@reason-machines/cli-linux-arm64-musl 0.2.279 → 0.2.281

package/bin/vm-hands/{vm-hands-entry-lite-9jfh56xt.js → vm-hands-entry-lite-c0whrdtr.js}

@@ -1,10 +1,10 @@
 // @bun
-import{t as u0}from"./vm-hands-entry-lite-k4c504n7.js";import{A as t8,B as o8,C as _7,D as F7,E as v3,F as v5,G as J5,H as _0,I as d$,J as l$,K as E0,L as $2,M as g5,N as t0,O as Y6,P as Z3,Q as a5,U as i5,ba as D7,ca as j7,da as z7,ea as O7,fa as u3,y as k6,z as y6}from"./vm-hands-entry-lite-2s3w4m10.js";import{Aa as e8,Ba as $5,Ca as H7,Da as N7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as V5,Ka as q7,La as W$,Oa as K4,Pa as V4,Qa as FJ,Ra as WJ,Sa as LJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as x$,Ya as B2,Za as U0,_a as M7,db as Q6,fb as S8,ha as u7,ib as g2,ka as q5,kb as m5,la as M5,lb as T3,nb as P5,oa as K5,qa as j5,rb as T7,sb as N3,ta as z5,ya as C5,za as I5}from"./vm-hands-entry-lite-6tpswr2c.js";import{Ab as O5,Bb as A5,Ib as R5}from"./vm-hands-entry-lite-c2nrar90.js";import{Nb as Z5}from"./vm-hands-entry-lite-65pbrs1x.js";import{Ub as h5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Cc as d5,Fc as W7,Ic as f6,Jc as h6,mc as a1,nc as K1,oc as T1,pc as L$,qc as JJ,rc as jJ,sc as zJ,tc as D$,uc as OJ,vc as X4,wc as _1,xc as A8,yc as Y4}from"./vm-hands-entry-lite-qdz95cmv.js";import{Fd as e1,Pd as F2,Tc as b2,Xc as K7,Yc as V7,zd as r8}from"./vm-hands-entry-lite-gqncr2j0.js";import{_d as B}from"./vm-hands-entry-lite-sv6xwe0h.js";import{ge as DJ,he as t2,ke as L7,ne as i$,pe as uJ,qe as dJ,ve as s5}from"./vm-hands-entry-lite-cq7qt28m.js";import{$e as k$,Ae as b$,Ce as P0,De as D4,Fe as J1,Ge as z0,He as x9,Ie as TJ,Je as _J,Ke as E2,Le as U2,Me as f3,Ne as z8,Oe as O8,Pe as X$,Qe as m$,Re as X0,Se as T2,Te as C7,Ue as I7,Ve as o1,We as A4,Ye as Q3,Ze as h1,_e as m0,af as X3,df as m1,ze as b0}from"./vm-hands-entry-lite-bfwf82rw.js";import{hf as D5}from"./vm-hands-entry-lite-ptmqg51y.js";import{fg as HJ,ig as u5,jg as h3,lg as Q5}from"./vm-hands-entry-lite-22f3c914.js";import{Ug as J2,Vg as f5}from"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as V0,Zg as $7}from"./vm-hands-entry-lite-9pmag2qk.js";import{uh as r}from"./vm-hands-entry-lite-01dd716a.js";import{Bh as U7}from"./vm-hands-entry-lite-anaydk9m.js";import{Gh as v0}from"./vm-hands-entry-lite-ffg7rf02.js";import{spawn as AJ,spawnSync as hK}from"child_process";import{closeSync as RJ,mkdirSync as mK,openSync as CJ,readdirSync as vK,realpathSync as V1,rmSync as z$}from"fs";import{hostname as gK}from"os";import{dirname as e3,join as F0,resolve as uK}from"path";var pJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function H9($){let J=typeof $==="string"?pJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as oJ,randomBytes as L9}from"crypto";import{createInterface as eJ}from"readline";import{randomBytes as cJ}from"crypto";import{chmodSync as U9,existsSync as q9,lstatSync as sJ,mkdirSync as aJ,readFileSync as M9,renameSync as iJ,unlinkSync as T9,writeFileSync as _9}from"fs";import{homedir as nJ}from"os";import{dirname as rJ,join as N9}from"path";function Z1($=process.env,J=nJ()){let Z=$.XDG_CONFIG_HOME?.trim()||N9(J,".config"),X=P0({env:$})==="staging"?["staging"]:[];return N9(U2(Z,...X),"credentials.json")}function F9($,J=Z1()){return aJ(rJ(J),{recursive:!0,mode:448}),_9(J,`${JSON.stringify($,null,2)}
-`,{mode:384}),U9(J,384),J}function P$($=Z1()){if(!q9($))return null;try{let J=M9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=J1(Q);if(X!==Q)tJ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function tJ($,J,Z){let Q=`${$}.${process.pid}.${cJ(6).toString("hex")}.tmp`;try{let X=sJ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(_9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
-`,{mode:384,flag:"wx"}),U9(Q,384),M9($,"utf8")!==J)throw Error("credentials_changed");iJ(Q,$)}catch{try{T9(Q)}catch{}}}function W9($=Z1()){if(!q9($))return!1;return T9($),!0}class M2 extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function D9(){let $=L9(48).toString("base64url"),J=oJ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:L9(32).toString("base64url")}}function $Z($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new M2(Q,Z)}async function JZ($,J,Z){let Q=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J}),X=await Q.json().catch(()=>({}));if(!Q.ok)throw $Z(X,`OAuth token request failed (${Q.status})`);return X}async function ZZ($,J={}){let Z=J.fetchImpl??fetch,Q=await JZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z);if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new M2("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return F9(X,J.path??Z1()),X}var q2=new Map;async function b1($={}){let J=$.path??Z1(),Z=P$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=q2.get(Y);if(G)return G;let H;return H=ZZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof M2)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=P$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return b1({fetchImpl:$.fetchImpl,path:J});return W9(J),null}).finally(()=>{if(q2.get(Y)===H)q2.delete(Y)}),q2.set(Y,H),H}function j9($,J){return new Promise((Z)=>{let Q=eJ({input:$}),X=!1,Y=(H)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(H)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(H)=>Y(H)),Q.once("close",()=>Y(null))})}var QZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),XZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function YZ($){let J=XZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var GZ=["minimal","low","medium","high","xhigh","max"],BZ=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),KZ=B.object({devices:B.array(BZ),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),VZ=B.object({id:B.string().min(1),name:B.string()}),HZ=B.object({items:B.array(VZ)}),NZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),UZ=B.object({items:B.array(NZ).default([])}),qZ=B.enum(["linux","macos"]),z9=B.object({id:B.string().min(1),name:B.string().min(1),platform:qZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),MZ=B.object({machines:B.array(z9)}),TZ=B.object({machine:z9}),_Z=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),FZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),O9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),WZ=O9.extend({organization_id:B.string().min(1)}),xV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var EV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function k1($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var LZ=B.object({error:B.object({type:B.string(),message:B.string()})});function A9($,J,Z){let Q=LZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",H=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(H)&&H>=0?H*1000:void 0)}async function R9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw A9(J.status,Z,J.headers.get("retry-after"));return k1(WZ,Z,"invalid_machine_ticket")}class H1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await b1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw A9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return k1(MZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return k1(TZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return k1(_Z,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return k1(FZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return k1(O9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=HZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return k1(UZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=KZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:GZ.filter((H)=>Q.includes(H))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return H9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=QZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=YZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments`)).items??[]}catch(J){if(J instanceof G0&&(J.status===403||J.status===404))return[];throw J}}async requireSessionAttachments(){if((await this.request("/deployment")).session_attachments!==!0)throw Error("This server does not support Session image attachments yet. Update the server and retry; the image was not sent.")}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return D4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function DZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function j4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function C9($){let J=$.env??process.env,Z=j4(J);if(!Z)return($.getCredentials??b1)({apiOrigin:DZ(J)});let Q=y1(J,$.channel??P0({env:J})),X=await($.fetchImpl??fetch)(Q+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Z,accept:"application/json"}}),Y=await X.json().catch(()=>({})),G=t0(Y)?Y:{};if(!X.ok){let K=typeof G.detail==="string"?G.detail:typeof G.message==="string"?G.message:"API key authentication failed ("+X.status+")";throw new G0(X.status,typeof G.error==="string"?G.error:"api_key_auth_failed",K)}if(typeof G.org_id!=="string"||!G.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let H=Array.isArray(G.scopes)?G.scopes.filter((K)=>typeof K==="string"):[];return{credentialKind:"api_key",apiOrigin:Q,accessToken:Z,orgId:G.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:H}}import{createHash as jZ}from"crypto";import{unlinkSync as zZ}from"fs";import{platform as OZ}from"os";import{join as AZ}from"path";var I9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>AZ($,"api-key.json");function j1($){let J=jZ("sha256").update(`reason-connect-api-key
-${$}`).digest("hex");return new o1(T2(),OZ(),J)}function z4($,J,Z=j1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof X0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=j1($)){if(!u(f1($)))return null;let Z=I9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof X0))throw Q;throw Error("worker_api_key_unreadable")}}function P9($,J=j1($)){if(!u(f1($)))return;if(I9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof X0))throw Z}zZ(f1($))}async function O4($,J){let Z;try{Z=await C9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as lZ,renameSync as pZ,rmSync as v1}from"fs";import{join as q0}from"path";import{createHash as RZ}from"crypto";import{realpathSync as CZ,statSync as IZ,unlinkSync as _2}from"fs";import{platform as PZ}from"os";import{join as y0}from"path";function d($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var xZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max(e1).optional()});function E9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function R4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=xZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?C4($):new A4(g($))}function W2($,J){T0($,!0),wZ($);let Z=J??C4($),Q=new A4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof X0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function C4($){return new o1(T2(),PZ(),EZ($))}function EZ($){let J=I4($);return RZ("sha256").update(`reason-worker
-${J?.directory??g($)}`).digest("hex")}function E$($,J){c(y0(g($),S$),{version:1,directory:I4($)?.directory??g($),devicePublicKey:J})}var S$="keychain-scope.json";function S9($){return u(y0(g($),S$))}var SZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function I4($){let J=y0(g($),S$);if(!u(J))return null;let Z=SZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function wZ($){let J=y0(g($),S$);if(!u(J))return;if(I4($))try{let Z=C4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof X0))throw Z}_2(J)}function N1($){let J=CZ($.workspaceRoot);if(J!==$.workspaceRoot||!IZ(J).isDirectory()||!x$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&x9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var w9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=d($).control;return u(J)?w9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(d($).control,w9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),S$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var bZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),P4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:bZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),kZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),x4=30000;class Q1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function yZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(x4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new Q1(X?.error==="device_revoked")}return Q.json()}async function E4($,J,Z,Q){u0();let X=P4.parse(JSON.parse(s(J)));return X1($,X,Z,Q)}async function X1($,J,Z,Q=(Y,G)=>yZ(Y,G,k0($.proxy)),X=performance.now()){let Y=k9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function b9($,J,Z,Q,X=performance.now()){let Y=k9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function k9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=kZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let V=F2(q.first_heartbeat);try{E9($,q.device_id,{...V?{offer:V}:{},enrollmentMs:Math.min(e1,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as fZ,randomUUID as hZ}from"crypto";import{unlinkSync as mZ}from"fs";import{join as vZ}from"path";var y9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),gZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function S4($){return gZ.parse($)}var uZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function z1($){return Z1(b$("REASON_CLI_CHANNEL",$.channel),V0())}async function O1($,J=z1($)){if(!u(J))return null;let Z=uZ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,H)=>Q(G,{...H,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await b1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function f9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function h9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=A1($),H=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(H){let K=await b9($,G.direct(J.orgId),Q,(N,q)=>H({approval:G.request,code_verifier:q,registration:N}).catch((V)=>{throw dZ(V)}),Y);if(K)return K}return X1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function dZ($){if(!($ instanceof G0))return $;if($.status===409)return new Q1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new Q1(!1);return $}var w$=($)=>vZ(g($),"enrollment-install.json");function m9($){if(u(w$($)))mZ(w$($))}function A1($,{stored:J=!0}={}){u0();let Z=w$($),Q=J&&u(Z)?y9.parse(JSON.parse(s(Z))):{version:1,install_id:hZ(),fingerprint_key:fZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let H=($.folders??[]).map((V)=>{let U=m1([V],X,Y)[0];if(U.path!==V)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=D9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...H.map((V)=>V.path_fingerprint)].map((V)=>({path_fingerprint:V,permissions:X,execution_mode:$.executionMode}))},q=(V)=>({version:1,organization_id:V,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...H.length?{folders:H}:{}});return{request:N,saveInstall(V){e(g(V),!0),c(w$(V),Q)},complete(V,U){let M=S4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(V),enrollment_ticket:M.enrollment_ticket}},direct:q}}function v9($,J,Z){let Q=w$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=y9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,d9=600000,l9=15000,g9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,U1=($)=>q0(g($),"workspaces"),p9="account.json",w4=($)=>u(q0($,p9));function h0($){let J;try{J=lZ(U1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=q0(U1($),Z),X=q0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:w4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(U1($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,p9),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function y$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var b4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function u9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");E$($,Z.devicePublicKey),e(g(J),!0);for(let Y of b4)v1(q0(g(J),Y),{force:!0});for(let Y of b4){let G=q0(g($),Y);if(u(G))pZ(G,q0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function k4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(f4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(V)=>Number(Date.parse(V.worker?.expiresAt??"")>X+60000),H=h0($).flatMap((V)=>{if(!V.account||!V.config)return[];try{if($0(V.config).revoked)return[];let U=t(V.config);return U&&U.orgId.toLowerCase()===V.organizationId&&(!Q||Y(U))?[{...V,config:V.config,state:U}]:[]}catch{return[]}}).sort((V,U)=>Number(U.organizationId===J)-Number(V.organizationId===J)||Y(U.state)-Y(V.state))[0];if(!H)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==H.organizationId){let V=j2($,N);u9($,V.config),c(V.configPath,V.config)}else if(u(g($))){try{if(u(d($).state))f0($)}catch{}for(let V of b4)v1(q0(g($),V),{force:!0})}k4($);let q=J0.parse({...H.config,stateDirectory:$.stateDirectory});return u9(H.config,q),c(q0($.stateDirectory,"worker.json"),q),v1(H.directory,{recursive:!0,force:!0}),q}var y4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)E$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==q0(U1($),Z))continue;let H=J0.parse({...G,stateDirectory:Q}),K=T0(H),N=h1(d(H).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(H)}},d(H).state,{proofStore:K});c(X,H)}catch{}}}},f4=($)=>q0(U1($),"listed.json");function c9($){try{let J=JSON.parse(s(f4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function s9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=c9($),G=Y&&!Y.listed?Y.reason:null,H=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&H.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...H].map(({organizationId:K,config:N,account:q})=>{let V=!1,U=null,M=!1;try{V=N?$0(N).revoked:!1,U=N&&!V?t(N):null,M=J&&!!U&&k$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:V?"removed":M?"connected":"not_running",blocked:!q&&!V&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function a9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,H=null,K=!1,N=c9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...C}=J,P=Z.roots.slice(1).map((R)=>R.path);return J0.parse({...C,...P.length?{folders:P}:{},stateDirectory:q0(U1(J),W)})},V=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let C=new AbortController,P=()=>C.abort();if(X.addEventListener("abort",P,{once:!0}),X.aborted)C.abort();let R={...W,controller:C,claims:0,done:Promise.resolve(),account:L};R.done=$.serve(W,C.signal,(I)=>{R.claims=I}).then(()=>{return},(I)=>{if(L&&I instanceof _0&&I.status===401&&g9.has(I.code)){if(I.code==="device_revoked")try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer
-`)}else if(I instanceof _0&&I.status===401&&g9.has(I.code)){try{f0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
+import{t as u0}from"./vm-hands-entry-lite-k4c504n7.js";import{A as o8,B as e8,C as F7,D as W7,E as v3,F as g5,G as Z5,H as _0,I as l$,J as p$,K as E0,L as J2,M as u5,N as t0,O as G6,P as Z3,Q as i5,U as n5,ba as j7,ca as z7,da as O7,ea as A7,fa as u3,y as y6,z as f6}from"./vm-hands-entry-lite-rwdevjb0.js";import{Aa as $5,Ba as J5,Ca as N7,Da as U7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as H5,Ka as M7,La as W$,Oa as K4,Pa as V4,Qa as WJ,Ra as LJ,Sa as DJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as T7,db as X6,fb as w8,ha as d7,ib as g2,ka as M5,kb as v5,la as T5,lb as T3,nb as x5,oa as V5,qa as z5,rb as _7,sb as N3,ta as O5,ya as I5,za as P5}from"./vm-hands-entry-lite-t678ape1.js";import{Ab as A5,Bb as R5,Ib as C5}from"./vm-hands-entry-lite-c2nrar90.js";import{Nb as Q5}from"./vm-hands-entry-lite-65pbrs1x.js";import{Ub as m5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Cc as l5,Fc as L7,Ic as h6,Jc as m6,mc as a1,nc as K1,oc as T1,pc as L$,qc as ZJ,rc as zJ,sc as OJ,tc as D$,uc as AJ,vc as X4,wc as _1,xc as R8,yc as Y4}from"./vm-hands-entry-lite-bm9x8vng.js";import{Fd as e1,Pd as F2,Tc as b2,Xc as V7,Yc as H7,zd as t8}from"./vm-hands-entry-lite-gqncr2j0.js";import{_d as B}from"./vm-hands-entry-lite-sv6xwe0h.js";import{ge as jJ,he as t2,ke as D7,ne as n$,pe as dJ,qe as lJ,ve as a5}from"./vm-hands-entry-lite-rs7g2egs.js";import{$e as y$,Ae as k$,Ce as P0,De as D4,Fe as J1,Ge as z0,He as E9,Ie as _J,Je as FJ,Ke as E2,Le as q2,Me as f3,Ne as O8,Oe as A8,Pe as X$,Qe as v$,Re as X0,Se as T2,Te as I7,Ue as P7,Ve as o1,We as A4,Ye as Q3,Ze as h1,_e as m0,af as X3,df as m1,ze as b0}from"./vm-hands-entry-lite-bfwf82rw.js";import{hf as j5}from"./vm-hands-entry-lite-ptmqg51y.js";import{fg as NJ,ig as d5,jg as h3,lg as X5}from"./vm-hands-entry-lite-d2xzrjx2.js";import{Ug as Z2,Vg as h5}from"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as V0,Zg as J7}from"./vm-hands-entry-lite-9pmag2qk.js";import{uh as r}from"./vm-hands-entry-lite-zjnq10yb.js";import{Bh as q7}from"./vm-hands-entry-lite-anaydk9m.js";import{Gh as v0}from"./vm-hands-entry-lite-ffg7rf02.js";import{spawn as RJ,spawnSync as vK}from"child_process";import{closeSync as CJ,mkdirSync as gK,openSync as IJ,readdirSync as uK,realpathSync as V1,rmSync as z$}from"fs";import{hostname as dK}from"os";import{dirname as e3,join as F0,resolve as lK}from"path";var cJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function H9($){let J=typeof $==="string"?cJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as eJ,randomBytes as L9}from"crypto";import{createInterface as $Z}from"readline";import{randomBytes as sJ}from"crypto";import{chmodSync as U9,existsSync as q9,lstatSync as aJ,mkdirSync as iJ,readFileSync as M9,renameSync as nJ,unlinkSync as T9,writeFileSync as _9}from"fs";import{homedir as rJ}from"os";import{dirname as tJ,join as N9}from"path";function Z1($=process.env,J=rJ()){let Z=$.XDG_CONFIG_HOME?.trim()||N9(J,".config"),X=P0({env:$})==="staging"?["staging"]:[];return N9(q2(Z,...X),"credentials.json")}function F9($,J=Z1()){return iJ(tJ(J),{recursive:!0,mode:448}),_9(J,`${JSON.stringify($,null,2)}
+`,{mode:384}),U9(J,384),J}function P$($=Z1()){if(!q9($))return null;try{let J=M9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=J1(Q);if(X!==Q)oJ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function oJ($,J,Z){let Q=`${$}.${process.pid}.${sJ(6).toString("hex")}.tmp`;try{let X=aJ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(_9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
+`,{mode:384,flag:"wx"}),U9(Q,384),M9($,"utf8")!==J)throw Error("credentials_changed");nJ(Q,$)}catch{try{T9(Q)}catch{}}}function W9($=Z1()){if(!q9($))return!1;return T9($),!0}class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function j9(){let $=L9(48).toString("base64url"),J=eJ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:L9(32).toString("base64url")}}function JZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function ZZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw JZ(Y,`OAuth token request failed (${X.status})`);return Y}var QZ=1e4;async function XZ($,J={}){let Z=J.fetchImpl??fetch,Q=await ZZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(QZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return F9(X,J.path??Z1()),X}var M2=new Map;function D9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function b1($={}){let J=$.path??Z1(),Z=P$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=M2.get(Y);if(G)return D9(G,$.signal);let H;return H=XZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=P$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return b1({fetchImpl:$.fetchImpl,path:J});return W9(J),null}).finally(()=>{if(M2.get(Y)===H)M2.delete(Y)}),M2.set(Y,H),D9(H,$.signal)}function z9($,J){return new Promise((Z)=>{let Q=$Z({input:$}),X=!1,Y=(H)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(H)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(H)=>Y(H)),Q.once("close",()=>Y(null))})}var YZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),GZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function BZ($){let J=GZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var KZ=["minimal","low","medium","high","xhigh","max"],VZ=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),HZ=B.object({devices:B.array(VZ),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),NZ=B.object({id:B.string().min(1),name:B.string()}),UZ=B.object({items:B.array(NZ)}),qZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),MZ=B.object({items:B.array(qZ).default([])}),TZ=B.enum(["linux","macos"]),O9=B.object({id:B.string().min(1),name:B.string().min(1),platform:TZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),_Z=B.object({machines:B.array(O9)}),FZ=B.object({machine:O9}),WZ=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),LZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),A9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),DZ=A9.extend({organization_id:B.string().min(1)}),SV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var wV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function k1($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var jZ=B.object({error:B.object({type:B.string(),message:B.string()})});function R9($,J,Z){let Q=jZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",H=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(H)&&H>=0?H*1000:void 0)}async function C9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw R9(J.status,Z,J.headers.get("retry-after"));return k1(DZ,Z,"invalid_machine_ticket")}class H1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await b1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw R9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return k1(_Z,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return k1(FZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return k1(WZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return k1(LZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return k1(A9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=UZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return k1(MZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=HZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:KZ.filter((H)=>Q.includes(H))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return H9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=YZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=BZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments`)).items??[]}catch(J){if(J instanceof G0&&(J.status===403||J.status===404))return[];throw J}}async requireSessionAttachments(){if((await this.request("/deployment")).session_attachments!==!0)throw Error("This server does not support Session image attachments yet. Update the server and retry; the image was not sent.")}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return D4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function zZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function j4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function I9($,J){let Z=$.env??process.env,Q=j4(Z);if(!Q)return($.getCredentials??b1)({apiOrigin:zZ(Z),signal:J});let X=y1(Z,$.channel??P0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),G=await Y.json().catch(()=>({})),H=t0(G)?G:{};if(!Y.ok){let N=typeof H.detail==="string"?H.detail:typeof H.message==="string"?H.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof H.error==="string"?H.error:"api_key_auth_failed",N)}if(typeof H.org_id!=="string"||!H.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(H.scopes)?H.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:H.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as OZ}from"crypto";import{unlinkSync as AZ}from"fs";import{platform as RZ}from"os";import{join as CZ}from"path";var P9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>CZ($,"api-key.json");function j1($){let J=OZ("sha256").update(`reason-connect-api-key
+${$}`).digest("hex");return new o1(T2(),RZ(),J)}function z4($,J,Z=j1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof X0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=j1($)){if(!u(f1($)))return null;let Z=P9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof X0))throw Q;throw Error("worker_api_key_unreadable")}}function x9($,J=j1($)){if(!u(f1($)))return;if(P9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof X0))throw Z}AZ(f1($))}async function O4($,J){let Z;try{Z=await I9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as cZ,renameSync as sZ,rmSync as v1}from"fs";import{join as q0}from"path";import{createHash as IZ}from"crypto";import{realpathSync as PZ,statSync as xZ,unlinkSync as _2}from"fs";import{platform as EZ}from"os";import{join as y0}from"path";function d($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var SZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max(e1).optional()});function S9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function R4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=SZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?C4($):new A4(g($))}function W2($,J){T0($,!0),kZ($);let Z=J??C4($),Q=new A4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof X0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function C4($){return new o1(T2(),EZ(),wZ($))}function wZ($){let J=I4($);return IZ("sha256").update(`reason-worker
+${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,directory:I4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function w9($){return u(y0(g($),w$))}var bZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function I4($){let J=y0(g($),w$);if(!u(J))return null;let Z=bZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function kZ($){let J=y0(g($),w$);if(!u(J))return;if(I4($))try{let Z=C4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof X0))throw Z}_2(J)}function N1($){let J=PZ($.workspaceRoot);if(J!==$.workspaceRoot||!xZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&E9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var b9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=d($).control;return u(J)?b9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(d($).control,b9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),w$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var yZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),P4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:yZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),fZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),x4=30000;class Q1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function hZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(x4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new Q1(X?.error==="device_revoked")}return Q.json()}async function E4($,J,Z,Q){u0();let X=P4.parse(JSON.parse(s(J)));return X1($,X,Z,Q)}async function X1($,J,Z,Q=(Y,G)=>hZ(Y,G,k0($.proxy)),X=performance.now()){let Y=y9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function k9($,J,Z,Q,X=performance.now()){let Y=y9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function y9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=fZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let V=F2(q.first_heartbeat);try{S9($,q.device_id,{...V?{offer:V}:{},enrollmentMs:Math.min(e1,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as mZ,randomUUID as vZ}from"crypto";import{unlinkSync as gZ}from"fs";import{join as uZ}from"path";var f9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),dZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function S4($){return dZ.parse($)}var lZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function z1($){return Z1(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function O1($,J=z1($)){if(!u(J))return null;let Z=lZ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,H)=>Q(G,{...H,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await b1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function h9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function m9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=A1($),H=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(H){let K=await k9($,G.direct(J.orgId),Q,(N,q)=>H({approval:G.request,code_verifier:q,registration:N}).catch((V)=>{throw pZ(V)}),Y);if(K)return K}return X1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function pZ($){if(!($ instanceof G0))return $;if($.status===409)return new Q1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new Q1(!1);return $}var b$=($)=>uZ(g($),"enrollment-install.json");function v9($){if(u(b$($)))gZ(b$($))}function A1($,{stored:J=!0}={}){u0();let Z=b$($),Q=J&&u(Z)?f9.parse(JSON.parse(s(Z))):{version:1,install_id:vZ(),fingerprint_key:mZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let H=($.folders??[]).map((V)=>{let U=m1([V],X,Y)[0];if(U.path!==V)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=j9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...H.map((V)=>V.path_fingerprint)].map((V)=>({path_fingerprint:V,permissions:X,execution_mode:$.executionMode}))},q=(V)=>({version:1,organization_id:V,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...H.length?{folders:H}:{}});return{request:N,saveInstall(V){e(g(V),!0),c(b$(V),Q)},complete(V,U){let M=S4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(V),enrollment_ticket:M.enrollment_ticket}},direct:q}}function g9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=f9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,l9=600000,p9=15000,u9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,U1=($)=>q0(g($),"workspaces"),c9="account.json",w4=($)=>u(q0($,c9));function h0($){let J;try{J=cZ(U1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=q0(U1($),Z),X=q0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:w4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(U1($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,c9),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var b4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function d9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of b4)v1(q0(g(J),Y),{force:!0});for(let Y of b4){let G=q0(g($),Y);if(u(G))sZ(G,q0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function k4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(f4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(V)=>Number(Date.parse(V.worker?.expiresAt??"")>X+60000),H=h0($).flatMap((V)=>{if(!V.account||!V.config)return[];try{if($0(V.config).revoked)return[];let U=t(V.config);return U&&U.orgId.toLowerCase()===V.organizationId&&(!Q||Y(U))?[{...V,config:V.config,state:U}]:[]}catch{return[]}}).sort((V,U)=>Number(U.organizationId===J)-Number(V.organizationId===J)||Y(U.state)-Y(V.state))[0];if(!H)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==H.organizationId){let V=j2($,N);d9($,V.config),c(V.configPath,V.config)}else if(u(g($))){try{if(u(d($).state))f0($)}catch{}for(let V of b4)v1(q0(g($),V),{force:!0})}k4($);let q=J0.parse({...H.config,stateDirectory:$.stateDirectory});return d9(H.config,q),c(q0($.stateDirectory,"worker.json"),q),v1(H.directory,{recursive:!0,force:!0}),q}var y4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==q0(U1($),Z))continue;let H=J0.parse({...G,stateDirectory:Q}),K=T0(H),N=h1(d(H).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(H)}},d(H).state,{proofStore:K});c(X,H)}catch{}}}},f4=($)=>q0(U1($),"listed.json");function s9($){try{let J=JSON.parse(s(f4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function a9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=s9($),G=Y&&!Y.listed?Y.reason:null,H=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&H.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...H].map(({organizationId:K,config:N,account:q})=>{let V=!1,U=null,M=!1;try{V=N?$0(N).revoked:!1,U=N&&!V?t(N):null,M=J&&!!U&&y$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:V?"removed":M?"connected":"not_running",blocked:!q&&!V&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function i9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,H=null,K=!1,N=s9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...C}=J,P=Z.roots.slice(1).map((R)=>R.path);return J0.parse({...C,...P.length?{folders:P}:{},stateDirectory:q0(U1(J),W)})},V=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let C=new AbortController,P=()=>C.abort();if(X.addEventListener("abort",P,{once:!0}),X.aborted)C.abort();let R={...W,controller:C,claims:0,done:Promise.resolve(),account:L};R.done=$.serve(W,C.signal,(I)=>{R.claims=I}).then(()=>{return},(I)=>{if(L&&I instanceof _0&&I.status===401&&u9.has(I.code)){try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer (${I.code}); run \`reason connect\` signed in as that account to connect it again
+`)}else if(I instanceof _0&&I.status===401&&u9.has(I.code)){try{f0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
 `)}else if(!C.signal.aborted)Y(`Reason worker: workspace ${W.organizationId} stopped (worker_workspace_failed); it starts again on the next check
 `)}).finally(()=>{if(C.abort(),X.removeEventListener("abort",P),R.claims=0,G.get(W.organizationId)===R)G.delete(W.organizationId);let I=W.config.stateDirectory;if(L&&!w4(I)&&!u(q0(I,"worker.json")))v1(I,{recursive:!0,force:!0})}),G.set(W.organizationId,R)},M=(W,L)=>{if(!L)return null;try{let C=q(W),P=t(L);if(!P||P.orgId!==W||Date.parse(P.worker?.expiresAt??"")<=Date.now()+60000||L.name!==C.name||L.executionMode!==C.executionMode||!z0(L.apiOrigin,C.apiOrigin)||P.roots.map((R)=>R.path).join(`
 `)!==Z.roots.map((R)=>R.path).join(`
@@ -12,21 +12,21 @@ ${J?.directory??g($)}`).digest("hex")}function E$($,J){c(y0(g($),S$),{version:1,
 `)}for(let A of x){if(X.aborted)return!0;if(P(A))continue;try{let f=G.get(A);if(E.get(A)){if(f&&f.claims===0)await V(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
 `);continue}let b=M(A,C.get(A)?.config??null);if(b&&f)continue;if(!b){if(f&&f.claims>0)continue;if(await V(A),b=await j(A),b)Y(`Reason worker: connected in workspace ${A}
 `)}if(b&&!X.aborted)U(b)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
