedActor:C.actor,uploadedAt:new Date().toISOString()})}await new Promise((C)=>setTimeout(C,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
+`);M.result=U$.parse({...V,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let V=t$.parse(q);await H(V);try{return(await K(V)).bytes.fill(0),await N(V.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:V});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...V,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(V).some(([D,j])=>!o$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...V,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function mY($,J){let Z=await hY($);return{async discover(Q){let X=await i2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as XG}from"fs/promises";var hM=B.object({version:B.literal(1),recording_operation_id:B.string().uuid(),proof_ready:B.literal(!1),acknowledged_at:B.iso.datetime()}).strict(),n2=B.object({action:B.literal("start"),request_id:B.string().uuid(),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),F6=B.object({action:B.literal("inspect"),recording_operation_id:B.string().uuid()}).strict(),mM=B.discriminatedUnion("action",[n2,F6]),W6=B.object({recording_operation_id:B.string().uuid()}).strict(),P3={device_id:B.string().uuid(),root_id:B.string().uuid()},vY=B.discriminatedUnion("action",[n2.extend(P3),F6.extend(P3),W6.extend({...P3,action:B.literal("stop")})]),vM=B.toJSONSchema(vY),gM=B.object({version:B.literal(1),recordingId:B.string().uuid(),proofReady:B.literal(!1),capture:B.object({captureId:B.string().uuid(),contentType:B.literal("video/webm"),sha256:B.string().regex(/^[a-f0-9]{64}$/),sizeBytes:B.number().int().min(128).max(10485760),startedAt:B.iso.datetime(),finishedAt:B.iso.datetime(),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000),owner:B.object({runId:B.string().uuid(),deviceId:B.string().uuid(),rootId:B.string().uuid(),rootRevision:B.string().max(64),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024),generation:B.string().uuid(),browserScope:B.string().max(128),tabId:B.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var rM=n2.extend({action:B.enum(["start","inspect"]),recording_boot_generation:B.string().uuid(),recording_operation_id:B.string().uuid().optional(),recording_attempt_id:B.string().uuid().optional()}).strict();import{createHash as nY,randomUUID as rY}from"crypto";import{mkdtemp as tY,realpath as oY,rm as C6}from"fs/promises";import{tmpdir as eY}from"os";import{join as $G}from"path";import{spawn as JG}from"child_process";import{isDeepStrictEqual as ZG}from"util";import{createHash as gY}from"crypto";import{execFile as uY}from"child_process";import{chmod as dY,lstat as D6,mkdtemp as lY,readFile as j6,realpath as z6,rm as pY,writeFile as L6}from"fs/promises";import{tmpdir as cY}from"os";import{isAbsolute as sY,join as r2}from"path";import{promisify as aY}from"util";var x3=aY(uY),iY=($)=>gY("sha256").update($).digest("hex");async function G1($){if(!sY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await z6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await D6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||iY(await j6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function e$($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]);let G=await z6(await lY(r2(J??cY(),"reason-owned-recording-")));await dY(G,448);let H=r2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await L6(r2(G,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await L6(r2(G,"frames.ffconcat"),N.join(`
+`)+`
+`,{mode:384,flag:"wx"});let q={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",H],q),K="output";let V=await D6(H);if(!V.isFile()||V.isSymbolicLink()||V.nlink!==1||V.size<128||V.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",H],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",H,"-f","null","-"],q),K="pin",await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]),await j6(H)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await pY(G,{recursive:!0,force:!0})}}}}var A6=B.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var B1=B.string().min(1).max(1024),O6=B.object({path:B1,sha256:B.string().regex(/^[a-f0-9]{64}$/)}).strict(),R6=B.object({owner:B.object({runId:B1,deviceId:B1,rootId:B1,rootRevision:B1,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B1,generation:B1,browserScope:B1,tabId:B.number().int().positive()}).strict(),socketPath:B1,extensionId:B.string().regex(/^[a-p]{32}$/),nativeHostName:B1,seconds:B.number().int().min(1).max(15),encoder:B.object({ffmpeg:O6,ffprobe:O6}).strict()}).strict();var QG=15728640,C1=()=>Error("mac_recording_worker_failed");function I6($){let J=R6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,H=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(C1()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([H(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,V=async()=>{if(X)throw C1();if(await K($.assertCurrent()),X)throw C1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await V(),await G1({path:Z.path,sha256:Z.sha256}),await V(),G=null;let U=await oY(await tY($G(eY(),"reason-recording-host-")));try{await V()}catch(x){throw await C6(U,{recursive:!0,force:!0}),x}let M=JG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((x)=>M.once("close",()=>x())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(x){if(x.code!=="ESRCH")throw x}},D=null;H=()=>D??=(async()=>{try{_()}catch(x){if(x.code!=="EPERM")throw x}await T;try{for(let x=0;;x++)try{_();break}catch(S){if(S.code!=="EPERM"||x>=20)throw S;await new Promise((A)=>setTimeout(A,25))}}finally{await C6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,C,P=new Promise((x,S)=>{L=x,C=S}),R,I,E=new Promise((x,S)=>{R=x,I=S});E.catch(()=>{});let w=(x=C1())=>{if(F)return;F=!0,clearTimeout(h),clearInterval(k),N().then(()=>{C(x),I(x)},(S)=>{C(S),I(S)})},h=setTimeout(()=>w(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,V().catch(()=>w()).finally(()=>{l=!1})},250);q={completion:E,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
+`)},cancel:()=>w()},M.on("error",()=>w()),M.stdin.on("error",()=>w()),M.stdout.on("data",(x)=>{if(F)return;if(z+=x.length,z>QG){w();return}j+=x.toString("utf8");let S;while((S=j.indexOf(`
+`))!==-1){let A=j.slice(0,S);j=j.slice(S+1);try{let f=JSON.parse(A);if(f.type==="failed"&&Object.keys(f).sort().join(",")==="reason,type"){let o=A6.safeParse(f.reason);w(o.success?Error(`mac_recording_worker_failed:${o.data}`):C1());return}if(f.type==="unsupported"&&!O){w(Error("mac_recording_encoder_unavailable"));return}if(f.type==="started"&&!O&&Object.keys(f).length===1){O=!0,L({recording:!0});continue}if(!O||f.type!=="capture"||W||Object.keys(f).sort().join(",")!=="bytes,capture,type")throw C1();let b=f.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!ZG(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof f.bytes!=="string"||f.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(f.bytes))throw C1();let n=Buffer.from(f.bytes,"base64");if(n.length!==b.sizeBytes||nY("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw C1();W={capture:Object.freeze({...b,captureId:rY(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{w();return}}}),M.once("close",(x)=>{if(F)return;if(x!==0||!W||j.trim()){w();return}let S=W;V().then(async()=>{if(await H(),F)return;F=!0,clearTimeout(h),clearInterval(k),Q.set(S.capture.captureId,S);while(Q.size>2)Q.delete(Q.keys().next().value);R(S.capture)}).catch(()=>w())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
+`);try{return await P}catch(x){throw q=null,x}}finally{Y=!1}},async completed(){if(await V(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await V();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await V();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var P6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await XG($.automationDirectory);J=(Q,X)=>i2(Z,Q,X)}if(await G1({path:$.worker.path,sha256:$.worker.sha256}),!await e$($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),H=new R1({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await H.connect(),K=P6.parse(await H.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!B.array(B.object({id:B.number()})).parse(await H.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{H.close()}return{extensionInstanceId:G.instanceId,async createHost(N,q,V){let U=new R1({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return I6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){V.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=P6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),BG=B.object({operationId:B.string().uuid()}).strict();function E6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=B.array(B.object({profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:B.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!B.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,G=!1,H=new YG,K=async(U)=>{let M=H.getStore();if(G||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),G)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=H6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let C=await $.resolveBrowser(U.profile,O,j,L);if(C.extensionInstanceId!==U.extensionInstanceId)throw A0();return C.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),G)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!x6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},V=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{G=!0})},1000);return V.unref(),{generation:$.generation,async execute(U,M,T){return H.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!x6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let C=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?C.capture.context.uploadOrigin:$.uploadOrigin)||C.capture.media.contentType!=="image/png"||C.capture.sha256!==_.sha256||C.bytes.length!==_.sizeBytes||GG("sha256").update(C.bytes).digest("hex")!==_.sha256)throw A0();await z();let P={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,P);try{let R=await fetch(L,{method:"PUT",body:C.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await R.body?.cancel(),await z(),R.ok)P.result={...P.result,status:"uploaded"}}catch{}F=P.result}finally{C.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==K6)return!1;let T=BG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await H.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(V);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var TG="__browser-recorder",_G=MG(KG),FG="/tmp/open-browser-use",WG=33554432,LG=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.literal(t2),extensionInstanceId:B.string().min(1).max(1024)})}),w6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:i$,ensureBrowser:f6,socketDirectory:FG,async identity($){let J=new R1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function b6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw w6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(h6(Z),"Default","Local Extension Settings",t2),X=(await S6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await S6(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=S3(J.socketDirectory,Y);try{let H=await HG(G);if(!H.isSocket()||H.uid!