@reason-machines/cli-linux-arm64-musl 0.2.277 → 0.2.279

package/bin/vm-hands/vm-hands-entry-lite-c2nrar90.js

@@ -0,0 +1,4046 @@
+// @bun
+import{Vb as i,Wb as l,Xb as g,Yb as y}from"./vm-hands-entry-lite-n07kxrd1.js";import{Af as I,Cf as O,ff as Q,gf as J,hf as z,if as Z,jf as K,kf as $,lf as k,nf as G,pf as X,qf as M,rf as Y,sf as H,tf as V,vf as S,wf as _,yf as P,zf as C}from"./vm-hands-entry-lite-ptmqg51y.js";import{lh as L,mh as W,nh as F,oh as j}from"./vm-hands-entry-lite-84aq8d12.js";var d=["cgroup_membership_read_failed","cgroup_v2_membership_absent","cgroup_scope_invalid","cgroup_root_unavailable","cgroup_directory_unavailable","cgroup_limit_read_failed","cgroup_events_read_failed","cgroup_current_read_failed","cgroup_stat_read_failed","boot_id_read_failed","boot_id_invalid","guest_meminfo_read_failed","guest_vmstat_read_failed","memory_counter_invalid","memory_field_missing","memory_capacity_invalid"];var a=String.raw`(function(fs, path) {
+  const fail = (message, reasonCode) => { throw Object.assign(Error(message), {reasonCode}); };
+  const read = (p, reasonCode, trim=true) => { try { const text=fs.readFileSync(p, "utf8"); return trim?text.trim():text; }
+    catch { fail("memory_read", reasonCode); } };
+  const checkPath = (p, reasonCode) => { let resolved; try { resolved=fs.realpathSync(p); }
+    catch { fail("memory_scope", reasonCode); }
+    if(resolved!==p) fail("memory_scope", "cgroup_scope_invalid"); };
+  const number = v => { if (!/^\d+$/.test(v)) fail("memory_count", "memory_counter_invalid"); const n=Number(v);
+    if (!Number.isSafeInteger(n)) fail("memory_count", "memory_counter_invalid"); return n; };
+  const field = (text, key) => { const row=text.split("\n").find(line=>line.split(/\s+/)[0]===key);
+    if (!row) fail("memory_field", "memory_field_missing"); return number(row.trim().split(/\s+/)[1]); };
+  const membership=read("/proc/self/cgroup", "cgroup_membership_read_failed", false);
+  const bareGuest=membership==="";
+  let p=bareGuest?null:/^0::([^\n]+)\n?$/.exec(membership)?.[1];
+  if (!bareGuest && !p) fail("memory_scope", "cgroup_v2_membership_absent");
+  if (p && (!/^\/(?:[A-Za-z0-9_.:@-]+\/?)*$/.test(p) || p.split("/").includes(".."))) fail("memory_scope", "cgroup_scope_invalid");
+  if (bareGuest) {
+    // Empty membership alone is not proof of a whole VM. Require a complete,
+    // bounded kernel mount table with no cgroup hierarchy before using /proc.
+    // Reuse the qualified diagnostic enum so rolling clients keep parsing it.
+    const rawMounts=read("/proc/self/mountinfo", "cgroup_v2_membership_absent", false);
+    const refuse=()=>fail("memory_scope", "cgroup_v2_membership_absent");
+    if(!rawMounts || rawMounts.length>262144 || Buffer.byteLength(rawMounts,"utf8")>262144) refuse();
+    // A kernel table may end in one LF; never erase malformed whitespace rows.
+    const mounts=rawMounts.endsWith("\n")?rawMounts.slice(0,-1):rawMounts;
+    const rows=mounts.split("\n"); if(rows.length>4096) refuse();
+    const mountIds=new Set();
+    const id=v=>/^\d+$/.test(v)&&Number.isSafeInteger(Number(v))&&Number(v)>0;
+    const device=v=>/^\d+:\d+$/.test(v)&&v.split(":").every(n=>Number.isSafeInteger(Number(n)));
+    for(const row of rows) {
+      if(row.length>8192 || Buffer.byteLength(row,"utf8")>8192) refuse();
+      const fields=row.split(" "), separator=fields.indexOf("-");
+      if(fields.some(v=>!v||/\s/.test(v)) || separator<6 || fields.lastIndexOf("-")!==separator || fields.length!==separator+4
+        || !id(fields[0]) || !id(fields[1]) || !device(fields[2])
+        || !fields[3].startsWith("/") || !fields[4].startsWith("/")
+        || fields[5].split(",").some(v=>!v) || fields[separator+3].split(",").some(v=>!v)
+        || !/^[A-Za-z0-9_.+-]+$/.test(fields[separator+1])
+        || fields.slice(6,separator).some(v=>! /^[a-z][a-z0-9_]*(?::\d+)?$/.test(v))) refuse();
+      if(mountIds.has(Number(fields[0]))) refuse(); mountIds.add(Number(fields[0]));
+      if(fields[separator+1]==="cgroup" || fields[separator+1]==="cgroup2") refuse();
+    }
+  }
+  const root="/sys/fs/cgroup"; let selected=null;
+  const readCgroup = (p, reasonCode) => { checkPath(p, reasonCode); return read(p, reasonCode); };
+  if (!bareGuest) {
+    checkPath(root, "cgroup_root_unavailable");
+    for (let depth=0; depth<128; depth++) {
+      const dir=root+(p==="/"?"":p);
+      checkPath(dir, "cgroup_directory_unavailable");
+      if (fs.existsSync(dir+"/memory.events") && fs.existsSync(dir+"/memory.max")) {
+        const limit=readCgroup(dir+"/memory.max", "cgroup_limit_read_failed"); if(limit!=="max") selected={dir,limit:number(limit)};
+      }
+      if(p==="/") break;
+      p=path.posix.dirname(p); if(depth===127) fail("memory_scope", "cgroup_scope_invalid");
+    }
+  }
+  const bootId=read("/proc/sys/kernel/random/boot_id", "boot_id_read_failed");
+  if(!UUID_RE.test(bootId)) fail("memory_boot", "boot_id_invalid");
+  if(selected) return {bootId,oomKills:field(readCgroup(selected.dir+"/memory.events", "cgroup_events_read_failed"),"oom_kill"),
+    currentBytes:number(readCgroup(selected.dir+"/memory.current", "cgroup_current_read_failed")),limitBytes:selected.limit,
+    inactiveFileBytes:field(readCgroup(selected.dir+"/memory.stat", "cgroup_stat_read_failed"),"inactive_file"),capacitySource:"cgroup",memoryScope:selected.dir};
+  const info=read("/proc/meminfo", "guest_meminfo_read_failed"); const limitBytes=field(info,"MemTotal:")*1024,available=field(info,"MemAvailable:")*1024;
+  if(!Number.isSafeInteger(limitBytes)||limitBytes<=0||!Number.isSafeInteger(available)||available>limitBytes) fail("memory_capacity", "memory_capacity_invalid");
+  return {bootId,oomKills:field(read("/proc/vmstat", "guest_vmstat_read_failed"),"oom_kill"),currentBytes:limitBytes-available,
+    limitBytes,inactiveFileBytes:0,capacitySource:"guest",memoryScope:"/proc"};
+})`;var r=(t)=>t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(e)=>`[${e.toLowerCase()}${e.toUpperCase()}]`),U=[...i.map((t)=>`/(${t.map(r).join("/")})(/|$)`),...l.map((t)=>`/(${t.map(r).join("/")})(/|$)`),...[...g].map((t)=>`/(${r(t)})$`),`/${r(".env.")}[^/]*$`,...y.map((t)=>`/[^/]*${r(t)}$`)],n=`function localGithubSandboxProfile(root, temporary) {
+  return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
+    '(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
+    '(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',
+    '(allow file-read* (subpath "/opt/homebrew/Cellar") (subpath "/opt/homebrew/opt") (subpath "/opt/homebrew/bin") (subpath "/opt/homebrew/lib") (subpath "/opt/homebrew/share") (subpath "/opt/homebrew/include") (subpath "/usr/local/Cellar") (subpath "/usr/local/opt") (subpath "/usr/local/bin") (subpath "/usr/local/lib") (subpath "/usr/local/share") (subpath "/usr/local/include") (subpath "/Library/Developer/CommandLineTools"))',
+    '(allow file-read* file-write* (subpath '+JSON.stringify(root)+') (subpath '+JSON.stringify(temporary)+'))',
+    '(allow file-read-metadata (path-ancestors '+JSON.stringify(root)+') (path-ancestors '+JSON.stringify(temporary)+'))',
+    '(deny file-read* file-write* (subpath "/opt/homebrew/etc") (subpath "/usr/local/etc") (literal "/private/etc/master.passwd"))',
+    '(deny file-write* (subpath "/opt/homebrew") (subpath "/usr/local") (subpath "/Library/Developer") (subpath "/cores"))',
+    ...${JSON.stringify(U)}.map(pattern => '(deny file-read* file-write* (regex #"'+pattern+'"))'),
+    '(deny network*)','(deny mach-lookup)','(deny process-info*)','(allow process-info* (target same-sandbox))','(allow process-info-listpids)','(allow file-read-metadata (subpath "/dev"))','(deny signal)','(allow signal (target same-sandbox))'].join('\\n');
+}`,h="/opt/homebrew/bin:/usr/local/bin:/Library/Developer/CommandLineTools/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin";function qt(t,e){return Function("return ("+n+")")()(t,e)+`
+(allow network-bind network-inbound (local tcp "localhost:*"))`}var x=String.raw`import os,sys,json,stat,fcntl,time,ctypes
+v=json.load(sys.stdin)
+root=v['root']; paths=list(dict.fromkeys([v['source'],v['snapshot']]))
+marker=('# reason-job-env-owner:'+v['runId']+'\n').encode()
+fds=[];parents=[]
+try:
+ if os.path.realpath(root)!=root:raise ValueError('root')
+ rootfd=os.open(root,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW)
+ try:
+  r=os.fstat(rootfd)
+  if not stat.S_ISDIR(r.st_mode):raise ValueError('root')
+  for p in paths:
+   parent=os.path.dirname(p)
+   if os.path.realpath(parent)!=parent:raise ValueError('parent')
+   pfd=os.open(parent,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW);parents.append((parent,pfd))
+   ps=os.fstat(pfd);pn=os.stat(parent,follow_symlinks=False)
+   if ps.st_uid!=os.geteuid() or stat.S_IMODE(ps.st_mode)&0o022 or (ps.st_dev,ps.st_ino)!=(pn.st_dev,pn.st_ino):raise ValueError('parent')
+   fd=os.open(os.path.basename(p),os.O_RDWR|os.O_NOFOLLOW|os.O_NONBLOCK,dir_fd=pfd);fds.append((p,fd))
+   s=os.fstat(fd)
+   if not stat.S_ISREG(s.st_mode) or s.st_nlink!=1 or s.st_uid!=os.geteuid() or stat.S_IMODE(s.st_mode)!=0o600:raise ValueError('file')
+   end=time.monotonic()+2
+   while True:
+    try:fcntl.flock(fd,fcntl.LOCK_EX|fcntl.LOCK_NB);break
+    except BlockingIOError:
+     if time.monotonic()>=end:raise ValueError('lock')
+     time.sleep(.02)
+   n=os.stat(p,follow_symlinks=False)
+   if (s.st_dev,s.st_ino)!=(n.st_dev,n.st_ino) or os.pread(fd,len(marker),0)!=marker:raise ValueError('owner')
+  libc=ctypes.CDLL(None,use_errno=True)
+  if libc.syncfs(rootfd)!=0:raise OSError(ctypes.get_errno(),'sync')
+  for parent,pfd in parents:
+   ps=os.fstat(pfd);pn=os.stat(parent,follow_symlinks=False)
+   if (ps.st_dev,ps.st_ino)!=(pn.st_dev,pn.st_ino):raise ValueError('parent_changed')
+  for p,fd in fds:
+   s=os.fstat(fd);n=os.stat(p,follow_symlinks=False)
+   if (s.st_dev,s.st_ino)!=(n.st_dev,n.st_ino):raise ValueError('changed')
+   os.ftruncate(fd,0);os.fsync(fd)
+  if libc.syncfs(rootfd)!=0:raise OSError(ctypes.get_errno(),'sync')
+ finally:os.close(rootfd)
+finally:
+ for _,fd in fds:os.close(fd)
+ for _,pfd in parents:os.close(pfd)
+`;var s=String.raw`function workspaceTarget(requested) {
+  if (typeof requested !== "string" || requested.length < 1 || requested.includes("\0")) {
+    throw new Error("workspace_file_path_invalid");
+  }
+  const root = fs.realpathSync(config.repoPath);
+  const target = path.isAbsolute(requested) ? path.resolve(requested) : path.resolve(root, requested);
+  const relative = path.relative(root, target);
+  if (relative === ".." || relative.startsWith(".." + path.sep) || path.isAbsolute(relative)) {
+    throw new Error("workspace_file_path_invalid");
+  }
+  let cursor = root;
+  for (const part of relative.split(path.sep).filter(Boolean)) {
+    cursor = path.join(cursor, part);
+    if (!fs.existsSync(cursor)) continue;
+    if (fs.lstatSync(cursor).isSymbolicLink()) throw new Error("workspace_file_symlink_rejected");
+  }
+  return { root, target, relative: relative.split(path.sep).join("/") || "." };
+}
+function atomicWrite(target, content) {
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  const temporary = target + ".ara-" + crypto.randomUUID() + ".tmp";
+  try {
+    const mode = fs.existsSync(target) ? fs.statSync(target).mode & 0o777 : 0o644;
+    fs.writeFileSync(temporary, content, { encoding: "utf8", mode });
+    fs.renameSync(temporary, target);
+  } finally {
+    try { fs.unlinkSync(temporary); } catch (error) { void error; }
+  }
+}
+const fileMutationQueues = new Map();
+function withFileMutationQueue(target, operation) {
+  const previous = fileMutationQueues.get(target) || Promise.resolve();
+  const queued = previous.catch(() => {}).then(operation);
+  fileMutationQueues.set(target, queued);
+  return queued.finally(() => {
+    if (fileMutationQueues.get(target) === queued) fileMutationQueues.delete(target);
+  });
+}
+function startsWith(bytes, signature) {
+  return bytes.length >= signature.length
+    && signature.every((byte, index) => bytes[index] === byte);
+}
+function startsWithAscii(bytes, offset, value) {
+  if (bytes.length < offset + value.length) return false;
+  for (let index = 0; index < value.length; index += 1) {
+    if (bytes[offset + index] !== value.charCodeAt(index)) return false;
+  }
+  return true;
+}
+function imageMimeType(bytes) {
+  if (startsWith(bytes, [0xff, 0xd8, 0xff]) && bytes[3] !== 0xf7) return "image/jpeg";
+  if (startsWith(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])) return "image/png";
+  if (startsWithAscii(bytes, 0, "GIF")) return "image/gif";
+  if (startsWithAscii(bytes, 0, "RIFF") && startsWithAscii(bytes, 8, "WEBP")) return "image/webp";
+  if (startsWithAscii(bytes, 0, "BM")) return "image/bmp";
+  return null;
+}
+function linesForCounting(content) {
+  if (content.length === 0) return [];
+  const lines = content.split("\n");
+  if (content.endsWith("\n")) lines.pop();
+  return lines;
+}
+function truncateReadHead(content) {
+  const maxLines = 2000;
+  const maxBytes = 50 * 1024;
+  const lines = linesForCounting(content);
+  const totalBytes = Buffer.byteLength(content, "utf8");
+  if (lines.length <= maxLines && totalBytes <= maxBytes) {
+    return {
+      content,
+      truncated: false,
+      truncatedBy: null,
+      outputLines: lines.length,
+      firstLineExceedsLimit: false,
+    };
+  }
+  const firstLineBytes = Buffer.byteLength(lines[0] || "", "utf8");
+  if (firstLineBytes > maxBytes) {
+    return {
+      content: "",
+      truncated: true,
+      truncatedBy: "bytes",
+      outputLines: 0,
+      firstLineExceedsLimit: true,
+    };
+  }
+  const output = [];
+  let outputBytes = 0;
+  let truncatedBy = "lines";
+  for (let index = 0; index < lines.length && index < maxLines; index += 1) {
+    const line = lines[index];
+    const lineBytes = Buffer.byteLength(line, "utf8") + (index > 0 ? 1 : 0);
+    if (outputBytes + lineBytes > maxBytes) {
+      truncatedBy = "bytes";
+      break;
+    }
+    output.push(line);
+    outputBytes += lineBytes;
+  }
+  return {
+    content: output.join("\n"),
+    truncated: true,
+    truncatedBy,
+    outputLines: output.length,
+    firstLineExceedsLimit: false,
+  };
+}
+function fileOperation(request) {
+  const promise = Promise.resolve().then(async () => {
+    let resolved;
+    try {
+      resolved = workspaceTarget(request.input.path);
+    } catch (error) {
+      return failure(request.id, 1, "command_failed", "", error instanceof Error ? error.message : "workspace_file_failed");
+    }
+    const execute = () => {
+      try {
+      if (request.tool === "read") {
+        if (!fs.existsSync(resolved.target) || !fs.statSync(resolved.target).isFile()) throw new Error("workspace_file_not_found");
+        const bytes = fs.readFileSync(resolved.target);
+        const mimeType = imageMimeType(bytes.subarray(0, 4100));
+        if (mimeType) {
+          const output = JSON.stringify({
+            type: "image",
+            path: resolved.relative,
+            mimeType,
+            data: bytes.toString("base64"),
+          });
+          if (output.length > MAX_OUTPUT_CHARS) throw new Error("workspace_image_too_large");
+          return success(request.id, output, "");
+        }
+        const original = bytes.toString("utf8");
+        const lines = original.split("\n");
+        const start = request.input.offset || 1;
+        const limit = request.input.limit === undefined
+          ? lines.length
+          : request.input.limit;
+        const startIndex = start - 1;
+        if (startIndex >= lines.length) {
+          throw new Error("Offset " + start + " is beyond end of file (" + lines.length + " lines total)");
+        }
+        const selected = lines.slice(startIndex, startIndex + limit);
+        const selectedContent = selected.join("\n");
+        const truncated = truncateReadHead(selectedContent);
+        const hasMore = startIndex + selected.length < lines.length;
+        const end = truncated.truncated
+          ? start + truncated.outputLines - 1
+          : start + selected.length - 1;
+        const output = JSON.stringify({
+          type: "text",
+          path: resolved.relative,
+          content: truncated.content,
+          startLine: start,
+          endLine: end,
+          totalLines: lines.length,
+          truncated: truncated.truncated || hasMore,
+          truncatedBy: truncated.truncatedBy,
+          firstLineExceedsLimit: truncated.firstLineExceedsLimit,
+          firstLineBytes: Buffer.byteLength(lines[startIndex] || "", "utf8"),
+        });
+        return success(request.id, output, "");
+      }
+      if (request.tool === "write") {
+        atomicWrite(resolved.target, request.input.content);
+        return success(request.id, JSON.stringify({
+          type: "write",
+          path: resolved.relative,
+          bytes: Buffer.byteLength(request.input.content, "utf8"),
+        }), "");
+      }
+      const original = fs.readFileSync(resolved.target, "utf8");
+      const matches = request.input.edits.map((edit) => {
+        const first = original.indexOf(edit.oldText);
+        if (first < 0) throw new Error("workspace_file_old_text_not_found");
+        if (original.indexOf(edit.oldText, first + edit.oldText.length) >= 0) throw new Error("workspace_file_old_text_not_unique");
+        return { ...edit, start: first, end: first + edit.oldText.length };
+      }).sort((left, right) => left.start - right.start);
+      for (let index = 1; index < matches.length; index += 1) {
+        if (matches[index].start < matches[index - 1].end) throw new Error("workspace_file_edits_overlap");
+      }
+      let updated = original;
+      for (const match of [...matches].reverse()) {
+        updated = updated.slice(0, match.start) + match.newText + updated.slice(match.end);
+      }
+      atomicWrite(resolved.target, updated);
+      return success(request.id, JSON.stringify({
+        type: "edit",
+        path: resolved.relative,
+        replacements: matches.length,
+        beforeSha256: crypto.createHash("sha256").update(original).digest("hex"),
+        afterSha256: crypto.createHash("sha256").update(updated).digest("hex"),
+      }), "");
+      } catch (error) {
+        return failure(request.id, 1, "command_failed", "", error instanceof Error ? error.message : "workspace_file_failed");
+      }
+    };
+    return request.tool === "read"
+      ? execute()
+      : await withFileMutationQueue(resolved.target, execute);
+  });
+  return { promise, cancel() {} };
+}
+`;var p="a3e39eb55160acfc116fa9871ccc594c68be7a642d2331b24baa707c8f601ec0";import{createHash as ot}from"crypto";var Ft=Object.freeze({"api.ara.so":"api.reasonmachines.com","api.reasonmachines.ai":"api.reasonmachines.com","api-staging.ara.so":"staging-api.reasonmachines.com","staging-api.reasonmachines.ai":"staging-api.reasonmachines.com"});var w=Object.freeze({trailingSlashPattern:/\/+$/.source,keyPrefix:"http.",keySuffix:"/.extraheader",valuePrefix:"Authorization: Bearer "});var q=Object.freeze({tokenEnv:"ARA_GIT_BROKER_TOKEN",reasonTokenEnv:"REASON_GIT_BROKER_TOKEN",urlEnv:"ARA_GIT_BROKER_URL",keyPrefix:"credential.",keySuffix:"/.helper",value:'!f(){ printf "username=%s\\npassword=%s\\n" "ara-run" "${REASON_GIT_BROKER_TOKEN:-$ARA_GIT_BROKER_TOKEN}"; };f'});var o=/^[A-Za-z_][A-Za-z0-9_]*$/;var N=new Set(["ARA_INFERENCE_TOKEN","AI_GATEWAY_API_KEY","CLOUD_AGENT_AI_GATEWAY_API_KEY","INFERENCE_V2_GATEWAY_API_KEY","VERCEL_AI_GATEWAY_API_KEY","INFERENCE_V2_CONCENTRATE_API_KEY","INFERENCE_V2_OPENAI_API_KEY","INFERENCE_V2_ANTHROPIC_API_KEY","INFERENCE_V2_FINGERPRINT_SECRET","OPENAI_API_KEY","OPENROUTER_API_KEY","ANTHROPIC_API_KEY","CODEX_ACCESS_TOKEN","GITHUB_COPILOT_API_KEY","AZURE_OPENAI_API_KEY","AZURE_OPENAI_CLIENT_SECRET"]),R=new Set(["ARA_OPERATOR_KEY","BL_API_KEY","BLAXEL_API_KEY","NSC_TOKEN","NSC_TOKEN_FILE","NAMESPACE_API_KEY","NAMESPACE_ACCESS_TOKEN","NAMESPACE_TOKEN","NAMESPACE_TOKEN_JSON","NAMESPACE_SANDBOX_TOKEN_JSON","ARA_LOCAL_QA_NAMESPACE_WORKLOAD_TOKEN_FILE","NAMESPACE_SANDBOX_USE_LOCAL_USER_TOKEN","COMPUTE_SERVICE_TOKEN"]),v=["INFISICAL_","NSC_"],E=new Set(["ARA_JOB_ENV","ARA_DELIVERY_BASE_SHA","WORK_ROOT","REPO_DIR","ARA_CONTROL_DIR","ARA_PRESERVE_WORKSPACE","ARA_PINNED_CHECKOUT_REUSE","FOLLOWUP_BRANCH","REPO_URL","TOKENLESS_URL","REPOSITORY_IDENTITY_URL","DEFAULT_BRANCH","BRANCH","BRANCH_GENERATED","BASE_REF","REPO_EMPTY","REPO_WRITABLE","ARA_DELIVERY_BASE_BRANCH","ARA_SERVER_GIT_PUBLICATION","ARA_EMPTY_REPOSITORY_COMMIT","REASON_MODEL","REASON_DELIVERY_BASE_BRANCH","REASON_DELIVERY_BASE_SHA","REASON_EMPTY_REPOSITORY_COMMIT","REASON_SCRATCH_SESSION_ID","REASON_SERVER_GIT_PUBLICATION","REASON_ALLOW_INSTALL_SCRIPTS","SCM_TOKEN","SCM_TOKEN_USER","REASON_OIDC_TOKEN_URL","REASON_OIDC_REQUEST_TOKEN","AWS_CONTAINER_CREDENTIALS_FULL_URI","AWS_CONTAINER_AUTHORIZATION_TOKEN","AWS_CONTAINER_CREDENTIALS_RELATIVE_URI","AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE","BASH_ENV","ENV","BASHOPTS","SHELLOPTS","PS4","IFS","CDPATH","GLOBIGNORE","PROMPT_COMMAND","PATH","HOME","TMPDIR","TMP","TEMP","XDG_CONFIG_HOME","GIT_DIR","GIT_WORK_TREE","GIT_INDEX_FILE","GIT_OBJECT_DIRECTORY","GIT_COMMON_DIR","GIT_NAMESPACE","GIT_CEILING_DIRECTORIES","GIT_DISCOVERY_ACROSS_FILESYSTEM","GIT_SHALLOW_FILE","GIT_ALLOW_PROTOCOL","GIT_PROTOCOL_FROM_USER","GIT_REPLACE_REF_BASE","NODE_OPTIONS","NODE_PATH","NODE_REPL_EXTERNAL_MODULES","CLASSPATH","PYTHONPATH","PYTHONSTARTUP","PYTHONHOME","RUBYOPT","RUBYLIB","PERL5LIB","PERL5OPT","JAVA_TOOL_OPTIONS","_JAVA_OPTIONS","JDK_JAVA_OPTIONS","GEM_PATH","GEM_HOME","GIT_SSH","GIT_SSH_COMMAND","GIT_EXEC_PATH","GIT_TEMPLATE_DIR","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_PROXY_COMMAND","GIT_EXTERNAL_DIFF","GIT_PAGER","GIT_EDITOR","GIT_ASKPASS","SSH_ASKPASS","PAGER","EDITOR","TAR_OPTIONS","CURL_HOME","WGETRC","APT_CONFIG","PERLLIB","GIT_GRAFT_FILE","POSIXLY_CORRECT"]),tt=["GIT_TRACE","CONTEXT_REPO_","ARA_CHECKPOINT_BOOTSTRAP_","_","ARA_HANDS_","ARA_DEVICE_","ARA_GIT_BROKER_","REASON_HANDS_","REASON_DEVICE_","REASON_GIT_BROKER_","LD_","DYLD_","GIT_CONFIG","BASH_FUNC_"];var u="^(?!(?:"+[...N,...R,...E].join("|")+")$)(?!(?:"+[...v,...tt].join("|")+"))"+o.source.slice(1),zt=new RegExp(u);var et=["HOME","PWD","OLDPWD","TMPDIR","TMP","TEMP","SHELL","USER","LOGNAME","SCM_TOKEN","SCM_TOKEN_USER","GH_TOKEN","GITHUB_TOKEN","GH_ENTERPRISE_TOKEN","GITHUB_ENTERPRISE_TOKEN","GITLAB_TOKEN"],rt=["ARA_HANDS_","ARA_DEVICE_","ARA_GIT_BROKER_","REASON_HANDS_","REASON_DEVICE_","REASON_GIT_BROKER_","BUN_"],it="^(?!(?:"+et.join("|")+")$)(?!(?:"+rt.join("|")+"))"+u.slice(1),nt="ARA_DELIVERY_BASE_SHA|WORK_ROOT|FOLLOWUP_BRANCH|ARA_PRESERVE_WORKSPACE|ARA_PINNED_CHECKOUT_REUSE|CONTEXT_REPO_[A-Z0-9_]+|REPO_URL|TOKENLESS_URL|REPOSITORY_IDENTITY_URL|DEFAULT_BRANCH|BRANCH|BRANCH_GENERATED|BASE_REF|REPO_EMPTY|REPO_WRITABLE|ARA_DELIVERY_BASE_BRANCH|ARA_SERVER_GIT_PUBLICATION|ARA_EMPTY_REPOSITORY_COMMIT|REASON_MODEL|REASON_DELIVERY_BASE_BRANCH|REASON_DELIVERY_BASE_SHA|REASON_EMPTY_REPOSITORY_COMMIT|REASON_SCRATCH_SESSION_ID|REASON_SERVER_GIT_PUBLICATION|REASON_ALLOW_INSTALL_SCRIPTS",c="^(?:"+nt+"|"+it.slice(1,-1)+")$",st=new RegExp(c);function kt(t){return st.test(t)}var b=Object.freeze({tokenPath:"/identity/token",awsPath:"/identity/aws",tokenPattern:/^[A-Za-z0-9_.~-]+$/.source}),m=Object.freeze({variables:256,valueBytes:130816,snapshotBytes:1048576}),Gt=Object.freeze({valueChars:16384,snapshotBytes:65536});var B=["set -g history-limit 50000","set -g status off","set -g window-size smallest","set -gq fill-character ' '","set -g escape-time 10","set -g prefix None","set -g prefix2 None","set -g terminal-overrides ',*:smcup@:rmcup@'"];var ut=2,ct="ara-hands-worker.cjs",A=["/usr/local/go/bin","/opt/node/bin","/usr/local/bin","/usr/sbin","/usr/bin","/sbin","/bin","/usr/local/cargo/bin"],ft=A.join(":"),dt=["/opt/homebrew/bin",...A].join(":"),at='(platform, linuxPath, macosPath) => platform === "darwin" ? macosPath : linuxPath';function Nt(t,e,f){return t==="darwin"?f:e}var lt=String.raw`(function(anchor, pid, native) {
+  const token = native.identity(pid);
+  const session = native.session(pid);
+  if (!native.same(anchor)) throw new Error("pty_session_identity_lost");
+  if (session.id === -1 && session.missing) return { retry: true, token: null };
+  if (session.id !== anchor[5]) throw new Error("pty_member_session_changed");
+  if (!token) return { retry: true, token: null };
+  return { retry: false, token };
+})`,gt=String.raw`(function(native) {
+  let probe;
+  try {
+    try {
+      probe = native.identity();
+      if (!probe) throw new Error("pty_pidfd_unavailable");
+      native.children();
+      native.signal(probe);
+    } finally { if (probe) native.release(probe); }
+  } catch (error) { native.close(); throw error; }
+})`,yt=String.raw`(function(bootstrap) {
+  const { dlopen, ptr } = require("bun:ffi");
+  const api = dlopen("libc.so.6", {
+    prctl: { args: ["i32", "u64", "u64", "u64", "u64"], returns: "i32" },
+    execve: { args: ["ptr", "ptr", "ptr"], returns: "i32" },
+  }).symbols;
+  const bit = new Int32Array(1);
+  if (api.prctl(36, 1, 0, 0, 0) !== 0 || api.prctl(37, ptr(bit), 0, 0, 0) !== 0 || bit[0] !== 1) {
+    throw new Error("pty_subreaper_unavailable");
+  }
+  const args = ["/bin/bash", "--noprofile", "--norc", "-c", bootstrap].map(value => Buffer.from(value + "\0"));
+  // Keep the serialized program distinct from native runtime lookup bytes:
+  // Mac release hardening removes those native lookups before signing.
