@reason-machines/cli-linux-arm64-musl 0.2.290 → 0.2.292

package/bin/vm-hands/vm-hands-entry-lite-pgzxf169.js

@@ -0,0 +1,459 @@
+// @bun
+import{Ab as B9,Bb as n0,Ib as K0,wb as BQ,xb as X8,yb as l9,zb as _0}from"./vm-hands-entry-lite-5rbj89cs.js";import{Qb as RQ,Rb as EQ,Sb as eZ,Tb as $4,Ub as z8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Bd as C0,Oc as r$,Rc as t$,ud as S9,vd as a0,wd as F8,xd as g0}from"./vm-hands-entry-lite-5zzey257.js";import{ae as x}from"./vm-hands-entry-lite-h7ndfgwc.js";import{Ke as gQ,Le as g8,Ze as kQ,df as n9,ef as b8}from"./vm-hands-entry-lite-zmf3vn3w.js";import{Af as P8,Df as d9,Lf as x8,Mf as S0,Nf as O0,Of as p9,Vf as E8,Wf as ZQ,Xf as n$,gf as BZ,jf as W9,sf as e$,tf as $Q,vf as QQ,xf as c9,yf as l$,zf as s$}from"./vm-hands-entry-lite-mysjgrwy.js";import{Xg as rZ}from"./vm-hands-entry-lite-cfjx91rj.js";import{Zg as B8,_g as u9,bh as aZ}from"./vm-hands-entry-lite-pr65ksfz.js";import{ch as U8,dh as i0,eh as W8,fh as o0,gh as H9,hh as Z8,ih as t8,jh as s0,kh as p0,lh as u$,wh as U$}from"./vm-hands-entry-lite-ngvxyjhy.js";import{Bh as GZ}from"./vm-hands-entry-lite-amhftpsq.js";import{Hh as tZ}from"./vm-hands-entry-lite-d94sv87n.js";import{Jh as C}from"./vm-hands-entry-lite-sn3vjjgx.js";import{Kh as D1,Nh as JZ}from"./vm-hands-entry-lite-a3n86qqm.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function y9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function P0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function R$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function E$($,Q){let Z=Buffer.from($,"latin1");return Buffer.concat([Buffer.from([Z.length]),Z,Q])}function I0($){if(!y9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(R$)||!P0($.attachmentRevision,0)||!P0($.grantRevision,1)||!P0($.generation,1)||!P0($.port,1024,65535)||!P0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function c0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function C9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function I$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function j9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function S$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function w$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!y9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello")return{type:"hello",binding:I0(Q.binding),...P0(Q.messages,v.chunk,v.upload)?{messages:Q.messages}:{},...P0(Q.window,1,v.window)?{window:Q.window}:{},...Q.bytes===!0?{bytes:!0}:{}};if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:I0(Q.binding),reason:Q.reason};if(!R$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return j9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&P0(Q.status,200,599)&&I$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&I$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return j9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:C9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function T8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((G)=>G.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function O8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function q9($){return await O8($)===!0}function h9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function b$($){if(!y9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:I0($.binding),deviceRelayUrl:h9($.deviceRelayUrl,"device")}}function k$($){if(!y9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:I0($.binding)}}import{request as N4}from"http";import{pipeline as M4}from"stream";import{constants as D8,createBrotliCompress as j4,createGzip as C4}from"zlib";import{WebSocket as T9}from"ws";import{randomBytes as W4,timingSafeEqual as B4}from"crypto";import{createServer as L4}from"net";var f$="x-preview-connection";async function g$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=W4(32).toString("base64url"),X=new Set,J=!1,G=L4((Y)=>{if(J||Q.aborted||X.size>=v.streams*2)return Y.destroy();X.add(Y);let H=new AbortController;Y.once("close",()=>{X.delete(Y),H.abort()}),Y.on("error",()=>Y.destroy()),Y.setTimeout(2000,()=>Y.destroy());let U=Buffer.alloc(0),F=(L)=>{U=Buffer.concat([U,L]);let B=U.indexOf(`\r
+\r
+`);if(B<0){if(U.length>16384)Y.destroy();return}if(Y.pause(),Y.off("data",F),B>16384||U.length>v.upload+16384)return Y.destroy();K(U,B).catch(()=>Y.destroy())};Y.on("data",F);async function K(L,B){let W=L.subarray(0,B).toString("latin1").split(`\r
+`),j=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(W.shift()??"");if(!j)throw Error("preview_request_invalid");C9(j[2]);let O=!1,q=0,_=[];for(let T of W){let k=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!k)throw Error("preview_header_invalid");if(k[1].toLowerCase()===f$){q++;let m=Buffer.from(k[2].trim());O=m.length===Z.length&&B4(m,Buffer.from(Z))}else if(k[1].toLowerCase()!=="host")_.push(T)}if(!O||q!==1||J||H.signal.aborted)throw Error("preview_connection_denied");let R=await $.connect(H.signal);if(J||H.signal.aborted)throw R.destroy(),Error("preview_closed");X.add(R),R.on("error",()=>Y.destroy()),R.once("close",()=>{X.delete(R),Y.destroy()}),Y.once("close",()=>R.destroy()),Y.setTimeout(0);let P=[`${j[1]} ${j[2]} HTTP/1.1`,`Host: 127.0.0.1:${R.remotePort}`,..._,"",""].join(`\r