-`)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(U1(J),!0),c(f4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(H)K=!0;else H=O().finally(()=>{H=null});return H},claims:()=>[...G.values()].reduce((W,L)=>W+L.claims,0),async settled(){await H,await Promise.all([...G.values()].map((W)=>W.done))}}}import{dirname as WQ}from"path";import{randomUUID as $$}from"crypto";import{chmodSync as t9,closeSync as J$,constants as Z$,existsSync as tZ,fstatSync as o9,lstatSync as e9,mkdirSync as $8,openSync as J8,readFileSync as Z8,readdirSync as Q8,readlinkSync as _N,realpathSync as FN,renameSync as Q$,rmSync as h4,statSync as X8,symlinkSync as WN,unlinkSync as h$,writeFileSync as m4}from"fs";import{basename as DN,dirname as Y8,isAbsolute as oZ,join as D0,relative as jN,resolve as zN,sep as ON}from"path";import{createRequire as eZ}from"module";var G8=1,B8=1,$Q=128,JQ=65536;var ZQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var i9=/^[a-z0-9_.-]{1,80}$/,QQ=64;var XQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function K8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function V8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&ZQ.test($)}function H8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function g4($){$8($,{recursive:!0,mode:448}),t9($,448)}function YQ($,J){g4(Y8($));let Z=`${$}.${process.pid}.${$$()}.tmp`;try{m4(Z,J,{mode:384,flag:"wx"}),t9(Z,384),Q$(Z,$)}finally{if(tZ(Z))h$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new m$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=b0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?b0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&oZ(X))?null:D0($.home??V0(),"Library","Application Support"),H=$.root??(G?D0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:H,...G?{legacyRoot:D0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(H,"versions"),current:D0(H,"current"),previous:D0(H,"previous"),brokerLock:D0(H,"broker.lock"),transitionLock:D0(H,"transition.lock"),lifecycleEvents:D0(H,"lifecycle-events")}}function GQ($){return K8($)&&V8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===G8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&H8($.started_at)&&R2($.runtime_version)}function N8($,J){try{let Z=e9($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=J8(D0($,J),Z$.O_RDONLY|Z$.O_NOFOLLOW|Z$.O_NONBLOCK);try{let X=o9(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return Z8(Q,"utf8")}finally{J$(Q)}}catch{return null}}function v4($){try{let J=JSON.parse(N8($,"owner.json")??"null");return GQ(J)?J:null}catch{return null}}function U8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var n9="lease",BQ=2,KQ=4,f$;function VQ(){if(f$!==void 0)return f$;if(f$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=eZ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return f$={flock:(G,H)=>X.symbols.flock(G,H),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},f$}catch{}return null}function HQ($){let J=VQ();if(!J)return null;let Z=J8(`${$}.lease`,Z$.O_RDWR|Z$.O_CREAT|Z$.O_NOFOLLOW,384);try{let Q=o9(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return J$(Z),"busy";if(J.flock(Z,BQ|KQ)===0)return Z;let X=J.errno();return J$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw J$(Z),Q}}function Y1($){g4(Y8($.path));let J=HQ($.path);if(J==="busy")return{acquired:!1,owner:v4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=NQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)J$(J)}}function NQ($,J){let Z=$.alive??U8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:G8,pid:$.pid??process.pid,nonce:$.nonce?.()??$$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${$$()}`,H=!1;try{if($8(G,{mode:448}),m4(D0(G,"owner.json"),`${JSON.stringify(Y)}
-`,{mode:384,flag:"wx"}),J!==null)m4(D0(G,n9),`flock
-`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw e9($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}Q$(G,$.path),H=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,v4($.path)?.nonce===Y.nonce)h4($.path,{recursive:!0,force:!0});if(J!==null)J$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=v4($.path),V=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?V-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&N8($.path,n9)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${$$()}`;try{Q$($.path,T),h4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!H)h4(G,{recursive:!0,force:!0})}}throw new m$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function q8($){return K8($)&&V8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===B8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&H8($.occurred_at)&&typeof $.event==="string"&&XQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&i9.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=QQ&&$.capabilities.every((J)=>typeof J==="string"&&i9.test(J)))}var UQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,qQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,MQ=300000,A2=0n;function TQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function M8($){try{return Q8($.lifecycleEvents).filter((J)=>UQ.test(J)).sort()}catch{return[]}}function r9($){try{let J=JSON.parse(Z8($,"utf8"));return q8(J)?J:null}catch{return null}}function _Q($,J=U8,Z=Date.now()){let Q;try{Q=Q8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(qQ);if(!Y)continue;let G=D0($.lifecycleEvents,X),H=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-X8(G).mtimeMs>=MQ}catch{continue}if(!K)continue;try{Q$(G,H)}catch(N){let q=N.code;if(q==="EEXIST")h$(G);else if(q!=="ENOENT")throw N}}}function FQ($){let Z=M8($).flatMap((X)=>{try{return[{name:X,size:X8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>$Q||Q>JQ){let X=Z.shift();if(!X)break;try{h$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function v$($,J,Z={}){let Q={schema_version:B8,event_id:Z.eventId?.()??$$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!q8(Q))throw new m$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return g4($.lifecycleEvents),YQ(D0($.lifecycleEvents,TQ(Q)),`${JSON.stringify(Q)}
-`),FQ($),Q}async function T8($,J,Z){_Q($);let Q=0;for(let X of M8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=r9(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${$$()}`;try{Q$(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let H=r9(G);if(!H){h$(G);continue}try{await J(H),h$(G),Q+=1}catch{try{Q$(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function W8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!LQ($.saved))return J;let Z=$.saved,Q=(G,H)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...H?{code:`worker_api_origin_move_${G}:${H}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?X$():$.native;if(!X)return J;let Y=[];try{let G=X.lock(WQ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let q=Y1({path:d(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let H=J0.parse(JSON.parse(s($.configPath)));if(H.stateDirectory!==Z.stateDirectory)return J;let K=L8(H),N={saved:H,configPath:$.configPath};if(!I2(H)&&K.length===0)return Q("unchanged"),N;if(I2(H)){let q=_8(H);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,_8(q.config))}catch(V){Q("failed",`workspace:${F8(V)}`)}return Q("moved"),N}catch(G){return Q("failed",F8(G)),J}finally{for(let G of Y.reverse())G()}}function I2($){return J1($.apiOrigin)!==$.apiOrigin}function L8($){return h0($).filter((J)=>J.config!==null&&I2(J.config))}function LQ($){return I2($)||L8($).length>0}function _8($){let J=J0.parse({...$,apiOrigin:J1($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)m0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function F8($){if($ instanceof X0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as DQ,lstatSync as l4,readdirSync as R8,readlinkSync as jQ,unlinkSync as zQ}from"fs";import{join as O0,sep as OQ}from"path";var P2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function C8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),G=O0(Z,"reason",...X),H=(V,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:V,...U?{code:`worker_state_rehome_${V}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?X$():$.native,N=$.saved,q=[];try{if(N&&j8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:G};if(!u4(K,G,j,q))return J;return D8(N,j,$.host,H)}if(N&&j8(Q)&&N.stateDirectory===G&&S9(N)&&u4(K,G,N,q))return I8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!Y$(Q)?.isDirectory())return J;if(xQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,P2),{version:r});return H("skipped",j),J},M=[Y];for(let j of RQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!AQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!u4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(z8(Z)!==null)return U("conflicting_identity");if(O8(Z)!==null)return U("conflicting_files");if(Y$(G)&&(!Y$(G).isDirectory()||R8(G).length>0))return U("connection_folder_taken");E$(N,T.devicePublicKey),y4.before(N);let _=p0(Y);if(_&&d4(Y))CQ(G,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&d4(Y))P8(G);return U(D.problem??"config_folder_kept")}return D8(N,{...N,stateDirectory:G},$.host,H)}catch(V){try{if(Y$(Y)?.isDirectory())c(O0(Y,P2),{version:r})}catch{}return H("failed",EQ(V)),PQ(N,Y,G,J)}finally{for(let V of q.reverse())V()}}function D8($,J,Z,Q){let X=l4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)DQ(J.stateDirectory,448);let Y=T0(J),G=h1(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new x2("identity_missing");let H=U0(J);if(G.worker.configDigest===U0($))m0({...G,worker:{...G.worker,configDigest:H}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==H)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),y4.after($,J),I8($,J,Z);let K=O0(J.stateDirectory,P2);if(u(K))zQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function I8($,J,Z){if(A8($,J,Z,"connect"),!d4(J.stateDirectory))return;let Q=IQ(j1($.stateDirectory));if(!Q)return;let X=j1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);P8($.stateDirectory)}function u4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Y1({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function AQ($,J,Z){if(u(g(J))){let X=Y1({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=Y$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function RQ($,J){let Z=[$,...R8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=O0(X,Y);if(G===J||!Y$(O0(G,"worker.json")))continue;let H=x8(G);if(!H||H.stateDirectory===$||H.stateDirectory.startsWith($+OQ))Q.push({directory:G,config:H})}return Q}function d4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function CQ($,J){let Z=j1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function P8($){try{j1($).deleteBinding()}catch(J){if(!(J instanceof X0))throw J}}function IQ($){try{return $.loadBinding()}catch(J){if(J instanceof X0)return null;throw J}}function PQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=x8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function j8($){try{return l4($).isSymbolicLink()&&jQ($)==="reason"}catch{return!1}}function xQ($){try{let J=JSON.parse(s(O0($,P2)));return typeof J.version==="string"?J.version:null}catch{return null}}function x8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function Y$($){try{return l4($)}catch{return null}}function EQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof X0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as SQ}from"fs";function S2($){try{let J=JSON.parse(SQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function E8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as MK}from"crypto";import{readdirSync as TK,realpathSync as ZJ,statSync as _K}from"fs";import{hostname as FK}from"os";import{join as n1,resolve as WK}from"path";var w2="cloud",wQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function g$($){return wQ.test($)&&!S8.test($)}var bQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function G$($){return bQ[$]}import{chmodSync as kQ,lstatSync as k2,mkdtempSync as yQ,realpathSync as y8,rmdirSync as fQ,rmSync as hQ,unlinkSync as mQ}from"fs";import{createConnection as vQ,createServer as gQ}from"net";import{basename as w8,dirname as b8,join as B$}from"path";var uQ=B.enum(["status","drain","resume","stop","reload_roots"]),dQ=B.strictObject({version:B.literal(1),instanceId:B.string(),deviceId:B.string(),phase:B.enum(["starting","running","reconnecting","stopping"]),drained:B.boolean(),activeClaims:B.number().int().nonnegative(),activeSessions:B.number().int().nonnegative().optional(),executionEligible:B.boolean(),supportedOperations:B.array(B.enum(b2)).max(b2.length).optional(),capabilityReadiness:B.partialRecord(B.enum(b2),B.boolean()).optional(),lastHeartbeat:B.string().nullable(),expiresAt:B.string()}),lQ=B.strictObject({nonce:B.string(),action:uQ}),pQ=B.object({nonce:B.uuid()}),f8=B.strictObject({version:B.literal(1),nonce:B.uuid(),socketPath:B.string().max(100)});function h8($){return B$(d($).lock,"control.json")}function p4($){return e(d($).lock),pQ.parse(JSON.parse(s(B$(d($).lock,"owner.json"))))}function k8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function cQ($,J){let Z=h8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return k8(Y)?Y:null}let Q=f8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=b8(Q.socketPath);if(b8(X)!==y8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(w8(X))||w8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),k8(Q.socketPath)?Q.socketPath:null}async function y2($,J,Z){if(p4($).nonce!==J)throw Error("worker_instance_changed");let Q=h8($);if(u(Q))throw Error("worker_control_already_serving");let X=yQ(B$(y8("/tmp"),"ara-worker-")),Y=B$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,H=gQ((V)=>{G.add(V),V.once("close",()=>G.delete(V)),V.setTimeout(2000,()=>V.destroy());let U="",M=!1;V.on("error",()=>V.destroy()),V.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){V.destroy();return}if(!U.includes(`
-`))return;M=!0;try{let _=lQ.parse(JSON.parse(U));if(_.nonce!==J){V.destroy();return}V.end(JSON.stringify(Z(_.action))+`
-`)}catch{V.destroy()}})});H.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let V of G)V.destroy();if(await new Promise((V)=>H.close(()=>V())),K&&u(Q)){let V=k2(Q);if(V.isFile()&&V.dev===K.dev&&V.ino===K.ino)try{let U=f8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)mQ(Q)}catch{}}try{fQ(X)}catch{}};try{if(await new Promise((V,U)=>{H.once("error",U),H.listen(Y,()=>{kQ(Y,384),V()})}),p4($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(V){throw await q(),V}}function m8($,J){try{let Z=JSON.parse(s(B$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function u$($){return m8($,"runtime_version")}function sQ($){return m8($,"nonce")}var aQ=21600000,iQ=B.strictObject({instance:B.string().nullable(),since:B.number().int().nonnegative()});function nQ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=iQ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{hQ(d($).updateDeferral,{force:!0})}catch{}}async function f2($,J,Z=()=>!1){let Q=sQ($),X=nQ($,Q);if(J!==void 0){let N=u$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),H=X;if(H===null){H=G;try{c(d($).updateDeferral,{instance:Q,since:H})}catch{}}let K=G-H;return{state:K<aQ?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=d($);if(!u(B$(Z.lock,"owner.json")))return null;let Q=p4($),X=cQ($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let H=vQ(X),K="",N=!1,q=(V,U)=>{if(N)return;if(N=!0,H.destroy(),U)G(U);else Y(V)};H.setTimeout(2000,()=>H.destroy(Error("worker_control_timeout"))),H.on("connect",()=>H.write(JSON.stringify({nonce:Q.nonce,action:J})+`
-`)),H.on("data",(V)=>{if(K+=V.toString(),Buffer.byteLength(K)>16384)H.destroy(Error("worker_control_oversize"))}),H.on("error",(V)=>{if("code"in V&&["ECONNREFUSED","ENOENT"].includes(String(V.code)))q(null);else q(null,Error("worker_control_unavailable"))}),H.on("end",()=>{try{let V=dQ.parse(JSON.parse(K));if(V.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(V)}catch{q(null,Error("worker_control_invalid_response"))}}),H.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as tG}from"crypto";import{homedir as X7}from"os";import{spawn as rQ}from"child_process";async function v8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),H=(V)=>{if(Q===V)return;Q=V,J.onStatusChange?.(V)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let V=(J.spawn??rQ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=V,V.once("exit",()=>{if(!X&&Z===V)H("failed"),K()}),await new Promise((U,M)=>{V.once("spawn",U),V.once("error",M)}),V.exitCode===null&&V.signalCode===null)H("held")}catch{H("failed"),K()}};G=N(),await G;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await G;let V=Z;if(!V||V.exitCode!==null||V.signalCode!==null||!V.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{V.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);V.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{V.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class h2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as JX}from"fs";import{constants as s4}from"fs";import{open as tQ}from"fs/promises";import{join as oQ}from"path";var eQ={platform:process.platform,home:V0,async openFile($){let J=await tQ($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function g8($=eQ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(oQ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function $X($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((H,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function u8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await $X($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?d$(X.status):l$(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var ZX=1000,QX=250,XX=Q5(JX(process.execPath)),d8=null,l8=null;function X5($){if(process.platform!=="darwin")return{};return l8??=g8().then((J)=>{d8={status:J,checkedAt:$().getTime()}}).finally(()=>{l8=null}),{fullDiskAccess:{...d8??{status:"unknown",checkedAt:$().getTime()},executablePath:XX}}}var p8=8,YX=2000,GX=2000,G3=8000,c8=3,BX=250,s8=1000,a8=30000,KX=0.2,VX=30000,HX=21600000,NX=300000,UX=3600000,qX=0.1,Y5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function MX($){return Math.min(c8,Math.max(1,$??c8))}function TX($){return typeof $.reason_code==="string"&&Y5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof v0&&($.reason.code==="cancelled"||Y5.has($.reason.code))?$.reason.code:"cancelled"}function i8($){return $ instanceof v0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function G5($){return $.capability==="hands.connect"&&($5($.payload)||e8($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*qX)))}function _X($,J=Math.random){let Z=Math.min(a8,s8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*KX*(Q*2-1);return Math.min(a8,Math.max(s8,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function FX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function o0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function WX($){if($ instanceof v2||$ instanceof K$||$ instanceof c$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function p$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(o0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:WX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)p$($,J,Q);throw Q}}class c$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,H=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,V,U=new Promise((_,D)=>{let j=()=>{let F=new c$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(V=()=>z(Math.max(0,Math.min(N-performance.now(),YX))),z(K),$.signal.addEventListener("abort",V,{once:!0}),$.signal.aborted)V()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),U]);break}catch(_){if(G.aborted||$.signal.aborted||E0(_)||o0(_)||!LX(_)||performance.now()>=N)throw p$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw p$($,"completion",_),_;try{await H(D,G)}catch{throw p$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",V),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function LX($){if(E0($))return!1;if(o0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof c$)return!1;return!0}return!1}class v2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function m2($){if($ instanceof v2)return!0;return $ instanceof _0?d$($.status):l$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function DX($,J,Z,Q,X){let Y=new AbortController,G,H=()=>{return},K=new Promise((q,V)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),V(M)};if(H=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,V)=>{G=setTimeout(()=>{let U=new v2;Y.abort(U),V(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);H()}}async function n8($,J,Z,Q,X,Y){let G=MX($.operationHeartbeatMaxAttempts),H=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??BX,N=Y.remainingMs(),q=Math.min(N,G*H+K*G*(G-1)/2);for(let V=0;V<G;V+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(H,Y.remainingMs()),M=await DX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:V},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||V+1>=G||o0(U)||E0(U)||!m2(U)){if(!Q.aborted)p$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(V+1),q*(V+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function jX($,J,Z,Q,X){let Y=G5(J),G=new AbortController,H=new AbortController,K=()=>{G.abort($.signal.reason),H.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,V,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,C={},P=(w)=>{j=!0,D.abort(w),G.abort(w),H.abort(w)},R=(w)=>{if(z)return z;let h=structuredClone(w),l=M;return z=(async()=>{let k=new AbortController,x=k.signal;x.throwIfAborted();let S,A=()=>{},f=new Promise((b,n)=>{if(A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0}),S=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),x.aborted)A()});try{for(let b=0;b<3;b+=1){x.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[h],signal:x,transientRetryOwner:"caller"})),f]);if(x.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(E0(n))X(n);let o=n instanceof _0?d$(n.status):l$(n);if(x.aborted||!o||b===2)throw n;let N0=Math.max(500*2**b,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,x),f])}}}finally{clearTimeout(S),x.removeEventListener("abort",A),k.abort()}})(),z},I=(w,h,l)=>{let k=(S)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:h,events:w,signal:S,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&o0(A))P(A);if(l&&(E0(A)||o0(A))){if(E0(A))X(A);G.abort(A),H.abort(A),D.abort(A)}throw A});if(!l)return async(S)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(S)).next_event_seq;return}S.throwIfAborted();let A=()=>{},f=new Promise((b,n)=>{A=()=>n(S.reason),S.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([k(S),f]);S.throwIfAborted(),M=b.next_event_seq}finally{S.removeEventListener("abort",A)}};let x=u8({send:k,lease:L,sleep:Z,retryAfterMs:(S)=>J3(S,($.now?.()??new Date).getTime())});return async(S)=>{let A=await x(S);if(A.next_event_seq!==h+w.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},E=async(w,h)=>{let l=w??await n8($,J,{controlAckSeq:U,waitMs:h},H.signal,Z,L),k=null,x=!1;for(let S=0;S<10;S+=1){let A=U+1;for(let f of l.controls){if(f.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(f.kind==="cancel"||f.kind==="operation.cancel")k??=TX(f.payload),G.abort(new v0(k,"Reason closed the Device operation."));if(f.kind!=="cancel"&&f.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,o=new Promise((N0,j0)=>{b=N0,n=j0});o.catch(()=>{}),C.current={promise:o,resolve:b,reject:n}}try{x||=!await $.onControl?.(J,f)}catch(b){if(b instanceof v0)q??=i8(b);throw C.current?.reject(b),b}}U=f.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:x}}try{l=await n8($,J,{controlAckSeq:U},H.signal,Z,L),C.current?.resolve()}catch(f){if(C.current?.reject(f),!k||o0(f)||E0(f))throw f;return{cancellationReason:k,unsupported:x}}}throw Error("Reason returned too many Device operation control batches.")};try{let w;try{if(!Y)L=new h2(J.lease_until,()=>($.now?.()??new Date).getTime(),(h)=>{if(!G.signal.aborted)N=h;G.abort(h),H.abort(h)});w=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await E()}catch(h){if(!e4(J)||o0(h)||E0(h))throw h;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(w.cancellationReason||$.signal.aborted){let h=w.cancellationReason??i4($.signal);G.abort(new v0(h,"Reason closed the Device operation.")),V={status:"cancelled",error_code:h}}else if(w.unsupported)G.abort(),V={status:"failed",error_code:"control_unsupported"};else{let h=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?GX:15000),x=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),S=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!H.signal.aborted)try{if(!S){if(await Z(k,H.signal),H.signal.aborted)return}let A=await E(void 0,S?x:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new v0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(E0(A))X(A);if(o0(A))N=A,P(A);if(!H.signal.aborted)N=A,G.abort();return}})();try{if(L?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(L?.remainingMs()??0)>0),V=await $.onClaim(J,G.signal,async(k)=>{if(e4(J))return;let x=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",S=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=S||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,D.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,f={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:S?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:f,settle:(j0)=>j0===void 0?o():N0(j0)})});let b=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(x)await R(f);return}if(F!==null){if(k.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),P1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await I([f],M,!0)(j0),F=null}catch(F1){throw F=F1??Error("Hands stop receipt could not be confirmed."),F1}finally{clearTimeout(P1),N0.abort()}return}if(S&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new h2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{G.abort(j0),H.abort(j0)})}let o=M;if(S)W=I([...b.map((N0)=>N0.wireEvent),f],o,!0),await W(A),W=void 0;else await I([...b.map((N0)=>N0.wireEvent),f],o,!1)(A)});n.then(()=>{for(let o of b)o.settle()},(o)=>{for(let N0 of b)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(E0(o))X(o);if(S){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),H.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await C.current?.promise}catch(k){V=G.signal.aborted?{status:"cancelled",error_code:i4(G.signal)}:{status:"failed",error_code:i8(k)}}finally{Q.authorized=()=>!1,D.abort();for(let k of _.splice(0))k.settle();H.abort(),await h}let l=t8(J.capability)?o8(V.result,J.operation_id):null;if(N){if(E0(N))throw N;V={status:"failed",error_code:q??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&V.status==="succeeded")V={status:"cancelled",error_code:i4(G.signal),...l?{result:l}:{}}}if(L?.close(),E0($.signal.reason))throw $.signal.reason;await $3($,J,V)}finally{L?.close(),D.abort(),H.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??k$,Y=$.statusPath??Q3(),G=J().toISOString(),H=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...X5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...H?{lastUsedAt:H}:{}}),q=0,V,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),Z5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??v8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await zX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;H=F.lastUsedAt??H,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,V=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(E0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=_X(q,$.reconnectRandom);V??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:V},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function zX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??k$,G=J().toISOString(),H=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let V=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(p8,U):p8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,Y0=0;for(let{claim:L1}of z.values()){let i0=L1.capability==="hands.connect"?L1.payload[r8]:void 0;if(typeof i0==="string"){if(v.has(i0))continue;v.add(i0)}Y0+=1}return Y0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),C=K?new Date(G).getTime()+n4(K.initialDelayMs??VX,V):Number.POSITIVE_INFINITY,P=null,R=!1,I=$.firstHeartbeat,E=I?.account_root_metadata_supported===!0,w=I?.workspace_root_metadata_supported===!0,h=I?.account_root_path_supported===!0,l=I?.home_contained_roots_supported===!0,k=I?.root_paths_supported===!0,x=I?.startup_supported===!0,S=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,f,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...X5(J),...H?{lastUsedAt:H}:{},...P?{organizationId:P.organization_id,organizationName:P.organization_name,organizationSlug:P.organization_slug}:{}}),o=()=>{let v=$.claimable?.()!==!1;if(!b)f??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...x&&!b&&f?{startup:f}:{},capabilities:v?J5($.capabilities,{accountRootMetadataSupported:E,workspaceRootMetadataSupported:w,accountRootPathSupported:h,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},N0=()=>{if(R||!$.client.identity)return;R=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;P=v;let Y0=Y(Q);if(!Y0)return;X({...Y0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{E=v.account_root_metadata_supported===!0,w=v.workspace_root_metadata_supported===!0,h=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,x=v.startup_supported===!0,S=!1},P1=(v)=>{if(v.startup)b=!0},F1=(v,Y0)=>{if(!(Y0 instanceof _0&&Y0.status===400&&Y0.code==="invalid_heartbeat")||!v.startup&&!S)throw Y0;if(b=!0,S)E=w=h=!1,l=k=x=S=!1;return null},r1=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},x1=!1,E1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(x1)E1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((Y0)=>F1(v,Y0))).then((Y0)=>{if(!Y0)return;P1(v),j0(Y0),r1(Y0)},()=>{return})});let a0=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let S1=!1,O$=$.maxConsecutiveHeartbeatFailures??3,W1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,Y0=o(),L1=A;A=void 0,x1=!0,E1=!1;try{let a=await V$($,"heartbeat",()=>$.client.heartbeat($.state,Y0,N.signal,...L1?[L1]:[]).catch((M0)=>F1(Y0,M0)));if(x1=!1,!a)continue;v=a,P1(Y0),W1=0}catch(a){if(x1=!1,$.signal.aborted)break;if(!m2(a))throw a;if(W1+=1,W1>=O$&&!W())throw a;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(Y0.capabilities).length)continue;if(E1)continue;if(r1(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))C=Math.min(C,J().getTime());if(K&&J().getTime()>=C)try{let a=new AbortController,M0=()=>a.abort($.signal.reason);if($.signal.aborted)M0();else $.signal.addEventListener("abort",M0,{once:!0});let l0;try{l0=K.check(a.signal)}catch(R0){l0=Promise.reject(R0)}let w1=l0.then((R0)=>({kind:"completed",result:R0}),(R0)=>({kind:"failed",error:R0})),t1;try{while(!0){let R0=await FX(w1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(R0.kind==="failed")throw new r4(R0.error);if(R0.kind==="completed"){t1=R0.result;break}try{let S0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,S0,N.signal).catch((V2)=>F1(S0,V2)));if(!R$)continue;v=R$,P1(S0),r1(v),W1=0}catch(S0){if($.signal.aborted)throw S0;if(!m2(S0))throw S0;if(W1+=1,W1>=O$&&!W())throw S0}}}catch(R0){a.abort(R0);let S0=await w1;if(S0.kind==="completed"&&S0.result==="activated")t1="activated";else throw R0}finally{$.signal.removeEventListener("abort",M0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,t1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}C=J().getTime()+n4(K.intervalMs??HX,V)}catch(a){if(!(a instanceof r4))throw a;T+=1;let M0=K.retryBaseMs??NX,l0=K.retryMaxMs??UX,w1=Math.min(l0,M0*2**Math.min(T-1,8));C=J().getTime()+n4(w1,V)}if($.signal.aborted)break;if(_&&L())break;if(_){await a0($.heartbeatIntervalMs??15000);continue}let i0=$.client.sessionCadence?.($.state)??null,A$=i0?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await a0(A$);continue}if(F()>=M){let a=new AbortController;O=a;try{await Z(A$,AbortSignal.any([$.signal,a.signal]))}catch(M0){if(!a.signal.aborted)throw M0}finally{if(O===a)O=null}continue}let g0,y=i0?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),i=performance.now();try{g0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:y,signal:N.signal}))}catch(a){if($.signal.aborted||!m2(a)||!W())throw a;await a0(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!g0){if(performance.now()-i<y-QX)await a0(ZX);continue}if($.claimable?.()===!1){await $3($,g0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}H=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:g0.operation_id,runId:g0.run_id,attemptId:g0.attempt_id,capability:g0.capability});let B0,I0={authorized:()=>!1,claim:g0};if(B0=jX({...$,signal:N.signal},g0,Z,I0,j).catch((a)=>{if(E0(a))j(a);else if(!o0(a)&&[...z].some(([M0,l0])=>M0!==B0&&l0.authorized())){if(a instanceof c$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!o0(a)&&D===null)D=a}).finally(()=>{z.delete(B0),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(B0,I0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),G5(g0)){if(await B0,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),S1=!0;let Y0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:Y0},Q),$.onEvent?.({type:"error",message:Y0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!S1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as eX}from"child_process";import{constants as w5,existsSync as $Y,mkdtempSync as l5,rmSync as JY}from"fs";import{access as b5,open as ZY,readFile as k5,readlink as QY,readdir as y5,unlink as XY,rmdir as YY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as g1}from"crypto";import{chmodSync as OX,closeSync as AX,fsyncSync as RX,openSync as CX,readFileSync as IX,rmdirSync as B5,unlinkSync as H5,writeFileSync as PX}from"fs";import{createConnection as xX,createServer as EX}from"net";import{dirname as SX,join as wX}from"path";var bX=5000;async function N5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:g1()},X={runId:g1(),deviceId:g1(),rootId:g1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=V5(J,X),G={version:1,snapshot_id:g1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{H5(Y.path)}catch{}}}async function U5($,J,Z=K5){if(J.aborted)return!1;let Q,X,Y=new Set,G=g1(),H=EX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(G)});H.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),V=setTimeout(N,bX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${g1()}`}),X=wX(Q.journalDirectory,"readiness.json");let U=CX(X,"wx",384);try{PX(U,G),RX(U)}finally{AX(U)}if(IX(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{H.once("error",()=>T(!1)),H.listen(Q.socketPath,()=>{try{OX(Q.socketPath,384)}catch{T(!1);return}K=xX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(V),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>H.close(()=>U())),Q?.disposeSocket(),X)try{H5(X)}catch{}if(Q){try{B5(Q.journalDirectory)}catch{}try{B5(SX(Q.journalDirectory))}catch{}}}}import{spawn as kX}from"child_process";import{randomUUID as u1}from"crypto";import{basename as yX}from"path";import{fileURLToPath as fX}from"url";function hX(){let $=yX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",fX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function T5($,J,Z=hX()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=kX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),H=!1,K=new Promise((F)=>G.once("close",()=>{H=!0,F()}));G.on("error",X);let N,q,V=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
+`)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(U1(J),!0),c(f4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(H)K=!0;else H=O().finally(()=>{H=null});return H},claims:()=>[...G.values()].reduce((W,L)=>W+L.claims,0),async settled(){await H,await Promise.all([...G.values()].map((W)=>W.done))}}}import{dirname as DQ}from"path";import{randomUUID as $$}from"crypto";import{chmodSync as o9,closeSync as J$,constants as Z$,existsSync as eZ,fstatSync as e9,lstatSync as $8,mkdirSync as J8,openSync as Z8,readFileSync as Q8,readdirSync as X8,readlinkSync as WN,realpathSync as LN,renameSync as Q$,rmSync as h4,statSync as Y8,symlinkSync as DN,unlinkSync as m$,writeFileSync as m4}from"fs";import{basename as zN,dirname as G8,isAbsolute as $Q,join as D0,relative as ON,resolve as AN,sep as RN}from"path";import{createRequire as JQ}from"module";var B8=1,K8=1,ZQ=128,QQ=65536;var XQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var n9=/^[a-z0-9_.-]{1,80}$/,YQ=64;var GQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function V8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function H8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&XQ.test($)}function N8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function g4($){J8($,{recursive:!0,mode:448}),o9($,448)}function BQ($,J){g4(G8($));let Z=`${$}.${process.pid}.${$$()}.tmp`;try{m4(Z,J,{mode:384,flag:"wx"}),o9(Z,384),Q$(Z,$)}finally{if(eZ(Z))m$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new v$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=b0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?b0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&$Q(X))?null:D0($.home??V0(),"Library","Application Support"),H=$.root??(G?D0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:H,...G?{legacyRoot:D0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(H,"versions"),current:D0(H,"current"),previous:D0(H,"previous"),brokerLock:D0(H,"broker.lock"),transitionLock:D0(H,"transition.lock"),lifecycleEvents:D0(H,"lifecycle-events")}}function KQ($){return V8($)&&H8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===B8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&N8($.started_at)&&R2($.runtime_version)}function U8($,J){try{let Z=$8($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=Z8(D0($,J),Z$.O_RDONLY|Z$.O_NOFOLLOW|Z$.O_NONBLOCK);try{let X=e9(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return Q8(Q,"utf8")}finally{J$(Q)}}catch{return null}}function v4($){try{let J=JSON.parse(U8($,"owner.json")??"null");return KQ(J)?J:null}catch{return null}}function q8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var r9="lease",VQ=2,HQ=4,h$;function NQ(){if(h$!==void 0)return h$;if(h$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=JQ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return h$={flock:(G,H)=>X.symbols.flock(G,H),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},h$}catch{}return null}function UQ($){let J=NQ();if(!J)return null;let Z=Z8(`${$}.lease`,Z$.O_RDWR|Z$.O_CREAT|Z$.O_NOFOLLOW,384);try{let Q=e9(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return J$(Z),"busy";if(J.flock(Z,VQ|HQ)===0)return Z;let X=J.errno();return J$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw J$(Z),Q}}function Y1($){g4(G8($.path));let J=UQ($.path);if(J==="busy")return{acquired:!1,owner:v4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=qQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)J$(J)}}function qQ($,J){let Z=$.alive??q8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:B8,pid:$.pid??process.pid,nonce:$.nonce?.()??$$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${$$()}`,H=!1;try{if(J8(G,{mode:448}),m4(D0(G,"owner.json"),`${JSON.stringify(Y)}
+`,{mode:384,flag:"wx"}),J!==null)m4(D0(G,r9),`flock
+`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw $8($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}Q$(G,$.path),H=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,v4($.path)?.nonce===Y.nonce)h4($.path,{recursive:!0,force:!0});if(J!==null)J$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=v4($.path),V=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?V-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&U8($.path,r9)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${$$()}`;try{Q$($.path,T),h4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!H)h4(G,{recursive:!0,force:!0})}}throw new v$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function M8($){return V8($)&&H8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===K8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&N8($.occurred_at)&&typeof $.event==="string"&&GQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&n9.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=YQ&&$.capabilities.every((J)=>typeof J==="string"&&n9.test(J)))}var MQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,TQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,_Q=300000,A2=0n;function FQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function T8($){try{return X8($.lifecycleEvents).filter((J)=>MQ.test(J)).sort()}catch{return[]}}function t9($){try{let J=JSON.parse(Q8($,"utf8"));return M8(J)?J:null}catch{return null}}function WQ($,J=q8,Z=Date.now()){let Q;try{Q=X8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(TQ);if(!Y)continue;let G=D0($.lifecycleEvents,X),H=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-Y8(G).mtimeMs>=_Q}catch{continue}if(!K)continue;try{Q$(G,H)}catch(N){let q=N.code;if(q==="EEXIST")m$(G);else if(q!=="ENOENT")throw N}}}function LQ($){let Z=T8($).flatMap((X)=>{try{return[{name:X,size:Y8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>ZQ||Q>QQ){let X=Z.shift();if(!X)break;try{m$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function g$($,J,Z={}){let Q={schema_version:K8,event_id:Z.eventId?.()??$$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!M8(Q))throw new v$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return g4($.lifecycleEvents),BQ(D0($.lifecycleEvents,FQ(Q)),`${JSON.stringify(Q)}
