@reason-machines/cli-linux-arm64-musl 0.2.283 → 0.2.285

package/bin/vm-hands/{vm-hands-entry-lite-2yne3ped.js → vm-hands-entry-lite-xrjy8dwy.js}

@@ -1,14 +1,14 @@
 // @bun
-import{Ab as W9,Bb as u0,Ib as z0,wb as WQ,xb as Z8,yb as u9,zb as q0}from"./vm-hands-entry-lite-8kqg77ym.js";import{Qb as PQ,Rb as IQ,Sb as rZ,Tb as tZ,Ub as G8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as R0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Bd as N0,Oc as a$,Rc as o$,ud as R9,vd as n0,wd as H8,xd as w0}from"./vm-hands-entry-lite-yh7n4svm.js";import{ae as I}from"./vm-hands-entry-lite-m5pmd2cz.js";import{Ke as kQ,Le as f8,Ze as wQ,df as s9,ef as w8}from"./vm-hands-entry-lite-k1wbh9dq.js";import{Af as x8,Df as c9,Lf as A8,Mf as P0,Nf as j0,Of as d9,Vf as R8,Wf as $Q,Xf as l$,gf as WZ,jf as F9,sf as r$,tf as t$,vf as e$,xf as v9,yf as p$,zf as u$}from"./vm-hands-entry-lite-53jm8bj7.js";import{Xg as aZ}from"./vm-hands-entry-lite-qbk0wxrz.js";import{Zg as U8,_g as p9,bh as iZ}from"./vm-hands-entry-lite-vvmq0mtv.js";import{ch as F8,dh as l0,eh as W8,fh as s0,gh as K9,hh as Q8,ih as r8,jh as p0,kh as v0,lh as d$,vh as F$}from"./vm-hands-entry-lite-kxbpf40y.js";import{Ah as JZ}from"./vm-hands-entry-lite-9jdxjw46.js";import{Gh as oZ}from"./vm-hands-entry-lite-y9k070mt.js";import{Ih as C}from"./vm-hands-entry-lite-wffqkcjq.js";import{Jh as L1,Mh as ZZ}from"./vm-hands-entry-lite-ss2w3h3d.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000};function g9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function g0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function I$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function _0($){if(!g9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(I$)||!g0($.attachmentRevision,0)||!g0($.grantRevision,1)||!g0($.generation,1)||!g0($.port,1024,65535)||!g0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function y0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function M9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function P$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function N9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function R$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function E$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!g9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello"){let Z=_0(Q.binding);return g0(Q.messages,v.chunk,v.upload)?{type:"hello",binding:Z,messages:Q.messages}:{type:"hello",binding:Z}}if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:_0(Q.binding),reason:Q.reason};if(!I$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return N9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&g0(Q.status,200,599)&&P$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&P$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return N9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:M9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function T8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((G)=>G.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function O8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function j9($){return await O8($)===!0}function y9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function S$($){if(!g9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:_0($.binding),deviceRelayUrl:y9($.deviceRelayUrl,"device")}}function w$($){if(!g9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:_0($.binding)}}import{request as B4}from"http";import{WebSocket as C9}from"ws";import{randomBytes as F4,timingSafeEqual as W4}from"crypto";import{createServer as U4}from"net";var b$="x-preview-connection";async function k$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=F4(32).toString("base64url"),X=new Set,J=!1,G=U4((Y)=>{if(J||Q.aborted||X.size>=v.streams*2)return Y.destroy();X.add(Y);let H=new AbortController;Y.once("close",()=>{X.delete(Y),H.abort()}),Y.on("error",()=>Y.destroy()),Y.setTimeout(2000,()=>Y.destroy());let W=Buffer.alloc(0),F=(L)=>{W=Buffer.concat([W,L]);let B=W.indexOf(`\r
+import{Ab as U9,Bb as u0,Ib as z0,wb as UQ,xb as Z8,yb as u9,zb as q0}from"./vm-hands-entry-lite-8kqg77ym.js";import{Qb as PQ,Rb as IQ,Sb as rZ,Tb as tZ,Ub as G8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as E0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Bd as N0,Oc as a$,Rc as o$,ud as R9,vd as n0,wd as V8,xd as b0}from"./vm-hands-entry-lite-yh7n4svm.js";import{ae as I}from"./vm-hands-entry-lite-m5pmd2cz.js";import{Ke as kQ,Le as f8,Ze as wQ,df as s9,ef as w8}from"./vm-hands-entry-lite-k1wbh9dq.js";import{Af as x8,Df as c9,Lf as A8,Mf as I0,Nf as j0,Of as d9,Vf as R8,Wf as $Q,Xf as l$,gf as UZ,jf as F9,sf as r$,tf as t$,vf as e$,xf as v9,yf as p$,zf as u$}from"./vm-hands-entry-lite-53jm8bj7.js";import{Xg as aZ}from"./vm-hands-entry-lite-qbk0wxrz.js";import{Zg as W8,_g as p9,bh as iZ}from"./vm-hands-entry-lite-vvmq0mtv.js";import{ch as F8,dh as l0,eh as U8,fh as s0,gh as K9,hh as Q8,ih as r8,jh as p0,kh as v0,lh as d$,vh as F$}from"./vm-hands-entry-lite-kxbpf40y.js";import{Ah as JZ}from"./vm-hands-entry-lite-mmp3qgtk.js";import{Gh as oZ}from"./vm-hands-entry-lite-y9k070mt.js";import{Ih as C}from"./vm-hands-entry-lite-wffqkcjq.js";import{Jh as L1,Mh as ZZ}from"./vm-hands-entry-lite-ss2w3h3d.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function g9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function _0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function I$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function A0($){if(!g9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(I$)||!_0($.attachmentRevision,0)||!_0($.grantRevision,1)||!_0($.generation,1)||!_0($.port,1024,65535)||!_0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function y0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function M9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function P$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function N9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function R$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function E$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!g9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello")return{type:"hello",binding:A0(Q.binding),..._0(Q.messages,v.chunk,v.upload)?{messages:Q.messages}:{},..._0(Q.window,1,v.window)?{window:Q.window}:{}};if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:A0(Q.binding),reason:Q.reason};if(!I$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return N9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&_0(Q.status,200,599)&&P$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&P$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return N9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:M9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function T8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((G)=>G.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function O8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function j9($){return await O8($)===!0}function y9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function S$($){if(!g9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:A0($.binding),deviceRelayUrl:y9($.deviceRelayUrl,"device")}}function w$($){if(!g9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:A0($.binding)}}import{request as B4}from"http";import{WebSocket as C9}from"ws";import{randomBytes as F4,timingSafeEqual as U4}from"crypto";import{createServer as W4}from"net";var b$="x-preview-connection";async function k$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=F4(32).toString("base64url"),X=new Set,J=!1,G=W4((Y)=>{if(J||Q.aborted||X.size>=v.streams*2)return Y.destroy();X.add(Y);let V=new AbortController;Y.once("close",()=>{X.delete(Y),V.abort()}),Y.on("error",()=>Y.destroy()),Y.setTimeout(2000,()=>Y.destroy());let U=Buffer.alloc(0),F=(L)=>{U=Buffer.concat([U,L]);let B=U.indexOf(`\r
 \r
-`);if(B<0){if(W.length>16384)Y.destroy();return}if(Y.pause(),Y.off("data",F),B>16384||W.length>v.upload+16384)return Y.destroy();K(W,B).catch(()=>Y.destroy())};Y.on("data",F);async function K(L,B){let U=L.subarray(0,B).toString("latin1").split(`\r
-`),M=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(U.shift()??"");if(!M)throw Error("preview_request_invalid");M9(M[2]);let _=!1,q=0,D=[];for(let T of U){let k=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!k)throw Error("preview_header_invalid");if(k[1].toLowerCase()===b$){q++;let g=Buffer.from(k[2].trim());_=g.length===Z.length&&W4(g,Buffer.from(Z))}else if(k[1].toLowerCase()!=="host")D.push(T)}if(!_||q!==1||J||H.signal.aborted)throw Error("preview_connection_denied");let x=await $.connect(H.signal);if(J||H.signal.aborted)throw x.destroy(),Error("preview_closed");X.add(x),x.on("error",()=>Y.destroy()),x.once("close",()=>{X.delete(x),Y.destroy()}),Y.once("close",()=>x.destroy()),Y.setTimeout(0);let b=[`${M[1]} ${M[2]} HTTP/1.1`,`Host: 127.0.0.1:${x.remotePort}`,...D,"",""].join(`\r
-`);x.write(Buffer.concat([Buffer.from(b,"latin1"),L.subarray(B+4)])),x.pipe(Y),Y.pipe(x),Y.resume()}});await new Promise((Y,H)=>{G.once("error",H),G.listen(0,"127.0.0.1",Y)});let z=G.address();if(!z||typeof z==="string")throw G.close(),Error("preview_bind_failed");function V(){if(J)return;J=!0,Q.removeEventListener("abort",V);for(let Y of X)Y.destroy();X.clear(),G.close()}if(Q.addEventListener("abort",V,{once:!0}),Q.aborted)V();return{port:z.port,headers:{[b$]:Z},close:V}}var L4=60000,N4=1e4,M4=5000;async function j4($){process.stderr.write(`${JSON.stringify({event:"worker_preview.open_refused",job_id:$.jobId,port:$.port,reason_code:$.reason})}
-`);let Q=$.binding,Z;try{Z=y9($.deviceRelayUrl,"device")}catch{return}if(!Q)return;await new Promise((X)=>{let J=new C9(Z,{followRedirects:!1,perMessageDeflate:!1,maxPayload:4096}),G=setTimeout(()=>{J.terminate(),X()},v.authorizationMs*2);J.addEventListener("open",()=>{J.send(JSON.stringify({type:"refused",binding:Q,reason:$.reason})),J.close(1000,`worker_refused_${$.reason}`)}),J.addEventListener("error",()=>{clearTimeout(G),X()}),J.addEventListener("close",()=>{clearTimeout(G),X()})})}async function C4($,Q){let Z=Date.now()+N4,X;for(;;){if(!Q())return"closed";let J=X??=$.refusal().finally(()=>{X=void 0}),G,z=await Promise.race([J.catch(()=>"port_unproved"),new Promise((V)=>{G=setTimeout(()=>V("port_check_timeout"),v.authorizationMs)})]).finally(()=>clearTimeout(G));if(z===null)return null;if(!["listener_unproved","port_check_timeout"].includes(z)||Date.now()+500>=Z)return z;await new Promise((V)=>setTimeout(V,500))}}async function f$($){let Q=_0($.binding),Z=()=>!$.signal.aborted&&Date.now()<Q.expiresAtMs,X=Q.expiresAtMs>Date.now()+v.lifetimeMs+M4?"binding_mismatch":await C4($.port,Z);if(X)throw await j4({deviceRelayUrl:$.deviceRelayUrl,binding:Q,jobId:Q.jobId,port:Q.port,reason:X}),Error("preview_not_authorized",{cause:X});let J=y9($.deviceRelayUrl,"device"),G=await k$($.port,$.signal),z;try{z=new C9(J,{followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload*1.4+300000})}catch(O){throw G.close(),O}let V=new Map,Y=!1,H=!1,W=0,F=!1,K,L,B,U=new Promise((O)=>{B=O}),M,_,q=new Promise((O,N)=>{M=O,_=N}),D=(O)=>{let N=JSON.stringify(O);if(W+=Buffer.byteLength(N),!Z()||H||z.readyState!==C9.OPEN)return x(Z()?"relay_closed":"expired");if(z.bufferedAmount>v.relayBuffered)return x("relay_backlog");if(W>v.total)return x("quota");z.send(N)};function x(O="closed"){if(H)return;H=!0,clearInterval(k),clearTimeout(T),$.signal.removeEventListener("abort",b);for(let N of V.values())N.stop();V.clear(),G.close(),z.close(1000,`worker_${O}`),_(Error("preview_closed")),B()}let b=()=>x("aborted"),T=setTimeout(()=>x("pair_timeout"),v.requestMs),k=setInterval(async()=>{if(!Z())return x($.signal.aborted?"aborted":"expired");if(F)return;F=!0;try{let O=K??=Promise.resolve().then(()=>$.port.check()).finally(()=>{K=void 0}),N=await O8(()=>O);if(N===!1)return x("port_refused");if(N){L=void 0;return}if(Date.now()-(L??=Date.now())>L4)return x("port_unknown");for(let j of V.values())j.stop()}finally{F=!1}},1000);if($.signal.addEventListener("abort",b,{once:!0}),!Z())x($.signal.aborted?"aborted":"expired");z.addEventListener("open",()=>D({type:"hello",binding:Q,messages:v.upload})),z.addEventListener("close",()=>x("relay_closed")),z.addEventListener("error",()=>x("relay_error")),z.addEventListener("message",(O)=>{try{if(!Z()||H)return x($.signal.aborted?"aborted":"expired");if(typeof O.data!=="string")throw Error("preview_frame_invalid");if(W+=Buffer.byteLength(O.data),W>v.total)return x("quota");let N=E$(O.data);if(!Y){if(N.type!=="hello"||!y0(Q,N.binding))return x("binding_mismatch");Y=!0,clearTimeout(T),M();return}if(N.type==="hello"||N.type==="refused")return x("invalid_frame");if(N.type==="request"){g(N).catch(()=>x("invalid_request"));return}let j=V.get(N.id);if(!j)return;if(N.type==="cancel"||N.type==="end")j.stop();else if(N.type==="credit"&&j.credit)j.credit();else if(N.type==="data"&&j.ws){if(j.ws.readyState!==C9.OPEN||j.ws.bufferedAmount>v.buffered)return j.stop();let A=N9(N.data,v.upload);j.ws.send(N.binary?A:A.toString("utf8"))}else x("invalid_frame")}catch{x("invalid_frame")}});async function g(O){if(V.has(O.id)||V.size>=v.streams)return x("stream_limit");if(!Z())return x($.signal.aborted?"aborted":"expired");let N=new AbortController,j,A,m,w=!1,E=(l=!1)=>{if(!V.delete(O.id))return;clearTimeout(j),N.abort(),A?.close(1000,"preview_closed"),m?.(),D({type:l?"end":"cancel",id:O.id})},P={stop:()=>E(),credit:()=>{w=!0,m?.()}};if(V.set(O.id,P),j=setTimeout(E,v.requestMs),!await j9(()=>$.port.check())||!Z()||N.signal.aborted)return E();let f=M9(O.path);if(O.upgrade){if(O.method!=="GET"||O.body)return E();let l=O.headers.find(([S])=>S.toLowerCase()==="sec-websocket-protocol")?.[1].split(",").map((S)=>S.trim());if(l?.some((S)=>!/^[a-zA-Z0-9._-]{1,100}$/.test(S))||(l?.length??0)>8)return E();A=new C9(`ws://127.0.0.1:${G.port}${f}`,l,{headers:G.headers,followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload}),P.ws=A,A.binaryType="arraybuffer",A.addEventListener("open",()=>{clearTimeout(j),D({type:"ws",id:O.id,protocol:A.protocol})}),A.addEventListener("message",(S)=>{let h=typeof S.data!=="string",c=R$(S.data);if(c.length>v.upload)return E();D({type:"data",id:O.id,data:c.toString("base64"),binary:h})}),A.addEventListener("error",()=>E()),A.addEventListener("close",(S)=>E(S.wasClean));return}let d=N9(O.body,v.upload),u=B4({hostname:"127.0.0.1",port:G.port,path:f,method:O.method,headers:{...Object.fromEntries(T8(O.headers)),...G.headers,connection:"close"},signal:N.signal,agent:!1,maxHeaderSize:16384},async(l)=>{try{let S=[];for(let h=0;h<l.rawHeaders.length;h+=2)S.push([l.rawHeaders[h],l.rawHeaders[h+1]]);D({type:"head",id:O.id,status:l.statusCode??502,headers:T8(S)});for await(let h of l){let c=Buffer.from(h);for(let a=0;a<c.length;a+=v.chunk){if(!w&&!N.signal.aborted)await new Promise((H0)=>{m=H0});if(m=void 0,N.signal.aborted)return;w=!1,D({type:"data",id:O.id,data:c.subarray(a,a+v.chunk).toString("base64"),binary:!0})}}E(!0)}catch{E()}});u.on("error",()=>E()),u.end(d)}return await q,{close:x,closed:U}}import{execFile as q4}from"child_process";import{readFile as T4,readdir as O4,readlink as D4}from"fs/promises";import{connect as _4}from"net";import{setTimeout as A4}from"timers/promises";var x4={directory:O4,text:($)=>T4($,"utf8"),link:D4};class D8 extends Error{code;constructor($="port_unproved"){super("preview_port_ownership_unproved");this.code=$}}var $0=($)=>new D8($),h9="preview_listener_unproved",m$="00000000000000000000000001000000";async function P4($,Q,Z=x4){let X=new Map;for(let z of["tcp","tcp6"]){let V=await Z.text(`/proc/net/${z}`);if(V.length>4194304)throw $0();for(let Y of V.split(`
-`).slice(1)){let H=Y.trim().split(/\s+/);if(H.length<10||!["0A","01"].includes(H[3]))continue;let[W,F]=H[1].split(":"),[K,L]=H[2].split(":");if(Number.parseInt(F,16)!==Q)continue;let B=(_)=>_==="0100007F"||_==="0000000000000000FFFF00000100007F"||_===m$,U=H[3]==="0A";if(!(B(W)||U&&/^0+$/.test(W??"")))continue;if(!U&&!B(K))continue;let M=H[9];if(!/^[1-9][0-9]*$/.test(M))continue;X.set(M,{kernelId:M,port:Q,peerPort:U?null:Number.parseInt(L,16),state:U?"listen":"established",host:W===m$?"::1":"127.0.0.1"})}}let J=await Z.directory("/proc");if(J.length>8192)throw $0();let G=[];for(let z of J){if(!/^[1-9][0-9]*$/.test(z))continue;try{let V=await Z.text(`/proc/${z}/stat`),Y=V.slice(V.lastIndexOf(")")+2).trim().split(/\s+/);if(Number(Y[2])!==$)continue;let H=await Z.directory(`/proc/${z}/fd`);if(H.length>1024)throw $0();let W=[];for(let L of H){if(!/^[0-9]+$/.test(L))continue;let B=await Z.link(`/proc/${z}/fd/${L}`).catch(()=>""),U=/^socket:\[([0-9]+)\]$/.exec(B)?.[1],M=U?X.get(U):void 0;if(M)W.push({...M,pid:Number(z),processGroupId:$,descriptor:L})}let F=await Z.text(`/proc/${z}/stat`),K=F.slice(F.lastIndexOf(")")+2).trim().split(/\s+/);if(Y[19]===K[19]&&Y[2]===K[2])G.push(...W)}catch(V){if(V instanceof Error&&V.message==="preview_port_ownership_unproved")throw V}}return G}function I4($,Q,Z){if($.length>2097152)throw $0();let X=0,J=0,G="",z="",V="",Y="",H=[],W=()=>{if(X<1||J!==Q||!/^\d+$/.test(G)||!/^0x[0-9a-f]+$/i.test(z))return;let F=Y==="LISTEN"&&["*","127.0.0.1","[::ffff:127.0.0.1]","[::1]"].some((L)=>V===`${L}:${Z}`),K=new RegExp(`^(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):${Z}->(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):([0-9]+)$`).exec(V);if(F||Y==="ESTABLISHED"&&K)H.push({pid:X,processGroupId:J,descriptor:G,kernelId:z,state:F?"listen":"established",port:Z,peerPort:F?null:Number(K[1]),host:V.startsWith("[::1]:")?"::1":"127.0.0.1"})};for(let F of $.split(/[\0\n]/)){let K=F.slice(1);if(F[0]==="p")W(),X=Number(K),J=0,G=z=V=Y="";else if(F[0]==="g")J=Number(K);else if(F[0]==="f")W(),G=K,z=V=Y="";else if(F[0]==="d")z=K;else if(F[0]==="n")V=K;else if(F.startsWith("TST="))Y=F.slice(4)}return W(),H}async function R4($,Q){if(process.platform==="linux")return P4($,Q);if(process.platform!=="darwin")throw $0();let Z=await new Promise((X,J)=>q4("/usr/sbin/lsof",["-nP","-a","-g",String($),`-iTCP:${Q}`,"-F0pgfdnT"],{timeout:1000,maxBuffer:2097152,encoding:"utf8",env:{PATH:"/usr/bin:/bin",LC_ALL:"C"}},(G,z)=>G?J($0()):X(z)));return I4(Z,$,Q)}function g$($,Q={}){let Z=_0($.binding),X=Q.inspectSockets??R4,J=Q.monotonicNow??(()=>performance.now());async function G(){let Y=()=>{if(Date.now()>=Z.expiresAtMs)throw $0("binding_expired");if($.deniedPorts.has(Z.port))throw $0("port_denied")};Y();let H=await $.readCurrentJob(),W=H?.job,F=W?.process;if(Y(),!H)throw $0("server_stopped");if(!y0(Z,H.binding)||W?.jobId!==Z.jobId)throw $0("binding_changed");if(W.state!=="running"||W.finishedAtMs!==null||W.leaseExpiresAtMs<Z.expiresAtMs)throw $0("job_not_running");if(!F||F.pid<1||F.pid!==F.processGroupId||F.executorLaunchId!==H.executorLaunchId)throw $0("process_unproved");return{pid:F.pid,launch:F.executorLaunchId,started:W.startedAtMs}}async function z(Y=()=>{}){Y();let H=await G();Y();let W=await X(H.pid,Z.port).catch(()=>{throw Error(h9)});Y();let F=await G();if(Y(),H.pid!==F.pid||H.launch!==F.launch||H.started!==F.started)throw $0("job_restarted");if(!W.some((K)=>K.state==="listen"))throw Error(h9);return W}async function V(){try{return await z(),null}catch(Y){if(Y instanceof Error&&Y.message===h9)return"listener_unproved";return Y instanceof D8?Y.code:"port_unproved"}}return{refusal:V,async check(){let Y=await V();if(Y==="listener_unproved")throw Error(h9);return Y===null},async connect(Y){if(Y.aborted)throw $0();let H=J()+2000,W=new AbortController,F=new Promise((_)=>W.signal.addEventListener("abort",()=>_(null),{once:!0})),K,L=()=>{W.abort(),K?.destroy()},B=setTimeout(L,2000);Y.addEventListener("abort",L,{once:!0});let U=()=>{if(W.signal.aborted||Y.aborted||J()>=H||K?.destroyed)throw L(),$0()};async function M(_){U();let q=await Promise.race([_().then((D)=>({value:D})),F]);if(U(),!q)throw $0();return q.value}try{let _=await M(()=>z(U));U();let q=_.some((b)=>b.state==="listen"&&b.host==="127.0.0.1")?"127.0.0.1":"::1",D=_4({host:q,port:Z.port,signal:Y});K=D,D.once("close",L),await M(()=>new Promise((b,T)=>{D.once("connect",b),D.once("error",T)}));let x=D.localPort;if(!x)throw $0();while(!(await M(()=>z(U))).some((b)=>b.state==="established"&&b.peerPort===x))await M(()=>A4(Math.min(20,Math.max(1,H-J())),void 0,{signal:W.signal}));return U(),D}catch(_){throw L(),_}finally{clearTimeout(B),Y.removeEventListener("abort",L),K?.off("close",L),W.abort()}}}}var E4=4,S4=[2375,2376,9222,9229];function y$($){let Q=new Set(S4);for(let Z of $){let X=new URL(Z);Q.add(Number(X.port||(["https:","wss:"].includes(X.protocol)?443:80)))}return Q}function A0(){throw new C("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var w4=60000;function h$($){let Q=new AbortController,Z=new Map,X=(Y)=>JSON.stringify([Y.jobId,Y.port]);function J(Y){let H=$.authority.owner;if(Q.signal.aborted||!$.isCurrent()||$.expiresAtMs<=Date.now()||Y.organization_id!==H.organization_id||Y.user_id!==H.user_id||Y.device_id!==H.device_id)A0()}function G(Y){let H;try{H=$.environment.current()}catch{return null}return H.binding.target_generation===Y.generation&&H.binding.target_fence_id===Y.fenceId&&H.run_id===$.runId&&H.device_id===$.authority.owner.device_id&&H.root_id===$.authority.rootId?H:null}async function z(Y,H,W){let F=await V(Y,H,W);if(F!=="moved")return F;let K=await V(Y,H,W);return K==="moved"?null:K}async function V(Y,H,W){try{J($.authority.owner);let F=$.identity();if(!F||W.aborted||Y.expiresAtMs<=Date.now()||Y.expiresAtMs>$.expiresAtMs)return null;let K=H.opened,L=K!==void 0&&F.generation>K.generation,B=G(F);if(L){if(B){if(B.revision<=K.revision||Y.expiresAtMs>Date.parse(B.expires_at)||B.binding.target_revision!==K.attachmentRevision||B.binding.root_grant_revision!==K.grantRevision)return null;H.recoveringSinceMs=void 0}else if(Date.now()-(H.recoveringSinceMs??=Date.now())>w4)return null}else if(!B||Y.expiresAtMs>Date.parse(B.expires_at)||K&&(F.generation!==K.generation||F.fenceId!==K.fenceId))return null;let U=await $.inspect(Y.jobId,W),M=$.identity(),_=M&&G(M);J($.authority.owner);let q=B&&{generation:F.generation,fenceId:F.fenceId,snapshotId:B.snapshot_id,revision:B.revision,attachmentRevision:B.binding.target_revision,grantRevision:B.binding.root_grant_revision},D=L?K:q;if(W.aborted||!M)return null;if(M.generation!==F.generation||M.fenceId!==F.fenceId||_?.snapshot_id!==B?.snapshot_id||_?.revision!==B?.revision)return"moved";let x=U.ok&&U.job.environmentSnapshotId!==void 0&&U.job.environmentRevision!==void 0?{snapshotId:U.job.environmentSnapshotId,revision:U.job.environmentRevision}:null;if(!U.ok||U.generation!==F.generation||!D||!x)return null;if((x.snapshotId!==D.snapshotId||x.revision!==D.revision)&&(L||!$.environment.carried(x.snapshotId,x.revision)))return null;if(!K&&F.generation===Y.generation&&F.fenceId===Y.fenceId)H.opened={...D,...x};return{executorLaunchId:$.executorLaunchId,job:U.job,binding:{organizationId:$.authority.owner.organization_id,userId:$.authority.owner.user_id,deviceId:$.authority.owner.device_id,rootId:$.authority.rootId,runId:$.runId,attachmentRevision:D.attachmentRevision,grantRevision:D.grantRevision,generation:D.generation,fenceId:D.fenceId,jobId:U.job.jobId,port:Y.port,expiresAtMs:Y.expiresAtMs}}}catch{return null}}return{async open(Y,H,W){J(H);let{binding:F,deviceRelayUrl:K}=S$(Y);if(W.aborted||F.expiresAtMs<=Date.now()||F.expiresAtMs>Date.now()+v.lifetimeMs||new URL(K).origin!==$.authority.relayOrigin)A0();let L=X(F),B=Z.get(L);if(B){if(!y0(B.binding,F)||B.relay!==K)A0();if(await B.opened,!await j9(()=>B.port.check())||W.aborted||B.abort.signal.aborted)A0();return{opened:!0,binding:F}}if(Z.size>=E4)A0();let U=new AbortController,M={},_=g$({binding:F,deniedPorts:$.authority.deniedPorts,readCurrentJob:()=>z(F,M,U.signal)}),q=()=>U.abort();if(W.addEventListener("abort",q,{once:!0}),Q.signal.addEventListener("abort",q,{once:!0}),W.aborted||Q.signal.aborted)q();let D=f$({binding:F,deviceRelayUrl:K,port:_,signal:U.signal}),x={binding:F,relay:K,abort:U,port:_,opened:D};Z.set(L,x);let b=()=>{if(W.removeEventListener("abort",q),Q.signal.removeEventListener("abort",q),Z.get(L)===x)Z.delete(L)};try{if((await D).closed.then(b),W.removeEventListener("abort",q),J(H),U.signal.aborted||!await j9(()=>_.check()))A0();return{opened:!0,binding:F}}catch{U.abort(),b(),A0()}},async close(Y,H){J(H);let{binding:W}=w$(Y),F=Z.get(X(W));if(!F||!y0(F.binding,W))A0();return F.abort.abort(),await F.opened.then((K)=>K.closed,()=>{return}),{closed:!0,binding:W}},dispose(){Q.abort();for(let Y of Z.values())Y.abort.abort();Z.clear()}}}import{WebSocket as _8}from"ws";var v$=($)=>("data"in $)?$.data.length:$.bytes,c$=2*p$;function i($){throw new C($,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var o0=($)=>!["starting","running"].includes($.state);function V2($,Q,Z=Date.now()){let X=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys($).length!==X.length||Object.keys($).some((H)=>!X.includes(H))||!A8(Q)||!A8($.session_id)||typeof $.expires_at!=="string"||typeof $.relay_url!=="string"||$.relay_url.length>4096||![$.cols,$.rows].every((H)=>Number.isSafeInteger(H)&&Number(H)>=1&&Number(H)<=x8))i("invalid_pty_request");let J=$.pty;if(!J||typeof J!=="object"||Array.isArray(J))i("invalid_pty_request");let G=J;if(Object.keys(G).length!==2||G.version!==1||!d9(G.jobId))i("invalid_pty_request");let z;try{z=new URL($.relay_url)}catch{return i("invalid_pty_request")}if(!["ws:","wss:"].includes(z.protocol)||z.username||z.password||z.hash||z.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(z.hostname))i("invalid_pty_request");let V=Date.parse($.expires_at);if(!Number.isSafeInteger(V)||V<=Z)i("invalid_pty_request");return{workspace:d$($.workspace)??i("invalid_pty_request"),session:{jobId:G.jobId,sessionId:$.session_id,operationId:Q,relayUrl:z.href,cols:Number($.cols),rows:Number($.rows),leaseExpiresAtMs:Math.min(V,Z+43200000)}}}async function s$($){let{session:Q,binding:Z}=$;if(Z.assertCurrent(),$.signal.aborted||Date.now()>=Q.leaseExpiresAtMs)i("cancelled");let X=new _8(Q.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:v9}),J=new AbortController,G=()=>{},z=()=>{J.abort(),G()};$.signal.addEventListener("abort",z,{once:!0});let V=setTimeout(z,Math.max(1,Q.leaseExpiresAtMs-Date.now())),Y=[],H=0,W=0,F=0,K=!1,L=!1,B=!1,U,M,_,q=(N)=>{_=new C(N,"Bound terminal input was refused."),z()};X.on("error",()=>q("pty_relay_unavailable")),X.on("close",z),X.on("message",(N,j)=>{if(J.signal.aborted)return;if(!L){q("pty_not_ready");return}let A=Array.isArray(N)?Buffer.concat(N):N instanceof ArrayBuffer?Buffer.from(N):N;if(A.length===0)return;let m=Y.at(-1),w=j&&m!==void 0&&"data"in m&&m.data.length+A.length<=v9;if(A.length>v9||H+A.length>u$){q("pty_input_backpressure");return}if(w)m.data=Buffer.concat([m.data,A]);else if(j)Y.push({data:Buffer.from(A)});else try{let E=JSON.parse(A.toString("utf8"));if(E&&E.t==="close"&&Object.keys(E).length===1){B=!0,z();return}if(!E||E.t!=="resize"||Object.keys(E).length!==3||![E.cols,E.rows].every((P)=>Number.isSafeInteger(P)&&P>=1&&P<=x8))throw Error("invalid_control");Y.push({cols:E.cols,rows:E.rows,bytes:A.length})}catch{q("invalid_pty_control");return}H+=A.length,G()});function D(N){return l$(JSON.stringify({...Z.scope,version:1,sessionId:Q.sessionId,operationId:Q.operationId,job:{...N,output:[],pty:N.pty?{...N.pty,output:[]}:void 0}}))}function x(N){if(!N.ok)i(N.error);let j=N.job;if(N.generation!==Z.scope.generation||j.jobId!==Q.jobId||!j.pty||j.leaseExpiresAtMs>Q.leaseExpiresAtMs||j.process&&j.process.executorLaunchId!==Z.scope.executorLaunchId||j.process&&M&&(j.process.pid!==M.pid||j.process.processGroupId!==M.processGroupId)||j.state!=="starting"&&(j.environmentRevision!==Z.environment.revision||j.environmentSnapshotId!==Z.environment.snapshotId))i("pty_binding_changed");if(D(j),j.process)M??={...j.process};return j}async function b(N){Z.assertCurrent();let j=await Z.request(N,J.signal);if(Z.assertCurrent(),J.signal.aborted)i("cancelled");let A=x(j);if(A.inputSequence!==W)i("job_input_sequence");if(!o0(A)&&A.leaseExpiresAtMs<=Date.now())i("pty_binding_changed");return A}function T(N){if(Z.assertCurrent(),J.signal.aborted||X.readyState!==_8.OPEN||X.bufferedAmount+Buffer.byteLength(N)>c$)i("pty_output_backpressure");X.send(N)}function k(N){if(N.firstCursor>F+1)F=N.firstCursor-1;for(let j of N.pty.output){if(j.cursor<=F)continue;if(j.cursor!==F+1)i("pty_output_gap");let A=Buffer.from(j.dataBase64,"base64");if(X.bufferedAmount+A.length>c$)return!1;T(A),F=j.cursor}if(F!==N.nextCursor)i("pty_output_gap");return!0}async function g(N,j){let A;try{await Promise.race([$.emit(N,j),new Promise((m,w)=>{A=setTimeout(()=>w(new C("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(A)}}async function O(){let N=AbortSignal.timeout(c9),j=Z.request({jobId:Q.jobId,action:"cancel",input:{}},N),A,m=new Promise((w,E)=>{if(A=()=>E(new C("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),N.addEventListener("abort",A,{once:!0}),N.aborted)A()});try{let w=await Promise.race([j,m]);if(N.aborted)i("pty_cleanup_unconfirmed");return x(w)}finally{N.removeEventListener("abort",A)}}try{await new Promise((w,E)=>{let P=setTimeout(()=>{z(),E(new C("pty_relay_unavailable","Terminal pairing timed out."))},5000),f=()=>{clearTimeout(P),E(new C("cancelled","Terminal pairing was cancelled."))};if(J.signal.addEventListener("abort",f,{once:!0}),X.once("open",()=>{clearTimeout(P),J.signal.removeEventListener("abort",f),w()}),J.signal.aborted)f()}),Z.assertCurrent(),K=!0,U=await b({jobId:Q.jobId,action:"start",input:{mode:"pty",cols:Q.cols,rows:Q.rows,leaseExpiresAtMs:Q.leaseExpiresAtMs}});let N=Date.now()+5000;while(U.state==="starting"){if(Date.now()>=N)i("pty_not_ready");await new Promise((w)=>setTimeout(w,25)),U=await b({jobId:Q.jobId,action:"inspect",input:{after:F}})}if(U.state!=="running"||U.inputSequence!==0||U.leaseExpiresAtMs<=Date.now())i("pty_not_ready");await g("pty.ready",D(U)),L=!0,T(JSON.stringify({t:"open",cols:U.pty.cols,rows:U.pty.rows,receipt:D(U)}));let j=!1,A=0,m=!1;while(!J.signal.aborted){let w=U.firstCursor>F+1,E=k(U);if(o0(U)){if(E)break}else if(w)j=!0;else if(j&&E&&Date.now()>=A){j=!1,A=Date.now()+1000;let{cols:f,rows:d}=U.pty;for(let u of[{cols:f,rows:d>1?d-1:2},{cols:f,rows:d}]){if(o0(U))break;let l=++W;if(U=await b({jobId:Q.jobId,action:"resize",input:{sequence:l,...u}}),U.inputSequence!==l)i("job_input_sequence")}continue}let P=o0(U)||m?void 0:Y.shift();if(P){H-=v$(P);let f=++W;try{U=await b("data"in P?{jobId:Q.jobId,action:"input",input:{sequence:f,dataBase64:P.data.toString("base64")}}:{jobId:Q.jobId,action:"resize",input:{sequence:f,cols:P.cols,rows:P.rows}})}catch(d){if(!(d instanceof C)||d.code!=="job_input_backpressure")throw d;W-=1,Y.unshift(P),H+=v$(P),m=!0;continue}if(U.inputSequence!==f)i("job_input_sequence")}else if(await new Promise((f)=>{let d=setTimeout(f,m||!E?10:50);if(G=()=>{clearTimeout(d),f()},J.signal.aborted||!m&&Y.length)G()}),m=!1,G=()=>{},!J.signal.aborted&&E)try{U=await b({jobId:Q.jobId,action:"inspect",input:{after:F}})}catch(f){if(!B||!(f instanceof C)||f.code!=="cancelled")throw f}}}catch(N){_??=N}finally{if(L=!1,Y.length=0,clearTimeout(V),$.signal.removeEventListener("abort",z),z(),K&&(!U||!o0(U)))try{U=await O()}catch{U=void 0}try{if(!U||!o0(U)||U.pty?.cleanup!=="confirmed")i("pty_cleanup_unconfirmed");let N=D(U);if(X.readyState===_8.OPEN)await new Promise((j)=>{let A=setTimeout(j,500);X.send(JSON.stringify({t:"exit",code:U.exitCode,receipt:N}),()=>{clearTimeout(A),j()})});await g("pty.stopped",N)}catch(N){_??=N}X.terminate()}if(_)throw _;if($.signal.aborted)i("cancelled");if(!U)i("pty_cleanup_unconfirmed");return{receipt:D(U)}}import{createHash as b4,randomUUID as QQ}from"crypto";import{spawnSync as k4}from"child_process";import{closeSync as n$,constants as P8,fstatSync as f4,fsyncSync as m4,lstatSync as q9,mkdirSync as g4,mkdtempSync as ZQ,openSync as i$,readFileSync as y4,readdirSync as XQ,realpathSync as t0,rmSync as I8,unlinkSync as h4}from"fs";import{createConnection as v4}from"net";import{dirname as c4,join as h0,sep as d4}from"path";import{tmpdir as p4}from"os";var e=new Map,x0=new Map;function C0($,Q){return b4("sha256").update(JSON.stringify([$,Q])).digest("hex")}function r0($){try{g4($,{mode:448})}catch(Z){if(!(Z instanceof Error&&("code"in Z)&&Z.code==="EEXIST"))throw Z}let Q=q9($);if(!Q.isDirectory()||Q.isSymbolicLink()||Q.uid!==process.getuid?.()||(Q.mode&63)!==0||t0($)!==$)throw new C("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function u4($){let Q;try{Q=q9($)}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!1;throw Z}return!Q.isDirectory()||Q.isSymbolicLink()||XQ($).length>0}function JQ($){let Q=C0($.root,$.runId),Z=$.previousRuntimeDirectories?.find((z)=>u4(h0(z,"jobs",Q.slice(0,16))))??$.runtimeDirectory;r0(Z);let X=h0(Z,"jobs");r0(X);let J=h0(X,Q.slice(0,16));if($.maxScopes!==void 0){let z=XQ(X);if(!Number.isSafeInteger($.maxScopes)||$.maxScopes<1||z.length>$.maxScopes||!z.includes(Q.slice(0,16))&&z.length>=$.maxScopes)throw new C("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}r0(J);let G=ZQ(h0(t0("/tmp"),"reason-j-"));try{return r0(G),{journalDirectory:J,scopeId:Q,socketPath:h0(G,"control.sock"),disposeSocket:()=>I8(G,{recursive:!0,force:!0})}}catch(z){throw I8(G,{recursive:!0,force:!0}),z}}var l4=60000,s4=5000;function n4($){let Q=k4("ps",["-o","lstart=","-p",String($)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),Z=Q.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(Q.stdout.trim()):null,X=Z?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(Z[1]):-1;if(!Z||X<0||X%3!==0)return null;let J=new Date(Number(Z[6]),X/3,Number(Z[2]),Number(Z[3]),Number(Z[4]),Number(Z[5])).getTime();return Number.isFinite(J)?J:null}function YQ($,Q={}){let Z=h0($.journalDirectory,"owner.lock"),X;try{X=i$(Z,P8.O_RDONLY|P8.O_NOFOLLOW)}catch{return null}try{let J=f4(X);if(!J.isFile()||J.nlink!==1||J.uid!==process.getuid?.()||(J.mode&63)!==0||J.size>4096)return null;let G=null;try{G=JSON.parse(y4(X,"utf8"))}catch{}let z;if(G===null){if((Q.now??Date.now)()-J.mtimeMs<l4)return null;z={reason:"never_written",executorLaunchId:null}}else{let{version:H,scopeId:W,pid:F,createdAtMs:K,executorLaunchId:L}=G;if(H!==1||W!==$.scopeId||typeof L!=="string"||typeof F!=="number"||!Number.isSafeInteger(F)||F<1||F===process.pid||typeof K!=="number"||!Number.isSafeInteger(K))return null;if(!(Q.exists??((U)=>{try{return process.kill(U,0),!0}catch(M){return!(M instanceof Error&&("code"in M)&&M.code==="ESRCH")}}))(F))z={reason:"owner_exited",executorLaunchId:L};else{let U=(Q.startedAtMs??n4)(F);if(U===null||U<=K+s4)return null;z={reason:"pid_reused",executorLaunchId:L}}}let V=q9(Z);if(V.dev!==J.dev||V.ino!==J.ino)return null;h4(Z);let Y=i$($.journalDirectory,P8.O_RDONLY);try{m4(Y)}finally{n$(Y)}return z}catch{return null}finally{n$(X)}}function GQ($){let Q={...$,workspace:$.workspace&&Object.freeze({...$.workspace}),previewAuthority:$.previewAuthority&&Object.freeze({...$.previewAuthority,owner:Object.freeze({...$.previewAuthority.owner}),deniedPorts:new Set($.previewAuthority.deniedPorts)})},Z=C0(Q.root,Q.runId);if(e.has(Z)||Q.operationId!==void 0&&x0.has(Q.operationId))throw new C("hands_jobs_busy","The Session already has a live Hands job supervisor.");let X={binding:Q,key:Z,terminals:new Map};if(Q.previewAuthority&&Q.environment)X.previews=h$({authority:Q.previewAuthority,runId:Q.runId,expiresAtMs:Q.expiresAtMs,executorLaunchId:Q.executorLaunchId,environment:Q.environment,isCurrent:()=>e.get(X.key)===X,identity:()=>{try{return e0(Q)}catch{return null}},inspect:(J,G)=>{if(e.get(X.key)!==X)throw new C("preview_unavailable","The Hands supervisor is no longer current.");return zQ(Q,{jobId:J,action:"inspect",input:{after:0}},G)}});if(e.set(Z,X),Q.operationId!==void 0)x0.set(Q.operationId,X);return()=>{if(e.get(X.key)===X)e.delete(X.key);if(Q.operationId!==void 0&&x0.get(Q.operationId)===X)x0.delete(Q.operationId);X.previews?.dispose();for(let J of X.terminals.values())J.abort()}}var i4=5000,a4=20;async function _2($){let Q=(J)=>{throw new C("hands_rebind_unavailable",J)};if(!j0($.operationId)||!j0($.runId)||!j0($.fenceId)||!P0($.targetGeneration))Q("Reason sent an invalid Hands rebind.");let Z=x0.get($.operationId);if(!Z||Z.binding.root!==$.root)return Q("No live Hands supervisor owns this operation.");for(let J=Date.now()+i4;;){if($.signal?.aborted)Q("The Hands rebind was cancelled.");if(x0.get($.operationId)!==Z)Q("The Hands supervisor is no longer current.");let G=null;try{G=e0(Z.binding)}catch{}if(G&&G.generation===$.targetGeneration&&G.fenceId===$.fenceId)break;if(G&&G.generation>$.targetGeneration||Date.now()>=J)Q("The executor did not adopt this take.");await new Promise((z)=>setTimeout(z,a4))}if(x0.get($.operationId)!==Z||e.get(Z.key)!==Z)Q("The Hands supervisor is no longer current.");let X=C0($.root,$.runId);if(Z.key===X)return;if(e.has(X))Q("The taking run already has a live Hands job supervisor.");e.delete(Z.key);for(let J of Z.terminals.values())J.abort();Z.key=X,e.set(X,Z)}function A2($){let Q="operationId"in $?x0.get($.operationId):e.get(C0($.root,$.runId)),Z=Q&&Q.binding.root===$.root?Q.binding:void 0;if(!Z?.environment||Z.expiresAtMs<=Date.now())throw new C("environment_unavailable","No live Hands supervisor owns this environment.");return Z.environment.install($.payload)}async function x2($){let Q=e.get(C0($.root,$.runId));if(!Q?.previews||!$.owner)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.open($.payload,$.owner,$.signal)}async function P2($){let Q=e.get(C0($.root,$.runId));if(!Q?.previews||!$.owner||$.signal.aborted)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.close($.payload,$.owner)}async function I2($){let Q=C0($.root,$.runId),Z=e.get(Q),X=Z?.binding,J=X?.runId,G=X?.previewAuthority,z=X?.environment,V=$.owner&&{...$.owner},Y=$.authority&&{...$.authority},H=()=>{throw new C("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!Z||!X||!G||!z||!V||!Y||!X.workspace)return H();let W=Object.freeze({...X.workspace}),F=e0(X),K=z.current(),L=()=>{if(e.get(Q)!==Z||V.organization_id!==G.owner.organization_id||V.user_id!==G.owner.user_id||V.device_id!==G.owner.device_id||$.deviceId!==G.owner.device_id||$.rootId!==G.rootId||v0($.workspace)!==v0(W))H();let U=e0(X),M=z.current();if(U.generation!==F.generation||U.fenceId!==F.fenceId||M.run_id!==J||M.device_id!==$.deviceId||M.root_id!==$.rootId||M.snapshot_id!==K.snapshot_id||M.revision!==K.revision||M.binding.target_generation!==F.generation||M.binding.target_fence_id!==F.fenceId||Y.device_id!==$.deviceId||Y.binding!==M.binding.kind||Y.target_revision!==M.binding.target_revision||Y.root_grant_revision!==M.binding.root_grant_revision||Y.target_generation!==F.generation||Y.target_fence_id!==F.fenceId)H()};if(L(),new URL($.session.relayUrl).origin!==G.relayOrigin||Z.terminals.has($.session.jobId)||Z.terminals.size>=4)return H();let B=new AbortController;Z.terminals.set($.session.jobId,B);try{return await s$({session:{...$.session,leaseExpiresAtMs:Math.min($.session.leaseExpiresAtMs,F.expiresAtMs,Date.parse(K.expires_at))},signal:AbortSignal.any([$.signal,B.signal]),emit:$.emit,binding:{assertCurrent:L,environment:{revision:K.revision,snapshotId:K.snapshot_id},scope:{runId:$.runId,deviceId:$.deviceId,rootId:$.rootId,workspace:W,binding:K.binding.kind,targetRevision:K.binding.target_revision,rootGrantRevision:K.binding.root_grant_revision,generation:F.generation,fenceId:F.fenceId,executorLaunchId:F.executorLaunchId},request:(U,M)=>KQ(F,R8(JSON.stringify({...U,type:"job",version:2,generation:F.generation,id:QQ()})),M)}})}finally{if(Z.terminals.get($.session.jobId)===B)Z.terminals.delete($.session.jobId)}}async function R2($){if(d9($.payload.jobId))throw new C("pty_binding_required","PTY jobs require the bound terminal capability.");let Q=e.get(C0($.root,$.runId))?.binding;if(!Q||Q.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return zQ(Q,$.payload,$.signal)}var o4=1e4,r4=20,t4=t$/2,e4=r$/2,$3=($)=>$.output.reduce((Q,Z)=>Q+Z.text.length,0);async function zQ($,Q,Z){if(Object.keys(Q).some((H)=>!["jobId","action","input","waitForExitMs"].includes(H)))throw new C("invalid_payload","Unexpected job control field.");let{waitForExitMs:X,...J}=Q;if(X!==void 0&&(J.action!=="start"||typeof J.input!=="object"||J.input===null||!("script"in J.input)||typeof X!=="number"||!Number.isSafeInteger(X)||X<1||X>o4))throw new C("invalid_payload","Only a script start may wait for its job, within its bound.");let G=(H)=>{let W=e0($);return KQ(W,R8(JSON.stringify({...H,type:"job",version:2,generation:W.generation,id:QQ()})),Z)},z=await G(J);if(X===void 0)return z;let V=Date.now()+X,Y=z;while(Y.ok&&["starting","running"].includes(Y.job.state)&&Y.job.output.length<t4&&$3(Y.job)<e4&&!Z.aborted&&Date.now()<V){if(await new Promise((H)=>setTimeout(H,Math.min(r4,V-Date.now()))),Z.aborted)break;try{let H=await G({jobId:J.jobId,action:"inspect",input:{after:0}});if(!H.ok)break;Y=H}catch{break}}return Y}function e0($){if($.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","Hands authority expired.");let Q=$.readIdentity?$.readIdentity():$;if(!Q||!P0(Q.generation)||!j0(Q.fenceId)||Q.generation<$.generation||Q.generation===$.generation&&Q.fenceId!==$.fenceId)throw new C("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return $.generation=Q.generation,$.fenceId=Q.fenceId,{...$}}function KQ($,Q,Z){if(Z.aborted)return Promise.reject(new C("cancelled","Job control was cancelled."));return new Promise((X,J)=>{let G=v4($.socketPath),z="",V=!1,Y,H=(F,K)=>{if(V)return;if(V=!0,clearTimeout(Y),Z.removeEventListener("abort",W),G.destroy(),F)J(F);else X(K)},W=()=>H(new C("cancelled","Job control waiter cancelled; inspect before retrying mutations."));Z.addEventListener("abort",W,{once:!0}),G.setEncoding("utf8"),Y=setTimeout(()=>H(new C("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,$.expiresAtMs-Date.now()))),G.on("error",()=>H(new C("hands_job_result_unknown","Hands job control connection failed."))),G.once("connect",()=>G.write(JSON.stringify({version:1,scopeId:$.scopeId,fenceId:$.fenceId,executorLaunchId:$.executorLaunchId,request:Q})+`