+`);R.write(Buffer.concat([Buffer.from(P,"latin1"),L.subarray(B+4)])),R.pipe(Y),Y.pipe(R),Y.resume()}});await new Promise((Y,H)=>{G.once("error",H),G.listen(0,"127.0.0.1",Y)});let z=G.address();if(!z||typeof z==="string")throw G.close(),Error("preview_bind_failed");function V(){if(J)return;J=!0,Q.removeEventListener("abort",V);for(let Y of X)Y.destroy();X.clear(),G.close()}if(Q.addEventListener("abort",V,{once:!0}),Q.aborted)V();return{port:z.port,headers:{[f$]:Z},close:V}}var q4=60000,T4=1e4,O4=5000,D4=/^(?:text\/(?!event-stream)|application\/(?:(?:x-)?javascript|json|[a-z.+-]*\+json|xml|[a-z.+-]*\+xml|wasm)|image\/svg\+xml)/i;function _4($,Q,Z,X){let J=(Y)=>Q.find(([H])=>H.toLowerCase()===Y)?.[1],G=(Y)=>X.find(([H])=>H.toLowerCase()===Y)?.[1],z=Number(G("content-length")??Number.NaN);if($!=="GET"||Z!==200||J("range")!==void 0||G("content-encoding")!==void 0||!D4.test(G("content-type")??"")||/\bno-transform\b/i.test(G("cache-control")??"")||z<1024)return null;let V=(Y)=>new RegExp(`(?:^|,)\\s*${Y}\\s*(?:,|$|;\\s*q=(?:1|0?\\.0*[1-9]))`,"i").test(J("accept-encoding")??"");return V("br")?"br":V("gzip")?"gzip":null}function A4($,Q){let Z=$.filter(([X])=>X.toLowerCase()==="vary").map(([,X])=>X).join(", ");return[...$.filter(([X])=>!["vary","etag","content-md5"].includes(X.toLowerCase())),...$.filter(([X])=>X.toLowerCase()==="etag").map(([X,J])=>[X,J.startsWith("W/")?J:`W/${J}`]),["Content-Encoding",Q],["Vary",Z.split(",").some((X)=>/^\s*(?:accept-encoding|\*)\s*$/i.test(X))?Z:Z?`${Z}, Accept-Encoding`:"Accept-Encoding"]]}async function x4($){process.stderr.write(`${JSON.stringify({event:"worker_preview.open_refused",job_id:$.jobId,port:$.port,reason_code:$.reason})}
+`);let Q=$.binding,Z;try{Z=h9($.deviceRelayUrl,"device")}catch{return}if(!Q)return;await new Promise((X)=>{let J=new T9(Z,{followRedirects:!1,perMessageDeflate:!1,maxPayload:4096}),G=setTimeout(()=>{J.terminate(),X()},v.authorizationMs*2);J.addEventListener("open",()=>{J.send(JSON.stringify({type:"refused",binding:Q,reason:$.reason})),J.close(1000,`worker_refused_${$.reason}`)}),J.addEventListener("error",()=>{clearTimeout(G),X()}),J.addEventListener("close",()=>{clearTimeout(G),X()})})}async function P4($,Q){let Z=Date.now()+T4,X;for(;;){if(!Q())return"closed";let J=X??=$.refusal().finally(()=>{X=void 0}),G,z=await Promise.race([J.catch(()=>"port_unproved"),new Promise((V)=>{G=setTimeout(()=>V("port_check_timeout"),v.authorizationMs)})]).finally(()=>clearTimeout(G));if(z===null)return null;if(!["listener_unproved","port_check_timeout"].includes(z)||Date.now()+500>=Z)return z;await new Promise((V)=>setTimeout(V,500))}}async function m$($){let Q=I0($.binding),Z=()=>!$.signal.aborted&&Date.now()<Q.expiresAtMs,X=Q.expiresAtMs>Date.now()+v.lifetimeMs+O4?"binding_mismatch":await P4($.port,Z);if(X)throw await x4({deviceRelayUrl:$.deviceRelayUrl,binding:Q,jobId:Q.jobId,port:Q.port,reason:X}),Error("preview_not_authorized",{cause:X});let J=h9($.deviceRelayUrl,"device"),G=await g$($.port,$.signal),z;try{z=new T9(J,{followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload*1.4+300000})}catch(N){throw G.close(),N}let V=new Map,Y=!1,H=!1,U=0,F=!1,K,L,B,W=new Promise((N)=>{B=N}),j,O,q=new Promise((N,M)=>{j=N,O=M}),_=!1,R=(N)=>{let M=Buffer.isBuffer(N)?N:JSON.stringify(N);if(U+=Buffer.byteLength(M),!Z()||H||z.readyState!==T9.OPEN)return P(Z()?"relay_closed":"expired");if(z.bufferedAmount>v.relayBuffered)return P("relay_backlog");if(U>v.total)return P("quota");z.send(M)};function P(N="closed"){if(H)return;H=!0,clearInterval(m),clearTimeout(k),$.signal.removeEventListener("abort",T);for(let M of V.values())M.stop();V.clear(),G.close(),z.close(1000,`worker_${N}`),O(Error("preview_closed")),B()}let T=()=>P("aborted"),k=setTimeout(()=>P("pair_timeout"),v.requestMs),m=setInterval(async()=>{if(!Z())return P($.signal.aborted?"aborted":"expired");if(F)return;F=!0;try{let N=K??=Promise.resolve().then(()=>$.port.check()).finally(()=>{K=void 0}),M=await O8(()=>N);if(M===!1)return P("port_refused");if(M){L=void 0;return}if(Date.now()-(L??=Date.now())>q4)return P("port_unknown");for(let D of V.values())D.stop()}finally{F=!1}},1000);if($.signal.addEventListener("abort",T,{once:!0}),!Z())P($.signal.aborted?"aborted":"expired");z.addEventListener("open",()=>R({type:"hello",binding:Q,messages:v.upload,window:v.window})),z.addEventListener("close",()=>P("relay_closed")),z.addEventListener("error",()=>P("relay_error")),z.addEventListener("message",(N)=>{try{if(!Z()||H)return P($.signal.aborted?"aborted":"expired");if(typeof N.data!=="string")throw Error("preview_frame_invalid");if(U+=Buffer.byteLength(N.data),U>v.total)return P("quota");let M=w$(N.data);if(!Y){if(M.type!=="hello"||!c0(Q,M.binding))return P("binding_mismatch");Y=!0,_=M.bytes===!0,clearTimeout(k),j();return}if(M.type==="hello"||M.type==="refused")return P("invalid_frame");if(M.type==="request"){E(M).catch(()=>P("invalid_request"));return}let D=V.get(M.id);if(!D)return;if(M.type==="cancel"||M.type==="end")D.stop();else if(M.type==="credit"&&D.credit)D.credit();else if(M.type==="data"&&D.ws){if(D.ws.readyState!==T9.OPEN||D.ws.bufferedAmount>v.buffered)return D.stop();let S=j9(M.data,v.upload);D.ws.send(M.binary?S:S.toString("utf8"))}else P("invalid_frame")}catch{P("invalid_frame")}});async function E(N){if(V.has(N.id)||V.size>=v.streams)return P("stream_limit");if(!Z())return P($.signal.aborted?"aborted":"expired");let M=new AbortController,D,S,b,f=0,A=(w=!1)=>{if(!V.delete(N.id))return;clearTimeout(D),M.abort(),S?.close(1000,"preview_closed"),b?.(),R({type:w?"end":"cancel",id:N.id})},g={stop:()=>A(),credit:()=>{f++,b?.()}};if(V.set(N.id,g),D=setTimeout(A,v.requestMs),!await q9(()=>$.port.check())||!Z()||M.signal.aborted)return A();let c=C9(N.path);if(N.upgrade){if(N.method!=="GET"||N.body)return A();let w=N.headers.find(([y])=>y.toLowerCase()==="sec-websocket-protocol")?.[1].split(",").map((y)=>y.trim());if(w?.some((y)=>!/^[a-zA-Z0-9._-]{1,100}$/.test(y))||(w?.length??0)>8)return A();S=new T9(`ws://127.0.0.1:${G.port}${c}`,w,{headers:G.headers,followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload}),g.ws=S,S.binaryType="arraybuffer",S.addEventListener("open",()=>{clearTimeout(D),R({type:"ws",id:N.id,protocol:S.protocol})}),S.addEventListener("message",(y)=>{let d=typeof y.data!