+`),LQ($),Q}async function _8($,J,Z){WQ($);let Q=0;for(let X of T8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=t9(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${$$()}`;try{Q$(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let H=t9(G);if(!H){m$(G);continue}try{await J(H),m$(G),Q+=1}catch{try{Q$(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function L8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!jQ($.saved))return J;let Z=$.saved,Q=(G,H)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...H?{code:`worker_api_origin_move_${G}:${H}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?X$():$.native;if(!X)return J;let Y=[];try{let G=X.lock(DQ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let q=Y1({path:d(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let H=J0.parse(JSON.parse(s($.configPath)));if(H.stateDirectory!==Z.stateDirectory)return J;let K=D8(H),N={saved:H,configPath:$.configPath};if(!I2(H)&&K.length===0)return Q("unchanged"),N;if(I2(H)){let q=F8(H);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,F8(q.config))}catch(V){Q("failed",`workspace:${W8(V)}`)}return Q("moved"),N}catch(G){return Q("failed",W8(G)),J}finally{for(let G of Y.reverse())G()}}function I2($){return J1($.apiOrigin)!==$.apiOrigin}function D8($){return h0($).filter((J)=>J.config!==null&&I2(J.config))}function jQ($){return I2($)||D8($).length>0}function F8($){let J=J0.parse({...$,apiOrigin:J1($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)m0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function W8($){if($ instanceof X0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as zQ,lstatSync as l4,readdirSync as C8,readlinkSync as OQ,unlinkSync as AQ}from"fs";import{join as O0,sep as RQ}from"path";var P2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function I8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),G=O0(Z,"reason",...X),H=(V,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:V,...U?{code:`worker_state_rehome_${V}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?X$():$.native,N=$.saved,q=[];try{if(N&&z8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:G};if(!u4(K,G,j,q))return J;return j8(N,j,$.host,H)}if(N&&z8(Q)&&N.stateDirectory===G&&w9(N)&&u4(K,G,N,q))return P8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!Y$(Q)?.isDirectory())return J;if(SQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,P2),{version:r});return H("skipped",j),J},M=[Y];for(let j of IQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!CQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!u4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(O8(Z)!==null)return U("conflicting_identity");if(A8(Z)!==null)return U("conflicting_files");if(Y$(G)&&(!Y$(G).isDirectory()||C8(G).length>0))return U("connection_folder_taken");S$(N,T.devicePublicKey),y4.before(N);let _=p0(Y);if(_&&d4(Y))PQ(G,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&d4(Y))x8(G);return U(D.problem??"config_folder_kept")}return j8(N,{...N,stateDirectory:G},$.host,H)}catch(V){try{if(Y$(Y)?.isDirectory())c(O0(Y,P2),{version:r})}catch{}return H("failed",wQ(V)),EQ(N,Y,G,J)}finally{for(let V of q.reverse())V()}}function j8($,J,Z,Q){let X=l4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)zQ(J.stateDirectory,448);let Y=T0(J),G=h1(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new x2("identity_missing");let H=U0(J);if(G.worker.configDigest===U0($))m0({...G,worker:{...G.worker,configDigest:H}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==H)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),y4.after($,J),P8($,J,Z);let K=O0(J.stateDirectory,P2);if(u(K))AQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function P8($,J,Z){if(R8($,J,Z,"connect"),!d4(J.stateDirectory))return;let Q=xQ(j1($.stateDirectory));if(!Q)return;let X=j1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);x8($.stateDirectory)}function u4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Y1({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function CQ($,J,Z){if(u(g(J))){let X=Y1({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=Y$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function IQ($,J){let Z=[$,...C8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=O0(X,Y);if(G===J||!Y$(O0(G,"worker.json")))continue;let H=E8(G);if(!H||H.stateDirectory===$||H.stateDirectory.startsWith($+RQ))Q.push({directory:G,config:H})}return Q}function d4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function PQ($,J){let Z=j1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function x8($){try{j1($).deleteBinding()}catch(J){if(!(J instanceof X0))throw J}}function xQ($){try{return $.loadBinding()}catch(J){if(J instanceof X0)return null;throw J}}function EQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=E8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function z8($){try{return l4($).isSymbolicLink()&&OQ($)==="reason"}catch{return!1}}function SQ($){try{let J=JSON.parse(s(O0($,P2)));return typeof J.version==="string"?J.version:null}catch{return null}}function E8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function Y$($){try{return l4($)}catch{return null}}function wQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof X0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as bQ}from"fs";function S2($){try{let J=JSON.parse(bQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function S8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as _K}from"crypto";import{readdirSync as FK,realpathSync as QJ,statSync as WK}from"fs";import{hostname as LK}from"os";import{join as n1,resolve as DK}from"path";var w2="cloud",kQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function u$($){return kQ.test($)&&!w8.test($)}var yQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function G$($){return yQ[$]}import{chmodSync as fQ,lstatSync as k2,mkdtempSync as hQ,realpathSync as f8,rmdirSync as mQ,rmSync as vQ,unlinkSync as gQ}from"fs";import{createConnection as uQ,createServer as dQ}from"net";import{basename as b8,dirname as k8,join as B$}from"path";var lQ=B.enum(["status","drain","resume","stop","reload_roots"]),pQ=B.strictObject({version:B.literal(1),instanceId:B.string(),deviceId:B.string(),phase:B.enum(["starting","running","reconnecting","stopping"]),drained:B.boolean(),activeClaims:B.number().int().nonnegative(),activeSessions:B.number().int().nonnegative().optional(),executionEligible:B.boolean(),supportedOperations:B.array(B.enum(b2)).max(b2.length).optional(),capabilityReadiness:B.partialRecord(B.enum(b2),B.boolean()).optional(),lastHeartbeat:B.string().nullable(),expiresAt:B.string()}),cQ=B.strictObject({nonce:B.string(),action:lQ}),sQ=B.object({nonce:B.uuid()}),h8=B.strictObject({version:B.literal(1),nonce:B.uuid(),socketPath:B.string().max(100)});function m8($){return B$(d($).lock,"control.json")}function p4($){return e(d($).lock),sQ.parse(JSON.parse(s(B$(d($).lock,"owner.json"))))}function y8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function aQ($,J){let Z=m8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return y8(Y)?Y:null}let Q=h8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=k8(Q.socketPath);if(k8(X)!==f8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(b8(X))||b8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),y8(Q.socketPath)?Q.socketPath:null}async function y2($,J,Z){if(p4($).nonce!==J)throw Error("worker_instance_changed");let Q=m8($);if(u(Q))throw Error("worker_control_already_serving");let X=hQ(B$(f8("/tmp"),"ara-worker-")),Y=B$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,H=dQ((V)=>{G.add(V),V.once("close",()=>G.delete(V)),V.setTimeout(2000,()=>V.destroy());let U="",M=!1;V.on("error",()=>V.destroy()),V.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){V.destroy();return}if(!U.includes(`
+`))return;M=!0;try{let _=cQ.parse(JSON.parse(U));if(_.nonce!==J){V.destroy();return}V.end(JSON.stringify(Z(_.action))+`
+`)}catch{V.destroy()}})});H.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let V of G)V.destroy();if(await new Promise((V)=>H.close(()=>V())),K&&u(Q)){let V=k2(Q);if(V.isFile()&&V.dev===K.dev&&V.ino===K.ino)try{let U=h8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)gQ(Q)}catch{}}try{mQ(X)}catch{}};try{if(await new Promise((V,U)=>{H.once("error",U),H.listen(Y,()=>{fQ(Y,384),V()})}),p4($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(V){throw await q(),V}}function v8($,J){try{let Z=JSON.parse(s(B$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function d$($){return v8($,"runtime_version")}function iQ($){return v8($,"nonce")}var nQ=21600000,rQ=B.strictObject({instance:B.string().nullable(),since:B.number().int().nonnegative()});function tQ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=rQ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{vQ(d($).updateDeferral,{force:!0})}catch{}}async function f2($,J,Z=()=>!1){let Q=iQ($),X=tQ($,Q);if(J!==void 0){let N=d$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),H=X;if(H===null){H=G;try{c(d($).updateDeferral,{instance:Q,since:H})}catch{}}let K=G-H;return{state:K<nQ?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=d($);if(!u(B$(Z.lock,"owner.json")))return null;let Q=p4($),X=aQ($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let H=uQ(X),K="",N=!1,q=(V,U)=>{if(N)return;if(N=!0,H.destroy(),U)G(U);else Y(V)};H.setTimeout(2000,()=>H.destroy(Error("worker_control_timeout"))),H.on("connect",()=>H.write(JSON.stringify({nonce:Q.nonce,action:J})+`
+`)),H.on("data",(V)=>{if(K+=V.toString(),Buffer.byteLength(K)>16384)H.destroy(Error("worker_control_oversize"))}),H.on("error",(V)=>{if("code"in V&&["ECONNREFUSED","ENOENT"].includes(String(V.code)))q(null);else q(null,Error("worker_control_unavailable"))}),H.on("end",()=>{try{let V=pQ.parse(JSON.parse(K));if(V.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(V)}catch{q(null,Error("worker_control_invalid_response"))}}),H.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as eG}from"crypto";import{homedir as Y7}from"os";import{spawn as oQ}from"child_process";async function g8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),H=(V)=>{if(Q===V)return;Q=V,J.onStatusChange?.(V)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let V=(J.spawn??oQ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=V,V.once("exit",()=>{if(!X&&Z===V)H("failed"),K()}),await new Promise((U,M)=>{V.once("spawn",U),V.once("error",M)}),V.exitCode===null&&V.signalCode===null)H("held")}catch{H("failed"),K()}};G=N(),await G;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await G;let V=Z;if(!V||V.exitCode!==null||V.signalCode!==null||!V.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{V.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);V.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{V.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class h2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as QX}from"fs";import{constants as s4}from"fs";import{open as eQ}from"fs/promises";import{join as $X}from"path";var JX={platform:process.platform,home:V0,async openFile($){let J=await eQ($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function u8($=JX){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile($X($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function ZX($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((H,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function d8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await ZX($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?l$(X.status):p$(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var XX=1000,YX=250,GX=X5(QX(process.execPath)),l8=null,p8=null;function Y5($){if(process.platform!=="darwin")return{};return p8??=u8().then((J)=>{l8={status:J,checkedAt:$().getTime()}}).finally(()=>{p8=null}),{fullDiskAccess:{...l8??{status:"unknown",checkedAt:$().getTime()},executablePath:GX}}}var c8=8,BX=2000,KX=2000,G3=8000,s8=3,VX=250,a8=1000,i8=30000,HX=0.2,NX=30000,UX=21600000,qX=300000,MX=3600000,TX=0.1,G5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function _X($){return Math.min(s8,Math.max(1,$??s8))}function FX($){return typeof $.reason_code==="string"&&G5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof v0&&($.reason.code==="cancelled"||G5.has($.reason.code))?$.reason.code:"cancelled"}function n8($){return $ instanceof v0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function B5($){return $.capability==="hands.connect"&&(J5($.payload)||$5($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*TX)))}function WX($,J=Math.random){let Z=Math.min(i8,a8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*HX*(Q*2-1);return Math.min(i8,Math.max(a8,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function LX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function o0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function DX($){if($ instanceof v2||$ instanceof K$||$ instanceof s$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function c$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(o0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:DX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)c$($,J,Q);throw Q}}class s$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,H=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,V,U=new Promise((_,D)=>{let j=()=>{let F=new s$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(V=()=>z(Math.max(0,Math.min(N-performance.now(),BX))),z(K),$.signal.addEventListener("abort",V,{once:!0}),$.signal.aborted)V()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),U]);break}catch(_){if(G.aborted||$.signal.aborted||E0(_)||o0(_)||!jX(_)||performance.now()>=N)throw c$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw c$($,"completion",_),_;try{await H(D,G)}catch{throw c$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",V),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function jX($){if(E0($))return!1;if(o0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof s$)return!1;return!0}return!1}class v2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function m2($){if($ instanceof v2)return!0;return $ instanceof _0?l$($.status):p$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function zX($,J,Z,Q,X){let Y=new AbortController,G,H=()=>{return},K=new Promise((q,V)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),V(M)};if(H=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,V)=>{G=setTimeout(()=>{let U=new v2;Y.abort(U),V(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);H()}}async function r8($,J,Z,Q,X,Y){let G=_X($.operationHeartbeatMaxAttempts),H=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??VX,N=Y.remainingMs(),q=Math.min(N,G*H+K*G*(G-1)/2);for(let V=0;V<G;V+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(H,Y.remainingMs()),M=await zX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:V},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||V+1>=G||o0(U)||E0(U)||!m2(U)){if(!Q.aborted)c$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(V+1),q*(V+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function OX($,J,Z,Q,X){let Y=B5(J),G=new AbortController,H=new AbortController,K=()=>{G.abort($.signal.reason),H.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,V,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,C={},P=(w)=>{j=!0,D.abort(w),G.abort(w),H.abort(w)},R=(w)=>{if(z)return z;let h=structuredClone(w),l=M;return z=(async()=>{let k=new AbortController,x=k.signal;x.throwIfAborted();let S,A=()=>{},f=new Promise((b,n)=>{if(A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0}),S=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),x.aborted)A()});try{for(let b=0;b<3;b+=1){x.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[h],signal:x,transientRetryOwner:"caller"})),f]);if(x.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(E0(n))X(n);let o=n instanceof _0?l$(n.status):p$(n);if(x.aborted||!o||b===2)throw n;let N0=Math.max(500*2**b,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,x),f])}}}finally{clearTimeout(S),x.removeEventListener("abort",A),k.abort()}})(),z},I=(w,h,l)=>{let k=(S)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:h,events:w,signal:S,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&o0(A))P(A);if(l&&(E0(A)||o0(A))){if(E0(A))X(A);G.abort(A),H.abort(A),D.abort(A)}throw A});if(!l)return async(S)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(S)).next_event_seq;return}S.throwIfAborted();let A=()=>{},f=new Promise((b,n)=>{A=()=>n(S.reason),S.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([k(S),f]);S.throwIfAborted(),M=b.next_event_seq}finally{S.removeEventListener("abort",A)}};let x=d8({send:k,lease:L,sleep:Z,retryAfterMs:(S)=>J3(S,($.now?.()??new Date).getTime())});return async(S)=>{let A=await x(S);if(A.next_event_seq!==h+w.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},E=async(w,h)=>{let l=w??await r8($,J,{controlAckSeq:U,waitMs:h},H.signal,Z,L),k=null,x=!1;for(let S=0;S<10;S+=1){let A=U+1;for(let f of l.controls){if(f.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(f.kind==="cancel"||f.kind==="operation.cancel")k??=FX(f.payload),G.abort(new v0(k,"Reason closed the Device operation."));if(f.kind!=="cancel"&&f.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,o=new Promise((N0,j0)=>{b=N0,n=j0});o.catch(()=>{}),C.current={promise:o,resolve:b,reject:n}}try{x||=!await $.onControl?.(J,f)}catch(b){if(b instanceof v0)q??=n8(b);throw C.current?.reject(b),b}}U=f.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:x}}try{l=await r8($,J,{controlAckSeq:U},H.signal,Z,L),C.current?.resolve()}catch(f){if(C.current?.reject(f),!k||o0(f)||E0(f))throw f;return{cancellationReason:k,unsupported:x}}}throw Error("Reason returned too many Device operation control batches.")};try{let w;try{if(!Y)L=new h2(J.lease_until,()=>($.now?.()??new Date).getTime(),(h)=>{if(!G.signal.aborted)N=h;G.abort(h),H.abort(h)});w=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await E()}catch(h){if(!e4(J)||o0(h)||E0(h))throw h;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(w.cancellationReason||$.signal.aborted){let h=w.cancellationReason??i4($.signal);G.abort(new v0(h,"Reason closed the Device operation.")),V={status:"cancelled",error_code:h}}else if(w.unsupported)G.abort(),V={status:"failed",error_code:"control_unsupported"};else{let h=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?KX:15000),x=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),S=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!H.signal.aborted)try{if(!S){if(await Z(k,H.signal),H.signal.aborted)return}let A=await E(void 0,S?x:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new v0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(E0(A))X(A);if(o0(A))N=A,P(A);if(!H.signal.aborted)N=A,G.abort();return}})();try{if(L?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(L?.remainingMs()??0)>0),V=await $.onClaim(J,G.signal,async(k)=>{if(e4(J))return;let x=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",S=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=S||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,D.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,f={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:S?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:f,settle:(j0)=>j0===void 0?o():N0(j0)})});let b=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(x)await R(f);return}if(F!==null){if(k.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),P1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await I([f],M,!0)(j0),F=null}catch(F1){throw F=F1??Error("Hands stop receipt could not be confirmed."),F1}finally{clearTimeout(P1),N0.abort()}return}if(S&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new h2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{G.abort(j0),H.abort(j0)})}let o=M;if(S)W=I([...b.map((N0)=>N0.wireEvent),f],o,!0),await W(A),W=void 0;else await I([...b.map((N0)=>N0.wireEvent),f],o,!1)(A)});n.then(()=>{for(let o of b)o.settle()},(o)=>{for(let N0 of b)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(E0(o))X(o);if(S){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),H.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await C.current?.promise}catch(k){V=G.signal.aborted?{status:"cancelled",error_code:i4(G.signal)}:{status:"failed",error_code:n8(k)}}finally{Q.authorized=()=>!1,D.abort();for(let k of _.splice(0))k.settle();H.abort(),await h}let l=o8(J.capability)?e8(V.result,J.operation_id):null;if(N){if(E0(N))throw N;V={status:"failed",error_code:q??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&V.status==="succeeded")V={status:"cancelled",error_code:i4(G.signal),...l?{result:l}:{}}}if(L?.close(),E0($.signal.reason))throw $.signal.reason;await $3($,J,V)}finally{L?.close(),D.abort(),H.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??y$,Y=$.statusPath??Q3(),G=J().toISOString(),H=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...Y5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...H?{lastUsedAt:H}:{}}),q=0,V,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),Q5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??g8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await AX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;H=F.lastUsedAt??H,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,V=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(E0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=WX(q,$.reconnectRandom);V??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:V},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function AX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??y$,G=J().toISOString(),H=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let V=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(c8,U):c8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,Y0=0;for(let{claim:L1}of z.values()){let i0=L1.capability==="hands.connect"?L1.payload[t8]:void 0;if(typeof i0==="string"){if(v.has(i0))continue;v.add(i0)}Y0+=1}return Y0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),C=K?new Date(G).getTime()+n4(K.initialDelayMs??NX,V):Number.POSITIVE_INFINITY,P=null,R=!1,I=$.firstHeartbeat,E=I?.account_root_metadata_supported===!0,w=I?.workspace_root_metadata_supported===!0,h=I?.account_root_path_supported===!0,l=I?.home_contained_roots_supported===!0,k=I?.root_paths_supported===!0,x=I?.startup_supported===!0,S=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,f,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...Y5(J),...H?{lastUsedAt:H}:{},...P?{organizationId:P.organization_id,organizationName:P.organization_name,organizationSlug:P.organization_slug}:{}}),o=()=>{let v=$.claimable?.()!==!1;if(!b)f??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...x&&!b&&f?{startup:f}:{},capabilities:v?Z5($.capabilities,{accountRootMetadataSupported:E,workspaceRootMetadataSupported:w,accountRootPathSupported:h,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},N0=()=>{if(R||!$.client.identity)return;R=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;P=v;let Y0=Y(Q);if(!Y0)return;X({...Y0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{E=v.account_root_metadata_supported===!0,w=v.workspace_root_metadata_supported===!0,h=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,x=v.startup_supported===!0,S=!1},P1=(v)=>{if(v.startup)b=!0},F1=(v,Y0)=>{if(!(Y0 instanceof _0&&Y0.status===400&&Y0.code==="invalid_heartbeat")||!v.startup&&!S)throw Y0;if(b=!0,S)E=w=h=!1,l=k=x=S=!1;return null},r1=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},x1=!1,E1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(x1)E1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((Y0)=>F1(v,Y0))).then((Y0)=>{if(!Y0)return;P1(v),j0(Y0),r1(Y0)},()=>{return})});let a0=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let S1=!1,O$=$.maxConsecutiveHeartbeatFailures??3,W1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,Y0=o(),L1=A;A=void 0,x1=!0,E1=!1;try{let a=await V$($,"heartbeat",()=>$.client.heartbeat($.state,Y0,N.signal,...L1?[L1]:[]).catch((M0)=>F1(Y0,M0)));if(x1=!1,!a)continue;v=a,P1(Y0),W1=0}catch(a){if(x1=!1,$.signal.aborted)break;if(!m2(a))throw a;if(W1+=1,W1>=O$&&!W())throw a;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(Y0.capabilities).length)continue;if(E1)continue;if(r1(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))C=Math.min(C,J().getTime());if(K&&J().getTime()>=C)try{let a=new AbortController,M0=()=>a.abort($.signal.reason);if($.signal.aborted)M0();else $.signal.addEventListener("abort",M0,{once:!0});let l0;try{l0=K.check(a.signal)}catch(R0){l0=Promise.reject(R0)}let w1=l0.then((R0)=>({kind:"completed",result:R0}),(R0)=>({kind:"failed",error:R0})),t1;try{while(!0){let R0=await LX(w1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(R0.kind==="failed")throw new r4(R0.error);if(R0.kind==="completed"){t1=R0.result;break}try{let S0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,S0,N.signal).catch((H2)=>F1(S0,H2)));if(!R$)continue;v=R$,P1(S0),r1(v),W1=0}catch(S0){if($.signal.aborted)throw S0;if(!m2(S0))throw S0;if(W1+=1,W1>=O$&&!W())throw S0}}}catch(R0){a.abort(R0);let S0=await w1;if(S0.kind==="completed"&&S0.result==="activated")t1="activated";else throw R0}finally{$.signal.removeEventListener("abort",M0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,t1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}C=J().getTime()+n4(K.intervalMs??UX,V)}catch(a){if(!(a instanceof r4))throw a;T+=1;let M0=K.retryBaseMs??qX,l0=K.retryMaxMs??MX,w1=Math.min(l0,M0*2**Math.min(T-1,8));C=J().getTime()+n4(w1,V)}if($.signal.aborted)break;if(_&&L())break;if(_){await a0($.heartbeatIntervalMs??15000);continue}let i0=$.client.sessionCadence?.($.state)??null,A$=i0?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await a0(A$);continue}if(F()>=M){let a=new AbortController;O=a;try{await Z(A$,AbortSignal.any([$.signal,a.signal]))}catch(M0){if(!a.signal.aborted)throw M0}finally{if(O===a)O=null}continue}let g0,y=i0?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),i=performance.now();try{g0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:y,signal:N.signal}))}catch(a){if($.signal.aborted||!m2(a)||!W())throw a;await a0(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!g0){if(performance.now()-i<y-YX)await a0(XX);continue}if($.claimable?.()===!1){await $3($,g0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}H=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:g0.operation_id,runId:g0.run_id,attemptId:g0.attempt_id,capability:g0.capability});let B0,I0={authorized:()=>!1,claim:g0};if(B0=OX({...$,signal:N.signal},g0,Z,I0,j).catch((a)=>{if(E0(a))j(a);else if(!o0(a)&&[...z].some(([M0,l0])=>M0!==B0&&l0.authorized())){if(a instanceof s$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!o0(a)&&D===null)D=a}).finally(()=>{z.delete(B0),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(B0,I0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),B5(g0)){if(await B0,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),S1=!0;let Y0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:Y0},Q),$.onEvent?.({type:"error",message:Y0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!S1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as JY}from"child_process";import{constants as b5,existsSync as ZY,mkdtempSync as p5,rmSync as QY}from"fs";import{access as k5,open as XY,readFile as y5,readlink as YY,readdir as f5,unlink as GY,rmdir as BY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as g1}from"crypto";import{chmodSync as RX,closeSync as CX,fsyncSync as IX,openSync as PX,readFileSync as xX,rmdirSync as K5,unlinkSync as N5,writeFileSync as EX}from"fs";import{createConnection as SX,createServer as wX}from"net";import{dirname as bX,join as kX}from"path";var yX=5000;async function U5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:g1()},X={runId:g1(),deviceId:g1(),rootId:g1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=H5(J,X),G={version:1,snapshot_id:g1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{N5(Y.path)}catch{}}}async function q5($,J,Z=V5){if(J.aborted)return!1;let Q,X,Y=new Set,G=g1(),H=wX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(G)});H.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),V=setTimeout(N,yX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${g1()}`}),X=kX(Q.journalDirectory,"readiness.json");let U=PX(X,"wx",384);try{EX(U,G),IX(U)}finally{CX(U)}if(xX(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{H.once("error",()=>T(!1)),H.listen(Q.socketPath,()=>{try{RX(Q.socketPath,384)}catch{T(!1);return}K=SX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(V),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>H.close(()=>U())),Q?.disposeSocket(),X)try{N5(X)}catch{}if(Q){try{K5(Q.journalDirectory)}catch{}try{K5(bX(Q.journalDirectory))}catch{}}}}import{spawn as fX}from"child_process";import{randomUUID as u1}from"crypto";import{basename as hX}from"path";import{fileURLToPath as mX}from"url";function vX(){let $=hX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",mX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function _5($,J,Z=vX()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=fX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),H=!1,K=new Promise((F)=>G.once("close",()=>{H=!0,F()}));G.on("error",X);let N,q,V=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
 `)){let O=T.indexOf(`
-`),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([V,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=u1(),L={organizationId:u1(),userId:u1(),runId:u1(),deviceId:u1(),rootId:u1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:u1(),port:F.port,expiresAtMs:O},C={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:W}}},P=M5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!H&&!Q.signal.aborted?C:null});j=await q5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:P,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),G.stdin.destroy(),!H)G.kill("SIGKILL");await K}return z&&H}import{execFileSync as u2}from"child_process";import{randomUUID as c0}from"crypto";import{chmodSync as _5,chownSync as x5,closeSync as V3,constants as q1,existsSync as mX,fstatSync as E5,mkdirSync as F5,mkdtempSync as vX,openSync as H3,readFileSync as gX,readSync as uX,realpathSync as dX,rmdirSync as lX,rmSync as pX}from"fs";import{join as d1}from"path";import{fileURLToPath as cX}from"url";var W5=1e4,sX=!1;function d2(){if(process.platform!=="linux")return!1;return sX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=u2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var aX=Buffer.from([0,255,3,4]);function L5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function iX($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function s$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=g2(),{directory:Q,root:X,runtimeDirectory:Y}=tX(Z),G=new AbortController,H=()=>G.abort();$.addEventListener("abort",H,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(H,W5),q={organization_id:c0(),user_id:c0(),device_id:c0()},V=c0(),U=c0(),M=c0(),T=c0(),_=Date.now()+W5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=c0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,C=!1,P=!1,R,I,E,w=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},h=!1;try{K=nX(Q,Z),R=Bun.serve({hostname:"127.0.0.1",port:0,fetch(x,S){let A=new URL(x.url).pathname,f=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(f&&S.upgrade(x,{data:{lane:f}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(x){if(x.data.lane==="pty")z=x},message(x,S){if(x.data.lane!=="pty")return;if(typeof S==="string"){try{if(JSON.parse(S).t==="open")W=!0}catch{H()}return}if(F.length+S.length>8192){H();return}F=Buffer.concat([F,S])}}});let l=`ws://127.0.0.1:${R.port}`;if(I=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:V,operationId:c0(),attemptId:c0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:D5,hands_worker_version:O5,hands_worker_artifact_sha256:R5,hands_worker_entrypoint:A5,target_generation:1,target_fence_id:M,environment_binding:D,[C5]:I5},emitEvent:async(x)=>{if(x==="hands.started")P=!0;if(x==="hands.ready")L=!0;if(x==="hands.stopped")C=!0}},{browserExecutablePath:null,slot:P5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:cX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)H()}),await w(()=>L),j5({root:X,runId:V,payload:{version:1,snapshot_id:T,revision:1,run_id:V,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),E=z5({root:X,runId:V,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${c0()}`,sessionId:"pty-readiness",operationId:c0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${j}`},emit:async(x,S)=>{if(x==="pty.ready")O=S}}).catch(()=>{H()}),await w(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${L5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${L5("foreground")}; ${K.wait("foreground")}'
-`)),await w(()=>mX(d1(X,"foreground.pid"))&&F.includes(aX)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((x)=>rX(d1(X,x)));if(new Set(k).size!==2||k.some((x)=>!Number.isSafeInteger(x)||x<2||x===O.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((x)=>iX(gX(`/proc/${x}/stat`,"utf8"),x,O.job.process.pid)))return!1}else{let S=u2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((A)=>A.trim().split(/\s+/).map(Number));if(S.length!==2||new Set(S.map(([A])=>A)).size!==2||S.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await E,G.signal.aborted)return!1;for(let x of[O.job.process.pid,...k])try{return process.kill(x,0),!1}catch(S){if(!(S instanceof Error&&("code"in S)&&S.code==="ESRCH"))return!1}h=!0}catch{h=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",H),H(),K?.close(),await E,await I,await R?.stop(!0),!P||C)oX({directory:Q,root:X},Z)}return h&&C&&!$.aborted}function nX($,J){let Z={foreground:d1($,"foreground.lifeline"),background:d1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");u2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let G=H3(Y,q1.O_RDONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW);try{if(Q.push(H3(Y,q1.O_WRONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW)),!E5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(G)}if(J)x5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function S5($=(J)=>s$(J)){let J=new AbortController,Z=JSON.stringify(g2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(g2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function rX($){let J;try{J=H3($,q1.O_RDONLY|q1.O_NOFOLLOW|q1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=E5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=uX(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function tX($,J=dX("/tmp")){let Z=vX(d1(J,"reason-pty-probe-")),Q=d1(Z,"workspace"),X=d1(Z,"private");if(F5(Q,{mode:448}),F5(X,{mode:448}),$)_5(Z,493),_5(Q,493),x5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function oX($,J){if(J)try{u2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),lX($.root)}catch{return}pX($.directory,{recursive:!0,force:!0})}var p5=5000,l1="ARA_WORKER_PROBE_READY";function GY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{eX($,J,{cwd:Z,env:Q,signal:X,timeout:p5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,H)=>Y(!G&&!X.aborted&&H===l1))})}function BY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function KY($,J){let Z=h5({home:J,temporaryDirectory:J}),Q=(Y,G,H)=>GY(Y,G,$.workspaceRoot,Z,H),X=async(Y,G,H,K=(q)=>q===l1,N=!1)=>{let q=await i5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:p5,signal:H});return!H.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await b5($.workspaceRoot,w5.R_OK),await y5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await b5($.workspaceRoot,w5.W_OK),Y.aborted)return!1;let G=l5(M3($.workspaceRoot,".ara-worker-probe-")),H=M3(G,"receipt");try{let K=await ZY(H,"wx",384);try{await K.writeFile(l1),await K.sync()}finally{await K.close()}return await k5(H,"utf8")===l1&&!Y.aborted}finally{await XY(H).catch(()=>{}),await YY(G).catch(()=>{})}},confinedShell:(Y)=>X(a5(),["-c",`printf ${l1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
-`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,H,K]=await Promise.all([QY("/proc/self/cwd"),y5("/proc/self/fd"),k5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&H.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${l1}`],Y),jobs:(Y)=>U5($,Y),environment:(Y)=>N5($,J,Y),preview:(Y)=>T5(J,Y),boundPty:(Y)=>s$(Y),desktopDisplay:()=>s5(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
-`);return d5()},desktopBrowser:async()=>i$()?.features.browser===!0,fullControlShell:(Y)=>{let G=g5(),H=BY(G,`printf ${l1}`);return H?Q(G,H,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&i$()?.features.computer===!0?u5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function VY($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return a$($,J,Z,Q,X).final}function a$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,G){let H,K;try{if(N1($),u0(),!J)e(g($),!0),H=l5(M3(g($),"probe-")),J=KY($,H);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",V=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(G).then(()=>Promise.all(q?[N("preview"),V,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,C,P,R,I]=await Promise.all([Promise.resolve(Q).then((E)=>E.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((E)=>E.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!C||!P||!R)&&!G)await U;if(q){if(!C)C=await N("bash");if(!P)P=await N("jobs");if(!R)R=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:C,jobs:P,environment:R,full:I}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:C,processes:P,bash:R,jobs:I,environment:E,full:w}=z,{preview:h,boundPty:l,desktopDisplay:k,desktopAutomation:x,desktopBrowser:S}=F,A=m5(),f=q&&process.platform==="darwin"&&w&&$Y("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&C&&X,"process.list":(process.platform==="linux"||L)&&P,"ports.list":(process.platform==="linux"||L)&&P,"exec.full":R&&w&&X,"hands.connect":O&&W&&R&&I,"jobs.control":O&&W&&R&&I,"pty.start":O&&W&&R&&I&&E&&l,"environment.install":O&&W&&R&&I&&E,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&R&&I&&E,"tunnel.open":O&&W&&R&&I&&E&&h,"tunnel.close":O&&W&&R&&I&&E&&h,"preview.serve.v1":O&&R&&I&&h&&w,"display.stream.v1":k,"automation.call.v1":x,"simulator.call.v1":f,"simulator.stream.v1":f,"browser.pr-proof.v1":x&&S&&f5()===null,"workspace.setup.v1":q&&v5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([V,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,C]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:C})}finally{if(H)JY(H,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await V||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var HY=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],NY=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return HY.filter((Z)=>J[Z]!==!0)}function c5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>VY($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
-`),(async()=>{for(let Y of $.delaysMs??NY){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let H=q3($.config,Q).filter((K)=>G[K]===!0);if(H.length>0)Q=Object.freeze({...Q,...Object.fromEntries(H.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${H.join(", ")}).