-`)),G.on("data",(F)=>{if(z+=F,Buffer.byteLength(z)>e$)H(new C("hands_job_result_unknown","Hands job result exceeded its bound."))}),G.once("end",()=>{if(Date.now()>=$.expiresAtMs){H(new C("hands_job_result_unknown","Hands authority expired before the result was acknowledged."));return}try{let F=$Q(z.trim());if(F.id!==Q.id||F.generation!==$.generation||F.ok&&F.job.jobId!==Q.jobId)throw Error("identity");H(void 0,F)}catch{H(new C("hands_job_result_unknown","Hands job response identity or shape was invalid."))}}),G.once("close",()=>{if(!V)H(new C("hands_job_result_unknown","Hands job control closed before an acknowledged result."))})})}function Q3($){let Q=t0($.root),Z=$.authority,X=Date.parse($.leaseUntil),J=()=>{if($.signal.throwIfAborted(),!Number.isFinite(X)||X<=Date.now())throw Error("local_device_gh_lease_expired")};if(J(),Z.readOnly&&Z.generation===null)return{root:Q,readOnly:!0,signal:$.signal,deadlineMs:X,assertCurrent:J};let G=C0(Q,$.runId),z=e.get(G),V=z?.binding;if(!V?.environment||!V.workspace||V.localGithubConfinement!==!0)throw Error("local_device_gh_confinement_unavailable");let Y=V.environment.current(),H=()=>{J();let F=V.environment.current(),K=e0(V);if(e.get(G)!==z||F.github_auth!=="local_gh"||F.run_id!==V.runId||Z.runId!==$.runId||F.device_id!==Z.deviceId||F.root_id!==Z.rootId||String(F.binding.root_grant_revision)!==Z.rootRevision||F.binding.target_generation!==Z.generation||F.binding.target_fence_id!==Z.fenceId||K.generation!==Z.generation||K.fenceId!==Z.fenceId||F.snapshot_id!==Y.snapshot_id||F.revision!==Y.revision)throw Error("local_device_gh_authority_changed")};H();let W=p9(Q,V.workspace);return{root:W.boundary,signal:$.signal,deadlineMs:X,privateDirectory:c4(V.environment.path),repoPath:W.path,readOnly:Z.readOnly,forbiddenSecretValues:Object.values(Y.variables),secretNames:(F)=>Object.entries(Y.variables).filter(([,K])=>K.trim()===F.trim()).map(([K])=>`variable ${K}`),assertCurrent:H}}async function E2($,Q){let Z=a$.parse($.request),X=o$.parse($.authority);if(Z.kind!=="pr_merge"){if(X.merge)throw Error("local_device_gh_merge_authority_invalid");return Q(Q3($))}if(!X.merge||X.readOnly||X.runId!==$.runId||X.repoFullName!==Z.repoFullName||X.merge.source==="agent"&&(X.generation===null||X.fenceId===null))throw Error("local_device_gh_merge_authority_invalid");let J=t0($.root),G=q9(J),z=Date.parse($.leaseUntil);if(!Number.isFinite(z)||z<=Date.now())throw Error("local_device_gh_lease_expired");let V=t0(p4());if(V===J||V.startsWith(J+d4))throw Error("local_device_gh_private_scope_unavailable");let Y=ZQ(h0(V,"reason-gh-merge-"));try{r0(Y);let H=()=>{if($.signal.throwIfAborted(),Date.now()>=z)throw Error("local_device_gh_lease_expired");let W=q9($.root);if(W.isSymbolicLink()||W.dev!==G.dev||W.ino!==G.ino||t0($.root)!==J)throw Error("local_device_gh_authority_changed");r0(Y)};return H(),await Q({root:J,readOnly:!1,privateDirectory:Y,forbiddenSecretValues:[],signal:$.signal,deadlineMs:z,assertCurrent:H})}finally{I8(Y,{recursive:!0,force:!0})}}var FQ=43200000;function $9($){return Number.isSafeInteger($)&&Math.abs($)<=8640000000000000?$:null}function VQ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function HQ($,Q){return Object.keys($).length===Q.length&&Q.every((Z)=>Object.hasOwn($,Z))}function w2($){if(!VQ($)||!HQ($,["version","outcome","clock_source","validation_now_ms","expiry_ms","remaining_ms","maximum_lifetime_ms","cli_artifact"])||$.version!==1||$.maximum_lifetime_ms!==43200000||typeof $.outcome!=="string"||!["accepted","parse","noncanonical","expired","over_cap"].includes($.outcome)||typeof $.clock_source!=="string"||!["date_now","injected"].includes($.clock_source))return null;for(let X of["validation_now_ms","expiry_ms"]){let J=$[X];if(J!==null&&(typeof J!=="number"||$9(J)===null))return null}if($.remaining_ms!==null&&(typeof $.remaining_ms!=="number"||!Number.isSafeInteger($.remaining_ms)))return null;let Q=typeof $.expiry_ms==="number"&&typeof $.validation_now_ms==="number"?$.expiry_ms-$.validation_now_ms:null;if($.remaining_ms!==(Q!==null&&Number.isSafeInteger(Q)?Q:null))return null;if($.outcome==="parse"&&$.expiry_ms!==null)return null;if($.outcome!=="parse"&&$.expiry_ms===null)return null;if($.outcome==="expired"&&!(typeof Q==="number"&&Q<=0))return null;if($.outcome==="over_cap"&&!(typeof Q==="number"&&Q>43200000))return null;if($.outcome==="accepted"&&!(typeof Q==="number"&&Q>0&&Q<=43200000))return null;let Z=$.cli_artifact;if(!VQ(Z)||!HQ(Z,["kind","status","sha256","observed_at_ms"])||Z.observed_at_ms!==null&&(typeof Z.observed_at_ms!=="number"||$9(Z.observed_at_ms)===null))return null;if(Z.kind==="entrypoint_file"){if(Z.status!=="observed"||typeof Z.sha256!=="string"||!/^[a-f0-9]{64}$/.test(Z.sha256)||Z.observed_at_ms===null)return null}else if(Z.kind!=="unavailable"||Z.sha256!==null||typeof Z.status!=="string"||!["unsupported_entrypoint","read_failed","file_changed","size_limit","time_limit"].includes(Z.status))return null;return $}var E8=I.strictObject({kind:I.enum(["workspace_source","mcp_control"]),target_revision:I.number().int().nonnegative(),root_grant_revision:I.number().int().positive()}),UQ=new RegExp(u9.tokenPattern),Z3=I.strictObject({token_url:I.url().max(2048),request_token:I.string().min(1).max(8192).regex(UQ),aws_credentials_url:I.url().max(2048).nullable()});function BQ($,Q){let Z=(X,J)=>{try{let G=new URL(X);return G.origin===new URL(Q).origin&&G.pathname===J&&!G.username&&!G.password&&!G.search&&!G.hash}catch{return!1}};if(!UQ.test($.request_token)||!Z($.token_url,u9.tokenPath)||$.aws_credentials_url!==null&&!Z($.aws_credentials_url,u9.awsPath))return null;return{REASON_OIDC_TOKEN_URL:$.token_url,REASON_OIDC_REQUEST_TOKEN:$.request_token,...$.aws_credentials_url!==null?{AWS_CONTAINER_CREDENTIALS_FULL_URI:$.aws_credentials_url,AWS_CONTAINER_AUTHORIZATION_TOKEN:$.request_token}:{}}}function LQ($){return new TextEncoder().encode($).byteLength}function X3($){return LQ(JSON.stringify($)+`
-`)}var NQ=I.strictObject({version:I.literal(1),snapshot_id:I.uuid(),revision:I.number().int().positive(),run_id:I.string().min(1).max(160),device_id:I.uuid(),root_id:I.uuid(),binding:E8.extend({target_generation:I.number().int().positive(),target_fence_id:I.uuid()}),expires_at:I.iso.datetime({offset:!0}),variables:I.record(I.string().max(128).regex(WQ),I.string().refine(($)=>!$.includes("\x00")&&LQ($)<=q0.valueBytes)).refine(($)=>Object.keys($).length<=q0.variables),github_auth:I.literal("local_gh").optional(),git:I.strictObject({base_url:I.url().max(2048),token:I.string().min(1).max(4096).regex(/^[A-Za-z0-9._~-]+$/),expires_at:I.iso.datetime({offset:!0})}).nullable(),cloud_access:Z3.optional()}).refine(($)=>$.github_auth!=="local_gh"||$.git===null,"conflicting git authority").refine(($)=>X3($)<=q0.snapshotBytes,"snapshot too large");import{randomUUID as J3}from"crypto";import{closeSync as Y3,constants as MQ,fstatSync as G3,lstatSync as jQ,mkdirSync as CQ,openSync as z3,readFileSync as K3,realpathSync as qQ,renameSync as V3,unlinkSync as H3,writeFileSync as F3}from"fs";import{dirname as TQ,resolve as OQ}from"path";var DQ=65536;function l9($){try{return jQ($),!0}catch(Q){if(Q instanceof Error&&"code"in Q&&Q.code==="ENOENT")return!1;throw Q}}function T9($,Q=!1){if(!l9($)){if(!Q)throw Error("worker_state_missing");_Q($),CQ($,{mode:448})}let Z=jQ($);if(!Z.isDirectory()||Z.isSymbolicLink()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0||qQ($)!==OQ($))throw Error("worker_state_directory_not_private_or_canonical")}function _Q($){let Q=TQ($);if(!l9(Q))_Q(Q),CQ(Q,{mode:448});if(qQ(Q)!==OQ(Q))throw Error("worker_parent_not_canonical")}function O9($,Q=DQ){let Z=z3($,MQ.O_RDONLY|MQ.O_NOFOLLOW);try{let X=G3(Z);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>Q)throw Error("worker_file_not_private");return K3(Z,"utf8")}finally{Y3(Z)}}function AQ($,Q,Z=DQ){let X=JSON.stringify(Q);if(X===void 0)throw Error("worker_file_invalid");let J=X+`
-`;if(Buffer.byteLength(J,"utf8")>Z)throw Error("worker_file_too_large");if(T9(TQ($)),l9($))O9($,Z);let G=`${$}.${J3()}`;try{F3(G,J,{mode:384,flag:"wx"}),V3(G,$)}finally{if(l9(G))H3(G)}}import{spawn as W3}from"child_process";import{basename as U3,isAbsolute as u2}from"path";var B3=0,L3=120000,N3=15000,M3=65536;function S8($=process.execPath,Q=process.argv[1]){let Z=U3($),X=(Z.startsWith("bun")||Z.startsWith("node"))&&typeof Q==="string"&&Q.length>0;return{command:$,prefix:X?[Q]:[]}}function l2($={}){let{command:Q,prefix:Z}=S8($.executablePath,$.sourceEntrypoint),X=$.spawnProcess??W3,J=$.now??Date.now,G=null,z=0,V=!1,Y=(W)=>{try{W.kill("SIGKILL")}catch{}},H=()=>{if(V||G)return;let W;try{W=X(Q,[...Z,"__device","__hands-worker","--handoff-fd",String(B3)],{cwd:"/",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin"},shell:!1,stdio:["pipe","ignore","pipe"]})}catch{return}G=W,z=J(),W.on("error",()=>{if(G===W)G=null}),W.once("exit",(F,K)=>{if(G!==W)return;G=null,$.log?.("hands.worker_prespawn_exited",{exit_code:F,exit_signal:K})}),$.log?.("hands.worker_prespawned",{pid:W.pid??null})};return{arm:H,take(W){let F=G;if(!F||V)return null;let K=W.args.at(-1),L=W.options.env,B=W.options.cwd,U=[...Z,"__device","__hands-worker","--config"];if(W.command!==Q||W.args.length!==U.length+1||U.some((D,x)=>W.args[x]!==D)||typeof K!=="string"||!L||typeof B!=="string"||W.options.shell||JSON.stringify(W.options.stdio)!==JSON.stringify(["ignore","ignore","pipe"]))return null;G=null;let M=F.stdin,_={configPath:K,cwd:B,env:Object.fromEntries(Object.entries(L).filter((D)=>typeof D[1]==="string"))},q=JSON.stringify(_);if(F.exitCode!==null||F.signalCode!==null||!M||M.destroyed||J()-z>=L3-N3||Buffer.byteLength(q,"utf8")>M3)return Y(F),null;return M.on("error",()=>{return}),M.end(q),F.once("exit",()=>{H()}),$.log?.("hands.worker_prespawn_taken",{pid:F.pid??null}),F},adopt(W){W.once("exit",()=>{H()})},close(){if(V=!0,G)Y(G);G=null}}}import{accessSync as D3,constants as _3,statSync as A3}from"fs";import{homedir as x3,tmpdir as P3,userInfo as I3}from"os";var j3=new Set(["ALL_PROXY","BUN_BE_BUN","BUN_OPTIONS","CURL_CA_BUNDLE","GIT_SSL_CAINFO","GRPC_DEFAULT_SSL_ROOTS_FILE_PATH","HTTPS_PROXY","HTTP_PROXY","NO_PROXY","NODE_EXTRA_CA_CERTS","NODE_OPTIONS","NODE_TLS_REJECT_UNAUTHORIZED","REQUESTS_CA_BUNDLE","SSLKEYLOGFILE","SSL_CERT_DIR","SSL_CERT_FILE","all_proxy","http_proxy","https_proxy","no_proxy"]);var C3=["BUN_CONFIG_","BUN_INSPECT","DYLD_","NODE_DEBUG"],q3=new Set(["BUN_INSTALL"]);var T3=/^--(?:max-old-space-size|max-semi-space-size|stack-size)=\d{1,9}$/;function O3($){return($??"").split(/\s+/).filter(Boolean).every((Q)=>T3.test(Q.replaceAll("_","-")))}function xQ($){return Object.keys($).filter((Q)=>j3.has(Q)&&!(Q==="NODE_OPTIONS"&&O3($[Q]))||C3.some((Z)=>Q.startsWith(Z))||Q.startsWith("BUN_")&&!q3.has(Q)).sort()}var R3=new Set(["HOME","PATH","PWD","OLDPWD","SHLVL","_","TMPDIR","TMP","TEMP","SHELL","BASH_ENV","ENV","ZDOTDIR","PROMPT_COMMAND","IFS","CDPATH","GLOBIGNORE","SHELLOPTS","BASHOPTS","NODE_PATH"]),E3=/^(?:ARA_|REASON_|PI_|GIT_|GH_|GITHUB_|LD_|DYLD_|BUN_|BASH_FUNC_|SSH_)/,S3=/TOKEN|SECRET|PASSW|PASSPHRASE|CREDENTIAL|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|AUTH/i,w3=/^[A-Za-z_][A-Za-z0-9_]*$/;function RQ($=process.env){let Q=(J)=>{if(!J.startsWith("/")||/[\0\r\n]/.test(J)||J.length>32768)throw Error("invalid_host_execution_environment");return J};if($.PATH!==void 0&&(/[\0\r\n]/.test($.PATH)||$.PATH.length>32768))throw Error("invalid_host_execution_environment");let Z=new Set(xQ($)),X=Object.fromEntries(Object.entries($).filter((J)=>{let[G,z]=J;return typeof z==="string"&&z.length<=32768&&!z.includes("\x00")&&G.length<=128&&w3.test(G)&&!Z.has(G)&&!R3.has(G)&&!E3.test(G)&&!S3.test(G)}).sort(([J],[G])=>J.localeCompare(G)).slice(0,512));return{home:Q($.HOME||x3()),path:IQ($.PATH??"").join(":")||PQ,temporaryDirectory:Q($.TMPDIR||$.TMP||$.TEMP||P3()),variables:X}}function EQ($=process.env,Q=()=>I3().shell){let Z=(J)=>{if(!J||!/^\/[A-Za-z0-9._/-]*\/(?:bash|zsh)$/.test(J))return!1;try{return D3(J,_3.X_OK),A3(J).isFile()}catch{return!1}};if(Z($.SHELL))return $.SHELL;let X;try{X=Q()}catch{X=void 0}return Z(X)?X:"/bin/zsh"}import{readFileSync as bQ,realpathSync as SQ,statSync as b3}from"fs";import{homedir as k3}from"os";import{dirname as f3,isAbsolute as m3,join as D9,sep as g3}from"path";var M5="--proxy",j5="--proxy-ca-file",y3=262144;class J0 extends Error{}function b8($){let Q;try{Q=new URL($)}catch{throw new J0("The proxy must be a URL like https://proxy.example.com:3128.")}if(Q.protocol!=="https:"&&Q.protocol!=="http:")throw new J0("The proxy URL must use the https or http scheme.");if(!Q.hostname)throw new J0("The proxy URL must name a host.");if(Q.port!==""&&Number(Q.port)<1)throw new J0("The proxy URL must use a port between 1 and 65535.");if(Q.pathname!==""&&Q.pathname!=="/"||Q.search||Q.hash)throw new J0("The proxy URL must not carry a path, query, or fragment.");return Q.toString()}function C5($){let Q=new URL($.url),Z=Q.port||(Q.protocol==="https:"?"443":"80");return`${Q.hostname}:${Z}`}function h3($={}){let Q=$.home??k3(),Z=$.statePath??wQ();return[f3(Z),D9(Q,".ssh"),D9(Q,".aws"),D9(Q,".gnupg"),D9(Q,".kube"),D9(Q,"Library","Keychains")]}function v3($,Q){return Q===$||Q.startsWith($+g3)}function c3($,Q={}){if(!m3($))throw new J0("The proxy CA file must be an absolute path.");let Z,X,J;try{Z=SQ($);let V=b3(Z);X=V.size,J=V.isFile()}catch{throw new J0("The proxy CA file does not exist or is not readable.")}if(!J)throw new J0("The proxy CA file must be a regular file.");if(X>y3)throw new J0("The proxy CA file must be 256 KB or smaller.");let G=h3(Q).flatMap((V)=>{try{let Y=SQ(V);return Y===V?[V]:[V,Y]}catch{return[V]}});for(let V of[$,Z])if(G.some((Y)=>v3(Y,V)))throw new J0("The proxy CA file must not live inside a credential directory.");let z;try{z=bQ(Z,"utf8")}catch{throw new J0("The proxy CA file is not readable.")}if(!z.includes("-----BEGIN CERTIFICATE-----"))throw new J0("The proxy CA file must be a PEM certificate bundle.");return Z}function q5($,Q={}){if(!$.proxyUrl)throw new J0("A proxy URL is required.");let Z=b8($.proxyUrl),X=$.caFile===void 0?void 0:c3($.caFile,Q);return{version:s9,url:Z,...X===void 0?{}:{caFile:X}}}function T5($,Q=fetch){if(!$)return Q;let Z,X=!1;return(G,z)=>{if(!X){if($.caFile)try{Z=bQ($.caFile,"utf8")}catch{throw new J0(`The configured proxy CA file is not readable: ${$.caFile}`)}X=!0}let V={...z,proxy:$.url,...Z===void 0?{}:{tls:{ca:Z}}};return Q(G,V)}}import{createHash as d3}from"crypto";import{isAbsolute as fQ,join as mQ,relative as gQ,resolve as i9,sep as yQ}from"path";var n9=I.string().min(1).refine(fQ,"absolute path required"),k8=I.strictObject({version:I.literal(1),apiOrigin:I.url(),channel:I.enum(["staging","production"]),stateDirectory:n9,workspaceRoot:n9,lifetime:I.enum(["persistent","ephemeral"]),executionMode:I.enum(["confined","host"]).default("confined"),name:I.string().min(1).max(160).default("Reason headless worker"),slots:I.number().int().min(1).max(4).default(1),shutdownGraceMs:I.number().int().min(0).max(300000).default(30000),proxy:I.strictObject({version:I.literal(s9),url:I.string().refine(($)=>{try{return b8($)===$}catch{return!1}},"invalid proxy URL"),caFile:n9.optional()}).optional(),userChrome:I.boolean().optional(),cloudSessions:I.literal(!0).optional(),localLogins:I.boolean().optional(),folders:I.array(n9).min(1).max(31).optional()}),p3=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,E5=I.discriminatedUnion("channel",[k8,k8.extend({channel:I.literal("pr"),apiOrigin:I.string(),prEnvironment:I.string()}),k8.extend({channel:I.literal("local-qa"),apiOrigin:I.string()})]).superRefine(($,Q)=>{if($.channel==="local-qa"){if(!p3.test($.apiOrigin))Q.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else if($.channel==="pr"){let X=$.prEnvironment,J=/^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.up\.railway\.app$/.exec($.apiOrigin),G=J?.[1]?.match(/(?:^|-)pr-[0-9]+(?=-|$)/g)?.map((z)=>z.replace(/^-/,""));if(!X||/^pr-[1-9][0-9]*$/.exec(X)?.[0]!==X||J?.[0]!==$.apiOrigin||G?.length!==1||G[0]!==X)Q.addIssue({code:"custom",message:"PR worker requires explicit prEnvironment and an exact same-PR HTTPS Railway origin"})}else{let X=new URL($.apiOrigin);if(X.origin!==$.apiOrigin||X.username||X.password||X.protocol!=="https:"&&!(X.protocol==="http:"&&f8(X.origin))||!f8(X.origin)&&!kQ($.channel,X.origin))Q.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!_9($.workspaceRoot,$.stateDirectory))Q.addIssue({code:"custom",message:"state and workspace must be disjoint"});let Z=$.folders??[];if(new Set([$.workspaceRoot,...Z]).size!==Z.length+1||Z.some((X)=>!_9(X,$.stateDirectory)))Q.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function u3($){return mQ($.stateDirectory,`headless-${$.channel==="pr"?$.prEnvironment:$.channel}`)}function S5($,Q={},Z={}){let X=$.executionMode==="host"?"unsandboxed":"sandboxed";return{worker:Object.freeze({executionMode:X,runtimeDirectory:u3($),handsSlots:$.slots,readiness:Object.freeze({...Q}),...Z.persistentTerminals?{persistentTerminals:!0}:{},...Z.probing?.length?{probing:Object.freeze([...Z.probing])}:{},...Z.displayVideo?{displayVideo:!0}:{},...Z.handsBrowser&&Q["hands.connect"]===!0?{handsBrowser:!0}:{},...Z.githubSignedIn===void 0?{}:{githubSignedIn:Z.githubSignedIn},...$.userChrome!==!1&&Z.userChrome?{userChrome:Z.userChrome}:{},...$.cloudSessions&&Q["automation.call.v1"]===!0?{cloudSessions:!0}:{}}),proxy:$.proxy??null}}function _9($,Q){if(I0(Q,$))return!1;return!I0($,Q)||R0(mQ(yQ,gQ(i9($),i9(Q))))}function I0($,Q){let Z=gQ(i9($),i9(Q));return Z===""||Z!==".."&&!Z.startsWith(`..${yQ}`)&&!fQ(Z)}function w5($){let{proxy:Q,userChrome:Z,cloudSessions:X,localLogins:J,folders:G,...z}=$;return d3("sha256").update(JSON.stringify(z)).digest("hex")}import{readdir as l3}from"fs/promises";var s3=15000;function n3($){let Q=$ instanceof Error&&"code"in $?$.code:null;return Q==="EPERM"||Q==="EACCES"}function i3($){return new C("folder_access_denied",`macOS blocked Reason from opening ${$}. Allow Reason in System Settings \u203A Privacy & Security \u203A Files and Folders `+"(or Full Disk Access), then try again.")}async function hQ($,{timeoutMs:Q=s3,open:Z=(X)=>l3(X)}={}){let X,J=new Promise((G)=>{X=setTimeout(()=>G("pending"),Q)});try{if(await Promise.race([Z($).then(()=>"open"),J])==="pending")throw new C("folder_access_pending",`macOS is asking whether Reason may open ${$}. Answer the prompt on this Mac, then try again.`)}catch(G){if(n3(G))throw i3($);if(G instanceof C)throw G}finally{clearTimeout(X)}}import{chmodSync as A1,closeSync as x1,constants as l8,fstatSync as P1,lstatSync as zZ,openSync as I1,readSync as R1,realpathSync as s8,unlinkSync as E1}from"fs";import{lookup as S1}from"dns/promises";import{createRequire as w1}from"module";import{request as b1}from"http";import{request as k1}from"https";import d0 from"net";import{platform as UZ}from"os";import{basename as f1,extname as m1,isAbsolute as KZ,relative as n8,resolve as J9,sep as i8}from"path";var vQ=String.raw`
+`);if(B<0){if(U.length>16384)Y.destroy();return}if(Y.pause(),Y.off("data",F),B>16384||U.length>v.upload+16384)return Y.destroy();K(U,B).catch(()=>Y.destroy())};Y.on("data",F);async function K(L,B){let W=L.subarray(0,B).toString("latin1").split(`\r
+`),M=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(W.shift()??"");if(!M)throw Error("preview_request_invalid");M9(M[2]);let _=!1,q=0,D=[];for(let T of W){let k=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!k)throw Error("preview_header_invalid");if(k[1].toLowerCase()===b$){q++;let g=Buffer.from(k[2].trim());_=g.length===Z.length&&U4(g,Buffer.from(Z))}else if(k[1].toLowerCase()!=="host")D.push(T)}if(!_||q!==1||J||V.signal.aborted)throw Error("preview_connection_denied");let x=await $.connect(V.signal);if(J||V.signal.aborted)throw x.destroy(),Error("preview_closed");X.add(x),x.on("error",()=>Y.destroy()),x.once("close",()=>{X.delete(x),Y.destroy()}),Y.once("close",()=>x.destroy()),Y.setTimeout(0);let b=[`${M[1]} ${M[2]} HTTP/1.1`,`Host: 127.0.0.1:${x.remotePort}`,...D,"",""].join(`\r
+`);x.write(Buffer.concat([Buffer.from(b,"latin1"),L.subarray(B+4)])),x.pipe(Y),Y.pipe(x),Y.resume()}});await new Promise((Y,V)=>{G.once("error",V),G.listen(0,"127.0.0.1",Y)});let z=G.address();if(!z||typeof z==="string")throw G.close(),Error("preview_bind_failed");function H(){if(J)return;J=!0,Q.removeEventListener("abort",H);for(let Y of X)Y.destroy();X.clear(),G.close()}if(Q.addEventListener("abort",H,{once:!0}),Q.aborted)H();return{port:z.port,headers:{[b$]:Z},close:H}}var L4=60000,N4=1e4,M4=5000;async function j4($){process.stderr.write(`${JSON.stringify({event:"worker_preview.open_refused",job_id:$.jobId,port:$.port,reason_code:$.reason})}
+`);let Q=$.binding,Z;try{Z=y9($.deviceRelayUrl,"device")}catch{return}if(!Q)return;await new Promise((X)=>{let J=new C9(Z,{followRedirects:!1,perMessageDeflate:!1,maxPayload:4096}),G=setTimeout(()=>{J.terminate(),X()},v.authorizationMs*2);J.addEventListener("open",()=>{J.send(JSON.stringify({type:"refused",binding:Q,reason:$.reason})),J.close(1000,`worker_refused_${$.reason}`)}),J.addEventListener("error",()=>{clearTimeout(G),X()}),J.addEventListener("close",()=>{clearTimeout(G),X()})})}async function C4($,Q){let Z=Date.now()+N4,X;for(;;){if(!Q())return"closed";let J=X??=$.refusal().finally(()=>{X=void 0}),G,z=await Promise.race([J.catch(()=>"port_unproved"),new Promise((H)=>{G=setTimeout(()=>H("port_check_timeout"),v.authorizationMs)})]).finally(()=>clearTimeout(G));if(z===null)return null;if(!["listener_unproved","port_check_timeout"].includes(z)||Date.now()+500>=Z)return z;await new Promise((H)=>setTimeout(H,500))}}async function f$($){let Q=A0($.binding),Z=()=>!$.signal.aborted&&Date.now()<Q.expiresAtMs,X=Q.expiresAtMs>Date.now()+v.lifetimeMs+M4?"binding_mismatch":await C4($.port,Z);if(X)throw await j4({deviceRelayUrl:$.deviceRelayUrl,binding:Q,jobId:Q.jobId,port:Q.port,reason:X}),Error("preview_not_authorized",{cause:X});let J=y9($.deviceRelayUrl,"device"),G=await k$($.port,$.signal),z;try{z=new C9(J,{followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload*1.4+300000})}catch(O){throw G.close(),O}let H=new Map,Y=!1,V=!1,U=0,F=!1,K,L,B,W=new Promise((O)=>{B=O}),M,_,q=new Promise((O,N)=>{M=O,_=N}),D=(O)=>{let N=JSON.stringify(O);if(U+=Buffer.byteLength(N),!Z()||V||z.readyState!==C9.OPEN)return x(Z()?"relay_closed":"expired");if(z.bufferedAmount>v.relayBuffered)return x("relay_backlog");if(U>v.total)return x("quota");z.send(N)};function x(O="closed"){if(V)return;V=!0,clearInterval(k),clearTimeout(T),$.signal.removeEventListener("abort",b);for(let N of H.values())N.stop();H.clear(),G.close(),z.close(1000,`worker_${O}`),_(Error("preview_closed")),B()}let b=()=>x("aborted"),T=setTimeout(()=>x("pair_timeout"),v.requestMs),k=setInterval(async()=>{if(!Z())return x($.signal.aborted?"aborted":"expired");if(F)return;F=!0;try{let O=K??=Promise.resolve().then(()=>$.port.check()).finally(()=>{K=void 0}),N=await O8(()=>O);if(N===!1)return x("port_refused");if(N){L=void 0;return}if(Date.now()-(L??=Date.now())>L4)return x("port_unknown");for(let j of H.values())j.stop()}finally{F=!1}},1000);if($.signal.addEventListener("abort",b,{once:!0}),!Z())x($.signal.aborted?"aborted":"expired");z.addEventListener("open",()=>D({type:"hello",binding:Q,messages:v.upload,window:v.window})),z.addEventListener("close",()=>x("relay_closed")),z.addEventListener("error",()=>x("relay_error")),z.addEventListener("message",(O)=>{try{if(!Z()||V)return x($.signal.aborted?"aborted":"expired");if(typeof O.data!=="string")throw Error("preview_frame_invalid");if(U+=Buffer.byteLength(O.data),U>v.total)return x("quota");let N=E$(O.data);if(!Y){if(N.type!=="hello"||!y0(Q,N.binding))return x("binding_mismatch");Y=!0,clearTimeout(T),M();return}if(N.type==="hello"||N.type==="refused")return x("invalid_frame");if(N.type==="request"){g(N).catch(()=>x("invalid_request"));return}let j=H.get(N.id);if(!j)return;if(N.type==="cancel"||N.type==="end")j.stop();else if(N.type==="credit"&&j.credit)j.credit();else if(N.type==="data"&&j.ws){if(j.ws.readyState!==C9.OPEN||j.ws.bufferedAmount>v.buffered)return j.stop();let A=N9(N.data,v.upload);j.ws.send(N.binary?A:A.toString("utf8"))}else x("invalid_frame")}catch{x("invalid_frame")}});async function g(O){if(H.has(O.id)||H.size>=v.streams)return x("stream_limit");if(!Z())return x($.signal.aborted?"aborted":"expired");let N=new AbortController,j,A,m,w=0,E=(l=!1)=>{if(!H.delete(O.id))return;clearTimeout(j),N.abort(),A?.close(1000,"preview_closed"),m?.(),D({type:l?"end":"cancel",id:O.id})},P={stop:()=>E(),credit:()=>{w++,m?.()}};if(H.set(O.id,P),j=setTimeout(E,v.requestMs),!await j9(()=>$.port.check())||!Z()||N.signal.aborted)return E();let f=M9(O.path);if(O.upgrade){if(O.method!=="GET"||O.body)return E();let l=O.headers.find(([S])=>S.toLowerCase()==="sec-websocket-protocol")?.[1].split(",").map((S)=>S.trim());if(l?.some((S)=>!/^[a-zA-Z0-9._-]{1,100}$/.test(S))||(l?.length??0)>8)return E();A=new C9(`ws://127.0.0.1:${G.port}${f}`,l,{headers:G.headers,followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload}),P.ws=A,A.binaryType="arraybuffer",A.addEventListener("open",()=>{clearTimeout(j),D({type:"ws",id:O.id,protocol:A.protocol})}),A.addEventListener("message",(S)=>{let h=typeof S.data!=="string",c=R$(S.data);if(c.length>v.upload)return E();D({type:"data",id:O.id,data:c.toString("base64"),binary:h})}),A.addEventListener("error",()=>E()),A.addEventListener("close",(S)=>E(S.wasClean));return}let d=N9(O.body,v.upload),u=B4({hostname:"127.0.0.1",port:G.port,path:f,method:O.method,headers:{...Object.fromEntries(T8(O.headers)),...G.headers,connection:"close"},signal:N.signal,agent:!1,maxHeaderSize:16384},async(l)=>{try{let S=[];for(let h=0;h<l.rawHeaders.length;h+=2)S.push([l.rawHeaders[h],l.rawHeaders[h+1]]);D({type:"head",id:O.id,status:l.statusCode??502,headers:T8(S)}),clearTimeout(j);for await(let h of l){let c=Buffer.from(h);for(let a=0;a<c.length;a+=v.chunk){if(w===0&&!N.signal.aborted)await new Promise((V0)=>{m=V0});if(m=void 0,N.signal.aborted)return;w--,D({type:"data",id:O.id,data:c.subarray(a,a+v.chunk).toString("base64"),binary:!0})}}E(!0)}catch{E()}});u.on("error",()=>E()),u.end(d)}return await q,{close:x,closed:W}}import{execFile as q4}from"child_process";import{readFile as T4,readdir as O4,readlink as D4}from"fs/promises";import{connect as _4}from"net";import{setTimeout as A4}from"timers/promises";var x4={directory:O4,text:($)=>T4($,"utf8"),link:D4};class D8 extends Error{code;constructor($="port_unproved"){super("preview_port_ownership_unproved");this.code=$}}var $0=($)=>new D8($),h9="preview_listener_unproved",m$="00000000000000000000000001000000";async function P4($,Q,Z=x4){let X=new Map;for(let z of["tcp","tcp6"]){let H=await Z.text(`/proc/net/${z}`);if(H.length>4194304)throw $0();for(let Y of H.split(`
+`).slice(1)){let V=Y.trim().split(/\s+/);if(V.length<10||!["0A","01"].includes(V[3]))continue;let[U,F]=V[1].split(":"),[K,L]=V[2].split(":");if(Number.parseInt(F,16)!==Q)continue;let B=(_)=>_==="0100007F"||_==="0000000000000000FFFF00000100007F"||_===m$,W=V[3]==="0A";if(!(B(U)||W&&/^0+$/.test(U??"")))continue;if(!W&&!B(K))continue;let M=V[9];if(!/^[1-9][0-9]*$/.test(M))continue;X.set(M,{kernelId:M,port:Q,peerPort:W?null:Number.parseInt(L,16),state:W?"listen":"established",host:U===m$?"::1":"127.0.0.1"})}}let J=await Z.directory("/proc");if(J.length>8192)throw $0();let G=[];for(let z of J){if(!/^[1-9][0-9]*$/.test(z))continue;try{let H=await Z.text(`/proc/${z}/stat`),Y=H.slice(H.lastIndexOf(")")+2).trim().split(/\s+/);if(Number(Y[2])!==$)continue;let V=await Z.directory(`/proc/${z}/fd`);if(V.length>1024)throw $0();let U=[];for(let L of V){if(!/^[0-9]+$/.test(L))continue;let B=await Z.link(`/proc/${z}/fd/${L}`).catch(()=>""),W=/^socket:\[([0-9]+)\]$/.exec(B)?.[1],M=W?X.get(W):void 0;if(M)U.push({...M,pid:Number(z),processGroupId:$,descriptor:L})}let F=await Z.text(`/proc/${z}/stat`),K=F.slice(F.lastIndexOf(")")+2).trim().split(/\s+/);if(Y[19]===K[19]&&Y[2]===K[2])G.push(...U)}catch(H){if(H instanceof Error&&H.message==="preview_port_ownership_unproved")throw H}}return G}function I4($,Q,Z){if($.length>2097152)throw $0();let X=0,J=0,G="",z="",H="",Y="",V=[],U=()=>{if(X<1||J!==Q||!/^\d+$/.test(G)||!/^0x[0-9a-f]+$/i.test(z))return;let F=Y==="LISTEN"&&["*","127.0.0.1","[::ffff:127.0.0.1]","[::1]"].some((L)=>H===`${L}:${Z}`),K=new RegExp(`^(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):${Z}->(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):([0-9]+)$`).exec(H);if(F||Y==="ESTABLISHED"&&K)V.push({pid:X,processGroupId:J,descriptor:G,kernelId:z,state:F?"listen":"established",port:Z,peerPort:F?null:Number(K[1]),host:H.startsWith("[::1]:")?"::1":"127.0.0.1"})};for(let F of $.split(/[\0\n]/)){let K=F.slice(1);if(F[0]==="p")U(),X=Number(K),J=0,G=z=H=Y="";else if(F[0]==="g")J=Number(K);else if(F[0]==="f")U(),G=K,z=H=Y="";else if(F[0]==="d")z=K;else if(F[0]==="n")H=K;else if(F.startsWith("TST="))Y=F.slice(4)}return U(),V}async function R4($,Q){if(process.platform==="linux")return P4($,Q);if(process.platform!=="darwin")throw $0();let Z=await new Promise((X,J)=>q4("/usr/sbin/lsof",["-nP","-a","-g",String($),`-iTCP:${Q}`,"-F0pgfdnT"],{timeout:1000,maxBuffer:2097152,encoding:"utf8",env:{PATH:"/usr/bin:/bin",LC_ALL:"C"}},(G,z)=>G?J($0()):X(z)));return I4(Z,$,Q)}function g$($,Q={}){let Z=A0($.binding),X=Q.inspectSockets??R4,J=Q.monotonicNow??(()=>performance.now());async function G(){let Y=()=>{if(Date.now()>=Z.expiresAtMs)throw $0("binding_expired");if($.deniedPorts.has(Z.port))throw $0("port_denied")};Y();let V=await $.readCurrentJob(),U=V?.job,F=U?.process;if(Y(),!V)throw $0("server_stopped");if(!y0(Z,V.binding)||U?.jobId!==Z.jobId)throw $0("binding_changed");if(U.state!=="running"||U.finishedAtMs!==null||U.leaseExpiresAtMs<Z.expiresAtMs)throw $0("job_not_running");if(!F||F.pid<1||F.pid!==F.processGroupId||F.executorLaunchId!==V.executorLaunchId)throw $0("process_unproved");return{pid:F.pid,launch:F.executorLaunchId,started:U.startedAtMs}}async function z(Y=()=>{}){Y();let V=await G();Y();let U=await X(V.pid,Z.port).catch(()=>{throw Error(h9)});Y();let F=await G();if(Y(),V.pid!==F.pid||V.launch!==F.launch||V.started!==F.started)throw $0("job_restarted");if(!U.some((K)=>K.state==="listen"))throw Error(h9);return U}async function H(){try{return await z(),null}catch(Y){if(Y instanceof Error&&Y.message===h9)return"listener_unproved";return Y instanceof D8?Y.code:"port_unproved"}}return{refusal:H,async check(){let Y=await H();if(Y==="listener_unproved")throw Error(h9);return Y===null},async connect(Y){if(Y.aborted)throw $0();let V=J()+2000,U=new AbortController,F=new Promise((_)=>U.signal.addEventListener("abort",()=>_(null),{once:!0})),K,L=()=>{U.abort(),K?.destroy()},B=setTimeout(L,2000);Y.addEventListener("abort",L,{once:!0});let W=()=>{if(U.signal.aborted||Y.aborted||J()>=V||K?.destroyed)throw L(),$0()};async function M(_){W();let q=await Promise.race([_().then((D)=>({value:D})),F]);if(W(),!q)throw $0();return q.value}try{let _=await M(()=>z(W));W();let q=_.some((b)=>b.state==="listen"&&b.host==="127.0.0.1")?"127.0.0.1":"::1",D=_4({host:q,port:Z.port,signal:Y});K=D,D.once("close",L),await M(()=>new Promise((b,T)=>{D.once("connect",b),D.once("error",T)}));let x=D.localPort;if(!x)throw $0();while(!(await M(()=>z(W))).some((b)=>b.state==="established"&&b.peerPort===x))await M(()=>A4(Math.min(20,Math.max(1,V-J())),void 0,{signal:U.signal}));return W(),D}catch(_){throw L(),_}finally{clearTimeout(B),Y.removeEventListener("abort",L),K?.off("close",L),U.abort()}}}}var E4=4,S4=[2375,2376,9222,9229];function y$($){let Q=new Set(S4);for(let Z of $){let X=new URL(Z);Q.add(Number(X.port||(["https:","wss:"].includes(X.protocol)?443:80)))}return Q}function x0(){throw new C("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var w4=60000;function h$($){let Q=new AbortController,Z=new Map,X=(Y)=>JSON.stringify([Y.jobId,Y.port]);function J(Y){let V=$.authority.owner;if(Q.signal.aborted||!$.isCurrent()||$.expiresAtMs<=Date.now()||Y.organization_id!==V.organization_id||Y.user_id!==V.user_id||Y.device_id!==V.device_id)x0()}function G(Y){let V;try{V=$.environment.current()}catch{return null}return V.binding.target_generation===Y.generation&&V.binding.target_fence_id===Y.fenceId&&V.run_id===$.runId&&V.device_id===$.authority.owner.device_id&&V.root_id===$.authority.rootId?V:null}async function z(Y,V,U){let F=await H(Y,V,U);if(F!=="moved")return F;let K=await H(Y,V,U);return K==="moved"?null:K}async function H(Y,V,U){try{J($.authority.owner);let F=$.identity();if(!F||U.aborted||Y.expiresAtMs<=Date.now()||Y.expiresAtMs>$.expiresAtMs)return null;let K=V.opened,L=K!==void 0&&F.generation>K.generation,B=G(F);if(L){if(B){if(B.revision<=K.revision||Y.expiresAtMs>Date.parse(B.expires_at)||B.binding.target_revision!==K.attachmentRevision||B.binding.root_grant_revision!==K.grantRevision)return null;V.recoveringSinceMs=void 0}else if(Date.now()-(V.recoveringSinceMs??=Date.now())>w4)return null}else if(!B||Y.expiresAtMs>Date.parse(B.expires_at)||K&&(F.generation!==K.generation||F.fenceId!==K.fenceId))return null;let W=await $.inspect(Y.jobId,U),M=$.identity(),_=M&&G(M);J($.authority.owner);let q=B&&{generation:F.generation,fenceId:F.fenceId,snapshotId:B.snapshot_id,revision:B.revision,attachmentRevision:B.binding.target_revision,grantRevision:B.binding.root_grant_revision},D=L?K:q;if(U.aborted||!M)return null;if(M.generation!==F.generation||M.fenceId!==F.fenceId||_?.snapshot_id!==B?.snapshot_id||_?.revision!==B?.revision)return"moved";let x=W.ok&&W.job.environmentSnapshotId!==void 0&&W.job.environmentRevision!==void 0?{snapshotId:W.job.environmentSnapshotId,revision:W.job.environmentRevision}:null;if(!W.ok||W.generation!==F.generation||!D||!x)return null;if((x.snapshotId!==D.snapshotId||x.revision!==D.revision)&&(L||!$.environment.carried(x.snapshotId,x.revision)))return null;if(!K&&F.generation===Y.generation&&F.fenceId===Y.fenceId)V.opened={...D,...x};return{executorLaunchId:$.executorLaunchId,job:W.job,binding:{organizationId:$.authority.owner.organization_id,userId:$.authority.owner.user_id,deviceId:$.authority.owner.device_id,rootId:$.authority.rootId,runId:$.runId,attachmentRevision:D.attachmentRevision,grantRevision:D.grantRevision,generation:D.generation,fenceId:D.fenceId,jobId:W.job.jobId,port:Y.port,expiresAtMs:Y.expiresAtMs}}}catch{return null}}return{async open(Y,V,U){J(V);let{binding:F,deviceRelayUrl:K}=S$(Y);if(U.aborted||F.expiresAtMs<=Date.now()||F.expiresAtMs>Date.now()+v.lifetimeMs||new URL(K).origin!==$.authority.relayOrigin)x0();let L=X(F),B=Z.get(L);if(B){if(!y0(B.binding,F)||B.relay!==K)x0();if(await B.opened,!await j9(()=>B.port.check())||U.aborted||B.abort.signal.aborted)x0();return{opened:!0,binding:F}}if(Z.size>=E4)x0();let W=new AbortController,M={},_=g$({binding:F,deniedPorts:$.authority.deniedPorts,readCurrentJob:()=>z(F,M,W.signal)}),q=()=>W.abort();if(U.addEventListener("abort",q,{once:!0}),Q.signal.addEventListener("abort",q,{once:!0}),U.aborted||Q.signal.aborted)q();let D=f$({binding:F,deviceRelayUrl:K,port:_,signal:W.signal}),x={binding:F,relay:K,abort:W,port:_,opened:D};Z.set(L,x);let b=()=>{if(U.removeEventListener("abort",q),Q.signal.removeEventListener("abort",q),Z.get(L)===x)Z.delete(L)};try{if((await D).closed.then(b),U.removeEventListener("abort",q),J(V),W.signal.aborted||!await j9(()=>_.check()))x0();return{opened:!0,binding:F}}catch{W.abort(),b(),x0()}},async close(Y,V){J(V);let{binding:U}=w$(Y),F=Z.get(X(U));if(!F||!y0(F.binding,U))x0();return F.abort.abort(),await F.opened.then((K)=>K.closed,()=>{return}),{closed:!0,binding:U}},dispose(){Q.abort();for(let Y of Z.values())Y.abort.abort();Z.clear()}}}import{WebSocket as _8}from"ws";var v$=($)=>("data"in $)?$.data.length:$.bytes,c$=2*p$;function i($){throw new C($,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var o0=($)=>!["starting","running"].includes($.state);function H2($,Q,Z=Date.now()){let X=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys($).length!==X.length||Object.keys($).some((V)=>!X.includes(V))||!A8(Q)||!A8($.session_id)||typeof $.expires_at!=="string"||typeof $.relay_url!=="string"||$.relay_url.length>4096||![$.cols,$.rows].every((V)=>Number.isSafeInteger(V)&&Number(V)>=1&&Number(V)<=x8))i("invalid_pty_request");let J=$.pty;if(!J||typeof J!=="object"||Array.isArray(J))i("invalid_pty_request");let G=J;if(Object.keys(G).length!==2||G.version!==1||!d9(G.jobId))i("invalid_pty_request");let z;try{z=new URL($.relay_url)}catch{return i("invalid_pty_request")}if(!["ws:","wss:"].includes(z.protocol)||z.username||z.password||z.hash||z.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(z.hostname))i("invalid_pty_request");let H=Date.parse($.expires_at);if(!Number.isSafeInteger(H)||H<=Z)i("invalid_pty_request");return{workspace:d$($.workspace)??i("invalid_pty_request"),session:{jobId:G.jobId,sessionId:$.session_id,operationId:Q,relayUrl:z.href,cols:Number($.cols),rows:Number($.rows),leaseExpiresAtMs:Math.min(H,Z+43200000)}}}async function s$($){let{session:Q,binding:Z}=$;if(Z.assertCurrent(),$.signal.aborted||Date.now()>=Q.leaseExpiresAtMs)i("cancelled");let X=new _8(Q.