@reason-machines/cli-linux-arm64-musl 0.2.281 → 0.2.283

package/bin/vm-hands/vm-hands-entry-lite-c0whrdtr.js

@@ -1,343 +0,0 @@
-// @bun
-import{t as u0}from"./vm-hands-entry-lite-k4c504n7.js";import{A as o8,B as e8,C as F7,D as W7,E as v3,F as g5,G as Z5,H as _0,I as l$,J as p$,K as E0,L as J2,M as u5,N as t0,O as G6,P as Z3,Q as i5,U as n5,ba as j7,ca as z7,da as O7,ea as A7,fa as u3,y as y6,z as f6}from"./vm-hands-entry-lite-rwdevjb0.js";import{Aa as $5,Ba as J5,Ca as N7,Da as U7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as H5,Ka as M7,La as W$,Oa as K4,Pa as V4,Qa as WJ,Ra as LJ,Sa as DJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as T7,db as X6,fb as w8,ha as d7,ib as g2,ka as M5,kb as v5,la as T5,lb as T3,nb as x5,oa as V5,qa as z5,rb as _7,sb as N3,ta as O5,ya as I5,za as P5}from"./vm-hands-entry-lite-t678ape1.js";import{Ab as A5,Bb as R5,Ib as C5}from"./vm-hands-entry-lite-c2nrar90.js";import{Nb as Q5}from"./vm-hands-entry-lite-65pbrs1x.js";import{Ub as m5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Cc as l5,Fc as L7,Ic as h6,Jc as m6,mc as a1,nc as K1,oc as T1,pc as L$,qc as ZJ,rc as zJ,sc as OJ,tc as D$,uc as AJ,vc as X4,wc as _1,xc as R8,yc as Y4}from"./vm-hands-entry-lite-bm9x8vng.js";import{Fd as e1,Pd as F2,Tc as b2,Xc as V7,Yc as H7,zd as t8}from"./vm-hands-entry-lite-gqncr2j0.js";import{_d as B}from"./vm-hands-entry-lite-sv6xwe0h.js";import{ge as jJ,he as t2,ke as D7,ne as n$,pe as dJ,qe as lJ,ve as a5}from"./vm-hands-entry-lite-rs7g2egs.js";import{$e as y$,Ae as k$,Ce as P0,De as D4,Fe as J1,Ge as z0,He as E9,Ie as _J,Je as FJ,Ke as E2,Le as q2,Me as f3,Ne as O8,Oe as A8,Pe as X$,Qe as v$,Re as X0,Se as T2,Te as I7,Ue as P7,Ve as o1,We as A4,Ye as Q3,Ze as h1,_e as m0,af as X3,df as m1,ze as b0}from"./vm-hands-entry-lite-bfwf82rw.js";import{hf as j5}from"./vm-hands-entry-lite-ptmqg51y.js";import{fg as NJ,ig as d5,jg as h3,lg as X5}from"./vm-hands-entry-lite-d2xzrjx2.js";import{Ug as Z2,Vg as h5}from"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as V0,Zg as J7}from"./vm-hands-entry-lite-9pmag2qk.js";import{uh as r}from"./vm-hands-entry-lite-zjnq10yb.js";import{Bh as q7}from"./vm-hands-entry-lite-anaydk9m.js";import{Gh as v0}from"./vm-hands-entry-lite-ffg7rf02.js";import{spawn as RJ,spawnSync as vK}from"child_process";import{closeSync as CJ,mkdirSync as gK,openSync as IJ,readdirSync as uK,realpathSync as V1,rmSync as z$}from"fs";import{hostname as dK}from"os";import{dirname as e3,join as F0,resolve as lK}from"path";var cJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function H9($){let J=typeof $==="string"?cJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as eJ,randomBytes as L9}from"crypto";import{createInterface as $Z}from"readline";import{randomBytes as sJ}from"crypto";import{chmodSync as U9,existsSync as q9,lstatSync as aJ,mkdirSync as iJ,readFileSync as M9,renameSync as nJ,unlinkSync as T9,writeFileSync as _9}from"fs";import{homedir as rJ}from"os";import{dirname as tJ,join as N9}from"path";function Z1($=process.env,J=rJ()){let Z=$.XDG_CONFIG_HOME?.trim()||N9(J,".config"),X=P0({env:$})==="staging"?["staging"]:[];return N9(q2(Z,...X),"credentials.json")}function F9($,J=Z1()){return iJ(tJ(J),{recursive:!0,mode:448}),_9(J,`${JSON.stringify($,null,2)}
-`,{mode:384}),U9(J,384),J}function P$($=Z1()){if(!q9($))return null;try{let J=M9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=J1(Q);if(X!==Q)oJ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function oJ($,J,Z){let Q=`${$}.${process.pid}.${sJ(6).toString("hex")}.tmp`;try{let X=aJ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(_9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
-`,{mode:384,flag:"wx"}),U9(Q,384),M9($,"utf8")!==J)throw Error("credentials_changed");nJ(Q,$)}catch{try{T9(Q)}catch{}}}function W9($=Z1()){if(!q9($))return!1;return T9($),!0}class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function j9(){let $=L9(48).toString("base64url"),J=eJ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:L9(32).toString("base64url")}}function JZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function ZZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw JZ(Y,`OAuth token request failed (${X.status})`);return Y}var QZ=1e4;async function XZ($,J={}){let Z=J.fetchImpl??fetch,Q=await ZZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(QZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return F9(X,J.path??Z1()),X}var M2=new Map;function D9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function b1($={}){let J=$.path??Z1(),Z=P$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=M2.get(Y);if(G)return D9(G,$.signal);let H;return H=XZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=P$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return b1({fetchImpl:$.fetchImpl,path:J});return W9(J),null}).finally(()=>{if(M2.get(Y)===H)M2.delete(Y)}),M2.set(Y,H),D9(H,$.signal)}function z9($,J){return new Promise((Z)=>{let Q=$Z({input:$}),X=!1,Y=(H)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(H)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(H)=>Y(H)),Q.once("close",()=>Y(null))})}var YZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),GZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function BZ($){let J=GZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var KZ=["minimal","low","medium","high","xhigh","max"],VZ=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),HZ=B.object({devices:B.array(VZ),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),NZ=B.object({id:B.string().min(1),name:B.string()}),UZ=B.object({items:B.array(NZ)}),qZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),MZ=B.object({items:B.array(qZ).default([])}),TZ=B.enum(["linux","macos"]),O9=B.object({id:B.string().min(1),name:B.string().min(1),platform:TZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),_Z=B.object({machines:B.array(O9)}),FZ=B.object({machine:O9}),WZ=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),LZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),A9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),DZ=A9.extend({organization_id:B.string().min(1)}),SV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var wV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function k1($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var jZ=B.object({error:B.object({type:B.string(),message:B.string()})});function R9($,J,Z){let Q=jZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",H=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(H)&&H>=0?H*1000:void 0)}async function C9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw R9(J.status,Z,J.headers.get("retry-after"));return k1(DZ,Z,"invalid_machine_ticket")}class H1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await b1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw R9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return k1(_Z,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return k1(FZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return k1(WZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return k1(LZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return k1(A9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=UZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return k1(MZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=HZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:KZ.filter((H)=>Q.includes(H))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return H9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=YZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=BZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments`)).items??[]}catch(J){if(J instanceof G0&&(J.status===403||J.status===404))return[];throw J}}async requireSessionAttachments(){if((await this.request("/deployment")).session_attachments!==!0)throw Error("This server does not support Session image attachments yet. Update the server and retry; the image was not sent.")}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return D4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function zZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function j4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function I9($,J){let Z=$.env??process.env,Q=j4(Z);if(!Q)return($.getCredentials??b1)({apiOrigin:zZ(Z),signal:J});let X=y1(Z,$.channel??P0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),G=await Y.json().catch(()=>({})),H=t0(G)?G:{};if(!Y.ok){let N=typeof H.detail==="string"?H.detail:typeof H.message==="string"?H.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof H.error==="string"?H.error:"api_key_auth_failed",N)}if(typeof H.org_id!=="string"||!H.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(H.scopes)?H.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:H.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as OZ}from"crypto";import{unlinkSync as AZ}from"fs";import{platform as RZ}from"os";import{join as CZ}from"path";var P9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>CZ($,"api-key.json");function j1($){let J=OZ("sha256").update(`reason-connect-api-key
-${$}`).digest("hex");return new o1(T2(),RZ(),J)}function z4($,J,Z=j1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof X0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=j1($)){if(!u(f1($)))return null;let Z=P9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof X0))throw Q;throw Error("worker_api_key_unreadable")}}function x9($,J=j1($)){if(!u(f1($)))return;if(P9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof X0))throw Z}AZ(f1($))}async function O4($,J){let Z;try{Z=await I9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as cZ,renameSync as sZ,rmSync as v1}from"fs";import{join as q0}from"path";import{createHash as IZ}from"crypto";import{realpathSync as PZ,statSync as xZ,unlinkSync as _2}from"fs";import{platform as EZ}from"os";import{join as y0}from"path";function d($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var SZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max(e1).optional()});function S9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function R4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=SZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?C4($):new A4(g($))}function W2($,J){T0($,!0),kZ($);let Z=J??C4($),Q=new A4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof X0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function C4($){return new o1(T2(),EZ(),wZ($))}function wZ($){let J=I4($);return IZ("sha256").update(`reason-worker
-${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,directory:I4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function w9($){return u(y0(g($),w$))}var bZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function I4($){let J=y0(g($),w$);if(!u(J))return null;let Z=bZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function kZ($){let J=y0(g($),w$);if(!u(J))return;if(I4($))try{let Z=C4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof X0))throw Z}_2(J)}function N1($){let J=PZ($.workspaceRoot);if(J!==$.workspaceRoot||!xZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&E9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var b9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=d($).control;return u(J)?b9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(d($).control,b9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),w$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var yZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),P4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:yZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),fZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),x4=30000;class Q1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function hZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(x4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new Q1(X?.error==="device_revoked")}return Q.json()}async function E4($,J,Z,Q){u0();let X=P4.parse(JSON.parse(s(J)));return X1($,X,Z,Q)}async function X1($,J,Z,Q=(Y,G)=>hZ(Y,G,k0($.proxy)),X=performance.now()){let Y=y9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function k9($,J,Z,Q,X=performance.now()){let Y=y9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function y9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=fZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let V=F2(q.first_heartbeat);try{S9($,q.device_id,{...V?{offer:V}:{},enrollmentMs:Math.min(e1,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as mZ,randomUUID as vZ}from"crypto";import{unlinkSync as gZ}from"fs";import{join as uZ}from"path";var f9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),dZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function S4($){return dZ.parse($)}var lZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function z1($){return Z1(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function O1($,J=z1($)){if(!u(J))return null;let Z=lZ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,H)=>Q(G,{...H,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await b1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function h9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function m9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=A1($),H=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(H){let K=await k9($,G.direct(J.orgId),Q,(N,q)=>H({approval:G.request,code_verifier:q,registration:N}).catch((V)=>{throw pZ(V)}),Y);if(K)return K}return X1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function pZ($){if(!($ instanceof G0))return $;if($.status===409)return new Q1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new Q1(!1);return $}var b$=($)=>uZ(g($),"enrollment-install.json");function v9($){if(u(b$($)))gZ(b$($))}function A1($,{stored:J=!0}={}){u0();let Z=b$($),Q=J&&u(Z)?f9.parse(JSON.parse(s(Z))):{version:1,install_id:vZ(),fingerprint_key:mZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let H=($.folders??[]).map((V)=>{let U=m1([V],X,Y)[0];if(U.path!==V)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=j9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...H.map((V)=>V.path_fingerprint)].map((V)=>({path_fingerprint:V,permissions:X,execution_mode:$.executionMode}))},q=(V)=>({version:1,organization_id:V,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...H.length?{folders:H}:{}});return{request:N,saveInstall(V){e(g(V),!0),c(b$(V),Q)},complete(V,U){let M=S4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(V),enrollment_ticket:M.enrollment_ticket}},direct:q}}function g9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=f9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,l9=600000,p9=15000,u9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,U1=($)=>q0(g($),"workspaces"),c9="account.json",w4=($)=>u(q0($,c9));function h0($){let J;try{J=cZ(U1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=q0(U1($),Z),X=q0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:w4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(U1($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,c9),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var b4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function d9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of b4)v1(q0(g(J),Y),{force:!0});for(let Y of b4){let G=q0(g($),Y);if(u(G))sZ(G,q0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function k4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(f4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(V)=>Number(Date.parse(V.worker?.expiresAt??"")>X+60000),H=h0($).flatMap((V)=>{if(!V.account||!V.config)return[];try{if($0(V.config).revoked)return[];let U=t(V.config);return U&&U.orgId.toLowerCase()===V.organizationId&&(!Q||Y(U))?[{...V,config:V.config,state:U}]:[]}catch{return[]}}).sort((V,U)=>Number(U.organizationId===J)-Number(V.organizationId===J)||Y(U.state)-Y(V.state))[0];if(!H)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==H.organizationId){let V=j2($,N);d9($,V.config),c(V.configPath,V.config)}else if(u(g($))){try{if(u(d($).state))f0($)}catch{}for(let V of b4)v1(q0(g($),V),{force:!0})}k4($);let q=J0.parse({...H.config,stateDirectory:$.stateDirectory});return d9(H.config,q),c(q0($.stateDirectory,"worker.json"),q),v1(H.directory,{recursive:!0,force:!0}),q}var y4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==q0(U1($),Z))continue;let H=J0.parse({...G,stateDirectory:Q}),K=T0(H),N=h1(d(H).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(H)}},d(H).state,{proofStore:K});c(X,H)}catch{}}}},f4=($)=>q0(U1($),"listed.json");function s9($){try{let J=JSON.parse(s(f4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function a9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=s9($),G=Y&&!Y.listed?Y.reason:null,H=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&H.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...H].map(({organizationId:K,config:N,account:q})=>{let V=!1,U=null,M=!1;try{V=N?$0(N).revoked:!1,U=N&&!V?t(N):null,M=J&&!!U&&y$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:V?"removed":M?"connected":"not_running",blocked:!q&&!V&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function i9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,H=null,K=!1,N=s9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...C}=J,P=Z.roots.slice(1).map((R)=>R.path);return J0.parse({...C,...P.length?{folders:P}:{},stateDirectory:q0(U1(J),W)})},V=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let C=new AbortController,P=()=>C.abort();if(X.addEventListener("abort",P,{once:!0}),X.aborted)C.abort();let R={...W,controller:C,claims:0,done:Promise.resolve(),account:L};R.done=$.serve(W,C.signal,(I)=>{R.claims=I}).then(()=>{return},(I)=>{if(L&&I instanceof _0&&I.status===401&&u9.has(I.code)){try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer (${I.code}); run \`reason connect\` signed in as that account to connect it again
-`)}else if(I instanceof _0&&I.status===401&&u9.has(I.code)){try{f0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
-`)}else if(!C.signal.aborted)Y(`Reason worker: workspace ${W.organizationId} stopped (worker_workspace_failed); it starts again on the next check
-`)}).finally(()=>{if(C.abort(),X.removeEventListener("abort",P),R.claims=0,G.get(W.organizationId)===R)G.delete(W.organizationId);let I=W.config.stateDirectory;if(L&&!w4(I)&&!u(q0(I,"worker.json")))v1(I,{recursive:!0,force:!0})}),G.set(W.organizationId,R)},M=(W,L)=>{if(!L)return null;try{let C=q(W),P=t(L);if(!P||P.orgId!==W||Date.parse(P.worker?.expiresAt??"")<=Date.now()+60000||L.name!==C.name||L.executionMode!==C.executionMode||!z0(L.apiOrigin,C.apiOrigin)||P.roots.map((R)=>R.path).join(`
-`)!==Z.roots.map((R)=>R.path).join(`
-`))return null;return{organizationId:W,config:L,state:P,proofStore:T0(L)}}catch{return null}},T=(W,L)=>{if(!L)return null;try{if($0(L).revoked)return null;let C=t(L);if(!C||C.orgId.toLowerCase()!==W||Date.parse(C.worker?.expiresAt??"")<=Date.now()+60000||L.executionMode!==J.executionMode||!z0(L.apiOrigin,J.apiOrigin))return null;return{organizationId:W,config:L,state:C,proofStore:T0(L)}}catch{return null}},_=(W,L)=>W.deviceId===L.deviceId&&W.devicePublicKey===L.devicePublicKey&&JSON.stringify(W.roots.map((C)=>[C.id,C.path]))===JSON.stringify(L.roots.map((C)=>[C.id,C.path])),D=async(W)=>{for(let[L,C]of W){if(X.aborted)return;let P=G.get(L),R=T(L,C.config);if(P&&R&&_(P.state,R.state))continue;if(P){if(P.claims>0)continue;await V(L)}if(R&&!X.aborted)U(R,!0)}for(let[L,C]of G)if(C.account&&!W.has(L)&&C.claims===0)await V(L)},j=async(W)=>{let L=q(W),C=J0.parse({...L,stateDirectory:J.stateDirectory});if(!u(q0(g(J),"enrollment-install.json")))return null;let P=A1(C),R=await Q.ownerWorkspaceEnrollment(Z,{organization_id:W,install_id:P.request.install_id,code_challenge:P.request.code_challenge},X),I=P.complete(W,R);if(e(g(L),!0),u(d(L).state))f0(L);let E=W2(L);try{let w=await X1(L,I,E,$.enroll);return m0(w,d(L).state,{proofStore:E}),x0(L,{version:1,drained:!1,revoked:!1}),c(q0(L.stateDirectory,"worker.json"),L),{organizationId:W,config:L,state:w,proofStore:E}}catch(w){if(w instanceof Q1&&w.deviceRemoved)return x0(L,{version:1,drained:!0,revoked:!0}),c(q0(L.stateDirectory,"worker.json"),L),null;throw w}},z=async()=>{let W=h0(J),L=new Map(W.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await D(L);let C=new Map(W.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),P=(A)=>L.has(A)||G.get(A)?.account===!0||w4(q0(U1(J),A)),R=(A)=>{let f=C.get(A)?.config;try{return f?$0(f).revoked:!1}catch{return!1}};for(let[A,f]of C){if(G.has(A)||R(A)||N.blocked.includes(A))continue;let b=M(A,f.config);if(b&&!X.aborted)U(b)}let I;try{I=await Q.ownerWorkspaces(Z,X)}catch(A){return N={listed:!1,blocked:N.blocked,...N.names?{names:N.names}:{},reason:A instanceof _0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let E=new Map(I.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>D2.test(A)&&A!==Z.orgId.toLowerCase()&&!P(A))),w=[...E.keys()].filter((A)=>C.has(A)?!R(A):!E.get(A)).slice(0,L2),h=[...G.values()].filter((A)=>!A.account&&A.claims>0&&!w.includes(A.organizationId)).length,l=w.filter((A)=>!C.has(A)),k=l.slice(l.length-Math.min(Math.max(0,w.length+h-L2),l.length)),x=w.filter((A)=>!k.includes(A)),S=Object.fromEntries(I.flatMap((A)=>A.name&&x.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));N={listed:!0,reason:null,blocked:x.filter((A)=>E.get(A)),names:S};for(let A of new Set([...C.keys(),...G.keys()])){if(x.includes(A)||P(A))continue;if(E.has(A)&&R(A))continue;if((G.get(A)?.claims??0)>0)continue;await V(A);let f=C.get(A)?.config;try{if(f&&u(d(f).state))f0(f)}catch{}v1(q0(U1(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
-`)}for(let A of x){if(X.aborted)return!0;if(P(A))continue;try{let f=G.get(A);if(E.get(A)){if(f&&f.claims===0)await V(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
-`);continue}let b=M(A,C.get(A)?.config??null);if(b&&f)continue;if(!b){if(f&&f.claims>0)continue;if(await V(A),b=await j(A),b)Y(`Reason worker: connected in workspace ${A}
-`)}if(b&&!X.aborted)U(b)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