-`),$.onReady(Q,H);if(q3($.config,Q).length===0)return}})()}import{execFile as KG}from"child_process";import{createHash as VG,randomUUID as b3}from"crypto";import{lstat as HG,readdir as S6,readFile as m6,realpath as NG,stat as UG}from"fs/promises";import{basename as qG,join as S3}from"path";import{promisify as MG}from"util";import{createConnection as UY}from"net";import{endianness as t5}from"os";var n$=4,W3=1e4;class R1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=UY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=qY({jsonrpc:"2.0",id:Q,method:$,params:X}),H=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(G),await H}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=n$){let J=t5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=n$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(n$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!e0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),e0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class l2{client;cdp;constructor($){this.client="client"in $?$.client:new R1($),this.cdp=new $6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=MY(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new o5(this,$)}getTabs(){return this.client.getTabs()}}class o5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new e5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class e5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class $6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(e0(Q)&&e0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return e0(Q)&&e0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";n5(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(e0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(H)=>{let K=await this.readDocumentState($);if(r5(K,Q))return;throw H}),G}async waitForLoadState($,J={}){let Z=J.state??"load";n5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(r5(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return e0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let G=!1,H=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),H?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),H=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(V){if(N())Y(V instanceof Error?V:Error(String(V)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=TY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function qY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(n$+J.length);if(t5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,n$),Z}function e0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function MY($,J){if(!e0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function n5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function r5($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function TY($,J){if($.method!=="onCDPEvent"||!e0($.params))return null;let Z=$.params.source;if(!e0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as _Y}from"crypto";function J6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${_Y("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as YG}from"async_hooks";import{isDeepStrictEqual as x6}from"util";import{createHash as GG}from"crypto";var FY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var WY=new Set(["png","jpg","jpeg","gif","webp"]),LY=new Set(["webm","mp4"]);function DY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function Z6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=DY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=FY.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),H=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!H||!K||!N)return null;let q=WY.has(N)?"image":LY.has(N)?"video":null;if(!q)return null;let V=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:G,artifactId:H,fileName:`${K}.${N}`,kind:q,phase:V?.[1]==="before"||V?.[1]==="after"?V[1]:null}}var jY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,p2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),p1=()=>{throw Error("cloud_browser_media_request_invalid")};function c2($){if(!p2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!jY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return p1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return p1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!Q6(J.origin,{mode:"public_web"}).allowed)return p1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!p2(Y)||Object.keys(Y).some((H)=>!["url","sourceUrl","kind"].includes(H))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return p1();let G=Z6(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return p1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let H;try{H=new URL(Y.sourceUrl)}catch{return p1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(H.pathname)?.[1];if(Y.kind!=="image"||H.origin!=="https://camo.githubusercontent.com"||H.username||H.password||H.search||H.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return p1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function X6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!p2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!p2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=B.string().uuid(),H$=B.string().regex(/^[a-f0-9]{64}$/),s1=B.iso.datetime({precision:3}),D3=B.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),G6=B.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),s0=B.object({kind:B.literal("primary_mac"),version:B.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:B.string().min(1).max(64),binding:B.enum(["workspace_source","mcp_control"]),targetRevision:B.number().int().nonnegative(),generation:L0,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),zY=B.custom().transform(($,J)=>{try{return Y6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),B.NEVER}}),N$=B.object({version:B.literal(1),owner:s0,contextId:L0,preparedAt:s1,expiresAt:s1,prUrl:G6,headSha:B.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:B.enum(["image","video"]),visualPlan:zY.optional(),uploadOrigin:B.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=B.object({version:B.literal(1),producer:B.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:B.number().int().positive(),startedAt:s1,finishedAt:s1,sha256:H$,media:B.discriminatedUnion("contentType",[B.object({contentType:B.literal("image/png"),sizeBytes:B.number().int().min(24).max(8388608),width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096)}).strict(),B.object({contentType:B.literal("video/webm"),sizeBytes:B.number().int().min(128).max(10485760),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),XM=B.discriminatedUnion("action",[B.object({action:B.literal("screenshot"),context_id:L0,tab_id:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),context_id:L0,tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("stop_video"),recording_operation_id:L0}).strict()]),a2=B.object({login:B.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:B.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),s2=B.string().regex(/^[1-9][0-9]{0,19}$/),r$=B.object({version:B.literal(1),owner:s0,expectedActorId:s2.nullable(),repositoryId:s2,repositoryFullName:B.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),OY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=B.discriminatedUnion("status",[r$.extend({status:B.literal("ready"),observedActor:a2,checkedAt:s1}),r$.extend({status:B.literal("not_ready"),reason:B.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:B.enum(OY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),c1=B.object({version:B.literal(1),owner:s0,expectedActorId:s2.nullable(),authenticatedActor:a2,attemptId:L0,captureId:L0,prUrl:G6,repositoryId:s2,headSha:B.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:B.number().int().min(128).max(10485760),contentType:B.literal("video/webm")}).strict(),B6=B.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=B.discriminatedUnion("status",[c1.extend({status:B.literal("not_attempted"),reason:B.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),c1.extend({status:B.literal("uncertain"),reason:B.literal("upload_outcome_unknown")}),c1.extend({status:B.literal("uploaded"),observedActor:a2,nativeUrl:B6,uploadedAt:s1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),t$=c1.extend({nativeUrl:B6,observedActor:a2,bodySha256:H$}),A3=B.discriminatedUnion("status",[t$.extend({status:B.literal("incomplete"),reason:B.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),t$.extend({status:B.literal("verified"),sourceSha256:H$,width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096),durationSeconds:B.number().positive().max(30),advancedSeconds:B.number().min(0.05).max(10),advancedFrames:B.number().int().positive(),playbackRestored:B.literal(!0),verifiedAt:s1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),AY=B.custom().transform(($,J)=>{try{let Z=c2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),B.NEVER}}),RY=B.discriminatedUnion("action",[B.object({action:B.literal("auth_check"),input:r$}).strict(),B.object({action:B.literal("prepare"),context:N$}).strict(),B.object({action:B.literal("capture_png"),owner:s0,contextId:L0,tabId:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),owner:s0,contextId:L0,tabId:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("inspect_capture"),owner:s0,captureId:L0}).strict(),B.object({action:B.literal("publish_video"),input:c1}).strict(),B.object({action:B.literal("verify_png_media"),owner:s0,media:AY}).strict().refine(($)=>$.media.runId===$.owner.runId),B.object({action:B.literal("verify_saved_media"),input:t$}).strict(),B.object({action:B.literal("publish_png"),owner:s0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:B.number().int().min(24).max(8388608),storagePath:B.string().max(512),uploadUrl:B.string().url().max(8192)}).strict()]);var K6="pr-proof.stop.v1",R3=B.object({requestId:L0,command:RY}).strict();import{createHash as CY,randomUUID as IY}from"crypto";import{isDeepStrictEqual as q$}from"util";var V6=B.object({operationId:B.string().uuid(),attemptId:B.string().uuid(),contextId:B.string().uuid(),tabId:B.number().int().positive()}).strict(),K0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>CY("sha256").update($).digest("hex");function H6($){let J=s0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw K0();if(await $.assertCurrent(),X)throw K0()},G=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw K0();return M},H=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,K0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>H(D)))).some((D)=>D.status==="rejected"))throw K0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function V(U,M){let T=V6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw K0();await Y(),U.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw K0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw K0();let P=await D.completion;if(await Y(),G(T.contextId),D.controller.signal.aborted)throw K0();return structuredClone(P)}if(Q.size>=16||[...Q.values()].some((P)=>!P.receipt&&!P.controller.signal.aborted&&P.claim.tabId===T.tabId))throw K0();let j,z,F=new Promise((P,R)=>{j=P,z=R});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{H(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),G(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},C;try{await L();let P;if(M==="image"){let R=new Date().toISOString();C=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let I=new Date().toISOString();if(await L(),C.length<24||C.length>8388608||!C.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||C.readUInt32BE(8)!==13||C.toString("ascii",12,16)!=="IHDR")throw K0();P=z3.parse({version:1,producer:"primary_mac",context:_,captureId:IY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:R,finishedAt:I,sha256:C3(C),media:{contentType:"image/png",sizeBytes:C.length,width:C.readUInt32BE(16),height:C.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),K0();await O.host.start(),O.started=!0;let R=O.host.completed();if(R.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let I=await R;if(O.stop)await O.stop;await L();let E=await O.host.read(I.captureId);C=E.bytes;let w={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(I,E.capture)||!q$(I.owner,w)||C.length!==I.sizeBytes||C3(C)!==I.sha256||C.length<128||C.readUInt32BE(0)!==440786851)throw K0();await O.host.close(),await L(),P=z3.parse({version:1,producer:"primary_mac",context:_,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((R,I)=>R+(I.bytes?.length??0),C.length)>20971520)throw K0();return O.bytes=Buffer.from(C),O.receipt=P,j(P),structuredClone(P)}catch(P){let R=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&P instanceof Error&&P.message==="mac_recording_worker_failed:no_frames"?new v0("proof_capture_no_frames","The owned tab emitted no recording frames."):K0();throw await H(O).catch(()=>{}),z(R),R}finally{C?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw K0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw K0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw K0();return structuredClone(T)}if(Z.size>=4)throw K0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>V(U,"image"),record:(U)=>V(U,"video"),async stop(U){let M=V6.parse(U);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw K0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw K0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw K0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw K0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(H));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw K0()}}}import{createHash as M6,randomUUID as fY}from"crypto";import{isDeepStrictEqual as o$}from"util";import{realpath as hY}from"fs/promises";var N6=String.raw`async (media) => {
+`),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([V,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=u1(),L={organizationId:u1(),userId:u1(),runId:u1(),deviceId:u1(),rootId:u1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:u1(),port:F.port,expiresAtMs:O},C={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:W}}},P=T5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!H&&!Q.signal.aborted?C:null});j=await M5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:P,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),G.stdin.destroy(),!H)G.kill("SIGKILL");await K}return z&&H}import{execFileSync as u2}from"child_process";import{randomUUID as c0}from"crypto";import{chmodSync as F5,chownSync as E5,closeSync as V3,constants as q1,existsSync as gX,fstatSync as S5,mkdirSync as W5,mkdtempSync as uX,openSync as H3,readFileSync as dX,readSync as lX,realpathSync as pX,rmdirSync as cX,rmSync as sX}from"fs";import{join as d1}from"path";import{fileURLToPath as aX}from"url";var L5=1e4,iX=!1;function d2(){if(process.platform!=="linux")return!1;return iX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=u2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var nX=Buffer.from([0,255,3,4]);function D5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function rX($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function a$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=g2(),{directory:Q,root:X,runtimeDirectory:Y}=eX(Z),G=new AbortController,H=()=>G.abort();$.addEventListener("abort",H,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(H,L5),q={organization_id:c0(),user_id:c0(),device_id:c0()},V=c0(),U=c0(),M=c0(),T=c0(),_=Date.now()+L5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=c0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,C=!1,P=!1,R,I,E,w=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},h=!1;try{K=tX(Q,Z),R=Bun.serve({hostname:"127.0.0.1",port:0,fetch(x,S){let A=new URL(x.url).pathname,f=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(f&&S.upgrade(x,{data:{lane:f}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(x){if(x.data.lane==="pty")z=x},message(x,S){if(x.data.lane!=="pty")return;if(typeof S==="string"){try{if(JSON.parse(S).t==="open")W=!0}catch{H()}return}if(F.length+S.length>8192){H();return}F=Buffer.concat([F,S])}}});let l=`ws://127.0.0.1:${R.port}`;if(I=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:V,operationId:c0(),attemptId:c0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:j5,hands_worker_version:A5,hands_worker_artifact_sha256:C5,hands_worker_entrypoint:R5,target_generation:1,target_fence_id:M,environment_binding:D,[I5]:P5},emitEvent:async(x)=>{if(x==="hands.started")P=!0;if(x==="hands.ready")L=!0;if(x==="hands.stopped")C=!0}},{browserExecutablePath:null,slot:x5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:aX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)H()}),await w(()=>L),z5({root:X,runId:V,payload:{version:1,snapshot_id:T,revision:1,run_id:V,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),E=O5({root:X,runId:V,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${c0()}`,sessionId:"pty-readiness",operationId:c0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${j}`},emit:async(x,S)=>{if(x==="pty.ready")O=S}}).catch(()=>{H()}),await w(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${D5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${D5("foreground")}; ${K.wait("foreground")}'
+`)),await w(()=>gX(d1(X,"foreground.pid"))&&F.includes(nX)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((x)=>oX(d1(X,x)));if(new Set(k).size!==2||k.some((x)=>!Number.isSafeInteger(x)||x<2||x===O.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((x)=>rX(dX(`/proc/${x}/stat`,"utf8"),x,O.job.process.pid)))return!1}else{let S=u2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((A)=>A.trim().split(/\s+/).map(Number));if(S.length!==2||new Set(S.map(([A])=>A)).size!==2||S.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await E,G.signal.aborted)return!1;for(let x of[O.job.process.pid,...k])try{return process.kill(x,0),!1}catch(S){if(!(S instanceof Error&&("code"in S)&&S.code==="ESRCH"))return!1}h=!0}catch{h=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",H),H(),K?.close(),await E,await I,await R?.stop(!0),!P||C)$Y({directory:Q,root:X},Z)}return h&&C&&!$.aborted}function tX($,J){let Z={foreground:d1($,"foreground.lifeline"),background:d1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");u2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let G=H3(Y,q1.O_RDONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW);try{if(Q.push(H3(Y,q1.O_WRONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW)),!S5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(G)}if(J)E5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function w5($=(J)=>a$(J)){let J=new AbortController,Z=JSON.stringify(g2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(g2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function oX($){let J;try{J=H3($,q1.O_RDONLY|q1.O_NOFOLLOW|q1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=S5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=lX(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function eX($,J=pX("/tmp")){let Z=uX(d1(J,"reason-pty-probe-")),Q=d1(Z,"workspace"),X=d1(Z,"private");if(W5(Q,{mode:448}),W5(X,{mode:448}),$)F5(Z,493),F5(Q,493),E5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function $Y($,J){if(J)try{u2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),cX($.root)}catch{return}sX($.directory,{recursive:!0,force:!0})}var c5=5000,l1="ARA_WORKER_PROBE_READY";function KY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{JY($,J,{cwd:Z,env:Q,signal:X,timeout:c5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,H)=>Y(!G&&!X.aborted&&H===l1))})}function VY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function HY($,J){let Z=m5({home:J,temporaryDirectory:J}),Q=(Y,G,H)=>KY(Y,G,$.workspaceRoot,Z,H),X=async(Y,G,H,K=(q)=>q===l1,N=!1)=>{let q=await n5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:c5,signal:H});return!H.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await k5($.workspaceRoot,b5.R_OK),await f5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await k5($.workspaceRoot,b5.W_OK),Y.aborted)return!1;let G=p5(M3($.workspaceRoot,".ara-worker-probe-")),H=M3(G,"receipt");try{let K=await XY(H,"wx",384);try{await K.writeFile(l1),await K.sync()}finally{await K.close()}return await y5(H,"utf8")===l1&&!Y.aborted}finally{await GY(H).catch(()=>{}),await BY(G).catch(()=>{})}},confinedShell:(Y)=>X(i5(),["-c",`printf ${l1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
+`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,H,K]=await Promise.all([YY("/proc/self/cwd"),f5("/proc/self/fd"),y5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&H.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${l1}`],Y),jobs:(Y)=>q5($,Y),environment:(Y)=>U5($,J,Y),preview:(Y)=>_5(J,Y),boundPty:(Y)=>a$(Y),desktopDisplay:()=>a5(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
+`);return l5()},desktopBrowser:async()=>n$()?.features.browser===!0,fullControlShell:(Y)=>{let G=u5(),H=VY(G,`printf ${l1}`);return H?Q(G,H,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&n$()?.features.computer===!0?d5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function NY($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return i$($,J,Z,Q,X).final}function i$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,G){let H,K;try{if(N1($),u0(),!J)e(g($),!0),H=p5(M3(g($),"probe-")),J=HY($,H);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",V=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(G).then(()=>Promise.all(q?[N("preview"),V,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,C,P,R,I]=await Promise.all([Promise.resolve(Q).then((E)=>E.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((E)=>E.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!C||!P||!R)&&!G)await U;if(q){if(!C)C=await N("bash");if(!P)P=await N("jobs");if(!R)R=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:C,jobs:P,environment:R,full:I}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:C,processes:P,bash:R,jobs:I,environment:E,full:w}=z,{preview:h,boundPty:l,desktopDisplay:k,desktopAutomation:x,desktopBrowser:S}=F,A=v5(),f=q&&process.platform==="darwin"&&w&&ZY("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&C&&X,"process.list":(process.platform==="linux"||L)&&P,"ports.list":(process.platform==="linux"||L)&&P,"exec.full":R&&w&&X,"hands.connect":O&&W&&R&&I,"jobs.control":O&&W&&R&&I,"pty.start":O&&W&&R&&I&&E&&l,"environment.install":O&&W&&R&&I&&E,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&R&&I&&E,"tunnel.open":O&&W&&R&&I&&E&&h,"tunnel.close":O&&W&&R&&I&&E&&h,"preview.serve.v1":O&&R&&I&&h&&w,"display.stream.v1":k,"automation.call.v1":x,"simulator.call.v1":f,"simulator.stream.v1":f,"browser.pr-proof.v1":x&&S&&h5()===null,"workspace.setup.v1":q&&g5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([V,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,C]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:C})}finally{if(H)QY(H,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await V||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var UY=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],qY=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return UY.filter((Z)=>J[Z]!==!0)}function s5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>NY($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
+`),(async()=>{for(let Y of $.delaysMs??qY){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let H=q3($.config,Q).filter((K)=>G[K]===!0);if(H.length>0)Q=Object.freeze({...Q,...Object.fromEntries(H.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${H.join(", ")}).
+`),$.onReady(Q,H);if(q3($.config,Q).length===0)return}})()}import{execFile as HG}from"child_process";import{createHash as NG,randomUUID as b3}from"crypto";import{lstat as UG,readdir as w6,readFile as v6,realpath as qG,stat as MG}from"fs/promises";import{basename as TG,join as S3}from"path";import{promisify as _G}from"util";import{createConnection as MY}from"net";import{endianness as o5}from"os";var r$=4,W3=1e4;class R1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=MY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=TY({jsonrpc:"2.0",id:Q,method:$,params:X}),H=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(G),await H}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=r$){let J=o5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=r$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(r$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!e0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),e0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class l2{client;cdp;constructor($){this.client="client"in $?$.client:new R1($),this.cdp=new J6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=_Y(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new e5(this,$)}getTabs(){return this.client.getTabs()}}class e5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new $6(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class $6{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class J6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(e0(Q)&&e0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return e0(Q)&&e0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";r5(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(e0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(H)=>{let K=await this.readDocumentState($);if(t5(K,Q))return;throw H}),G}async waitForLoadState($,J={}){let Z=J.state??"load";r5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(t5(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return e0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let G=!1,H=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),H?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),H=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(V){if(N())Y(V instanceof Error?V:Error(String(V)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=FY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function TY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(r$+J.length);if(o5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,r$),Z}function e0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function _Y($,J){if(!e0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function r5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function t5($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function FY($,J){if($.method!=="onCDPEvent"||!e0($.params))return null;let Z=$.params.source;if(!e0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as WY}from"crypto";function Z6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${WY("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as BG}from"async_hooks";import{isDeepStrictEqual as E6}from"util";import{createHash as KG}from"crypto";var LY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var DY=new Set(["png","jpg","jpeg","gif","webp"]),jY=new Set(["webm","mp4"]);function zY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function Q6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=zY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=LY.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),H=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!H||!K||!N)return null;let q=DY.has(N)?"image":jY.has(N)?"video":null;if(!q)return null;let V=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:G,artifactId:H,fileName:`${K}.${N}`,kind:q,phase:V?.[1]==="before"||V?.[1]==="after"?V[1]:null}}var OY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,p2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),p1=()=>{throw Error("cloud_browser_media_request_invalid")};function c2($){if(!p2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!OY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return p1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return p1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!X6(J.origin,{mode:"public_web"}).allowed)return p1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!p2(Y)||Object.keys(Y).some((H)=>!["url","sourceUrl","kind"].includes(H))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return p1();let G=Q6(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return p1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let H;try{H=new URL(Y.sourceUrl)}catch{return p1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(H.pathname)?.[1];if(Y.kind!=="image"||H.origin!=="https://camo.githubusercontent.com"||H.username||H.password||H.search||H.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return p1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function Y6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!p2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!p2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=B.string().uuid(),H$=B.string().regex(/^[a-f0-9]{64}$/),s1=B.iso.datetime({precision:3}),D3=B.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),B6=B.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),s0=B.object({kind:B.literal("primary_mac"),version:B.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:B.string().min(1).max(64),binding:B.enum(["workspace_source","mcp_control"]),targetRevision:B.number().int().nonnegative(),generation:L0,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),AY=B.custom().transform(($,J)=>{try{return G6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),B.NEVER}}),N$=B.object({version:B.literal(1),owner:s0,contextId:L0,preparedAt:s1,expiresAt:s1,prUrl:B6,headSha:B.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:B.enum(["image","video"]),visualPlan:AY.optional(),uploadOrigin:B.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=B.object({version:B.literal(1),producer:B.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:B.number().int().positive(),startedAt:s1,finishedAt:s1,sha256:H$,media:B.discriminatedUnion("contentType",[B.object({contentType:B.literal("image/png"),sizeBytes:B.number().int().min(24).max(8388608),width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096)}).strict(),B.object({contentType:B.literal("video/webm"),sizeBytes:B.number().int().min(128).max(10485760),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),GM=B.discriminatedUnion("action",[B.object({action:B.literal("screenshot"),context_id:L0,tab_id:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),context_id:L0,tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("stop_video"),recording_operation_id:L0}).strict()]),a2=B.object({login:B.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:B.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),s2=B.string().regex(/^[1-9][0-9]{0,19}$/),t$=B.object({version:B.literal(1),owner:s0,expectedActorId:s2.nullable(),repositoryId:s2,repositoryFullName:B.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),RY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=B.discriminatedUnion("status",[t$.extend({status:B.literal("ready"),observedActor:a2,checkedAt:s1}),t$.extend({status:B.literal("not_ready"),reason:B.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:B.enum(RY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),c1=B.object({version:B.literal(1),owner:s0,expectedActorId:s2.nullable(),authenticatedActor:a2,attemptId:L0,captureId:L0,prUrl:B6,repositoryId:s2,headSha:B.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:B.number().int().min(128).max(10485760),contentType:B.literal("video/webm")}).strict(),K6=B.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=B.discriminatedUnion("status",[c1.extend({status:B.literal("not_attempted"),reason:B.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),c1.extend({status:B.literal("uncertain"),reason:B.literal("upload_outcome_unknown")}),c1.extend({status:B.literal("uploaded"),observedActor:a2,nativeUrl:K6,uploadedAt:s1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),o$=c1.extend({nativeUrl:K6,observedActor:a2,bodySha256:H$}),A3=B.discriminatedUnion("status",[o$.extend({status:B.literal("incomplete"),reason:B.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),o$.extend({status:B.literal("verified"),sourceSha256:H$,width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096),durationSeconds:B.number().positive().max(30),advancedSeconds:B.number().min(0.05).max(10),advancedFrames:B.number().int().positive(),playbackRestored:B.literal(!0),verifiedAt:s1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),CY=B.custom().transform(($,J)=>{try{let Z=c2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),B.NEVER}}),IY=B.discriminatedUnion("action",[B.object({action:B.literal("auth_check"),input:t$}).strict(),B.object({action:B.literal("prepare"),context:N$}).strict(),B.object({action:B.literal("capture_png"),owner:s0,contextId:L0,tabId:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),owner:s0,contextId:L0,tabId:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("inspect_capture"),owner:s0,captureId:L0}).strict(),B.object({action:B.literal("publish_video"),input:c1}).strict(),B.object({action:B.literal("verify_png_media"),owner:s0,media:CY}).strict().refine(($)=>$.media.runId===$.owner.runId),B.object({action:B.literal("verify_saved_media"),input:o$}).strict(),B.object({action:B.literal("publish_png"),owner:s0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:B.number().int().min(24).max(8388608),storagePath:B.string().max(512),uploadUrl:B.string().url().max(8192)}).strict()]);var V6="pr-proof.stop.v1",R3=B.object({requestId:L0,command:IY}).strict();import{createHash as PY,randomUUID as xY}from"crypto";import{isDeepStrictEqual as q$}from"util";var H6=B.object({operationId:B.string().uuid(),attemptId:B.string().uuid(),contextId:B.string().uuid(),tabId:B.number().int().positive()}).strict(),K0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>PY("sha256").update($).digest("hex");function N6($){let J=s0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw K0();if(await $.assertCurrent(),X)throw K0()},G=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw K0();return M},H=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,K0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>H(D)))).some((D)=>D.status==="rejected"))throw K0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function V(U,M){let T=H6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw K0();await Y(),U.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw K0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw K0();let P=await D.completion;if(await Y(),G(T.contextId),D.controller.signal.aborted)throw K0();return structuredClone(P)}if(Q.size>=16||[...Q.values()].some((P)=>!P.receipt&&!P.controller.signal.aborted&&P.claim.tabId===T.tabId))throw K0();let j,z,F=new Promise((P,R)=>{j=P,z=R});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{H(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),G(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},C;try{await L();let P;if(M==="image"){let R=new Date().toISOString();C=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let I=new Date().toISOString();if(await L(),C.length<24||C.length>8388608||!C.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||C.readUInt32BE(8)!==13||C.toString("ascii",12,16)!=="IHDR")throw K0();P=z3.parse({version:1,producer:"primary_mac",context:_,captureId:xY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:R,finishedAt:I,sha256:C3(C),media:{contentType:"image/png",sizeBytes:C.length,width:C.readUInt32BE(16),height:C.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),K0();await O.host.start(),O.started=!0;let R=O.host.completed();if(R.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let I=await R;if(O.stop)await O.stop;await L();let E=await O.host.read(I.captureId);C=E.bytes;let w={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(I,E.capture)||!q$(I.owner,w)||C.length!==I.sizeBytes||C3(C)!==I.sha256||C.length<128||C.readUInt32BE(0)!==440786851)throw K0();await O.host.close(),await L(),P=z3.parse({version:1,producer:"primary_mac",context:_,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((R,I)=>R+(I.bytes?.length??0),C.length)>20971520)throw K0();return O.bytes=Buffer.from(C),O.receipt=P,j(P),structuredClone(P)}catch(P){let R=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&P instanceof Error&&P.message==="mac_recording_worker_failed:no_frames"?new v0("proof_capture_no_frames","The owned tab emitted no recording frames."):K0();throw await H(O).catch(()=>{}),z(R),R}finally{C?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw K0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw K0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw K0();return structuredClone(T)}if(Z.size>=4)throw K0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>V(U,"image"),record:(U)=>V(U,"video"),async stop(U){let M=H6.parse(U);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw K0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw K0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw K0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw K0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(H));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw K0()}}}import{createHash as T6,randomUUID as mY}from"crypto";import{isDeepStrictEqual as e$}from"util";import{realpath as vY}from"fs/promises";var U6=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -73,24 +73,24 @@ ${J?.directory??g($)}`).digest("hex")}function E$($,J){c(y0(g($),S$),{version:1,
     }
   }));
   return { verified: true, items };