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:v9}),J=new AbortController,G=()=>{},z=()=>{J.abort(),G()};$.signal.addEventListener("abort",z,{once:!0});let H=setTimeout(z,Math.max(1,Q.leaseExpiresAtMs-Date.now())),Y=[],V=0,U=0,F=0,K=!1,L=!1,B=!1,W,M,_,q=(N)=>{_=new C(N,"Bound terminal input was refused."),z()};X.on("error",()=>q("pty_relay_unavailable")),X.on("close",z),X.on("message",(N,j)=>{if(J.signal.aborted)return;if(!L){q("pty_not_ready");return}let A=Array.isArray(N)?Buffer.concat(N):N instanceof ArrayBuffer?Buffer.from(N):N;if(A.length===0)return;let m=Y.at(-1),w=j&&m!==void 0&&"data"in m&&m.data.length+A.length<=v9;if(A.length>v9||V+A.length>u$){q("pty_input_backpressure");return}if(w)m.data=Buffer.concat([m.data,A]);else if(j)Y.push({data:Buffer.from(A)});else try{let E=JSON.parse(A.toString("utf8"));if(E&&E.t==="close"&&Object.keys(E).length===1){B=!0,z();return}if(!E||E.t!=="resize"||Object.keys(E).length!==3||![E.cols,E.rows].every((P)=>Number.isSafeInteger(P)&&P>=1&&P<=x8))throw Error("invalid_control");Y.push({cols:E.cols,rows:E.rows,bytes:A.length})}catch{q("invalid_pty_control");return}V+=A.length,G()});function D(N){return l$(JSON.stringify({...Z.scope,version:1,sessionId:Q.sessionId,operationId:Q.operationId,job:{...N,output:[],pty:N.pty?{...N.pty,output:[]}:void 0}}))}function x(N){if(!N.ok)i(N.error);let j=N.job;if(N.generation!==Z.scope.generation||j.jobId!==Q.jobId||!j.pty||j.leaseExpiresAtMs>Q.leaseExpiresAtMs||j.process&&j.process.executorLaunchId!==Z.scope.executorLaunchId||j.process&&M&&(j.process.pid!==M.pid||j.process.processGroupId!==M.processGroupId)||j.state!=="starting"&&(j.environmentRevision!==Z.environment.revision||j.environmentSnapshotId!==Z.environment.snapshotId))i("pty_binding_changed");if(D(j),j.process)M??={...j.process};return j}async function b(N){Z.assertCurrent();let j=await Z.request(N,J.signal);if(Z.assertCurrent(),J.signal.aborted)i("cancelled");let A=x(j);if(A.inputSequence!==U)i("job_input_sequence");if(!o0(A)&&A.leaseExpiresAtMs<=Date.now())i("pty_binding_changed");return A}function T(N){if(Z.assertCurrent(),J.signal.aborted||X.readyState!==_8.OPEN||X.bufferedAmount+Buffer.byteLength(N)>c$)i("pty_output_backpressure");X.send(N)}function k(N){if(N.firstCursor>F+1)F=N.firstCursor-1;for(let j of N.pty.output){if(j.cursor<=F)continue;if(j.cursor!==F+1)i("pty_output_gap");let A=Buffer.from(j.dataBase64,"base64");if(X.bufferedAmount+A.length>c$)return!1;T(A),F=j.cursor}if(F!==N.nextCursor)i("pty_output_gap");return!0}async function g(N,j){let A;try{await Promise.race([$.emit(N,j),new Promise((m,w)=>{A=setTimeout(()=>w(new C("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(A)}}async function O(){let N=AbortSignal.timeout(c9),j=Z.request({jobId:Q.jobId,action:"cancel",input:{}},N),A,m=new Promise((w,E)=>{if(A=()=>E(new C("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),N.addEventListener("abort",A,{once:!0}),N.aborted)A()});try{let w=await Promise.race([j,m]);if(N.aborted)i("pty_cleanup_unconfirmed");return x(w)}finally{N.removeEventListener("abort",A)}}try{await new Promise((w,E)=>{let P=setTimeout(()=>{z(),E(new C("pty_relay_unavailable","Terminal pairing timed out."))},5000),f=()=>{clearTimeout(P),E(new C("cancelled","Terminal pairing was cancelled."))};if(J.signal.addEventListener("abort",f,{once:!0}),X.once("open",()=>{clearTimeout(P),J.signal.removeEventListener("abort",f),w()}),J.signal.aborted)f()}),Z.assertCurrent(),K=!0,W=await b({jobId:Q.jobId,action:"start",input:{mode:"pty",cols:Q.cols,rows:Q.rows,leaseExpiresAtMs:Q.leaseExpiresAtMs}});let N=Date.now()+5000;while(W.state==="starting"){if(Date.now()>=N)i("pty_not_ready");await new Promise((w)=>setTimeout(w,25)),W=await b({jobId:Q.jobId,action:"inspect",input:{after:F}})}if(W.state!=="running"||W.inputSequence!==0||W.leaseExpiresAtMs<=Date.now())i("pty_not_ready");await g("pty.ready",D(W)),L=!0,T(JSON.stringify({t:"open",cols:W.pty.cols,rows:W.pty.rows,receipt:D(W)}));let j=!1,A=0,m=!1;while(!J.signal.aborted){let w=W.firstCursor>F+1,E=k(W);if(o0(W)){if(E)break}else if(w)j=!0;else if(j&&E&&Date.now()>=A){j=!1,A=Date.now()+1000;let{cols:f,rows:d}=W.pty;for(let u of[{cols:f,rows:d>1?d-1:2},{cols:f,rows:d}]){if(o0(W))break;let l=++U;if(W=await b({jobId:Q.jobId,action:"resize",input:{sequence:l,...u}}),W.inputSequence!==l)i("job_input_sequence")}continue}let P=o0(W)||m?void 0:Y.shift();if(P){V-=v$(P);let f=++U;try{W=await b("data"in P?{jobId:Q.jobId,action:"input",input:{sequence:f,dataBase64:P.data.toString("base64")}}:{jobId:Q.jobId,action:"resize",input:{sequence:f,cols:P.cols,rows:P.rows}})}catch(d){if(!(d instanceof C)||d.code!=="job_input_backpressure")throw d;U-=1,Y.unshift(P),V+=v$(P),m=!0;continue}if(W.inputSequence!==f)i("job_input_sequence")}else if(await new Promise((f)=>{let d=setTimeout(f,m||!E?10:50);if(G=()=>{clearTimeout(d),f()},J.signal.aborted||!m&&Y.length)G()}),m=!1,G=()=>{},!J.signal.aborted&&E)try{W=await b({jobId:Q.jobId,action:"inspect",input:{after:F}})}catch(f){if(!B||!(f instanceof C)||f.code!=="cancelled")throw f}}}catch(N){_??=N}finally{if(L=!1,Y.length=0,clearTimeout(H),$.signal.removeEventListener("abort",z),z(),K&&(!W||!o0(W)))try{W=await O()}catch{W=void 0}try{if(!W||!o0(W)||W.pty?.cleanup!=="confirmed")i("pty_cleanup_unconfirmed");let N=D(W);if(X.readyState===_8.OPEN)await new Promise((j)=>{let A=setTimeout(j,500);X.send(JSON.stringify({t:"exit",code:W.exitCode,receipt:N}),()=>{clearTimeout(A),j()})});await g("pty.stopped",N)}catch(N){_??=N}X.terminate()}if(_)throw _;if($.signal.aborted)i("cancelled");if(!W)i("pty_cleanup_unconfirmed");return{receipt:D(W)}}import{createHash as b4,randomUUID as QQ}from"crypto";import{spawnSync as k4}from"child_process";import{closeSync as n$,constants as P8,fstatSync as f4,fsyncSync as m4,lstatSync as q9,mkdirSync as g4,mkdtempSync as ZQ,openSync as i$,readFileSync as y4,readdirSync as XQ,realpathSync as t0,rmSync as I8,unlinkSync as h4}from"fs";import{createConnection as v4}from"net";import{dirname as c4,join as h0,sep as d4}from"path";import{tmpdir as p4}from"os";var e=new Map,P0=new Map;function C0($,Q){return b4("sha256").update(JSON.stringify([$,Q])).digest("hex")}function r0($){try{g4($,{mode:448})}catch(Z){if(!(Z instanceof Error&&("code"in Z)&&Z.code==="EEXIST"))throw Z}let Q=q9($);if(!Q.isDirectory()||Q.isSymbolicLink()||Q.uid!==process.getuid?.()||(Q.mode&63)!==0||t0($)!==$)throw new C("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function u4($){let Q;try{Q=q9($)}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!1;throw Z}return!Q.isDirectory()||Q.isSymbolicLink()||XQ($).length>0}function JQ($){let Q=C0($.root,$.runId),Z=$.previousRuntimeDirectories?.find((z)=>u4(h0(z,"jobs",Q.slice(0,16))))??$.runtimeDirectory;r0(Z);let X=h0(Z,"jobs");r0(X);let J=h0(X,Q.slice(0,16));if($.maxScopes!==void 0){let z=XQ(X);if(!Number.isSafeInteger($.maxScopes)||$.maxScopes<1||z.length>$.maxScopes||!z.includes(Q.slice(0,16))&&z.length>=$.maxScopes)throw new C("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}r0(J);let G=ZQ(h0(t0("/tmp"),"reason-j-"));try{return r0(G),{journalDirectory:J,scopeId:Q,socketPath:h0(G,"control.sock"),disposeSocket:()=>I8(G,{recursive:!0,force:!0})}}catch(z){throw I8(G,{recursive:!0,force:!0}),z}}var l4=60000,s4=5000;function n4($){let Q=k4("ps",["-o","lstart=","-p",String($)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),Z=Q.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(Q.stdout.trim()):null,X=Z?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(Z[1]):-1;if(!Z||X<0||X%3!==0)return null;let J=new Date(Number(Z[6]),X/3,Number(Z[2]),Number(Z[3]),Number(Z[4]),Number(Z[5])).getTime();return Number.isFinite(J)?J:null}function YQ($,Q={}){let Z=h0($.journalDirectory,"owner.lock"),X;try{X=i$(Z,P8.O_RDONLY|P8.O_NOFOLLOW)}catch{return null}try{let J=f4(X);if(!J.isFile()||J.nlink!==1||J.uid!==process.getuid?.()||(J.mode&63)!==0||J.size>4096)return null;let G=null;try{G=JSON.parse(y4(X,"utf8"))}catch{}let z;if(G===null){if((Q.now??Date.now)()-J.mtimeMs<l4)return null;z={reason:"never_written",executorLaunchId:null}}else{let{version:V,scopeId:U,pid:F,createdAtMs:K,executorLaunchId:L}=G;if(V!==1||U!==$.scopeId||typeof L!=="string"||typeof F!=="number"||!Number.isSafeInteger(F)||F<1||F===process.pid||typeof K!=="number"||!Number.isSafeInteger(K))return null;if(!(Q.exists??((W)=>{try{return process.kill(W,0),!0}catch(M){return!(M instanceof Error&&("code"in M)&&M.code==="ESRCH")}}))(F))z={reason:"owner_exited",executorLaunchId:L};else{let W=(Q.startedAtMs??n4)(F);if(W===null||W<=K+s4)return null;z={reason:"pid_reused",executorLaunchId:L}}}let H=q9(Z);if(H.dev!==J.dev||H.ino!==J.ino)return null;h4(Z);let Y=i$($.journalDirectory,P8.O_RDONLY);try{m4(Y)}finally{n$(Y)}return z}catch{return null}finally{n$(X)}}function GQ($){let Q={...$,workspace:$.workspace&&Object.freeze({...$.workspace}),previewAuthority:$.previewAuthority&&Object.freeze({...$.previewAuthority,owner:Object.freeze({...$.previewAuthority.owner}),deniedPorts:new Set($.previewAuthority.deniedPorts)})},Z=C0(Q.root,Q.runId);if(e.has(Z)||Q.operationId!==void 0&&P0.has(Q.operationId))throw new C("hands_jobs_busy","The Session already has a live Hands job supervisor.");let X={binding:Q,key:Z,terminals:new Map};if(Q.previewAuthority&&Q.environment)X.previews=h$({authority:Q.previewAuthority,runId:Q.runId,expiresAtMs:Q.expiresAtMs,executorLaunchId:Q.executorLaunchId,environment:Q.environment,isCurrent:()=>e.get(X.key)===X,identity:()=>{try{return e0(Q)}catch{return null}},inspect:(J,G)=>{if(e.get(X.key)!==X)throw new C("preview_unavailable","The Hands supervisor is no longer current.");return zQ(Q,{jobId:J,action:"inspect",input:{after:0}},G)}});if(e.set(Z,X),Q.operationId!==void 0)P0.set(Q.operationId,X);return()=>{if(e.get(X.key)===X)e.delete(X.key);if(Q.operationId!==void 0&&P0.get(Q.operationId)===X)P0.delete(Q.operationId);X.previews?.dispose();for(let J of X.terminals.values())J.abort()}}var i4=5000,a4=20;async function _2($){let Q=(J)=>{throw new C("hands_rebind_unavailable",J)};if(!j0($.operationId)||!j0($.runId)||!j0($.fenceId)||!I0($.targetGeneration))Q("Reason sent an invalid Hands rebind.");let Z=P0.get($.operationId);if(!Z||Z.binding.root!==$.root)return Q("No live Hands supervisor owns this operation.");for(let J=Date.now()+i4;;){if($.signal?.aborted)Q("The Hands rebind was cancelled.");if(P0.get($.operationId)!==Z)Q("The Hands supervisor is no longer current.");let G=null;try{G=e0(Z.binding)}catch{}if(G&&G.generation===$.targetGeneration&&G.fenceId===$.fenceId)break;if(G&&G.generation>$.targetGeneration||Date.now()>=J)Q("The executor did not adopt this take.");await new Promise((z)=>setTimeout(z,a4))}if(P0.get($.operationId)!==Z||e.get(Z.key)!==Z)Q("The Hands supervisor is no longer current.");let X=C0($.root,$.runId);if(Z.key===X)return;if(e.has(X))Q("The taking run already has a live Hands job supervisor.");e.delete(Z.key);for(let J of Z.terminals.values())J.abort();Z.key=X,e.set(X,Z)}function A2($){let Q="operationId"in $?P0.get($.operationId):e.get(C0($.root,$.runId)),Z=Q&&Q.binding.root===$.root?Q.binding:void 0;if(!Z?.environment||Z.expiresAtMs<=Date.now())throw new C("environment_unavailable","No live Hands supervisor owns this environment.");return Z.environment.install($.payload)}async function x2($){let Q=e.get(C0($.root,$.runId));if(!Q?.previews||!$.owner)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.open($.payload,$.owner,$.signal)}async function P2($){let Q=e.get(C0($.root,$.runId));if(!Q?.previews||!$.owner||$.signal.aborted)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.close($.payload,$.owner)}async function I2($){let Q=C0($.root,$.runId),Z=e.get(Q),X=Z?.binding,J=X?.runId,G=X?.previewAuthority,z=X?.environment,H=$.owner&&{...$.owner},Y=$.authority&&{...$.authority},V=()=>{throw new C("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!Z||!X||!G||!z||!H||!Y||!X.workspace)return V();let U=Object.freeze({...X.workspace}),F=e0(X),K=z.current(),L=()=>{if(e.get(Q)!==Z||H.organization_id!==G.owner.organization_id||H.user_id!==G.owner.user_id||H.device_id!==G.owner.device_id||$.deviceId!==G.owner.device_id||$.rootId!==G.rootId||v0($.workspace)!==v0(U))V();let W=e0(X),M=z.current();if(W.generation!==F.generation||W.fenceId!==F.fenceId||M.run_id!==J||M.device_id!==$.deviceId||M.root_id!==$.rootId||M.snapshot_id!==K.snapshot_id||M.revision!==K.revision||M.binding.target_generation!==F.generation||M.binding.target_fence_id!==F.fenceId||Y.device_id!==$.deviceId||Y.binding!==M.binding.kind||Y.target_revision!==M.binding.target_revision||Y.root_grant_revision!==M.binding.root_grant_revision||Y.target_generation!==F.generation||Y.target_fence_id!==F.fenceId)V()};if(L(),new URL($.session.relayUrl).origin!==G.relayOrigin||Z.terminals.has($.session.jobId)||Z.terminals.size>=4)return V();let B=new AbortController;Z.terminals.set($.session.jobId,B);try{return await s$({session:{...$.session,leaseExpiresAtMs:Math.min($.session.leaseExpiresAtMs,F.expiresAtMs,Date.parse(K.expires_at))},signal:AbortSignal.any([$.signal,B.signal]),emit:$.emit,binding:{assertCurrent:L,environment:{revision:K.revision,snapshotId:K.snapshot_id},scope:{runId:$.runId,deviceId:$.deviceId,rootId:$.rootId,workspace:U,binding:K.binding.kind,targetRevision:K.binding.target_revision,rootGrantRevision:K.binding.root_grant_revision,generation:F.generation,fenceId:F.fenceId,executorLaunchId:F.executorLaunchId},request:(W,M)=>KQ(F,R8(JSON.stringify({...W,type:"job",version:2,generation:F.generation,id:QQ()})),M)}})}finally{if(Z.terminals.get($.session.jobId)===B)Z.terminals.delete($.session.jobId)}}async function R2($){if(d9($.payload.jobId))throw new C("pty_binding_required","PTY jobs require the bound terminal capability.");let Q=e.get(C0($.root,$.runId))?.binding;if(!Q||Q.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return zQ(Q,$.payload,$.signal)}var o4=1e4,r4=20,t4=t$/2,e4=r$/2,$3=($)=>$.output.reduce((Q,Z)=>Q+Z.text.length,0);async function zQ($,Q,Z){if(Object.keys(Q).some((V)=>!["jobId","action","input","waitForExitMs"].includes(V)))throw new C("invalid_payload","Unexpected job control field.");let{waitForExitMs:X,...J}=Q;if(X!==void 0&&(J.action!=="start"||typeof J.input!=="object"||J.input===null||!("script"in J.input)||typeof X!=="number"||!Number.isSafeInteger(X)||X<1||X>o4))throw new C("invalid_payload","Only a script start may wait for its job, within its bound.");let G=(V)=>{let U=e0($);return KQ(U,R8(JSON.stringify({...V,type:"job",version:2,generation:U.generation,id:QQ()})),Z)},z=await G(J);if(X===void 0)return z;let H=Date.now()+X,Y=z;while(Y.ok&&["starting","running"].includes(Y.job.state)&&Y.job.output.length<t4&&$3(Y.job)<e4&&!Z.aborted&&Date.now()<H){if(await new Promise((V)=>setTimeout(V,Math.min(r4,H-Date.now()))),Z.aborted)break;try{let V=await G({jobId:J.jobId,action:"inspect",input:{after:0}});if(!V.ok)break;Y=V}catch{break}}return Y}function e0($){if($.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","Hands authority expired.");let Q=$.readIdentity?$.readIdentity():$;if(!Q||!I0(Q.generation)||!j0(Q.fenceId)||Q.generation<$.generation||Q.generation===$.generation&&Q.fenceId!==$.fenceId)throw new C("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return $.generation=Q.generation,$.fenceId=Q.fenceId,{...$}}function KQ($,Q,Z){if(Z.aborted)return Promise.reject(new C("cancelled","Job control was cancelled."));return new Promise((X,J)=>{let G=v4($.socketPath),z="",H=!1,Y,V=(F,K)=>{if(H)return;if(H=!0,clearTimeout(Y),Z.removeEventListener("abort",U),G.destroy(),F)J(F);else X(K)},U=()=>V(new C("cancelled","Job control waiter cancelled; inspect before retrying mutations."));Z.addEventListener("abort",U,{once:!0}),G.setEncoding("utf8"),Y=setTimeout(()=>V(new C("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,$.expiresAtMs-Date.now()))),G.on("error",()=>V(new C("hands_job_result_unknown","Hands job control connection failed."))),G.once("connect",()=>G.write(JSON.stringify({version:1,scopeId:$.scopeId,fenceId:$.fenceId,executorLaunchId:$.executorLaunchId,request:Q})+`
+`)),G.on("data",(F)=>{if(z+=F,Buffer.byteLength(z)>e$)V(new C("hands_job_result_unknown","Hands job result exceeded its bound."))}),G.once("end",()=>{if(Date.now()>=$.expiresAtMs){V(new C("hands_job_result_unknown","Hands authority expired before the result was acknowledged."));return}try{let F=$Q(z.trim());if(F.id!==Q.id||F.generation!==$.generation||F.ok&&F.job.jobId!==Q.jobId)throw Error("identity");V(void 0,F)}catch{V(new C("hands_job_result_unknown","Hands job response identity or shape was invalid."))}}),G.once("close",()=>{if(!H)V(new C("hands_job_result_unknown","Hands job control closed before an acknowledged result."))})})}function Q3($){let Q=t0($.root),Z=$.authority,X=Date.parse($.leaseUntil),J=()=>{if($.signal.throwIfAborted(),!Number.isFinite(X)||X<=Date.now())throw Error("local_device_gh_lease_expired")};if(J(),Z.readOnly&&Z.generation===null)return{root:Q,readOnly:!0,signal:$.signal,deadlineMs:X,assertCurrent:J};let G=C0(Q,$.runId),z=e.get(G),H=z?.binding;if(!H?.environment||!H.workspace||H.localGithubConfinement!==!0)throw Error("local_device_gh_confinement_unavailable");let Y=H.environment.current(),V=()=>{J();let F=H.environment.current(),K=e0(H);if(e.get(G)!==z||F.github_auth!=="local_gh"||F.run_id!==H.runId||Z.runId!==$.runId||F.device_id!==Z.deviceId||F.root_id!==Z.rootId||String(F.binding.root_grant_revision)!==Z.rootRevision||F.binding.target_generation!==Z.generation||F.binding.target_fence_id!==Z.fenceId||K.generation!==Z.generation||K.fenceId!==Z.fenceId||F.snapshot_id!==Y.snapshot_id||F.revision!==Y.revision)throw Error("local_device_gh_authority_changed")};V();let U=p9(Q,H.workspace);return{root:U.boundary,signal:$.signal,deadlineMs:X,privateDirectory:c4(H.environment.path),repoPath:U.path,readOnly:Z.readOnly,forbiddenSecretValues:Object.values(Y.variables),secretNames:(F)=>Object.entries(Y.variables).filter(([,K])=>K.trim()===F.trim()).map(([K])=>`variable ${K}`),assertCurrent:V}}async function E2($,Q){let Z=a$.parse($.request),X=o$.parse($.authority);if(Z.kind!=="pr_merge"){if(X.merge)throw Error("local_device_gh_merge_authority_invalid");return Q(Q3($))}if(!X.merge||X.readOnly||X.runId!==$.runId||X.repoFullName!==Z.repoFullName||X.merge.source==="agent"&&(X.generation===null||X.fenceId===null))throw Error("local_device_gh_merge_authority_invalid");let J=t0($.root),G=q9(J),z=Date.parse($.leaseUntil);if(!Number.isFinite(z)||z<=Date.now())throw Error("local_device_gh_lease_expired");let H=t0(p4());if(H===J||H.startsWith(J+d4))throw Error("local_device_gh_private_scope_unavailable");let Y=ZQ(h0(H,"reason-gh-merge-"));try{r0(Y);let V=()=>{if($.signal.throwIfAborted(),Date.now()>=z)throw Error("local_device_gh_lease_expired");let U=q9($.root);if(U.isSymbolicLink()||U.dev!==G.dev||U.ino!==G.ino||t0($.root)!==J)throw Error("local_device_gh_authority_changed");r0(Y)};return V(),await Q({root:J,readOnly:!1,privateDirectory:Y,forbiddenSecretValues:[],signal:$.signal,deadlineMs:z,assertCurrent:V})}finally{I8(Y,{recursive:!0,force:!0})}}var FQ=43200000;function $9($){return Number.isSafeInteger($)&&Math.abs($)<=8640000000000000?$:null}function HQ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function VQ($,Q){return Object.keys($).length===Q.length&&Q.every((Z)=>Object.hasOwn($,Z))}function w2($){if(!HQ($)||!VQ($,["version","outcome","clock_source","validation_now_ms","expiry_ms","remaining_ms","maximum_lifetime_ms","cli_artifact"])||$.version!==1||$.maximum_lifetime_ms!==43200000||typeof $.outcome!=="string"||!["accepted","parse","noncanonical","expired","over_cap"].includes($.outcome)||typeof $.clock_source!=="string"||!["date_now","injected"].includes($.clock_source))return null;for(let X of["validation_now_ms","expiry_ms"]){let J=$[X];if(J!==null&&(typeof J!=="number"||$9(J)===null))return null}if($.remaining_ms!==null&&(typeof $.remaining_ms!=="number"||!Number.isSafeInteger($.remaining_ms)))return null;let Q=typeof $.expiry_ms==="number"&&typeof $.validation_now_ms==="number"?$.expiry_ms-$.validation_now_ms:null;if($.remaining_ms!==(Q!==null&&Number.isSafeInteger(Q)?Q:null))return null;if($.outcome==="parse"&&$.expiry_ms!==null)return null;if($.outcome!=="parse"&&$.expiry_ms===null)return null;if($.outcome==="expired"&&!(typeof Q==="number"&&Q<=0))return null;if($.outcome==="over_cap"&&!(typeof Q==="number"&&Q>43200000))return null;if($.outcome==="accepted"&&!(typeof Q==="number"&&Q>0&&Q<=43200000))return null;let Z=$.cli_artifact;if(!HQ(Z)||!VQ(Z,["kind","status","sha256","observed_at_ms"])||Z.observed_at_ms!==null&&(typeof Z.observed_at_ms!=="number"||$9(Z.observed_at_ms)===null))return null;if(Z.kind==="entrypoint_file"){if(Z.status!=="observed"||typeof Z.sha256!=="string"||!/^[a-f0-9]{64}$/.test(Z.sha256)||Z.observed_at_ms===null)return null}else if(Z.kind!=="unavailable"||Z.sha256!==null||typeof Z.status!=="string"||!["unsupported_entrypoint","read_failed","file_changed","size_limit","time_limit"].includes(Z.status))return null;return $}var E8=I.strictObject({kind:I.enum(["workspace_source","mcp_control"]),target_revision:I.number().int().nonnegative(),root_grant_revision:I.number().int().positive()}),WQ=new RegExp(u9.tokenPattern),Z3=I.strictObject({token_url:I.url().max(2048),request_token:I.string().min(1).max(8192).regex(WQ),aws_credentials_url:I.url().max(2048).nullable()});function BQ($,Q){let Z=(X,J)=>{try{let G=new URL(X);return G.origin===new URL(Q).origin&&G.pathname===J&&!G.username&&!G.password&&!G.search&&!G.hash}catch{return!1}};if(!WQ.test($.request_token)||!Z($.token_url,u9.tokenPath)||$.aws_credentials_url!==null&&!Z($.aws_credentials_url,u9.awsPath))return null;return{REASON_OIDC_TOKEN_URL:$.token_url,REASON_OIDC_REQUEST_TOKEN:$.request_token,...$.aws_credentials_url!==null?{AWS_CONTAINER_CREDENTIALS_FULL_URI:$.aws_credentials_url,AWS_CONTAINER_AUTHORIZATION_TOKEN:$.request_token}:{}}}function LQ($){return new TextEncoder().encode($).byteLength}function X3($){return LQ(JSON.stringify($)+`
+`)}var NQ=I.strictObject({version:I.literal(1),snapshot_id:I.uuid(),revision:I.number().int().positive(),run_id:I.string().min(1).max(160),device_id:I.uuid(),root_id:I.uuid(),binding:E8.extend({target_generation:I.number().int().positive(),target_fence_id:I.uuid()}),expires_at:I.iso.datetime({offset:!0}),variables:I.record(I.string().max(128).regex(UQ),I.string().refine(($)=>!$.includes("\x00")&&LQ($)<=q0.valueBytes)).refine(($)=>Object.keys($).length<=q0.variables),github_auth:I.literal("local_gh").optional(),git:I.strictObject({base_url:I.url().max(2048),token:I.string().min(1).max(4096).regex(/^[A-Za-z0-9._~-]+$/),expires_at:I.iso.datetime({offset:!0})}).nullable(),cloud_access:Z3.optional()}).refine(($)=>$.github_auth!=="local_gh"||$.git===null,"conflicting git authority").refine(($)=>X3($)<=q0.snapshotBytes,"snapshot too large");import{randomUUID as J3}from"crypto";import{closeSync as Y3,constants as MQ,fstatSync as G3,lstatSync as jQ,mkdirSync as CQ,openSync as z3,readFileSync as K3,realpathSync as qQ,renameSync as H3,unlinkSync as V3,writeFileSync as F3}from"fs";import{dirname as TQ,resolve as OQ}from"path";var DQ=65536;function l9($){try{return jQ($),!0}catch(Q){if(Q instanceof Error&&"code"in Q&&Q.code==="ENOENT")return!1;throw Q}}function T9($,Q=!1){if(!l9($)){if(!Q)throw Error("worker_state_missing");_Q($),CQ($,{mode:448})}let Z=jQ($);if(!Z.isDirectory()||Z.isSymbolicLink()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0||qQ($)!==OQ($))throw Error("worker_state_directory_not_private_or_canonical")}function _Q($){let Q=TQ($);if(!l9(Q))_Q(Q),CQ(Q,{mode:448});if(qQ(Q)!==OQ(Q))throw Error("worker_parent_not_canonical")}function O9($,Q=DQ){let Z=z3($,MQ.O_RDONLY|MQ.O_NOFOLLOW);try{let X=G3(Z);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>Q)throw Error("worker_file_not_private");return K3(Z,"utf8")}finally{Y3(Z)}}function AQ($,Q,Z=DQ){let X=JSON.stringify(Q);if(X===void 0)throw Error("worker_file_invalid");let J=X+`
+`;if(Buffer.byteLength(J,"utf8")>Z)throw Error("worker_file_too_large");if(T9(TQ($)),l9($))O9($,Z);let G=`${$}.${J3()}`;try{F3(G,J,{mode:384,flag:"wx"}),H3(G,$)}finally{if(l9(G))V3(G)}}import{spawn as U3}from"child_process";import{basename as W3,isAbsolute as u2}from"path";var B3=0,L3=120000,N3=15000,M3=65536;function S8($=process.execPath,Q=process.argv[1]){let Z=W3($),X=(Z.startsWith("bun")||Z.startsWith("node"))&&typeof Q==="string"&&Q.length>0;return{command:$,prefix:X?[Q]:[]}}function l2($={}){let{command:Q,prefix:Z}=S8($.executablePath,$.sourceEntrypoint),X=$.spawnProcess??U3,J=$.now??Date.now,G=null,z=0,H=!1,Y=(U)=>{try{U.kill("SIGKILL")}catch{}},V=()=>{if(H||G)return;let U;try{U=X(Q,[...Z,"__device","__hands-worker","--handoff-fd",String(B3)],{cwd:"/",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin"},shell:!1,stdio:["pipe","ignore","pipe"]})}catch{return}G=U,z=J(),U.on("error",()=>{if(G===U)G=null}),U.once("exit",(F,K)=>{if(G!==U)return;G=null,$.log?.("hands.worker_prespawn_exited",{exit_code:F,exit_signal:K})}),$.log?.("hands.worker_prespawned",{pid:U.pid??null})};return{arm:V,take(U){let F=G;if(!F||H)return null;let K=U.args.at(-1),L=U.options.env,B=U.options.cwd,W=[...Z,"__device","__hands-worker","--config"];if(U.command!==Q||U.args.length!==W.length+1||W.some((D,x)=>U.args[x]!==D)||typeof K!=="string"||!L||typeof B!=="string"||U.options.shell||JSON.stringify(U.options.stdio)!==JSON.stringify(["ignore","ignore","pipe"]))return null;G=null;let M=F.stdin,_={configPath:K,cwd:B,env:Object.fromEntries(Object.entries(L).filter((D)=>typeof D[1]==="string"))},q=JSON.stringify(_);if(F.exitCode!==null||F.signalCode!==null||!M||M.destroyed||J()-z>=L3-N3||Buffer.byteLength(q,"utf8")>M3)return Y(F),null;return M.on("error",()=>{return}),M.end(q),F.once("exit",()=>{V()}),$.log?.("hands.worker_prespawn_taken",{pid:F.pid??null}),F},adopt(U){U.once("exit",()=>{V()})},close(){if(H=!0,G)Y(G);G=null}}}import{accessSync as D3,constants as _3,statSync as A3}from"fs";import{homedir as x3,tmpdir as P3,userInfo as I3}from"os";var j3=new Set(["ALL_PROXY","BUN_BE_BUN","BUN_OPTIONS","CURL_CA_BUNDLE","GIT_SSL_CAINFO","GRPC_DEFAULT_SSL_ROOTS_FILE_PATH","HTTPS_PROXY","HTTP_PROXY","NO_PROXY","NODE_EXTRA_CA_CERTS","NODE_OPTIONS","NODE_TLS_REJECT_UNAUTHORIZED","REQUESTS_CA_BUNDLE","SSLKEYLOGFILE","SSL_CERT_DIR","SSL_CERT_FILE","all_proxy","http_proxy","https_proxy","no_proxy"]);var C3=["BUN_CONFIG_","BUN_INSPECT","DYLD_","NODE_DEBUG"],q3=new Set(["BUN_INSTALL"]);var T3=/^--(?:max-old-space-size|max-semi-space-size|stack-size)=\d{1,9}$/;function O3($){return($??"").split(/\s+/).filter(Boolean).every((Q)=>T3.test(Q.replaceAll("_","-")))}function xQ($){return Object.keys($).filter((Q)=>j3.has(Q)&&!(Q==="NODE_OPTIONS"&&O3($[Q]))||C3.some((Z)=>Q.startsWith(Z))||Q.startsWith("BUN_")&&!q3.has(Q)).sort()}var R3=new Set(["HOME","PATH","PWD","OLDPWD","SHLVL","_","TMPDIR","TMP","TEMP","SHELL","BASH_ENV","ENV","ZDOTDIR","PROMPT_COMMAND","IFS","CDPATH","GLOBIGNORE","SHELLOPTS","BASHOPTS","NODE_PATH"]),E3=/^(?:ARA_|REASON_|PI_|GIT_|GH_|GITHUB_|LD_|DYLD_|BUN_|BASH_FUNC_|SSH_)/,S3=/TOKEN|SECRET|PASSW|PASSPHRASE|CREDENTIAL|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|AUTH/i,w3=/^[A-Za-z_][A-Za-z0-9_]*$/;function RQ($=process.env){let Q=(J)=>{if(!J.startsWith("/")||/[\0\r\n]/.test(J)||J.length>32768)throw Error("invalid_host_execution_environment");return J};if($.PATH!==void 0&&(/[\0\r\n]/.test($.PATH)||$.PATH.length>32768))throw Error("invalid_host_execution_environment");let Z=new Set(xQ($)),X=Object.fromEntries(Object.entries($).filter((J)=>{let[G,z]=J;return typeof z==="string"&&z.length<=32768&&!z.includes("\x00")&&G.length<=128&&w3.test(G)&&!Z.has(G)&&!R3.has(G)&&!E3.test(G)&&!S3.test(G)}).sort(([J],[G])=>J.localeCompare(G)).slice(0,512));return{home:Q($.HOME||x3()),path:IQ($.PATH??"").join(":")||PQ,temporaryDirectory:Q($.TMPDIR||$.TMP||$.TEMP||P3()),variables:X}}function EQ($=process.env,Q=()=>I3().shell){let Z=(J)=>{if(!J||!/^\/[A-Za-z0-9._/-]*\/(?:bash|zsh)$/.test(J))return!1;try{return D3(J,_3.X_OK),A3(J).isFile()}catch{return!1}};if(Z($.SHELL))return $.SHELL;let X;try{X=Q()}catch{X=void 0}return Z(X)?X:"/bin/zsh"}import{readFileSync as bQ,realpathSync as SQ,statSync as b3}from"fs";import{homedir as k3}from"os";import{dirname as f3,isAbsolute as m3,join as D9,sep as g3}from"path";var M5="--proxy",j5="--proxy-ca-file",y3=262144;class J0 extends Error{}function b8($){let Q;try{Q=new URL($)}catch{throw new J0("The proxy must be a URL like https://proxy.example.com:3128.")}if(Q.protocol!=="https:"&&Q.protocol!=="http:")throw new J0("The proxy URL must use the https or http scheme.");if(!Q.hostname)throw new J0("The proxy URL must name a host.");if(Q.port!==""&&Number(Q.port)<1)throw new J0("The proxy URL must use a port between 1 and 65535.");if(Q.pathname!==""&&Q.pathname!=="/"||Q.search||Q.hash)throw new J0("The proxy URL must not carry a path, query, or fragment.");return Q.toString()}function C5($){let Q=new URL($.url),Z=Q.port||(Q.protocol==="https:"?"443":"80");return`${Q.hostname}:${Z}`}function h3($={}){let Q=$.home??k3(),Z=$.statePath??wQ();return[f3(Z),D9(Q,".ssh"),D9(Q,".aws"),D9(Q,".gnupg"),D9(Q,".kube"),D9(Q,"Library","Keychains")]}function v3($,Q){return Q===$||Q.startsWith($+g3)}function c3($,Q={}){if(!m3($))throw new J0("The proxy CA file must be an absolute path.");let Z,X,J;try{Z=SQ($);let H=b3(Z);X=H.size,J=H.isFile()}catch{throw new J0("The proxy CA file does not exist or is not readable.")}if(!J)throw new J0("The proxy CA file must be a regular file.");if(X>y3)throw new J0("The proxy CA file must be 256 KB or smaller.");let G=h3(Q).flatMap((H)=>{try{let Y=SQ(H);return Y===H?[H]:[H,Y]}catch{return[H]}});for(let H of[$,Z])if(G.some((Y)=>v3(Y,H)))throw new J0("The proxy CA file must not live inside a credential directory.");let z;try{z=bQ(Z,"utf8")}catch{throw new J0("The proxy CA file is not readable.")}if(!z.includes("-----BEGIN CERTIFICATE-----"))throw new J0("The proxy CA file must be a PEM certificate bundle.");return Z}function q5($,Q={}){if(!$.proxyUrl)throw new J0("A proxy URL is required.");let Z=b8($.proxyUrl),X=$.caFile===void 0?void 0:c3($.caFile,Q);return{version:s9,url:Z,...X===void 0?{}:{caFile:X}}}function T5($,Q=fetch){if(!$)return Q;let Z,X=!1;return(G,z)=>{if(!X){if($.caFile)try{Z=bQ($.caFile,"utf8")}catch{throw new J0(`The configured proxy CA file is not readable: ${$.caFile}`)}X=!0}let H={...z,proxy:$.url,...Z===void 0?{}:{tls:{ca:Z}}};return Q(G,H)}}import{createHash as d3}from"crypto";import{isAbsolute as fQ,join as mQ,relative as gQ,resolve as i9,sep as yQ}from"path";var n9=I.string().min(1).refine(fQ,"absolute path required"),k8=I.strictObject({version:I.literal(1),apiOrigin:I.url(),channel:I.enum(["staging","production"]),stateDirectory:n9,workspaceRoot:n9,lifetime:I.enum(["persistent","ephemeral"]),executionMode:I.enum(["confined","host"]).default("confined"),name:I.string().min(1).max(160).default("Reason headless worker"),slots:I.number().int().min(1).max(4).default(1),shutdownGraceMs:I.number().int().min(0).max(300000).default(30000),proxy:I.strictObject({version:I.literal(s9),url:I.string().refine(($)=>{try{return b8($)===$}catch{return!1}},"invalid proxy URL"),caFile:n9.optional()}).optional(),userChrome:I.boolean().optional(),cloudSessions:I.literal(!0).optional(),localLogins:I.boolean().optional(),folders:I.array(n9).min(1).max(31).optional()}),p3=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,E5=I.discriminatedUnion("channel",[k8,k8.extend({channel:I.literal("pr"),apiOrigin:I.string(),prEnvironment:I.string()}),k8.extend({channel:I.literal("local-qa"),apiOrigin:I.string()})]).superRefine(($,Q)=>{if($.channel==="local-qa"){if(!p3.test($.apiOrigin))Q.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else if($.channel==="pr"){let X=$.prEnvironment,J=/^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.up\.railway\.app$/.exec($.apiOrigin),G=J?.[1]?.match(/(?:^|-)pr-[0-9]+(?=-|$)/g)?.map((z)=>z.replace(/^-/,""));if(!X||/^pr-[1-9][0-9]*$/.exec(X)?.[0]!==X||J?.[0]!==$.apiOrigin||G?.length!==1||G[0]!==X)Q.addIssue({code:"custom",message:"PR worker requires explicit prEnvironment and an exact same-PR HTTPS Railway origin"})}else{let X=new URL($.apiOrigin);if(X.origin!==$.apiOrigin||X.username||X.password||X.protocol!=="https:"&&!(X.protocol==="http:"&&f8(X.origin))||!f8(X.origin)&&!kQ($.channel,X.origin))Q.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!_9($.workspaceRoot,$.stateDirectory))Q.addIssue({code:"custom",message:"state and workspace must be disjoint"});let Z=$.folders??[];if(new Set([$.workspaceRoot,...Z]).size!==Z.length+1||Z.some((X)=>!_9(X,$.stateDirectory)))Q.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function u3($){return mQ($.stateDirectory,`headless-${$.channel==="pr"?$.prEnvironment:$.channel}`)}function S5($,Q={},Z={}){let X=$.executionMode==="host"?"unsandboxed":"sandboxed";return{worker:Object.freeze({executionMode:X,runtimeDirectory:u3($),handsSlots:$.slots,readiness:Object.freeze({...Q}),...Z.persistentTerminals?{persistentTerminals:!0}:{},...Z.probing?.length?{probing:Object.freeze([...Z.probing])}:{},...Z.displayVideo?{displayVideo:!0}:{},...Z.handsBrowser&&Q["hands.connect"]===!0?{handsBrowser:!0}:{},...Z.githubSignedIn===void 0?{}:{githubSignedIn:Z.githubSignedIn},...$.userChrome!==!1&&Z.userChrome?{userChrome:Z.userChrome}:{},...$.cloudSessions&&Q["automation.call.v1"]===!0?{cloudSessions:!0}:{}}),proxy:$.proxy??null}}function _9($,Q){if(R0(Q,$))return!1;return!R0($,Q)||E0(mQ(yQ,gQ(i9($),i9(Q))))}function R0($,Q){let Z=gQ(i9($),i9(Q));return Z===""||Z!==".."&&!Z.startsWith(`..${yQ}`)&&!fQ(Z)}function w5($){let{proxy:Q,userChrome:Z,cloudSessions:X,localLogins:J,folders:G,...z}=$;return d3("sha256").update(JSON.stringify(z)).digest("hex")}import{readdir as l3}from"fs/promises";var s3=15000;function n3($){let Q=$ instanceof Error&&"code"in $?$.code:null;return Q==="EPERM"||Q==="EACCES"}function i3($){return new C("folder_access_denied",`macOS blocked Reason from opening ${$}. Allow Reason in System Settings \u203A Privacy & Security \u203A Files and Folders `+"(or Full Disk Access), then try again.")}async function hQ($,{timeoutMs:Q=s3,open:Z=(X)=>l3(X)}={}){let X,J=new Promise((G)=>{X=setTimeout(()=>G("pending"),Q)});try{if(await Promise.race([Z($).then(()=>"open"),J])==="pending")throw new C("folder_access_pending",`macOS is asking whether Reason may open ${$}. Answer the prompt on this Mac, then try again.`)}catch(G){if(n3(G))throw i3($);if(G instanceof C)throw G}finally{clearTimeout(X)}}import{chmodSync as A1,closeSync as x1,constants as l8,fstatSync as P1,lstatSync as zZ,openSync as I1,readSync as R1,realpathSync as s8,unlinkSync as E1}from"fs";import{lookup as S1}from"dns/promises";import{createRequire as w1}from"module";import{request as b1}from"http";import{request as k1}from"https";import d0 from"net";import{platform as WZ}from"os";import{basename as f1,extname as m1,isAbsolute as KZ,relative as n8,resolve as J9,sep as i8}from"path";var vQ=String.raw`
 async (roots) => {
   "use strict";
   const version = 2;
@@ -303,14 +303,14 @@ async (input) => {
   if (!bridge || typeof bridge.evaluate !== "function") throw new Error("Reason Hands browser bridge is not installed");
   return await bridge.evaluate(typeof input === "string" ? input : input && input.code);
 }
