@reason-machines/cli-linux-arm64-musl 0.2.283 → 0.2.284

package/bin/vm-hands/{vm-hands-entry-lite-bjhw87nc.js → vm-hands-entry-lite-5pb2jqh3.js}

@@ -1,32 +1,32 @@
 // @bun
-import{t as u0}from"./vm-hands-entry-lite-yvmzze06.js";import{A as J5,B as Z5,C as D7,D as j7,E as v3,F as l5,G as Y5,H as _0,I as l$,J as p$,K as E0,L as J2,M as p5,N as t0,O as V6,P as Z3,Q as t5,U as o5,ba as A7,ca as R7,da as C7,ea as I7,fa as u3,y as m6,z as v6}from"./vm-hands-entry-lite-y3k1pyx7.js";import{Aa as Q5,Ba as X5,Ca as M7,Da as T7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as q5,Ka as F7,La as W$,Oa as V4,Pa as H4,Qa as jJ,Ra as zJ,Sa as OJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as W7,db as B6,fb as b8,ha as c7,ib as u2,ka as F5,kb as d5,la as W5,lb as T3,nb as w5,oa as U5,qa as R5,rb as L7,sb as N3,ta as C5,ya as E5,za as S5}from"./vm-hands-entry-lite-2yne3ped.js";import{Ab as I5,Bb as P5,Ib as x5}from"./vm-hands-entry-lite-8kqg77ym.js";import{Nb as G5}from"./vm-hands-entry-lite-h2xpqaxn.js";import{Ub as u5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Ac as G4,Ec as s5,Hc as z7,Kc as g6,Lc as u6,mc as i1,nc as K1,oc as T1,pc as L$,qc as YJ,rc as RJ,sc as CJ,tc as D$,uc as IJ,vc as e3,wc as PJ,xc as Y4,yc as _1,zc as C8}from"./vm-hands-entry-lite-d2wgjdc5.js";import{Bd as $5,Hd as $$,Rd as F2,Vc as b2,Zc as U7,_c as q7}from"./vm-hands-entry-lite-yh7n4svm.js";import{ae as B}from"./vm-hands-entry-lite-m5pmd2cz.js";import{ie as AJ,je as o2,me as O7,pe as n$,re as sJ,se as aJ,xe as r5}from"./vm-hands-entry-lite-7s23wnph.js";import{$e as h1,Be as b0,Ce as k$,Ee as P0,Fe as j4,He as J1,Ie as z0,Je as S9,Ke as LJ,Le as DJ,Me as E2,Ne as q2,Oe as f3,Pe as A8,Qe as R8,Re as Y$,Se as v$,Te as X0,Ue as T2,Ve as E7,We as S7,Xe as e1,Ye as R4,_e as Q3,af as m0,bf as y$,cf as X3,ff as m1}from"./vm-hands-entry-lite-k1wbh9dq.js";import{jf as A5}from"./vm-hands-entry-lite-53jm8bj7.js";import{hg as MJ,kg as c5,lg as h3,ng as B5}from"./vm-hands-entry-lite-rnykqcys.js";import{Wg as Z2,Xg as g5}from"./vm-hands-entry-lite-qbk0wxrz.js";import{$g as X7,Zg as V0}from"./vm-hands-entry-lite-vvmq0mtv.js";import{wh as r}from"./vm-hands-entry-lite-0etm5tzc.js";import{Dh as _7}from"./vm-hands-entry-lite-y9k070mt.js";import{Ih as v0}from"./vm-hands-entry-lite-wffqkcjq.js";import{spawn as xJ,spawnSync as dK}from"child_process";import{closeSync as EJ,mkdirSync as lK,openSync as SJ,readdirSync as pK,realpathSync as V1,rmSync as z$}from"fs";import{hostname as cK}from"os";import{dirname as $9,join as F0,resolve as sK}from"path";var nJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function N9($){let J=typeof $==="string"?nJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as QZ,randomBytes as D9}from"crypto";import{createInterface as XZ}from"readline";import{randomBytes as rJ}from"crypto";import{chmodSync as q9,existsSync as M9,lstatSync as tJ,mkdirSync as oJ,readFileSync as T9,renameSync as eJ,unlinkSync as _9,writeFileSync as F9}from"fs";import{homedir as $Z}from"os";import{dirname as JZ,join as U9}from"path";function Z1($=process.env,J=$Z()){let Z=$.XDG_CONFIG_HOME?.trim()||U9(J,".config"),X=P0({env:$})==="staging"?["staging"]:[];return U9(q2(Z,...X),"credentials.json")}function W9($,J=Z1()){return oJ(JZ(J),{recursive:!0,mode:448}),F9(J,`${JSON.stringify($,null,2)}
-`,{mode:384}),q9(J,384),J}function P$($=Z1()){if(!M9($))return null;try{let J=T9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=J1(Q);if(X!==Q)ZZ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function ZZ($,J,Z){let Q=`${$}.${process.pid}.${rJ(6).toString("hex")}.tmp`;try{let X=tJ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(F9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
-`,{mode:384,flag:"wx"}),q9(Q,384),T9($,"utf8")!==J)throw Error("credentials_changed");eJ(Q,$)}catch{try{_9(Q)}catch{}}}function L9($=Z1()){if(!M9($))return!1;return _9($),!0}class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function z9(){let $=D9(48).toString("base64url"),J=QZ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:D9(32).toString("base64url")}}function YZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function GZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw YZ(Y,`OAuth token request failed (${X.status})`);return Y}var BZ=1e4;async function KZ($,J={}){let Z=J.fetchImpl??fetch,Q=await GZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(BZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return W9(X,J.path??Z1()),X}var M2=new Map;function j9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function b1($={}){let J=$.path??Z1(),Z=P$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=M2.get(Y);if(G)return j9(G,$.signal);let V;return V=KZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=P$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return b1({fetchImpl:$.fetchImpl,path:J});return L9(J),null}).finally(()=>{if(M2.get(Y)===V)M2.delete(Y)}),M2.set(Y,V),j9(V,$.signal)}function O9($,J){return new Promise((Z)=>{let Q=XZ({input:$}),X=!1,Y=(V)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(V)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(V)=>Y(V)),Q.once("close",()=>Y(null))})}var VZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),HZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function NZ($){let J=HZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var UZ=["minimal","low","medium","high","xhigh","max"],qZ=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),MZ=B.object({devices:B.array(qZ),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),TZ=B.object({id:B.string().min(1),name:B.string()}),_Z=B.object({items:B.array(TZ)}),FZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),WZ=B.object({items:B.array(FZ).default([])}),LZ=B.enum(["linux","macos"]),A9=B.object({id:B.string().min(1),name:B.string().min(1),platform:LZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),DZ=B.object({machines:B.array(A9)}),jZ=B.object({machine:A9}),zZ=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),OZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),R9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),AZ=R9.extend({organization_id:B.string().min(1)}),kV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var yV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function k1($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var RZ=B.object({error:B.object({type:B.string(),message:B.string()})});function C9($,J,Z){let Q=RZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",V=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(V)&&V>=0?V*1000:void 0)}async function I9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw C9(J.status,Z,J.headers.get("retry-after"));return k1(AZ,Z,"invalid_machine_ticket")}class H1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await b1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw C9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return k1(DZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return k1(jZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return k1(zZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return k1(OZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return k1(R9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=_Z.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return k1(WZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=MZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:UZ.filter((V)=>Q.includes(V))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return N9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=VZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=NZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments`)).items??[]}catch(J){if(J instanceof G0&&(J.status===403||J.status===404))return[];throw J}}async requireSessionAttachments(){if((await this.request("/deployment")).session_attachments!==!0)throw Error("This server does not support Session image attachments yet. Update the server and retry; the image was not sent.")}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return j4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function CZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function z4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function P9($,J){let Z=$.env??process.env,Q=z4(Z);if(!Q)return($.getCredentials??b1)({apiOrigin:CZ(Z),signal:J});let X=y1(Z,$.channel??P0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),G=await Y.json().catch(()=>({})),V=t0(G)?G:{};if(!Y.ok){let N=typeof V.detail==="string"?V.detail:typeof V.message==="string"?V.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof V.error==="string"?V.error:"api_key_auth_failed",N)}if(typeof V.org_id!=="string"||!V.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(V.scopes)?V.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:V.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as IZ}from"crypto";import{unlinkSync as PZ}from"fs";import{platform as xZ}from"os";import{join as EZ}from"path";var x9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>EZ($,"api-key.json");function j1($){let J=IZ("sha256").update(`reason-connect-api-key
-${$}`).digest("hex");return new e1(T2(),xZ(),J)}function O4($,J,Z=j1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof X0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=j1($)){if(!u(f1($)))return null;let Z=x9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof X0))throw Q;throw Error("worker_api_key_unreadable")}}function E9($,J=j1($)){if(!u(f1($)))return;if(x9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof X0))throw Z}PZ(f1($))}async function A4($,J){let Z;try{Z=await P9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as nZ,renameSync as rZ,rmSync as v1}from"fs";import{join as q0}from"path";import{createHash as SZ}from"crypto";import{realpathSync as wZ,statSync as bZ,unlinkSync as _2}from"fs";import{platform as kZ}from"os";import{join as y0}from"path";function l($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var yZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max($$).optional()});function w9($,J,Z){e(g($),!0),c(l($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function C4($,J){let Z=l($).firstHeartbeat;try{if(!u(Z))return null;let Q=yZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?I4($):new R4(g($))}function W2($,J){T0($,!0),mZ($);let Z=J??I4($),Q=new R4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof X0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function I4($){return new e1(T2(),kZ(),fZ($))}function fZ($){let J=P4($);return SZ("sha256").update(`reason-worker
-${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,directory:P4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function b9($){return u(y0(g($),w$))}var hZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function P4($){let J=y0(g($),w$);if(!u(J))return null;let Z=hZ.safeParse(JSON.parse(s(J))),Q=l($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function mZ($){let J=y0(g($),w$);if(!u(J))return;if(P4($))try{let Z=I4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof X0))throw Z}_2(J)}function N1($){let J=wZ($.workspaceRoot);if(J!==$.workspaceRoot||!bZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(l($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&S9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var k9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=l($).control;return u(J)?k9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(l($).control,k9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),w$);if(u(Z))_2(Z);let Q=l($).state;if(u(Q))_2(Q)}var vZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),x4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:vZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),gZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),E4=30000;class Q1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function uZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(E4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new Q1(X?.error==="device_revoked")}return Q.json()}async function S4($,J,Z,Q){u0();let X=x4.parse(JSON.parse(s(J)));return X1($,X,Z,Q)}async function X1($,J,Z,Q=(Y,G)=>uZ(Y,G,k0($.proxy)),X=performance.now()){let Y=f9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function y9($,J,Z,Q,X=performance.now()){let Y=f9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function f9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=gZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let H=F2(q.first_heartbeat);try{w9($,q.device_id,{...H?{offer:H}:{},enrollmentMs:Math.min($$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as dZ,randomUUID as lZ}from"crypto";import{unlinkSync as pZ}from"fs";import{join as cZ}from"path";var h9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),sZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function w4($){return sZ.parse($)}var aZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function z1($){return Z1(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function O1($,J=z1($)){if(!u(J))return null;let Z=aZ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await b1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function m9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function v9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=A1($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await y9($,G.direct(J.orgId),Q,(N,q)=>V({approval:G.request,code_verifier:q,registration:N}).catch((H)=>{throw iZ(H)}),Y);if(K)return K}return X1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function iZ($){if(!($ instanceof G0))return $;if($.status===409)return new Q1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new Q1(!1);return $}var b$=($)=>cZ(g($),"enrollment-install.json");function g9($){if(u(b$($)))pZ(b$($))}function A1($,{stored:J=!0}={}){u0();let Z=b$($),Q=J&&u(Z)?h9.parse(JSON.parse(s(Z))):{version:1,install_id:lZ(),fingerprint_key:dZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((H)=>{let U=m1([H],X,Y)[0];if(U.path!==H)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=z9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((H)=>H.path_fingerprint)].map((H)=>({path_fingerprint:H,permissions:X,execution_mode:$.executionMode}))},q=(H)=>({version:1,organization_id:H,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(H){e(g(H),!0),c(b$(H),Q)},complete(H,U){let M=w4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(H),enrollment_ticket:M.enrollment_ticket}},direct:q}}function u9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=h9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,p9=600000,c9=15000,d9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,U1=($)=>q0(g($),"workspaces"),s9="account.json",b4=($)=>u(q0($,s9));function h0($){let J;try{J=nZ(U1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=q0(U1($),Z),X=q0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:b4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(U1($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,s9),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var k4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function l9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of k4)v1(q0(g(J),Y),{force:!0});for(let Y of k4){let G=q0(g($),Y);if(u(G))rZ(G,q0(g(J),Y))}let Q=T0(J),X=h1(l(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},l(J).state,{proofStore:Q})}function y4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(l(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(h4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(H)=>Number(Date.parse(H.worker?.expiresAt??"")>X+60000),V=h0($).flatMap((H)=>{if(!H.account||!H.config)return[];try{if($0(H.config).revoked)return[];let U=t(H.config);return U&&U.orgId.toLowerCase()===H.organizationId&&(!Q||Y(U))?[{...H,config:H.config,state:U}]:[]}catch{return[]}}).sort((H,U)=>Number(U.organizationId===J)-Number(H.organizationId===J)||Y(U.state)-Y(H.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==V.organizationId){let H=j2($,N);l9($,H.config),c(H.configPath,H.config)}else if(u(g($))){try{if(u(l($).state))f0($)}catch{}for(let H of k4)v1(q0(g($),H),{force:!0})}y4($);let q=J0.parse({...V.config,stateDirectory:$.stateDirectory});return l9(V.config,q),c(q0($.stateDirectory,"worker.json"),q),v1(V.directory,{recursive:!0,force:!0}),q}var f4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==q0(U1($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=T0(V),N=h1(l(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(V)}},l(V).state,{proofStore:K});c(X,V)}catch{}}}},h4=($)=>q0(U1($),"listed.json");function a9($){try{let J=JSON.parse(s(h4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function i9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=a9($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:q})=>{let H=!1,U=null,M=!1;try{H=N?$0(N).revoked:!1,U=N&&!H?t(N):null,M=J&&!!U&&y$(l(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:H?"removed":M?"connected":"not_running",blocked:!q&&!H&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function n9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=a9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...R}=J,x=Z.roots.slice(1).map((C)=>C.path);return J0.parse({...R,...x.length?{folders:x}:{},stateDirectory:q0(U1(J),W)})},H=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let R=new AbortController,x=()=>R.abort();if(X.addEventListener("abort",x,{once:!0}),X.aborted)R.abort();let C={...W,controller:R,claims:0,done:Promise.resolve(),account:L};C.done=$.serve(W,R.signal,(I)=>{C.claims=I}).then(()=>{return},(I)=>{if(L&&I instanceof _0&&I.status===401&&d9.has(I.code)){try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer (${I.code}); run \`reason connect\` signed in as that account to connect it again
-`)}else if(I instanceof _0&&I.status===401&&d9.has(I.code)){try{f0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
+import{t as u0}from"./vm-hands-entry-lite-yvmzze06.js";import{A as Z5,B as Q5,C as j7,D as z7,E as v3,F as p5,G as G5,H as _0,I as l$,J as p$,K as E0,L as J2,M as c5,N as i0,O as H6,P as Z3,Q as o5,U as e5,ba as R7,ca as C7,da as I7,ea as P7,fa as u3,y as v6,z as g6}from"./vm-hands-entry-lite-7e0r93qr.js";import{Aa as X5,Ba as Y5,Ca as T7,Da as _7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as M5,Ka as W7,La as W$,Oa as V4,Pa as H4,Qa as zJ,Ra as OJ,Sa as AJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as L7,db as K6,fb as k8,ha as s7,ib as u2,ka as W5,kb as l5,la as L5,lb as T3,nb as b5,oa as q5,qa as C5,rb as D7,sb as N3,ta as I5,ya as S5,za as w5}from"./vm-hands-entry-lite-csnwmngz.js";import{Ab as P5,Bb as x5,Ib as E5}from"./vm-hands-entry-lite-8kqg77ym.js";import{Nb as B5}from"./vm-hands-entry-lite-h2xpqaxn.js";import{Ub as d5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Ac as G4,Ec as a5,Hc as O7,Kc as u6,Lc as d6,mc as i1,nc as Y1,oc as _1,pc as L$,qc as GJ,rc as CJ,sc as IJ,tc as D$,uc as PJ,vc as e3,wc as xJ,xc as Y4,yc as F1,zc as I8}from"./vm-hands-entry-lite-7neqq6s2.js";import{Bd as J5,Hd as $$,Rd as F2,Vc as b2,Zc as q7,_c as M7}from"./vm-hands-entry-lite-yh7n4svm.js";import{ae as B}from"./vm-hands-entry-lite-m5pmd2cz.js";import{ie as RJ,je as o2,me as A7,pe as n$,re as aJ,se as iJ,xe as t5}from"./vm-hands-entry-lite-avqrqtfe.js";import{$e as h1,Be as b0,Ce as k$,Ee as P0,Fe as j4,He as o0,Ie as z0,Je as w9,Ke as DJ,Le as jJ,Me as E2,Ne as q2,Oe as f3,Pe as R8,Qe as C8,Re as Y$,Se as v$,Te as Y0,Ue as T2,Ve as S7,We as w7,Xe as e1,Ye as R4,_e as Q3,af as m0,bf as y$,cf as X3,ff as m1}from"./vm-hands-entry-lite-k1wbh9dq.js";import{jf as R5}from"./vm-hands-entry-lite-53jm8bj7.js";import{hg as TJ,kg as s5,lg as h3,ng as K5}from"./vm-hands-entry-lite-pfsce35z.js";import{Wg as Z2,Xg as u5}from"./vm-hands-entry-lite-qbk0wxrz.js";import{$g as Y7,Zg as V0}from"./vm-hands-entry-lite-vvmq0mtv.js";import{wh as r}from"./vm-hands-entry-lite-9dr4z8fr.js";import{Dh as F7}from"./vm-hands-entry-lite-y9k070mt.js";import{Ih as v0}from"./vm-hands-entry-lite-wffqkcjq.js";import{spawn as EJ,spawnSync as lK}from"child_process";import{closeSync as SJ,mkdirSync as pK,openSync as wJ,readdirSync as cK,realpathSync as G1,rmSync as z$}from"fs";import{hostname as sK}from"os";import{dirname as $9,join as F0,resolve as aK}from"path";var rJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function U9($){let J=typeof $==="string"?rJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as XZ,randomBytes as j9}from"crypto";import{createInterface as YZ}from"readline";import{randomBytes as tJ}from"crypto";import{chmodSync as M9,existsSync as T9,lstatSync as oJ,mkdirSync as eJ,readFileSync as _9,renameSync as $Z,unlinkSync as F9,writeFileSync as W9}from"fs";import{homedir as JZ}from"os";import{dirname as ZZ,join as q9}from"path";function e0($=process.env,J=JZ()){let Z=$.XDG_CONFIG_HOME?.trim()||q9(J,".config"),X=P0({env:$})==="staging"?["staging"]:[];return q9(q2(Z,...X),"credentials.json")}function L9($,J=e0()){return eJ(ZZ(J),{recursive:!0,mode:448}),W9(J,`${JSON.stringify($,null,2)}
+`,{mode:384}),M9(J,384),J}function P$($=e0()){if(!T9($))return null;try{let J=_9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=o0(Q);if(X!==Q)QZ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function QZ($,J,Z){let Q=`${$}.${process.pid}.${tJ(6).toString("hex")}.tmp`;try{let X=oJ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(W9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
+`,{mode:384,flag:"wx"}),M9(Q,384),_9($,"utf8")!==J)throw Error("credentials_changed");$Z(Q,$)}catch{try{F9(Q)}catch{}}}function D9($=e0()){if(!T9($))return!1;return F9($),!0}class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function O9(){let $=j9(48).toString("base64url"),J=XZ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:j9(32).toString("base64url")}}function GZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function BZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw GZ(Y,`OAuth token request failed (${X.status})`);return Y}var KZ=1e4;async function VZ($,J={}){let Z=J.fetchImpl??fetch,Q=await BZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(KZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return L9(X,J.path??e0()),X}var M2=new Map;function z9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function b1($={}){let J=$.path??e0(),Z=P$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=M2.get(Y);if(G)return z9(G,$.signal);let V;return V=VZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=P$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return b1({fetchImpl:$.fetchImpl,path:J});return D9(J),null}).finally(()=>{if(M2.get(Y)===V)M2.delete(Y)}),M2.set(Y,V),z9(V,$.signal)}function A9($,J){return new Promise((Z)=>{let Q=YZ({input:$}),X=!1,Y=(V)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(V)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(V)=>Y(V)),Q.once("close",()=>Y(null))})}var HZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),NZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function UZ($){let J=NZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var qZ=["minimal","low","medium","high","xhigh","max"],MZ=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),TZ=B.object({devices:B.array(MZ),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),_Z=B.object({id:B.string().min(1),name:B.string()}),FZ=B.object({items:B.array(_Z)}),WZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),LZ=B.object({items:B.array(WZ).default([])}),DZ=B.enum(["linux","macos"]),R9=B.object({id:B.string().min(1),name:B.string().min(1),platform:DZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),jZ=B.object({machines:B.array(R9)}),zZ=B.object({machine:R9}),OZ=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),AZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),C9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),RZ=C9.extend({organization_id:B.string().min(1)}),yV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var fV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function k1($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var CZ=B.object({error:B.object({type:B.string(),message:B.string()})});function I9($,J,Z){let Q=CZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",V=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(V)&&V>=0?V*1000:void 0)}async function P9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw I9(J.status,Z,J.headers.get("retry-after"));return k1(RZ,Z,"invalid_machine_ticket")}class N1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await b1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw I9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return k1(jZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return k1(zZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return k1(OZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return k1(AZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return k1(C9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=FZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return k1(LZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=TZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:qZ.filter((V)=>Q.includes(V))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return U9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=HZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=UZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments`)).items??[]}catch(J){if(J instanceof G0&&(J.status===403||J.status===404))return[];throw J}}async requireSessionAttachments(){if((await this.request("/deployment")).session_attachments!==!0)throw Error("This server does not support Session image attachments yet. Update the server and retry; the image was not sent.")}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return j4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function IZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function z4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function x9($,J){let Z=$.env??process.env,Q=z4(Z);if(!Q)return($.getCredentials??b1)({apiOrigin:IZ(Z),signal:J});let X=y1(Z,$.channel??P0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),G=await Y.json().catch(()=>({})),V=i0(G)?G:{};if(!Y.ok){let N=typeof V.detail==="string"?V.detail:typeof V.message==="string"?V.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof V.error==="string"?V.error:"api_key_auth_failed",N)}if(typeof V.org_id!=="string"||!V.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(V.scopes)?V.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:V.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as PZ}from"crypto";import{unlinkSync as xZ}from"fs";import{platform as EZ}from"os";import{join as SZ}from"path";var E9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>SZ($,"api-key.json");function z1($){let J=PZ("sha256").update(`reason-connect-api-key
+${$}`).digest("hex");return new e1(T2(),EZ(),J)}function O4($,J,Z=z1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function l0($,J=z1($)){if(!u(f1($)))return null;let Z=E9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function S9($,J=z1($)){if(!u(f1($)))return;if(E9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}xZ(f1($))}async function A4($,J){let Z;try{Z=await x9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as rZ,renameSync as tZ,rmSync as v1}from"fs";import{join as M0}from"path";import{createHash as wZ}from"crypto";import{realpathSync as bZ,statSync as kZ,unlinkSync as _2}from"fs";import{platform as yZ}from"os";import{join as y0}from"path";function d($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var fZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max($$).optional()});function b9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function C4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=fZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?I4($):new R4(g($))}function W2($,J){T0($,!0),vZ($);let Z=J??I4($),Q=new R4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function I4($){return new e1(T2(),yZ(),hZ($))}function hZ($){let J=P4($);return wZ("sha256").update(`reason-worker
+${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,directory:P4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function k9($){return u(y0(g($),w$))}var mZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function P4($){let J=y0(g($),w$);if(!u(J))return null;let Z=mZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function vZ($){let J=y0(g($),w$);if(!u(J))return;if(P4($))try{let Z=I4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof Y0))throw Z}_2(J)}function U1($){let J=bZ($.workspaceRoot);if(J!==$.workspaceRoot||!kZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&w9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var y9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=d($).control;return u(J)?y9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(d($).control,y9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),w$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var gZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),x4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:gZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),uZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),E4=30000;class $1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function dZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(E4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new $1(X?.error==="device_revoked")}return Q.json()}async function S4($,J,Z,Q){u0();let X=x4.parse(JSON.parse(s(J)));return J1($,X,Z,Q)}async function J1($,J,Z,Q=(Y,G)=>dZ(Y,G,k0($.proxy)),X=performance.now()){let Y=h9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function f9($,J,Z,Q,X=performance.now()){let Y=h9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function h9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=uZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let H=F2(q.first_heartbeat);try{b9($,q.device_id,{...H?{offer:H}:{},enrollmentMs:Math.min($$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as lZ,randomUUID as pZ}from"crypto";import{unlinkSync as cZ}from"fs";import{join as sZ}from"path";var m9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),aZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function w4($){return aZ.parse($)}var iZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function O1($){return e0(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function A1($,J=O1($)){if(!u(J))return null;let Z=iZ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await b1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function v9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=R1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function g9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=R1($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await f9($,G.direct(J.orgId),Q,(N,q)=>V({approval:G.request,code_verifier:q,registration:N}).catch((H)=>{throw nZ(H)}),Y);if(K)return K}return J1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function nZ($){if(!($ instanceof G0))return $;if($.status===409)return new $1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new $1(!1);return $}var b$=($)=>sZ(g($),"enrollment-install.json");function u9($){if(u(b$($)))cZ(b$($))}function R1($,{stored:J=!0}={}){u0();let Z=b$($),Q=J&&u(Z)?m9.parse(JSON.parse(s(Z))):{version:1,install_id:pZ(),fingerprint_key:lZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((H)=>{let U=m1([H],X,Y)[0];if(U.path!==H)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=O9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((H)=>H.path_fingerprint)].map((H)=>({path_fingerprint:H,permissions:X,execution_mode:$.executionMode}))},q=(H)=>({version:1,organization_id:H,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(H){e(g(H),!0),c(b$(H),Q)},complete(H,U){let M=w4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(H),enrollment_ticket:M.enrollment_ticket}},direct:q}}function d9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=m9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,c9=600000,s9=15000,l9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,q1=($)=>M0(g($),"workspaces"),a9="account.json",b4=($)=>u(M0($,a9));function h0($){let J;try{J=rZ(q1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=M0(q1($),Z),X=M0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:b4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:M0(q1($),Z)});return e(Q.stateDirectory,!0),c(M0(Q.stateDirectory,a9),{version:1}),{config:Q,configPath:M0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var k4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function p9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of k4)v1(M0(g(J),Y),{force:!0});for(let Y of k4){let G=M0(g($),Y);if(u(G))tZ(G,M0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function y4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(h4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(H)=>Number(Date.parse(H.worker?.expiresAt??"")>X+60000),V=h0($).flatMap((H)=>{if(!H.account||!H.config)return[];try{if($0(H.config).revoked)return[];let U=t(H.config);return U&&U.orgId.toLowerCase()===H.organizationId&&(!Q||Y(U))?[{...H,config:H.config,state:U}]:[]}catch{return[]}}).sort((H,U)=>Number(U.organizationId===J)-Number(H.organizationId===J)||Y(U.state)-Y(H.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==V.organizationId){let H=j2($,N);p9($,H.config),c(H.configPath,H.config)}else if(u(g($))){try{if(u(d($).state))f0($)}catch{}for(let H of k4)v1(M0(g($),H),{force:!0})}y4($);let q=J0.parse({...V.config,stateDirectory:$.stateDirectory});return p9(V.config,q),c(M0($.stateDirectory,"worker.json"),q),v1(V.directory,{recursive:!0,force:!0}),q}var f4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==M0(q1($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=T0(V),N=h1(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},h4=($)=>M0(q1($),"listed.json");function i9($){try{let J=JSON.parse(s(h4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function n9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=i9($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:q})=>{let H=!1,U=null,M=!1;try{H=N?$0(N).revoked:!1,U=N&&!H?t(N):null,M=J&&!!U&&y$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:H?"removed":M?"connected":"not_running",blocked:!q&&!H&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function r9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=i9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...R}=J,x=Z.roots.slice(1).map((C)=>C.path);return J0.parse({...R,...x.length?{folders:x}:{},stateDirectory:M0(q1(J),W)})},H=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let R=new AbortController,x=()=>R.abort();if(X.addEventListener("abort",x,{once:!0}),X.aborted)R.abort();let C={...W,controller:R,claims:0,done:Promise.resolve(),account:L};C.done=$.serve(W,R.signal,(I)=>{C.claims=I}).then(()=>{return},(I)=>{if(L&&I instanceof _0&&I.status===401&&l9.has(I.code)){try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer (${I.code}); run \`reason connect\` signed in as that account to connect it again
+`)}else if(I instanceof _0&&I.status===401&&l9.has(I.code)){try{f0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
 `)}else if(!R.signal.aborted)Y(`Reason worker: workspace ${W.organizationId} stopped (worker_workspace_failed); it starts again on the next check
-`)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",x),C.claims=0,G.get(W.organizationId)===C)G.delete(W.organizationId);let I=W.config.stateDirectory;if(L&&!b4(I)&&!u(q0(I,"worker.json")))v1(I,{recursive:!0,force:!0})}),G.set(W.organizationId,C)},M=(W,L)=>{if(!L)return null;try{let R=q(W),x=t(L);if(!x||x.orgId!==W||Date.parse(x.worker?.expiresAt??"")<=Date.now()+60000||L.name!==R.name||L.executionMode!==R.executionMode||!z0(L.apiOrigin,R.apiOrigin)||x.roots.map((C)=>C.path).join(`
+`)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",x),C.claims=0,G.get(W.organizationId)===C)G.delete(W.organizationId);let I=W.config.stateDirectory;if(L&&!b4(I)&&!u(M0(I,"worker.json")))v1(I,{recursive:!0,force:!0})}),G.set(W.organizationId,C)},M=(W,L)=>{if(!L)return null;try{let R=q(W),x=t(L);if(!x||x.orgId!==W||Date.parse(x.worker?.expiresAt??"")<=Date.now()+60000||L.name!==R.name||L.executionMode!==R.executionMode||!z0(L.apiOrigin,R.apiOrigin)||x.roots.map((C)=>C.path).join(`
 `)!==Z.roots.map((C)=>C.path).join(`
-`))return null;return{organizationId:W,config:L,state:x,proofStore:T0(L)}}catch{return null}},T=(W,L)=>{if(!L)return null;try{if($0(L).revoked)return null;let R=t(L);if(!R||R.orgId.toLowerCase()!==W||Date.parse(R.worker?.expiresAt??"")<=Date.now()+60000||L.executionMode!==J.executionMode||!z0(L.apiOrigin,J.apiOrigin))return null;return{organizationId:W,config:L,state:R,proofStore:T0(L)}}catch{return null}},_=(W,L)=>W.deviceId===L.deviceId&&W.devicePublicKey===L.devicePublicKey&&JSON.stringify(W.roots.map((R)=>[R.id,R.path]))===JSON.stringify(L.roots.map((R)=>[R.id,R.path])),D=async(W)=>{for(let[L,R]of W){if(X.aborted)return;let x=G.get(L),C=T(L,R.config);if(x&&C&&_(x.state,C.state))continue;if(x){if(x.claims>0)continue;await H(L)}if(C&&!X.aborted)U(C,!0)}for(let[L,R]of G)if(R.account&&!W.has(L)&&R.claims===0)await H(L)},j=async(W)=>{let L=q(W),R=J0.parse({...L,stateDirectory:J.stateDirectory});if(!u(q0(g(J),"enrollment-install.json")))return null;let x=A1(R),C=await Q.ownerWorkspaceEnrollment(Z,{organization_id:W,install_id:x.request.install_id,code_challenge:x.request.code_challenge},X),I=x.complete(W,C);if(e(g(L),!0),u(l(L).state))f0(L);let h=W2(L);try{let S=await X1(L,I,h,$.enroll);return m0(S,l(L).state,{proofStore:h}),x0(L,{version:1,drained:!1,revoked:!1}),c(q0(L.stateDirectory,"worker.json"),L),{organizationId:W,config:L,state:S,proofStore:h}}catch(S){if(S instanceof Q1&&S.deviceRemoved)return x0(L,{version:1,drained:!0,revoked:!0}),c(q0(L.stateDirectory,"worker.json"),L),null;throw S}},z=async()=>{let W=h0(J),L=new Map(W.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await D(L);let R=new Map(W.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),x=(A)=>L.has(A)||G.get(A)?.account===!0||b4(q0(U1(J),A)),C=(A)=>{let y=R.get(A)?.config;try{return y?$0(y).revoked:!1}catch{return!1}};for(let[A,y]of R){if(G.has(A)||C(A)||N.blocked.includes(A))continue;let w=M(A,y.config);if(w&&!X.aborted)U(w)}let I;try{I=await Q.ownerWorkspaces(Z,X)}catch(A){return N={listed:!1,blocked:N.blocked,...N.names?{names:N.names}:{},reason:A instanceof _0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let h=new Map(I.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>D2.test(A)&&A!==Z.orgId.toLowerCase()&&!x(A))),S=[...h.keys()].filter((A)=>R.has(A)?!C(A):!h.get(A)).slice(0,L2),f=[...G.values()].filter((A)=>!A.account&&A.claims>0&&!S.includes(A.organizationId)).length,d=S.filter((A)=>!R.has(A)),b=d.slice(d.length-Math.min(Math.max(0,S.length+f-L2),d.length)),P=S.filter((A)=>!b.includes(A)),E=Object.fromEntries(I.flatMap((A)=>A.name&&P.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));N={listed:!0,reason:null,blocked:P.filter((A)=>h.get(A)),names:E};for(let A of new Set([...R.keys(),...G.keys()])){if(P.includes(A)||x(A))continue;if(h.has(A)&&C(A))continue;if((G.get(A)?.claims??0)>0)continue;await H(A);let y=R.get(A)?.config;try{if(y&&u(l(y).state))f0(y)}catch{}v1(q0(U1(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
-`)}for(let A of P){if(X.aborted)return!0;if(x(A))continue;try{let y=G.get(A);if(h.get(A)){if(y&&y.claims===0)await H(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
-`);continue}let w=M(A,R.get(A)?.config??null);if(w&&y)continue;if(!w){if(y&&y.claims>0)continue;if(await H(A),w=await j(A),w)Y(`Reason worker: connected in workspace ${A}