-`)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(U1(J),!0),c(f4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(H)K=!0;else H=O().finally(()=>{H=null});return H},claims:()=>[...G.values()].reduce((W,L)=>W+L.claims,0),async settled(){await H,await Promise.all([...G.values()].map((W)=>W.done))}}}import{dirname as DQ}from"path";import{randomUUID as $$}from"crypto";import{chmodSync as o9,closeSync as J$,constants as Z$,existsSync as eZ,fstatSync as e9,lstatSync as $8,mkdirSync as J8,openSync as Z8,readFileSync as Q8,readdirSync as X8,readlinkSync as WN,realpathSync as LN,renameSync as Q$,rmSync as h4,statSync as Y8,symlinkSync as DN,unlinkSync as m$,writeFileSync as m4}from"fs";import{basename as zN,dirname as G8,isAbsolute as $Q,join as D0,relative as ON,resolve as AN,sep as RN}from"path";import{createRequire as JQ}from"module";var B8=1,K8=1,ZQ=128,QQ=65536;var XQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var n9=/^[a-z0-9_.-]{1,80}$/,YQ=64;var GQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function V8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function H8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&XQ.test($)}function N8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function g4($){J8($,{recursive:!0,mode:448}),o9($,448)}function BQ($,J){g4(G8($));let Z=`${$}.${process.pid}.${$$()}.tmp`;try{m4(Z,J,{mode:384,flag:"wx"}),o9(Z,384),Q$(Z,$)}finally{if(eZ(Z))m$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new v$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=b0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?b0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&$Q(X))?null:D0($.home??V0(),"Library","Application Support"),H=$.root??(G?D0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:H,...G?{legacyRoot:D0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(H,"versions"),current:D0(H,"current"),previous:D0(H,"previous"),brokerLock:D0(H,"broker.lock"),transitionLock:D0(H,"transition.lock"),lifecycleEvents:D0(H,"lifecycle-events")}}function KQ($){return V8($)&&H8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===B8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&N8($.started_at)&&R2($.runtime_version)}function U8($,J){try{let Z=$8($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=Z8(D0($,J),Z$.O_RDONLY|Z$.O_NOFOLLOW|Z$.O_NONBLOCK);try{let X=e9(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return Q8(Q,"utf8")}finally{J$(Q)}}catch{return null}}function v4($){try{let J=JSON.parse(U8($,"owner.json")??"null");return KQ(J)?J:null}catch{return null}}function q8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var r9="lease",VQ=2,HQ=4,h$;function NQ(){if(h$!==void 0)return h$;if(h$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=JQ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return h$={flock:(G,H)=>X.symbols.flock(G,H),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},h$}catch{}return null}function UQ($){let J=NQ();if(!J)return null;let Z=Z8(`${$}.lease`,Z$.O_RDWR|Z$.O_CREAT|Z$.O_NOFOLLOW,384);try{let Q=e9(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return J$(Z),"busy";if(J.flock(Z,VQ|HQ)===0)return Z;let X=J.errno();return J$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw J$(Z),Q}}function Y1($){g4(G8($.path));let J=UQ($.path);if(J==="busy")return{acquired:!1,owner:v4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=qQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)J$(J)}}function qQ($,J){let Z=$.alive??q8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:B8,pid:$.pid??process.pid,nonce:$.nonce?.()??$$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${$$()}`,H=!1;try{if(J8(G,{mode:448}),m4(D0(G,"owner.json"),`${JSON.stringify(Y)}
-`,{mode:384,flag:"wx"}),J!==null)m4(D0(G,r9),`flock
-`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw $8($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}Q$(G,$.path),H=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,v4($.path)?.nonce===Y.nonce)h4($.path,{recursive:!0,force:!0});if(J!==null)J$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=v4($.path),V=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?V-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&U8($.path,r9)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${$$()}`;try{Q$($.path,T),h4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!H)h4(G,{recursive:!0,force:!0})}}throw new v$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function M8($){return V8($)&&H8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===K8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&N8($.occurred_at)&&typeof $.event==="string"&&GQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&n9.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=YQ&&$.capabilities.every((J)=>typeof J==="string"&&n9.test(J)))}var MQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,TQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,_Q=300000,A2=0n;function FQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function T8($){try{return X8($.lifecycleEvents).filter((J)=>MQ.test(J)).sort()}catch{return[]}}function t9($){try{let J=JSON.parse(Q8($,"utf8"));return M8(J)?J:null}catch{return null}}function WQ($,J=q8,Z=Date.now()){let Q;try{Q=X8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(TQ);if(!Y)continue;let G=D0($.lifecycleEvents,X),H=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-Y8(G).mtimeMs>=_Q}catch{continue}if(!K)continue;try{Q$(G,H)}catch(N){let q=N.code;if(q==="EEXIST")m$(G);else if(q!=="ENOENT")throw N}}}function LQ($){let Z=T8($).flatMap((X)=>{try{return[{name:X,size:Y8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>ZQ||Q>QQ){let X=Z.shift();if(!X)break;try{m$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function g$($,J,Z={}){let Q={schema_version:K8,event_id:Z.eventId?.()??$$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!M8(Q))throw new v$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return g4($.lifecycleEvents),BQ(D0($.lifecycleEvents,FQ(Q)),`${JSON.stringify(Q)}
-`),LQ($),Q}async function _8($,J,Z){WQ($);let Q=0;for(let X of T8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=t9(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${$$()}`;try{Q$(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let H=t9(G);if(!H){m$(G);continue}try{await J(H),m$(G),Q+=1}catch{try{Q$(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function L8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!jQ($.saved))return J;let Z=$.saved,Q=(G,H)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...H?{code:`worker_api_origin_move_${G}:${H}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?X$():$.native;if(!X)return J;let Y=[];try{let G=X.lock(DQ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let q=Y1({path:d(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let H=J0.parse(JSON.parse(s($.configPath)));if(H.stateDirectory!==Z.stateDirectory)return J;let K=D8(H),N={saved:H,configPath:$.configPath};if(!I2(H)&&K.length===0)return Q("unchanged"),N;if(I2(H)){let q=F8(H);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,F8(q.config))}catch(V){Q("failed",`workspace:${W8(V)}`)}return Q("moved"),N}catch(G){return Q("failed",W8(G)),J}finally{for(let G of Y.reverse())G()}}function I2($){return J1($.apiOrigin)!==$.apiOrigin}function D8($){return h0($).filter((J)=>J.config!==null&&I2(J.config))}function jQ($){return I2($)||D8($).length>0}function F8($){let J=J0.parse({...$,apiOrigin:J1($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)m0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function W8($){if($ instanceof X0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as zQ,lstatSync as l4,readdirSync as C8,readlinkSync as OQ,unlinkSync as AQ}from"fs";import{join as O0,sep as RQ}from"path";var P2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function I8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),G=O0(Z,"reason",...X),H=(V,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:V,...U?{code:`worker_state_rehome_${V}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?X$():$.native,N=$.saved,q=[];try{if(N&&z8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:G};if(!u4(K,G,j,q))return J;return j8(N,j,$.host,H)}if(N&&z8(Q)&&N.stateDirectory===G&&w9(N)&&u4(K,G,N,q))return P8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!Y$(Q)?.isDirectory())return J;if(SQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,P2),{version:r});return H("skipped",j),J},M=[Y];for(let j of IQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!CQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!u4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(O8(Z)!==null)return U("conflicting_identity");if(A8(Z)!==null)return U("conflicting_files");if(Y$(G)&&(!Y$(G).isDirectory()||C8(G).length>0))return U("connection_folder_taken");S$(N,T.devicePublicKey),y4.before(N);let _=p0(Y);if(_&&d4(Y))PQ(G,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&d4(Y))x8(G);return U(D.problem??"config_folder_kept")}return j8(N,{...N,stateDirectory:G},$.host,H)}catch(V){try{if(Y$(Y)?.isDirectory())c(O0(Y,P2),{version:r})}catch{}return H("failed",wQ(V)),EQ(N,Y,G,J)}finally{for(let V of q.reverse())V()}}function j8($,J,Z,Q){let X=l4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)zQ(J.stateDirectory,448);let Y=T0(J),G=h1(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new x2("identity_missing");let H=U0(J);if(G.worker.configDigest===U0($))m0({...G,worker:{...G.worker,configDigest:H}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==H)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),y4.after($,J),P8($,J,Z);let K=O0(J.stateDirectory,P2);if(u(K))AQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function P8($,J,Z){if(R8($,J,Z,"connect"),!d4(J.stateDirectory))return;let Q=xQ(j1($.stateDirectory));if(!Q)return;let X=j1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);x8($.stateDirectory)}function u4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Y1({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function CQ($,J,Z){if(u(g(J))){let X=Y1({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=Y$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function IQ($,J){let Z=[$,...C8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=O0(X,Y);if(G===J||!Y$(O0(G,"worker.json")))continue;let H=E8(G);if(!H||H.stateDirectory===$||H.stateDirectory.startsWith($+RQ))Q.push({directory:G,config:H})}return Q}function d4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function PQ($,J){let Z=j1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function x8($){try{j1($).deleteBinding()}catch(J){if(!(J instanceof X0))throw J}}function xQ($){try{return $.loadBinding()}catch(J){if(J instanceof X0)return null;throw J}}function EQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=E8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function z8($){try{return l4($).isSymbolicLink()&&OQ($)==="reason"}catch{return!1}}function SQ($){try{let J=JSON.parse(s(O0($,P2)));return typeof J.version==="string"?J.version:null}catch{return null}}function E8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function Y$($){try{return l4($)}catch{return null}}function wQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof X0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as bQ}from"fs";function S2($){try{let J=JSON.parse(bQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function S8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as _K}from"crypto";import{readdirSync as FK,realpathSync as QJ,statSync as WK}from"fs";import{hostname as LK}from"os";import{join as n1,resolve as DK}from"path";var w2="cloud",kQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function u$($){return kQ.test($)&&!w8.test($)}var yQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function G$($){return yQ[$]}import{chmodSync as fQ,lstatSync as k2,mkdtempSync as hQ,realpathSync as f8,rmdirSync as mQ,rmSync as vQ,unlinkSync as gQ}from"fs";import{createConnection as uQ,createServer as dQ}from"net";import{basename as b8,dirname as k8,join as B$}from"path";var lQ=B.enum(["status","drain","resume","stop","reload_roots"]),pQ=B.strictObject({version:B.literal(1),instanceId:B.string(),deviceId:B.string(),phase:B.enum(["starting","running","reconnecting","stopping"]),drained:B.boolean(),activeClaims:B.number().int().nonnegative(),activeSessions:B.number().int().nonnegative().optional(),executionEligible:B.boolean(),supportedOperations:B.array(B.enum(b2)).max(b2.length).optional(),capabilityReadiness:B.partialRecord(B.enum(b2),B.boolean()).optional(),lastHeartbeat:B.string().nullable(),expiresAt:B.string()}),cQ=B.strictObject({nonce:B.string(),action:lQ}),sQ=B.object({nonce:B.uuid()}),h8=B.strictObject({version:B.literal(1),nonce:B.uuid(),socketPath:B.string().max(100)});function m8($){return B$(d($).lock,"control.json")}function p4($){return e(d($).lock),sQ.parse(JSON.parse(s(B$(d($).lock,"owner.json"))))}function y8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function aQ($,J){let Z=m8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return y8(Y)?Y:null}let Q=h8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=k8(Q.socketPath);if(k8(X)!==f8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(b8(X))||b8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),y8(Q.socketPath)?Q.socketPath:null}async function y2($,J,Z){if(p4($).nonce!==J)throw Error("worker_instance_changed");let Q=m8($);if(u(Q))throw Error("worker_control_already_serving");let X=hQ(B$(f8("/tmp"),"ara-worker-")),Y=B$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,H=dQ((V)=>{G.add(V),V.once("close",()=>G.delete(V)),V.setTimeout(2000,()=>V.destroy());let U="",M=!1;V.on("error",()=>V.destroy()),V.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){V.destroy();return}if(!U.includes(`
-`))return;M=!0;try{let _=cQ.parse(JSON.parse(U));if(_.nonce!==J){V.destroy();return}V.end(JSON.stringify(Z(_.action))+`
-`)}catch{V.destroy()}})});H.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let V of G)V.destroy();if(await new Promise((V)=>H.close(()=>V())),K&&u(Q)){let V=k2(Q);if(V.isFile()&&V.dev===K.dev&&V.ino===K.ino)try{let U=h8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)gQ(Q)}catch{}}try{mQ(X)}catch{}};try{if(await new Promise((V,U)=>{H.once("error",U),H.listen(Y,()=>{fQ(Y,384),V()})}),p4($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(V){throw await q(),V}}function v8($,J){try{let Z=JSON.parse(s(B$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function d$($){return v8($,"runtime_version")}function iQ($){return v8($,"nonce")}var nQ=21600000,rQ=B.strictObject({instance:B.string().nullable(),since:B.number().int().nonnegative()});function tQ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=rQ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{vQ(d($).updateDeferral,{force:!0})}catch{}}async function f2($,J,Z=()=>!1){let Q=iQ($),X=tQ($,Q);if(J!==void 0){let N=d$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),H=X;if(H===null){H=G;try{c(d($).updateDeferral,{instance:Q,since:H})}catch{}}let K=G-H;return{state:K<nQ?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=d($);if(!u(B$(Z.lock,"owner.json")))return null;let Q=p4($),X=aQ($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let H=uQ(X),K="",N=!1,q=(V,U)=>{if(N)return;if(N=!0,H.destroy(),U)G(U);else Y(V)};H.setTimeout(2000,()=>H.destroy(Error("worker_control_timeout"))),H.on("connect",()=>H.write(JSON.stringify({nonce:Q.nonce,action:J})+`
-`)),H.on("data",(V)=>{if(K+=V.toString(),Buffer.byteLength(K)>16384)H.destroy(Error("worker_control_oversize"))}),H.on("error",(V)=>{if("code"in V&&["ECONNREFUSED","ENOENT"].includes(String(V.code)))q(null);else q(null,Error("worker_control_unavailable"))}),H.on("end",()=>{try{let V=pQ.parse(JSON.parse(K));if(V.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(V)}catch{q(null,Error("worker_control_invalid_response"))}}),H.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as eG}from"crypto";import{homedir as Y7}from"os";import{spawn as oQ}from"child_process";async function g8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),H=(V)=>{if(Q===V)return;Q=V,J.onStatusChange?.(V)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let V=(J.spawn??oQ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=V,V.once("exit",()=>{if(!X&&Z===V)H("failed"),K()}),await new Promise((U,M)=>{V.once("spawn",U),V.once("error",M)}),V.exitCode===null&&V.signalCode===null)H("held")}catch{H("failed"),K()}};G=N(),await G;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await G;let V=Z;if(!V||V.exitCode!==null||V.signalCode!==null||!V.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{V.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);V.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{V.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class h2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as QX}from"fs";import{constants as s4}from"fs";import{open as eQ}from"fs/promises";import{join as $X}from"path";var JX={platform:process.platform,home:V0,async openFile($){let J=await eQ($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function u8($=JX){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile($X($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function ZX($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((H,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function d8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await ZX($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?l$(X.status):p$(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var XX=1000,YX=250,GX=X5(QX(process.execPath)),l8=null,p8=null;function Y5($){if(process.platform!=="darwin")return{};return p8??=u8().then((J)=>{l8={status:J,checkedAt:$().getTime()}}).finally(()=>{p8=null}),{fullDiskAccess:{...l8??{status:"unknown",checkedAt:$().getTime()},executablePath:GX}}}var c8=8,BX=2000,KX=2000,G3=8000,s8=3,VX=250,a8=1000,i8=30000,HX=0.2,NX=30000,UX=21600000,qX=300000,MX=3600000,TX=0.1,G5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function _X($){return Math.min(s8,Math.max(1,$??s8))}function FX($){return typeof $.reason_code==="string"&&G5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof v0&&($.reason.code==="cancelled"||G5.has($.reason.code))?$.reason.code:"cancelled"}function n8($){return $ instanceof v0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function B5($){return $.capability==="hands.connect"&&(J5($.payload)||$5($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*TX)))}function WX($,J=Math.random){let Z=Math.min(i8,a8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*HX*(Q*2-1);return Math.min(i8,Math.max(a8,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function LX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function o0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function DX($){if($ instanceof v2||$ instanceof K$||$ instanceof s$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function c$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(o0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:DX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)c$($,J,Q);throw Q}}class s$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,H=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,V,U=new Promise((_,D)=>{let j=()=>{let F=new s$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(V=()=>z(Math.max(0,Math.min(N-performance.now(),BX))),z(K),$.signal.addEventListener("abort",V,{once:!0}),$.signal.aborted)V()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),U]);break}catch(_){if(G.aborted||$.signal.aborted||E0(_)||o0(_)||!jX(_)||performance.now()>=N)throw c$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw c$($,"completion",_),_;try{await H(D,G)}catch{throw c$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",V),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function jX($){if(E0($))return!1;if(o0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof s$)return!1;return!0}return!1}class v2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function m2($){if($ instanceof v2)return!0;return $ instanceof _0?l$($.status):p$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function zX($,J,Z,Q,X){let Y=new AbortController,G,H=()=>{return},K=new Promise((q,V)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),V(M)};if(H=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,V)=>{G=setTimeout(()=>{let U=new v2;Y.abort(U),V(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);H()}}async function r8($,J,Z,Q,X,Y){let G=_X($.operationHeartbeatMaxAttempts),H=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??VX,N=Y.remainingMs(),q=Math.min(N,G*H+K*G*(G-1)/2);for(let V=0;V<G;V+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(H,Y.remainingMs()),M=await zX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:V},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||V+1>=G||o0(U)||E0(U)||!m2(U)){if(!Q.aborted)c$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(V+1),q*(V+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function OX($,J,Z,Q,X){let Y=B5(J),G=new AbortController,H=new AbortController,K=()=>{G.abort($.signal.reason),H.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,V,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,C={},P=(w)=>{j=!0,D.abort(w),G.abort(w),H.abort(w)},R=(w)=>{if(z)return z;let h=structuredClone(w),l=M;return z=(async()=>{let k=new AbortController,x=k.signal;x.throwIfAborted();let S,A=()=>{},f=new Promise((b,n)=>{if(A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0}),S=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),x.aborted)A()});try{for(let b=0;b<3;b+=1){x.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[h],signal:x,transientRetryOwner:"caller"})),f]);if(x.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(E0(n))X(n);let o=n instanceof _0?l$(n.status):p$(n);if(x.aborted||!o||b===2)throw n;let N0=Math.max(500*2**b,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,x),f])}}}finally{clearTimeout(S),x.removeEventListener("abort",A),k.abort()}})(),z},I=(w,h,l)=>{let k=(S)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:h,events:w,signal:S,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&o0(A))P(A);if(l&&(E0(A)||o0(A))){if(E0(A))X(A);G.abort(A),H.abort(A),D.abort(A)}throw A});if(!l)return async(S)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(S)).next_event_seq;return}S.throwIfAborted();let A=()=>{},f=new Promise((b,n)=>{A=()=>n(S.reason),S.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([k(S),f]);S.throwIfAborted(),M=b.next_event_seq}finally{S.removeEventListener("abort",A)}};let x=d8({send:k,lease:L,sleep:Z,retryAfterMs:(S)=>J3(S,($.now?.()??new Date).getTime())});return async(S)=>{let A=await x(S);if(A.next_event_seq!