-`.trim();import{Buffer as Q9}from"buffer";import{randomUUID as a3}from"crypto";class lQ extends Error{code;constructor($){super($==="hands_repl_private_profile_attribute_denied"?"Private browser attribute read denied.":$);this.code=$;this.name="HandsReplBrowserDispatcherError"}}var sQ=new Set(["__defineGetter__","__defineSetter__","__lookupGetter__","__lookupSetter__","__proto__","constructor","prototype"]),dQ=/^hands_[A-Za-z0-9_-]{8,128}$/,o3=2048,nQ=32,iQ=1e4,r3=new Set(["href","src","alt","title","role","aria-label","aria-expanded","aria-checked","aria-selected","aria-disabled","placeholder","type","name","data-testid"]);function t3($){let Q=$.split("+"),Z=(Q.pop()??"").replace(/^Key/,"").toLowerCase();if(Z==="f12")return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&["l","n","t","j","i","p","s","w","u","o","r","tab","pageup","pagedown"].includes(Z))return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&Q.includes("Shift")&&Z==="c")return!0;return Q.includes("Alt")&&["d","arrowleft","arrowright","home"].includes(Z)}var e3=($)=>{let Q=$.closest("a[href],area[href]");return{password:$.tagName==="INPUT"&&$.type==="password",executableLink:Boolean(Q&&!/^(https?:|about:blank)/i.test(Q.href))}},aQ={browser:{close:{returns:"void"},contexts:{returns:"context[]"},isConnected:{returns:"json"},version:{returns:"json"}},context:{addCookies:{returns:"void"},addInitScript:{returns:"void"},browser:{returns:"browser"},clearCookies:{returns:"void"},clearPermissions:{returns:"void"},close:{returns:"void"},cookies:{returns:"json"},grantPermissions:{returns:"void"},newPage:{returns:"page"},pages:{returns:"page[]"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setGeolocation:{returns:"void"},setHTTPCredentials:{returns:"void"},setOffline:{returns:"void"},setViewportSize:{returns:"void"},storageState:{returns:"json"},viewportSize:{returns:"json",special:"contextViewportSize"}},page:{addInitScript:{returns:"void"},addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},bringToFront:{returns:"void"},close:{returns:"void"},content:{returns:"json"},context:{returns:"context"},emulateMedia:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},frame:{returns:"frame"},frameLocator:{returns:"frameLocator"},frames:{returns:"frame[]"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goBack:{returns:"void"},goForward:{returns:"void"},goto:{returns:"void"},isClosed:{returns:"json"},locator:{returns:"locator"},mainFrame:{returns:"frame"},opener:{returns:"page"},pdf:{returns:"bytes"},reload:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setContent:{returns:"void"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setInputFiles:{returns:"void"},setViewportSize:{returns:"void"},title:{returns:"json"},url:{returns:"json"},viewportSize:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},locator:{all:{returns:"locator[]"},allInnerTexts:{returns:"json"},allTextContents:{returns:"json"},and:{returns:"locator"},ariaSnapshot:{returns:"json"},blur:{returns:"void"},boundingBox:{returns:"json"},check:{returns:"void"},clear:{returns:"void"},click:{returns:"void"},contentFrame:{returns:"frameLocator"},count:{returns:"json"},dblclick:{returns:"void"},dragTo:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},evaluateAll:{returns:"json",requiresStringSource:!0},fill:{returns:"void"},filter:{returns:"locator"},first:{returns:"locator",special:"property"},focus:{returns:"void"},getAttribute:{returns:"json"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},hover:{returns:"void"},innerHTML:{returns:"json"},innerText:{returns:"json"},inputValue:{returns:"json"},isChecked:{returns:"json"},isEditable:{returns:"json"},isEnabled:{returns:"json"},isHidden:{returns:"json"},isVisible:{returns:"json"},last:{returns:"locator",special:"property"},locator:{returns:"locator"},nth:{returns:"locator"},or:{returns:"locator"},page:{returns:"page"},press:{returns:"void"},pressSequentially:{returns:"void"},scrollIntoViewIfNeeded:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setInputFiles:{returns:"void"},tap:{returns:"void"},textContent:{returns:"json"},type:{returns:"void"},uncheck:{returns:"void"},waitFor:{returns:"void"}},frame:{addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},childFrames:{returns:"frame[]"},content:{returns:"json"},evaluate:{returns:"json",requiresStringSource:!0},frameLocator:{returns:"frameLocator"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goto:{returns:"void"},isDetached:{returns:"json"},locator:{returns:"locator"},name:{returns:"json"},page:{returns:"page"},parentFrame:{returns:"frame"},setContent:{returns:"void"},title:{returns:"json"},url:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},frameLocator:{getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},locator:{returns:"locator"},owner:{returns:"locator"}}};function R($){throw new lQ($)}function G0($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Q=Object.getPrototypeOf($);return Q===Object.prototype||Q===null}function Z9($,Q=0,Z={nodes:0}){if(Q>nQ||++Z.nodes>iQ)R("hands_repl_json_too_complex");if($===null||typeof $==="boolean"||typeof $==="string")return;if(typeof $==="number"){if(!Number.isFinite($))R("hands_repl_invalid_json");return}if(Array.isArray($)){for(let X of $)Z9(X,Q+1,Z);return}if(!G0($))R("hands_repl_invalid_json");for(let[X,J]of Object.entries($)){if(sQ.has(X))R("hands_repl_invalid_json");Z9(J,Q+1,Z)}}function m8($){return typeof $==="string"&&Object.hasOwn(aQ,$)}function $1($){if(!$.endsWith("[]"))return null;let Q=$.slice(0,-2);return m8(Q)?Q:null}function pQ($){return G0($)&&Object.keys($).length===2&&$.$handsRepl==="bytes"&&typeof $.base64==="string"}function Q1($){return G0($)&&Object.keys($).length===1&&$.$handsRepl==="undefined"}function uQ($){return G0($)&&Object.keys($).length===2&&$.$handsRepl==="routeFulfill"&&"options"in $}function E0($){return!!$&&typeof $==="object"}function a9(){return Object.freeze({$handsRepl:"undefined"})}function Z1($){if(!Q9.isBuffer($)&&!($ instanceof Uint8Array))R("hands_repl_expected_bytes");return Object.freeze({$handsRepl:"bytes",base64:Q9.from($).toString("base64")})}function oQ($){if(!E0($.browser)||!E0($.context)||!E0($.page))R("hands_repl_invalid_roots");if(typeof $.a11y!=="function"||typeof $.view!=="function")R("hands_repl_invalid_callbacks");let Q=$.maxHandles??o3;if(!Number.isInteger(Q)||Q<3||Q>1e5)R("hands_repl_invalid_handle_limit");let Z=new Map,X=new WeakMap,J=$.createOpaqueId??a3,G=(K,L)=>{if(!E0(L))R("hands_repl_expected_target");let B=X.get(L)?.get(K);if(B)return B;if(Z.size>=Q)R("hands_repl_handle_limit");let U="";for(let q=0;q<16;q+=1){let D=`hands_${J()}`;if(dQ.test(D)&&!Z.has(D)){U=D;break}}if(!U)R("hands_repl_invalid_opaque_id");let M=Object.freeze({$handsRepl:"handle",id:U,kind:K});Z.set(U,{kind:K,target:L});let _=X.get(L);if(!_)_=new Map,X.set(L,_);return _.set(K,M),M},z=Object.freeze({browser:G("browser",$.browser),context:G("context",$.context),page:G("page",$.page)}),V=(K)=>{if(!G0(K)||Object.keys(K).length!==3||K.$handsRepl!=="handle"||typeof K.id!=="string"||!dQ.test(K.id)||!m8(K.kind))R("hands_repl_invalid_handle");let L=Z.get(K.id);if(!L||L.kind!==K.kind)R("hands_repl_unknown_handle");return L},Y=(K,L=0,B=new Set)=>{if(L>nQ)R("hands_repl_json_too_complex");if(K===void 0)return a9();if(K===null||typeof K==="boolean"||typeof K==="string")return K;if(typeof K==="number"){if(!Number.isFinite(K))R("hands_repl_non_json_result");return K}if(Array.isArray(K)){if(B.has(K))R("hands_repl_cyclic_result");B.add(K);try{return K.map((U)=>Y(U,L+1,B))}finally{B.delete(K)}}if(!G0(K))R("hands_repl_non_json_result");if(B.has(K))R("hands_repl_cyclic_result");B.add(K);try{let U=Object.create(null);for(let M of Object.keys(K)){let _=Object.getOwnPropertyDescriptor(K,M);if(!_||!("value"in _))continue;U[M]=Y(_.value,L+1,B)}return U}finally{B.delete(K)}},H=(K,L)=>{if(L==="void")return a9();if(L==="json")return Y(K);if(L==="bytes")return Z1(K);let B=$1(L);if(B){if(!Array.isArray(K))R("hands_repl_expected_target_list");if(B==="context"&&K.some((U)=>U!==$.context))R("hands_repl_foreign_context");return K.map((U)=>G(B,U))}if(K===null||K===void 0)return a9();if(!m8(L))R("hands_repl_invalid_return_kind");if(L==="context"&&K!==$.context)R("hands_repl_foreign_context");return G(L,K)},W=(K)=>{if(G0(K)&&K.$handsRepl==="handle")return V(K).target;if(pQ(K))return Q9.from(K.base64,"base64");if(Q1(K))return;if(uQ(K))R("hands_repl_route_fulfill_only");if(Array.isArray(K))return K.map(W);if(!G0(K))return K;let L=Object.create(null);for(let[B,U]of Object.entries(K))L[B]=W(U);return L};return Object.freeze({roots:z,dispatch:async(K)=>{if(!G0(K)||typeof K.type!=="string")R("hands_repl_invalid_request");if(K.type==="a11y"){let T=K.target===void 0?Z.get(z.page.id):V(K.target);if(!T||T.kind!=="page"&&T.kind!=="locator")R("hands_repl_invalid_a11y_target");return Y(await $.a11y(T.target))}if(K.type==="view"){if(Z9(K.source),K.options!==void 0)Z9(K.options);let T=pQ(K.source)?Q9.from(K.source.base64,"base64"):K.source;if($.privateProfile&&!Q9.isBuffer(T))R("hands_repl_profile_requires_image_bytes");return Y(await $.view(T,K.options))}if(K.type!=="call")R("hands_repl_invalid_request");if(typeof K.method!=="string"||K.method.length===0||K.method.length>128)R("hands_repl_invalid_method");if(sQ.has(K.method))R("hands_repl_forbidden_method");let L=V(K.target),B=K.args??[];if(!Array.isArray(B))R("hands_repl_invalid_arguments");if(Z9(B),L.kind==="page"&&K.method==="captureScreenshot"){if(B.length!==0)R("hands_repl_invalid_arguments");if(!$.screenshotExport)R("hands_repl_screenshot_export_unavailable");return Y(await $.screenshotExport(L.target))}if(L.kind==="context"&&["startRecording","stopRecording"].includes(K.method)){if(!$.recording||L.target!==$.context)R("hands_repl_recording_unavailable");if(B.length>(K.method==="startRecording"?1:0))R("hands_repl_invalid_arguments");return Y(K.method==="startRecording"?await $.recording.start(B[0]):await $.recording.stop())}if($.privateProfile){let T=K.method;if(["evaluate","evaluateAll","waitForFunction","addInitScript","addScriptTag","addStyleTag","setContent","setInputFiles","route","content","cookies","storageState","addCookies","clearCookies","setExtraHTTPHeaders","setHTTPCredentials","grantPermissions","clearPermissions","innerHTML","textContent","allTextContents"].includes(T)||L.kind==="browser"&&T==="close"||L.kind==="context"&&T==="close")R("hands_repl_private_profile_method_denied");if(L.kind==="browser"&&T==="contexts")return H([$.context],"context[]");if((T==="screenshot"||T==="pdf")&&G0(B[0])&&(("path"in B[0])||("style"in B[0])))R("hands_repl_private_profile_path_denied");if(T==="goto"){if(typeof B[0]!=="string")R("hands_repl_private_profile_url_denied");try{let k=new URL(B[0]);if(!["http:","https:"].includes(k.protocol)&&B[0]!=="about:blank")R("hands_repl_private_profile_url_denied")}catch{R("hands_repl_private_profile_url_denied")}}if(T==="getAttribute"&&(typeof B[0]!=="string"||!r3.has(B[0].toLowerCase())))R("hands_repl_private_profile_attribute_denied");if(L.kind==="locator"&&["innerText","allInnerTexts","getAttribute"].includes(T)){let k=[L.target];if(T==="allInnerTexts"){let g=Reflect.get(L.target,"all");if(typeof g!=="function")R("hands_repl_private_profile_probe_unavailable");let O=await Reflect.apply(g,L.target,[]);if(!Array.isArray(O)||O.length>iQ||!O.every(E0))R("hands_repl_private_profile_probe_unavailable");k=O}for(let g of k){let O=Reflect.get(g,"isVisible");if(typeof O!=="function"||!await Reflect.apply(O,g,[]))R("hands_repl_private_profile_hidden_value_denied")}}if(T==="press"&&typeof B[0]==="string"&&t3(B[0]))R("hands_repl_private_profile_browser_shortcut_denied");if(L.kind==="locator"&&["inputValue","click","dblclick","tap","press"].includes(T)){let k=Reflect.get(L.target,"evaluate");if(typeof k!=="function")R("hands_repl_private_profile_probe_unavailable");let g=await Reflect.apply(k,L.target,[e3]);if(!G0(g)||typeof g.password!=="boolean"||typeof g.executableLink!=="boolean")R("hands_repl_private_profile_probe_unavailable");if(T==="inputValue"&&g.password)R("hands_repl_private_profile_password_denied");if(T!=="inputValue"&&g.executableLink)R("hands_repl_private_profile_url_denied");if(T==="inputValue"){let O=Reflect.get(L.target,"isVisible");if(typeof O!=="function"||!await Reflect.apply(O,L.target,[]))R("hands_repl_private_profile_hidden_value_denied")}}}let U=aQ[L.kind][K.method];if(!U)R("hands_repl_method_not_allowed");if(U.requiresStringSource&&typeof B[0]!=="string")R("hands_repl_string_source_required");if(L.kind==="browser"&&K.method==="contexts")return[z.context];if(["addInitScript","addScriptTag","addStyleTag","screenshot","pdf","storageState"].includes(K.method)&&B.some((T)=>G0(T)&&("path"in T)))R("hands_repl_file_path_not_allowed");if(K.method==="goto"&&typeof B[0]==="string"){let T;try{T=new URL(B[0]).protocol}catch{R("hands_repl_invalid_url")}if(!["http:","https:","data:","about:","blob:"].includes(T))R("hands_repl_file_path_not_allowed")}if(U.special==="contextViewportSize"){let T=Reflect.get(L.target,"pages");if(typeof T!=="function")R("hands_repl_method_unavailable");let k=await Reflect.apply(T,L.target,[]),g=Array.isArray(k)?k[0]:void 0,O=E0(g)?Reflect.get(g,"viewportSize"):void 0;if(typeof O!=="function")return a9();return H(await Reflect.apply(O,g,[]),U.returns)}if(U.special==="property"){let T=Reflect.get(L.target,K.method);return H(typeof T==="function"?Reflect.apply(T,L.target,[]):T,U.returns)}let M=Reflect.get(L.target,K.method);if(typeof M!=="function")R("hands_repl_method_unavailable");if(U.special==="route"){let T=B[1];if(!uQ(T))R("hands_repl_invalid_route_handler");Z9(T.options);let k=W(T.options),g=async(j)=>{if(!E0(j))R("hands_repl_invalid_route");let A=Reflect.get(j,"fulfill");if(typeof A!=="function")R("hands_repl_invalid_route");await Reflect.apply(A,j,[k])},O=[W(B[0]??null),g],N=await Reflect.apply(M,L.target,O);return H(N,U.returns)}let _=B.map(W);if(K.method==="setInputFiles"){let T=L.kind==="locator"?0:1,k=async(O)=>{if(typeof O!=="string"){if(!G0(O)||typeof O.name!=="string"||typeof O.mimeType!=="string"||!Q9.isBuffer(O.buffer))R("hands_repl_invalid_file_input");return O}if(!$.readWorkspaceFile)R("hands_repl_workspace_required");return $.readWorkspaceFile(O)},g=_[T];_[T]=Array.isArray(g)?await Promise.all(g.map(k)):await k(g)}if(K.method==="goto")await $.beforeNavigation?.();let q=$.actionRecorder?.(),D=await Reflect.apply(M,L.target,_),b={click:"Click browser element",tap:"Click browser element",dblclick:"Double click browser element",fill:"Type text",type:"Type text",pressSequentially:"Type text",clear:"Clear browser field",press:"Press key",scrollIntoViewIfNeeded:"Scroll browser element into view",dragTo:"Drag on computer",selectOption:"Select browser option",check:"Check browser control",uncheck:"Uncheck browser control",hover:"Hover browser element",focus:"Focus browser element",goto:"Open browser page",reload:"Reload browser page",goBack:"Go back in browser",goForward:"Go forward in browser",screenshot:"Take browser screenshot"}[K.method];if(b){let T=Reflect.get(L.target,"page"),k=L.kind==="page"?L.target:typeof T==="function"?Reflect.apply(T,L.target,[]):void 0;q?.(b,E0(k)?k:void 0)}return H(D,U.returns)}})}import{isIP as QZ}from"net";import{Resolver as X1}from"dns/promises";import{isIP as r9}from"net";var J1=[["0.0.0.0",8],["10.0.0.0",8],["100.64.0.0",10],["127.0.0.0",8],["169.254.0.0",16],["172.16.0.0",12],["192.0.0.0",24],["192.0.2.0",24],["192.168.0.0",16],["198.18.0.0",15],["198.51.100.0",24],["203.0.113.0",24],["224.0.0.0",4],["240.0.0.0",4]];function g8($){if(r9($)!==4)return null;let Q=$.split(".");if(Q.length!==4)return null;let Z=0;for(let X of Q){let J=Number(X);if(!Number.isInteger(J)||J<0||J>255)return null;Z=Z*256+J}return Z>>>0}function Y1($,Q,Z){let X=g8(Q);if(X===null)return!1;let J=Z===0?0:4294967295<<32-Z>>>0;return($&J)>>>0===(X&J)>>>0}function rQ($){let Q=g8($);if(Q===null)return!0;return J1.some(([Z,X])=>Y1(Q,Z,X))}function G1($){if(r9($)!==6)return null;let Q=$.toLowerCase(),Z=Q.indexOf("%");if(Z>=0)Q=Q.slice(0,Z);let X=[],J=Q.lastIndexOf(":"),G=J>=0?Q.slice(J+1):"";if(G.includes(".")){let K=g8(G);if(K===null)return null;X=[K>>>16&65535,K&65535],Q=Q.slice(0,J+1)+"0:0"}let z=Q.split("::");if(z.length>2)return null;let V=(K)=>{if(K==="")return[];let L=[];for(let B of K.split(":")){if(B===""||B.length>4||!/^[0-9a-f]+$/.test(B))return null;L.push(Number.parseInt(B,16))}return L},Y=V(z[0]??"");if(Y===null)return null;if(z.length===1){let K=Y;if(K.length!==8)return null;return X.length>0?K.slice(0,6).concat(X):K}let H=V(z[1]??"");if(H===null)return null;let W=8-Y.length-H.length;if(W<0)return null;let F=Y.concat(Array(W).fill(0),H);if(F.length!==8)return null;return X.length>0?F.slice(0,6).concat(X):F}function z1($,Q){return`${$>>8&255}.${$&255}.${Q>>8&255}.${Q&255}`}function K1($){let Q=G1($);if(Q===null)return!0;let[Z,X,J]=Q;if((Z&57344)!==8192)return!0;if(Z===8193&&(X&65024)===0)return!0;if(Z===8193&&X===3512)return!0;if(Z===16383&&(X&61440)===0)return!0;if(Z===8194)return rQ(z1(X,J));return!1}function tQ($){return $.replace(/^\[|\]$/g,"")}function o9($){let Q=tQ($.trim()),Z=r9(Q);if(Z===4)return rQ(Q);if(Z===6)return K1(Q);return!0}function eQ($){if($ instanceof Error&&$.name==="TimeoutError")return"dns_timeout";switch(typeof $==="object"&&$!==null&&"code"in $?$.code:void 0){case"ENOTFOUND":return"dns_not_found";case"ENODATA":return"dns_empty";case"EAI_AGAIN":case"ESERVFAIL":case"ECONNREFUSED":return"dns_temporary";case"ETIMEOUT":case"ETIMEDOUT":return"dns_timeout";default:return"dns_failed"}}var $Z=5000;function V1($){return async(Q,Z)=>{if(Z?.aborted)throw Error("aborted");let X=new X1({timeout:$Z,tries:1});if($)X.setServers($);let J=()=>X.cancel();Z?.addEventListener("abort",J,{once:!0});try{let[G,z]=await Promise.allSettled([X.resolve4(Q),X.resolve6(Q)]),V=[...G.status==="fulfilled"?G.value:[],...z.status==="fulfilled"?z.value:[]];if(V.length>0)return V;let Y=[G,z].flatMap((W)=>W.status==="rejected"?[W.reason]:[]);throw Y.find((W)=>["dns_temporary","dns_timeout"].includes(eQ(W)))??Y[0]??Object.assign(Error("DNS returned no addresses"),{code:"ENODATA"})}finally{Z?.removeEventListener("abort",J)}}}var H1=V1();async function F1($,Q,Z,X){if(X?.aborted)throw Error("aborted");let J=new AbortController,G,z,V=Q($,J.signal);V.catch(()=>{});try{return await Promise.race([V,new Promise((Y,H)=>{if(G=setTimeout(()=>H(new DOMException("DNS lookup timed out","TimeoutError")),Z),X)z=()=>H(Error("aborted")),X.addEventListener("abort",z,{once:!0})})])}finally{if(G!==void 0)clearTimeout(G);if(X&&z)X.removeEventListener("abort",z);J.abort()}}async function p5($,Q=H1,Z){let X=tQ($);if(r9(X))return o9(X)?{ok:!1,reason:"non_public_ip"}:{ok:!0,addresses:[X]};let J;try{J=await F1(X,Q,$Z,Z)}catch(G){return{ok:!1,reason:Z?.aborted?Z.reason instanceof Error&&Z.reason.name==="TimeoutError"?"dns_timeout":"aborted":eQ(G)}}if(J.length===0)return{ok:!1,reason:"dns_empty"};if(J.some(o9))return{ok:!1,reason:"non_public_ip"};return{ok:!0,addresses:J}}var W1=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;function y8($){return $.length<=253&&W1.test($.toLowerCase())}function U1($,Q){let Z=$.trim().toLowerCase();if(!y8(Z))return!1;if(Z.startsWith("*.")){let X=Z.slice(2);return Q===X||Q.endsWith(`.${X}`)}return Z===Q}function B1($){let Q=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec($);if(!Q)return null;let Z=Q.slice(1).map(Number);return Z.some((X)=>X>255)?null:Z}function h8($,Q=[]){let Z=(X)=>{if(X=X.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,""),!X.includes(":"))return X;try{X=new URL(`http://[${X}]/`).hostname.slice(1,-1)}catch{return X}let J=/^::ffff:([\da-f]+):([\da-f]+)$/.exec(X);if(!J)return X;let G=parseInt(J[1],16),z=parseInt(J[2],16);return`${G>>8}.${G&255}.${z>>8}.${z&255}`};return Q.some((X)=>Z(X)===Z($))}function c0($){$=$.toLowerCase().replace(/^\[|\]$/g,"");let Q=B1($);if(Q){let[G,z,V]=Q;if(G===127)return"loopback";return G===0||G===10||G>=224||G===100&&z>=64&&z<=127||G===169&&z===254||G===172&&z>=16&&z<=31||G===192&&(z===168||z===0&&(V===0||V===2)||z===88&&V===99)||G===198&&(z===18||z===19||z===51&&V===100)||G===203&&z===0&&V===113?"private":"public"}if(!$.includes(":"))return"hostname";try{$=new URL(`http://[${$}]/`).hostname.slice(1,-1)}catch{return"private"}if($==="::1")return"loopback";let Z=/^::ffff:([\da-f]+):([\da-f]+)$/.exec($);if(Z){let G=parseInt(Z[1],16),z=parseInt(Z[2],16);return c0(`${G>>8}.${G&255}.${z>>8}.${z&255}`)==="public"?"public":"private"}let[X,J=0]=$.split(":").map((G)=>parseInt(G||"0",16));return X<8192||X>16383||X===8194||X===8193&&(J<512||J===3512)||X===16383&&J<4096?"private":"public"}function A9($,Q){let Z;try{Z=new URL($)}catch{return{allowed:!1,url:$,host:null,reason:"invalid_url"}}if(["about:","data:","blob:"].includes(Z.protocol))return{allowed:!0,url:$,host:null,reason:"local_document"};if(!["http:","https:","ws:","wss:"].includes(Z.protocol))return{allowed:!1,url:$,host:Z.hostname||null,reason:"unsupported_protocol"};let X=Z.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,"");if(Q.mode==="off")return{allowed:!0,url:$,host:X,reason:"policy_off"};let J=(V)=>({allowed:!1,url:$,host:X,reason:V});if(Z.username||Z.password)return J("invalid_url");if(Q.mode==="public_web"){let V=c0(X)!=="public"&&c0(X)!=="hostname"||X==="localhost"||/\.(?:localhost|local|internal|arpa)$/.test(X)||!X.includes(".")&&!QZ(X)||Boolean(QZ(X)&&o9(X));return{allowed:!V,url:$,host:X,reason:V?"private_network":"public_web"}}let G=Number(Z.port||(["https:","wss:"].includes(Z.protocol)?443:80));if(Q.deniedPorts?.includes(G)||h8(X,Q.deniedHosts))return J("destination_not_allowed");let z=c0(X);if(z==="private"||["local","internal","arpa"].some((V)=>X===V||X.endsWith(`.${V}`)))return J("private_network");if(z==="loopback"||X==="localhost"||X.endsWith(".localhost"))return Q.allowedLoopbackPorts?.includes(G)?{allowed:!0,url:$,host:X,reason:"loopback"}:J("destination_not_allowed");if(Q.allowedDomains.some((V)=>U1(V,X)))return{allowed:!0,url:$,host:X,reason:"allowed_domain"};return{allowed:!1,url:$,host:X,reason:"destination_not_allowed"}}import XZ from"child_process";import{accessSync as N1,constants as M1,readFileSync as j1,statSync as C1}from"fs";import{createRequire as q1}from"module";import{isAbsolute as v8,join as T1}from"path";var c8=Object.freeze({schemaVersion:1,driver:"playwright-core",driverVersion:JZ.dependencies["playwright-core"],browser:"chromium"}),YZ=["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome","/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge","/Applications/Brave Browser.app/Contents/MacOS/Brave Browser","/Applications/Chromium.app/Contents/MacOS/Chromium"],d8=["/usr/bin/chromium","/usr/bin/chromium-browser","/usr/bin/google-chrome","/usr/bin/google-chrome-stable"];function x9($){try{return N1($,M1.X_OK),v8($)&&C1($).isFile()}catch{return!1}}function p8($,Q=process.platform){let Z=Q==="darwin"?YZ:Q==="linux"?d8:null;return Z?($??Z).find(x9)??null:null}function O1(){if(!process.versions.bun)return;let $=Symbol.for("ara.headless-browser.bun-pipe-owners");if(Object.hasOwn(globalThis,$))return;let Q=[];XZ.spawn=new Proxy(XZ.spawn,{apply(Z,X,J){let G=Reflect.apply(Z,X,J),z=J[1],V=J[2]?.stdio;if(Array.isArray(z)&&z.includes("--remote-debugging-pipe")&&Array.isArray(V)&&V[3]==="pipe"&&V[4]==="pipe")Q.push(G);return G}}),Object.defineProperty(globalThis,$,{value:Q})}async function t9($){if(O1(),$!==void 0){if(!v8($))throw Error("hands_browser_driver_path_must_be_absolute");let X=T1($,"package.json"),J=JSON.parse(j1(X,"utf8"));if(J.name!==c8.driver)throw Error("hands_browser_wrong_driver");let G=q1(X)($),z=G.default?.chromium??G.chromium;if(!z)throw Error("hands_browser_missing_chromium");return{version:J.version,chromium:z}}let[Q,Z]=await Promise.all([import("./index-9aw1gjs5.js"),import("./package-56yg8k4a.js").then((m)=>L1(m.default,1))]);return{version:Z.default.version,chromium:Q.chromium}}var D1=($,Q=c8.driverVersion)=>({status:"unavailable",reason:$,expectedDriverVersion:Q}),_1=($)=>$.loadDriver?.()??t9($.driverModuleDirectory);async function X9($={}){return GZ($,c8.driverVersion)}async function u8($,Q={}){if($.driverVersion!=="1.61.1"||!v8($.driverModuleDirectory))throw Error("hands_browser_invalid_managed_compatibility");return GZ({...Q,driverModuleDirectory:$.driverModuleDirectory,allowSystemBrowser:!0},$.driverVersion)}async function GZ($,Q){let Z=(Y)=>D1(Y,Q),X=$.platform??process.platform;if(X!=="linux"&&X!=="darwin")return Z("unsupported_platform");let J;try{J=await _1($)}catch{return Z("driver_missing")}if(J.version!==Q)return Z("driver_version_mismatch");let G=(Y,H)=>({status:"resolved",executablePath:Y,source:H,driverVersion:J.version});if($.executablePath!==void 0)return x9($.executablePath)?G($.executablePath,"configured"):Z("executable_missing");let z=J.chromium.executablePath();if(x9(z))return G(z,"managed");let V=$.allowSystemBrowser===!0?p8($.systemCandidates,X):null;return V?G(V,"system"):Z("executable_missing")}var g1=["/usr/local/bin/chromium",...d8];function y1($,Q=UZ()){return p8($??(Q==="linux"?g1:void 0),Q)}async function h1(){try{return(await t9()).chromium}catch{return w1(import.meta.url)("playwright-core").chromium}}var v1=1048576,c1=105000,d1=20000,VZ=5000,p1=2000,u1=1000,l1=30000,HZ=81920,s1={".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".gif":"image/gif"};async function n1($,Q){let Z=new URL($.url()),X={...await $.allHeaders(),host:Z.host};for(let J of Object.keys(X))if(/^(?:proxy-|connection$|upgrade$|transfer-encoding$|content-length$)/i.test(J))delete X[J];return new Promise((J,G)=>{let V=(Z.protocol==="https:"?k1:b1)(Z,{method:$.method(),headers:X,agent:!1,lookup:(H,W,F)=>{let K=d0.isIP(Q);if(W.all)F(null,[{address:Q,family:K}]);else F(null,Q,K)}},(H)=>{let W=[],F=0;H.on("data",(K)=>{if(F+=K.length,F>33554432)V.destroy(Error("hands_browser_response_too_large"));else W.push(K)}),H.on("error",G),H.on("end",()=>{let K={};for(let[L,B]of Object.entries(H.headers))if(B!==void 0&&!["transfer-encoding","connection","content-length"].includes(L))K[L]=Array.isArray(B)?B.join(`
-`):B;J({status:H.statusCode??502,headers:K,body:Buffer.concat(W)})})}),Y=setTimeout(()=>V.destroy(Error("hands_browser_fetch_timeout")),l1);V.once("close",()=>clearTimeout(Y)),V.on("error",G),V.end($.postDataBuffer()??void 0)})}async function i1($,Q,Z=()=>{},X={lookup:(J)=>S1(J,{all:!0}),fetch:n1}){let J=new WeakSet,G=new WeakMap,z=(V)=>{let Y=G.get(V);if(Y)return Y;let H=(async()=>{if(!$.newCDPSession)return;let W=await $.newCDPSession(V),F=new Map;W.on("Network.loadingFinished",({requestId:K})=>F.delete(K)),W.on("Network.loadingFailed",({requestId:K})=>F.delete(K)),W.on("Fetch.requestPaused",async(K)=>{let L=K.networkId??K.requestId,B=K.redirectedRequestId?(F.get(L)??0)+1:0;F.set(L,B);let U=A9(K.request.url,Q),M=Q.mode==="enforce"&&Boolean(K.redirectedRequestId)&&U.host!==null&&!d0.isIP(U.host),_=!U.allowed?U:M?{...U,allowed:!1,reason:"destination_not_allowed"}:B>20?{...U,allowed:!1,reason:"redirect_not_supported"}:null;try{if(_)Z(_),await W.send("Fetch.failRequest",{requestId:K.requestId,errorReason:"BlockedByClient"});else await W.send("Fetch.continueRequest",{requestId:K.requestId})}catch{await W.send("Fetch.failRequest",{requestId:K.requestId,errorReason:"Failed"}).catch(()=>{})}}),await W.send("Network.enable"),await W.send("Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]}),J.add(V)})();return G.set(V,H),H};return await $.route("**/*",async(V)=>{let Y=V.request().url(),H=A9(Y,Q);if(H.allowed&&Q.mode==="public_web"){await V.continue();return}let W=V.request();if(H.allowed&&H.host&&d0.isIP(H.host)&&W.isNavigationRequest?.()){let F=W.frame();if(J.has(F.page())&&F===F.page().mainFrame()){await V.continue();return}}if(H.allowed&&(Q.mode==="off"||H.reason==="local_document")){await V.continue();return}if(H.allowed&&H.host)try{let F=H.host,K=c0(F),L,B=await(async()=>{if(K!=="hostname")return[{address:F,family:d0.isIP(F)}];if(H.reason==="loopback")return[{address:"127.0.0.1",family:4}];try{return await Promise.race([X.lookup(F),new Promise((U,M)=>{L=setTimeout(()=>M(Error("hands_browser_dns_timeout")),5000)})])}finally{if(L)clearTimeout(L)}})();if(!B.length||B.some(({address:U})=>{let M=c0(U);return!d0.isIP(U)||Q.mode==="enforce"&&h8(U,Q.deniedHosts)||(H.reason==="loopback"?M!=="loopback":M!=="public")}))H={...H,allowed:!1,reason:"private_network"};else{let U=await X.fetch(V.request(),B[0].address);if(U.status>=300&&U.status<400){let M=U.headers.location??Y;try{M=new URL(M,Y).href}catch{}let _=A9(M,Q);H=_.allowed?{..._,allowed:!1,reason:"redirect_not_supported"}:_}else{await V.fulfill(U);return}}}catch{await V.abort("failed");return}Z(H),await V.abort("blockedbyclient")}),await $.routeWebSocket("**/*",async(V)=>{let Y=A9(V.url(),Q);if(Q.mode==="enforce"&&Y.allowed&&(!Y.host||!d0.isIP(Y.host)))Y={...Y,allowed:!1,reason:"destination_not_allowed"};if(Y.allowed){V.connectToServer();return}Z(Y),await V.close({code:1008,reason:"Reason egress policy denied"})}),Q.mode==="off"?void 0:{preparePage:z}}async function BZ($,Q=UZ(),Z){if(Z){let J=await u8(Z,{platform:Q,systemCandidates:$});return J.status==="resolved"?J.executablePath:null}if($!==void 0){let J=y1($,Q);if(J)return J}let X=await X9({platform:Q,systemCandidates:$,allowSystemBrowser:!0});return X.status==="resolved"?X.executablePath:null}function FZ($,Q){if(!$)throw Error("hands_repl_workspace_required");let Z=s8($),X=J9($),J=n8(X,J9(X,Q)),z=J!==".."&&!J.startsWith(`..${i8}`)&&!KZ(J)?J9(Z,J):J9(Z,Q);if(R0(J9(X,Q))||R0(z))throw Error("hands_repl_protected_path");let V=(B)=>{let U=n8(Z,B);return U!==""&&U!==".."&&!U.startsWith(`..${i8}`)&&!KZ(U)},Y=s8(z);if(R0(Y))throw Error("hands_repl_protected_path");if(!V(z)||!V(Y))throw Error("hands_repl_file_outside_workspace");let H=n8(Z,z).split(i8),W=[Z,...H.map((B,U)=>J9(Z,...H.slice(0,U+1)))],F=W.map((B)=>zZ(B));if(F.some((B)=>B.isSymbolicLink()))throw Error("hands_repl_file_symlink");let K=F[F.length-1];if(!K.isFile()||K.nlink!==1||K.size>16777216)throw Error("hands_repl_file_not_regular_or_too_large");let L=I1(z,l8.O_RDONLY|l8.O_NOFOLLOW|l8.O_NONBLOCK);try{let B=P1(L);if(B.dev!==K.dev||B.ino!==K.ino||!B.isFile())throw Error("hands_repl_file_changed");for(let q=0;q<W.length;q++){let D=zZ(W[q]);if(D.dev!==F[q].dev||D.ino!==F[q].ino||D.isSymbolicLink())throw Error("hands_repl_file_changed")}if(!V(s8(z)))throw Error("hands_repl_file_outside_workspace");let U=Buffer.alloc(16777217),M=0;while(M<U.length){let q=R1(L,U,M,U.length-M,null);if(!q)break;M+=q}if(M===U.length)throw Error("hands_repl_file_too_large");let _=U.subarray(0,M);return{name:f1(z),mimeType:s1[m1(z).toLowerCase()]??"application/octet-stream",buffer:_}}finally{x1(L)}}function Y9($,Q){$.end(`${JSON.stringify(Q)}
-`)}function e9($){try{E1($)}catch{}}async function LZ($){if($.managedBrowser&&$.driverModuleDirectory!==void 0)throw Error("hands_browser_ambiguous_driver_configuration");let Q=$.launch||$.targetContext?null:$.managedBrowser?await u8($.managedBrowser,{executablePath:$.browserExecutablePath}):await X9({executablePath:$.browserExecutablePath,driverModuleDirectory:$.driverModuleDirectory});if(Q?.status==="unavailable")throw Error(`hands_browser_${Q.reason}`);let Z=Q?.status==="resolved"?Q.executablePath:$.browserExecutablePath;if(!Z||!x9(Z))throw Error("hands_browser_unavailable");let X=$.launch??(async(N)=>($.targetContext?await h1():(await t9($.managedBrowser?.driverModuleDirectory??$.driverModuleDirectory)).chromium).launch(N)),J=[],G={},z=null,V=null,Y=null,H=null,W=!1,F=null,K=new Map,L=new WeakMap,B=null,U=()=>{if(W)throw Error("hands_repl_stopped");if(H)throw H},M=(N)=>{let j=L.get(N);if(j)return j;let A=Promise.resolve().then(()=>N.close()).then(()=>{K.delete(N)});return L.set(N,A),A},_=async()=>{let N=[...K.entries()].reverse(),j=B??=performance.now()+u1,A=Promise.allSettled(N.filter(([,P])=>P==="context").map(([P])=>M(P))),m;try{await Promise.race([A,new Promise((P)=>{m=setTimeout(P,Math.max(0,j-performance.now()))})])}finally{if(m)clearTimeout(m)}let w=await Promise.allSettled(N.map(([P])=>M(P))),E=[];for(let[P,f]of w.entries()){if(f.status!=="rejected")continue;let d=f.reason instanceof Error&&["Error","TimeoutError","ProtocolError"].includes(f.reason.name)?f.reason.name:"unknown";E.push(Error(`hands_repl_close_failed: ${N[P][1]}: ${d}`))}if(E.length)throw AggregateError(E,"hands_repl_stop_unconfirmed")},q=(N,j)=>{if(K.set(N,j),W||H)M(N).catch(()=>{return}),U();return N},D=async()=>{let N=await X({executablePath:Z,headless:!0,chromiumSandbox:$.managedBrowser===void 0,args:["--disable-background-networking","--disable-quic","--disable-dev-shm-usage","--disable-gpu","--disable-software-rasterizer","--dns-prefetch-disable","--force-webrtc-ip-handling-policy=disable_non_proxied_udp","--no-pings"]}),j=null;try{q(N,"browser"),j=$.targetContext??q(await N.newContext({viewport:{width:1440,height:900},screen:{width:1440,height:900},serviceWorkers:"block",acceptDownloads:!1}),"context");let A=await i1(j,$.networkPolicy??{mode:"off"},$.onEgressDenied);if(U(),A){let S=j.newPage.bind(j);j.newPage=async()=>{let h=await S();return await A.preparePage(h),h}}let w=j.pages()[0]??await j.newPage();await A?.preparePage(w),U();let E=async(S=w)=>{let h=S;if(typeof h.ariaSnapshot==="function")return h.ariaSnapshot({timeout:1e4});return w.locator("body").innerText({timeout:1e4})},P=async(S,h={})=>{let c=h&&typeof h==="object"&&!Array.isArray(h)?h:{},a,H0="image/png";if(Buffer.isBuffer(S)||S instanceof Uint8Array)a=Buffer.from(S);else if(typeof S==="string"&&(S.startsWith("data:")||/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(S)))a=Buffer.from(S.replace(/^data:[^,]*,/,""),"base64");else if(typeof S==="string"){let k0=FZ($.workspaceRoot,S);a=k0.buffer,H0=k0.mimeType}else throw Error("view() needs a Buffer, a base64 string, or a path to an image file");if(a.length===0)throw Error("view(): the image is empty");let B8=String(c.label??"").replace(/[\r\n>]+/g," ").trim().slice(0,120),D0=Number(c.maxWidth)||1024,i0=Number(c.quality)||72,w9=$.targetContext?await N.newPage():await j.newPage();try{let k0=`data:${H0};base64,${a.toString("base64")}`;for(let r=0;r<5;r+=1){let B0=await w9.evaluate(async(F0)=>{let L0=new Image;L0.src=F0.url,await L0.decode();let f0=Math.min(1,F0.maxWidth/L0.naturalWidth),Y0=document.createElement("canvas");Y0.width=Math.max(1,Math.round(L0.naturalWidth*f0)),Y0.height=Math.max(1,Math.round(L0.naturalHeight*f0));let X0=Y0.getContext("2d");if(!X0)throw Error("view(): canvas unavailable");return X0.fillStyle="#ffffff",X0.fillRect(0,0,Y0.width,Y0.height),X0.drawImage(L0,0,0,Y0.width,Y0.height),{data:Y0.toDataURL("image/jpeg",F0.q/100).split(",")[1]??"",width:Y0.width,height:Y0.height,sourceWidth:L0.naturalWidth,sourceHeight:L0.naturalHeight}},{url:k0,maxWidth:D0,q:i0}),a0=Buffer.from(B0.data,"base64");if(a0.length<=HZ){let F0=B8||"image";return`<<<ARA_VIEW_IMAGE ${B0.data} image/jpeg ${F0}>>>
-Viewing ${F0} (${B0.sourceWidth}x${B0.sourceHeight} source, sent at ${B0.width}x${B0.height}, ${Math.round(a0.length/1024)}KB).`}if(D0>640)D0=Math.round(D0*0.75);else i0=Math.max(30,i0-15)}throw Error(`view(): could not reduce the image under ${Math.round(HZ/1024)}KB`)}finally{await w9.close().catch(()=>{return})}},f=oQ({browser:$.targetContext?.browser()??N,context:j,page:w,a11y:E,view:P,readWorkspaceFile:(S)=>FZ($.workspaceRoot,S),privateProfile:$.privateProfile,beforeNavigation:$.beforeNavigation,recording:$.recording,screenshotExport:$.screenshotExport,actionRecorder:()=>{let S=J,h=G;return(c,a)=>{if(S.length<WZ)S.push(c);if(a)h.page=a}}}),d=async(S)=>{U();let h=q(await N.newContext({serviceWorkers:"block",acceptDownloads:!1}),"context");try{await h.route("**/*",(a)=>a.abort()),U(),await h.routeWebSocket("**/*",(a)=>a.close({code:1008,reason:"Reason evaluator network denied"})),U(),await h.exposeBinding("__araHandsRpc",async(a,H0)=>$.onBrowserOperation?$.onBrowserOperation(S,()=>f.dispatch(H0)):f.dispatch(H0)),U();let c=await h.newPage();return U(),await c.goto("data:text/html,<title>Reason Hands evaluator</title>"),U(),await c.evaluate(`(${vQ})(${JSON.stringify(f.roots)})`),{context:h,page:c,runId:S}}catch(c){throw await M(h).catch(()=>{return}),c}},u=await d(),l={browser:N,context:j,page:w,evaluator:u,async captureProgressFrame(S){return P(await S.screenshot({type:"jpeg",quality:65,timeout:2000}),{label:"Screen after browser action"})},async resetEvaluator(S){await M(l.evaluator.context),l.evaluator=await d(S)}};return U(),l}catch(A){throw await _().catch(()=>{return}),A}},x=async()=>{if(U(),z)return z;if(!Y){V=D();let N;Y=Promise.race([V,new Promise((j,A)=>{N=setTimeout(()=>A(Error("hands_browser_unavailable: startup timed out")),d1)})]).then((j)=>{return U(),z=j,j}).catch(async()=>{H=Error("hands_browser_unavailable: startup failed or timed out");let j;try{await Promise.race([_(),new Promise((A,m)=>{j=setTimeout(()=>m(Error("hands_repl_stop_timeout")),VZ)})])}catch{H=Error("hands_browser_unavailable: startup cleanup unconfirmed")}finally{if(j)clearTimeout(j)}throw H}).finally(()=>{if(N)clearTimeout(N)})}return Y},b=async(N,j,A=!1)=>{let m=await x(),w=G;if($.onBrowserOperation&&m.evaluator.runId!==j)await m.resetEvaluator(j);let P=(async()=>{let u=await m.evaluator.page.evaluate(`(${cQ})(${JSON.stringify({code:N})})`);if(typeof u!=="string")throw Error("hands_repl_invalid_evaluator_output");let l=w.page;if(A&&l&&!u.includes("<<<ARA_VIEW_IMAGE")){let S=()=>m.captureProgressFrame(l);try{let h=await($.onBrowserOperation?$.onBrowserOperation(j,S):S());return w.automaticProgressImage=!0,`${u}
+`.trim();import{Buffer as Q9}from"buffer";import{randomUUID as a3}from"crypto";class lQ extends Error{code;constructor($){super($==="hands_repl_private_profile_attribute_denied"?"Private browser attribute read denied.":$);this.code=$;this.name="HandsReplBrowserDispatcherError"}}var sQ=new Set(["__defineGetter__","__defineSetter__","__lookupGetter__","__lookupSetter__","__proto__","constructor","prototype"]),dQ=/^hands_[A-Za-z0-9_-]{8,128}$/,o3=2048,nQ=32,iQ=1e4,r3=new Set(["href","src","alt","title","role","aria-label","aria-expanded","aria-checked","aria-selected","aria-disabled","placeholder","type","name","data-testid"]);function t3($){let Q=$.split("+"),Z=(Q.pop()??"").replace(/^Key/,"").toLowerCase();if(Z==="f12")return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&["l","n","t","j","i","p","s","w","u","o","r","tab","pageup","pagedown"].includes(Z))return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&Q.includes("Shift")&&Z==="c")return!0;return Q.includes("Alt")&&["d","arrowleft","arrowright","home"].includes(Z)}var e3=($)=>{let Q=$.closest("a[href],area[href]");return{password:$.tagName==="INPUT"&&$.type==="password",executableLink:Boolean(Q&&!/^(https?:|about:blank)/i.test(Q.href))}},aQ={browser:{close:{returns:"void"},contexts:{returns:"context[]"},isConnected:{returns:"json"},version:{returns:"json"}},context:{addCookies:{returns:"void"},addInitScript:{returns:"void"},browser:{returns:"browser"},clearCookies:{returns:"void"},clearPermissions:{returns:"void"},close:{returns:"void"},cookies:{returns:"json"},grantPermissions:{returns:"void"},newPage:{returns:"page"},pages:{returns:"page[]"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setGeolocation:{returns:"void"},setHTTPCredentials:{returns:"void"},setOffline:{returns:"void"},setViewportSize:{returns:"void"},storageState:{returns:"json"},viewportSize:{returns:"json",special:"contextViewportSize"}},page:{addInitScript:{returns:"void"},addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},bringToFront:{returns:"void"},close:{returns:"void"},content:{returns:"json"},context:{returns:"context"},emulateMedia:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},frame:{returns:"frame"},frameLocator:{returns:"frameLocator"},frames:{returns:"frame[]"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goBack:{returns:"void"},goForward:{returns:"void"},goto:{returns:"void"},isClosed:{returns:"json"},locator:{returns:"locator"},mainFrame:{returns:"frame"},opener:{returns:"page"},pdf:{returns:"bytes"},reload:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setContent:{returns:"void"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setInputFiles:{returns:"void"},setViewportSize:{returns:"void"},title:{returns:"json"},url:{returns:"json"},viewportSize:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},locator:{all:{returns:"locator[]"},allInnerTexts:{returns:"json"},allTextContents:{returns:"json"},and:{returns:"locator"},ariaSnapshot:{returns:"json"},blur:{returns:"void"},boundingBox:{returns:"json"},check:{returns:"void"},clear:{returns:"void"},click:{returns:"void"},contentFrame:{returns:"frameLocator"},count:{returns:"json"},dblclick:{returns:"void"},dragTo:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},evaluateAll:{returns:"json",requiresStringSource:!0},fill:{returns:"void"},filter:{returns:"locator"},first:{returns:"locator",special:"property"},focus:{returns:"void"},getAttribute:{returns:"json"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},hover:{returns:"void"},innerHTML:{returns:"json"},innerText:{returns:"json"},inputValue:{returns:"json"},isChecked:{returns:"json"},isEditable:{returns:"json"},isEnabled:{returns:"json"},isHidden:{returns:"json"},isVisible:{returns:"json"},last:{returns:"locator",special:"property"},locator:{returns:"locator"},nth:{returns:"locator"},or:{returns:"locator"},page:{returns:"page"},press:{returns:"void"},pressSequentially:{returns:"void"},scrollIntoViewIfNeeded:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setInputFiles:{returns:"void"},tap:{returns:"void"},textContent:{returns:"json"},type:{returns:"void"},uncheck:{returns:"void"},waitFor:{returns:"void"}},frame:{addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},childFrames:{returns:"frame[]"},content:{returns:"json"},evaluate:{returns:"json",requiresStringSource:!0},frameLocator:{returns:"frameLocator"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goto:{returns:"void"},isDetached:{returns:"json"},locator:{returns:"locator"},name:{returns:"json"},page:{returns:"page"},parentFrame:{returns:"frame"},setContent:{returns:"void"},title:{returns:"json"},url:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},frameLocator:{getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},locator:{returns:"locator"},owner:{returns:"locator"}}};function R($){throw new lQ($)}function G0($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Q=Object.getPrototypeOf($);return Q===Object.prototype||Q===null}function Z9($,Q=0,Z={nodes:0}){if(Q>nQ||++Z.nodes>iQ)R("hands_repl_json_too_complex");if($===null||typeof $==="boolean"||typeof $==="string")return;if(typeof $==="number"){if(!Number.isFinite($))R("hands_repl_invalid_json");return}if(Array.isArray($)){for(let X of $)Z9(X,Q+1,Z);return}if(!G0($))R("hands_repl_invalid_json");for(let[X,J]of Object.entries($)){if(sQ.has(X))R("hands_repl_invalid_json");Z9(J,Q+1,Z)}}function m8($){return typeof $==="string"&&Object.hasOwn(aQ,$)}function $1($){if(!$.endsWith("[]"))return null;let Q=$.slice(0,-2);return m8(Q)?Q:null}function pQ($){return G0($)&&Object.keys($).length===2&&$.$handsRepl==="bytes"&&typeof $.base64==="string"}function Q1($){return G0($)&&Object.keys($).length===1&&$.$handsRepl==="undefined"}function uQ($){return G0($)&&Object.keys($).length===2&&$.$handsRepl==="routeFulfill"&&"options"in $}function S0($){return!!$&&typeof $==="object"}function a9(){return Object.freeze({$handsRepl:"undefined"})}function Z1($){if(!Q9.isBuffer($)&&!