+`))return null;return{organizationId:W,config:L,state:x,proofStore:T0(L)}}catch{return null}},T=(W,L)=>{if(!L)return null;try{if($0(L).revoked)return null;let R=t(L);if(!R||R.orgId.toLowerCase()!==W||Date.parse(R.worker?.expiresAt??"")<=Date.now()+60000||L.executionMode!==J.executionMode||!z0(L.apiOrigin,J.apiOrigin))return null;return{organizationId:W,config:L,state:R,proofStore:T0(L)}}catch{return null}},_=(W,L)=>W.deviceId===L.deviceId&&W.devicePublicKey===L.devicePublicKey&&JSON.stringify(W.roots.map((R)=>[R.id,R.path]))===JSON.stringify(L.roots.map((R)=>[R.id,R.path])),D=async(W)=>{for(let[L,R]of W){if(X.aborted)return;let x=G.get(L),C=T(L,R.config);if(x&&C&&_(x.state,C.state))continue;if(x){if(x.claims>0)continue;await H(L)}if(C&&!X.aborted)U(C,!0)}for(let[L,R]of G)if(R.account&&!W.has(L)&&R.claims===0)await H(L)},j=async(W)=>{let L=q(W),R=J0.parse({...L,stateDirectory:J.stateDirectory});if(!u(M0(g(J),"enrollment-install.json")))return null;let x=R1(R),C=await Q.ownerWorkspaceEnrollment(Z,{organization_id:W,install_id:x.request.install_id,code_challenge:x.request.code_challenge},X),I=x.complete(W,C);if(e(g(L),!0),u(d(L).state))f0(L);let h=W2(L);try{let S=await J1(L,I,h,$.enroll);return m0(S,d(L).state,{proofStore:h}),x0(L,{version:1,drained:!1,revoked:!1}),c(M0(L.stateDirectory,"worker.json"),L),{organizationId:W,config:L,state:S,proofStore:h}}catch(S){if(S instanceof $1&&S.deviceRemoved)return x0(L,{version:1,drained:!0,revoked:!0}),c(M0(L.stateDirectory,"worker.json"),L),null;throw S}},z=async()=>{let W=h0(J),L=new Map(W.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await D(L);let R=new Map(W.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),x=(A)=>L.has(A)||G.get(A)?.account===!0||b4(M0(q1(J),A)),C=(A)=>{let b=R.get(A)?.config;try{return b?$0(b).revoked:!1}catch{return!1}};for(let[A,b]of R){if(G.has(A)||C(A)||N.blocked.includes(A))continue;let w=M(A,b.config);if(w&&!X.aborted)U(w)}let I;try{I=await Q.ownerWorkspaces(Z,X)}catch(A){return N={listed:!1,blocked:N.blocked,...N.names?{names:N.names}:{},reason:A instanceof _0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let h=new Map(I.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>D2.test(A)&&A!==Z.orgId.toLowerCase()&&!x(A))),S=[...h.keys()].filter((A)=>R.has(A)?!C(A):!h.get(A)).slice(0,L2),f=[...G.values()].filter((A)=>!A.account&&A.claims>0&&!S.includes(A.organizationId)).length,l=S.filter((A)=>!R.has(A)),k=l.slice(l.length-Math.min(Math.max(0,S.length+f-L2),l.length)),P=S.filter((A)=>!k.includes(A)),E=Object.fromEntries(I.flatMap((A)=>A.name&&P.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));N={listed:!0,reason:null,blocked:P.filter((A)=>h.get(A)),names:E};for(let A of new Set([...R.keys(),...G.keys()])){if(P.includes(A)||x(A))continue;if(h.has(A)&&C(A))continue;if((G.get(A)?.claims??0)>0)continue;await H(A);let b=R.get(A)?.config;try{if(b&&u(d(b).state))f0(b)}catch{}v1(M0(q1(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
+`)}for(let A of P){if(X.aborted)return!0;if(x(A))continue;try{let b=G.get(A);if(h.get(A)){if(b&&b.claims===0)await H(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
+`);continue}let w=M(A,R.get(A)?.config??null);if(w&&b)continue;if(!w){if(b&&b.claims>0)continue;if(await H(A),w=await j(A),w)Y(`Reason worker: connected in workspace ${A}
 `)}if(w&&!X.aborted)U(w)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
-`)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(U1(J),!0),c(h4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(V)K=!0;else V=O().finally(()=>{V=null});return V},claims:()=>[...G.values()].reduce((W,L)=>W+L.claims,0),async settled(){await V,await Promise.all([...G.values()].map((W)=>W.done))}}}import{dirname as AQ}from"path";import{randomUUID as J$}from"crypto";import{chmodSync as e9,closeSync as Z$,constants as Q$,existsSync as QQ,fstatSync as $8,lstatSync as J8,mkdirSync as Z8,openSync as Q8,readFileSync as X8,readdirSync as Y8,readlinkSync as jN,realpathSync as zN,renameSync as X$,rmSync as m4,statSync as G8,symlinkSync as ON,unlinkSync as m$,writeFileSync as v4}from"fs";import{basename as RN,dirname as B8,isAbsolute as XQ,join as D0,relative as CN,resolve as IN,sep as PN}from"path";import{createRequire as YQ}from"module";var K8=1,V8=1,GQ=128,BQ=65536;var KQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var r9=/^[a-z0-9_.-]{1,80}$/,VQ=64;var HQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function H8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function N8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&KQ.test($)}function U8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function u4($){Z8($,{recursive:!0,mode:448}),e9($,448)}function NQ($,J){u4(B8($));let Z=`${$}.${process.pid}.${J$()}.tmp`;try{v4(Z,J,{mode:384,flag:"wx"}),e9(Z,384),X$(Z,$)}finally{if(QQ(Z))m$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new v$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=b0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?b0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&XQ(X))?null:D0($.home??V0(),"Library","Application Support"),V=$.root??(G?D0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...G?{legacyRoot:D0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(V,"versions"),current:D0(V,"current"),previous:D0(V,"previous"),brokerLock:D0(V,"broker.lock"),transitionLock:D0(V,"transition.lock"),lifecycleEvents:D0(V,"lifecycle-events")}}function UQ($){return H8($)&&N8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===K8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&U8($.started_at)&&R2($.runtime_version)}function q8($,J){try{let Z=J8($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=Q8(D0($,J),Q$.O_RDONLY|Q$.O_NOFOLLOW|Q$.O_NONBLOCK);try{let X=$8(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return X8(Q,"utf8")}finally{Z$(Q)}}catch{return null}}function g4($){try{let J=JSON.parse(q8($,"owner.json")??"null");return UQ(J)?J:null}catch{return null}}function M8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var t9="lease",qQ=2,MQ=4,h$;function TQ(){if(h$!==void 0)return h$;if(h$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=YQ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return h$={flock:(G,V)=>X.symbols.flock(G,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},h$}catch{}return null}function _Q($){let J=TQ();if(!J)return null;let Z=Q8(`${$}.lease`,Q$.O_RDWR|Q$.O_CREAT|Q$.O_NOFOLLOW,384);try{let Q=$8(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return Z$(Z),"busy";if(J.flock(Z,qQ|MQ)===0)return Z;let X=J.errno();return Z$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw Z$(Z),Q}}function Y1($){u4(B8($.path));let J=_Q($.path);if(J==="busy")return{acquired:!1,owner:g4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=FQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)Z$(J)}}function FQ($,J){let Z=$.alive??M8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:K8,pid:$.pid??process.pid,nonce:$.nonce?.()??J$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${J$()}`,V=!1;try{if(Z8(G,{mode:448}),v4(D0(G,"owner.json"),`${JSON.stringify(Y)}
-`,{mode:384,flag:"wx"}),J!==null)v4(D0(G,t9),`flock
-`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw J8($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}X$(G,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,g4($.path)?.nonce===Y.nonce)m4($.path,{recursive:!0,force:!0});if(J!==null)Z$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=g4($.path),H=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?H-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&q8($.path,t9)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${J$()}`;try{X$($.path,T),m4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!V)m4(G,{recursive:!0,force:!0})}}throw new v$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function T8($){return H8($)&&N8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===V8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&U8($.occurred_at)&&typeof $.event==="string"&&HQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&r9.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=VQ&&$.capabilities.every((J)=>typeof J==="string"&&r9.test(J)))}var WQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,LQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,DQ=300000,A2=0n;function jQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function _8($){try{return Y8($.lifecycleEvents).filter((J)=>WQ.test(J)).sort()}catch{return[]}}function o9($){try{let J=JSON.parse(X8($,"utf8"));return T8(J)?J:null}catch{return null}}function zQ($,J=M8,Z=Date.now()){let Q;try{Q=Y8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(LQ);if(!Y)continue;let G=D0($.lifecycleEvents,X),V=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-G8(G).mtimeMs>=DQ}catch{continue}if(!K)continue;try{X$(G,V)}catch(N){let q=N.code;if(q==="EEXIST")m$(G);else if(q!=="ENOENT")throw N}}}function OQ($){let Z=_8($).flatMap((X)=>{try{return[{name:X,size:G8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>GQ||Q>BQ){let X=Z.shift();if(!X)break;try{m$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function g$($,J,Z={}){let Q={schema_version:V8,event_id:Z.eventId?.()??J$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!T8(Q))throw new v$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return u4($.lifecycleEvents),NQ(D0($.lifecycleEvents,jQ(Q)),`${JSON.stringify(Q)}
-`),OQ($),Q}async function F8($,J,Z){zQ($);let Q=0;for(let X of _8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=o9(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${J$()}`;try{X$(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=o9(G);if(!V){m$(G);continue}try{await J(V),m$(G),Q+=1}catch{try{X$(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function D8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!RQ($.saved))return J;let Z=$.saved,Q=(G,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...V?{code:`worker_api_origin_move_${G}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?Y$():$.native;if(!X)return J;let Y=[];try{let G=X.lock(AQ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let q=Y1({path:l(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=j8(V),N={saved:V,configPath:$.configPath};if(!I2(V)&&K.length===0)return Q("unchanged"),N;if(I2(V)){let q=W8(V);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,W8(q.config))}catch(H){Q("failed",`workspace:${L8(H)}`)}return Q("moved"),N}catch(G){return Q("failed",L8(G)),J}finally{for(let G of Y.reverse())G()}}function I2($){return J1($.apiOrigin)!==$.apiOrigin}function j8($){return h0($).filter((J)=>J.config!==null&&I2(J.config))}function RQ($){return I2($)||j8($).length>0}function W8($){let J=J0.parse({...$,apiOrigin:J1($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)m0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},l(J).state,{proofStore:T0(J)});return J}function L8($){if($ instanceof X0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as CQ,lstatSync as p4,readdirSync as I8,readlinkSync as IQ,unlinkSync as PQ}from"fs";import{join as O0,sep as xQ}from"path";var P2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function P8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),G=O0(Z,"reason",...X),V=(H,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:H,...U?{code:`worker_state_rehome_${H}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?Y$():$.native,N=$.saved,q=[];try{if(N&&O8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:G};if(!d4(K,G,j,q))return J;return z8(N,j,$.host,V)}if(N&&O8(Q)&&N.stateDirectory===G&&b9(N)&&d4(K,G,N,q))return x8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!G$(Q)?.isDirectory())return J;if(yQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,P2),{version:r});return V("skipped",j),J},M=[Y];for(let j of SQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!EQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!d4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(A8(Z)!==null)return U("conflicting_identity");if(R8(Z)!==null)return U("conflicting_files");if(G$(G)&&(!G$(G).isDirectory()||I8(G).length>0))return U("connection_folder_taken");S$(N,T.devicePublicKey),f4.before(N);let _=p0(Y);if(_&&l4(Y))wQ(G,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&l4(Y))E8(G);return U(D.problem??"config_folder_kept")}return z8(N,{...N,stateDirectory:G},$.host,V)}catch(H){try{if(G$(Y)?.isDirectory())c(O0(Y,P2),{version:r})}catch{}return V("failed",fQ(H)),kQ(N,Y,G,J)}finally{for(let H of q.reverse())H()}}function z8($,J,Z,Q){let X=p4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)CQ(J.stateDirectory,448);let Y=T0(J),G=h1(l(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new x2("identity_missing");let V=U0(J);if(G.worker.configDigest===U0($))m0({...G,worker:{...G.worker,configDigest:V}},l(J).state,{proofStore:Y});else if(G.worker.configDigest!==V)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),f4.after($,J),x8($,J,Z);let K=O0(J.stateDirectory,P2);if(u(K))PQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function x8($,J,Z){if(C8($,J,Z,"connect"),!l4(J.stateDirectory))return;let Q=bQ(j1($.stateDirectory));if(!Q)return;let X=j1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);E8($.stateDirectory)}function d4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Y1({path:l(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function EQ($,J,Z){if(u(g(J))){let X=Y1({path:l(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=G$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function SQ($,J){let Z=[$,...I8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=O0(X,Y);if(G===J||!G$(O0(G,"worker.json")))continue;let V=S8(G);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+xQ))Q.push({directory:G,config:V})}return Q}function l4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function wQ($,J){let Z=j1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function E8($){try{j1($).deleteBinding()}catch(J){if(!(J instanceof X0))throw J}}function bQ($){try{return $.loadBinding()}catch(J){if(J instanceof X0)return null;throw J}}function kQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=S8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function O8($){try{return p4($).isSymbolicLink()&&IQ($)==="reason"}catch{return!1}}function yQ($){try{let J=JSON.parse(s(O0($,P2)));return typeof J.version==="string"?J.version:null}catch{return null}}function S8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function G$($){try{return p4($)}catch{return null}}function fQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof X0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as hQ}from"fs";function S2($){try{let J=JSON.parse(hQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function w8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as LK}from"crypto";import{readdirSync as DK,realpathSync as GJ,statSync as jK}from"fs";import{hostname as zK}from"os";import{join as r1,resolve as OK}from"path";var w2="cloud",mQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function u$($){return mQ.test($)&&!b8.test($)}var vQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function B$($){return vQ[$]}import{chmodSync as gQ,lstatSync as k2,mkdtempSync as uQ,realpathSync as h8,rmdirSync as dQ,rmSync as lQ,unlinkSync as pQ}from"fs";import{createConnection as cQ,createServer as sQ}from"net";import{basename as k8,dirname as y8,join as g1}from"path";var aQ=B.enum(["status","drain","resume","stop","reload_roots"]),iQ=B.strictObject({version:B.literal(1),instanceId:B.string(),deviceId:B.string(),phase:B.enum(["starting","running","reconnecting","stopping"]),drained:B.boolean(),activeClaims:B.number().int().nonnegative(),activeSessions:B.number().int().nonnegative().optional(),executionEligible:B.boolean(),supportedOperations:B.array(B.enum(b2)).max(b2.length).optional(),capabilityReadiness:B.partialRecord(B.enum(b2),B.boolean()).optional(),lastHeartbeat:B.string().nullable(),expiresAt:B.string()}),nQ=B.strictObject({nonce:B.string(),action:aQ}),rQ=B.object({nonce:B.uuid()}),m8=B.strictObject({version:B.literal(1),nonce:B.uuid(),socketPath:B.string().max(100)});function v8($){return g1(l($).lock,"control.json")}function y2($){return e(l($).lock),rQ.parse(JSON.parse(s(g1(l($).lock,"owner.json"))))}function f8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function g8($,J){let Z=v8($);if(!u(Z)){let Y=l($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return f8(Y)?Y:null}let Q=m8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=y8(Q.socketPath);if(y8(X)!==h8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(k8(X))||k8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),f8(Q.socketPath)?Q.socketPath:null}async function f2($,J,Z){if(y2($).nonce!==J)throw Error("worker_instance_changed");let Q=v8($);if(u(Q))throw Error("worker_control_already_serving");let X=uQ(g1(h8("/tmp"),"ara-worker-")),Y=g1(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,V=sQ((H)=>{G.add(H),H.once("close",()=>G.delete(H)),H.setTimeout(2000,()=>H.destroy());let U="",M=!1;H.on("error",()=>H.destroy()),H.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){H.destroy();return}if(!U.includes(`
-`))return;M=!0;try{let _=nQ.parse(JSON.parse(U));if(_.nonce!==J){H.destroy();return}H.end(JSON.stringify(Z(_.action))+`
-`)}catch{H.destroy()}})});V.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let H of G)H.destroy();if(await new Promise((H)=>V.close(()=>H())),K&&u(Q)){let H=k2(Q);if(H.isFile()&&H.dev===K.dev&&H.ino===K.ino)try{let U=m8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)pQ(Q)}catch{}}try{dQ(X)}catch{}};try{if(await new Promise((H,U)=>{V.once("error",U),V.listen(Y,()=>{gQ(Y,384),H()})}),y2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(H){throw await q(),H}}function u8($,J){try{let Z=JSON.parse(s(g1(l($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function d$($){return u8($,"runtime_version")}function tQ($){return u8($,"nonce")}function d8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(g1(l($).lock,"owner.json")))return"no_lock";return g8($,y2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var oQ=21600000,eQ=B.strictObject({instance:B.string().nullable(),since:B.number().int().nonnegative()});function $X($,J){let Z=l($).updateDeferral;try{if(!u(Z))return null;let Q=eQ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{lQ(l($).updateDeferral,{force:!0})}catch{}}async function h2($,J,Z=()=>!1){let Q=tQ($),X=$X($,Q);if(J!==void 0){let N=d$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),V=X;if(V===null){V=G;try{c(l($).updateDeferral,{instance:Q,since:V})}catch{}}let K=G-V;return{state:K<oQ?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=l($);if(!u(g1(Z.lock,"owner.json")))return null;let Q=y2($),X=g8($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let V=cQ(X),K="",N=!1,q=(H,U)=>{if(N)return;if(N=!0,V.destroy(),U)G(U);else Y(H)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
-`)),V.on("data",(H)=>{if(K+=H.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(H)=>{if("code"in H&&["ECONNREFUSED","ENOENT"].includes(String(H.code)))q(null);else q(null,H.message==="worker_control_timeout"?H:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let H=iQ.parse(JSON.parse(K));if(H.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(H)}catch{q(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as ZB}from"crypto";import{homedir as K7}from"os";import{spawn as JX}from"child_process";async function l8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),V=(H)=>{if(Q===H)return;Q=H,J.onStatusChange?.(H)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let H=(J.spawn??JX)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=H,H.once("exit",()=>{if(!X&&Z===H)V("failed"),K()}),await new Promise((U,M)=>{H.once("spawn",U),H.once("error",M)}),H.exitCode===null&&H.signalCode===null)V("held")}catch{V("failed"),K()}};G=N(),await G;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await G;let H=Z;if(!H||H.exitCode!==null||H.signalCode!==null||!H.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{H.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);H.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{H.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class m2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as GX}from"fs";import{constants as s4}from"fs";import{open as ZX}from"fs/promises";import{join as QX}from"path";var XX={platform:process.platform,home:V0,async openFile($){let J=await ZX($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function p8($=XX){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(QX($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function YX($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function c8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await YX($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?l$(X.status):p$(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var BX=1000,KX=250,VX=B5(GX(process.execPath)),s8=null,a8=null;function K5($){if(process.platform!=="darwin")return{};return a8??=p8().then((J)=>{s8={status:J,checkedAt:$().getTime()}}).finally(()=>{a8=null}),{fullDiskAccess:{...s8??{status:"unknown",checkedAt:$().getTime()},executablePath:VX}}}var i8=8,HX=2000,NX=2000,G3=8000,n8=3,UX=250,r8=1000,t8=30000,qX=0.2,MX=30000,TX=21600000,_X=300000,FX=3600000,WX=0.1,V5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function LX($){return Math.min(n8,Math.max(1,$??n8))}function DX($){return typeof $.reason_code==="string"&&V5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof v0&&($.reason.code==="cancelled"||V5.has($.reason.code))?$.reason.code:"cancelled"}function o8($){return $ instanceof v0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function H5($){return $.capability==="hands.connect"&&(X5($.payload)||Q5($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*WX)))}function jX($,J=Math.random){let Z=Math.min(t8,r8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*qX*(Q*2-1);return Math.min(t8,Math.max(r8,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function zX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function o0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function OX($){if($ instanceof g2||$ instanceof K$||$ instanceof s$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function c$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(o0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:OX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)c$($,J,Q);throw Q}}class s$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,H,U=new Promise((_,D)=>{let j=()=>{let F=new s$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(H=()=>z(Math.max(0,Math.min(N-performance.now(),HX))),z(K),$.signal.addEventListener("abort",H,{once:!0}),$.signal.aborted)H()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),U]);break}catch(_){if(G.aborted||$.signal.aborted||E0(_)||o0(_)||!AX(_)||performance.now()>=N)throw c$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw c$($,"completion",_),_;try{await V(D,G)}catch{throw c$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",H),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function AX($){if(E0($))return!1;if(o0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof s$)return!1;return!0}return!1}class g2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function v2($){if($ instanceof g2)return!0;return $ instanceof _0?l$($.status):p$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function RX($,J,Z,Q,X){let Y=new AbortController,G,V=()=>{return},K=new Promise((q,H)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),H(M)};if(V=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,H)=>{G=setTimeout(()=>{let U=new g2;Y.abort(U),H(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);V()}}async function e8($,J,Z,Q,X,Y){let G=LX($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??UX,N=Y.remainingMs(),q=Math.min(N,G*V+K*G*(G-1)/2);for(let H=0;H<G;H+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(V,Y.remainingMs()),M=await RX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:H},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||H+1>=G||o0(U)||E0(U)||!v2(U)){if(!Q.aborted)c$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(H+1),q*(H+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function CX($,J,Z,Q,X){let Y=H5(J),G=new AbortController,V=new AbortController,K=()=>{G.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,H,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,R={},x=(S)=>{j=!0,D.abort(S),G.abort(S),V.abort(S)},C=(S)=>{if(z)return z;let f=structuredClone(S),d=M;return z=(async()=>{let b=new AbortController,P=b.signal;P.throwIfAborted();let E,A=()=>{},y=new Promise((w,n)=>{if(A=()=>n(P.reason),P.addEventListener("abort",A,{once:!0}),E=setTimeout(()=>b.abort(Error("Hands stop receipt delivery timed out.")),4000),P.aborted)A()});try{for(let w=0;w<3;w+=1){P.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:d,events:[f],signal:P,transientRetryOwner:"caller"})),y]);if(P.throwIfAborted(),n.next_event_seq!==d+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(E0(n))X(n);let o=n instanceof _0?l$(n.status):p$(n);if(P.aborted||!o||w===2)throw n;let N0=Math.max(500*2**w,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,P),y])}}}finally{clearTimeout(E),P.removeEventListener("abort",A),b.abort()}})(),z},I=(S,f,d)=>{let b=(E)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:f,events:S,signal:E,...d?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&o0(A))x(A);if(d&&(E0(A)||o0(A))){if(E0(A))X(A);G.abort(A),V.abort(A),D.abort(A)}throw A});if(!d)return async(E)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await b(E)).next_event_seq;return}E.throwIfAborted();let A=()=>{},y=new Promise((w,n)=>{A=()=>n(E.reason),E.addEventListener("abort",A,{once:!0})});try{let w=await Promise.race([b(E),y]);E.throwIfAborted(),M=w.next_event_seq}finally{E.removeEventListener("abort",A)}};let P=c8({send:b,lease:L,sleep:Z,retryAfterMs:(E)=>J3(E,($.now?.()??new Date).getTime())});return async(E)=>{let A=await P(E);if(A.next_event_seq!==f+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,f)=>{let d=S??await e8($,J,{controlAckSeq:U,waitMs:f},V.signal,Z,L),b=null,P=!1;for(let E=0;E<10;E+=1){let A=U+1;for(let y of d.controls){if(y.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(y.kind==="cancel"||y.kind==="operation.cancel")b??=DX(y.payload),G.abort(new v0(b,"Reason closed the Device operation."));if(y.kind!=="cancel"&&y.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let w,n,o=new Promise((N0,j0)=>{w=N0,n=j0});o.catch(()=>{}),R.current={promise:o,resolve:w,reject:n}}try{P||=!await $.onControl?.(J,y)}catch(w){if(w instanceof v0)q??=o8(w);throw R.current?.reject(w),w}}U=y.seq,A+=1}if(d.controls.length===0){if(d.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:b,unsupported:P}}try{d=await e8($,J,{controlAckSeq:U},V.signal,Z,L),R.current?.resolve()}catch(y){if(R.current?.reject(y),!b||o0(y)||E0(y))throw y;return{cancellationReason:b,unsupported:P}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)L=new m2(J.lease_until,()=>($.now?.()??new Date).getTime(),(f)=>{if(!G.signal.aborted)N=f;G.abort(f),V.abort(f)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(f){if(!e4(J)||o0(f)||E0(f))throw f;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let f=S.cancellationReason??i4($.signal);G.abort(new v0(f,"Reason closed the Device operation.")),H={status:"cancelled",error_code:f}}else if(S.unsupported)G.abort(),H={status:"failed",error_code:"control_unsupported"};else{let f=Y?Promise.resolve():(async()=>{let b=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?NX:15000),P=Math.min(b,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),E=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!E){if(await Z(b,V.signal),V.signal.aborted)return}let A=await h(void 0,E?P:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new v0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(E0(A))X(A);if(o0(A))N=A,x(A);if(!V.signal.aborted)N=A,G.abort();return}})();try{if(L?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(L?.remainingMs()??0)>0),H=await $.onClaim(J,G.signal,async(b)=>{if(e4(J))return;let P=J.capability==="hands.connect"&&b.capability==="hands.connect"&&b.kind==="hands.stopped",E=J.capability==="hands.connect"&&b.kind==="hands.reconnected",A=E||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,D.signal,...b.deliverySignal?[b.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,y={kind:b.kind,payload:{sequence:b.sequence,capability:b.capability,...b.data?{data:E?structuredClone(b.data):b.data}:{}}};if(J.capability==="hands.connect"&&b.capability==="hands.connect"&&(b.kind==="started"||b.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&b.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:y,settle:(j0)=>j0===void 0?o():N0(j0)})});let w=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(P)await C(y);return}if(F!==null){if(b.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),P1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await I([y],M,!0)(j0),F=null}catch(F1){throw F=F1??Error("Hands stop receipt could not be confirmed."),F1}finally{clearTimeout(P1),N0.abort()}return}if(E&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new m2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{G.abort(j0),V.abort(j0)})}let o=M;if(E)W=I([...w.map((N0)=>N0.wireEvent),y],o,!0),await W(A),W=void 0;else await I([...w.map((N0)=>N0.wireEvent),y],o,!1)(A)});n.then(()=>{for(let o of w)o.settle()},(o)=>{for(let N0 of w)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(E0(o))X(o);if(E){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),V.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(b){H=G.signal.aborted?{status:"cancelled",error_code:i4(G.signal)}:{status:"failed",error_code:o8(b)}}finally{Q.authorized=()=>!1,D.abort();for(let b of _.splice(0))b.settle();V.abort(),await f}let d=J5(J.capability)?Z5(H.result,J.operation_id):null;if(N){if(E0(N))throw N;H={status:"failed",error_code:q??"control_or_heartbeat_failed",...d?{result:d}:{}}}else if(G.signal.aborted&&H.status==="succeeded")H={status:"cancelled",error_code:i4(G.signal),...d?{result:d}:{}}}if(L?.close(),E0($.signal.reason))throw $.signal.reason;await $3($,J,H)}finally{L?.close(),D.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??y$,Y=$.statusPath??Q3(),G=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...K5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),q=0,H,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),G5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??l8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await IX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,H=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(E0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=jX(q,$.reconnectRandom);H??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:H},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function IX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??y$,G=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let H=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(i8,U):i8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,Y0=0;for(let{claim:L1}of z.values()){let i0=L1.capability==="hands.connect"?L1.payload[$5]:void 0;if(typeof i0==="string"){if(v.has(i0))continue;v.add(i0)}Y0+=1}return Y0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(G).getTime()+n4(K.initialDelayMs??MX,H):Number.POSITIVE_INFINITY,x=null,C=!1,I=$.firstHeartbeat,h=I?.account_root_metadata_supported===!0,S=I?.workspace_root_metadata_supported===!0,f=I?.account_root_path_supported===!0,d=I?.home_contained_roots_supported===!0,b=I?.root_paths_supported===!0,P=I?.startup_supported===!0,E=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,y,w=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...K5(J),...V?{lastUsedAt:V}:{},...x?{organizationId:x.organization_id,organizationName:x.organization_name,organizationSlug:x.organization_slug}:{}}),o=()=>{let v=$.claimable?.()!==!1;if(!w)y??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...P&&!w&&y?{startup:y}:{},capabilities:v?Y5($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:f,homeContainedRootsSupported:d,rootPathsSupported:b}):{supported_operations:[]}}},N0=()=>{if(C||!$.client.identity)return;C=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;x=v;let Y0=Y(Q);if(!Y0)return;X({...Y0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,f=v.account_root_path_supported===!0,d=v.home_contained_roots_supported===!0,b=v.root_paths_supported===!0,P=v.startup_supported===!0,E=!1},P1=(v)=>{if(v.startup)w=!0},F1=(v,Y0)=>{if(!(Y0 instanceof _0&&Y0.status===400&&Y0.code==="invalid_heartbeat")||!v.startup&&!E)throw Y0;if(w=!0,E)h=S=f=!1,d=b=P=E=!1;return null},t1=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},x1=!1,E1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(x1)E1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((Y0)=>F1(v,Y0))).then((Y0)=>{if(!Y0)return;P1(v),j0(Y0),t1(Y0)},()=>{return})});let a0=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let S1=!1,O$=$.maxConsecutiveHeartbeatFailures??3,W1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,Y0=o(),L1=A;A=void 0,x1=!0,E1=!1;try{let a=await V$($,"heartbeat",()=>$.client.heartbeat($.state,Y0,N.signal,...L1?[L1]:[]).catch((M0)=>F1(Y0,M0)));if(x1=!1,!a)continue;v=a,P1(Y0),W1=0}catch(a){if(x1=!1,$.signal.aborted)break;if(!v2(a))throw a;if(W1+=1,W1>=O$&&!W())throw a;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(Y0.capabilities).length)continue;if(E1)continue;if(t1(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let a=new AbortController,M0=()=>a.abort($.signal.reason);if($.signal.aborted)M0();else $.signal.addEventListener("abort",M0,{once:!0});let l0;try{l0=K.check(a.signal)}catch(R0){l0=Promise.reject(R0)}let w1=l0.then((R0)=>({kind:"completed",result:R0}),(R0)=>({kind:"failed",error:R0})),o1;try{while(!0){let R0=await zX(w1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(R0.kind==="failed")throw new r4(R0.error);if(R0.kind==="completed"){o1=R0.result;break}try{let S0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,S0,N.signal).catch((H2)=>F1(S0,H2)));if(!R$)continue;v=R$,P1(S0),t1(v),W1=0}catch(S0){if($.signal.aborted)throw S0;if(!v2(S0))throw S0;if(W1+=1,W1>=O$&&!W())throw S0}}}catch(R0){a.abort(R0);let S0=await w1;if(S0.kind==="completed"&&S0.result==="activated")o1="activated";else throw R0}finally{$.signal.removeEventListener("abort",M0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,o1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+n4(K.intervalMs??TX,H)}catch(a){if(!(a instanceof r4))throw a;T+=1;let M0=K.retryBaseMs??_X,l0=K.retryMaxMs??FX,w1=Math.min(l0,M0*2**Math.min(T-1,8));R=J().getTime()+n4(w1,H)}if($.signal.aborted)break;if(_&&L())break;if(_){await a0($.heartbeatIntervalMs??15000);continue}let i0=$.client.sessionCadence?.($.state)??null,A$=i0?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await a0(A$);continue}if(F()>=M){let a=new AbortController;O=a;try{await Z(A$,AbortSignal.any([$.signal,a.signal]))}catch(M0){if(!a.signal.aborted)throw M0}finally{if(O===a)O=null}continue}let g0,k=i0?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),i=performance.now();try{g0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:k,signal:N.signal}))}catch(a){if($.signal.aborted||!v2(a)||!W())throw a;await a0(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!g0){if(performance.now()-i<k-KX)await a0(BX);continue}if($.claimable?.()===!1){await $3($,g0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:g0.operation_id,runId:g0.run_id,attemptId:g0.attempt_id,capability:g0.capability});let B0,I0={authorized:()=>!1,claim:g0};if(B0=CX({...$,signal:N.signal},g0,Z,I0,j).catch((a)=>{if(E0(a))j(a);else if(!o0(a)&&[...z].some(([M0,l0])=>M0!==B0&&l0.authorized())){if(a instanceof s$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!o0(a)&&D===null)D=a}).finally(()=>{z.delete(B0),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(B0,I0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),H5(g0)){if(await B0,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),S1=!0;let Y0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:Y0},Q),$.onEvent?.({type:"error",message:Y0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!S1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as XY}from"child_process";import{constants as f5,existsSync as YY,mkdtempSync as a5,rmSync as GY}from"fs";import{access as h5,open as BY,readFile as m5,readlink as KY,readdir as v5,unlink as VY,rmdir as HY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as u1}from"crypto";import{chmodSync as PX,closeSync as xX,fsyncSync as EX,openSync as SX,readFileSync as wX,rmdirSync as N5,unlinkSync as M5,writeFileSync as bX}from"fs";import{createConnection as kX,createServer as yX}from"net";import{dirname as fX,join as hX}from"path";var mX=5000;async function T5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:u1()},X={runId:u1(),deviceId:u1(),rootId:u1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=q5(J,X),G={version:1,snapshot_id:u1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{M5(Y.path)}catch{}}}async function _5($,J,Z=U5){if(J.aborted)return!1;let Q,X,Y=new Set,G=u1(),V=yX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(G)});V.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),H=setTimeout(N,mX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${u1()}`}),X=hX(Q.journalDirectory,"readiness.json");let U=SX(X,"wx",384);try{bX(U,G),EX(U)}finally{xX(U)}if(wX(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{PX(Q.socketPath,384)}catch{T(!1);return}K=kX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(H),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>V.close(()=>U())),Q?.disposeSocket(),X)try{M5(X)}catch{}if(Q){try{N5(Q.journalDirectory)}catch{}try{N5(fX(Q.journalDirectory))}catch{}}}}import{spawn as vX}from"child_process";import{randomUUID as d1}from"crypto";import{basename as gX}from"path";import{fileURLToPath as uX}from"url";function dX(){let $=gX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",uX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function L5($,J,Z=dX()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=vX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>G.once("close",()=>{V=!0,F()}));G.on("error",X);let N,q,H=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