+  const runtimeModeKey = ["BUN", "BE", "BUN"].join("_");
+  const env = Object.entries(process.env).filter(([name]) => name !== runtimeModeKey)
+    .map(([name, value]) => Buffer.from(name + "=" + value + "\0"));
+  const argv = new BigUint64Array([...args.map(value => BigInt(ptr(value))), 0n]);
+  const envp = new BigUint64Array([...env.map(value => BigInt(ptr(value))), 0n]);
+  require("node:fs").writeSync(3, "subreaper\n");
+  api.execve(ptr(args[0]), ptr(argv), ptr(envp));
+  throw new Error("pty_exec_failed");
+})`,ht=String.raw`
+"use strict";
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const net = require("node:net");
+const path = require("node:path");
+const { spawn, spawnSync } = require("node:child_process");
+const { StringDecoder } = require("node:string_decoder");
+const GIT_BROKER_HTTP_HEADER_POLICY = ${JSON.stringify(w)};
+const GIT_BROKER_CREDENTIAL_HELPER_POLICY = ${JSON.stringify(q)};
+const DEVICE_ENVIRONMENT_NAME_RE = new RegExp(${JSON.stringify(c)});
+const DEVICE_CLOUD_ACCESS_POLICY = ${JSON.stringify(b)};
+const DEVICE_ENVIRONMENT_LIMITS = ${JSON.stringify(m)};
+
+const VERSION = ${z};
+const WORKER_VERSION = ${ut};
+const WORKER_ENTRYPOINT = ${JSON.stringify(ct)};
+const GUEST_MEMORY_UNAVAILABLE_REASONS = ${JSON.stringify(d)};
+const sampleGuestMemory = ${a};
+const inspectMacPtyMember = ${lt};
+const probeLinuxPtyLibrary = ${gt};
+const LINUX_PTY_EXEC_SOURCE = ${JSON.stringify(yt)};
+const CLOSE_CODES = ${JSON.stringify(O)};
+const SHA256_RE = /^[0-9a-f]{64}$/;
+const MAX_FRAME_BYTES = ${Z};
+const MAX_INPUT_CHARS = ${K};
+const MAX_STRUCTURED_INPUT_CHARS = ${$};
+const MAX_OUTPUT_CHARS = ${k};
+const MAX_ERROR_CHARS = ${G};
+const MAX_LEDGER_IDS = 16384;
+const MAX_CACHED_RESULTS = 256;
+const MAX_JOB_INPUT_CHARS = ${X};
+const MAX_JOB_OUTPUT_CHARS = ${M};
+const MAX_JOB_OUTPUT_CHUNKS = ${Y};
+const MAX_JOBS = ${H};
+const MAX_JOB_RECORD_BYTES = 262144;
+const MAX_JOB_JOURNAL_BYTES = MAX_JOBS * MAX_JOB_RECORD_BYTES;
+const MAX_JOB_CONTROL_FRAME_BYTES = ${V};
+const MAX_PTY_INPUT_BYTES = ${S};
+const MAX_PTY_OUTPUT_BYTES = ${_};
+const MAX_PTY_DIMENSION = ${P};
+const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const FIXED_BASH = "/bin/bash";
+/** A Reason cloud machine's memory ceiling, which guestd records on every
+ * start (/run/sc/memory-max-mib), or 0 elsewhere. Read per command: a resize
+ * changes it. */
+function machineMemoryMaxMiB() {
+  try {
+    const file = validPath(config.machineMemoryMaxPath) ? config.machineMemoryMaxPath : "/run/sc/memory-max-mib";
+    const text = fs.readFileSync(file, "utf8").trim();
+    return /^[1-9][0-9]{2,6}$/.test(text) ? Number(text) : 0;
+  } catch {
+    return 0;
+  }
+}
+/** The shell prelude that sizes the command for the memory the machine can
+ * grow to. Node takes a quarter of the memory it sees at start as its heap
+ * limit, and a cloud machine starts small and grows on demand, so without
+ * this a TypeScript build stops at a 512 MiB heap while gigabytes could be
+ * plugged in. NODE_OPTIONS is otherwise unset for every command; this sets
+ * only the heap size, a quarter of the ceiling as on a machine that size,
+ * and publishes the ceiling as REASON_MEMORY_MAX_MIB. A command's own
+ * NODE_OPTIONS still wins. Empty off a cloud machine. */
+function machineMemoryPrelude() {
+  const max = machineMemoryMaxMiB();
+  return max ? "export NODE_OPTIONS=--max-old-space-size=" + Math.max(2048, Math.floor(max / 4)) + " REASON_MEMORY_MAX_MIB=" + max + "; " : "";
+}
+/** config.jobsUser: the argv prefix that runs a job as the payload account, never root.
+ * A script job (model: true) takes the egress guard's model-jobs group when there is one. */
+function jobsUserPrefix(model) {
+  const user = config.jobsUser;
+  const gid = model && user && user.modelGid !== undefined ? user.modelGid : user && user.gid;
+  return user ? ["/usr/bin/setpriv", "--reuid=" + user.uid, "--regid=" + gid, "--clear-groups", "--no-new-privs", "--",
+    "/usr/bin/env", "HOME=" + user.home, "USER=" + user.username, "LOGNAME=" + user.username] : [];
+}
+const FIXED_CLOUD_CHILD_PATH = ${JSON.stringify(ft)};
+const FIXED_MACOS_CLOUD_CHILD_PATH = ${JSON.stringify(dt)};
+const selectCloudChildPath = ${at};
+const config = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const allowedTools = config.allowedTools === undefined
+  ? ["bash", "repl", "read", "edit", "write"]
+  : config.allowedTools;
+// Local GitHub authority confines a Session's Bash and file access under
+// sandbox-exec on macOS. A personal Linux worker runs every Session's tools
+// with the person's own permissions (host mode, which already reach their gh
+// login and the network), so there it keeps the ordinary tool paths.
+const localGithubSandbox = config.localGithubConfinement === true && process.platform === "darwin";
+
+function validPath(value) {
+  return typeof value === "string" && path.isAbsolute(value) && !value.includes("\0");
+}
+function validTimeout(value) {
+  return Number.isSafeInteger(value) && value >= 50 && value <= 600000;
+}
+function validHostVariables(variables) {
+  if (!variables || typeof variables !== "object" || Array.isArray(variables)) return false;
+  const entries = Object.entries(variables);
+  return entries.length <= 512 && entries.every(([name, value]) => name.length <= 128 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name)
+    && typeof value === "string" && value.length <= 32768 && !value.includes("\0"));
+}
+function validEnvironmentConfiguration() {
+  if (config.localGithubConfinement === true && config.environmentSnapshotPath === undefined) return false;
+  if (config.gitCredentialEnvironment !== undefined && (config.gitCredentialEnvironment !== true
+    || config.environmentSnapshotPath === undefined || config.localGithubConfinement === true)) return false;
+  const baseline = config.executionEnvironment;
+  if (baseline !== undefined && (config.environmentSnapshotPath === undefined
+    || !hasOnlyKeys(baseline, ["home", "path", "temporaryDirectory", "variables"])
+    || (baseline.variables !== undefined && !validHostVariables(baseline.variables))
+    || ![baseline.home, baseline.temporaryDirectory].every(value => validPath(value) && value.length <= 32768 && !/[\r\n]/.test(value))
+    || typeof baseline.path !== "string" || baseline.path.length > 32768
+    || !baseline.path.split(":").every(value => validPath(value) && !/[\r\n]/.test(value)))) return false;
+  if (config.environmentSnapshotPath === undefined) return config.environmentExpectedBinding === undefined;
+  const authority = config.environmentExpectedBinding;
+  if (!validPath(config.environmentSnapshotPath) || path.basename(config.environmentSnapshotPath) !== "environment.json"
+    || config.jobEnvSourcePath !== undefined
+    || !hasOnlyKeys(authority, ["runId", "deviceId", "rootId", "apiOrigin", "binding"])
+    || typeof authority.runId !== "string" || authority.runId.length < 1 || authority.runId.length > 160
+    || !UUID_RE.test(authority.deviceId) || !UUID_RE.test(authority.rootId)
+    || !hasOnlyKeys(authority.binding, ["kind", "target_revision", "root_grant_revision"])
+    || !["workspace_source", "mcp_control"].includes(authority.binding.kind)
+    || !Number.isSafeInteger(authority.binding.target_revision) || authority.binding.target_revision < 0
+    || !Number.isSafeInteger(authority.binding.root_grant_revision) || authority.binding.root_grant_revision < 1) return false;
+  try {
+    const origin = new URL(authority.apiOrigin);
+    return ["https:", "http:"].includes(origin.protocol) && !origin.username && !origin.password
+      && origin.pathname === "/" && !origin.search && !origin.hash;
+  } catch { return false; }
+}
+let parsedUrl;
+try { parsedUrl = new URL(config.url); } catch { parsedUrl = null; }
+const validLoopbackRelay = config.transport === "sandbox_loopback"
+  && parsedUrl && parsedUrl.protocol === "ws:"
+  && parsedUrl.hostname === "127.0.0.1"
+  && !parsedUrl.username && !parsedUrl.password && !parsedUrl.search && !parsedUrl.hash;
+const validDeviceRelay = config.transport === "ara_device_wss"
+  && parsedUrl
+  && ((parsedUrl.protocol === "wss:"
+      && parsedUrl.hostname !== "127.0.0.1" && parsedUrl.hostname !== "localhost")
+    || (parsedUrl.protocol === "ws:"
+      && (parsedUrl.hostname === "127.0.0.1" || parsedUrl.hostname === "localhost")))
+  && !parsedUrl.username && !parsedUrl.password && !parsedUrl.hash;
+const validPrivateJob = config.transport === "local_job_ipc" && config.url === ""
+  && config.proxyUrl === undefined && config.managedJobs && config.jobControlSocketPath
+  && config.allowedTools?.length === 1 && config.allowedTools[0] === "bash"
+  && config.workRoot === config.workspaceAliasPath && config.environmentSnapshotPath === undefined
+  && config.jobEnvSourcePath === undefined && config.spawnPolicy === undefined && config.managedPty === undefined
+  && hasOnlyKeys(config.directShell, ["mode", "executable", "jobId"]) && UUID_RE.test(config.directShell.jobId)
+  && validPath(config.directShell.executable) && ["bash", "zsh"].includes(path.basename(config.directShell.executable))
+  && (config.directShell.mode === "host" ? config.bashCommandPrefix === undefined
+    : config.directShell.mode === "confined" && process.platform === "darwin"
+      && config.bashCommandPrefix?.length === 3 && config.bashCommandPrefix[0] === "/usr/bin/sandbox-exec"
+      && config.bashCommandPrefix[1] === "-p");
+let validProxyUrl = config.proxyUrl === undefined;
+if (!validProxyUrl && config.transport === "ara_device_wss" && typeof config.proxyUrl === "string") {
+  try {
+    const proxyParsed = new URL(config.proxyUrl);
+    validProxyUrl = (proxyParsed.protocol === "https:" || proxyParsed.protocol === "http:")
+      && proxyParsed.hostname !== "";
+  } catch { validProxyUrl = false; }
+}
+function validJobEnvSourcePath() {
+  if (config.jobEnvSourcePath === undefined || config.jobEnvSourcePath === path.join(config.workRoot, "job.env")) return true;
+  // A cloud workspace's job.env is in its Session's root-only control
+  // directory (shared/device-workspace.ts), derived from the root alone.
+  const cloud = new RegExp(${JSON.stringify(j.source)}).exec(config.workRoot);
+  if (process.platform === "linux" && cloud) {
+    const workspaceId = cloud[3];
+    const owner = (new RegExp(${JSON.stringify(W.source)}).exec(workspaceId) || [])[1]
+      ?? (new RegExp(${JSON.stringify(F.source)}).exec(workspaceId) || [])[1] ?? workspaceId;
+    return config.jobEnvSourcePath === ${JSON.stringify(L)} + "/" + owner + "/job.env";
+  }
+  // Personal Cloud controls are root-owned and outside the writable grant.
+  // Admit only the same canonical session, never a caller-selected private path.
+  const session = /^\/var\/lib\/reason\/sessions\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/.exec(config.workRoot);
+  return process.platform === "linux" && session !== null
+    && config.jobEnvSourcePath === "/var/lib/reason/session-controls/" + session[1] + "/job.env";
+}
+if (
+  typeof WebSocket !== "function" ||
+  (!validLoopbackRelay && !validDeviceRelay && !validPrivateJob) || !validProxyUrl ||
+  (config.directShell !== undefined && !validPrivateJob) ||
+  (config.directTerminalReceiptPath !== undefined && (!validPrivateJob
+    || config.directTerminalReceiptPath !== path.join(path.dirname(config.readyPath), "terminal.json"))) ||
+  (!validPrivateJob && !/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(parsedUrl.pathname)) ||
+  config.workerVersion !== WORKER_VERSION || config.protocolVersion !== VERSION ||
+  typeof config.workerArtifactSha256 !== "string" || !SHA256_RE.test(config.workerArtifactSha256) ||
+  config.workerEntrypoint !== WORKER_ENTRYPOINT ||
+  !Number.isSafeInteger(config.targetGeneration) || config.targetGeneration < 1 ||
+  typeof config.fenceId !== "string" || !UUID_RE.test(config.fenceId) ||
+  !validPath(config.workRoot) || !validPath(config.workspaceAliasPath) ||
+  (config.deviceRootPath !== undefined && !validPath(config.deviceRootPath)) ||
+  (config.workspacePoolPath !== undefined && !validPath(config.workspacePoolPath)) ||
+  !validPath(config.jobEnvPath) || !validPath(config.repoPath) ||
+  !validEnvironmentConfiguration() ||
+  !validJobEnvSourcePath() ||
+  !validPath(config.replSocketPath) || !validPath(config.readyPath) ||
+  (config.terminalCleanupRunId !== undefined && (!UUID_RE.test(config.terminalCleanupRunId) || config.terminalCleanupRunId !== config.browserRunId)) ||
+  (config.terminalDaemonNonce !== undefined && (!UUID_RE.test(config.terminalDaemonNonce) || !config.terminalCleanupRunId)) ||
+  (config.browserRunId !== undefined && (typeof config.browserRunId !== "string" || !UUID_RE.test(config.browserRunId))) ||
+  config.workRoot === "/" || config.workspaceAliasPath === "/" ||
+  (config.workRoot !== config.workspaceAliasPath && (
+    config.workRoot.startsWith(config.workspaceAliasPath + "/") ||
+    config.workspaceAliasPath.startsWith(config.workRoot + "/")
+  )) ||
+  typeof config.launchId !== "string" || !/^[a-f0-9-]{36}$/.test(config.launchId) ||
+  !Number.isSafeInteger(config.expiresAtMs) || config.expiresAtMs <= Date.now() ||
+  !validTimeout(config.bashTimeoutMs) || !validTimeout(config.replTimeoutMs) ||
+  // An argument may be a whole sandbox-exec profile: a local GitHub Session's
+  // dev server's (shared/local-gh-confinement.ts) is about 7.5 KB.
+  (config.bashCommandPrefix !== undefined && (
+    !Array.isArray(config.bashCommandPrefix) || config.bashCommandPrefix.length < 1 ||
+    config.bashCommandPrefix.length > 32 || !validPath(config.bashCommandPrefix[0]) ||
+    config.bashCommandPrefix.some((arg) => typeof arg !== "string" || arg.length > 32768 || arg.includes("\0"))
+  )) ||
+  (config.managedJobs !== undefined && (
+    !config.managedJobs || !validPath(config.managedJobs.journalDirectory) ||
+    typeof config.managedJobs.scopeId !== "string" || !ID_RE.test(config.managedJobs.scopeId)
+  )) ||
+  (config.jobsUser !== undefined && (!hasOnlyKeys(config.jobsUser, ["uid", "gid", "home", "username", "modelGid"])
+    || (config.jobsUser.modelGid !== undefined && (!Number.isSafeInteger(config.jobsUser.modelGid) || config.jobsUser.modelGid < 1))
+    || process.platform !== "linux" || process.getuid() !== 0
+    || !Number.isSafeInteger(config.jobsUser.uid) || config.jobsUser.uid < 1
+    || !Number.isSafeInteger(config.jobsUser.gid) || config.jobsUser.gid < 1
+    || typeof config.jobsUser.home !== "string" || !/^\/[A-Za-z0-9._\/-]+$/.test(config.jobsUser.home) || config.jobsUser.home.includes("..")
+    || typeof config.jobsUser.username !== "string" || !/^[a-z_][a-z0-9_-]{0,31}$/i.test(config.jobsUser.username))) ||
+  (config.managedPty !== undefined && (!hasOnlyKeys(config.managedPty, ["version", "persistent", "shell"])
+    || config.managedPty.version !== 1 || ![undefined, true].includes(config.managedPty.persistent) || !config.managedJobs || config.environmentSnapshotPath === undefined
+    || (config.managedPty.shell !== undefined && (process.platform !== "darwin" || typeof config.managedPty.shell !== "string"
+      || !/^\/[A-Za-z0-9._\/-]*\/(?:bash|zsh)$/.test(config.managedPty.shell))))) ||
+  (config.spawnPolicy !== undefined && (
+    !config.spawnPolicy || !validPath(config.spawnPolicy.socketPath) ||
+    path.basename(config.spawnPolicy.socketPath) !== "spawn.sock" || Buffer.byteLength(config.spawnPolicy.socketPath) > 100 ||
+    !ID_RE.test(config.spawnPolicy.scopeId) || !ID_RE.test(config.spawnPolicy.targetRevision) ||
+    config.bashCommandPrefix !== undefined || config.jobEnvSourcePath !== undefined
+  )) ||
+  (config.jobControlSocketPath !== undefined && (
+    !config.managedJobs || !validPath(config.jobControlSocketPath) ||
+    path.basename(config.jobControlSocketPath) !== "control.sock" || Buffer.byteLength(config.jobControlSocketPath) > 100
+  )) ||
+  !Array.isArray(allowedTools) || allowedTools.length < 1 || allowedTools.length > 5 ||
+  new Set(allowedTools).size !== allowedTools.length ||
+  allowedTools.some((tool) => !["bash", "repl", "read", "edit", "write"].includes(tool))
+) process.exit(42);
+
+function workspaceAliasMatches() {
+  try {
+    const alias = fs.lstatSync(config.workspaceAliasPath);
+    if (!alias.isSymbolicLink()) return false;
+    if (fs.readlinkSync(config.workspaceAliasPath) !== config.workRoot) return false;
+    return fs.realpathSync(config.workspaceAliasPath) === fs.realpathSync(config.workRoot);
+  } catch {
+    return false;
+  }
+}
+function ensureWorkspaceAlias() {
+  try {
+    if (!fs.statSync(config.workRoot).isDirectory()) return false;
+    if (config.workRoot === config.workspaceAliasPath) return true;
+    try {
+      fs.lstatSync(config.workspaceAliasPath);
+      return workspaceAliasMatches();
+    } catch (error) {
+      if (!error || error.code !== "ENOENT") return false;
+    }
+    try {
+      fs.symlinkSync(config.workRoot, config.workspaceAliasPath, "dir");
+    } catch (error) {
+      if (!error || error.code !== "EEXIST") return false;
+    }
+    return workspaceAliasMatches();
+  } catch {
+    return false;
+  }
+}
+if (!ensureWorkspaceAlias()) process.exit(43);
+
+let stopped = false;
+let terminalCleanupStarted = false;
+let terminalCleanupPromise = null;
+let terminalParentPending = null;
+let terminalParentBuffer = "";
+let terminalParentFailed = false;
+if (config.terminalDaemonNonce) {
+  const failParent = () => { terminalParentFailed = true; terminalParentPending?.finish(false); };
+  process.stdin.on("data", chunk => {
+    terminalParentBuffer += chunk.toString();
+    if (Buffer.byteLength(terminalParentBuffer) > 4096) return failParent();
+    let at;
+    while ((at = terminalParentBuffer.indexOf("\n")) >= 0) {
+      const line = terminalParentBuffer.slice(0, at); terminalParentBuffer = terminalParentBuffer.slice(at + 1);
+      let value; try { value = JSON.parse(line); } catch { return failParent(); }
+      if (!terminalParentPending || !hasOnlyKeys(value, ["type", "version", "nonce", "id", "accepted"])
+        || value.type !== "terminal_daemon_ack" || value.version !== 1 || value.nonce !== config.terminalDaemonNonce
+        || value.id !== terminalParentPending.id || typeof value.accepted !== "boolean") return failParent();
+      terminalParentPending.finish(value.accepted);
+    }
+  });
+  process.stdin.on("error", failParent); process.stdin.on("end", failParent);
+}
+function terminalParentRequest(action, claim) {
+  if (!config.terminalDaemonNonce) return Promise.resolve(true);
+  if (terminalParentFailed || terminalParentPending) return Promise.resolve(false);
+  return new Promise(resolve => {
+    const id = crypto.randomUUID();
+    const timer = setTimeout(() => { terminalParentFailed = true; finish(false); }, 2000);
+    let settled = false;
+    const finish = accepted => { if (settled) return; settled = true; clearTimeout(timer); terminalParentPending = null; resolve(accepted); };
+    terminalParentPending = { id, finish };
+    process.stdout.write(JSON.stringify({ type: "terminal_daemon", version: 1, nonce: config.terminalDaemonNonce,
+      runId: config.terminalCleanupRunId, executorLaunchId: config.launchId, generation: claim.generation, action, id }) + "\n",
+      error => { if (error) { terminalParentFailed = true; finish(false); } });
+  });
+}
+let stoppingPromise = null;
+let socket = null;
+let generation = 0;
+let retryMs = 25;
+let connectionAttempt = 0;
+let targetGeneration = config.targetGeneration;
+let targetFenceId = config.fenceId;
+const active = new Map();
+const ledger = new Map();
+const cachedResultIds = [];
+// Managed records extend this worker's Bash supervisor, not the backend queue.
+// No command/environment/stdin text or recoverable PID is stored in the journal.
+const jobs = new Map();
+let journalFailed = false;
+let cleanupUnconfirmed = false;
+let journalDebrisBytes = 0;
+let journalDirectory = null;
+let journalOwnership = null;
+let jobControlServer = null;
+const jobControlClients = new Set();
+let pendingJobRequests = 0;
+let maintenanceLease = null;
+// Process groups of settled retainBackground Bash requests and Pi shells whose descendants
+// were still running when the command exited, keyed by process group ID. They
+// are live work until the group is empty, and stop() ends them with the worker.
+const backgroundGroups = new Map();
+let backgroundGroupTimer = null;
+// reason-sdk state (see machineSdkEndpoint): the claim of the current socket,
+// the worker's private directory with the shim, the live per-request
+// endpoints and the calls waiting for the Brain's sdk_response.
+let socketClaim = null;
+let sdkBase = null;
+let sdkEndpointCount = 0;
+const sdkEndpoints = new Set();
+const sdkPending = new Map();
+
+// Fixed-shape diagnostics: never include URLs, peer reasons, errors, request IDs,
+// command text, paths, or credential-bearing configuration. Bound reconnect storms.
+let diagnosticWindowMs = 0;
+let diagnosticCount = 0;
+let suppressedDiagnostics = 0;
+function diagnostic(event, reason = null, peerGeneration = null, closeCode = null) {
+  const now = Date.now();
+  if (now - diagnosticWindowMs >= 60000) {
+    diagnosticWindowMs = now;
+    diagnosticCount = 0;
+  }
+  if (diagnosticCount >= 120 && event !== "stopping" && event !== "stopped") {
+    suppressedDiagnostics += 1;
+    return;
+  }
+  diagnosticCount += 1;
+  try {
+    process.stderr.write(JSON.stringify({
+      event: "hands.worker." + event,
+      timestampMs: now,
+      launchId: config.launchId,
+      connectionAttempt,
+      connectionGeneration: generation,
+      targetGeneration,
+      peerGeneration,
+      activeRequestCount: active.size,
+      socketState: socket ? socket.readyState : null,
+      remainingLifetimeMs: Math.max(0, config.expiresAtMs - now),
+      closeCode,
+      reason,
+      suppressedDiagnostics,
+    }) + "\n");
+    suppressedDiagnostics = 0;
+  } catch { /* Diagnostics must never affect execution. */ }
+}
+
+function hasOnlyKeys(value, allowed) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const keys = Object.keys(value);
+  return keys.every((key) => allowed.includes(key));
+}
+function safeId(value) {
+  return typeof value === "string" && ID_RE.test(value) ? value : "invalid";
+}
+function clip(value, maximum) {
+  value = typeof value === "string" ? value : String(value || "");
+  if (value.length <= maximum) return value;
+  const marker = "\n...[executor output truncated]";
+  return value.slice(0, Math.max(0, maximum - marker.length)) + marker;
+}
+function failure(id, exitCode, error, stdout, stderr, responseGeneration = targetGeneration) {
+  return {
+    version: VERSION,
+    generation: responseGeneration,
+    id: safeId(id),
+    ok: false,
+    exitCode: Number.isSafeInteger(exitCode) && exitCode > 0 && exitCode <= 255 ? exitCode : 1,
+    stdout: clip(stdout || "", MAX_OUTPUT_CHARS),
+    stderr: clip(stderr || "", MAX_OUTPUT_CHARS),
+    cwd: config.repoPath,
+    error: clip(error, MAX_ERROR_CHARS),
+  };
+}
+function success(id, stdout, stderr, responseGeneration = targetGeneration) {
+  return {
+    version: VERSION,
+    generation: responseGeneration,
+    id,
+    ok: true,
+    exitCode: 0,
+    stdout: clip(stdout || "", MAX_OUTPUT_CHARS),
+    stderr: clip(stderr || "", MAX_OUTPUT_CHARS),
+    cwd: config.repoPath,
+  };
+}
+// The code alone names the reason: Bun's WebSocket client drops close text.