==process.getuid?.())continue;let K=LG.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await UG(N)).size<=WG&&(await m6(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:t2}}catch{}}throw w6()}async function w3($){let J=await NG($);return{path:J,sha256:VG("sha256").update(await m6(J)).digest("hex")}}async function v6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await _G(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await e$(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...qG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],TG]};return{worker:{...await w3(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function g6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=k6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?y6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,H=(V)=>J6(V.organizationId,V.sessionId,V.deviceId,1),K=$.recording,N,q=E6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:H,...K?{resolveBrowser:async(V,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>b6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(V,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>DG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(V)=>I3({...V,endpoint:(U)=>({discover:(M)=>b6(M,Z),tabScope:H(U)})})});return{capability:G,broker:q}}function DG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as hG}from"child_process";import{execFile as jG}from"child_process";import{readFile as zG}from"fs/promises";import{join as $1}from"path";var OG="Claude Code-credentials",AG="/usr/bin/security",RG=120000,CG=8192,o2={exec:($,J,Z)=>new Promise((Q)=>{jG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await zG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=CG?$:null}function IG($,J){return $.CLAUDE_CONFIG_DIR||$1(J,".claude")}function PG($,J){return $.CODEX_HOME||$1(J,".codex")}function u6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function xG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function EG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:xG(Z)??Date.now()}}catch{return null}}function SG($,J){return $1($.XDG_DATA_HOME||$1(J,".local","share"),"opencode","auth.json")}var wG={anthropic:"anthropic",openai:"openai-codex"};function bG($){return c6($,wG)}function c6($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let H=T$(G.access),K=T$(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(H&&K&&N!==null)Q.push({provider:Y,access:H,refresh:K,expires:N})}return Q}catch{return[]}}function kG($){return c6($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function yG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?$1(J,Z.slice(2)):Z||$1(J,".pi","agent")}async function s6($,J,Z=o2){let Q=[],X=await Z.exec(AG,["find-generic-password","-s",OG,"-w"],RG),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?u6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(u6(await Z.readText($1(IG($,J),".credentials.json"))));let H=EG(await Z.readText($1(PG($,J),"auth.json")));G(H),G(fG(await Z.readText($1($.GROK_HOME||$1(J,".grok"),"auth.json"))));for(let K of bG(await Z.readText(SG($,J))))G(K);for(let K of kG(await Z.readText($1(yG($,J),"auth.json"))))G(K);return Q}function a6($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var d6="https://auth.x.ai",l6="b1a00492-073a-47ea-816f-4c329264a828",p6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function fG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${d6}::${l6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==d6||Q.oidc_client_id!==l6||!p6(Q.key)||!p6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var i6=330000,mG=300000,vG=60000;function gG($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+i6)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function uG($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*i6)?vG:mG}var dG=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function n6($){let J=new Map,Z=$.wait??dG,Q=$.stores??(process.platform==="darwin"?o2:{...o2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=a6(await s6($.environment??process.env,$.home,Q));for(let Y of gG(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(uG(J),$.signal)}}function r6($=process.env){return new Promise((J)=>{hG("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as lG,spawn as W_,spawnSync as L_}from"child_process";import{chmodSync as j_,existsSync as pG,mkdirSync as z_,readFileSync as O_,renameSync as A_,rmSync as R_,statSync as C_,writeFileSync as I_}from"fs";import{dirname as x_,isAbsolute as E_,join as y3}from"path";var t6=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function o6($,J){if(!t6.test($)||!t6.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var cG="com.reasonmachines.updater",sG=["so.ara.updater","so.reason.updater"];function aG($){let J=$==="staging"?".staging":"";return{label:`${cG}${J}`,legacyLabels:[...sG].reverse().map((Z)=>`${Z}${J}`)}}function iG($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function nG($,J){return new Promise((Z)=>{lG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function J7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=aG($.channel),G=$.configHome??$7(Q),H=[X,...Y].filter((V)=>{let U=iG(V,Q,G);return pG(J==="darwin"?U.launchAgent:U.systemdService)});if(H.length===0)return"absent";let K=$.command??nG,N=H[0];if(H.length>1){for(let V of H)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${V}`]):await K("systemctl",["--user","is-enabled",`${V}.timer`]))===0){N=V;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var e6=60000;function Z7($){let J=(X,Y)=>{try{return o6(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(e6-1,Math.floor(G*e6)))}}var rG=30000;async function Q7($){return($.flush??T8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(rG);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var Y7=25000,oG=5000,eG=600000,$B=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return u0(),j7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var G7=5000,JB=600000;function ZB($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[a1])return null;try{return C2({platform:J})}catch{return null}}function QB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function XB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)v$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)v$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Z2($,J,Z,Q,X={}){if(u0(),$.executionMode==="host")J2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let H=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?L7():Promise.resolve(!1),q=M7().then((y)=>y.status==="resolved",()=>!1),V=X.prestartedReadiness??a$($,X.readinessProbes,H,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?V.initial:V.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??r6)().catch(()=>!1):null,D=new AbortController,j=null,z=async(y,i)=>{let I0=($.userChrome??X.ownComputer===!0)&&y["automation.call.v1"]===!0?W7():null;if(I0&&"code"in I0)process.stderr.write(`Reason worker: your own Chrome unavailable (${I0.code})
+`);let a=g3($,y,{displayVideo:y["display.stream.v1"]===!0&&await N(),handsBrowser:y["hands.connect"]===!0&&await q,userChrome:I0&&"host"in I0?I0.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:y["pty.start"]===!0&&d2(),probing:i});if(!j&&a.worker.readiness?.["browser.pr-proof.v1"]===!0){let M0=await v6();if(j||D.signal.aborted)return a;process.stderr.write("error"in M0?`Reason worker: PR video proof unavailable (${M0.error})
+`:`Reason worker: PR video proof ready (ffmpeg ${M0.encoder.ffmpeg.path})
+`),j=g6({assertCurrent:async()=>{if(!l())throw Error("proof_authority_lost")},...!("error"in M0)?{recording:M0}:{}})}return a},F=await z(M,U?F3.filter((y)=>M[y]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,C=0,P="starting",R=null,I=!1,E=!1,w=null,h,l=()=>!G.drained&&!W&&Date.parse(Y)>Date.now()&&O.supported_operations.some((y)=>F.worker.readiness?.[y]===!0),k=null,x=()=>L+(k?.claims()??0),S=null,A=new Set,f=(y)=>{let i=y.capabilities.root_paths;if(Object.assign(y.capabilities,m3(y.config,y.state,F,j?.capability)),i)y.capabilities.root_paths=i},b=(y)=>{F=y,f({config:$,state:J,capabilities:O}),S?.();for(let i of A)f(i),i.heartbeatNow?.()},n=new Set,o=new Set,N0=setInterval(()=>{let y=new Set;for(let i of[{state:J,capabilities:O},...A])for(let B0 of $B){if(i.capabilities.operation_constraints?.[B0]?.probing!==!0)continue;let a=`${i.state.deviceId} ${B0}`;if(y.add(a),!n.has(a)||o.has(a))continue;o.add(a),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:i.state.deviceId,lane:B0,login_device:i.state===J,timestamp:new Date().toISOString()})}
+`)}n.clear();for(let i of y)n.add(i)},eG);N0.unref();let j0=(y)=>{if(!X.readinessProbes)c5({config:$,readiness:y,signal:D.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(i)=>{z(i,[]).then(b)}})},P1=U?V.final.then(async(y)=>{if(D.signal.aborted)return;b(await z(y,[]));let i=F3.filter((B0)=>y[B0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${i.length?`ready: ${i.join(", ")}`:"none ready"}).
+`),j0(y)},()=>{}):Promise.resolve();if(!U)j0(M);_?.then(async(y)=>{T=y;for(;;){let i=F,B0=await z(i.worker.readiness??{},i.worker.probing??[]);if(D.signal.aborted)return;if(F!==i)continue;b(B0);return}});let F1=U&&F.worker.probing?.includes("pty.start")?V.pty.then(async(y)=>{let i=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!i())return;let B0=await z({...F.worker.readiness,"pty.start":y},(F.worker.probing??[]).filter((I0)=>I0!=="pty.start"));if(D.signal.aborted||!i())return;b(B0)},()=>{}):Promise.resolve(),r1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:P,drained:G.drained||W||I,activeClaims:x(),activeSessions:C,lastHeartbeat:R,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:l()&&!I&&P==="running"}),x1=!1,E1=()=>{x1=!0,a0()},a0=()=>{if(W)return;if(W=!0,P="stopping",w?.close(),x()===0)D.abort();else h=setTimeout(()=>D.abort(),$.shutdownGraceMs)},S1=$.channel==="production"||$.channel==="staging"?$.channel:null,O$=d($).releaseCheck,W1=X.publishedRelease??(S1&&$.lifetime==="persistent"?Z7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let y=JSON.parse(s(O$));return typeof y==="string"?y:null}catch{return null}})(),check:async(y)=>{try{c(O$,y)}catch{}let i=await J7({channel:S1});process.stderr.write(i==="started"?`Reason worker: CLI ${y} is published; the updater is checking now.