==h+w.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},E=async(w,h)=>{let l=w??await r8($,J,{controlAckSeq:U,waitMs:h},H.signal,Z,L),k=null,x=!1;for(let S=0;S<10;S+=1){let A=U+1;for(let f of l.controls){if(f.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(f.kind==="cancel"||f.kind==="operation.cancel")k??=FX(f.payload),G.abort(new v0(k,"Reason closed the Device operation."));if(f.kind!=="cancel"&&f.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,o=new Promise((N0,j0)=>{b=N0,n=j0});o.catch(()=>{}),C.current={promise:o,resolve:b,reject:n}}try{x||=!await $.onControl?.(J,f)}catch(b){if(b instanceof v0)q??=n8(b);throw C.current?.reject(b),b}}U=f.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:x}}try{l=await r8($,J,{controlAckSeq:U},H.signal,Z,L),C.current?.resolve()}catch(f){if(C.current?.reject(f),!k||o0(f)||E0(f))throw f;return{cancellationReason:k,unsupported:x}}}throw Error("Reason returned too many Device operation control batches.")};try{let w;try{if(!Y)L=new h2(J.lease_until,()=>($.now?.()??new Date).getTime(),(h)=>{if(!G.signal.aborted)N=h;G.abort(h),H.abort(h)});w=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await E()}catch(h){if(!e4(J)||o0(h)||E0(h))throw h;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(w.cancellationReason||$.signal.aborted){let h=w.cancellationReason??i4($.signal);G.abort(new v0(h,"Reason closed the Device operation.")),V={status:"cancelled",error_code:h}}else if(w.unsupported)G.abort(),V={status:"failed",error_code:"control_unsupported"};else{let h=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?KX:15000),x=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),S=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!H.signal.aborted)try{if(!S){if(await Z(k,H.signal),H.signal.aborted)return}let A=await E(void 0,S?x:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new v0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(E0(A))X(A);if(o0(A))N=A,P(A);if(!H.signal.aborted)N=A,G.abort();return}})();try{if(L?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(L?.remainingMs()??0)>0),V=await $.onClaim(J,G.signal,async(k)=>{if(e4(J))return;let x=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",S=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=S||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,D.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,f={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:S?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:f,settle:(j0)=>j0===void 0?o():N0(j0)})});let b=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(x)await R(f);return}if(F!==null){if(k.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),P1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await I([f],M,!0)(j0),F=null}catch(F1){throw F=F1??Error("Hands stop receipt could not be confirmed."),F1}finally{clearTimeout(P1),N0.abort()}return}if(S&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new h2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{G.abort(j0),H.abort(j0)})}let o=M;if(S)W=I([...b.map((N0)=>N0.wireEvent),f],o,!0),await W(A),W=void 0;else await I([...b.map((N0)=>N0.wireEvent),f],o,!1)(A)});n.then(()=>{for(let o of b)o.settle()},(o)=>{for(let N0 of b)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(E0(o))X(o);if(S){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),H.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await C.current?.promise}catch(k){V=G.signal.aborted?{status:"cancelled",error_code:i4(G.signal)}:{status:"failed",error_code:n8(k)}}finally{Q.authorized=()=>!1,D.abort();for(let k of _.splice(0))k.settle();H.abort(),await h}let l=o8(J.capability)?e8(V.result,J.operation_id):null;if(N){if(E0(N))throw N;V={status:"failed",error_code:q??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&V.status==="succeeded")V={status:"cancelled",error_code:i4(G.signal),...l?{result:l}:{}}}if(L?.close(),E0($.signal.reason))throw $.signal.reason;await $3($,J,V)}finally{L?.close(),D.abort(),H.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??y$,Y=$.statusPath??Q3(),G=J().toISOString(),H=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...Y5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...H?{lastUsedAt:H}:{}}),q=0,V,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),Q5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??g8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await AX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;H=F.lastUsedAt??H,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,V=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(E0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=WX(q,$.reconnectRandom);V??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:V},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function AX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??y$,G=J().toISOString(),H=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let V=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(c8,U):c8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,Y0=0;for(let{claim:L1}of z.values()){let i0=L1.capability==="hands.connect"?L1.payload[t8]:void 0;if(typeof i0==="string"){if(v.has(i0))continue;v.add(i0)}Y0+=1}return Y0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),C=K?new Date(G).getTime()+n4(K.initialDelayMs??NX,V):Number.POSITIVE_INFINITY,P=null,R=!1,I=$.firstHeartbeat,E=I?.account_root_metadata_supported===!0,w=I?.workspace_root_metadata_supported===!0,h=I?.account_root_path_supported===!0,l=I?.home_contained_roots_supported===!0,k=I?.root_paths_supported===!0,x=I?.startup_supported===!0,S=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,f,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...Y5(J),...H?{lastUsedAt:H}:{},...P?{organizationId:P.organization_id,organizationName:P.organization_name,organizationSlug:P.organization_slug}:{}}),o=()=>{let v=$.claimable?.()!==!1;if(!b)f??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...x&&!b&&f?{startup:f}:{},capabilities:v?Z5($.capabilities,{accountRootMetadataSupported:E,workspaceRootMetadataSupported:w,accountRootPathSupported:h,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},N0=()=>{if(R||!$.client.identity)return;R=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;P=v;let Y0=Y(Q);if(!Y0)return;X({...Y0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{E=v.account_root_metadata_supported===!0,w=v.workspace_root_metadata_supported===!0,h=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,x=v.startup_supported===!0,S=!1},P1=(v)=>{if(v.startup)b=!0},F1=(v,Y0)=>{if(!(Y0 instanceof _0&&Y0.status===400&&Y0.code==="invalid_heartbeat")||!v.startup&&!S)throw Y0;if(b=!0,S)E=w=h=!1,l=k=x=S=!1;return null},r1=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},x1=!1,E1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(x1)E1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((Y0)=>F1(v,Y0))).then((Y0)=>{if(!Y0)return;P1(v),j0(Y0),r1(Y0)},()=>{return})});let a0=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let S1=!1,O$=$.maxConsecutiveHeartbeatFailures??3,W1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,Y0=o(),L1=A;A=void 0,x1=!0,E1=!1;try{let a=await V$($,"heartbeat",()=>$.client.heartbeat($.state,Y0,N.signal,...L1?[L1]:[]).catch((M0)=>F1(Y0,M0)));if(x1=!1,!a)continue;v=a,P1(Y0),W1=0}catch(a){if(x1=!1,$.signal.aborted)break;if(!m2(a))throw a;if(W1+=1,W1>=O$&&!W())throw a;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(Y0.capabilities).length)continue;if(E1)continue;if(r1(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))C=Math.min(C,J().getTime());if(K&&J().getTime()>=C)try{let a=new AbortController,M0=()=>a.abort($.signal.reason);if($.signal.aborted)M0();else $.signal.addEventListener("abort",M0,{once:!0});let l0;try{l0=K.check(a.signal)}catch(R0){l0=Promise.reject(R0)}let w1=l0.then((R0)=>({kind:"completed",result:R0}),(R0)=>({kind:"failed",error:R0})),t1;try{while(!0){let R0=await LX(w1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(R0.kind==="failed")throw new r4(R0.error);if(R0.kind==="completed"){t1=R0.result;break}try{let S0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,S0,N.signal).catch((H2)=>F1(S0,H2)));if(!R$)continue;v=R$,P1(S0),r1(v),W1=0}catch(S0){if($.signal.aborted)throw S0;if(!m2(S0))throw S0;if(W1+=1,W1>=O$&&!W())throw S0}}}catch(R0){a.abort(R0);let S0=await w1;if(S0.kind==="completed"&&S0.result==="activated")t1="activated";else throw R0}finally{$.signal.removeEventListener("abort",M0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,t1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}C=J().getTime()+n4(K.intervalMs??UX,V)}catch(a){if(!(a instanceof r4))throw a;T+=1;let M0=K.retryBaseMs??qX,l0=K.retryMaxMs??MX,w1=Math.min(l0,M0*2**Math.min(T-1,8));C=J().getTime()+n4(w1,V)}if($.signal.aborted)break;if(_&&L())break;if(_){await a0($.heartbeatIntervalMs??15000);continue}let i0=$.client.sessionCadence?.($.state)??null,A$=i0?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await a0(A$);continue}if(F()>=M){let a=new AbortController;O=a;try{await Z(A$,AbortSignal.any([$.signal,a.signal]))}catch(M0){if(!a.signal.aborted)throw M0}finally{if(O===a)O=null}continue}let g0,y=i0?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),i=performance.now();try{g0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:y,signal:N.signal}))}catch(a){if($.signal.aborted||!m2(a)||!W())throw a;await a0(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!g0){if(performance.now()-i<y-YX)await a0(XX);continue}if($.claimable?.()===!1){await $3($,g0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}H=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:g0.operation_id,runId:g0.run_id,attemptId:g0.attempt_id,capability:g0.capability});let B0,I0={authorized:()=>!1,claim:g0};if(B0=OX({...$,signal:N.signal},g0,Z,I0,j).catch((a)=>{if(E0(a))j(a);else if(!o0(a)&&[...z].some(([M0,l0])=>M0!==B0&&l0.authorized())){if(a instanceof s$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!o0(a)&&D===null)D=a}).finally(()=>{z.delete(B0),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(B0,I0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),B5(g0)){if(await B0,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),S1=!0;let Y0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:Y0},Q),$.onEvent?.({type:"error",message:Y0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!S1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as JY}from"child_process";import{constants as b5,existsSync as ZY,mkdtempSync as p5,rmSync as QY}from"fs";import{access as k5,open as XY,readFile as y5,readlink as YY,readdir as f5,unlink as GY,rmdir as BY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as g1}from"crypto";import{chmodSync as RX,closeSync as CX,fsyncSync as IX,openSync as PX,readFileSync as xX,rmdirSync as K5,unlinkSync as N5,writeFileSync as EX}from"fs";import{createConnection as SX,createServer as wX}from"net";import{dirname as bX,join as kX}from"path";var yX=5000;async function U5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:g1()},X={runId:g1(),deviceId:g1(),rootId:g1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=H5(J,X),G={version:1,snapshot_id:g1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{N5(Y.path)}catch{}}}async function q5($,J,Z=V5){if(J.aborted)return!1;let Q,X,Y=new Set,G=g1(),H=wX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(G)});H.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),V=setTimeout(N,yX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${g1()}`}),X=kX(Q.journalDirectory,"readiness.json");let U=PX(X,"wx",384);try{EX(U,G),IX(U)}finally{CX(U)}if(xX(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{H.once("error",()=>T(!1)),H.listen(Q.socketPath,()=>{try{RX(Q.socketPath,384)}catch{T(!1);return}K=SX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(V),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>H.close(()=>U())),Q?.disposeSocket(),X)try{N5(X)}catch{}if(Q){try{K5(Q.journalDirectory)}catch{}try{K5(bX(Q.journalDirectory))}catch{}}}}import{spawn as fX}from"child_process";import{randomUUID as u1}from"crypto";import{basename as hX}from"path";import{fileURLToPath as mX}from"url";function vX(){let $=hX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",mX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function _5($,J,Z=vX()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=fX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),H=!1,K=new Promise((F)=>G.once("close",()=>{H=!0,F()}));G.on("error",X);let N,q,V=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
-`)){let O=T.indexOf(`
-`),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([V,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=u1(),L={organizationId:u1(),userId:u1(),runId:u1(),deviceId:u1(),rootId:u1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:u1(),port:F.port,expiresAtMs:O},C={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:W}}},P=T5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!H&&!Q.signal.aborted?C:null});j=await M5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:P,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),G.stdin.destroy(),!H)G.kill("SIGKILL");await K}return z&&H}import{execFileSync as u2}from"child_process";import{randomUUID as c0}from"crypto";import{chmodSync as F5,chownSync as E5,closeSync as V3,constants as q1,existsSync as gX,fstatSync as S5,mkdirSync as W5,mkdtempSync as uX,openSync as H3,readFileSync as dX,readSync as lX,realpathSync as pX,rmdirSync as cX,rmSync as sX}from"fs";import{join as d1}from"path";import{fileURLToPath as aX}from"url";var L5=1e4,iX=!1;function d2(){if(process.platform!=="linux")return!1;return iX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=u2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var nX=Buffer.from([0,255,3,4]);function D5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function rX($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function a$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=g2(),{directory:Q,root:X,runtimeDirectory:Y}=eX(Z),G=new AbortController,H=()=>G.abort();$.addEventListener("abort",H,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(H,L5),q={organization_id:c0(),user_id:c0(),device_id:c0()},V=c0(),U=c0(),M=c0(),T=c0(),_=Date.now()+L5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=c0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,C=!1,P=!1,R,I,E,w=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},h=!1;try{K=tX(Q,Z),R=Bun.serve({hostname:"127.0.0.1",port:0,fetch(x,S){let A=new URL(x.url).pathname,f=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(f&&S.upgrade(x,{data:{lane:f}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(x){if(x.data.lane==="pty")z=x},message(x,S){if(x.data.lane!=="pty")return;if(typeof S==="string"){try{if(JSON.parse(S).t==="open")W=!0}catch{H()}return}if(F.length+S.length>8192){H();return}F=Buffer.concat([F,S])}}});let l=`ws://127.0.0.1:${R.port}`;if(I=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:V,operationId:c0(),attemptId:c0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:j5,hands_worker_version:A5,hands_worker_artifact_sha256:C5,hands_worker_entrypoint:R5,target_generation:1,target_fence_id:M,environment_binding:D,[I5]:P5},emitEvent:async(x)=>{if(x==="hands.started")P=!0;if(x==="hands.ready")L=!0;if(x==="hands.stopped")C=!0}},{browserExecutablePath:null,slot:x5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:aX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)H()}),await w(()=>L),z5({root:X,runId:V,payload:{version:1,snapshot_id:T,revision:1,run_id:V,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),E=O5({root:X,runId:V,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${c0()}`,sessionId:"pty-readiness",operationId:c0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${j}`},emit:async(x,S)=>{if(x==="pty.ready")O=S}}).catch(()=>{H()}),await w(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${D5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${D5("foreground")}; ${K.wait("foreground")}'
-`)),await w(()=>gX(d1(X,"foreground.pid"))&&F.includes(nX)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((x)=>oX(d1(X,x)));if(new Set(k).size!==2||k.some((x)=>!Number.isSafeInteger(x)||x<2||x===O.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((x)=>rX(dX(`/proc/${x}/stat`,"utf8"),x,O.job.process.pid)))return!1}else{let S=u2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((A)=>A.trim().split(/\s+/).map(Number));if(S.length!==2||new Set(S.map(([A])=>A)).size!==2||S.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await E,G.signal.aborted)return!1;for(let x of[O.job.process.pid,...k])try{return process.kill(x,0),!1}catch(S){if(!(S instanceof Error&&("code"in S)&&S.code==="ESRCH"))return!1}h=!0}catch{h=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",H),H(),K?.close(),await E,await I,await R?.stop(!0),!P||C)$Y({directory:Q,root:X},Z)}return h&&C&&!$.aborted}function tX($,J){let Z={foreground:d1($,"foreground.lifeline"),background:d1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");u2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let G=H3(Y,q1.O_RDONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW);try{if(Q.push(H3(Y,q1.O_WRONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW)),!S5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(G)}if(J)E5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function w5($=(J)=>a$(J)){let J=new AbortController,Z=JSON.stringify(g2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(g2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function oX($){let J;try{J=H3($,q1.O_RDONLY|q1.O_NOFOLLOW|q1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=S5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=lX(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function eX($,J=pX("/tmp")){let Z=uX(d1(J,"reason-pty-probe-")),Q=d1(Z,"workspace"),X=d1(Z,"private");if(W5(Q,{mode:448}),W5(X,{mode:448}),$)F5(Z,493),F5(Q,493),E5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function $Y($,J){if(J)try{u2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),cX($.root)}catch{return}sX($.directory,{recursive:!0,force:!0})}var c5=5000,l1="ARA_WORKER_PROBE_READY";function KY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{JY($,J,{cwd:Z,env:Q,signal:X,timeout:c5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,H)=>Y(!G&&!X.aborted&&H===l1))})}function VY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function HY($,J){let Z=m5({home:J,temporaryDirectory:J}),Q=(Y,G,H)=>KY(Y,G,$.workspaceRoot,Z,H),X=async(Y,G,H,K=(q)=>q===l1,N=!1)=>{let q=await n5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:c5,signal:H});return!H.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await k5($.workspaceRoot,b5.R_OK),await f5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await k5($.workspaceRoot,b5.W_OK),Y.aborted)return!1;let G=p5(M3($.workspaceRoot,".ara-worker-probe-")),H=M3(G,"receipt");try{let K=await XY(H,"wx",384);try{await K.writeFile(l1),await K.sync()}finally{await K.close()}return await y5(H,"utf8")===l1&&!Y.aborted}finally{await GY(H).catch(()=>{}),await BY(G).catch(()=>{})}},confinedShell:(Y)=>X(i5(),["-c",`printf ${l1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
-`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,H,K]=await Promise.all([YY("/proc/self/cwd"),f5("/proc/self/fd"),y5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&H.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${l1}`],Y),jobs:(Y)=>q5($,Y),environment:(Y)=>U5($,J,Y),preview:(Y)=>_5(J,Y),boundPty:(Y)=>a$(Y),desktopDisplay:()=>a5(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
-`);return l5()},desktopBrowser:async()=>n$()?.features.browser===!0,fullControlShell:(Y)=>{let G=u5(),H=VY(G,`printf ${l1}`);return H?Q(G,H,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&n$()?.features.computer===!0?d5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function NY($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return i$($,J,Z,Q,X).final}function i$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,G){let H,K;try{if(N1($),u0(),!J)e(g($),!0),H=p5(M3(g($),"probe-")),J=HY($,H);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",V=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(G).then(()=>Promise.all(q?[N("preview"),V,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,C,P,R,I]=await Promise.all([Promise.resolve(Q).then((E)=>E.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((E)=>E.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!C||!P||!R)&&!G)await U;if(q){if(!C)C=await N("bash");if(!P)P=await N("jobs");if(!R)R=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:C,jobs:P,environment:R,full:I}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:C,processes:P,bash:R,jobs:I,environment:E,full:w}=z,{preview:h,boundPty:l,desktopDisplay:k,desktopAutomation:x,desktopBrowser:S}=F,A=v5(),f=q&&process.platform==="darwin"&&w&&ZY("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&C&&X,"process.list":(process.platform==="linux"||L)&&P,"ports.list":(process.platform==="linux"||L)&&P,"exec.full":R&&w&&X,"hands.connect":O&&W&&R&&I,"jobs.control":O&&W&&R&&I,"pty.start":O&&W&&R&&I&&E&&l,"environment.install":O&&W&&R&&I&&E,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&R&&I&&E,"tunnel.open":O&&W&&R&&I&&E&&h,"tunnel.close":O&&W&&R&&I&&E&&h,"preview.serve.v1":O&&R&&I&&h&&w,"display.stream.v1":k,"automation.call.v1":x,"simulator.call.v1":f,"simulator.stream.v1":f,"browser.pr-proof.v1":x&&S&&h5()===null,"workspace.setup.v1":q&&g5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([V,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,C]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:C})}finally{if(H)QY(H,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await V||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var UY=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],qY=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return UY.filter((Z)=>J[Z]!==!0)}function s5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>NY($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
-`),(async()=>{for(let Y of $.delaysMs??qY){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let H=q3($.config,Q).filter((K)=>G[K]===!0);if(H.length>0)Q=Object.freeze({...Q,...Object.fromEntries(H.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${H.join(", ")}).