-}`;var U6=function($){let J=this??globalThis,Z=10485760,Q=(G,H)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,V={login:K,id:q};if(G.expectedActorId!==null&&q!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||q!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||q!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(H){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:V}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,H=Q(G,!0);if(!H.ok)return{dispatched:!1,reason:H.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let V=J.document.querySelector("#fc-new_comment_field");if(!V)return{dispatched:!1,reason:"attachment_unavailable"};return V.files=q.files,V.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:H.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let H=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=H?.startsWith(K)&&H.endsWith(")")?H.slice(K.length,-1):H;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),H=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(H));if(q.length!==1)throw Error("saved_player_missing");let V=q[0],U={muted:V.muted,volume:V.volume,rate:V.playbackRate,preload:V.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(V.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(V.muted=!0,V.playbackRate=1,V.currentTime=0,V.readyState<2)V.preload="auto",V.load();await D(()=>V.readyState>=2&&V.videoWidth>0&&V.videoHeight>0);let j=V.currentSrc;if(!H(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!H(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let h=await _(O.read());if(h.done)break;if(L+=h.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(h.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let C=new J.Uint8Array(L),P=0;for(let h of W)C.set(h,P),P+=h.length;let R=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",C)))].map((h)=>h.toString(16).padStart(2,"0")).join("");if(R!==X.sha256||V.currentSrc!==j||!N.contains(V))throw Error("source_changed");let I=V.currentTime,E=V.getVideoPlaybackQuality().totalVideoFrames;if(await _(V.play()),await D(()=>V.currentTime-I>=0.05&&V.getVideoPlaybackQuality().totalVideoFrames>E),!Q(X,!1).ok||V.currentSrc!==j||!N.contains(V)||V.error)throw Error("player_changed");return{status:"verified",sourceSha256:R,width:V.videoWidth,height:V.videoHeight,durationSeconds:V.duration,advancedSeconds:V.currentTime-I,advancedFrames:V.getVideoPlaybackQuality().totalVideoFrames-E,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),V.pause(),V.currentTime=0,V.muted=U.muted,V.volume=U.volume,V.playbackRate=U.rate,V.preload=U.preload,!V.paused||V.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as PY}from"child_process";import{lstat as xY,realpath as EY}from"fs/promises";import{join as q6,resolve as SY}from"path";import{promisify as wY}from"util";var bY=wY(PY);async function kY($,J){let Z=await EY($),{stdout:Q}=await bY(q6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return B.array(B.object({browser:B.string(),directory:B.string(),connected:B.boolean().optional(),source:B.string(),socketPath:B.string().optional(),instanceId:B.string().optional(),extensionId:B.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&SY(Y.source)===q6(Z,"Reason Browser Use","manifest.json"))}async function i2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await kY($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await xY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as yY}from"crypto";function M$($){return`reason-browser-${yY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var T6=B.discriminatedUnion("ok",[B.object({ok:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({ok:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),_6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function I3($){let J=s0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await mY($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${fY()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},H=async(q)=>{if(!o$(J,q.owner))throw Z0();await G()},K=async(q)=>{await H(q);let V=await $.readVideo(q.captureId);try{await G();let U=V.capture;if(!o$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||V.bytes.length!==q.sizeBytes||V.bytes.length<128||V.bytes.length>10485760||V.bytes.readUInt32BE(0)!==440786851||M6("sha256").update(V.bytes).digest("hex")!==q.sha256)throw Z0();return V}catch(U){throw V.bytes.fill(0),U}};async function N(q,V,U){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new l2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await G(),D)throw Z0()};try{await F(T.connect());let W=_6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((R)=>{if(D)R.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let P=await F(V(_,async(R)=>{await O();let I=await F(_.evaluate(`(${U6.toString()})(${JSON.stringify(R)})`,{awaitPromise:!0}));return await O(),I},O));return await O(),P}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,C)=>{W=setTimeout(()=>C(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(q,V,U){let M=N$.parse(q);if(await H(M),!Number.isSafeInteger(V)||V<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new l2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=_6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!B.array(B.object({id:B.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===V))throw Z0();await G(),U.throwIfAborted();let F=B.object({data:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(V,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await G(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let V=c2(q);if(V.runId!==J.runId||V.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(V.media.map((R)=>R.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,C=(R,I)=>{if(L.size>=32){F=!0;return}let E=_.executeCdp(U.id,R,I);L.add(E),E.catch(()=>{F=!0}).finally(()=>L.delete(E))},P=_.onNotification((R)=>{if(R.method!=="onCDPEvent"||!t0(R.params)||!t0(R.params.source)||R.params.source.tabId!==U.id||!t0(R.params.params))return;let I=R.params.params;if(++O>512){F=!0;return}if(R.params.method==="Fetch.requestPaused"){let h=typeof I.requestId==="string"&&t0(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&D.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!h)F=!0;C(h?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...h?{}:{errorReason:"BlockedByClient"}})}if(R.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(R.params.method==="Network.loadingFailed")F=!0;if(R.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")z.add(I.requestId);if(R.params.method!=="Network.responseReceived")return;if(!t0(I.response)||typeof I.response.url!=="string"||!D.has(I.response.url)||typeof I.requestId!=="string"||!t0(I.response.headers)||I.type!=="Image"){F=!0;return}let E=Object.fromEntries(Object.entries(I.response.headers).map(([h,l])=>[h.toLowerCase(),l])),w=Number(E["content-length"]);if(j.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof E["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(E["content-length"])||!Number.isSafeInteger(w)||w>8388608||E["content-range"]||E["content-encoding"]&&E["content-encoding"]!=="identity"){F=!0;return}j.set(I.response.url,{id:I.requestId,length:w})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let R=B.object({frameTree:B.object({frame:B.object({id:B.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),I=[...new Set(V.media.map((h)=>new URL(h.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:R.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new v0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let E;try{E=await U.evaluate(`(${N6})(${JSON.stringify(V.media)})`,{awaitPromise:!0})}catch{throw new v0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!t0(E)||!Array.isArray(E.items)||E.items.length!==V.media.length)throw Z0();await Promise.all(L);let w=[];for(let h=0;h<V.media.length;h++){await G();let l=j.get(V.media[h].sourceUrl);if(F||!l||!z.has(l.id))throw Z0();let k=B.object({base64Encoded:B.literal(!0),body:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:l.id})),x=Buffer.from(k.body,"base64");try{let S=E.items[h];if(x.length!==l.length||x.toString("base64")!==k.body||!t0(S))throw Z0();w.push({...S,sourceSha256:M6("sha256").update(x).digest("hex")})}finally{x.fill(0)}}if(F)throw Z0();return X6({verified:!0,items:w},V)}finally{if(P(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new v0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let V=r$.parse(q);await H(V);let U="browser_unavailable";try{return await N(`https://github.com/${V.repositoryFullName}`,async(M,T)=>{let _=T6.parse(await T({operation:"preflight",expected:{...V,prUrl:`https://github.com/${V.repositoryFullName}`}}));return O3.parse(_.ok?{...V,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...V,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...V,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...V,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let V=c1.parse(q);if(await H(V),V.expectedActorId!==null&&V.authenticatedActor.id!==V.expectedActorId)throw Z0();let U=Q.get(V.attemptId);if(U){if(!o$(U.binding,V))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(V),result:U$.parse({...V,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(V.attemptId,M);let T=!1,_="dispatch";try{(await K(V)).bytes.fill(0),M.result=await N(V.prUrl,async(D,j)=>{let z=T6.parse(await j({operation:"identity",expected:V}));if(!z.ok)return U$.parse({...V,status:"not_attempted",reason:z.reason});let F=await K(V),O;try{T=!0,O=B.discriminatedUnion("dispatched",[B.object({dispatched:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({dispatched:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:V,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...V,status:"not_attempted",reason:O.reason});if(!o$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...V,observedActor:z.actor}});if(L!==null){let C=B.object({nativeUrl:B.string(),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await G(),U$.parse({...V,status:"uploaded",nativeUrl:C.nativeUrl,observedActor:C.actor,uploadedAt:new Date().toISOString()})}await new Promise((C)=>setTimeout(C,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
-`);M.result=U$.parse({...V,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let V=t$.parse(q);await H(V);try{return(await K(V)).bytes.fill(0),await N(V.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:V});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...V,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(V).some(([D,j])=>!o$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...V,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function mY($,J){let Z=await hY($);return{async discover(Q){let X=await i2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as XG}from"fs/promises";var hM=B.object({version:B.literal(1),recording_operation_id:B.string().uuid(),proof_ready:B.literal(!1),acknowledged_at:B.iso.datetime()}).strict(),n2=B.object({action:B.literal("start"),request_id:B.string().uuid(),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),F6=B.object({action:B.literal("inspect"),recording_operation_id:B.string().uuid()}).strict(),mM=B.discriminatedUnion("action",[n2,F6]),W6=B.object({recording_operation_id:B.string().uuid()}).strict(),P3={device_id:B.string().uuid(),root_id:B.string().uuid()},vY=B.discriminatedUnion("action",[n2.extend(P3),F6.extend(P3),W6.extend({...P3,action:B.literal("stop")})]),vM=B.toJSONSchema(vY),gM=B.object({version:B.literal(1),recordingId:B.string().uuid(),proofReady:B.literal(!1),capture:B.object({captureId:B.string().uuid(),contentType:B.literal("video/webm"),sha256:B.string().regex(/^[a-f0-9]{64}$/),sizeBytes:B.number().int().min(128).max(10485760),startedAt:B.iso.datetime(),finishedAt:B.iso.datetime(),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000),owner:B.object({runId:B.string().uuid(),deviceId:B.string().uuid(),rootId:B.string().uuid(),rootRevision:B.string().max(64),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024),generation:B.string().uuid(),browserScope:B.string().max(128),tabId:B.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var rM=n2.extend({action:B.enum(["start","inspect"]),recording_boot_generation:B.string().uuid(),recording_operation_id:B.string().uuid().optional(),recording_attempt_id:B.string().uuid().optional()}).strict();import{createHash as nY,randomUUID as rY}from"crypto";import{mkdtemp as tY,realpath as oY,rm as C6}from"fs/promises";import{tmpdir as eY}from"os";import{join as $G}from"path";import{spawn as JG}from"child_process";import{isDeepStrictEqual as ZG}from"util";import{createHash as gY}from"crypto";import{execFile as uY}from"child_process";import{chmod as dY,lstat as D6,mkdtemp as lY,readFile as j6,realpath as z6,rm as pY,writeFile as L6}from"fs/promises";import{tmpdir as cY}from"os";import{isAbsolute as sY,join as r2}from"path";import{promisify as aY}from"util";var x3=aY(uY),iY=($)=>gY("sha256").update($).digest("hex");async function G1($){if(!sY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await z6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await D6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||iY(await j6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function e$($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]);let G=await z6(await lY(r2(J??cY(),"reason-owned-recording-")));await dY(G,448);let H=r2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await L6(r2(G,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await L6(r2(G,"frames.ffconcat"),N.join(`
+}`;var q6=function($){let J=this??globalThis,Z=10485760,Q=(G,H)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,V={login:K,id:q};if(G.expectedActorId!==null&&q!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||q!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||q!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(H){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:V}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,H=Q(G,!0);if(!H.ok)return{dispatched:!1,reason:H.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let V=J.document.querySelector("#fc-new_comment_field");if(!V)return{dispatched:!1,reason:"attachment_unavailable"};return V.files=q.files,V.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:H.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let H=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=H?.startsWith(K)&&H.endsWith(")")?H.slice(K.length,-1):H;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),H=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(H));if(q.length!==1)throw Error("saved_player_missing");let V=q[0],U={muted:V.muted,volume:V.volume,rate:V.playbackRate,preload:V.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(V.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(V.muted=!0,V.playbackRate=1,V.currentTime=0,V.readyState<2)V.preload="auto",V.load();await D(()=>V.readyState>=2&&V.videoWidth>0&&V.videoHeight>0);let j=V.currentSrc;if(!H(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!H(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let h=await _(O.read());if(h.done)break;if(L+=h.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(h.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let C=new J.Uint8Array(L),P=0;for(let h of W)C.set(h,P),P+=h.length;let R=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",C)))].map((h)=>h.toString(16).padStart(2,"0")).join("");if(R!==X.sha256||V.currentSrc!==j||!N.contains(V))throw Error("source_changed");let I=V.currentTime,E=V.getVideoPlaybackQuality().totalVideoFrames;if(await _(V.play()),await D(()=>V.currentTime-I>=0.05&&V.getVideoPlaybackQuality().totalVideoFrames>E),!Q(X,!1).ok||V.currentSrc!==j||!N.contains(V)||V.error)throw Error("player_changed");return{status:"verified",sourceSha256:R,width:V.videoWidth,height:V.videoHeight,durationSeconds:V.duration,advancedSeconds:V.currentTime-I,advancedFrames:V.getVideoPlaybackQuality().totalVideoFrames-E,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),V.pause(),V.currentTime=0,V.muted=U.muted,V.volume=U.volume,V.playbackRate=U.rate,V.preload=U.preload,!V.paused||V.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as EY}from"child_process";import{lstat as SY,realpath as wY}from"fs/promises";import{join as M6,resolve as bY}from"path";import{promisify as kY}from"util";var yY=kY(EY);async function fY($,J){let Z=await wY($),{stdout:Q}=await yY(M6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return B.array(B.object({browser:B.string(),directory:B.string(),connected:B.boolean().optional(),source:B.string(),socketPath:B.string().optional(),instanceId:B.string().optional(),extensionId:B.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&bY(Y.source)===M6(Z,"Reason Browser Use","manifest.json"))}async function i2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await fY($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await SY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as hY}from"crypto";function M$($){return`reason-browser-${hY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var _6=B.discriminatedUnion("ok",[B.object({ok:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({ok:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),F6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function I3($){let J=s0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await gY($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${mY()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},H=async(q)=>{if(!e$(J,q.owner))throw Z0();await G()},K=async(q)=>{await H(q);let V=await $.readVideo(q.captureId);try{await G();let U=V.capture;if(!e$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||V.bytes.length!==q.sizeBytes||V.bytes.length<128||V.bytes.length>10485760||V.bytes.readUInt32BE(0)!==440786851||T6("sha256").update(V.bytes).digest("hex")!==q.sha256)throw Z0();return V}catch(U){throw V.bytes.fill(0),U}};async function N(q,V,U){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new l2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await G(),D)throw Z0()};try{await F(T.connect());let W=F6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((R)=>{if(D)R.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let P=await F(V(_,async(R)=>{await O();let I=await F(_.evaluate(`(${q6.toString()})(${JSON.stringify(R)})`,{awaitPromise:!0}));return await O(),I},O));return await O(),P}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,C)=>{W=setTimeout(()=>C(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(q,V,U){let M=N$.parse(q);if(await H(M),!Number.isSafeInteger(V)||V<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new l2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=F6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!B.array(B.object({id:B.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===V))throw Z0();await G(),U.throwIfAborted();let F=B.object({data:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(V,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await G(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let V=c2(q);if(V.runId!==J.runId||V.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(V.media.map((R)=>R.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,C=(R,I)=>{if(L.size>=32){F=!0;return}let E=_.executeCdp(U.id,R,I);L.add(E),E.catch(()=>{F=!0}).finally(()=>L.delete(E))},P=_.onNotification((R)=>{if(R.method!=="onCDPEvent"||!t0(R.params)||!t0(R.params.source)||R.params.source.tabId!==U.id||!t0(R.params.params))return;let I=R.params.params;if(++O>512){F=!0;return}if(R.params.method==="Fetch.requestPaused"){let h=typeof I.requestId==="string"&&t0(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&D.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!h)F=!0;C(h?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...h?{}:{errorReason:"BlockedByClient"}})}if(R.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(R.params.method==="Network.loadingFailed")F=!0;if(R.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")z.add(I.requestId);if(R.params.method!=="Network.responseReceived")return;if(!t0(I.response)||typeof I.response.url!=="string"||!D.has(I.response.url)||typeof I.requestId!=="string"||!t0(I.response.headers)||I.type!=="Image"){F=!0;return}let E=Object.fromEntries(Object.entries(I.response.headers).map(([h,l])=>[h.toLowerCase(),l])),w=Number(E["content-length"]);if(j.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof E["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(E["content-length"])||!Number.isSafeInteger(w)||w>8388608||E["content-range"]||E["content-encoding"]&&E["content-encoding"]!=="identity"){F=!0;return}j.set(I.response.url,{id:I.requestId,length:w})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let R=B.object({frameTree:B.object({frame:B.object({id:B.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),I=[...new Set(V.media.map((h)=>new URL(h.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:R.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new v0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let E;try{E=await U.evaluate(`(${U6})(${JSON.stringify(V.media)})`,{awaitPromise:!0})}catch{throw new v0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!t0(E)||!Array.isArray(E.items)||E.items.length!==V.media.length)throw Z0();await Promise.all(L);let w=[];for(let h=0;h<V.media.length;h++){await G();let l=j.get(V.media[h].sourceUrl);if(F||!l||!z.has(l.id))throw Z0();let k=B.object({base64Encoded:B.literal(!0),body:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:l.id})),x=Buffer.from(k.body,"base64");try{let S=E.items[h];if(x.length!==l.length||x.toString("base64")!==k.body||!t0(S))throw Z0();w.push({...S,sourceSha256:T6("sha256").update(x).digest("hex")})}finally{x.fill(0)}}if(F)throw Z0();return Y6({verified:!0,items:w},V)}finally{if(P(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new v0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let V=t$.parse(q);await H(V);let U="browser_unavailable";try{return await N(`https://github.com/${V.repositoryFullName}`,async(M,T)=>{let _=_6.parse(await T({operation:"preflight",expected:{...V,prUrl:`https://github.com/${V.repositoryFullName}`}}));return O3.parse(_.ok?{...V,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...V,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...V,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...V,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let V=c1.parse(q);if(await H(V),V.expectedActorId!==null&&V.authenticatedActor.id!==V.expectedActorId)throw Z0();let U=Q.get(V.attemptId);if(U){if(!e$(U.binding,V))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(V),result:U$.parse({...V,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(V.attemptId,M);let T=!1,_="dispatch";try{(await K(V)).bytes.fill(0),M.result=await N(V.prUrl,async(D,j)=>{let z=_6.parse(await j({operation:"identity",expected:V}));if(!z.ok)return U$.parse({...V,status:"not_attempted",reason:z.reason});let F=await K(V),O;try{T=!0,O=B.discriminatedUnion("dispatched",[B.object({dispatched:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({dispatched:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:V,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...V,status:"not_attempted",reason:O.reason});if(!e$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...V,observedActor:z.actor}});if(L!==null){let C=B.object({nativeUrl:B.string(),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await G(),U$.parse({...V,status:"uploaded",nativeUrl:C.nativeUrl,observedActor:C.actor,uploadedAt:new Date().toISOString()})}await new Promise((C)=>setTimeout(C,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
+`);M.result=U$.parse({...V,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let V=o$.parse(q);await H(V);try{return(await K(V)).bytes.fill(0),await N(V.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:V});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...V,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(V).some(([D,j])=>!e$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...V,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function gY($,J){let Z=await vY($);return{async discover(Q){let X=await i2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as GG}from"fs/promises";var vM=B.object({version:B.literal(1),recording_operation_id:B.string().uuid(),proof_ready:B.literal(!1),acknowledged_at:B.iso.datetime()}).strict(),n2=B.object({action:B.literal("start"),request_id:B.string().uuid(),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),W6=B.object({action:B.literal("inspect"),recording_operation_id:B.string().uuid()}).strict(),gM=B.discriminatedUnion("action",[n2,W6]),L6=B.object({recording_operation_id:B.string().uuid()}).strict(),P3={device_id:B.string().uuid(),root_id:B.string().uuid()},uY=B.discriminatedUnion("action",[n2.extend(P3),W6.extend(P3),L6.extend({...P3,action:B.literal("stop")})]),uM=B.toJSONSchema(uY),dM=B.object({version:B.literal(1),recordingId:B.string().uuid(),proofReady:B.literal(!1),capture:B.object({captureId:B.string().uuid(),contentType:B.literal("video/webm"),sha256:B.string().regex(/^[a-f0-9]{64}$/),sizeBytes:B.number().int().min(128).max(10485760),startedAt:B.iso.datetime(),finishedAt:B.iso.datetime(),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000),owner:B.object({runId:B.string().uuid(),deviceId:B.string().uuid(),rootId:B.string().uuid(),rootRevision:B.string().max(64),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024),generation:B.string().uuid(),browserScope:B.string().max(128),tabId:B.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var oM=n2.extend({action:B.enum(["start","inspect"]),recording_boot_generation:B.string().uuid(),recording_operation_id:B.string().uuid().optional(),recording_attempt_id:B.string().uuid().optional()}).strict();import{createHash as tY,randomUUID as oY}from"crypto";import{mkdtemp as eY,realpath as $G,rm as I6}from"fs/promises";import{tmpdir as JG}from"os";import{join as ZG}from"path";import{spawn as QG}from"child_process";import{isDeepStrictEqual as XG}from"util";import{createHash as dY}from"crypto";import{execFile as lY}from"child_process";import{chmod as pY,lstat as j6,mkdtemp as cY,readFile as z6,realpath as O6,rm as sY,writeFile as D6}from"fs/promises";import{tmpdir as aY}from"os";import{isAbsolute as iY,join as r2}from"path";import{promisify as nY}from"util";var x3=nY(lY),rY=($)=>dY("sha256").update($).digest("hex");async function G1($){if(!iY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await O6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await j6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||rY(await z6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function $2($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]);let G=await O6(await cY(r2(J??aY(),"reason-owned-recording-")));await pY(G,448);let H=r2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await D6(r2(G,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await D6(r2(G,"frames.ffconcat"),N.join(`
 `)+`
-`,{mode:384,flag:"wx"});let q={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",H],q),K="output";let V=await D6(H);if(!V.isFile()||V.isSymbolicLink()||V.nlink!==1||V.size<128||V.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",H],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",H,"-f","null","-"],q),K="pin",await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]),await j6(H)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await pY(G,{recursive:!0,force:!0})}}}}var A6=B.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var B1=B.string().min(1).max(1024),O6=B.object({path:B1,sha256:B.string().regex(/^[a-f0-9]{64}$/)}).strict(),R6=B.object({owner:B.object({runId:B1,deviceId:B1,rootId:B1,rootRevision:B1,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B1,generation:B1,browserScope:B1,tabId:B.number().int().positive()}).strict(),socketPath:B1,extensionId:B.string().regex(/^[a-p]{32}$/),nativeHostName:B1,seconds:B.number().int().min(1).max(15),encoder:B.object({ffmpeg:O6,ffprobe:O6}).strict()}).strict();var QG=15728640,C1=()=>Error("mac_recording_worker_failed");function I6($){let J=R6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,H=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(C1()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([H(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,V=async()=>{if(X)throw C1();if(await K($.assertCurrent()),X)throw C1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await V(),await G1({path:Z.path,sha256:Z.sha256}),await V(),G=null;let U=await oY(await tY($G(eY(),"reason-recording-host-")));try{await V()}catch(x){throw await C6(U,{recursive:!0,force:!0}),x}let M=JG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((x)=>M.once("close",()=>x())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(x){if(x.code!=="ESRCH")throw x}},D=null;H=()=>D??=(async()=>{try{_()}catch(x){if(x.code!=="EPERM")throw x}await T;try{for(let x=0;;x++)try{_();break}catch(S){if(S.code!=="EPERM"||x>=20)throw S;await new Promise((A)=>setTimeout(A,25))}}finally{await C6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,C,P=new Promise((x,S)=>{L=x,C=S}),R,I,E=new Promise((x,S)=>{R=x,I=S});E.catch(()=>{});let w=(x=C1())=>{if(F)return;F=!0,clearTimeout(h),clearInterval(k),N().then(()=>{C(x),I(x)},(S)=>{C(S),I(S)})},h=setTimeout(()=>w(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,V().catch(()=>w()).finally(()=>{l=!1})},250);q={completion:E,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
-`)},cancel:()=>w()},M.on("error",()=>w()),M.stdin.on("error",()=>w()),M.stdout.on("data",(x)=>{if(F)return;if(z+=x.length,z>QG){w();return}j+=x.toString("utf8");let S;while((S=j.indexOf(`
-`))!==-1){let A=j.slice(0,S);j=j.slice(S+1);try{let f=JSON.parse(A);if(f.type==="failed"&&Object.keys(f).sort().join(",")==="reason,type"){let o=A6.safeParse(f.reason);w(o.success?Error(`mac_recording_worker_failed:${o.data}`):C1());return}if(f.type==="unsupported"&&!O){w(Error("mac_recording_encoder_unavailable"));return}if(f.type==="started"&&!O&&Object.keys(f).length===1){O=!0,L({recording:!0});continue}if(!O||f.type!=="capture"||W||Object.keys(f).sort().join(",")!=="bytes,capture,type")throw C1();let b=f.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!ZG(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof f.bytes!=="string"||f.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(f.bytes))throw C1();let n=Buffer.from(f.bytes,"base64");if(n.length!==b.sizeBytes||nY("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw C1();W={capture:Object.freeze({...b,captureId:rY(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{w();return}}}),M.once("close",(x)=>{if(F)return;if(x!==0||!W||j.trim()){w();return}let S=W;V().then(async()=>{if(await H(),F)return;F=!0,clearTimeout(h),clearInterval(k),Q.set(S.capture.captureId,S);while(Q.size>2)Q.delete(Q.keys().next().value);R(S.capture)}).catch(()=>w())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
-`);try{return await P}catch(x){throw q=null,x}}finally{Y=!1}},async completed(){if(await V(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await V();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await V();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var P6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await XG($.automationDirectory);J=(Q,X)=>i2(Z,Q,X)}if(await G1({path:$.worker.path,sha256:$.worker.sha256}),!await e$($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),H=new R1({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await H.connect(),K=P6.parse(await H.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!B.array(B.object({id:B.number()})).parse(await H.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{H.close()}return{extensionInstanceId:G.instanceId,async createHost(N,q,V){let U=new R1({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return I6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){V.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=P6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),BG=B.object({operationId:B.string().uuid()}).strict();function E6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=B.array(B.object({profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:B.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!B.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,G=!1,H=new YG,K=async(U)=>{let M=H.getStore();if(G||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),G)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=H6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let C=await $.resolveBrowser(U.profile,O,j,L);if(C.extensionInstanceId!==U.extensionInstanceId)throw A0();return C.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),G)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!x6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},V=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{G=!0})},1000);return V.unref(),{generation:$.generation,async execute(U,M,T){return H.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!x6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let C=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?C.capture.context.uploadOrigin:$.uploadOrigin)||C.capture.media.contentType!=="image/png"||C.capture.sha256!==_.sha256||C.bytes.length!==_.sizeBytes||GG("sha256").update(C.bytes).digest("hex")!==_.sha256)throw A0();await z();let P={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,P);try{let R=await fetch(L,{method:"PUT",body:C.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await R.body?.cancel(),await z(),R.ok)P.result={...P.result,status:"uploaded"}}catch{}F=P.result}finally{C.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==K6)return!1;let T=BG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await H.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(V);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var TG="__browser-recorder",_G=MG(KG),FG="/tmp/open-browser-use",WG=33554432,LG=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.literal(t2),extensionInstanceId:B.string().min(1).max(1024)})}),w6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:i$,ensureBrowser:f6,socketDirectory:FG,async identity($){let J=new R1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function b6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw w6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(h6(Z),"Default","Local Extension Settings",t2),X=(await S6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await S6(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=S3(J.socketDirectory,Y);try{let H=await HG(G);if(!H.isSocket()||H.uid!==process.getuid?.())continue;let K=LG.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await UG(N)).size<=WG&&(await m6(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:t2}}catch{}}throw w6()}async function w3($){let J=await NG($);return{path:J,sha256:VG("sha256").update(await m6(J)).digest("hex")}}async function v6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await _G(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await e$(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...qG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],TG]};return{worker:{...await w3(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function g6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=k6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?y6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,H=(V)=>J6(V.organizationId,V.sessionId,V.deviceId,1),K=$.recording,N,q=E6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:H,...K?{resolveBrowser:async(V,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>b6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(V,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>DG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(V)=>I3({...V,endpoint:(U)=>({discover:(M)=>b6(M,Z),tabScope:H(U)})})});return{capability:G,broker:q}}function DG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as hG}from"child_process";import{execFile as jG}from"child_process";import{readFile as zG}from"fs/promises";import{join as $1}from"path";var OG="Claude Code-credentials",AG="/usr/bin/security",RG=120000,CG=8192,o2={exec:($,J,Z)=>new Promise((Q)=>{jG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await zG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=CG?$:null}function IG($,J){return $.CLAUDE_CONFIG_DIR||$1(J,".claude")}function PG($,J){return $.CODEX_HOME||$1(J,".codex")}function u6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function xG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function EG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:xG(Z)??Date.now()}}catch{return null}}function SG($,J){return $1($.XDG_DATA_HOME||$1(J,".local","share"),"opencode","auth.json")}var wG={anthropic:"anthropic",openai:"openai-codex"};function bG($){return c6($,wG)}function c6($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let H=T$(G.access),K=T$(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(H&&K&&N!==null)Q.push({provider:Y,access:H,refresh:K,expires:N})}return Q}catch{return[]}}function kG($){return c6($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function yG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?$1(J,Z.slice(2)):Z||$1(J,".pi","agent")}async function s6($,J,Z=o2){let Q=[],X=await Z.exec(AG,["find-generic-password","-s",OG,"-w"],RG),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?u6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(u6(await Z.readText($1(IG($,J),".credentials.json"))));let H=EG(await Z.readText($1(PG($,J),"auth.json")));G(H),G(fG(await Z.readText($1($.GROK_HOME||$1(J,".grok"),"auth.json"))));for(let K of bG(await Z.readText(SG($,J))))G(K);for(let K of kG(await Z.readText($1(yG($,J),"auth.json"))))G(K);return Q}function a6($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var d6="https://auth.x.ai",l6="b1a00492-073a-47ea-816f-4c329264a828",p6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function fG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${d6}::${l6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==d6||Q.oidc_client_id!==l6||!p6(Q.key)||!p6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var i6=330000,mG=300000,vG=60000;function gG($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+i6)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function uG($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*i6)?vG:mG}var dG=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function n6($){let J=new Map,Z=$.wait??dG,Q=$.stores??(process.platform==="darwin"?o2:{...o2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=a6(await s6($.environment??process.env,$.home,Q));for(let Y of gG(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(uG(J),$.signal)}}function r6($=process.env){return new Promise((J)=>{hG("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as lG,spawn as W_,spawnSync as L_}from"child_process";import{chmodSync as j_,existsSync as pG,mkdirSync as z_,readFileSync as O_,renameSync as A_,rmSync as R_,statSync as C_,writeFileSync as I_}from"fs";import{dirname as x_,isAbsolute as E_,join as y3}from"path";var t6=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function o6($,J){if(!t6.test($)||!t6.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var cG="com.reasonmachines.updater",sG=["so.ara.updater","so.reason.updater"];function aG($){let J=$==="staging"?".staging":"";return{label:`${cG}${J}`,legacyLabels:[...sG].reverse().map((Z)=>`${Z}${J}`)}}function iG($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function nG($,J){return new Promise((Z)=>{lG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function J7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=aG($.channel),G=$.configHome??$7(Q),H=[X,...Y].filter((V)=>{let U=iG(V,Q,G);return pG(J==="darwin"?U.launchAgent:U.systemdService)});if(H.length===0)return"absent";let K=$.command??nG,N=H[0];if(H.length>1){for(let V of H)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${V}`]):await K("systemctl",["--user","is-enabled",`${V}.timer`]))===0){N=V;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var e6=60000;function Z7($){let J=(X,Y)=>{try{return o6(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(e6-1,Math.floor(G*e6)))}}var rG=30000;async function Q7($){return($.flush??T8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(rG);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var Y7=25000,oG=5000,eG=600000,$B=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return u0(),j7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var G7=5000,JB=600000;function ZB($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[a1])return null;try{return C2({platform:J})}catch{return null}}function QB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function XB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)v$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)v$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Z2($,J,Z,Q,X={}){if(u0(),$.executionMode==="host")J2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let H=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?L7():Promise.resolve(!1),q=M7().then((y)=>y.status==="resolved",()=>!1),V=X.prestartedReadiness??a$($,X.readinessProbes,H,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?V.initial:V.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??r6)().catch(()=>!1):null,D=new AbortController,j=null,z=async(y,i)=>{let I0=($.userChrome??X.ownComputer===!0)&&y["automation.call.v1"]===!0?W7():null;if(I0&&"code"in I0)process.stderr.write(`Reason worker: your own Chrome unavailable (${I0.code})