+`:i==="absent"?`Reason worker: CLI ${y} is published; no updater is installed for it here.
+`:`Reason worker: CLI ${y} is published; the updater did not start, so its next scheduled check takes it.
+`)}}):void 0),v=(y)=>{if(y==="stop")E1();if(y==="reload_roots"){let i=t($);if(!i||i.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=i.roots;let B0=D7(J.roots,X7());if(B0)O.root_paths=B0;else delete O.root_paths;k?.check()}if(y==="drain"||y==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:y==="drain"},x0($,G)}return r1()};X.prestartedControl?.handle(v);let Y0=X.prestartedControl?await X.prestartedControl.closed:await y2($,Q,v),L1,i0=!1,A$=()=>{let y=Date.parse(Y)-Date.now();if(y>0){L1=setTimeout(A$,Math.min(y,2147483647));return}W=!0,w?.close(),i0=!0,P="stopping",D.abort(Error("worker_credential_expired"))};A$(),X.signal?.addEventListener("abort",a0,{once:!0});let g0=X.processSignals!==!1;if(g0)process.once("SIGTERM",a0),process.once("SIGINT",E1);if(X.signal?.aborted)a0();try{X.onStartup?.("control_ready");let y=X.client??new $2(J1($.apiOrigin),k0($.proxy,B7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),i=d($).daemon,B0=R4($,J.deviceId),I0=X.startupTiming,a=I0?()=>({...I0(),...B0?.enrollmentMs!==void 0?{enrollment_ms:B0.enrollmentMs}:{}}):void 0,M0=(m)=>{let n0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&n0)(X.handOverLocalLogins??n6)({state:m.state,client:{localSubscription:n0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=X7(),w0=m.client.liveSessionWorktrees?.bind(m.client);if(w0)N7(()=>H7({home:W0,deviceId:m.state.deviceId,liveIds:(D1)=>w0(m.state,D1,m.signal)}),m.signal)};M0({state:J,client:y,signal:D.signal});let l0=ZB($,X.platform??process.platform),w1=y.deviceLifecycle?.bind(y),t1=Promise.resolve(),R0=0,S0=()=>{if(!l0||!w1||W||Date.now()<R0)return;R0=Date.now()+JB,t1=t1.then(()=>Q7({paths:l0,device:J,client:{deviceLifecycle:w1},accept:QB,signal:D.signal})).catch(()=>{return})};if(S0(),l0)V.final.then((m)=>XB(l0,m),()=>{});let R$=(m,n0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+_7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:Y7,operationCompletionTimeoutMs:Y7,maxConsecutiveHeartbeatFailures:3,claimable:l,onClaim:async(W0,w0,D1)=>{let I$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let r0=F.worker.probing??[],K9=r0.includes(W0.capability)?P1:W0.capability==="hands.connect"&&$.executionMode==="host"&&r0.includes("pty.start")?F1:null;if(K9){let N2,L4=()=>{};await Promise.race([K9,new Promise((V9)=>{N2=setTimeout(V9,oG),L4=()=>V9(),w0.addEventListener("abort",L4,{once:!0})})]),clearTimeout(N2),w0.removeEventListener("abort",L4)}let H2=W0.capability==="hands.connect",W4=H2?w:null,lJ={signal:w0,emit:D1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(N2)=>m.client.operationCustomEndpointCredential(m.state,W0,N2)}:{},...H2?{handsLaunch:{claimedAtMs:I$,...W4?{takePrespawnedWorker:W4.take,adoptSpawnedWorker:W4.adopt}:{}}}:{}};if(H2)C+=1;try{return await(X.execute??u3)(m.state,W0,lJ)}finally{if(H2)C-=1}},onControl:async(W0,w0)=>await z7(m.state,W0,w0,m.client)||await O7(m.state,W0,w0)||await F7(W0,w0)||await j?.broker.control(W0,w0)||!1,onEvent:n0}),V2=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:tG(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(G7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,G9=y.ownerWorkspaces?.bind(y),B9=y.ownerWorkspaceEnrollment?.bind(y);if(C$&&G9&&B9)k=a9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:G9,ownerWorkspaceEnrollment:B9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,n0,W0)=>{let w0=R4(m.config,m.state.deviceId),D1={config:m.config,state:m.state,signal:n0,statusPath:d(m.config).daemon,...w0?.offer?{firstHeartbeat:w0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new $2(J1($.apiOrigin),k0($.proxy,B7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};M0(D1);let I$={...D1,heartbeatNow:null};A.add(I$);try{await K3({registerHeartbeatNow:(r0)=>{I$.heartbeatNow=r0},...R$(D1,(r0)=>{if(r0.type==="completed")v3(r0.operationId,r0.status);if(r0.type==="claims_changed"){if(W0(r0.activeClaims),W&&x()===0)D.abort()}if(r0.type==="stopped")W0(0)})})}finally{A.delete(I$)}if(W&&!i0)await V2(D1)}});let T4=0,_4=0,F4=C$?.intervalMs??d9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?S2(i):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{S=m},...a?{startup:a}:{},...R$({state:J,client:y,capabilities:O,signal:D.signal,statusPath:i,...B0?.offer?{firstHeartbeat:B0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&x()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!w)w=q7({log:(n0,W0)=>{process.stderr.write(`${JSON.stringify({event:n0,...W0})}
+`)}}),w.arm(),setTimeout(T7,0);else if(!m.handsPrespawn&&w)w.close(),w=null}if(m.type==="heartbeat"){if(k&&!W&&Date.now()>=T4)T4=Date.now()+F4,k.check().then((n0)=>{_4=n0?0:_4+1,T4=Date.now()+(n0?F4:Math.min(F4,l9*2**Math.min(_4-1,10)))});if(R=m.serverTime,I=m.drain,S0(),!W&&S1)W1?.(m.latestCliVersions?.[S1]);if(!W)P="running";if(!W&&!E&&r1().executionEligible){if(E=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)P="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await k?.settled(),W&&!i0&&$.lifetime==="ephemeral")await y.disconnect?.(J,AbortSignal.timeout(G7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
+`)});else if(W&&!i0)await V2({state:J,client:y});if(x1)await U7().catch(()=>{return})}catch(y){if(!(y instanceof _0&&y.status===401))throw y;if(x0($,{...G,revoked:!0}),y.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(L1),clearInterval(N0),h)clearTimeout(h);if(g0)process.removeListener("SIGTERM",a0),process.removeListener("SIGINT",E1);X.signal?.removeEventListener("abort",a0),D.abort(),w?.close(),await k?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await Y0()}}function B7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(K7,V7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as YB,sign as GB}from"crypto";var A7=65536,BB=65536;function KB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new X0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new X0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!C7(X))throw new X0("invalid_public_key");return X}function R7(){try{let{privateKey:$,publicKey:J}=YB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:KB(J)}}catch($){if($ instanceof X0)throw $;throw new X0("proof_key_generation_failed")}}class Q2{keyPair=R7();binding=null;loadPublicKey(){if(!this.keyPair)throw new X0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=R7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>BB)throw new X0("proof_sign_failed");let J;try{J=GB("sha256",$,this.keyPair.privateKey)}catch{throw new X0("proof_sign_failed")}if(!I7(J))throw new X0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>A7)throw new X0("invalid_binding");if(this.binding)throw new X0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>A7)throw new X0("invalid_binding");if(!this.binding)throw new X0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as TB,spawn as _B}from"child_process";import{isAbsolute as FB}from"path";import{promisify as WB}from"util";var X2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class Y2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=X2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
+`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as VB}from"crypto";import{unlinkSync as HB}from"fs";import{join as NB}from"path";var G2=1,e2=45000,UB=B.strictObject({type:B.literal("configure"),protocol:B.literal(G2),version:B.string(),config:J0}),qB=B.strictObject({type:B.literal("ticket"),organizationId:B.string().min(1).max(160),receipt:B.unknown()}),MB=B.strictObject({type:B.enum(["ping","stop"])});async function P7($={}){let J=$.clock??X2,Z=new Y2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,H,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:V,version:U}=UB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(N1(V),e(g(V),!0),H=Y1({path:d(V).lock,runtimeVersion:r}),!H.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=NB(g(V),`ssh-preflight-${VB()}.json`);try{c(M,{version:1}),s(M)}finally{try{HB(M)}catch{}}let T=t(V),_=$0(V);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&V.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:G2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=V.lifetime==="ephemeral"?K=new Q2:T0(V,!0);if(!T){let W=A1(V);await Z.send({type:"ticket-request",request:W.request});let L=qB.parse(await Z.receive(70000,Q.signal)),C=W.complete(L.organizationId,L.receipt);if(T=await X1(V,C,D,$.enroll),V.lifetime==="persistent")m0(T,d(V).state,{proofStore:D});x0(V,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(MB.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min(e2,$.startupTimeoutMs??e2)),()=>{F=!0,Y()});let O=H.owner.nonce;if(await Z2(V,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(V,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:V.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(V){let U=V instanceof Error&&/^worker_[a-z_]+$/.test(V.message)?V.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),H?.acquired)H.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>FB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,LB=B.strictObject({type:B.literal("hello"),protocol:B.literal(G2),version:B.string(),platform:B.enum(["linux","darwin"]),architecture:B.enum(["arm64","x64"]),enrolled:B.boolean()}),DB=B.strictObject({type:B.literal("ticket-request"),request:B.strictObject({install_id:B.uuid(),code_challenge:B.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:B.enum(["persistent","ephemeral"]),roots:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),execution_mode:B.enum(["confined","host"]),permissions:B.strictObject({read:B.literal(!0),write:B.literal(!0),execute:B.literal(!0),discover_environment:B.literal(!0),expose_mcp:B.literal(!1)})})).length(1)})}),x7=B.discriminatedUnion("type",[B.strictObject({type:B.literal("running"),deviceId:B.string().min(1).max(160),expiresAt:B.iso.datetime({offset:!0}),lifetime:B.enum(["persistent","ephemeral"]),supervision:B.literal("ssh-foreground")}),B.strictObject({type:B.literal("pong")}),B.strictObject({type:B.literal("stopped")})]),jB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function $4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&jB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function E7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