+function closeSocket(target, reason) {
+  try {
+    if (target.readyState < WebSocket.CLOSING) target.close(CLOSE_CODES[reason], reason);
+  } catch {
+    try { target.close(); } catch { return; }
+  }
+}
+function parseRequest(raw, expectedGeneration) {
+  if (Buffer.byteLength(raw, "utf8") > MAX_FRAME_BYTES) {
+    const error = new Error("frame_too_large"); error.code = "frame_too_large"; throw error;
+  }
+  let value;
+  try { value = JSON.parse(raw); } catch {
+    const error = new Error("invalid_json"); error.code = "invalid_json"; throw error;
+  }
+  const id = safeId(value && value.id);
+  if (
+    !hasOnlyKeys(value, ["version", "generation", "id", "tool", "input", "semanticDigest", "lifecycleLeaseId"]) ||
+    (value.lifecycleLeaseId !== undefined && (value.tool !== "bash" || typeof value.lifecycleLeaseId !== "string" || !UUID_RE.test(value.lifecycleLeaseId))) ||
+    value.version !== VERSION || !Number.isSafeInteger(value.generation) || value.generation < 1 || id === "invalid" ||
+    (value.tool === "pi_tool" ? !validPiToolRequest(value) : value.tool !== "resume" && !allowedTools.includes(value.tool)) ||
+    !value.input || typeof value.input !== "object" || Array.isArray(value.input)
+  ) {
+    const error = new Error("invalid_request"); error.code = "invalid_request"; error.id = id; throw error;
+  }
+  if (value.generation !== expectedGeneration) {
+    const error = new Error("stale_generation"); error.code = "stale_generation"; error.id = id; throw error;
+  }
+  if (
+    value.tool === "bash" &&
+    (!hasOnlyKeys(value.input, ["script", "retainBackground", "machineSdk"]) || typeof value.input.script !== "string" || value.input.script.length > MAX_INPUT_CHARS ||
+      (value.input.retainBackground !== undefined && value.input.retainBackground !== true) ||
+      (value.input.machineSdk !== undefined && value.input.machineSdk !== true) ||
+      (value.semanticDigest !== undefined && (typeof value.semanticDigest !== "string" || !SHA256_RE.test(value.semanticDigest))))
+  ) {
+    const error = new Error("invalid_request"); error.code = "invalid_request"; error.id = id; throw error;
+  }
+  if (
+    value.tool === "repl" &&
+    (!hasOnlyKeys(value.input, ["code"]) || typeof value.input.code !== "string" ||
+      value.input.code.length > MAX_INPUT_CHARS || value.semanticDigest !== undefined)
+  ) {
+    const error = new Error("invalid_request"); error.code = "invalid_request"; error.id = id; throw error;
+  }
+  if (value.tool === "resume" && (
+    value.semanticDigest !== undefined || !hasOnlyKeys(value.input, ["semanticDigest"]) ||
+    typeof value.input.semanticDigest !== "string" || !SHA256_RE.test(value.input.semanticDigest)
+  )) {
+    const error = new Error("invalid_request"); error.code = "invalid_request"; error.id = id; throw error;
+  }
+  if (
+    value.tool === "read" &&
+    (!hasOnlyKeys(value.input, ["path", "offset", "limit"]) ||
+      typeof value.input.path !== "string" || value.input.path.length < 1 || value.input.path.length > MAX_INPUT_CHARS ||
+      value.semanticDigest !== undefined ||
+      (value.input.offset !== undefined && (!Number.isSafeInteger(value.input.offset) || value.input.offset < 1)) ||
+      (value.input.limit !== undefined && (!Number.isSafeInteger(value.input.limit) || value.input.limit < 1 || value.input.limit > 2000)))
+  ) {
+    const error = new Error("invalid_request"); error.code = "invalid_request"; error.id = id; throw error;
+  }
+  if (value.tool === "edit") {
+    let chars = typeof value.input.path === "string"
+      ? value.input.path.length
+      : MAX_STRUCTURED_INPUT_CHARS + 1;
+    const validEdits = Array.isArray(value.input.edits) && value.input.edits.length >= 1 && value.input.edits.length <= 128
+      && value.input.edits.every((edit) => {
+        if (!hasOnlyKeys(edit, ["oldText", "newText"]) || typeof edit.oldText !== "string" || edit.oldText.length < 1 || typeof edit.newText !== "string") return false;
+        chars += edit.oldText.length + edit.newText.length;
+        return chars <= MAX_STRUCTURED_INPUT_CHARS;
+      });
+    if (!hasOnlyKeys(value.input, ["path", "edits"]) || typeof value.input.path !== "string" || value.input.path.length < 1 || value.semanticDigest !== undefined || !validEdits) {
+      const error = new Error("invalid_request"); error.code = "invalid_request"; error.id = id; throw error;
+    }
+  }
+  if (
+    value.tool === "write" &&
+    (!hasOnlyKeys(value.input, ["path", "content"]) || typeof value.input.path !== "string" || value.input.path.length < 1 ||
+      typeof value.input.content !== "string"
+      || value.input.path.length + value.input.content.length > MAX_STRUCTURED_INPUT_CHARS
+      || value.semanticDigest !== undefined)
+  ) {
+    const error = new Error("invalid_request"); error.code = "invalid_request"; error.id = id; throw error;
+  }
+  return value;
+}
+function sendResult(target, result) {
+  if (target.readyState !== WebSocket.OPEN) return;
+  const encoded = JSON.stringify(result);
+  if (Buffer.byteLength(encoded, "utf8") > MAX_FRAME_BYTES) {
+    closeSocket(target, "result_too_large");
+    return;
+  }
+  target.send(encoded);
+}
+function sendProgress(target, id, sequence, stdout, stderr, responseGeneration = targetGeneration) {
+  if (target.readyState !== WebSocket.OPEN) return;
+  const encoded = JSON.stringify({
+    type: "progress",
+    version: VERSION,
+    generation: responseGeneration,
+    id,
+    sequence,
+    stdout: clip(stdout || "", MAX_OUTPUT_CHARS),
+    stderr: clip(stderr || "", MAX_OUTPUT_CHARS),
+  });
+  if (Buffer.byteLength(encoded, "utf8") > MAX_FRAME_BYTES) {
+    closeSocket(target, "progress_too_large");
+    return;
+  }
+  target.send(encoded);
+}
+function bindResultGeneration(result, responseGeneration) {
+  return { ...result, generation: responseGeneration };
+}
+function bindResumeResult(result, responseGeneration) {
+  return { ...result, generation: responseGeneration, resumed: true };
+}
+function requestHash(request, input = request.input) {
+  return crypto.createHash("sha256").update(JSON.stringify({
+    version: request.version,
+    id: request.id,
+    tool: request.tool,
+    input,
+    semanticDigest: request.semanticDigest || null,
+  })).digest("hex");
+}
+function digest(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+function privateJournalRead(name, maxBytes = MAX_JOB_RECORD_BYTES) {
+  const fd = fs.openSync(path.join(journalDirectory, name), fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+  try {
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile() || stat.uid !== process.getuid() || (stat.mode & 0o077) !== 0 || stat.size > maxBytes) {
+      throw new Error("invalid_job_journal");
+    }
+    return { value: JSON.parse(fs.readFileSync(fd, "utf8")), bytes: stat.size };
+  } finally { fs.closeSync(fd); }
+}
+// Atomic replacement always survives a worker crash. Only a durable write also
+// survives a host crash: fsync costs ~17 ms per call on slow container disks,
+// so hot paths (output, stdin, snapshots) skip it; transitions keep it.
+function privateJournalWrite(name, encoded, maxBytes = MAX_JOB_RECORD_BYTES, durable = true) {
+  const target = path.join(journalDirectory, name);
+  const temp = target + ".tmp";
+  const bytes = Buffer.byteLength(encoded);
+  if (bytes > maxBytes) throw new Error("job_journal_full");
+  // A fixed temp name bounds crash debris. The composition root must give a
+  // single live worker exclusive ownership of this scope's private directory.
+  try { fs.unlinkSync(temp); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  const fd = fs.openSync(temp, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
+  try { fs.writeFileSync(fd, encoded); if (durable) fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+  fs.renameSync(temp, target);
+  if (!durable) return bytes;
+  const directoryFd = fs.openSync(path.dirname(target), fs.constants.O_RDONLY);
+  try { fs.fsyncSync(directoryFd); } finally { fs.closeSync(directoryFd); }
+  return bytes;
+}
+function journalScope(generation, fenceId) {
+  return { schema: 1, scopeId: config.managedJobs.scopeId, repoPath: fs.realpathSync(config.repoPath), generation, fenceId };
+}
+function isLiveJob(record) { return record.state === "starting" || record.state === "running"; }
+function jobJournalReservation(job) {
+  return isLiveJob(job.record) || job.record.state === "uncertain" || job.operation
+    ? MAX_JOB_RECORD_BYTES : job.journalBytes;
+}
+function hasJobCapacity() {
+  // Identity metadata uses the same bounded lifetime ceiling as request replay.
+  // The byte budget remains the original 64 full records, including reservations
+  // for every process whose future output or cleanup is still unresolved.
+  if (jobs.size >= MAX_LEDGER_IDS) return false;
+  let reserved = MAX_JOB_RECORD_BYTES + journalDebrisBytes;
+  for (const job of jobs.values()) reserved += jobJournalReservation(job);
+  return reserved <= MAX_JOB_JOURNAL_BYTES;
+}
+function jobFile(jobId) { return digest(jobId) + ".job.json"; }
+function initializeJobs() {
+  if (!config.managedJobs) return;
+  fs.mkdirSync(config.managedJobs.journalDirectory, { mode: 0o700 });
+}
+// Worker state (the job journal, the private environment) stays out of the
+// Session's folder, except under a protected directory
+// (shared/local-protected-paths.ts) that the file tools and every confinement
+// refuse. A home-folder worker keeps it in ~/.config/reason, so its Session may
+// work in the home folder itself, as a Mac's home grant does.
+const PROTECTED_STATE_DIRECTORIES = ${JSON.stringify(i)};
+function stateOverlapsWorkspace(state, root) {
+  if (state === root || root.startsWith(state + path.sep)) return true;
+  if (!state.startsWith(root + path.sep)) return false;
+  const segments = state.slice(root.length + 1).toLowerCase().split(path.sep);
+  return !PROTECTED_STATE_DIRECTORIES.some((sequence) => segments.some((_, start) =>
+    sequence.every((part, offset) => segments[start + offset] === part)));
+}
+function prepareJournalDirectory() {
+  if (!config.managedJobs) return;
+  const candidate = config.managedJobs.journalDirectory;
+  try { initializeJobs(); } catch (error) { if (error.code !== "EEXIST") throw error; }
+  const stat = fs.lstatSync(candidate);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid() || (stat.mode & 0o077) !== 0) throw new Error("invalid_job_journal");
+  journalDirectory = fs.realpathSync(candidate);
+  for (const root of [config.repoPath, config.workRoot]) {
+    const canonical = fs.realpathSync(root);
+    if (stateOverlapsWorkspace(journalDirectory, canonical)) throw new Error("job_journal_inside_workspace");
+  }
+}
+function acquireJournalOwnership() {
+  if (!journalDirectory) return;
+  const lockPath = path.join(journalDirectory, "owner.lock");
+  // Atomic across distinct launch sockets and surviving daemon generations.
+  // Crash markers are deliberately NOT reclaimed by PID, expiry or reconnect.
+  // Only the serialized daemon recovery owner may retire a marker after exact
+  // prior-launch and descendant-stop proof. Never race two recovery cleaners.
+  const fd = fs.openSync(lockPath, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600);
+  journalOwnership = { fd, path: lockPath, stat: fs.fstatSync(fd) };
+  fs.writeFileSync(fd, JSON.stringify({ version: 1, scopeId: config.managedJobs.scopeId,
+    executorLaunchId: config.launchId, workerArtifactSha256: config.workerArtifactSha256,
+    pid: process.pid, createdAtMs: Date.now() }));
+  fs.fsyncSync(fd);
+  const directoryFd = fs.openSync(journalDirectory, fs.constants.O_RDONLY);
+  try { fs.fsyncSync(directoryFd); } finally { fs.closeSync(directoryFd); }
+}
+function releaseJournalOwnership() {
+  if (!journalOwnership) return;
+  const owned = journalOwnership;
+  const current = fs.lstatSync(owned.path);
+  if (current.dev !== owned.stat.dev || current.ino !== owned.stat.ino || current.nlink !== 1) throw new Error("job_ownership_changed");
+  fs.unlinkSync(owned.path);
+  fs.closeSync(owned.fd);
+  journalOwnership = null;
+  const directoryFd = fs.openSync(journalDirectory, fs.constants.O_RDONLY);
+  try { fs.fsyncSync(directoryFd); } finally { fs.closeSync(directoryFd); }
+}
+function loadJobs() {
+  if (!config.managedJobs) return;
+  const names = fs.readdirSync(journalDirectory);
+  if (names.length > MAX_LEDGER_IDS * 2 + 4) throw new Error("job_journal_full");
+  if (names.includes("scope.json")) {
+    const { value: scope } = privateJournalRead("scope.json");
+    if (scope.schema !== 1 || scope.scopeId !== config.managedJobs.scopeId || scope.repoPath !== fs.realpathSync(config.repoPath)
+      || !Number.isSafeInteger(scope.generation) || scope.generation < 1 || !UUID_RE.test(scope.fenceId)) throw new Error("job_scope_mismatch");
+    if (scope.generation > targetGeneration || (scope.generation === targetGeneration && scope.fenceId !== targetFenceId)) {
+      targetGeneration = scope.generation;
+      targetFenceId = scope.fenceId;
+    }
+  } else if (names.some((name) => name !== "scope.json.tmp" && name !== "control.sock" && name !== "owner.lock")) throw new Error("job_scope_missing");
+  privateJournalWrite("scope.json", JSON.stringify(journalScope(targetGeneration, targetFenceId)));
+  let reservedBytes = 0;
+  for (const name of names) {
+    if (name === "scope.json" || name === "scope.json.tmp" || name === "owner.lock" || name === "requests") continue;
+    if (name === "control.sock" && fs.lstatSync(path.join(journalDirectory, name)).isSocket()) continue;
+    if (/^[0-9a-f]{64}\.job\.json\.tmp$/.test(name)) continue;
+    if (!/^[0-9a-f]{64}\.job\.json$/.test(name)) throw new Error("invalid_job_journal");
+    let { value: record, bytes } = privateJournalRead(name);
+    if (!hasOnlyKeys(record, ["schema", "jobId", "digest", "state", "startedAtMs", "finishedAtMs", "exitCode",
+      "leaseExpiresAtMs", "inputSequence", "inputDigest", "output", "nextCursor", "outputLost", "environmentRevision", "environmentSnapshotId", "pty"])
+      || record.schema !== 1 || typeof record.jobId !== "string" || !ID_RE.test(record.jobId)
+      || jobFile(record.jobId) !== name || !SHA256_RE.test(record.digest)
+      || !["starting", "running", "exited", "cancelled", "expired", "uncertain"].includes(record.state)
+      || !Number.isSafeInteger(record.startedAtMs) || record.startedAtMs < 1
+      || !Number.isSafeInteger(record.leaseExpiresAtMs) || record.leaseExpiresAtMs < 1
+      || (record.finishedAtMs !== null && (!Number.isSafeInteger(record.finishedAtMs) || record.finishedAtMs < record.startedAtMs))
+      || (record.exitCode !== null && (!Number.isSafeInteger(record.exitCode) || record.exitCode < 0 || record.exitCode > 255))
+      || !Number.isSafeInteger(record.inputSequence) || record.inputSequence < 0
+      || (record.inputDigest !== null && !SHA256_RE.test(record.inputDigest))
+      || !Number.isSafeInteger(record.nextCursor) || record.nextCursor < 0 || typeof record.outputLost !== "boolean"
+      || !Array.isArray(record.output) || record.output.length > MAX_JOB_OUTPUT_CHUNKS
+      || (record.environmentRevision === undefined) !== (record.environmentSnapshotId === undefined)
+      || (record.environmentRevision !== undefined && (!Number.isSafeInteger(record.environmentRevision)
+        || record.environmentRevision < 1 || !UUID_RE.test(record.environmentSnapshotId)))) throw new Error("invalid_job_journal");
+    let cursor = 0;
+    let chars = 0;
+    for (const chunk of record.output) {
+      if (!chunk || !Number.isSafeInteger(chunk.cursor) || chunk.cursor <= cursor || chunk.cursor > record.nextCursor
+        || !["stdout", "stderr"].includes(chunk.stream) || typeof chunk.text !== "string") throw new Error("invalid_job_journal");
+      cursor = chunk.cursor;
+      chars += chunk.text.length;
+    }
+    if (chars > MAX_JOB_OUTPUT_CHARS || jobs.size >= MAX_LEDGER_IDS) throw new Error("job_journal_full");
+    if (record.pty !== undefined) {
+      const pty = record.pty;
+      if (!isPtyJobId(record.jobId) || !hasOnlyKeys(pty, ["version", "cols", "rows", "output", "cleanup"])
+        || pty.version !== 1 || !validPtyDimensions(pty) || record.output.length !== 0
+        || !Array.isArray(pty.output) || pty.output.length > MAX_JOB_OUTPUT_CHUNKS
+        || (isLiveJob(record) ? pty.cleanup !== "pending" : record.state === "uncertain"
+          ? pty.cleanup !== "unconfirmed" : pty.cleanup !== "confirmed")) throw new Error("invalid_job_journal");
+      let previous = 0, bytes = 0;
+      for (const chunk of pty.output) {
+        if (!hasOnlyKeys(chunk, ["cursor", "dataBase64"]) || !Number.isSafeInteger(chunk.cursor)
+          || chunk.cursor <= previous || chunk.cursor > record.nextCursor || !validPtyBytes(chunk.dataBase64)) throw new Error("invalid_job_journal");
+        previous = chunk.cursor;
+        bytes += Buffer.from(chunk.dataBase64, "base64").length;
+      }
+      if (bytes > MAX_PTY_OUTPUT_BYTES) throw new Error("job_journal_full");
+    }
+    if (isLiveJob(record)) {
+      record.state = "uncertain";
+      if (record.pty) record.pty.cleanup = "unconfirmed";
+      record.finishedAtMs = Date.now();
+      record.exitCode = null;
+      bytes = privateJournalWrite(name, JSON.stringify(record));
+    }
+    const job = { record, operation: null, flushTimer: null, journalBytes: bytes };
+    reservedBytes += jobJournalReservation(job);
+    if (reservedBytes > MAX_JOB_JOURNAL_BYTES) throw new Error("job_journal_full");
+    jobs.set(record.jobId, job);
+  }
+  // Recovery rewrites remove matching temp files. Scan again afterward so
+  // neither missing entries nor already-deleted bytes depend on listing order.
+  for (const name of fs.readdirSync(journalDirectory)) {
+    if (!/^[0-9a-f]{64}\.job\.json\.tmp$/.test(name)) continue;
+    const stat = fs.lstatSync(path.join(journalDirectory, name));
+    if (!stat.isFile() || stat.uid !== process.getuid() || (stat.mode & 0o077) !== 0 || stat.size > MAX_JOB_RECORD_BYTES) throw new Error("invalid_job_journal");
+    journalDebrisBytes += stat.size;
+    reservedBytes += stat.size;
+    if (reservedBytes > MAX_JOB_JOURNAL_BYTES) throw new Error("job_journal_full");
+  }
+}
+try { prepareJournalDirectory(); } catch { process.exit(44); }
+try { acquireJournalOwnership(); } catch { process.exit(46); }
+// An unchanged record is not rewritten; a durable request still fsyncs one
+// that was last written without it.
+function persistJob(job, durable = true) {
+  if (journalFailed) throw new Error("job_journal_unavailable");
+  const encoded = JSON.stringify(job.record), written = digest(encoded);
+  if (written === job.journalDigest && (job.journalDurable || !durable)) return;
+  try {
+    job.journalBytes = privateJournalWrite(jobFile(job.record.jobId), encoded, MAX_JOB_RECORD_BYTES, durable);
+    job.journalDigest = written;
+    job.journalDurable = durable;
+  }
+  catch {
+    journalFailed = true;
+    // Once durable evidence is unavailable no new effects are admitted. Only
+    // our live ChildProcess handles are cancelled; journaled PIDs are never used.
+    for (const candidate of jobs.values()) {
+      if (!isLiveJob(candidate.record)) continue;
+      candidate.record.state = "uncertain";
+      if (candidate.record.pty) candidate.record.pty.cleanup = "unconfirmed";
+      candidate.record.exitCode = null;
+      if (candidate.operation) void candidate.operation.cancel().catch(() => {});
+    }
+    throw new Error("job_journal_unavailable");
+  }
+}
+function appendJobOutput(job, stream, text) {
+  if (!text || journalFailed) return;
+  const record = job.record;
+  // Split oversized reads rather than silently losing the prefix inside one
+  // cursor. Cursor gaps then describe every discarded output chunk precisely.
+  if (text.length > MAX_JOB_OUTPUT_CHARS) {
+    for (let offset = 0; offset < text.length; offset += MAX_JOB_OUTPUT_CHARS) {
+      appendJobOutput(job, stream, text.slice(offset, offset + MAX_JOB_OUTPUT_CHARS));
+    }
+    return;
+  }
+  record.output.push({ cursor: ++record.nextCursor, stream, text });
+  let chars = record.output.reduce((sum, chunk) => sum + chunk.text.length, 0);
+  while (record.output.length > MAX_JOB_OUTPUT_CHUNKS || chars > MAX_JOB_OUTPUT_CHARS) {
+    chars -= record.output.shift().text.length;
+    record.outputLost = true;
+  }
+  scheduleJobFlush(job);
+}
+function scheduleJobFlush(job) {
+  if (!job.flushTimer) job.flushTimer = setTimeout(() => {
+    job.flushTimer = null;
+    try { persistJob(job, false); } catch { /* failure already stops live jobs */ }
+  }, 50);
+}
+function appendPtyOutput(job, data) {
+  if (!data.length || journalFailed) return;
+  const record = job.record, output = record.pty.output;
+  for (let offset = 0; offset < data.length; offset += MAX_PTY_INPUT_BYTES) {
+    output.push({ cursor: ++record.nextCursor, dataBase64: Buffer.from(data.subarray(offset, offset + MAX_PTY_INPUT_BYTES)).toString("base64") });
+  }
+  let bytes = output.reduce((sum, chunk) => sum + Buffer.from(chunk.dataBase64, "base64").length, 0);
+  while (output.length > MAX_JOB_OUTPUT_CHUNKS || bytes > MAX_PTY_OUTPUT_BYTES) {
+    bytes -= Buffer.from(output.shift().dataBase64, "base64").length;
+    record.outputLost = true;
+  }
+  scheduleJobFlush(job);
+}
+async function jobSnapshot(job, after = 0) {
+  const record = job.record;
+  const operation = job.operation;
+  let processIdentity = isLiveJob(record) && operation ? operation.processIdentity() : null;
+  if (record.pty && isLiveJob(record) && !processIdentity && operation) {
+    await operation.started;
+    processIdentity = isLiveJob(record) ? operation.processIdentity() : null;
+    // The anchor can exit before its promise publishes the terminal record.
+    // Wait for the owning cleanup proof, not a client retry or a fabricated
+    // running PID. Unexpected identity loss still resolves uncertain.
+    if (!processIdentity) { await operation.settle(); await operation.promise; }
+  }
+  const firstCursor = (record.pty ? record.pty.output : record.output)[0]?.cursor || record.nextCursor + 1;
+  return {
+    jobId: record.jobId, state: record.state, startedAtMs: record.startedAtMs,
+    finishedAtMs: record.finishedAtMs, leaseExpiresAtMs: record.leaseExpiresAtMs,
+    exitCode: record.exitCode, inputSequence: record.inputSequence,
+    firstCursor, nextCursor: record.nextCursor,
+    truncated: after < firstCursor - 1 || (record.outputLost && after === 0),
+    output: record.output.filter((chunk) => chunk.cursor > after),
+    ...(record.pty ? { pty: { ...record.pty, output: record.pty.output.filter((chunk) => chunk.cursor > after) } } : {}),
+    ...(processIdentity ? { process: processIdentity } : {}),
+    ...(record.environmentRevision === undefined ? {} : {
+      environmentRevision: record.environmentRevision, environmentSnapshotId: record.environmentSnapshotId,
+    }),
+  };
+}
+function isPtyJobId(value) { return typeof value === "string" && value.startsWith("pty-") && UUID_RE.test(value.slice(4)); }
+function validPtyDimensions(input) {
+  return [input.cols, input.rows].every((n) => Number.isSafeInteger(n) && n >= 1 && n <= MAX_PTY_DIMENSION);
+}
+function validPtyBytes(value) {
+  if (typeof value !== "string" || !value.length || value.length > Math.ceil(MAX_PTY_INPUT_BYTES / 3) * 4) return false;
+  const bytes = Buffer.from(value, "base64");
+  return bytes.length > 0 && bytes.length <= MAX_PTY_INPUT_BYTES && bytes.toString("base64") === value;
+}
+function validJobRequest(value) {
+  if (!hasOnlyKeys(value, ["type", "version", "generation", "id", "jobId", "action", "input"])
+    || value.type !== "job" || value.version !== VERSION || !Number.isSafeInteger(value.generation) || value.generation < 1
+    || typeof value.id !== "string" || !ID_RE.test(value.id) || typeof value.jobId !== "string" || !ID_RE.test(value.jobId)
+    || !hasOnlyKeys(value.input, ["script", "leaseExpiresAtMs", "after", "sequence", "data", "eof", "mode", "cols", "rows", "dataBase64"])) return false;
+  const input = value.input;
+  const validLease = Number.isSafeInteger(input.leaseExpiresAtMs) && input.leaseExpiresAtMs > 0;
+  if (value.action === "start") return input.mode === "pty"
+    ? hasOnlyKeys(input, ["mode", "cols", "rows", "leaseExpiresAtMs"]) && isPtyJobId(value.jobId) && validPtyDimensions(input) && validLease
+    : hasOnlyKeys(input, ["script", "leaseExpiresAtMs"]) && typeof input.script === "string" && input.script.length <= MAX_INPUT_CHARS && validLease;
+  if (value.action === "inspect") return hasOnlyKeys(input, ["after"]) && Number.isSafeInteger(input.after) && input.after >= 0;
+  if (value.action === "resize") return hasOnlyKeys(input, ["sequence", "cols", "rows"])
+    && isPtyJobId(value.jobId) && Number.isSafeInteger(input.sequence) && input.sequence >= 1 && validPtyDimensions(input);
+  if (value.action === "input" && "dataBase64" in input) return hasOnlyKeys(input, ["sequence", "dataBase64"])
+    && isPtyJobId(value.jobId) && Number.isSafeInteger(input.sequence) && input.sequence >= 1 && validPtyBytes(input.dataBase64);
+  if (value.action === "input") return hasOnlyKeys(input, ["sequence", "data", "eof"])
+    && Number.isSafeInteger(input.sequence) && input.sequence >= 1 && typeof input.data === "string"
+    && input.data.length <= MAX_JOB_INPUT_CHARS && typeof input.eof === "boolean";
+  if (value.action === "renew") return hasOnlyKeys(input, ["leaseExpiresAtMs"]) && validLease;
+  return value.action === "cancel" && hasOnlyKeys(input, []);
+}
+function currentMaintenance() {
+  if (maintenanceLease && maintenanceLease.expiresAtMs <= Date.now() && active.size === 0) maintenanceLease = null;
+  return maintenanceLease;
+}
+function handleLifecycle(target, claim, raw) {
+  let value;
+  try { value = JSON.parse(raw); } catch { return; }
+  if (!hasOnlyKeys(value, ["type", "version", "generation", "id", "action", "leaseId"])
+    || value.type !== "lifecycle" || value.version !== VERSION || safeId(value.id) === "invalid"
+    || typeof value.leaseId !== "string" || !UUID_RE.test(value.leaseId)
+    || !["inspect", "quiesce", "release", "retire"].includes(value.action)) return;
+  // A running managed job also holds a slot in active (so it is cancelled with
+  // the worker) but is counted as a live job. Reporting it as an active request
+  // too made a running dev server look like an in-flight request to callers
+  // that proceed when only live jobs remain. Admission below still uses active.
+  let liveJobs = liveBackgroundGroups(), uncertainJobs = 0, activeJobs = 0;
+  for (const job of jobs.values()) {
+    if (["starting", "running"].includes(job.record.state) || job.operation) liveJobs += 1;
+    if (job.record.state === "uncertain") uncertainJobs += 1;
+    if (active.has(job)) activeJobs += 1;
+  }
+  const held = currentMaintenance();
+  let status = held ? "held" : "idle";
+  if (stopped || value.generation !== claim.generation || claim.generation !== targetGeneration || claim.fenceId !== targetFenceId) status = "fenced";
+  else if (value.action === "retire") {
+    if (!held || held.id !== value.leaseId) status = "fenced";
+    else if (active.size || pendingJobRequests || liveJobs || uncertainJobs || journalFailed || requestJournalFailed || uncertainRequestIds.size) status = "busy";
+    else { stopped = true; status = "retired"; }
+  } else if (value.action === "release") {
+    if (held && held.id === value.leaseId && active.size > 0) status = "busy";
+    else if (held && held.id === value.leaseId) { maintenanceLease = null; status = "released"; }
+    else status = "fenced";
+  } else if (value.action === "quiesce") {
+    if (held && held.id !== value.leaseId) status = "busy";
+    else if (active.size || pendingJobRequests || liveJobs || uncertainJobs || journalFailed || requestJournalFailed || uncertainRequestIds.size) status = "busy";
+    else {
+      maintenanceLease = held || { id: value.leaseId, expiresAtMs: Math.min(config.expiresAtMs, Date.now() + 10 * 60 * 1000) };
+      status = "acquired";
+    }
+  }
+  sendResult(target, { type: "lifecycle_result", version: VERSION, generation: claim.generation,
+    id: value.id, leaseId: value.leaseId, status, activeRequests: active.size - activeJobs,
+    pendingJobRequests, liveJobs, uncertainJobs, uncertainRequests: uncertainRequestIds.size, expiresAtMs: maintenanceLease ? maintenanceLease.expiresAtMs : null });
+  // Retirement revokes admission synchronously. Give the response a bounded
+  // flush window, then exit cleanly and release the durable journal owner.
+  // A lost acknowledgement is recoverable as worker loss, never a live replay.
+  if (status === "retired") setTimeout(() => { void stop("planned_retirement"); }, 50);
+}
+function handleGuestMemory(target, claim, raw) {
+  let v; try { v=JSON.parse(raw); } catch { return; }
+  if (!hasOnlyKeys(v,["type","version","generation","fenceId","id","runId","executorLaunchId"])
+    || v.type!=="guest_memory" || v.version!==VERSION || safeId(v.id)==="invalid"
+    || !UUID_RE.test(v.runId) || !UUID_RE.test(v.executorLaunchId) || !UUID_RE.test(v.fenceId)) return;
+  const reply=(status,sample,reasonCode) => sendResult(target,{...v,type:"guest_memory_result",status,observedAtMs:Date.now(),...(sample?{sample}:{}),...(claim.guestMemoryDiagnosticsVersion===1 && reasonCode?{reasonCode}:{})});
+  if(claim.guestMemoryVersion!==1 || process.platform!=="linux" || !config.terminalCleanupRunId) return reply("unsupported");
+  if(stopped || terminalCleanupStarted || target!==socket || v.generation!==claim.generation
+    || claim.generation!==targetGeneration || claim.fenceId!==targetFenceId || v.fenceId!==claim.fenceId
+    || v.executorLaunchId!==config.launchId || v.runId!==config.terminalCleanupRunId
+    || Date.now()>=config.expiresAtMs || currentMaintenance()) return reply("fenced");
+  try { const sample=sampleGuestMemory(fs,path); reply("observed",sample); }
+  catch (error) {
+    const reasonCode=error && typeof error=== "object" && typeof error.reasonCode=== "string"
+      && GUEST_MEMORY_UNAVAILABLE_REASONS.includes(error.reasonCode) ? error.reasonCode : undefined;
+    reply("unavailable",undefined,reasonCode);
+  }
+}
+async function handleTerminalCleanup(target, claim, raw) {
+  let v;
+  try { v = JSON.parse(raw); } catch { return; }
+  if (!hasOnlyKeys(v, ["type", "version", "generation", "id", "runId", "executorLaunchId"])
+    || v.type !== "terminal_cleanup" || v.version !== VERSION || safeId(v.id) === "invalid"
+    || !UUID_RE.test(v.runId) || !UUID_RE.test(v.executorLaunchId)) return;
+  const reply = status => sendResult(target, { ...v, type: "terminal_cleanup_result", status, observedAtMs: Date.now() });
+  if (claim.terminalCleanupVersion !== 1 || process.platform !== "linux" || !config.jobEnvSourcePath || !config.terminalCleanupRunId) return reply("unsupported");
+  if (stopped || terminalCleanupStarted || target !== socket || v.generation !== claim.generation
+    || claim.generation !== targetGeneration || claim.fenceId !== targetFenceId
+    || v.executorLaunchId !== config.launchId || v.runId !== config.terminalCleanupRunId || Date.now() >= config.expiresAtMs) return reply("fenced");
+  if (currentMaintenance() || active.size || pendingJobRequests || journalFailed || requestJournalFailed || uncertainRequestIds.size
+    || [...jobs.values()].some(job => job.operation || ["starting", "running", "uncertain"].includes(job.record.state))) return reply("busy");
+  // No new claim, model request, private job or reconnect may race the fixed
+  // privileged operation. This fence is never released, even on failure.
+  terminalCleanupStarted = true;
+  terminalCleanupPromise = (async () => {
+    // The run is over: its retained background commands end before cleanup.