=="string",l=S$(y.data);if(l.length>v.upload)return A();R({type:"data",id:N.id,data:l.toString("base64"),binary:d})}),S.addEventListener("error",()=>A()),S.addEventListener("close",(y)=>A(y.wasClean));return}let u=j9(N.body,v.upload),a=N4({hostname:"127.0.0.1",port:G.port,path:c,method:N.method,headers:{...Object.fromEntries(T8(N.headers)),...G.headers,connection:"close"},signal:M.signal,agent:!1,maxHeaderSize:16384},async(w)=>{try{let y=[];for(let N0=0;N0<w.rawHeaders.length;N0+=2)y.push([w.rawHeaders[N0],w.rawHeaders[N0+1]]);let d=w.statusCode??502,l=_4(N.method,N.headers,d,y),G0=l==="br"?j4({flush:D8.BROTLI_OPERATION_FLUSH,params:{[D8.BROTLI_PARAM_QUALITY]:5}}):l==="gzip"?C4({level:6,flush:D8.Z_SYNC_FLUSH}):void 0;if(R({type:"head",id:N.id,status:d,headers:T8(l?A4(y,l):y)}),clearTimeout(D),G0)M4(w,G0,()=>{});for await(let N0 of G0??w){let F0=Buffer.from(N0);for(let U0=0;U0<F0.length;U0+=v.chunk){if(f===0&&!M.signal.aborted)await new Promise((q0)=>{b=q0});if(b=void 0,M.signal.aborted)return;f--;let y0=F0.subarray(U0,U0+v.chunk);R(_?E$(N.id,y0):{type:"data",id:N.id,data:y0.toString("base64"),binary:!0})}}A(!0)}catch{A()}});a.on("error",()=>A()),a.end(u)}return await q,{close:P,closed:W}}import{execFile as I4}from"child_process";import{readFile as R4,readdir as E4,readlink as S4}from"fs/promises";import{connect as w4}from"net";import{setTimeout as b4}from"timers/promises";var k4={directory:E4,text:($)=>R4($,"utf8"),link:S4};class _8 extends Error{code;constructor($="port_unproved"){super("preview_port_ownership_unproved");this.code=$}}var $0=($)=>new _8($),v9="preview_listener_unproved",y$="00000000000000000000000001000000";async function f4($,Q,Z=k4){let X=new Map;for(let z of["tcp","tcp6"]){let V=await Z.text(`/proc/net/${z}`);if(V.length>4194304)throw $0();for(let Y of V.split(`
+`).slice(1)){let H=Y.trim().split(/\s+/);if(H.length<10||!["0A","01"].includes(H[3]))continue;let[U,F]=H[1].split(":"),[K,L]=H[2].split(":");if(Number.parseInt(F,16)!==Q)continue;let B=(O)=>O==="0100007F"||O==="0000000000000000FFFF00000100007F"||O===y$,W=H[3]==="0A";if(!(B(U)||W&&/^0+$/.test(U??"")))continue;if(!W&&!B(K))continue;let j=H[9];if(!/^[1-9][0-9]*$/.test(j))continue;X.set(j,{kernelId:j,port:Q,peerPort:W?null:Number.parseInt(L,16),state:W?"listen":"established",host:U===y$?"::1":"127.0.0.1"})}}let J=await Z.directory("/proc");if(J.length>8192)throw $0();let G=[];for(let z of J){if(!/^[1-9][0-9]*$/.test(z))continue;try{let V=await Z.text(`/proc/${z}/stat`),Y=V.slice(V.lastIndexOf(")")+2).trim().split(/\s+/);if(Number(Y[2])!==$)continue;let H=await Z.directory(`/proc/${z}/fd`);if(H.length>1024)throw $0();let U=[];for(let L of H){if(!/^[0-9]+$/.test(L))continue;let B=await Z.link(`/proc/${z}/fd/${L}`).catch(()=>""),W=/^socket:\[([0-9]+)\]$/.exec(B)?.[1],j=W?X.get(W):void 0;if(j)U.push({...j,pid:Number(z),processGroupId:$,descriptor:L})}let F=await Z.text(`/proc/${z}/stat`),K=F.slice(F.lastIndexOf(")")+2).trim().split(/\s+/);if(Y[19]===K[19]&&Y[2]===K[2])G.push(...U)}catch(V){if(V instanceof Error&&V.message==="preview_port_ownership_unproved")throw V}}return G}function g4($,Q,Z){if($.length>2097152)throw $0();let X=0,J=0,G="",z="",V="",Y="",H=[],U=()=>{if(X<1||J!==Q||!/^\d+$/.test(G)||!/^0x[0-9a-f]+$/i.test(z))return;let F=Y==="LISTEN"&&["*","127.0.0.1","[::ffff:127.0.0.1]","[::1]"].some((L)=>V===`${L}:${Z}`),K=new RegExp(`^(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):${Z}->(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):([0-9]+)$`).exec(V);if(F||Y==="ESTABLISHED"&&K)H.push({pid:X,processGroupId:J,descriptor:G,kernelId:z,state:F?"listen":"established",port:Z,peerPort:F?null:Number(K[1]),host:V.startsWith("[::1]:")?"::1":"127.0.0.1"})};for(let F of $.split(/[\0\n]/)){let K=F.slice(1);if(F[0]==="p")U(),X=Number(K),J=0,G=z=V=Y="";else if(F[0]==="g")J=Number(K);else if(F[0]==="f")U(),G=K,z=V=Y="";else if(F[0]==="d")z=K;else if(F[0]==="n")V=K;else if(F.startsWith("TST="))Y=F.slice(4)}return U(),H}async function m4($,Q){if(process.platform==="linux")return f4($,Q);if(process.platform!=="darwin")throw $0();let Z=await new Promise((X,J)=>I4("/usr/sbin/lsof",["-nP","-a","-g",String($),`-iTCP:${Q}`,"-F0pgfdnT"],{timeout:1000,maxBuffer:2097152,encoding:"utf8",env:{PATH:"/usr/bin:/bin",LC_ALL:"C"}},(G,z)=>G?J($0()):X(z)));return g4(Z,$,Q)}function h$($,Q={}){let Z=I0($.binding),X=Q.inspectSockets??m4,J=Q.monotonicNow??(()=>performance.now());async function G(){let Y=()=>{if(Date.now()>=Z.expiresAtMs)throw $0("binding_expired");if($.deniedPorts.has(Z.port))throw $0("port_denied")};Y();let H=await $.readCurrentJob(),U=H?.job,F=U?.process;if(Y(),!H)throw $0("server_stopped");if(!c0(Z,H.binding)||U?.jobId!==Z.jobId)throw $0("binding_changed");if(U.state!=="running"||U.finishedAtMs!==null||U.leaseExpiresAtMs<Z.expiresAtMs)throw $0("job_not_running");if(!F||F.pid<1||F.pid!==F.processGroupId||F.executorLaunchId!==H.executorLaunchId)throw $0("process_unproved");return{pid:F.pid,launch:F.executorLaunchId,started:U.startedAtMs}}async function z(Y=()=>{}){Y();let H=await G();Y();let U=await X(H.pid,Z.port).catch(()=>{throw Error(v9)});Y();let F=await G();if(Y(),H.pid!==F.pid||H.launch!==F.launch||H.started!==F.started)throw $0("job_restarted");if(!U.some((K)=>K.state==="listen"))throw Error(v9);return U}async function V(){try{return await z(),null}catch(Y){if(Y instanceof Error&&Y.message===v9)return"listener_unproved";return Y instanceof _8?Y.code:"port_unproved"}}return{refusal:V,async check(){let Y=await V();if(Y==="listener_unproved")throw Error(v9);return Y===null},async connect(Y){if(Y.aborted)throw $0();let H=J()+2000,U=new AbortController,F=new Promise((O)=>U.signal.addEventListener("abort",()=>O(null),{once:!0})),K,L=()=>{U.abort(),K?.destroy()},B=setTimeout(L,2000);Y.addEventListener("abort",L,{once:!0});let W=()=>{if(U.signal.aborted||Y.aborted||J()>=H||K?.destroyed)throw L(),$0()};async function j(O){W();let q=await Promise.race([O().then((_)=>({value:_})),F]);if(W(),!q)throw $0();return q.value}try{let O=await j(()=>z(W));W();let q=O.some((P)=>P.state==="listen"&&P.host==="127.0.0.1")?"127.0.0.1":"::1",_=w4({host:q,port:Z.port,signal:Y});K=_,_.once("close",L),await j(()=>new Promise((P,T)=>{_.once("connect",P),_.once("error",T)}));let R=_.localPort;if(!R)throw $0();while(!