+a=${d3($.remoteCli)}
+[ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
+p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
+p=$(cd -P "$p" && pwd -P)
+[ "\${p%/}/$f" = "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
+if [ -x /usr/bin/sha256sum ]; then h=$(/usr/bin/sha256sum < "$a");
+elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
+else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
+h=\${h%% *}
+[ "$h" = ${d3($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
+exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function S7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,E7($)]}function zB($){return S7($,!1)}function w7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function OB($){let J;try{({stdout:J}=await WB(TB)("/usr/bin/ssh",["-G",...S7($,!0)],{env:w7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
+`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function AB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function RB($){await OB($);let J=_B("/usr/bin/ssh",zB($),{stdio:["pipe","pipe","pipe"],env:w7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=AB(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function CB($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let H=$[G];if(H==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(H)||J.has(H))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(H,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let H=J.get(G);if(!H)throw Error("worker_required_input_missing");return H},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");E7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(B2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function IB($,J,Z,Q,X){let{request:Y}=DB.parse($4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},H=(async()=>{G();let N=Z??z1(J),q=await(Q.enrollmentCredentials??O1)(J,N);if(G(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=Q.createTicketClient?.(q)??new H1(q,{credentialsPath:N}),U=S4(await V.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([H,new Promise((q,V)=>{if(K=()=>V(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function b7($,J={}){let{config:Z,target:Q,credentialPath:X}=CB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??X2,G=await(J.sshTransport??RB)(Q),H=new Y2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),q,V;if(G.result.then((U)=>{V=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await H.send({type:"configure",protocol:G2,version:r,config:Z});let U=LB.parse($4(await H.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await IB(H,Z,X,J,AbortSignal.any([K.signal,H.signal]));q=Y.every(1e4,()=>{H.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:x4)+e2+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=x7.parse($4(await H.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
+`)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await H.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(x7.parse($4(await H.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=V??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),H.dispose()}}import{createConnection as wB}from"net";import{WebSocket as J4}from"ws";var PB=1,F$=65536,k7=4096,y7=67108864,f7=4194304,_$=B.uuid(),xB=B.strictObject({kind:B.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:B.literal("install"),generation:B.number().int().positive(),transport:B.literal("reverse_ssh"),expiresAt:B.iso.datetime({offset:!0}),maxDurationMs:B.literal(300000),maxChannels:B.literal(1),allowTcpForwarding:B.literal(!1),allowPty:B.literal(!1)}),EB=B.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var SB=B.strictObject({protocol:B.literal(PB),type:B.literal("ssh_install_relay"),authorityToken:B.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:xB,relayUrl:EB,endpoint:B.strictObject({host:B.literal("127.0.0.1"),port:B.literal(22)})});function p3($,J=Date.now()){let Z=SB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function h7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function m7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var v7="ssh_install_relay_closed";function bB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function kB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function yB($,J=v7){try{$.close(1000,J)}catch{$.terminate()}}async function fB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new J4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>wB({host:"127.0.0.1",port:22})),G,H=!1,K=!1,N=0,q=0,V,U=(W)=>{if(V)clearTimeout(V);V=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),V.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=v7)=>{if(K)return;if(K=!0,V)clearTimeout(V);if($.signal?.removeEventListener("abort",D),G?.destroy(),X.readyState===J4.OPEN)yB(X,W);else if(X.readyState!==J4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=k7&&q<=y7},F=(W)=>{if(K||!H||X.readyState!==J4.OPEN||X.bufferedAmount>f7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=h7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let C=bB(W);if(C>F$||!z(C))return j();if(!H){if(L)return j();try{let R=m7(JSON.parse(String(W)));if(R.type!=="ssh_install_relay_ready"||R.authorityId!==Z.authority.authorityId)return j();H=!0,U(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",j),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{j()}return}if(!L)return j();let P=kB(W);if(!P||!G||G.destroyed||!G.write(P))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function g7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await fB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as hB}from"crypto";var i1="ARA_WORKER_PREVIEW_PROBE";async function d7(){if(typeof Bun>"u")return 1;let $=hB(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,H){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(i1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&H.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,H){if(typeof H!=="string"||H.length>8192){G.close();return}if(!G.data.relay){if(H===i1)G.send(i1);else G.close();return}try{let K=u7(H),N=(q)=>G.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>i1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===i1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(i1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===i1&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
+`);else throw Error("probe_protocol_failed")}catch{G.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
+`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as gB,createReadStream as uB,fstatSync as dB,readFileSync as lB}from"fs";var l7="/run/sc/instance-generation";var mB=/^[1-9][0-9]{0,15}\n?$/;function vB($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function p7($){if(typeof $!=="string"||!mB.test($))return null;let J=Number($.trim());return vB(J)?J:null}var c7=3,pB=600000,cB=65536,sB=500;function s7($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(c7))throw Error("worker_standby_invalid_invocation");return{handoffFd:c7}}function aB($=(J)=>lB(J,"utf8")){try{return p7($(l7))}catch{return null}}function iB($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=P4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var a7={isPipe:($)=>dB($).isFIFO(),stream:($)=>{let J=uB("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function nB($,J=a7){if(!J.isPipe($.fd)){try{gB($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??pB),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});G.catch(()=>{});let H=J.every(sB,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],V=0;for await(let U of Q.chunks){if(X)throw X;if(V===0)$.onArriving?.();if(V+=U.length,V>cB)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{H(),Q.close()}}async function i7($,J=a7){let Z=$.readGeneration??(()=>aB()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await nB({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return iB(Y)}var rB=`Usage: reason worker <command> --config PATH [--json]
+  enroll                        Obtain/redeem a ticket using the current Reason login
+  start                         Run the existing Device daemon in the foreground
+  status                        Read enrollment and live local control state
+  doctor                        Read local prerequisites; never enroll or repair
+  drain                         Persist withdrawal of new claims; keep current work
+  resume                        Explicitly clear persistent drain
+  stop                          Drain, then cancel at shutdownGraceMs (ephemeral: ends its Device)
+  revoke                        Revoke an offline Device and remove its local key
+  attach                        Start this same worker over verified system SSH
+Config: version 1; apiOrigin, channel, stateDirectory, workspaceRoot, lifetime
+(persistent|ephemeral); executionMode defaults confined (host is explicit consent);
+slots (Sessions at once, 1-4) defaults 1 and a Machine worker runs one;
+shutdownGraceMs defaults 30000. Paths must be absolute and canonical.
+Config and enrollment files must be owned by the current user with mode 0600.
+Enroll: --enrollment-file PATH redeems a platform-provided ticket instead.
+Enroll: --credential-file PATH selects a protected Reason credentials JSON file
+(including credentialKind: api_key). Credentials never belong in argv or worker state.
+The current login needs devices:write; enrollment never opens a browser or starts work.
+Ephemeral: start keeps its proof key only in this process. It redeems
+--enrollment-file PATH, or else obtains a ticket with the current login.
+Its Device ends when the process exits; every start enrolls a new Device.
+Use lifetime persistent to stop and start the same Device.
+Simple setup: \`reason serve NAME\` writes this config and enrolls for you.
+State is isolated under stateDirectory/headless-<channel>, never Desktop identity.