+`)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(q1(J),!0),c(h4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(V)K=!0;else V=O().finally(()=>{V=null});return V},claims:()=>[...G.values()].reduce((W,L)=>W+L.claims,0),async settled(){await V,await Promise.all([...G.values()].map((W)=>W.done))}}}import{dirname as RQ}from"path";import{randomUUID as J$}from"crypto";import{chmodSync as $8,closeSync as Z$,constants as Q$,existsSync as XQ,fstatSync as J8,lstatSync as Z8,mkdirSync as Q8,openSync as X8,readFileSync as Y8,readdirSync as G8,readlinkSync as zN,realpathSync as ON,renameSync as X$,rmSync as m4,statSync as B8,symlinkSync as AN,unlinkSync as m$,writeFileSync as v4}from"fs";import{basename as CN,dirname as K8,isAbsolute as YQ,join as D0,relative as IN,resolve as PN,sep as xN}from"path";import{createRequire as GQ}from"module";var V8=1,H8=1,BQ=128,KQ=65536;var VQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var t9=/^[a-z0-9_.-]{1,80}$/,HQ=64;var NQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function N8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function U8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&VQ.test($)}function q8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function u4($){Q8($,{recursive:!0,mode:448}),$8($,448)}function UQ($,J){u4(K8($));let Z=`${$}.${process.pid}.${J$()}.tmp`;try{v4(Z,J,{mode:384,flag:"wx"}),$8(Z,384),X$(Z,$)}finally{if(XQ(Z))m$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new v$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=b0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?b0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&YQ(X))?null:D0($.home??V0(),"Library","Application Support"),V=$.root??(G?D0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...G?{legacyRoot:D0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(V,"versions"),current:D0(V,"current"),previous:D0(V,"previous"),brokerLock:D0(V,"broker.lock"),transitionLock:D0(V,"transition.lock"),lifecycleEvents:D0(V,"lifecycle-events")}}function qQ($){return N8($)&&U8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===V8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&q8($.started_at)&&R2($.runtime_version)}function M8($,J){try{let Z=Z8($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=X8(D0($,J),Q$.O_RDONLY|Q$.O_NOFOLLOW|Q$.O_NONBLOCK);try{let X=J8(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return Y8(Q,"utf8")}finally{Z$(Q)}}catch{return null}}function g4($){try{let J=JSON.parse(M8($,"owner.json")??"null");return qQ(J)?J:null}catch{return null}}function T8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var o9="lease",MQ=2,TQ=4,h$;function _Q(){if(h$!==void 0)return h$;if(h$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=GQ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return h$={flock:(G,V)=>X.symbols.flock(G,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},h$}catch{}return null}function FQ($){let J=_Q();if(!J)return null;let Z=X8(`${$}.lease`,Q$.O_RDWR|Q$.O_CREAT|Q$.O_NOFOLLOW,384);try{let Q=J8(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return Z$(Z),"busy";if(J.flock(Z,MQ|TQ)===0)return Z;let X=J.errno();return Z$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw Z$(Z),Q}}function Z1($){u4(K8($.path));let J=FQ($.path);if(J==="busy")return{acquired:!1,owner:g4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=WQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)Z$(J)}}function WQ($,J){let Z=$.alive??T8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:V8,pid:$.pid??process.pid,nonce:$.nonce?.()??J$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${J$()}`,V=!1;try{if(Q8(G,{mode:448}),v4(D0(G,"owner.json"),`${JSON.stringify(Y)}
+`,{mode:384,flag:"wx"}),J!==null)v4(D0(G,o9),`flock
+`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw Z8($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}X$(G,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,g4($.path)?.nonce===Y.nonce)m4($.path,{recursive:!0,force:!0});if(J!==null)Z$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=g4($.path),H=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?H-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&M8($.path,o9)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${J$()}`;try{X$($.path,T),m4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!V)m4(G,{recursive:!0,force:!0})}}throw new v$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function _8($){return N8($)&&U8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===H8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&q8($.occurred_at)&&typeof $.event==="string"&&NQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&t9.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=HQ&&$.capabilities.every((J)=>typeof J==="string"&&t9.test(J)))}var LQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,DQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,jQ=300000,A2=0n;function zQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function F8($){try{return G8($.lifecycleEvents).filter((J)=>LQ.test(J)).sort()}catch{return[]}}function e9($){try{let J=JSON.parse(Y8($,"utf8"));return _8(J)?J:null}catch{return null}}function OQ($,J=T8,Z=Date.now()){let Q;try{Q=G8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(DQ);if(!Y)continue;let G=D0($.lifecycleEvents,X),V=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-B8(G).mtimeMs>=jQ}catch{continue}if(!K)continue;try{X$(G,V)}catch(N){let q=N.code;if(q==="EEXIST")m$(G);else if(q!=="ENOENT")throw N}}}function AQ($){let Z=F8($).flatMap((X)=>{try{return[{name:X,size:B8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>BQ||Q>KQ){let X=Z.shift();if(!X)break;try{m$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function g$($,J,Z={}){let Q={schema_version:H8,event_id:Z.eventId?.()??J$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!_8(Q))throw new v$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return u4($.lifecycleEvents),UQ(D0($.lifecycleEvents,zQ(Q)),`${JSON.stringify(Q)}
+`),AQ($),Q}async function W8($,J,Z){OQ($);let Q=0;for(let X of F8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=e9(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${J$()}`;try{X$(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=e9(G);if(!V){m$(G);continue}try{await J(V),m$(G),Q+=1}catch{try{X$(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function j8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!CQ($.saved))return J;let Z=$.saved,Q=(G,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...V?{code:`worker_api_origin_move_${G}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?Y$():$.native;if(!X)return J;let Y=[];try{let G=X.lock(RQ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let q=Z1({path:d(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=z8(V),N={saved:V,configPath:$.configPath};if(!I2(V)&&K.length===0)return Q("unchanged"),N;if(I2(V)){let q=L8(V);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,L8(q.config))}catch(H){Q("failed",`workspace:${D8(H)}`)}return Q("moved"),N}catch(G){return Q("failed",D8(G)),J}finally{for(let G of Y.reverse())G()}}function I2($){return o0($.apiOrigin)!==$.apiOrigin}function z8($){return h0($).filter((J)=>J.config!==null&&I2(J.config))}function CQ($){return I2($)||z8($).length>0}function L8($){let J=J0.parse({...$,apiOrigin:o0($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)m0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function D8($){if($ instanceof Y0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as IQ,lstatSync as p4,readdirSync as P8,readlinkSync as PQ,unlinkSync as xQ}from"fs";import{join as O0,sep as EQ}from"path";var P2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function x8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),G=O0(Z,"reason",...X),V=(H,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:H,...U?{code:`worker_state_rehome_${H}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?Y$():$.native,N=$.saved,q=[];try{if(N&&A8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:G};if(!d4(K,G,j,q))return J;return O8(N,j,$.host,V)}if(N&&A8(Q)&&N.stateDirectory===G&&k9(N)&&d4(K,G,N,q))return E8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!G$(Q)?.isDirectory())return J;if(fQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,P2),{version:r});return V("skipped",j),J},M=[Y];for(let j of wQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!SQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!d4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(R8(Z)!==null)return U("conflicting_identity");if(C8(Z)!==null)return U("conflicting_files");if(G$(G)&&(!G$(G).isDirectory()||P8(G).length>0))return U("connection_folder_taken");S$(N,T.devicePublicKey),f4.before(N);let _=l0(Y);if(_&&l4(Y))bQ(G,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&l4(Y))S8(G);return U(D.problem??"config_folder_kept")}return O8(N,{...N,stateDirectory:G},$.host,V)}catch(H){try{if(G$(Y)?.isDirectory())c(O0(Y,P2),{version:r})}catch{}return V("failed",hQ(H)),yQ(N,Y,G,J)}finally{for(let H of q.reverse())H()}}function O8($,J,Z,Q){let X=p4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)IQ(J.stateDirectory,448);let Y=T0(J),G=h1(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new x2("identity_missing");let V=U0(J);if(G.worker.configDigest===U0($))m0({...G,worker:{...G.worker,configDigest:V}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==V)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),f4.after($,J),E8($,J,Z);let K=O0(J.stateDirectory,P2);if(u(K))xQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function E8($,J,Z){if(I8($,J,Z,"connect"),!l4(J.stateDirectory))return;let Q=kQ(z1($.stateDirectory));if(!Q)return;let X=z1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);S8($.stateDirectory)}function d4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Z1({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function SQ($,J,Z){if(u(g(J))){let X=Z1({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=G$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function wQ($,J){let Z=[$,...P8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=O0(X,Y);if(G===J||!G$(O0(G,"worker.json")))continue;let V=w8(G);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+EQ))Q.push({directory:G,config:V})}return Q}function l4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function bQ($,J){let Z=z1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function S8($){try{z1($).deleteBinding()}catch(J){if(!(J instanceof Y0))throw J}}function kQ($){try{return $.loadBinding()}catch(J){if(J instanceof Y0)return null;throw J}}function yQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=w8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function A8($){try{return p4($).isSymbolicLink()&&PQ($)==="reason"}catch{return!1}}function fQ($){try{let J=JSON.parse(s(O0($,P2)));return typeof J.version==="string"?J.version:null}catch{return null}}function w8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function G$($){try{return p4($)}catch{return null}}function hQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof Y0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as mQ}from"fs";function S2($){try{let J=JSON.parse(mQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function b8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as DK}from"crypto";import{readdirSync as jK,realpathSync as BJ,statSync as zK}from"fs";import{hostname as OK}from"os";import{join as r1,resolve as AK}from"path";var w2="cloud",vQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function u$($){return vQ.test($)&&!k8.test($)}var gQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function B$($){return gQ[$]}import{chmodSync as uQ,lstatSync as k2,mkdtempSync as dQ,realpathSync as m8,rmdirSync as lQ,rmSync as pQ,unlinkSync as cQ}from"fs";import{createConnection as sQ,createServer as aQ}from"net";import{basename as y8,dirname as f8,join as g1}from"path";var iQ=B.enum(["status","drain","resume","stop","reload_roots"]),nQ=B.strictObject({version:B.literal(1),instanceId:B.string(),deviceId:B.string(),phase:B.enum(["starting","running","reconnecting","stopping"]),drained:B.boolean(),activeClaims:B.number().int().nonnegative(),activeSessions:B.number().int().nonnegative().optional(),executionEligible:B.boolean(),supportedOperations:B.array(B.enum(b2)).max(b2.length).optional(),capabilityReadiness:B.partialRecord(B.enum(b2),B.boolean()).optional(),lastHeartbeat:B.string().nullable(),expiresAt:B.string()}),rQ=B.strictObject({nonce:B.string(),action:iQ}),tQ=B.object({nonce:B.uuid()}),v8=B.strictObject({version:B.literal(1),nonce:B.uuid(),socketPath:B.string().max(100)});function g8($){return g1(d($).lock,"control.json")}function y2($){return e(d($).lock),tQ.parse(JSON.parse(s(g1(d($).lock,"owner.json"))))}function h8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function u8($,J){let Z=g8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return h8(Y)?Y:null}let Q=v8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=f8(Q.socketPath);if(f8(X)!==m8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(y8(X))||y8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),h8(Q.socketPath)?Q.socketPath:null}async function f2($,J,Z){if(y2($).nonce!==J)throw Error("worker_instance_changed");let Q=g8($);if(u(Q))throw Error("worker_control_already_serving");let X=dQ(g1(m8("/tmp"),"ara-worker-")),Y=g1(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,V=aQ((H)=>{G.add(H),H.once("close",()=>G.delete(H)),H.setTimeout(2000,()=>H.destroy());let U="",M=!1;H.on("error",()=>H.destroy()),H.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){H.destroy();return}if(!U.includes(`
+`))return;M=!0;try{let _=rQ.parse(JSON.parse(U));if(_.nonce!==J){H.destroy();return}H.end(JSON.stringify(Z(_.action))+`
+`)}catch{H.destroy()}})});V.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let H of G)H.destroy();if(await new Promise((H)=>V.close(()=>H())),K&&u(Q)){let H=k2(Q);if(H.isFile()&&H.dev===K.dev&&H.ino===K.ino)try{let U=v8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)cQ(Q)}catch{}}try{lQ(X)}catch{}};try{if(await new Promise((H,U)=>{V.once("error",U),V.listen(Y,()=>{uQ(Y,384),H()})}),y2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(H){throw await q(),H}}function d8($,J){try{let Z=JSON.parse(s(g1(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function d$($){return d8($,"runtime_version")}function oQ($){return d8($,"nonce")}function l8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(g1(d($).lock,"owner.json")))return"no_lock";return u8($,y2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var eQ=21600000,$X=B.strictObject({instance:B.string().nullable(),since:B.number().int().nonnegative()});function JX($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=$X.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{pQ(d($).updateDeferral,{force:!0})}catch{}}async function h2($,J,Z=()=>!1){let Q=oQ($),X=JX($,Q);if(J!==void 0){let N=d$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),V=X;if(V===null){V=G;try{c(d($).updateDeferral,{instance:Q,since:V})}catch{}}let K=G-V;return{state:K<eQ?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=d($);if(!u(g1(Z.lock,"owner.json")))return null;let Q=y2($),X=u8($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let V=sQ(X),K="",N=!1,q=(H,U)=>{if(N)return;if(N=!0,V.destroy(),U)G(U);else Y(H)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
+`)),V.on("data",(H)=>{if(K+=H.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(H)=>{if("code"in H&&["ECONNREFUSED","ENOENT"].includes(String(H.code)))q(null);else q(null,H.message==="worker_control_timeout"?H:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let H=nQ.parse(JSON.parse(K));if(H.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(H)}catch{q(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as QB}from"crypto";import{homedir as V7}from"os";import{spawn as ZX}from"child_process";async function p8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),V=(H)=>{if(Q===H)return;Q=H,J.onStatusChange?.(H)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let H=(J.spawn??ZX)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=H,H.once("exit",()=>{if(!X&&Z===H)V("failed"),K()}),await new Promise((U,M)=>{H.once("spawn",U),H.once("error",M)}),H.exitCode===null&&H.signalCode===null)V("held")}catch{V("failed"),K()}};G=N(),await G;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await G;let H=Z;if(!H||H.exitCode!==null||H.signalCode!==null||!H.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{H.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);H.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{H.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class m2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as BX}from"fs";import{constants as s4}from"fs";import{open as QX}from"fs/promises";import{join as XX}from"path";var YX={platform:process.platform,home:V0,async openFile($){let J=await QX($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function c8($=YX){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(XX($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function GX($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function s8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await GX($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?l$(X.status):p$(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var KX=1000,VX=250,HX=K5(BX(process.execPath)),a8=null,i8=null;function V5($){if(process.platform!=="darwin")return{};return i8??=c8().then((J)=>{a8={status:J,checkedAt:$().getTime()}}).finally(()=>{i8=null}),{fullDiskAccess:{...a8??{status:"unknown",checkedAt:$().getTime()},executablePath:HX}}}var n8=8,NX=2000,UX=2000,G3=8000,r8=3,qX=250,t8=1000,o8=30000,MX=0.2,TX=30000,_X=21600000,FX=300000,WX=3600000,LX=0.1,H5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function DX($){return Math.min(r8,Math.max(1,$??r8))}function jX($){return typeof $.reason_code==="string"&&H5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof v0&&($.reason.code==="cancelled"||H5.has($.reason.code))?$.reason.code:"cancelled"}function e8($){return $ instanceof v0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function N5($){return $.capability==="hands.connect"&&(Y5($.payload)||X5($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*LX)))}function zX($,J=Math.random){let Z=Math.min(o8,t8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*MX*(Q*2-1);return Math.min(o8,Math.max(t8,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function OX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function n0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function AX($){if($ instanceof g2||$ instanceof K$||$ instanceof s$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function c$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(n0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:AX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)c$($,J,Q);throw Q}}class s$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,H,U=new Promise((_,D)=>{let j=()=>{let F=new s$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(H=()=>z(Math.max(0,Math.min(N-performance.now(),NX))),z(K),$.signal.addEventListener("abort",H,{once:!0}),$.signal.aborted)H()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),U]);break}catch(_){if(G.aborted||$.signal.aborted||E0(_)||n0(_)||!RX(_)||performance.now()>=N)throw c$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw c$($,"completion",_),_;try{await V(D,G)}catch{throw c$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",H),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function RX($){if(E0($))return!1;if(n0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof s$)return!1;return!0}return!1}class g2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function v2($){if($ instanceof g2)return!0;return $ instanceof _0?l$($.status):p$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function CX($,J,Z,Q,X){let Y=new AbortController,G,V=()=>{return},K=new Promise((q,H)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),H(M)};if(V=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,H)=>{G=setTimeout(()=>{let U=new g2;Y.abort(U),H(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);V()}}async function $5($,J,Z,Q,X,Y){let G=DX($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??qX,N=Y.remainingMs(),q=Math.min(N,G*V+K*G*(G-1)/2);for(let H=0;H<G;H+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(V,Y.remainingMs()),M=await CX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:H},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||H+1>=G||n0(U)||E0(U)||!v2(U)){if(!Q.aborted)c$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(H+1),q*(H+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function IX($,J,Z,Q,X){let Y=N5(J),G=new AbortController,V=new AbortController,K=()=>{G.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,H,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,R={},x=(S)=>{j=!0,D.abort(S),G.abort(S),V.abort(S)},C=(S)=>{if(z)return z;let f=structuredClone(S),l=M;return z=(async()=>{let k=new AbortController,P=k.signal;P.throwIfAborted();let E,A=()=>{},b=new Promise((w,n)=>{if(A=()=>n(P.reason),P.addEventListener("abort",A,{once:!0}),E=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),P.aborted)A()});try{for(let w=0;w<3;w+=1){P.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[f],signal:P,transientRetryOwner:"caller"})),b]);if(P.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(E0(n))X(n);let o=n instanceof _0?l$(n.status):p$(n);if(P.aborted||!o||w===2)throw n;let N0=Math.max(500*2**w,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,P),b])}}}finally{clearTimeout(E),P.removeEventListener("abort",A),k.abort()}})(),z},I=(S,f,l)=>{let k=(E)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:f,events:S,signal:E,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&n0(A))x(A);if(l&&(E0(A)||n0(A))){if(E0(A))X(A);G.abort(A),V.abort(A),D.abort(A)}throw A});if(!l)return async(E)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(E)).next_event_seq;return}E.throwIfAborted();let A=()=>{},b=new Promise((w,n)=>{A=()=>n(E.reason),E.addEventListener("abort",A,{once:!0})});try{let w=await Promise.race([k(E),b]);E.throwIfAborted(),M=w.next_event_seq}finally{E.removeEventListener("abort",A)}};let P=s8({send:k,lease:L,sleep:Z,retryAfterMs:(E)=>J3(E,($.now?.()??new Date).getTime())});return async(E)=>{let A=await P(E);if(A.next_event_seq!==f+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,f)=>{let l=S??await $5($,J,{controlAckSeq:U,waitMs:f},V.signal,Z,L),k=null,P=!1;for(let E=0;E<10;E+=1){let A=U+1;for(let b of l.controls){if(b.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(b.kind==="cancel"||b.kind==="operation.cancel")k??=jX(b.payload),G.abort(new v0(k,"Reason closed the Device operation."));if(b.kind!=="cancel"&&b.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let w,n,o=new Promise((N0,j0)=>{w=N0,n=j0});o.catch(()=>{}),R.current={promise:o,resolve:w,reject:n}}try{P||=!await $.onControl?.(J,b)}catch(w){if(w instanceof v0)q??=e8(w);throw R.current?.reject(w),w}}U=b.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:P}}try{l=await $5($,J,{controlAckSeq:U},V.signal,Z,L),R.current?.resolve()}catch(b){if(R.current?.reject(b),!k||n0(b)||E0(b))throw b;return{cancellationReason:k,unsupported:P}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)L=new m2(J.lease_until,()=>($.now?.()??new Date).getTime(),(f)=>{if(!G.signal.aborted)N=f;G.abort(f),V.abort(f)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(f){if(!e4(J)||n0(f)||E0(f))throw f;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let f=S.cancellationReason??i4($.signal);G.abort(new v0(f,"Reason closed the Device operation.")),H={status:"cancelled",error_code:f}}else if(S.unsupported)G.abort(),H={status:"failed",error_code:"control_unsupported"};else{let f=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?UX:15000),P=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),E=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!E){if(await Z(k,V.signal),V.signal.aborted)return}let A=await h(void 0,E?P:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new v0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(E0(A))X(A);if(n0(A))N=A,x(A);if(!V.signal.aborted)N=A,G.abort();return}})();try{if(L?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(L?.remainingMs()??0)>0),H=await $.onClaim(J,G.signal,async(k)=>{if(e4(J))return;let P=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",E=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=E||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,D.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,b={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:E?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:b,settle:(j0)=>j0===void 0?o():N0(j0)})});let w=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(P)await C(b);return}if(F!==null){if(k.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),W1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await I([b],M,!0)(j0),F=null}catch(L1){throw F=L1??Error("Hands stop receipt could not be confirmed."),L1}finally{clearTimeout(W1),N0.abort()}return}if(E&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new m2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{G.abort(j0),V.abort(j0)})}let o=M;if(E)W=I([...w.map((N0)=>N0.wireEvent),b],o,!0),await W(A),W=void 0;else await I([...w.map((N0)=>N0.wireEvent),b],o,!1)(A)});n.then(()=>{for(let o of w)o.settle()},(o)=>{for(let N0 of w)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(E0(o))X(o);if(E){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),V.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(k){H=G.signal.aborted?{status:"cancelled",error_code:i4(G.signal)}:{status:"failed",error_code:e8(k)}}finally{Q.authorized=()=>!1,D.abort();for(let k of _.splice(0))k.settle();V.abort(),await f}let l=Z5(J.capability)?Q5(H.result,J.operation_id):null;if(N){if(E0(N))throw N;H={status:"failed",error_code:q??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&H.status==="succeeded")H={status:"cancelled",error_code:i4(G.signal),...l?{result:l}:{}}}if(L?.close(),E0($.signal.reason))throw $.signal.reason;await $3($,J,H)}finally{L?.close(),D.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??y$,Y=$.statusPath??Q3(),G=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...V5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),q=0,H,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),B5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??p8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await PX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,H=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(E0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=zX(q,$.reconnectRandom);H??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:H},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function PX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??y$,G=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let H=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(n8,U):n8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,X0=0;for(let{claim:S1}of z.values()){let V1=S1.capability==="hands.connect"?S1.payload[J5]:void 0;if(typeof V1==="string"){if(v.has(V1))continue;v.add(V1)}X0+=1}return X0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(G).getTime()+n4(K.initialDelayMs??TX,H):Number.POSITIVE_INFINITY,x=null,C=!1,I=$.firstHeartbeat,h=I?.account_root_metadata_supported===!0,S=I?.workspace_root_metadata_supported===!0,f=I?.account_root_path_supported===!0,l=I?.home_contained_roots_supported===!0,k=I?.root_paths_supported===!0,P=I?.startup_supported===!0,E=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,b,w=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...V5(J),...V?{lastUsedAt:V}:{},...x?{organizationId:x.organization_id,organizationName:x.organization_name,organizationSlug:x.organization_slug}:{}}),o=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!w)b??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...P&&!w&&b?{startup:b}:{},capabilities:v?G5($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:f,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},N0=()=>{if(C||!$.client.identity)return;C=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;x=v;let X0=Y(Q);if(!X0)return;X({...X0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,f=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,P=v.startup_supported===!0,E=!1},W1=(v)=>{if(v.startup)w=!0},L1=(v,X0)=>{if(!(X0 instanceof _0&&X0.status===400&&X0.code==="invalid_heartbeat")||!v.startup&&!E)throw X0;if(w=!0,E)h=S=f=!1,l=k=P=E=!1;return null},O$=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},x1=!1,t1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(x1)t1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((X0)=>L1(v,X0))).then((X0)=>{if(!X0)return;W1(v),j0(X0),O$(X0)},()=>{return})});let D1=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let B1=!1,E1=$.maxConsecutiveHeartbeatFailures??3,K1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,X0=o(),S1=A;A=void 0,x1=!0,t1=!1;try{let i=await V$($,"heartbeat",()=>$.client.heartbeat($.state,X0,N.signal,...S1?[S1]:[]).catch((K0)=>L1(X0,K0)));if(x1=!1,!i)continue;v=i,W1(X0),K1=0}catch(i){if(x1=!1,$.signal.aborted)break;if(!v2(i))throw i;if(K1+=1,K1>=E1&&!W())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(X0.capabilities).length)continue;if(t1)continue;if(O$(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let i=new AbortController,K0=()=>i.abort($.signal.reason);if($.signal.aborted)K0();else $.signal.addEventListener("abort",K0,{once:!0});let R0;try{R0=K.check(i.signal)}catch(C0){R0=Promise.reject(C0)}let H1=R0.then((C0)=>({kind:"completed",result:C0}),(C0)=>({kind:"failed",error:C0})),o1;try{while(!0){let C0=await OX(H1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(C0.kind==="failed")throw new r4(C0.error);if(C0.kind==="completed"){o1=C0.result;break}try{let S0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,S0,N.signal).catch((H2)=>L1(S0,H2)));if(!R$)continue;v=R$,W1(S0),O$(v),K1=0}catch(S0){if($.signal.aborted)throw S0;if(!v2(S0))throw S0;if(K1+=1,K1>=E1&&!W())throw S0}}}catch(C0){i.abort(C0);let S0=await H1;if(S0.kind==="completed"&&S0.result==="activated")o1="activated";else throw C0}finally{$.signal.removeEventListener("abort",K0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,o1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+n4(K.intervalMs??_X,H)}catch(i){if(!(i instanceof r4))throw i;T+=1;let K0=K.retryBaseMs??FX,R0=K.retryMaxMs??WX,H1=Math.min(R0,K0*2**Math.min(T-1,8));R=J().getTime()+n4(H1,H)}if($.signal.aborted)break;if(_&&L())break;if(_){await D1($.heartbeatIntervalMs??15000);continue}let V1=$.client.sessionCadence?.($.state)??null,w1=V1?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await D1(w1);continue}if(F()>=M){let i=new AbortController;O=i;try{await Z(w1,AbortSignal.any([$.signal,i.signal]))}catch(K0){if(!i.signal.aborted)throw K0}finally{if(O===i)O=null}continue}let g0,A$=V1?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),y=performance.now();try{g0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:A$,signal:N.signal}))}catch(i){if($.signal.aborted||!v2(i)||!W())throw i;await D1(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!g0){if(performance.now()-y<A$-VX)await D1(KX);continue}if($.claimable?.()===!1){await $3($,g0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:g0.operation_id,runId:g0.run_id,attemptId:g0.attempt_id,capability:g0.capability});let a,q0={authorized:()=>!1,claim:g0};if(a=IX({...$,signal:N.signal},g0,Z,q0,j).catch((i)=>{if(E0(i))j(i);else if(!n0(i)&&[...z].some(([K0,R0])=>K0!==a&&R0.authorized())){if(i instanceof s$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!n0(i)&&D===null)D=i}).finally(()=>{z.delete(a),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(a,q0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),N5(g0)){if(await a,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),B1=!0;let X0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:X0},Q),$.onEvent?.({type:"error",message:X0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!B1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as YY}from"child_process";import{constants as h5,existsSync as GY,mkdtempSync as i5,rmSync as BY}from"fs";import{access as m5,open as KY,readFile as v5,readlink as VY,readdir as g5,unlink as HY,rmdir as NY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as u1}from"crypto";import{chmodSync as xX,closeSync as EX,fsyncSync as SX,openSync as wX,readFileSync as bX,rmdirSync as U5,unlinkSync as T5,writeFileSync as kX}from"fs";import{createConnection as yX,createServer as fX}from"net";import{dirname as hX,join as mX}from"path";var vX=5000;async function _5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:u1()},X={runId:u1(),deviceId:u1(),rootId:u1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=M5(J,X),G={version:1,snapshot_id:u1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{T5(Y.path)}catch{}}}async function F5($,J,Z=q5){if(J.aborted)return!1;let Q,X,Y=new Set,G=u1(),V=fX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(G)});V.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),H=setTimeout(N,vX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${u1()}`}),X=mX(Q.journalDirectory,"readiness.json");let U=wX(X,"wx",384);try{kX(U,G),SX(U)}finally{EX(U)}if(bX(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{xX(Q.socketPath,384)}catch{T(!1);return}K=yX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(H),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>V.close(()=>U())),Q?.disposeSocket(),X)try{T5(X)}catch{}if(Q){try{U5(Q.journalDirectory)}catch{}try{U5(hX(Q.journalDirectory))}catch{}}}}import{spawn as gX}from"child_process";import{randomUUID as d1}from"crypto";import{basename as uX}from"path";import{fileURLToPath as dX}from"url";function lX(){let $=uX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",dX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function D5($,J,Z=lX()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=gX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>G.once("close",()=>{V=!0,F()}));G.on("error",X);let N,q,H=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
 `)){let O=T.indexOf(`
-`),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([H,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=d1(),L={organizationId:d1(),userId:d1(),runId:d1(),deviceId:d1(),rootId:d1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:d1(),port:F.port,expiresAtMs:O},R={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:W}}},x=W5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});j=await F5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:x,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),G.stdin.destroy(),!V)G.kill("SIGKILL");await K}return z&&V}import{execFileSync as d2}from"child_process";import{randomUUID as c0}from"crypto";import{chmodSync as D5,chownSync as b5,closeSync as V3,constants as q1,existsSync as lX,fstatSync as k5,mkdirSync as j5,mkdtempSync as pX,openSync as H3,readFileSync as cX,readSync as sX,realpathSync as aX,rmdirSync as iX,rmSync as nX}from"fs";import{join as l1}from"path";import{fileURLToPath as rX}from"url";var z5=1e4,tX=!1;function l2(){if(process.platform!=="linux")return!1;return tX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=d2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var oX=Buffer.from([0,255,3,4]);function O5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function eX($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function a$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=u2(),{directory:Q,root:X,runtimeDirectory:Y}=ZY(Z),G=new AbortController,V=()=>G.abort();$.addEventListener("abort",V,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,z5),q={organization_id:c0(),user_id:c0(),device_id:c0()},H=c0(),U=c0(),M=c0(),T=c0(),_=Date.now()+z5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=c0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,R=!1,x=!1,C,I,h,S=async(d)=>{while(!d()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((b)=>setTimeout(b,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},f=!1;try{K=$Y(Q,Z),C=Bun.serve({hostname:"127.0.0.1",port:0,fetch(P,E){let A=new URL(P.url).pathname,y=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(y&&E.upgrade(P,{data:{lane:y}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(P){if(P.data.lane==="pty")z=P},message(P,E){if(P.data.lane!=="pty")return;if(typeof E==="string"){try{if(JSON.parse(E).t==="open")W=!0}catch{V()}return}if(F.length+E.length>8192){V();return}F=Buffer.concat([F,E])}}});let d=`ws://127.0.0.1:${C.port}`;if(I=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:H,operationId:c0(),attemptId:c0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${d}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:A5,hands_worker_version:I5,hands_worker_artifact_sha256:x5,hands_worker_entrypoint:P5,target_generation:1,target_fence_id:M,environment_binding:D,[E5]:S5},emitEvent:async(P)=>{if(P==="hands.started")x=!0;if(P==="hands.ready")L=!0;if(P==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:w5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:rX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)V()}),await S(()=>L),R5({root:X,runId:H,payload:{version:1,snapshot_id:T,revision:1,run_id:H,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),h=C5({root:X,runId:H,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${c0()}`,sessionId:"pty-readiness",operationId:c0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${d}/device/pty/${j}`},emit:async(P,E)=>{if(P==="pty.ready")O=E}}).catch(()=>{V()}),await S(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${O5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${O5("foreground")}; ${K.wait("foreground")}'
-`)),await S(()=>lX(l1(X,"foreground.pid"))&&F.includes(oX)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let b=["background.pid","foreground.pid"].map((P)=>JY(l1(X,P)));if(new Set(b).size!==2||b.some((P)=>!Number.isSafeInteger(P)||P<2||P===O.job.process.pid))return!1;if(process.platform==="linux"){if(!b.every((P)=>eX(cX(`/proc/${P}/stat`,"utf8"),P,O.job.process.pid)))return!1}else{let E=d2("/bin/ps",["-o","pid=,pgid=","-p",b.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((A)=>A.trim().split(/\s+/).map(Number));if(E.length!==2||new Set(E.map(([A])=>A)).size!==2||E.some((A)=>A.length!==2||!b.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await h,G.signal.aborted)return!1;for(let P of[O.job.process.pid,...b])try{return process.kill(P,0),!1}catch(E){if(!(E instanceof Error&&("code"in E)&&E.code==="ESRCH"))return!1}f=!0}catch{f=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await I,await C?.stop(!0),!x||R)QY({directory:Q,root:X},Z)}return f&&R&&!$.aborted}function $Y($,J){let Z={foreground:l1($,"foreground.lifeline"),background:l1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");d2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let G=H3(Y,q1.O_RDONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW);try{if(Q.push(H3(Y,q1.O_WRONLY|q1.O_NONBLOCK|q1.O_NOFOLLOW)),!k5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(G)}if(J)b5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function y5($=(J)=>a$(J)){let J=new AbortController,Z=JSON.stringify(u2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(u2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function JY($){let J;try{J=H3($,q1.O_RDONLY|q1.O_NOFOLLOW|q1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=k5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=sX(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function ZY($,J=aX("/tmp")){let Z=pX(l1(J,"reason-pty-probe-")),Q=l1(Z,"workspace"),X=l1(Z,"private");if(j5(Q,{mode:448}),j5(X,{mode:448}),$)D5(Z,493),D5(Q,493),b5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function QY($,J){if(J)try{d2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),iX($.root)}catch{return}nX($.directory,{recursive:!0,force:!0})}var i5=5000,p1="ARA_WORKER_PROBE_READY";function NY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{XY($,J,{cwd:Z,env:Q,signal:X,timeout:i5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,V)=>Y(!G&&!X.aborted&&V===p1))})}function UY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function qY($,J){let Z=u5({home:J,temporaryDirectory:J}),Q=(Y,G,V)=>NY(Y,G,$.workspaceRoot,Z,V),X=async(Y,G,V,K=(q)=>q===p1,N=!1)=>{let q=await o5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:i5,signal:V});return!V.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await h5($.workspaceRoot,f5.R_OK),await v5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await h5($.workspaceRoot,f5.W_OK),Y.aborted)return!1;let G=a5(M3($.workspaceRoot,".ara-worker-probe-")),V=M3(G,"receipt");try{let K=await BY(V,"wx",384);try{await K.writeFile(p1),await K.sync()}finally{await K.close()}return await m5(V,"utf8")===p1&&!Y.aborted}finally{await VY(V).catch(()=>{}),await HY(G).catch(()=>{})}},confinedShell:(Y)=>X(t5(),["-c",`printf ${p1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
-`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,V,K]=await Promise.all([KY("/proc/self/cwd"),v5("/proc/self/fd"),m5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${p1}`],Y),jobs:(Y)=>_5($,Y),environment:(Y)=>T5($,J,Y),preview:(Y)=>L5(J,Y),boundPty:(Y)=>a$(Y),desktopDisplay:()=>r5(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