(await j(()=>z(W))).some((P)=>P.state==="established"&&P.peerPort===R))await j(()=>b4(Math.min(20,Math.max(1,H-J())),void 0,{signal:U.signal}));return W(),_}catch(O){throw L(),O}finally{clearTimeout(B),Y.removeEventListener("abort",L),K?.off("close",L),U.abort()}}}}var y4=4,h4=[2375,2376,9222,9229];function v$($){let Q=new Set(h4);for(let Z of $){let X=new URL(Z);Q.add(Number(X.port||(["https:","wss:"].includes(X.protocol)?443:80)))}return Q}function R0(){throw new C("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var v4=60000;function c$($){let Q=new AbortController,Z=new Map,X=(Y)=>JSON.stringify([Y.jobId,Y.port]);function J(Y){let H=$.authority.owner;if(Q.signal.aborted||!$.isCurrent()||$.expiresAtMs<=Date.now()||Y.organization_id!==H.organization_id||Y.user_id!==H.user_id||Y.device_id!==H.device_id)R0()}function G(Y){let H;try{H=$.environment.current()}catch{return null}return H.binding.target_generation===Y.generation&&H.binding.target_fence_id===Y.fenceId&&H.run_id===$.runId&&H.device_id===$.authority.owner.device_id&&H.root_id===$.authority.rootId?H:null}async function z(Y,H,U){let F=await V(Y,H,U);if(F!=="moved")return F;let K=await V(Y,H,U);return K==="moved"?null:K}async function V(Y,H,U){try{J($.authority.owner);let F=$.identity();if(!F||U.aborted||Y.expiresAtMs<=Date.now()||Y.expiresAtMs>$.expiresAtMs)return null;let K=H.opened,L=K!==void 0&&F.generation>K.generation,B=G(F);if(L){if(B){if(B.revision<=K.revision||Y.expiresAtMs>Date.parse(B.expires_at)||B.binding.target_revision!==K.attachmentRevision||B.binding.root_grant_revision!==K.grantRevision)return null;H.recoveringSinceMs=void 0}else if(Date.now()-(H.recoveringSinceMs??=Date.now())>v4)return null}else if(!B||Y.expiresAtMs>Date.parse(B.expires_at)||K&&(F.generation!==K.generation||F.fenceId!==K.fenceId))return null;let W=await $.inspect(Y.jobId,U),j=$.identity(),O=j&&G(j);J($.authority.owner);let q=B&&{generation:F.generation,fenceId:F.fenceId,snapshotId:B.snapshot_id,revision:B.revision,attachmentRevision:B.binding.target_revision,grantRevision:B.binding.root_grant_revision},_=L?K:q;if(U.aborted||!j)return null;if(j.generation!==F.generation||j.fenceId!==F.fenceId||O?.snapshot_id!==B?.snapshot_id||O?.revision!==B?.revision)return"moved";let R=W.ok&&W.job.environmentSnapshotId!==void 0&&W.job.environmentRevision!==void 0?{snapshotId:W.job.environmentSnapshotId,revision:W.job.environmentRevision}:null;if(!W.ok||W.generation!==F.generation||!_||!R)return null;if((R.snapshotId!==_.snapshotId||R.revision!==_.revision)&&(L||!$.environment.carried(R.snapshotId,R.revision)))return null;if(!K&&F.generation===Y.generation&&F.fenceId===Y.fenceId)H.opened={..._,...R};return{executorLaunchId:$.executorLaunchId,job:W.job,binding:{organizationId:$.authority.owner.organization_id,userId:$.authority.owner.user_id,deviceId:$.authority.owner.device_id,rootId:$.authority.rootId,runId:$.runId,attachmentRevision:_.attachmentRevision,grantRevision:_.grantRevision,generation:_.generation,fenceId:_.fenceId,jobId:W.job.jobId,port:Y.port,expiresAtMs:Y.expiresAtMs}}}catch{return null}}return{async open(Y,H,U){J(H);let{binding:F,deviceRelayUrl:K}=b$(Y);if(U.aborted||F.expiresAtMs<=Date.now()||F.expiresAtMs>Date.now()+v.lifetimeMs||new URL(K).origin!==$.authority.relayOrigin)R0();let L=X(F),B=Z.get(L);if(B){if(!c0(B.binding,F)||B.relay!==K)R0();if(await B.opened,!await q9(()=>B.port.check())||U.aborted||B.abort.signal.aborted)R0();return{opened:!0,binding:F}}if(Z.size>=y4)R0();let W=new AbortController,j={},O=h$({binding:F,deniedPorts:$.authority.deniedPorts,readCurrentJob:()=>z(F,j,W.signal)}),q=()=>W.abort();if(U.addEventListener("abort",q,{once:!0}),Q.signal.addEventListener("abort",q,{once:!0}),U.aborted||Q.signal.aborted)q();let _=m$({binding:F,deviceRelayUrl:K,port:O,signal:W.signal}),R={binding:F,relay:K,abort:W,port:O,opened:_};Z.set(L,R);let P=()=>{if(U.removeEventListener("abort",q),Q.signal.removeEventListener("abort",q),Z.get(L)===R)Z.delete(L)};try{if((await _).closed.then(P),U.removeEventListener("abort",q),J(H),W.signal.aborted||!await q9(()=>O.check()))R0();return{opened:!0,binding:F}}catch{W.abort(),P(),R0()}},async close(Y,H){J(H);let{binding:U}=k$(Y),F=Z.get(X(U));if(!F||!c0(F.binding,U))R0();return F.abort.abort(),await F.opened.then((K)=>K.closed,()=>{return}),{closed:!0,binding:U}},dispose(){Q.abort();for(let Y of Z.values())Y.abort.abort();Z.clear()}}}import{WebSocket as A8}from"ws";var d$=($)=>("data"in $)?$.data.length:$.bytes,p$=2*l$;function i($){throw new C($,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var t0=($)=>!["starting","running"].includes($.state);function C2($,Q,Z=Date.now()){let X=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys($).length!==X.length||Object.keys($).some((H)=>!X.includes(H))||!x8(Q)||!x8($.session_id)||typeof $.expires_at!=="string"||typeof $.relay_url!=="string"||$.relay_url.length>4096||![$.cols,$.rows].every((H)=>Number.isSafeInteger(H)&&Number(H)>=1&&Number(H)<=P8))i("invalid_pty_request");let J=$.pty;if(!J||typeof J!=="object"||Array.isArray(J))i("invalid_pty_request");let G=J;if(Object.keys(G).length!==2||G.version!==1||!p9(G.jobId))i("invalid_pty_request");let z;try{z=new URL($.relay_url)}catch{return i("invalid_pty_request")}if(!["ws:","wss:"].includes(z.protocol)||z.username||z.password||z.hash||z.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(z.hostname))i("invalid_pty_request");let V=Date.parse($.expires_at);if(!Number.isSafeInteger(V)||V<=Z)i("invalid_pty_request");return{workspace:u$($.workspace)??i("invalid_pty_request"),session:{jobId:G.jobId,sessionId:$.session_id,operationId:Q,relayUrl:z.href,cols:Number($.cols),rows:Number($.rows),leaseExpiresAtMs:Math.min(V,Z+43200000)}}}async function i$($){let{session:Q,binding:Z}=$;if(Z.assertCurrent(),$.signal.aborted||Date.now()>=Q.leaseExpiresAtMs)i("cancelled");let X=new A8(Q.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:c9}),J=new AbortController,G=()=>{},z=()=>{J.abort(),G()};$.signal.addEventListener("abort",z,{once:!0});let V=setTimeout(z,Math.max(1,Q.leaseExpiresAtMs-Date.now())),Y=[],H=0,U=0,F=0,K=!1,L=!1,B=!1,W,j,O,q=(N)=>{O=new C(N,"Bound terminal input was refused."),z()};X.on("error",()=>q("pty_relay_unavailable")),X.on("close",z),X.on("message",(N,M)=>{if(J.signal.aborted)return;if(!L){q("pty_not_ready");return}let D=Array.isArray(N)?Buffer.concat(N):N instanceof ArrayBuffer?Buffer.from(N):N;if(D.length===0)return;let S=Y.at(-1),b=M&&S!