-`),$.onReady(Q,H);if(q3($.config,Q).length===0)return}})()}import{execFile as HG}from"child_process";import{createHash as NG,randomUUID as b3}from"crypto";import{lstat as UG,readdir as w6,readFile as v6,realpath as qG,stat as MG}from"fs/promises";import{basename as TG,join as S3}from"path";import{promisify as _G}from"util";import{createConnection as MY}from"net";import{endianness as o5}from"os";var r$=4,W3=1e4;class R1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=MY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=TY({jsonrpc:"2.0",id:Q,method:$,params:X}),H=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(G),await H}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=r$){let J=o5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=r$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(r$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!e0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),e0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class l2{client;cdp;constructor($){this.client="client"in $?$.client:new R1($),this.cdp=new J6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=_Y(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new e5(this,$)}getTabs(){return this.client.getTabs()}}class e5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new $6(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class $6{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class J6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(e0(Q)&&e0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return e0(Q)&&e0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";r5(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(e0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(H)=>{let K=await this.readDocumentState($);if(t5(K,Q))return;throw H}),G}async waitForLoadState($,J={}){let Z=J.state??"load";r5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(t5(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return e0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let G=!1,H=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),H?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),H=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(V){if(N())Y(V instanceof Error?V:Error(String(V)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=FY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function TY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(r$+J.length);if(o5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,r$),Z}function e0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function _Y($,J){if(!e0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function r5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function t5($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function FY($,J){if($.method!=="onCDPEvent"||!e0($.params))return null;let Z=$.params.source;if(!e0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as WY}from"crypto";function Z6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${WY("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as BG}from"async_hooks";import{isDeepStrictEqual as E6}from"util";import{createHash as KG}from"crypto";var LY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var DY=new Set(["png","jpg","jpeg","gif","webp"]),jY=new Set(["webm","mp4"]);function zY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function Q6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=zY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=LY.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),H=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!H||!K||!N)return null;let q=DY.has(N)?"image":jY.has(N)?"video":null;if(!q)return null;let V=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:G,artifactId:H,fileName:`${K}.${N}`,kind:q,phase:V?.[1]==="before"||V?.[1]==="after"?V[1]:null}}var OY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,p2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),p1=()=>{throw Error("cloud_browser_media_request_invalid")};function c2($){if(!p2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!OY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return p1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return p1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!X6(J.origin,{mode:"public_web"}).allowed)return p1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!p2(Y)||Object.keys(Y).some((H)=>!["url","sourceUrl","kind"].includes(H))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return p1();let G=Q6(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return p1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let H;try{H=new URL(Y.sourceUrl)}catch{return p1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(H.pathname)?.[1];if(Y.kind!=="image"||H.origin!=="https://camo.githubusercontent.com"||H.username||H.password||H.search||H.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return p1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function Y6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!p2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!p2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=B.string().uuid(),H$=B.string().regex(/^[a-f0-9]{64}$/),s1=B.iso.datetime({precision:3}),D3=B.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),B6=B.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),s0=B.object({kind:B.literal("primary_mac"),version:B.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:B.string().min(1).max(64),binding:B.enum(["workspace_source","mcp_control"]),targetRevision:B.number().int().nonnegative(),generation:L0,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),AY=B.custom().transform(($,J)=>{try{return G6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),B.NEVER}}),N$=B.object({version:B.literal(1),owner:s0,contextId:L0,preparedAt:s1,expiresAt:s1,prUrl:B6,headSha:B.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:B.enum(["image","video"]),visualPlan:AY.optional(),uploadOrigin:B.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=B.object({version:B.literal(1),producer:B.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:B.number().int().positive(),startedAt:s1,finishedAt:s1,sha256:H$,media:B.discriminatedUnion("contentType",[B.object({contentType:B.literal("image/png"),sizeBytes:B.number().int().min(24).max(8388608),width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096)}).strict(),B.object({contentType:B.literal("video/webm"),sizeBytes:B.number().int().min(128).max(10485760),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),GM=B.discriminatedUnion("action",[B.object({action:B.literal("screenshot"),context_id:L0,tab_id:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),context_id:L0,tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("stop_video"),recording_operation_id:L0}).strict()]),a2=B.object({login:B.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:B.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),s2=B.string().regex(/^[1-9][0-9]{0,19}$/),t$=B.object({version:B.literal(1),owner:s0,expectedActorId:s2.nullable(),repositoryId:s2,repositoryFullName:B.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),RY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=B.discriminatedUnion("status",[t$.extend({status:B.literal("ready"),observedActor:a2,checkedAt:s1}),t$.extend({status:B.literal("not_ready"),reason:B.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:B.enum(RY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),c1=B.object({version:B.literal(1),owner:s0,expectedActorId:s2.nullable(),authenticatedActor:a2,attemptId:L0,captureId:L0,prUrl:B6,repositoryId:s2,headSha:B.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:B.number().int().min(128).max(10485760),contentType:B.literal("video/webm")}).strict(),K6=B.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=B.discriminatedUnion("status",[c1.extend({status:B.literal("not_attempted"),reason:B.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),c1.extend({status:B.literal("uncertain"),reason:B.literal("upload_outcome_unknown")}),c1.extend({status:B.literal("uploaded"),observedActor:a2,nativeUrl:K6,uploadedAt:s1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),o$=c1.extend({nativeUrl:K6,observedActor:a2,bodySha256:H$}),A3=B.discriminatedUnion("status",[o$.extend({status:B.literal("incomplete"),reason:B.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),o$.extend({status:B.literal("verified"),sourceSha256:H$,width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096),durationSeconds:B.number().positive().max(30),advancedSeconds:B.number().min(0.05).max(10),advancedFrames:B.number().int().positive(),playbackRestored:B.literal(!0),verifiedAt:s1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),CY=B.custom().transform(($,J)=>{try{let Z=c2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),B.NEVER}}),IY=B.discriminatedUnion("action",[B.object({action:B.literal("auth_check"),input:t$}).strict(),B.object({action:B.literal("prepare"),context:N$}).strict(),B.object({action:B.literal("capture_png"),owner:s0,contextId:L0,tabId:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),owner:s0,contextId:L0,tabId:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("inspect_capture"),owner:s0,captureId:L0}).strict(),B.object({action:B.literal("publish_video"),input:c1}).strict(),B.object({action:B.literal("verify_png_media"),owner:s0,media:CY}).strict().refine(($)=>$.media.runId===$.owner.runId),B.object({action:B.literal("verify_saved_media"),input:o$}).strict(),B.object({action:B.literal("publish_png"),owner:s0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:B.number().int().min(24).max(8388608),storagePath:B.string().max(512),uploadUrl:B.string().url().max(8192)}).strict()]);var V6="pr-proof.stop.v1",R3=B.object({requestId:L0,command:IY}).strict();import{createHash as PY,randomUUID as xY}from"crypto";import{isDeepStrictEqual as q$}from"util";var H6=B.object({operationId:B.string().uuid(),attemptId:B.string().uuid(),contextId:B.string().uuid(),tabId:B.number().int().positive()}).strict(),K0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>PY("sha256").update($).digest("hex");function N6($){let J=s0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw K0();if(await $.assertCurrent(),X)throw K0()},G=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw K0();return M},H=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,K0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>H(D)))).some((D)=>D.status==="rejected"))throw K0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function V(U,M){let T=H6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw K0();await Y(),U.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw K0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw K0();let P=await D.completion;if(await Y(),G(T.contextId),D.controller.signal.aborted)throw K0();return structuredClone(P)}if(Q.size>=16||[...Q.values()].some((P)=>!P.receipt&&!P.controller.signal.aborted&&P.claim.tabId===T.tabId))throw K0();let j,z,F=new Promise((P,R)=>{j=P,z=R});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{H(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),G(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},C;try{await L();let P;if(M==="image"){let R=new Date().toISOString();C=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let I=new Date().toISOString();if(await L(),C.length<24||C.length>8388608||!C.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||C.readUInt32BE(8)!==13||C.toString("ascii",12,16)!=="IHDR")throw K0();P=z3.parse({version:1,producer:"primary_mac",context:_,captureId:xY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:R,finishedAt:I,sha256:C3(C),media:{contentType:"image/png",sizeBytes:C.length,width:C.readUInt32BE(16),height:C.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),K0();await O.host.start(),O.started=!0;let R=O.host.completed();if(R.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let I=await R;if(O.stop)await O.stop;await L();let E=await O.host.read(I.captureId);C=E.bytes;let w={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(I,E.capture)||!q$(I.owner,w)||C.length!==I.sizeBytes||C3(C)!==I.sha256||C.length<128||C.readUInt32BE(0)!==440786851)throw K0();await O.host.close(),await L(),P=z3.parse({version:1,producer:"primary_mac",context:_,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((R,I)=>R+(I.bytes?.length??0),C.length)>20971520)throw K0();return O.bytes=Buffer.from(C),O.receipt=P,j(P),structuredClone(P)}catch(P){let R=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&P instanceof Error&&P.message==="mac_recording_worker_failed:no_frames"?new v0("proof_capture_no_frames","The owned tab emitted no recording frames."):K0();throw await H(O).catch(()=>{}),z(R),R}finally{C?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw K0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw K0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw K0();return structuredClone(T)}if(Z.size>=4)throw K0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>V(U,"image"),record:(U)=>V(U,"video"),async stop(U){let M=H6.parse(U);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw K0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw K0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw K0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw K0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(H));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw K0()}}}import{createHash as T6,randomUUID as mY}from"crypto";import{isDeepStrictEqual as e$}from"util";import{realpath as vY}from"fs/promises";var U6=String.raw`async (media) => {
-  const deadline = (promise) => {
-    let timer;
-    return Promise.race([promise, new Promise((_, reject) => {
-      timer = setTimeout(() => reject(new Error("media_decode_timeout")), 12000);
-    })]).finally(() => clearTimeout(timer));
-  };
-  const items = await Promise.all(media.map(async (item) => {
-    const element = document.createElement(item.kind === "image" ? "img" : "video");
-    document.body.append(element);
-    try {
-      if (item.kind === "image") {
-        element.src = item.sourceUrl;
-        await deadline(element.decode());
-        if (!element.complete || !element.naturalWidth || !element.naturalHeight) throw new Error("media_image_not_decoded");
-        return { ...item, width: element.naturalWidth, height: element.naturalHeight };
-      }
-      element.muted = true;
-      element.playsInline = true;
-      element.preload = "auto";
-      const loaded = new Promise((resolve, reject) => {
-        element.addEventListener("loadeddata", resolve, { once: true });
-        element.addEventListener("error", () => reject(new Error("media_video_not_decoded")), { once: true });
-      });
-      element.src = item.sourceUrl;
-      await deadline(loaded);
-      if (!element.videoWidth || !element.videoHeight || !Number.isFinite(element.duration) || element.duration <= 0) throw new Error("media_video_not_decoded");
-      const initial = element.currentTime;
-      await deadline(element.play());
-      await deadline(new Promise((resolve, reject) => {
-        let timer;
-        const check = () => {
-          if (element.error) { clearTimeout(timer); reject(new Error("media_video_not_decoded")); return; }
-          if (element.currentTime - initial >= 0.05) { clearTimeout(timer); resolve(); return; }
-          timer = setTimeout(check, 25);
-        };
-        element.addEventListener("pause", () => { clearTimeout(timer); reject(new Error("media_video_not_advancing")); }, { once: true });
-        check();
-      }));
-      return { ...item, width: element.videoWidth, height: element.videoHeight, advancedSeconds: element.currentTime - initial };
-    } finally {
-      if (item.kind === "video") element.pause();
-      element.removeAttribute("src");
-      element.remove();
-    }
-  }));
-  return { verified: true, items };
-}`;var q6=function($){let J=this??globalThis,Z=10485760,Q=(G,H)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,V={login:K,id:q};if(G.expectedActorId!==null&&q!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||q!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||q!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(H){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:V}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,H=Q(G,!0);if(!H.ok)return{dispatched:!1,reason:H.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let V=J.document.querySelector("#fc-new_comment_field");if(!V)return{dispatched:!1,reason:"attachment_unavailable"};return V.files=q.files,V.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:H.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let H=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=H?.startsWith(K)&&H.endsWith(")")?H.slice(K.length,-1):H;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),H=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(H));if(q.length!==1)throw Error("saved_player_missing");let V=q[0],U={muted:V.muted,volume:V.volume,rate:V.playbackRate,preload:V.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(V.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(V.muted=!0,V.playbackRate=1,V.currentTime=0,V.readyState<2)V.preload="auto",V.load();await D(()=>V.readyState>=2&&V.videoWidth>0&&V.videoHeight>0);let j=V.currentSrc;if(!H(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!H(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let h=await _(O.read());if(h.done)break;if(L+=h.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(h.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let C=new J.Uint8Array(L),P=0;for(let h of W)C.set(h,P),P+=h.length;let R=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",C)))].map((h)=>h.toString(16).padStart(2,"0")).join("");if(R!==X.sha256||V.currentSrc!==j||!N.contains(V))throw Error("source_changed");let I=V.currentTime,E=V.getVideoPlaybackQuality().totalVideoFrames;if(await _(V.play()),await D(()=>V.currentTime-I>=0.05&&V.getVideoPlaybackQuality().totalVideoFrames>E),!Q(X,!1).ok||V.currentSrc!==j||!N.contains(V)||V.error)throw Error("player_changed");return{status:"verified",sourceSha256:R,width:V.videoWidth,height:V.videoHeight,durationSeconds:V.duration,advancedSeconds:V.currentTime-I,advancedFrames:V.getVideoPlaybackQuality().totalVideoFrames-E,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),V.pause(),V.currentTime=0,V.muted=U.muted,V.volume=U.volume,V.playbackRate=U.rate,V.preload=U.preload,!V.paused||V.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as EY}from"child_process";import{lstat as SY,realpath as wY}from"fs/promises";import{join as M6,resolve as bY}from"path";import{promisify as kY}from"util";var yY=kY(EY);async function fY($,J){let Z=await wY($),{stdout:Q}=await yY(M6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return B.array(B.object({browser:B.string(),directory:B.string(),connected:B.boolean().optional(),source:B.string(),socketPath:B.string().optional(),instanceId:B.string().optional(),extensionId:B.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&bY(Y.source)===M6(Z,"Reason Browser Use","manifest.json"))}async function i2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await fY($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await SY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as hY}from"crypto";function M$($){return`reason-browser-${hY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var _6=B.discriminatedUnion("ok",[B.object({ok:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({ok:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),F6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function I3($){let J=s0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await gY($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${mY()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},H=async(q)=>{if(!e$(J,q.owner))throw Z0();await G()},K=async(q)=>{await H(q);let V=await $.readVideo(q.captureId);try{await G();let U=V.capture;if(!e$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||V.bytes.length!==q.sizeBytes||V.bytes.length<128||V.bytes.length>10485760||V.bytes.readUInt32BE(0)!==440786851||T6("sha256").update(V.bytes).digest("hex")!==q.sha256)throw Z0();return V}catch(U){throw V.bytes.fill(0),U}};async function N(q,V,U){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new l2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await G(),D)throw Z0()};try{await F(T.connect());let W=F6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((R)=>{if(D)R.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let P=await F(V(_,async(R)=>{await O();let I=await F(_.evaluate(`(${q6.toString()})(${JSON.stringify(R)})`,{awaitPromise:!0}));return await O(),I},O));return await O(),P}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,C)=>{W=setTimeout(()=>C(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(q,V,U){let M=N$.parse(q);if(await H(M),!Number.isSafeInteger(V)||V<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new l2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=F6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!B.array(B.object({id:B.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===V))throw Z0();await G(),U.throwIfAborted();let F=B.object({data:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(V,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await G(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let V=c2(q);if(V.runId!==J.runId||V.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(V.media.map((R)=>R.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,C=(R,I)=>{if(L.size>=32){F=!0;return}let E=_.executeCdp(U.id,R,I);L.add(E),E.catch(()=>{F=!0}).finally(()=>L.delete(E))},P=_.onNotification((R)=>{if(R.method!=="onCDPEvent"||!t0(R.params)||!t0(R.params.source)||R.params.source.tabId!==U.id||!t0(R.params.params))return;let I=R.params.params;if(++O>512){F=!0;return}if(R.params.method==="Fetch.requestPaused"){let h=typeof I.requestId==="string"&&t0(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&D.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!h)F=!0;C(h?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...h?{}:{errorReason:"BlockedByClient"}})}if(R.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(R.params.method==="Network.loadingFailed")F=!0;if(R.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")z.add(I.requestId);if(R.params.method!=="Network.responseReceived")return;if(!t0(I.response)||typeof I.response.url!=="string"||!D.has(I.response.url)||typeof I.requestId!=="string"||!t0(I.response.headers)||I.type!=="Image"){F=!0;return}let E=Object.fromEntries(Object.entries(I.response.headers).map(([h,l])=>[h.toLowerCase(),l])),w=Number(E["content-length"]);if(j.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof E["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(E["content-length"])||!Number.isSafeInteger(w)||w>8388608||E["content-range"]||E["content-encoding"]&&E["content-encoding"]!=="identity"){F=!0;return}j.set(I.response.url,{id:I.requestId,length:w})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let R=B.object({frameTree:B.object({frame:B.object({id:B.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),I=[...new Set(V.media.map((h)=>new URL(h.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:R.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new v0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let E;try{E=await U.evaluate(`(${U6})(${JSON.stringify(V.media)})`,{awaitPromise:!0})}catch{throw new v0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!t0(E)||!Array.isArray(E.items)||E.items.length!==V.media.length)throw Z0();await Promise.all(L);let w=[];for(let h=0;h<V.media.length;h++){await G();let l=j.get(V.media[h].sourceUrl);if(F||!l||!z.has(l.id))throw Z0();let k=B.object({base64Encoded:B.literal(!0),body:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:l.id})),x=Buffer.from(k.body,"base64");try{let S=E.items[h];if(x.length!==l.length||x.toString("base64")!==k.body||!t0(S))throw Z0();w.push({...S,sourceSha256:T6("sha256").update(x).digest("hex")})}finally{x.fill(0)}}if(F)throw Z0();return Y6({verified:!0,items:w},V)}finally{if(P(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new v0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let V=t$.parse(q);await H(V);let U="browser_unavailable";try{return await N(`https://github.com/${V.repositoryFullName}`,async(M,T)=>{let _=_6.parse(await T({operation:"preflight",expected:{...V,prUrl:`https://github.com/${V.repositoryFullName}`}}));return O3.parse(_.ok?{...V,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...V,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...V,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...V,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let V=c1.parse(q);if(await H(V),V.expectedActorId!==null&&V.authenticatedActor.id!==V.expectedActorId)throw Z0();let U=Q.get(V.attemptId);if(U){if(!e$(U.binding,V))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(V),result:U$.parse({...V,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(V.attemptId,M);let T=!1,_="dispatch";try{(await K(V)).bytes.fill(0),M.result=await N(V.prUrl,async(D,j)=>{let z=_6.parse(await j({operation:"identity",expected:V}));if(!z.ok)return U$.parse({...V,status:"not_attempted",reason:z.reason});let F=await K(V),O;try{T=!0,O=B.discriminatedUnion("dispatched",[B.object({dispatched:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({dispatched:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:V,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...V,status:"not_attempted",reason:O.reason});if(!e$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...V,observedActor:z.actor}});if(L!==null){let C=B.object({nativeUrl:B.string(),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await G(),U$.parse({...V,status:"uploaded",nativeUrl:C.nativeUrl,observedActor:C.actor,uploadedAt:new Date().toISOString()})}await new Promise((C)=>setTimeout(C,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