-`);let a=g3($,y,{displayVideo:y["display.stream.v1"]===!0&&await N(),handsBrowser:y["hands.connect"]===!0&&await q,userChrome:I0&&"host"in I0?I0.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:y["pty.start"]===!0&&d2(),probing:i});if(!j&&a.worker.readiness?.["browser.pr-proof.v1"]===!0){let M0=await v6();if(j||D.signal.aborted)return a;process.stderr.write("error"in M0?`Reason worker: PR video proof unavailable (${M0.error})
+`,{mode:384,flag:"wx"});let q={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",H],q),K="output";let V=await j6(H);if(!V.isFile()||V.isSymbolicLink()||V.nlink!==1||V.size<128||V.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",H],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",H,"-f","null","-"],q),K="pin",await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]),await z6(H)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await sY(G,{recursive:!0,force:!0})}}}}var R6=B.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var B1=B.string().min(1).max(1024),A6=B.object({path:B1,sha256:B.string().regex(/^[a-f0-9]{64}$/)}).strict(),C6=B.object({owner:B.object({runId:B1,deviceId:B1,rootId:B1,rootRevision:B1,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B1,generation:B1,browserScope:B1,tabId:B.number().int().positive()}).strict(),socketPath:B1,extensionId:B.string().regex(/^[a-p]{32}$/),nativeHostName:B1,seconds:B.number().int().min(1).max(15),encoder:B.object({ffmpeg:A6,ffprobe:A6}).strict()}).strict();var YG=15728640,C1=()=>Error("mac_recording_worker_failed");function P6($){let J=C6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,H=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(C1()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([H(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,V=async()=>{if(X)throw C1();if(await K($.assertCurrent()),X)throw C1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await V(),await G1({path:Z.path,sha256:Z.sha256}),await V(),G=null;let U=await $G(await eY(ZG(JG(),"reason-recording-host-")));try{await V()}catch(x){throw await I6(U,{recursive:!0,force:!0}),x}let M=QG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((x)=>M.once("close",()=>x())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(x){if(x.code!=="ESRCH")throw x}},D=null;H=()=>D??=(async()=>{try{_()}catch(x){if(x.code!=="EPERM")throw x}await T;try{for(let x=0;;x++)try{_();break}catch(S){if(S.code!=="EPERM"||x>=20)throw S;await new Promise((A)=>setTimeout(A,25))}}finally{await I6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,C,P=new Promise((x,S)=>{L=x,C=S}),R,I,E=new Promise((x,S)=>{R=x,I=S});E.catch(()=>{});let w=(x=C1())=>{if(F)return;F=!0,clearTimeout(h),clearInterval(k),N().then(()=>{C(x),I(x)},(S)=>{C(S),I(S)})},h=setTimeout(()=>w(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,V().catch(()=>w()).finally(()=>{l=!1})},250);q={completion:E,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
+`)},cancel:()=>w()},M.on("error",()=>w()),M.stdin.on("error",()=>w()),M.stdout.on("data",(x)=>{if(F)return;if(z+=x.length,z>YG){w();return}j+=x.toString("utf8");let S;while((S=j.indexOf(`
+`))!==-1){let A=j.slice(0,S);j=j.slice(S+1);try{let f=JSON.parse(A);if(f.type==="failed"&&Object.keys(f).sort().join(",")==="reason,type"){let o=R6.safeParse(f.reason);w(o.success?Error(`mac_recording_worker_failed:${o.data}`):C1());return}if(f.type==="unsupported"&&!O){w(Error("mac_recording_encoder_unavailable"));return}if(f.type==="started"&&!O&&Object.keys(f).length===1){O=!0,L({recording:!0});continue}if(!O||f.type!=="capture"||W||Object.keys(f).sort().join(",")!=="bytes,capture,type")throw C1();let b=f.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!XG(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof f.bytes!=="string"||f.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(f.bytes))throw C1();let n=Buffer.from(f.bytes,"base64");if(n.length!==b.sizeBytes||tY("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw C1();W={capture:Object.freeze({...b,captureId:oY(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{w();return}}}),M.once("close",(x)=>{if(F)return;if(x!==0||!W||j.trim()){w();return}let S=W;V().then(async()=>{if(await H(),F)return;F=!0,clearTimeout(h),clearInterval(k),Q.set(S.capture.captureId,S);while(Q.size>2)Q.delete(Q.keys().next().value);R(S.capture)}).catch(()=>w())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
+`);try{return await P}catch(x){throw q=null,x}}finally{Y=!1}},async completed(){if(await V(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await V();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await V();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var x6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await GG($.automationDirectory);J=(Q,X)=>i2(Z,Q,X)}if(await G1({path:$.worker.path,sha256:$.worker.sha256}),!await $2($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),H=new R1({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await H.connect(),K=x6.parse(await H.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!B.array(B.object({id:B.number()})).parse(await H.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{H.close()}return{extensionInstanceId:G.instanceId,async createHost(N,q,V){let U=new R1({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return P6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){V.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=x6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),VG=B.object({operationId:B.string().uuid()}).strict();function S6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=B.array(B.object({profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:B.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!B.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,G=!1,H=new BG,K=async(U)=>{let M=H.getStore();if(G||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),G)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=N6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let C=await $.resolveBrowser(U.profile,O,j,L);if(C.extensionInstanceId!==U.extensionInstanceId)throw A0();return C.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),G)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!E6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},V=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{G=!0})},1000);return V.unref(),{generation:$.generation,async execute(U,M,T){return H.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!E6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let C=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?C.capture.context.uploadOrigin:$.uploadOrigin)||C.capture.media.contentType!=="image/png"||C.capture.sha256!==_.sha256||C.bytes.length!==_.sizeBytes||KG("sha256").update(C.bytes).digest("hex")!==_.sha256)throw A0();await z();let P={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,P);try{let R=await fetch(L,{method:"PUT",body:C.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await R.body?.cancel(),await z(),R.ok)P.result={...P.result,status:"uploaded"}}catch{}F=P.result}finally{C.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==V6)return!1;let T=VG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await H.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(V);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var FG="__browser-recorder",WG=_G(HG),LG="/tmp/open-browser-use",DG=33554432,jG=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.literal(t2),extensionInstanceId:B.string().min(1).max(1024)})}),b6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:n$,ensureBrowser:h6,socketDirectory:LG,async identity($){let J=new R1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function k6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw b6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(m6(Z),"Default","Local Extension Settings",t2),X=(await w6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await w6(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=S3(J.socketDirectory,Y);try{let H=await UG(G);if(!H.isSocket()||H.uid!==process.getuid?.())continue;let K=jG.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await MG(N)).size<=DG&&(await v6(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:t2}}catch{}}throw b6()}async function w3($){let J=await qG($);return{path:J,sha256:NG("sha256").update(await v6(J)).digest("hex")}}async function g6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await WG(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await $2(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...TG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],FG]};return{worker:{...await w3(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function u6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=y6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?f6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,H=(V)=>Z6(V.organizationId,V.sessionId,V.deviceId,1),K=$.recording,N,q=S6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:H,...K?{resolveBrowser:async(V,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>k6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(V,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>zG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(V)=>I3({...V,endpoint:(U)=>({discover:(M)=>k6(M,Z),tabScope:H(U)})})});return{capability:G,broker:q}}function zG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as vG}from"child_process";import{execFile as OG}from"child_process";import{readFile as AG}from"fs/promises";import{join as $1}from"path";var RG="Claude Code-credentials",CG="/usr/bin/security",IG=120000,PG=8192,o2={exec:($,J,Z)=>new Promise((Q)=>{OG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await AG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=PG?$:null}function xG($,J){return $.CLAUDE_CONFIG_DIR||$1(J,".claude")}function EG($,J){return $.CODEX_HOME||$1(J,".codex")}function d6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function SG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function wG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:SG(Z)??Date.now()}}catch{return null}}function bG($,J){return $1($.XDG_DATA_HOME||$1(J,".local","share"),"opencode","auth.json")}var kG={anthropic:"anthropic",openai:"openai-codex"};function yG($){return s6($,kG)}function s6($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let H=T$(G.access),K=T$(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(H&&K&&N!==null)Q.push({provider:Y,access:H,refresh:K,expires:N})}return Q}catch{return[]}}function fG($){return s6($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function hG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?$1(J,Z.slice(2)):Z||$1(J,".pi","agent")}async function a6($,J,Z=o2){let Q=[],X=await Z.exec(CG,["find-generic-password","-s",RG,"-w"],IG),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?d6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(d6(await Z.readText($1(xG($,J),".credentials.json"))));let H=wG(await Z.readText($1(EG($,J),"auth.json")));G(H),G(mG(await Z.readText($1($.GROK_HOME||$1(J,".grok"),"auth.json"))));for(let K of yG(await Z.readText(bG($,J))))G(K);for(let K of fG(await Z.readText($1(hG($,J),"auth.json"))))G(K);return Q}function i6($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var l6="https://auth.x.ai",p6="b1a00492-073a-47ea-816f-4c329264a828",c6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function mG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${l6}::${p6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==l6||Q.oidc_client_id!==p6||!c6(Q.key)||!c6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var n6=330000,gG=300000,uG=60000;function dG($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+n6)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function lG($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*n6)?uG:gG}var pG=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function r6($){let J=new Map,Z=$.wait??pG,Q=$.stores??(process.platform==="darwin"?o2:{...o2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=i6(await a6($.environment??process.env,$.home,Q));for(let Y of dG(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(lG(J),$.signal)}}function t6($=process.env){return new Promise((J)=>{vG("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as cG,spawn as D_,spawnSync as j_}from"child_process";import{chmodSync as O_,existsSync as sG,mkdirSync as A_,readFileSync as R_,renameSync as C_,rmSync as I_,statSync as P_,writeFileSync as x_}from"fs";import{dirname as S_,isAbsolute as w_,join as y3}from"path";var o6=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function e6($,J){if(!o6.test($)||!o6.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var aG="com.reasonmachines.updater",iG=["so.ara.updater","so.reason.updater"];function nG($){let J=$==="staging"?".staging":"";return{label:`${aG}${J}`,legacyLabels:[...iG].reverse().map((Z)=>`${Z}${J}`)}}function rG($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function tG($,J){return new Promise((Z)=>{cG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function Z7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=nG($.channel),G=$.configHome??J7(Q),H=[X,...Y].filter((V)=>{let U=rG(V,Q,G);return sG(J==="darwin"?U.launchAgent:U.systemdService)});if(H.length===0)return"absent";let K=$.command??tG,N=H[0];if(H.length>1){for(let V of H)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${V}`]):await K("systemctl",["--user","is-enabled",`${V}.timer`]))===0){N=V;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var $7=60000;function Q7($){let J=(X,Y)=>{try{return e6(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min($7-1,Math.floor(G*$7)))}}var oG=30000;async function X7($){return($.flush??_8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(oG);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var G7=25000,$B=5000,JB=600000,ZB=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return u0(),z7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var B7=5000,QB=600000;function XB($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[a1])return null;try{return C2({platform:J})}catch{return null}}function YB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function GB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)g$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)g$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Q2($,J,Z,Q,X={}){if(u0(),$.executionMode==="host")Z2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let H=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?D7():Promise.resolve(!1),q=T7().then((y)=>y.status==="resolved",()=>!1),V=X.prestartedReadiness??i$($,X.readinessProbes,H,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?V.initial:V.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??t6)().catch(()=>!1):null,D=new AbortController,j=null,z=async(y,i)=>{let I0=($.userChrome??X.ownComputer===!0)&&y["automation.call.v1"]===!0?L7():null;if(I0&&"code"in I0)process.stderr.write(`Reason worker: your own Chrome unavailable (${I0.code})
+`);let a=g3($,y,{displayVideo:y["display.stream.v1"]===!0&&await N(),handsBrowser:y["hands.connect"]===!0&&await q,userChrome:I0&&"host"in I0?I0.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:y["pty.start"]===!0&&d2(),probing:i});if(!j&&a.worker.readiness?.["browser.pr-proof.v1"]===!0){let M0=await g6();if(j||D.signal.aborted)return a;process.stderr.write("error"in M0?`Reason worker: PR video proof unavailable (${M0.error})
 `:`Reason worker: PR video proof ready (ffmpeg ${M0.encoder.ffmpeg.path})
-`),j=g6({assertCurrent:async()=>{if(!l())throw Error("proof_authority_lost")},...!("error"in M0)?{recording:M0}:{}})}return a},F=await z(M,U?F3.filter((y)=>M[y]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,C=0,P="starting",R=null,I=!1,E=!1,w=null,h,l=()=>!G.drained&&!W&&Date.parse(Y)>Date.now()&&O.supported_operations.some((y)=>F.worker.readiness?.[y]===!0),k=null,x=()=>L+(k?.claims()??0),S=null,A=new Set,f=(y)=>{let i=y.capabilities.root_paths;if(Object.assign(y.capabilities,m3(y.config,y.state,F,j?.capability)),i)y.capabilities.root_paths=i},b=(y)=>{F=y,f({config:$,state:J,capabilities:O}),S?.();for(let i of A)f(i),i.heartbeatNow?.()},n=new Set,o=new Set,N0=setInterval(()=>{let y=new Set;for(let i of[{state:J,capabilities:O},...A])for(let B0 of $B){if(i.capabilities.operation_constraints?.[B0]?.probing!==!0)continue;let a=`${i.state.deviceId} ${B0}`;if(y.add(a),!n.has(a)||o.has(a))continue;o.add(a),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:i.state.deviceId,lane:B0,login_device:i.state===J,timestamp:new Date().toISOString()})}
-`)}n.clear();for(let i of y)n.add(i)},eG);N0.unref();let j0=(y)=>{if(!X.readinessProbes)c5({config:$,readiness:y,signal:D.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(i)=>{z(i,[]).then(b)}})},P1=U?V.final.then(async(y)=>{if(D.signal.aborted)return;b(await z(y,[]));let i=F3.filter((B0)=>y[B0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${i.length?`ready: ${i.join(", ")}`:"none ready"}).
-`),j0(y)},()=>{}):Promise.resolve();if(!U)j0(M);_?.then(async(y)=>{T=y;for(;;){let i=F,B0=await z(i.worker.readiness??{},i.worker.probing??[]);if(D.signal.aborted)return;if(F!==i)continue;b(B0);return}});let F1=U&&F.worker.probing?.includes("pty.start")?V.pty.then(async(y)=>{let i=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!i())return;let B0=await z({...F.worker.readiness,"pty.start":y},(F.worker.probing??[]).filter((I0)=>I0!=="pty.start"));if(D.signal.aborted||!i())return;b(B0)},()=>{}):Promise.resolve(),r1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:P,drained:G.drained||W||I,activeClaims:x(),activeSessions:C,lastHeartbeat:R,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:l()&&!I&&P==="running"}),x1=!1,E1=()=>{x1=!0,a0()},a0=()=>{if(W)return;if(W=!0,P="stopping",w?.close(),x()===0)D.abort();else h=setTimeout(()=>D.abort(),$.shutdownGraceMs)},S1=$.channel==="production"||$.channel==="staging"?$.channel:null,O$=d($).releaseCheck,W1=X.publishedRelease??(S1&&$.lifetime==="persistent"?Z7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let y=JSON.parse(s(O$));return typeof y==="string"?y:null}catch{return null}})(),check:async(y)=>{try{c(O$,y)}catch{}let i=await J7({channel:S1});process.stderr.write(i==="started"?`Reason worker: CLI ${y} is published; the updater is checking now.
+`),j=u6({assertCurrent:async()=>{if(!l())throw Error("proof_authority_lost")},...!("error"in M0)?{recording:M0}:{}})}return a},F=await z(M,U?F3.filter((y)=>M[y]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,C=0,P="starting",R=null,I=!1,E=!1,w=null,h,l=()=>!G.drained&&!W&&Date.parse(Y)>Date.now()&&O.supported_operations.some((y)=>F.worker.readiness?.[y]===!0),k=null,x=()=>L+(k?.claims()??0),S=null,A=new Set,f=(y)=>{let i=y.capabilities.root_paths;if(Object.assign(y.capabilities,m3(y.config,y.state,F,j?.capability)),i)y.capabilities.root_paths=i},b=(y)=>{F=y,f({config:$,state:J,capabilities:O}),S?.();for(let i of A)f(i),i.heartbeatNow?.()},n=new Set,o=new Set,N0=setInterval(()=>{let y=new Set;for(let i of[{state:J,capabilities:O},...A])for(let B0 of ZB){if(i.capabilities.operation_constraints?.[B0]?.probing!==!0)continue;let a=`${i.state.deviceId} ${B0}`;if(y.add(a),!n.has(a)||o.has(a))continue;o.add(a),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:i.state.deviceId,lane:B0,login_device:i.state===J,timestamp:new Date().toISOString()})}
+`)}n.clear();for(let i of y)n.add(i)},JB);N0.unref();let j0=(y)=>{if(!X.readinessProbes)s5({config:$,readiness:y,signal:D.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(i)=>{z(i,[]).then(b)}})},P1=U?V.final.then(async(y)=>{if(D.signal.aborted)return;b(await z(y,[]));let i=F3.filter((B0)=>y[B0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${i.length?`ready: ${i.join(", ")}`:"none ready"}).
+`),j0(y)},()=>{}):Promise.resolve();if(!U)j0(M);_?.then(async(y)=>{T=y;for(;;){let i=F,B0=await z(i.worker.readiness??{},i.worker.probing??[]);if(D.signal.aborted)return;if(F!==i)continue;b(B0);return}});let F1=U&&F.worker.probing?.includes("pty.start")?V.pty.then(async(y)=>{let i=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!i())return;let B0=await z({...F.worker.readiness,"pty.start":y},(F.worker.probing??[]).filter((I0)=>I0!=="pty.start"));if(D.signal.aborted||!i())return;b(B0)},()=>{}):Promise.resolve(),r1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:P,drained:G.drained||W||I,activeClaims:x(),activeSessions:C,lastHeartbeat:R,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:l()&&!I&&P==="running"}),x1=!1,E1=()=>{x1=!0,a0()},a0=()=>{if(W)return;if(W=!0,P="stopping",w?.close(),x()===0)D.abort();else h=setTimeout(()=>D.abort(),$.shutdownGraceMs)},S1=$.channel==="production"||$.channel==="staging"?$.channel:null,O$=d($).releaseCheck,W1=X.publishedRelease??(S1&&$.lifetime==="persistent"?Q7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let y=JSON.parse(s(O$));return typeof y==="string"?y:null}catch{return null}})(),check:async(y)=>{try{c(O$,y)}catch{}let i=await Z7({channel:S1});process.stderr.write(i==="started"?`Reason worker: CLI ${y} is published; the updater is checking now.
 `:i==="absent"?`Reason worker: CLI ${y} is published; no updater is installed for it here.
 `:`Reason worker: CLI ${y} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),v=(y)=>{if(y==="stop")E1();if(y==="reload_roots"){let i=t($);if(!i||i.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=i.roots;let B0=D7(J.roots,X7());if(B0)O.root_paths=B0;else delete O.root_paths;k?.check()}if(y==="drain"||y==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:y==="drain"},x0($,G)}return r1()};X.prestartedControl?.handle(v);let Y0=X.prestartedControl?await X.prestartedControl.closed:await y2($,Q,v),L1,i0=!1,A$=()=>{let y=Date.parse(Y)-Date.now();if(y>0){L1=setTimeout(A$,Math.min(y,2147483647));return}W=!0,w?.close(),i0=!0,P="stopping",D.abort(Error("worker_credential_expired"))};A$(),X.signal?.addEventListener("abort",a0,{once:!0});let g0=X.processSignals!==!1;if(g0)process.once("SIGTERM",a0),process.once("SIGINT",E1);if(X.signal?.aborted)a0();try{X.onStartup?.("control_ready");let y=X.client??new $2(J1($.apiOrigin),k0($.proxy,B7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),i=d($).daemon,B0=R4($,J.deviceId),I0=X.startupTiming,a=I0?()=>({...I0(),...B0?.enrollmentMs!==void 0?{enrollment_ms:B0.enrollmentMs}:{}}):void 0,M0=(m)=>{let n0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&n0)(X.handOverLocalLogins??n6)({state:m.state,client:{localSubscription:n0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=X7(),w0=m.client.liveSessionWorktrees?.bind(m.client);if(w0)N7(()=>H7({home:W0,deviceId:m.state.deviceId,liveIds:(D1)=>w0(m.state,D1,m.signal)}),m.signal)};M0({state:J,client:y,signal:D.signal});let l0=ZB($,X.platform??process.platform),w1=y.deviceLifecycle?.bind(y),t1=Promise.resolve(),R0=0,S0=()=>{if(!l0||!w1||W||Date.now()<R0)return;R0=Date.now()+JB,t1=t1.then(()=>Q7({paths:l0,device:J,client:{deviceLifecycle:w1},accept:QB,signal:D.signal})).catch(()=>{return})};if(S0(),l0)V.final.then((m)=>XB(l0,m),()=>{});let R$=(m,n0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+_7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:Y7,operationCompletionTimeoutMs:Y7,maxConsecutiveHeartbeatFailures:3,claimable:l,onClaim:async(W0,w0,D1)=>{let I$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let r0=F.worker.probing??[],K9=r0.includes(W0.capability)?P1:W0.capability==="hands.connect"&&$.executionMode==="host"&&r0.includes("pty.start")?F1:null;if(K9){let N2,L4=()=>{};await Promise.race([K9,new Promise((V9)=>{N2=setTimeout(V9,oG),L4=()=>V9(),w0.addEventListener("abort",L4,{once:!0})})]),clearTimeout(N2),w0.removeEventListener("abort",L4)}let H2=W0.capability==="hands.connect",W4=H2?w:null,lJ={signal:w0,emit:D1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(N2)=>m.client.operationCustomEndpointCredential(m.state,W0,N2)}:{},...H2?{handsLaunch:{claimedAtMs:I$,...W4?{takePrespawnedWorker:W4.take,adoptSpawnedWorker:W4.adopt}:{}}}:{}};if(H2)C+=1;try{return await(X.execute??u3)(m.state,W0,lJ)}finally{if(H2)C-=1}},onControl:async(W0,w0)=>await z7(m.state,W0,w0,m.client)||await O7(m.state,W0,w0)||await F7(W0,w0)||await j?.broker.control(W0,w0)||!1,onEvent:n0}),V2=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:tG(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(G7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,G9=y.ownerWorkspaces?.bind(y),B9=y.ownerWorkspaceEnrollment?.bind(y);if(C$&&G9&&B9)k=a9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:G9,ownerWorkspaceEnrollment:B9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,n0,W0)=>{let w0=R4(m.config,m.state.deviceId),D1={config:m.config,state:m.state,signal:n0,statusPath:d(m.config).daemon,...w0?.offer?{firstHeartbeat:w0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new $2(J1($.apiOrigin),k0($.proxy,B7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};M0(D1);let I$={...D1,heartbeatNow:null};A.add(I$);try{await K3({registerHeartbeatNow:(r0)=>{I$.heartbeatNow=r0},...R$(D1,(r0)=>{if(r0.type==="completed")v3(r0.operationId,r0.status);if(r0.type==="claims_changed"){if(W0(r0.activeClaims),W&&x()===0)D.abort()}if(r0.type==="stopped")W0(0)})})}finally{A.delete(I$)}if(W&&!i0)await V2(D1)}});let T4=0,_4=0,F4=C$?.intervalMs??d9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?S2(i):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{S=m},...a?{startup:a}:{},...R$({state:J,client:y,capabilities:O,signal:D.signal,statusPath:i,...B0?.offer?{firstHeartbeat:B0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&x()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!w)w=q7({log:(n0,W0)=>{process.stderr.write(`${JSON.stringify({event:n0,...W0})}
-`)}}),w.arm(),setTimeout(T7,0);else if(!m.handsPrespawn&&w)w.close(),w=null}if(m.type==="heartbeat"){if(k&&!W&&Date.now()>=T4)T4=Date.now()+F4,k.check().then((n0)=>{_4=n0?0:_4+1,T4=Date.now()+(n0?F4:Math.min(F4,l9*2**Math.min(_4-1,10)))});if(R=m.serverTime,I=m.drain,S0(),!W&&S1)W1?.(m.latestCliVersions?.[S1]);if(!W)P="running";if(!W&&!E&&r1().executionEligible){if(E=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)P="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await k?.settled(),W&&!i0&&$.lifetime==="ephemeral")await y.disconnect?.(J,AbortSignal.timeout(G7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(W&&!i0)await V2({state:J,client:y});if(x1)await U7().catch(()=>{return})}catch(y){if(!(y instanceof _0&&y.status===401))throw y;if(x0($,{...G,revoked:!0}),y.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(L1),clearInterval(N0),h)clearTimeout(h);if(g0)process.removeListener("SIGTERM",a0),process.removeListener("SIGINT",E1);X.signal?.removeEventListener("abort",a0),D.abort(),w?.close(),await k?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await Y0()}}function B7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(K7,V7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as YB,sign as GB}from"crypto";var A7=65536,BB=65536;function KB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new X0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new X0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!C7(X))throw new X0("invalid_public_key");return X}function R7(){try{let{privateKey:$,publicKey:J}=YB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:KB(J)}}catch($){if($ instanceof X0)throw $;throw new X0("proof_key_generation_failed")}}class Q2{keyPair=R7();binding=null;loadPublicKey(){if(!this.keyPair)throw new X0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=R7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>BB)throw new X0("proof_sign_failed");let J;try{J=GB("sha256",$,this.keyPair.privateKey)}catch{throw new X0("proof_sign_failed")}if(!I7(J))throw new X0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>A7)throw new X0("invalid_binding");if(this.binding)throw new X0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>A7)throw new X0("invalid_binding");if(!this.binding)throw new X0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as TB,spawn as _B}from"child_process";import{isAbsolute as FB}from"path";import{promisify as WB}from"util";var X2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class Y2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=X2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
-`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as VB}from"crypto";import{unlinkSync as HB}from"fs";import{join as NB}from"path";var G2=1,e2=45000,UB=B.strictObject({type:B.literal("configure"),protocol:B.literal(G2),version:B.string(),config:J0}),qB=B.strictObject({type:B.literal("ticket"),organizationId:B.string().min(1).max(160),receipt:B.unknown()}),MB=B.strictObject({type:B.enum(["ping","stop"])});async function P7($={}){let J=$.clock??X2,Z=new Y2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,H,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:V,version:U}=UB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(N1(V),e(g(V),!0),H=Y1({path:d(V).lock,runtimeVersion:r}),!H.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=NB(g(V),`ssh-preflight-${VB()}.json`);try{c(M,{version:1}),s(M)}finally{try{HB(M)}catch{}}let T=t(V),_=$0(V);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&V.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:G2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=V.lifetime==="ephemeral"?K=new Q2:T0(V,!0);if(!T){let W=A1(V);await Z.send({type:"ticket-request",request:W.request});let L=qB.parse(await Z.receive(70000,Q.signal)),C=W.complete(L.organizationId,L.receipt);if(T=await X1(V,C,D,$.enroll),V.lifetime==="persistent")m0(T,d(V).state,{proofStore:D});x0(V,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(MB.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min(e2,$.startupTimeoutMs??e2)),()=>{F=!0,Y()});let O=H.owner.nonce;if(await Z2(V,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(V,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:V.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(V){let U=V instanceof Error&&/^worker_[a-z_]+$/.test(V.message)?V.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),H?.acquired)H.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>FB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,LB=B.strictObject({type:B.literal("hello"),protocol:B.literal(G2),version:B.string(),platform:B.enum(["linux","darwin"]),architecture:B.enum(["arm64","x64"]),enrolled:B.boolean()}),DB=B.strictObject({type:B.literal("ticket-request"),request:B.strictObject({install_id:B.uuid(),code_challenge:B.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:B.enum(["persistent","ephemeral"]),roots:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),execution_mode:B.enum(["confined","host"]),permissions:B.strictObject({read:B.literal(!0),write:B.literal(!0),execute:B.literal(!0),discover_environment:B.literal(!0),expose_mcp:B.literal(!1)})})).length(1)})}),x7=B.discriminatedUnion("type",[B.strictObject({type:B.literal("running"),deviceId:B.string().min(1).max(160),expiresAt:B.iso.datetime({offset:!0}),lifetime:B.enum(["persistent","ephemeral"]),supervision:B.literal("ssh-foreground")}),B.strictObject({type:B.literal("pong")}),B.strictObject({type:B.literal("stopped")})]),jB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function $4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&jB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function E7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
+`)}}):void 0),v=(y)=>{if(y==="stop")E1();if(y==="reload_roots"){let i=t($);if(!i||i.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=i.roots;let B0=j7(J.roots,Y7());if(B0)O.root_paths=B0;else delete O.root_paths;k?.check()}if(y==="drain"||y==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:y==="drain"},x0($,G)}return r1()};X.prestartedControl?.handle(v);let Y0=X.prestartedControl?await X.prestartedControl.closed:await y2($,Q,v),L1,i0=!1,A$=()=>{let y=Date.parse(Y)-Date.now();if(y>0){L1=setTimeout(A$,Math.min(y,2147483647));return}W=!0,w?.close(),i0=!0,P="stopping",D.abort(Error("worker_credential_expired"))};A$(),X.signal?.addEventListener("abort",a0,{once:!0});let g0=X.processSignals!==!1;if(g0)process.once("SIGTERM",a0),process.once("SIGINT",E1);if(X.signal?.aborted)a0();try{X.onStartup?.("control_ready");let y=X.client??new J2(J1($.apiOrigin),k0($.proxy,K7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),i=d($).daemon,B0=R4($,J.deviceId),I0=X.startupTiming,a=I0?()=>({...I0(),...B0?.enrollmentMs!==void 0?{enrollment_ms:B0.enrollmentMs}:{}}):void 0,M0=(m)=>{let n0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&n0)(X.handOverLocalLogins??r6)({state:m.state,client:{localSubscription:n0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=Y7(),w0=m.client.liveSessionWorktrees?.bind(m.client);if(w0)U7(()=>N7({home:W0,deviceId:m.state.deviceId,liveIds:(D1)=>w0(m.state,D1,m.signal)}),m.signal)};M0({state:J,client:y,signal:D.signal});let l0=XB($,X.platform??process.platform),w1=y.deviceLifecycle?.bind(y),t1=Promise.resolve(),R0=0,S0=()=>{if(!l0||!w1||W||Date.now()<R0)return;R0=Date.now()+QB,t1=t1.then(()=>X7({paths:l0,device:J,client:{deviceLifecycle:w1},accept:YB,signal:D.signal})).catch(()=>{return})};if(S0(),l0)V.final.then((m)=>GB(l0,m),()=>{});let R$=(m,n0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+F7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:G7,operationCompletionTimeoutMs:G7,maxConsecutiveHeartbeatFailures:3,claimable:l,onClaim:async(W0,w0,D1)=>{let I$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let r0=F.worker.probing??[],K9=r0.includes(W0.capability)?P1:W0.capability==="hands.connect"&&$.executionMode==="host"&&r0.includes("pty.start")?F1:null;if(K9){let U2,L4=()=>{};await Promise.race([K9,new Promise((V9)=>{U2=setTimeout(V9,$B),L4=()=>V9(),w0.addEventListener("abort",L4,{once:!0})})]),clearTimeout(U2),w0.removeEventListener("abort",L4)}let N2=W0.capability==="hands.connect",W4=N2?w:null,pJ={signal:w0,emit:D1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(U2)=>m.client.operationCustomEndpointCredential(m.state,W0,U2)}:{},...N2?{handsLaunch:{claimedAtMs:I$,...W4?{takePrespawnedWorker:W4.take,adoptSpawnedWorker:W4.adopt}:{}}}:{}};if(N2)C+=1;try{return await(X.execute??u3)(m.state,W0,pJ)}finally{if(N2)C-=1}},onControl:async(W0,w0)=>await O7(m.state,W0,w0,m.client)||await A7(m.state,W0,w0)||await W7(W0,w0)||await j?.broker.control(W0,w0)||!1,onEvent:n0}),H2=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:eG(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(B7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,G9=y.ownerWorkspaces?.bind(y),B9=y.ownerWorkspaceEnrollment?.bind(y);if(C$&&G9&&B9)k=i9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:G9,ownerWorkspaceEnrollment:B9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,n0,W0)=>{let w0=R4(m.config,m.state.deviceId),D1={config:m.config,state:m.state,signal:n0,statusPath:d(m.config).daemon,...w0?.offer?{firstHeartbeat:w0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new J2(J1($.apiOrigin),k0($.proxy,K7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};M0(D1);let I$={...D1,heartbeatNow:null};A.add(I$);try{await K3({registerHeartbeatNow:(r0)=>{I$.heartbeatNow=r0},...R$(D1,(r0)=>{if(r0.type==="completed")v3(r0.operationId,r0.status);if(r0.type==="claims_changed"){if(W0(r0.activeClaims),W&&x()===0)D.abort()}if(r0.type==="stopped")W0(0)})})}finally{A.delete(I$)}if(W&&!i0)await H2(D1)}});let T4=0,_4=0,F4=C$?.intervalMs??l9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?S2(i):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{S=m},...a?{startup:a}:{},...R$({state:J,client:y,capabilities:O,signal:D.signal,statusPath:i,...B0?.offer?{firstHeartbeat:B0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&x()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!w)w=M7({log:(n0,W0)=>{process.stderr.write(`${JSON.stringify({event:n0,...W0})}
+`)}}),w.arm(),setTimeout(_7,0);else if(!m.handsPrespawn&&w)w.close(),w=null}if(m.type==="heartbeat"){if(k&&!W&&Date.now()>=T4)T4=Date.now()+F4,k.check().then((n0)=>{_4=n0?0:_4+1,T4=Date.now()+(n0?F4:Math.min(F4,p9*2**Math.min(_4-1,10)))});if(R=m.serverTime,I=m.drain,S0(),!W&&S1)W1?.(m.latestCliVersions?.[S1]);if(!W)P="running";if(!W&&!E&&r1().executionEligible){if(E=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)P="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await k?.settled(),W&&!i0&&$.lifetime==="ephemeral")await y.disconnect?.(J,AbortSignal.timeout(B7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
+`)});else if(W&&!i0)await H2({state:J,client:y});if(x1)await q7().catch(()=>{return})}catch(y){if(!(y instanceof _0&&y.status===401))throw y;if(x0($,{...G,revoked:!0}),y.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(L1),clearInterval(N0),h)clearTimeout(h);if(g0)process.removeListener("SIGTERM",a0),process.removeListener("SIGINT",E1);X.signal?.removeEventListener("abort",a0),D.abort(),w?.close(),await k?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await Y0()}}function K7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(V7,H7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as BB,sign as KB}from"crypto";var R7=65536,VB=65536;function HB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new X0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new X0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!I7(X))throw new X0("invalid_public_key");return X}function C7(){try{let{privateKey:$,publicKey:J}=BB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:HB(J)}}catch($){if($ instanceof X0)throw $;throw new X0("proof_key_generation_failed")}}class X2{keyPair=C7();binding=null;loadPublicKey(){if(!this.keyPair)throw new X0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=C7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>VB)throw new X0("proof_sign_failed");let J;try{J=KB("sha256",$,this.keyPair.privateKey)}catch{throw new X0("proof_sign_failed")}if(!P7(J))throw new X0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>R7)throw new X0("invalid_binding");if(this.binding)throw new X0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>R7)throw new X0("invalid_binding");if(!this.binding)throw new X0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as FB,spawn as WB}from"child_process";import{isAbsolute as LB}from"path";import{promisify as DB}from"util";var Y2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class G2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=Y2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