+    if ((await Promise.all(stopBackgroundGroups())).some(Boolean)) { cleanupUnconfirmed = true; return false; }
+    if (!(await terminalParentRequest("begin", claim)) || stopped || target !== socket
+      || claim.generation !== targetGeneration || claim.fenceId !== targetFenceId || Date.now() >= config.expiresAtMs) {
+      cleanupUnconfirmed = true; return false;
+    }
+    const ok = await new Promise(resolve => {
+    let child, timer, killTimer;
+    const finish = ok => { clearTimeout(timer); clearTimeout(killTimer); if (!ok) cleanupUnconfirmed = true; resolve(ok); };
+    try {
+      child = spawn("/usr/bin/python3", ["-I", "-c", ${JSON.stringify(x)}],
+        { stdio: ["pipe", "ignore", "ignore"], env: { PATH: "/usr/bin:/bin" }, detached: true });
+      let timedOut = false;
+      timer = setTimeout(() => { timedOut = true; try { process.kill(-child.pid, "SIGTERM"); } catch { cleanupUnconfirmed = true; }
+        killTimer = setTimeout(() => { try { process.kill(-child.pid, "SIGKILL"); } catch { cleanupUnconfirmed = true; } }, 500); }, 10_000);
+      child.once("error", () => finish(false));
+      child.once("close", code => finish(!timedOut && code === 0));
+      child.stdin.on("error", () => {});
+      child.stdin.end(JSON.stringify({ root: config.workRoot, source: config.jobEnvSourcePath,
+        snapshot: config.jobEnvPath, runId: config.terminalCleanupRunId }));
+    } catch { finish(false); }
+  });
+    const accepted = ok && !stopped && target === socket && claim.generation === targetGeneration
+      && claim.fenceId === targetFenceId && await terminalParentRequest("cleaned", claim);
+    if (!accepted) cleanupUnconfirmed = true;
+    return accepted;
+  })();
+  const parentAccepted = await terminalCleanupPromise;
+  reply(parentAccepted && target === socket && claim.generation === targetGeneration && claim.fenceId === targetFenceId ? "cleaned" : "unconfirmed");
+}
+function validJobLease(deadline) {
+  return deadline > Date.now() && deadline <= config.expiresAtMs && deadline <= Date.now() + 12 * 60 * 60 * 1000;
+}
+async function handleJob(claim, raw, sendReply, isCurrent, fromControl = false) {
+  let request;
+  try { request = JSON.parse(raw); } catch { return; }
+  const reply = (body) => {
+    if (!isCurrent() || claim.generation !== targetGeneration || claim.fenceId !== targetFenceId) return;
+    sendReply({ type: "job_result", version: VERSION, generation: claim.generation, id: safeId(request.id), ...body });
+  };
+  const fail = (error) => reply({ ok: false, error });
+  if (!isCurrent() || terminalCleanupStarted || stopped || claim.generation !== targetGeneration || claim.fenceId !== targetFenceId) return;
+  if (!validJobRequest(request)) return fail("invalid_job_request");
+  if (validPrivateJob && (request.jobId !== config.directShell.jobId
+    || !["start", "inspect", "cancel"].includes(request.action) || request.input.mode !== undefined)) return fail("invalid_job_request");
+  if (request.generation !== claim.generation) return fail("stale_generation");
+  if (!config.managedJobs || !allowedTools.includes("bash")) return fail("jobs_disabled");
+  if (journalFailed) return fail("job_journal_unavailable");
+  if (currentMaintenance() && !["inspect", "poll", "cancel"].includes(request.action)) return fail("maintenance_held");
+  if (pendingJobRequests >= 128) return fail("job_capacity");
+  pendingJobRequests += 1;
+  let job = jobs.get(request.jobId);
+  try {
+    if (request.action === "start") {
+      const pty = request.input.mode === "pty";
+      if (pty && !ptySupported()) return fail("pty_unsupported");
+      if (!pty && request.input.script.includes("\0")) return fail("invalid_job_request");
+      const hash = digest(pty ? JSON.stringify(["pty", request.input.cols, request.input.rows]) : request.input.script);
+      if (job) {
+        if (Boolean(job.record.pty) !== pty) return fail("job_mode_mismatch");
+        if (job.record.digest !== hash) return fail("job_conflict");
+        // A duplicate start observes the original admission, including its
+        // consumed environment receipt; "starting" is only an inspect result.
+        if (job.operation) await job.operation.started;
+      } else {
+        if (!validJobLease(request.input.leaseExpiresAtMs)) return fail("job_lease_expired");
+        if (!hasJobCapacity()) return fail("job_capacity");
+        // Chosen before the durable record, so nothing can cancel a job whose spawn is pending.
+        const terminal = pty ? await terminalProgram() : null;
+        if (jobs.has(request.jobId) || !hasJobCapacity()) {
+          if (terminal) terminal.release();
+          return fail(jobs.has(request.jobId) ? "job_conflict" : "job_capacity");
+        }
+        job = { record: {
+          schema: 1, jobId: request.jobId, digest: hash, state: "starting", startedAtMs: Date.now(),
+          finishedAtMs: null, exitCode: null, leaseExpiresAtMs: request.input.leaseExpiresAtMs,
+          inputSequence: 0, inputDigest: null, output: [], nextCursor: 0, outputLost: false,
+          ...(pty ? { pty: { version: 1, cols: request.input.cols, rows: request.input.rows, output: [], cleanup: "pending" } } : {}),
+        }, operation: null, flushTimer: null, journalBytes: 0 };
+        jobs.set(request.jobId, job);
+        persistJob(job); // Durable intent before any process is spawned.
+        if (!validJobLease(job.record.leaseExpiresAtMs)) {
+          job.record.state = "expired";
+          job.record.finishedAtMs = Date.now();
+          job.record.exitCode = 124;
+          if (pty) job.record.pty.cleanup = "confirmed";
+          if (terminal) terminal.release();
+          persistJob(job);
+          return fail("job_lease_expired");
+        }
+        const managed = {
+          // A job a person started over the control socket runs as the payload account (config.jobsUser).
+          asJobsUser: fromControl && Boolean(config.jobsUser),
+          leaseExpiresAtMs: job.record.leaseExpiresAtMs,
+          onOutput: (stream, text) => appendJobOutput(job, stream, text),
+          onBytes: (bytes) => appendPtyOutput(job, bytes),
+          onEnvironment: (environment) => {
+            job.record.environmentRevision = environment.revision;
+            job.record.environmentSnapshotId = environment.snapshot_id;
+            persistJob(job);
+          },
+        };
+        const operation = pty ? ptyOperation(request, managed, terminal.program)
+          : bashOperation({ id: request.jobId, input: { script: request.input.script } }, null, managed);
+        job.operation = operation;
+        active.set(job, operation);
+        void operation.promise.then((result) => {
+          if (terminal) terminal.release();
+          active.delete(job);
+          job.operation = null;
+          clearTimeout(job.flushTimer);
+          job.flushTimer = null;
+          if (job.record.state !== "uncertain") {
+            job.record.state = result.error === "timeout" ? "expired"
+              : result.error === "cancelled" ? "cancelled"
+              : result.error === "process_group_cleanup_unconfirmed" ? "uncertain" : "exited";
+            job.record.exitCode = job.record.state === "uncertain" ? null : result.exitCode;
+          }
+          job.record.finishedAtMs = Date.now();
+          if (job.record.pty) job.record.pty.cleanup = job.record.state === "uncertain" ? "unconfirmed" : "confirmed";
+          try { persistJob(job); } catch { /* remains uncertain on durable failure */ }
+        });
+        if (await operation.started && job.record.state === "starting") job.record.state = "running";
+        persistJob(job);
+      }
+    } else if (!job) return fail("job_not_found");
+    else if (request.action === "cancel") {
+      if (job.operation && isLiveJob(job.record)) {
+        const operation = job.operation;
+        await operation.cancel();
+        await operation.promise;
+      }
+    } else if (request.action === "input" || request.action === "resize") {
+      const input = request.input;
+      const pty = request.action === "resize" || "dataBase64" in input;
+      if (Boolean(job.record.pty) !== pty) return fail("job_mode_mismatch");
+      const hash = digest(JSON.stringify(pty ? [request.action, input.dataBase64, input.cols, input.rows] : [input.data, input.eof]));
+      const data = pty ? Buffer.from(input.dataBase64 || "", "base64") : input.data;
+      if (input.sequence === job.record.inputSequence && hash === job.record.inputDigest) {
+        // Duplicate intent: returning state is not a promise that stdin was consumed.
+      } else {
+        if (!job.operation || !isLiveJob(job.record)) return fail("job_not_running");
+        if (Date.now() >= job.record.leaseExpiresAtMs) return fail("job_lease_expired");
+        if (input.sequence !== job.record.inputSequence + 1) return fail("job_input_sequence");
+        const inputError = job.operation.canInput(data);
+        if (inputError) return fail(inputError);
+        job.record.inputSequence = input.sequence;
+        job.record.inputDigest = hash;
+        persistJob(job, false); // Record accepted intent before stdin effects; never replay on recovery.
+        const error = request.action === "resize" ? job.operation.resize(input.cols, input.rows) : job.operation.input(data, input.eof);
+        if (error) return fail(error);
+        if (request.action === "resize") { job.record.pty.cols = input.cols; job.record.pty.rows = input.rows; }
+      }
+    } else if (request.action === "renew") {
+      if (!job.operation || !isLiveJob(job.record)) return fail("job_not_running");
+      // Preparation holds its own immutable deadline. Do not acknowledge a
+      // pipe-job extension until that authority has admitted the child.
+      if (!job.record.pty && job.record.state !== "running") return fail("job_not_running");
+      if (Date.now() >= job.record.leaseExpiresAtMs || !validJobLease(request.input.leaseExpiresAtMs)) return fail("job_lease_expired");
+      // Retried or out-of-order renewals never shorten an already accepted lease.
+      job.record.leaseExpiresAtMs = Math.max(job.record.leaseExpiresAtMs, request.input.leaseExpiresAtMs);
+      persistJob(job);
+      if (!job.operation.renew(job.record.leaseExpiresAtMs)) return fail("job_not_running");
+    }
+    const snapshot = await jobSnapshot(job, request.action === "inspect" ? request.input.after : 0);
+    persistJob(job, false); // The acknowledged output cursor survives a worker restart.
+    reply({ ok: true, job: snapshot });
+  } catch { fail(journalFailed ? "job_journal_unavailable" : "job_not_running"); }
+  finally { pendingJobRequests -= 1; }
+}
+function startJobControl() {
+  if (!config.jobControlSocketPath) return Promise.resolve();
+  return new Promise((resolve, reject) => {
+    const directory = path.dirname(config.jobControlSocketPath);
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid()
+      || (stat.mode & 0o777) !== 0o700 || fs.realpathSync(directory) !== directory
+      || path.join(directory, "control.sock") !== config.jobControlSocketPath) throw new Error("invalid_job_control_directory");
+    for (const root of [config.repoPath, config.workRoot]) {
+      const canonical = fs.realpathSync(root);
+      if (directory === canonical || directory.startsWith(canonical + path.sep) || canonical.startsWith(directory + path.sep)) {
+        throw new Error("job_control_overlaps_workspace");
+      }
+    }
+    // lstat also rejects dangling symlinks; never unlink or adopt an existing
+    // endpoint. An exclusive per-launch directory is composition-owned.
+    try { fs.lstatSync(config.jobControlSocketPath); throw new Error("job_control_path_exists"); }
+    catch (error) { if (error.code !== "ENOENT") throw error; }
+    // Bind before connecting the relay so a duplicate/stale socket cannot leave
+    // a second serving worker. Single framed request per connection, bounded
+    // clients/body/time; the existing job handler owns all mutations.
+    const server = net.createServer((client) => {
+      jobControlClients.add(client);
+      client.once("close", () => jobControlClients.delete(client));
+      client.on("error", () => {});
+      client.setTimeout(10000, () => client.destroy());
+      client.setEncoding("utf8");
+      let raw = "";
+      let received = false;
+      client.on("data", (chunk) => {
+        if (received) { client.destroy(); return; }
+        raw += chunk;
+        if (Buffer.byteLength(raw) > MAX_JOB_CONTROL_FRAME_BYTES) { client.destroy(); return; }
+        const end = raw.indexOf("\n");
+        if (end < 0) return;
+        received = true;
+        if (end !== raw.length - 1) { client.destroy(); return; }
+        let envelope;
+        try { envelope = JSON.parse(raw.slice(0, end)); } catch { client.destroy(); return; }
+        if (!hasOnlyKeys(envelope, ["version", "scopeId", "fenceId", "executorLaunchId", "request"])
+          || envelope.version !== 1 || envelope.scopeId !== config.managedJobs.scopeId
+          || envelope.fenceId !== targetFenceId || envelope.executorLaunchId !== config.launchId
+          || !validJobRequest(envelope.request) || envelope.request.generation !== targetGeneration || stopped) {
+          client.destroy(); return;
+        }
+        void handleJob({ generation: envelope.request.generation, fenceId: envelope.fenceId }, JSON.stringify(envelope.request),
+          (result) => client.end(JSON.stringify(result) + "\n"), () => !client.destroyed, true);
+      });
+    });
+    server.maxConnections = 16;
+    server.once("error", reject);
+    server.listen(config.jobControlSocketPath, () => {
+      try { fs.chmodSync(config.jobControlSocketPath, 0o600); }
+      catch (error) { server.close(); reject(error); return; }
+      jobControlServer = server;
+      resolve();
+    });
+  });
+}
+async function handleRequestCancel(target, claim, raw) {
+  let request;
+  try { request = JSON.parse(raw); } catch { return; }
+  if (!hasOnlyKeys(request, ["type", "version", "generation", "id", "targetId"])
+    || request.type !== "cancel_request" || request.version !== VERSION || request.generation !== claim.generation
+    || typeof request.id !== "string" || !ID_RE.test(request.id)
+    || typeof request.targetId !== "string" || !ID_RE.test(request.targetId)) {
+    closeSocket(target, "invalid_cancel_request"); return;
+  }
+  const operation = active.get(request.targetId);
+  let status = ledger.has(request.targetId) ? "settled" : "not_found";
+  if (operation) {
+    // The CLI owns REPL child termination on socket abort. Closing that RPC
+    // requests reset but cannot itself attest child death over a closed socket.
+    status = operation.supportsCancellation ? "cancelled" : "unsupported";
+    if (operation.supportsCancellation) {
+      try {
+        await operation.cancel(true);
+        const result = await operation.promise;
+        if (result.error === "process_group_cleanup_unconfirmed") status = "unconfirmed";
+        else if (operation.cancellationRequiresExternalProof) status = "unconfirmed";
+        else if (result.error !== "cancelled") status = "settled";
+      } catch { status = "unconfirmed"; }
+    }
+  }
+  if (target === socket && claim.generation === targetGeneration && claim.fenceId === targetFenceId) {
+    sendResult(target, { type: "cancel_ack", version: VERSION, generation: claim.generation,
+      id: request.id, targetId: request.targetId, status });
+  }
+}
+function processGroupAbsent(pgid) {
+  try {
+    process.kill(-pgid, 0);
+    if (process.platform === "linux") {
+      try {
+        const entries = fs.readdirSync("/proc");
+        for (let i = 0; i < entries.length; i++) {
+          const entry = entries[i];
+          if (entry.charCodeAt(0) < 48 || entry.charCodeAt(0) > 57) continue;
+          try {
+            const stat = fs.readFileSync("/proc/" + entry + "/stat", "utf8");
+            const closeParen = stat.lastIndexOf(")");
+            if (closeParen < 0) continue;
+            const fields = stat.slice(closeParen + 2).split(" ");
+            const state = fields[0];
+            const pgrp = Number(fields[2]);
+            if (pgrp === pgid && state !== "Z") {
+              return false;
+            }
+          } catch {
+            // Process exited between readdir and stat read
+          }
+        }
+        return true;
+      } catch {
+        // Fallback to process.kill result
+      }
+    }
+    return false;
+  } catch (error) {
+    return Boolean(error && error.code === "ESRCH");
+  }
+}
+function waitForProcessGroupAbsent(pgid, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  return new Promise((resolve) => {
+    const inspect = () => {
+      if (processGroupAbsent(pgid)) {
+        resolve(true);
+        return;
+      }
+      if (Date.now() >= deadline) {
+        resolve(false);
+        return;
+      }
+      // This referenced timer is part of the worker's exact stop proof. The
+      // worker must remain alive until every tracked process group is absent.
+      setTimeout(inspect, 20);
+    };
+    inspect();
+  });
+}
+async function killGroup(child) {
+  if (!child || !Number.isSafeInteger(child.pid)) return;
+  const pgid = child.pid;
+  if (processGroupAbsent(pgid)) return;
+  try { process.kill(-pgid, "SIGTERM"); } catch (error) {
+    if (error && error.code !== "ESRCH") throw error;
+  }
+  if (await waitForProcessGroupAbsent(pgid, 500)) return;
+  try { process.kill(-pgid, "SIGKILL"); } catch (error) {
+    if (error && error.code !== "ESRCH") throw error;
+  }
+  if (await waitForProcessGroupAbsent(pgid, 2_000)) return;
+  throw new Error("process_group_cleanup_unconfirmed");
+}
+// A retainBackground Bash request or Pi shell settles when its command exits; descendants
+// still in its process group keep running and stay tracked here. A group ID
+// cannot be reused while any member lives, and the group is forgotten once
+// empty (polled every 500 ms, and when a Bash leader is spawned with that PID).
+function liveBackgroundGroups() {
+  for (const pgid of backgroundGroups.keys()) if (processGroupAbsent(pgid)) backgroundGroups.delete(pgid);
+  if (!backgroundGroups.size && backgroundGroupTimer) { clearInterval(backgroundGroupTimer); backgroundGroupTimer = null; }
+  return backgroundGroups.size;
+}
+function retainBackgroundGroup(child) {
+  if (processGroupAbsent(child.pid)) return;
+  backgroundGroups.set(child.pid, child);
+  if (!backgroundGroupTimer) {
+    backgroundGroupTimer = setInterval(liveBackgroundGroups, 500);
+    backgroundGroupTimer.unref();
+  }
+}
+function stopBackgroundGroups() {
+  const groups = [...backgroundGroups.values()];
+  backgroundGroups.clear();
+  return groups.map((child) => killGroup(child).then(() => null,
+    () => ({ error: "process_group_cleanup_unconfirmed" })));
+}
+// reason-sdk (runtime/reason-v7-sync-yield-machine-sdk-v1): Reason's SDK as a
+// command on this machine, composable in shell. A Bash request sent with
+// machineSdk gets a private Unix socket for as long as the request runs; the
+// reason-sdk shim on its PATH sends each call there, and the worker forwards it
+// to the Brain as an sdk_request bound to that request's id. The Brain runs the
+// call and answers; no Reason credential is ever on the machine. Once the
+// request settles its socket is gone, so a process it left running in the
+// background cannot call Reason.
+const SDK_USAGE = [
+  "reason-sdk search WORDS [--namespace NAME] [--limit N]",
+  "reason-sdk namespace NAME",
+  "reason-sdk describe NAME",
+  "reason-sdk call NAME [--json '{...}' | --json -]",
+].join("\n");
+const SDK_NOT_LIVE = "reason-sdk: unavailable: it works only while the Bash call that ran it is running (within its first 60 s), and that call has ended.";
+const SDK_DISCONNECTED = "reason-sdk: unavailable: Reason is not connected to this machine right now. Try again.";
+const SDK_MAX_LINE_CHARS = 4 * MAX_INPUT_CHARS;
+const SDK_MAX_PENDING = 64;
+// The shim's socket client: macOS's own Perl (its nc exits at the end of its
+// input, before the answer), or this worker's runtime on Linux (the compiled CLI
+// runs as Bun there, as the Linux PTY launcher does). Either sends the shim's
+// line, prints the answer and prints nothing when the socket is gone.
+const SDK_RUNTIME_CLIENT = 'const s=require("node:net").createConnection(process.env.REASON_SDK_SOCKET);'
+  + 'const c=[];process.stdin.on("data",d=>c.push(d));process.stdin.on("end",()=>s.write(Buffer.concat(c)));'
+  + 's.pipe(process.stdout);s.on("error",()=>process.exit(0));';
+const SDK_PERL_CLIENT = 'use IO::Socket::UNIX;my $s=IO::Socket::UNIX->new(Type=>SOCK_STREAM(),Peer=>$ENV{REASON_SDK_SOCKET}) or exit 0;'
+  + 'local $/;my $in=<STDIN>;print $s $in;$s->flush;my $b;while(sysread($s,$b,65536)){syswrite(STDOUT,$b)}';
+function shellQuote(value) { return "'" + String(value).replace(/'/g, "'\\''") + "'"; }
+function machineSdkClientCommand() {
+  if (process.platform === "darwin") return fs.existsSync("/usr/bin/perl") ? "/usr/bin/perl -e " + shellQuote(SDK_PERL_CLIENT) : null;
+  if (process.platform !== "linux") return null;
+  return typeof Bun === "undefined"
+    ? shellQuote(process.execPath) + " -e " + shellQuote(SDK_RUNTIME_CLIENT)
+    : "env " + ["BUN", "BE", "BUN"].join("_") + "=1 " + shellQuote(process.execPath)
+      + " --no-env-file --config=/dev/null -e " + shellQuote(SDK_RUNTIME_CLIENT);
+}
+function machineSdkShim(client) {
+  return [
+    "#!/bin/bash",
+    "# reason-sdk: Reason's tools from this machine, while the Bash call that runs it is running.",
+    'socket="' + "$" + '{REASON_SDK_SOCKET:-}"',
+    'if [ -z "$socket" ] || [ ! -S "$socket" ]; then',
+    "  printf '%s\\n' " + shellQuote(SDK_NOT_LIVE) + " >&2",
+    "  exit 69",
+    "fi",
+    "stdin=-",
+    "previous=",
+    'for arg in "$@"; do',
+    '  if { [ "$previous" = --json ] && [ "$arg" = - ]; } || [ "$arg" = --json=- ]; then stdin="a$(base64 | tr -d \'\\n\')"; fi',
+    '  previous=$arg',
+    "done",
+    'line="v1 $stdin"',
+    'for arg in "$@"; do line="$line a$(printf %s "$arg" | base64 | tr -d \'\\n\')"; done',
+    "printf '%s\\n' \"$line\" | " + client + " | {",
+    "  IFS= read -r status || { printf '%s\\n' " + shellQuote(SDK_NOT_LIVE) + " >&2; exit 69; }",
+    '  case "$status" in',
+    "    0) cat ;;",
+    '    1|2|69|75) cat >&2; exit "$status" ;;',
+    "    *) printf '%s\\n' 'reason-sdk: invalid reply.' >&2; exit 75 ;;",
+    "  esac",
+    "}",
+    "",
+  ].join("\n");
+}
+// Asked at every claim, so it touches nothing on disk: the private directory
+// and shim are created by the first machineSdk request (machineSdkBase).
+function machineSdkAvailable() {
+  if (!allowedTools.includes("bash") || validPrivateJob || config.spawnPolicy || config.bashCommandPrefix
+    || localGithubSandbox || !machineSdkClientCommand()) return false;
+  return machineSdkTemporaryRoot() !== null;
+}
+// Where the private directory goes: the worker's temporary directory when a
+// socket path under it fits the Unix limit, else /tmp. A headless worker's
+// TMPDIR is a per-launch directory under its state directory, which commonly
+// exceeds the limit (as the managed-job control socket's does).
+function machineSdkTemporaryRoot() {
+  for (const candidate of [require("node:os").tmpdir(), "/tmp"]) {
+    try {
+      const root = fs.realpathSync(candidate);
+      if (fs.statSync(root).isDirectory() && Buffer.byteLength(path.join(root, "rsdk-XXXXXX", "00000000.sock")) <= 100) return root;
+    } catch (error) { void error; }
+  }
+  return null;
+}
+// One private directory per worker (owner-only, outside the workspace), created
+// by the first machineSdk request: the shim, and a socket per live machineSdk
+// request. Removed when the worker stops.
+function machineSdkBase() {
+  if (sdkBase) return sdkBase;
+  const client = machineSdkClientCommand();
+  const temporaryRoot = machineSdkTemporaryRoot();
+  if (!client || !temporaryRoot) throw new Error("machine_sdk_unavailable");
+  const root = fs.mkdtempSync(path.join(temporaryRoot, "rsdk-"));
+  try {
+    fs.chmodSync(root, 0o700);
+    const bin = path.join(root, "bin");
+    fs.mkdirSync(bin, { mode: 0o700 });
+    fs.writeFileSync(path.join(bin, "reason-sdk"), machineSdkShim(client), { mode: 0o700, flag: "wx" });
+    if (Buffer.byteLength(path.join(root, "00000000.sock")) > 100) throw new Error("machine_sdk_path_too_long");
+    sdkBase = { root, bin };
+    return sdkBase;
+  } catch (error) {
+    fs.rmSync(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+function removeMachineSdk() {
+  for (const endpoint of [...sdkEndpoints]) endpoint.close();
+  if (!sdkBase) return;
+  const root = sdkBase.root;
+  sdkBase = null;
+  // Best effort while stopping: a leftover private directory holds no live socket.
+  try { fs.rmSync(root, { recursive: true, force: true }); } catch (error) { void error; }
+}
+function failSdkCalls(target, message) {
+  for (const [id, entry] of sdkPending) {
+    if (target !== null && entry.target !== target) continue;
+    sdkPending.delete(id);
+    entry.reply(69, message);
+  }
+}
+// The shim's line: "v1", its stdin (only for --json -) and each argument, each
+// "a" + base64 or "-". The command is parsed here, so a usage error never
+// reaches the Brain; a call is forwarded only in a shape the Brain accepts.
+function machineSdkCall(line) {
+  const tokens = line.split(" ");
+  const decode = (token) => /^a[A-Za-z0-9+/]*={0,2}$/.test(token) ? Buffer.from(token.slice(1), "base64").toString("utf8") : null;
+  if (tokens.length < 2 || tokens[0] !== "v1" || (tokens[1] !== "-" && decode(tokens[1]) === null)) return { error: "reason-sdk: invalid request." };
+  const stdin = tokens[1] === "-" ? null : decode(tokens[1]);
+  const argv = tokens.slice(2).map(decode);
+  if (argv.some((arg) => arg === null)) return { error: "reason-sdk: invalid request." };
+  const usage = (message) => ({ error: "reason-sdk: " + message + "\nUsage:\n" + SDK_USAGE });
+  const validName = (name) => typeof name === "string" && name.length >= 1 && name.length <= 200 && !name.includes("\0");
+  const [verb, ...rest] = argv;
+  if (verb === undefined || ((verb === "help" || verb === "--help" || verb === "-h") && rest.length === 0)) return { call: { verb: "help" } };
+  if (verb === "search") {
+    const words = [];
+    const args = {};
+    for (let index = 0; index < rest.length;) {
+      const word = rest[index];
+      const flag = ["--namespace", "--limit"].find((name) => word === name || word.startsWith(name + "="));
+      if (!flag) { words.push(word); index += 1; continue; }
+      let value;
+      if (word === flag) {
+        if (index + 1 >= rest.length) return usage(flag + " needs a value.");
+        value = rest[index + 1]; index += 2;
+      } else { value = word.slice(flag.length + 1); index += 1; }
+      if (flag === "--namespace") {
+        if (!validName(value)) return usage("--namespace takes one name.");
+        args.namespace = value;
+      } else {
+        const limit = Number(value);
+        if (!Number.isInteger(limit) || limit < 1 || limit > 50) return usage("--limit takes a whole number from 1 to 50.");
+        args.limit = limit;
+      }
+    }
+    const query = words.join(" ");
+    if (!query.trim()) return usage("search needs words to search for.");
+    if (query.length > 2000) return usage("the search words are too long.");
+    return { call: { verb: "search", query, ...(Object.keys(args).length ? { args } : {}) } };
+  }
+  if (verb === "describe" || verb === "namespace") {
+    if (rest.length !== 1 || !validName(rest[0])) return usage(verb + " takes exactly one name.");
+    return { call: { verb, name: rest[0] } };
+  }
+  if (verb !== "call") return usage("unknown command " + JSON.stringify(verb) + ".");
+  const [name, ...options] = rest;
+  if (!validName(name)) return usage("call needs a tool name.");
+  let json;
+  for (let index = 0; index < options.length;) {
+    const option = options[index];
+    let value;
+    if (option.startsWith("--json=")) { value = option.slice(7); index += 1; }
+    else if (option === "--json") {
+      if (index + 1 >= options.length) return usage("--json needs a value.");
+      value = options[index + 1]; index += 2;
+    } else return usage("unexpected argument " + JSON.stringify(option) + "; pass the arguments as one JSON object with --json.");
+    if (json !== undefined) return usage("pass --json once.");
+    json = value === "-" ? (stdin ?? "") : value;
+  }
+  let args = {};
+  if (json !== undefined) {
+    try { args = JSON.parse(json); } catch (error) {
+      return { error: "reason-sdk: the --json arguments are not valid JSON (" + (error && error.message ? error.message : "parse error") + ")." };
+    }
+    if (!args || typeof args !== "object" || Array.isArray(args)) return { error: "reason-sdk: the --json arguments must be one JSON object." };
+    if (JSON.stringify(args).length > MAX_INPUT_CHARS) return { error: "reason-sdk: the --json arguments are too large." };
+  }
+  return { call: { verb: "call", name, args } };
+}
+function forwardSdkCall(jobRequestId, call, reply) {
+  const target = socket;
+  const claim = socketClaim;
+  if (!target || target.readyState !== WebSocket.OPEN || !claim || claim.machineSdkVersion !== 1
+    || claim.generation !== targetGeneration || claim.fenceId !== targetFenceId) { reply(69, SDK_DISCONNECTED); return; }
+  if (sdkPending.size >= SDK_MAX_PENDING) { reply(75, "reason-sdk: too many calls at once; wait for some to finish."); return; }
+  const id = "sdk-" + crypto.randomUUID();
+  const frame = JSON.stringify({ type: "sdk_request", version: VERSION, generation: targetGeneration, id, jobRequestId, ...call });
+  if (Buffer.byteLength(frame, "utf8") > MAX_FRAME_BYTES) { reply(2, "reason-sdk: the request is too large."); return; }
+  sdkPending.set(id, { jobRequestId, reply, target });
+  try { target.send(frame); } catch { sdkPending.delete(id); reply(69, SDK_DISCONNECTED); }
+}
+function handleSdkResponse(target, raw) {
+  let value;
+  try { value = JSON.parse(raw); } catch { closeSocket(target, "invalid_sdk_response"); return; }
+  const answer = value && value.ok === true ? "result" : "error";
+  if (!hasOnlyKeys(value, ["type", "version", "generation", "id", "ok", answer]) || value.type !== "sdk_response"
+    || value.version !== VERSION || value.generation !== targetGeneration || typeof value.id !== "string" || !ID_RE.test(value.id)
+    || (value.ok !== true && value.ok !== false) || typeof value[answer] !== "string" || value[answer].length > MAX_OUTPUT_CHARS
+    || (value.ok === false && value.error.length < 1)) {
+    closeSocket(target, "invalid_sdk_response");
+    return;
+  }
+  const entry = sdkPending.get(value.id);
+  // A late answer for a call whose request already settled has nowhere to go.