+Persistent keys: a new identity's is a non-extractable login Keychain key on a Mac
+where the CLI can create one there, otherwise an extractable owner-only file.
+proxy {version 1, url, caFile?} carries enrollment, control, Hands and desktop relay
+traffic (not yet previews or kept terminals); proxy environment variables stay refused.
+No service is installed, no update is performed, and no desktop/VNC is enabled.
+SSH: attach --ssh ALIAS --ssh-config PATH --remote-cli /absolute/path/reason
+  --artifact-sha256 HASH --config PATH --foreground [--credential-file PATH]
+The config describes remote paths. An existing, SHA-256-pinned CLI is required.
+SSH config must be protected (0600); it explicitly owns IdentityFile and host trust.
+ProxyJump/ProxyCommand are unsupported; configure a directly reachable alias.
+Pretrust known_hosts. No agent forwarding, automatic installation or detached service.
+SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
+are not forwarded/supported; running is not a browser-readiness receipt.
+Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
+`;function tB($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let H=0;H<Z.length;H++){let K=Z[H];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++H];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var oB=1e4,eB=2000,n7=15000,$K=50;async function t7($,J,Z,Q,X,Y){let G=new Q2,H=new AbortController,K,N,q=new Promise((P,R)=>{K=P,N=R});if(q.catch(()=>{}),u0(),$.executionMode==="host")J2();Z("enrollment_started");let V=X(G);V.catch(()=>{});let U=null,M=y2($,J,(P)=>{if(!U)throw Error("worker_starting");return U(P)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([H.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((P)=>{z=P}),O=setTimeout(()=>z(),oB);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(P)=>{if(P==="ready")W=setTimeout(()=>z(),eB);Q.onStartup?.(P)},C=a$($,Q.readinessProbes,D,q,void 0,j,F);C.final.catch(()=>{});try{let P;try{P=await V}catch(R){throw H.abort(),N(Error("worker_enrollment_failed")),await C.final.catch(()=>{}),await M.then((I)=>I(),()=>{}),R}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(n7,Date.parse(P.worker?.expiresAt??"")-Date.now()||n7))),K(P.roots[0].permissions),x0($,{version:1,drained:!1,revoked:!1}),await Z2($,P,G,J,{...Q,onStartup:L,prestartedReadiness:C,prestartedControl:{closed:M,handle:(R)=>{U=R}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),H.abort(),G.deleteBinding(),G.deleteKey(),await M.then((P)=>P(),()=>{})}}async function JK($,J,Z,Q){let{handoffFd:X}=s7($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,H=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>s$(T);if(K||!M)return;try{u0(),J2()}catch{return}if(Y=S5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{d2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??i7)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(H,$K)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
+`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:V,enrollment:U}=q;try{e(g(V),!0);let M=await o7(V,()=>{});try{if(Q("lock_acquired"),t(V))throw Error("worker_ephemeral_requires_fresh_enrollment");return N1(V),await t7(V,M.owner.nonce,Q,Z,(T)=>X1(V,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function M1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
+`),J.onStartup?.(K)},H={...J,onStartup:G,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(V)=>Math.min(e1,Math.max(0,Math.round(V))),N=Y.get("readiness_started"),q=Y.get("readiness_completed");return{service_start_to_heartbeat_ms:K(performance.now()),...N!==void 0&&q!==void 0?{readiness_ms:K(q-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
+`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await d7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await b7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await g7();return await P7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await f2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
+`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await JK($,J,H,G);let K=tB($);if(!K)return Z.stdout.write(rB),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
+`),V=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!V||!!M,deviceId:V?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:V||M?Date.parse(V?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{N1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":V&&T0(N)instanceof o1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(V||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(QK);return 0}}e(g(N),!0);let U=await o7(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
+`)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")x0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");N1(N);let D=()=>{f0(N),m9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await E4(N,T,O,J.enroll):await r7(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof Q1)||!O.deviceRemoved)throw O;return D(),j()});return m0(F,d(N).state,{proofStore:z}),x0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new $2(J1(N.apiOrigin),k0(N.proxy),T);if(x0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return f0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(N1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await t7(N,U.owner.nonce,G,H,async(T)=>K.enrollmentPath?E4(N,K.enrollmentPath,T,J.enroll):r7(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Z2(N,M,T0(N),U.owner.nonce,H)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
+`);let q=$.includes("--json")?void 0:G$(K instanceof Q1&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(q)Z.stderr.write(`${q}
+`);return N==="worker_revoked"&&X?0:1}}var ZK=60000;async function o7($,J){let Z=Date.now()+$.shutdownGraceMs+ZK,Q=!1;for(;;){let X=Y1({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((H)=>setTimeout(H,250))}}var QK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function r7($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return X1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??z1($),G=await(Z.enrollmentCredentials??O1)($,Y);if(!G)throw Error(X);let H=Z.createTicketClient?.(G)??new H1(G,{credentialsPath:Y,fetchImpl:k0($.proxy)});return h9($,G,H,Q,Z.enroll)}import{spawn as XK}from"child_process";import{existsSync as YK,readFileSync as GK,unlinkSync as BK}from"fs";import{join as KK}from"path";var VK=120,HK=15,NK=5000;function Z4($={}){let J=$.stateDirectory?KK($.stateDirectory,UK):null;if(J)qK(J);let Z=["/bin/bash","/usr/bin/bash"].find((V)=>YK(V));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??VK)),X=$.pid??process.pid,Y=Math.min(HK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${e7(r)} > ${e7(J)} 2>/dev/null
+`:"",H=(V)=>`[ $((SECONDS - started)) -ge ${Math.max(1,V-1)} ]`,K=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
+while :; do started=$SECONDS
+IFS= read -r -t ${Q} pulse && continue
+${H(Q)} && parent_is_worker || exit 0
+started=$SECONDS
+IFS= read -r -t ${Y} pulse && continue
+if ${H(Y)} && parent_is_worker; then
+  echo "Reason: worker_event_loop_stalled; no progress for ${Q+Y}s, restarting the worker." >&2
+  ${G}kill -KILL ${X}
+fi
+exit 0
+done`,N=XK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
+`),Math.min(NK,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var UK="worker-stalled";function e7($){return`'${$.replaceAll("'","'\\''")}'`}function qK($){let J;try{J=GK($,"utf8"),BK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{v$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var LK=`Share this computer as a machine
+Usage:
+  reason serve                     This computer, signed in (machine name: its hostname)
+  reason serve --token rmt_\u2026       Any server, no login: the token names the machine
+  reason serve NAME [--dir PATH] [--once] [--sandbox] [--yes]
+  reason serve [NAME | --token rmt_\u2026] [--dir PATH] --service
+  reason serve NAME --stop [--json]  (same as: reason stop NAME)
+Adds this computer as a worker of a machine and waits for sessions. Start one
+from anywhere with: reason "fix the flaky test" --on NAME
+(To run one session here yourself, run \`reason "PROMPT"\` in the folder; it
+needs no machine and serves only while that command runs.)
+Sessions queue on the machine until one of its workers is free. Run
+\`reason serve\` on more computers, or in more folders, to add workers.
+Signed in, the machine is created if it doesn't exist (owners and admins).
+Without a login, use a token from \`reason machines token NAME\`: --token, or
+REASON_TOKEN. The token is used once to join and is never saved. Reconnect
+later with \`reason serve NAME\` or the same command. Press Ctrl-C to stop.
+With --service (macOS and Linux), this computer joins in the foreground, then
+keeps the worker running in the background: it starts again at login (Linux:
+at boot, when user lingering is allowed) and restarts if it fails. The service
+runs \`reason serve NAME --dir PATH\` with this worker's saved identity; the
+token is never saved. \`reason stop NAME\` stops and removes it.
+Options:
+  --dir PATH   Folder sessions work in (default: the current directory)
+  --once       Keep the worker only while this command runs; nothing is saved
+  --sandbox    Run confined. Sandboxed machines can't host sessions yet.
+  --yes        Accept the first-run confirmation (required without a terminal;
+               a token already carries it)
+  --service    Keep this worker running as a background service (see above)
+  --stop       Stop this computer's running workers for NAME and remove
+               their background services. They stay in Reason and can
+               start again; \`reason disconnect NAME\` removes them.
+Sessions run commands in the folder with the permissions of the user who runs
+the worker unless --sandbox is set. Settings live in
+~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
+folder served for NAME is its own worker. Use
+\`reason worker status|revoke --config <that file>\` for advanced control.