($ instanceof Uint8Array))R("hands_repl_expected_bytes");return Object.freeze({$handsRepl:"bytes",base64:Q9.from($).toString("base64")})}function oQ($){if(!S0($.browser)||!S0($.context)||!S0($.page))R("hands_repl_invalid_roots");if(typeof $.a11y!=="function"||typeof $.view!=="function")R("hands_repl_invalid_callbacks");let Q=$.maxHandles??o3;if(!Number.isInteger(Q)||Q<3||Q>1e5)R("hands_repl_invalid_handle_limit");let Z=new Map,X=new WeakMap,J=$.createOpaqueId??a3,G=(K,L)=>{if(!S0(L))R("hands_repl_expected_target");let B=X.get(L)?.get(K);if(B)return B;if(Z.size>=Q)R("hands_repl_handle_limit");let W="";for(let q=0;q<16;q+=1){let D=`hands_${J()}`;if(dQ.test(D)&&!Z.has(D)){W=D;break}}if(!W)R("hands_repl_invalid_opaque_id");let M=Object.freeze({$handsRepl:"handle",id:W,kind:K});Z.set(W,{kind:K,target:L});let _=X.get(L);if(!_)_=new Map,X.set(L,_);return _.set(K,M),M},z=Object.freeze({browser:G("browser",$.browser),context:G("context",$.context),page:G("page",$.page)}),H=(K)=>{if(!G0(K)||Object.keys(K).length!==3||K.$handsRepl!=="handle"||typeof K.id!=="string"||!dQ.test(K.id)||!m8(K.kind))R("hands_repl_invalid_handle");let L=Z.get(K.id);if(!L||L.kind!==K.kind)R("hands_repl_unknown_handle");return L},Y=(K,L=0,B=new Set)=>{if(L>nQ)R("hands_repl_json_too_complex");if(K===void 0)return a9();if(K===null||typeof K==="boolean"||typeof K==="string")return K;if(typeof K==="number"){if(!Number.isFinite(K))R("hands_repl_non_json_result");return K}if(Array.isArray(K)){if(B.has(K))R("hands_repl_cyclic_result");B.add(K);try{return K.map((W)=>Y(W,L+1,B))}finally{B.delete(K)}}if(!G0(K))R("hands_repl_non_json_result");if(B.has(K))R("hands_repl_cyclic_result");B.add(K);try{let W=Object.create(null);for(let M of Object.keys(K)){let _=Object.getOwnPropertyDescriptor(K,M);if(!_||!("value"in _))continue;W[M]=Y(_.value,L+1,B)}return W}finally{B.delete(K)}},V=(K,L)=>{if(L==="void")return a9();if(L==="json")return Y(K);if(L==="bytes")return Z1(K);let B=$1(L);if(B){if(!Array.isArray(K))R("hands_repl_expected_target_list");if(B==="context"&&K.some((W)=>W!==$.context))R("hands_repl_foreign_context");return K.map((W)=>G(B,W))}if(K===null||K===void 0)return a9();if(!m8(L))R("hands_repl_invalid_return_kind");if(L==="context"&&K!==$.context)R("hands_repl_foreign_context");return G(L,K)},U=(K)=>{if(G0(K)&&K.$handsRepl==="handle")return H(K).target;if(pQ(K))return Q9.from(K.base64,"base64");if(Q1(K))return;if(uQ(K))R("hands_repl_route_fulfill_only");if(Array.isArray(K))return K.map(U);if(!G0(K))return K;let L=Object.create(null);for(let[B,W]of Object.entries(K))L[B]=U(W);return L};return Object.freeze({roots:z,dispatch:async(K)=>{if(!G0(K)||typeof K.type!=="string")R("hands_repl_invalid_request");if(K.type==="a11y"){let T=K.target===void 0?Z.get(z.page.id):H(K.target);if(!T||T.kind!=="page"&&T.kind!=="locator")R("hands_repl_invalid_a11y_target");return Y(await $.a11y(T.target))}if(K.type==="view"){if(Z9(K.source),K.options!==void 0)Z9(K.options);let T=pQ(K.source)?Q9.from(K.source.base64,"base64"):K.source;if($.privateProfile&&!Q9.isBuffer(T))R("hands_repl_profile_requires_image_bytes");return Y(await $.view(T,K.options))}if(K.type!=="call")R("hands_repl_invalid_request");if(typeof K.method!=="string"||K.method.length===0||K.method.length>128)R("hands_repl_invalid_method");if(sQ.has(K.method))R("hands_repl_forbidden_method");let L=H(K.target),B=K.args??[];if(!Array.isArray(B))R("hands_repl_invalid_arguments");if(Z9(B),L.kind==="page"&&K.method==="captureScreenshot"){if(B.length!==0)R("hands_repl_invalid_arguments");if(!$.screenshotExport)R("hands_repl_screenshot_export_unavailable");return Y(await $.screenshotExport(L.target))}if(L.kind==="context"&&["startRecording","stopRecording"].includes(K.method)){if(!$.recording||L.target!==$.context)R("hands_repl_recording_unavailable");if(B.length>(K.method==="startRecording"?1:0))R("hands_repl_invalid_arguments");return Y(K.method==="startRecording"?await $.recording.start(B[0]):await $.recording.stop())}if($.privateProfile){let T=K.method;if(["evaluate","evaluateAll","waitForFunction","addInitScript","addScriptTag","addStyleTag","setContent","setInputFiles","route","content","cookies","storageState","addCookies","clearCookies","setExtraHTTPHeaders","setHTTPCredentials","grantPermissions","clearPermissions","innerHTML","textContent","allTextContents"].includes(T)||L.kind==="browser"&&T==="close"||L.kind==="context"&&T==="close")R("hands_repl_private_profile_method_denied");if(L.kind==="browser"&&T==="contexts")return V([$.context],"context[]");if((T==="screenshot"||T==="pdf")&&G0(B[0])&&(("path"in B[0])||("style"in B[0])))R("hands_repl_private_profile_path_denied");if(T==="goto"){if(typeof B[0]!=="string")R("hands_repl_private_profile_url_denied");try{let k=new URL(B[0]);if(!["http:","https:"].includes(k.protocol)&&B[0]!=="about:blank")R("hands_repl_private_profile_url_denied")}catch{R("hands_repl_private_profile_url_denied")}}if(T==="getAttribute"&&(typeof B[0]!=="string"||!r3.has(B[0].toLowerCase())))R("hands_repl_private_profile_attribute_denied");if(L.kind==="locator"&&["innerText","allInnerTexts","getAttribute"].includes(T)){let k=[L.target];if(T==="allInnerTexts"){let g=Reflect.get(L.target,"all");if(typeof g!=="function")R("hands_repl_private_profile_probe_unavailable");let O=await Reflect.apply(g,L.target,[]);if(!Array.isArray(O)||O.length>iQ||!O.every(S0))R("hands_repl_private_profile_probe_unavailable");k=O}for(let g of k){let O=Reflect.get(g,"isVisible");if(typeof O!=="function"||!await Reflect.apply(O,g,[]))R("hands_repl_private_profile_hidden_value_denied")}}if(T==="press"&&typeof B[0]==="string"&&t3(B[0]))R("hands_repl_private_profile_browser_shortcut_denied");if(L.kind==="locator"&&["inputValue","click","dblclick","tap","press"].includes(T)){let k=Reflect.get(L.target,"evaluate");if(typeof k!=="function")R("hands_repl_private_profile_probe_unavailable");let g=await Reflect.apply(k,L.target,[e3]);if(!G0(g)||typeof g.password!=="boolean"||typeof g.executableLink!=="boolean")R("hands_repl_private_profile_probe_unavailable");if(T==="inputValue"&&g.password)R("hands_repl_private_profile_password_denied");if(T!=="inputValue"&&g.executableLink)R("hands_repl_private_profile_url_denied");if(T==="inputValue"){let O=Reflect.get(L.target,"isVisible");if(typeof O!=="function"||!await Reflect.apply(O,L.target,[]))R("hands_repl_private_profile_hidden_value_denied")}}}let W=aQ[L.kind][K.method];if(!W)R("hands_repl_method_not_allowed");if(W.requiresStringSource&&typeof B[0]!=="string")R("hands_repl_string_source_required");if(L.kind==="browser"&&K.method==="contexts")return[z.context];if(["addInitScript","addScriptTag","addStyleTag","screenshot","pdf","storageState"].includes(K.method)&&B.some((T)=>G0(T)&&("path"in T)))R("hands_repl_file_path_not_allowed");if(K.method==="goto"&&typeof B[0]==="string"){let T;try{T=new URL(B[0]).protocol}catch{R("hands_repl_invalid_url")}if(!["http:","https:","data:","about:","blob:"].includes(T))R("hands_repl_file_path_not_allowed")}if(W.special==="contextViewportSize"){let T=Reflect.get(L.target,"pages");if(typeof T!=="function")R("hands_repl_method_unavailable");let k=await Reflect.apply(T,L.target,[]),g=Array.isArray(k)?k[0]:void 0,O=S0(g)?Reflect.get(g,"viewportSize"):void 0;if(typeof O!=="function")return a9();return V(await Reflect.apply(O,g,[]),W.returns)}if(W.special==="property"){let T=Reflect.get(L.target,K.method);return V(typeof T==="function"?Reflect.apply(T,L.target,[]):T,W.returns)}let M=Reflect.get(L.target,K.method);if(typeof M!=="function")R("hands_repl_method_unavailable");if(W.special==="route"){let T=B[1];if(!uQ(T))R("hands_repl_invalid_route_handler");Z9(T.options);let k=U(T.options),g=async(j)=>{if(!S0(j))R("hands_repl_invalid_route");let A=Reflect.get(j,"fulfill");if(typeof A!=="function")R("hands_repl_invalid_route");await Reflect.apply(A,j,[k])},O=[U(B[0]??null),g],N=await Reflect.apply(M,L.target,O);return V(N,W.returns)}let _=B.map(U);if(K.method==="setInputFiles"){let T=L.kind==="locator"?0:1,k=async(O)=>{if(typeof O!=="string"){if(!G0(O)||typeof O.name!=="string"||typeof O.mimeType!=="string"||!Q9.isBuffer(O.buffer))R("hands_repl_invalid_file_input");return O}if(!$.readWorkspaceFile)R("hands_repl_workspace_required");return $.readWorkspaceFile(O)},g=_[T];_[T]=Array.isArray(g)?await Promise.all(g.map(k)):await k(g)}if(K.method==="goto")await $.beforeNavigation?.();let q=$.actionRecorder?.(),D=await Reflect.apply(M,L.target,_),b={click:"Click browser element",tap:"Click browser element",dblclick:"Double click browser element",fill:"Type text",type:"Type text",pressSequentially:"Type text",clear:"Clear browser field",press:"Press key",scrollIntoViewIfNeeded:"Scroll browser element into view",dragTo:"Drag on computer",selectOption:"Select browser option",check:"Check browser control",uncheck:"Uncheck browser control",hover:"Hover browser element",focus:"Focus browser element",goto:"Open browser page",reload:"Reload browser page",goBack:"Go back in browser",goForward:"Go forward in browser",screenshot:"Take browser screenshot"}[K.method];if(b){let T=Reflect.get(L.target,"page"),k=L.kind==="page"?L.target:typeof T==="function"?Reflect.apply(T,L.target,[]):void 0;q?.(b,S0(k)?k:void 0)}return V(D,W.returns)}})}import{isIP as QZ}from"net";import{Resolver as X1}from"dns/promises";import{isIP as r9}from"net";var J1=[["0.0.0.0",8],["10.0.0.0",8],["100.64.0.0",10],["127.0.0.0",8],["169.254.0.0",16],["172.16.0.0",12],["192.0.0.0",24],["192.0.2.0",24],["192.168.0.0",16],["198.18.0.0",15],["198.51.100.0",24],["203.0.113.0",24],["224.0.0.0",4],["240.0.0.0",4]];function g8($){if(r9($)!==4)return null;let Q=$.split(".");if(Q.length!==4)return null;let Z=0;for(let X of Q){let J=Number(X);if(!Number.isInteger(J)||J<0||J>255)return null;Z=Z*256+J}return Z>>>0}function Y1($,Q,Z){let X=g8(Q);if(X===null)return!1;let J=Z===0?0:4294967295<<32-Z>>>0;return($&J)>>>0===(X&J)>>>0}function rQ($){let Q=g8($);if(Q===null)return!0;return J1.some(([Z,X])=>Y1(Q,Z,X))}function G1($){if(r9($)!==6)return null;let Q=$.toLowerCase(),Z=Q.indexOf("%");if(Z>=0)Q=Q.slice(0,Z);let X=[],J=Q.lastIndexOf(":"),G=J>=0?Q.slice(J+1):"";if(G.includes(".")){let K=g8(G);if(K===null)return null;X=[K>>>16&65535,K&65535],Q=Q.slice(0,J+1)+"0:0"}let z=Q.split("::");if(z.length>2)return null;let H=(K)=>{if(K==="")return[];let L=[];for(let B of K.split(":")){if(B===""||B.length>4||!/^[0-9a-f]+$/.test(B))return null;L.push(Number.parseInt(B,16))}return L},Y=H(z[0]??"");if(Y===null)return null;if(z.length===1){let K=Y;if(K.length!==8)return null;return X.length>0?K.slice(0,6).concat(X):K}let V=H(z[1]??"");if(V===null)return null;let U=8-Y.length-V.length;if(U<0)return null;let F=Y.concat(Array(U).fill(0),V);if(F.length!==8)return null;return X.length>0?F.slice(0,6).concat(X):F}function z1($,Q){return`${$>>8&255}.${$&255}.${Q>>8&255}.${Q&255}`}function K1($){let Q=G1($);if(Q===null)return!0;let[Z,X,J]=Q;if((Z&57344)!==8192)return!0;if(Z===8193&&(X&65024)===0)return!0;if(Z===8193&&X===3512)return!0;if(Z===16383&&(X&61440)===0)return!0;if(Z===8194)return rQ(z1(X,J));return!1}function tQ($){return $.replace(/^\[|\]$/g,"")}function o9($){let Q=tQ($.trim()),Z=r9(Q);if(Z===4)return rQ(Q);if(Z===6)return K1(Q);return!0}function eQ($){if($ instanceof Error&&$.name==="TimeoutError")return"dns_timeout";switch(typeof $==="object"&&$!==null&&"code"in $?$.code:void 0){case"ENOTFOUND":return"dns_not_found";case"ENODATA":return"dns_empty";case"EAI_AGAIN":case"ESERVFAIL":case"ECONNREFUSED":return"dns_temporary";case"ETIMEOUT":case"ETIMEDOUT":return"dns_timeout";default:return"dns_failed"}}var $Z=5000;function H1($){return async(Q,Z)=>{if(Z?.aborted)throw Error("aborted");let X=new X1({timeout:$Z,tries:1});if($)X.setServers($);let J=()=>X.cancel();Z?.addEventListener("abort",J,{once:!0});try{let[G,z]=await Promise.allSettled([X.resolve4(Q),X.resolve6(Q)]),H=[...G.status==="fulfilled"?G.value:[],...z.status==="fulfilled"?z.value:[]];if(H.length>0)return H;let Y=[G,z].flatMap((U)=>U.status==="rejected"?[U.reason]:[]);throw Y.find((U)=>["dns_temporary","dns_timeout"].includes(eQ(U)))??Y[0]??Object.assign(Error("DNS returned no addresses"),{code:"ENODATA"})}finally{Z?.removeEventListener("abort",J)}}}var V1=H1();async function F1($,Q,Z,X){if(X?.aborted)throw Error("aborted");let J=new AbortController,G,z,H=Q($,J.signal);H.catch(()=>{});try{return await Promise.race([H,new Promise((Y,V)=>{if(G=setTimeout(()=>V(new DOMException("DNS lookup timed out","TimeoutError")),Z),X)z=()=>V(Error("aborted")),X.addEventListener("abort",z,{once:!0})})])}finally{if(G!==void 0)clearTimeout(G);if(X&&z)X.removeEventListener("abort",z);J.abort()}}async function p5($,Q=V1,Z){let X=tQ($);if(r9(X))return o9(X)?{ok:!1,reason:"non_public_ip"}:{ok:!0,addresses:[X]};let J;try{J=await F1(X,Q,$Z,Z)}catch(G){return{ok:!1,reason:Z?.aborted?Z.reason instanceof Error&&Z.reason.name==="TimeoutError"?"dns_timeout":"aborted":eQ(G)}}if(J.length===0)return{ok:!1,reason:"dns_empty"};if(J.some(o9))return{ok:!1,reason:"non_public_ip"};return{ok:!0,addresses:J}}var U1=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;function y8($){return $.length<=253&&U1.test($.toLowerCase())}function W1($,Q){let Z=$.trim().toLowerCase();if(!y8(Z))return!1;if(Z.startsWith("*.")){let X=Z.slice(2);return Q===X||Q.endsWith(`.${X}`)}return Z===Q}function B1($){let Q=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec($);if(!Q)return null;let Z=Q.slice(1).map(Number);return Z.some((X)=>X>255)?null:Z}function h8($,Q=[]){let Z=(X)=>{if(X=X.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,""),!X.includes(":"))return X;try{X=new URL(`http://[${X}]/`).hostname.slice(1,-1)}catch{return X}let J=/^::ffff:([\da-f]+):([\da-f]+)$/.exec(X);if(!J)return X;let G=parseInt(J[1],16),z=parseInt(J[2],16);return`${G>>8}.${G&255}.${z>>8}.${z&255}`};return Q.some((X)=>Z(X)===Z($))}function c0($){$=$.toLowerCase().replace(/^\[|\]$/g,"");let Q=B1($);if(Q){let[G,z,H]=Q;if(G===127)return"loopback";return G===0||G===10||G>=224||G===100&&z>=64&&z<=127||G===169&&z===254||G===172&&z>=16&&z<=31||G===192&&(z===168||z===0&&(H===0||H===2)||z===88&&H===99)||G===198&&(z===18||z===19||z===51&&H===100)||G===203&&z===0&&H===113?"private":"public"}if(!$.includes(":"))return"hostname";try{$=new URL(`http://[${$}]/`).hostname.slice(1,-1)}catch{return"private"}if($==="::1")return"loopback";let Z=/^::ffff:([\da-f]+):([\da-f]+)$/.exec($);if(Z){let G=parseInt(Z[1],16),z=parseInt(Z[2],16);return c0(`${G>>8}.${G&255}.${z>>8}.${z&255}`)==="public"?"public":"private"}let[X,J=0]=$.split(":").map((G)=>parseInt(G||"0",16));return X<8192||X>16383||X===8194||X===8193&&(J<512||J===3512)||X===16383&&J<4096?"private":"public"}function A9($,Q){let Z;try{Z=new URL($)}catch{return{allowed:!1,url:$,host:null,reason:"invalid_url"}}if(["about:","data:","blob:"].includes(Z.protocol))return{allowed:!0,url:$,host:null,reason:"local_document"};if(!["http:","https:","ws:","wss:"].includes(Z.protocol))return{allowed:!1,url:$,host:Z.hostname||null,reason:"unsupported_protocol"};let X=Z.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,"");if(Q.mode==="off")return{allowed:!0,url:$,host:X,reason:"policy_off"};let J=(H)=>({allowed:!1,url:$,host:X,reason:H});if(Z.username||Z.password)return J("invalid_url");if(Q.mode==="public_web"){let H=c0(X)!=="public"&&c0(X)!=="hostname"||X==="localhost"||/\.(?:localhost|local|internal|arpa)$/.test(X)||!X.includes(".")&&!QZ(X)||Boolean(QZ(X)&&o9(X));return{allowed:!H,url:$,host:X,reason:H?"private_network":"public_web"}}let G=Number(Z.port||(["https:","wss:"].includes(Z.protocol)?443:80));if(Q.deniedPorts?.includes(G)||h8(X,Q.deniedHosts))return J("destination_not_allowed");let z=c0(X);if(z==="private"||["local","internal","arpa"].some((H)=>X===H||X.endsWith(`.${H}`)))return J("private_network");if(z==="loopback"||X==="localhost"||X.endsWith(".localhost"))return Q.allowedLoopbackPorts?.includes(G)?{allowed:!0,url:$,host:X,reason:"loopback"}:J("destination_not_allowed");if(Q.allowedDomains.some((H)=>W1(H,X)))return{allowed:!0,url:$,host:X,reason:"allowed_domain"};return{allowed:!1,url:$,host:X,reason:"destination_not_allowed"}}import XZ from"child_process";import{accessSync as N1,constants as M1,readFileSync as j1,statSync as C1}from"fs";import{createRequire as q1}from"module";import{isAbsolute as v8,join as T1}from"path";var c8=Object.freeze({schemaVersion:1,driver:"playwright-core",driverVersion:JZ.dependencies["playwright-core"],browser:"chromium"}),YZ=["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome","/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge","/Applications/Brave Browser.app/Contents/MacOS/Brave Browser","/Applications/Chromium.app/Contents/MacOS/Chromium"],d8=["/usr/bin/chromium","/usr/bin/chromium-browser","/usr/bin/google-chrome","/usr/bin/google-chrome-stable"];function x9($){try{return N1($,M1.X_OK),v8($)&&C1($).isFile()}catch{return!1}}function p8($,Q=process.platform){let Z=Q==="darwin"?YZ:Q==="linux"?d8:null;return Z?($??Z).find(x9)??null:null}function O1(){if(!process.versions.bun)return;let $=Symbol.for("ara.headless-browser.bun-pipe-owners");if(Object.hasOwn(globalThis,$))return;let Q=[];XZ.spawn=new Proxy(XZ.spawn,{apply(Z,X,J){let G=Reflect.apply(Z,X,J),z=J[1],H=J[2]?.stdio;if(Array.isArray(z)&&z.includes("--remote-debugging-pipe")&&Array.isArray(H)&&H[3]==="pipe"&&H[4]==="pipe")Q.push(G);return G}}),Object.defineProperty(globalThis,$,{value:Q})}async function t9($){if(O1(),$!==void 0){if(!v8($))throw Error("hands_browser_driver_path_must_be_absolute");let X=T1($,"package.json"),J=JSON.parse(j1(X,"utf8"));if(J.name!==c8.driver)throw Error("hands_browser_wrong_driver");let G=q1(X)($),z=G.default?.chromium??G.chromium;if(!z)throw Error("hands_browser_missing_chromium");return{version:J.version,chromium:z}}let[Q,Z]=await Promise.all([import("./index-9aw1gjs5.js"),import("./package-56yg8k4a.js").then((m)=>L1(m.default,1))]);return{version:Z.default.version,chromium:Q.chromium}}var D1=($,Q=c8.driverVersion)=>({status:"unavailable",reason:$,expectedDriverVersion:Q}),_1=($)=>$.loadDriver?.()??t9($.driverModuleDirectory);async function X9($={}){return GZ($,c8.driverVersion)}async function u8($,Q={}){if($.driverVersion!=="1.61.1"||!v8($.driverModuleDirectory))throw Error("hands_browser_invalid_managed_compatibility");return GZ({...Q,driverModuleDirectory:$.driverModuleDirectory,allowSystemBrowser:!0},$.driverVersion)}async function GZ($,Q){let Z=(Y)=>D1(Y,Q),X=$.platform??process.platform;if(X!=="linux"&&X!=="darwin")return Z("unsupported_platform");let J;try{J=await _1($)}catch{return Z("driver_missing")}if(J.version!==Q)return Z("driver_version_mismatch");let G=(Y,V)=>({status:"resolved",executablePath:Y,source:V,driverVersion:J.version});if($.executablePath!==void 0)return x9($.executablePath)?G($.executablePath,"configured"):Z("executable_missing");let z=J.chromium.executablePath();if(x9(z))return G(z,"managed");let H=$.allowSystemBrowser===!0?p8($.systemCandidates,X):null;return H?G(H,"system"):Z("executable_missing")}var g1=["/usr/local/bin/chromium",...d8];function y1($,Q=WZ()){return p8($??(Q==="linux"?g1:void 0),Q)}async function h1(){try{return(await t9()).chromium}catch{return w1(import.meta.url)("playwright-core").chromium}}var v1=1048576,c1=105000,d1=20000,HZ=5000,p1=2000,u1=1000,l1=30000,VZ=81920,s1={".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".gif":"image/gif"};async function n1($,Q){let Z=new URL($.url()),X={...await $.allHeaders(),host:Z.host};for(let J of Object.keys(X))if(/^(?:proxy-|connection$|upgrade$|transfer-encoding$|content-length$)/i.test(J))delete X[J];return new Promise((J,G)=>{let H=(Z.protocol==="https:"?k1:b1)(Z,{method:$.method(),headers:X,agent:!1,lookup:(V,U,F)=>{let K=d0.isIP(Q);if(U.all)F(null,[{address:Q,family:K}]);else F(null,Q,K)}},(V)=>{let U=[],F=0;V.on("data",(K)=>{if(F+=K.length,F>33554432)H.destroy(Error("hands_browser_response_too_large"));else U.push(K)}),V.on("error",G),V.on("end",()=>{let K={};for(let[L,B]of Object.entries(V.headers))if(B!==void 0&&!["transfer-encoding","connection","content-length"].includes(L))K[L]=Array.isArray(B)?B.join(`
+`):B;J({status:V.statusCode??502,headers:K,body:Buffer.concat(U)})})}),Y=setTimeout(()=>H.destroy(Error("hands_browser_fetch_timeout")),l1);H.once("close",()=>clearTimeout(Y)),H.on("error",G),H.end($.postDataBuffer()??void 0)})}async function i1($,Q,Z=()=>{},X={lookup:(J)=>S1(J,{all:!0}),fetch:n1}){let J=new WeakSet,G=new WeakMap,z=(H)=>{let Y=G.get(H);if(Y)return Y;let V=(async()=>{if(!$.newCDPSession)return;let U=await $.newCDPSession(H),F=new Map;U.on("Network.loadingFinished",({requestId:K})=>F.delete(K)),U.on("Network.loadingFailed",({requestId:K})=>F.delete(K)),U.on("Fetch.requestPaused",async(K)=>{let L=K.networkId??K.requestId,B=K.redirectedRequestId?(F.get(L)??0)+1:0;F.set(L,B);let W=A9(K.request.url,Q),M=Q.mode==="enforce"&&Boolean(K.redirectedRequestId)&&W.host!==null&&!d0.isIP(W.host),_=!W.allowed?W:M?{...W,allowed:!1,reason:"destination_not_allowed"}:B>20?{...W,allowed:!1,reason:"redirect_not_supported"}:null;try{if(_)Z(_),await U.send("Fetch.failRequest",{requestId:K.requestId,errorReason:"BlockedByClient"});else await U.send("Fetch.continueRequest",{requestId:K.requestId})}catch{await U.send("Fetch.failRequest",{requestId:K.requestId,errorReason:"Failed"}).catch(()=>{})}}),await U.send("Network.enable"),await U.send("Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]}),J.add(H)})();return G.set(H,V),V};return await $.route("**/*",async(H)=>{let Y=H.request().url(),V=A9(Y,Q);if(V.allowed&&Q.mode==="public_web"){await H.continue();return}let U=H.request();if(V.allowed&&V.host&&d0.isIP(V.host)&&U.isNavigationRequest?.()){let F=U.frame();if(J.has(F.page())&&F===F.page().mainFrame()){await H.continue();return}}if(V.allowed&&(Q.mode==="off"||V.reason==="local_document")){await H.continue();return}if(V.allowed&&V.host)try{let F=V.host,K=c0(F),L,B=await(async()=>{if(K!=="hostname")return[{address:F,family:d0.isIP(F)}];if(V.reason==="loopback")return[{address:"127.0.0.1",family:4}];try{return await Promise.race([X.lookup(F),new Promise((W,M)=>{L=setTimeout(()=>M(Error("hands_browser_dns_timeout")),5000)})])}finally{if(L)clearTimeout(L)}})();if(!B.length||B.some(({address:W})=>{let M=c0(W);return!d0.isIP(W)||Q.mode==="enforce"&&h8(W,Q.deniedHosts)||(V.reason==="loopback"?M!=="loopback":M!=="public")}))V={...V,allowed:!1,reason:"private_network"};else{let W=await X.fetch(H.request(),B[0].address);if(W.status>=300&&W.status<400){let M=W.headers.location??Y;try{M=new URL(M,Y).href}catch{}let _=A9(M,Q);V=_.allowed?{..._,allowed:!1,reason:"redirect_not_supported"}:_}else{await H.fulfill(W);return}}}catch{await H.abort("failed");return}Z(V),await H.abort("blockedbyclient")}),await $.routeWebSocket("**/*",async(H)=>{let Y=A9(H.url(),Q);if(Q.mode==="enforce"&&Y.allowed&&(!Y.host||!d0.isIP(Y.host)))Y={...Y,allowed:!1,reason:"destination_not_allowed"};if(Y.allowed){H.connectToServer();return}Z(Y),await H.close({code:1008,reason:"Reason egress policy denied"})}),Q.mode==="off"?void 0:{preparePage:z}}async function BZ($,Q=WZ(),Z){if(Z){let J=await u8(Z,{platform:Q,systemCandidates:$});return J.status==="resolved"?J.executablePath:null}if($!==void 0){let J=y1($,Q);if(J)return J}let X=await X9({platform:Q,systemCandidates:$,allowSystemBrowser:!0});return X.status==="resolved"?X.executablePath:null}function FZ($,Q){if(!$)throw Error("hands_repl_workspace_required");let Z=s8($),X=J9($),J=n8(X,J9(X,Q)),z=J!==".."&&!J.startsWith(`..${i8}`)&&!KZ(J)?J9(Z,J):J9(Z,Q);if(E0(J9(X,Q))||E0(z))throw Error("hands_repl_protected_path");let H=(B)=>{let W=n8(Z,B);return W!==""&&W!==".."&&!W.startsWith(`..${i8}`)&&!KZ(W)},Y=s8(z);if(E0(Y))throw Error("hands_repl_protected_path");if(!H(z)||!H(Y))throw Error("hands_repl_file_outside_workspace");let V=n8(Z,z).split(i8),U=[Z,...V.map((B,W)=>J9(Z,...V.slice(0,W+1)))],F=U.map((B)=>zZ(B));if(F.some((B)=>B.isSymbolicLink()))throw Error("hands_repl_file_symlink");let K=F[F.length-1];if(!K.isFile()||K.nlink!==1||K.size>16777216)throw Error("hands_repl_file_not_regular_or_too_large");let L=I1(z,l8.O_RDONLY|l8.O_NOFOLLOW|l8.O_NONBLOCK);try{let B=P1(L);if(B.dev!==K.dev||B.ino!==K.ino||!B.isFile())throw Error("hands_repl_file_changed");for(let q=0;q<U.length;q++){let D=zZ(U[q]);if(D.dev!==F[q].dev||D.ino!==F[q].ino||D.isSymbolicLink())throw Error("hands_repl_file_changed")}if(!H(s8(z)))throw Error("hands_repl_file_outside_workspace");let W=Buffer.alloc(16777217),M=0;while(M<W.length){let q=R1(L,W,M,W.length-M,null);if(!q)break;M+=q}if(M===W.length)throw Error("hands_repl_file_too_large");let _=W.subarray(0,M);return{name:f1(z),mimeType:s1[m1(z).toLowerCase()]??"application/octet-stream",buffer:_}}finally{x1(L)}}function Y9($,Q){$.end(`${JSON.stringify(Q)}
+`)}function e9($){try{E1($)}catch{}}async function LZ($){if($.managedBrowser&&$.driverModuleDirectory!==void 0)throw Error("hands_browser_ambiguous_driver_configuration");let Q=$.launch||$.targetContext?null:$.managedBrowser?await u8($.managedBrowser,{executablePath:$.browserExecutablePath}):await X9({executablePath:$.browserExecutablePath,driverModuleDirectory:$.driverModuleDirectory});if(Q?.status==="unavailable")throw Error(`hands_browser_${Q.reason}`);let Z=Q?.status==="resolved"?Q.executablePath:$.browserExecutablePath;if(!Z||!x9(Z))throw Error("hands_browser_unavailable");let X=$.launch??(async(N)=>($.targetContext?await h1():(await t9($.managedBrowser?.driverModuleDirectory??$.driverModuleDirectory)).chromium).launch(N)),J=[],G={},z=null,H=null,Y=null,V=null,U=!1,F=null,K=new Map,L=new WeakMap,B=null,W=()=>{if(U)throw Error("hands_repl_stopped");if(V)throw V},M=(N)=>{let j=L.get(N);if(j)return j;let A=Promise.resolve().then(()=>N.close()).then(()=>{K.delete(N)});return L.set(N,A),A},_=async()=>{let N=[...K.entries()].reverse(),j=B??=performance.now()+u1,A=Promise.allSettled(N.filter(([,P])=>P==="context").map(([P])=>M(P))),m;try{await Promise.race([A,new Promise((P)=>{m=setTimeout(P,Math.max(0,j-performance.now()))})])}finally{if(m)clearTimeout(m)}let w=await Promise.allSettled(N.map(([P])=>M(P))),E=[];for(let[P,f]of w.entries()){if(f.status!=="rejected")continue;let d=f.reason instanceof Error&&["Error","TimeoutError","ProtocolError"].includes(f.reason.name)?f.reason.name:"unknown";E.push(Error(`hands_repl_close_failed: ${N[P][1]}: ${d}`))}if(E.length)throw AggregateError(E,"hands_repl_stop_unconfirmed")},q=(N,j)=>{if(K.set(N,j),U||V)M(N).catch(()=>{return}),W();return N},D=async()=>{let N=await X({executablePath:Z,headless:!0,chromiumSandbox:$.managedBrowser===void 0,args:["--disable-background-networking","--disable-quic","--disable-dev-shm-usage","--disable-gpu","--disable-software-rasterizer","--dns-prefetch-disable","--force-webrtc-ip-handling-policy=disable_non_proxied_udp","--no-pings"]}),j=null;try{q(N,"browser"),j=$.targetContext??q(await N.newContext({viewport:{width:1440,height:900},screen:{width:1440,height:900},serviceWorkers:"block",acceptDownloads:!1}),"context");let A=await i1(j,$.networkPolicy??{mode:"off"},$.onEgressDenied);if(W(),A){let S=j.newPage.bind(j);j.newPage=async()=>{let h=await S();return await A.preparePage(h),h}}let w=j.pages()[0]??await j.newPage();await A?.preparePage(w),W();let E=async(S=w)=>{let h=S;if(typeof h.ariaSnapshot==="function")return h.ariaSnapshot({timeout:1e4});return w.locator("body").innerText({timeout:1e4})},P=async(S,h={})=>{let c=h&&typeof h==="object"&&!Array.isArray(h)?h:{},a,V0="image/png";if(Buffer.isBuffer(S)||S instanceof Uint8Array)a=Buffer.from(S);else if(typeof S==="string"&&(S.startsWith("data:")||/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(S)))a=Buffer.from(S.replace(/^data:[^,]*,/,""),"base64");else if(typeof S==="string"){let f0=FZ($.workspaceRoot,S);a=f0.buffer,V0=f0.mimeType}else throw Error("view() needs a Buffer, a base64 string, or a path to an image file");if(a.length===0)throw Error("view(): the image is empty");let B8=String(c.label??"").replace(/[\r\n>]+/g," ").trim().slice(0,120),D0=Number(c.maxWidth)||1024,i0=Number(c.quality)||72,w9=$.targetContext?await N.newPage():await j.newPage();try{let f0=`data:${V0};base64,${a.toString("base64")}`;for(let r=0;r<5;r+=1){let B0=await w9.evaluate(async(F0)=>{let L0=new Image;L0.src=F0.url,await L0.decode();let m0=Math.min(1,F0.maxWidth/L0.naturalWidth),Y0=document.createElement("canvas");Y0.width=Math.max(1,Math.round(L0.naturalWidth*m0)),Y0.height=Math.max(1,Math.round(L0.naturalHeight*m0));let X0=Y0.getContext("2d");if(!X0)throw Error("view(): canvas unavailable");return X0.fillStyle="#ffffff",X0.fillRect(0,0,Y0.width,Y0.height),X0.drawImage(L0,0,0,Y0.width,Y0.height),{data:Y0.toDataURL("image/jpeg",F0.q/100).split(",")[1]??"",width:Y0.width,height:Y0.height,sourceWidth:L0.naturalWidth,sourceHeight:L0.naturalHeight}},{url:f0,maxWidth:D0,q:i0}),a0=Buffer.from(B0.data,"base64");if(a0.length<=VZ){let F0=B8||"image";return`<<<ARA_VIEW_IMAGE ${B0.data} image/jpeg ${F0}>>>
+Viewing ${F0} (${B0.sourceWidth}x${B0.sourceHeight} source, sent at ${B0.width}x${B0.height}, ${Math.round(a0.length/1024)}KB).`}if(D0>640)D0=Math.round(D0*0.75);else i0=Math.max(30,i0-15)}throw Error(`view(): could not reduce the image under ${Math.round(VZ/1024)}KB`)}finally{await w9.close().catch(()=>{return})}},f=oQ({browser:$.targetContext?.browser()??N,context:j,page:w,a11y:E,view:P,readWorkspaceFile:(S)=>FZ($.workspaceRoot,S),privateProfile:$.privateProfile,beforeNavigation:$.beforeNavigation,recording:$.recording,screenshotExport:$.screenshotExport,actionRecorder:()=>{let S=J,h=G;return(c,a)=>{if(S.length<UZ)S.push(c);if(a)h.page=a}}}),d=async(S)=>{W();let h=q(await N.newContext({serviceWorkers:"block",acceptDownloads:!1}),"context");try{await h.route("**/*",(a)=>a.abort()),W(),await h.routeWebSocket("**/*",(a)=>a.close({code:1008,reason:"Reason evaluator network denied"})),W(),await h.exposeBinding("__araHandsRpc",async(a,V0)=>$.onBrowserOperation?$.onBrowserOperation(S,()=>f.dispatch(V0)):f.dispatch(V0)),W();let c=await h.newPage();return W(),await c.goto("data:text/html,<title>Reason Hands evaluator</title>"),W(),await c.evaluate(`(${vQ})(${JSON.stringify(f.roots)})`),{context:h,page:c,runId:S}}catch(c){throw await M(h).catch(()=>{return}),c}},u=await d(),l={browser:N,context:j,page:w,evaluator:u,async captureProgressFrame(S){return P(await S.screenshot({type:"jpeg",quality:65,timeout:2000}),{label:"Screen after browser action"})},async resetEvaluator(S){await M(l.evaluator.context),l.evaluator=await d(S)}};return W(),l}catch(A){throw await _().catch(()=>{return}),A}},x=async()=>{if(W(),z)return z;if(!Y){H=D();let N;Y=Promise.race([H,new Promise((j,A)=>{N=setTimeout(()=>A(Error("hands_browser_unavailable: startup timed out")),d1)})]).then((j)=>{return W(),z=j,j}).catch(async()=>{V=Error("hands_browser_unavailable: startup failed or timed out");let j;try{await Promise.race([_(),new Promise((A,m)=>{j=setTimeout(()=>m(Error("hands_repl_stop_timeout")),HZ)})])}catch{V=Error("hands_browser_unavailable: startup cleanup unconfirmed")}finally{if(j)clearTimeout(j)}throw V}).finally(()=>{if(N)clearTimeout(N)})}return Y},b=async(N,j,A=!1)=>{let m=await x(),w=G;if($.onBrowserOperation&&m.evaluator.runId!==j)await m.resetEvaluator(j);let P=(async()=>{let u=await m.evaluator.page.evaluate(`(${cQ})(${JSON.stringify({code:N})})`);if(typeof u!=="string")throw Error("hands_repl_invalid_evaluator_output");let l=w.page;if(A&&l&&!u.includes("<<<ARA_VIEW_IMAGE")){let S=()=>m.captureProgressFrame(l);try{let h=await($.onBrowserOperation?$.onBrowserOperation(j,S):S());return w.automaticProgressImage=!0,`${u}
 ${h}`}catch{return`${u}
 Screen capture unavailable.`}}return u})(),f,d=new Promise((u,l)=>{f=setTimeout(()=>l(Error("REPL evaluation timed out after 105 seconds")),c1)});try{return await Promise.race([P,d])}catch(u){if(u instanceof Error&&u.message.includes("timed out"))P.catch(()=>{return}),await m.resetEvaluator(j).catch(()=>{return});throw u}finally{if(f)clearTimeout(f)}},T=Promise.resolve(),k=new Set,g=new Set;e9($.socketPath);let O=d0.createServer((N)=>{k.add(N),N.once("close",()=>{k.delete(N),g.delete(N)}),N.setEncoding("utf8");let j="",A=!1;N.on("data",(m)=>{if(A)return;if(j+=m,j.length>v1){A=!0,Y9(N,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let w=j.indexOf(`
-`);if(w===-1)return;A=!0;let E=j.slice(0,w);if($.onControl)try{let P=JSON.parse(E);if(typeof P.action==="string"&&P.action!=="evaluate")g.add(N)}catch{}T=T.then(async()=>{if(N.destroyed)return;J=[],G={};try{let P=JSON.parse(E);if(P.action==="probe"){let S=await x();await b("undefined",S.evaluator.runId),Y9(N,{ok:!0,output:"ARA_HANDS_REPL_READY"});return}if(typeof P.action==="string"&&P.action!=="evaluate"&&$.onControl){Y9(N,{ok:!0,output:await $.onControl(P.action,P)});return}if(P.action!=="evaluate"||typeof P.code!=="string")throw Error("Invalid REPL request");let f=P.code,d=typeof P.runId==="string"?P.runId:void 0,u=()=>b(f,d,P.includeProgressCapture===!0),l=await($.onEvaluate?$.onEvaluate(P,u):u());Y9(N,{ok:!0,output:l,browserActions:J,...G.automaticProgressImage?{automaticProgressImage:!0}:{}})}catch(P){Y9(N,{ok:!1,error:P instanceof Error?P.message:String(P),stack:P instanceof Error?P.stack:void 0,browserActions:J})}}).catch((P)=>{Y9(N,{ok:!1,error:P instanceof Error?P.message:String(P)})})})});try{await new Promise((N,j)=>{O.once("error",j),O.listen($.socketPath,()=>{O.off("error",j);try{A1($.socketPath,384),N()}catch(A){O.close(()=>j(A))}})})}catch(N){throw e9($.socketPath),N}return{socketPath:$.socketPath,browserExecutablePath:Z,stop(){if(F)return F;W=!0;let N=g.size?setTimeout(()=>{for(let w of g)w.destroy()},p1):void 0,j=new Promise((w)=>O.close(()=>{if(N)clearTimeout(N);w()}));for(let w of k)if(!g.has(w))w.destroy();T.catch(()=>{return});let A=async()=>{await j,e9($.socketPath);let w=[_()];if(V)w.push(V.then(()=>{return},()=>{return}));let E=await Promise.allSettled(w),P=await Promise.allSettled([_()]),f=[...E,...P].filter((d)=>d.status==="rejected");if(f.length)throw AggregateError(f.map((d)=>d.reason),"hands_repl_stop_unconfirmed")},m;return F=Promise.race([A(),new Promise((w,E)=>{m=setTimeout(()=>E(Error("hands_repl_stop_timeout")),VZ)})]).finally(()=>{if(m)clearTimeout(m);e9($.socketPath)}),F}}}var a1=["private_runtime","runtime_root","temporary_directory","granted_root","workspace_layout","jobs","browser_socket","relay_url","environment_owner","job_environment","config_write"],o1=["ENOENT","EACCES","EPERM","EINVAL","ENOTDIR","EISDIR","ELOOP","EROFS","ENOSPC","EMFILE","ENFILE","EEXIST"];function NZ($,Q){if(!$||!a1.includes($))return null;let Z=typeof Q==="object"&&Q!==null&&"code"in Q?Q.code:null;return{workspace_stage:$,workspace_errno:typeof Z==="string"&&o1.includes(Z)?Z:"unknown"}}import{lstatSync as r1,readFileSync as t1}from"fs";var e1="/run/sc/egress-guard",$6=10002,a8=10003;function MZ($=process.platform,Q=e1){if($!=="linux")return!1;try{let Z=r1(Q);if(!Z.isFile()||Z.uid!==0||(Z.mode&18)!==0)return!1;return t1(Q,"utf8")===`v1 ${$6} ${a8}