-`);M.result=U$.parse({...V,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let V=o$.parse(q);await H(V);try{return(await K(V)).bytes.fill(0),await N(V.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:V});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...V,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(V).some(([D,j])=>!e$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...V,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function gY($,J){let Z=await vY($);return{async discover(Q){let X=await i2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as GG}from"fs/promises";var vM=B.object({version:B.literal(1),recording_operation_id:B.string().uuid(),proof_ready:B.literal(!1),acknowledged_at:B.iso.datetime()}).strict(),n2=B.object({action:B.literal("start"),request_id:B.string().uuid(),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),W6=B.object({action:B.literal("inspect"),recording_operation_id:B.string().uuid()}).strict(),gM=B.discriminatedUnion("action",[n2,W6]),L6=B.object({recording_operation_id:B.string().uuid()}).strict(),P3={device_id:B.string().uuid(),root_id:B.string().uuid()},uY=B.discriminatedUnion("action",[n2.extend(P3),W6.extend(P3),L6.extend({...P3,action:B.literal("stop")})]),uM=B.toJSONSchema(uY),dM=B.object({version:B.literal(1),recordingId:B.string().uuid(),proofReady:B.literal(!1),capture:B.object({captureId:B.string().uuid(),contentType:B.literal("video/webm"),sha256:B.string().regex(/^[a-f0-9]{64}$/),sizeBytes:B.number().int().min(128).max(10485760),startedAt:B.iso.datetime(),finishedAt:B.iso.datetime(),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000),owner:B.object({runId:B.string().uuid(),deviceId:B.string().uuid(),rootId:B.string().uuid(),rootRevision:B.string().max(64),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024),generation:B.string().uuid(),browserScope:B.string().max(128),tabId:B.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var oM=n2.extend({action:B.enum(["start","inspect"]),recording_boot_generation:B.string().uuid(),recording_operation_id:B.string().uuid().optional(),recording_attempt_id:B.string().uuid().optional()}).strict();import{createHash as tY,randomUUID as oY}from"crypto";import{mkdtemp as eY,realpath as $G,rm as I6}from"fs/promises";import{tmpdir as JG}from"os";import{join as ZG}from"path";import{spawn as QG}from"child_process";import{isDeepStrictEqual as XG}from"util";import{createHash as dY}from"crypto";import{execFile as lY}from"child_process";import{chmod as pY,lstat as j6,mkdtemp as cY,readFile as z6,realpath as O6,rm as sY,writeFile as D6}from"fs/promises";import{tmpdir as aY}from"os";import{isAbsolute as iY,join as r2}from"path";import{promisify as nY}from"util";var x3=nY(lY),rY=($)=>dY("sha256").update($).digest("hex");async function G1($){if(!iY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await O6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await j6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||rY(await z6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function $2($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]);let G=await O6(await cY(r2(J??aY(),"reason-owned-recording-")));await pY(G,448);let H=r2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await D6(r2(G,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await D6(r2(G,"frames.ffconcat"),N.join(`
-`)+`
-`,{mode:384,flag:"wx"});let q={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",H],q),K="output";let V=await j6(H);if(!V.isFile()||V.isSymbolicLink()||V.nlink!==1||V.size<128||V.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",H],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",H,"-f","null","-"],q),K="pin",await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]),await z6(H)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await sY(G,{recursive:!0,force:!0})}}}}var R6=B.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var B1=B.string().min(1).max(1024),A6=B.object({path:B1,sha256:B.string().regex(/^[a-f0-9]{64}$/)}).strict(),C6=B.object({owner:B.object({runId:B1,deviceId:B1,rootId:B1,rootRevision:B1,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B1,generation:B1,browserScope:B1,tabId:B.number().int().positive()}).strict(),socketPath:B1,extensionId:B.string().regex(/^[a-p]{32}$/),nativeHostName:B1,seconds:B.number().int().min(1).max(15),encoder:B.object({ffmpeg:A6,ffprobe:A6}).strict()}).strict();var YG=15728640,C1=()=>Error("mac_recording_worker_failed");function P6($){let J=C6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,H=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(C1()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([H(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,V=async()=>{if(X)throw C1();if(await K($.assertCurrent()),X)throw C1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await V(),await G1({path:Z.path,sha256:Z.sha256}),await V(),G=null;let U=await $G(await eY(ZG(JG(),"reason-recording-host-")));try{await V()}catch(x){throw await I6(U,{recursive:!0,force:!0}),x}let M=QG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((x)=>M.once("close",()=>x())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(x){if(x.code!=="ESRCH")throw x}},D=null;H=()=>D??=(async()=>{try{_()}catch(x){if(x.code!=="EPERM")throw x}await T;try{for(let x=0;;x++)try{_();break}catch(S){if(S.code!=="EPERM"||x>=20)throw S;await new Promise((A)=>setTimeout(A,25))}}finally{await I6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,C,P=new Promise((x,S)=>{L=x,C=S}),R,I,E=new Promise((x,S)=>{R=x,I=S});E.catch(()=>{});let w=(x=C1())=>{if(F)return;F=!0,clearTimeout(h),clearInterval(k),N().then(()=>{C(x),I(x)},(S)=>{C(S),I(S)})},h=setTimeout(()=>w(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,V().catch(()=>w()).finally(()=>{l=!1})},250);q={completion:E,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
-`)},cancel:()=>w()},M.on("error",()=>w()),M.stdin.on("error",()=>w()),M.stdout.on("data",(x)=>{if(F)return;if(z+=x.length,z>YG){w();return}j+=x.toString("utf8");let S;while((S=j.indexOf(`
-`))!==-1){let A=j.slice(0,S);j=j.slice(S+1);try{let f=JSON.parse(A);if(f.type==="failed"&&Object.keys(f).sort().join(",")==="reason,type"){let o=R6.safeParse(f.reason);w(o.success?Error(`mac_recording_worker_failed:${o.data}`):C1());return}if(f.type==="unsupported"&&!O){w(Error("mac_recording_encoder_unavailable"));return}if(f.type==="started"&&!O&&Object.keys(f).length===1){O=!0,L({recording:!0});continue}if(!O||f.type!=="capture"||W||Object.keys(f).sort().join(",")!=="bytes,capture,type")throw C1();let b=f.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!XG(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof f.bytes!=="string"||f.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(f.bytes))throw C1();let n=Buffer.from(f.bytes,"base64");if(n.length!==b.sizeBytes||tY("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw C1();W={capture:Object.freeze({...b,captureId:oY(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{w();return}}}),M.once("close",(x)=>{if(F)return;if(x!==0||!W||j.trim()){w();return}let S=W;V().then(async()=>{if(await H(),F)return;F=!0,clearTimeout(h),clearInterval(k),Q.set(S.capture.captureId,S);while(Q.size>2)Q.delete(Q.keys().next().value);R(S.capture)}).catch(()=>w())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
-`);try{return await P}catch(x){throw q=null,x}}finally{Y=!1}},async completed(){if(await V(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await V();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await V();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var x6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await GG($.automationDirectory);J=(Q,X)=>i2(Z,Q,X)}if(await G1({path:$.worker.path,sha256:$.worker.sha256}),!await $2($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),H=new R1({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await H.connect(),K=x6.parse(await H.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!B.array(B.object({id:B.number()})).parse(await H.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{H.close()}return{extensionInstanceId:G.instanceId,async createHost(N,q,V){let U=new R1({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return P6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){V.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=x6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),VG=B.object({operationId:B.string().uuid()}).strict();function S6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=B.array(B.object({profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:B.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!B.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,G=!1,H=new BG,K=async(U)=>{let M=H.getStore();if(G||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),G)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=N6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let C=await $.resolveBrowser(U.profile,O,j,L);if(C.extensionInstanceId!==U.extensionInstanceId)throw A0();return C.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),G)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!E6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},V=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{G=!0})},1000);return V.unref(),{generation:$.generation,async execute(U,M,T){return H.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!E6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let C=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?C.capture.context.uploadOrigin:$.uploadOrigin)||C.capture.media.contentType!=="image/png"||C.capture.sha256!==_.sha256||C.bytes.length!==_.sizeBytes||KG("sha256").update(C.bytes).digest("hex")!==_.sha256)throw A0();await z();let P={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,P);try{let R=await fetch(L,{method:"PUT",body:C.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await R.body?.cancel(),await z(),R.ok)P.result={...P.result,status:"uploaded"}}catch{}F=P.result}finally{C.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==V6)return!1;let T=VG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await H.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(V);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var FG="__browser-recorder",WG=_G(HG),LG="/tmp/open-browser-use",DG=33554432,jG=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.literal(t2),extensionInstanceId:B.string().min(1).max(1024)})}),b6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:n$,ensureBrowser:h6,socketDirectory:LG,async identity($){let J=new R1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function k6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw b6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(m6(Z),"Default","Local Extension Settings",t2),X=(await w6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await w6(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=S3(J.socketDirectory,Y);try{let H=await UG(G);if(!H.isSocket()||H.uid!==process.getuid?.())continue;let K=jG.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await MG(N)).size<=DG&&(await v6(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:t2}}catch{}}throw b6()}async function w3($){let J=await qG($);return{path:J,sha256:NG("sha256").update(await v6(J)).digest("hex")}}async function g6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await WG(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await $2(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...TG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],FG]};return{worker:{...await w3(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function u6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=y6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?f6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,H=(V)=>Z6(V.organizationId,V.sessionId,V.deviceId,1),K=$.recording,N,q=S6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:H,...K?{resolveBrowser:async(V,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>k6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(V,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>zG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(V)=>I3({...V,endpoint:(U)=>({discover:(M)=>k6(M,Z),tabScope:H(U)})})});return{capability:G,broker:q}}function zG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as vG}from"child_process";import{execFile as OG}from"child_process";import{readFile as AG}from"fs/promises";import{join as $1}from"path";var RG="Claude Code-credentials",CG="/usr/bin/security",IG=120000,PG=8192,o2={exec:($,J,Z)=>new Promise((Q)=>{OG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await AG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=PG?$:null}function xG($,J){return $.CLAUDE_CONFIG_DIR||$1(J,".claude")}function EG($,J){return $.CODEX_HOME||$1(J,".codex")}function d6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function SG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function wG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:SG(Z)??Date.now()}}catch{return null}}function bG($,J){return $1($.XDG_DATA_HOME||$1(J,".local","share"),"opencode","auth.json")}var kG={anthropic:"anthropic",openai:"openai-codex"};function yG($){return s6($,kG)}function s6($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let H=T$(G.access),K=T$(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(H&&K&&N!==null)Q.push({provider:Y,access:H,refresh:K,expires:N})}return Q}catch{return[]}}function fG($){return s6($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function hG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?$1(J,Z.slice(2)):Z||$1(J,".pi","agent")}async function a6($,J,Z=o2){let Q=[],X=await Z.exec(CG,["find-generic-password","-s",RG,"-w"],IG),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?d6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(d6(await Z.readText($1(xG($,J),".credentials.json"))));let H=wG(await Z.readText($1(EG($,J),"auth.json")));G(H),G(mG(await Z.readText($1($.GROK_HOME||$1(J,".grok"),"auth.json"))));for(let K of yG(await Z.readText(bG($,J))))G(K);for(let K of fG(await Z.readText($1(hG($,J),"auth.json"))))G(K);return Q}function i6($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var l6="https://auth.x.ai",p6="b1a00492-073a-47ea-816f-4c329264a828",c6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function mG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${l6}::${p6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==l6||Q.oidc_client_id!==p6||!c6(Q.key)||!c6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var n6=330000,gG=300000,uG=60000;function dG($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+n6)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function lG($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*n6)?uG:gG}var pG=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function r6($){let J=new Map,Z=$.wait??pG,Q=$.stores??(process.platform==="darwin"?o2:{...o2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=i6(await a6($.environment??process.env,$.home,Q));for(let Y of dG(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(lG(J),$.signal)}}function t6($=process.env){return new Promise((J)=>{vG("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as cG,spawn as D_,spawnSync as j_}from"child_process";import{chmodSync as O_,existsSync as sG,mkdirSync as A_,readFileSync as R_,renameSync as C_,rmSync as I_,statSync as P_,writeFileSync as x_}from"fs";import{dirname as S_,isAbsolute as w_,join as y3}from"path";var o6=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function e6($,J){if(!o6.test($)||!o6.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var aG="com.reasonmachines.updater",iG=["so.ara.updater","so.reason.updater"];function nG($){let J=$==="staging"?".staging":"";return{label:`${aG}${J}`,legacyLabels:[...iG].reverse().map((Z)=>`${Z}${J}`)}}function rG($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function tG($,J){return new Promise((Z)=>{cG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function Z7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=nG($.channel),G=$.configHome??J7(Q),H=[X,...Y].filter((V)=>{let U=rG(V,Q,G);return sG(J==="darwin"?U.launchAgent:U.systemdService)});if(H.length===0)return"absent";let K=$.command??tG,N=H[0];if(H.length>1){for(let V of H)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${V}`]):await K("systemctl",["--user","is-enabled",`${V}.timer`]))===0){N=V;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var $7=60000;function Q7($){let J=(X,Y)=>{try{return e6(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min($7-1,Math.floor(G*$7)))}}var oG=30000;async function X7($){return($.flush??_8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(oG);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var G7=25000,$B=5000,JB=600000,ZB=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return u0(),z7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var B7=5000,QB=600000;function XB($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[a1])return null;try{return C2({platform:J})}catch{return null}}function YB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function GB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)g$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)g$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Q2($,J,Z,Q,X={}){if(u0(),$.executionMode==="host")Z2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let H=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?D7():Promise.resolve(!1),q=T7().then((y)=>y.status==="resolved",()=>!1),V=X.prestartedReadiness??i$($,X.readinessProbes,H,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?V.initial:V.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??t6)().catch(()=>!1):null,D=new AbortController,j=null,z=async(y,i)=>{let I0=($.userChrome??X.ownComputer===!0)&&y["automation.call.v1"]===!0?L7():null;if(I0&&"code"in I0)process.stderr.write(`Reason worker: your own Chrome unavailable (${I0.code})
-`);let a=g3($,y,{displayVideo:y["display.stream.v1"]===!0&&await N(),handsBrowser:y["hands.connect"]===!0&&await q,userChrome:I0&&"host"in I0?I0.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:y["pty.start"]===!0&&d2(),probing:i});if(!j&&a.worker.readiness?.["browser.pr-proof.v1"]===!0){let M0=await g6();if(j||D.signal.aborted)return a;process.stderr.write("error"in M0?`Reason worker: PR video proof unavailable (${M0.error})
-`:`Reason worker: PR video proof ready (ffmpeg ${M0.encoder.ffmpeg.path})
-`),j=u6({assertCurrent:async()=>{if(!l())throw Error("proof_authority_lost")},...!("error"in M0)?{recording:M0}:{}})}return a},F=await z(M,U?F3.filter((y)=>M[y]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,C=0,P="starting",R=null,I=!1,E=!1,w=null,h,l=()=>!G.drained&&!W&&Date.parse(Y)>Date.now()&&O.supported_operations.some((y)=>F.worker.readiness?.[y]===!0),k=null,x=()=>L+(k?.claims()??0),S=null,A=new Set,f=(y)=>{let i=y.capabilities.root_paths;if(Object.assign(y.capabilities,m3(y.config,y.state,F,j?.capability)),i)y.capabilities.root_paths=i},b=(y)=>{F=y,f({config:$,state:J,capabilities:O}),S?.();for(let i of A)f(i),i.heartbeatNow?.()},n=new Set,o=new Set,N0=setInterval(()=>{let y=new Set;for(let i of[{state:J,capabilities:O},...A])for(let B0 of ZB){if(i.capabilities.operation_constraints?.[B0]?.probing!==!0)continue;let a=`${i.state.deviceId} ${B0}`;if(y.add(a),!n.has(a)||o.has(a))continue;o.add(a),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:i.state.deviceId,lane:B0,login_device:i.state===J,timestamp:new Date().toISOString()})}
-`)}n.clear();for(let i of y)n.add(i)},JB);N0.unref();let j0=(y)=>{if(!X.readinessProbes)s5({config:$,readiness:y,signal:D.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(i)=>{z(i,[]).then(b)}})},P1=U?V.final.then(async(y)=>{if(D.signal.aborted)return;b(await z(y,[]));let i=F3.filter((B0)=>y[B0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${i.length?`ready: ${i.join(", ")}`:"none ready"}).