==void 0&&"data"in S&&S.data.length+D.length<=c9;if(D.length>c9||H+D.length>s$){q("pty_input_backpressure");return}if(b)S.data=Buffer.concat([S.data,D]);else if(M)Y.push({data:Buffer.from(D)});else try{let f=JSON.parse(D.toString("utf8"));if(f&&f.t==="close"&&Object.keys(f).length===1){B=!0,z();return}if(!f||f.t!=="resize"||Object.keys(f).length!==3||![f.cols,f.rows].every((A)=>Number.isSafeInteger(A)&&A>=1&&A<=P8))throw Error("invalid_control");Y.push({cols:f.cols,rows:f.rows,bytes:D.length})}catch{q("invalid_pty_control");return}H+=D.length,G()});function _(N){return n$(JSON.stringify({...Z.scope,version:1,sessionId:Q.sessionId,operationId:Q.operationId,job:{...N,output:[],pty:N.pty?{...N.pty,output:[]}:void 0}}))}function R(N){if(!N.ok)i(N.error);let M=N.job;if(N.generation!==Z.scope.generation||M.jobId!==Q.jobId||!M.pty||M.leaseExpiresAtMs>Q.leaseExpiresAtMs||M.process&&M.process.executorLaunchId!==Z.scope.executorLaunchId||M.process&&j&&(M.process.pid!==j.pid||M.process.processGroupId!==j.processGroupId)||M.state!=="starting"&&(M.environmentRevision!==Z.environment.revision||M.environmentSnapshotId!==Z.environment.snapshotId))i("pty_binding_changed");if(_(M),M.process)j??={...M.process};return M}async function P(N){Z.assertCurrent();let M=await Z.request(N,J.signal);if(Z.assertCurrent(),J.signal.aborted)i("cancelled");let D=R(M);if(D.inputSequence!==U)i("job_input_sequence");if(!t0(D)&&D.leaseExpiresAtMs<=Date.now())i("pty_binding_changed");return D}function T(N){if(Z.assertCurrent(),J.signal.aborted||X.readyState!==A8.OPEN||X.bufferedAmount+Buffer.byteLength(N)>p$)i("pty_output_backpressure");X.send(N)}function k(N){if(N.firstCursor>F+1)F=N.firstCursor-1;for(let M of N.pty.output){if(M.cursor<=F)continue;if(M.cursor!==F+1)i("pty_output_gap");let D=Buffer.from(M.dataBase64,"base64");if(X.bufferedAmount+D.length>p$)return!1;T(D),F=M.cursor}if(F!==N.nextCursor)i("pty_output_gap");return!0}async function m(N,M){let D;try{await Promise.race([$.emit(N,M),new Promise((S,b)=>{D=setTimeout(()=>b(new C("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(D)}}async function E(){let N=AbortSignal.timeout(d9),M=Z.request({jobId:Q.jobId,action:"cancel",input:{}},N),D,S=new Promise((b,f)=>{if(D=()=>f(new C("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),N.addEventListener("abort",D,{once:!0}),N.aborted)D()});try{let b=await Promise.race([M,S]);if(N.aborted)i("pty_cleanup_unconfirmed");return R(b)}finally{N.removeEventListener("abort",D)}}try{await new Promise((b,f)=>{let A=setTimeout(()=>{z(),f(new C("pty_relay_unavailable","Terminal pairing timed out."))},5000),g=()=>{clearTimeout(A),f(new C("cancelled","Terminal pairing was cancelled."))};if(J.signal.addEventListener("abort",g,{once:!0}),X.once("open",()=>{clearTimeout(A),J.signal.removeEventListener("abort",g),b()}),J.signal.aborted)g()}),Z.assertCurrent(),K=!0,W=await P({jobId:Q.jobId,action:"start",input:{mode:"pty",cols:Q.cols,rows:Q.rows,leaseExpiresAtMs:Q.leaseExpiresAtMs}});let N=Date.now()+5000;while(W.state==="starting"){if(Date.now()>=N)i("pty_not_ready");await new Promise((b)=>setTimeout(b,25)),W=await P({jobId:Q.jobId,action:"inspect",input:{after:F}})}if(W.state!=="running"||W.inputSequence!==0||W.leaseExpiresAtMs<=Date.now())i("pty_not_ready");await m("pty.ready",_(W)),L=!0,T(JSON.stringify({t:"open",cols:W.pty.cols,rows:W.pty.rows,receipt:_(W)}));let M=!1,D=0,S=!1;while(!J.signal.aborted){let b=W.firstCursor>F+1,f=k(W);if(t0(W)){if(f)break}else if(b)M=!0;else if(M&&f&&Date.now()>=D){M=!1,D=Date.now()+1000;let{cols:g,rows:c}=W.pty;for(let u of[{cols:g,rows:c>1?c-1:2},{cols:g,rows:c}]){if(t0(W))break;let a=++U;if(W=await P({jobId:Q.jobId,action:"resize",input:{sequence:a,...u}}),W.inputSequence!==a)i("job_input_sequence")}continue}let A=t0(W)||S?void 0:Y.shift();if(A){H-=d$(A);let g=++U;try{W=await P("data"in A?{jobId:Q.jobId,action:"input",input:{sequence:g,dataBase64:A.data.toString("base64")}}:{jobId:Q.jobId,action:"resize",input:{sequence:g,cols:A.cols,rows:A.rows}})}catch(c){if(!(c instanceof C)||c.code!=="job_input_backpressure")throw c;U-=1,Y.unshift(A),H+=d$(A),S=!0;continue}if(W.inputSequence!==g)i("job_input_sequence")}else if(await new Promise((g)=>{let c=setTimeout(g,S||!f?10:50);if(G=()=>{clearTimeout(c),g()},J.signal.aborted||!S&&Y.length)G()}),S=!1,G=()=>{},!J.signal.aborted&&f)try{W=await P({jobId:Q.jobId,action:"inspect",input:{after:F}})}catch(g){if(!B||!(g instanceof C)||g.code!=="cancelled")throw g}}}catch(N){O??=N}finally{if(L=!1,Y.length=0,clearTimeout(V),$.signal.removeEventListener("abort",z),z(),K&&(!W||!t0(W)))try{W=await E()}catch{W=void 0}try{if(!W||!t0(W)||W.pty?.cleanup!=="confirmed")i("pty_cleanup_unconfirmed");let N=_(W);if(X.readyState===A8.OPEN)await new Promise((M)=>{let D=setTimeout(M,500);X.send(JSON.stringify({t:"exit",code:W.exitCode,receipt:N}),()=>{clearTimeout(D),M()})});await m("pty.stopped",N)}catch(N){O??=N}X.terminate()}if(O)throw O;if($.signal.aborted)i("cancelled");if(!W)i("pty_cleanup_unconfirmed");return{receipt:_(W)}}import{createHash as c4,randomUUID as XQ}from"crypto";import{spawnSync as d4}from"child_process";import{closeSync as o$,constants as I8,fstatSync as p4,fsyncSync as u4,lstatSync as O9,mkdirSync as l4,mkdtempSync as JQ,openSync as a$,readFileSync as s4,readdirSync as YQ,realpathSync as $9,rmSync as R8,unlinkSync as n4}from"fs";import{createConnection as i4}from"net";import{dirname as o4,join as d0,sep as a4}from"path";import{tmpdir as r4}from"os";var e=new Map,E0=new Map;function D0($,Q){return c4("sha256").update(JSON.stringify([$,Q])).digest("hex")}function e0($){try{l4($,{mode:448})}catch(Z){if(!(Z instanceof Error&&("code"in Z)&&Z.code==="EEXIST"))throw Z}let Q=O9($);if(!Q.isDirectory()||Q.isSymbolicLink()||Q.uid!==process.getuid?.()||(Q.mode&63)!==0||$9($)!