+  if (!entry || entry.target !== target) return;
+  sdkPending.delete(value.id);
+  entry.reply(value.ok ? 0 : 1, value[answer]);
+}
+// The socket and PATH entry of one machineSdk Bash request. Calls are accepted
+// only until close(), which the request's settlement calls.
+function machineSdkEndpoint(jobRequestId) {
+  const base = machineSdkBase();
+  sdkEndpointCount += 1;
+  const socketPath = path.join(base.root, String(sdkEndpointCount).padStart(8, "0") + ".sock");
+  const clients = new Map();
+  let live = true;
+  const server = net.createServer({ allowHalfOpen: true }, (client) => {
+    if (!live) { client.destroy(); return; }
+    let answered = false;
+    const reply = (status, text) => {
+      if (answered) return;
+      answered = true;
+      clients.delete(client);
+      if (!client.destroyed) client.end(status + "\n" + text + (text.endsWith("\n") ? "" : "\n"));
+    };
+    clients.set(client, reply);
+    client.once("close", () => clients.delete(client));
+    client.on("error", () => {});
+    client.setEncoding("utf8");
+    let raw = "";
+    let received = false;
+    client.on("data", (chunk) => {
+      if (received) return;
+      raw += chunk;
+      if (raw.length > SDK_MAX_LINE_CHARS) { received = true; reply(2, "reason-sdk: the request is too large."); return; }
+      const end = raw.indexOf("\n");
+      if (end < 0) return;
+      received = true;
+      const parsed = machineSdkCall(raw.slice(0, end));
+      if (parsed.error) reply(2, parsed.error);
+      else if (!live) reply(69, SDK_NOT_LIVE);
+      else forwardSdkCall(jobRequestId, parsed.call, reply);
+    });
+  });
+  server.maxConnections = 16;
+  const ready = new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      try { fs.chmodSync(socketPath, 0o600); resolve(); } catch (error) { reject(error); }
+    });
+  });
+  void ready.catch(() => {});
+  const endpoint = {
+    ready,
+    prelude: "export PATH=" + shellQuote(base.bin) + '":$PATH" REASON_SDK_SOCKET=' + shellQuote(socketPath) + "; ",
+    close() {
+      if (!live) return;
+      live = false;
+      sdkEndpoints.delete(endpoint);
+      server.close();
+      for (const [id, entry] of sdkPending) {
+        if (entry.jobRequestId !== jobRequestId) continue;
+        sdkPending.delete(id);
+        entry.reply(69, SDK_NOT_LIVE);
+      }
+      for (const reply of [...clients.values()]) reply(69, SDK_NOT_LIVE);
+      fs.rmSync(socketPath, { force: true });
+    },
+  };
+  sdkEndpoints.add(endpoint);
+  return endpoint;
+}
+function refreshJobEnvSnapshot() {
+  if (config.jobEnvSourcePath === undefined) return true;
+  const temporaryPath = config.jobEnvPath + "." + crypto.randomUUID() + ".tmp";
+  try {
+    const source = fs.lstatSync(config.jobEnvSourcePath);
+    if (source.isSymbolicLink() || !source.isFile()) return false;
+    fs.copyFileSync(
+      config.jobEnvSourcePath,
+      temporaryPath,
+      fs.constants.COPYFILE_EXCL,
+    );
+    fs.chmodSync(temporaryPath, 0o600);
+    fs.renameSync(temporaryPath, config.jobEnvPath);
+    return true;
+  } catch {
+    try { fs.unlinkSync(temporaryPath); } catch (error) { void error; }
+    return false;
+  }
+}
+// The descriptor is opened and read synchronously immediately before child
+// spawn, after any asynchronous policy preparation. Atomic replacement is
+// allowed; links, oversized files and mutable workspace paths are not.
+let consumedEnvironment = null;
+function readPrivateEnvironment() {
+  const candidate = config.environmentSnapshotPath;
+  const parent = path.dirname(candidate);
+  if (fs.realpathSync(parent) !== parent) throw new Error("environment_unavailable");
+  const directory = fs.lstatSync(parent);
+  if (!directory.isDirectory() || directory.uid !== process.getuid() || (directory.mode & 0o7777) !== 0o700) throw new Error("environment_unavailable");
+  for (const root of [config.workRoot, config.repoPath]) {
+    const canonical = fs.realpathSync(root);
+    if (stateOverlapsWorkspace(parent, canonical)) throw new Error("environment_unavailable");
+  }
+  const fd = fs.openSync(candidate, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+  try {
+    const before = fs.fstatSync(fd);
+    if (!before.isFile() || before.uid !== process.getuid() || before.nlink !== 1
+      || ![0o600, 0o400].includes(before.mode & 0o7777) || before.size < 1 || before.size > DEVICE_ENVIRONMENT_LIMITS.snapshotBytes) throw new Error("environment_unavailable");
+    const bytes = Buffer.alloc(before.size + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = fs.readSync(fd, bytes, length, bytes.length - length, null);
+      if (!count) break;
+      length += count;
+    }
+    const after = fs.fstatSync(fd);
+    if (length !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs
+      || after.ctimeMs !== before.ctimeMs || after.nlink !== 1) throw new Error("environment_unavailable");
+    const contents = bytes.subarray(0, length);
+    return { snapshot: JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(contents)), fileSha256: digest(contents) };
+  } finally { fs.closeSync(fd); }
+}
+function validateEnvironmentSnapshot(snapshot) {
+  const authority = config.environmentExpectedBinding;
+  if (!hasOnlyKeys(snapshot, ["version", "snapshot_id", "revision", "run_id", "device_id", "root_id", "binding", "expires_at", "variables", "git", "github_auth", "cloud_access"])
+    || snapshot.version !== 1 || !UUID_RE.test(snapshot.snapshot_id)
+    || !Number.isSafeInteger(snapshot.revision) || snapshot.revision < 1
+    || snapshot.run_id !== authority.runId || snapshot.device_id !== authority.deviceId || snapshot.root_id !== authority.rootId
+    || !hasOnlyKeys(snapshot.binding, ["kind", "target_revision", "root_grant_revision", "target_generation", "target_fence_id"])
+    || snapshot.binding.kind !== authority.binding.kind || snapshot.binding.target_revision !== authority.binding.target_revision
+    || snapshot.binding.root_grant_revision !== authority.binding.root_grant_revision
+    || snapshot.binding.target_generation !== targetGeneration || snapshot.binding.target_fence_id !== targetFenceId
+    || !hasOnlyKeys(snapshot.variables, Object.keys(snapshot.variables || {})) || Object.keys(snapshot.variables).length > DEVICE_ENVIRONMENT_LIMITS.variables) throw new Error("environment_unavailable");
+  const expires = Date.parse(snapshot.expires_at);
+  if (!Number.isFinite(expires) || expires <= Date.now() || expires > config.expiresAtMs) throw new Error("environment_unavailable");
+  for (const [name, value] of Object.entries(snapshot.variables)) {
+    if (name.length > 128 || !DEVICE_ENVIRONMENT_NAME_RE.test(name) || typeof value !== "string" || Buffer.byteLength(value, "utf8") > DEVICE_ENVIRONMENT_LIMITS.valueBytes || value.includes("\0")) throw new Error("environment_unavailable");
+  }
+  if (snapshot.github_auth !== undefined && (snapshot.github_auth !== "local_gh" || snapshot.git !== null
+    || !["darwin", "linux"].includes(process.platform) || !config.executionEnvironment || config.environmentExpectedBinding.binding.kind !== "workspace_source")) {
+    throw new Error("environment_unavailable");
+  }
+  if (snapshot.git !== null) {
+    const git = snapshot.git;
+    if (!hasOnlyKeys(git, ["base_url", "token", "expires_at"]) || typeof git.base_url !== "string" || git.base_url.length > 2048
+      || typeof git.token !== "string" || git.token.length < 1 || git.token.length > 4096 || !/^[A-Za-z0-9._~-]+$/.test(git.token)) throw new Error("environment_unavailable");
+    const url = new URL(git.base_url);
+    const gitExpires = Date.parse(git.expires_at);
+    if (url.origin !== new URL(authority.apiOrigin).origin || !["/git", "/git/"].includes(url.pathname)
+      || url.username || url.password || url.search || url.hash || !Number.isFinite(gitExpires)
+      || gitExpires <= Date.now() || gitExpires > expires) throw new Error("environment_unavailable");
+  }
+  if (snapshot.cloud_access !== undefined && !cloudAccessVariables(snapshot.cloud_access, authority.apiOrigin)) throw new Error("environment_unavailable");
+  const hash = digest(JSON.stringify({ ...snapshot,
+    variables: Object.fromEntries(Object.entries(snapshot.variables).sort(([left], [right]) => left.localeCompare(right))),
+  }));
+  if (consumedEnvironment && (snapshot.revision < consumedEnvironment.revision
+    || (snapshot.revision === consumedEnvironment.revision && hash !== consumedEnvironment.hash))) throw new Error("environment_unavailable");
+  return { snapshot, hash };
+}
+// The reserved cloud access variables (shared/device-environment.ts
+// cloudAccessEnvironment), or null unless both URLs are exactly the policy's
+// endpoints on this worker's API origin.
+function cloudAccessVariables(access, apiOrigin) {
+  if (!access || typeof access !== "object" || !hasOnlyKeys(access, ["token_url", "request_token", "aws_credentials_url"])
+    || typeof access.request_token !== "string" || access.request_token.length > 8192
+    || !new RegExp(DEVICE_CLOUD_ACCESS_POLICY.tokenPattern).test(access.request_token)) return null;
+  const exact = (value, pathname) => {
+    if (typeof value !== "string" || value.length > 2048) return false;
+    try {
+      const url = new URL(value);
+      return url.origin === new URL(apiOrigin).origin && url.pathname === pathname && !url.username && !url.password && !url.search && !url.hash;
+    } catch { return false; }
+  };
+  if (!exact(access.token_url, DEVICE_CLOUD_ACCESS_POLICY.tokenPath)
+    || (access.aws_credentials_url !== null && !exact(access.aws_credentials_url, DEVICE_CLOUD_ACCESS_POLICY.awsPath))) return null;
+  return { REASON_OIDC_TOKEN_URL: access.token_url, REASON_OIDC_REQUEST_TOKEN: access.request_token,
+    ...(access.aws_credentials_url !== null ? { AWS_CONTAINER_CREDENTIALS_FULL_URI: access.aws_credentials_url,
+      AWS_CONTAINER_AUTHORIZATION_TOKEN: access.request_token } : {}) };
+}
+${n}
+// Pi's shell's global Git config: a private file beside this worker's config,
+// so git config --global works for the Hands session, as stock Pi's does. The
+// path is in the shell's environment, where the person reads it, so the file
+// carries the product's name. Each worker launch has its own new directory
+// (cli/local-hands-relay.ts), so no earlier file exists to carry over.
+const PI_GIT_CONFIG_GLOBAL = path.join(path.dirname(process.argv[2]), "reason-gitconfig");
+/** Spawns that waited for their environment, by request id: reported once on the result. */
+const environmentWaits = new Map();
+/** Set when a claim negotiated environmentWaitVersion (only this build's server, for resident takes): spawns may wait. */
+let environmentWaitNegotiated = false;
+/** How long a spawn waits for its generation's environment before it refuses (environment_unavailable). */
+const SPAWN_ENVIRONMENT_WAIT_MS = 2_000;
+/** Waits (bounded) until this generation's environment validates; returns the ms waited. Never validates
+ * anything itself: the spawn below still calls environmentForSpawn, which refuses on its own. */
+async function waitForSpawnEnvironment(piShell, confined) {
+  const startedAt = performance.now();
+  for (;;) {
+    try { environmentForSpawn(piShell, confined); return Math.round(performance.now() - startedAt); }
+    catch (error) {
+      if (!(error instanceof Error && error.message === "environment_unavailable")
+        || performance.now() - startedAt >= SPAWN_ENVIRONMENT_WAIT_MS) return Math.round(performance.now() - startedAt);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+}
+function environmentForSpawn(piShell = false, confined = false) {
+  const privateFile = readPrivateEnvironment();
+  const validated = validateEnvironmentSnapshot(privateFile.snapshot);
+  const snapshot = validated.snapshot;
+  const deviceRoot = fs.realpathSync(config.deviceRootPath || config.workRoot);
+  const workspace = fs.realpathSync(config.workRoot);
+  const repo = fs.realpathSync(config.repoPath);
+  const within = (candidate, root) => candidate === root || candidate.startsWith(root + path.sep);
+  if (!within(workspace, deviceRoot) || !within(repo, workspace)) throw new Error("environment_unavailable");
+  let pool;
+  if (config.workspacePoolPath !== undefined) {
+    pool = fs.realpathSync(config.workspacePoolPath);
+    if (!within(pool, deviceRoot) || path.dirname(workspace) !== pool) throw new Error("environment_unavailable");
+  }
+  // Never spread process.env here. Explicit local host-mode composition may
+  // preserve toolchain coordinates, and for Pi's shell the host's filtered
+  // variables (an image's GOPATH, LANG...) below the snapshot; secrets/loaders
+  // still come only from the fenced snapshot, and shell/Git controls cannot be
+  // overridden.
+  const baseline = config.executionEnvironment;
+  const temporaryDirectory = baseline?.temporaryDirectory ?? config.workRoot;
+  const hostVariables = piShell && !(snapshot.github_auth === "local_gh" && localGithubSandbox) ? baseline?.variables : undefined;
+  const env = { ...hostVariables, ...snapshot.variables, PATH: baseline?.path ?? "/opt/homebrew/bin:" + FIXED_CLOUD_CHILD_PATH,
+    HOME: baseline?.home ?? config.workRoot, PWD: config.repoPath, TMPDIR: temporaryDirectory, TMP: temporaryDirectory, TEMP: temporaryDirectory,
+    SHELL: FIXED_BASH, BASH_ENV: "/dev/null", ENV: "/dev/null",
+    // Each coordinate under its Reason name and the Ara name every server
+    // script and Session shell before the rename reads.
+    REASON_DEVICE_ROOT: deviceRoot, REASON_HANDS_WORKSPACE: workspace, REASON_HANDS_REPO: repo,
+    ARA_DEVICE_ROOT: deviceRoot, ARA_HANDS_WORKSPACE: workspace, ARA_HANDS_REPO: repo,
+    ...(pool === undefined ? {} : { REASON_HANDS_WORKSPACE_POOL: pool, ARA_HANDS_WORKSPACE_POOL: pool }),
+    GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_SYSTEM: "/dev/null", GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0",
+  };
+  const pairs = [["credential.helper", ""], ["http.extraheader", ""]];
+  let confinementPrefix;
+  if (snapshot.github_auth === "local_gh" && config.localGithubConfinement !== true) throw new Error("local_device_gh_confinement_unavailable");
+  if (snapshot.github_auth === "local_gh" && localGithubSandbox) {
+    if (config.spawnPolicy || config.bashCommandPrefix
+      || !fs.existsSync("/usr/bin/sandbox-exec")) throw new Error("local_device_gh_confinement_unavailable");
+    const temporary = path.join(workspace, ".ara-local-gh-tmp");
+    fs.mkdirSync(temporary, { recursive: true, mode: 0o700 });
+    if (fs.lstatSync(temporary).isSymbolicLink() || fs.realpathSync(temporary) !== temporary) throw new Error("local_device_gh_confinement_unavailable");
+    env.HOME = workspace;
+    env.OPENSSL_CONF = "/dev/null";
+    env.TMPDIR = temporary; env.TMP = temporary; env.TEMP = temporary;
+    env.PATH = ${JSON.stringify(h)};
+    for (const name of Object.keys(env)) if (name.startsWith("GH_") || name.startsWith("GITHUB_") || name.startsWith("GIT_TRACE")) delete env[name];
+    confinementPrefix = ["/usr/bin/sandbox-exec", "-p", localGithubSandboxProfile(workspace, temporary)];
+  }
+  if (config.localGithubConfinement === true && snapshot.github_auth !== "local_gh") throw new Error("local_device_gh_authority_changed");
+  if (snapshot.git && config.gitCredentialEnvironment === true) {
+    const helper = GIT_BROKER_CREDENTIAL_HELPER_POLICY;
+    const base = snapshot.git.base_url.replace(new RegExp(GIT_BROKER_HTTP_HEADER_POLICY.trailingSlashPattern), "");
+    env[helper.urlEnv] = base;
+    env[helper.tokenEnv] = snapshot.git.token;
+    env[helper.reasonTokenEnv] = snapshot.git.token;
+    pairs.push([helper.keyPrefix + base + helper.keySuffix, helper.value]);
+  } else if (snapshot.git) {
+    const policy = GIT_BROKER_HTTP_HEADER_POLICY;
+    const base = snapshot.git.base_url.replace(new RegExp(policy.trailingSlashPattern), "");
+    pairs.push([policy.keyPrefix + base + policy.keySuffix, policy.valuePrefix + snapshot.git.token]);
+  }
+  // Server-provided, after the customer variables (which can never carry these names).
+  if (snapshot.cloud_access !== undefined) Object.assign(env, cloudAccessVariables(snapshot.cloud_access, config.environmentExpectedBinding.apiOrigin));
+  env.GIT_CONFIG_COUNT = String(pairs.length);
+  pairs.forEach(([key, value], index) => { env["GIT_CONFIG_KEY_" + index] = key; env["GIT_CONFIG_VALUE_" + index] = value; });
+  // Local GitHub confinement denies files outside the workspace, so it keeps
+  // the empty /dev/null config.
+  // A confined payload cannot read the worker's private files; it keeps the bash tool's empty config.
+  if (piShell && !confinementPrefix && !confined) env.GIT_CONFIG_GLOBAL = PI_GIT_CONFIG_GLOBAL;
+  return { ...validated, env, confinementPrefix, fileSha256: privateFile.fileSha256 };
+}
+${s}const WORKSPACE_FILE_OPERATIONS_RUNTIME_SOURCE = ${JSON.stringify(s)};
+// One workspace file call in a spawned child (sandbox-exec confined under local
+// GitHub authority), bounded by workspaceTarget: inside the canonical
+// repository root, with no symlink path component. The typed file tools and
+// Pi's confined file operations share this boundary.
+function workspaceFileScript(request, body, nodeRedirect = "") {
+  const encodedRequest = Buffer.from(JSON.stringify(request)).toString("base64");
+  const program = [
+    '"use strict";',
+    'const crypto = require("node:crypto");',
+    'const fs = require("node:fs");',
+    'const path = require("node:path");',
+    'const config = { repoPath: process.cwd() };',
+    'const MAX_OUTPUT_CHARS = ' + MAX_OUTPUT_CHARS + ';',
+    'const success = (_id, stdout, stderr) => ({ code: 0, stdout, stderr });',
+    'const failure = (_id, code, _kind, stdout, stderr) => ({ code, stdout, stderr });',
+    WORKSPACE_FILE_OPERATIONS_RUNTIME_SOURCE,
+    'const request = JSON.parse(Buffer.from("' + encodedRequest + '", "base64").toString("utf8"));',
+    body,
+  ].join("\n");
+  return "node" + nodeRedirect + " <<'ARA_WORKSPACE_FILE_OPERATION'\n" + program + "\nARA_WORKSPACE_FILE_OPERATION\n";
+}
+function payloadFileOperation(request) {
+  return bashOperation({ id: request.id, input: { script: workspaceFileScript(request,
+    'fileOperation(request).promise.then(result => { process.stdout.write(result.stdout); process.stderr.write(result.stderr); process.exitCode = result.code; });'),
+  } }, null);
+}
+// Pi's read/edit/write operations under local GitHub confinement. A read
+// returns raw bytes through the unclipped Pi shell stream (the child's stderr
+// is discarded so nothing interleaves) and is shared by access, image sniffing
+// and readFile within one tool call. writeFile is the typed tool's checked
+// atomic write, which creates parent directories after checking the target, so
+// mkdir defers to it rather than creating directories ahead of that check.
+// Cancelling the tool call stops the child like a cancelled typed file tool.
+function confinedPiFileOperations(id, state, writable, signal) {
+  const run = (operation) => {
+    const stop = () => { void operation.cancel().catch(() => {}); };
+    if (signal.aborted) stop();
+    else signal.addEventListener("abort", stop, { once: true });
+    return operation.promise.then((result) => {
+      signal.removeEventListener("abort", stop);
+      if (result.error === "process_group_cleanup_unconfirmed") state.cleanupUnconfirmed = true;
+      return result;
+    });
+  };
+  const reads = new Map();
+  const read = (file) => {
+    if (!reads.has(file)) {
+      const chunks = [];
+      const script = workspaceFileScript({ path: file, writable }, [
+        'let reply;',
+        'try {',
+        '  const { target } = workspaceTarget(request.path);',
+        '  fs.accessSync(target, request.writable ? fs.constants.R_OK | fs.constants.W_OK : fs.constants.R_OK);',
+        '  reply = { data: fs.readFileSync(target).toString("base64") };',
+        '} catch (error) {',
+        '  reply = { error: error instanceof Error ? error.message : "workspace_file_failed", code: typeof error?.code === "string" ? error.code : undefined };',
+        '}',
+        'process.stdout.write(JSON.stringify(reply));',
+      ].join("\n"), " 2>/dev/null");
+      reads.set(file, run(bashOperation({ id, input: { script } }, null, null, { onData: (chunk) => chunks.push(chunk) }))
+        .then((result) => {
+          if (!result.ok) throw new Error(result.error || "workspace_file_failed");
+          const reply = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+          if (typeof reply.error === "string") throw Object.assign(new Error(reply.error), reply.code ? { code: reply.code } : {});
+          return Buffer.from(reply.data, "base64");
+        }));
+    }
+    return reads.get(file);
+  };
+  return {
+    access: (file) => read(file).then(() => undefined),
+    readFile: read,
+    // Pi's own sniffing over the leading bytes its file-based default reads.
+    detectImageMimeType: (file) => read(file).then((bytes) => loadPiTools().detectSupportedImageMimeType(bytes.subarray(0, 4100))),
+    writeFile: (file, content) => run(payloadFileOperation({ id, tool: "write", input: { path: file, content } })).then((result) => {
+      reads.delete(file);
+      if (!result.ok) throw new Error(result.stderr || result.error || "workspace_file_failed");
+    }),
+    mkdir: () => Promise.resolve(),
+  };
+}
+function prepareBashSpawn(argv, extraFileDescriptors, expiresAtMs, signal, onLost) {
+  const policy = config.spawnPolicy;
+  const claimedGeneration = targetGeneration;
+  const claimedFence = targetFenceId;
+  return new Promise((resolve, reject) => {
+    const parent = path.dirname(policy.socketPath);
+    const directory = fs.lstatSync(parent);
+    const endpoint = fs.lstatSync(policy.socketPath);
+    if (fs.realpathSync(parent) !== parent || !directory.isDirectory() || directory.uid !== process.getuid()
+      || (directory.mode & 0o777) !== 0o700 || !endpoint.isSocket() || endpoint.uid !== process.getuid()
+      || (endpoint.mode & 0o077) !== 0) throw new Error("invalid_spawn_socket");
+    const id = crypto.randomUUID();
+    const client = net.createConnection(policy.socketPath);
+    let raw = "";
+    let prepared = null;
+    let preparedEnvironmentSha256;
+    let authorized = false;
+    let released = false;
+    const current = () => !stopped && !signal.aborted && claimedGeneration === targetGeneration
+      && claimedFence === targetFenceId && Date.now() < expiresAtMs;
+    const abort = () => client.destroy();
+    const close = (confirmed) => {
+      if (released) return;
+      released = true;
+      signal.removeEventListener("abort", abort);
+      if (confirmed && !client.destroyed) client.end(JSON.stringify({ version: 1, type: "release", id }) + "\n");
+      else client.destroy();
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    client.setEncoding("utf8");
+    client.setTimeout(5000, abort);
+    client.on("error", () => {});
+    client.once("close", () => {
+      signal.removeEventListener("abort", abort);
+      if (!authorized) reject(new Error("spawn_policy_rejected"));
+      else if (!released) onLost();
+    });
+    client.once("connect", () => {
+      if (!current()) { client.destroy(); return; }
+      client.write(JSON.stringify({ version: 1, type: "prepare", id, scopeId: policy.scopeId,
+        targetRevision: policy.targetRevision, generation: claimedGeneration, fenceId: claimedFence,
+        executorLaunchId: config.launchId, expiresAtMs, cwd: fs.realpathSync(config.repoPath), argv, extraFileDescriptors }) + "\n");
+    });
+    client.on("data", (chunk) => {
+      raw += chunk;
+      if (Buffer.byteLength(raw) > 262144) { client.destroy(); return; }
+      const newline = raw.indexOf("\n");
+      if (newline < 0) return;
+      if (newline !== raw.length - 1 || !current()) { client.destroy(); return; }
+      let frame;
+      try { frame = JSON.parse(raw.slice(0, -1)); } catch { client.destroy(); return; }
+      raw = "";
+      if (frame.version !== 1 || frame.id !== id) { client.destroy(); return; }
+      if (!prepared && frame.type === "prepared" && hasOnlyKeys(frame, ["version", "id", "type", "argv", "cwd", "environmentSnapshotSha256"])
+        && (config.environmentSnapshotPath === undefined ? frame.environmentSnapshotSha256 === undefined
+          : typeof frame.environmentSnapshotSha256 === "string" && SHA256_RE.test(frame.environmentSnapshotSha256))
+        && frame.cwd === fs.realpathSync(config.repoPath) && Array.isArray(frame.argv) && frame.argv.length > 0 && frame.argv.length <= 32
+        && validPath(frame.argv[0]) && frame.argv.every((arg) => typeof arg === "string" && !arg.includes("\0"))) {
+        prepared = frame.argv;
+        preparedEnvironmentSha256 = frame.environmentSnapshotSha256;
+        client.write(JSON.stringify({ version: 1, type: "activate", id }) + "\n");
+      } else if (prepared && !authorized && frame.type === "spawn" && hasOnlyKeys(frame, ["version", "id", "type", "expiresAtMs"])
+        && Number.isSafeInteger(frame.expiresAtMs) && frame.expiresAtMs > Date.now() && frame.expiresAtMs <= expiresAtMs) {
+        authorized = true; client.setTimeout(0);
+        signal.removeEventListener("abort", abort);
+        resolve({ argv: prepared, environmentSnapshotSha256: preparedEnvironmentSha256,
+          current: () => current() && Date.now() < frame.expiresAtMs, release: () => close(true), abandon: () => close(false) });
+      } else client.destroy();
+    });
+  });
+}
+let nativePtyOwner = null;
+function ptySupported() {
+  if (localGithubSandbox || !config.managedPty || config.environmentSnapshotPath === undefined || config.spawnPolicy || config.bashCommandPrefix
+    || !["darwin", "linux"].includes(process.platform) || typeof Bun === "undefined" || typeof Bun.Terminal !== "function") return false;
+  if (process.platform === "linux" && !["x64", "arm64"].includes(process.arch)) return false;
+  try { platformPtyOwner(); return true; } catch { return false; }
+}
+function platformPtyOwner() { return process.platform === "linux" ? linuxPtyOwner() : macPtyOwner(); }
+/** Only live native process identities, never recovered PIDs. Darwin's audit
+ * token includes the kernel PID version; stale versions cannot signal a reused
+ * PID. Keep the trusted session leader alive until its interactive groups are
+ * empty. This is graceful PTY-attached session cleanup, NOT supervisor-crash containment or
+ * confinement against host-mode code that deliberately escapes its session. */
+function macPtyOwner() {
+  if (nativePtyOwner) return nativePtyOwner;
+  const { dlopen, ptr, read } = require("bun:ffi");
+  const library = dlopen("/usr/lib/libSystem.B.dylib", {
+    mach_task_self: { args: [], returns: "u32" },
+    task_name_for_pid: { args: ["u32", "i32", "ptr"], returns: "i32" },
+    task_info: { args: ["u32", "u32", "ptr", "ptr"], returns: "i32" },
+    mach_port_deallocate: { args: ["u32", "u32"], returns: "i32" },
+    proc_signal_with_audittoken: { args: ["ptr", "i32"], returns: "i32" },
+    proc_listpids: { args: ["u32", "u32", "ptr", "i32"], returns: "i32" },
+    proc_pidinfo: { args: ["i32", "i32", "u64", "ptr", "i32"], returns: "i32" },
+    getsid: { args: ["i32"], returns: "i32" },
+    getpgid: { args: ["i32"], returns: "i32" },
+    socketpair: { args: ["i32", "i32", "i32", "ptr"], returns: "i32" },
+    ioctl: { args: ["i32", "u64"], returns: "i32" },
+    setsockopt: { args: ["i32", "i32", "i32", "ptr", "u32"], returns: "i32" },
+    recv: { args: ["i32", "ptr", "u64", "i32"], returns: "i64_fast" },
+    send: { args: ["i32", "ptr", "u64", "i32"], returns: "i64_fast" },
+    __error: { args: [], returns: "ptr" },
+  });
+  const api = library.symbols, self = api.mach_task_self();
+  function identity(pid) {
+    const port = new Uint32Array(1), count = new Uint32Array([8]), token = new Uint32Array(8);
+    if (api.task_name_for_pid(self, pid, ptr(port)) !== 0) return null;
+    try {
+      // TASK_AUDIT_TOKEN / TASK_AUDIT_TOKEN_COUNT from the macOS SDK.