+`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as NB}from"crypto";import{unlinkSync as UB}from"fs";import{join as qB}from"path";var B2=1,e2=45000,MB=B.strictObject({type:B.literal("configure"),protocol:B.literal(B2),version:B.string(),config:J0}),TB=B.strictObject({type:B.literal("ticket"),organizationId:B.string().min(1).max(160),receipt:B.unknown()}),_B=B.strictObject({type:B.enum(["ping","stop"])});async function x7($={}){let J=$.clock??Y2,Z=new G2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,H,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:V,version:U}=MB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(N1(V),e(g(V),!0),H=Y1({path:d(V).lock,runtimeVersion:r}),!H.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=qB(g(V),`ssh-preflight-${NB()}.json`);try{c(M,{version:1}),s(M)}finally{try{UB(M)}catch{}}let T=t(V),_=$0(V);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&V.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:B2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=V.lifetime==="ephemeral"?K=new X2:T0(V,!0);if(!T){let W=A1(V);await Z.send({type:"ticket-request",request:W.request});let L=TB.parse(await Z.receive(70000,Q.signal)),C=W.complete(L.organizationId,L.receipt);if(T=await X1(V,C,D,$.enroll),V.lifetime==="persistent")m0(T,d(V).state,{proofStore:D});x0(V,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(_B.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min(e2,$.startupTimeoutMs??e2)),()=>{F=!0,Y()});let O=H.owner.nonce;if(await Q2(V,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(V,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:V.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(V){let U=V instanceof Error&&/^worker_[a-z_]+$/.test(V.message)?V.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),H?.acquired)H.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>LB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,jB=B.strictObject({type:B.literal("hello"),protocol:B.literal(B2),version:B.string(),platform:B.enum(["linux","darwin"]),architecture:B.enum(["arm64","x64"]),enrolled:B.boolean()}),zB=B.strictObject({type:B.literal("ticket-request"),request:B.strictObject({install_id:B.uuid(),code_challenge:B.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:B.enum(["persistent","ephemeral"]),roots:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),execution_mode:B.enum(["confined","host"]),permissions:B.strictObject({read:B.literal(!0),write:B.literal(!0),execute:B.literal(!0),discover_environment:B.literal(!0),expose_mcp:B.literal(!1)})})).length(1)})}),E7=B.discriminatedUnion("type",[B.strictObject({type:B.literal("running"),deviceId:B.string().min(1).max(160),expiresAt:B.iso.datetime({offset:!0}),lifetime:B.enum(["persistent","ephemeral"]),supervision:B.literal("ssh-foreground")}),B.strictObject({type:B.literal("pong")}),B.strictObject({type:B.literal("stopped")})]),OB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function $4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&OB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function S7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
 a=${d3($.remoteCli)}
 [ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
 p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
@@ -101,11 +101,11 @@ elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
 else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
 h=\${h%% *}
 [ "$h" = ${d3($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function S7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,E7($)]}function zB($){return S7($,!1)}function w7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function OB($){let J;try{({stdout:J}=await WB(TB)("/usr/bin/ssh",["-G",...S7($,!0)],{env:w7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
-`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function AB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function RB($){await OB($);let J=_B("/usr/bin/ssh",zB($),{stdio:["pipe","pipe","pipe"],env:w7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=AB(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function CB($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let H=$[G];if(H==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(H)||J.has(H))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(H,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let H=J.get(G);if(!H)throw Error("worker_required_input_missing");return H},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");E7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(B2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function IB($,J,Z,Q,X){let{request:Y}=DB.parse($4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},H=(async()=>{G();let N=Z??z1(J),q=await(Q.enrollmentCredentials??O1)(J,N);if(G(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=Q.createTicketClient?.(q)??new H1(q,{credentialsPath:N}),U=S4(await V.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([H,new Promise((q,V)=>{if(K=()=>V(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function b7($,J={}){let{config:Z,target:Q,credentialPath:X}=CB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??X2,G=await(J.sshTransport??RB)(Q),H=new Y2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),q,V;if(G.result.then((U)=>{V=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await H.send({type:"configure",protocol:G2,version:r,config:Z});let U=LB.parse($4(await H.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await IB(H,Z,X,J,AbortSignal.any([K.signal,H.signal]));q=Y.every(1e4,()=>{H.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:x4)+e2+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=x7.parse($4(await H.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
-`)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await H.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(x7.parse($4(await H.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=V??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),H.dispose()}}import{createConnection as wB}from"net";import{WebSocket as J4}from"ws";var PB=1,F$=65536,k7=4096,y7=67108864,f7=4194304,_$=B.uuid(),xB=B.strictObject({kind:B.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:B.literal("install"),generation:B.number().int().positive(),transport:B.literal("reverse_ssh"),expiresAt:B.iso.datetime({offset:!0}),maxDurationMs:B.literal(300000),maxChannels:B.literal(1),allowTcpForwarding:B.literal(!1),allowPty:B.literal(!1)}),EB=B.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var SB=B.strictObject({protocol:B.literal(PB),type:B.literal("ssh_install_relay"),authorityToken:B.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:xB,relayUrl:EB,endpoint:B.strictObject({host:B.literal("127.0.0.1"),port:B.literal(22)})});function p3($,J=Date.now()){let Z=SB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function h7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function m7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var v7="ssh_install_relay_closed";function bB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function kB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function yB($,J=v7){try{$.close(1000,J)}catch{$.terminate()}}async function fB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new J4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>wB({host:"127.0.0.1",port:22})),G,H=!1,K=!1,N=0,q=0,V,U=(W)=>{if(V)clearTimeout(V);V=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),V.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=v7)=>{if(K)return;if(K=!0,V)clearTimeout(V);if($.signal?.removeEventListener("abort",D),G?.destroy(),X.readyState===J4.OPEN)yB(X,W);else if(X.readyState!==J4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=k7&&q<=y7},F=(W)=>{if(K||!H||X.readyState!==J4.OPEN||X.bufferedAmount>f7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=h7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let C=bB(W);if(C>F$||!z(C))return j();if(!H){if(L)return j();try{let R=m7(JSON.parse(String(W)));if(R.type!=="ssh_install_relay_ready"||R.authorityId!==Z.authority.authorityId)return j();H=!0,U(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",j),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{j()}return}if(!L)return j();let P=kB(W);if(!P||!G||G.destroyed||!G.write(P))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function g7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await fB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as hB}from"crypto";var i1="ARA_WORKER_PREVIEW_PROBE";async function d7(){if(typeof Bun>"u")return 1;let $=hB(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,H){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(i1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&H.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,H){if(typeof H!=="string"||H.length>8192){G.close();return}if(!G.data.relay){if(H===i1)G.send(i1);else G.close();return}try{let K=u7(H),N=(q)=>G.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>i1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===i1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(i1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===i1&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
+exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function w7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,S7($)]}function AB($){return w7($,!1)}function b7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function RB($){let J;try{({stdout:J}=await DB(FB)("/usr/bin/ssh",["-G",...w7($,!0)],{env:b7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
+`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function CB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function IB($){await RB($);let J=WB("/usr/bin/ssh",AB($),{stdio:["pipe","pipe","pipe"],env:b7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=CB(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function PB($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let H=$[G];if(H==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(H)||J.has(H))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(H,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let H=J.get(G);if(!H)throw Error("worker_required_input_missing");return H},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");S7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(K2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function xB($,J,Z,Q,X){let{request:Y}=zB.parse($4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},H=(async()=>{G();let N=Z??z1(J),q=await(Q.enrollmentCredentials??O1)(J,N);if(G(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=Q.createTicketClient?.(q)??new H1(q,{credentialsPath:N}),U=S4(await V.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([H,new Promise((q,V)=>{if(K=()=>V(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function k7($,J={}){let{config:Z,target:Q,credentialPath:X}=PB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??Y2,G=await(J.sshTransport??IB)(Q),H=new G2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),q,V;if(G.result.then((U)=>{V=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await H.send({type:"configure",protocol:B2,version:r,config:Z});let U=jB.parse($4(await H.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await xB(H,Z,X,J,AbortSignal.any([K.signal,H.signal]));q=Y.every(1e4,()=>{H.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:x4)+e2+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=E7.parse($4(await H.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
+`)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await H.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(E7.parse($4(await H.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=V??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),H.dispose()}}import{createConnection as kB}from"net";import{WebSocket as J4}from"ws";var EB=1,F$=65536,y7=4096,f7=67108864,h7=4194304,_$=B.uuid(),SB=B.strictObject({kind:B.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:B.literal("install"),generation:B.number().int().positive(),transport:B.literal("reverse_ssh"),expiresAt:B.iso.datetime({offset:!0}),maxDurationMs:B.literal(300000),maxChannels:B.literal(1),allowTcpForwarding:B.literal(!1),allowPty:B.literal(!1)}),wB=B.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var bB=B.strictObject({protocol:B.literal(EB),type:B.literal("ssh_install_relay"),authorityToken:B.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:SB,relayUrl:wB,endpoint:B.strictObject({host:B.literal("127.0.0.1"),port:B.literal(22)})});function p3($,J=Date.now()){let Z=bB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function m7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function v7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var g7="ssh_install_relay_closed";function yB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function fB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function hB($,J=g7){try{$.close(1000,J)}catch{$.terminate()}}async function mB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new J4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>kB({host:"127.0.0.1",port:22})),G,H=!1,K=!1,N=0,q=0,V,U=(W)=>{if(V)clearTimeout(V);V=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),V.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=g7)=>{if(K)return;if(K=!0,V)clearTimeout(V);if($.signal?.removeEventListener("abort",D),G?.destroy(),X.readyState===J4.OPEN)hB(X,W);else if(X.readyState!==J4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=y7&&q<=f7},F=(W)=>{if(K||!H||X.readyState!==J4.OPEN||X.bufferedAmount>h7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=m7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let C=yB(W);if(C>F$||!z(C))return j();if(!H){if(L)return j();try{let R=v7(JSON.parse(String(W)));if(R.type!=="ssh_install_relay_ready"||R.authorityId!==Z.authority.authorityId)return j();H=!0,U(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",j),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{j()}return}if(!L)return j();let P=fB(W);if(!P||!G||G.destroyed||!G.write(P))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function u7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await mB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as vB}from"crypto";var i1="ARA_WORKER_PREVIEW_PROBE";async function l7(){if(typeof Bun>"u")return 1;let $=vB(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,H){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(i1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&H.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,H){if(typeof H!=="string"||H.length>8192){G.close();return}if(!G.data.relay){if(H===i1)G.send(i1);else G.close();return}try{let K=d7(H),N=(q)=>G.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>i1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===i1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(i1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===i1&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
 `);else throw Error("probe_protocol_failed")}catch{G.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
-`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as gB,createReadStream as uB,fstatSync as dB,readFileSync as lB}from"fs";var l7="/run/sc/instance-generation";var mB=/^[1-9][0-9]{0,15}\n?$/;function vB($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function p7($){if(typeof $!=="string"||!mB.test($))return null;let J=Number($.trim());return vB(J)?J:null}var c7=3,pB=600000,cB=65536,sB=500;function s7($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(c7))throw Error("worker_standby_invalid_invocation");return{handoffFd:c7}}function aB($=(J)=>lB(J,"utf8")){try{return p7($(l7))}catch{return null}}function iB($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=P4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var a7={isPipe:($)=>dB($).isFIFO(),stream:($)=>{let J=uB("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function nB($,J=a7){if(!J.isPipe($.fd)){try{gB($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??pB),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});G.catch(()=>{});let H=J.every(sB,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],V=0;for await(let U of Q.chunks){if(X)throw X;if(V===0)$.onArriving?.();if(V+=U.length,V>cB)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{H(),Q.close()}}async function i7($,J=a7){let Z=$.readGeneration??(()=>aB()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await nB({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return iB(Y)}var rB=`Usage: reason worker <command> --config PATH [--json]
+`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as dB,createReadStream as lB,fstatSync as pB,readFileSync as cB}from"fs";var p7="/run/sc/instance-generation";var gB=/^[1-9][0-9]{0,15}\n?$/;function uB($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function c7($){if(typeof $!=="string"||!gB.test($))return null;let J=Number($.trim());return uB(J)?J:null}var s7=3,sB=600000,aB=65536,iB=500;function a7($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(s7))throw Error("worker_standby_invalid_invocation");return{handoffFd:s7}}function nB($=(J)=>cB(J,"utf8")){try{return c7($(p7))}catch{return null}}function rB($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=P4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var i7={isPipe:($)=>pB($).isFIFO(),stream:($)=>{let J=lB("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function tB($,J=i7){if(!J.isPipe($.fd)){try{dB($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??sB),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});G.catch(()=>{});let H=J.every(iB,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],V=0;for await(let U of Q.chunks){if(X)throw X;if(V===0)$.onArriving?.();if(V+=U.length,V>aB)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{H(),Q.close()}}async function n7($,J=i7){let Z=$.readGeneration??(()=>nB()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await tB({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return rB(Y)}var oB=`Usage: reason worker <command> --config PATH [--json]
 
   enroll                        Obtain/redeem a ticket using the current Reason login
   start                         Run the existing Device daemon in the foreground
@@ -146,15 +146,15 @@ Pretrust known_hosts. No agent forwarding, automatic installation or detached se
 SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
 are not forwarded/supported; running is not a browser-readiness receipt.
 Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function tB($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let H=0;H<Z.length;H++){let K=Z[H];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++H];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var oB=1e4,eB=2000,n7=15000,$K=50;async function t7($,J,Z,Q,X,Y){let G=new Q2,H=new AbortController,K,N,q=new Promise((P,R)=>{K=P,N=R});if(q.catch(()=>{}),u0(),$.executionMode==="host")J2();Z("enrollment_started");let V=X(G);V.catch(()=>{});let U=null,M=y2($,J,(P)=>{if(!U)throw Error("worker_starting");return U(P)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([H.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((P)=>{z=P}),O=setTimeout(()=>z(),oB);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(P)=>{if(P==="ready")W=setTimeout(()=>z(),eB);Q.onStartup?.(P)},C=a$($,Q.readinessProbes,D,q,void 0,j,F);C.final.catch(()=>{});try{let P;try{P=await V}catch(R){throw H.abort(),N(Error("worker_enrollment_failed")),await C.final.catch(()=>{}),await M.then((I)=>I(),()=>{}),R}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(n7,Date.parse(P.worker?.expiresAt??"")-Date.now()||n7))),K(P.roots[0].permissions),x0($,{version:1,drained:!1,revoked:!1}),await Z2($,P,G,J,{...Q,onStartup:L,prestartedReadiness:C,prestartedControl:{closed:M,handle:(R)=>{U=R}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),H.abort(),G.deleteBinding(),G.deleteKey(),await M.then((P)=>P(),()=>{})}}async function JK($,J,Z,Q){let{handoffFd:X}=s7($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,H=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>s$(T);if(K||!M)return;try{u0(),J2()}catch{return}if(Y=S5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{d2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??i7)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(H,$K)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
-`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:V,enrollment:U}=q;try{e(g(V),!0);let M=await o7(V,()=>{});try{if(Q("lock_acquired"),t(V))throw Error("worker_ephemeral_requires_fresh_enrollment");return N1(V),await t7(V,M.owner.nonce,Q,Z,(T)=>X1(V,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function M1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
+`;function eB($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let H=0;H<Z.length;H++){let K=Z[H];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++H];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var $K=1e4,JK=2000,r7=15000,ZK=50;async function o7($,J,Z,Q,X,Y){let G=new X2,H=new AbortController,K,N,q=new Promise((P,R)=>{K=P,N=R});if(q.catch(()=>{}),u0(),$.executionMode==="host")Z2();Z("enrollment_started");let V=X(G);V.catch(()=>{});let U=null,M=y2($,J,(P)=>{if(!U)throw Error("worker_starting");return U(P)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([H.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((P)=>{z=P}),O=setTimeout(()=>z(),$K);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(P)=>{if(P==="ready")W=setTimeout(()=>z(),JK);Q.onStartup?.(P)},C=i$($,Q.readinessProbes,D,q,void 0,j,F);C.final.catch(()=>{});try{let P;try{P=await V}catch(R){throw H.abort(),N(Error("worker_enrollment_failed")),await C.final.catch(()=>{}),await M.then((I)=>I(),()=>{}),R}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(r7,Date.parse(P.worker?.expiresAt??"")-Date.now()||r7))),K(P.roots[0].permissions),x0($,{version:1,drained:!1,revoked:!1}),await Q2($,P,G,J,{...Q,onStartup:L,prestartedReadiness:C,prestartedControl:{closed:M,handle:(R)=>{U=R}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),H.abort(),G.deleteBinding(),G.deleteKey(),await M.then((P)=>P(),()=>{})}}async function QK($,J,Z,Q){let{handoffFd:X}=a7($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,H=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>a$(T);if(K||!M)return;try{u0(),Z2()}catch{return}if(Y=w5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{d2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??n7)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(H,ZK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
+`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:V,enrollment:U}=q;try{e(g(V),!0);let M=await e7(V,()=>{});try{if(Q("lock_acquired"),t(V))throw Error("worker_ephemeral_requires_fresh_enrollment");return N1(V),await o7(V,M.owner.nonce,Q,Z,(T)=>X1(V,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function M1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
 `),J.onStartup?.(K)},H={...J,onStartup:G,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(V)=>Math.min(e1,Math.max(0,Math.round(V))),N=Y.get("readiness_started"),q=Y.get("readiness_completed");return{service_start_to_heartbeat_ms:K(performance.now()),...N!==void 0&&q!==void 0?{readiness_ms:K(q-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
-`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await d7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await b7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await g7();return await P7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await f2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
-`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await JK($,J,H,G);let K=tB($);if(!K)return Z.stdout.write(rB),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
-`),V=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!V||!!M,deviceId:V?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:V||M?Date.parse(V?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{N1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":V&&T0(N)instanceof o1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(V||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(QK);return 0}}e(g(N),!0);let U=await o7(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")x0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");N1(N);let D=()=>{f0(N),m9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await E4(N,T,O,J.enroll):await r7(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof Q1)||!O.deviceRemoved)throw O;return D(),j()});return m0(F,d(N).state,{proofStore:z}),x0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new $2(J1(N.apiOrigin),k0(N.proxy),T);if(x0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return f0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(N1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await t7(N,U.owner.nonce,G,H,async(T)=>K.enrollmentPath?E4(N,K.enrollmentPath,T,J.enroll):r7(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Z2(N,M,T0(N),U.owner.nonce,H)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
+`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await l7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await k7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await u7();return await x7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await f2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
+`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await QK($,J,H,G);let K=eB($);if(!K)return Z.stdout.write(oB),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
+`),V=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!V||!!M,deviceId:V?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:V||M?Date.parse(V?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{N1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":V&&T0(N)instanceof o1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(V||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(YK);return 0}}e(g(N),!0);let U=await e7(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
+`)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")x0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");N1(N);let D=()=>{f0(N),v9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await E4(N,T,O,J.enroll):await t7(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof Q1)||!O.deviceRemoved)throw O;return D(),j()});return m0(F,d(N).state,{proofStore:z}),x0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new J2(J1(N.apiOrigin),k0(N.proxy),T);if(x0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return f0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(N1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await o7(N,U.owner.nonce,G,H,async(T)=>K.enrollmentPath?E4(N,K.enrollmentPath,T,J.enroll):t7(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Q2(N,M,T0(N),U.owner.nonce,H)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
 `);let q=$.includes("--json")?void 0:G$(K instanceof Q1&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(q)Z.stderr.write(`${q}
-`);return N==="worker_revoked"&&X?0:1}}var ZK=60000;async function o7($,J){let Z=Date.now()+$.shutdownGraceMs+ZK,Q=!1;for(;;){let X=Y1({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((H)=>setTimeout(H,250))}}var QK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function r7($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return X1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??z1($),G=await(Z.enrollmentCredentials??O1)($,Y);if(!G)throw Error(X);let H=Z.createTicketClient?.(G)??new H1(G,{credentialsPath:Y,fetchImpl:k0($.proxy)});return h9($,G,H,Q,Z.enroll)}import{spawn as XK}from"child_process";import{existsSync as YK,readFileSync as GK,unlinkSync as BK}from"fs";import{join as KK}from"path";var VK=120,HK=15,NK=5000;function Z4($={}){let J=$.stateDirectory?KK($.stateDirectory,UK):null;if(J)qK(J);let Z=["/bin/bash","/usr/bin/bash"].find((V)=>YK(V));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??VK)),X=$.pid??process.pid,Y=Math.min(HK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${e7(r)} > ${e7(J)} 2>/dev/null
+`);return N==="worker_revoked"&&X?0:1}}var XK=60000;async function e7($,J){let Z=Date.now()+$.shutdownGraceMs+XK,Q=!1;for(;;){let X=Y1({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((H)=>setTimeout(H,250))}}var YK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function t7($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return X1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??z1($),G=await(Z.enrollmentCredentials??O1)($,Y);if(!G)throw Error(X);let H=Z.createTicketClient?.(G)??new H1(G,{credentialsPath:Y,fetchImpl:k0($.proxy)});return m9($,G,H,Q,Z.enroll)}import{spawn as GK}from"child_process";import{existsSync as BK,readFileSync as KK,unlinkSync as VK}from"fs";import{join as HK}from"path";var NK=120,UK=15,qK=5000;function Z4($={}){let J=$.stateDirectory?HK($.stateDirectory,MK):null;if(J)TK(J);let Z=["/bin/bash","/usr/bin/bash"].find((V)=>BK(V));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??NK)),X=$.pid??process.pid,Y=Math.min(UK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${$J(r)} > ${$J(J)} 2>/dev/null
 `:"",H=(V)=>`[ $((SECONDS - started)) -ge ${Math.max(1,V-1)} ]`,K=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
 while :; do started=$SECONDS
 IFS= read -r -t ${Q} pulse && continue
@@ -166,8 +166,8 @@ if ${H(Y)} && parent_is_worker; then
   ${G}kill -KILL ${X}
 fi
 exit 0
-done`,N=XK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
-`),Math.min(NK,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var UK="worker-stalled";function e7($){return`'${$.replaceAll("'","'\\''")}'`}function qK($){let J;try{J=GK($,"utf8"),BK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{v$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var LK=`Share this computer as a machine
+done`,N=GK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
+`),Math.min(qK,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var MK="worker-stalled";function $J($){return`'${$.replaceAll("'","'\\''")}'`}function TK($){let J;try{J=KK($,"utf8"),VK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{g$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var jK=`Share this computer as a machine
 
 Usage:
   reason serve                     This computer, signed in (machine name: its hostname)
@@ -210,20 +210,20 @@ the worker unless --sandbox is set. Settings live in
 ~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
 folder served for NAME is its own worker. Use
 \`reason worker status|revoke --config <that file>\` for advanced control.
-`,DK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,jK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,QJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",$J=["REASON_TOKEN","REASON_MACHINE_TOKEN"],XJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&g$(J)&&J!==w2?J:XJ}class Q0 extends Error{}function zK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let V=$[N+1];if(!V||V.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,V),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!g$(Z)&&!DK.test(Z))throw new Q0(QJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,H=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(H!==void 0&&!jK.test(H))throw new Q0("--org must be a workspace id.")}else if(H!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...H===void 0?{}:{org:H.toLowerCase()}}}function G4($,J){let Z=WK($,J??"."),Q;try{Q=ZJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!_K(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var Q4=($)=>n1($,".reason","workers"),c3=($)=>u(d($).state);function OK($,J,Z){let Q=n1(Q4($),J);if(C0(n1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return n1(Q4($),`${J}@${MK("sha256").update(Z).digest("hex").slice(0,8)}`)}function YJ($){let{stateDirectory:J}=$;if(B2($.workspaceRoot,J)||B2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function C0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function AK($,J){$.stdout.write(`${J} [y/N] `);let Z=await j9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function B4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var RK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function GJ($){try{return await $()}catch(J){let Z=J instanceof G0?RK[J.code]:void 0;throw Z?Error(Z):J}}async function CK($,J,Z,Q){let X=YJ({...J,name:$.name??XJ,stateDirectory:n1(Q4(Z),".token-enrollment")}),Y=A1(X,{stored:!1}),G=await GJ(()=>R9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!g$(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let H=!1;return{name:$.name??G.machine_name,input:(K)=>{if(H)throw Error("worker_ticket_receipt_mismatch");return H=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function IK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??O1)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((H)=>new H1(H)))(Y);return f9(X,Y,{createHeadlessDeviceEnrollmentTicket:(H)=>GJ(async()=>{try{return await G.createMachineEnrollmentTicket($,H)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
-`)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,H)})})}}async function BJ($,J,Z,Q){let X=await f2($,Q,()=>JJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!_1($,J,Z))return null;return c4($),X}function i3($,J){let Z=Q4($);if(!u(Z))return[];let Q=J.toLowerCase();return TK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=n1(Z,X,"worker.json"),H=C0(G);return H?[{path:G,config:H}]:[]})}async function PK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??H0,H=[];for(let K of Y){let N=await G(K.config,"stop")!==null,q=Y4(K.config,X),V=N||q!==null;if(H.push({config:K.path,folder:K.config.workspaceRoot,running:V,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
+`,zK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,OK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,XJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",JJ=["REASON_TOKEN","REASON_MACHINE_TOKEN"],YJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&u$(J)&&J!==w2?J:YJ}class Q0 extends Error{}function AK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let V=$[N+1];if(!V||V.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,V),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!u$(Z)&&!zK.test(Z))throw new Q0(XJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,H=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(H!==void 0&&!OK.test(H))throw new Q0("--org must be a workspace id.")}else if(H!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...H===void 0?{}:{org:H.toLowerCase()}}}function G4($,J){let Z=DK($,J??"."),Q;try{Q=QJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!WK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var Q4=($)=>n1($,".reason","workers"),c3=($)=>u(d($).state);function RK($,J,Z){let Q=n1(Q4($),J);if(C0(n1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return n1(Q4($),`${J}@${_K("sha256").update(Z).digest("hex").slice(0,8)}`)}function GJ($){let{stateDirectory:J}=$;if(K2($.workspaceRoot,J)||K2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function C0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function CK($,J){$.stdout.write(`${J} [y/N] `);let Z=await z9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function B4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var IK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function BJ($){try{return await $()}catch(J){let Z=J instanceof G0?IK[J.code]:void 0;throw Z?Error(Z):J}}async function PK($,J,Z,Q){let X=GJ({...J,name:$.name??YJ,stateDirectory:n1(Q4(Z),".token-enrollment")}),Y=A1(X,{stored:!1}),G=await BJ(()=>C9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!u$(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let H=!1;return{name:$.name??G.machine_name,input:(K)=>{if(H)throw Error("worker_ticket_receipt_mismatch");return H=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function xK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??O1)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((H)=>new H1(H)))(Y);return h9(X,Y,{createHeadlessDeviceEnrollmentTicket:(H)=>BJ(async()=>{try{return await G.createMachineEnrollmentTicket($,H)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
+`)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,H)})})}}async function KJ($,J,Z,Q){let X=await f2($,Q,()=>ZJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!_1($,J,Z))return null;return c4($),X}function i3($,J){let Z=Q4($);if(!u(Z))return[];let Q=J.toLowerCase();return FK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=n1(Z,X,"worker.json"),H=C0(G);return H?[{path:G,config:H}]:[]})}async function EK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??H0,H=[];for(let K of Y){let N=await G(K.config,"stop")!==null,q=Y4(K.config,X),V=N||q!==null;if(H.push({config:K.path,folder:K.config.workspaceRoot,running:V,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
 `);if(!$.json)Z.stdout.write(V?`Stopping machine "${$.name}" in ${K.config.workspaceRoot}; current work finishes first.
 `:`Machine "${$.name}" in ${K.config.workspaceRoot} is not running.
 `)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:H})}
-`);return 0}async function KJ($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??M1,X=J.env??process.env,Y=$J.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of $J)delete process.env[G];try{let G=zK($,Y);if(!G)return Z.stdout.write(LK),0;let H=ZJ(J.home??V0()),K=J.serviceHost??K1(H);if(G.stop)return await PK({...G,name:G.name},H,Z,J,K);let N=J.channel??P0(),q=G4(J.cwd??process.cwd(),G.dir),V=G.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:G.once,sandbox:G.sandbox},M=G.token?await CK({...G,token:G.token},U,H,J):void 0,T=M?.name??G.name??a3((J.hostname??FK)()),_=OK(H,T,q),D=n1(_,"worker.json"),j=C0(D);if(M&&j&&c3(j)&&$0(j).revoked)f0(j);let z=!M&&j!==null&&c3(j)&&(!b0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=YJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
+`);return 0}async function VJ($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??M1,X=J.env??process.env,Y=JJ.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of JJ)delete process.env[G];try{let G=AK($,Y);if(!G)return Z.stdout.write(jK),0;let H=QJ(J.home??V0()),K=J.serviceHost??K1(H);if(G.stop)return await EK({...G,name:G.name},H,Z,J,K);let N=J.channel??P0(),q=G4(J.cwd??process.cwd(),G.dir),V=G.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:G.once,sandbox:G.sandbox},M=G.token?await PK({...G,token:G.token},U,H,J):void 0,T=M?.name??G.name??a3((J.hostname??LK)()),_=RK(H,T,q),D=n1(_,"worker.json"),j=C0(D);if(M&&j&&c3(j)&&$0(j).revoked)f0(j);let z=!M&&j!==null&&c3(j)&&(!b0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=GJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
 Run it with: reason serve ${T} ${s3(j)}
 Or remove it first: reason worker revoke --config ${D}`)}let W=F.lifetime==="persistent"?D$(F,K):null;if(W&&!G.service&&X[a1]!==W.label)return Z.stdout.write(`Machine "${T}" in ${q} already runs as a background service (${W.label}).
   Logs: ${W.logs}
   Stop it with: reason stop ${T}
-`),0;if(G.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!g$(T))throw new Q0(QJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
+`),0;if(G.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!u$(T))throw new Q0(XJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
 `);else if(L&&!G.yes&&!M){let R=`Sessions on "${T}" will run commands in ${q} with your user permissions (no sandbox). Continue?`,I=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!I)throw new Q0(`${R.replace(/ Continue\?$/,"")}
-Re-run with --yes to confirm.`);if(!await(J.confirm??((E)=>AK(Z,E)))(R))return Z.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!O)e(F.stateDirectory,!0),c(D,F);let C={...J.worker,enrollmentInput:IK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
+Re-run with --yes to confirm.`);if(!await(J.confirm??((E)=>CK(Z,E)))(R))return Z.stderr.write(`Cancelled. Nothing was added.