-`);return s5()},desktopBrowser:async()=>n$()?.features.browser===!0,fullControlShell:(Y)=>{let G=p5(),V=UY(G,`printf ${p1}`);return V?Q(G,V,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&n$()?.features.computer===!0?c5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function MY($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return i$($,J,Z,Q,X).final}function i$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,G){let V,K;try{if(N1($),u0(),!J)e(g($),!0),V=a5(M3(g($),"probe-")),J=qY($,V);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",H=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(G).then(()=>Promise.all(q?[N("preview"),H,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,R,x,C,I]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!R||!x||!C)&&!G)await U;if(q){if(!R)R=await N("bash");if(!x)x=await N("jobs");if(!C)C=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:R,jobs:x,environment:C,full:I}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:R,processes:x,bash:C,jobs:I,environment:h,full:S}=z,{preview:f,boundPty:d,desktopDisplay:b,desktopAutomation:P,desktopBrowser:E}=F,A=d5(),y=q&&process.platform==="darwin"&&S&&YY("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&R&&X,"process.list":(process.platform==="linux"||L)&&x,"ports.list":(process.platform==="linux"||L)&&x,"exec.full":C&&S&&X,"hands.connect":O&&W&&C&&I,"jobs.control":O&&W&&C&&I,"pty.start":O&&W&&C&&I&&h&&d,"environment.install":O&&W&&C&&I&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&C&&I&&h,"tunnel.open":O&&W&&C&&I&&h&&f,"tunnel.close":O&&W&&C&&I&&h&&f,"preview.serve.v1":O&&C&&I&&f&&S,"display.stream.v1":b,"automation.call.v1":P,"simulator.call.v1":y,"simulator.stream.v1":y,"browser.pr-proof.v1":P&&E&&g5()===null,"workspace.setup.v1":q&&l5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([H,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,R]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:R})}finally{if(V)GY(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await H||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var TY=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],_Y=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return TY.filter((Z)=>J[Z]!==!0)}function n5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>MY($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
-`),(async()=>{for(let Y of $.delaysMs??_Y){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=q3($.config,Q).filter((K)=>G[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
-`),$.onReady(Q,V);if(q3($.config,Q).length===0)return}})()}import{execFile as qG}from"child_process";import{createHash as MG,randomUUID as b3}from"crypto";import{lstat as TG,readdir as y6,readFile as d6,realpath as _G,stat as FG}from"fs/promises";import{basename as WG,join as S3}from"path";import{promisify as LG}from"util";import{createConnection as FY}from"net";import{endianness as J6}from"os";var r$=4,W3=1e4;class R1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=FY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=WY({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(G),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=r$){let J=J6()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=r$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(r$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!e0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),e0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class p2{client;cdp;constructor($){this.client="client"in $?$.client:new R1($),this.cdp=new X6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=LY(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new Z6(this,$)}getTabs(){return this.client.getTabs()}}class Z6{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new Q6(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class Q6{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class X6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(e0(Q)&&e0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return e0(Q)&&e0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";e5(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(e0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if($6(K,Q))return;throw V}),G}async waitForLoadState($,J={}){let Z=J.state??"load";e5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if($6(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return e0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let G=!1,V=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(H){if(N())Y(H instanceof Error?H:Error(String(H)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=DY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function WY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(r$+J.length);if(J6()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,r$),Z}function e0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function LY($,J){if(!e0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function e5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function $6($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function DY($,J){if($.method!=="onCDPEvent"||!e0($.params))return null;let Z=$.params.source;if(!e0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as jY}from"crypto";function Y6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${jY("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as HG}from"async_hooks";import{isDeepStrictEqual as b6}from"util";import{createHash as NG}from"crypto";var zY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var OY=new Set(["png","jpg","jpeg","gif","webp"]),AY=new Set(["webm","mp4"]);function RY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function G6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=RY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=zY.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!V||!K||!N)return null;let q=OY.has(N)?"image":AY.has(N)?"video":null;if(!q)return null;let H=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:G,artifactId:V,fileName:`${K}.${N}`,kind:q,phase:H?.[1]==="before"||H?.[1]==="after"?H[1]:null}}var CY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,c2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),c1=()=>{throw Error("cloud_browser_media_request_invalid")};function s2($){if(!c2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!CY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return c1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return c1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!B6(J.origin,{mode:"public_web"}).allowed)return c1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!c2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return c1();let G=G6(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return c1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return c1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return c1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function K6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!c2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!c2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=B.string().uuid(),H$=B.string().regex(/^[a-f0-9]{64}$/),a1=B.iso.datetime({precision:3}),D3=B.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),H6=B.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),s0=B.object({kind:B.literal("primary_mac"),version:B.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:B.string().min(1).max(64),binding:B.enum(["workspace_source","mcp_control"]),targetRevision:B.number().int().nonnegative(),generation:L0,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),IY=B.custom().transform(($,J)=>{try{return V6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),B.NEVER}}),N$=B.object({version:B.literal(1),owner:s0,contextId:L0,preparedAt:a1,expiresAt:a1,prUrl:H6,headSha:B.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:B.enum(["image","video"]),visualPlan:IY.optional(),uploadOrigin:B.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=B.object({version:B.literal(1),producer:B.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:B.number().int().positive(),startedAt:a1,finishedAt:a1,sha256:H$,media:B.discriminatedUnion("contentType",[B.object({contentType:B.literal("image/png"),sizeBytes:B.number().int().min(24).max(8388608),width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096)}).strict(),B.object({contentType:B.literal("video/webm"),sizeBytes:B.number().int().min(128).max(10485760),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),VM=B.discriminatedUnion("action",[B.object({action:B.literal("screenshot"),context_id:L0,tab_id:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),context_id:L0,tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("stop_video"),recording_operation_id:L0}).strict()]),i2=B.object({login:B.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:B.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),a2=B.string().regex(/^[1-9][0-9]{0,19}$/),t$=B.object({version:B.literal(1),owner:s0,expectedActorId:a2.nullable(),repositoryId:a2,repositoryFullName:B.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),PY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=B.discriminatedUnion("status",[t$.extend({status:B.literal("ready"),observedActor:i2,checkedAt:a1}),t$.extend({status:B.literal("not_ready"),reason:B.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:B.enum(PY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),s1=B.object({version:B.literal(1),owner:s0,expectedActorId:a2.nullable(),authenticatedActor:i2,attemptId:L0,captureId:L0,prUrl:H6,repositoryId:a2,headSha:B.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:B.number().int().min(128).max(10485760),contentType:B.literal("video/webm")}).strict(),N6=B.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=B.discriminatedUnion("status",[s1.extend({status:B.literal("not_attempted"),reason:B.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),s1.extend({status:B.literal("uncertain"),reason:B.literal("upload_outcome_unknown")}),s1.extend({status:B.literal("uploaded"),observedActor:i2,nativeUrl:N6,uploadedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),o$=s1.extend({nativeUrl:N6,observedActor:i2,bodySha256:H$}),A3=B.discriminatedUnion("status",[o$.extend({status:B.literal("incomplete"),reason:B.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),o$.extend({status:B.literal("verified"),sourceSha256:H$,width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096),durationSeconds:B.number().positive().max(30),advancedSeconds:B.number().min(0.05).max(10),advancedFrames:B.number().int().positive(),playbackRestored:B.literal(!0),verifiedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),xY=B.custom().transform(($,J)=>{try{let Z=s2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),B.NEVER}}),EY=B.discriminatedUnion("action",[B.object({action:B.literal("auth_check"),input:t$}).strict(),B.object({action:B.literal("prepare"),context:N$}).strict(),B.object({action:B.literal("capture_png"),owner:s0,contextId:L0,tabId:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),owner:s0,contextId:L0,tabId:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("inspect_capture"),owner:s0,captureId:L0}).strict(),B.object({action:B.literal("publish_video"),input:s1}).strict(),B.object({action:B.literal("verify_png_media"),owner:s0,media:xY}).strict().refine(($)=>$.media.runId===$.owner.runId),B.object({action:B.literal("verify_saved_media"),input:o$}).strict(),B.object({action:B.literal("publish_png"),owner:s0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:B.number().int().min(24).max(8388608),storagePath:B.string().max(512),uploadUrl:B.string().url().max(8192)}).strict()]);var U6="pr-proof.stop.v1",R3=B.object({requestId:L0,command:EY}).strict();import{createHash as SY,randomUUID as wY}from"crypto";import{isDeepStrictEqual as q$}from"util";var q6=B.object({operationId:B.string().uuid(),attemptId:B.string().uuid(),contextId:B.string().uuid(),tabId:B.number().int().positive()}).strict(),K0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>SY("sha256").update($).digest("hex");function M6($){let J=s0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw K0();if(await $.assertCurrent(),X)throw K0()},G=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw K0();return M},V=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,K0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>V(D)))).some((D)=>D.status==="rejected"))throw K0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function H(U,M){let T=q6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw K0();await Y(),U.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw K0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw K0();let x=await D.completion;if(await Y(),G(T.contextId),D.controller.signal.aborted)throw K0();return structuredClone(x)}if(Q.size>=16||[...Q.values()].some((x)=>!x.receipt&&!x.controller.signal.aborted&&x.claim.tabId===T.tabId))throw K0();let j,z,F=new Promise((x,C)=>{j=x,z=C});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{V(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),G(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},R;try{await L();let x;if(M==="image"){let C=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let I=new Date().toISOString();if(await L(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw K0();x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:wY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C,finishedAt:I,sha256:C3(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),K0();await O.host.start(),O.started=!0;let C=O.host.completed();if(C.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let I=await C;if(O.stop)await O.stop;await L();let h=await O.host.read(I.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(I,h.capture)||!q$(I.owner,S)||R.length!==I.sizeBytes||C3(R)!==I.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw K0();await O.host.close(),await L(),x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((C,I)=>C+(I.bytes?.length??0),R.length)>20971520)throw K0();return O.bytes=Buffer.from(R),O.receipt=x,j(x),structuredClone(x)}catch(x){let C=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&x instanceof Error&&x.message==="mac_recording_worker_failed:no_frames"?new v0("proof_capture_no_frames","The owned tab emitted no recording frames."):K0();throw await V(O).catch(()=>{}),z(C),C}finally{R?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw K0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw K0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw K0();return structuredClone(T)}if(Z.size>=4)throw K0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>H(U,"image"),record:(U)=>H(U,"video"),async stop(U){let M=q6.parse(U);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw K0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw K0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw K0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw K0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw K0()}}}import{createHash as W6,randomUUID as uY}from"crypto";import{isDeepStrictEqual as e$}from"util";import{realpath as dY}from"fs/promises";var T6=String.raw`async (media) => {
+`),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([H,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=d1(),L={organizationId:d1(),userId:d1(),runId:d1(),deviceId:d1(),rootId:d1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:d1(),port:F.port,expiresAtMs:O},R={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:W}}},x=L5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});j=await W5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:x,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),G.stdin.destroy(),!V)G.kill("SIGKILL");await K}return z&&V}import{execFileSync as d2}from"child_process";import{randomUUID as p0}from"crypto";import{chmodSync as j5,chownSync as k5,closeSync as V3,constants as M1,existsSync as pX,fstatSync as y5,mkdirSync as z5,mkdtempSync as cX,openSync as H3,readFileSync as sX,readSync as aX,realpathSync as iX,rmdirSync as nX,rmSync as rX}from"fs";import{join as l1}from"path";import{fileURLToPath as tX}from"url";var O5=1e4,oX=!1;function l2(){if(process.platform!=="linux")return!1;return oX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=d2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var eX=Buffer.from([0,255,3,4]);function A5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function $Y($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function a$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=u2(),{directory:Q,root:X,runtimeDirectory:Y}=QY(Z),G=new AbortController,V=()=>G.abort();$.addEventListener("abort",V,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,O5),q={organization_id:p0(),user_id:p0(),device_id:p0()},H=p0(),U=p0(),M=p0(),T=p0(),_=Date.now()+O5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=p0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,R=!1,x=!1,C,I,h,S=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},f=!1;try{K=JY(Q,Z),C=Bun.serve({hostname:"127.0.0.1",port:0,fetch(P,E){let A=new URL(P.url).pathname,b=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(b&&E.upgrade(P,{data:{lane:b}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(P){if(P.data.lane==="pty")z=P},message(P,E){if(P.data.lane!=="pty")return;if(typeof E==="string"){try{if(JSON.parse(E).t==="open")W=!0}catch{V()}return}if(F.length+E.length>8192){V();return}F=Buffer.concat([F,E])}}});let l=`ws://127.0.0.1:${C.port}`;if(I=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:H,operationId:p0(),attemptId:p0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:R5,hands_worker_version:P5,hands_worker_artifact_sha256:E5,hands_worker_entrypoint:x5,target_generation:1,target_fence_id:M,environment_binding:D,[S5]:w5},emitEvent:async(P)=>{if(P==="hands.started")x=!0;if(P==="hands.ready")L=!0;if(P==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:b5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:tX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)V()}),await S(()=>L),C5({root:X,runId:H,payload:{version:1,snapshot_id:T,revision:1,run_id:H,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),h=I5({root:X,runId:H,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${p0()}`,sessionId:"pty-readiness",operationId:p0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${j}`},emit:async(P,E)=>{if(P==="pty.ready")O=E}}).catch(()=>{V()}),await S(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${A5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${A5("foreground")}; ${K.wait("foreground")}'
+`)),await S(()=>pX(l1(X,"foreground.pid"))&&F.includes(eX)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((P)=>ZY(l1(X,P)));if(new Set(k).size!==2||k.some((P)=>!Number.isSafeInteger(P)||P<2||P===O.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((P)=>$Y(sX(`/proc/${P}/stat`,"utf8"),P,O.job.process.pid)))return!1}else{let E=d2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((A)=>A.trim().split(/\s+/).map(Number));if(E.length!==2||new Set(E.map(([A])=>A)).size!==2||E.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await h,G.signal.aborted)return!1;for(let P of[O.job.process.pid,...k])try{return process.kill(P,0),!1}catch(E){if(!(E instanceof Error&&("code"in E)&&E.code==="ESRCH"))return!1}f=!0}catch{f=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await I,await C?.stop(!0),!x||R)XY({directory:Q,root:X},Z)}return f&&R&&!$.aborted}function JY($,J){let Z={foreground:l1($,"foreground.lifeline"),background:l1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");d2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let G=H3(Y,M1.O_RDONLY|M1.O_NONBLOCK|M1.O_NOFOLLOW);try{if(Q.push(H3(Y,M1.O_WRONLY|M1.O_NONBLOCK|M1.O_NOFOLLOW)),!y5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(G)}if(J)k5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function f5($=(J)=>a$(J)){let J=new AbortController,Z=JSON.stringify(u2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(u2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function ZY($){let J;try{J=H3($,M1.O_RDONLY|M1.O_NOFOLLOW|M1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=y5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=aX(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function QY($,J=iX("/tmp")){let Z=cX(l1(J,"reason-pty-probe-")),Q=l1(Z,"workspace"),X=l1(Z,"private");if(z5(Q,{mode:448}),z5(X,{mode:448}),$)j5(Z,493),j5(Q,493),k5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function XY($,J){if(J)try{d2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),nX($.root)}catch{return}rX($.directory,{recursive:!0,force:!0})}var n5=5000,p1="ARA_WORKER_PROBE_READY";function UY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{YY($,J,{cwd:Z,env:Q,signal:X,timeout:n5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,V)=>Y(!G&&!X.aborted&&V===p1))})}function qY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function MY($,J){let Z=d5({home:J,temporaryDirectory:J}),Q=(Y,G,V)=>UY(Y,G,$.workspaceRoot,Z,V),X=async(Y,G,V,K=(q)=>q===p1,N=!1)=>{let q=await e5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:n5,signal:V});return!V.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await m5($.workspaceRoot,h5.R_OK),await g5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await m5($.workspaceRoot,h5.W_OK),Y.aborted)return!1;let G=i5(M3($.workspaceRoot,".ara-worker-probe-")),V=M3(G,"receipt");try{let K=await KY(V,"wx",384);try{await K.writeFile(p1),await K.sync()}finally{await K.close()}return await v5(V,"utf8")===p1&&!Y.aborted}finally{await HY(V).catch(()=>{}),await NY(G).catch(()=>{})}},confinedShell:(Y)=>X(o5(),["-c",`printf ${p1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
+`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,V,K]=await Promise.all([VY("/proc/self/cwd"),g5("/proc/self/fd"),v5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${p1}`],Y),jobs:(Y)=>F5($,Y),environment:(Y)=>_5($,J,Y),preview:(Y)=>D5(J,Y),boundPty:(Y)=>a$(Y),desktopDisplay:()=>t5(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
+`);return a5()},desktopBrowser:async()=>n$()?.features.browser===!0,fullControlShell:(Y)=>{let G=c5(),V=qY(G,`printf ${p1}`);return V?Q(G,V,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&n$()?.features.computer===!0?s5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function TY($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return i$($,J,Z,Q,X).final}function i$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,G){let V,K;try{if(U1($),u0(),!J)e(g($),!0),V=i5(M3(g($),"probe-")),J=MY($,V);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",H=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(G).then(()=>Promise.all(q?[N("preview"),H,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,R,x,C,I]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!R||!x||!C)&&!G)await U;if(q){if(!R)R=await N("bash");if(!x)x=await N("jobs");if(!C)C=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:R,jobs:x,environment:C,full:I}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:R,processes:x,bash:C,jobs:I,environment:h,full:S}=z,{preview:f,boundPty:l,desktopDisplay:k,desktopAutomation:P,desktopBrowser:E}=F,A=l5(),b=q&&process.platform==="darwin"&&S&&GY("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&R&&X,"process.list":(process.platform==="linux"||L)&&x,"ports.list":(process.platform==="linux"||L)&&x,"exec.full":C&&S&&X,"hands.connect":O&&W&&C&&I,"jobs.control":O&&W&&C&&I,"pty.start":O&&W&&C&&I&&h&&l,"environment.install":O&&W&&C&&I&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&C&&I&&h,"tunnel.open":O&&W&&C&&I&&h&&f,"tunnel.close":O&&W&&C&&I&&h&&f,"preview.serve.v1":O&&C&&I&&f&&S,"display.stream.v1":k,"automation.call.v1":P,"simulator.call.v1":b,"simulator.stream.v1":b,"browser.pr-proof.v1":P&&E&&u5()===null,"workspace.setup.v1":q&&p5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([H,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,R]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:R})}finally{if(V)BY(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await H||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var _Y=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],FY=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return _Y.filter((Z)=>J[Z]!==!0)}function r5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>TY($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
+`),(async()=>{for(let Y of $.delaysMs??FY){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=q3($.config,Q).filter((K)=>G[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
+`),$.onReady(Q,V);if(q3($.config,Q).length===0)return}})()}import{execFile as MG}from"child_process";import{createHash as TG,randomUUID as b3}from"crypto";import{lstat as _G,readdir as f6,readFile as l6,realpath as FG,stat as WG}from"fs/promises";import{basename as LG,join as S3}from"path";import{promisify as DG}from"util";import{createConnection as WY}from"net";import{endianness as Z6}from"os";var r$=4,W3=1e4;class C1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=WY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=LY({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(G),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=r$){let J=Z6()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=r$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(r$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!r0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),r0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class p2{client;cdp;constructor($){this.client="client"in $?$.client:new C1($),this.cdp=new Y6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=DY(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new Q6(this,$)}getTabs(){return this.client.getTabs()}}class Q6{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new X6(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class X6{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class Y6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(r0(Q)&&r0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return r0(Q)&&r0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";$6(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(r0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if(J6(K,Q))return;throw V}),G}async waitForLoadState($,J={}){let Z=J.state??"load";$6(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(J6(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return r0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let G=!1,V=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(H){if(N())Y(H instanceof Error?H:Error(String(H)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=jY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function LY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(r$+J.length);if(Z6()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,r$),Z}function r0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function DY($,J){if(!r0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function $6($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function J6($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function jY($,J){if($.method!=="onCDPEvent"||!r0($.params))return null;let Z=$.params.source;if(!r0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as zY}from"crypto";function G6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${zY("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as NG}from"async_hooks";import{isDeepStrictEqual as k6}from"util";import{createHash as UG}from"crypto";var OY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var AY=new Set(["png","jpg","jpeg","gif","webp"]),RY=new Set(["webm","mp4"]);function CY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function B6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=CY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=OY.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!V||!K||!N)return null;let q=AY.has(N)?"image":RY.has(N)?"video":null;if(!q)return null;let H=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:G,artifactId:V,fileName:`${K}.${N}`,kind:q,phase:H?.[1]==="before"||H?.[1]==="after"?H[1]:null}}var IY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,c2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),c1=()=>{throw Error("cloud_browser_media_request_invalid")};function s2($){if(!c2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!IY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return c1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return c1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!K6(J.origin,{mode:"public_web"}).allowed)return c1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!c2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return c1();let G=B6(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return c1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return c1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return c1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function V6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!c2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!c2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=B.string().uuid(),H$=B.string().regex(/^[a-f0-9]{64}$/),a1=B.iso.datetime({precision:3}),D3=B.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),N6=B.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),c0=B.object({kind:B.literal("primary_mac"),version:B.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:B.string().min(1).max(64),binding:B.enum(["workspace_source","mcp_control"]),targetRevision:B.number().int().nonnegative(),generation:L0,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),PY=B.custom().transform(($,J)=>{try{return H6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),B.NEVER}}),N$=B.object({version:B.literal(1),owner:c0,contextId:L0,preparedAt:a1,expiresAt:a1,prUrl:N6,headSha:B.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:B.enum(["image","video"]),visualPlan:PY.optional(),uploadOrigin:B.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=B.object({version:B.literal(1),producer:B.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:B.number().int().positive(),startedAt:a1,finishedAt:a1,sha256:H$,media:B.discriminatedUnion("contentType",[B.object({contentType:B.literal("image/png"),sizeBytes:B.number().int().min(24).max(8388608),width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096)}).strict(),B.object({contentType:B.literal("video/webm"),sizeBytes:B.number().int().min(128).max(10485760),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),HM=B.discriminatedUnion("action",[B.object({action:B.literal("screenshot"),context_id:L0,tab_id:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),context_id:L0,tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("stop_video"),recording_operation_id:L0}).strict()]),i2=B.object({login:B.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:B.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),a2=B.string().regex(/^[1-9][0-9]{0,19}$/),t$=B.object({version:B.literal(1),owner:c0,expectedActorId:a2.nullable(),repositoryId:a2,repositoryFullName:B.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),xY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=B.discriminatedUnion("status",[t$.extend({status:B.literal("ready"),observedActor:i2,checkedAt:a1}),t$.extend({status:B.literal("not_ready"),reason:B.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:B.enum(xY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),s1=B.object({version:B.literal(1),owner:c0,expectedActorId:a2.nullable(),authenticatedActor:i2,attemptId:L0,captureId:L0,prUrl:N6,repositoryId:a2,headSha:B.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:B.number().int().min(128).max(10485760),contentType:B.literal("video/webm")}).strict(),U6=B.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=B.discriminatedUnion("status",[s1.extend({status:B.literal("not_attempted"),reason:B.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),s1.extend({status:B.literal("uncertain"),reason:B.literal("upload_outcome_unknown")}),s1.extend({status:B.literal("uploaded"),observedActor:i2,nativeUrl:U6,uploadedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),o$=s1.extend({nativeUrl:U6,observedActor:i2,bodySha256:H$}),A3=B.discriminatedUnion("status",[o$.extend({status:B.literal("incomplete"),reason:B.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),o$.extend({status:B.literal("verified"),sourceSha256:H$,width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096),durationSeconds:B.number().positive().max(30),advancedSeconds:B.number().min(0.05).max(10),advancedFrames:B.number().int().positive(),playbackRestored:B.literal(!0),verifiedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),EY=B.custom().transform(($,J)=>{try{let Z=s2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),B.NEVER}}),SY=B.discriminatedUnion("action",[B.object({action:B.literal("auth_check"),input:t$}).strict(),B.object({action:B.literal("prepare"),context:N$}).strict(),B.object({action:B.literal("capture_png"),owner:c0,contextId:L0,tabId:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),owner:c0,contextId:L0,tabId:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("inspect_capture"),owner:c0,captureId:L0}).strict(),B.object({action:B.literal("publish_video"),input:s1}).strict(),B.object({action:B.literal("verify_png_media"),owner:c0,media:EY}).strict().refine(($)=>$.media.runId===$.owner.runId),B.object({action:B.literal("verify_saved_media"),input:o$}).strict(),B.object({action:B.literal("publish_png"),owner:c0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:B.number().int().min(24).max(8388608),storagePath:B.string().max(512),uploadUrl:B.string().url().max(8192)}).strict()]);var q6="pr-proof.stop.v1",R3=B.object({requestId:L0,command:SY}).strict();import{createHash as wY,randomUUID as bY}from"crypto";import{isDeepStrictEqual as q$}from"util";var M6=B.object({operationId:B.string().uuid(),attemptId:B.string().uuid(),contextId:B.string().uuid(),tabId:B.number().int().positive()}).strict(),B0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>wY("sha256").update($).digest("hex");function T6($){let J=c0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw B0();if(await $.assertCurrent(),X)throw B0()},G=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw B0();return M},V=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,B0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>V(D)))).some((D)=>D.status==="rejected"))throw B0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function H(U,M){let T=M6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw B0();await Y(),U.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw B0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw B0();let x=await D.completion;if(await Y(),G(T.contextId),D.controller.signal.aborted)throw B0();return structuredClone(x)}if(Q.size>=16||[...Q.values()].some((x)=>!x.receipt&&!x.controller.signal.aborted&&x.claim.tabId===T.tabId))throw B0();let j,z,F=new Promise((x,C)=>{j=x,z=C});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{V(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),G(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},R;try{await L();let x;if(M==="image"){let C=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let I=new Date().toISOString();if(await L(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw B0();x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:bY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C,finishedAt:I,sha256:C3(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),B0();await O.host.start(),O.started=!0;let C=O.host.completed();if(C.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let I=await C;if(O.stop)await O.stop;await L();let h=await O.host.read(I.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(I,h.capture)||!q$(I.owner,S)||R.length!==I.sizeBytes||C3(R)!==I.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw B0();await O.host.close(),await L(),x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((C,I)=>C+(I.bytes?.length??0),R.length)>20971520)throw B0();return O.bytes=Buffer.from(R),O.receipt=x,j(x),structuredClone(x)}catch(x){let C=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&x instanceof Error&&x.message==="mac_recording_worker_failed:no_frames"?new v0("proof_capture_no_frames","The owned tab emitted no recording frames."):B0();throw await V(O).catch(()=>{}),z(C),C}finally{R?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw B0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw B0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw B0();return structuredClone(T)}if(Z.size>=4)throw B0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>H(U,"image"),record:(U)=>H(U,"video"),async stop(U){let M=M6.parse(U);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw B0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw B0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw B0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw B0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw B0()}}}import{createHash as L6,randomUUID as dY}from"crypto";import{isDeepStrictEqual as e$}from"util";import{realpath as lY}from"fs/promises";var _6=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -73,24 +73,24 @@ ${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,
     }
   }));
   return { verified: true, items };