+      if (api.task_info(port[0], 15, ptr(token), ptr(count)) !== 0 || count[0] !== 8 || token[5] !== pid) return null;
+      return token;
+    } finally { api.mach_port_deallocate(self, port[0]); }
+  }
+  function same(token) {
+    const current = identity(token[5]);
+    return current && current[5] === token[5] && current[7] === token[7];
+  }
+  function ttyDevice(anchor) {
+    // 64-bit proc_bsdinfo / PROC_PIDTBSDINFO from the current macOS SDK.
+    const info = Buffer.alloc(136);
+    if (!same(anchor) || api.proc_pidinfo(anchor[5], 3, 0, ptr(info), info.length) !== info.length
+      || info.readUInt32LE(12) !== anchor[5] || !(info.readUInt32LE(0) & 0x40)) throw new Error("pty_terminal_identity_lost");
+    return info.readUInt32LE(108);
+  }
+  function session(anchor, device) {
+    if (!same(anchor) || api.getsid(anchor[5]) !== anchor[5] || ttyDevice(anchor) !== device) throw new Error("pty_session_identity_lost");
+    const pids = new Int32Array(32768);
+    const bytes = api.proc_listpids(3, device, ptr(pids), pids.byteLength); // PROC_TTY_ONLY
+    const count = bytes / 4;
+    if (!Number.isSafeInteger(count) || count < 1 || count >= pids.length
+      || !pids.subarray(0, count).includes(anchor[5])) throw new Error("pty_session_inventory_unconfirmed");
+    const members = [];
+    for (let index = 0; index < count; index++) {
+      const pid = pids[index];
+      if (pid <= 0 || pid === anchor[5]) continue;
+      const member = inspectMacPtyMember(anchor, pid, { identity, same, session(memberPid) {
+        const id = api.getsid(memberPid);
+        return { id, missing: id === -1 && read.i32(api.__error()) === 3 };
+      } });
+      // No signals from a partially invalidated inventory. The owning bounded
+      // sweep re-inventories while its anchor remains verified; it never turns
+      // a vanished or unreadable member into empty-session proof.
+      if (member.retry) return { members: [], empty: false };
+      members.push(member.token);
+    }
+    // Do not mistake a reused session number for the original live session.
+    if (!same(anchor) || ttyDevice(anchor) !== device) throw new Error("pty_session_identity_lost");
+    // Empty comes from the kernel-filtered snapshot, not from failed per-PID
+    // lookups. Fork/exit races cannot turn vanished identities into empty proof.
+    return { members, empty: count === 1 };
+  }
+  function signal(token, number) {
+    const result = api.proc_signal_with_audittoken(ptr(token), number);
+    if (result !== 0 && result !== 3) throw new Error("pty_signal_unconfirmed"); // ESRCH is already gone.
+  }
+  function controlPair() {
+    const descriptors = new Int32Array(2);
+    if (api.socketpair(1, 1, 0, ptr(descriptors)) !== 0) throw new Error("pty_control_unavailable");
+    try {
+      // AF_UNIX/SOCK_STREAM; FIOCLEX has no ioctl argument. Avoid fcntl's
+      // variadic integer ABI (different from a fixed-argument FFI on arm64).
+      const enabled = new Int32Array([1]);
+      for (const fd of descriptors) {
+        if (api.ioctl(fd, 0x20006601) !== 0 || api.setsockopt(fd, 0xffff, 0x1022, ptr(enabled), 4) !== 0) {
+          throw new Error("pty_control_unavailable");
+        }
+      }
+      return [...descriptors];
+    } catch (error) { for (const fd of descriptors) fs.closeSync(fd); throw error; }
+  }
+  function readControl(fd) {
+    const bytes = Buffer.alloc(256);
+    const size = api.recv(fd, ptr(bytes), bytes.length, 0x80); // MSG_DONTWAIT
+    if (size < 0) {
+      if ([4, 35].includes(read.i32(api.__error()))) return ""; // EINTR/EAGAIN
+      throw new Error("pty_control_read_failed");
+    }
+    if (!size) throw new Error("pty_control_closed");
+    return bytes.subarray(0, size).toString("ascii");
+  }
+  function releaseControl(fd) {
+    const bytes = Buffer.from("release\n");
+    if (api.send(fd, ptr(bytes), bytes.length, 0x80) !== bytes.length) throw new Error("pty_control_release_failed");
+  }
+  nativePtyOwner = { identity, same, session, ttyDevice, signal, controlPair, readControl, releaseControl,
+    identityKey: (token) => token[5] + ":" + token[7], group: api.getpgid, sid: api.getsid };
+  if (!identity(process.pid)) { nativePtyOwner = null; library.close(); throw new Error("pty_identity_unavailable"); }
+  return nativePtyOwner;
+}
+function linuxPtyOwner() {
+  if (nativePtyOwner) return nativePtyOwner;
+  const { dlopen, ptr, read } = require("bun:ffi");
+  const library = dlopen("libc.so.6", {
+    pidfd_open: { args: ["i32", "u32"], returns: "i32" },
+    pidfd_send_signal: { args: ["i32", "i32", "ptr", "u32"], returns: "i32" },
+    poll: { args: ["ptr", "u64", "i32"], returns: "i32" },
+    getsid: { args: ["i32"], returns: "i32" },
+    getpgid: { args: ["i32"], returns: "i32" },
+    socketpair: { args: ["i32", "i32", "i32", "ptr"], returns: "i32" },
+    recv: { args: ["i32", "ptr", "u64", "i32"], returns: "i64_fast" },
+    send: { args: ["i32", "ptr", "u64", "i32"], returns: "i64_fast" },
+    __errno_location: { args: [], returns: "ptr" },
+  });
+  const api = library.symbols;
+  const errno = () => read.i32(api.__errno_location());
+  function stat(pid) {
+    const raw = fs.readFileSync("/proc/" + pid + "/stat", "utf8");
+    const end = raw.lastIndexOf(")"), fields = raw.slice(end + 2).trim().split(/\s+/);
+    if (!raw.startsWith(pid + " (") || end < 0 || fields.length < 20 || !/^\d+$/.test(fields[19])) throw new Error("pty_process_identity_unconfirmed");
+    return { parent: Number(fields[1]), tty: Number(fields[4]), birth: fields[19] };
+  }
+  function same(token) {
+    const pollfd = Buffer.alloc(8);
+    pollfd.writeInt32LE(token.fd, 0); pollfd.writeInt16LE(1, 4); // POLLIN reports exit, including an unreaped zombie.
+    const result = api.poll(ptr(pollfd), 1, 0);
+    if (result < 0) throw new Error("pty_identity_poll_failed");
+    return result === 0;
+  }
+  function identity(pid) {
+    const fd = api.pidfd_open(pid, 0);
+    if (fd < 0) {
+      if (errno() === 3) return null;
+      throw new Error("pty_pidfd_unavailable");
+    }
+    try {
+      const record = stat(pid), token = { pid, fd, birth: record.birth };
+      if (!same(token)) { fs.closeSync(fd); return null; }
+      return token;
+    } catch (error) {
+      fs.closeSync(fd);
+      if (error.code === "ENOENT" || error.code === "ESRCH") return null;
+      throw error;
+    }
+  }
+  function ttyDevice(anchor) {
+    if (!same(anchor)) throw new Error("pty_session_identity_lost");
+    const tty = stat(anchor.pid).tty;
+    if (!tty || !same(anchor)) throw new Error("pty_terminal_identity_lost");
+    return tty;
+  }
+  function childrenOf(pid) {
+    const fd = fs.openSync("/proc/" + pid + "/task/" + pid + "/children", "r");
+    try {
+      const bytes = Buffer.alloc(262145), size = fs.readSync(fd, bytes, 0, bytes.length, null);
+      if (size > 262144) throw new Error("pty_children_inventory_unconfirmed");
+      const raw = bytes.subarray(0, size).toString("ascii");
+      if (raw.length && !/^(?:[1-9][0-9]*\s+)*$/.test(raw)) throw new Error("pty_children_inventory_unconfirmed");
+      const children = raw.trim() ? raw.trim().split(/\s+/).map(Number) : [];
+      if (children.length > 32768 || new Set(children).size !== children.length) throw new Error("pty_children_inventory_unconfirmed");
+      return children;
+    } finally { fs.closeSync(fd); }
+  }
+  function session(anchor, device) {
+    if (!same(anchor) || api.getsid(anchor.pid) !== anchor.pid || ttyDevice(anchor) !== device) throw new Error("pty_session_identity_lost");
+    // Fresh open at position zero: the kernel checks the first direct child
+    // under tasklist_lock. Nonempty seq walks can omit exiting children, so
+    // they are ONLY a worklist. Only an empty fresh read, with the subreaper
+    // still pinned and unable to spawn again, proves the tree is empty.
+    const children = childrenOf(anchor.pid);
+    const members = [];
+    try {
+      for (const pid of children) {
+        const token = identity(pid);
+        if (!token) continue;
+        members.push(token);
+        let parent;
+        try { parent = stat(pid).parent; }
+        catch (error) {
+          if (error.code === "ENOENT" && !same(token)) continue;
+          throw error;
+        }
+        if (!same(anchor)) throw new Error("pty_session_identity_lost");
+        if (parent !== anchor.pid && same(token)) throw new Error("pty_child_ownership_changed");
+      }
+      if (!same(anchor)) throw new Error("pty_session_identity_lost");
+      return { members, empty: children.length === 0 };
+    } catch (error) { for (const token of members) fs.closeSync(token.fd); throw error; }
+  }
+  function signal(token, number) {
+    if (api.pidfd_send_signal(token.fd, number, null, 0) !== 0 && errno() !== 3) throw new Error("pty_signal_unconfirmed");
+  }
+  function controlPair() {
+    const descriptors = new Int32Array(2);
+    if (api.socketpair(1, 1 | 0x80000, 0, ptr(descriptors)) !== 0) throw new Error("pty_control_unavailable"); // SOCK_CLOEXEC
+    return [...descriptors];
+  }
+  function readControl(fd) {
+    const bytes = Buffer.alloc(256), size = api.recv(fd, ptr(bytes), bytes.length, 0x40); // MSG_DONTWAIT
+    if (size < 0) {
+      if ([4, 11].includes(errno())) return "";
+      throw new Error("pty_control_read_failed");
+    }
+    if (!size) throw new Error("pty_control_closed");
+    return bytes.subarray(0, size).toString("ascii");
+  }
+  function releaseControl(fd) {
+    const bytes = Buffer.from("release\n");
+    if (api.send(fd, ptr(bytes), bytes.length, 0x40 | 0x4000) !== bytes.length) throw new Error("pty_control_release_failed"); // MSG_NOSIGNAL
+  }
+  // CONFIG_PROC_CHILDREN and pidfd signaling must work before admission.
+  probeLinuxPtyLibrary({ identity: () => identity(process.pid), children: () => childrenOf(process.pid),
+    signal: (probe) => signal(probe, 0), release: (probe) => fs.closeSync(probe.fd), close: () => library.close() });
+  nativePtyOwner = { identity, same, session, ttyDevice, signal, controlPair, readControl, releaseControl,
+    releaseIdentity: (token) => fs.closeSync(token.fd), identityKey: (token) => token.pid + ":" + token.birth,
+    group: api.getpgid, sid: api.getsid };
+  return nativePtyOwner;
+}
+// Persistent terminals (config.managedPty.persistent, Linux). Each terminal's
+// shell lives in its own tmux server, started detached in a private 0700
+// directory derived from this worker's managed-jobs scope (one Session on one
+// root), so it outlives this worker. A viewer PTY job runs only a tmux client
+// attached to a host: closing the viewer, releasing the Session's interaction
+// (last tab closed, idle, Disconnect) or this worker stopping ends that client
+// (detach), never the shell, and frees nothing but the client. The next worker
+// of the same scope (one at a time, as its journal ownership enforces) finds
+// those shells, so a reopened terminal reattaches through an ordinary pty.start
+// with that start's authority. A new viewer takes a host no live viewer holds,
+// so concurrent terminals keep separate shells. The directory comes from the
+// trusted config, never a payload, so only this Session's terminals reach its
+// sockets. A persisted shell ends when it exits (exit or Ctrl-D, a Device
+// terminal's explicit close) or 12 h after it started (a host's lease cap):
+// tmux then hangs up the shell, which hangs up its jobs. As on cloud session
+// terminals (same tmux settings, shared/session-terminals.ts), processes the
+// user detaches from the shell (nohup, setsid, disown, or jobs left at exit)
+// are not swept. At most TERMINAL_HOST_LIMIT shells per scope.
+const TERMINAL_SHELL = "/bin/bash --noprofile --norc -i";
+const TERMINAL_TMUX_CONFIG = ${JSON.stringify([...B,"new-session -d -s main /bin/bash --noprofile --norc -i","set -g exit-empty on","run-shell -b -d 43200 -C kill-server",""].join(`
+`))};
+const TERMINAL_HOST_LIMIT = 4;
+const terminalViewers = new Map();
+let terminalTmux;
+let terminalChoice = Promise.resolve();
+function terminalTmuxPath() {
+  if (terminalTmux !== undefined) return terminalTmux;
+  terminalTmux = null;
+  if (process.platform !== "linux" || !config.managedPty || config.managedPty.persistent !== true || config.jobsUser) return null;
+  for (const candidate of ["/usr/bin/tmux", "/usr/local/bin/tmux", "/bin/tmux"]) {
+    // 3.2 added clients that never start a server (-N) and run-shell -d/-C.
+    const version = spawnSync(candidate, ["-V"], { encoding: "utf8", timeout: 2000, env: { PATH: "/usr/bin:/bin" } });
+    const match = /^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(version.status === 0 ? version.stdout : "");
+    if (match && Number(match[1]) * 100 + Number(match[2]) >= 302) { terminalTmux = candidate; break; }
+  }
+  return terminalTmux;
+}
+// PTY admission needs the program to lead its own foreground group, as the
+// interactive shell does. An interactive bash running a compound command
+// (never a lone exec, which skips job control) leads one and runs tmux as its job.
+function terminalCommand(command) { return TERMINAL_SHELL + ' -c "' + command + '; exit"'; }
+function terminalScopeDirectory() {
+  // Terminals a later worker keeps under the Reason name are found there, when that is this
+  // user's own private directory (never followed through a link); else /tmp/ara-terminals-*.
+  const scope = digest(config.managedJobs.scopeId).slice(0, 16);
+  const reasonDirectory = "/tmp/reason-terminals-" + scope;
+  let ownReasonDirectory = false;
+  try {
+    const found = fs.lstatSync(reasonDirectory);
+    ownReasonDirectory = found.isDirectory() && found.uid === process.getuid() && (found.mode & 0o077) === 0;
+  } catch { /* none */ }
+  const directory = ownReasonDirectory ? reasonDirectory : "/tmp/ara-terminals-" + scope;
+  try { fs.mkdirSync(directory, { mode: 0o700 }); }
+  catch (error) { if (!error || error.code !== "EEXIST") throw error; }
+  const stat = fs.lstatSync(directory);
+  if (!stat.isDirectory() || stat.uid !== process.getuid() || (stat.mode & 0o077) !== 0) throw new Error("terminal_directory_invalid");
+  return directory;
+}
+function terminalHostServes(socketPath) {
+  return new Promise((resolve) => {
+    const child = spawn(terminalTmux, ["-S", socketPath, "-N", "has-session", "-t", "=main"],
+      { stdio: "ignore", env: { PATH: "/usr/bin:/bin" } });
+    const timer = setTimeout(() => { try { child.kill("SIGKILL"); } catch { /* exited */ } }, 2000);
+    child.once("error", () => { clearTimeout(timer); resolve(false); });
+    child.once("close", (code) => { clearTimeout(timer); resolve(code === 0); });
+  });
+}
+/** Starts a detached tmux server with this Session's private environment. A
+ * stale socket at the path is replaced by tmux itself. */
+function startTerminalHost(socketPath) {
+  if (stopped || !/^[A-Za-z0-9/._-]+$/.test(socketPath)) return false;
+  const configPath = socketPath + ".conf";
+  try { fs.unlinkSync(configPath); } catch { /* absent */ }
+  fs.writeFileSync(configPath, TERMINAL_TMUX_CONFIG, { mode: 0o600, flag: "wx" });
+  const env = { ...environmentForSpawn().env, TERM: "xterm-256color", BASH_SILENCE_DEPRECATION_WARNING: "1" };
+  return spawnSync(terminalTmux, ["-u", "-S", socketPath, "-f", configPath, "start-server"],
+    { cwd: config.repoPath, env, stdio: "ignore", timeout: 5000 }).status === 0;
+}
+/** The program a new PTY job runs: a client attached to a free persistent
+ * terminal, or the one-shot shell. release() frees the host once the job ends. */
+function terminalProgram() {
+  // Serialized, so concurrent starts never pick the same free host.
+  const choice = terminalChoice.then(chooseTerminalProgram);
+  terminalChoice = choice.catch(() => {});
+  return choice;
+}
+async function chooseTerminalProgram() {
+  // A Mac terminal runs the user's login shell, as their own terminal would.
+  const shell = config.managedPty && config.managedPty.shell;
+  const oneShot = { program: shell ? shell + " -i -l" : TERMINAL_SHELL, release: () => {} };
+  if (stopped || !terminalTmuxPath()) return oneShot;
+  let directory;
+  try { directory = terminalScopeDirectory(); } catch { return oneShot; }
+  const numbers = fs.readdirSync(directory).filter((name) => /^[1-9][0-9]{0,8}$/.test(name)).map(Number).sort((a, b) => a - b);
+  let socketPath = null, live = 0, unused = null;
+  for (const number of numbers) {
+    const candidate = path.join(directory, String(number));
+    if (await terminalHostServes(candidate)) {
+      live += 1;
+      if (!socketPath && !terminalViewers.get(candidate)) socketPath = candidate;
+    } else if (unused === null && !terminalViewers.get(candidate)) unused = candidate;
+  }
+  if (!socketPath) {
+    if (live >= TERMINAL_HOST_LIMIT) return oneShot;
+    let next = 1;
+    while (numbers.includes(next)) next += 1;
+    socketPath = unused || path.join(directory, String(next));
+    try { if (!startTerminalHost(socketPath)) return oneShot; } catch { return oneShot; }
+  }
+  terminalViewers.set(socketPath, (terminalViewers.get(socketPath) || 0) + 1);
+  let released = false;
+  const release = () => {
+    if (released) return;
+    released = true;
+    const viewers = terminalViewers.get(socketPath) - 1;
+    if (viewers > 0) terminalViewers.set(socketPath, viewers); else terminalViewers.delete(socketPath);
+  };
+  for (const deadline = Date.now() + 3000; !stopped && Date.now() < deadline;) {
+    if (await terminalHostServes(socketPath)) {
+      return { program: terminalCommand(terminalTmux + " -u -S " + socketPath + " -N attach-session -t =main"), release };
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  release();
+  return oneShot;
+}
+function ptyOperation(request, managed, program = TERMINAL_SHELL) {
+  const native = platformPtyOwner();
+  let child = null, anchor = null, terminal = null, childEnvironment = null, device = null;
+  let done = false, cancelled = false, timedOut = false, cleanup = null, exitCode = null;
+  let timer = null, poll = null, metadata = "", shellPid = null, admitted = false;
+  let controlFd = null;
+  let controlReleased = false;
+  let subreaper = process.platform !== "linux";
+  const spawnGeneration = targetGeneration, spawnFence = targetFenceId;
+  let resolveResult, acknowledgeSpawn;
+  const promise = new Promise((resolve) => { resolveResult = resolve; });
+  const started = new Promise((resolve) => { acknowledgeSpawn = resolve; });
+  const finish = (error, code) => {
+    if (done) return;
+    done = true; acknowledgeSpawn(false);
+    clearTimeout(timer); clearInterval(poll);
+    let closeFailed = false;
+    try { if (terminal) terminal.close(); } catch { closeFailed = true; }
+    try { if (controlFd !== null) fs.closeSync(controlFd); } catch { closeFailed = true; }
+    try { if (anchor) native.releaseIdentity?.(anchor); } catch { closeFailed = true; }
+    controlFd = null;
+    if (closeFailed) { error = "process_group_cleanup_unconfirmed"; code = 1; }
+    resolveResult(error ? failure(request.id, code, error, "", "") : success(request.id, "", ""));
+  };
+  const delay = () => new Promise((resolve) => setTimeout(resolve, 20));
+  function stopSession() {
+    if (cleanup) return cleanup;
+    cleanup = Promise.resolve().then(async () => {
+      if (!child) { finish(timedOut ? "timeout" : "cancelled", timedOut ? 124 : 130); return; }
+      try {
+        if (!anchor || child.exitCode !== null) throw new Error("pty_session_identity_lost");
+        const startedAt = Date.now(), termSent = new Set();
+        for (;;) {
+          const { members, empty } = native.session(anchor, device);
+          try {
+            if (empty && exitCode !== null && subreaper) break;
+            if (Date.now() - startedAt > ${C}) throw new Error("pty_cleanup_timeout");
+            for (const token of members) {
+              if (!native.same(anchor)) throw new Error("pty_session_identity_lost");
+              const id = native.identityKey(token);
+              if (Date.now() - startedAt >= 500) native.signal(token, 9);
+              else if (!termSent.has(id)) { native.signal(token, 15); termSent.add(id); }
+            }
+          } finally { for (const token of members) native.releaseIdentity?.(token); }
+          await delay();
+        }
+        // The fixed bootstrap cannot spawn again after its interactive shell
+        // exits. Release only after the still-owned session has no other tasks.
+        native.releaseControl(controlFd);
+        controlReleased = true;
+        let exitTimer;
+        try { await Promise.race([child.exited, new Promise((_, reject) => {
+          exitTimer = setTimeout(() => reject(new Error("pty_anchor_exit_unconfirmed")), ${I});
+        })]); } finally { clearTimeout(exitTimer); }
+        if (timedOut) finish("timeout", 124);
+        else if (cancelled) finish("cancelled", 130);
+        else finish(exitCode === 0 ? null : "command_failed", exitCode ?? 1);
+      } catch {
+        // Do not signal a reconstructed PID/session after losing the anchor.
+        finish("process_group_cleanup_unconfirmed", 1);
+      }
+    });
+    return cleanup;
+  }
+  function arm(deadline) {
+    clearTimeout(timer);
+    timer = setTimeout(() => { timedOut = true; void stopSession(); }, Math.max(1, deadline - Date.now()));
+  }
+  // Each accepted input is handed to Bun exactly once. Terminal.write() keeps
+  // whatever the PTY cannot take now in Bun's own ordered queue and writes it as
+  // the PTY drains; its return value counts only bytes written synchronously, so
+  // writing the "rest" again duplicates input. Bun 1.3.14 never calls the
+  // Terminal "drain" callback (Terminal.zig wires "onWritable", but
+  // PosixStreamingWriter reads "function_table.onReady") and exposes no queue
+  // size, so that queue cannot be bounded here; each input stays capped by the
+  // protocol's per-request size and the bridge sends one at a time.
+  const canInput = () => done || cleanup || !admitted || !terminal || terminal.closed ? "job_not_running" : null;
+  try {
+    childEnvironment = environmentForSpawn();
+    if (stopped || spawnGeneration !== targetGeneration || spawnFence !== targetFenceId
+      || !validJobLease(managed.leaseExpiresAtMs)) throw new Error("pty_spawn_expired");
+    // A fixed non-login bootstrap pins the session identity. Private fds are
+    // closed before the interactive shell; no workspace startup/env file runs.
+    const bootstrap = 'trap ":" HUP TERM; '
+      + '/bin/bash --noprofile --norc -c \'printf "ready:%s\\n" "$$" >&3; exec 3>&-; exec ' + [...jobsUserPrefix(false), program].join(" ") + '\'; '
+      + 'ara_pty_exit=$?; printf "exit:%s\\n" "$ara_pty_exit" >&3; '
+      + 'while IFS= read -r ara_pty_control <&3; do [ "$ara_pty_control" = release ] && break; done; exit "$ara_pty_exit"';
+    const pair = native.controlPair(); controlFd = pair[0];
+    try {
+      const command = process.platform === "linux"
+        ? [process.execPath, "--no-env-file", "--config=/dev/null", "-e", LINUX_PTY_EXEC_SOURCE + "(" + JSON.stringify(bootstrap) + ")"]
+        : [FIXED_BASH, "--noprofile", "--norc", "-c", bootstrap];
+      const env = { ...childEnvironment.env, TERM: "xterm-256color", BASH_SILENCE_DEPRECATION_WARNING: "1" };
+      if (process.platform === "linux") env[["BUN", "BE", "BUN"].join("_")] = "1";
+      if (process.platform === "darwin") {
+        if (config.managedPty.shell) env.SHELL = config.managedPty.shell;
+        // Without a locale, a Mac shell's line editor reads typed UTF-8 as
+        // meta keys and drops it.
+        if (!env.LANG && !env.LC_ALL) env.LANG = "en_US.UTF-8";
+      }
+      child = Bun.spawn({ cmd: command, cwd: config.repoPath, env,
+        stdio: ["ignore", "ignore", "ignore", pair[1]],
+        terminal: { cols: request.input.cols, rows: request.input.rows, data: (_terminal, bytes) => {
+          if (!done) managed.onBytes(bytes);
+        } },
+      });
+    } finally { fs.closeSync(pair[1]); }
+    terminal = child.terminal;
+    anchor = native.identity(child.pid);
+    if (!terminal || !anchor || native.sid(child.pid) !== child.pid || native.group(child.pid) !== child.pid) throw new Error("pty_spawn_identity_unconfirmed");
+    device = native.ttyDevice(anchor);
+    consumedEnvironment = { revision: childEnvironment.snapshot.revision, hash: childEnvironment.hash };
+    managed.onEnvironment(childEnvironment.snapshot);
+    arm(managed.leaseExpiresAtMs);
+    poll = setInterval(() => {
+      if (done || controlReleased) return;
+      try {
+        metadata += native.readControl(controlFd);
+        if (metadata.length > 512) throw new Error("pty_metadata_invalid");
+        for (;;) {
+          const end = metadata.indexOf("\n");
+          if (end < 0) break;
+          const line = metadata.slice(0, end); metadata = metadata.slice(end + 1);
+          if (line === "subreaper" && !subreaper && shellPid === null) subreaper = true;
+          else if (/^ready:[1-9][0-9]*$/.test(line) && shellPid === null) shellPid = Number(line.slice(6));
+          else if (/^exit:[0-9]{1,3}$/.test(line) && Number(line.slice(5)) <= 255) {
+            exitCode = Number(line.slice(5)); void stopSession();
+          } else throw new Error("pty_metadata_invalid");
+        }
+        if (!admitted && !cleanup && subreaper && shellPid && native.same(anchor) && native.sid(shellPid) === child.pid && native.group(shellPid) === shellPid) {
+          admitted = true; acknowledgeSpawn(true);
+        }
+      } catch { cancelled = true; void stopSession(); }
+    }, 10);
+    void child.exited.then(() => { if (!done && !cleanup) void stopSession(); });
+  } catch {
+    if (child) { cancelled = true; void stopSession(); }
+    else finish("spawn_failed", 1);
+  }
+  return { promise, started, supportsCancellation: true, canInput,
+    settle: stopSession,
+    processIdentity() {
+      return admitted && !done && child.exitCode === null && native.same(anchor)
+        ? { pid: child.pid, processGroupId: child.pid, executorLaunchId: config.launchId } : null;
+    },
+    input(data) {
+      const error = canInput(); if (error) return error;
+      try { terminal.write(data); return null; }
+      catch { cancelled = true; void stopSession(); return "job_not_running"; }
+    },
+    resize(cols, rows) {
+      const error = canInput(); if (error) return error;
+      try { terminal.resize(cols, rows); return null; }
+      catch { cancelled = true; void stopSession(); return "job_not_running"; }
+    },
+    renew(deadline) { if (done || cleanup) return false; arm(deadline); return true; },
+    cancel() { cancelled = true; return stopSession(); },
+  };
+}
+function bashOperation(request, onProgress, managed, piShell) {
+  // Only a claimed retainBackground request; never managed jobs. Pi's shell
+  // retains its background processes by stock Pi's rule (settle below).
+  const retainBackground = !managed && !piShell && request.input.retainBackground === true;
+  // Only a claimed machineSdk request: reason-sdk lives exactly as long as it.
+  const machineSdk = !managed && !piShell && request.input.machineSdk === true;
+  let sdkEndpoint = null;
+  let child = null;
+  let groupCleanup = null;
+  let timedOut = false;
+  let cancelled = false;
+  let done = false;
+  let timer = null;
+  const preparationAbort = new AbortController();
+  let preparation = null;
+  let childEnvironment = null;
+  const spawnGeneration = targetGeneration;
+  const spawnFence = targetFenceId;
+  // Pi's shell has no default timeout (stock Pi's has none): it runs until the
+  // model's own timeout, a cancel or the Hands lease.
+  const initialDeadline = piShell ? config.expiresAtMs
+    : Math.min(config.expiresAtMs, managed ? managed.leaseExpiresAtMs : Date.now() + config.bashTimeoutMs);
+  let acknowledgeSpawn;
+  const started = new Promise((resolve) => { acknowledgeSpawn = resolve; });
+  const canInput = (data) => {
+    if (done || cancelled || timedOut || !child || !child.stdin || child.stdin.destroyed || child.stdin.writableEnded) return "job_not_running";
+    if (child.stdin.writableLength + Buffer.byteLength(data) > 65536) return "job_input_backpressure";
+    return null;
+  };
+  const startGroupCleanup = () => {
+    if (!child) return Promise.resolve();
+    if (!groupCleanup) {
+      groupCleanup = killGroup(child);
+      // Keep the rejection observed even if the process has not closed yet;
+      // callers still await the original promise and fail closed on it.