-`}catch{return!1}}var Q6=/^(\/.+)-sidechat-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;function jZ($){let Q=Q6.exec($.replace(/\/+$/,""));return Q?`${Q[1]}/repo`:null}import{randomUUID as r6}from"crypto";import{spawn as t6,spawnSync as e6}from"child_process";import{chmodSync as E9,closeSync as $7,constants as K$,fchmodSync as Q7,fstatSync as Z7,openSync as X7,copyFileSync as J7,existsSync as H$,lstatSync as t,statSync as S9,mkdtempSync as Y7,mkdirSync as U9,realpathSync as n,renameSync as K8,rmSync as G7,writeFileSync as V8}from"fs";import{homedir as z7,tmpdir as eZ}from"os";import{basename as K7,dirname as K0,join as o,resolve as $4}from"path";var Z6={"navigation.ara-egress.invalid":"canary_navigation","fetch.ara-egress.invalid":"canary_fetch","subresource.ara-egress.invalid":"canary_subresource","codeload.github.com":"canary_redirect","websocket.ara-egress.invalid":"canary_websocket"};function CZ($){return $===null?"other":Z6[$]??"other"}function V0($,Q){if($===void 0||Q===void 0)return null;let Z=Math.round(Q-$);return Number.isSafeInteger(Z)&&Z>=0&&Z<=600000?Z:null}var p="workspace_mode",S0="granted_root",W0="project_root",G9="terminal_root",z9="terminal_benchmark_tool_profile",X6=["bash","bash-node-repl","bash-node-repl-files"],qZ="hands_node_repl_persistent_execution_unsupported";function TZ($){return $==="bash"?null:"hands_node_repl_persistent_execution_unsupported"}function o8($){return X6.includes($)}function OX($){return OZ($)&&$.workspace_mode==="terminal_root"&&o8($.terminal_benchmark_tool_profile)}var U0="tool_scoped_standby";function DX($){return OZ($)&&$[U0]===!0}function OZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}var IX=I.object({device_id:I.string().uuid(),root_id:I.string().uuid()}),t8=/^reason\/[0-9a-f]{8}$/,J6=I.strictObject({source_path:I.string().refine(p0).optional(),branch:I.string().regex(t8)}),RX=I.object({checkout_mode:I.enum(["worktree","direct"]).optional(),project_workspace_source:I.object({kind:I.literal("local_device"),device_id:I.string().uuid(),root_id:I.string().uuid(),path:I.string().refine(p0).optional(),worktree:J6.optional()})});import{execFile as Y6}from"child_process";var G6=20000,z6=1e4,DZ=/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/,K6=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","gc.auto=0","-c","maintenance.auto=false"];async function _Z($,Q=V6){let Z=(M,_=z6)=>Q([...K6,"-C",$,...M],_),X=async(M)=>{let _=await Z(M);return _.status===0?_.stdout.trim():null},J=await X(["rev-parse","--verify","--quiet","HEAD^{commit}"]);if(!J||!DZ.test(J))return null;let G=J.slice(0,12),z=(M)=>({commit:J,from:"head",note:`reason: started from ${M}`}),V=await X(["symbolic-ref","--quiet","HEAD"]);if(!V?.startsWith("refs/heads/"))return z(`the checkout's detached HEAD ${G}`);let Y=V.slice(11),H=await Z(["--no-optional-locks","status","--porcelain=v1","--untracked-files=no"]);if(H.status!==0||H.stdout.trim())return z(`${Y} at ${G}: the checkout has uncommitted changes, which stay there`);let W=await X(["config","--get",`branch.${Y}.remote`]),F=await X(["config","--get",`branch.${Y}.merge`]);if(!W||!F?.startsWith("refs/")||W.startsWith("-"))return z(`${Y} at ${G}: it has no upstream to catch up with`);let K=W==="."||(await Z(["fetch","--quiet","--no-tags","--no-write-fetch-head","--no-recurse-submodules",W,F],G6)).status===0,L=await X(["rev-parse","--abbrev-ref","--symbolic-full-name","@{upstream}"]),B=L?await X(["rev-parse","--verify","--quiet","@{upstream}^{commit}"]):null;if(!L||!B||!DZ.test(B))return z(`${Y} at ${G}: ${K?"it has no upstream to catch up with":`fetching ${W} failed`}`);if(!K)return z(`${Y} at ${G}: fetching ${L} failed, so it may be behind`);if(B===J)return z(`${Y} at ${G}, the same commit as ${L} after fetching it`);if((await Z(["merge-base","--is-ancestor",J,B])).status!==0)return z(`${Y} at ${G}: it has commits that ${L} does not`);let U=await X(["rev-list","--count",`${J}..${B}`]);return{commit:B,from:"upstream",note:`reason: started from ${L} at ${B.slice(0,12)}, fetched just now: ${Y} had no commits of its own and was ${U??"some"} commits behind it`}}function V6($,Q){return new Promise((Z)=>{Y6("git",$,{encoding:"utf8",timeout:Q,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(X,J)=>{let G=X?typeof X.code==="number"?X.code:null:0;Z({status:G,stdout:String(J??"")})})})}import{execFile as H6}from"child_process";import{lstatSync as Q$,readdirSync as e8,readFileSync as PZ,realpathSync as $8,rmdirSync as AZ,unlinkSync as F6,writeFileSync as W6}from"fs";import{readFile as U6}from"fs/promises";import{join as T0,resolve as xZ}from"path";var P9=".reason-device",B6=86400000,L6=500,N6=60000;function IZ($,Q,Z){let X=Q.split("/"),J=K9.split("/");if(X.length!==J.length+2||J.some((G,z)=>X[z]!==G)||!Q8.test(X[J.length]))return;try{let G=RZ($,X[J.length]);W6(T0(G,P9),Z,{flag:"wx",mode:384})}catch{}}function RZ($,Q){let Z=()=>new C("session_worktree_outside_workspace","Reason removes only Session folders in ~/.reason/workspace/sessions.");if(!Q8.test(Q))throw Z();let X=T0($8($),K9),J=T0(X,Q);if(!Q$(J).isDirectory()||$8(J)!==J)throw Z();return J}async function M6($,Q,Z=C6){let X;try{X=RZ($,Q)}catch(J){if($$(J))return!0;throw J}for(let J of e8(X,{withFileTypes:!0})){if(J.name===P9||!J.isDirectory())continue;let G=T0(X,J.name),z=await j6(G);if(z){let V=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false",`--git-dir=${z}`,"worktree"];if((await Z([...V,"remove","--force",G])).status===0)await Z([...V,"prune"])}else try{AZ(G)}catch{}}if(e8(X).some((J)=>J!==P9))return!1;try{F6(T0(X,P9))}catch(J){if(!$$(J))throw J}return AZ(X),!0}async function j6($){try{let Q=T0($,".git");if(!Q$(Q).isFile())return null;let Z=/^gitdir: (.+)$/m.exec(PZ(Q,"utf8"));if(!Z)return null;let X=xZ($,Z[1].trim());return xZ(X,(await U6(T0(X,"commondir"),"utf8")).trim())}catch{return null}}async function hX($){let Q;try{if(Q=T0($8($.home),K9),!Q$(Q).isDirectory())return{status:"skipped",reason:"workspace_untrusted"};if($8(Q)!==Q)return{status:"skipped",reason:"workspace_untrusted"}}catch(G){if($$(G))return{status:"skipped",reason:"no_workspace"};throw G}let Z=e8(Q,{withFileTypes:!0}).filter((G)=>G.isDirectory()&&Q8.test(G.name)).map((G)=>G.name).filter((G)=>{try{return PZ(T0(Q,G,P9),"utf8")===$.deviceId}catch{return!1}}).sort().slice(0,L6);if(!Z.length)return{status:"done",removed:[],kept:[],failed:[]};let X=await $.liveIds(Z);if(X===null)return{status:"skipped",reason:"server_unsupported"};let J={status:"done",removed:[],kept:Z.filter((G)=>X.includes(G)),failed:[]};for(let G of Z.filter((z)=>!X.includes(z)))(await M6($.home,G,$.runGit).catch(()=>!1)?J.removed:J.failed).push(G);return J}function vX($,Q,Z=B6){if(Q.aborted)return;let X=!1,J=()=>{if(X||Q.aborted)return;X=!0,$().catch(()=>{return}).finally(()=>{X=!1})},G=setInterval(J,Z);G.unref?.(),Q.addEventListener("abort",()=>clearInterval(G),{once:!0}),J()}function $$($){return typeof $==="object"&&$!==null&&$.code==="ENOENT"}function C6($){return new Promise((Q)=>{H6("git",$,{encoding:"utf8",timeout:N6,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(Z,X,J)=>{let G=Z&&typeof Z.code==="number"?Z.code:null;Q({status:Z?G??1:0,stderr:J??""})})})}import{createHash as q6}from"crypto";import{join as T6}from"path";function O6($){return Z8($)}function O0(){throw new C("environment_unavailable","The private Session environment is unavailable or stale.")}function X8($){return q6("sha256").update(JSON.stringify({...$,variables:Object.fromEntries(Object.entries($.variables).sort(([Q],[Z])=>Q.localeCompare(Z)))})).digest("hex")}function EZ($,Q){T9($);let Z=T6($,"environment.json"),X,J=new Set,G=(V,Y)=>`${Y}:${V}`,z=(V)=>{let Y=NQ.safeParse(V);if(!Y.success)return O0();let H=Y.data,W=Q.identity(),F=Date.parse(H.expires_at);if(!W||H.run_id!==Q.runId||H.device_id!==Q.deviceId||H.root_id!==Q.rootId||H.binding.kind!==Q.binding.kind||H.binding.target_revision!==Q.binding.target_revision||H.binding.root_grant_revision!==Q.binding.root_grant_revision||H.binding.target_generation!==W.generation||H.binding.target_fence_id!==W.fenceId||F<=Date.now()||F>Q.expiresAtMs||Q.expiresAtMs<=Date.now()||Object.keys(H.variables).some((K)=>!O6(K)))return O0();if(H.git){let K=new URL(Q.apiOrigin),L=new URL(H.git.base_url),B=Date.parse(H.git.expires_at);if(L.origin!==K.origin)throw new C("environment_git_origin_mismatch","The delivered Git broker is not on this worker's API origin.");if(!["/git","/git/"].includes(L.pathname)||L.username||L.password||L.search||L.hash||B<=Date.now()||B>F)return O0()}if(H.cloud_access&&!BQ(H.cloud_access,Q.apiOrigin))throw new C("environment_cloud_access_origin_mismatch","The delivered cloud access is not on this worker's API origin.");return H};return{path:Z,install(V){let Y=z(V),H=X8(Y);if(X&&(Y.revision<X.revision||Y.revision===X.revision&&(H!==X.hash||Y.snapshot_id!==X.snapshotId)))return O0();if(!X||Y.revision>X.revision){if(AQ(Z,Y,q0.snapshotBytes),X8(z(JSON.parse(O9(Z,q0.snapshotBytes))))!==H)return O0();let W=X;if(X={revision:Y.revision,hash:H,snapshotId:Y.snapshot_id,generation:Y.binding.target_generation},W&&W.generation<X.generation)J.add(G(W.snapshotId,W.revision))}else if(X8(z(JSON.parse(O9(Z,q0.snapshotBytes))))!==X.hash)return O0();return{installed:!0,snapshot_id:Y.snapshot_id,installed_revision:Y.revision}},current(){if(!X)return O0();try{let V=z(JSON.parse(O9(Z,q0.snapshotBytes)));if(X8(V)!==X.hash)return O0();return V}catch{return O0()}},carried:(V,Y)=>J.has(G(V,Y))}}var V9=Object.freeze([Object.freeze({version:"0.2.61",artifact_sha256:"02ffcd514bf7cc0a9e73d4ce31ecea32709429cd0adf79e7062c1b70ff9ab8b8",legacy_linux_x64_sha256:"cdc0828abde3157e39afc6a64e033deee52ff7cfb09b55a42e60394df24980b9"}),Object.freeze({version:"0.2.62",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d",legacy_linux_x64_sha256:"cce594365d518b680abfb2378d234c8ef4e3daf257df83adef650a4523fb2d92"}),Object.freeze({version:"0.2.63",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d"}),Object.freeze({version:"0.2.64",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.65",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.66",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.67",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.68",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.69",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.70",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.71",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.72",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.73",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.74",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.75",artifact_sha256:"a6e0648894f1f4876affd77c0ff42642c1f9cbe9bb752de19d7a97a5fb3b820e"}),Object.freeze({version:"0.2.76",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.77",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.78",artifact_sha256:"0a7a7ece14850a28b8f972d66e4eef570eb2bb75d58f8a82f4e9afe91424e27f",pi_tools_v1:!0}),Object.freeze({version:"0.2.79",artifact_sha256:"96f52656b454fc5b9ffe520f5c5d55720b5173eb084cd326d2710e434623897b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.80",artifact_sha256:"6ee0ed70889e2771bd9b239ee039b549361b56ce870e08956ec7cce7fa199cd7",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.81",artifact_sha256:"c8909b36f4ee9316c0c3e298cb9adb5fc821a6ec5ca365cab60043eb942c258a",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.82",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.83",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.84",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.85",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.86",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.87",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.88",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.89",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.90",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.91",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.92",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.93",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.94",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.95",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.96",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.97",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.98",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.99",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.100",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.101",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.102",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.103",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.104",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.105",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.106",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.107",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.108",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.109",artifact_sha256:"7a82b33611b9f47478fb181d0da6f49a04f7e4bc401a7752530fecffb2dc5864",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.110",artifact_sha256:"00b7dcc9078a7d7ea4814414fbf92dcf9ba3b0fd51186aac1b967e9ae306a377",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.111",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.112",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.113",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.114",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.115",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.116",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.117",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.118",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.119",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.120",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.121",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.122",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.123",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.124",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.125",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.126",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.127",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.128",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.129",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.130",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.131",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.132",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.133",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.134",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.135",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.136",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.137",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.138",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.139",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.140",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.141",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.142",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.143",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.144",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.145",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.146",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.147",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.148",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.149",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.150",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.151",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.152",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.153",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.154",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.155",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.156",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.157",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.158",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.159",artifact_sha256:"cc806ca6df14c39d45a944d1e1db9827dae35b3e66e0265ededb3eea3d883dcb",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.160",artifact_sha256:"0b8f6c4598a19acbeff93929efc237dbc4e356ccb26abf6957e297bfc1b551e8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.161",artifact_sha256:"d570f5035bfc5916c31f4954ce5bcc00013eec83edb020edbbfbd3260b9c17d0",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.162",artifact_sha256:"6e52c44af7a3ea3633a4dc28aa63696143cd80044bca7f67a57c4c156985566f",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.163",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.164",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.165",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.166",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.167",artifact_sha256:"62658de309f9b9c8fd70041c83898d8625d85fed303ac6e60c3a17afc85477e2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.168",artifact_sha256:"24d7efe74218b862a90f48cf71dc59dce1d0dba29b167168aca06649bbfab364",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.169",artifact_sha256:"83879d03741c3f37c1502535d128685421cd7a498bc22543516a23ef2b21e496",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.170",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.171",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.172",artifact_sha256:"7a01a820961bd03b31007e46ba4f09df0a621ea5bfc9ee84548d6acdfd750169",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.173",artifact_sha256:"82c9ece017e109cf8b4b54734ac7a81b1ecb2ff35a426998369b6c3e690fd1ae",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.174",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.175",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.176",artifact_sha256:"ba3e211489877d0622aeca87be98e235d245f39d2b57f275cd924168d05f98ce",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0})]),D6="16befed856b4414dee65733e82549e1db74fe0ff3841d2571cfd8605d3ee970b",_6=Object.freeze(["ea63410f321f70848139a63ddcaa9f3f0a48daa3641898cc1db9f0e15ddfbb13","6cd101ddb09f87ed6996aa92a93911b1759b5ae33e9579c3dff8225ecfcbe1b6",D6]),SZ=Object.freeze(["0f57db3036c275f78064796a72827d0f47fe702475e5feebb31e1569bcb5a0cf","38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2"]),ZJ=Object.freeze(["pi_tools_v1","background_bash_v1","machine_sdk_v1","pi_tools_confinement_v1","home_folder_v1"]),XJ=new Set([z0,...V9.map(($)=>$.artifact_sha256),..._6,...SZ]);var JJ=new Set([z0,...V9.filter(($)=>$.pi_tools_v1).map(($)=>$.artifact_sha256),...SZ]);var YJ=new Set([z0,...V9.filter(($)=>$.pi_tools_confinement_v1).map(($)=>$.artifact_sha256)]);var GJ=new Set([z0,...V9.filter(($)=>$.home_folder_v1).map(($)=>$.artifact_sha256)]);var zJ=new Set([z0,...V9.filter(($)=>$.background_bash_v1).map(($)=>$.artifact_sha256)]);var KJ=new Set([z0,...V9.filter(($)=>$.machine_sdk_v1).map(($)=>$.artifact_sha256)]);var A6=[u0,"reason-hands-worker.cjs"];function wZ($){return typeof $==="string"&&A6.includes($)}var x6;function bZ(){return x6??{kind:"unavailable",status:"unsupported_entrypoint",sha256:null,observed_at_ms:null}}import{closeSync as P6,constants as Z$,fstatSync as kZ,lstatSync as I6,openSync as R6,readSync as E6,realpathSync as S6,watch as w6}from"fs";import{dirname as fZ}from"path";function J8($,Q){let Z;try{let X=fZ($),J=I6(X);if(!J.isDirectory()||J.isSymbolicLink()||J.uid!==process.getuid?.()||(J.mode&18)!==0||S6(X)!==X)return null;Z=R6($,Z$.O_RDONLY|Z$.O_NOFOLLOW|Z$.O_NONBLOCK);let G=kZ(Z);if(!G.isFile()||G.nlink!==1||G.uid!==process.getuid?.()||(G.mode&63)!==0||G.size<1||G.size>8192)return null;let z=Buffer.alloc(8193),V=E6(Z,z,0,z.length,0),Y=kZ(Z);if(V!==G.size||Y.size!==G.size||Y.nlink!==1||Y.mtimeMs!==G.mtimeMs||Y.ctimeMs!==G.ctimeMs)return null;let H=JSON.parse(z.subarray(0,V).toString("utf8"));if(!H||H.pid!==Q.pid||!Number.isSafeInteger(H.pid)||H.pid<1||H.launchId!==Q.launchId||H.workerVersion!==Q.workerVersion||H.protocolVersion!==Q.protocolVersion||H.workerArtifactSha256!==Q.workerArtifactSha256||H.workerEntrypoint!==Q.workerEntrypoint||H.workspaceAliasReady!==!0||!P0(H.targetGeneration)||!P0(H.generation)||!j0(H.fenceId))return null;return{...Q,generation:H.generation,targetGeneration:H.targetGeneration,fenceId:H.fenceId,workspaceAliasReady:!0}}catch{return null}finally{if(Z!==void 0)P6(Z)}}var b6=($,Q,Z)=>{let X=w6($,{persistent:!1},Q);return X.on("error",Z),X};function mZ($){let Q=new AbortController,Z=$.initial,X=Z.targetGeneration,J=!1,G=!1,z,V,Y=()=>{if(G)return;G=!0,z?.close(),z=void 0,clearInterval(V),$.signal.removeEventListener("abort",Y),Q.abort()},H=()=>{if(G)return;if(!$.isAlive()){Y();return}let W=J8($.path,$.initial);if(!W||W.generation<Z.generation||W.targetGeneration<Z.targetGeneration||W.targetGeneration===Z.targetGeneration&&W.fenceId!==Z.fenceId)return;if(Z=W,J||W.targetGeneration<=X)return;X=W.targetGeneration,J=!0,Promise.resolve().then(()=>{return Q.signal.throwIfAborted(),$.publish(W,Q.signal)}).catch(()=>{if(!G)Y(),$.failed?.()}).finally(()=>{J=!1,H()})};if($.signal.aborted)return Y(),{stop:Y};$.signal.addEventListener("abort",Y,{once:!0});try{z=($.watch??b6)(fZ($.path),H,()=>{z?.close(),z=void 0})}catch{}return V=setInterval(H,1000),V.unref?.(),H(),{stop:Y}}import{spawn as k6}from"child_process";import{chmodSync as f6,mkdtempSync as m6,realpathSync as g6,rmSync as y6,unlinkSync as h6,writeFileSync as v6}from"fs";import c6 from"net";import{platform as d6,tmpdir as p6}from"os";import{join as gZ}from"path";var yZ=1048576,Y$=105000,u6=2000,l6=String.raw`
+`);if(w===-1)return;A=!0;let E=j.slice(0,w);if($.onControl)try{let P=JSON.parse(E);if(typeof P.action==="string"&&P.action!=="evaluate")g.add(N)}catch{}T=T.then(async()=>{if(N.destroyed)return;J=[],G={};try{let P=JSON.parse(E);if(P.action==="probe"){let S=await x();await b("undefined",S.evaluator.runId),Y9(N,{ok:!0,output:"ARA_HANDS_REPL_READY"});return}if(typeof P.action==="string"&&P.action!=="evaluate"&&$.onControl){Y9(N,{ok:!0,output:await $.onControl(P.action,P)});return}if(P.action!=="evaluate"||typeof P.code!=="string")throw Error("Invalid REPL request");let f=P.code,d=typeof P.runId==="string"?P.runId:void 0,u=()=>b(f,d,P.includeProgressCapture===!0),l=await($.onEvaluate?$.onEvaluate(P,u):u());Y9(N,{ok:!0,output:l,browserActions:J,...G.automaticProgressImage?{automaticProgressImage:!0}:{}})}catch(P){Y9(N,{ok:!1,error:P instanceof Error?P.message:String(P),stack:P instanceof Error?P.stack:void 0,browserActions:J})}}).catch((P)=>{Y9(N,{ok:!1,error:P instanceof Error?P.message:String(P)})})})});try{await new Promise((N,j)=>{O.once("error",j),O.listen($.socketPath,()=>{O.off("error",j);try{A1($.socketPath,384),N()}catch(A){O.close(()=>j(A))}})})}catch(N){throw e9($.socketPath),N}return{socketPath:$.socketPath,browserExecutablePath:Z,stop(){if(F)return F;U=!0;let N=g.size?setTimeout(()=>{for(let w of g)w.destroy()},p1):void 0,j=new Promise((w)=>O.close(()=>{if(N)clearTimeout(N);w()}));for(let w of k)if(!g.has(w))w.destroy();T.catch(()=>{return});let A=async()=>{await j,e9($.socketPath);let w=[_()];if(H)w.push(H.then(()=>{return},()=>{return}));let E=await Promise.allSettled(w),P=await Promise.allSettled([_()]),f=[...E,...P].filter((d)=>d.status==="rejected");if(f.length)throw AggregateError(f.map((d)=>d.reason),"hands_repl_stop_unconfirmed")},m;return F=Promise.race([A(),new Promise((w,E)=>{m=setTimeout(()=>E(Error("hands_repl_stop_timeout")),HZ)})]).finally(()=>{if(m)clearTimeout(m);e9($.socketPath)}),F}}}var a1=["private_runtime","runtime_root","temporary_directory","granted_root","workspace_layout","jobs","browser_socket","relay_url","environment_owner","job_environment","config_write"],o1=["ENOENT","EACCES","EPERM","EINVAL","ENOTDIR","EISDIR","ELOOP","EROFS","ENOSPC","EMFILE","ENFILE","EEXIST"];function NZ($,Q){if(!$||!a1.includes($))return null;let Z=typeof Q==="object"&&Q!==null&&"code"in Q?Q.code:null;return{workspace_stage:$,workspace_errno:typeof Z==="string"&&o1.includes(Z)?Z:"unknown"}}import{lstatSync as r1,readFileSync as t1}from"fs";var e1="/run/sc/egress-guard",$6=10002,a8=10003;function MZ($=process.platform,Q=e1){if($!=="linux")return!1;try{let Z=r1(Q);if(!Z.isFile()||Z.uid!==0||(Z.mode&18)!==0)return!1;return t1(Q,"utf8")===`v1 ${$6} ${a8}
+`}catch{return!1}}var Q6=/^(\/.+)-sidechat-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;function jZ($){let Q=Q6.exec($.replace(/\/+$/,""));return Q?`${Q[1]}/repo`:null}import{randomUUID as r6}from"crypto";import{spawn as t6,spawnSync as e6}from"child_process";import{chmodSync as E9,closeSync as $7,constants as K$,fchmodSync as Q7,fstatSync as Z7,openSync as X7,copyFileSync as J7,existsSync as V$,lstatSync as t,statSync as S9,mkdtempSync as Y7,mkdirSync as W9,realpathSync as n,renameSync as K8,rmSync as G7,writeFileSync as H8}from"fs";import{homedir as z7,tmpdir as eZ}from"os";import{basename as K7,dirname as K0,join as o,resolve as $4}from"path";var Z6={"navigation.ara-egress.invalid":"canary_navigation","fetch.ara-egress.invalid":"canary_fetch","subresource.ara-egress.invalid":"canary_subresource","codeload.github.com":"canary_redirect","websocket.ara-egress.invalid":"canary_websocket"};function CZ($){return $===null?"other":Z6[$]??"other"}function H0($,Q){if($===void 0||Q===void 0)return null;let Z=Math.round(Q-$);return Number.isSafeInteger(Z)&&Z>=0&&Z<=600000?Z:null}var p="workspace_mode",w0="granted_root",U0="project_root",G9="terminal_root",z9="terminal_benchmark_tool_profile",X6=["bash","bash-node-repl","bash-node-repl-files"],qZ="hands_node_repl_persistent_execution_unsupported";function TZ($){return $==="bash"?null:"hands_node_repl_persistent_execution_unsupported"}function o8($){return X6.includes($)}function OX($){return OZ($)&&$.workspace_mode==="terminal_root"&&o8($.terminal_benchmark_tool_profile)}var W0="tool_scoped_standby";function DX($){return OZ($)&&$[W0]===!0}function OZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}var IX=I.object({device_id:I.string().uuid(),root_id:I.string().uuid()}),t8=/^reason\/[0-9a-f]{8}$/,J6=I.strictObject({source_path:I.string().refine(p0).optional(),branch:I.string().regex(t8)}),RX=I.object({checkout_mode:I.enum(["worktree","direct"]).optional(),project_workspace_source:I.object({kind:I.literal("local_device"),device_id:I.string().uuid(),root_id:I.string().uuid(),path:I.string().refine(p0).optional(),worktree:J6.optional()})});import{execFile as Y6}from"child_process";var G6=20000,z6=1e4,DZ=/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/,K6=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","gc.auto=0","-c","maintenance.auto=false"];async function _Z($,Q=H6){let Z=(M,_=z6)=>Q([...K6,"-C",$,...M],_),X=async(M)=>{let _=await Z(M);return _.status===0?_.stdout.trim():null},J=await X(["rev-parse","--verify","--quiet","HEAD^{commit}"]);if(!J||!DZ.test(J))return null;let G=J.slice(0,12),z=(M)=>({commit:J,from:"head",note:`reason: started from ${M}`}),H=await X(["symbolic-ref","--quiet","HEAD"]);if(!H?.startsWith("refs/heads/"))return z(`the checkout's detached HEAD ${G}`);let Y=H.slice(11),V=await Z(["--no-optional-locks","status","--porcelain=v1","--untracked-files=no"]);if(V.status!==0||V.stdout.trim())return z(`${Y} at ${G}: the checkout has uncommitted changes, which stay there`);let U=await X(["config","--get",`branch.${Y}.remote`]),F=await X(["config","--get",`branch.${Y}.merge`]);if(!U||!F?.startsWith("refs/")||U.startsWith("-"))return z(`${Y} at ${G}: it has no upstream to catch up with`);let K=U==="."||(await Z(["fetch","--quiet","--no-tags","--no-write-fetch-head","--no-recurse-submodules",U,F],G6)).status===0,L=await X(["rev-parse","--abbrev-ref","--symbolic-full-name","@{upstream}"]),B=L?await X(["rev-parse","--verify","--quiet","@{upstream}^{commit}"]):null;if(!L||!B||!DZ.test(B))return z(`${Y} at ${G}: ${K?"it has no upstream to catch up with":`fetching ${U} failed`}`);if(!K)return z(`${Y} at ${G}: fetching ${L} failed, so it may be behind`);if(B===J)return z(`${Y} at ${G}, the same commit as ${L} after fetching it`);if((await Z(["merge-base","--is-ancestor",J,B])).status!==0)return z(`${Y} at ${G}: it has commits that ${L} does not`);let W=await X(["rev-list","--count",`${J}..${B}`]);return{commit:B,from:"upstream",note:`reason: started from ${L} at ${B.slice(0,12)}, fetched just now: ${Y} had no commits of its own and was ${W??"some"} commits behind it`}}function H6($,Q){return new Promise((Z)=>{Y6("git",$,{encoding:"utf8",timeout:Q,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(X,J)=>{let G=X?typeof X.code==="number"?X.code:null:0;Z({status:G,stdout:String(J??"")})})})}import{execFile as V6}from"child_process";import{lstatSync as Q$,readdirSync as e8,readFileSync as PZ,realpathSync as $8,rmdirSync as AZ,unlinkSync as F6,writeFileSync as U6}from"fs";import{readFile as W6}from"fs/promises";import{join as T0,resolve as xZ}from"path";var P9=".reason-device",B6=86400000,L6=500,N6=60000;function IZ($,Q,Z){let X=Q.split("/"),J=K9.split("/");if(X.length!==J.length+2||J.some((G,z)=>X[z]!==G)||!Q8.test(X[J.length]))return;try{let G=RZ($,X[J.length]);U6(T0(G,P9),Z,{flag:"wx",mode:384})}catch{}}function RZ($,Q){let Z=()=>new C("session_worktree_outside_workspace","Reason removes only Session folders in ~/.reason/workspace/sessions.");if(!Q8.test(Q))throw Z();let X=T0($8($),K9),J=T0(X,Q);if(!Q$(J).isDirectory()||$8(J)!==J)throw Z();return J}async function M6($,Q,Z=C6){let X;try{X=RZ($,Q)}catch(J){if($$(J))return!0;throw J}for(let J of e8(X,{withFileTypes:!0})){if(J.name===P9||!J.isDirectory())continue;let G=T0(X,J.name),z=await j6(G);if(z){let H=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false",`--git-dir=${z}`,"worktree"];if((await Z([...H,"remove","--force",G])).status===0)await Z([...H,"prune"])}else try{AZ(G)}catch{}}if(e8(X).some((J)=>J!==P9))return!1;try{F6(T0(X,P9))}catch(J){if(!$$(J))throw J}return AZ(X),!0}async function j6($){try{let Q=T0($,".git");if(!Q$(Q).isFile())return null;let Z=/^gitdir: (.+)$/m.exec(PZ(Q,"utf8"));if(!Z)return null;let X=xZ($,Z[1].trim());return xZ(X,(await W6(T0(X,"commondir"),"utf8")).trim())}catch{return null}}async function hX($){let Q;try{if(Q=T0($8($.home),K9),!Q$(Q).isDirectory())return{status:"skipped",reason:"workspace_untrusted"};if($8(Q)!==Q)return{status:"skipped",reason:"workspace_untrusted"}}catch(G){if($$(G))return{status:"skipped",reason:"no_workspace"};throw G}let Z=e8(Q,{withFileTypes:!0}).filter((G)=>G.isDirectory()&&Q8.test(G.name)).map((G)=>G.name).filter((G)=>{try{return PZ(T0(Q,G,P9),"utf8")===$.deviceId}catch{return!1}}).sort().slice(0,L6);if(!Z.length)return{status:"done",removed:[],kept:[],failed:[]};let X=await $.liveIds(Z);if(X===null)return{status:"skipped",reason:"server_unsupported"};let J={status:"done",removed:[],kept:Z.filter((G)=>X.includes(G)),failed:[]};for(let G of Z.filter((z)=>!X.includes(z)))(await M6($.home,G,$.runGit).catch(()=>!1)?J.removed:J.failed).push(G);return J}function vX($,Q,Z=B6){if(Q.aborted)return;let X=!1,J=()=>{if(X||Q.aborted)return;X=!0,$().catch(()=>{return}).finally(()=>{X=!1})},G=setInterval(J,Z);G.unref?.(),Q.addEventListener("abort",()=>clearInterval(G),{once:!0}),J()}function $$($){return typeof $==="object"&&$!==null&&$.code==="ENOENT"}function C6($){return new Promise((Q)=>{V6("git",$,{encoding:"utf8",timeout:N6,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(Z,X,J)=>{let G=Z&&typeof Z.code==="number"?Z.code:null;Q({status:Z?G??1:0,stderr:J??""})})})}import{createHash as q6}from"crypto";import{join as T6}from"path";function O6($){return Z8($)}function O0(){throw new C("environment_unavailable","The private Session environment is unavailable or stale.")}function X8($){return q6("sha256").update(JSON.stringify({...$,variables:Object.fromEntries(Object.entries($.variables).sort(([Q],[Z])=>Q.localeCompare(Z)))})).digest("hex")}function EZ($,Q){T9($);let Z=T6($,"environment.json"),X,J=new Set,G=(H,Y)=>`${Y}:${H}`,z=(H)=>{let Y=NQ.safeParse(H);if(!Y.success)return O0();let V=Y.data,U=Q.identity(),F=Date.parse(V.expires_at);if(!U||V.run_id!==Q.runId||V.device_id!==Q.deviceId||V.root_id!==Q.rootId||V.binding.kind!==Q.binding.kind||V.binding.target_revision!==Q.binding.target_revision||V.binding.root_grant_revision!==Q.binding.root_grant_revision||V.binding.target_generation!==U.generation||V.binding.target_fence_id!==U.fenceId||F<=Date.now()||F>Q.expiresAtMs||Q.expiresAtMs<=Date.now()||Object.keys(V.variables).some((K)=>!O6(K)))return O0();if(V.git){let K=new URL(Q.apiOrigin),L=new URL(V.git.base_url),B=Date.parse(V.git.expires_at);if(L.origin!==K.origin)throw new C("environment_git_origin_mismatch","The delivered Git broker is not on this worker's API origin.");if(!["/git","/git/"].includes(L.pathname)||L.username||L.password||L.search||L.hash||B<=Date.now()||B>F)return O0()}if(V.cloud_access&&!BQ(V.cloud_access,Q.apiOrigin))throw new C("environment_cloud_access_origin_mismatch","The delivered cloud access is not on this worker's API origin.");return V};return{path:Z,install(H){let Y=z(H),V=X8(Y);if(X&&(Y.revision<X.revision||Y.revision===X.revision&&(V!==X.hash||Y.snapshot_id!==X.snapshotId)))return O0();if(!X||Y.revision>X.revision){if(AQ(Z,Y,q0.snapshotBytes),X8(z(JSON.parse(O9(Z,q0.snapshotBytes))))!==V)return O0();let U=X;if(X={revision:Y.revision,hash:V,snapshotId:Y.snapshot_id,generation:Y.binding.target_generation},U&&U.generation<X.generation)J.add(G(U.snapshotId,U.revision))}else if(X8(z(JSON.parse(O9(Z,q0.snapshotBytes))))!==X.hash)return O0();return{installed:!0,snapshot_id:Y.snapshot_id,installed_revision:Y.revision}},current(){if(!X)return O0();try{let H=z(JSON.parse(O9(Z,q0.snapshotBytes)));if(X8(H)!==X.hash)return O0();return H}catch{return O0()}},carried:(H,Y)=>J.has(G(H,Y))}}var H9=Object.freeze([Object.freeze({version:"0.2.61",artifact_sha256:"02ffcd514bf7cc0a9e73d4ce31ecea32709429cd0adf79e7062c1b70ff9ab8b8",legacy_linux_x64_sha256:"cdc0828abde3157e39afc6a64e033deee52ff7cfb09b55a42e60394df24980b9"}),Object.freeze({version:"0.2.62",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d",legacy_linux_x64_sha256:"cce594365d518b680abfb2378d234c8ef4e3daf257df83adef650a4523fb2d92"}),Object.freeze({version:"0.2.63",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d"}),Object.freeze({version:"0.2.64",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.65",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.66",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.67",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.68",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.69",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.70",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.71",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.72",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.73",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.74",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.75",artifact_sha256:"a6e0648894f1f4876affd77c0ff42642c1f9cbe9bb752de19d7a97a5fb3b820e"}),Object.freeze({version:"0.2.76",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.77",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.78",artifact_sha256:"0a7a7ece14850a28b8f972d66e4eef570eb2bb75d58f8a82f4e9afe91424e27f",pi_tools_v1:!0}),Object.freeze({version:"0.2.79",artifact_sha256:"96f52656b454fc5b9ffe520f5c5d55720b5173eb084cd326d2710e434623897b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.80",artifact_sha256:"6ee0ed70889e2771bd9b239ee039b549361b56ce870e08956ec7cce7fa199cd7",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.81",artifact_sha256:"c8909b36f4ee9316c0c3e298cb9adb5fc821a6ec5ca365cab60043eb942c258a",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.82",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.83",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.84",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.85",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.86",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.87",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.88",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.89",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.90",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.91",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.92",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.93",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.94",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.95",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.96",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.97",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.98",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.99",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.100",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.101",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.102",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.103",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.104",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.105",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.106",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.107",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.108",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.109",artifact_sha256:"7a82b33611b9f47478fb181d0da6f49a04f7e4bc401a7752530fecffb2dc5864",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.110",artifact_sha256:"00b7dcc9078a7d7ea4814414fbf92dcf9ba3b0fd51186aac1b967e9ae306a377",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.111",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.112",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.113",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.114",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.115",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.116",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.117",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.118",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.119",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.120",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.121",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.122",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.123",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.124",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.125",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.126",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.127",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.128",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.129",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.130",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.131",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.132",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.133",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.134",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.135",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.136",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.137",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.138",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.139",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.140",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.141",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.142",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.143",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.144",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.145",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.146",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.147",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.148",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.149",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.150",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.151",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.152",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.153",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.154",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.155",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.156",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.157",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.158",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.159",artifact_sha256:"cc806ca6df14c39d45a944d1e1db9827dae35b3e66e0265ededb3eea3d883dcb",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.160",artifact_sha256:"0b8f6c4598a19acbeff93929efc237dbc4e356ccb26abf6957e297bfc1b551e8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.161",artifact_sha256:"d570f5035bfc5916c31f4954ce5bcc00013eec83edb020edbbfbd3260b9c17d0",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.162",artifact_sha256:"6e52c44af7a3ea3633a4dc28aa63696143cd80044bca7f67a57c4c156985566f",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.163",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.164",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.165",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.166",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.167",artifact_sha256:"62658de309f9b9c8fd70041c83898d8625d85fed303ac6e60c3a17afc85477e2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.168",artifact_sha256:"24d7efe74218b862a90f48cf71dc59dce1d0dba29b167168aca06649bbfab364",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.169",artifact_sha256:"83879d03741c3f37c1502535d128685421cd7a498bc22543516a23ef2b21e496",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.170",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.171",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.172",artifact_sha256:"7a01a820961bd03b31007e46ba4f09df0a621ea5bfc9ee84548d6acdfd750169",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.173",artifact_sha256:"82c9ece017e109cf8b4b54734ac7a81b1ecb2ff35a426998369b6c3e690fd1ae",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.174",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.175",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.176",artifact_sha256:"ba3e211489877d0622aeca87be98e235d245f39d2b57f275cd924168d05f98ce",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0})]),D6="16befed856b4414dee65733e82549e1db74fe0ff3841d2571cfd8605d3ee970b",_6=Object.freeze(["ea63410f321f70848139a63ddcaa9f3f0a48daa3641898cc1db9f0e15ddfbb13","6cd101ddb09f87ed6996aa92a93911b1759b5ae33e9579c3dff8225ecfcbe1b6",D6]),SZ=Object.freeze(["0f57db3036c275f78064796a72827d0f47fe702475e5feebb31e1569bcb5a0cf","38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2"]),ZJ=Object.freeze(["pi_tools_v1","background_bash_v1","machine_sdk_v1","pi_tools_confinement_v1","home_folder_v1"]),XJ=new Set([z0,...H9.map(($)=>$.artifact_sha256),..._6,...SZ]);var JJ=new Set([z0,...H9.filter(($)=>$.pi_tools_v1).map(($)=>$.artifact_sha256),...SZ]);var YJ=new Set([z0,...H9.filter(($)=>$.pi_tools_confinement_v1).map(($)=>$.artifact_sha256)]);var GJ=new Set([z0,...H9.filter(($)=>$.home_folder_v1).map(($)=>$.artifact_sha256)]);var zJ=new Set([z0,...H9.filter(($)=>$.background_bash_v1).map(($)=>$.artifact_sha256)]);var KJ=new Set([z0,...H9.filter(($)=>$.machine_sdk_v1).map(($)=>$.artifact_sha256)]);var A6=[u0,"reason-hands-worker.cjs"];function wZ($){return typeof $==="string"&&A6.includes($)}var x6;function bZ(){return x6??{kind:"unavailable",status:"unsupported_entrypoint",sha256:null,observed_at_ms:null}}import{closeSync as P6,constants as Z$,fstatSync as kZ,lstatSync as I6,openSync as R6,readSync as E6,realpathSync as S6,watch as w6}from"fs";import{dirname as fZ}from"path";function J8($,Q){let Z;try{let X=fZ($),J=I6(X);if(!J.isDirectory()||J.isSymbolicLink()||J.uid!==process.getuid?.()||(J.mode&18)!==0||S6(X)!==X)return null;Z=R6($,Z$.O_RDONLY|Z$.O_NOFOLLOW|Z$.O_NONBLOCK);let G=kZ(Z);if(!G.isFile()||G.nlink!==1||G.uid!==process.getuid?.()||(G.mode&63)!==0||G.size<1||G.size>8192)return null;let z=Buffer.alloc(8193),H=E6(Z,z,0,z.length,0),Y=kZ(Z);if(H!==G.size||Y.size!==G.size||Y.nlink!==1||Y.mtimeMs!==G.mtimeMs||Y.ctimeMs!==G.ctimeMs)return null;let V=JSON.parse(z.subarray(0,H).toString("utf8"));if(!V||V.pid!==Q.pid||!Number.isSafeInteger(V.pid)||V.pid<1||V.launchId!==Q.launchId||V.workerVersion!==Q.workerVersion||V.protocolVersion!==Q.protocolVersion||V.workerArtifactSha256!==Q.workerArtifactSha256||V.workerEntrypoint!==Q.workerEntrypoint||V.workspaceAliasReady!==!0||!I0(V.targetGeneration)||!I0(V.generation)||!j0(V.fenceId))return null;return{...Q,generation:V.generation,targetGeneration:V.targetGeneration,fenceId:V.fenceId,workspaceAliasReady:!0}}catch{return null}finally{if(Z!==void 0)P6(Z)}}var b6=($,Q,Z)=>{let X=w6($,{persistent:!1},Q);return X.on("error",Z),X};function mZ($){let Q=new AbortController,Z=$.initial,X=Z.targetGeneration,J=!1,G=!1,z,H,Y=()=>{if(G)return;G=!0,z?.close(),z=void 0,clearInterval(H),$.signal.removeEventListener("abort",Y),Q.abort()},V=()=>{if(G)return;if(!$.isAlive()){Y();return}let U=J8($.path,$.initial);if(!U||U.generation<Z.generation||U.targetGeneration<Z.targetGeneration||U.targetGeneration===Z.targetGeneration&&U.fenceId!==Z.fenceId)return;if(Z=U,J||U.targetGeneration<=X)return;X=U.targetGeneration,J=!0,Promise.resolve().then(()=>{return Q.signal.throwIfAborted(),$.publish(U,Q.signal)}).catch(()=>{if(!G)Y(),$.failed?.()}).finally(()=>{J=!1,V()})};if($.signal.aborted)return Y(),{stop:Y};$.signal.addEventListener("abort",Y,{once:!0});try{z=($.watch??b6)(fZ($.path),V,()=>{z?.close(),z=void 0})}catch{}return H=setInterval(V,1000),H.unref?.(),V(),{stop:Y}}import{spawn as k6}from"child_process";import{chmodSync as f6,mkdtempSync as m6,realpathSync as g6,rmSync as y6,unlinkSync as h6,writeFileSync as v6}from"fs";import c6 from"net";import{platform as d6,tmpdir as p6}from"os";import{join as gZ}from"path";var yZ=1048576,Y$=105000,u6=2000,l6=String.raw`