+`,DK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,jK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,QJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",$J=["REASON_TOKEN","REASON_MACHINE_TOKEN"],XJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&g$(J)&&J!==w2?J:XJ}class Q0 extends Error{}function zK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let V=$[N+1];if(!V||V.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,V),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!g$(Z)&&!DK.test(Z))throw new Q0(QJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,H=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(H!==void 0&&!jK.test(H))throw new Q0("--org must be a workspace id.")}else if(H!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...H===void 0?{}:{org:H.toLowerCase()}}}function G4($,J){let Z=WK($,J??"."),Q;try{Q=ZJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!_K(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var Q4=($)=>n1($,".reason","workers"),c3=($)=>u(d($).state);function OK($,J,Z){let Q=n1(Q4($),J);if(C0(n1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return n1(Q4($),`${J}@${MK("sha256").update(Z).digest("hex").slice(0,8)}`)}function YJ($){let{stateDirectory:J}=$;if(B2($.workspaceRoot,J)||B2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function C0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function AK($,J){$.stdout.write(`${J} [y/N] `);let Z=await j9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function B4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var RK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function GJ($){try{return await $()}catch(J){let Z=J instanceof G0?RK[J.code]:void 0;throw Z?Error(Z):J}}async function CK($,J,Z,Q){let X=YJ({...J,name:$.name??XJ,stateDirectory:n1(Q4(Z),".token-enrollment")}),Y=A1(X,{stored:!1}),G=await GJ(()=>R9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!g$(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let H=!1;return{name:$.name??G.machine_name,input:(K)=>{if(H)throw Error("worker_ticket_receipt_mismatch");return H=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function IK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??O1)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((H)=>new H1(H)))(Y);return f9(X,Y,{createHeadlessDeviceEnrollmentTicket:(H)=>GJ(async()=>{try{return await G.createMachineEnrollmentTicket($,H)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
+`)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,H)})})}}async function BJ($,J,Z,Q){let X=await f2($,Q,()=>JJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!_1($,J,Z))return null;return c4($),X}function i3($,J){let Z=Q4($);if(!u(Z))return[];let Q=J.toLowerCase();return TK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=n1(Z,X,"worker.json"),H=C0(G);return H?[{path:G,config:H}]:[]})}async function PK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??H0,H=[];for(let K of Y){let N=await G(K.config,"stop")!==null,q=Y4(K.config,X),V=N||q!==null;if(H.push({config:K.path,folder:K.config.workspaceRoot,running:V,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
+`);if(!$.json)Z.stdout.write(V?`Stopping machine "${$.name}" in ${K.config.workspaceRoot}; current work finishes first.
+`:`Machine "${$.name}" in ${K.config.workspaceRoot} is not running.
+`)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:H})}
+`);return 0}async function KJ($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??M1,X=J.env??process.env,Y=$J.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of $J)delete process.env[G];try{let G=zK($,Y);if(!G)return Z.stdout.write(LK),0;let H=ZJ(J.home??V0()),K=J.serviceHost??K1(H);if(G.stop)return await PK({...G,name:G.name},H,Z,J,K);let N=J.channel??P0(),q=G4(J.cwd??process.cwd(),G.dir),V=G.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:G.once,sandbox:G.sandbox},M=G.token?await CK({...G,token:G.token},U,H,J):void 0,T=M?.name??G.name??a3((J.hostname??FK)()),_=OK(H,T,q),D=n1(_,"worker.json"),j=C0(D);if(M&&j&&c3(j)&&$0(j).revoked)f0(j);let z=!M&&j!==null&&c3(j)&&(!b0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=YJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
+Run it with: reason serve ${T} ${s3(j)}
+Or remove it first: reason worker revoke --config ${D}`)}let W=F.lifetime==="persistent"?D$(F,K):null;if(W&&!G.service&&X[a1]!==W.label)return Z.stdout.write(`Machine "${T}" in ${q} already runs as a background service (${W.label}).
+  Logs: ${W.logs}
+  Stop it with: reason stop ${T}
+`),0;if(G.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!g$(T))throw new Q0(QJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
+`);else if(L&&!G.yes&&!M){let R=`Sessions on "${T}" will run commands in ${q} with your user permissions (no sandbox). Continue?`,I=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!I)throw new Q0(`${R.replace(/ Continue\?$/,"")}
+Re-run with --yes to confirm.`);if(!await(J.confirm??((E)=>AK(Z,E)))(R))return Z.stderr.write(`Cancelled. Nothing was added.
+`),1}if(!O)e(F.stateDirectory,!0),c(D,F);let C={...J.worker,enrollmentInput:IK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
+`);let I=await Q(["enroll","--config",D],{...C,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(I!==0)return I}if(V){let R;try{R=X4({config:F,launcher:V,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(I){if(!(I instanceof T1))throw I;throw new Q0(`${I.message}
+This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${s3(F)}
+Or try the background service again with: reason serve ${T} ${s3(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${q}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${R.label} (starts at ${R.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${R.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...R.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
+`)),0}Z.stdout.write([`Reason machine "${T}"`,`  Folder:   ${q}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Lifetime: ${F.lifetime==="persistent"?`saved; run \`reason serve ${T}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
+`));let P=W&&X[a1]===W.label&&!J.runWorker?Z4({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",D],{...C,io:{stdout:Z.stdout,stderr:B4(Z.stderr)},onStartup:(R)=>{if(R==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
+`);J.worker?.onStartup?.(R)}})}finally{P?.stop()}}catch(G){if(G instanceof Q0||G instanceof T1){let N=G instanceof T1&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
+`),2}let H=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:null,K=H?G$(H):void 0;return Z.stderr.write(`Reason: ${H?K?`${K} (${H})`:H:"could not prepare this machine."}
+`),1}}var xK=200;var mL=B.strictObject({version:B.literal(1),session_ids:B.array(B.string().min(1).max(200)).max(xK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as VJ}from"child_process";import{readFileSync as EK,rmdirSync as SK,rmSync as wK}from"fs";import{join as n3}from"path";var bK=["Reason.app","Ara Sidecar.app","Ara Device.app"],kK="sidecar_retire_failed";function yK($){return n3($,"Library","Application Support","Ara","Sidecar")}function fK($){try{let J=EK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function NJ($,J={}){let Z=yK($),Q=bK.map((H)=>n3(Z,H)).filter(fK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>VJ("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((H)=>process.kill(H,"SIGTERM")),G=J.command??((H,K)=>VJ(H,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let H of X().split(`
+`)){let K=H.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let H of Q)G(HJ,["-u",H]),wK(H,{recursive:!0,force:!0});try{SK(Z)}catch{}}catch{return{status:"failed",code:kK}}return{status:"removed",bundles:Q}}var dK=`Connect this computer to Reason
+Usage:
+  reason connect                 Your computer, kept connected in the background
+  reason connect --to NAME       Add it to team machine NAME (as reason serve NAME --service)
+  reason connect --token rmt_\u2026   Join a machine with no login (as reason serve --token \u2026 --service)
+  reason connect --once          Only while this command runs; nothing is saved
+  reason connect --api-key KEY   Without reason login: a headless box, with an API key that has
+                                 devices:write (or set REASON_API_KEY, which keeps it out of ps).
+                                 The connection keeps the key to renew itself (macOS: Keychain).
+  reason disconnect [NAME]       Stop and remove it (NAME: this computer's workers for machine NAME);
+                                 it stays disconnected until you run reason connect
+Settings, saved; run reason connect again to change them:
+  --folder PATH                  Where Sessions may run (yours: your home folder; a machine: the current folder)
+  --sessions N                   Sessions at once, 1-4 (yours: 4; a machine: 1)
+  --name NAME                    This computer's name in Reason (default: its hostname)
+  --api-url URL                  The Reason API to connect to (as REASON_API_URL)
+  --proxy URL                    Reach Reason through this proxy (HTTPS_PROXY is not used)
+  --proxy-ca-file PATH           The proxy's PEM CA bundle
+  --user-chrome on|off           Your Sessions may use your own Chrome and its signed-in profiles
+                                 (macOS, through the Reason extension; on by default)
+  --cloud-sessions on|off        No longer needed: Reason does not read it
+  --minimal                      Keep this computer minimal: files, shell and terminal, no desktop,
+                                 computer use or browser use (reason desktop install adds them)
+  --local-logins on|off          Your Sessions run on the Claude Code, Codex and Grok logins
+                                 on this computer (on by default; off with an API key).
+                                 Reason gets each login's current access token, never
+                                 its refresh token.
+  --keep-awake on|off            macOS: keep this Mac awake while it runs Sessions (default on).
+                                 Applies at once, without reconnecting.
+  --add-folder PATH              Let Sessions run in another folder too, on the same computer in
+  --remove-folder PATH           Reason; or stop that. Applies at once; running Sessions in other
+                                 folders keep running. \`reason status --json\` lists the folders.
+Your computer is Personal: it needs no machine and no admin role, and only you
+start Sessions on it until you make it Team in Settings \u203A Computers. They run commands
+with your user permissions (there is no sandbox mode). It starts again at login (Linux:
+at boot, when lingering is allowed), restarts if it fails, and \`reason update\`
+restarts it on the new version. \`reason status\` shows it.