+      void groupCleanup.catch(() => {});
+    }
+    return groupCleanup;
+  };
+  let progressTimer = null;
+  let progressSequence = 0;
+  let keepaliveTimer = null;
+  const promise = new Promise((resolve) => {
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
+    let stdout = "";
+    let stderr = "";
+    const finish = (result) => {
+      if (done) return;
+      done = true;
+      if (sdkEndpoint) sdkEndpoint.close();
+      if (result.error === "process_group_cleanup_unconfirmed") cleanupUnconfirmed = true;
+      acknowledgeSpawn(false);
+      clearTimeout(timer);
+      clearTimeout(progressTimer);
+      clearInterval(keepaliveTimer);
+      if (preparation) {
+        if (result.error === "process_group_cleanup_unconfirmed") preparation.abandon();
+        else preparation.release();
+      }
+      resolve(result);
+    };
+    const publishProgress = () => {
+      progressTimer = null;
+      if (done || (stdout.length === 0 && stderr.length === 0)) return;
+      progressSequence += 1;
+      if (onProgress) onProgress(stdout, stderr, progressSequence);
+    };
+    const scheduleProgress = () => {
+      if (done || progressTimer) return;
+      progressTimer = setTimeout(publishProgress, 50);
+    };
+    timer = setTimeout(() => {
+      timedOut = true;
+      preparationAbort.abort();
+      if (child) void startGroupCleanup().catch(() => {});
+      else finish(failure(request.id, 124, "timeout", "", ""));
+    }, Math.max(1, initialDeadline - Date.now()));
+    const launch = async () => {
+    if (!validPrivateJob && config.environmentSnapshotPath === undefined && !refreshJobEnvSnapshot()) {
+      finish(failure(request.id, 1, "spawn_failed", "", "job_env_refresh_failed"));
+      return;
+    }
+    try {
+      if (machineSdk) {
+        try {
+          sdkEndpoint = machineSdkEndpoint(request.id);
+          await sdkEndpoint.ready;
+        } catch {
+          // Nothing ran: reason-sdk could not be set up on this machine.
+          finish(failure(request.id, 1, "spawn_failed", "", "machine_sdk_unavailable: reason-sdk could not be set up on this machine; nothing ran."));
+          return;
+        }
+        if (done) { sdkEndpoint.close(); return; }
+      }
+      let command = [
+          ...(config.bashCommandPrefix || []),
+          FIXED_BASH,
+          "--noprofile",
+          "--norc",
+          "-c",
+          'set -euo pipefail; '
+            + (config.environmentSnapshotPath === undefined ? 'set -a; . "$1"; set +a; ' : '')
+            // The wrapper starts with no startup file; Pi's shell then has none set, as stock Pi's.
+            + (piShell ? 'unset BASH_ENV ENV; ' : 'export BASH_ENV=/dev/null ENV=/dev/null; ')
+            + 'unset NODE_OPTIONS NODE_PATH LD_PRELOAD LD_LIBRARY_PATH; '
+            + machineMemoryPrelude()
+            + (sdkEndpoint ? sdkEndpoint.prelude : '')
+            + (managed
+              ? 'IFS= read -r -d "" ara_job_script; eval "$ara_job_script"'
+              // Pi runs bash -c with no stdin script and no errexit.
+              : piShell ? 'exec /bin/bash --noprofile --norc -c "$2"'
+              : 'exec /bin/bash --noprofile --norc -se'),
+          "h1-bash",
+          config.environmentSnapshotPath === undefined ? config.jobEnvPath : "/dev/null",
+          ...(piShell ? [request.input.script] : []),
+      ];
+      if (validPrivateJob) command = [...(config.bashCommandPrefix || []), config.directShell.executable,
+        config.directShell.mode === "host" ? "-lic" : "-c",
+        // Interactive login configuration is retained, but foreground commands
+        // must stay in the owned process group instead of shell job-control groups.
+        config.directShell.mode === "host" ? "set +m; " + request.input.script : request.input.script];
+      // Resident Hands a run took over report ready at claim_ack, while their
+      // environment for this generation is still being installed: wait for it,
+      // bounded, instead of refusing; the wait is reported (environmentWaitMs).
+      // Before the spawn preparation and the currency check below, which then
+      // re-prove cancellation, generation, fence and deadline after the wait.
+      if (config.environmentSnapshotPath !== undefined && environmentWaitNegotiated) {
+        const waitedMs = await waitForSpawnEnvironment(Boolean(piShell), Boolean(piShell && piShell.confined));
+        if (waitedMs > 0) environmentWaits.set(request.id, waitedMs);
+      }
+      if (config.spawnPolicy) {
+        preparation = await prepareBashSpawn(command, 0, initialDeadline, preparationAbort.signal, () => {
+          cancelled = true;
+          void startGroupCleanup().catch(() => {});
+        });
+        command = preparation.argv;
+      }
+      if (done || cancelled || timedOut || stopped || spawnGeneration !== targetGeneration || spawnFence !== targetFenceId
+        || Date.now() >= initialDeadline || (preparation && !preparation.current())) {
+        if (preparation) preparation.release();
+        finish(failure(request.id, 130, "cancelled", "", ""));
+        return;
+      }
+      // This is deliberately after policy RPC awaits: a missing/revoked/stale
+      // snapshot cannot authorize a later asynchronous child spawn.
+      if (config.environmentSnapshotPath !== undefined) childEnvironment = environmentForSpawn(Boolean(piShell), Boolean(piShell && piShell.confined));
+      if (childEnvironment?.confinementPrefix) command = [...childEnvironment.confinementPrefix, ...command];
+      if (managed && managed.asJobsUser) command = [...jobsUserPrefix(true), ...command];
+      if (preparation && childEnvironment && preparation.environmentSnapshotSha256 !== childEnvironment.fileSha256) throw new Error("environment_preparation_changed");
+      if (Date.now() >= initialDeadline || (preparation && !preparation.current())) throw new Error("spawn_lease_expired");
+      child = spawn(
+        command[0], command.slice(1),
+        {
+          cwd: config.repoPath,
+          detached: true,
+          env: validPrivateJob ? process.env : childEnvironment ? childEnvironment.env : {
+            ...process.env,
+            // A physical Device keeps the CLI-resolved host PATH (including
+            // Homebrew). Cloud Hands accepts only immutable image toolchains.
+            PATH: config.jobEnvSourcePath === undefined
+              || (process.platform === "darwin" && config.workspacePoolPath === path.dirname(config.workRoot)
+                && config.repoPath === path.join(config.workRoot, "repo"))
+              ? process.env.PATH
+              : selectCloudChildPath(process.platform, FIXED_CLOUD_CHILD_PATH, FIXED_MACOS_CLOUD_CHILD_PATH),
+            BASH_ENV: "/dev/null",
+            ENV: "/dev/null",
+            NODE_OPTIONS: "",
+            NODE_PATH: "",
+            LD_PRELOAD: "",
+            LD_LIBRARY_PATH: "",
+          },
+          // Pi's shell reads /dev/null, as stock Pi's, so rg PATTERN searches the cwd.
+          // A confined Pi file write passes its content on stdin.
+          stdio: [piShell && piShell.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+        },
+      );
+      // A new leader with this PID proves the retained group of that ID ended.
+      if (Number.isSafeInteger(child.pid)) backgroundGroups.delete(child.pid);
+    } catch (error) {
+      // The protocol error stays spawn_failed; a coded refusal such as
+      // local_device_gh_confinement_unavailable or environment_unavailable is
+      // its stderr, so the server sees why nothing ran. Uncoded error text
+      // (paths, OS messages) is never sent.
+      const code = !timedOut && !cancelled && error instanceof Error && /^[a-z][a-z0-9_]{2,79}$/.test(error.message) ? error.message : "";
+      finish(failure(request.id, timedOut ? 124 : cancelled ? 130 : 1, timedOut ? "timeout" : cancelled ? "cancelled" : "spawn_failed", "", code));
+      return;
+    }
+    // Pi's shell settles as stock Pi's: once its stdio ends after the shell
+    // exits, or its output has been idle for 100 ms after the exit. Processes
+    // it started in the background keep running, retained below.
+    let settled = false;
+    let exited = null;
+    let idleTimer = null;
+    const armIdle = () => {
+      if (!exited || settled) return;
+      clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => {
+        child.stdout.destroy();
+        child.stderr.destroy();
+        void settle(exited.code, exited.signal);
+      }, PI_EXIT_STDIO_GRACE_MS);
+    };
+    child.stdout.on("data", (chunk) => {
+      if (piShell) { piShell.onData(chunk); armIdle(); }
+      const text = stdoutDecoder.write(chunk);
+      if (managed) managed.onOutput("stdout", text);
+      stdout = clip(stdout + text, MAX_OUTPUT_CHARS);
+      scheduleProgress();
+    });
+    child.stderr.on("data", (chunk) => {
+      if (piShell) { (piShell.onStderr || piShell.onData)(chunk); armIdle(); }
+      const text = stderrDecoder.write(chunk);
+      if (managed) managed.onOutput("stderr", text);
+      stderr = clip(stderr + text, MAX_OUTPUT_CHARS);
+      scheduleProgress();
+    });
+    child.once("error", () => finish(failure(request.id, 1, "spawn_failed", stdout, stderr)));
+    child.once("spawn", () => {
+      if (childEnvironment) {
+        consumedEnvironment = { revision: childEnvironment.snapshot.revision, hash: childEnvironment.hash };
+        try { if (managed) managed.onEnvironment(childEnvironment.snapshot); }
+        catch { cancelled = true; void startGroupCleanup().catch(() => {}); }
+      }
+      acknowledgeSpawn(true);
+      if (onProgress) {
+        keepaliveTimer = setInterval(() => {
+          if (done) { clearInterval(keepaliveTimer); return; }
+          publishProgress();
+        }, 15_000);
+      }
+    });
+    // A leader exiting must not leave descendants holding pipes open until the
+    // deadline. This uses only the live owned group, never recovered PID data.
+    // A retained command's descendants are deliberately left running; any that
+    // still hold its stdio keep the result open until they exit or time out.
+    child.once("exit", (code, signal) => {
+      if (piShell) { exited = { code, signal }; armIdle(); }
+      else if (!retainBackground) void startGroupCleanup().catch(() => {});
+    });
+    const settle = async (code, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(idleTimer);
+      try {
+        // A command that deliberately closes inherited stdio can leave a
+        // background descendant after its group leader exits. No Bash result
+        // is terminal until the entire detached process group is absent, or,
+        // for a retained command or Pi's shell, tracked until it is.
+        if ((retainBackground || piShell) && !groupCleanup && !timedOut && !cancelled) retainBackgroundGroup(child);
+        else await startGroupCleanup();
+      } catch {
+        finish(failure(request.id, 1, "process_group_cleanup_unconfirmed", stdout, stderr));
+        return;
+      }
+      const stdoutTail = stdoutDecoder.end();
+      const stderrTail = stderrDecoder.end();
+      if (managed) {
+        managed.onOutput("stdout", stdoutTail);
+        managed.onOutput("stderr", stderrTail);
+      }
+      stdout = clip(stdout + stdoutTail, MAX_OUTPUT_CHARS);
+      stderr = clip(stderr + stderrTail, MAX_OUTPUT_CHARS);
+      if (timedOut) finish(failure(request.id, 124, "timeout", stdout, stderr));
+      else if (cancelled) finish(failure(request.id, 130, "cancelled", stdout, stderr));
+      else if (code === 0) finish(success(request.id, stdout, stderr));
+      else finish(failure(request.id, Number.isSafeInteger(code) ? code
+        : piShell && signal ? 128 + (require("node:os").constants.signals[signal] || 0) : 1, "command_failed", stdout, stderr));
+    };
+    child.once("close", (code, signal) => { void settle(code, signal); });
+    if (piShell) {
+      if (piShell.stdin !== undefined) { child.stdin.on("error", () => {}); child.stdin.end(piShell.stdin); }
+      return;
+    }
+    child.stdin.on("error", () => {});
+    if (managed && !validPrivateJob) {
+      // One ordered pipe carries a complete script frame followed by job input.
+      // EOF before its delimiter fails closed instead of evaluating a prefix.
+      child.stdin.write(request.input.script + "\0");
+    } else child.stdin.end(validPrivateJob ? undefined : request.input.script);
+    };
+    void launch().catch(() => finish(failure(request.id, 1, "spawn_failed", "", "")));
+  });
+  return {
+    promise,
+    started,
+    supportsCancellation: true,
+    canInput,
+    processIdentity() {
+      if (done || !child || !Number.isSafeInteger(child.pid) || child.exitCode !== null || child.signalCode !== null) return null;
+      return { pid: child.pid, processGroupId: child.pid, executorLaunchId: config.launchId };
+    },
+    input(data, eof) {
+      const error = canInput(data);
+      if (error) return error;
+      if (eof) child.stdin.end(data);
+      else child.stdin.write(data);
+      return null;
+    },
+    renew(expiresAtMs) {
+      if (done || cancelled || timedOut) return false;
+      clearTimeout(timer);
+      timer = setTimeout(() => { timedOut = true; void startGroupCleanup().catch(() => {}); }, Math.max(1, expiresAtMs - Date.now()));
+      return true;
+    },
+    cancel() {
+      cancelled = true;
+      preparationAbort.abort();
+      return startGroupCleanup();
+    },
+  };
+}
+function replOperation(request) {
+  let client = null;
+  let timedOut = false;
+  let hardCancelled = false;
+  let done = false;
+  let timer = null;
+  const promise = new Promise((resolve) => {
+    let raw = "";
+    const finish = (result) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    client = net.createConnection(config.replSocketPath);
+    client.setEncoding("utf8");
+    client.once("connect", () => {
+      client.write(JSON.stringify({ action: "evaluate", code: request.input.code, includeProgressCapture: true,
+        ...(config.browserRunId ? { runId: config.browserRunId } : {}) }) + "\n");
+    });
+    client.on("data", (chunk) => {
+      raw += chunk;
+      if (raw.length > MAX_FRAME_BYTES) {
+        client.destroy();
+        finish(failure(request.id, 1, "repl_response_too_large", "", ""));
+      }
+    });
+    client.once("error", () => {
+      finish(failure(
+        request.id,
+        timedOut ? 124 : hardCancelled ? 130 : 1,
+        timedOut ? "timeout" : hardCancelled ? "cancelled" : "repl_transport_failed",
+        "",
+        "",
+      ));
+    });
+    client.once("end", () => {
+      if (hardCancelled) {
+        finish(failure(request.id, 130, "cancelled", "", ""));
+        return;
+      }
+      let response;
+      try { response = JSON.parse(raw); } catch {
+        finish(failure(request.id, 1, "invalid_repl_response", "", "Invalid REPL response"));
+        return;
+      }
+      if (response && response.ok === true && typeof response.output === "string") {
+        finish({ ...success(request.id, response.output, ""), browserActions: response.browserActions,
+          ...(response.automaticProgressImage === true ? { automaticProgressImage: true } : {}) });
+        return;
+      }
+      const stderr = response && typeof response.stack === "string"
+        ? response.stack
+        : response && typeof response.error === "string" ? response.error : "REPL request failed";
+      finish({ ...failure(request.id, 1, "repl_failed", "", stderr), browserActions: response && response.browserActions });
+    });
+    client.once("close", () => {
+      if (!done) finish(failure(
+        request.id,
+        hardCancelled ? 130 : 1,
+        hardCancelled ? "cancelled" : "repl_transport_failed",
+        "",
+        "",
+      ));
+    });
+    timer = setTimeout(() => {
+      timedOut = true;
+      client.destroy();
+      finish(failure(request.id, 124, "timeout", "", ""));
+    }, config.replTimeoutMs);
+  });
+  return {
+    promise,
+    supportsCancellation: true,
+    cancellationRequiresExternalProof: true,
+    cancel(hard) {
+      if (!hard) return;
+      hardCancelled = true;
+      if (client) client.destroy();
+    },
+  };
+}
+// Pi's own read/bash/edit/write (pi_tool), bundled unchanged. The 3 MB source
+// is not part of this worker: a host that serves pi_tool passes it as
+// araHandsPiToolsSource, and it is checked against the pinned digest and
+// evaluated on first use, so worker starts never parse it. read/edit/write use
+// Pi's local file operations in this process, which deliberately reach paths
+// outside the workspace; under local GitHub confinement they use
+// confinedPiFileOperations, the typed file tools' boundary, instead. pi_tool is
+// refused where a spawn policy or command prefix confines file access to a
+// child process this worker does not compose. Bash keeps Pi's
+// output handling and full-output file; its spawn operation is the ordinary
+// Hands Bash spawn above, in the fenced environment, with stock Pi's process
+// semantics: the host's filtered variables, BASH_ENV and ENV unset, a
+// private global Git config, stdin from /dev/null, no deadline but the model's
+// timeout and the lease, and background processes retained until the worker
+// stops. One departure from stock: a command idle on a watcher's banner is
+// stopped (PI_WATCH_BANNER). PI_* variables are not set here.
+const PI_TOOLS_SHA256 = "${p}";
+const piToolsSource = typeof araHandsPiToolsSource === "function" ? araHandsPiToolsSource : null;
+let piTools = null;
+function loadPiTools() {
+  if (piTools) return piTools;
+  const source = piToolsSource();
+  if (digest(source) !== PI_TOOLS_SHA256) throw new Error("pi_tools_digest_mismatch");
+  const module = { exports: {} };
+  new Function("module", "exports", "require", '"use strict";\n' + source)(module, module.exports, require);
+  piTools = module.exports;
+  return piTools;
+}
+function piToolsAvailable() {
+  return piToolsSource !== null && !validPrivateJob && !config.spawnPolicy && !config.bashCommandPrefix
+    && ["bash", "read", "edit", "write"].every((tool) => allowedTools.includes(tool));
+}
+function validPiToolRequest(value) {
+  const input = value.input;
+  return piToolsAvailable() && value.semanticDigest === undefined && hasOnlyKeys(input, ["tool", "args"])
+    && ["bash", "read", "edit", "write"].includes(input.tool)
+    && Boolean(input.args) && typeof input.args === "object" && !Array.isArray(input.args)
+    && (input.tool !== "bash" || (typeof input.args.command === "string" && input.args.command.length <= MAX_INPUT_CHARS));
+}
+const PI_MAX_TIMEOUT_SECONDS = 2147483647 / 1000;
+const PI_EXIT_STDIO_GRACE_MS = 100;
+// Run confinement (shared/pi-tool-confinement.ts): the Brain's template holds
+// the token once under quoteDepth layers of single quoting, so the confined
+// script is byte-identical to what the Brain's confineBashPayload gives the
+// bash tool: srt/bwrap, the payload uid, the network allowlist and allowWrite.
+const PI_TOOL_CONFINEMENT_TOKEN = "${Q}";
+function validPiToolConfinement(value) {
+  return hasOnlyKeys(value, ["template", "quoteDepth"]) && typeof value.template === "string"
+    && value.template.length <= ${J} && !value.template.includes("\0")
+    && value.template.split(PI_TOOL_CONFINEMENT_TOKEN).length === 2 && [1, 2, 3].includes(value.quoteDepth);
+}
+// The script T when this command is exactly this policy's confineBashPayload(T)
+// (a Brain that wraps Pi's command itself): the middle is a well-formed escape
+// of T. Null for any other command.
+function piConfinedInnerScript(confinement, script) {
+  const [before, after] = confinement.template.split(PI_TOOL_CONFINEMENT_TOKEN);
+  if (script.length < before.length + after.length || !script.startsWith(before) || !script.endsWith(after)) return null;
+  const middle = script.slice(before.length, script.length - after.length);
+  let inner = middle;
+  for (let layer = 0; layer < confinement.quoteDepth; layer += 1) inner = inner.split("'\\''").join("'");
+  let again = inner;
+  for (let layer = 0; layer < confinement.quoteDepth; layer += 1) again = again.replace(/'/g, "'\\''");
+  return again === middle ? inner : null;
+}
+function piConfinedScript(confinement, script) {
+  // Already confined by this exact policy: wrapping it again would nest srt.
+  if (piConfinedInnerScript(confinement, script) !== null) return script;
+  const [before, after] = confinement.template.split(PI_TOOL_CONFINEMENT_TOKEN);
+  let escaped = script;
+  for (let layer = 0; layer < confinement.quoteDepth; layer += 1) escaped = escaped.replace(/'/g, "'\\''");
+  return before + escaped + after;
+}
+// What identifies a Brain-confined Pi Bash call in the request ledger: the
+// model's command and timeout, without the wrapper. The wrapper is rendered by
+// the dispatching Brain's build from the run's policy, so the Brain that takes
+// a run over at a deploy sends the same call id around a different wrapper. The
+// ledger then refused the replay as another request (duplicate_request_id) and
+// the model read a failure for a command that was still running (prod
+// 2026-10-10, Session 9d60d6ca: a sleep 3500 handed off across the deploy of a
+// confinement change). Null when the request is not such a call.
+function piConfinedBashCallInput(request, confinement) {
+  if (request.tool !== "pi_tool" || request.input.tool !== "bash" || !confinement) return null;
+  const command = piConfinedInnerScript(confinement, request.input.args.command);
+  return command === null ? null : { tool: "bash", confinedArgs: { ...request.input.args, command } };
+}
+// Pi's read/edit/write under run confinement: every file access is a small
+// shell step run through the confined script as the payload, so srt's read
+// denials and allowWrite decide what Pi can see and change, as for model Bash.
+// The step's exit code names the failure; file bytes come back on stdout and
+// written content goes in on stdin, so neither passes through argv.
+const PI_CONFINED_FILE_ERRORS = { 71: ["ENOENT", "no such file or directory"], 72: ["EACCES", "permission denied"],
+  73: ["EISDIR", "illegal operation on a directory"], 75: ["EEXIST", "file already exists"] };
+function piConfinedFileError(result, syscall, file) {
+  const known = result.error === "command_failed" ? PI_CONFINED_FILE_ERRORS[result.exitCode] : undefined;
+  if (known) return Object.assign(new Error(known[0] + ": " + known[1] + ", " + syscall + " '" + file + "'"), { code: known[0], syscall, path: file });
+  const detail = String(result.stderr || "").trim().slice(0, 2000);
+  return Object.assign(new Error("confined " + syscall + " failed (" + (result.error || "exit " + result.exitCode) + ")" + (detail ? ": " + detail : "")), { code: "EIO" });
+}
+function piConfinedFileScript(step, file) {
+  const quoted = shellQuote(file);
+  if (step === "read") return "p=" + quoted + '; if [ ! -e "$p" ]; then exit 71; fi; if [ -d "$p" ]; then exit 73; fi; if [ ! -r "$p" ]; then exit 72; fi; exec cat -- "$p"';
+  if (step === "access_rw") return "p=" + quoted + '; if [ ! -e "$p" ]; then exit 71; fi; if [ ! -r "$p" ] || [ ! -w "$p" ]; then exit 72; fi';
+  if (step === "mkdir") return "p=" + quoted + '; if [ -e "$p" ] && [ ! -d "$p" ]; then exit 75; fi; mkdir -p -- "$p" || exit 72';
+  return "p=" + quoted + '; if [ -d "$p" ]; then exit 73; fi; if [ ! -d "$(dirname -- "$p")" ]; then exit 71; fi; cat > "$p" || exit 72';
+}
+function piConfinedFileOperations(id, state, confinement, signal, writable) {
+  const run = (step, file, stdin) => {
+    const chunks = [];
+    const errors = [];
+    const operation = bashOperation({ id, input: { script: piConfinedScript(confinement, piConfinedFileScript(step, file)) } }, null, null,
+      { onData: (chunk) => chunks.push(chunk), onStderr: (chunk) => errors.push(chunk), confined: true, ...(stdin === undefined ? {} : { stdin }) });
+    const stop = () => { void operation.cancel().catch(() => {}); };
+    if (signal.aborted) stop();
+    else signal.addEventListener("abort", stop, { once: true });
+    return operation.promise.then((result) => {
+      signal.removeEventListener("abort", stop);
+      if (result.error === "process_group_cleanup_unconfirmed") state.cleanupUnconfirmed = true;
+      if (!result.ok) throw piConfinedFileError({ ...result, stderr: Buffer.concat(errors).toString("utf8") },
+        step === "access_rw" ? "access" : step === "read" ? "open" : step === "mkdir" ? "mkdir" : "open", file);
+      return Buffer.concat(chunks);
+    });
+  };
+  const reads = new Map();
+  const read = (file) => {
+    if (!reads.has(file)) reads.set(file, run("read", file));
+    return reads.get(file);
+  };
+  return {
+    // Pi's read checks R_OK (the read itself answers it) and its edit R_OK|W_OK.
+    access: (file) => (writable ? run("access_rw", file) : read(file)).then(() => undefined),
+    readFile: read,
+    detectImageMimeType: (file) => read(file).then((bytes) => loadPiTools().detectSupportedImageMimeType(bytes.subarray(0, 4100))),
+    writeFile: (file, content) => run("write", file, Buffer.from(content, "utf8")).then(() => { reads.delete(file); }),
+    mkdir: (dir) => run("mkdir", dir).then(() => undefined),
+  };
+}
+// A watcher's banner ends the output of a command that will never exit: the
+// tool says it is waiting for file changes. stdin is /dev/null and the output
+// is a pipe, which stops prompts and pagers but not watchers: vitest before 2
+// watches unless CI is set, whatever its stdin (prod 2026-10-11: all 10 hung
+// test calls of a field study ended on vitest's banner and ran to the model's
+// 120 s timeout, the tests done in 0.5 to 73 s). CI is deliberately not set
+// for every command: under it pnpm install refuses a changed package.json,
+// jest and vitest refuse to write a new snapshot, and repository scripts
+// switch to their CI branches. Only text that itself states the wait counts:
+// silence or an idle CPU also describes sleep, a download and a remote build.
+// A dev server's ready line is not a banner (a command may start one, wait and
+// then use it). Output through a pipeline (| tail) never shows the banner here.
+const PI_WATCH_IDLE_MS = 10000;
+const PI_WATCH_BANNER = /(?:waiting|watching) for (?:file )?changes[^\n]*(?:\n[^\n]*press h to show help[^\n]*)?\s*$/i;
+const PI_VITEST_BANNER = /Waiting for file changes\.\.\.\s+press h to show help/;
+function piWatchBanner(tail) {
+  const text = tail.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "").replace(/\r/g, "\n");
+  if (!PI_WATCH_BANNER.test(text)) return null;
+  return PI_VITEST_BANNER.test(text) ? "vitest" : "watcher";
+}
+function piWatchNote(banner) {
+  return "\n\n[Stopped by Reason after " + (PI_WATCH_IDLE_MS / 1000) + " seconds without output: the command finished its run and was waiting for file changes (watch mode), so it would never exit. Its results are above; exit code 124 is this stop, not the command's own. To run it once: "
+    + (banner === "vitest"
+      ? "prefix the same command with CI=1, or pass --run to vitest before any \"--\" (vitest run ...)."
+      : "use its one-shot form (drop --watch or -w; jest: --watchAll=false; vitest: --run), or prefix the command with CI=1 where the tool honours it.")
+    + " To keep a watcher running, start it in the background with its output in a file.]\n";
+}
+function piShellOperations(id, onProgress, state, confinement) {
+  return { exec(command, _cwd, { onData: piOnData, signal, timeout }) {
+    // Pi's local operation contract: reject invalid timeouts, report "aborted"
+    // and "timeout:<seconds>", otherwise resolve the exit code.
+    if (timeout !== undefined && (!Number.isFinite(timeout) || timeout <= 0)) {
+      return Promise.reject(new Error("Invalid timeout: must be a finite number of seconds"));
+    }
+    if (timeout > PI_MAX_TIMEOUT_SECONDS) {
+      return Promise.reject(new Error("Invalid timeout: maximum is " + PI_MAX_TIMEOUT_SECONDS + " seconds"));
+    }
+    if (signal.aborted) return Promise.reject(new Error("aborted"));
+    const startedAt = Date.now();
+    let timedOut = false;
+    let watchTail = "";
+    let watchTimer = null;
+    let watchStopped = false;
+    let stop = () => {};
+    // Every chunk restarts the wait: the banner must be the last thing printed.
+    const onData = (chunk) => {
+      piOnData(chunk);
+      clearTimeout(watchTimer);
+      watchTail = (watchTail + chunk.toString("latin1")).slice(-2048);
+      const banner = piWatchBanner(watchTail);
+      if (!banner || timedOut || watchStopped || signal.aborted) return;
+      watchTimer = setTimeout(() => {
+        if (timedOut || signal.aborted) return;
+        watchStopped = true;
+        piOnData(Buffer.from(piWatchNote(banner), "utf8"));
+        stop();
+      }, PI_WATCH_IDLE_MS);
+    };
+    const shell = confinement
+      ? bashOperation({ id, input: { script: piConfinedScript(confinement, command) } }, onProgress, null, { onData, confined: true })
+      : bashOperation({ id, input: { script: command } }, onProgress, null, { onData });
+    stop = () => { void shell.cancel().catch(() => {}); };
+    const timer = timeout === undefined ? null : setTimeout(() => { if (!watchStopped) { timedOut = true; stop(); } }, timeout * 1000);
+    signal.addEventListener("abort", stop, { once: true });
+    return shell.promise.then((result) => {
+      clearTimeout(timer);
+      clearTimeout(watchTimer);
+      signal.removeEventListener("abort", stop);
+      if (result.error === "process_group_cleanup_unconfirmed") state.cleanupUnconfirmed = true;
+      if (signal.aborted || state.cleanupUnconfirmed) throw new Error("aborted");
+      // The whole group is gone, the watcher with it; the note is the output's last lines.
+      if (watchStopped) return { exitCode: 124 };
+      if (timedOut) throw new Error("timeout:" + timeout);
+      // The Hands lease ended first.
+      if (result.error === "timeout") throw new Error("timeout:" + Math.round((Date.now() - startedAt) / 1000));
+      if (result.ok || result.error === "command_failed") return { exitCode: result.exitCode };
+      throw new Error(result.error || "spawn_failed");
+    });
+  } };
+}
+// Results are journaled and cached; Pi's largest are inline images (4.5 MB
+// base64) and Bash structured output (1 MiB, escaped).
+const MAX_PI_TOOL_OUTCOME_BYTES = 12 * 1024 * 1024;
+function piToolOperation(request, onProgress, confinement) {
+  const controller = new AbortController();
+  const state = { cleanupUnconfirmed: false };
+  let cancelled = false;
+  const promise = (async () => {
+    const { tool, args } = request.input;
+    let outcome;
+    try {
+      const tools = loadPiTools();
+      const cwd = config.repoPath;
+      let instance;
+      if (tool === "bash") {
+        instance = tools.createBashTool(cwd, { operations: piShellOperations(request.id, onProgress, state, confinement), exposeSessionEnvironment: false });
+      } else if (confinement) {
+        const operations = piConfinedFileOperations(request.id, state, confinement, controller.signal, tool === "edit");
+        instance = tool === "read" ? tools.createReadTool(cwd, { operations })
+          : tool === "edit" ? tools.createEditTool(cwd, { operations }) : tools.createWriteTool(cwd, { operations });
+      } else if (localGithubSandbox) {
+        // Relative paths resolve against the canonical root workspaceTarget checks.