-}`;var _6=function($){let J=this??globalThis,Z=10485760,Q=(G,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,H={login:K,id:q};if(G.expectedActorId!==null&&q!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||q!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||q!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:H}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,V=Q(G,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let H=J.document.querySelector("#fc-new_comment_field");if(!H)return{dispatched:!1,reason:"attachment_unavailable"};return H.files=q.files,H.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),V=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(V));if(q.length!==1)throw Error("saved_player_missing");let H=q[0],U={muted:H.muted,volume:H.volume,rate:H.playbackRate,preload:H.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(H.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(H.muted=!0,H.playbackRate=1,H.currentTime=0,H.readyState<2)H.preload="auto",H.load();await D(()=>H.readyState>=2&&H.videoWidth>0&&H.videoHeight>0);let j=H.currentSrc;if(!V(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!V(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let f=await _(O.read());if(f.done)break;if(L+=f.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(f.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(L),x=0;for(let f of W)R.set(f,x),x+=f.length;let C=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((f)=>f.toString(16).padStart(2,"0")).join("");if(C!==X.sha256||H.currentSrc!==j||!N.contains(H))throw Error("source_changed");let I=H.currentTime,h=H.getVideoPlaybackQuality().totalVideoFrames;if(await _(H.play()),await D(()=>H.currentTime-I>=0.05&&H.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||H.currentSrc!==j||!N.contains(H)||H.error)throw Error("player_changed");return{status:"verified",sourceSha256:C,width:H.videoWidth,height:H.videoHeight,durationSeconds:H.duration,advancedSeconds:H.currentTime-I,advancedFrames:H.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),H.pause(),H.currentTime=0,H.muted=U.muted,H.volume=U.volume,H.playbackRate=U.rate,H.preload=U.preload,!H.paused||H.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as bY}from"child_process";import{lstat as kY,realpath as yY}from"fs/promises";import{join as F6,resolve as fY}from"path";import{promisify as hY}from"util";var mY=hY(bY);async function vY($,J){let Z=await yY($),{stdout:Q}=await mY(F6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return B.array(B.object({browser:B.string(),directory:B.string(),connected:B.boolean().optional(),source:B.string(),socketPath:B.string().optional(),instanceId:B.string().optional(),extensionId:B.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&fY(Y.source)===F6(Z,"Reason Browser Use","manifest.json"))}async function n2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await vY($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await kY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as gY}from"crypto";function M$($){return`reason-browser-${gY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var L6=B.discriminatedUnion("ok",[B.object({ok:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({ok:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),D6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function I3($){let J=s0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await lY($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${uY()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(q)=>{if(!e$(J,q.owner))throw Z0();await G()},K=async(q)=>{await V(q);let H=await $.readVideo(q.captureId);try{await G();let U=H.capture;if(!e$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||H.bytes.length!==q.sizeBytes||H.bytes.length<128||H.bytes.length>10485760||H.bytes.readUInt32BE(0)!==440786851||W6("sha256").update(H.bytes).digest("hex")!==q.sha256)throw Z0();return H}catch(U){throw H.bytes.fill(0),U}};async function N(q,H,U){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new p2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await G(),D)throw Z0()};try{await F(T.connect());let W=D6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((C)=>{if(D)C.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let x=await F(H(_,async(C)=>{await O();let I=await F(_.evaluate(`(${_6.toString()})(${JSON.stringify(C)})`,{awaitPromise:!0}));return await O(),I},O));return await O(),x}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,R)=>{W=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(q,H,U){let M=N$.parse(q);if(await V(M),!Number.isSafeInteger(H)||H<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new p2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=D6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!B.array(B.object({id:B.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===H))throw Z0();await G(),U.throwIfAborted();let F=B.object({data:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(H,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await G(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let H=s2(q);if(H.runId!==J.runId||H.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(H.media.map((C)=>C.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,R=(C,I)=>{if(L.size>=32){F=!0;return}let h=_.executeCdp(U.id,C,I);L.add(h),h.catch(()=>{F=!0}).finally(()=>L.delete(h))},x=_.onNotification((C)=>{if(C.method!=="onCDPEvent"||!t0(C.params)||!t0(C.params.source)||C.params.source.tabId!==U.id||!t0(C.params.params))return;let I=C.params.params;if(++O>512){F=!0;return}if(C.params.method==="Fetch.requestPaused"){let f=typeof I.requestId==="string"&&t0(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&D.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!f)F=!0;R(f?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...f?{}:{errorReason:"BlockedByClient"}})}if(C.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(C.params.method==="Network.loadingFailed")F=!0;if(C.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")z.add(I.requestId);if(C.params.method!=="Network.responseReceived")return;if(!t0(I.response)||typeof I.response.url!=="string"||!D.has(I.response.url)||typeof I.requestId!=="string"||!t0(I.response.headers)||I.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(I.response.headers).map(([f,d])=>[f.toLowerCase(),d])),S=Number(h["content-length"]);if(j.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}j.set(I.response.url,{id:I.requestId,length:S})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let C=B.object({frameTree:B.object({frame:B.object({id:B.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),I=[...new Set(H.media.map((f)=>new URL(f.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:C.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new v0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await U.evaluate(`(${T6})(${JSON.stringify(H.media)})`,{awaitPromise:!0})}catch{throw new v0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!t0(h)||!Array.isArray(h.items)||h.items.length!==H.media.length)throw Z0();await Promise.all(L);let S=[];for(let f=0;f<H.media.length;f++){await G();let d=j.get(H.media[f].sourceUrl);if(F||!d||!z.has(d.id))throw Z0();let b=B.object({base64Encoded:B.literal(!0),body:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:d.id})),P=Buffer.from(b.body,"base64");try{let E=h.items[f];if(P.length!==d.length||P.toString("base64")!==b.body||!t0(E))throw Z0();S.push({...E,sourceSha256:W6("sha256").update(P).digest("hex")})}finally{P.fill(0)}}if(F)throw Z0();return K6({verified:!0,items:S},H)}finally{if(x(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new v0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let H=t$.parse(q);await V(H);let U="browser_unavailable";try{return await N(`https://github.com/${H.repositoryFullName}`,async(M,T)=>{let _=L6.parse(await T({operation:"preflight",expected:{...H,prUrl:`https://github.com/${H.repositoryFullName}`}}));return O3.parse(_.ok?{...H,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...H,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...H,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...H,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let H=s1.parse(q);if(await V(H),H.expectedActorId!==null&&H.authenticatedActor.id!==H.expectedActorId)throw Z0();let U=Q.get(H.attemptId);if(U){if(!e$(U.binding,H))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(H),result:U$.parse({...H,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(H.attemptId,M);let T=!1,_="dispatch";try{(await K(H)).bytes.fill(0),M.result=await N(H.prUrl,async(D,j)=>{let z=L6.parse(await j({operation:"identity",expected:H}));if(!z.ok)return U$.parse({...H,status:"not_attempted",reason:z.reason});let F=await K(H),O;try{T=!0,O=B.discriminatedUnion("dispatched",[B.object({dispatched:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({dispatched:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:H,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...H,status:"not_attempted",reason:O.reason});if(!e$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...H,observedActor:z.actor}});if(L!==null){let R=B.object({nativeUrl:B.string(),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await G(),U$.parse({...H,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
-`);M.result=U$.parse({...H,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let H=o$.parse(q);await V(H);try{return(await K(H)).bytes.fill(0),await N(H.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:H});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...H,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(H).some(([D,j])=>!e$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...H,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function lY($,J){let Z=await dY($);return{async discover(Q){let X=await n2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as VG}from"fs/promises";var dM=B.object({version:B.literal(1),recording_operation_id:B.string().uuid(),proof_ready:B.literal(!1),acknowledged_at:B.iso.datetime()}).strict(),r2=B.object({action:B.literal("start"),request_id:B.string().uuid(),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),j6=B.object({action:B.literal("inspect"),recording_operation_id:B.string().uuid()}).strict(),lM=B.discriminatedUnion("action",[r2,j6]),z6=B.object({recording_operation_id:B.string().uuid()}).strict(),P3={device_id:B.string().uuid(),root_id:B.string().uuid()},pY=B.discriminatedUnion("action",[r2.extend(P3),j6.extend(P3),z6.extend({...P3,action:B.literal("stop")})]),pM=B.toJSONSchema(pY),cM=B.object({version:B.literal(1),recordingId:B.string().uuid(),proofReady:B.literal(!1),capture:B.object({captureId:B.string().uuid(),contentType:B.literal("video/webm"),sha256:B.string().regex(/^[a-f0-9]{64}$/),sizeBytes:B.number().int().min(128).max(10485760),startedAt:B.iso.datetime(),finishedAt:B.iso.datetime(),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000),owner:B.object({runId:B.string().uuid(),deviceId:B.string().uuid(),rootId:B.string().uuid(),rootRevision:B.string().max(64),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024),generation:B.string().uuid(),browserScope:B.string().max(128),tabId:B.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var JT=r2.extend({action:B.enum(["start","inspect"]),recording_boot_generation:B.string().uuid(),recording_operation_id:B.string().uuid().optional(),recording_attempt_id:B.string().uuid().optional()}).strict();import{createHash as $G,randomUUID as JG}from"crypto";import{mkdtemp as ZG,realpath as QG,rm as E6}from"fs/promises";import{tmpdir as XG}from"os";import{join as YG}from"path";import{spawn as GG}from"child_process";import{isDeepStrictEqual as BG}from"util";import{createHash as cY}from"crypto";import{execFile as sY}from"child_process";import{chmod as aY,lstat as A6,mkdtemp as iY,readFile as R6,realpath as C6,rm as nY,writeFile as O6}from"fs/promises";import{tmpdir as rY}from"os";import{isAbsolute as tY,join as t2}from"path";import{promisify as oY}from"util";var x3=oY(sY),eY=($)=>cY("sha256").update($).digest("hex");async function G1($){if(!tY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await C6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await A6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||eY(await R6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function $2($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]);let G=await C6(await iY(t2(J??rY(),"reason-owned-recording-")));await aY(G,448);let V=t2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await O6(t2(G,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await O6(t2(G,"frames.ffconcat"),N.join(`
+}`;var F6=function($){let J=this??globalThis,Z=10485760,Q=(G,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,H={login:K,id:q};if(G.expectedActorId!==null&&q!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||q!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||q!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:H}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,V=Q(G,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let H=J.document.querySelector("#fc-new_comment_field");if(!H)return{dispatched:!1,reason:"attachment_unavailable"};return H.files=q.files,H.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),V=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(V));if(q.length!==1)throw Error("saved_player_missing");let H=q[0],U={muted:H.muted,volume:H.volume,rate:H.playbackRate,preload:H.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(H.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(H.muted=!0,H.playbackRate=1,H.currentTime=0,H.readyState<2)H.preload="auto",H.load();await D(()=>H.readyState>=2&&H.videoWidth>0&&H.videoHeight>0);let j=H.currentSrc;if(!V(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!V(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let f=await _(O.read());if(f.done)break;if(L+=f.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(f.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(L),x=0;for(let f of W)R.set(f,x),x+=f.length;let C=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((f)=>f.toString(16).padStart(2,"0")).join("");if(C!==X.sha256||H.currentSrc!==j||!N.contains(H))throw Error("source_changed");let I=H.currentTime,h=H.getVideoPlaybackQuality().totalVideoFrames;if(await _(H.play()),await D(()=>H.currentTime-I>=0.05&&H.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||H.currentSrc!==j||!N.contains(H)||H.error)throw Error("player_changed");return{status:"verified",sourceSha256:C,width:H.videoWidth,height:H.videoHeight,durationSeconds:H.duration,advancedSeconds:H.currentTime-I,advancedFrames:H.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),H.pause(),H.currentTime=0,H.muted=U.muted,H.volume=U.volume,H.playbackRate=U.rate,H.preload=U.preload,!H.paused||H.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as kY}from"child_process";import{lstat as yY,realpath as fY}from"fs/promises";import{join as W6,resolve as hY}from"path";import{promisify as mY}from"util";var vY=mY(kY);async function gY($,J){let Z=await fY($),{stdout:Q}=await vY(W6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return B.array(B.object({browser:B.string(),directory:B.string(),connected:B.boolean().optional(),source:B.string(),socketPath:B.string().optional(),instanceId:B.string().optional(),extensionId:B.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&hY(Y.source)===W6(Z,"Reason Browser Use","manifest.json"))}async function n2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await gY($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await yY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as uY}from"crypto";function M$($){return`reason-browser-${uY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var D6=B.discriminatedUnion("ok",[B.object({ok:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({ok:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),j6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function I3($){let J=c0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await pY($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${dY()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(q)=>{if(!e$(J,q.owner))throw Z0();await G()},K=async(q)=>{await V(q);let H=await $.readVideo(q.captureId);try{await G();let U=H.capture;if(!e$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||H.bytes.length!==q.sizeBytes||H.bytes.length<128||H.bytes.length>10485760||H.bytes.readUInt32BE(0)!==440786851||L6("sha256").update(H.bytes).digest("hex")!==q.sha256)throw Z0();return H}catch(U){throw H.bytes.fill(0),U}};async function N(q,H,U){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new p2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await G(),D)throw Z0()};try{await F(T.connect());let W=j6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((C)=>{if(D)C.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let x=await F(H(_,async(C)=>{await O();let I=await F(_.evaluate(`(${F6.toString()})(${JSON.stringify(C)})`,{awaitPromise:!0}));return await O(),I},O));return await O(),x}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,R)=>{W=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(q,H,U){let M=N$.parse(q);if(await V(M),!Number.isSafeInteger(H)||H<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new p2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=j6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!B.array(B.object({id:B.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===H))throw Z0();await G(),U.throwIfAborted();let F=B.object({data:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(H,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await G(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let H=s2(q);if(H.runId!==J.runId||H.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(H.media.map((C)=>C.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,R=(C,I)=>{if(L.size>=32){F=!0;return}let h=_.executeCdp(U.id,C,I);L.add(h),h.catch(()=>{F=!0}).finally(()=>L.delete(h))},x=_.onNotification((C)=>{if(C.method!=="onCDPEvent"||!i0(C.params)||!i0(C.params.source)||C.params.source.tabId!==U.id||!i0(C.params.params))return;let I=C.params.params;if(++O>512){F=!0;return}if(C.params.method==="Fetch.requestPaused"){let f=typeof I.requestId==="string"&&i0(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&D.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!f)F=!0;R(f?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...f?{}:{errorReason:"BlockedByClient"}})}if(C.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(C.params.method==="Network.loadingFailed")F=!0;if(C.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")z.add(I.requestId);if(C.params.method!=="Network.responseReceived")return;if(!i0(I.response)||typeof I.response.url!=="string"||!D.has(I.response.url)||typeof I.requestId!=="string"||!i0(I.response.headers)||I.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(I.response.headers).map(([f,l])=>[f.toLowerCase(),l])),S=Number(h["content-length"]);if(j.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}j.set(I.response.url,{id:I.requestId,length:S})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let C=B.object({frameTree:B.object({frame:B.object({id:B.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),I=[...new Set(H.media.map((f)=>new URL(f.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:C.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new v0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await U.evaluate(`(${_6})(${JSON.stringify(H.media)})`,{awaitPromise:!0})}catch{throw new v0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!i0(h)||!Array.isArray(h.items)||h.items.length!==H.media.length)throw Z0();await Promise.all(L);let S=[];for(let f=0;f<H.media.length;f++){await G();let l=j.get(H.media[f].sourceUrl);if(F||!l||!z.has(l.id))throw Z0();let k=B.object({base64Encoded:B.literal(!0),body:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:l.id})),P=Buffer.from(k.body,"base64");try{let E=h.items[f];if(P.length!==l.length||P.toString("base64")!==k.body||!i0(E))throw Z0();S.push({...E,sourceSha256:L6("sha256").update(P).digest("hex")})}finally{P.fill(0)}}if(F)throw Z0();return V6({verified:!0,items:S},H)}finally{if(x(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new v0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let H=t$.parse(q);await V(H);let U="browser_unavailable";try{return await N(`https://github.com/${H.repositoryFullName}`,async(M,T)=>{let _=D6.parse(await T({operation:"preflight",expected:{...H,prUrl:`https://github.com/${H.repositoryFullName}`}}));return O3.parse(_.ok?{...H,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...H,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...H,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...H,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let H=s1.parse(q);if(await V(H),H.expectedActorId!==null&&H.authenticatedActor.id!==H.expectedActorId)throw Z0();let U=Q.get(H.attemptId);if(U){if(!e$(U.binding,H))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(H),result:U$.parse({...H,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(H.attemptId,M);let T=!1,_="dispatch";try{(await K(H)).bytes.fill(0),M.result=await N(H.prUrl,async(D,j)=>{let z=D6.parse(await j({operation:"identity",expected:H}));if(!z.ok)return U$.parse({...H,status:"not_attempted",reason:z.reason});let F=await K(H),O;try{T=!0,O=B.discriminatedUnion("dispatched",[B.object({dispatched:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({dispatched:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:H,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...H,status:"not_attempted",reason:O.reason});if(!e$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...H,observedActor:z.actor}});if(L!==null){let R=B.object({nativeUrl:B.string(),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await G(),U$.parse({...H,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
+`);M.result=U$.parse({...H,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let H=o$.parse(q);await V(H);try{return(await K(H)).bytes.fill(0),await N(H.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:H});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...H,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(H).some(([D,j])=>!e$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...H,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function pY($,J){let Z=await lY($);return{async discover(Q){let X=await n2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as HG}from"fs/promises";var lM=B.object({version:B.literal(1),recording_operation_id:B.string().uuid(),proof_ready:B.literal(!1),acknowledged_at:B.iso.datetime()}).strict(),r2=B.object({action:B.literal("start"),request_id:B.string().uuid(),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),z6=B.object({action:B.literal("inspect"),recording_operation_id:B.string().uuid()}).strict(),pM=B.discriminatedUnion("action",[r2,z6]),O6=B.object({recording_operation_id:B.string().uuid()}).strict(),P3={device_id:B.string().uuid(),root_id:B.string().uuid()},cY=B.discriminatedUnion("action",[r2.extend(P3),z6.extend(P3),O6.extend({...P3,action:B.literal("stop")})]),cM=B.toJSONSchema(cY),sM=B.object({version:B.literal(1),recordingId:B.string().uuid(),proofReady:B.literal(!1),capture:B.object({captureId:B.string().uuid(),contentType:B.literal("video/webm"),sha256:B.string().regex(/^[a-f0-9]{64}$/),sizeBytes:B.number().int().min(128).max(10485760),startedAt:B.iso.datetime(),finishedAt:B.iso.datetime(),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000),owner:B.object({runId:B.string().uuid(),deviceId:B.string().uuid(),rootId:B.string().uuid(),rootRevision:B.string().max(64),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024),generation:B.string().uuid(),browserScope:B.string().max(128),tabId:B.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var ZT=r2.extend({action:B.enum(["start","inspect"]),recording_boot_generation:B.string().uuid(),recording_operation_id:B.string().uuid().optional(),recording_attempt_id:B.string().uuid().optional()}).strict();import{createHash as JG,randomUUID as ZG}from"crypto";import{mkdtemp as QG,realpath as XG,rm as S6}from"fs/promises";import{tmpdir as YG}from"os";import{join as GG}from"path";import{spawn as BG}from"child_process";import{isDeepStrictEqual as KG}from"util";import{createHash as sY}from"crypto";import{execFile as aY}from"child_process";import{chmod as iY,lstat as R6,mkdtemp as nY,readFile as C6,realpath as I6,rm as rY,writeFile as A6}from"fs/promises";import{tmpdir as tY}from"os";import{isAbsolute as oY,join as t2}from"path";import{promisify as eY}from"util";var x3=eY(aY),$G=($)=>sY("sha256").update($).digest("hex");async function Q1($){if(!oY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await I6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await R6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||$G(await C6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function $2($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([Q1(Z.ffmpeg),Q1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([Q1(Z.ffmpeg),Q1(Z.ffprobe)]);let G=await I6(await nY(t2(J??tY(),"reason-owned-recording-")));await iY(G,448);let V=t2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await A6(t2(G,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await A6(t2(G,"frames.ffconcat"),N.join(`
 `)+`
-`,{mode:384,flag:"wx"});let q={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],q),K="output";let H=await A6(V);if(!H.isFile()||H.isSymbolicLink()||H.nlink!==1||H.size<128||H.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],q),K="pin",await Promise.all([G1(Z.ffmpeg),G1(Z.ffprobe)]),await R6(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await nY(G,{recursive:!0,force:!0})}}}}var P6=B.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var B1=B.string().min(1).max(1024),I6=B.object({path:B1,sha256:B.string().regex(/^[a-f0-9]{64}$/)}).strict(),x6=B.object({owner:B.object({runId:B1,deviceId:B1,rootId:B1,rootRevision:B1,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B1,generation:B1,browserScope:B1,tabId:B.number().int().positive()}).strict(),socketPath:B1,extensionId:B.string().regex(/^[a-p]{32}$/),nativeHostName:B1,seconds:B.number().int().min(1).max(15),encoder:B.object({ffmpeg:I6,ffprobe:I6}).strict()}).strict();var KG=15728640,C1=()=>Error("mac_recording_worker_failed");function S6($){let J=x6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,V=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(C1()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,H=async()=>{if(X)throw C1();if(await K($.assertCurrent()),X)throw C1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await H(),await G1({path:Z.path,sha256:Z.sha256}),await H(),G=null;let U=await QG(await ZG(YG(XG(),"reason-recording-host-")));try{await H()}catch(P){throw await E6(U,{recursive:!0,force:!0}),P}let M=GG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((P)=>M.once("close",()=>P())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(P){if(P.code!=="ESRCH")throw P}},D=null;V=()=>D??=(async()=>{try{_()}catch(P){if(P.code!=="EPERM")throw P}await T;try{for(let P=0;;P++)try{_();break}catch(E){if(E.code!=="EPERM"||P>=20)throw E;await new Promise((A)=>setTimeout(A,25))}}finally{await E6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,R,x=new Promise((P,E)=>{L=P,R=E}),C,I,h=new Promise((P,E)=>{C=P,I=E});h.catch(()=>{});let S=(P=C1())=>{if(F)return;F=!0,clearTimeout(f),clearInterval(b),N().then(()=>{R(P),I(P)},(E)=>{R(E),I(E)})},f=setTimeout(()=>S(),(J.seconds+25)*1000),d=!1,b=setInterval(()=>{if(d||F)return;d=!0,H().catch(()=>S()).finally(()=>{d=!1})},250);q={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
-`)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(P)=>{if(F)return;if(z+=P.length,z>KG){S();return}j+=P.toString("utf8");let E;while((E=j.indexOf(`
-`))!==-1){let A=j.slice(0,E);j=j.slice(E+1);try{let y=JSON.parse(A);if(y.type==="failed"&&Object.keys(y).sort().join(",")==="reason,type"){let o=P6.safeParse(y.reason);S(o.success?Error(`mac_recording_worker_failed:${o.data}`):C1());return}if(y.type==="unsupported"&&!O){S(Error("mac_recording_encoder_unavailable"));return}if(y.type==="started"&&!O&&Object.keys(y).length===1){O=!0,L({recording:!0});continue}if(!O||y.type!=="capture"||W||Object.keys(y).sort().join(",")!=="bytes,capture,type")throw C1();let w=y.capture;if(!w||Object.keys(w).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof w.sha256!=="string"||typeof w.startedAt!=="string"||typeof w.finishedAt!=="string"||!BG(w.owner,J.owner)||w.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(w.sha256)||!Number.isSafeInteger(w.sizeBytes)||w.sizeBytes<128||w.sizeBytes>10485760||!Number.isSafeInteger(w.frameCount)||w.frameCount<1||w.frameCount>450||!Number.isSafeInteger(w.receivedFrameCount)||w.receivedFrameCount<w.frameCount||w.receivedFrameCount>2000||!Number.isFinite(w.durationSeconds)||w.durationSeconds<0.05||w.durationSeconds>J.seconds||!Number.isFinite(Date.parse(w.startedAt))||!Number.isFinite(Date.parse(w.finishedAt))||Math.abs((Date.parse(w.finishedAt)-Date.parse(w.startedAt))/1000-w.durationSeconds)>0.1||typeof y.bytes!=="string"||y.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(y.bytes))throw C1();let n=Buffer.from(y.bytes,"base64");if(n.length!==w.sizeBytes||$G("sha256").update(n).digest("hex")!==w.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw C1();W={capture:Object.freeze({...w,captureId:JG(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(P)=>{if(F)return;if(P!==0||!W||j.trim()){S();return}let E=W;H().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(f),clearInterval(b),Q.set(E.capture.captureId,E);while(Q.size>2)Q.delete(Q.keys().next().value);C(E.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
-`);try{return await x}catch(P){throw q=null,P}}finally{Y=!1}},async completed(){if(await H(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await H();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await H();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var w6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await VG($.automationDirectory);J=(Q,X)=>n2(Z,Q,X)}if(await G1({path:$.worker.path,sha256:$.worker.sha256}),!await $2($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),V=new R1({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=w6.parse(await V.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!B.array(B.object({id:B.number()})).parse(await V.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:G.instanceId,async createHost(N,q,H){let U=new R1({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return S6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){H.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=w6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),UG=B.object({operationId:B.string().uuid()}).strict();function k6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=B.array(B.object({profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:B.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!B.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,G=!1,V=new HG,K=async(U)=>{let M=V.getStore();if(G||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),G)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=M6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let R=await $.resolveBrowser(U.profile,O,j,L);if(R.extensionInstanceId!==U.extensionInstanceId)throw A0();return R.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),G)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!b6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},H=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{G=!0})},1000);return H.unref(),{generation:$.generation,async execute(U,M,T){return V.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!b6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let R=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||NG("sha256").update(R.bytes).digest("hex")!==_.sha256)throw A0();await z();let x={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,x);try{let C=await fetch(L,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await C.body?.cancel(),await z(),C.ok)x.result={...x.result,status:"uploaded"}}catch{}F=x.result}finally{R.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==U6)return!1;let T=UG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await V.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(H);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var DG="__browser-recorder",jG=LG(qG),zG="/tmp/open-browser-use",OG=33554432,AG=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.literal(o2),extensionInstanceId:B.string().min(1).max(1024)})}),f6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:n$,ensureBrowser:g6,socketDirectory:zG,async identity($){let J=new R1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function h6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw f6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(u6(Z),"Default","Local Extension Settings",o2),X=(await y6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await y6(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=S3(J.socketDirectory,Y);try{let V=await TG(G);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=AG.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await FG(N)).size<=OG&&(await d6(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:o2}}catch{}}throw f6()}async function w3($){let J=await _G($);return{path:J,sha256:MG("sha256").update(await d6(J)).digest("hex")}}async function l6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await jG(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await $2(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...WG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],DG]};return{worker:{...await w3(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function p6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=m6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?v6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(H)=>Y6(H.organizationId,H.sessionId,H.deviceId,1),K=$.recording,N,q=k6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(H,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>h6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(H,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>RG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(H)=>I3({...H,endpoint:(U)=>({discover:(M)=>h6(M,Z),tabScope:V(U)})})});return{capability:G,broker:q}}function RG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as dG}from"child_process";import{execFile as CG}from"child_process";import{readFile as IG}from"fs/promises";import{join as $1}from"path";var PG="Claude Code-credentials",xG="/usr/bin/security",EG=120000,SG=8192,e2={exec:($,J,Z)=>new Promise((Q)=>{CG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await IG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=SG?$:null}function wG($,J){return $.CLAUDE_CONFIG_DIR||$1(J,".claude")}function bG($,J){return $.CODEX_HOME||$1(J,".codex")}function c6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function kG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function yG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:kG(Z)??Date.now()}}catch{return null}}function fG($,J){return $1($.XDG_DATA_HOME||$1(J,".local","share"),"opencode","auth.json")}var hG={anthropic:"anthropic",openai:"openai-codex"};function mG($){return n6($,hG)}function n6($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let V=T$(G.access),K=T$(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function vG($){return n6($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function gG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?$1(J,Z.slice(2)):Z||$1(J,".pi","agent")}async function r6($,J,Z=e2){let Q=[],X=await Z.exec(xG,["find-generic-password","-s",PG,"-w"],EG),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?c6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(c6(await Z.readText($1(wG($,J),".credentials.json"))));let V=yG(await Z.readText($1(bG($,J),"auth.json")));G(V),G(uG(await Z.readText($1($.GROK_HOME||$1(J,".grok"),"auth.json"))));for(let K of mG(await Z.readText(fG($,J))))G(K);for(let K of vG(await Z.readText($1(gG($,J),"auth.json"))))G(K);return Q}function t6($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var s6="https://auth.x.ai",a6="b1a00492-073a-47ea-816f-4c329264a828",i6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function uG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${s6}::${a6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==s6||Q.oidc_client_id!==a6||!i6(Q.key)||!i6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var o6=330000,lG=300000,pG=60000;function cG($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+o6)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function sG($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*o6)?pG:lG}var aG=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function e6($){let J=new Map,Z=$.wait??aG,Q=$.stores??(process.platform==="darwin"?e2:{...e2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=t6(await r6($.environment??process.env,$.home,Q));for(let Y of cG(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(sG(J),$.signal)}}function $7($=process.env){return new Promise((J)=>{dG("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as iG,spawn as O_,spawnSync as A_}from"child_process";import{chmodSync as C_,existsSync as nG,mkdirSync as I_,readFileSync as P_,renameSync as x_,rmSync as E_,statSync as S_,writeFileSync as w_}from"fs";import{dirname as k_,isAbsolute as y_,join as y3}from"path";var J7=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function Z7($,J){if(!J7.test($)||!J7.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var rG="com.reasonmachines.updater",tG=["so.ara.updater","so.reason.updater"];function oG($){let J=$==="staging"?".staging":"";return{label:`${rG}${J}`,legacyLabels:[...tG].reverse().map((Z)=>`${Z}${J}`)}}function eG($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function $B($,J){return new Promise((Z)=>{iG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function Y7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=oG($.channel),G=$.configHome??X7(Q),V=[X,...Y].filter((H)=>{let U=eG(H,Q,G);return nG(J==="darwin"?U.launchAgent:U.systemdService)});if(V.length===0)return"absent";let K=$.command??$B,N=V[0];if(V.length>1){for(let H of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${H}`]):await K("systemctl",["--user","is-enabled",`${H}.timer`]))===0){N=H;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var Q7=60000;function G7($){let J=(X,Y)=>{try{return Z7(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(Q7-1,Math.floor(G*Q7)))}}var JB=30000;async function B7($){return($.flush??F8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(JB);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var V7=25000,QB=5000,XB=600000,YB=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return u0(),R7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var H7=5000,GB=600000;function BB($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[i1])return null;try{return C2({platform:J})}catch{return null}}function KB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function VB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)g$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)g$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Q2($,J,Z,Q,X={}){if(u0(),$.executionMode==="host")Z2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?O7():Promise.resolve(!1),q=W7().then((k)=>k.status==="resolved",()=>!1),H=X.prestartedReadiness??i$($,X.readinessProbes,V,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?H.initial:H.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??$7)().catch(()=>!1):null,D=new AbortController,j=null,z=async(k,i)=>{let I0=($.userChrome??X.ownComputer===!0)&&k["automation.call.v1"]===!0?z7():null;if(I0&&"code"in I0)process.stderr.write(`Reason worker: your own Chrome unavailable (${I0.code})
-`);let a=g3($,k,{displayVideo:k["display.stream.v1"]===!0&&await N(),handsBrowser:k["hands.connect"]===!0&&await q,userChrome:I0&&"host"in I0?I0.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:k["pty.start"]===!0&&l2(),probing:i});if(!j&&a.worker.readiness?.["browser.pr-proof.v1"]===!0){let M0=await l6();if(j||D.signal.aborted)return a;process.stderr.write("error"in M0?`Reason worker: PR video proof unavailable (${M0.error})
-`:`Reason worker: PR video proof ready (ffmpeg ${M0.encoder.ffmpeg.path})
-`),j=p6({assertCurrent:async()=>{if(!d())throw Error("proof_authority_lost")},...!("error"in M0)?{recording:M0}:{}})}return a},F=await z(M,U?F3.filter((k)=>M[k]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,R=0,x="starting",C=null,I=!1,h=!1,S=null,f,d=()=>!G.drained&&!W&&Date.parse(Y)>Date.now()&&O.supported_operations.some((k)=>F.worker.readiness?.[k]===!0),b=null,P=()=>L+(b?.claims()??0),E=null,A=new Set,y=(k)=>{let i=k.capabilities.root_paths;if(Object.assign(k.capabilities,m3(k.config,k.state,F,j?.capability)),i)k.capabilities.root_paths=i},w=(k)=>{F=k,y({config:$,state:J,capabilities:O}),E?.();for(let i of A)y(i),i.heartbeatNow?.()},n=new Set,o=new Set,N0=setInterval(()=>{let k=new Set;for(let i of[{state:J,capabilities:O},...A])for(let B0 of YB){if(i.capabilities.operation_constraints?.[B0]?.probing!==!0)continue;let a=`${i.state.deviceId} ${B0}`;if(k.add(a),!n.has(a)||o.has(a))continue;o.add(a),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:i.state.deviceId,lane:B0,login_device:i.state===J,timestamp:new Date().toISOString()})}
-`)}n.clear();for(let i of k)n.add(i)},XB);N0.unref();let j0=(k)=>{if(!X.readinessProbes)n5({config:$,readiness:k,signal:D.signal,idle:()=>P()===0,permissions:J.roots[0].permissions,onReady:(i)=>{z(i,[]).then(w)}})},P1=U?H.final.then(async(k)=>{if(D.signal.aborted)return;w(await z(k,[]));let i=F3.filter((B0)=>k[B0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${i.length?`ready: ${i.join(", ")}`:"none ready"}).