-`),j0(y)},()=>{}):Promise.resolve();if(!U)j0(M);_?.then(async(y)=>{T=y;for(;;){let i=F,B0=await z(i.worker.readiness??{},i.worker.probing??[]);if(D.signal.aborted)return;if(F!==i)continue;b(B0);return}});let F1=U&&F.worker.probing?.includes("pty.start")?V.pty.then(async(y)=>{let i=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!i())return;let B0=await z({...F.worker.readiness,"pty.start":y},(F.worker.probing??[]).filter((I0)=>I0!=="pty.start"));if(D.signal.aborted||!i())return;b(B0)},()=>{}):Promise.resolve(),r1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:P,drained:G.drained||W||I,activeClaims:x(),activeSessions:C,lastHeartbeat:R,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:l()&&!I&&P==="running"}),x1=!1,E1=()=>{x1=!0,a0()},a0=()=>{if(W)return;if(W=!0,P="stopping",w?.close(),x()===0)D.abort();else h=setTimeout(()=>D.abort(),$.shutdownGraceMs)},S1=$.channel==="production"||$.channel==="staging"?$.channel:null,O$=d($).releaseCheck,W1=X.publishedRelease??(S1&&$.lifetime==="persistent"?Q7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let y=JSON.parse(s(O$));return typeof y==="string"?y:null}catch{return null}})(),check:async(y)=>{try{c(O$,y)}catch{}let i=await Z7({channel:S1});process.stderr.write(i==="started"?`Reason worker: CLI ${y} is published; the updater is checking now.
-`:i==="absent"?`Reason worker: CLI ${y} is published; no updater is installed for it here.
-`:`Reason worker: CLI ${y} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),v=(y)=>{if(y==="stop")E1();if(y==="reload_roots"){let i=t($);if(!i||i.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=i.roots;let B0=j7(J.roots,Y7());if(B0)O.root_paths=B0;else delete O.root_paths;k?.check()}if(y==="drain"||y==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:y==="drain"},x0($,G)}return r1()};X.prestartedControl?.handle(v);let Y0=X.prestartedControl?await X.prestartedControl.closed:await y2($,Q,v),L1,i0=!1,A$=()=>{let y=Date.parse(Y)-Date.now();if(y>0){L1=setTimeout(A$,Math.min(y,2147483647));return}W=!0,w?.close(),i0=!0,P="stopping",D.abort(Error("worker_credential_expired"))};A$(),X.signal?.addEventListener("abort",a0,{once:!0});let g0=X.processSignals!==!1;if(g0)process.once("SIGTERM",a0),process.once("SIGINT",E1);if(X.signal?.aborted)a0();try{X.onStartup?.("control_ready");let y=X.client??new J2(J1($.apiOrigin),k0($.proxy,K7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),i=d($).daemon,B0=R4($,J.deviceId),I0=X.startupTiming,a=I0?()=>({...I0(),...B0?.enrollmentMs!==void 0?{enrollment_ms:B0.enrollmentMs}:{}}):void 0,M0=(m)=>{let n0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&n0)(X.handOverLocalLogins??r6)({state:m.state,client:{localSubscription:n0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=Y7(),w0=m.client.liveSessionWorktrees?.bind(m.client);if(w0)U7(()=>N7({home:W0,deviceId:m.state.deviceId,liveIds:(D1)=>w0(m.state,D1,m.signal)}),m.signal)};M0({state:J,client:y,signal:D.signal});let l0=XB($,X.platform??process.platform),w1=y.deviceLifecycle?.bind(y),t1=Promise.resolve(),R0=0,S0=()=>{if(!l0||!w1||W||Date.now()<R0)return;R0=Date.now()+QB,t1=t1.then(()=>X7({paths:l0,device:J,client:{deviceLifecycle:w1},accept:YB,signal:D.signal})).catch(()=>{return})};if(S0(),l0)V.final.then((m)=>GB(l0,m),()=>{});let R$=(m,n0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+F7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:G7,operationCompletionTimeoutMs:G7,maxConsecutiveHeartbeatFailures:3,claimable:l,onClaim:async(W0,w0,D1)=>{let I$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let r0=F.worker.probing??[],K9=r0.includes(W0.capability)?P1:W0.capability==="hands.connect"&&$.executionMode==="host"&&r0.includes("pty.start")?F1:null;if(K9){let U2,L4=()=>{};await Promise.race([K9,new Promise((V9)=>{U2=setTimeout(V9,$B),L4=()=>V9(),w0.addEventListener("abort",L4,{once:!0})})]),clearTimeout(U2),w0.removeEventListener("abort",L4)}let N2=W0.capability==="hands.connect",W4=N2?w:null,pJ={signal:w0,emit:D1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(U2)=>m.client.operationCustomEndpointCredential(m.state,W0,U2)}:{},...N2?{handsLaunch:{claimedAtMs:I$,...W4?{takePrespawnedWorker:W4.take,adoptSpawnedWorker:W4.adopt}:{}}}:{}};if(N2)C+=1;try{return await(X.execute??u3)(m.state,W0,pJ)}finally{if(N2)C-=1}},onControl:async(W0,w0)=>await O7(m.state,W0,w0,m.client)||await A7(m.state,W0,w0)||await W7(W0,w0)||await j?.broker.control(W0,w0)||!1,onEvent:n0}),H2=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:eG(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(B7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,G9=y.ownerWorkspaces?.bind(y),B9=y.ownerWorkspaceEnrollment?.bind(y);if(C$&&G9&&B9)k=i9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:G9,ownerWorkspaceEnrollment:B9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,n0,W0)=>{let w0=R4(m.config,m.state.deviceId),D1={config:m.config,state:m.state,signal:n0,statusPath:d(m.config).daemon,...w0?.offer?{firstHeartbeat:w0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new J2(J1($.apiOrigin),k0($.proxy,K7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};M0(D1);let I$={...D1,heartbeatNow:null};A.add(I$);try{await K3({registerHeartbeatNow:(r0)=>{I$.heartbeatNow=r0},...R$(D1,(r0)=>{if(r0.type==="completed")v3(r0.operationId,r0.status);if(r0.type==="claims_changed"){if(W0(r0.activeClaims),W&&x()===0)D.abort()}if(r0.type==="stopped")W0(0)})})}finally{A.delete(I$)}if(W&&!i0)await H2(D1)}});let T4=0,_4=0,F4=C$?.intervalMs??l9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?S2(i):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{S=m},...a?{startup:a}:{},...R$({state:J,client:y,capabilities:O,signal:D.signal,statusPath:i,...B0?.offer?{firstHeartbeat:B0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&x()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!w)w=M7({log:(n0,W0)=>{process.stderr.write(`${JSON.stringify({event:n0,...W0})}
-`)}}),w.arm(),setTimeout(_7,0);else if(!m.handsPrespawn&&w)w.close(),w=null}if(m.type==="heartbeat"){if(k&&!W&&Date.now()>=T4)T4=Date.now()+F4,k.check().then((n0)=>{_4=n0?0:_4+1,T4=Date.now()+(n0?F4:Math.min(F4,p9*2**Math.min(_4-1,10)))});if(R=m.serverTime,I=m.drain,S0(),!W&&S1)W1?.(m.latestCliVersions?.[S1]);if(!W)P="running";if(!W&&!E&&r1().executionEligible){if(E=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)P="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await k?.settled(),W&&!i0&&$.lifetime==="ephemeral")await y.disconnect?.(J,AbortSignal.timeout(B7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(W&&!i0)await H2({state:J,client:y});if(x1)await q7().catch(()=>{return})}catch(y){if(!(y instanceof _0&&y.status===401))throw y;if(x0($,{...G,revoked:!0}),y.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(L1),clearInterval(N0),h)clearTimeout(h);if(g0)process.removeListener("SIGTERM",a0),process.removeListener("SIGINT",E1);X.signal?.removeEventListener("abort",a0),D.abort(),w?.close(),await k?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await Y0()}}function K7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(V7,H7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as BB,sign as KB}from"crypto";var R7=65536,VB=65536;function HB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new X0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new X0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!I7(X))throw new X0("invalid_public_key");return X}function C7(){try{let{privateKey:$,publicKey:J}=BB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:HB(J)}}catch($){if($ instanceof X0)throw $;throw new X0("proof_key_generation_failed")}}class X2{keyPair=C7();binding=null;loadPublicKey(){if(!this.keyPair)throw new X0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=C7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>VB)throw new X0("proof_sign_failed");let J;try{J=KB("sha256",$,this.keyPair.privateKey)}catch{throw new X0("proof_sign_failed")}if(!P7(J))throw new X0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>R7)throw new X0("invalid_binding");if(this.binding)throw new X0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>R7)throw new X0("invalid_binding");if(!this.binding)throw new X0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as FB,spawn as WB}from"child_process";import{isAbsolute as LB}from"path";import{promisify as DB}from"util";var Y2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class G2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=Y2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
-`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as NB}from"crypto";import{unlinkSync as UB}from"fs";import{join as qB}from"path";var B2=1,e2=45000,MB=B.strictObject({type:B.literal("configure"),protocol:B.literal(B2),version:B.string(),config:J0}),TB=B.strictObject({type:B.literal("ticket"),organizationId:B.string().min(1).max(160),receipt:B.unknown()}),_B=B.strictObject({type:B.enum(["ping","stop"])});async function x7($={}){let J=$.clock??Y2,Z=new G2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,H,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:V,version:U}=MB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(N1(V),e(g(V),!0),H=Y1({path:d(V).lock,runtimeVersion:r}),!H.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=qB(g(V),`ssh-preflight-${NB()}.json`);try{c(M,{version:1}),s(M)}finally{try{UB(M)}catch{}}let T=t(V),_=$0(V);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&V.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:B2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=V.lifetime==="ephemeral"?K=new X2:T0(V,!0);if(!T){let W=A1(V);await Z.send({type:"ticket-request",request:W.request});let L=TB.parse(await Z.receive(70000,Q.signal)),C=W.complete(L.organizationId,L.receipt);if(T=await X1(V,C,D,$.enroll),V.lifetime==="persistent")m0(T,d(V).state,{proofStore:D});x0(V,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(_B.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min(e2,$.startupTimeoutMs??e2)),()=>{F=!0,Y()});let O=H.owner.nonce;if(await Q2(V,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(V,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:V.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(V){let U=V instanceof Error&&/^worker_[a-z_]+$/.test(V.message)?V.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),H?.acquired)H.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>LB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,jB=B.strictObject({type:B.literal("hello"),protocol:B.literal(B2),version:B.string(),platform:B.enum(["linux","darwin"]),architecture:B.enum(["arm64","x64"]),enrolled:B.boolean()}),zB=B.strictObject({type:B.literal("ticket-request"),request:B.strictObject({install_id:B.uuid(),code_challenge:B.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:B.enum(["persistent","ephemeral"]),roots:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),execution_mode:B.enum(["confined","host"]),permissions:B.strictObject({read:B.literal(!0),write:B.literal(!0),execute:B.literal(!0),discover_environment:B.literal(!0),expose_mcp:B.literal(!1)})})).length(1)})}),E7=B.discriminatedUnion("type",[B.strictObject({type:B.literal("running"),deviceId:B.string().min(1).max(160),expiresAt:B.iso.datetime({offset:!0}),lifetime:B.enum(["persistent","ephemeral"]),supervision:B.literal("ssh-foreground")}),B.strictObject({type:B.literal("pong")}),B.strictObject({type:B.literal("stopped")})]),OB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function $4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&OB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function S7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
-a=${d3($.remoteCli)}
-[ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
-p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
-p=$(cd -P "$p" && pwd -P)
-[ "\${p%/}/$f" = "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
-if [ -x /usr/bin/sha256sum ]; then h=$(/usr/bin/sha256sum < "$a");
-elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
-else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
-h=\${h%% *}
-[ "$h" = ${d3($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function w7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,S7($)]}function AB($){return w7($,!1)}function b7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function RB($){let J;try{({stdout:J}=await DB(FB)("/usr/bin/ssh",["-G",...w7($,!0)],{env:b7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
-`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function CB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function IB($){await RB($);let J=WB("/usr/bin/ssh",AB($),{stdio:["pipe","pipe","pipe"],env:b7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=CB(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function PB($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let H=$[G];if(H==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(H)||J.has(H))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(H,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let H=J.get(G);if(!H)throw Error("worker_required_input_missing");return H},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");S7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(K2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function xB($,J,Z,Q,X){let{request:Y}=zB.parse($4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},H=(async()=>{G();let N=Z??z1(J),q=await(Q.enrollmentCredentials??O1)(J,N);if(G(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=Q.createTicketClient?.(q)??new H1(q,{credentialsPath:N}),U=S4(await V.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([H,new Promise((q,V)=>{if(K=()=>V(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function k7($,J={}){let{config:Z,target:Q,credentialPath:X}=PB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??Y2,G=await(J.sshTransport??IB)(Q),H=new G2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),q,V;if(G.result.then((U)=>{V=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await H.send({type:"configure",protocol:B2,version:r,config:Z});let U=jB.parse($4(await H.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await xB(H,Z,X,J,AbortSignal.any([K.signal,H.signal]));q=Y.every(1e4,()=>{H.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:x4)+e2+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=E7.parse($4(await H.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
-`)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await H.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(E7.parse($4(await H.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=V??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),H.dispose()}}import{createConnection as kB}from"net";import{WebSocket as J4}from"ws";var EB=1,F$=65536,y7=4096,f7=67108864,h7=4194304,_$=B.uuid(),SB=B.strictObject({kind:B.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:B.literal("install"),generation:B.number().int().positive(),transport:B.literal("reverse_ssh"),expiresAt:B.iso.datetime({offset:!0}),maxDurationMs:B.literal(300000),maxChannels:B.literal(1),allowTcpForwarding:B.literal(!1),allowPty:B.literal(!1)}),wB=B.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var bB=B.strictObject({protocol:B.literal(EB),type:B.literal("ssh_install_relay"),authorityToken:B.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:SB,relayUrl:wB,endpoint:B.strictObject({host:B.literal("127.0.0.1"),port:B.literal(22)})});function p3($,J=Date.now()){let Z=bB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function m7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function v7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var g7="ssh_install_relay_closed";function yB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function fB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function hB($,J=g7){try{$.close(1000,J)}catch{$.terminate()}}async function mB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new J4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>kB({host:"127.0.0.1",port:22})),G,H=!1,K=!1,N=0,q=0,V,U=(W)=>{if(V)clearTimeout(V);V=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),V.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=g7)=>{if(K)return;if(K=!0,V)clearTimeout(V);if($.signal?.removeEventListener("abort",D),G?.destroy(),X.readyState===J4.OPEN)hB(X,W);else if(X.readyState!==J4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=y7&&q<=f7},F=(W)=>{if(K||!H||X.readyState!==J4.OPEN||X.bufferedAmount>h7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=m7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let C=yB(W);if(C>F$||!z(C))return j();if(!H){if(L)return j();try{let R=v7(JSON.parse(String(W)));if(R.type!=="ssh_install_relay_ready"||R.authorityId!==Z.authority.authorityId)return j();H=!0,U(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",j),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{j()}return}if(!L)return j();let P=fB(W);if(!P||!G||G.destroyed||!G.write(P))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function u7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await mB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as vB}from"crypto";var i1="ARA_WORKER_PREVIEW_PROBE";async function l7(){if(typeof Bun>"u")return 1;let $=vB(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,H){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(i1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&H.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,H){if(typeof H!=="string"||H.length>8192){G.close();return}if(!G.data.relay){if(H===i1)G.send(i1);else G.close();return}try{let K=d7(H),N=(q)=>G.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>i1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===i1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(i1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===i1&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
-`);else throw Error("probe_protocol_failed")}catch{G.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
-`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as dB,createReadStream as lB,fstatSync as pB,readFileSync as cB}from"fs";var p7="/run/sc/instance-generation";var gB=/^[1-9][0-9]{0,15}\n?$/;function uB($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function c7($){if(typeof $!=="string"||!gB.test($))return null;let J=Number($.trim());return uB(J)?J:null}var s7=3,sB=600000,aB=65536,iB=500;function a7($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(s7))throw Error("worker_standby_invalid_invocation");return{handoffFd:s7}}function nB($=(J)=>cB(J,"utf8")){try{return c7($(p7))}catch{return null}}function rB($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=P4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var i7={isPipe:($)=>pB($).isFIFO(),stream:($)=>{let J=lB("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function tB($,J=i7){if(!J.isPipe($.fd)){try{dB($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??sB),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});G.catch(()=>{});let H=J.every(iB,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],V=0;for await(let U of Q.chunks){if(X)throw X;if(V===0)$.onArriving?.();if(V+=U.length,V>aB)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{H(),Q.close()}}async function n7($,J=i7){let Z=$.readGeneration??(()=>nB()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await tB({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return rB(Y)}var oB=`Usage: reason worker <command> --config PATH [--json]
-
-  enroll                        Obtain/redeem a ticket using the current Reason login
-  start                         Run the existing Device daemon in the foreground
-  status                        Read enrollment and live local control state
-  doctor                        Read local prerequisites; never enroll or repair
-  drain                         Persist withdrawal of new claims; keep current work
-  resume                        Explicitly clear persistent drain
-  stop                          Drain, then cancel at shutdownGraceMs (ephemeral: ends its Device)
-  revoke                        Revoke an offline Device and remove its local key
-  attach                        Start this same worker over verified system SSH
-
-Config: version 1; apiOrigin, channel, stateDirectory, workspaceRoot, lifetime
-(persistent|ephemeral); executionMode defaults confined (host is explicit consent);
-slots (Sessions at once, 1-4) defaults 1 and a Machine worker runs one;
-shutdownGraceMs defaults 30000. Paths must be absolute and canonical.