+It is connected in the workspace you signed in to. It is also connected, by
+itself, in up to 8 other workspaces you belong to, as each one's own computer,
+when this computer was signed in with the setup command Reason shows you (it
+ends in --pair CODE, a one-time code from your signed-in Reason) or by the
+Reason app, and was connected after that. Signed in with \`reason login\`
+alone, or connected with --api-key or --once, it stays in the one workspace:
+run the setup command from Reason here, then \`reason disconnect\` and
+\`reason connect\` if it was connected before. One sign-in covers one computer;
+a second computer needs its own. \`reason status\` says when this applies.
+One computer serves several Reason accounts. Signed in as another account than
+the one it is connected for, reason connect connects it for that account too,
+as that account's own computer in the workspace it signed in to; the other
+accounts stay connected. That account's \`reason logout\` removes only its own.
+`,lK=`Disconnect this computer from Reason
+Usage:
+  reason disconnect              Stop your computer's connection and remove it from Reason, in every
+                                 workspace and for every Reason account it is connected for. It stays
+                                 disconnected (reason "\u2026" won't connect it) until you run reason connect
+  reason disconnect NAME         Stop this computer's workers for machine NAME and remove them from Reason
+  --account                      Only the signed-in account's computer leaves Reason (all of it when it is
+                                 the only account here); it stays disconnected for that account until
+                                 its reason connect (the Reason app's Disconnect)
+  --temporary                    The Reason app's sign-out: only the signed-in account's computer leaves
+                                 Reason (all of it when it is the only account here), and it is not kept
+                                 disconnected: the next reason "\u2026" connects it again
+  --yes, -y                      Accepted for scripts; disconnect never asks
+`;class p extends Error{}var pK=4,H4={write:()=>!0};function d0($,J,Z=!1){let Q=PJ($,J,Z);return Q.length===1?Q[0]:F0(U2(F0($,".config")),...IJ(J,Z))}var IJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function PJ($,J,Z=!1){let Q=$;try{Q=V1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...IJ(J,Z))).filter(cK)}function cK($){try{if(V1($)!==$)return!1;return C0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var xJ="disconnected.json";function CD($,J){return u(F0(d0($,J),xJ))}function N4($,J,Z){let Q=F0(d0($,J),xJ);if(!Z){z$(Q,{force:!0});return}e(e3(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function sK($){let J=new Map,Z=new Set;for(let V=0;V<$.length;V+=1){let U=$[V];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",K4,V4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[V+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),V+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(V4)&&!J.has(K4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((V)=>V!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((V)=>J.has(V));if(Y.length>0&&(J.size>1||[...Z].some((V)=>V!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let H=J.get("--cloud-sessions");if(H!==void 0&&H!=="on"&&H!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(V,U)=>U===void 0?{}:{[V]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",G===void 0?void 0:G==="on"),...q("cloudSessions",H===void 0?void 0:H==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(K4)),...q("proxyCaFile",J.get(V4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var I1=($)=>u(d($).state),EJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function SJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function aK($){return $===1?"one at a time":`up to ${$} at once`}function wJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=G4($.options.cwd??process.cwd(),J.folder)}catch(H){throw new p(H instanceof Error?H.message:String(H))}if(!x$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!b0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(H){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${H instanceof Error?H.message:String(H)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!_J(X)&&!TJ($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=LJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(H){if(!(H instanceof FJ))throw H;throw new p(H.message)}let G=(Z?.folders??[]).filter((H)=>H!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??gK)()),slots:J.sessions??Z?.slots??pK,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function bJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function $9($,J,Z,Q,X){if($0($).revoked){if(I1($))try{f0($)}catch{}k4($);let Y=[];try{Y=vK(g($))}catch{}for(let G of Y)if(G!=="workspaces")z$(F0(g($),G),{recursive:!0,force:!0})}else if(I1($))f0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??M1)(["enroll","--config",J],{...J9(Q.worker,X),io:{stdout:H4,stderr:Z.stderr}})}function K2($,J,Z){let Q=P$(Z1(b$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function iK($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),G=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},H=null;try{H=C0(Y)}catch{}if(G(H))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let K=await $9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&I1(X))await U4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function J9($,J){return J?{...$,enrollmentCredentials:(Z)=>O4(Z,J)}:{...$}}async function Z9($,J,Z,Q,X,Y="connect"){if(await Q9($,Q,X,Y),Y==="connect"&&!await vJ($,Z,Q))return!1;if(!await U4($,J,Z,Q))return!1;return P9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function U4($,J,Z,Q){if(!I1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??M1)(["revoke","--config",J],{...Q.worker,io:{stdout:H4,stderr:Y?Z.stderr:H4}})===0)return!0;if(Y)return!1;await new Promise((H)=>setTimeout(H,1000))}}async function Q9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,G=async()=>Y($,"status").catch(()=>null),H=await Y($,"stop").catch(()=>null)!==null,K=!X&&Y4($,Z,Q);if(H||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((q)=>setTimeout(q,250))}}function X9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...X9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${SJ($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
+`)}function t3($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${aK(J.slots)}`,`  Mode:      ${SJ(J)}`,...J.proxy?[`  Proxy:     ${WJ(J.proxy)}`]:[],...X9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
+`)}async function UJ($,J,Z){let{io:Q,options:X}=Z;if(PJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:e3(J),timestamp:new Date().toISOString()})}
+`);let Y=E2(F0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
+`);f3(Z.home,Z.host.platform);let G=C8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(U)=>Q.stderr.write(`${U}
+`),host:Z.host}),H=W8({...G,log:(U)=>Q.stderr.write(`${U}
+`)}),{configPath:K}=H,N=H.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let q=(U,M)=>{let T=M4(Z.home,Z.channel),_;try{let j=null;try{j=M.keep?null:t(N)?.orgId.toLowerCase()??null}catch{}if(_=O2(N,{prefer:K2(Z.home,Z.channel,N),...M}),_&&j)z2(_,j)}finally{T()}if(!_)return!1;N=_;let D="";try{D=` (workspace ${t(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${U}; this computer goes on running Sessions for its other Reason account${D}.
+`),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=p0(N.stateDirectory)??void 0,M=U?null:K2(Z.home,Z.channel,N);if(!U&&!(M&&y$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let V=N.executionMode==="confined";if(V||!j$(N)){let U=p0(N.stateDirectory)??void 0;if(Q.stderr.write(V?EJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
+`),await $9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=p0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Z4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??M1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return N4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function nK($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:H}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=d0(Y,G,!0),N=wJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:H}),q=bJ(N,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),V=F0(K,"worker.json");return e(K,!0),c(V,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M1)(["start","--config",V],{...J9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:B4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
+`);X.worker?.onStartup?.(U)}})}function rK($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),E8(d(J).daemon,$);let X=S2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
+`),0}var tK=B.object({root:B.object({id:B.string().min(1).max(160),label:B.string().max(160),path_fingerprint:B.string()})});async function kJ($,J,Z,Q){let X=await(J9(Q.worker,Z).enrollmentCredentials??O1)($,z1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new H1(X,{credentialsPath:z1($),fetchImpl:k0($.proxy)}),G=(H)=>H instanceof G0&&H.status===404&&!["device_not_found","root_not_found"].includes(H.code);return{add:async(H)=>{let K=v9($,H,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((V)=>{if(G(V))throw Error("worker_folders_unavailable");if(V instanceof G0&&V.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw V}),q=tK.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(H)=>{await Y.removeDeviceRoot(J.deviceId,H).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function yJ($,J,Z){m0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:T0($)})}async function fJ($,J,Z,Q){let{io:X,options:Y,host:G}=Q,H=J&&!Q.apiKey&&p0(J.stateDirectory)===null?K2(Q.home,Q.channel,J):null,K=J&&H&&I1(J)&&!y$(J,H)?h0(J).find((R)=>R.account&&R.organizationId===H)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,V=N&&I1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!V||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=G4(T,M)}catch(R){if(U)throw new p(R instanceof Error?R.message:String(R));_=uK(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=V.roots.slice(1).find((R)=>R.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!x$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??p0(N.stateDirectory)??void 0,F=await kJ(N,V,z,Y),O=V.roots.filter((R)=>R.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);yJ(N,V,O);let W=U?[...D.filter((R)=>R!==_),_]:D.filter((R)=>R!==_),{folders:L,...C}=N;if(c(q,J0.parse({...C,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))_1(J,G,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
+`:`Removed ${_}. Sessions on "${N.name}" no longer run in it.
+`),0}async function ID($,J,Z){let Q=o3(Z),X=M4(Q.home,Q.channel);try{let Y=F0(d0(Q.home,Q.channel),"worker.json");return await fJ({once:!1,yes:J,addFolder:$},C0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=V1($.home??V0()),Q=$.env??process.env;return{io:$.io??q4(),options:$,home:Z,channel:$.channel??P0(),environment:Q,apiKey:J??j4(Q),host:$.serviceHost??K1(Z)}}async function oK($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await kJ($,X,Z,Q),H=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[H,...Y.slice(1).filter((K)=>K.id!==H.id)]}yJ(J,X,Y)}var hJ=Symbol("serve here");async function eK($,J,Z,Q){let{io:X,options:Y,home:G,channel:H,environment:K,host:N}=Q;if(N.platform==="darwin"){let E=NJ(G);if(E.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${E.code}).