-`),j0(k)},()=>{}):Promise.resolve();if(!U)j0(M);_?.then(async(k)=>{T=k;for(;;){let i=F,B0=await z(i.worker.readiness??{},i.worker.probing??[]);if(D.signal.aborted)return;if(F!==i)continue;w(B0);return}});let F1=U&&F.worker.probing?.includes("pty.start")?H.pty.then(async(k)=>{let i=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!i())return;let B0=await z({...F.worker.readiness,"pty.start":k},(F.worker.probing??[]).filter((I0)=>I0!=="pty.start"));if(D.signal.aborted||!i())return;w(B0)},()=>{}):Promise.resolve(),t1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:x,drained:G.drained||W||I,activeClaims:P(),activeSessions:R,lastHeartbeat:C,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:d()&&!I&&x==="running"}),x1=!1,E1=()=>{x1=!0,a0()},a0=()=>{if(W)return;if(W=!0,x="stopping",S?.close(),P()===0)D.abort();else f=setTimeout(()=>D.abort(),$.shutdownGraceMs)},S1=$.channel==="production"||$.channel==="staging"?$.channel:null,O$=l($).releaseCheck,W1=X.publishedRelease??(S1&&$.lifetime==="persistent"?G7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let k=JSON.parse(s(O$));return typeof k==="string"?k:null}catch{return null}})(),check:async(k)=>{try{c(O$,k)}catch{}let i=await Y7({channel:S1});process.stderr.write(i==="started"?`Reason worker: CLI ${k} is published; the updater is checking now.
-`:i==="absent"?`Reason worker: CLI ${k} is published; no updater is installed for it here.
-`:`Reason worker: CLI ${k} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),v=(k)=>{if(k==="stop")E1();if(k==="reload_roots"){let i=t($);if(!i||i.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=i.roots;let B0=A7(J.roots,K7());if(B0)O.root_paths=B0;else delete O.root_paths;b?.check()}if(k==="drain"||k==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:k==="drain"},x0($,G)}return t1()};X.prestartedControl?.handle(v);let Y0=X.prestartedControl?await X.prestartedControl.closed:await f2($,Q,v),L1,i0=!1,A$=()=>{let k=Date.parse(Y)-Date.now();if(k>0){L1=setTimeout(A$,Math.min(k,2147483647));return}W=!0,S?.close(),i0=!0,x="stopping",D.abort(Error("worker_credential_expired"))};A$(),X.signal?.addEventListener("abort",a0,{once:!0});let g0=X.processSignals!==!1;if(g0)process.once("SIGTERM",a0),process.once("SIGINT",E1);if(X.signal?.aborted)a0();try{X.onStartup?.("control_ready");let k=X.client??new J2(J1($.apiOrigin),k0($.proxy,N7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),i=l($).daemon,B0=C4($,J.deviceId),I0=X.startupTiming,a=I0?()=>({...I0(),...B0?.enrollmentMs!==void 0?{enrollment_ms:B0.enrollmentMs}:{}}):void 0,M0=(m)=>{let n0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&n0)(X.handOverLocalLogins??e6)({state:m.state,client:{localSubscription:n0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=K7(),w0=m.client.liveSessionWorktrees?.bind(m.client);if(w0)T7(()=>M7({home:W0,deviceId:m.state.deviceId,liveIds:(D1)=>w0(m.state,D1,m.signal)}),m.signal)};M0({state:J,client:k,signal:D.signal});let l0=BB($,X.platform??process.platform),w1=k.deviceLifecycle?.bind(k),o1=Promise.resolve(),R0=0,S0=()=>{if(!l0||!w1||W||Date.now()<R0)return;R0=Date.now()+GB,o1=o1.then(()=>B7({paths:l0,device:J,client:{deviceLifecycle:w1},accept:KB,signal:D.signal})).catch(()=>{return})};if(S0(),l0)H.final.then((m)=>VB(l0,m),()=>{});let R$=(m,n0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+D7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:V7,operationCompletionTimeoutMs:V7,maxConsecutiveHeartbeatFailures:3,claimable:d,onClaim:async(W0,w0,D1)=>{let I$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let r0=F.worker.probing??[],V9=r0.includes(W0.capability)?P1:W0.capability==="hands.connect"&&$.executionMode==="host"&&r0.includes("pty.start")?F1:null;if(V9){let U2,D4=()=>{};await Promise.race([V9,new Promise((H9)=>{U2=setTimeout(H9,QB),D4=()=>H9(),w0.addEventListener("abort",D4,{once:!0})})]),clearTimeout(U2),w0.removeEventListener("abort",D4)}let N2=W0.capability==="hands.connect",L4=N2?S:null,iJ={signal:w0,emit:D1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(U2)=>m.client.operationCustomEndpointCredential(m.state,W0,U2)}:{},...N2?{handsLaunch:{claimedAtMs:I$,...L4?{takePrespawnedWorker:L4.take,adoptSpawnedWorker:L4.adopt}:{}}}:{}};if(N2)R+=1;try{return await(X.execute??u3)(m.state,W0,iJ)}finally{if(N2)R-=1}},onControl:async(W0,w0)=>await C7(m.state,W0,w0,m.client)||await I7(m.state,W0,w0)||await j7(W0,w0)||await j?.broker.control(W0,w0)||!1,onEvent:n0}),H2=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:ZB(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(H7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,B9=k.ownerWorkspaces?.bind(k),K9=k.ownerWorkspaceEnrollment?.bind(k);if(C$&&B9&&K9)b=n9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:B9,ownerWorkspaceEnrollment:K9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,n0,W0)=>{let w0=C4(m.config,m.state.deviceId),D1={config:m.config,state:m.state,signal:n0,statusPath:l(m.config).daemon,...w0?.offer?{firstHeartbeat:w0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new J2(J1($.apiOrigin),k0($.proxy,N7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};M0(D1);let I$={...D1,heartbeatNow:null};A.add(I$);try{await K3({registerHeartbeatNow:(r0)=>{I$.heartbeatNow=r0},...R$(D1,(r0)=>{if(r0.type==="completed")v3(r0.operationId,r0.status);if(r0.type==="claims_changed"){if(W0(r0.activeClaims),W&&P()===0)D.abort()}if(r0.type==="stopped")W0(0)})})}finally{A.delete(I$)}if(W&&!i0)await H2(D1)}});let _4=0,F4=0,W4=C$?.intervalMs??p9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>P()>0?S2(i):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{E=m},...a?{startup:a}:{},...R$({state:J,client:k,capabilities:O,signal:D.signal,statusPath:i,...B0?.offer?{firstHeartbeat:B0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&P()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=F7({log:(n0,W0)=>{process.stderr.write(`${JSON.stringify({event:n0,...W0})}
-`)}}),S.arm(),setTimeout(L7,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(b&&!W&&Date.now()>=_4)_4=Date.now()+W4,b.check().then((n0)=>{F4=n0?0:F4+1,_4=Date.now()+(n0?W4:Math.min(W4,c9*2**Math.min(F4-1,10)))});if(C=m.serverTime,I=m.drain,S0(),!W&&S1)W1?.(m.latestCliVersions?.[S1]);if(!W)x="running";if(!W&&!h&&t1().executionEligible){if(h=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)x="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await b?.settled(),W&&!i0&&$.lifetime==="ephemeral")await k.disconnect?.(J,AbortSignal.timeout(H7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(W&&!i0)await H2({state:J,client:k});if(x1)await _7().catch(()=>{return})}catch(k){if(!(k instanceof _0&&k.status===401))throw k;if(x0($,{...G,revoked:!0}),k.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(L1),clearInterval(N0),f)clearTimeout(f);if(g0)process.removeListener("SIGTERM",a0),process.removeListener("SIGINT",E1);X.signal?.removeEventListener("abort",a0),D.abort(),S?.close(),await b?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await Y0()}}function N7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(U7,q7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as HB,sign as NB}from"crypto";var P7=65536,UB=65536;function qB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new X0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new X0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!E7(X))throw new X0("invalid_public_key");return X}function x7(){try{let{privateKey:$,publicKey:J}=HB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:qB(J)}}catch($){if($ instanceof X0)throw $;throw new X0("proof_key_generation_failed")}}class X2{keyPair=x7();binding=null;loadPublicKey(){if(!this.keyPair)throw new X0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=x7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>UB)throw new X0("proof_sign_failed");let J;try{J=NB("sha256",$,this.keyPair.privateKey)}catch{throw new X0("proof_sign_failed")}if(!S7(J))throw new X0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>P7)throw new X0("invalid_binding");if(this.binding)throw new X0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>P7)throw new X0("invalid_binding");if(!this.binding)throw new X0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as DB,spawn as jB}from"child_process";import{isAbsolute as zB}from"path";import{promisify as OB}from"util";var Y2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class G2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=Y2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
-`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as MB}from"crypto";import{unlinkSync as TB}from"fs";import{join as _B}from"path";var B2=1,$4=45000,FB=B.strictObject({type:B.literal("configure"),protocol:B.literal(B2),version:B.string(),config:J0}),WB=B.strictObject({type:B.literal("ticket"),organizationId:B.string().min(1).max(160),receipt:B.unknown()}),LB=B.strictObject({type:B.enum(["ping","stop"])});async function w7($={}){let J=$.clock??Y2,Z=new G2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,V,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:H,version:U}=FB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(N1(H),e(g(H),!0),V=Y1({path:l(H).lock,runtimeVersion:r}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=_B(g(H),`ssh-preflight-${MB()}.json`);try{c(M,{version:1}),s(M)}finally{try{TB(M)}catch{}}let T=t(H),_=$0(H);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&H.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:B2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=H.lifetime==="ephemeral"?K=new X2:T0(H,!0);if(!T){let W=A1(H);await Z.send({type:"ticket-request",request:W.request});let L=WB.parse(await Z.receive(70000,Q.signal)),R=W.complete(L.organizationId,L.receipt);if(T=await X1(H,R,D,$.enroll),H.lifetime==="persistent")m0(T,l(H).state,{proofStore:D});x0(H,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(LB.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min($4,$.startupTimeoutMs??$4)),()=>{F=!0,Y()});let O=V.owner.nonce;if(await Q2(H,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(H,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:H.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(H){let U=H instanceof Error&&/^worker_[a-z_]+$/.test(H.message)?H.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>zB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,AB=B.strictObject({type:B.literal("hello"),protocol:B.literal(B2),version:B.string(),platform:B.enum(["linux","darwin"]),architecture:B.enum(["arm64","x64"]),enrolled:B.boolean()}),RB=B.strictObject({type:B.literal("ticket-request"),request:B.strictObject({install_id:B.uuid(),code_challenge:B.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:B.enum(["persistent","ephemeral"]),roots:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),execution_mode:B.enum(["confined","host"]),permissions:B.strictObject({read:B.literal(!0),write:B.literal(!0),execute:B.literal(!0),discover_environment:B.literal(!0),expose_mcp:B.literal(!1)})})).length(1)})}),b7=B.discriminatedUnion("type",[B.strictObject({type:B.literal("running"),deviceId:B.string().min(1).max(160),expiresAt:B.iso.datetime({offset:!0}),lifetime:B.enum(["persistent","ephemeral"]),supervision:B.literal("ssh-foreground")}),B.strictObject({type:B.literal("pong")}),B.strictObject({type:B.literal("stopped")})]),CB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function J4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&CB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function k7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
+`,{mode:384,flag:"wx"});let q={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],q),K="output";let H=await R6(V);if(!H.isFile()||H.isSymbolicLink()||H.nlink!==1||H.size<128||H.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],q),K="pin",await Promise.all([Q1(Z.ffmpeg),Q1(Z.ffprobe)]),await C6(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await rY(G,{recursive:!0,force:!0})}}}}var x6=B.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var X1=B.string().min(1).max(1024),P6=B.object({path:X1,sha256:B.string().regex(/^[a-f0-9]{64}$/)}).strict(),E6=B.object({owner:B.object({runId:X1,deviceId:X1,rootId:X1,rootRevision:X1,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:X1,generation:X1,browserScope:X1,tabId:B.number().int().positive()}).strict(),socketPath:X1,extensionId:B.string().regex(/^[a-p]{32}$/),nativeHostName:X1,seconds:B.number().int().min(1).max(15),encoder:B.object({ffmpeg:P6,ffprobe:P6}).strict()}).strict();var VG=15728640,I1=()=>Error("mac_recording_worker_failed");function w6($){let J=E6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,V=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(I1()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,H=async()=>{if(X)throw I1();if(await K($.assertCurrent()),X)throw I1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await H(),await Q1({path:Z.path,sha256:Z.sha256}),await H(),G=null;let U=await XG(await QG(GG(YG(),"reason-recording-host-")));try{await H()}catch(P){throw await S6(U,{recursive:!0,force:!0}),P}let M=BG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((P)=>M.once("close",()=>P())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(P){if(P.code!=="ESRCH")throw P}},D=null;V=()=>D??=(async()=>{try{_()}catch(P){if(P.code!=="EPERM")throw P}await T;try{for(let P=0;;P++)try{_();break}catch(E){if(E.code!=="EPERM"||P>=20)throw E;await new Promise((A)=>setTimeout(A,25))}}finally{await S6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,R,x=new Promise((P,E)=>{L=P,R=E}),C,I,h=new Promise((P,E)=>{C=P,I=E});h.catch(()=>{});let S=(P=I1())=>{if(F)return;F=!0,clearTimeout(f),clearInterval(k),N().then(()=>{R(P),I(P)},(E)=>{R(E),I(E)})},f=setTimeout(()=>S(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,H().catch(()=>S()).finally(()=>{l=!1})},250);q={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
+`)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(P)=>{if(F)return;if(z+=P.length,z>VG){S();return}j+=P.toString("utf8");let E;while((E=j.indexOf(`
+`))!==-1){let A=j.slice(0,E);j=j.slice(E+1);try{let b=JSON.parse(A);if(b.type==="failed"&&Object.keys(b).sort().join(",")==="reason,type"){let o=x6.safeParse(b.reason);S(o.success?Error(`mac_recording_worker_failed:${o.data}`):I1());return}if(b.type==="unsupported"&&!O){S(Error("mac_recording_encoder_unavailable"));return}if(b.type==="started"&&!O&&Object.keys(b).length===1){O=!0,L({recording:!0});continue}if(!O||b.type!=="capture"||W||Object.keys(b).sort().join(",")!=="bytes,capture,type")throw I1();let w=b.capture;if(!w||Object.keys(w).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof w.sha256!=="string"||typeof w.startedAt!=="string"||typeof w.finishedAt!=="string"||!KG(w.owner,J.owner)||w.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(w.sha256)||!Number.isSafeInteger(w.sizeBytes)||w.sizeBytes<128||w.sizeBytes>10485760||!Number.isSafeInteger(w.frameCount)||w.frameCount<1||w.frameCount>450||!Number.isSafeInteger(w.receivedFrameCount)||w.receivedFrameCount<w.frameCount||w.receivedFrameCount>2000||!Number.isFinite(w.durationSeconds)||w.durationSeconds<0.05||w.durationSeconds>J.seconds||!Number.isFinite(Date.parse(w.startedAt))||!Number.isFinite(Date.parse(w.finishedAt))||Math.abs((Date.parse(w.finishedAt)-Date.parse(w.startedAt))/1000-w.durationSeconds)>0.1||typeof b.bytes!=="string"||b.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(b.bytes))throw I1();let n=Buffer.from(b.bytes,"base64");if(n.length!==w.sizeBytes||JG("sha256").update(n).digest("hex")!==w.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw I1();W={capture:Object.freeze({...w,captureId:ZG(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(P)=>{if(F)return;if(P!==0||!W||j.trim()){S();return}let E=W;H().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(f),clearInterval(k),Q.set(E.capture.captureId,E);while(Q.size>2)Q.delete(Q.keys().next().value);C(E.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
+`);try{return await x}catch(P){throw q=null,P}}finally{Y=!1}},async completed(){if(await H(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await H();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await H();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var b6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await HG($.automationDirectory);J=(Q,X)=>n2(Z,Q,X)}if(await Q1({path:$.worker.path,sha256:$.worker.sha256}),!await $2($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),V=new C1({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=b6.parse(await V.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!B.array(B.object({id:B.number()})).parse(await V.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:G.instanceId,async createHost(N,q,H){let U=new C1({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return w6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){H.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=b6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),qG=B.object({operationId:B.string().uuid()}).strict();function y6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=B.array(B.object({profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:B.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!B.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,G=!1,V=new NG,K=async(U)=>{let M=V.getStore();if(G||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),G)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=T6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let R=await $.resolveBrowser(U.profile,O,j,L);if(R.extensionInstanceId!==U.extensionInstanceId)throw A0();return R.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),G)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!k6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},H=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{G=!0})},1000);return H.unref(),{generation:$.generation,async execute(U,M,T){return V.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!k6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let R=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||UG("sha256").update(R.bytes).digest("hex")!==_.sha256)throw A0();await z();let x={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,x);try{let C=await fetch(L,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await C.body?.cancel(),await z(),C.ok)x.result={...x.result,status:"uploaded"}}catch{}F=x.result}finally{R.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==q6)return!1;let T=qG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await V.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(H);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var jG="__browser-recorder",zG=DG(MG),OG="/tmp/open-browser-use",AG=33554432,RG=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.literal(o2),extensionInstanceId:B.string().min(1).max(1024)})}),h6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:n$,ensureBrowser:u6,socketDirectory:OG,async identity($){let J=new C1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function m6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw h6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(d6(Z),"Default","Local Extension Settings",o2),X=(await f6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await f6(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=S3(J.socketDirectory,Y);try{let V=await _G(G);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=RG.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await WG(N)).size<=AG&&(await l6(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:o2}}catch{}}throw h6()}async function w3($){let J=await FG($);return{path:J,sha256:TG("sha256").update(await l6(J)).digest("hex")}}async function p6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await zG(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await $2(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...LG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],jG]};return{worker:{...await w3(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function c6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=v6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?g6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(H)=>G6(H.organizationId,H.sessionId,H.deviceId,1),K=$.recording,N,q=y6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(H,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>m6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(H,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>CG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(H)=>I3({...H,endpoint:(U)=>({discover:(M)=>m6(M,Z),tabScope:V(U)})})});return{capability:G,broker:q}}function CG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as lG}from"child_process";import{execFile as IG}from"child_process";import{readFile as PG}from"fs/promises";import{join as t0}from"path";var xG="Claude Code-credentials",EG="/usr/bin/security",SG=120000,wG=8192,e2={exec:($,J,Z)=>new Promise((Q)=>{IG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await PG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=wG?$:null}function bG($,J){return $.CLAUDE_CONFIG_DIR||t0(J,".claude")}function kG($,J){return $.CODEX_HOME||t0(J,".codex")}function s6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function yG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function fG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:yG(Z)??Date.now()}}catch{return null}}function hG($,J){return t0($.XDG_DATA_HOME||t0(J,".local","share"),"opencode","auth.json")}var mG={anthropic:"anthropic",openai:"openai-codex"};function vG($){return r6($,mG)}function r6($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let V=T$(G.access),K=T$(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function gG($){return r6($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function uG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?t0(J,Z.slice(2)):Z||t0(J,".pi","agent")}async function t6($,J,Z=e2){let Q=[],X=await Z.exec(EG,["find-generic-password","-s",xG,"-w"],SG),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?s6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(s6(await Z.readText(t0(bG($,J),".credentials.json"))));let V=fG(await Z.readText(t0(kG($,J),"auth.json")));G(V),G(dG(await Z.readText(t0($.GROK_HOME||t0(J,".grok"),"auth.json"))));for(let K of vG(await Z.readText(hG($,J))))G(K);for(let K of gG(await Z.readText(t0(uG($,J),"auth.json"))))G(K);return Q}function o6($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var a6="https://auth.x.ai",i6="b1a00492-073a-47ea-816f-4c329264a828",n6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function dG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${a6}::${i6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==a6||Q.oidc_client_id!==i6||!n6(Q.key)||!n6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var e6=330000,pG=300000,cG=60000;function sG($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+e6)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function aG($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*e6)?cG:pG}var iG=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function $7($){let J=new Map,Z=$.wait??iG,Q=$.stores??(process.platform==="darwin"?e2:{...e2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=o6(await t6($.environment??process.env,$.home,Q));for(let Y of sG(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(aG(J),$.signal)}}function J7($=process.env){return new Promise((J)=>{lG("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as nG,spawn as A_,spawnSync as R_}from"child_process";import{chmodSync as I_,existsSync as rG,mkdirSync as P_,readFileSync as x_,renameSync as E_,rmSync as S_,statSync as w_,writeFileSync as b_}from"fs";import{dirname as y_,isAbsolute as f_,join as y3}from"path";var Z7=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function Q7($,J){if(!Z7.test($)||!Z7.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var tG="com.reasonmachines.updater",oG=["so.ara.updater","so.reason.updater"];function eG($){let J=$==="staging"?".staging":"";return{label:`${tG}${J}`,legacyLabels:[...oG].reverse().map((Z)=>`${Z}${J}`)}}function $B($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function JB($,J){return new Promise((Z)=>{nG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function G7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=eG($.channel),G=$.configHome??Y7(Q),V=[X,...Y].filter((H)=>{let U=$B(H,Q,G);return rG(J==="darwin"?U.launchAgent:U.systemdService)});if(V.length===0)return"absent";let K=$.command??JB,N=V[0];if(V.length>1){for(let H of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${H}`]):await K("systemctl",["--user","is-enabled",`${H}.timer`]))===0){N=H;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var X7=60000;function B7($){let J=(X,Y)=>{try{return Q7(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(X7-1,Math.floor(G*X7)))}}var ZB=30000;async function K7($){return($.flush??W8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(ZB);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var H7=25000,XB=5000,YB=600000,GB=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return u0(),C7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var N7=5000,BB=600000;function KB($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[i1])return null;try{return C2({platform:J})}catch{return null}}function VB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function HB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)g$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)g$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Q2($,J,Z,Q,X={}){if(u0(),$.executionMode==="host")Z2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?A7():Promise.resolve(!1),q=L7().then((y)=>y.status==="resolved",()=>!1),H=X.prestartedReadiness??i$($,X.readinessProbes,V,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?H.initial:H.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??J7)().catch(()=>!1):null,D=new AbortController,j=null,z=async(y,a)=>{let i=($.userChrome??X.ownComputer===!0)&&y["automation.call.v1"]===!0?O7():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
+`);let K0=g3($,y,{displayVideo:y["display.stream.v1"]===!0&&await N(),handsBrowser:y["hands.connect"]===!0&&await q,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:y["pty.start"]===!0&&l2(),probing:a});if(!j&&K0.worker.readiness?.["browser.pr-proof.v1"]===!0){let R0=await p6();if(j||D.signal.aborted)return K0;process.stderr.write("error"in R0?`Reason worker: PR video proof unavailable (${R0.error})
+`:`Reason worker: PR video proof ready (ffmpeg ${R0.encoder.ffmpeg.path})
+`),j=c6({assertCurrent:async()=>{if(!k())throw Error("proof_authority_lost")},...!("error"in R0)?{recording:R0}:{}})}return K0},F=await z(M,U?F3.filter((y)=>M[y]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,R=0,x="starting",C=null,I=!1,h=!1,S=null,f,l=()=>!G.drained&&Date.parse(Y)>Date.now()&&O.supported_operations.some((y)=>F.worker.readiness?.[y]===!0),k=()=>!W&&l(),P=null,E=()=>L+(P?.claims()??0),A=null,b=new Set,w=(y)=>{let a=y.capabilities.root_paths;if(Object.assign(y.capabilities,m3(y.config,y.state,F,j?.capability)),a)y.capabilities.root_paths=a},n=(y)=>{F=y,w({config:$,state:J,capabilities:O}),A?.();for(let a of b)w(a),a.heartbeatNow?.()},o=new Set,N0=new Set,j0=setInterval(()=>{let y=new Set;for(let a of[{state:J,capabilities:O},...b])for(let q0 of GB){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let K0=`${a.state.deviceId} ${q0}`;if(y.add(K0),!o.has(K0)||N0.has(K0))continue;N0.add(K0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
+`)}o.clear();for(let a of y)o.add(a)},YB);j0.unref();let W1=(y)=>{if(!X.readinessProbes)r5({config:$,readiness:y,signal:D.signal,idle:()=>E()===0,permissions:J.roots[0].permissions,onReady:(a)=>{z(a,[]).then(n)}})},L1=U?H.final.then(async(y)=>{if(D.signal.aborted)return;n(await z(y,[]));let a=F3.filter((q0)=>y[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
+`),W1(y)},()=>{}):Promise.resolve();if(!U)W1(M);_?.then(async(y)=>{T=y;for(;;){let a=F,q0=await z(a.worker.readiness??{},a.worker.probing??[]);if(D.signal.aborted)return;if(F!==a)continue;n(q0);return}});let O$=U&&F.worker.probing?.includes("pty.start")?H.pty.then(async(y)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!a())return;let q0=await z({...F.worker.readiness,"pty.start":y},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(D.signal.aborted||!a())return;n(q0)},()=>{}):Promise.resolve(),x1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:x,drained:G.drained||W||I,activeClaims:E(),activeSessions:R,lastHeartbeat:C,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:k()&&!I&&x==="running"}),t1=!1,D1=()=>{t1=!0,B1()},B1=()=>{if(W)return;if(W=!0,x="stopping",S?.close(),E()===0)D.abort();else f=setTimeout(()=>D.abort(),$.shutdownGraceMs)},E1=$.channel==="production"||$.channel==="staging"?$.channel:null,K1=d($).releaseCheck,v=X.publishedRelease??(E1&&$.lifetime==="persistent"?B7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let y=JSON.parse(s(K1));return typeof y==="string"?y:null}catch{return null}})(),check:async(y)=>{try{c(K1,y)}catch{}let a=await G7({channel:E1});process.stderr.write(a==="started"?`Reason worker: CLI ${y} is published; the updater is checking now.
+`:a==="absent"?`Reason worker: CLI ${y} is published; no updater is installed for it here.
+`:`Reason worker: CLI ${y} is published; the updater did not start, so its next scheduled check takes it.