+`),1}if(!O)e(F.stateDirectory,!0),c(D,F);let C={...J.worker,enrollmentInput:xK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
 `);let I=await Q(["enroll","--config",D],{...C,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(I!==0)return I}if(V){let R;try{R=X4({config:F,launcher:V,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(I){if(!(I instanceof T1))throw I;throw new Q0(`${I.message}
 This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${s3(F)}
 Or try the background service again with: reason serve ${T} ${s3(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${q}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${R.label} (starts at ${R.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${R.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...R.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
@@ -231,8 +231,8 @@ Or try the background service again with: reason serve ${T} ${s3(F)} --service`)
 `));let P=W&&X[a1]===W.label&&!J.runWorker?Z4({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",D],{...C,io:{stdout:Z.stdout,stderr:B4(Z.stderr)},onStartup:(R)=>{if(R==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
 `);J.worker?.onStartup?.(R)}})}finally{P?.stop()}}catch(G){if(G instanceof Q0||G instanceof T1){let N=G instanceof T1&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
 `),2}let H=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:null,K=H?G$(H):void 0;return Z.stderr.write(`Reason: ${H?K?`${K} (${H})`:H:"could not prepare this machine."}
-`),1}}var xK=200;var mL=B.strictObject({version:B.literal(1),session_ids:B.array(B.string().min(1).max(200)).max(xK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as VJ}from"child_process";import{readFileSync as EK,rmdirSync as SK,rmSync as wK}from"fs";import{join as n3}from"path";var bK=["Reason.app","Ara Sidecar.app","Ara Device.app"],kK="sidecar_retire_failed";function yK($){return n3($,"Library","Application Support","Ara","Sidecar")}function fK($){try{let J=EK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function NJ($,J={}){let Z=yK($),Q=bK.map((H)=>n3(Z,H)).filter(fK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>VJ("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((H)=>process.kill(H,"SIGTERM")),G=J.command??((H,K)=>VJ(H,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let H of X().split(`
-`)){let K=H.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let H of Q)G(HJ,["-u",H]),wK(H,{recursive:!0,force:!0});try{SK(Z)}catch{}}catch{return{status:"failed",code:kK}}return{status:"removed",bundles:Q}}var dK=`Connect this computer to Reason
+`),1}}var SK=200;var gL=B.strictObject({version:B.literal(1),session_ids:B.array(B.string().min(1).max(200)).max(SK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as HJ}from"child_process";import{readFileSync as wK,rmdirSync as bK,rmSync as kK}from"fs";import{join as n3}from"path";var yK=["Reason.app","Ara Sidecar.app","Ara Device.app"],fK="sidecar_retire_failed";function hK($){return n3($,"Library","Application Support","Ara","Sidecar")}function mK($){try{let J=wK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function UJ($,J={}){let Z=hK($),Q=yK.map((H)=>n3(Z,H)).filter(mK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>HJ("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((H)=>process.kill(H,"SIGTERM")),G=J.command??((H,K)=>HJ(H,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let H of X().split(`
+`)){let K=H.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let H of Q)G(NJ,["-u",H]),kK(H,{recursive:!0,force:!0});try{bK(Z)}catch{}}catch{return{status:"failed",code:fK}}return{status:"removed",bundles:Q}}var pK=`Connect this computer to Reason
 
 Usage:
   reason connect                 Your computer, kept connected in the background
@@ -288,7 +288,7 @@ One computer serves several Reason accounts. Signed in as another account than
 the one it is connected for, reason connect connects it for that account too,
 as that account's own computer in the workspace it signed in to; the other
 accounts stay connected. That account's \`reason logout\` removes only its own.
-`,lK=`Disconnect this computer from Reason
+`,cK=`Disconnect this computer from Reason
 
 Usage:
   reason disconnect              Stop your computer's connection and remove it from Reason, in every
@@ -303,41 +303,41 @@ Usage:
                                  Reason (all of it when it is the only account here), and it is not kept
                                  disconnected: the next reason "\u2026" connects it again
   --yes, -y                      Accepted for scripts; disconnect never asks
-`;class p extends Error{}var pK=4,H4={write:()=>!0};function d0($,J,Z=!1){let Q=PJ($,J,Z);return Q.length===1?Q[0]:F0(U2(F0($,".config")),...IJ(J,Z))}var IJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function PJ($,J,Z=!1){let Q=$;try{Q=V1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...IJ(J,Z))).filter(cK)}function cK($){try{if(V1($)!==$)return!1;return C0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var xJ="disconnected.json";function CD($,J){return u(F0(d0($,J),xJ))}function N4($,J,Z){let Q=F0(d0($,J),xJ);if(!Z){z$(Q,{force:!0});return}e(e3(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function sK($){let J=new Map,Z=new Set;for(let V=0;V<$.length;V+=1){let U=$[V];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",K4,V4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[V+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),V+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(V4)&&!J.has(K4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((V)=>V!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((V)=>J.has(V));if(Y.length>0&&(J.size>1||[...Z].some((V)=>V!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let H=J.get("--cloud-sessions");if(H!==void 0&&H!=="on"&&H!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(V,U)=>U===void 0?{}:{[V]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",G===void 0?void 0:G==="on"),...q("cloudSessions",H===void 0?void 0:H==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(K4)),...q("proxyCaFile",J.get(V4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var I1=($)=>u(d($).state),EJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function SJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function aK($){return $===1?"one at a time":`up to ${$} at once`}function wJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=G4($.options.cwd??process.cwd(),J.folder)}catch(H){throw new p(H instanceof Error?H.message:String(H))}if(!x$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!b0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(H){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${H instanceof Error?H.message:String(H)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!_J(X)&&!TJ($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=LJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(H){if(!(H instanceof FJ))throw H;throw new p(H.message)}let G=(Z?.folders??[]).filter((H)=>H!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??gK)()),slots:J.sessions??Z?.slots??pK,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function bJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function $9($,J,Z,Q,X){if($0($).revoked){if(I1($))try{f0($)}catch{}k4($);let Y=[];try{Y=vK(g($))}catch{}for(let G of Y)if(G!=="workspaces")z$(F0(g($),G),{recursive:!0,force:!0})}else if(I1($))f0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??M1)(["enroll","--config",J],{...J9(Q.worker,X),io:{stdout:H4,stderr:Z.stderr}})}function K2($,J,Z){let Q=P$(Z1(b$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function iK($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),G=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},H=null;try{H=C0(Y)}catch{}if(G(H))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let K=await $9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&I1(X))await U4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function J9($,J){return J?{...$,enrollmentCredentials:(Z)=>O4(Z,J)}:{...$}}async function Z9($,J,Z,Q,X,Y="connect"){if(await Q9($,Q,X,Y),Y==="connect"&&!await vJ($,Z,Q))return!1;if(!await U4($,J,Z,Q))return!1;return P9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function U4($,J,Z,Q){if(!I1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??M1)(["revoke","--config",J],{...Q.worker,io:{stdout:H4,stderr:Y?Z.stderr:H4}})===0)return!0;if(Y)return!1;await new Promise((H)=>setTimeout(H,1000))}}async function Q9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,G=async()=>Y($,"status").catch(()=>null),H=await Y($,"stop").catch(()=>null)!==null,K=!X&&Y4($,Z,Q);if(H||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((q)=>setTimeout(q,250))}}function X9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...X9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${SJ($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
-`)}function t3($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${aK(J.slots)}`,`  Mode:      ${SJ(J)}`,...J.proxy?[`  Proxy:     ${WJ(J.proxy)}`]:[],...X9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
-`)}async function UJ($,J,Z){let{io:Q,options:X}=Z;if(PJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:e3(J),timestamp:new Date().toISOString()})}
+`;class p extends Error{}var sK=4,H4={write:()=>!0};function d0($,J,Z=!1){let Q=xJ($,J,Z);return Q.length===1?Q[0]:F0(q2(F0($,".config")),...PJ(J,Z))}var PJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function xJ($,J,Z=!1){let Q=$;try{Q=V1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...PJ(J,Z))).filter(aK)}function aK($){try{if(V1($)!==$)return!1;return C0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var EJ="disconnected.json";function PD($,J){return u(F0(d0($,J),EJ))}function N4($,J,Z){let Q=F0(d0($,J),EJ);if(!Z){z$(Q,{force:!0});return}e(e3(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function iK($){let J=new Map,Z=new Set;for(let V=0;V<$.length;V+=1){let U=$[V];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",K4,V4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[V+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),V+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(V4)&&!J.has(K4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((V)=>V!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((V)=>J.has(V));if(Y.length>0&&(J.size>1||[...Z].some((V)=>V!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let H=J.get("--cloud-sessions");if(H!==void 0&&H!=="on"&&H!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(V,U)=>U===void 0?{}:{[V]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",G===void 0?void 0:G==="on"),...q("cloudSessions",H===void 0?void 0:H==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(K4)),...q("proxyCaFile",J.get(V4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var I1=($)=>u(d($).state),SJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function wJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function nK($){return $===1?"one at a time":`up to ${$} at once`}function bJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=G4($.options.cwd??process.cwd(),J.folder)}catch(H){throw new p(H instanceof Error?H.message:String(H))}if(!E$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!b0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(H){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${H instanceof Error?H.message:String(H)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!FJ(X)&&!_J($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=DJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(H){if(!(H instanceof WJ))throw H;throw new p(H.message)}let G=(Z?.folders??[]).filter((H)=>H!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??dK)()),slots:J.sessions??Z?.slots??sK,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function kJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function $9($,J,Z,Q,X){if($0($).revoked){if(I1($))try{f0($)}catch{}k4($);let Y=[];try{Y=uK(g($))}catch{}for(let G of Y)if(G!=="workspaces")z$(F0(g($),G),{recursive:!0,force:!0})}else if(I1($))f0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??M1)(["enroll","--config",J],{...J9(Q.worker,X),io:{stdout:H4,stderr:Z.stderr}})}function V2($,J,Z){let Q=P$(Z1(k$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function rK($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),G=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},H=null;try{H=C0(Y)}catch{}if(G(H))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let K=await $9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&I1(X))await U4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function J9($,J){return J?{...$,enrollmentCredentials:(Z)=>O4(Z,J)}:{...$}}async function Z9($,J,Z,Q,X,Y="connect"){if(await Q9($,Q,X,Y),Y==="connect"&&!await gJ($,Z,Q))return!1;if(!await U4($,J,Z,Q))return!1;return x9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function U4($,J,Z,Q){if(!I1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??M1)(["revoke","--config",J],{...Q.worker,io:{stdout:H4,stderr:Y?Z.stderr:H4}})===0)return!0;if(Y)return!1;await new Promise((H)=>setTimeout(H,1000))}}async function Q9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,G=async()=>Y($,"status").catch(()=>null),H=await Y($,"stop").catch(()=>null)!==null,K=!X&&Y4($,Z,Q);if(H||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((q)=>setTimeout(q,250))}}function X9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...X9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${wJ($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
+`)}function t3($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${nK(J.slots)}`,`  Mode:      ${wJ(J)}`,...J.proxy?[`  Proxy:     ${LJ(J.proxy)}`]:[],...X9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
+`)}async function qJ($,J,Z){let{io:Q,options:X}=Z;if(xJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:e3(J),timestamp:new Date().toISOString()})}
 `);let Y=E2(F0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
-`);f3(Z.home,Z.host.platform);let G=C8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(U)=>Q.stderr.write(`${U}
-`),host:Z.host}),H=W8({...G,log:(U)=>Q.stderr.write(`${U}
-`)}),{configPath:K}=H,N=H.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let q=(U,M)=>{let T=M4(Z.home,Z.channel),_;try{let j=null;try{j=M.keep?null:t(N)?.orgId.toLowerCase()??null}catch{}if(_=O2(N,{prefer:K2(Z.home,Z.channel,N),...M}),_&&j)z2(_,j)}finally{T()}if(!_)return!1;N=_;let D="";try{D=` (workspace ${t(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${U}; this computer goes on running Sessions for its other Reason account${D}.
-`),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=p0(N.stateDirectory)??void 0,M=U?null:K2(Z.home,Z.channel,N);if(!U&&!(M&&y$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let V=N.executionMode==="confined";if(V||!j$(N)){let U=p0(N.stateDirectory)??void 0;if(Q.stderr.write(V?EJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
-`),await $9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=p0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Z4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??M1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return N4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function nK($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:H}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=d0(Y,G,!0),N=wJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:H}),q=bJ(N,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),V=F0(K,"worker.json");return e(K,!0),c(V,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M1)(["start","--config",V],{...J9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:B4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
-`);X.worker?.onStartup?.(U)}})}function rK($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),E8(d(J).daemon,$);let X=S2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var tK=B.object({root:B.object({id:B.string().min(1).max(160),label:B.string().max(160),path_fingerprint:B.string()})});async function kJ($,J,Z,Q){let X=await(J9(Q.worker,Z).enrollmentCredentials??O1)($,z1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new H1(X,{credentialsPath:z1($),fetchImpl:k0($.proxy)}),G=(H)=>H instanceof G0&&H.status===404&&!["device_not_found","root_not_found"].includes(H.code);return{add:async(H)=>{let K=v9($,H,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((V)=>{if(G(V))throw Error("worker_folders_unavailable");if(V instanceof G0&&V.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw V}),q=tK.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(H)=>{await Y.removeDeviceRoot(J.deviceId,H).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function yJ($,J,Z){m0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:T0($)})}async function fJ($,J,Z,Q){let{io:X,options:Y,host:G}=Q,H=J&&!Q.apiKey&&p0(J.stateDirectory)===null?K2(Q.home,Q.channel,J):null,K=J&&H&&I1(J)&&!y$(J,H)?h0(J).find((R)=>R.account&&R.organizationId===H)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,V=N&&I1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!V||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=G4(T,M)}catch(R){if(U)throw new p(R instanceof Error?R.message:String(R));_=uK(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=V.roots.slice(1).find((R)=>R.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!x$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??p0(N.stateDirectory)??void 0,F=await kJ(N,V,z,Y),O=V.roots.filter((R)=>R.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);yJ(N,V,O);let W=U?[...D.filter((R)=>R!==_),_]:D.filter((R)=>R!==_),{folders:L,...C}=N;if(c(q,J0.parse({...C,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))_1(J,G,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
+`);f3(Z.home,Z.host.platform);let G=I8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(U)=>Q.stderr.write(`${U}
+`),host:Z.host}),H=L8({...G,log:(U)=>Q.stderr.write(`${U}
+`)}),{configPath:K}=H,N=H.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let q=(U,M)=>{let T=M4(Z.home,Z.channel),_;try{let j=null;try{j=M.keep?null:t(N)?.orgId.toLowerCase()??null}catch{}if(_=O2(N,{prefer:V2(Z.home,Z.channel,N),...M}),_&&j)z2(_,j)}finally{T()}if(!_)return!1;N=_;let D="";try{D=` (workspace ${t(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${U}; this computer goes on running Sessions for its other Reason account${D}.
+`),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=p0(N.stateDirectory)??void 0,M=U?null:V2(Z.home,Z.channel,N);if(!U&&!(M&&f$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let V=N.executionMode==="confined";if(V||!j$(N)){let U=p0(N.stateDirectory)??void 0;if(Q.stderr.write(V?SJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
+`),await $9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=p0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Z4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??M1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return N4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function tK($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:H}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=d0(Y,G,!0),N=bJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:H}),q=kJ(N,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),V=F0(K,"worker.json");return e(K,!0),c(V,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M1)(["start","--config",V],{...J9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:B4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
+`);X.worker?.onStartup?.(U)}})}function oK($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),S8(d(J).daemon,$);let X=S2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
+`),0}var eK=B.object({root:B.object({id:B.string().min(1).max(160),label:B.string().max(160),path_fingerprint:B.string()})});async function yJ($,J,Z,Q){let X=await(J9(Q.worker,Z).enrollmentCredentials??O1)($,z1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new H1(X,{credentialsPath:z1($),fetchImpl:k0($.proxy)}),G=(H)=>H instanceof G0&&H.status===404&&!["device_not_found","root_not_found"].includes(H.code);return{add:async(H)=>{let K=g9($,H,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((V)=>{if(G(V))throw Error("worker_folders_unavailable");if(V instanceof G0&&V.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw V}),q=eK.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(H)=>{await Y.removeDeviceRoot(J.deviceId,H).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function fJ($,J,Z){m0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:T0($)})}async function hJ($,J,Z,Q){let{io:X,options:Y,host:G}=Q,H=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(Q.home,Q.channel,J):null,K=J&&H&&I1(J)&&!f$(J,H)?h0(J).find((R)=>R.account&&R.organizationId===H)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,V=N&&I1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!V||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=G4(T,M)}catch(R){if(U)throw new p(R instanceof Error?R.message:String(R));_=lK(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=V.roots.slice(1).find((R)=>R.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!E$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??p0(N.stateDirectory)??void 0,F=await yJ(N,V,z,Y),O=V.roots.filter((R)=>R.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);fJ(N,V,O);let W=U?[...D.filter((R)=>R!==_),_]:D.filter((R)=>R!==_),{folders:L,...C}=N;if(c(q,J0.parse({...C,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))_1(J,G,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
 `:`Removed ${_}. Sessions on "${N.name}" no longer run in it.
-`),0}async function ID($,J,Z){let Q=o3(Z),X=M4(Q.home,Q.channel);try{let Y=F0(d0(Q.home,Q.channel),"worker.json");return await fJ({once:!1,yes:J,addFolder:$},C0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=V1($.home??V0()),Q=$.env??process.env;return{io:$.io??q4(),options:$,home:Z,channel:$.channel??P0(),environment:Q,apiKey:J??j4(Q),host:$.serviceHost??K1(Z)}}async function oK($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await kJ($,X,Z,Q),H=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[H,...Y.slice(1).filter((K)=>K.id!==H.id)]}yJ(J,X,Y)}var hJ=Symbol("serve here");async function eK($,J,Z,Q){let{io:X,options:Y,home:G,channel:H,environment:K,host:N}=Q;if(N.platform==="darwin"){let E=NJ(G);if(E.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${E.code}).
-`)}let q=J&&!Q.apiKey&&p0(J.stateDirectory)===null?K2(G,H,J):null,V=J&&q&&$0(J).revoked&&h0(J).some((E)=>E.account&&E.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=wJ({parsed:$,saved:V,stateDirectory:d0(G,H),lifetime:"persistent",home:G,channel:H,options:Y,environment:K});if(N4(G,H,!1),V?.executionMode==="confined")X.stdout.write(EJ);let M=V?p0(V.stateDirectory):null,T=bJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=V!==null&&I1(V),j=D&&U0(V)===U0(T),z=j&&j$(T),F=V?.userChrome!==!1===(T.userChrome!==!1)&&V?.cloudSessions===T.cloudSessions&&V?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(V).revoked&&!y$(V,q);if(W){if(!j||!F||JSON.stringify(V.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let E=await iK(V,q,X,Y);if(E!==0)return E}let L=W?[`  Account:   yours too, in workspace ${q}, beside this computer's other Reason account`]:[],C=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await O4(T,$.apiKey),z4(T.stateDirectory,$.apiKey)};if(z&&JSON.stringify(V?.proxy)===JSON.stringify(T.proxy)&&F&&D$(T,N,"connect")?.label===jJ(T.channel)&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)&&[null,r].includes(u$(T))){await C();let E=OJ(T,N,"connect");if(E==="retired"){let w=await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!w||w.phase==="stopping")_1(T,N,"connect")}else if(E==="current_not_running")_1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let P=!z&&!W;if(D&&!j)if(V.apiOrigin!==T.apiOrigin||V.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),0}async function xD($,J,Z){let Q=o3(Z),X=M4(Q.home,Q.channel);try{let Y=F0(d0(Q.home,Q.channel),"worker.json");return await hJ({once:!1,yes:J,addFolder:$},C0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=V1($.home??V0()),Q=$.env??process.env;return{io:$.io??q4(),options:$,home:Z,channel:$.channel??P0(),environment:Q,apiKey:J??j4(Q),host:$.serviceHost??K1(Z)}}async function $V($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await yJ($,X,Z,Q),H=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[H,...Y.slice(1).filter((K)=>K.id!==H.id)]}fJ(J,X,Y)}var mJ=Symbol("serve here");async function JV($,J,Z,Q){let{io:X,options:Y,home:G,channel:H,environment:K,host:N}=Q;if(N.platform==="darwin"){let E=UJ(G);if(E.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${E.code}).
+`)}let q=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(G,H,J):null,V=J&&q&&$0(J).revoked&&h0(J).some((E)=>E.account&&E.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=bJ({parsed:$,saved:V,stateDirectory:d0(G,H),lifetime:"persistent",home:G,channel:H,options:Y,environment:K});if(N4(G,H,!1),V?.executionMode==="confined")X.stdout.write(SJ);let M=V?p0(V.stateDirectory):null,T=kJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=V!==null&&I1(V),j=D&&U0(V)===U0(T),z=j&&j$(T),F=V?.userChrome!==!1===(T.userChrome!==!1)&&V?.cloudSessions===T.cloudSessions&&V?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(V).revoked&&!f$(V,q);if(W){if(!j||!F||JSON.stringify(V.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let E=await rK(V,q,X,Y);if(E!==0)return E}let L=W?[`  Account:   yours too, in workspace ${q}, beside this computer's other Reason account`]:[],C=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await O4(T,$.apiKey),z4(T.stateDirectory,$.apiKey)};if(z&&JSON.stringify(V?.proxy)===JSON.stringify(T.proxy)&&F&&D$(T,N,"connect")?.label===zJ(T.channel)&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)&&[null,r].includes(d$(T))){await C();let E=AJ(T,N,"connect");if(E==="retired"){let w=await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!w||w.phase==="stopping")_1(T,N,"connect")}else if(E==="current_not_running")_1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let P=!z&&!W;if(D&&!j)if(V.apiOrigin!==T.apiOrigin||V.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
 `),!await Z9(V,Z,X,Y,N))throw new p("Could not remove this computer's previous connection from Reason. Check your network and try again.")}else if(V.executionMode==="host"&&j$(V))X.stdout.write(`Applying the new settings to this computer\u2026
-`),await oK(V,T,O,Y),P=!1;else await Q9(V,Y,N);if(P){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
+`),await $V(V,T,O,Y),P=!1;else await Q9(V,Y,N);if(P){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
 `);let E=await $9(T,Z,X,Y,O);if(E!==0)return E;if(O)z4(T.stateDirectory,O)}else c(Z,T),await C();let R;try{R=X4({config:T,launcher:_,path:K.PATH||"/usr/local/bin:/usr/bin:/bin",host:N,kind:"connect"})}catch(E){if(!(E instanceof T1))throw E;if(E.code!=="worker_service_manager_missing")throw new p(`${E.message}
 This computer is set up; run reason connect again to start it.`);if(Y.serveHere&&K.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),hJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await $V(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new T1(`${E.message}
-This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,E.code)}let I=[...L,...R.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...R.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${R.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,I):t3("This computer is connected to Reason",T,N.platform,[`  Service:   ${R.label} (starts at ${R.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${R.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...I])),0}async function $V($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??mJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((H)=>setTimeout(H,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function mJ($,J,Z){let Q=CJ(Z,"a",384);try{let X=AJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{RJ(Q)}}async function vJ($,J,Z,Q=!1){let X=!0;for(let Y of h0($)){if(Q&&Y.account)continue;if(Y.config&&I1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??M1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:H4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function q4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function Y9($,J){if($ instanceof p||$ instanceof T1){let X=$ instanceof T1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
+`),mJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await ZV(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new T1(`${E.message}
+This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,E.code)}let I=[...L,...R.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...R.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${R.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,I):t3("This computer is connected to Reason",T,N.platform,[`  Service:   ${R.label} (starts at ${R.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${R.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...I])),0}async function ZV($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??vJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((H)=>setTimeout(H,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function vJ($,J,Z){let Q=IJ(Z,"a",384);try{let X=RJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{CJ(Q)}}async function gJ($,J,Z,Q=!1){let X=!0;for(let Y of h0($)){if(Q&&Y.account)continue;if(Y.config&&I1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??M1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:H4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function q4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function Y9($,J){if($ instanceof p||$ instanceof T1){let X=$ instanceof T1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
 `),2}let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:null,Q=Z?G$(Z):void 0;return J.stderr.write(`Reason: ${Z?Q?`${Q} (${Z})`:Z:"could not connect this computer."}
-`),1}function qJ($,J){if($.minimal){uJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||dJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??MJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
+`),1}function MJ($,J){if($.minimal){dJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||lJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??TJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
 `);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let Q=(J.options.installDesktop??MJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function MJ($,J,Z){if(!Z)return hK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;mK(e3(Z.log),{recursive:!0,mode:448});let Q=CJ(Z.log,"w",384);try{let X=AJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{RJ(Q)}return 0}async function PD($,J={}){let Z=J.io??q4();try{let Q=sK($);if(!Q)return Z.stdout.write(dK),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return qJ(Q,o3(J)),await(J.runServe??KJ)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let H=zJ(G[a1],Y),K=H||Q.once?()=>{return}:M4(X.home,Y);try{let N=F0(d0(X.home,Y),"worker.json"),q=C0(N);if(H)return await UJ(q,N,X);if(Q.keepAwake!==void 0)return rK(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await fJ(Q,q,N,X);if(qJ(Q,X),Q.once)return await nK(Q,q,X);let V=await eK(Q,q,N,X);if(V!==hJ)return V;return K(),K=()=>{return},await UJ(C0(N),N,X)}finally{K()}}catch(Q){return Y9(Q,Z)}}async function xD($,J={}){let Z=J.io??q4();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(lK),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await QV(Q[0],Z,J);return await gJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return Y9(Q,Z)}}async function ED($={}){let J=$.io??q4();try{return await gJ(J,$,"logout")}catch(Z){return Y9(Z,J)}}async function gJ($,J,Z){let Q=V1(J.home??V0()),X=J.channel??P0(),Y=M4(Q,X);try{return await JV($,J,Z,Q,X)}finally{Y()}}function M4($,J){let Z=d0($,J),Q=u(Z)?X$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function JV($,J,Z,Q,X){let Y=F0(d0(Q,X),"worker.json"),G=C0(Y);if(!G){if(Z==="disconnect")N4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(Z!=="disconnect"){let K=await ZV(G,Y,$,J,Z,Q,X);if(K!==null)return K}let H=!1;try{H=await Z9(G,Y,$,J,J.serviceHost??K1(Q))}finally{if(Z!=="temporary")N4(Q,X,!0)}if(!H)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`);let Q=(J.options.installDesktop??TJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
+`)}function TJ($,J,Z){if(!Z)return vK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;gK(e3(Z.log),{recursive:!0,mode:448});let Q=IJ(Z.log,"w",384);try{let X=RJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{CJ(Q)}return 0}async function ED($,J={}){let Z=J.io??q4();try{let Q=iK($);if(!Q)return Z.stdout.write(pK),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return MJ(Q,o3(J)),await(J.runServe??VJ)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let H=OJ(G[a1],Y),K=H||Q.once?()=>{return}:M4(X.home,Y);try{let N=F0(d0(X.home,Y),"worker.json"),q=C0(N);if(H)return await qJ(q,N,X);if(Q.keepAwake!==void 0)return oK(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await hJ(Q,q,N,X);if(MJ(Q,X),Q.once)return await tK(Q,q,X);let V=await JV(Q,q,N,X);if(V!==mJ)return V;return K(),K=()=>{return},await qJ(C0(N),N,X)}finally{K()}}catch(Q){return Y9(Q,Z)}}async function SD($,J={}){let Z=J.io??q4();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(cK),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await YV(Q[0],Z,J);return await uJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return Y9(Q,Z)}}async function wD($={}){let J=$.io??q4();try{return await uJ(J,$,"logout")}catch(Z){return Y9(Z,J)}}async function uJ($,J,Z){let Q=V1(J.home??V0()),X=J.channel??P0(),Y=M4(Q,X);try{return await QV($,J,Z,Q,X)}finally{Y()}}function M4($,J){let Z=d0($,J),Q=u(Z)?X$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function QV($,J,Z,Q,X){let Y=F0(d0(Q,X),"worker.json"),G=C0(Y);if(!G){if(Z==="disconnect")N4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(Z!=="disconnect"){let K=await XV(G,Y,$,J,Z,Q,X);if(K!==null)return K}let H=!1;try{H=await Z9(G,Y,$,J,J.serviceHost??K1(Q))}finally{if(Z!=="temporary")N4(Q,X,!0)}if(!H)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
 `),1;return $.stdout.write(`Disconnected "${G.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function ZV($,J,Z,Q,X,Y,G){let H=h0($).filter((D)=>D.account);if(H.length===0)return null;let K=K2(Y,G,$),N=Q.controlWorker??H0,q=H.find((D)=>D.organizationId===K);if(q){if(q.config&&!await U4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),0}async function XV($,J,Z,Q,X,Y,G){let H=h0($).filter((D)=>D.account);if(H.length===0)return null;let K=V2(Y,G,$),N=Q.controlWorker??H0,q=H.find((D)=>D.organizationId===K);if(q){if(q.config&&!await U4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
 `),1;if(X!=="account"||!q.config)z$(q.directory,{recursive:!0,force:!0});return await N($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${K} for your account. It stays connected for its other Reason accounts.
-`),0}if(!K&&X==="account")throw new p("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!K||!y$($,K)){if(X==="account"&&K)z2($,K);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let V=Q.serviceHost??K1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await Q9($,Q,V,"connect",!0),!await vJ($,Z,Q,!0)||!await U4($,J,Z,Q))return _1($,V,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`),0}if(!K&&X==="account")throw new p("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!K||!f$($,K)){if(X==="account"&&K)z2($,K);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
+`);return 0}let V=Q.serviceHost??K1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await Q9($,Q,V,"connect",!0),!await gJ($,Z,Q,!0)||!await U4($,J,Z,Q))return _1($,V,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
 `),1;let M=O2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&U)z2(M,U);let T=_1(M,V,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
-`),0}async function QV($,J,Z){let Q=V1(Z.home??V0()),X=Z.serviceHost??K1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let H of Y)if(await Z9(H.config,H.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${H.config.workspaceRoot}.
+`),0}async function YV($,J,Z){let Q=V1(Z.home??V0()),X=Z.serviceHost??K1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let H of Y)if(await Z9(H.config,H.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${H.config.workspaceRoot}.
 `);else G=!0,J.stderr.write(`Reason: machine "${$}" in ${H.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
-`);return G?1:0}async function SD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=await($.controlWorker??H0)(Z,"status").catch(()=>null),X=Q?u$(Z):null,Y=$.serviceHost??K1(J),G=D$(Z,Y,"connect"),H=$0(Z).revoked,K=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:N,off:q}=H||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:s9(Z,Q?.phase==="running");return{workspaces:N,workspaces_off:q,workspaces_max:L2+(N?.filter((V)=>V.account).length??0),name:Z.name,device_id:K?.deviceId??null,organization_id:K?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:X9(Z,Y.platform),cloud_sessions:Z.cloudSessions===!0,root:K?.roots[0]?{id:K.roots[0].id,permissions:K.roots[0].permissions}:null,roots:K?.roots.map((V)=>({id:V.id,folder:V.path,permissions:V.permissions}))??[],state:H?"removed":Q?Q.phase==="running"?"connected":Q.phase:"not_running",sessions_running:Q?.activeSessions??null,version:X,service:G?{label:G.label,logs:G.logs}:null}}async function wD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=C0(F0(d0(V1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?DJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function bD($={}){try{let J=V1($.home??V0());return C0(F0(d0(J,$.channel??P0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function kD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;return _1(Z,$.serviceHost??K1(J),"connect")?.label??null}async function yD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??K1(J),X=await BJ(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return XV(Z,Q,$)}async function XV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&u$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let H=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<H&&await Q($,"status").catch(()=>null)!==null)await new Promise((V)=>setTimeout(V,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??mJ)(G,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
-export{Z1 as a,H1 as b,C9 as c,d,S2 as e,C0 as f,dK as g,lK as h,d0 as i,CD as j,ID as k,PD as l,xD as m,ED as n,SD as o,wD as p,bD as q,kD as r,yD as s};
+`);return G?1:0}async function bD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=await($.controlWorker??H0)(Z,"status").catch(()=>null),X=Q?d$(Z):null,Y=$.serviceHost??K1(J),G=D$(Z,Y,"connect"),H=$0(Z).revoked,K=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:N,off:q}=H||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:a9(Z,Q?.phase==="running");return{workspaces:N,workspaces_off:q,workspaces_max:L2+(N?.filter((V)=>V.account).length??0),name:Z.name,device_id:K?.deviceId??null,organization_id:K?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:X9(Z,Y.platform),cloud_sessions:Z.cloudSessions===!0,root:K?.roots[0]?{id:K.roots[0].id,permissions:K.roots[0].permissions}:null,roots:K?.roots.map((V)=>({id:V.id,folder:V.path,permissions:V.permissions}))??[],state:H?"removed":Q?Q.phase==="running"?"connected":Q.phase:"not_running",sessions_running:Q?.activeSessions??null,version:X,service:G?{label:G.label,logs:G.logs}:null}}async function kD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=C0(F0(d0(V1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?jJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function yD($={}){try{let J=V1($.home??V0());return C0(F0(d0(J,$.channel??P0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function fD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;return _1(Z,$.serviceHost??K1(J),"connect")?.label??null}async function hD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??K1(J),X=await KJ(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return GV(Z,Q,$)}async function GV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&d$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let H=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<H&&await Q($,"status").catch(()=>null)!==null)await new Promise((V)=>setTimeout(V,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??vJ)(G,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
+export{Z1 as a,H1 as b,I9 as c,d,S2 as e,C0 as f,pK as g,cK as h,d0 as i,PD as j,xD as k,ED as l,SD as m,wD as n,bD as o,kD as p,yD as q,fD as r,hD as s};