-Config and enrollment files must be owned by the current user with mode 0600.
-Enroll: --enrollment-file PATH redeems a platform-provided ticket instead.
-Enroll: --credential-file PATH selects a protected Reason credentials JSON file
-(including credentialKind: api_key). Credentials never belong in argv or worker state.
-The current login needs devices:write; enrollment never opens a browser or starts work.
-Ephemeral: start keeps its proof key only in this process. It redeems
---enrollment-file PATH, or else obtains a ticket with the current login.
-Its Device ends when the process exits; every start enrolls a new Device.
-Use lifetime persistent to stop and start the same Device.
-Simple setup: \`reason serve NAME\` writes this config and enrolls for you.
-State is isolated under stateDirectory/headless-<channel>, never Desktop identity.
-Persistent keys: a new identity's is a non-extractable login Keychain key on a Mac
-where the CLI can create one there, otherwise an extractable owner-only file.
-proxy {version 1, url, caFile?} carries enrollment, control, Hands and desktop relay
-traffic (not yet previews or kept terminals); proxy environment variables stay refused.
-No service is installed, no update is performed, and no desktop/VNC is enabled.
-SSH: attach --ssh ALIAS --ssh-config PATH --remote-cli /absolute/path/reason
-  --artifact-sha256 HASH --config PATH --foreground [--credential-file PATH]
-The config describes remote paths. An existing, SHA-256-pinned CLI is required.
-SSH config must be protected (0600); it explicitly owns IdentityFile and host trust.
-ProxyJump/ProxyCommand are unsupported; configure a directly reachable alias.
-Pretrust known_hosts. No agent forwarding, automatic installation or detached service.
-SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
-are not forwarded/supported; running is not a browser-readiness receipt.
-Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function eB($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let H=0;H<Z.length;H++){let K=Z[H];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++H];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var $K=1e4,JK=2000,r7=15000,ZK=50;async function o7($,J,Z,Q,X,Y){let G=new X2,H=new AbortController,K,N,q=new Promise((P,R)=>{K=P,N=R});if(q.catch(()=>{}),u0(),$.executionMode==="host")Z2();Z("enrollment_started");let V=X(G);V.catch(()=>{});let U=null,M=y2($,J,(P)=>{if(!U)throw Error("worker_starting");return U(P)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([H.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((P)=>{z=P}),O=setTimeout(()=>z(),$K);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(P)=>{if(P==="ready")W=setTimeout(()=>z(),JK);Q.onStartup?.(P)},C=i$($,Q.readinessProbes,D,q,void 0,j,F);C.final.catch(()=>{});try{let P;try{P=await V}catch(R){throw H.abort(),N(Error("worker_enrollment_failed")),await C.final.catch(()=>{}),await M.then((I)=>I(),()=>{}),R}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(r7,Date.parse(P.worker?.expiresAt??"")-Date.now()||r7))),K(P.roots[0].permissions),x0($,{version:1,drained:!1,revoked:!1}),await Q2($,P,G,J,{...Q,onStartup:L,prestartedReadiness:C,prestartedControl:{closed:M,handle:(R)=>{U=R}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),H.abort(),G.deleteBinding(),G.deleteKey(),await M.then((P)=>P(),()=>{})}}async function QK($,J,Z,Q){let{handoffFd:X}=a7($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,H=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>a$(T);if(K||!M)return;try{u0(),Z2()}catch{return}if(Y=w5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{d2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??n7)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(H,ZK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
-`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:V,enrollment:U}=q;try{e(g(V),!0);let M=await e7(V,()=>{});try{if(Q("lock_acquired"),t(V))throw Error("worker_ephemeral_requires_fresh_enrollment");return N1(V),await o7(V,M.owner.nonce,Q,Z,(T)=>X1(V,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function M1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
-`),J.onStartup?.(K)},H={...J,onStartup:G,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(V)=>Math.min(e1,Math.max(0,Math.round(V))),N=Y.get("readiness_started"),q=Y.get("readiness_completed");return{service_start_to_heartbeat_ms:K(performance.now()),...N!==void 0&&q!==void 0?{readiness_ms:K(q-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
-`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await l7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await k7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await u7();return await x7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await f2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
-`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await QK($,J,H,G);let K=eB($);if(!K)return Z.stdout.write(oB),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
-`),V=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!V||!!M,deviceId:V?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:V||M?Date.parse(V?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{N1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":V&&T0(N)instanceof o1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(V||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(YK);return 0}}e(g(N),!0);let U=await e7(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")x0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");N1(N);let D=()=>{f0(N),v9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await E4(N,T,O,J.enroll):await t7(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof Q1)||!O.deviceRemoved)throw O;return D(),j()});return m0(F,d(N).state,{proofStore:z}),x0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new J2(J1(N.apiOrigin),k0(N.proxy),T);if(x0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return f0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(N1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await o7(N,U.owner.nonce,G,H,async(T)=>K.enrollmentPath?E4(N,K.enrollmentPath,T,J.enroll):t7(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Q2(N,M,T0(N),U.owner.nonce,H)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
-`);let q=$.includes("--json")?void 0:G$(K instanceof Q1&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(q)Z.stderr.write(`${q}
-`);return N==="worker_revoked"&&X?0:1}}var XK=60000;async function e7($,J){let Z=Date.now()+$.shutdownGraceMs+XK,Q=!1;for(;;){let X=Y1({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((H)=>setTimeout(H,250))}}var YK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function t7($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return X1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??z1($),G=await(Z.enrollmentCredentials??O1)($,Y);if(!G)throw Error(X);let H=Z.createTicketClient?.(G)??new H1(G,{credentialsPath:Y,fetchImpl:k0($.proxy)});return m9($,G,H,Q,Z.enroll)}import{spawn as GK}from"child_process";import{existsSync as BK,readFileSync as KK,unlinkSync as VK}from"fs";import{join as HK}from"path";var NK=120,UK=15,qK=5000;function Z4($={}){let J=$.stateDirectory?HK($.stateDirectory,MK):null;if(J)TK(J);let Z=["/bin/bash","/usr/bin/bash"].find((V)=>BK(V));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??NK)),X=$.pid??process.pid,Y=Math.min(UK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${$J(r)} > ${$J(J)} 2>/dev/null
-`:"",H=(V)=>`[ $((SECONDS - started)) -ge ${Math.max(1,V-1)} ]`,K=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
-while :; do started=$SECONDS
-IFS= read -r -t ${Q} pulse && continue
-${H(Q)} && parent_is_worker || exit 0
-started=$SECONDS
-IFS= read -r -t ${Y} pulse && continue
-if ${H(Y)} && parent_is_worker; then
-  echo "Reason: worker_event_loop_stalled; no progress for ${Q+Y}s, restarting the worker." >&2
-  ${G}kill -KILL ${X}
-fi
-exit 0
-done`,N=GK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
-`),Math.min(qK,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var MK="worker-stalled";function $J($){return`'${$.replaceAll("'","'\\''")}'`}function TK($){let J;try{J=KK($,"utf8"),VK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{g$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var jK=`Share this computer as a machine
-
-Usage:
-  reason serve                     This computer, signed in (machine name: its hostname)
-  reason serve --token rmt_\u2026       Any server, no login: the token names the machine
-  reason serve NAME [--dir PATH] [--once] [--sandbox] [--yes]
-  reason serve [NAME | --token rmt_\u2026] [--dir PATH] --service
-  reason serve NAME --stop [--json]  (same as: reason stop NAME)
-
-Adds this computer as a worker of a machine and waits for sessions. Start one
-from anywhere with: reason "fix the flaky test" --on NAME
-(To run one session here yourself, run \`reason "PROMPT"\` in the folder; it
-needs no machine and serves only while that command runs.)
-Sessions queue on the machine until one of its workers is free. Run
-\`reason serve\` on more computers, or in more folders, to add workers.
-
-Signed in, the machine is created if it doesn't exist (owners and admins).
-Without a login, use a token from \`reason machines token NAME\`: --token, or
-REASON_TOKEN. The token is used once to join and is never saved. Reconnect
-later with \`reason serve NAME\` or the same command. Press Ctrl-C to stop.
-
-With --service (macOS and Linux), this computer joins in the foreground, then
-keeps the worker running in the background: it starts again at login (Linux:
-at boot, when user lingering is allowed) and restarts if it fails. The service
-runs \`reason serve NAME --dir PATH\` with this worker's saved identity; the
-token is never saved. \`reason stop NAME\` stops and removes it.
-
-Options:
-  --dir PATH   Folder sessions work in (default: the current directory)
-  --once       Keep the worker only while this command runs; nothing is saved
-  --sandbox    Run confined. Sandboxed machines can't host sessions yet.
-  --yes        Accept the first-run confirmation (required without a terminal;
-               a token already carries it)
-  --service    Keep this worker running as a background service (see above)
-  --stop       Stop this computer's running workers for NAME and remove
-               their background services. They stay in Reason and can
-               start again; \`reason disconnect NAME\` removes them.
-
-Sessions run commands in the folder with the permissions of the user who runs
-the worker unless --sandbox is set. Settings live in
-~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
-folder served for NAME is its own worker. Use
-\`reason worker status|revoke --config <that file>\` for advanced control.
-`,zK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,OK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,XJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",JJ=["REASON_TOKEN","REASON_MACHINE_TOKEN"],YJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&u$(J)&&J!==w2?J:YJ}class Q0 extends Error{}function AK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let V=$[N+1];if(!V||V.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,V),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!u$(Z)&&!zK.test(Z))throw new Q0(XJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,H=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(H!==void 0&&!OK.test(H))throw new Q0("--org must be a workspace id.")}else if(H!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...H===void 0?{}:{org:H.toLowerCase()}}}function G4($,J){let Z=DK($,J??"."),Q;try{Q=QJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!WK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var Q4=($)=>n1($,".reason","workers"),c3=($)=>u(d($).state);function RK($,J,Z){let Q=n1(Q4($),J);if(C0(n1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return n1(Q4($),`${J}@${_K("sha256").update(Z).digest("hex").slice(0,8)}`)}function GJ($){let{stateDirectory:J}=$;if(K2($.workspaceRoot,J)||K2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function C0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function CK($,J){$.stdout.write(`${J} [y/N] `);let Z=await z9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function B4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var IK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function BJ($){try{return await $()}catch(J){let Z=J instanceof G0?IK[J.code]:void 0;throw Z?Error(Z):J}}async function PK($,J,Z,Q){let X=GJ({...J,name:$.name??YJ,stateDirectory:n1(Q4(Z),".token-enrollment")}),Y=A1(X,{stored:!1}),G=await BJ(()=>C9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!u$(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let H=!1;return{name:$.name??G.machine_name,input:(K)=>{if(H)throw Error("worker_ticket_receipt_mismatch");return H=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function xK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??O1)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((H)=>new H1(H)))(Y);return h9(X,Y,{createHeadlessDeviceEnrollmentTicket:(H)=>BJ(async()=>{try{return await G.createMachineEnrollmentTicket($,H)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
-`)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,H)})})}}async function KJ($,J,Z,Q){let X=await f2($,Q,()=>ZJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!_1($,J,Z))return null;return c4($),X}function i3($,J){let Z=Q4($);if(!u(Z))return[];let Q=J.toLowerCase();return FK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=n1(Z,X,"worker.json"),H=C0(G);return H?[{path:G,config:H}]:[]})}async function EK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??H0,H=[];for(let K of Y){let N=await G(K.config,"stop")!==null,q=Y4(K.config,X),V=N||q!==null;if(H.push({config:K.path,folder:K.config.workspaceRoot,running:V,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
-`);if(!$.json)Z.stdout.write(V?`Stopping machine "${$.name}" in ${K.config.workspaceRoot}; current work finishes first.
-`:`Machine "${$.name}" in ${K.config.workspaceRoot} is not running.
-`)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:H})}
-`);return 0}async function VJ($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??M1,X=J.env??process.env,Y=JJ.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of JJ)delete process.env[G];try{let G=AK($,Y);if(!G)return Z.stdout.write(jK),0;let H=QJ(J.home??V0()),K=J.serviceHost??K1(H);if(G.stop)return await EK({...G,name:G.name},H,Z,J,K);let N=J.channel??P0(),q=G4(J.cwd??process.cwd(),G.dir),V=G.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:G.once,sandbox:G.sandbox},M=G.token?await PK({...G,token:G.token},U,H,J):void 0,T=M?.name??G.name??a3((J.hostname??LK)()),_=RK(H,T,q),D=n1(_,"worker.json"),j=C0(D);if(M&&j&&c3(j)&&$0(j).revoked)f0(j);let z=!M&&j!==null&&c3(j)&&(!b0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=GJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
-Run it with: reason serve ${T} ${s3(j)}
-Or remove it first: reason worker revoke --config ${D}`)}let W=F.lifetime==="persistent"?D$(F,K):null;if(W&&!G.service&&X[a1]!==W.label)return Z.stdout.write(`Machine "${T}" in ${q} already runs as a background service (${W.label}).
-  Logs: ${W.logs}
-  Stop it with: reason stop ${T}
-`),0;if(G.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!u$(T))throw new Q0(XJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
-`);else if(L&&!G.yes&&!M){let R=`Sessions on "${T}" will run commands in ${q} with your user permissions (no sandbox). Continue?`,I=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!I)throw new Q0(`${R.replace(/ Continue\?$/,"")}
-Re-run with --yes to confirm.`);if(!await(J.confirm??((E)=>CK(Z,E)))(R))return Z.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!O)e(F.stateDirectory,!0),c(D,F);let C={...J.worker,enrollmentInput:xK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
-`);let I=await Q(["enroll","--config",D],{...C,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(I!==0)return I}if(V){let R;try{R=X4({config:F,launcher:V,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(I){if(!(I instanceof T1))throw I;throw new Q0(`${I.message}
-This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${s3(F)}
-Or try the background service again with: reason serve ${T} ${s3(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${q}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${R.label} (starts at ${R.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${R.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...R.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
-`)),0}Z.stdout.write([`Reason machine "${T}"`,`  Folder:   ${q}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Lifetime: ${F.lifetime==="persistent"?`saved; run \`reason serve ${T}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
-`));let P=W&&X[a1]===W.label&&!J.runWorker?Z4({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",D],{...C,io:{stdout:Z.stdout,stderr:B4(Z.stderr)},onStartup:(R)=>{if(R==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
-`);J.worker?.onStartup?.(R)}})}finally{P?.stop()}}catch(G){if(G instanceof Q0||G instanceof T1){let N=G instanceof T1&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
-`),2}let H=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:null,K=H?G$(H):void 0;return Z.stderr.write(`Reason: ${H?K?`${K} (${H})`:H:"could not prepare this machine."}
-`),1}}var SK=200;var gL=B.strictObject({version:B.literal(1),session_ids:B.array(B.string().min(1).max(200)).max(SK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as HJ}from"child_process";import{readFileSync as wK,rmdirSync as bK,rmSync as kK}from"fs";import{join as n3}from"path";var yK=["Reason.app","Ara Sidecar.app","Ara Device.app"],fK="sidecar_retire_failed";function hK($){return n3($,"Library","Application Support","Ara","Sidecar")}function mK($){try{let J=wK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function UJ($,J={}){let Z=hK($),Q=yK.map((H)=>n3(Z,H)).filter(mK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>HJ("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((H)=>process.kill(H,"SIGTERM")),G=J.command??((H,K)=>HJ(H,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let H of X().split(`
-`)){let K=H.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let H of Q)G(NJ,["-u",H]),kK(H,{recursive:!0,force:!0});try{bK(Z)}catch{}}catch{return{status:"failed",code:fK}}return{status:"removed",bundles:Q}}var pK=`Connect this computer to Reason
-
-Usage:
-  reason connect                 Your computer, kept connected in the background
-  reason connect --to NAME       Add it to team machine NAME (as reason serve NAME --service)
-  reason connect --token rmt_\u2026   Join a machine with no login (as reason serve --token \u2026 --service)
-  reason connect --once          Only while this command runs; nothing is saved
-  reason connect --api-key KEY   Without reason login: a headless box, with an API key that has
-                                 devices:write (or set REASON_API_KEY, which keeps it out of ps).
-                                 The connection keeps the key to renew itself (macOS: Keychain).
-  reason disconnect [NAME]       Stop and remove it (NAME: this computer's workers for machine NAME);
-                                 it stays disconnected until you run reason connect
-
-Settings, saved; run reason connect again to change them:
-  --folder PATH                  Where Sessions may run (yours: your home folder; a machine: the current folder)
-  --sessions N                   Sessions at once, 1-4 (yours: 4; a machine: 1)
-  --name NAME                    This computer's name in Reason (default: its hostname)
-  --api-url URL                  The Reason API to connect to (as REASON_API_URL)
-  --proxy URL                    Reach Reason through this proxy (HTTPS_PROXY is not used)
-  --proxy-ca-file PATH           The proxy's PEM CA bundle
-  --user-chrome on|off           Your Sessions may use your own Chrome and its signed-in profiles
-                                 (macOS, through the Reason extension; on by default)
-  --cloud-sessions on|off        No longer needed: Reason does not read it
-  --minimal                      Keep this computer minimal: files, shell and terminal, no desktop,
-                                 computer use or browser use (reason desktop install adds them)
-  --local-logins on|off          Your Sessions run on the Claude Code, Codex and Grok logins
-                                 on this computer (on by default; off with an API key).