==$)throw new C("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function t4($){let Q;try{Q=O9($)}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!1;throw Z}return!Q.isDirectory()||Q.isSymbolicLink()||YQ($).length>0}function GQ($){let Q=D0($.root,$.runId),Z=$.previousRuntimeDirectories?.find((z)=>t4(d0(z,"jobs",Q.slice(0,16))))??$.runtimeDirectory;e0(Z);let X=d0(Z,"jobs");e0(X);let J=d0(X,Q.slice(0,16));if($.maxScopes!==void 0){let z=YQ(X);if(!Number.isSafeInteger($.maxScopes)||$.maxScopes<1||z.length>$.maxScopes||!z.includes(Q.slice(0,16))&&z.length>=$.maxScopes)throw new C("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}e0(J);let G=JQ(d0($9("/tmp"),"reason-j-"));try{return e0(G),{journalDirectory:J,scopeId:Q,socketPath:d0(G,"control.sock"),disposeSocket:()=>R8(G,{recursive:!0,force:!0})}}catch(z){throw R8(G,{recursive:!0,force:!0}),z}}var e4=60000,$3=5000;function Q3($){let Q=d4("ps",["-o","lstart=","-p",String($)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),Z=Q.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(Q.stdout.trim()):null,X=Z?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(Z[1]):-1;if(!Z||X<0||X%3!==0)return null;let J=new Date(Number(Z[6]),X/3,Number(Z[2]),Number(Z[3]),Number(Z[4]),Number(Z[5])).getTime();return Number.isFinite(J)?J:null}function zQ($,Q={}){let Z=d0($.journalDirectory,"owner.lock"),X;try{X=a$(Z,I8.O_RDONLY|I8.O_NOFOLLOW)}catch{return null}try{let J=p4(X);if(!J.isFile()||J.nlink!==1||J.uid!==process.getuid?.()||(J.mode&63)!==0||J.size>4096)return null;let G=null;try{G=JSON.parse(s4(X,"utf8"))}catch{}let z;if(G===null){if((Q.now??Date.now)()-J.mtimeMs<e4)return null;z={reason:"never_written",executorLaunchId:null}}else{let{version:H,scopeId:U,pid:F,createdAtMs:K,executorLaunchId:L}=G;if(H!==1||U!==$.scopeId||typeof L!=="string"||typeof F!=="number"||!Number.isSafeInteger(F)||F<1||F===process.pid||typeof K!=="number"||!Number.isSafeInteger(K))return null;if(!(Q.exists??((W)=>{try{return process.kill(W,0),!0}catch(j){return!(j instanceof Error&&("code"in j)&&j.code==="ESRCH")}}))(F))z={reason:"owner_exited",executorLaunchId:L};else{let W=(Q.startedAtMs??Q3)(F);if(W===null||W<=K+$3)return null;z={reason:"pid_reused",executorLaunchId:L}}}let V=O9(Z);if(V.dev!==J.dev||V.ino!==J.ino)return null;n4(Z);let Y=a$($.journalDirectory,I8.O_RDONLY);try{u4(Y)}finally{o$(Y)}return z}catch{return null}finally{o$(X)}}function KQ($){let Q={...$,workspace:$.workspace&&Object.freeze({...$.workspace}),previewAuthority:$.previewAuthority&&Object.freeze({...$.previewAuthority,owner:Object.freeze({...$.previewAuthority.owner}),deniedPorts:new Set($.previewAuthority.deniedPorts)})},Z=D0(Q.root,Q.runId);if(e.has(Z)||Q.operationId!==void 0&&E0.has(Q.operationId))throw new C("hands_jobs_busy","The Session already has a live Hands job supervisor.");let X={binding:Q,key:Z,terminals:new Map};if(Q.previewAuthority&&Q.environment)X.previews=c$({authority:Q.previewAuthority,runId:Q.runId,expiresAtMs:Q.expiresAtMs,executorLaunchId:Q.executorLaunchId,environment:Q.environment,isCurrent:()=>e.get(X.key)===X,identity:()=>{try{return Q9(Q)}catch{return null}},inspect:(J,G)=>{if(e.get(X.key)!==X)throw new C("preview_unavailable","The Hands supervisor is no longer current.");return VQ(Q,{jobId:J,action:"inspect",input:{after:0}},G)}});if(e.set(Z,X),Q.operationId!==void 0)E0.set(Q.operationId,X);return()=>{if(e.get(X.key)===X)e.delete(X.key);if(Q.operationId!==void 0&&E0.get(Q.operationId)===X)E0.delete(Q.operationId);X.previews?.dispose();for(let J of X.terminals.values())J.abort()}}var Z3=5000,X3=20;async function k2($){let Q=(J)=>{throw new C("hands_rebind_unavailable",J)};if(!O0($.operationId)||!O0($.runId)||!O0($.fenceId)||!S0($.targetGeneration))Q("Reason sent an invalid Hands rebind.");let Z=E0.get($.operationId);if(!Z||Z.binding.root!==$.root)return Q("No live Hands supervisor owns this operation.");for(let J=Date.now()+Z3;;){if($.signal?.aborted)Q("The Hands rebind was cancelled.");if(E0.get($.operationId)!==Z)Q("The Hands supervisor is no longer current.");let G=null;try{G=Q9(Z.binding)}catch{}if(G&&G.generation===$.targetGeneration&&G.fenceId===$.fenceId)break;if(G&&G.generation>$.targetGeneration||Date.now()>=J)Q("The executor did not adopt this take.");await new Promise((z)=>setTimeout(z,X3))}if(E0.get($.operationId)!==Z||e.get(Z.key)!==Z)Q("The Hands supervisor is no longer current.");let X=D0($.root,$.runId);if(Z.key===X)return;if(e.has(X))Q("The taking run already has a live Hands job supervisor.");e.delete(Z.key);for(let J of Z.terminals.values())J.abort();Z.key=X,e.set(X,Z)}function f2($){let Q="operationId"in $?E0.get($.operationId):e.get(D0($.root,$.runId)),Z=Q&&Q.binding.root===$.root?Q.binding:void 0;if(!Z?.environment||Z.expiresAtMs<=Date.now())throw new C("environment_unavailable","No live Hands supervisor owns this environment.");return Z.environment.install($.payload)}async function g2($){let Q=e.get(D0($.root,$.runId));if(!Q?.previews||!$.owner)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.open($.payload,$.owner,$.signal)}async function m2($){let Q=e.get(D0($.root,$.runId));if(!Q?.previews||!$.owner||$.signal.aborted)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.close($.payload,$.owner)}async function y2($){let Q=D0($.root,$.runId),Z=e.get(Q),X=Z?.binding,J=X?.runId,G=X?.previewAuthority,z=X?.environment,V=$.owner&&{...$.owner},Y=$.authority&&{...$.authority},H=()=>{throw new C("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!Z||!X||!G||!z||!V||!Y||!X.workspace)return H();let U=Object.freeze({...X.workspace}),F=Q9(X),K=z.current(),L=()=>{if(e.get(Q)!==Z||V.organization_id!==G.owner.organization_id||V.user_id!==G.owner.user_id||V.device_id!==G.owner.device_id||$.deviceId!==G.owner.device_id||$.rootId!==G.rootId||p0($.workspace)!==p0(U))H();let W=Q9(X),j=z.current();if(W.generation!==F.generation||W.fenceId!==F.fenceId||j.run_id!==J||j.device_id!==$.deviceId||j.root_id!==$.rootId||j.snapshot_id!==K.snapshot_id||j.revision!==K.revision||j.binding.target_generation!