 const { writeSync } = require("node:fs");
 const { createRequire } = require("node:module");
 const { join } = require("node:path");
@@ -451,9 +451,9 @@ lines.on("line", (line) => {
 });
 `;function s6($=process.execPath,Q=process.versions.bun){return Q?"node":$}function X$($){try{h6($)}catch{}}function Y8($,Q){$.end(`${JSON.stringify(Q)}
 `)}function J$($){return JSON.stringify($)}function n6($){let Q=m6(gZ(p6(),"reason-node-repl-")),Z=gZ(Q,"node-repl.sb"),J=["(version 1)","(deny default)",'(import "system.sb")',"(allow process*)","(deny network*)",`(allow file-read* ${["/System","/usr","/bin","/opt/homebrew","/usr/local"].map((z)=>`(subpath ${J$(z)})`).join(" ")})`,`(allow file-read* file-write* (subpath ${J$($.workRoot)}) (subpath ${J$(Q)}))`].join(`
-`);v6(Z,J,{mode:384});let G=!1;return{command:"/usr/bin/sandbox-exec",args:["-f",Z,$.nodeExecutable,...$.nodeArgs],cwd:$.workRoot,env:{...$.environment,TMPDIR:Q},async cleanup(){if(G)return;G=!0,y6(Q,{recursive:!0,force:!0})}}}async function i6($){let Q=g6($.workRoot),Z=$.nodeExecutable??s6(),X=["--max-old-space-size=512","--permission",`--allow-fs-read=${Q}`,`--allow-fs-write=${Q}`,"-e",l6],J=G8({home:Q,temporaryDirectory:Q}),G=$.platformName??d6();if(G==="linux")return{command:Z,args:X,cwd:Q,env:J,async cleanup(){}};if(G==="darwin")return n6({nodeExecutable:Z,nodeArgs:X,workRoot:Q,environment:J});throw Error("hands_node_repl_platform_unsupported")}async function I9($){let Q;try{await Promise.race([$,new Promise((Z,X)=>{Q=setTimeout(()=>X(Error("hands_node_repl_child_cleanup_timeout")),u6)})])}finally{clearTimeout(Q)}}async function hZ($){if($.executionMode!=="single-evaluation")throw Error(qZ);let Q=await i6($),Z;try{Z=k6(Q.command,Q.args,{cwd:Q.cwd,env:Q.env,stdio:["pipe","pipe","pipe"]})}catch(q){throw await Q.cleanup(),q}let X=new Promise((q)=>Z.once("close",()=>q())),J;Z.once("error",(q)=>{J=q});let G=!1,z=!1,V="";Z.stderr.setEncoding("utf8"),Z.stderr.on("data",(q)=>{V=`${V}${q}`.slice(-16384)});let Y=Z.stdout,H,W=(q,D,x)=>{if(x)q.failure??=x;if(q.finishing)return;q.finishing=!0,z=!0,Z.kill("SIGKILL"),I9(X).then(()=>{if(q.failure)q.reject(q.failure);else q.resolve(D??{})},(b)=>q.reject(b))},F=()=>{if(z=!0,H)W(H,void 0,Error("hands_node_repl_state_lost"));else Z.kill("SIGKILL")},K="";Y?.setEncoding("utf8"),Y?.on("data",(q)=>{if(H?.finishing||z)return;if(K+=q,K.length>yZ){F();return}while(!0){let D=K.indexOf(`
-`);if(D===-1)return;let x=K.slice(0,D);K=K.slice(D+1);let b=H;if(!b){F();return}try{let T=JSON.parse(x);if(b.action==="probe")b.resolve(T);else{W(b,T);return}}catch{W(b,void 0,Error("invalid_hands_node_repl_child_response"));return}}});let L=(q)=>{let D=V.trim(),x=q??Error(D?`hands_node_repl_child_exited:${D}`:"hands_node_repl_child_exited");if(z=!0,H&&!H.finishing)W(H,void 0,x)};Z.once("error",L),Z.once("close",()=>L()),Z.stdin.on("error",L);let B=(q)=>new Promise((D,x)=>{if(G||z||Z.exitCode!==null||Z.signalCode!==null){x(Error(z?"hands_node_repl_state_lost":"hands_node_repl_stopped"));return}let b=setTimeout(F,q.action==="probe"?1e4:Math.max(1,Math.min($.evaluationTimeoutMs??Y$-1000,Y$-1000))),T={action:q.action,finishing:!1,resolve(k){if(H===T)H=void 0;clearTimeout(b),D(k)},reject(k){if(H===T)H=void 0;clearTimeout(b),x(k)}};H=T,Z.stdin.write(`${JSON.stringify(q)}
-`,(k)=>{if(!k)return;W(T,void 0,k)})});try{if(!Y){if(Z.pid===void 0)await I9(X);throw J??Error("hands_node_repl_control_pipe_missing")}let q=await B({action:"probe"});if(q.ok!==!0||q.output!=="ARA_HANDS_REPL_READY")throw Error("hands_node_repl_probe_failed")}catch(q){G=!0,Z.kill("SIGKILL");try{await I9(X)}finally{await Q.cleanup()}throw q}let U=Promise.resolve(),M=new Set;X$($.socketPath);let _=c6.createServer((q)=>{M.add(q),q.once("close",()=>M.delete(q)),q.setEncoding("utf8");let D="",x=!1,b=!1;q.once("close",()=>{if(b)F()}),q.on("error",()=>q.destroy()),q.on("data",(T)=>{if(x)return;if(D+=T,D.length>yZ){x=!0,Y8(q,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let k=D.indexOf(`
-`);if(k===-1)return;x=!0;let g=D.slice(0,k);U=U.then(async()=>{if(q.destroyed)return;try{let O=JSON.parse(g);if(O.action!=="evaluate"||typeof O.code!=="string")throw Error("Invalid REPL request");b=!0;let N=await B({action:"evaluate",code:O.code});if(b=!1,N.ok!==!0||typeof N.output!=="string")throw Error(typeof N.error==="string"?N.error:"hands_node_repl_failed");Y8(q,{ok:!0,output:N.output})}catch(O){b=!1,Y8(q,{ok:!1,error:O instanceof Error?O.message:String(O),stack:O instanceof Error?O.stack:void 0})}}).catch((O)=>{Y8(q,{ok:!1,error:O instanceof Error?O.message:String(O)})})})});try{await new Promise((q,D)=>{_.once("error",D),_.listen($.socketPath,()=>{_.off("error",D);try{f6($.socketPath,384),q()}catch(x){_.close(()=>D(x))}})})}catch(q){G=!0,Z.kill("SIGKILL");try{await I9(X)}finally{await Q.cleanup(),X$($.socketPath)}throw q}return{socketPath:$.socketPath,async stop(){if(G)return;G=!0;let q=new Promise((D)=>_.close(()=>D()));for(let D of M)D.destroy();await q,U.catch(()=>{return}),F();try{await I9(X)}finally{await Q.cleanup(),X$($.socketPath)}}}}var G$=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var vZ="/workspace",cZ="/var/lib/reason/sessions",a6="/var/lib/reason/session-controls";function dZ($){let Q=`${cZ}/`;if(!$.startsWith(Q))return null;let Z=$.slice(Q.length);if(!G$.test(Z)||Z!==Z.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${a6}/${Z}/job.env`}function o6($){if(!G$.test($))throw Error("personal_computer_invalid_identity");return $.toLowerCase()}function z8($){let Q=o6($);return{runtimeRoot:`${cZ}/${Q}`,workspaceRoot:`${vZ}/sessions/${Q}`,sharedRoot:vZ}}var pZ="/root/.ara/cloud-browser/repl.sock";function z$($){return $==="compute"}function uZ($,Q,Z="linux"){if($)z8($);if(Z!=="linux")throw Error("cloud_browser_os_invalid");if(Q!==void 0&&(!$||!/^[1-9][0-9]{0,18}$/.test(Q)))throw Error("cloud_browser_generation_invalid");let X=$?`/var/lib/reason/browsers/${$.toLowerCase()}`:"/root/.ara/cloud-browser",J=$?`${X}/${Q?`g${Q}`:"current"}`:X,G=$?`/root/.b/${$.toLowerCase().replaceAll("-","")}`:X;return{temporarySessionDirectory:G,temporaryDirectory:$?`${G}/${Q??"current"}`:`${J}/tmp`,directory:J,sessionDirectory:X,config:`${J}/config.json`,status:`${J}/status.json`,socket:`${J}/repl.sock`,bundle:`${J}/driver.mjs`,processName:$?`ara-browser-${$.toLowerCase()}${Q?`-${Q}`:""}`:"ara-cloud-browser"}}var V$="browser_egress",lZ=FQ,V7=45000,H7=c9+1500,b0=/^[A-Za-z0-9._:-]{1,160}$/,F7="/run/ara-hands";function W7($,Q,Z=eZ()){if($==="darwin")return{temporaryRoot:Z,prepareRoot:!1,sessionMode:448};return{temporaryRoot:Q??F7,prepareRoot:!0,sessionMode:457}}function sZ($,Q=process.platform,Z=process.geteuid?.()){return $===!0&&Q==="linux"&&Z===0}function W$($=aZ(),Q=process.platform,Z=process.geteuid?.()){return $&&Q==="linux"&&Z===0?{uid:$.uid,gid:$.gid,home:$.home,username:$.username}:null}function U7($=W$(),Q=MZ){return $&&Q()?a8:null}function OY($=W$(),Q=process.platform,Z=process.geteuid?.()){return Q!=="linux"||Z!==0||$!==null}function DY($=process.platform,Q=process.geteuid?.()){return $!=="linux"||Q!==0}function B7($,Q){if(!Q&&($??"linux")==="linux")return pZ;return uZ(Q,void 0,$??"linux").socket}function L7($){return $[U0]===!0?"sandbox_loopback":"ara_device_wss"}function H9($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function Q4($){let Q=$.toLowerCase().replace(/^\[|\]$/g,"");return Q==="localhost"||Q.endsWith(".localhost")||Q==="::1"||Q==="0:0:0:0:0:0:0:1"||Q==="0.0.0.0"||Q.startsWith("127.")}class Z4 extends C{expiryDiagnostic;constructor($){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=$}}function N7($){return H9($)&&Object.keys($).every((Q)=>Q==="source_path"||Q==="branch")&&($.source_path===void 0||p0($.source_path))&&typeof $.branch==="string"&&t8.test($.branch)}function M7($,Q,Z){let X=Q===void 0?Date.now():Q,J=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],G=new Set([...J,"workspace_id","legacy_workspace_id",l0,s0,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",p,U0,V$,z9,N0,n0,w0]),z=H9($)?$:null,V=z?.[V$],Y=z?.[z9],H=z?.[n0],W=V===void 0||(z?.[p]===S0||H===R9&&z?.[p]===void 0)&&H9(V)&&Object.keys(V).every((q)=>q==="mode"||q==="allowed_domains")&&V.mode==="enforce"&&Array.isArray(V.allowed_domains)&&V.allowed_domains.length<=256&&V.allowed_domains.every((q)=>typeof q==="string"&&y8(q));if(!H9($)||J.some((q)=>!(q in $))||Object.keys($).some((q)=>!G.has(q))||!W||H!==void 0&&H!==R9||z?.[w0]!==void 0&&z[w0]!==H8||z?.personal_workspace!==void 0&&(z.personal_workspace!==!0||z[p]!==S0)||z?.cloud_browser!==void 0&&(z.cloud_browser!==!0||z[p]!==S0)||z?.sandbox_provider!==void 0&&!z$(z.sandbox_provider)||z?.sandbox_os!==void 0&&z.sandbox_os!=="linux"||Y!==void 0&&(z?.[p]!==G9||!o8(Y))||p in $&&$[p]!==S0&&$[p]!==G9&&$[p]!==W0||U0 in $&&$[U0]!==!0||$.workspace_path!==void 0&&(!p0($.workspace_path)||$[p]!==W0)||$.workspace_worktree!==void 0&&($.workspace_path===void 0||!N7($.workspace_worktree))||typeof $.relay_url!=="string"||typeof $.session_id!=="string"||!b0.test($.session_id)||$.workspace_id!==void 0&&(typeof $.workspace_id!=="string"||!b0.test($.workspace_id))||$.legacy_workspace_id!==void 0&&(typeof $.legacy_workspace_id!=="string"||!b0.test($.legacy_workspace_id))||$[l0]!==void 0&&($[l0]!==F8||(p in $))||$[s0]!==void 0&&($[s0]!==W8||(p in $))||$[N0]!==void 0&&(typeof $[N0]!=="string"||!b0.test($[N0]))||typeof $.environment_id!=="string"||!b0.test($.environment_id)||typeof $.expires_at!=="string"||$.policy_mode!=="full_access"||$.policy_version!==1||$.hands_protocol_version!==F9||$.hands_worker_version!==W9||$.hands_worker_artifact_sha256!==z0||!wZ($.hands_worker_entrypoint)||!P0($.target_generation)||!j0($.target_fence_id))throw new C("invalid_hands_payload","Reason Hands connection payload is invalid.");let F;try{F=new URL($.relay_url)}catch{throw new C("invalid_hands_relay","Reason Hands relay URL is invalid.")}let K=$[U0]===!0,L=Q4(F.hostname);if((K?F.protocol!=="ws:"||!L:L?F.protocol!=="ws:":F.protocol!=="wss:")||F.username||F.password||F.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(F.pathname))throw new C("invalid_hands_relay","Reason Hands relay URL is not allowed.");let B=Date.parse($.expires_at),U=Number.isNaN(B)?"parse":new Date(B).toISOString()!==$.expires_at?"noncanonical":B<=X?"expired":B-X>lZ?"over_cap":"accepted",M={version:1,outcome:U,clock_source:Q===void 0?"date_now":"injected",validation_now_ms:$9(X),expiry_ms:$9(B),remaining_ms:Number.isSafeInteger(B-X)?B-X:null,maximum_lifetime_ms:lZ,cli_artifact:bZ()};if(U!=="accepted")throw new Z4(M);try{Z?.(M)}catch{}let _=$.environment_binding===void 0?void 0:E8.safeParse($.environment_binding);if(_&&!_.success)throw new C("invalid_hands_request","Reason Hands environment binding is invalid.");return{...$.cloud_browser===!0?{cloud_browser:!0}:{},...z$($.sandbox_provider)?{sandbox_provider:$.sandbox_provider}:{},...$.sandbox_os==="linux"?{sandbox_os:$.sandbox_os}:{},...$.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:F.toString(),..._?.success?{environment_binding:_.data}:{},session_id:$.session_id,...$.workspace_id===void 0?{}:{workspace_id:$.workspace_id},...$.legacy_workspace_id===void 0?{}:{legacy_workspace_id:$.legacy_workspace_id},...$[l0]===F8?{[l0]:F8}:{},...$[s0]===W8?{[s0]:W8}:{},...typeof $[N0]==="string"?{[N0]:$[N0]}:{},...$[n0]===R9?{[n0]:R9}:{},...$[w0]===H8?{[w0]:H8}:{},...typeof $.workspace_path==="string"?{workspace_path:$.workspace_path}:{},...H9($.workspace_worktree)?{workspace_worktree:{...typeof $.workspace_worktree.source_path==="string"?{source_path:$.workspace_worktree.source_path}:{},branch:String($.workspace_worktree.branch)}}:{},environment_id:$.environment_id,expires_at:$.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:F9,hands_worker_version:W9,hands_worker_artifact_sha256:z0,hands_worker_entrypoint:u0,target_generation:$.target_generation,target_fence_id:$.target_fence_id,...p in $?{[p]:$[p]}:{},...K?{[U0]:!0}:{},...Y===void 0?{}:{[z9]:Y},...V===void 0?{}:{[V$]:{mode:"enforce",allowed_domains:[...new Set(V.allowed_domains)].sort()}}}}function j7(){let $=new Map;return{acquire(Q,Z){if($.has(Q))return null;let X=[...$.values()],J=(z)=>Z.group!==void 0&&z.group===Z.group;if(Z.exclusive?!X.every(J):X.some((z)=>z.exclusive))return null;if(Z.limit!==void 0&&!X.some(J)&&new Set(X.map((z,V)=>z.group??V)).size>=Z.limit)return null;$.set(Q,Z);let G=!1;return()=>{if(G)return;G=!0,$.delete(Q)}},activeOwners:()=>[...$.keys()]}}var C7=j7();function q7($,Q){U9($,{recursive:!0,mode:448});let Z=n($),X=()=>new C("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let z of Q.split("/")){let V=o(Z,z);try{let H=t(V);if(H.isSymbolicLink()||!H.isDirectory())throw X()}catch(H){if(!(H&&typeof H==="object"&&("code"in H)&&H.code==="ENOENT"))throw H;try{U9(V,{mode:448})}catch(W){if(!(W&&typeof W==="object"&&("code"in W)&&W.code==="EEXIST"))throw W}}let Y=t(V);if(Y.isSymbolicLink()||!Y.isDirectory()||n(V)!==V)throw X();Z=V}let J=t(Z),G=X7(Z,K$.O_RDONLY|K$.O_DIRECTORY|K$.O_NOFOLLOW);try{let z=Z7(G);if(!z.isDirectory()||z.dev!==J.dev||z.ino!==J.ino||n(Z)!==Z)throw X();Q7(G,448)}finally{$7(G)}return Z}function T7($,Q=iZ(),Z,X,J){if(!b0.test($)||Z!==void 0&&!b0.test(Z))throw new C("invalid_hands_workspace","Reason Hands run identity is invalid.");let G=K0(v0({kind:"managed",workspaceId:$,...X?{base:X}:{},...J?{layout:J}:{}})),z=q7(Q,K0(G)),V=o(z,K7(G)),Y=!1;try{let K=t(V);if(Y=!0,K.isSymbolicLink())throw new C("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}if(J&&!Y)try{let K=o(n(Q),K0(v0({kind:"managed",workspaceId:$,...X?{base:X}:{}}))),L=t(K);if(!L.isSymbolicLink()&&L.isDirectory()&&n(K)===K)K8(K,V),Y=!0}catch{}if(Z&&Z!==$){let K=o(z,Z);try{let L=t(K);if(L.isSymbolicLink()||!L.isDirectory())throw new C("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let B=n(K);if(K0(B)!==z)throw new C("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let U=null;if(Y){U=o(z,`.${$}.previous`);try{throw t(U),new C("invalid_hands_workspace","Reason Hands previous workspace backup already exists.")}catch(M){if(M instanceof C||!(M&&typeof M==="object"&&("code"in M)&&M.code==="ENOENT"))throw M}K8(V,U)}try{K8(B,V)}catch(M){if(U)K8(U,V);throw M}Y=!0}catch(L){if(L instanceof C||!(L&&typeof L==="object"&&("code"in L)&&L.code==="ENOENT"))throw L}}U9(V,{recursive:!0,mode:448}),E9(V,448);let H=n(V);if(K0(H)!==z)throw new C("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let W=o(H,"repo");try{let K=t(W);if(K.isSymbolicLink()||!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}U9(W,{recursive:!0,mode:448}),E9(W,448);let F=n(W);if(K0(F)!==H)throw new C("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:H,repoPath:F}}function X4($){let Q=null;try{Q=t($)}catch{}if(!Q||Q.isSymbolicLink()||!Q.isDirectory()||Q.uid!==0||Q.gid!==0||(Q.mode&4095)!==493)throw new C("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function O7($,Q){let Z="/";for(let X of["",...$.split("/"),...Q.split("/")].filter((J,G)=>G===0||J)){if(X)Z=o(Z,X);let J;try{J=t(Z)}catch{return null}if(J.uid!==0)return J.uid;if((J.mode&2)!==0&&(J.mode&512)===0&&!J.isSymbolicLink())return-1;if(J.isSymbolicLink()||!J.isDirectory())return null}return null}function D7($,Q,Z,X=process.geteuid?.(),J){if(!b0.test(Q))return null;let G,z;try{G=n($),z=K0(v0({kind:"managed",workspaceId:Q,...Z?{base:Z}:{},...J?{layout:J}:{}}))}catch{return null}let V=o(G,z),Y=F$(V)!==null,H=(B)=>new C("cloud_workspace_root_invalid",B),W;if(X===0){let B=O7(G,z);if(B===null)return null;if(!Y)throw new C("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");W=B}else{if(!Y)return null;let B,U;try{B=t(K0(V)),U=t(V)}catch{return null}if(B.isSymbolicLink()||!B.isDirectory()||B.uid===0||U.uid!==0)return null;W=B.uid}let F=G;for(let B of z.split("/")){let U=o(F,B),M=!1;try{let _=t(U);M=!_.isSymbolicLink()&&_.isDirectory()&&n(U)===U}catch{}if(!M)throw H("This cloud Session's workspace root is missing or is not a real directory.");F=U}X4(V);let K;try{K=J4(V)}catch(B){if(B instanceof C)throw B;throw H("This cloud Session's workspace root changed while Reason Hands checked it.")}let L=null;try{L=S9(K.repoPath).uid}catch{}if(L!==W)throw new C("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return K}function J4($,Q=!1){let Z=n($),X=o(Z,"repo"),J;try{J=t(X)}catch{throw new C("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(Q){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(Z))throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");if(z8(Z.slice(Z.lastIndexOf("/")+1)).runtimeRoot!==Z)throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");let V=n("/workspace"),Y=n(X);if(V!=="/workspace"||!S9(Y).isDirectory()||!Y.startsWith("/workspace/"))throw new C("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:Z,repoPath:Y}}let G=jZ(Z);if(G&&J.isSymbolicLink()){let V=n(X);if(V!==n(G)||!S9(V).isDirectory())throw new C("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:Z,repoPath:V}}if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let z=n(X);if(K0(z)!==Z)throw new C("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:Z,repoPath:z}}function U$($,Q,Z){if(Q!==void 0&&!p0(Q))throw new C("invalid_hands_workspace",`Reason Hands ${Z} is invalid.`);let X=$4($,Q??".");if(!I0($,X))throw new C("invalid_hands_workspace",`Reason Hands ${Z} escapes its granted root.`);return X}function Y4($,Q,Z){if(r8(Q)){let X=n(Z);return{anchor:X,target:$4(X,Q),boundary:o(X,K9)}}return{anchor:$,target:U$($,Q,"folder"),boundary:$}}function _7($,Q){if(!I0($,Q))throw new C("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let Z=$;for(let X of Q.slice($.length).split("/").filter(Boolean)){Z=o(Z,X);let J=null;try{J=t(Z)}catch(G){if(G.code!=="ENOENT")throw G}if(!J)U9(Z,{mode:448});else if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function G4($,Q){let Z=n(U$($,Q.source_path,"repository"));if(!I0($,Z)||!S9(Z).isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return Z}async function A7($,Q,Z,X=U8()){try{let J=n($);if(H$(Y4(J,Q,X).target))return;return await _Z(G4(J,Z))??void 0}catch{return}}function x7($,Q,Z,X,J=P7,G=U8()){let z=n($),{target:V,boundary:Y,anchor:H}=Y4(z,Q,G);if(Z&&!H$(V)){let K=G4(z,Z);_7(H,K0(V));let L=["-c","core.hooksPath=/dev/null","-C",K];if(X)J([...L,"update-ref","--create-reflog","-m",X.note,`refs/heads/${Z.branch}`,X.commit,""]);let B=X?J([...L,"worktree","add",V,Z.branch]):J([...L,"worktree","add","-b",Z.branch,V]);if(!X&&B.status!==0&&/already exists/.test(B.stderr)&&!H$(V))B=J([...L,"worktree","add",V,Z.branch]);if(B.status!==0)throw new C(/not a git repository/i.test(B.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let W;try{W=t(V)}catch{throw new C("workspace_folder_missing","This Session's folder no longer exists.")}let F=n(V);if(W.isSymbolicLink()&&!I0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!S9(F).isDirectory()||!I0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(R0(F))throw new C("protected_path","Credential and secret folders are unavailable to Sessions.");return F}function P7($){let Q=e6("git",$,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:Q.status,stderr:Q.stderr??""}}function z4($){return dZ($)??F$($)?.jobEnv??o($,"job.env")}function I7($,Q){let Z=z4($),X=t(Z);if(X.isSymbolicLink()||!X.isFile())throw new C("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");J7(Z,Q),E9(Q,384)}function R7($){if($.workspaceMode===W0&&$.workspacePath!==void 0){let z=$.home??U8(),V=x7($.grantedRoot,$.workspacePath,$.workspaceWorktree,$.workspaceWorktreeStart,void 0,z);if($.workspaceWorktree&&$.deviceId)IZ(z,$.workspacePath,$.deviceId);return{workRoot:V,repoPath:V,workspace:{kind:"root",path:$.workspacePath},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if($.workspaceMode===S0)return{...J4($.grantedRoot,$.personalWorkspace),workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if($.workspaceMode===G9||$.workspaceMode===W0){let z=t($.grantedRoot);if(z.isSymbolicLink()||!z.isDirectory())throw new C("invalid_hands_workspace","Reason Hands root must be a real directory.");let V=n($.grantedRoot);return{workRoot:V,repoPath:V,workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let Q=$.workspaceId??$.runId,Z={kind:"managed",workspaceId:Q,...$.workspaceBase?{base:$.workspaceBase}:{},...$.workspaceLayout?{layout:$.workspaceLayout}:{}},X=p9($.grantedRoot,Z,$.home).anchor,J=D7(X,Q,$.workspaceBase,void 0,$.workspaceLayout);if(J)return{...J,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let G=T7(Q,X,$.legacyWorkspaceId,$.workspaceBase,$.workspaceLayout);return{...G,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:K0(G.workRoot),managedWorkspace:!0}}function E7($){let{command:Q,prefix:Z}=S8($.executablePath,$.sourceEntrypoint),X=G8({home:z7(),temporaryDirectory:$.temporaryDirectory,path:$.path});if(X.REASON_DEVICE_ROOT=X.ARA_DEVICE_ROOT=$.grantedRoot,X.REASON_HANDS_WORKSPACE=X.ARA_HANDS_WORKSPACE=$.workRoot,X.REASON_HANDS_REPO=X.ARA_HANDS_REPO=$.root,$.workspacePoolPath)X.REASON_HANDS_WORKSPACE_POOL=X.ARA_HANDS_WORKSPACE_POOL=$.workspacePoolPath;return{command:Q,args:[...Z,"__device","__hands-worker","--config",$.configPath],options:{cwd:$.root,env:X,shell:!1,stdio:["ignore","ignore","pipe"]}}}function S7($,Q){let Z="",X=!1,J=Date.now(),G=0,z=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped"].map((F)=>`hands.worker.${F}`)),V=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed"]),Y=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],H=["peerGeneration","socketState","closeCode"],W=new Set(["event","reason","launchId",...Y,...H]);return(F)=>{for(let K of F.toString().split(/(?<=\n)/)){let L=K.endsWith(`
-`);if(!X&&Z.length+K.length<=2048)Z+=K;else X=!0;if(!L)continue;let B=Z;if(Z="",X){X=!1;continue}try{let U=JSON.parse(B);if(!U||typeof U!=="object"||Array.isArray(U)||Object.keys(U).some((M)=>!W.has(M))||!z.has(U.event)||!V.has(U.reason)||U.launchId!==$||Y.some((M)=>!Number.isSafeInteger(U[M])||U[M]<0)||H.some((M)=>U[M]!==null&&(!Number.isSafeInteger(U[M])||U[M]<0)))continue;if(Date.now()-J>=60000)J=Date.now(),G=0;if(G>=122)continue;G+=1,Q(U)}catch{}}}}async function w7($){let Q=$.now()+$.timeoutMs;while($.now()<Q){if($.signal.aborted)throw new C("cancelled","Reason Hands start was cancelled.");if($.spawnFailed?.()||$.child.exitCode!==null||$.child.signalCode!==null)throw new C("hands_worker_exited","Reason Hands exited before ready.");let Z=J8($.path,{pid:$.child.pid??-1,launchId:$.launchId,workerVersion:W9,protocolVersion:F9,workerArtifactSha256:z0,workerEntrypoint:u0});if(Z?.targetGeneration===$.targetGeneration&&Z.fenceId===$.fenceId)return Z;await new Promise((X)=>setTimeout(X,10))}throw new C("hands_ready_timeout","Reason Hands did not become ready.")}async function b7($,Q){let Z=()=>$.exitCode===0&&$.signalCode===null;if($.exitCode!==null||$.signalCode!==null)return Z()?"stopped":"already_exited";let X=new Promise((z)=>$.once("exit",()=>z()));try{if(!$.kill("SIGTERM"))return Z()?"stopped":"unobserved"}catch{return Z()?"stopped":"unobserved"}if(await nZ(X,Q))return Z()?"stopped":"unobserved";try{$.kill("SIGKILL")}catch{}return await nZ(X,Q)?"forced":"unobserved"}async function nZ($,Q){let Z;try{return await Promise.race([$.then(()=>!0),new Promise((X)=>{Z=setTimeout(()=>X(!1),Q)})])}finally{clearTimeout(Z)}}function k7($){return new Promise((Q)=>{let Z=!1,X=(V)=>{if(Z)return;Z=!0,clearTimeout(z),$.signal.removeEventListener("abort",J),$.child.off("exit",G),Q(V)},J=()=>X("cancelled"),G=()=>X("exited"),z=setTimeout(()=>X("expired"),Math.max(0,$.expiresAt-$.now()));if($.signal.addEventListener("abort",J,{once:!0}),$.child.once("exit",G),$.signal.aborted)J();else if($.child.exitCode!==null||$.child.signalCode!==null)G()})}var K4=tZ();function f7($,Q){if(!($ instanceof Error)||$ instanceof C)return!1;let Z=["hands_browser_driver_missing","hands_browser_driver_version_mismatch","hands_browser_executable_missing","hands_browser_unsupported_platform","hands_browser_unavailable"].includes($.message),X=["ENOENT","EACCES","EPERM"].includes($.code??"");if(!Z&&!X)return!1;try{return t(Q),!1}catch(J){return H9(J)&&J.code==="ENOENT"}}function m7($){return $.sandbox_provider==="compute"&&!$.cloud_browser&&!$[U0]&&$[p]===S0}function g7($,Q,Z){return $===void 0?{}:{dispatch_stages:{version:1,claim_to_entered_ms:V0($,Q),...Z===void 0?{}:{worker_prespawned:Z}}}}function _Y(){K4().catch(()=>{return}),X9().catch(()=>{return})}async function AY($,Q={}){let Z=Q.logDiagnostic??((N)=>console.warn(N)),X=new Map,J=(N)=>{let j=Date.now();X.set(N,j);try{Z(JSON.stringify({event:"sandbox.hands_startup",stage:N,timestampMs:j}))}catch{}};J("entered");let G=$.claimEnvironment;$.claimEnvironment=void 0;let z=Q.now??Date.now,V,Y=M7($.payload,Q.now?.(),(N)=>{V=N});if($.managedPty&&($.managedPty.version!==1||!$.headless||!$.runtimeDirectory||![void 0,!0].includes($.managedPty.startupVerified)||!$.deviceIdentity||!$.claimOwner||$.claimOwner.device_id!==$.deviceIdentity.deviceId||!Y.environment_binding||!["darwin","linux"].includes(process.platform)))throw new C("pty_unsupported","Bound PTY requires qualified headless Hands with private jobs and environment.");let H=async(N)=>{let j;try{await Promise.race([N,new Promise((A,m)=>{j=setTimeout(()=>m(new C("hands_event_delivery_unavailable","Hands event delivery did not settle within its deadline.")),Math.max(1,Math.min(Q.eventDeliveryTimeoutMs??5000,5000)))})])}finally{clearTimeout(j)}},W=async(N,j)=>H($.emitEvent(N,j));if($.headless&&(Y.cloud_browser===!0||$.managedBrowser!==void 0||Y[U0]!==void 0||Y[z9]!==void 0||Y[p]!==void 0&&Y[p]!==W0))throw new C("invalid_hands_request","Managed sandbox extensions are unavailable to a headless worker.");let F=W$(),K=Y[w0]===void 0?null:U7(F);if(Y[w0]!==void 0&&(K===null||!$.headless||!sZ($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_model_jobs_egress_unavailable","This worker cannot hold its jobs to the guest egress guard; the Hands did not start.");if(Y[n0]!==void 0&&!($.headless&&sZ($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_confinement_unavailable","Confined Hands need a root Linux worker in host mode.");if(Y.cloud_browser&&process.platform!=="linux")throw new C("cloud_browser_target_invalid","Cloud browser is available only on a cloud machine.");let L=`${$.operationId}:${$.attemptId}`,B=Y[p]===G9,U=$.headless||process.platform==="darwin"&&$.managedBrowser===void 0&&!Y.cloud_browser&&!Y.browser_egress&&!Y[U0]&&(Y[p]===void 0||Y[p]===W0)||m7(Y),M=B?Y[z9]??"bash":null,_=M?TZ(M):null;if(_)throw new C(_,"Persistent Node REPL execution is unavailable; this benchmark profile cannot start.");let q=Y[p],D=$.headless===!0?$.handsSlots??1:void 0,x=(Q.slot??C7).acquire(L,{exclusive:D===1||q!==void 0&&q!==W0,...D!==void 0&&D>1?{limit:D}:{},...$.headless===!0&&Y[N0]!==void 0?{group:Y[N0]}:{}});if(!x)throw new C("hands_slot_busy",D!==void 0&&D>1?`This Reason worker runs at most ${D} sessions at a time.`:"This Reason Device runs one session at a time.");let b=$.headless===!0?oZ($.runId):null,T=null,k=null,g,O;try{J("browser_resolution");let N=$.headless&&Q.browserExecutablePath===void 0?await X9():null,j=B||Y.cloud_browser?null:Q.browserExecutablePath===void 0?$.headless?N?.status==="resolved"?N.executablePath:null:await BZ(void 0,process.platform,$.managedBrowser):Q.browserExecutablePath;if(!B&&!Y.cloud_browser&&!U&&!j)throw new C("hands_browser_unavailable","Reason Hands requires Chrome, Edge, Brave, Chromium, or a Playwright Chromium install.");J("path_resolution");let A;try{A=await(Q.resolvePathEnvironment??K4)()}catch{A={path:rZ(),source:"fallback"}}if(J("workspace_setup"),process.platform==="darwin"){let s=Y[p]===W0&&Y.workspace_path!==void 0?U$($.root,Y.workspace_worktree?Y.workspace_worktree.source_path:Y.workspace_path,"folder"):null;for(let Z0 of new Set([$.root,...s?[s]:[]]))await hQ(Z0)}let w=Y[p]===S0||Y[p]===G9?W7(process.platform,Q.sandboxRuntimeRoot):null,E=$.headless&&$.runtimeDirectory?$.runtimeDirectory:w?w.temporaryRoot:eZ();if(T="private_runtime",$.headless&&$.runtimeDirectory){T9(E);let s=n($.root);if(!_9(s,E))throw new C("invalid_hands_workspace","Private worker state must not overlap the granted workspace.")}if($.headless&&$.runtimeDirectory&&(!$.deviceIdentity||!Y.environment_binding))throw new C("environment_unavailable","Headless Hands requires a server-bound private environment.");if(T="runtime_root",w?.prepareRoot)U9(E,{recursive:!0,mode:457}),E9(E,457);T="temporary_directory";let P=n(Y7(o(E,"reason-hands-session-")));k=P,E9(P,w?.sessionMode??448);let f=o(P,"hands-config.json"),d=o(P,"hands-ready.json"),u=r6(),l=Y.target_fence_id;T="granted_root";let S=n($.root);T="workspace_layout";let h=Y[p]===W0&&Y.workspace_path!==void 0&&Y.workspace_worktree?await A7(S,Y.workspace_path,Y.workspace_worktree):void 0,{workRoot:c,repoPath:a,jobEnvPath:H0,workspacePoolPath:B8,managedWorkspace:D0,workspace:i0,cloudSessionRoot:w9}=R7({grantedRoot:S,personalWorkspace:Y.personal_workspace===!0,runId:$.runId,workspaceId:Y.workspace_id,legacyWorkspaceId:Y.legacy_workspace_id,workspaceBase:Y[l0],workspaceLayout:Y[s0],temporaryDirectory:P,workspaceMode:Y[p],applicationSupportPath:Q.applicationSupportPath,...Y.workspace_path===void 0?{}:{workspacePath:Y.workspace_path},...Y.workspace_worktree?{workspaceWorktree:Y.workspace_worktree}:{},...h?{workspaceWorktreeStart:h}:{},...$.deviceIdentity?{deviceId:$.deviceIdentity.deviceId}:{}}),k0=L7(Y);T="jobs";let r=$.headless&&$.runtimeDirectory?JQ({runtimeDirectory:$.runtimeDirectory,root:S,runId:$.runId}):void 0;g=r?.disposeSocket;let B0=r?YQ(r):null;if(B0)try{Z(JSON.stringify({event:"hands.journal_owner_retired",run_id:$.runId,reason:B0.reason,prior_executor_launch_id:B0.executorLaunchId}))}catch{}if(r&&[c,a].some((s)=>!_9(s,r.journalDirectory)))throw new C("invalid_hands_workspace","A Session can't work in the folder that holds this worker's settings; start it in a project or repository inside it.");let a0=Y.personal_workspace?c.slice(c.lastIndexOf("/")+1):void 0;if(a0&&a0!==Y.workspace_id)throw new C("invalid_hands_workspace","Personal session identity does not match its Device grant.");T="browser_socket";let F0=Y.cloud_browser?B7(Y.sandbox_os,a0):o(r?K0(r.socketPath):P,"repl.sock");T="relay_url";let L0=Q4(new URL(Y.relay_url).hostname),f0=k0==="ara_device_wss"&&!L0?(Q.loadProxy??w8)()?.url:void 0,Y0;T="environment_owner";let X0=$.headless&&$.deviceIdentity&&Y.environment_binding?EZ(P,{runId:$.runId,...$.deviceIdentity,binding:Y.environment_binding,expiresAtMs:Date.parse(Y.expires_at),identity:()=>Y0?.()??null}):void 0;T="job_environment";let B9=!X0&&i0.kind==="managed"&&D0?o(c,"job.env"):null;if(B9)try{V8(B9,"",{mode:384,flag:"wx"})}catch(s){if(!(s instanceof Error&&("code"in s)&&s.code==="EEXIST"))throw s}let L8={url:Y.relay_url,transport:k0,...f0===void 0?{}:{proxyUrl:f0},...$.localGithubConfinement?{localGithubConfinement:!0}:{},...Y[n0]&&X0?{gitCredentialEnvironment:!0}:{},workerVersion:W9,protocolVersion:F9,workerArtifactSha256:z0,workerEntrypoint:u0,targetGeneration:Y.target_generation,fenceId:l,workRoot:c,workspaceAliasPath:c,jobEnvPath:H0,...X0?{environmentSnapshotPath:X0.path,...$.hostExecution?{executionEnvironment:RQ()}:{},environmentExpectedBinding:{runId:$.runId,...$.deviceIdentity,binding:Y.environment_binding}}:B9?{jobEnvSourcePath:B9,workspacePoolPath:K0(c)}:D0?{}:{jobEnvSourcePath:z4(c)},repoPath:a,replSocketPath:F0,...Y.cloud_browser?{browserRunId:$.runId}:{},readyPath:d,launchId:u,expiresAtMs:Date.parse(Y.expires_at),bashTimeoutMs:300000,replTimeoutMs:120000,...r?{managedJobs:{journalDirectory:r.journalDirectory,scopeId:r.scopeId},jobControlSocketPath:r.socketPath}:{},...r&&F?{jobsUser:{...F,...K!==null?{modelGid:K}:{}}}:{},...$.managedPty&&r&&X0?{managedPty:{version:1,...$.managedPty.startupVerified===!0?{persistent:!0}:{},...process.platform==="darwin"?{shell:EQ()}:{}}}:{},...U&&!j?{allowedTools:["bash","read","write","edit"]}:B?{allowedTools:M==="bash"?["bash"]:["bash","repl"]}:{}};if(X0||D0&&!B9)V8(H0,"",{mode:384});else I7(c,H0);T="config_write",V8(f,JSON.stringify(L8),{mode:384}),T=null;let m0={session_id:Y.session_id,environment_id:Y.environment_id,hands_protocol_version:F9,hands_worker_version:W9,hands_worker_artifact_sha256:z0,hands_worker_entrypoint:u0,target_generation:Y.target_generation,target_fence_id:Y.target_fence_id,executor_launch_id:u},b9=null,B$=!1,L$=!1,N$,Q0=null,M$,j$,k9="failed",C$=null,N8=Promise.resolve(),q$=null,M8=async(s,Z0)=>{try{await W(s,Z0)}catch{}};try{J("event_started");let s,Z0=(async()=>{await $.emitEvent("hands.started",{...m0,policy_mode:"full_access",policy_version:1,path_source:A.source}),s=Date.now()})();Z0.catch(()=>{return}),J("worker_setup");let f9=Y.browser_egress?{mode:"enforce",allowedDomains:Y.browser_egress.allowed_domains}:{mode:"off"};if(M&&M!=="bash")b9=await(Q.startNodeRepl??hZ)({socketPath:F0,workRoot:c});else if(!B&&!Y.cloud_browser&&j)b9=await(Q.startRepl??LZ)({socketPath:F0,browserExecutablePath:j,workspaceRoot:a,...$.managedBrowser?{managedBrowser:$.managedBrowser}:{},...$.desktopRecording?{recording:$.desktopRecording}:{},networkPolicy:f9,onEgressDenied:(y)=>{let M0=CZ(y.host);Z(JSON.stringify({event:"sandbox.repl_egress_denied",destination_id:M0,reason:y.reason,run_id:$.runId})),N8=N8.then(()=>W("hands.browser_egress_denied",{destination_id:M0,reason:y.reason})).catch((H4)=>{q$??=H4})}}).catch((y)=>{if(!U||$.signal.aborted||z()>=Date.parse(Y.expires_at)||!f7(y,F0))throw y;return Object.assign(L8,{allowedTools:["bash","read","write","edit"]}),V8(f,JSON.stringify(L8),{mode:384}),L$=!0,null});let T$=E7({configPath:f,root:a,grantedRoot:S,workRoot:c,workspacePoolPath:B8,temporaryDirectory:P,path:A.path,executablePath:Q.executablePath,sourceEntrypoint:Q.sourceEntrypoint}),j8=Date.now(),C8,O$,q8=Q.takePrespawnedWorker?.(T$)??null;if(N$=Q.takePrespawnedWorker?q8!==null:void 0,Q0=q8??(Q.spawnWorker??((y)=>t6(y.command,y.args,y.options)))(T$),!q8)Q.adoptSpawnedWorker?.(Q0);Q0.stderr?.on("data",S7(u,(y)=>{if(y.event==="hands.worker.connecting")C8??=y.timestampMs;else if(y.event==="hands.worker.open")O$??=y.timestampMs;Z(JSON.stringify({...y,run_id:$.runId}))}));let D$=!1;Q0.on("error",()=>{D$=!0}),Q0.once("exit",(y,M0)=>{try{Z(JSON.stringify({event:"hands.worker.exited",run_id:$.runId,launchId:u,exit_code:y,exit_signal:M0}))}catch{}}),O=Q0,J("worker_ready_wait");let L9=await w7({path:d,launchId:u,fenceId:l,targetGeneration:Y.target_generation,child:Q0,spawnFailed:()=>D$,signal:$.signal,timeoutMs:Q.readyTimeoutMs??V7,now:z}),V4=Date.now();if(Y0=()=>{if(!Q0||Q0.exitCode!==null||Q0.signalCode!==null)return null;let y=J8(d,L9);return y?{generation:y.targetGeneration,fenceId:y.fenceId}:null},r){let y={root:S,runId:$.runId,operationId:$.operationId,scopeId:r.scopeId,socketPath:r.socketPath,generation:L9.targetGeneration,fenceId:L9.fenceId,executorLaunchId:u,expiresAtMs:Date.parse(Y.expires_at),readIdentity:Y0,workspace:i0,localGithubConfinement:$.localGithubConfinement===!0};if(X0)y.environment=X0;if($.claimOwner&&$.deviceIdentity&&$.claimOwner.device_id===$.deviceIdentity.deviceId){let M0=[$.deviceIdentity.apiOrigin,Y.relay_url];if(f0)M0.push(f0);y.previewAuthority={owner:Object.freeze({...$.claimOwner}),rootId:$.deviceIdentity.rootId,relayOrigin:new URL(Y.relay_url).origin,deniedPorts:y$(M0)}}j$=GQ(y)}if(await new Promise((y)=>{setImmediate(y)}),w9)X4(c);let m9;if(G&&X0){try{let y=X0.install(G);m9={snapshot_id:y.snapshot_id,installed_revision:y.installed_revision}}catch{}try{Z(JSON.stringify({event:"hands.environment_at_claim",run_id:$.runId,installed:m9!==void 0}))}catch{}}G=void 0,J("event_ready");let _$=H(Z0);_$.catch(()=>{return});let A$=Date.now();B$=!0,await W("hands.ready",{...m0,expiry_diagnostic:V,startup_stages:{version:1,browser_resolution_ms:V0(X.get("browser_resolution"),X.get("path_resolution")),path_resolution_ms:V0(X.get("path_resolution"),X.get("workspace_setup")),workspace_setup_ms:V0(X.get("workspace_setup"),X.get("event_started")),repl_setup_ms:V0(X.get("worker_setup"),j8),worker_boot_ms:V0(j8,C8),worker_dial_ms:V0(C8,O$),worker_ready_ms:V0(j8,V4),started_event_ms:V0(X.get("event_started"),s),started_join_wait_ms:V0(X.get("event_ready"),A$),total_ms:V0(X.get("entered"),A$)},...g7($.claimedAtMs,X.get("entered"),N$),...$.managedPty?.startupVerified===!0?{managed_pty:{version:1,execution_mode:"host",descendant_cleanup_verified:!0}}:{},policy_mode:"full_access",policy_version:1,path_source:A.source,connection_generation:L9.generation,...m9?{environment_installed:m9}:{},...U&&!b9?{browser_state:"unavailable",browser_reason_code:L$?"setup_failed":"not_resolved"}:{viewport_width:1440,viewport_height:900}}),await _$,J("ready"),M$=mZ({path:d,initial:L9,signal:$.signal,isAlive:()=>Q0!==null&&Q0.exitCode===null&&Q0.signalCode===null&&z()<Date.parse(Y.expires_at),publish:(y,M0)=>$.emitEvent("hands.reconnected",{...m0,target_generation:y.targetGeneration,target_fence_id:y.fenceId,connection_generation:y.generation},M0),failed:()=>Z(JSON.stringify({event:"hands.worker.generation_proof_failed",run_id:$.runId,executor_launch_id:u}))});let x$=await k7({child:Q0,signal:$.signal,expiresAt:Date.parse(Y.expires_at),now:z});if(x$==="cancelled"){let y=$.signal.reason instanceof C?$.signal.reason.code:"cancelled";throw k9=y,new C(y,"Reason Hands was cancelled.")}if(x$==="exited")throw new C("hands_worker_exited","Reason Hands exited unexpectedly.");return k9="expired",{...m0,policy_mode:"full_access",policy_version:1,ended:"expired"}}catch(s){C$=s;let Z0=s instanceof C?s.code:"hands_failed",f9=Z0==="cancelled"||["run_finished","run_cancelled","driver_handoff","driver_stopped"].includes(Z0);if(k9=f9?Z0:"failed",!f9)await M8("hands.failed",{...m0,reason_code:Z0});throw s}finally{M$?.stop(),j$?.();let s=Q0?await b7(Q0,Q.stopTimeoutMs??H7):null,Z0=!1;await $.desktopRecording?.close();try{await b9?.stop()}catch{Z0=!0}if(await N8,(s==="stopped"||s==="already_exited"&&!B$)&&!Z0)await M8("hands.stopped",{...m0,reason_code:k9});else if(s!==null||Z0){if(await M8("hands.failed",{...m0,reason_code:s==="forced"?"hands_stop_forced":"hands_stop_unconfirmed"}),C$===null||Z0)throw new C("hands_stop_unconfirmed","Reason Hands resource cleanup could not be proven.")}if(q$!==null)throw new C("hands_egress_audit_failed","Reason Hands could not persist a browser egress denial receipt.")}}catch(N){let j=NZ(T,N);if(j)try{Z(JSON.stringify({event:"sandbox.hands_workspace_failed",...j}))}catch{}throw N}finally{try{if(!O||O.exitCode!==null||O.signalCode!==null)g?.();if(k!==null&&(!O||O.exitCode!==null||O.signalCode!==null))G7(k,{recursive:!0,force:!0})}finally{b?.(),x()}}}