+`)}let q=J&&!Q.apiKey&&p0(J.stateDirectory)===null?K2(G,H,J):null,V=J&&q&&$0(J).revoked&&h0(J).some((E)=>E.account&&E.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=wJ({parsed:$,saved:V,stateDirectory:d0(G,H),lifetime:"persistent",home:G,channel:H,options:Y,environment:K});if(N4(G,H,!1),V?.executionMode==="confined")X.stdout.write(EJ);let M=V?p0(V.stateDirectory):null,T=bJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=V!==null&&I1(V),j=D&&U0(V)===U0(T),z=j&&j$(T),F=V?.userChrome!==!1===(T.userChrome!==!1)&&V?.cloudSessions===T.cloudSessions&&V?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(V).revoked&&!y$(V,q);if(W){if(!j||!F||JSON.stringify(V.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let E=await iK(V,q,X,Y);if(E!==0)return E}let L=W?[`  Account:   yours too, in workspace ${q}, beside this computer's other Reason account`]:[],C=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await O4(T,$.apiKey),z4(T.stateDirectory,$.apiKey)};if(z&&JSON.stringify(V?.proxy)===JSON.stringify(T.proxy)&&F&&D$(T,N,"connect")?.label===jJ(T.channel)&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)&&[null,r].includes(u$(T))){await C();let E=OJ(T,N,"connect");if(E==="retired"){let w=await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!w||w.phase==="stopping")_1(T,N,"connect")}else if(E==="current_not_running")_1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let P=!z&&!W;if(D&&!j)if(V.apiOrigin!==T.apiOrigin||V.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),!await Z9(V,Z,X,Y,N))throw new p("Could not remove this computer's previous connection from Reason. Check your network and try again.")}else if(V.executionMode==="host"&&j$(V))X.stdout.write(`Applying the new settings to this computer\u2026
+`),await oK(V,T,O,Y),P=!1;else await Q9(V,Y,N);if(P){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
+`);let E=await $9(T,Z,X,Y,O);if(E!==0)return E;if(O)z4(T.stateDirectory,O)}else c(Z,T),await C();let R;try{R=X4({config:T,launcher:_,path:K.PATH||"/usr/local/bin:/usr/bin:/bin",host:N,kind:"connect"})}catch(E){if(!(E instanceof T1))throw E;if(E.code!=="worker_service_manager_missing")throw new p(`${E.message}
+This computer is set up; run reason connect again to start it.`);if(Y.serveHere&&K.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
+`),hJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await $V(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new T1(`${E.message}
+This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,E.code)}let I=[...L,...R.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...R.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${R.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,I):t3("This computer is connected to Reason",T,N.platform,[`  Service:   ${R.label} (starts at ${R.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${R.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...I])),0}async function $V($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??mJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((H)=>setTimeout(H,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function mJ($,J,Z){let Q=CJ(Z,"a",384);try{let X=AJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{RJ(Q)}}async function vJ($,J,Z,Q=!1){let X=!0;for(let Y of h0($)){if(Q&&Y.account)continue;if(Y.config&&I1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??M1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:H4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function q4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function Y9($,J){if($ instanceof p||$ instanceof T1){let X=$ instanceof T1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
+`),2}let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:null,Q=Z?G$(Z):void 0;return J.stderr.write(`Reason: ${Z?Q?`${Q} (${Z})`:Z:"could not connect this computer."}
+`),1}function qJ($,J){if($.minimal){uJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||dJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??MJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
+`);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
+`);let Q=(J.options.installDesktop??MJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
+`)}function MJ($,J,Z){if(!Z)return hK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;mK(e3(Z.log),{recursive:!0,mode:448});let Q=CJ(Z.log,"w",384);try{let X=AJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{RJ(Q)}return 0}async function PD($,J={}){let Z=J.io??q4();try{let Q=sK($);if(!Q)return Z.stdout.write(dK),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return qJ(Q,o3(J)),await(J.runServe??KJ)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let H=zJ(G[a1],Y),K=H||Q.once?()=>{return}:M4(X.home,Y);try{let N=F0(d0(X.home,Y),"worker.json"),q=C0(N);if(H)return await UJ(q,N,X);if(Q.keepAwake!==void 0)return rK(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await fJ(Q,q,N,X);if(qJ(Q,X),Q.once)return await nK(Q,q,X);let V=await eK(Q,q,N,X);if(V!==hJ)return V;return K(),K=()=>{return},await UJ(C0(N),N,X)}finally{K()}}catch(Q){return Y9(Q,Z)}}async function xD($,J={}){let Z=J.io??q4();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(lK),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await QV(Q[0],Z,J);return await gJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return Y9(Q,Z)}}async function ED($={}){let J=$.io??q4();try{return await gJ(J,$,"logout")}catch(Z){return Y9(Z,J)}}async function gJ($,J,Z){let Q=V1(J.home??V0()),X=J.channel??P0(),Y=M4(Q,X);try{return await JV($,J,Z,Q,X)}finally{Y()}}function M4($,J){let Z=d0($,J),Q=u(Z)?X$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function JV($,J,Z,Q,X){let Y=F0(d0(Q,X),"worker.json"),G=C0(Y);if(!G){if(Z==="disconnect")N4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(Z!=="disconnect"){let K=await ZV(G,Y,$,J,Z,Q,X);if(K!==null)return K}let H=!1;try{H=await Z9(G,Y,$,J,J.serviceHost??K1(Q))}finally{if(Z!=="temporary")N4(Q,X,!0)}if(!H)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`),1;return $.stdout.write(`Disconnected "${G.name}". It no longer runs Sessions; run reason connect to connect it again.
+`),0}async function ZV($,J,Z,Q,X,Y,G){let H=h0($).filter((D)=>D.account);if(H.length===0)return null;let K=K2(Y,G,$),N=Q.controlWorker??H0,q=H.find((D)=>D.organizationId===K);if(q){if(q.config&&!await U4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),1;if(X!=="account"||!q.config)z$(q.directory,{recursive:!0,force:!0});return await N($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${K} for your account. It stays connected for its other Reason accounts.
+`),0}if(!K&&X==="account")throw new p("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!K||!y$($,K)){if(X==="account"&&K)z2($,K);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
+`);return 0}let V=Q.serviceHost??K1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await Q9($,Q,V,"connect",!0),!await vJ($,Z,Q,!0)||!await U4($,J,Z,Q))return _1($,V,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`),1;let M=O2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&U)z2(M,U);let T=_1(M,V,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
+`),0}async function QV($,J,Z){let Q=V1(Z.home??V0()),X=Z.serviceHost??K1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let H of Y)if(await Z9(H.config,H.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${H.config.workspaceRoot}.
+`);else G=!0,J.stderr.write(`Reason: machine "${$}" in ${H.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
+`);return G?1:0}async function SD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=await($.controlWorker??H0)(Z,"status").catch(()=>null),X=Q?u$(Z):null,Y=$.serviceHost??K1(J),G=D$(Z,Y,"connect"),H=$0(Z).revoked,K=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:N,off:q}=H||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:s9(Z,Q?.phase==="running");return{workspaces:N,workspaces_off:q,workspaces_max:L2+(N?.filter((V)=>V.account).length??0),name:Z.name,device_id:K?.deviceId??null,organization_id:K?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:X9(Z,Y.platform),cloud_sessions:Z.cloudSessions===!0,root:K?.roots[0]?{id:K.roots[0].id,permissions:K.roots[0].permissions}:null,roots:K?.roots.map((V)=>({id:V.id,folder:V.path,permissions:V.permissions}))??[],state:H?"removed":Q?Q.phase==="running"?"connected":Q.phase:"not_running",sessions_running:Q?.activeSessions??null,version:X,service:G?{label:G.label,logs:G.logs}:null}}async function wD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=C0(F0(d0(V1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?DJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function bD($={}){try{let J=V1($.home??V0());return C0(F0(d0(J,$.channel??P0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function kD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;return _1(Z,$.serviceHost??K1(J),"connect")?.label??null}async function yD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??K1(J),X=await BJ(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return XV(Z,Q,$)}async function XV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&u$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let H=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<H&&await Q($,"status").catch(()=>null)!==null)await new Promise((V)=>setTimeout(V,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??mJ)(G,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
+export{Z1 as a,H1 as b,C9 as c,d,S2 as e,C0 as f,dK as g,lK as h,d0 as i,CD as j,ID as k,PD as l,xD as m,ED as n,SD as o,wD as p,bD as q,kD as r,yD as s};