+`)}}):void 0),X0=(y)=>{if(y==="stop")D1();if(y==="reload_roots"){let a=t($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=R7(J.roots,V7());if(q0)O.root_paths=q0;else delete O.root_paths;P?.check()}if(y==="drain"||y==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:y==="drain"},x0($,G)}return x1()};X.prestartedControl?.handle(X0);let S1=X.prestartedControl?await X.prestartedControl.closed:await f2($,Q,X0),V1,w1=!1,g0=()=>{let y=Date.parse(Y)-Date.now();if(y>0){V1=setTimeout(g0,Math.min(y,2147483647));return}W=!0,S?.close(),w1=!0,x="stopping",D.abort(Error("worker_credential_expired"))};g0(),X.signal?.addEventListener("abort",B1,{once:!0});let A$=X.processSignals!==!1;if(A$)process.once("SIGTERM",B1),process.once("SIGINT",D1);if(X.signal?.aborted)B1();try{X.onStartup?.("control_ready");let y=X.client??new J2(o0($.apiOrigin),k0($.proxy,U7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=C4($,J.deviceId),i=X.startupTiming,K0=i?()=>({...i(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,R0=(m)=>{let s0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&s0)(X.handOverLocalLogins??$7)({state:m.state,client:{localSubscription:s0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=V7(),w0=m.client.liveSessionWorktrees?.bind(m.client);if(w0)_7(()=>T7({home:W0,deviceId:m.state.deviceId,liveIds:(j1)=>w0(m.state,j1,m.signal)}),m.signal)};R0({state:J,client:y,signal:D.signal});let H1=KB($,X.platform??process.platform),o1=y.deviceLifecycle?.bind(y),C0=Promise.resolve(),S0=0,R$=()=>{if(!H1||!o1||W||Date.now()<S0)return;S0=Date.now()+BB,C0=C0.then(()=>K7({paths:H1,device:J,client:{deviceLifecycle:o1},accept:VB,signal:D.signal})).catch(()=>{return})};if(R$(),H1)H.final.then((m)=>HB(H1,m),()=>{});let H2=(m,s0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+j7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:H7,operationCompletionTimeoutMs:H7,maxConsecutiveHeartbeatFailures:3,claimable:k,advertised:l,onClaim:async(W0,w0,j1)=>{let I$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let a0=F.worker.probing??[],H9=a0.includes(W0.capability)?L1:W0.capability==="hands.connect"&&$.executionMode==="host"&&a0.includes("pty.start")?O$:null;if(H9){let U2,D4=()=>{};await Promise.race([H9,new Promise((N9)=>{U2=setTimeout(N9,XB),D4=()=>N9(),w0.addEventListener("abort",D4,{once:!0})})]),clearTimeout(U2),w0.removeEventListener("abort",D4)}let N2=W0.capability==="hands.connect",L4=N2?S:null,nJ={signal:w0,emit:j1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(U2)=>m.client.operationCustomEndpointCredential(m.state,W0,U2)}:{},...N2?{handsLaunch:{claimedAtMs:I$,...L4?{takePrespawnedWorker:L4.take,adoptSpawnedWorker:L4.adopt}:{}}}:{}};if(N2)R+=1;try{return await(X.execute??u3)(m.state,W0,nJ)}finally{if(N2)R-=1}},onControl:async(W0,w0)=>await I7(m.state,W0,w0,m.client)||await P7(m.state,W0,w0)||await z7(W0,w0)||await j?.broker.control(W0,w0)||!1,onEvent:s0}),B9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:QB(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(N7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,K9=y.ownerWorkspaces?.bind(y),V9=y.ownerWorkspaceEnrollment?.bind(y);if(C$&&K9&&V9)P=r9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:K9,ownerWorkspaceEnrollment:V9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,s0,W0)=>{let w0=C4(m.config,m.state.deviceId),j1={config:m.config,state:m.state,signal:s0,statusPath:d(m.config).daemon,...w0?.offer?{firstHeartbeat:w0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new J2(o0($.apiOrigin),k0($.proxy,U7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};R0(j1);let I$={...j1,heartbeatNow:null};b.add(I$);try{await K3({registerHeartbeatNow:(a0)=>{I$.heartbeatNow=a0},...H2(j1,(a0)=>{if(a0.type==="completed")v3(a0.operationId,a0.status);if(a0.type==="claims_changed"){if(W0(a0.activeClaims),W&&E()===0)D.abort()}if(a0.type==="stopped")W0(0)})})}finally{b.delete(I$)}if(W&&!w1)await B9(j1)}});let _4=0,F4=0,W4=C$?.intervalMs??c9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>E()>0?S2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...K0?{startup:K0}:{},...H2({state:J,client:y,capabilities:O,signal:D.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&E()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=W7({log:(s0,W0)=>{process.stderr.write(`${JSON.stringify({event:s0,...W0})}
+`)}}),S.arm(),setTimeout(D7,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(P&&!W&&Date.now()>=_4)_4=Date.now()+W4,P.check().then((s0)=>{F4=s0?0:F4+1,_4=Date.now()+(s0?W4:Math.min(W4,s9*2**Math.min(F4-1,10)))});if(C=m.serverTime,I=m.drain,R$(),!W&&E1)v?.(m.latestCliVersions?.[E1]);if(!W)x="running";if(!W&&!h&&x1().executionEligible){if(h=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)x="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await P?.settled(),W&&!w1&&$.lifetime==="ephemeral")await y.disconnect?.(J,AbortSignal.timeout(N7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
+`)});else if(W&&!w1)await B9({state:J,client:y});if(t1)await F7().catch(()=>{return})}catch(y){if(!(y instanceof _0&&y.status===401))throw y;if(x0($,{...G,revoked:!0}),y.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(V1),clearInterval(j0),f)clearTimeout(f);if(A$)process.removeListener("SIGTERM",B1),process.removeListener("SIGINT",D1);X.signal?.removeEventListener("abort",B1),D.abort(),S?.close(),await P?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await S1()}}function U7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(q7,M7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as NB,sign as UB}from"crypto";var x7=65536,qB=65536;function MB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new Y0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new Y0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!S7(X))throw new Y0("invalid_public_key");return X}function E7(){try{let{privateKey:$,publicKey:J}=NB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:MB(J)}}catch($){if($ instanceof Y0)throw $;throw new Y0("proof_key_generation_failed")}}class X2{keyPair=E7();binding=null;loadPublicKey(){if(!this.keyPair)throw new Y0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=E7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>qB)throw new Y0("proof_sign_failed");let J;try{J=UB("sha256",$,this.keyPair.privateKey)}catch{throw new Y0("proof_sign_failed")}if(!w7(J))throw new Y0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>x7)throw new Y0("invalid_binding");if(this.binding)throw new Y0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>x7)throw new Y0("invalid_binding");if(!this.binding)throw new Y0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as jB,spawn as zB}from"child_process";import{isAbsolute as OB}from"path";import{promisify as AB}from"util";var Y2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class G2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=Y2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
+`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as TB}from"crypto";import{unlinkSync as _B}from"fs";import{join as FB}from"path";var B2=1,$4=45000,WB=B.strictObject({type:B.literal("configure"),protocol:B.literal(B2),version:B.string(),config:J0}),LB=B.strictObject({type:B.literal("ticket"),organizationId:B.string().min(1).max(160),receipt:B.unknown()}),DB=B.strictObject({type:B.enum(["ping","stop"])});async function b7($={}){let J=$.clock??Y2,Z=new G2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,V,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:H,version:U}=WB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(U1(H),e(g(H),!0),V=Z1({path:d(H).lock,runtimeVersion:r}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=FB(g(H),`ssh-preflight-${TB()}.json`);try{c(M,{version:1}),s(M)}finally{try{_B(M)}catch{}}let T=t(H),_=$0(H);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&H.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:B2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=H.lifetime==="ephemeral"?K=new X2:T0(H,!0);if(!T){let W=R1(H);await Z.send({type:"ticket-request",request:W.request});let L=LB.parse(await Z.receive(70000,Q.signal)),R=W.complete(L.organizationId,L.receipt);if(T=await J1(H,R,D,$.enroll),H.lifetime==="persistent")m0(T,d(H).state,{proofStore:D});x0(H,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(DB.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min($4,$.startupTimeoutMs??$4)),()=>{F=!0,Y()});let O=V.owner.nonce;if(await Q2(H,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(H,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:H.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(H){let U=H instanceof Error&&/^worker_[a-z_]+$/.test(H.message)?H.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>OB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,RB=B.strictObject({type:B.literal("hello"),protocol:B.literal(B2),version:B.string(),platform:B.enum(["linux","darwin"]),architecture:B.enum(["arm64","x64"]),enrolled:B.boolean()}),CB=B.strictObject({type:B.literal("ticket-request"),request:B.strictObject({install_id:B.uuid(),code_challenge:B.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:B.enum(["persistent","ephemeral"]),roots:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),execution_mode:B.enum(["confined","host"]),permissions:B.strictObject({read:B.literal(!0),write:B.literal(!0),execute:B.literal(!0),discover_environment:B.literal(!0),expose_mcp:B.literal(!1)})})).length(1)})}),k7=B.discriminatedUnion("type",[B.strictObject({type:B.literal("running"),deviceId:B.string().min(1).max(160),expiresAt:B.iso.datetime({offset:!0}),lifetime:B.enum(["persistent","ephemeral"]),supervision:B.literal("ssh-foreground")}),B.strictObject({type:B.literal("pong")}),B.strictObject({type:B.literal("stopped")})]),IB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function J4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&IB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function y7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
 a=${d3($.remoteCli)}
 [ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
 p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
@@ -101,11 +101,11 @@ elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
 else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
 h=\${h%% *}
 [ "$h" = ${d3($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function y7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,k7($)]}function IB($){return y7($,!1)}function f7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function PB($){let J;try{({stdout:J}=await OB(DB)("/usr/bin/ssh",["-G",...y7($,!0)],{env:f7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
-`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function xB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function EB($){await PB($);let J=jB("/usr/bin/ssh",IB($),{stdio:["pipe","pipe","pipe"],env:f7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=xB(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function SB($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let V=$[G];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let V=J.get(G);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");k7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(K2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function wB($,J,Z,Q,X){let{request:Y}=RB.parse(J4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{G();let N=Z??z1(J),q=await(Q.enrollmentCredentials??O1)(J,N);if(G(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let H=Q.createTicketClient?.(q)??new H1(q,{credentialsPath:N}),U=w4(await H.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([V,new Promise((q,H)=>{if(K=()=>H(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function h7($,J={}){let{config:Z,target:Q,credentialPath:X}=SB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??Y2,G=await(J.sshTransport??EB)(Q),V=new G2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),q,H;if(G.result.then((U)=>{H=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:B2,version:r,config:Z});let U=AB.parse(J4(await V.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await wB(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));q=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:E4)+$4+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=b7.parse(J4(await V.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
-`)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(b7.parse(J4(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=H??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),V.dispose()}}import{createConnection as hB}from"net";import{WebSocket as Z4}from"ws";var bB=1,F$=65536,m7=4096,v7=67108864,g7=4194304,_$=B.uuid(),kB=B.strictObject({kind:B.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:B.literal("install"),generation:B.number().int().positive(),transport:B.literal("reverse_ssh"),expiresAt:B.iso.datetime({offset:!0}),maxDurationMs:B.literal(300000),maxChannels:B.literal(1),allowTcpForwarding:B.literal(!1),allowPty:B.literal(!1)}),yB=B.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var fB=B.strictObject({protocol:B.literal(bB),type:B.literal("ssh_install_relay"),authorityToken:B.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:kB,relayUrl:yB,endpoint:B.strictObject({host:B.literal("127.0.0.1"),port:B.literal(22)})});function p3($,J=Date.now()){let Z=fB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function u7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function d7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var l7="ssh_install_relay_closed";function mB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function vB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function gB($,J=l7){try{$.close(1000,J)}catch{$.terminate()}}async function uB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new Z4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>hB({host:"127.0.0.1",port:22})),G,V=!1,K=!1,N=0,q=0,H,U=(W)=>{if(H)clearTimeout(H);H=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),H.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=l7)=>{if(K)return;if(K=!0,H)clearTimeout(H);if($.signal?.removeEventListener("abort",D),G?.destroy(),X.readyState===Z4.OPEN)gB(X,W);else if(X.readyState!==Z4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=m7&&q<=v7},F=(W)=>{if(K||!V||X.readyState!==Z4.OPEN||X.bufferedAmount>g7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=u7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let R=mB(W);if(R>F$||!z(R))return j();if(!V){if(L)return j();try{let C=d7(JSON.parse(String(W)));if(C.type!=="ssh_install_relay_ready"||C.authorityId!==Z.authority.authorityId)return j();V=!0,U(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",j),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{j()}return}if(!L)return j();let x=vB(W);if(!x||!G||G.destroyed||!G.write(x))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function p7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await uB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as dB}from"crypto";var n1="ARA_WORKER_PREVIEW_PROBE";async function s7(){if(typeof Bun>"u")return 1;let $=dB(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,V){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(n1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,V){if(typeof V!=="string"||V.length>8192){G.close();return}if(!G.data.relay){if(V===n1)G.send(n1);else G.close();return}try{let K=c7(V),N=(q)=>G.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>n1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===n1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(n1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===n1&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
+exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function f7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,y7($)]}function PB($){return f7($,!1)}function h7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function xB($){let J;try{({stdout:J}=await AB(jB)("/usr/bin/ssh",["-G",...f7($,!0)],{env:h7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
+`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function EB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function SB($){await xB($);let J=zB("/usr/bin/ssh",PB($),{stdio:["pipe","pipe","pipe"],env:h7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=EB(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function wB($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let V=$[G];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let V=J.get(G);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");y7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(K2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function bB($,J,Z,Q,X){let{request:Y}=CB.parse(J4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{G();let N=Z??O1(J),q=await(Q.enrollmentCredentials??A1)(J,N);if(G(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let H=Q.createTicketClient?.(q)??new N1(q,{credentialsPath:N}),U=w4(await H.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([V,new Promise((q,H)=>{if(K=()=>H(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function m7($,J={}){let{config:Z,target:Q,credentialPath:X}=wB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??Y2,G=await(J.sshTransport??SB)(Q),V=new G2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),q,H;if(G.result.then((U)=>{H=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:B2,version:r,config:Z});let U=RB.parse(J4(await V.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await bB(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));q=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:E4)+$4+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=k7.parse(J4(await V.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
+`)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(k7.parse(J4(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=H??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),V.dispose()}}import{createConnection as mB}from"net";import{WebSocket as Z4}from"ws";var kB=1,F$=65536,v7=4096,g7=67108864,u7=4194304,_$=B.uuid(),yB=B.strictObject({kind:B.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:B.literal("install"),generation:B.number().int().positive(),transport:B.literal("reverse_ssh"),expiresAt:B.iso.datetime({offset:!0}),maxDurationMs:B.literal(300000),maxChannels:B.literal(1),allowTcpForwarding:B.literal(!1),allowPty:B.literal(!1)}),fB=B.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var hB=B.strictObject({protocol:B.literal(kB),type:B.literal("ssh_install_relay"),authorityToken:B.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:yB,relayUrl:fB,endpoint:B.strictObject({host:B.literal("127.0.0.1"),port:B.literal(22)})});function p3($,J=Date.now()){let Z=hB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function d7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function l7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var p7="ssh_install_relay_closed";function vB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function gB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function uB($,J=p7){try{$.close(1000,J)}catch{$.terminate()}}async function dB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new Z4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>mB({host:"127.0.0.1",port:22})),G,V=!1,K=!1,N=0,q=0,H,U=(W)=>{if(H)clearTimeout(H);H=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),H.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=p7)=>{if(K)return;if(K=!0,H)clearTimeout(H);if($.signal?.removeEventListener("abort",D),G?.destroy(),X.readyState===Z4.OPEN)uB(X,W);else if(X.readyState!==Z4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=v7&&q<=g7},F=(W)=>{if(K||!V||X.readyState!==Z4.OPEN||X.bufferedAmount>u7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=d7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let R=vB(W);if(R>F$||!z(R))return j();if(!V){if(L)return j();try{let C=l7(JSON.parse(String(W)));if(C.type!=="ssh_install_relay_ready"||C.authorityId!==Z.authority.authorityId)return j();V=!0,U(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",j),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{j()}return}if(!L)return j();let x=gB(W);if(!x||!G||G.destroyed||!G.write(x))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function c7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await dB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as lB}from"crypto";var n1="ARA_WORKER_PREVIEW_PROBE";async function a7(){if(typeof Bun>"u")return 1;let $=lB(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,V){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(n1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,V){if(typeof V!=="string"||V.length>8192){G.close();return}if(!G.data.relay){if(V===n1)G.send(n1);else G.close();return}try{let K=s7(V),N=(q)=>G.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>n1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===n1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(n1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===n1&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
 `);else throw Error("probe_protocol_failed")}catch{G.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
-`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as cB,createReadStream as sB,fstatSync as aB,readFileSync as iB}from"fs";var a7="/run/sc/instance-generation";var lB=/^[1-9][0-9]{0,15}\n?$/;function pB($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function i7($){if(typeof $!=="string"||!lB.test($))return null;let J=Number($.trim());return pB(J)?J:null}var n7=3,nB=600000,rB=65536,tB=500;function r7($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(n7))throw Error("worker_standby_invalid_invocation");return{handoffFd:n7}}function oB($=(J)=>iB(J,"utf8")){try{return i7($(a7))}catch{return null}}function eB($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=x4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var t7={isPipe:($)=>aB($).isFIFO(),stream:($)=>{let J=sB("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function $K($,J=t7){if(!J.isPipe($.fd)){try{cB($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??nB),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});G.catch(()=>{});let V=J.every(tB,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],H=0;for await(let U of Q.chunks){if(X)throw X;if(H===0)$.onArriving?.();if(H+=U.length,H>rB)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function o7($,J=t7){let Z=$.readGeneration??(()=>oB()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await $K({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return eB(Y)}var JK=`Usage: reason worker <command> --config PATH [--json]
+`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as sB,createReadStream as aB,fstatSync as iB,readFileSync as nB}from"fs";var i7="/run/sc/instance-generation";var pB=/^[1-9][0-9]{0,15}\n?$/;function cB($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function n7($){if(typeof $!=="string"||!pB.test($))return null;let J=Number($.trim());return cB(J)?J:null}var r7=3,rB=600000,tB=65536,oB=500;function t7($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(r7))throw Error("worker_standby_invalid_invocation");return{handoffFd:r7}}function eB($=(J)=>nB(J,"utf8")){try{return n7($(i7))}catch{return null}}function $K($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=x4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var o7={isPipe:($)=>iB($).isFIFO(),stream:($)=>{let J=aB("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function JK($,J=o7){if(!J.isPipe($.fd)){try{sB($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??rB),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});G.catch(()=>{});let V=J.every(oB,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],H=0;for await(let U of Q.chunks){if(X)throw X;if(H===0)$.onArriving?.();if(H+=U.length,H>tB)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function e7($,J=o7){let Z=$.readGeneration??(()=>eB()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await JK({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return $K(Y)}var ZK=`Usage: reason worker <command> --config PATH [--json]
 
   enroll                        Obtain/redeem a ticket using the current Reason login
   start                         Run the existing Device daemon in the foreground
@@ -146,15 +146,15 @@ Pretrust known_hosts. No agent forwarding, automatic installation or detached se
 SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
 are not forwarded/supported; running is not a browser-readiness receipt.
 Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function ZK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var QK=1e4,XK=2000,e7=15000,YK=50;async function JJ($,J,Z,Q,X,Y){let G=new X2,V=new AbortController,K,N,q=new Promise((x,C)=>{K=x,N=C});if(q.catch(()=>{}),u0(),$.executionMode==="host")Z2();Z("enrollment_started");let H=X(G);H.catch(()=>{});let U=null,M=f2($,J,(x)=>{if(!U)throw Error("worker_starting");return U(x)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((x)=>{z=x}),O=setTimeout(()=>z(),QK);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(x)=>{if(x==="ready")W=setTimeout(()=>z(),XK);Q.onStartup?.(x)},R=i$($,Q.readinessProbes,D,q,void 0,j,F);R.final.catch(()=>{});try{let x;try{x=await H}catch(C){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((I)=>I(),()=>{}),C}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(e7,Date.parse(x.worker?.expiresAt??"")-Date.now()||e7))),K(x.roots[0].permissions),x0($,{version:1,drained:!1,revoked:!1}),await Q2($,x,G,J,{...Q,onStartup:L,prestartedReadiness:R,prestartedControl:{closed:M,handle:(C)=>{U=C}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),V.abort(),G.deleteBinding(),G.deleteKey(),await M.then((x)=>x(),()=>{})}}async function GK($,J,Z,Q){let{handoffFd:X}=r7($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>a$(T);if(K||!M)return;try{u0(),Z2()}catch{return}if(Y=y5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{l2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??o7)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(V,YK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
-`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:H,enrollment:U}=q;try{e(g(H),!0);let M=await ZJ(H,()=>{});try{if(Q("lock_acquired"),t(H))throw Error("worker_ephemeral_requires_fresh_enrollment");return N1(H),await JJ(H,M.owner.nonce,Q,Z,(T)=>X1(H,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function M1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
+`;function QK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var XK=1e4,YK=2000,$J=15000,GK=50;async function ZJ($,J,Z,Q,X,Y){let G=new X2,V=new AbortController,K,N,q=new Promise((x,C)=>{K=x,N=C});if(q.catch(()=>{}),u0(),$.executionMode==="host")Z2();Z("enrollment_started");let H=X(G);H.catch(()=>{});let U=null,M=f2($,J,(x)=>{if(!U)throw Error("worker_starting");return U(x)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((x)=>{z=x}),O=setTimeout(()=>z(),XK);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(x)=>{if(x==="ready")W=setTimeout(()=>z(),YK);Q.onStartup?.(x)},R=i$($,Q.readinessProbes,D,q,void 0,j,F);R.final.catch(()=>{});try{let x;try{x=await H}catch(C){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((I)=>I(),()=>{}),C}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min($J,Date.parse(x.worker?.expiresAt??"")-Date.now()||$J))),K(x.roots[0].permissions),x0($,{version:1,drained:!1,revoked:!1}),await Q2($,x,G,J,{...Q,onStartup:L,prestartedReadiness:R,prestartedControl:{closed:M,handle:(C)=>{U=C}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),V.abort(),G.deleteBinding(),G.deleteKey(),await M.then((x)=>x(),()=>{})}}async function BK($,J,Z,Q){let{handoffFd:X}=t7($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>a$(T);if(K||!M)return;try{u0(),Z2()}catch{return}if(Y=f5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{l2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??e7)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(V,GK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
+`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:H,enrollment:U}=q;try{e(g(H),!0);let M=await QJ(H,()=>{});try{if(Q("lock_acquired"),t(H))throw Error("worker_ephemeral_requires_fresh_enrollment");return U1(H),await ZJ(H,M.owner.nonce,Q,Z,(T)=>J1(H,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function T1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
 `),J.onStartup?.(K)},V={...J,onStartup:G,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(H)=>Math.min($$,Math.max(0,Math.round(H))),N=Y.get("readiness_started"),q=Y.get("readiness_completed");return{service_start_to_heartbeat_ms:K(performance.now()),...N!==void 0&&q!==void 0?{readiness_ms:K(q-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
-`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await s7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await h7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await p7();return await w7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await h2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
-`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await GK($,J,V,G);let K=ZK($);if(!K)return Z.stdout.write(JK),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
-`),H=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!H||!!M,deviceId:H?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:H||M?Date.parse(H?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{N1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":H&&T0(N)instanceof e1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(H||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(KK);return 0}}e(g(N),!0);let U=await ZJ(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")x0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");N1(N);let D=()=>{f0(N),g9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await S4(N,T,O,J.enroll):await $J(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof Q1)||!O.deviceRemoved)throw O;return D(),j()});return m0(F,l(N).state,{proofStore:z}),x0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new J2(J1(N.apiOrigin),k0(N.proxy),T);if(x0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return f0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(N1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await JJ(N,U.owner.nonce,G,V,async(T)=>K.enrollmentPath?S4(N,K.enrollmentPath,T,J.enroll):$J(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Q2(N,M,T0(N),U.owner.nonce,V)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
-`);let q=$.includes("--json")?void 0:B$(K instanceof Q1&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(q)Z.stderr.write(`${q}
-`);return N==="worker_revoked"&&X?0:1}}var BK=60000;async function ZJ($,J){let Z=Date.now()+$.shutdownGraceMs+BK,Q=!1;for(;;){let X=Y1({path:l($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var KK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function $J($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return X1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??z1($),G=await(Z.enrollmentCredentials??O1)($,Y);if(!G)throw Error(X);let V=Z.createTicketClient?.(G)??new H1(G,{credentialsPath:Y,fetchImpl:k0($.proxy)});return v9($,G,V,Q,Z.enroll)}import{spawn as VK}from"child_process";import{existsSync as HK,readFileSync as NK,unlinkSync as UK}from"fs";import{join as qK}from"path";var MK=120,TK=15,_K=5000;function Q4($={}){let J=$.stateDirectory?qK($.stateDirectory,FK):null;if(J)WK(J);let Z=["/bin/bash","/usr/bin/bash"].find((H)=>HK(H));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??MK)),X=$.pid??process.pid,Y=Math.min(TK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${QJ(r)} > ${QJ(J)} 2>/dev/null
+`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await a7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await m7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await c7();return await b7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await h2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
+`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await BK($,J,V,G);let K=QK($);if(!K)return Z.stdout.write(ZK),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
+`),H=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!H||!!M,deviceId:H?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:H||M?Date.parse(H?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{U1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":H&&T0(N)instanceof e1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(H||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(VK);return 0}}e(g(N),!0);let U=await QJ(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
+`)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")x0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");U1(N);let D=()=>{f0(N),u9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await S4(N,T,O,J.enroll):await JJ(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof $1)||!O.deviceRemoved)throw O;return D(),j()});return m0(F,d(N).state,{proofStore:z}),x0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new J2(o0(N.apiOrigin),k0(N.proxy),T);if(x0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return f0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(U1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await ZJ(N,U.owner.nonce,G,V,async(T)=>K.enrollmentPath?S4(N,K.enrollmentPath,T,J.enroll):JJ(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Q2(N,M,T0(N),U.owner.nonce,V)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
+`);let q=$.includes("--json")?void 0:B$(K instanceof $1&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(q)Z.stderr.write(`${q}
+`);return N==="worker_revoked"&&X?0:1}}var KK=60000;async function QJ($,J){let Z=Date.now()+$.shutdownGraceMs+KK,Q=!1;for(;;){let X=Z1({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var VK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function JJ($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return J1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??O1($),G=await(Z.enrollmentCredentials??A1)($,Y);if(!G)throw Error(X);let V=Z.createTicketClient?.(G)??new N1(G,{credentialsPath:Y,fetchImpl:k0($.proxy)});return g9($,G,V,Q,Z.enroll)}import{spawn as HK}from"child_process";import{existsSync as NK,readFileSync as UK,unlinkSync as qK}from"fs";import{join as MK}from"path";var TK=120,_K=15,FK=5000;function Q4($={}){let J=$.stateDirectory?MK($.stateDirectory,WK):null;if(J)LK(J);let Z=["/bin/bash","/usr/bin/bash"].find((H)=>NK(H));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??TK)),X=$.pid??process.pid,Y=Math.min(_K,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${XJ(r)} > ${XJ(J)} 2>/dev/null
 `:"",V=(H)=>`[ $((SECONDS - started)) -ge ${Math.max(1,H-1)} ]`,K=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
 while :; do started=$SECONDS
 IFS= read -r -t ${Q} pulse && continue
@@ -166,8 +166,8 @@ if ${V(Y)} && parent_is_worker; then
   ${G}kill -KILL ${X}
 fi
 exit 0
-done`,N=VK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
-`),Math.min(_K,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var FK="worker-stalled";function QJ($){return`'${$.replaceAll("'","'\\''")}'`}function WK($){let J;try{J=NK($,"utf8"),UK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{g$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var AK=`Share this computer as a machine
+done`,N=HK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
+`),Math.min(FK,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var WK="worker-stalled";function XJ($){return`'${$.replaceAll("'","'\\''")}'`}function LK($){let J;try{J=UK($,"utf8"),qK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{g$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var RK=`Share this computer as a machine
 
 Usage:
   reason serve                     This computer, signed in (machine name: its hostname)
@@ -210,29 +210,29 @@ the worker unless --sandbox is set. Settings live in
 ~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
 folder served for NAME is its own worker. Use
 \`reason worker status|revoke --config <that file>\` for advanced control.
-`,RK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,CK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,BJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",XJ=["REASON_TOKEN","REASON_MACHINE_TOKEN"],KJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&u$(J)&&J!==w2?J:KJ}class Q0 extends Error{}function IK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let H=$[N+1];if(!H||H.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,H),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!u$(Z)&&!RK.test(Z))throw new Q0(BJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!CK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...V===void 0?{}:{org:V.toLowerCase()}}}function B4($,J){let Z=OK($,J??"."),Q;try{Q=GJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!jK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var X4=($)=>r1($,".reason","workers"),c3=($)=>u(l($).state);function PK($,J,Z){let Q=r1(X4($),J);if(C0(r1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return r1(X4($),`${J}@${LK("sha256").update(Z).digest("hex").slice(0,8)}`)}function VJ($){let{stateDirectory:J}=$;if(K2($.workspaceRoot,J)||K2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function C0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function xK($,J){$.stdout.write(`${J} [y/N] `);let Z=await O9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function K4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var EK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function HJ($){try{return await $()}catch(J){let Z=J instanceof G0?EK[J.code]:void 0;throw Z?Error(Z):J}}async function SK($,J,Z,Q){let X=VJ({...J,name:$.name??KJ,stateDirectory:r1(X4(Z),".token-enrollment")}),Y=A1(X,{stored:!1}),G=await HJ(()=>I9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!u$(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??G.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function wK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??O1)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((V)=>new H1(V)))(Y);return m9(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>HJ(async()=>{try{return await G.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
-`)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,V)})})}}async function NJ($,J,Z,Q){let X=await h2($,Q,()=>YJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!_1($,J,Z))return null;return c4($),X}function i3($,J){let Z=X4($);if(!u(Z))return[];let Q=J.toLowerCase();return DK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=r1(Z,X,"worker.json"),V=C0(G);return V?[{path:G,config:V}]:[]})}async function bK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??H0,V=[];for(let K of Y){let N=await G(K.config,"stop")!==null,q=G4(K.config,X),H=N||q!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:H,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
+`,CK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,IK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,KJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",YJ=["REASON_TOKEN","REASON_MACHINE_TOKEN"],VJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&u$(J)&&J!==w2?J:VJ}class Q0 extends Error{}function PK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let H=$[N+1];if(!H||H.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,H),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!u$(Z)&&!CK.test(Z))throw new Q0(KJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!IK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...V===void 0?{}:{org:V.toLowerCase()}}}function B4($,J){let Z=AK($,J??"."),Q;try{Q=BJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!zK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var X4=($)=>r1($,".reason","workers"),c3=($)=>u(d($).state);function xK($,J,Z){let Q=r1(X4($),J);if(I0(r1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return r1(X4($),`${J}@${DK("sha256").update(Z).digest("hex").slice(0,8)}`)}function HJ($){let{stateDirectory:J}=$;if(K2($.workspaceRoot,J)||K2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function I0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function EK($,J){$.stdout.write(`${J} [y/N] `);let Z=await A9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function K4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var SK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function NJ($){try{return await $()}catch(J){let Z=J instanceof G0?SK[J.code]:void 0;throw Z?Error(Z):J}}async function wK($,J,Z,Q){let X=HJ({...J,name:$.name??VJ,stateDirectory:r1(X4(Z),".token-enrollment")}),Y=R1(X,{stored:!1}),G=await NJ(()=>P9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!u$(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??G.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function bK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??A1)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((V)=>new N1(V)))(Y);return v9(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>NJ(async()=>{try{return await G.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
+`)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,V)})})}}async function UJ($,J,Z,Q){let X=await h2($,Q,()=>GJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!F1($,J,Z))return null;return c4($),X}function i3($,J){let Z=X4($);if(!u(Z))return[];let Q=J.toLowerCase();return jK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=r1(Z,X,"worker.json"),V=I0(G);return V?[{path:G,config:V}]:[]})}async function kK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??H0,V=[];for(let K of Y){let N=await G(K.config,"stop")!==null,q=G4(K.config,X),H=N||q!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:H,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
 `);if(!$.json)Z.stdout.write(H?`Stopping machine "${$.name}" in ${K.config.workspaceRoot}; current work finishes first.
 `:`Machine "${$.name}" in ${K.config.workspaceRoot} is not running.
 `)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:V})}
-`);return 0}async function UJ($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??M1,X=J.env??process.env,Y=XJ.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of XJ)delete process.env[G];try{let G=IK($,Y);if(!G)return Z.stdout.write(AK),0;let V=GJ(J.home??V0()),K=J.serviceHost??K1(V);if(G.stop)return await bK({...G,name:G.name},V,Z,J,K);let N=J.channel??P0(),q=B4(J.cwd??process.cwd(),G.dir),H=G.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:G.once,sandbox:G.sandbox},M=G.token?await SK({...G,token:G.token},U,V,J):void 0,T=M?.name??G.name??a3((J.hostname??zK)()),_=PK(V,T,q),D=r1(_,"worker.json"),j=C0(D);if(M&&j&&c3(j)&&$0(j).revoked)f0(j);let z=!M&&j!==null&&c3(j)&&(!b0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=VJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
+`);return 0}async function qJ($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??T1,X=J.env??process.env,Y=YJ.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of YJ)delete process.env[G];try{let G=PK($,Y);if(!G)return Z.stdout.write(RK),0;let V=BJ(J.home??V0()),K=J.serviceHost??Y1(V);if(G.stop)return await kK({...G,name:G.name},V,Z,J,K);let N=J.channel??P0(),q=B4(J.cwd??process.cwd(),G.dir),H=G.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:G.once,sandbox:G.sandbox},M=G.token?await wK({...G,token:G.token},U,V,J):void 0,T=M?.name??G.name??a3((J.hostname??OK)()),_=xK(V,T,q),D=r1(_,"worker.json"),j=I0(D);if(M&&j&&c3(j)&&$0(j).revoked)f0(j);let z=!M&&j!==null&&c3(j)&&(!b0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=HJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
 Run it with: reason serve ${T} ${s3(j)}
 Or remove it first: reason worker revoke --config ${D}`)}let W=F.lifetime==="persistent"?D$(F,K):null;if(W&&!G.service&&X[i1]!==W.label)return Z.stdout.write(`Machine "${T}" in ${q} already runs as a background service (${W.label}).