-                                 Reason gets each login's current access token, never
-                                 its refresh token.
-
-  --keep-awake on|off            macOS: keep this Mac awake while it runs Sessions (default on).
-                                 Applies at once, without reconnecting.
-  --add-folder PATH              Let Sessions run in another folder too, on the same computer in
-  --remove-folder PATH           Reason; or stop that. Applies at once; running Sessions in other
-                                 folders keep running. \`reason status --json\` lists the folders.
-
-Your computer is Personal: it needs no machine and no admin role, and only you
-start Sessions on it until you make it Team in Settings \u203A Computers. They run commands
-with your user permissions (there is no sandbox mode). It starts again at login (Linux:
-at boot, when lingering is allowed), restarts if it fails, and \`reason update\`
-restarts it on the new version. \`reason status\` shows it.
-
-It is connected in the workspace you signed in to. It is also connected, by
-itself, in up to 8 other workspaces you belong to, as each one's own computer,
-when this computer was signed in with the setup command Reason shows you (it
-ends in --pair CODE, a one-time code from your signed-in Reason) or by the
-Reason app, and was connected after that. Signed in with \`reason login\`
-alone, or connected with --api-key or --once, it stays in the one workspace:
-run the setup command from Reason here, then \`reason disconnect\` and
-\`reason connect\` if it was connected before. One sign-in covers one computer;
-a second computer needs its own. \`reason status\` says when this applies.
-
-One computer serves several Reason accounts. Signed in as another account than
-the one it is connected for, reason connect connects it for that account too,
-as that account's own computer in the workspace it signed in to; the other
-accounts stay connected. That account's \`reason logout\` removes only its own.
-`,cK=`Disconnect this computer from Reason
-
-Usage:
-  reason disconnect              Stop your computer's connection and remove it from Reason, in every
-                                 workspace and for every Reason account it is connected for. It stays
-                                 disconnected (reason "\u2026" won't connect it) until you run reason connect
-  reason disconnect NAME         Stop this computer's workers for machine NAME and remove them from Reason
-
-  --account                      Only the signed-in account's computer leaves Reason (all of it when it is
-                                 the only account here); it stays disconnected for that account until
-                                 its reason connect (the Reason app's Disconnect)
-  --temporary                    The Reason app's sign-out: only the signed-in account's computer leaves
-                                 Reason (all of it when it is the only account here), and it is not kept
-                                 disconnected: the next reason "\u2026" connects it again
-  --yes, -y                      Accepted for scripts; disconnect never asks
-`;class p extends Error{}var sK=4,H4={write:()=>!0};function d0($,J,Z=!1){let Q=xJ($,J,Z);return Q.length===1?Q[0]:F0(q2(F0($,".config")),...PJ(J,Z))}var PJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function xJ($,J,Z=!1){let Q=$;try{Q=V1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...PJ(J,Z))).filter(aK)}function aK($){try{if(V1($)!==$)return!1;return C0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var EJ="disconnected.json";function PD($,J){return u(F0(d0($,J),EJ))}function N4($,J,Z){let Q=F0(d0($,J),EJ);if(!Z){z$(Q,{force:!0});return}e(e3(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function iK($){let J=new Map,Z=new Set;for(let V=0;V<$.length;V+=1){let U=$[V];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",K4,V4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[V+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),V+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(V4)&&!J.has(K4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((V)=>V!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((V)=>J.has(V));if(Y.length>0&&(J.size>1||[...Z].some((V)=>V!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let H=J.get("--cloud-sessions");if(H!==void 0&&H!=="on"&&H!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(V,U)=>U===void 0?{}:{[V]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",G===void 0?void 0:G==="on"),...q("cloudSessions",H===void 0?void 0:H==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(K4)),...q("proxyCaFile",J.get(V4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var I1=($)=>u(d($).state),SJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function wJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function nK($){return $===1?"one at a time":`up to ${$} at once`}function bJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=G4($.options.cwd??process.cwd(),J.folder)}catch(H){throw new p(H instanceof Error?H.message:String(H))}if(!E$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!b0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(H){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${H instanceof Error?H.message:String(H)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!FJ(X)&&!_J($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=DJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(H){if(!(H instanceof WJ))throw H;throw new p(H.message)}let G=(Z?.folders??[]).filter((H)=>H!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??dK)()),slots:J.sessions??Z?.slots??sK,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function kJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function $9($,J,Z,Q,X){if($0($).revoked){if(I1($))try{f0($)}catch{}k4($);let Y=[];try{Y=uK(g($))}catch{}for(let G of Y)if(G!=="workspaces")z$(F0(g($),G),{recursive:!0,force:!0})}else if(I1($))f0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??M1)(["enroll","--config",J],{...J9(Q.worker,X),io:{stdout:H4,stderr:Z.stderr}})}function V2($,J,Z){let Q=P$(Z1(k$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function rK($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),G=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},H=null;try{H=C0(Y)}catch{}if(G(H))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let K=await $9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&I1(X))await U4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function J9($,J){return J?{...$,enrollmentCredentials:(Z)=>O4(Z,J)}:{...$}}async function Z9($,J,Z,Q,X,Y="connect"){if(await Q9($,Q,X,Y),Y==="connect"&&!await gJ($,Z,Q))return!1;if(!await U4($,J,Z,Q))return!1;return x9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function U4($,J,Z,Q){if(!I1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??M1)(["revoke","--config",J],{...Q.worker,io:{stdout:H4,stderr:Y?Z.stderr:H4}})===0)return!0;if(Y)return!1;await new Promise((H)=>setTimeout(H,1000))}}async function Q9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,G=async()=>Y($,"status").catch(()=>null),H=await Y($,"stop").catch(()=>null)!==null,K=!X&&Y4($,Z,Q);if(H||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((q)=>setTimeout(q,250))}}function X9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...X9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${wJ($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
-`)}function t3($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${nK(J.slots)}`,`  Mode:      ${wJ(J)}`,...J.proxy?[`  Proxy:     ${LJ(J.proxy)}`]:[],...X9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
-`)}async function qJ($,J,Z){let{io:Q,options:X}=Z;if(xJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:e3(J),timestamp:new Date().toISOString()})}
-`);let Y=E2(F0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
-`);f3(Z.home,Z.host.platform);let G=I8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(U)=>Q.stderr.write(`${U}
-`),host:Z.host}),H=L8({...G,log:(U)=>Q.stderr.write(`${U}
-`)}),{configPath:K}=H,N=H.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let q=(U,M)=>{let T=M4(Z.home,Z.channel),_;try{let j=null;try{j=M.keep?null:t(N)?.orgId.toLowerCase()??null}catch{}if(_=O2(N,{prefer:V2(Z.home,Z.channel,N),...M}),_&&j)z2(_,j)}finally{T()}if(!_)return!1;N=_;let D="";try{D=` (workspace ${t(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${U}; this computer goes on running Sessions for its other Reason account${D}.
-`),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=p0(N.stateDirectory)??void 0,M=U?null:V2(Z.home,Z.channel,N);if(!U&&!(M&&f$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let V=N.executionMode==="confined";if(V||!j$(N)){let U=p0(N.stateDirectory)??void 0;if(Q.stderr.write(V?SJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
-`),await $9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=p0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Z4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??M1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return N4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function tK($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:H}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=d0(Y,G,!0),N=bJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:H}),q=kJ(N,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),V=F0(K,"worker.json");return e(K,!0),c(V,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M1)(["start","--config",V],{...J9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:B4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
-`);X.worker?.onStartup?.(U)}})}function oK($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),S8(d(J).daemon,$);let X=S2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var eK=B.object({root:B.object({id:B.string().min(1).max(160),label:B.string().max(160),path_fingerprint:B.string()})});async function yJ($,J,Z,Q){let X=await(J9(Q.worker,Z).enrollmentCredentials??O1)($,z1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new H1(X,{credentialsPath:z1($),fetchImpl:k0($.proxy)}),G=(H)=>H instanceof G0&&H.status===404&&!["device_not_found","root_not_found"].includes(H.code);return{add:async(H)=>{let K=g9($,H,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((V)=>{if(G(V))throw Error("worker_folders_unavailable");if(V instanceof G0&&V.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw V}),q=eK.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(H)=>{await Y.removeDeviceRoot(J.deviceId,H).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function fJ($,J,Z){m0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:T0($)})}async function hJ($,J,Z,Q){let{io:X,options:Y,host:G}=Q,H=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(Q.home,Q.channel,J):null,K=J&&H&&I1(J)&&!f$(J,H)?h0(J).find((R)=>R.account&&R.organizationId===H)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,V=N&&I1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!V||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=G4(T,M)}catch(R){if(U)throw new p(R instanceof Error?R.message:String(R));_=lK(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=V.roots.slice(1).find((R)=>R.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!E$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??p0(N.stateDirectory)??void 0,F=await yJ(N,V,z,Y),O=V.roots.filter((R)=>R.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);fJ(N,V,O);let W=U?[...D.filter((R)=>R!==_),_]:D.filter((R)=>R!==_),{folders:L,...C}=N;if(c(q,J0.parse({...C,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))_1(J,G,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
-`:`Removed ${_}. Sessions on "${N.name}" no longer run in it.
-`),0}async function xD($,J,Z){let Q=o3(Z),X=M4(Q.home,Q.channel);try{let Y=F0(d0(Q.home,Q.channel),"worker.json");return await hJ({once:!1,yes:J,addFolder:$},C0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=V1($.home??V0()),Q=$.env??process.env;return{io:$.io??q4(),options:$,home:Z,channel:$.channel??P0(),environment:Q,apiKey:J??j4(Q),host:$.serviceHost??K1(Z)}}async function $V($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await yJ($,X,Z,Q),H=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[H,...Y.slice(1).filter((K)=>K.id!==H.id)]}fJ(J,X,Y)}var mJ=Symbol("serve here");async function JV($,J,Z,Q){let{io:X,options:Y,home:G,channel:H,environment:K,host:N}=Q;if(N.platform==="darwin"){let E=UJ(G);if(E.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${E.code}).
-`)}let q=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(G,H,J):null,V=J&&q&&$0(J).revoked&&h0(J).some((E)=>E.account&&E.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=bJ({parsed:$,saved:V,stateDirectory:d0(G,H),lifetime:"persistent",home:G,channel:H,options:Y,environment:K});if(N4(G,H,!1),V?.executionMode==="confined")X.stdout.write(SJ);let M=V?p0(V.stateDirectory):null,T=kJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=V!==null&&I1(V),j=D&&U0(V)===U0(T),z=j&&j$(T),F=V?.userChrome!==!1===(T.userChrome!==!1)&&V?.cloudSessions===T.cloudSessions&&V?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(V).revoked&&!f$(V,q);if(W){if(!j||!F||JSON.stringify(V.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let E=await rK(V,q,X,Y);if(E!==0)return E}let L=W?[`  Account:   yours too, in workspace ${q}, beside this computer's other Reason account`]:[],C=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await O4(T,$.apiKey),z4(T.stateDirectory,$.apiKey)};if(z&&JSON.stringify(V?.proxy)===JSON.stringify(T.proxy)&&F&&D$(T,N,"connect")?.label===zJ(T.channel)&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)&&[null,r].includes(d$(T))){await C();let E=AJ(T,N,"connect");if(E==="retired"){let w=await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!w||w.phase==="stopping")_1(T,N,"connect")}else if(E==="current_not_running")_1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let P=!z&&!W;if(D&&!j)if(V.apiOrigin!==T.apiOrigin||V.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
-`),!await Z9(V,Z,X,Y,N))throw new p("Could not remove this computer's previous connection from Reason. Check your network and try again.")}else if(V.executionMode==="host"&&j$(V))X.stdout.write(`Applying the new settings to this computer\u2026
-`),await $V(V,T,O,Y),P=!1;else await Q9(V,Y,N);if(P){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
-`);let E=await $9(T,Z,X,Y,O);if(E!==0)return E;if(O)z4(T.stateDirectory,O)}else c(Z,T),await C();let R;try{R=X4({config:T,launcher:_,path:K.PATH||"/usr/local/bin:/usr/bin:/bin",host:N,kind:"connect"})}catch(E){if(!(E instanceof T1))throw E;if(E.code!=="worker_service_manager_missing")throw new p(`${E.message}
-This computer is set up; run reason connect again to start it.`);if(Y.serveHere&&K.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),mJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await ZV(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new T1(`${E.message}
-This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,E.code)}let I=[...L,...R.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...R.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${R.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,I):t3("This computer is connected to Reason",T,N.platform,[`  Service:   ${R.label} (starts at ${R.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${R.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...I])),0}async function ZV($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??vJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((H)=>setTimeout(H,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function vJ($,J,Z){let Q=IJ(Z,"a",384);try{let X=RJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{CJ(Q)}}async function gJ($,J,Z,Q=!1){let X=!0;for(let Y of h0($)){if(Q&&Y.account)continue;if(Y.config&&I1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??M1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:H4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function q4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function Y9($,J){if($ instanceof p||$ instanceof T1){let X=$ instanceof T1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
-`),2}let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:null,Q=Z?G$(Z):void 0;return J.stderr.write(`Reason: ${Z?Q?`${Q} (${Z})`:Z:"could not connect this computer."}
-`),1}function MJ($,J){if($.minimal){dJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||lJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??TJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
-`);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let Q=(J.options.installDesktop??TJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function TJ($,J,Z){if(!Z)return vK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;gK(e3(Z.log),{recursive:!0,mode:448});let Q=IJ(Z.log,"w",384);try{let X=RJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{CJ(Q)}return 0}async function ED($,J={}){let Z=J.io??q4();try{let Q=iK($);if(!Q)return Z.stdout.write(pK),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return MJ(Q,o3(J)),await(J.runServe??VJ)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let H=OJ(G[a1],Y),K=H||Q.once?()=>{return}:M4(X.home,Y);try{let N=F0(d0(X.home,Y),"worker.json"),q=C0(N);if(H)return await qJ(q,N,X);if(Q.keepAwake!==void 0)return oK(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await hJ(Q,q,N,X);if(MJ(Q,X),Q.once)return await tK(Q,q,X);let V=await JV(Q,q,N,X);if(V!==mJ)return V;return K(),K=()=>{return},await qJ(C0(N),N,X)}finally{K()}}catch(Q){return Y9(Q,Z)}}async function SD($,J={}){let Z=J.io??q4();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(cK),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await YV(Q[0],Z,J);return await uJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return Y9(Q,Z)}}async function wD($={}){let J=$.io??q4();try{return await uJ(J,$,"logout")}catch(Z){return Y9(Z,J)}}async function uJ($,J,Z){let Q=V1(J.home??V0()),X=J.channel??P0(),Y=M4(Q,X);try{return await QV($,J,Z,Q,X)}finally{Y()}}function M4($,J){let Z=d0($,J),Q=u(Z)?X$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function QV($,J,Z,Q,X){let Y=F0(d0(Q,X),"worker.json"),G=C0(Y);if(!G){if(Z==="disconnect")N4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(Z!=="disconnect"){let K=await XV(G,Y,$,J,Z,Q,X);if(K!==null)return K}let H=!1;try{H=await Z9(G,Y,$,J,J.serviceHost??K1(Q))}finally{if(Z!=="temporary")N4(Q,X,!0)}if(!H)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
-`),1;return $.stdout.write(`Disconnected "${G.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function XV($,J,Z,Q,X,Y,G){let H=h0($).filter((D)=>D.account);if(H.length===0)return null;let K=V2(Y,G,$),N=Q.controlWorker??H0,q=H.find((D)=>D.organizationId===K);if(q){if(q.config&&!await U4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
-`),1;if(X!=="account"||!q.config)z$(q.directory,{recursive:!0,force:!0});return await N($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${K} for your account. It stays connected for its other Reason accounts.
-`),0}if(!K&&X==="account")throw new p("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!K||!f$($,K)){if(X==="account"&&K)z2($,K);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let V=Q.serviceHost??K1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await Q9($,Q,V,"connect",!0),!await gJ($,Z,Q,!0)||!await U4($,J,Z,Q))return _1($,V,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
-`),1;let M=O2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&U)z2(M,U);let T=_1(M,V,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
-`),0}async function YV($,J,Z){let Q=V1(Z.home??V0()),X=Z.serviceHost??K1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let H of Y)if(await Z9(H.config,H.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${H.config.workspaceRoot}.
-`);else G=!0,J.stderr.write(`Reason: machine "${$}" in ${H.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
-`);return G?1:0}async function bD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=await($.controlWorker??H0)(Z,"status").catch(()=>null),X=Q?d$(Z):null,Y=$.serviceHost??K1(J),G=D$(Z,Y,"connect"),H=$0(Z).revoked,K=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:N,off:q}=H||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:a9(Z,Q?.phase==="running");return{workspaces:N,workspaces_off:q,workspaces_max:L2+(N?.filter((V)=>V.account).length??0),name:Z.name,device_id:K?.deviceId??null,organization_id:K?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:X9(Z,Y.platform),cloud_sessions:Z.cloudSessions===!0,root:K?.roots[0]?{id:K.roots[0].id,permissions:K.roots[0].permissions}:null,roots:K?.roots.map((V)=>({id:V.id,folder:V.path,permissions:V.permissions}))??[],state:H?"removed":Q?Q.phase==="running"?"connected":Q.phase:"not_running",sessions_running:Q?.activeSessions??null,version:X,service:G?{label:G.label,logs:G.logs}:null}}async function kD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=C0(F0(d0(V1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?jJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function yD($={}){try{let J=V1($.home??V0());return C0(F0(d0(J,$.channel??P0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function fD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;return _1(Z,$.serviceHost??K1(J),"connect")?.label??null}async function hD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??K1(J),X=await KJ(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return GV(Z,Q,$)}async function GV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&d$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let H=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<H&&await Q($,"status").catch(()=>null)!==null)await new Promise((V)=>setTimeout(V,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??vJ)(G,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
-export{Z1 as a,H1 as b,I9 as c,d,S2 as e,C0 as f,pK as g,cK as h,d0 as i,PD as j,xD as k,ED as l,SD as m,wD as n,bD as o,kD as p,yD as q,fD as r,hD as s};