==F.generation||j.binding.target_fence_id!==F.fenceId||Y.device_id!==$.deviceId||Y.binding!==j.binding.kind||Y.target_revision!==j.binding.target_revision||Y.root_grant_revision!==j.binding.root_grant_revision||Y.target_generation!==F.generation||Y.target_fence_id!==F.fenceId)H()};if(L(),new URL($.session.relayUrl).origin!==G.relayOrigin||Z.terminals.has($.session.jobId)||Z.terminals.size>=4)return H();let B=new AbortController;Z.terminals.set($.session.jobId,B);try{return await i$({session:{...$.session,leaseExpiresAtMs:Math.min($.session.leaseExpiresAtMs,F.expiresAtMs,Date.parse(K.expires_at))},signal:AbortSignal.any([$.signal,B.signal]),emit:$.emit,binding:{assertCurrent:L,environment:{revision:K.revision,snapshotId:K.snapshot_id},scope:{runId:$.runId,deviceId:$.deviceId,rootId:$.rootId,workspace:U,binding:K.binding.kind,targetRevision:K.binding.target_revision,rootGrantRevision:K.binding.root_grant_revision,generation:F.generation,fenceId:F.fenceId,executorLaunchId:F.executorLaunchId},request:(W,j)=>HQ(F,E8(JSON.stringify({...W,type:"job",version:2,generation:F.generation,id:XQ()})),j)}})}finally{if(Z.terminals.get($.session.jobId)===B)Z.terminals.delete($.session.jobId)}}async function h2($){if(p9($.payload.jobId))throw new C("pty_binding_required","PTY jobs require the bound terminal capability.");let Q=e.get(D0($.root,$.runId))?.binding;if(!Q||Q.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return VQ(Q,$.payload,$.signal)}var J3=1e4,Y3=20,G3=$Q/2,z3=e$/2,K3=($)=>$.output.reduce((Q,Z)=>Q+Z.text.length,0);async function VQ($,Q,Z){if(Object.keys(Q).some((H)=>!["jobId","action","input","waitForExitMs"].includes(H)))throw new C("invalid_payload","Unexpected job control field.");let{waitForExitMs:X,...J}=Q;if(X!==void 0&&(J.action!=="start"||typeof J.input!=="object"||J.input===null||!("script"in J.input)||typeof X!=="number"||!Number.isSafeInteger(X)||X<1||X>J3))throw new C("invalid_payload","Only a script start may wait for its job, within its bound.");let G=(H)=>{let U=Q9($);return HQ(U,E8(JSON.stringify({...H,type:"job",version:2,generation:U.generation,id:XQ()})),Z)},z=await G(J);if(X===void 0)return z;let V=Date.now()+X,Y=z;while(Y.ok&&["starting","running"].includes(Y.job.state)&&Y.job.output.length<G3&&K3(Y.job)<z3&&!Z.aborted&&Date.now()<V){if(await new Promise((H)=>setTimeout(H,Math.min(Y3,V-Date.now()))),Z.aborted)break;try{let H=await G({jobId:J.jobId,action:"inspect",input:{after:0}});if(!H.ok)break;Y=H}catch{break}}return Y}function Q9($){if($.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","Hands authority expired.");let Q=$.readIdentity?$.readIdentity():$;if(!Q||!S0(Q.generation)||!O0(Q.fenceId)||Q.generation<$.generation||Q.generation===$.generation&&Q.fenceId!==$.fenceId)throw new C("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return $.generation=Q.generation,$.fenceId=Q.fenceId,{...$}}function HQ($,Q,Z){if(Z.aborted)return Promise.reject(new C("cancelled","Job control was cancelled."));return new Promise((X,J)=>{let G=i4($.socketPath),z="",V=!1,Y,H=(F,K)=>{if(V)return;if(V=!0,clearTimeout(Y),Z.removeEventListener("abort",U),G.destroy(),F)J(F);else X(K)},U=()=>H(new C("cancelled","Job control waiter cancelled; inspect before retrying mutations."));Z.addEventListener("abort",U,{once:!0}),G.setEncoding("utf8"),Y=setTimeout(()=>H(new C("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,$.expiresAtMs-Date.now()))),G.on("error",()=>H(new C("hands_job_result_unknown","Hands job control connection failed."))),G.once("connect",()=>G.write(JSON.stringify({version:1,scopeId:$.scopeId,fenceId:$.fenceId,executorLaunchId:$.executorLaunchId,request:Q})+`
+`)),G.on("data",(F)=>{if(z+=F,Buffer.byteLength(z)>QQ)H(new C("hands_job_result_unknown","Hands job result exceeded its bound."))}),G.once("end",()=>{if(Date.now()>=$.expiresAtMs){H(new C("hands_job_result_unknown","Hands authority expired before the result was acknowledged."));return}try{let F=ZQ(z.trim());if(F.id!==Q.id||F.generation!==$.generation||F.ok&&F.job.jobId!==Q.jobId)throw Error("identity");H(void 0,F)}catch{H(new C("hands_job_result_unknown","Hands job response identity or shape was invalid."))}}),G.once("close",()=>{if(!V)H(new C("hands_job_result_unknown","Hands job control closed before an acknowledged result."))})})}function V3($){let Q=$9($.root),Z=$.authority,X=Date.parse($.leaseUntil),J=()=>{if($.signal.throwIfAborted(),!Number.isFinite(X)||X<=Date.now())throw Error("local_device_gh_lease_expired")};if(J(),Z.readOnly&&Z.generation===null)return{root:Q,readOnly:!0,signal:$.signal,deadlineMs:X,assertCurrent:J};let G=D0(Q,$.runId),z=e.get(G),V=z?.binding;if(!V?.environment||!V.workspace||V.localGithubConfinement!==!0)throw Error("local_device_gh_confinement_unavailable");let Y=V.environment.current(),H=()=>{J();let F=V.environment.current(),K=Q9(V);if(e.get(G)!==z||F.github_auth!=="local_gh"||F.run_id!==V.runId||Z.runId!==$.runId||F.device_id!==Z.deviceId||F.root_id!==Z.rootId||String(F.binding.root_grant_revision)!==Z.rootRevision||F.binding.target_generation!==Z.generation||F.binding.target_fence_id!==Z.fenceId||K.generation!==Z.generation||K.fenceId!==Z.fenceId||F.snapshot_id!==Y.snapshot_id||F.revision!==Y.revision)throw Error("local_device_gh_authority_changed")};H();let U=u9(Q,V.workspace);return{root:U.boundary,signal:$.signal,deadlineMs:X,privateDirectory:o4(V.environment.path),repoPath:U.path,readOnly:Z.readOnly,forbiddenSecretValues:Object.values(Y.variables),secretNames:(F)=>Object.entries(Y.variables).filter(([,K])=>K.trim()===F.trim()).map(([K])=>`variable ${K}`),assertCurrent:H}}async function v2($,Q){let Z=r$.parse($.request),X=t$.parse($.authority);if(Z.kind!=="pr_merge"){if(X.merge)throw Error("local_device_gh_merge_authority_invalid");return Q(V3($))}if(!X.merge||X.readOnly||X.runId!==$.runId||X.repoFullName!