   Logs: ${W.logs}
   Stop it with: reason stop ${T}
-`),0;if(G.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!u$(T))throw new Q0(BJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
+`),0;if(G.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!u$(T))throw new Q0(KJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
 `);else if(L&&!G.yes&&!M){let C=`Sessions on "${T}" will run commands in ${q} with your user permissions (no sandbox). Continue?`,I=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!I)throw new Q0(`${C.replace(/ Continue\?$/,"")}
-Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>xK(Z,h)))(C))return Z.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!O)e(F.stateDirectory,!0),c(D,F);let R={...J.worker,enrollmentInput:wK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
-`);let I=await Q(["enroll","--config",D],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(I!==0)return I}if(H){let C;try{C=Y4({config:F,launcher:H,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(I){if(!(I instanceof T1))throw I;throw new Q0(`${I.message}
+Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>EK(Z,h)))(C))return Z.stderr.write(`Cancelled. Nothing was added.
+`),1}if(!O)e(F.stateDirectory,!0),c(D,F);let R={...J.worker,enrollmentInput:bK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
+`);let I=await Q(["enroll","--config",D],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(I!==0)return I}if(H){let C;try{C=Y4({config:F,launcher:H,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(I){if(!(I instanceof _1))throw I;throw new Q0(`${I.message}
 This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${s3(F)}
 Or try the background service again with: reason serve ${T} ${s3(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${q}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${C.label} (starts at ${C.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${C.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...C.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
 `)),0}Z.stdout.write([`Reason machine "${T}"`,`  Folder:   ${q}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Lifetime: ${F.lifetime==="persistent"?`saved; run \`reason serve ${T}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
 `));let x=W&&X[i1]===W.label&&!J.runWorker?Q4({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",D],{...R,io:{stdout:Z.stdout,stderr:K4(Z.stderr)},onStartup:(C)=>{if(C==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
-`);J.worker?.onStartup?.(C)}})}finally{x?.stop()}}catch(G){if(G instanceof Q0||G instanceof T1){let N=G instanceof T1&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
+`);J.worker?.onStartup?.(C)}})}finally{x?.stop()}}catch(G){if(G instanceof Q0||G instanceof _1){let N=G instanceof _1&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
 `),2}let V=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:null,K=V?B$(V):void 0;return Z.stderr.write(`Reason: ${V?K?`${K} (${V})`:V:"could not prepare this machine."}
-`),1}}var kK=200;var lL=B.strictObject({version:B.literal(1),session_ids:B.array(B.string().min(1).max(200)).max(kK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as qJ}from"child_process";import{readFileSync as yK,rmdirSync as fK,rmSync as hK}from"fs";import{join as n3}from"path";var mK=["Reason.app","Ara Sidecar.app","Ara Device.app"],vK="sidecar_retire_failed";function gK($){return n3($,"Library","Application Support","Ara","Sidecar")}function uK($){try{let J=yK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function TJ($,J={}){let Z=gK($),Q=mK.map((V)=>n3(Z,V)).filter(uK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>qJ("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),G=J.command??((V,K)=>qJ(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
-`)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)G(MJ,["-u",V]),hK(V,{recursive:!0,force:!0});try{fK(Z)}catch{}}catch{return{status:"failed",code:vK}}return{status:"removed",bundles:Q}}var aK=`Connect this computer to Reason
+`),1}}var yK=200;var pL=B.strictObject({version:B.literal(1),session_ids:B.array(B.string().min(1).max(200)).max(yK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as MJ}from"child_process";import{readFileSync as fK,rmdirSync as hK,rmSync as mK}from"fs";import{join as n3}from"path";var vK=["Reason.app","Ara Sidecar.app","Ara Device.app"],gK="sidecar_retire_failed";function uK($){return n3($,"Library","Application Support","Ara","Sidecar")}function dK($){try{let J=fK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function _J($,J={}){let Z=uK($),Q=vK.map((V)=>n3(Z,V)).filter(dK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>MJ("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),G=J.command??((V,K)=>MJ(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
+`)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)G(TJ,["-u",V]),mK(V,{recursive:!0,force:!0});try{hK(Z)}catch{}}catch{return{status:"failed",code:gK}}return{status:"removed",bundles:Q}}var iK=`Connect this computer to Reason
 
 Usage:
   reason connect                 Your computer, kept connected in the background
@@ -288,7 +288,7 @@ One computer serves several Reason accounts. Signed in as another account than
 the one it is connected for, reason connect connects it for that account too,
 as that account's own computer in the workspace it signed in to; the other
 accounts stay connected. That account's \`reason logout\` removes only its own.
-`,iK=`Disconnect this computer from Reason
+`,nK=`Disconnect this computer from Reason
 
 Usage:
   reason disconnect              Stop your computer's connection and remove it from Reason, in every
@@ -303,41 +303,41 @@ Usage:
                                  Reason (all of it when it is the only account here), and it is not kept
                                  disconnected: the next reason "\u2026" connects it again
   --yes, -y                      Accepted for scripts; disconnect never asks
-`;class p extends Error{}var nK=4,N4={write:()=>!0};function d0($,J,Z=!1){let Q=bJ($,J,Z);return Q.length===1?Q[0]:F0(q2(F0($,".config")),...wJ(J,Z))}var wJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function bJ($,J,Z=!1){let Q=$;try{Q=V1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...wJ(J,Z))).filter(rK)}function rK($){try{if(V1($)!==$)return!1;return C0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var kJ="disconnected.json";function SD($,J){return u(F0(d0($,J),kJ))}function U4($,J,Z){let Q=F0(d0($,J),kJ);if(!Z){z$(Q,{force:!0});return}e($9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function tK($){let J=new Map,Z=new Set;for(let H=0;H<$.length;H+=1){let U=$[H];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",V4,H4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[H+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),H+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(H4)&&!J.has(V4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((H)=>J.has(H));if(Y.length>0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(H,U)=>U===void 0?{}:{[H]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",G===void 0?void 0:G==="on"),...q("cloudSessions",V===void 0?void 0:V==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(V4)),...q("proxyCaFile",J.get(H4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var I1=($)=>u(l($).state),yJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function fJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function oK($){return $===1?"one at a time":`up to ${$} at once`}function hJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=B4($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!E$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!b0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!DJ(X)&&!LJ($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=OJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof jJ))throw V;throw new p(V.message)}let G=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??cK)()),slots:J.sessions??Z?.slots??nK,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function mJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function J9($,J,Z,Q,X){if($0($).revoked){if(I1($))try{f0($)}catch{}y4($);let Y=[];try{Y=pK(g($))}catch{}for(let G of Y)if(G!=="workspaces")z$(F0(g($),G),{recursive:!0,force:!0})}else if(I1($))f0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??M1)(["enroll","--config",J],{...Z9(Q.worker,X),io:{stdout:N4,stderr:Z.stderr}})}function V2($,J,Z){let Q=P$(Z1(k$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function eK($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),G=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=C0(Y)}catch{}if(G(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let K=await J9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&I1(X))await q4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function Z9($,J){return J?{...$,enrollmentCredentials:(Z)=>A4(Z,J)}:{...$}}async function Q9($,J,Z,Q,X,Y="connect"){if(await X9($,Q,X,Y),Y==="connect"&&!await pJ($,Z,Q))return!1;if(!await q4($,J,Z,Q))return!1;return E9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function q4($,J,Z,Q){if(!I1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??M1)(["revoke","--config",J],{...Q.worker,io:{stdout:N4,stderr:Y?Z.stderr:N4}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function X9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,G=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&G4($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((q)=>setTimeout(q,250))}}function Y9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...Y9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${fJ($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
-`)}function t3($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${oK(J.slots)}`,`  Mode:      ${fJ(J)}`,...J.proxy?[`  Proxy:     ${zJ(J.proxy)}`]:[],...Y9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
-`)}async function _J($,J,Z){let{io:Q,options:X}=Z;if(bJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:$9(J),timestamp:new Date().toISOString()})}
+`;class p extends Error{}var rK=4,N4={write:()=>!0};function d0($,J,Z=!1){let Q=kJ($,J,Z);return Q.length===1?Q[0]:F0(q2(F0($,".config")),...bJ(J,Z))}var bJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function kJ($,J,Z=!1){let Q=$;try{Q=G1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...bJ(J,Z))).filter(tK)}function tK($){try{if(G1($)!==$)return!1;return I0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var yJ="disconnected.json";function wD($,J){return u(F0(d0($,J),yJ))}function U4($,J,Z){let Q=F0(d0($,J),yJ);if(!Z){z$(Q,{force:!0});return}e($9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function oK($){let J=new Map,Z=new Set;for(let H=0;H<$.length;H+=1){let U=$[H];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",V4,H4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[H+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),H+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(H4)&&!J.has(V4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((H)=>J.has(H));if(Y.length>0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(H,U)=>U===void 0?{}:{[H]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",G===void 0?void 0:G==="on"),...q("cloudSessions",V===void 0?void 0:V==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(V4)),...q("proxyCaFile",J.get(H4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var P1=($)=>u(d($).state),fJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function hJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function eK($){return $===1?"one at a time":`up to ${$} at once`}function mJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=B4($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!E$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!b0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!jJ(X)&&!DJ($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=AJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof zJ))throw V;throw new p(V.message)}let G=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??sK)()),slots:J.sessions??Z?.slots??rK,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function vJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function J9($,J,Z,Q,X){if($0($).revoked){if(P1($))try{f0($)}catch{}y4($);let Y=[];try{Y=cK(g($))}catch{}for(let G of Y)if(G!=="workspaces")z$(F0(g($),G),{recursive:!0,force:!0})}else if(P1($))f0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??T1)(["enroll","--config",J],{...Z9(Q.worker,X),io:{stdout:N4,stderr:Z.stderr}})}function V2($,J,Z){let Q=P$(e0(k$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function $V($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),G=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=I0(Y)}catch{}if(G(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let K=await J9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&P1(X))await q4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function Z9($,J){return J?{...$,enrollmentCredentials:(Z)=>A4(Z,J)}:{...$}}async function Q9($,J,Z,Q,X,Y="connect"){if(await X9($,Q,X,Y),Y==="connect"&&!await cJ($,Z,Q))return!1;if(!await q4($,J,Z,Q))return!1;return S9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function q4($,J,Z,Q){if(!P1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??T1)(["revoke","--config",J],{...Q.worker,io:{stdout:N4,stderr:Y?Z.stderr:N4}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function X9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,G=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&G4($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((q)=>setTimeout(q,250))}}function Y9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...Y9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${hJ($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
+`)}function t3($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${eK(J.slots)}`,`  Mode:      ${hJ(J)}`,...J.proxy?[`  Proxy:     ${OJ(J.proxy)}`]:[],...Y9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
+`)}async function FJ($,J,Z){let{io:Q,options:X}=Z;if(kJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:$9(J),timestamp:new Date().toISOString()})}
 `);let Y=E2(F0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
-`);f3(Z.home,Z.host.platform);let G=P8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(U)=>Q.stderr.write(`${U}
-`),host:Z.host}),V=D8({...G,log:(U)=>Q.stderr.write(`${U}
+`);f3(Z.home,Z.host.platform);let G=x8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(U)=>Q.stderr.write(`${U}
+`),host:Z.host}),V=j8({...G,log:(U)=>Q.stderr.write(`${U}
 `)}),{configPath:K}=V,N=V.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let q=(U,M)=>{let T=T4(Z.home,Z.channel),_;try{let j=null;try{j=M.keep?null:t(N)?.orgId.toLowerCase()??null}catch{}if(_=O2(N,{prefer:V2(Z.home,Z.channel,N),...M}),_&&j)z2(_,j)}finally{T()}if(!_)return!1;N=_;let D="";try{D=` (workspace ${t(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${U}; this computer goes on running Sessions for its other Reason account${D}.
-`),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=p0(N.stateDirectory)??void 0,M=U?null:V2(Z.home,Z.channel,N);if(!U&&!(M&&f$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let H=N.executionMode==="confined";if(H||!j$(N)){let U=p0(N.stateDirectory)??void 0;if(Q.stderr.write(H?yJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
-`),await J9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=p0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Q4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??M1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return U4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function $V($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=d0(Y,G,!0),N=hJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),q=mJ(N,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),H=F0(K,"worker.json");return e(K,!0),c(H,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M1)(["start","--config",H],{...Z9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:K4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
-`);X.worker?.onStartup?.(U)}})}function JV($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),w8(l(J).daemon,$);let X=S2(l(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var ZV=B.object({root:B.object({id:B.string().min(1).max(160),label:B.string().max(160),path_fingerprint:B.string()})});async function vJ($,J,Z,Q){let X=await(Z9(Q.worker,Z).enrollmentCredentials??O1)($,z1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new H1(X,{credentialsPath:z1($),fetchImpl:k0($.proxy)}),G=(V)=>V instanceof G0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=u9($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((H)=>{if(G(H))throw Error("worker_folders_unavailable");if(H instanceof G0&&H.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw H}),q=ZV.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function gJ($,J,Z){m0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},l($).state,{proofStore:T0($)})}async function uJ($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(Q.home,Q.channel,J):null,K=J&&V&&I1(J)&&!f$(J,V)?h0(J).find((C)=>C.account&&C.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,H=N&&I1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!H||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=B4(T,M)}catch(C){if(U)throw new p(C instanceof Error?C.message:String(C));_=sK(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=H.roots.slice(1).find((C)=>C.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!E$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??p0(N.stateDirectory)??void 0,F=await vJ(N,H,z,Y),O=H.roots.filter((C)=>C.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);gJ(N,H,O);let W=U?[...D.filter((C)=>C!==_),_]:D.filter((C)=>C!==_),{folders:L,...R}=N;if(c(q,J0.parse({...R,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))_1(J,G,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
+`),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=l0(N.stateDirectory)??void 0,M=U?null:V2(Z.home,Z.channel,N);if(!U&&!(M&&f$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let H=N.executionMode==="confined";if(H||!j$(N)){let U=l0(N.stateDirectory)??void 0;if(Q.stderr.write(H?fJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
+`),await J9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=l0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Q4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??T1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return U4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function JV($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=d0(Y,G,!0),N=mJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),q=vJ(N,Z.apiKey??(J?l0(J.stateDirectory)??void 0:void 0)),H=F0(K,"worker.json");return e(K,!0),c(H,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??T1)(["start","--config",H],{...Z9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:K4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
+`);X.worker?.onStartup?.(U)}})}function ZV($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),b8(d(J).daemon,$);let X=S2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
+`),0}var QV=B.object({root:B.object({id:B.string().min(1).max(160),label:B.string().max(160),path_fingerprint:B.string()})});async function gJ($,J,Z,Q){let X=await(Z9(Q.worker,Z).enrollmentCredentials??A1)($,O1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new N1(X,{credentialsPath:O1($),fetchImpl:k0($.proxy)}),G=(V)=>V instanceof G0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=d9($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((H)=>{if(G(H))throw Error("worker_folders_unavailable");if(H instanceof G0&&H.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw H}),q=QV.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function uJ($,J,Z){m0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:T0($)})}async function dJ($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&l0(J.stateDirectory)===null?V2(Q.home,Q.channel,J):null,K=J&&V&&P1(J)&&!f$(J,V)?h0(J).find((C)=>C.account&&C.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,H=N&&P1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!H||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=B4(T,M)}catch(C){if(U)throw new p(C instanceof Error?C.message:String(C));_=aK(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=H.roots.slice(1).find((C)=>C.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!E$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??l0(N.stateDirectory)??void 0,F=await gJ(N,H,z,Y),O=H.roots.filter((C)=>C.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);uJ(N,H,O);let W=U?[...D.filter((C)=>C!==_),_]:D.filter((C)=>C!==_),{folders:L,...R}=N;if(c(q,J0.parse({...R,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))F1(J,G,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
 `:`Removed ${_}. Sessions on "${N.name}" no longer run in it.
-`),0}async function wD($,J,Z){let Q=o3(Z),X=T4(Q.home,Q.channel);try{let Y=F0(d0(Q.home,Q.channel),"worker.json");return await uJ({once:!1,yes:J,addFolder:$},C0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=V1($.home??V0()),Q=$.env??process.env;return{io:$.io??M4(),options:$,home:Z,channel:$.channel??P0(),environment:Q,apiKey:J??z4(Q),host:$.serviceHost??K1(Z)}}async function QV($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await vJ($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}gJ(J,X,Y)}var dJ=Symbol("serve here");async function XV($,J,Z,Q){let{io:X,options:Y,home:G,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let P=TJ(G);if(P.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${P.code}).
-`)}let q=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(G,V,J):null,H=J&&q&&$0(J).revoked&&h0(J).some((P)=>P.account&&P.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=hJ({parsed:$,saved:H,stateDirectory:d0(G,V),lifetime:"persistent",home:G,channel:V,options:Y,environment:K});if(U4(G,V,!1),H?.executionMode==="confined")X.stdout.write(yJ);let M=H?p0(H.stateDirectory):null,T=mJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=H!==null&&I1(H),j=D&&U0(H)===U0(T),z=j&&j$(T),F=H?.userChrome!==!1===(T.userChrome!==!1)&&H?.cloudSessions===T.cloudSessions&&H?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(H).revoked&&!f$(H,q);if(W){if(!j||!F||JSON.stringify(H.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let P=await eK(H,q,X,Y);if(P!==0)return P}let L=W?[`  Account:   yours too, in workspace ${q}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await A4(T,$.apiKey),O4(T.stateDirectory,$.apiKey)},x=K.PATH||"/usr/local/bin:/usr/bin:/bin",C=z&&JSON.stringify(H?.proxy)===JSON.stringify(T.proxy)&&F?D$(T,N,"connect"):null,I=C?.label===RJ(T.channel),h=I&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)!==null,S=I&&!h&&e3(C,N)&&PJ({config:T,launcher:_,path:x,host:N,kind:"connect"});if((h||S)&&[null,r].includes(d$(T))){await R();let P=IJ(T,N,"connect");if(P==="retired"){let E=S?null:await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!S&&(!E||E.phase==="stopping"))_1(T,N,"connect")}else if(P==="current_not_running")_1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let f=!z&&!W;if(D&&!j)if(H.apiOrigin!==T.apiOrigin||H.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),0}async function bD($,J,Z){let Q=o3(Z),X=T4(Q.home,Q.channel);try{let Y=F0(d0(Q.home,Q.channel),"worker.json");return await dJ({once:!1,yes:J,addFolder:$},I0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=G1($.home??V0()),Q=$.env??process.env;return{io:$.io??M4(),options:$,home:Z,channel:$.channel??P0(),environment:Q,apiKey:J??z4(Q),host:$.serviceHost??Y1(Z)}}async function XV($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await gJ($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}uJ(J,X,Y)}var lJ=Symbol("serve here");async function YV($,J,Z,Q){let{io:X,options:Y,home:G,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let P=_J(G);if(P.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${P.code}).
+`)}let q=J&&!Q.apiKey&&l0(J.stateDirectory)===null?V2(G,V,J):null,H=J&&q&&$0(J).revoked&&h0(J).some((P)=>P.account&&P.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=mJ({parsed:$,saved:H,stateDirectory:d0(G,V),lifetime:"persistent",home:G,channel:V,options:Y,environment:K});if(U4(G,V,!1),H?.executionMode==="confined")X.stdout.write(fJ);let M=H?l0(H.stateDirectory):null,T=vJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=H!==null&&P1(H),j=D&&U0(H)===U0(T),z=j&&j$(T),F=H?.userChrome!==!1===(T.userChrome!==!1)&&H?.cloudSessions===T.cloudSessions&&H?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(H).revoked&&!f$(H,q);if(W){if(!j||!F||JSON.stringify(H.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let P=await $V(H,q,X,Y);if(P!==0)return P}let L=W?[`  Account:   yours too, in workspace ${q}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await A4(T,$.apiKey),O4(T.stateDirectory,$.apiKey)},x=K.PATH||"/usr/local/bin:/usr/bin:/bin",C=z&&JSON.stringify(H?.proxy)===JSON.stringify(T.proxy)&&F?D$(T,N,"connect"):null,I=C?.label===CJ(T.channel),h=I&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)!==null,S=I&&!h&&e3(C,N)&&xJ({config:T,launcher:_,path:x,host:N,kind:"connect"});if((h||S)&&[null,r].includes(d$(T))){await R();let P=PJ(T,N,"connect");if(P==="retired"){let E=S?null:await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!S&&(!E||E.phase==="stopping"))F1(T,N,"connect")}else if(P==="current_not_running")F1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let f=!z&&!W;if(D&&!j)if(H.apiOrigin!==T.apiOrigin||H.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
 `),!await Q9(H,Z,X,Y,N))throw new p("Could not remove this computer's previous connection from Reason. Check your network and try again.")}else if(H.executionMode==="host"&&j$(H))X.stdout.write(`Applying the new settings to this computer\u2026
-`),await QV(H,T,O,Y),f=!1;else await X9(H,Y,N);if(f){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
-`);let P=await J9(T,Z,X,Y,O);if(P!==0)return P;if(O)O4(T.stateDirectory,O)}else c(Z,T),await R();let d;try{d=Y4({config:T,launcher:_,path:x,host:N,kind:"connect"})}catch(P){if(!(P instanceof T1))throw P;if(P.code!=="worker_service_manager_missing")throw new p(`${P.message}
+`),await XV(H,T,O,Y),f=!1;else await X9(H,Y,N);if(f){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
+`);let P=await J9(T,Z,X,Y,O);if(P!==0)return P;if(O)O4(T.stateDirectory,O)}else c(Z,T),await R();let l;try{l=Y4({config:T,launcher:_,path:x,host:N,kind:"connect"})}catch(P){if(!(P instanceof _1))throw P;if(P.code!=="worker_service_manager_missing")throw new p(`${P.message}
 This computer is set up; run reason connect again to start it.`);if(Y.serveHere&&K.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),dJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await YV(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new T1(`${P.message}
-This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,P.code)}let b=[...L,...d.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...d.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${d.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,b):t3("This computer is connected to Reason",T,N.platform,[`  Service:   ${d.label} (starts at ${d.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${d.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...b])),0}async function YV($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??lJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function lJ($,J,Z){let Q=SJ(Z,"a",384);try{let X=xJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{EJ(Q)}}async function pJ($,J,Z,Q=!1){let X=!0;for(let Y of h0($)){if(Q&&Y.account)continue;if(Y.config&&I1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??M1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:N4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function M4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function G9($,J){if($ instanceof p||$ instanceof T1){let X=$ instanceof T1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
+`),lJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await GV(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new _1(`${P.message}
+This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,P.code)}let k=[...L,...l.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...l.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${l.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,k):t3("This computer is connected to Reason",T,N.platform,[`  Service:   ${l.label} (starts at ${l.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${l.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...k])),0}async function GV($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??pJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function pJ($,J,Z){let Q=wJ(Z,"a",384);try{let X=EJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{SJ(Q)}}async function cJ($,J,Z,Q=!1){let X=!0;for(let Y of h0($)){if(Q&&Y.account)continue;if(Y.config&&P1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??T1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:N4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function M4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function G9($,J){if($ instanceof p||$ instanceof _1){let X=$ instanceof _1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
 `),2}let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:null,Q=Z?B$(Z):void 0;return J.stderr.write(`Reason: ${Z?Q?`${Q} (${Z})`:Z:"could not connect this computer."}
-`),1}function FJ($,J){if($.minimal){sJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||aJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??WJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
+`),1}function WJ($,J){if($.minimal){aJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||iJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??LJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
 `);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let Q=(J.options.installDesktop??WJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function WJ($,J,Z){if(!Z)return dK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;lK($9(Z.log),{recursive:!0,mode:448});let Q=SJ(Z.log,"w",384);try{let X=xJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{EJ(Q)}return 0}async function bD($,J={}){let Z=J.io??M4();try{let Q=tK($);if(!Q)return Z.stdout.write(aK),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return FJ(Q,o3(J)),await(J.runServe??UJ)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=CJ(G[i1],Y),K=V||Q.once?()=>{return}:T4(X.home,Y);try{let N=F0(d0(X.home,Y),"worker.json"),q=C0(N);if(V)return await _J(q,N,X);if(Q.keepAwake!==void 0)return JV(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await uJ(Q,q,N,X);if(FJ(Q,X),Q.once)return await $V(Q,q,X);let H=await XV(Q,q,N,X);if(H!==dJ)return H;return K(),K=()=>{return},await _J(C0(N),N,X)}finally{K()}}catch(Q){return G9(Q,Z)}}async function kD($,J={}){let Z=J.io??M4();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(iK),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await KV(Q[0],Z,J);return await cJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return G9(Q,Z)}}async function yD($={}){let J=$.io??M4();try{return await cJ(J,$,"logout")}catch(Z){return G9(Z,J)}}async function cJ($,J,Z){let Q=V1(J.home??V0()),X=J.channel??P0(),Y=T4(Q,X);try{return await GV($,J,Z,Q,X)}finally{Y()}}function T4($,J){let Z=d0($,J),Q=u(Z)?Y$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function GV($,J,Z,Q,X){let Y=F0(d0(Q,X),"worker.json"),G=C0(Y);if(!G){if(Z==="disconnect")U4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(Z!=="disconnect"){let K=await BV(G,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await Q9(G,Y,$,J,J.serviceHost??K1(Q))}finally{if(Z!=="temporary")U4(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`);let Q=(J.options.installDesktop??LJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
+`)}function LJ($,J,Z){if(!Z)return lK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;pK($9(Z.log),{recursive:!0,mode:448});let Q=wJ(Z.log,"w",384);try{let X=EJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{SJ(Q)}return 0}async function kD($,J={}){let Z=J.io??M4();try{let Q=oK($);if(!Q)return Z.stdout.write(iK),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return WJ(Q,o3(J)),await(J.runServe??qJ)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=IJ(G[i1],Y),K=V||Q.once?()=>{return}:T4(X.home,Y);try{let N=F0(d0(X.home,Y),"worker.json"),q=I0(N);if(V)return await FJ(q,N,X);if(Q.keepAwake!==void 0)return ZV(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await dJ(Q,q,N,X);if(WJ(Q,X),Q.once)return await JV(Q,q,X);let H=await YV(Q,q,N,X);if(H!==lJ)return H;return K(),K=()=>{return},await FJ(I0(N),N,X)}finally{K()}}catch(Q){return G9(Q,Z)}}async function yD($,J={}){let Z=J.io??M4();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(nK),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await VV(Q[0],Z,J);return await sJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return G9(Q,Z)}}async function fD($={}){let J=$.io??M4();try{return await sJ(J,$,"logout")}catch(Z){return G9(Z,J)}}async function sJ($,J,Z){let Q=G1(J.home??V0()),X=J.channel??P0(),Y=T4(Q,X);try{return await BV($,J,Z,Q,X)}finally{Y()}}function T4($,J){let Z=d0($,J),Q=u(Z)?Y$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function BV($,J,Z,Q,X){let Y=F0(d0(Q,X),"worker.json"),G=I0(Y);if(!G){if(Z==="disconnect")U4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(Z!=="disconnect"){let K=await KV(G,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await Q9(G,Y,$,J,J.serviceHost??Y1(Q))}finally{if(Z!=="temporary")U4(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
 `),1;return $.stdout.write(`Disconnected "${G.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function BV($,J,Z,Q,X,Y,G){let V=h0($).filter((D)=>D.account);if(V.length===0)return null;let K=V2(Y,G,$),N=Q.controlWorker??H0,q=V.find((D)=>D.organizationId===K);if(q){if(q.config&&!await q4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),0}async function KV($,J,Z,Q,X,Y,G){let V=h0($).filter((D)=>D.account);if(V.length===0)return null;let K=V2(Y,G,$),N=Q.controlWorker??H0,q=V.find((D)=>D.organizationId===K);if(q){if(q.config&&!await q4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
 `),1;if(X!=="account"||!q.config)z$(q.directory,{recursive:!0,force:!0});return await N($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${K} for your account. It stays connected for its other Reason accounts.
 `),0}if(!K&&X==="account")throw new p("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!K||!f$($,K)){if(X==="account"&&K)z2($,K);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let H=Q.serviceHost??K1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await X9($,Q,H,"connect",!0),!await pJ($,Z,Q,!0)||!await q4($,J,Z,Q))return _1($,H,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
-`),1;let M=O2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&U)z2(M,U);let T=_1(M,H,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
-`),0}async function KV($,J,Z){let Q=V1(Z.home??V0()),X=Z.serviceHost??K1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let V of Y)if(await Q9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
+`);return 0}let H=Q.serviceHost??Y1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await X9($,Q,H,"connect",!0),!await cJ($,Z,Q,!0)||!await q4($,J,Z,Q))return F1($,H,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`),1;let M=O2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&U)z2(M,U);let T=F1(M,H,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
+`),0}async function VV($,J,Z){let Q=G1(Z.home??V0()),X=Z.serviceHost??Y1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let V of Y)if(await Q9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
 `);else G=!0,J.stderr.write(`Reason: machine "${$}" in ${V.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
-`);return G?1:0}async function fD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??H0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?d$(Z):null,G=$.serviceHost??K1(J),V=D$(Z,G,"connect"),K=$0(Z).revoked,N=!K&&!X,q=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:H,off:U}=K||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:i9(Z,X?.phase==="running");return{workspaces:H,workspaces_off:U,workspaces_max:L2+(H?.filter((M)=>M.account).length??0),name:Z.name,device_id:q?.deviceId??null,organization_id:q?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:Y9(Z,G.platform),cloud_sessions:Z.cloudSessions===!0,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,roots:q?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?d8(Z,Q):null,worker_alive:N&&V?e3(V,G):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function hD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=C0(F0(d0(V1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?AJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function mD($={}){try{let J=V1($.home??V0());return C0(F0(d0(J,$.channel??P0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function vD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;return _1(Z,$.serviceHost??K1(J),"connect")?.label??null}async function gD($={}){let J=V1($.home??V0()),Z=C0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??K1(J),X=await NJ(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return VV(Z,Q,$)}async function VV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&d$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((H)=>setTimeout(H,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??lJ)(G,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
-export{Z1 as a,H1 as b,P9 as c,l as d,S2 as e,C0 as f,aK as g,iK as h,d0 as i,SD as j,wD as k,bD as l,kD as m,yD as n,fD as o,hD as p,mD as q,vD as r,gD as s};
+`);return G?1:0}async function hD($={}){let J=G1($.home??V0()),Z=I0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??H0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?d$(Z):null,G=$.serviceHost??Y1(J),V=D$(Z,G,"connect"),K=$0(Z).revoked,N=!K&&!X,q=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:H,off:U}=K||l0(Z.stateDirectory)!==null?{workspaces:null,off:null}:n9(Z,X?.phase==="running");return{workspaces:H,workspaces_off:U,workspaces_max:L2+(H?.filter((M)=>M.account).length??0),name:Z.name,device_id:q?.deviceId??null,organization_id:q?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:Y9(Z,G.platform),cloud_sessions:Z.cloudSessions===!0,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,roots:q?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?l8(Z,Q):null,worker_alive:N&&V?e3(V,G):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function mD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=I0(F0(d0(G1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?RJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function vD($={}){try{let J=G1($.home??V0());return I0(F0(d0(J,$.channel??P0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function gD($={}){let J=G1($.home??V0()),Z=I0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;return F1(Z,$.serviceHost??Y1(J),"connect")?.label??null}async function uD($={}){let J=G1($.home??V0()),Z=I0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??Y1(J),X=await UJ(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return HV(Z,Q,$)}async function HV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&d$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((H)=>setTimeout(H,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??pJ)(G,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
+export{e0 as a,N1 as b,x9 as c,d,S2 as e,I0 as f,iK as g,nK as h,d0 as i,wD as j,bD as k,kD as l,yD as m,fD as n,hD as o,mD as p,vD as q,gD as r,uD as s};