-export{v as ga,E$ as ha,S$ as ia,j4 as ja,f$ as ka,g$ as la,y$ as ma,V2 as na,JQ as oa,_2 as pa,A2 as qa,x2 as ra,P2 as sa,I2 as ta,R2 as ua,KQ as va,E2 as wa,w2 as xa,p as ya,W0 as za,OX as Aa,DX as Ba,hX as Ca,vX as Da,NQ as Ea,l9 as Fa,T9 as Ga,O9 as Ha,AQ as Ia,EZ as Ja,l2 as Ka,xQ as La,RQ as Ma,EQ as Na,M5 as Oa,j5 as Pa,J0 as Qa,C5 as Ra,q5 as Sa,T5 as Ta,E5 as Ua,u3 as Va,S5 as Wa,_9 as Xa,I0 as Ya,w5 as Za,X9 as _a,n3 as $a,i3 as ab,tQ as bb,p5 as cb,A9 as db,y1 as eb,G$ as fb,dZ as gb,sZ as hb,W$ as ib,U7 as jb,OY as kb,DY as lb,Z4 as mb,j7 as nb,X4 as ob,J4 as pb,E7 as qb,_Y as rb,AY as sb};
+`);v6(Z,J,{mode:384});let G=!1;return{command:"/usr/bin/sandbox-exec",args:["-f",Z,$.nodeExecutable,...$.nodeArgs],cwd:$.workRoot,env:{...$.environment,TMPDIR:Q},async cleanup(){if(G)return;G=!0,y6(Q,{recursive:!0,force:!0})}}}async function i6($){let Q=g6($.workRoot),Z=$.nodeExecutable??s6(),X=["--max-old-space-size=512","--permission",`--allow-fs-read=${Q}`,`--allow-fs-write=${Q}`,"-e",l6],J=G8({home:Q,temporaryDirectory:Q}),G=$.platformName??d6();if(G==="linux")return{command:Z,args:X,cwd:Q,env:J,async cleanup(){}};if(G==="darwin")return n6({nodeExecutable:Z,nodeArgs:X,workRoot:Q,environment:J});throw Error("hands_node_repl_platform_unsupported")}async function I9($){let Q;try{await Promise.race([$,new Promise((Z,X)=>{Q=setTimeout(()=>X(Error("hands_node_repl_child_cleanup_timeout")),u6)})])}finally{clearTimeout(Q)}}async function hZ($){if($.executionMode!=="single-evaluation")throw Error(qZ);let Q=await i6($),Z;try{Z=k6(Q.command,Q.args,{cwd:Q.cwd,env:Q.env,stdio:["pipe","pipe","pipe"]})}catch(q){throw await Q.cleanup(),q}let X=new Promise((q)=>Z.once("close",()=>q())),J;Z.once("error",(q)=>{J=q});let G=!1,z=!1,H="";Z.stderr.setEncoding("utf8"),Z.stderr.on("data",(q)=>{H=`${H}${q}`.slice(-16384)});let Y=Z.stdout,V,U=(q,D,x)=>{if(x)q.failure??=x;if(q.finishing)return;q.finishing=!0,z=!0,Z.kill("SIGKILL"),I9(X).then(()=>{if(q.failure)q.reject(q.failure);else q.resolve(D??{})},(b)=>q.reject(b))},F=()=>{if(z=!0,V)U(V,void 0,Error("hands_node_repl_state_lost"));else Z.kill("SIGKILL")},K="";Y?.setEncoding("utf8"),Y?.on("data",(q)=>{if(V?.finishing||z)return;if(K+=q,K.length>yZ){F();return}while(!0){let D=K.indexOf(`
+`);if(D===-1)return;let x=K.slice(0,D);K=K.slice(D+1);let b=V;if(!b){F();return}try{let T=JSON.parse(x);if(b.action==="probe")b.resolve(T);else{U(b,T);return}}catch{U(b,void 0,Error("invalid_hands_node_repl_child_response"));return}}});let L=(q)=>{let D=H.trim(),x=q??Error(D?`hands_node_repl_child_exited:${D}`:"hands_node_repl_child_exited");if(z=!0,V&&!V.finishing)U(V,void 0,x)};Z.once("error",L),Z.once("close",()=>L()),Z.stdin.on("error",L);let B=(q)=>new Promise((D,x)=>{if(G||z||Z.exitCode!==null||Z.signalCode!==null){x(Error(z?"hands_node_repl_state_lost":"hands_node_repl_stopped"));return}let b=setTimeout(F,q.action==="probe"?1e4:Math.max(1,Math.min($.evaluationTimeoutMs??Y$-1000,Y$-1000))),T={action:q.action,finishing:!1,resolve(k){if(V===T)V=void 0;clearTimeout(b),D(k)},reject(k){if(V===T)V=void 0;clearTimeout(b),x(k)}};V=T,Z.stdin.write(`${JSON.stringify(q)}
+`,(k)=>{if(!k)return;U(T,void 0,k)})});try{if(!Y){if(Z.pid===void 0)await I9(X);throw J??Error("hands_node_repl_control_pipe_missing")}let q=await B({action:"probe"});if(q.ok!==!0||q.output!=="ARA_HANDS_REPL_READY")throw Error("hands_node_repl_probe_failed")}catch(q){G=!0,Z.kill("SIGKILL");try{await I9(X)}finally{await Q.cleanup()}throw q}let W=Promise.resolve(),M=new Set;X$($.socketPath);let _=c6.createServer((q)=>{M.add(q),q.once("close",()=>M.delete(q)),q.setEncoding("utf8");let D="",x=!1,b=!1;q.once("close",()=>{if(b)F()}),q.on("error",()=>q.destroy()),q.on("data",(T)=>{if(x)return;if(D+=T,D.length>yZ){x=!0,Y8(q,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let k=D.indexOf(`
+`);if(k===-1)return;x=!0;let g=D.slice(0,k);W=W.then(async()=>{if(q.destroyed)return;try{let O=JSON.parse(g);if(O.action!=="evaluate"||typeof O.code!=="string")throw Error("Invalid REPL request");b=!0;let N=await B({action:"evaluate",code:O.code});if(b=!1,N.ok!==!0||typeof N.output!=="string")throw Error(typeof N.error==="string"?N.error:"hands_node_repl_failed");Y8(q,{ok:!0,output:N.output})}catch(O){b=!1,Y8(q,{ok:!1,error:O instanceof Error?O.message:String(O),stack:O instanceof Error?O.stack:void 0})}}).catch((O)=>{Y8(q,{ok:!1,error:O instanceof Error?O.message:String(O)})})})});try{await new Promise((q,D)=>{_.once("error",D),_.listen($.socketPath,()=>{_.off("error",D);try{f6($.socketPath,384),q()}catch(x){_.close(()=>D(x))}})})}catch(q){G=!0,Z.kill("SIGKILL");try{await I9(X)}finally{await Q.cleanup(),X$($.socketPath)}throw q}return{socketPath:$.socketPath,async stop(){if(G)return;G=!0;let q=new Promise((D)=>_.close(()=>D()));for(let D of M)D.destroy();await q,W.catch(()=>{return}),F();try{await I9(X)}finally{await Q.cleanup(),X$($.socketPath)}}}}var G$=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var vZ="/workspace",cZ="/var/lib/reason/sessions",a6="/var/lib/reason/session-controls";function dZ($){let Q=`${cZ}/`;if(!$.startsWith(Q))return null;let Z=$.slice(Q.length);if(!G$.test(Z)||Z!==Z.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${a6}/${Z}/job.env`}function o6($){if(!G$.test($))throw Error("personal_computer_invalid_identity");return $.toLowerCase()}function z8($){let Q=o6($);return{runtimeRoot:`${cZ}/${Q}`,workspaceRoot:`${vZ}/sessions/${Q}`,sharedRoot:vZ}}var pZ="/root/.ara/cloud-browser/repl.sock";function z$($){return $==="compute"}function uZ($,Q,Z="linux"){if($)z8($);if(Z!=="linux")throw Error("cloud_browser_os_invalid");if(Q!==void 0&&(!$||!/^[1-9][0-9]{0,18}$/.test(Q)))throw Error("cloud_browser_generation_invalid");let X=$?`/var/lib/reason/browsers/${$.toLowerCase()}`:"/root/.ara/cloud-browser",J=$?`${X}/${Q?`g${Q}`:"current"}`:X,G=$?`/root/.b/${$.toLowerCase().replaceAll("-","")}`:X;return{temporarySessionDirectory:G,temporaryDirectory:$?`${G}/${Q??"current"}`:`${J}/tmp`,directory:J,sessionDirectory:X,config:`${J}/config.json`,status:`${J}/status.json`,socket:`${J}/repl.sock`,bundle:`${J}/driver.mjs`,processName:$?`ara-browser-${$.toLowerCase()}${Q?`-${Q}`:""}`:"ara-cloud-browser"}}var H$="browser_egress",lZ=FQ,H7=45000,V7=c9+1500,k0=/^[A-Za-z0-9._:-]{1,160}$/,F7="/run/ara-hands";function U7($,Q,Z=eZ()){if($==="darwin")return{temporaryRoot:Z,prepareRoot:!1,sessionMode:448};return{temporaryRoot:Q??F7,prepareRoot:!0,sessionMode:457}}function sZ($,Q=process.platform,Z=process.geteuid?.()){return $===!0&&Q==="linux"&&Z===0}function U$($=aZ(),Q=process.platform,Z=process.geteuid?.()){return $&&Q==="linux"&&Z===0?{uid:$.uid,gid:$.gid,home:$.home,username:$.username}:null}function W7($=U$(),Q=MZ){return $&&Q()?a8:null}function OY($=U$(),Q=process.platform,Z=process.geteuid?.()){return Q!=="linux"||Z!==0||$!==null}function DY($=process.platform,Q=process.geteuid?.()){return $!=="linux"||Q!==0}function B7($,Q){if(!Q&&($??"linux")==="linux")return pZ;return uZ(Q,void 0,$??"linux").socket}function L7($){return $[W0]===!0?"sandbox_loopback":"ara_device_wss"}function V9($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function Q4($){let Q=$.toLowerCase().replace(/^\[|\]$/g,"");return Q==="localhost"||Q.endsWith(".localhost")||Q==="::1"||Q==="0:0:0:0:0:0:0:1"||Q==="0.0.0.0"||Q.startsWith("127.")}class Z4 extends C{expiryDiagnostic;constructor($){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=$}}function N7($){return V9($)&&Object.keys($).every((Q)=>Q==="source_path"||Q==="branch")&&($.source_path===void 0||p0($.source_path))&&typeof $.branch==="string"&&t8.test($.branch)}function M7($,Q,Z){let X=Q===void 0?Date.now():Q,J=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],G=new Set([...J,"workspace_id","legacy_workspace_id",l0,s0,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",p,W0,H$,z9,N0,n0,b0]),z=V9($)?$:null,H=z?.[H$],Y=z?.[z9],V=z?.[n0],U=H===void 0||(z?.[p]===w0||V===R9&&z?.[p]===void 0)&&V9(H)&&Object.keys(H).every((q)=>q==="mode"||q==="allowed_domains")&&H.mode==="enforce"&&Array.isArray(H.allowed_domains)&&H.allowed_domains.length<=256&&H.allowed_domains.every((q)=>typeof q==="string"&&y8(q));if(!V9($)||J.some((q)=>!(q in $))||Object.keys($).some((q)=>!G.has(q))||!U||V!==void 0&&V!==R9||z?.[b0]!==void 0&&z[b0]!==V8||z?.personal_workspace!==void 0&&(z.personal_workspace!==!0||z[p]!==w0)||z?.cloud_browser!==void 0&&(z.cloud_browser!==!0||z[p]!==w0)||z?.sandbox_provider!==void 0&&!z$(z.sandbox_provider)||z?.sandbox_os!==void 0&&z.sandbox_os!=="linux"||Y!==void 0&&(z?.[p]!==G9||!o8(Y))||p in $&&$[p]!==w0&&$[p]!==G9&&$[p]!==U0||W0 in $&&$[W0]!==!0||$.workspace_path!==void 0&&(!p0($.workspace_path)||$[p]!==U0)||$.workspace_worktree!==void 0&&($.workspace_path===void 0||!N7($.workspace_worktree))||typeof $.relay_url!=="string"||typeof $.session_id!=="string"||!k0.test($.session_id)||$.workspace_id!==void 0&&(typeof $.workspace_id!=="string"||!k0.test($.workspace_id))||$.legacy_workspace_id!==void 0&&(typeof $.legacy_workspace_id!=="string"||!k0.test($.legacy_workspace_id))||$[l0]!==void 0&&($[l0]!==F8||(p in $))||$[s0]!==void 0&&($[s0]!==U8||(p in $))||$[N0]!==void 0&&(typeof $[N0]!=="string"||!k0.test($[N0]))||typeof $.environment_id!=="string"||!k0.test($.environment_id)||typeof $.expires_at!=="string"||$.policy_mode!=="full_access"||$.policy_version!==1||$.hands_protocol_version!==F9||$.hands_worker_version!==U9||$.hands_worker_artifact_sha256!==z0||!wZ($.hands_worker_entrypoint)||!I0($.target_generation)||!j0($.target_fence_id))throw new C("invalid_hands_payload","Reason Hands connection payload is invalid.");let F;try{F=new URL($.relay_url)}catch{throw new C("invalid_hands_relay","Reason Hands relay URL is invalid.")}let K=$[W0]===!0,L=Q4(F.hostname);if((K?F.protocol!=="ws:"||!L:L?F.protocol!=="ws:":F.protocol!=="wss:")||F.username||F.password||F.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(F.pathname))throw new C("invalid_hands_relay","Reason Hands relay URL is not allowed.");let B=Date.parse($.expires_at),W=Number.isNaN(B)?"parse":new Date(B).toISOString()!==$.expires_at?"noncanonical":B<=X?"expired":B-X>lZ?"over_cap":"accepted",M={version:1,outcome:W,clock_source:Q===void 0?"date_now":"injected",validation_now_ms:$9(X),expiry_ms:$9(B),remaining_ms:Number.isSafeInteger(B-X)?B-X:null,maximum_lifetime_ms:lZ,cli_artifact:bZ()};if(W!=="accepted")throw new Z4(M);try{Z?.(M)}catch{}let _=$.environment_binding===void 0?void 0:E8.safeParse($.environment_binding);if(_&&!_.success)throw new C("invalid_hands_request","Reason Hands environment binding is invalid.");return{...$.cloud_browser===!0?{cloud_browser:!0}:{},...z$($.sandbox_provider)?{sandbox_provider:$.sandbox_provider}:{},...$.sandbox_os==="linux"?{sandbox_os:$.sandbox_os}:{},...$.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:F.toString(),..._?.success?{environment_binding:_.data}:{},session_id:$.session_id,...$.workspace_id===void 0?{}:{workspace_id:$.workspace_id},...$.legacy_workspace_id===void 0?{}:{legacy_workspace_id:$.legacy_workspace_id},...$[l0]===F8?{[l0]:F8}:{},...$[s0]===U8?{[s0]:U8}:{},...typeof $[N0]==="string"?{[N0]:$[N0]}:{},...$[n0]===R9?{[n0]:R9}:{},...$[b0]===V8?{[b0]:V8}:{},...typeof $.workspace_path==="string"?{workspace_path:$.workspace_path}:{},...V9($.workspace_worktree)?{workspace_worktree:{...typeof $.workspace_worktree.source_path==="string"?{source_path:$.workspace_worktree.source_path}:{},branch:String($.workspace_worktree.branch)}}:{},environment_id:$.environment_id,expires_at:$.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:F9,hands_worker_version:U9,hands_worker_artifact_sha256:z0,hands_worker_entrypoint:u0,target_generation:$.target_generation,target_fence_id:$.target_fence_id,...p in $?{[p]:$[p]}:{},...K?{[W0]:!0}:{},...Y===void 0?{}:{[z9]:Y},...H===void 0?{}:{[H$]:{mode:"enforce",allowed_domains:[...new Set(H.allowed_domains)].sort()}}}}function j7(){let $=new Map;return{acquire(Q,Z){if($.has(Q))return null;let X=[...$.values()],J=(z)=>Z.group!==void 0&&z.group===Z.group;if(Z.exclusive?!X.every(J):X.some((z)=>z.exclusive))return null;if(Z.limit!==void 0&&!X.some(J)&&new Set(X.map((z,H)=>z.group??H)).size>=Z.limit)return null;$.set(Q,Z);let G=!1;return()=>{if(G)return;G=!0,$.delete(Q)}},activeOwners:()=>[...$.keys()]}}var C7=j7();function q7($,Q){W9($,{recursive:!0,mode:448});let Z=n($),X=()=>new C("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let z of Q.split("/")){let H=o(Z,z);try{let V=t(H);if(V.isSymbolicLink()||!V.isDirectory())throw X()}catch(V){if(!(V&&typeof V==="object"&&("code"in V)&&V.code==="ENOENT"))throw V;try{W9(H,{mode:448})}catch(U){if(!(U&&typeof U==="object"&&("code"in U)&&U.code==="EEXIST"))throw U}}let Y=t(H);if(Y.isSymbolicLink()||!Y.isDirectory()||n(H)!==H)throw X();Z=H}let J=t(Z),G=X7(Z,K$.O_RDONLY|K$.O_DIRECTORY|K$.O_NOFOLLOW);try{let z=Z7(G);if(!z.isDirectory()||z.dev!==J.dev||z.ino!==J.ino||n(Z)!==Z)throw X();Q7(G,448)}finally{$7(G)}return Z}function T7($,Q=iZ(),Z,X,J){if(!k0.test($)||Z!==void 0&&!k0.test(Z))throw new C("invalid_hands_workspace","Reason Hands run identity is invalid.");let G=K0(v0({kind:"managed",workspaceId:$,...X?{base:X}:{},...J?{layout:J}:{}})),z=q7(Q,K0(G)),H=o(z,K7(G)),Y=!1;try{let K=t(H);if(Y=!0,K.isSymbolicLink())throw new C("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}if(J&&!Y)try{let K=o(n(Q),K0(v0({kind:"managed",workspaceId:$,...X?{base:X}:{}}))),L=t(K);if(!L.isSymbolicLink()&&L.isDirectory()&&n(K)===K)K8(K,H),Y=!0}catch{}if(Z&&Z!==$){let K=o(z,Z);try{let L=t(K);if(L.isSymbolicLink()||!L.isDirectory())throw new C("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let B=n(K);if(K0(B)!==z)throw new C("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let W=null;if(Y){W=o(z,`.${$}.previous`);try{throw t(W),new C("invalid_hands_workspace","Reason Hands previous workspace backup already exists.")}catch(M){if(M instanceof C||!(M&&typeof M==="object"&&("code"in M)&&M.code==="ENOENT"))throw M}K8(H,W)}try{K8(B,H)}catch(M){if(W)K8(W,H);throw M}Y=!0}catch(L){if(L instanceof C||!(L&&typeof L==="object"&&("code"in L)&&L.code==="ENOENT"))throw L}}W9(H,{recursive:!0,mode:448}),E9(H,448);let V=n(H);if(K0(V)!==z)throw new C("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let U=o(V,"repo");try{let K=t(U);if(K.isSymbolicLink()||!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}W9(U,{recursive:!0,mode:448}),E9(U,448);let F=n(U);if(K0(F)!==V)throw new C("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:V,repoPath:F}}function X4($){let Q=null;try{Q=t($)}catch{}if(!Q||Q.isSymbolicLink()||!Q.isDirectory()||Q.uid!==0||Q.gid!==0||(Q.mode&4095)!==493)throw new C("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function O7($,Q){let Z="/";for(let X of["",...$.split("/"),...Q.split("/")].filter((J,G)=>G===0||J)){if(X)Z=o(Z,X);let J;try{J=t(Z)}catch{return null}if(J.uid!==0)return J.uid;if((J.mode&2)!==0&&(J.mode&512)===0&&!J.isSymbolicLink())return-1;if(J.isSymbolicLink()||!J.isDirectory())return null}return null}function D7($,Q,Z,X=process.geteuid?.(),J){if(!k0.test(Q))return null;let G,z;try{G=n($),z=K0(v0({kind:"managed",workspaceId:Q,...Z?{base:Z}:{},...J?{layout:J}:{}}))}catch{return null}let H=o(G,z),Y=F$(H)!==null,V=(B)=>new C("cloud_workspace_root_invalid",B),U;if(X===0){let B=O7(G,z);if(B===null)return null;if(!Y)throw new C("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");U=B}else{if(!Y)return null;let B,W;try{B=t(K0(H)),W=t(H)}catch{return null}if(B.isSymbolicLink()||!B.isDirectory()||B.uid===0||W.uid!==0)return null;U=B.uid}let F=G;for(let B of z.split("/")){let W=o(F,B),M=!1;try{let _=t(W);M=!_.isSymbolicLink()&&_.isDirectory()&&n(W)===W}catch{}if(!M)throw V("This cloud Session's workspace root is missing or is not a real directory.");F=W}X4(H);let K;try{K=J4(H)}catch(B){if(B instanceof C)throw B;throw V("This cloud Session's workspace root changed while Reason Hands checked it.")}let L=null;try{L=S9(K.repoPath).uid}catch{}if(L!==U)throw new C("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return K}function J4($,Q=!1){let Z=n($),X=o(Z,"repo"),J;try{J=t(X)}catch{throw new C("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(Q){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(Z))throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");if(z8(Z.slice(Z.lastIndexOf("/")+1)).runtimeRoot!==Z)throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");let H=n("/workspace"),Y=n(X);if(H!=="/workspace"||!S9(Y).isDirectory()||!Y.startsWith("/workspace/"))throw new C("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:Z,repoPath:Y}}let G=jZ(Z);if(G&&J.isSymbolicLink()){let H=n(X);if(H!==n(G)||!S9(H).isDirectory())throw new C("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:Z,repoPath:H}}if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let z=n(X);if(K0(z)!==Z)throw new C("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:Z,repoPath:z}}function W$($,Q,Z){if(Q!==void 0&&!p0(Q))throw new C("invalid_hands_workspace",`Reason Hands ${Z} is invalid.`);let X=$4($,Q??".");if(!R0($,X))throw new C("invalid_hands_workspace",`Reason Hands ${Z} escapes its granted root.`);return X}function Y4($,Q,Z){if(r8(Q)){let X=n(Z);return{anchor:X,target:$4(X,Q),boundary:o(X,K9)}}return{anchor:$,target:W$($,Q,"folder"),boundary:$}}function _7($,Q){if(!R0($,Q))throw new C("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let Z=$;for(let X of Q.slice($.length).split("/").filter(Boolean)){Z=o(Z,X);let J=null;try{J=t(Z)}catch(G){if(G.code!=="ENOENT")throw G}if(!J)W9(Z,{mode:448});else if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function G4($,Q){let Z=n(W$($,Q.source_path,"repository"));if(!R0($,Z)||!S9(Z).isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return Z}async function A7($,Q,Z,X=W8()){try{let J=n($);if(V$(Y4(J,Q,X).target))return;return await _Z(G4(J,Z))??void 0}catch{return}}function x7($,Q,Z,X,J=P7,G=W8()){let z=n($),{target:H,boundary:Y,anchor:V}=Y4(z,Q,G);if(Z&&!V$(H)){let K=G4(z,Z);_7(V,K0(H));let L=["-c","core.hooksPath=/dev/null","-C",K];if(X)J([...L,"update-ref","--create-reflog","-m",X.note,`refs/heads/${Z.branch}`,X.commit,""]);let B=X?J([...L,"worktree","add",H,Z.branch]):J([...L,"worktree","add","-b",Z.branch,H]);if(!X&&B.status!==0&&/already exists/.test(B.stderr)&&!V$(H))B=J([...L,"worktree","add",H,Z.branch]);if(B.status!==0)throw new C(/not a git repository/i.test(B.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let U;try{U=t(H)}catch{throw new C("workspace_folder_missing","This Session's folder no longer exists.")}let F=n(H);if(U.isSymbolicLink()&&!R0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!S9(F).isDirectory()||!R0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(E0(F))throw new C("protected_path","Credential and secret folders are unavailable to Sessions.");return F}function P7($){let Q=e6("git",$,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:Q.status,stderr:Q.stderr??""}}function z4($){return dZ($)??F$($)?.jobEnv??o($,"job.env")}function I7($,Q){let Z=z4($),X=t(Z);if(X.isSymbolicLink()||!X.isFile())throw new C("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");J7(Z,Q),E9(Q,384)}function R7($){if($.workspaceMode===U0&&$.workspacePath!==void 0){let z=$.home??W8(),H=x7($.grantedRoot,$.workspacePath,$.workspaceWorktree,$.workspaceWorktreeStart,void 0,z);if($.workspaceWorktree&&$.deviceId)IZ(z,$.workspacePath,$.deviceId);return{workRoot:H,repoPath:H,workspace:{kind:"root",path:$.workspacePath},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if($.workspaceMode===w0)return{...J4($.grantedRoot,$.personalWorkspace),workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if($.workspaceMode===G9||$.workspaceMode===U0){let z=t($.grantedRoot);if(z.isSymbolicLink()||!z.isDirectory())throw new C("invalid_hands_workspace","Reason Hands root must be a real directory.");let H=n($.grantedRoot);return{workRoot:H,repoPath:H,workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let Q=$.workspaceId??$.runId,Z={kind:"managed",workspaceId:Q,...$.workspaceBase?{base:$.workspaceBase}:{},...$.workspaceLayout?{layout:$.workspaceLayout}:{}},X=p9($.grantedRoot,Z,$.home).anchor,J=D7(X,Q,$.workspaceBase,void 0,$.workspaceLayout);if(J)return{...J,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let G=T7(Q,X,$.legacyWorkspaceId,$.workspaceBase,$.workspaceLayout);return{...G,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:K0(G.workRoot),managedWorkspace:!0}}function E7($){let{command:Q,prefix:Z}=S8($.executablePath,$.sourceEntrypoint),X=G8({home:z7(),temporaryDirectory:$.temporaryDirectory,path:$.path});if(X.REASON_DEVICE_ROOT=X.ARA_DEVICE_ROOT=$.grantedRoot,X.REASON_HANDS_WORKSPACE=X.ARA_HANDS_WORKSPACE=$.workRoot,X.REASON_HANDS_REPO=X.ARA_HANDS_REPO=$.root,$.workspacePoolPath)X.REASON_HANDS_WORKSPACE_POOL=X.ARA_HANDS_WORKSPACE_POOL=$.workspacePoolPath;return{command:Q,args:[...Z,"__device","__hands-worker","--config",$.configPath],options:{cwd:$.root,env:X,shell:!1,stdio:["ignore","ignore","pipe"]}}}function S7($,Q){let Z="",X=!1,J=Date.now(),G=0,z=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped"].map((F)=>`hands.worker.${F}`)),H=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed"]),Y=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],V=["peerGeneration","socketState","closeCode"],U=new Set(["event","reason","launchId",...Y,...V]);return(F)=>{for(let K of F.toString().split(/(?<=\n)/)){let L=K.endsWith(`
+`);if(!X&&Z.length+K.length<=2048)Z+=K;else X=!0;if(!L)continue;let B=Z;if(Z="",X){X=!1;continue}try{let W=JSON.parse(B);if(!W||typeof W!=="object"||Array.isArray(W)||Object.keys(W).some((M)=>!U.has(M))||!z.has(W.event)||!H.has(W.reason)||W.launchId!==$||Y.some((M)=>!Number.isSafeInteger(W[M])||W[M]<0)||V.some((M)=>W[M]!==null&&(!Number.isSafeInteger(W[M])||W[M]<0)))continue;if(Date.now()-J>=60000)J=Date.now(),G=0;if(G>=122)continue;G+=1,Q(W)}catch{}}}}async function w7($){let Q=$.now()+$.timeoutMs;while($.now()<Q){if($.signal.aborted)throw new C("cancelled","Reason Hands start was cancelled.");if($.spawnFailed?.()||$.child.exitCode!==null||$.child.signalCode!==null)throw new C("hands_worker_exited","Reason Hands exited before ready.");let Z=J8($.path,{pid:$.child.pid??-1,launchId:$.launchId,workerVersion:U9,protocolVersion:F9,workerArtifactSha256:z0,workerEntrypoint:u0});if(Z?.targetGeneration===$.targetGeneration&&Z.fenceId===$.fenceId)return Z;await new Promise((X)=>setTimeout(X,10))}throw new C("hands_ready_timeout","Reason Hands did not become ready.")}async function b7($,Q){let Z=()=>$.exitCode===0&&$.signalCode===null;if($.exitCode!==null||$.signalCode!==null)return Z()?"stopped":"already_exited";let X=new Promise((z)=>$.once("exit",()=>z()));try{if(!$.kill("SIGTERM"))return Z()?"stopped":"unobserved"}catch{return Z()?"stopped":"unobserved"}if(await nZ(X,Q))return Z()?"stopped":"unobserved";try{$.kill("SIGKILL")}catch{}return await nZ(X,Q)?"forced":"unobserved"}async function nZ($,Q){let Z;try{return await Promise.race([$.then(()=>!0),new Promise((X)=>{Z=setTimeout(()=>X(!1),Q)})])}finally{clearTimeout(Z)}}function k7($){return new Promise((Q)=>{let Z=!1,X=(H)=>{if(Z)return;Z=!0,clearTimeout(z),$.signal.removeEventListener("abort",J),$.child.off("exit",G),Q(H)},J=()=>X("cancelled"),G=()=>X("exited"),z=setTimeout(()=>X("expired"),Math.max(0,$.expiresAt-$.now()));if($.signal.addEventListener("abort",J,{once:!0}),$.child.once("exit",G),$.signal.aborted)J();else if($.child.exitCode!==null||$.child.signalCode!==null)G()})}var K4=tZ();function f7($,Q){if(!($ instanceof Error)||$ instanceof C)return!1;let Z=["hands_browser_driver_missing","hands_browser_driver_version_mismatch","hands_browser_executable_missing","hands_browser_unsupported_platform","hands_browser_unavailable"].includes($.message),X=["ENOENT","EACCES","EPERM"].includes($.code??"");if(!Z&&!X)return!1;try{return t(Q),!1}catch(J){return V9(J)&&J.code==="ENOENT"}}function m7($){return $.sandbox_provider==="compute"&&!$.cloud_browser&&!$[W0]&&$[p]===w0}function g7($,Q,Z){return $===void 0?{}:{dispatch_stages:{version:1,claim_to_entered_ms:H0($,Q),...Z===void 0?{}:{worker_prespawned:Z}}}}function _Y(){K4().catch(()=>{return}),X9().catch(()=>{return})}async function AY($,Q={}){let Z=Q.logDiagnostic??((N)=>console.warn(N)),X=new Map,J=(N)=>{let j=Date.now();X.set(N,j);try{Z(JSON.stringify({event:"sandbox.hands_startup",stage:N,timestampMs:j}))}catch{}};J("entered");let G=$.claimEnvironment;$.claimEnvironment=void 0;let z=Q.now??Date.now,H,Y=M7($.payload,Q.now?.(),(N)=>{H=N});if($.managedPty&&($.managedPty.version!==1||!$.headless||!$.runtimeDirectory||![void 0,!0].includes($.managedPty.startupVerified)||!$.deviceIdentity||!$.claimOwner||$.claimOwner.device_id!==$.deviceIdentity.deviceId||!Y.environment_binding||!["darwin","linux"].includes(process.platform)))throw new C("pty_unsupported","Bound PTY requires qualified headless Hands with private jobs and environment.");let V=async(N)=>{let j;try{await Promise.race([N,new Promise((A,m)=>{j=setTimeout(()=>m(new C("hands_event_delivery_unavailable","Hands event delivery did not settle within its deadline.")),Math.max(1,Math.min(Q.eventDeliveryTimeoutMs??5000,5000)))})])}finally{clearTimeout(j)}},U=async(N,j)=>V($.emitEvent(N,j));if($.headless&&(Y.cloud_browser===!0||$.managedBrowser!==void 0||Y[W0]!==void 0||Y[z9]!==void 0||Y[p]!==void 0&&Y[p]!==U0))throw new C("invalid_hands_request","Managed sandbox extensions are unavailable to a headless worker.");let F=U$(),K=Y[b0]===void 0?null:W7(F);if(Y[b0]!==void 0&&(K===null||!$.headless||!sZ($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_model_jobs_egress_unavailable","This worker cannot hold its jobs to the guest egress guard; the Hands did not start.");if(Y[n0]!==void 0&&!($.headless&&sZ($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_confinement_unavailable","Confined Hands need a root Linux worker in host mode.");if(Y.cloud_browser&&process.platform!=="linux")throw new C("cloud_browser_target_invalid","Cloud browser is available only on a cloud machine.");let L=`${$.operationId}:${$.attemptId}`,B=Y[p]===G9,W=$.headless||process.platform==="darwin"&&$.managedBrowser===void 0&&!Y.cloud_browser&&!Y.browser_egress&&!Y[W0]&&(Y[p]===void 0||Y[p]===U0)||m7(Y),M=B?Y[z9]??"bash":null,_=M?TZ(M):null;if(_)throw new C(_,"Persistent Node REPL execution is unavailable; this benchmark profile cannot start.");let q=Y[p],D=$.headless===!0?$.handsSlots??1:void 0,x=(Q.slot??C7).acquire(L,{exclusive:D===1||q!==void 0&&q!==U0,...D!==void 0&&D>1?{limit:D}:{},...$.headless===!0&&Y[N0]!==void 0?{group:Y[N0]}:{}});if(!x)throw new C("hands_slot_busy",D!==void 0&&D>1?`This Reason worker runs at most ${D} sessions at a time.`:"This Reason Device runs one session at a time.");let b=$.headless===!0?oZ($.runId):null,T=null,k=null,g,O;try{J("browser_resolution");let N=$.headless&&Q.browserExecutablePath===void 0?await X9():null,j=B||Y.cloud_browser?null:Q.browserExecutablePath===void 0?$.headless?N?.status==="resolved"?N.executablePath:null:await BZ(void 0,process.platform,$.managedBrowser):Q.browserExecutablePath;if(!B&&!Y.cloud_browser&&!W&&!j)throw new C("hands_browser_unavailable","Reason Hands requires Chrome, Edge, Brave, Chromium, or a Playwright Chromium install.");J("path_resolution");let A;try{A=await(Q.resolvePathEnvironment??K4)()}catch{A={path:rZ(),source:"fallback"}}if(J("workspace_setup"),process.platform==="darwin"){let s=Y[p]===U0&&Y.workspace_path!==void 0?W$($.root,Y.workspace_worktree?Y.workspace_worktree.source_path:Y.workspace_path,"folder"):null;for(let Z0 of new Set([$.root,...s?[s]:[]]))await hQ(Z0)}let w=Y[p]===w0||Y[p]===G9?U7(process.platform,Q.sandboxRuntimeRoot):null,E=$.headless&&$.runtimeDirectory?$.runtimeDirectory:w?w.temporaryRoot:eZ();if(T="private_runtime",$.headless&&$.runtimeDirectory){T9(E);let s=n($.root);if(!_9(s,E))throw new C("invalid_hands_workspace","Private worker state must not overlap the granted workspace.")}if($.headless&&$.runtimeDirectory&&(!$.deviceIdentity||!Y.environment_binding))throw new C("environment_unavailable","Headless Hands requires a server-bound private environment.");if(T="runtime_root",w?.prepareRoot)W9(E,{recursive:!0,mode:457}),E9(E,457);T="temporary_directory";let P=n(Y7(o(E,"reason-hands-session-")));k=P,E9(P,w?.sessionMode??448);let f=o(P,"hands-config.json"),d=o(P,"hands-ready.json"),u=r6(),l=Y.target_fence_id;T="granted_root";let S=n($.root);T="workspace_layout";let h=Y[p]===U0&&Y.workspace_path!==void 0&&Y.workspace_worktree?await A7(S,Y.workspace_path,Y.workspace_worktree):void 0,{workRoot:c,repoPath:a,jobEnvPath:V0,workspacePoolPath:B8,managedWorkspace:D0,workspace:i0,cloudSessionRoot:w9}=R7({grantedRoot:S,personalWorkspace:Y.personal_workspace===!0,runId:$.runId,workspaceId:Y.workspace_id,legacyWorkspaceId:Y.legacy_workspace_id,workspaceBase:Y[l0],workspaceLayout:Y[s0],temporaryDirectory:P,workspaceMode:Y[p],applicationSupportPath:Q.applicationSupportPath,...Y.workspace_path===void 0?{}:{workspacePath:Y.workspace_path},...Y.workspace_worktree?{workspaceWorktree:Y.workspace_worktree}:{},...h?{workspaceWorktreeStart:h}:{},...$.deviceIdentity?{deviceId:$.deviceIdentity.deviceId}:{}}),f0=L7(Y);T="jobs";let r=$.headless&&$.runtimeDirectory?JQ({runtimeDirectory:$.runtimeDirectory,root:S,runId:$.runId}):void 0;g=r?.disposeSocket;let B0=r?YQ(r):null;if(B0)try{Z(JSON.stringify({event:"hands.journal_owner_retired",run_id:$.runId,reason:B0.reason,prior_executor_launch_id:B0.executorLaunchId}))}catch{}if(r&&[c,a].some((s)=>!_9(s,r.journalDirectory)))throw new C("invalid_hands_workspace","A Session can't work in the folder that holds this worker's settings; start it in a project or repository inside it.");let a0=Y.personal_workspace?c.slice(c.lastIndexOf("/")+1):void 0;if(a0&&a0!==Y.workspace_id)throw new C("invalid_hands_workspace","Personal session identity does not match its Device grant.");T="browser_socket";let F0=Y.cloud_browser?B7(Y.sandbox_os,a0):o(r?K0(r.socketPath):P,"repl.sock");T="relay_url";let L0=Q4(new URL(Y.relay_url).hostname),m0=f0==="ara_device_wss"&&!L0?(Q.loadProxy??w8)()?.url:void 0,Y0;T="environment_owner";let X0=$.headless&&$.deviceIdentity&&Y.environment_binding?EZ(P,{runId:$.runId,...$.deviceIdentity,binding:Y.environment_binding,expiresAtMs:Date.parse(Y.expires_at),identity:()=>Y0?.()??null}):void 0;T="job_environment";let B9=!X0&&i0.kind==="managed"&&D0?o(c,"job.env"):null;if(B9)try{H8(B9,"",{mode:384,flag:"wx"})}catch(s){if(!(s instanceof Error&&("code"in s)&&s.code==="EEXIST"))throw s}let L8={url:Y.relay_url,transport:f0,...m0===void 0?{}:{proxyUrl:m0},...$.localGithubConfinement?{localGithubConfinement:!0}:{},...Y[n0]&&X0?{gitCredentialEnvironment:!0}:{},workerVersion:U9,protocolVersion:F9,workerArtifactSha256:z0,workerEntrypoint:u0,targetGeneration:Y.target_generation,fenceId:l,workRoot:c,workspaceAliasPath:c,jobEnvPath:V0,...X0?{environmentSnapshotPath:X0.path,...$.hostExecution?{executionEnvironment:RQ()}:{},environmentExpectedBinding:{runId:$.runId,...$.deviceIdentity,binding:Y.environment_binding}}:B9?{jobEnvSourcePath:B9,workspacePoolPath:K0(c)}:D0?{}:{jobEnvSourcePath:z4(c)},repoPath:a,replSocketPath:F0,...Y.cloud_browser?{browserRunId:$.runId}:{},readyPath:d,launchId:u,expiresAtMs:Date.parse(Y.expires_at),bashTimeoutMs:300000,replTimeoutMs:120000,...r?{managedJobs:{journalDirectory:r.journalDirectory,scopeId:r.scopeId},jobControlSocketPath:r.socketPath}:{},...r&&F?{jobsUser:{...F,...K!==null?{modelGid:K}:{}}}:{},...$.managedPty&&r&&X0?{managedPty:{version:1,...$.managedPty.startupVerified===!0?{persistent:!0}:{},...process.platform==="darwin"?{shell:EQ()}:{}}}:{},...W&&!j?{allowedTools:["bash","read","write","edit"]}:B?{allowedTools:M==="bash"?["bash"]:["bash","repl"]}:{}};if(X0||D0&&!B9)H8(V0,"",{mode:384});else I7(c,V0);T="config_write",H8(f,JSON.stringify(L8),{mode:384}),T=null;let g0={session_id:Y.session_id,environment_id:Y.environment_id,hands_protocol_version:F9,hands_worker_version:U9,hands_worker_artifact_sha256:z0,hands_worker_entrypoint:u0,target_generation:Y.target_generation,target_fence_id:Y.target_fence_id,executor_launch_id:u},b9=null,B$=!1,L$=!1,N$,Q0=null,M$,j$,k9="failed",C$=null,N8=Promise.resolve(),q$=null,M8=async(s,Z0)=>{try{await U(s,Z0)}catch{}};try{J("event_started");let s,Z0=(async()=>{await $.emitEvent("hands.started",{...g0,policy_mode:"full_access",policy_version:1,path_source:A.source}),s=Date.now()})();Z0.catch(()=>{return}),J("worker_setup");let f9=Y.browser_egress?{mode:"enforce",allowedDomains:Y.browser_egress.allowed_domains}:{mode:"off"};if(M&&M!=="bash")b9=await(Q.startNodeRepl??hZ)({socketPath:F0,workRoot:c});else if(!B&&!Y.cloud_browser&&j)b9=await(Q.startRepl??LZ)({socketPath:F0,browserExecutablePath:j,workspaceRoot:a,...$.managedBrowser?{managedBrowser:$.managedBrowser}:{},...$.desktopRecording?{recording:$.desktopRecording}:{},networkPolicy:f9,onEgressDenied:(y)=>{let M0=CZ(y.host);Z(JSON.stringify({event:"sandbox.repl_egress_denied",destination_id:M0,reason:y.reason,run_id:$.runId})),N8=N8.then(()=>U("hands.browser_egress_denied",{destination_id:M0,reason:y.reason})).catch((V4)=>{q$??=V4})}}).catch((y)=>{if(!W||$.signal.aborted||z()>=Date.parse(Y.expires_at)||!f7(y,F0))throw y;return Object.assign(L8,{allowedTools:["bash","read","write","edit"]}),H8(f,JSON.stringify(L8),{mode:384}),L$=!0,null});let T$=E7({configPath:f,root:a,grantedRoot:S,workRoot:c,workspacePoolPath:B8,temporaryDirectory:P,path:A.path,executablePath:Q.executablePath,sourceEntrypoint:Q.sourceEntrypoint}),j8=Date.now(),C8,O$,q8=Q.takePrespawnedWorker?.(T$)??null;if(N$=Q.takePrespawnedWorker?q8!==null:void 0,Q0=q8??(Q.spawnWorker??((y)=>t6(y.command,y.args,y.options)))(T$),!q8)Q.adoptSpawnedWorker?.(Q0);Q0.stderr?.on("data",S7(u,(y)=>{if(y.event==="hands.worker.connecting")C8??=y.timestampMs;else if(y.event==="hands.worker.open")O$??=y.timestampMs;Z(JSON.stringify({...y,run_id:$.runId}))}));let D$=!1;Q0.on("error",()=>{D$=!0}),Q0.once("exit",(y,M0)=>{try{Z(JSON.stringify({event:"hands.worker.exited",run_id:$.runId,launchId:u,exit_code:y,exit_signal:M0}))}catch{}}),O=Q0,J("worker_ready_wait");let L9=await w7({path:d,launchId:u,fenceId:l,targetGeneration:Y.target_generation,child:Q0,spawnFailed:()=>D$,signal:$.signal,timeoutMs:Q.readyTimeoutMs??H7,now:z}),H4=Date.now();if(Y0=()=>{if(!Q0||Q0.exitCode!==null||Q0.signalCode!==null)return null;let y=J8(d,L9);return y?{generation:y.targetGeneration,fenceId:y.fenceId}:null},r){let y={root:S,runId:$.runId,operationId:$.operationId,scopeId:r.scopeId,socketPath:r.socketPath,generation:L9.targetGeneration,fenceId:L9.fenceId,executorLaunchId:u,expiresAtMs:Date.parse(Y.expires_at),readIdentity:Y0,workspace:i0,localGithubConfinement:$.localGithubConfinement===!0};if(X0)y.environment=X0;if($.claimOwner&&$.deviceIdentity&&$.claimOwner.device_id===$.deviceIdentity.deviceId){let M0=[$.deviceIdentity.apiOrigin,Y.relay_url];if(m0)M0.push(m0);y.previewAuthority={owner:Object.freeze({...$.claimOwner}),rootId:$.deviceIdentity.rootId,relayOrigin:new URL(Y.relay_url).origin,deniedPorts:y$(M0)}}j$=GQ(y)}if(await new Promise((y)=>{setImmediate(y)}),w9)X4(c);let m9;if(G&&X0){try{let y=X0.install(G);m9={snapshot_id:y.snapshot_id,installed_revision:y.installed_revision}}catch{}try{Z(JSON.stringify({event:"hands.environment_at_claim",run_id:$.runId,installed:m9!==void 0}))}catch{}}G=void 0,J("event_ready");let _$=V(Z0);_$.catch(()=>{return});let A$=Date.now();B$=!0,await U("hands.ready",{...g0,expiry_diagnostic:H,startup_stages:{version:1,browser_resolution_ms:H0(X.get("browser_resolution"),X.get("path_resolution")),path_resolution_ms:H0(X.get("path_resolution"),X.get("workspace_setup")),workspace_setup_ms:H0(X.get("workspace_setup"),X.get("event_started")),repl_setup_ms:H0(X.get("worker_setup"),j8),worker_boot_ms:H0(j8,C8),worker_dial_ms:H0(C8,O$),worker_ready_ms:H0(j8,H4),started_event_ms:H0(X.get("event_started"),s),started_join_wait_ms:H0(X.get("event_ready"),A$),total_ms:H0(X.get("entered"),A$)},...g7($.claimedAtMs,X.get("entered"),N$),...$.managedPty?.startupVerified===!0?{managed_pty:{version:1,execution_mode:"host",descendant_cleanup_verified:!0}}:{},policy_mode:"full_access",policy_version:1,path_source:A.source,connection_generation:L9.generation,...m9?{environment_installed:m9}:{},...W&&!b9?{browser_state:"unavailable",browser_reason_code:L$?"setup_failed":"not_resolved"}:{viewport_width:1440,viewport_height:900}}),await _$,J("ready"),M$=mZ({path:d,initial:L9,signal:$.signal,isAlive:()=>Q0!==null&&Q0.exitCode===null&&Q0.signalCode===null&&z()<Date.parse(Y.expires_at),publish:(y,M0)=>$.emitEvent("hands.reconnected",{...g0,target_generation:y.targetGeneration,target_fence_id:y.fenceId,connection_generation:y.generation},M0),failed:()=>Z(JSON.stringify({event:"hands.worker.generation_proof_failed",run_id:$.runId,executor_launch_id:u}))});let x$=await k7({child:Q0,signal:$.signal,expiresAt:Date.parse(Y.expires_at),now:z});if(x$==="cancelled"){let y=$.signal.reason instanceof C?$.signal.reason.code:"cancelled";throw k9=y,new C(y,"Reason Hands was cancelled.")}if(x$==="exited")throw new C("hands_worker_exited","Reason Hands exited unexpectedly.");return k9="expired",{...g0,policy_mode:"full_access",policy_version:1,ended:"expired"}}catch(s){C$=s;let Z0=s instanceof C?s.code:"hands_failed",f9=Z0==="cancelled"||["run_finished","run_cancelled","driver_handoff","driver_stopped"].includes(Z0);if(k9=f9?Z0:"failed",!f9)await M8("hands.failed",{...g0,reason_code:Z0});throw s}finally{M$?.stop(),j$?.();let s=Q0?await b7(Q0,Q.stopTimeoutMs??V7):null,Z0=!1;await $.desktopRecording?.close();try{await b9?.stop()}catch{Z0=!0}if(await N8,(s==="stopped"||s==="already_exited"&&!B$)&&!Z0)await M8("hands.stopped",{...g0,reason_code:k9});else if(s!==null||Z0){if(await M8("hands.failed",{...g0,reason_code:s==="forced"?"hands_stop_forced":"hands_stop_unconfirmed"}),C$===null||Z0)throw new C("hands_stop_unconfirmed","Reason Hands resource cleanup could not be proven.")}if(q$!==null)throw new C("hands_egress_audit_failed","Reason Hands could not persist a browser egress denial receipt.")}}catch(N){let j=NZ(T,N);if(j)try{Z(JSON.stringify({event:"sandbox.hands_workspace_failed",...j}))}catch{}throw N}finally{try{if(!O||O.exitCode!==null||O.signalCode!==null)g?.();if(k!==null&&(!O||O.exitCode!==null||O.signalCode!==null))G7(k,{recursive:!0,force:!0})}finally{b?.(),x()}}}
+export{v as ga,E$ as ha,S$ as ia,j4 as ja,f$ as ka,g$ as la,y$ as ma,H2 as na,JQ as oa,_2 as pa,A2 as qa,x2 as ra,P2 as sa,I2 as ta,R2 as ua,KQ as va,E2 as wa,w2 as xa,p as ya,U0 as za,OX as Aa,DX as Ba,hX as Ca,vX as Da,NQ as Ea,l9 as Fa,T9 as Ga,O9 as Ha,AQ as Ia,EZ as Ja,l2 as Ka,xQ as La,RQ as Ma,EQ as Na,M5 as Oa,j5 as Pa,J0 as Qa,C5 as Ra,q5 as Sa,T5 as Ta,E5 as Ua,u3 as Va,S5 as Wa,_9 as Xa,R0 as Ya,w5 as Za,X9 as _a,n3 as $a,i3 as ab,tQ as bb,p5 as cb,A9 as db,y1 as eb,G$ as fb,dZ as gb,sZ as hb,U$ as ib,W7 as jb,OY as kb,DY as lb,Z4 as mb,j7 as nb,X4 as ob,J4 as pb,E7 as qb,_Y as rb,AY as sb};