+        const root = fs.realpathSync(cwd);
+        const operations = confinedPiFileOperations(request.id, state, tool === "edit", controller.signal);
+        instance = tool === "read" ? tools.createReadTool(root, { operations })
+          : tool === "edit" ? tools.createEditTool(root, { operations }) : tools.createWriteTool(root, { operations });
+      } else {
+        instance = tool === "read" ? tools.createReadTool(cwd) : tool === "edit" ? tools.createEditTool(cwd) : tools.createWriteTool(cwd);
+      }
+      const result = await instance.execute(request.id, args, controller.signal);
+      outcome = {
+        content: result.content,
+        ...(result.details === undefined ? {} : { details: result.details }),
+        ...(result.structuredContent === undefined ? {} : { structuredContent: result.structuredContent }),
+        ...(result.isError === true ? { isError: true } : {}),
+      };
+    } catch (error) {
+      outcome = { thrown: error instanceof Error ? error.message : String(error) };
+    }
+    if (state.cleanupUnconfirmed) return failure(request.id, 1, "process_group_cleanup_unconfirmed", "", "");
+    if (cancelled) return failure(request.id, 130, "cancelled", "", "");
+    const bytes = Buffer.byteLength(JSON.stringify(outcome), "utf8");
+    if (bytes > MAX_PI_TOOL_OUTCOME_BYTES) return failure(request.id, 1, "result_too_large", "", "");
+    const result = { ...success(request.id, "", ""), piToolOutcome: outcome };
+    piToolOutcomeBytes.set(result, bytes);
+    return result;
+  })();
+  return {
+    promise,
+    supportsCancellation: true,
+    cancel() {
+      cancelled = true;
+      controller.abort();
+      return promise.then(() => undefined);
+    },
+  };
+}
+// The same exclusive scope lock used by managed jobs owns request receipts.
+// Store no command/input text. Intent is fsynced BEFORE execution; completion
+// before acknowledgement. A restarted worker can recover completed output, but
+// an interrupted intent is uncertain and must never launch that effect again.
+const MAX_REQUEST_RECORD_BYTES = 16 * 1024 * 1024;
+let requestJournalFailed = false;
+const uncertainRequestIds = new Set();
+function prepareRequestJournal() {
+  if (!journalDirectory) return;
+  const directory = path.join(journalDirectory, "requests");
+  try { fs.mkdirSync(directory, { mode: 0o700 }); }
+  catch (error) { if (error.code !== "EEXIST") throw error; }
+  const stat = fs.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid()
+    || (stat.mode & 0o077) !== 0) throw new Error("invalid_request_journal");
+  // Stream the private directory: receipt count is not a lifetime call cap.
+  // A crash may leave the fixed temp sibling; only the renamed final record
+  // is authoritative, so it cannot authorize replay or a completed result.
+  const directoryHandle = fs.opendirSync(directory);
+  try {
+    let item;
+    while ((item = directoryHandle.readSync()) !== null) {
+      const file = item.name;
+      if (/^[0-9a-f]{64}\.json\.tmp$/.test(file)) continue;
+      if (!/^[0-9a-f]{64}\.json$/.test(file)) throw new Error("invalid_request_journal");
+      const record = privateJournalRead("requests/" + file, MAX_REQUEST_RECORD_BYTES).value;
+      if (safeId(record.id) === "invalid" || requestFile(record.id) !== "requests/" + file) throw new Error("invalid_request_journal");
+      const entry = readRequestReceipt(record.id);
+      if (entry && entry.uncertain) uncertainRequestIds.add(record.id);
+    }
+  } finally { directoryHandle.closeSync(); }
+}
+function requestFile(id) { return "requests/" + digest(id) + ".json"; }
+function readRequestReceipt(id) {
+  if (!journalDirectory) return null;
+  if (requestJournalFailed) throw new Error("request_journal_unavailable");
+  let record;
+  try { record = privateJournalRead(requestFile(id), MAX_REQUEST_RECORD_BYTES).value; }
+  catch (error) { if (error.code === "ENOENT") return null; throw error; }
+  if (!hasOnlyKeys(record, ["schema", "id", "hash", "semanticDigest", "result"])
+    || record.schema !== 1 || record.id !== id || !SHA256_RE.test(record.hash)
+    || (record.semanticDigest !== null && !SHA256_RE.test(record.semanticDigest))
+    || (record.result !== null && (record.result.id !== id
+      || record.result.version !== VERSION || typeof record.result.ok !== "boolean"
+      || typeof record.result.stdout !== "string" || typeof record.result.stderr !== "string"))) {
+    throw new Error("invalid_request_journal");
+  }
+  return { hash: record.hash, semanticDigest: record.semanticDigest, result: record.result,
+    promise: null, uncertain: record.result === null };
+}
+function persistRequestReceipt(id, entry, result) {
+  if (!journalDirectory) return;
+  if (requestJournalFailed) throw new Error("request_journal_unavailable");
+  try {
+    privateJournalWrite(requestFile(id), JSON.stringify({ schema: 1, id, hash: entry.hash,
+      semanticDigest: entry.semanticDigest, result }), MAX_REQUEST_RECORD_BYTES);
+  } catch (error) { requestJournalFailed = true; throw error; }
+}
+function rememberResult(id, entry, result) {
+  try { persistRequestReceipt(id, entry, result); }
+  catch {
+    entry.promise = null; entry.result = null; entry.uncertain = true;
+    uncertainRequestIds.add(id);
+    return false;
+  }
+  entry.promise = null;
+  entry.result = result;
+  uncertainRequestIds.delete(id);
+  cachedResultIds.push(id);
+  cachedPiToolOutcomeBytes += piToolOutcomeBytes.get(result) || 0;
+  while (cachedResultIds.length > MAX_CACHED_RESULTS || cachedPiToolOutcomeBytes > MAX_CACHED_PI_TOOL_OUTCOME_BYTES) {
+    const evictedId = cachedResultIds.shift();
+    const evicted = ledger.get(evictedId);
+    if (evicted && evicted.result) cachedPiToolOutcomeBytes -= piToolOutcomeBytes.get(evicted.result) || 0;
+    if (journalDirectory) ledger.delete(evictedId);
+    else if (evicted) evicted.result = null;
+  }
+  return true;
+}
+// Count retained Pi outcomes by size as well; other results are bounded by count.
+const MAX_CACHED_PI_TOOL_OUTCOME_BYTES = 64 * 1024 * 1024;
+const piToolOutcomeBytes = new WeakMap();
+let cachedPiToolOutcomeBytes = 0;
+async function handleRequest(target, connectionGeneration, claim, raw) {
+  const receivedAtMs = performance.now();
+  if (
+    claim.generation !== targetGeneration
+    || claim.fenceId !== targetFenceId
+  ) {
+    closeSocket(target, "stale_generation");
+    return;
+  }
+  let request;
+  try {
+    request = parseRequest(raw, claim.generation);
+  } catch (error) {
+    if (error.code === "frame_too_large") closeSocket(target, "frame_too_large");
+    else if (error.code === "invalid_json") closeSocket(target, "invalid_json");
+    else if (error.code === "stale_generation") closeSocket(target, "stale_generation");
+    else sendResult(target, failure(
+      error.id || "invalid",
+      2,
+      "invalid_request",
+      "",
+      "",
+      claim.generation,
+    ));
+    return;
+  }
+  if ((request.tool === "pi_tool" && claim.piToolsVersion !== 1)
+    || (request.tool === "bash" && request.input.retainBackground === true && claim.backgroundBashVersion !== 1)
+    || (request.tool === "bash" && request.input.machineSdk === true && claim.machineSdkVersion !== 1)) {
+    sendResult(target, failure(request.id, 2, "invalid_request", "", "", request.generation));
+    return;
+  }
+  const heldMaintenance = currentMaintenance();
+  if ((heldMaintenance && (request.tool !== "bash" || request.lifecycleLeaseId !== heldMaintenance.id || heldMaintenance.expiresAtMs <= Date.now()))
+    || (request.lifecycleLeaseId !== undefined && (!heldMaintenance || request.lifecycleLeaseId !== heldMaintenance.id))) {
+    sendResult(target, failure(request.id, 2, "maintenance_held", "", "", request.generation)); return;
+  }
+  let existing;
+  try { existing = ledger.get(request.id) || readRequestReceipt(request.id); }
+  catch {
+    sendResult(target, failure(request.id, 2, "request_journal_unavailable", "", "", request.generation));
+    return;
+  }
+  if (request.tool === "resume") {
+    if (!existing) {
+      sendResult(target, failure(request.id, 2, "request_not_found", "", "", request.generation));
+      return;
+    }
+    if (existing.semanticDigest !== request.input.semanticDigest) {
+      sendResult(target, failure(request.id, 2, "resume_digest_mismatch", "", "", request.generation));
+      return;
+    }
+    if (existing.result) sendResult(
+      target,
+      bindResumeResult(existing.result, request.generation),
+    );
+    else if (existing.promise) {
+      const result = await existing.promise;
+      if (
+        target === socket
+        && generation === connectionGeneration
+        && targetGeneration === request.generation
+        && targetFenceId === claim.fenceId
+      ) sendResult(target, bindResumeResult(result, request.generation));
+    } else sendResult(target, failure(
+      request.id,
+      2,
+      existing.uncertain ? "request_outcome_uncertain" : "duplicate_result_evicted",
+      "",
+      "",
+      request.generation,
+    ));
+    return;
+  }
+  // A receipt an earlier worker build journaled holds the hash of the frame as sent.
+  const frameHash = requestHash(request);
+  const confinedBashCall = piConfinedBashCallInput(request, claim.piToolsConfinement);
+  const hash = confinedBashCall ? requestHash(request, confinedBashCall) : frameHash;
+  if (existing) {
+    if (existing.hash !== hash && existing.hash !== frameHash) {
+      sendResult(target, failure(
+        request.id,
+        2,
+        "duplicate_request_id",
+        "",
+        "",
+        request.generation,
+      ));
+      return;
+    }
+    if (existing.result) sendResult(
+      target,
+      bindResultGeneration(existing.result, request.generation),
+    );
+    else if (existing.promise) {
+      const result = await existing.promise;
+      if (
+        target === socket
+        && generation === connectionGeneration
+        && targetGeneration === request.generation
+        && targetFenceId === claim.fenceId
+      ) sendResult(target, bindResultGeneration(result, request.generation));
+    } else sendResult(target, failure(
+      request.id,
+      2,
+      existing.uncertain ? "request_outcome_uncertain" : "duplicate_result_evicted",
+      "",
+      "",
+      request.generation,
+    ));
+    return;
+  }
+  if (ledger.size >= MAX_LEDGER_IDS) {
+    sendResult(target, failure(
+      request.id,
+      1,
+      "request_ledger_full",
+      "",
+      "",
+      request.generation,
+    ));
+    return;
+  }
+  const entry = { hash, semanticDigest: request.semanticDigest || null, promise: null, result: null };
+  try { persistRequestReceipt(request.id, entry, null); }
+  catch {
+    sendResult(target, failure(request.id, 2, "request_journal_unavailable", "", "", request.generation));
+    return;
+  }
+  const progress = (stdout, stderr, sequence) => {
+    if (
+      target === socket
+      && generation === connectionGeneration
+      && targetGeneration === request.generation
+      && targetFenceId === claim.fenceId
+    ) sendProgress(
+      target,
+      request.id,
+      sequence,
+      stdout,
+      stderr,
+      request.generation,
+    );
+  };
+  const operation = request.tool === "bash"
+    ? bashOperation(request, progress)
+    : request.tool === "pi_tool"
+      ? piToolOperation(request, request.input.tool === "bash" ? progress : null, claim.piToolsConfinement)
+    : request.tool === "repl"
+      ? localGithubSandbox ? { promise: Promise.resolve(failure(request.id, 1, "tool_unavailable", "", "local_device_gh_repl_unavailable")), cancel() {} } : replOperation(request)
+      : localGithubSandbox || (config.spawnPolicy || config.bashCommandPrefix) && request.tool !== "read"
+        ? payloadFileOperation(request)
+        : fileOperation(request);
+  // Every waiter observes the durable completion, never the raw child result.
+  entry.promise = operation.promise.then((result) => {
+    active.delete(request.id);
+    return rememberResult(request.id, entry, result) ? result
+      : failure(request.id, 2, "request_outcome_uncertain", "", "", request.generation);
+  });
+  ledger.set(request.id, entry);
+  active.set(request.id, operation);
+  const result = await entry.promise.finally(() => {
+    // Read below at most once; never kept past this request (a changed socket or generation sends nothing).
+    queueMicrotask(() => environmentWaits.delete(request.id));
+  });
+  if (
+    target === socket
+    && generation === connectionGeneration
+    && targetGeneration === request.generation
+    && targetFenceId === claim.fenceId
+  ) {
+    // Only this connection's own execution is timed; a cached or resumed
+    // result is not. The Brain subtracts this from its round trip.
+    const bound = bindResultGeneration(result, request.generation);
+    const environmentWaitMs = claim.environmentWaitVersion === 1 ? environmentWaits.get(request.id) : undefined;
+    sendResult(target, claim.executionTimingVersion === 1
+      ? { ...bound, workerElapsedMs: Math.max(0, Math.round(performance.now() - receivedAtMs)),
+        ...(environmentWaitMs ? { environmentWaitMs } : {}) } : bound);
+  }
+}
+function parseClaim(raw) {
+  if (Buffer.byteLength(raw, "utf8") > MAX_FRAME_BYTES) {
+    const error = new Error("frame_too_large"); error.code = "frame_too_large"; throw error;
+  }
+  let value;
+  try { value = JSON.parse(raw); } catch {
+    const error = new Error("invalid_json"); error.code = "invalid_json"; throw error;
+  }
+  if (
+    !hasOnlyKeys(value, ["type", "version", "generation", "fenceId", "executorLaunchId", "requestCancelVersion", "managedJobsVersion", "browserRunEnvelopeVersion", "terminalCleanupVersion", "guestMemoryVersion", "guestMemoryDiagnosticsVersion", "piToolsVersion", "piToolsConfinement", "backgroundBashVersion", "machineSdkVersion", "executionTimingVersion", "environmentWaitVersion"]) ||
+    value.type !== "claim" || value.version !== VERSION ||
+    !Number.isSafeInteger(value.generation) || value.generation < 1 ||
+    typeof value.fenceId !== "string" || !UUID_RE.test(value.fenceId) ||
+    typeof value.executorLaunchId !== "string" || !UUID_RE.test(value.executorLaunchId) ||
+    (value.requestCancelVersion !== undefined && value.requestCancelVersion !== 1) ||
+    (value.managedJobsVersion !== undefined && value.managedJobsVersion !== 1) ||
+    (value.browserRunEnvelopeVersion !== undefined && value.browserRunEnvelopeVersion !== 1) ||
+    (value.guestMemoryVersion !== undefined && value.guestMemoryVersion !== 1) ||
+    (value.guestMemoryDiagnosticsVersion !== undefined && (value.guestMemoryDiagnosticsVersion !== 1 || value.guestMemoryVersion !== 1)) ||
+    (value.terminalCleanupVersion !== undefined && value.terminalCleanupVersion !== 1) ||
+    (value.piToolsVersion !== undefined && value.piToolsVersion !== 1) ||
+    (value.piToolsConfinement !== undefined && (!validPiToolConfinement(value.piToolsConfinement) || value.piToolsVersion !== 1)) ||
+    (value.backgroundBashVersion !== undefined && value.backgroundBashVersion !== 1) ||
+    (value.machineSdkVersion !== undefined && value.machineSdkVersion !== 1) ||
+    (value.executionTimingVersion !== undefined && value.executionTimingVersion !== 1)
+    || (value.environmentWaitVersion !== undefined && (value.environmentWaitVersion !== 1 || value.executionTimingVersion !== 1))
+  ) {
+    const error = new Error("invalid_claim"); error.code = "invalid_claim"; throw error;
+  }
+  return value;
+}
+function handleClaim(target, connectionClaim, raw) {
+  if (terminalCleanupStarted) { closeSocket(target, "terminal_cleanup_started"); return; }
+  let claim;
+  try {
+    claim = parseClaim(raw);
+  } catch (error) {
+    diagnostic("claim_rejected", error.code === "frame_too_large" ? "frame_too_large" : error.code === "invalid_json" ? "invalid_json" : "invalid_claim");
+    closeSocket(
+      target,
+      error.code === "frame_too_large" ? "frame_too_large" : error.code === "invalid_json" ? "invalid_json" : "invalid_claim",
+    );
+    return;
+  }
+  if (claim.executorLaunchId !== config.launchId) {
+    diagnostic("claim_rejected", "executor_mismatch", claim.generation);
+    closeSocket(target, "executor_mismatch");
+    return;
+  }
+  if (claim.generation < targetGeneration) {
+    diagnostic("claim_rejected", "stale_generation", claim.generation);
+    closeSocket(target, "stale_generation");
+    return;
+  }
+  if (claim.generation === targetGeneration && claim.fenceId !== targetFenceId) {
+    diagnostic("claim_rejected", "fence_conflict", claim.generation);
+    closeSocket(target, "fence_conflict");
+    return;
+  }
+  if (claim.generation > targetGeneration) {
+    maintenanceLease = null;
+    if (journalDirectory) {
+      try { privateJournalWrite("scope.json", JSON.stringify(journalScope(claim.generation, claim.fenceId))); }
+      catch { closeSocket(target, "job_journal_unavailable"); return; }
+    }
+    targetGeneration = claim.generation;
+    targetFenceId = claim.fenceId;
+    markReady();
+  }
+  diagnostic("claim_accepted", null, claim.generation);
+  connectionClaim.generation = claim.generation;
+  connectionClaim.fenceId = claim.fenceId;
+  connectionClaim.terminalCleanupVersion = claim.terminalCleanupVersion;
+  connectionClaim.guestMemoryVersion = claim.guestMemoryVersion;
+  connectionClaim.guestMemoryDiagnosticsVersion = claim.guestMemoryDiagnosticsVersion;
+  connectionClaim.piToolsVersion = claim.piToolsVersion === 1 && piToolsAvailable() ? 1 : undefined;
+  // The run's confinement for every pi_tool request on this connection. Local
+  // GitHub confinement owns Pi's file and shell boundary there instead.
+  connectionClaim.piToolsConfinement = claim.piToolsConfinement !== undefined && connectionClaim.piToolsVersion === 1
+    && !localGithubSandbox ? claim.piToolsConfinement : undefined;
+  // A spawn policy authorizes each Bash child only until its own deadline.
+  connectionClaim.backgroundBashVersion = claim.backgroundBashVersion === 1 && allowedTools.includes("bash")
+    && !config.spawnPolicy ? 1 : undefined;
+  connectionClaim.machineSdkVersion = claim.machineSdkVersion === 1 && machineSdkAvailable() ? 1 : undefined;
+  connectionClaim.executionTimingVersion = claim.executionTimingVersion === 1 ? 1 : undefined;
+  connectionClaim.environmentWaitVersion = claim.environmentWaitVersion === 1 && claim.executionTimingVersion === 1 ? 1 : undefined;
+  if (connectionClaim.environmentWaitVersion === 1) environmentWaitNegotiated = true;
+  target.send(JSON.stringify({
+    type: "claim_ack",
+    version: VERSION,
+    generation: targetGeneration,
+    fenceId: targetFenceId,
+    executorLaunchId: config.launchId,
+    workerVersion: WORKER_VERSION,
+    workerArtifactSha256: config.workerArtifactSha256,
+    ...(claim.guestMemoryVersion === 1 && process.platform === "linux" && config.terminalCleanupRunId ? { guestMemoryVersion: 1 } : {}),
+    ...(claim.guestMemoryDiagnosticsVersion === 1 && process.platform === "linux" && config.terminalCleanupRunId ? { guestMemoryDiagnosticsVersion: 1 } : {}),
+    ...(claim.terminalCleanupVersion === 1 && process.platform === "linux" && config.terminalCleanupRunId && config.jobEnvSourcePath ? { terminalCleanupVersion: 1 } : {}),
+    ...(claim.browserRunEnvelopeVersion === 1 && config.browserRunId ? { browserRunEnvelopeVersion: 1 } : {}),
+    ...(connectionClaim.piToolsVersion === 1 ? { piToolsVersion: 1 } : {}),
+    ...(connectionClaim.piToolsConfinement !== undefined ? { piToolsConfinementVersion: 1 } : {}),
+    ...(connectionClaim.backgroundBashVersion === 1 ? { backgroundBashVersion: 1 } : {}),
+    ...(connectionClaim.machineSdkVersion === 1 ? { machineSdkVersion: 1 } : {}),
+    ...(connectionClaim.executionTimingVersion === 1 ? { executionTimingVersion: 1 } : {}),
+    ...(connectionClaim.environmentWaitVersion === 1 ? { environmentWaitVersion: 1 } : {}),
+    ...(claim.requestCancelVersion === 1 && claim.managedJobsVersion === 1 ? { lifecycleVersion: 1 } : {}),
+    ...(claim.requestCancelVersion === 1 ? { requestCancelVersion: 1 } : {}),
+    ...(claim.managedJobsVersion === 1 && config.managedJobs && allowedTools.includes("bash") ? { managedJobsVersion: 1 } : {}),
+  }));
+}
+function cancelActive(hard) {
+  const terminal = [];
+  for (const operation of active.values()) {
+    const cleanup = operation.cancel(hard);
+    terminal.push(operation.promise);
+    if (cleanup) terminal.push(cleanup);
+  }
+  return terminal;
+}
+function markReady() {
+  const temp = config.readyPath + ".tmp";
+  fs.writeFileSync(temp, JSON.stringify({
+    generation,
+    pid: process.pid,
+    launchId: config.launchId,
+    workerVersion: WORKER_VERSION,
+    protocolVersion: VERSION,
+    workerArtifactSha256: config.workerArtifactSha256,
+    workerEntrypoint: WORKER_ENTRYPOINT,
+    targetGeneration,
+    fenceId: targetFenceId,
+    workspaceAliasReady: true,
+  }), { encoding: "utf8", mode: 0o600 });
+  fs.renameSync(temp, config.readyPath);
+  fs.chmodSync(config.readyPath, 0o600);
+}
+function reconnect() {
+  if (stopped || Date.now() >= config.expiresAtMs) return;
+  setTimeout(connect, retryMs);
+  retryMs = Math.min(1000, retryMs * 2);
+}
+function disconnected(next, closeEvent) {
+  if (stopped || next !== socket) return;
+  socket = null;
+  socketClaim = null;
+  failSdkCalls(next, SDK_DISCONNECTED);
+  // A Brain socket disappearing is not, by itself, a user cancellation. The
+  // executor ledger must keep an in-flight Bash/REPL operation alive so a
+  // replacement Brain can reconnect and receive the exact result. Explicit
+  // lifecycle/abort close reasons still cancel work; an unclean TCP close has
+  // no reason and is deliberately recoverable.
+  const reason = closeEvent && typeof closeEvent.reason === "string"
+    ? closeEvent.reason
+    : "";
+  if ([
+    "request_aborted",
+    "request_timeout",
+    "client_closed",
+    "driver_stopped",
+    "driver_handoff",
+    "run_cancelled",
+    "run_finished",
+  ].includes(reason)) {
+    cancelActive(false);
+  }
+  reconnect();
+}
+function connect() {
+  if (stopped || Date.now() >= config.expiresAtMs) return;
+  connectionAttempt += 1;
+  diagnostic("connecting");
+  const next = config.proxyUrl
+    ? new WebSocket(config.url, { proxy: config.proxyUrl })
+    : new WebSocket(config.url);
+  const connectionClaim = { generation: 0, fenceId: "" };
+  socket = next;
+  socketClaim = connectionClaim;
+  const pendingTimer = setTimeout(() => {
+    if (!stopped && next === socket && next.readyState === WebSocket.CONNECTING) diagnostic("dial_pending", "open_not_received");
+  }, 10000);
+  pendingTimer.unref();
+  next.addEventListener("open", () => {
+    if (stopped || next !== socket) return;
+    clearTimeout(pendingTimer);
+    generation += 1;
+    diagnostic("open");
+    retryMs = 25;
+    markReady();
+  });
+  next.addEventListener("message", (event) => {
+    if (next !== socket || generation < 1) return;
+    if (typeof event.data !== "string") {
+      closeSocket(next, "text_only");
+      return;
+    }
+    if (Buffer.byteLength(event.data, "utf8") > MAX_FRAME_BYTES) {
+      closeSocket(next, "frame_too_large"); return;
+    }
+    let frameType = "";
+    try {
+      const value = JSON.parse(event.data);
+      frameType = value && typeof value === "object" ? value.type : "";
+    } catch { frameType = ""; }
+    if (frameType === "claim") {
+      handleClaim(next, connectionClaim, event.data);
+      return;
+    }
+    if (connectionClaim.generation < 1) {
+      closeSocket(next, "claim_required");
+      return;
+    }
+    if (connectionClaim.generation !== targetGeneration || connectionClaim.fenceId !== targetFenceId) {
+      closeSocket(next, "stale_generation"); return;
+    }
+    if (frameType === "guest_memory") { handleGuestMemory(next, { ...connectionClaim }, event.data); return; }
+    if (frameType === "terminal_cleanup") { void handleTerminalCleanup(next, { ...connectionClaim }, event.data); return; }
+    if (terminalCleanupStarted) { closeSocket(next, "terminal_cleanup_started"); return; }
+    if (frameType === "lifecycle") { handleLifecycle(next, { ...connectionClaim }, event.data); return; }
+    if (frameType === "job") {
+      void handleJob({ ...connectionClaim }, event.data, (result) => sendResult(next, result), () => next === socket);
+      return;
+    }
+    if (frameType === "cancel_request") { void handleRequestCancel(next, { ...connectionClaim }, event.data); return; }
+    if (frameType === "sdk_response") { handleSdkResponse(next, event.data); return; }
+    void handleRequest(next, generation, connectionClaim, event.data);
+  });
+  next.addEventListener("error", () => {
+    clearTimeout(pendingTimer);
+    diagnostic("socket_error", next === socket ? "current_connection" : "obsolete_connection");
+    disconnected(next);
+  });
+  next.addEventListener("close", (event) => {
+    clearTimeout(pendingTimer);
+    const knownReasons = ["request_aborted", "request_timeout", "client_closed", "driver_stopped", "driver_handoff", "run_cancelled", "run_finished"];
+    diagnostic("close", knownReasons.includes(event.reason) ? event.reason : "other",
+      null, Number.isSafeInteger(event.code) ? event.code : null);
+    disconnected(next, event);
+  });
+}
+function stop(reason) {
+  if (stoppingPromise) return stoppingPromise;
+  stopped = true;
+  for (const client of jobControlClients) client.destroy();
+  if (jobControlServer) jobControlServer.close();
+  diagnostic("stopping", reason);
+  // Persistent terminal shells outlive the worker; their viewer clients are active PTY jobs.
+  const terminal = [...cancelActive(true), ...stopBackgroundGroups()];
+  removeMachineSdk();
+  if (socket && socket.readyState < WebSocket.CLOSING) socket.close(1000, "stopped");
+  try { fs.unlinkSync(config.readyPath); } catch { stopped = true; }
+  // A clean worker exit is the driver's exact stop proof. Do not exit until
+  // every tracked Bash process group or REPL request has reached its terminal
+  // close path after cancellation. If one cannot settle, the driver eventually
+  // force-kills us and deliberately withholds hands.stopped.
+  stoppingPromise = Promise.all([...terminal, ...(terminalCleanupPromise ? [terminalCleanupPromise] : [])]).then(
+    (results) => {
+      if (journalFailed || cleanupUnconfirmed || results.some((result) => result && result.error === "process_group_cleanup_unconfirmed")
+        || [...jobs.values()].some((job) => job.record.state === "uncertain")) {
+        diagnostic("stopped", "cleanup_failed"); process.exit(1);
+      }
+      try { releaseJournalOwnership(); } catch { diagnostic("stopped", "cleanup_failed"); process.exit(1); }
+      if (config.directTerminalReceiptPath) {
+        const job = jobs.get(config.directShell.jobId)?.record;
+        if (job && ["exited", "cancelled", "expired"].includes(job.state) && Number.isSafeInteger(job.exitCode)) {
+          try {
+            const fd = fs.openSync(config.directTerminalReceiptPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
+            try {
+              fs.writeFileSync(fd, JSON.stringify({ launch_id: config.launchId, fence_id: config.fenceId,
+                scope_id: config.managedJobs.scopeId, observation: { version: 1, process_id: job.jobId,
+                  state: job.state, exit_code: job.exitCode, observed_at: new Date().toISOString() } }));
+              fs.fsyncSync(fd);
+            } finally { fs.closeSync(fd); }
+          } catch { diagnostic("stopped", "cleanup_receipt_failed"); process.exit(1); }
+        }
+      }
+      diagnostic("stopped", "cleanup_complete");
+      process.exit(0);
+    },
+    () => { diagnostic("stopped", "cleanup_failed"); process.exit(1); },
+  );
+  return stoppingPromise;
+}
+process.once("SIGTERM", () => { void stop("SIGTERM"); });
+process.once("SIGINT", () => { void stop("SIGINT"); });
+process.once("SIGHUP", () => { void stop("SIGHUP"); });
+setTimeout(() => { void stop("expired"); }, Math.max(1, config.expiresAtMs - Date.now())).unref();
+void startJobControl().then(() => {
+  // Socket ownership is established before recovery mutates any live records.
+  try { loadJobs(); prepareRequestJournal(); } catch { process.exit(44); }
+  if (validPrivateJob) markReady(); else connect();
+}, () => process.exit(45));
+`.trimStart(),Rt=ot("sha256").update(ht,"utf8").digest("hex");
+export{n as tb,h as ub,qt as vb,o as wb,kt as xb,b as yb,m as zb,ut as Ab,ct as Bb,ft as Cb,dt as Db,Nt as Eb,lt as Fb,gt as Gb,ht as Hb,Rt as Ib};