==Z.repoFullName||X.merge.source==="agent"&&(X.generation===null||X.fenceId===null))throw Error("local_device_gh_merge_authority_invalid");let J=$9($.root),G=O9(J),z=Date.parse($.leaseUntil);if(!Number.isFinite(z)||z<=Date.now())throw Error("local_device_gh_lease_expired");let V=$9(r4());if(V===J||V.startsWith(J+a4))throw Error("local_device_gh_private_scope_unavailable");let Y=JQ(d0(V,"reason-gh-merge-"));try{e0(Y);let H=()=>{if($.signal.throwIfAborted(),Date.now()>=z)throw Error("local_device_gh_lease_expired");let U=O9($.root);if(U.isSymbolicLink()||U.dev!==G.dev||U.ino!==G.ino||$9($.root)!==J)throw Error("local_device_gh_authority_changed");e0(Y)};return H(),await Q({root:J,readOnly:!1,privateDirectory:Y,forbiddenSecretValues:[],signal:$.signal,deadlineMs:z,assertCurrent:H})}finally{R8(Y,{recursive:!0,force:!0})}}var WQ=43200000;function Z9($){return Number.isSafeInteger($)&&Math.abs($)<=8640000000000000?$:null}function FQ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function UQ($,Q){return Object.keys($).length===Q.length&&Q.every((Z)=>Object.hasOwn($,Z))}function d2($){if(!FQ($)||!UQ($,["version","outcome","clock_source","validation_now_ms","expiry_ms","remaining_ms","maximum_lifetime_ms","cli_artifact"])||$.version!==1||$.maximum_lifetime_ms!==43200000||typeof $.outcome!=="string"||!["accepted","parse","noncanonical","expired","over_cap"].includes($.outcome)||typeof $.clock_source!=="string"||!["date_now","injected"].includes($.clock_source))return null;for(let X of["validation_now_ms","expiry_ms"]){let J=$[X];if(J!==null&&(typeof J!=="number"||Z9(J)===null))return null}if($.remaining_ms!==null&&(typeof $.remaining_ms!=="number"||!Number.isSafeInteger($.remaining_ms)))return null;let Q=typeof $.expiry_ms==="number"&&typeof $.validation_now_ms==="number"?$.expiry_ms-$.validation_now_ms:null;if($.remaining_ms!==(Q!==null&&Number.isSafeInteger(Q)?Q:null))return null;if($.outcome==="parse"&&$.expiry_ms!==null)return null;if($.outcome!=="parse"&&$.expiry_ms===null)return null;if($.outcome==="expired"&&!(typeof Q==="number"&&Q<=0))return null;if($.outcome==="over_cap"&&!(typeof Q==="number"&&Q>43200000))return null;if($.outcome==="accepted"&&!(typeof Q==="number"&&Q>0&&Q<=43200000))return null;let Z=$.cli_artifact;if(!FQ(Z)||!UQ(Z,["kind","status","sha256","observed_at_ms"])||Z.observed_at_ms!==null&&(typeof Z.observed_at_ms!=="number"||Z9(Z.observed_at_ms)===null))return null;if(Z.kind==="entrypoint_file"){if(Z.status!=="observed"||typeof Z.sha256!=="string"||!/^[a-f0-9]{64}$/.test(Z.sha256)||Z.observed_at_ms===null)return null}else if(Z.kind!=="unavailable"||Z.sha256!==null||typeof Z.status!=="string"||!["unsupported_entrypoint","read_failed","file_changed","size_limit","time_limit"].includes(Z.status))return null;return $}var S8=x.strictObject({kind:x.enum(["workspace_source","mcp_control"]),target_revision:x.number().int().nonnegative(),root_grant_revision:x.number().int().positive()}),LQ=new RegExp(l9.tokenPattern),H3=x.strictObject({token_url:x.url().max(2048),request_token:x.string().min(1).max(8192).regex(LQ),aws_credentials_url:x.url().max(2048).nullable()});function NQ($,Q){let Z=(X,J)=>{try{let G=new URL(X);return G.origin===new URL(Q).origin&&G.pathname===J&&!G.username&&!G.password&&!G.search&&!G.hash}catch{return!1}};if(!LQ.test($.request_token)||!Z($.token_url,l9.tokenPath)||$.aws_credentials_url!==null&&!Z($.aws_credentials_url,l9.awsPath))return null;return{REASON_OIDC_TOKEN_URL:$.token_url,REASON_OIDC_REQUEST_TOKEN:$.request_token,...$.aws_credentials_url!==null?{AWS_CONTAINER_CREDENTIALS_FULL_URI:$.aws_credentials_url,AWS_CONTAINER_AUTHORIZATION_TOKEN:$.request_token}:{}}}function MQ($){return new TextEncoder().encode($).byteLength}function F3($){return MQ(JSON.stringify($)+`
+`)}var jQ=x.strictObject({version:x.literal(1),snapshot_id:x.uuid(),revision:x.number().int().positive(),run_id:x.string().min(1).max(160),device_id:x.uuid(),root_id:x.uuid(),binding:S8.extend({target_generation:x.number().int().positive(),target_fence_id:x.uuid()}),expires_at:x.iso.datetime({offset:!0}),variables:x.record(x.string().max(128).regex(BQ),x.string().refine(($)=>!$.includes("\x00")&&MQ($)<=_0.valueBytes)).refine(($)=>Object.keys($).length<=_0.variables),github_auth:x.literal("local_gh").optional(),git:x.strictObject({base_url:x.url().max(2048),token:x.string().min(1).max(4096).regex(/^[A-Za-z0-9._~-]+$/),expires_at:x.iso.datetime({offset:!0})}).nullable(),cloud_access:H3.optional()}).refine(($)=>$.github_auth!=="local_gh"||$.git===null,"conflicting git authority").refine(($)=>F3($)<=_0.snapshotBytes,"snapshot too large");import{randomUUID as U3}from"crypto";import{closeSync as W3,constants as CQ,fstatSync as B3,lstatSync as qQ,mkdirSync as TQ,openSync as L3,readFileSync as N3,realpathSync as OQ,renameSync as M3,unlinkSync as j3,writeFileSync as C3}from"fs";import{dirname as DQ,resolve as _Q}from"path";var AQ=65536;function s9($){try{return qQ($),!0}catch(Q){if(Q instanceof Error&&"code"in Q&&Q.code==="ENOENT")return!1;throw Q}}function D9($,Q=!1){if(!s9($)){if(!Q)throw Error("worker_state_missing");xQ($),TQ($,{mode:448})}let Z=qQ($);if(!Z.isDirectory()||Z.isSymbolicLink()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0||OQ($)!==_Q($))throw Error("worker_state_directory_not_private_or_canonical")}function xQ($){let Q=DQ($);if(!s9(Q))xQ(Q),TQ(Q,{mode:448});if(OQ(Q)!==_Q(Q))throw Error("worker_parent_not_canonical")}function _9($,Q=AQ){let Z=L3($,CQ.O_RDONLY|CQ.O_NOFOLLOW);try{let X=B3(Z);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>Q)throw Error("worker_file_not_private");return N3(Z,"utf8")}finally{W3(Z)}}function PQ($,Q,Z=AQ){let X=JSON.stringify(Q);if(X===void 0)throw Error("worker_file_invalid");let J=X+`
+`;if(Buffer.byteLength(J,"utf8")>Z)throw Error("worker_file_too_large");if(D9(DQ($)),s9($))_9($,Z);let G=`${$}.${U3()}`;try{C3(G,J,{mode:384,flag:"wx"}),M3(G,$)}finally{if(s9(G))j3(G)}}import{spawn as q3}from"child_process";import{basename as T3,isAbsolute as $5}from"path";var O3=0,D3=120000,_3=15000,A3=65536;function w8($=process.execPath,Q=process.argv[1]){let Z=T3($),X=(Z.startsWith("bun")||Z.startsWith("node"))&&typeof Q==="string"&&Q.length>0;return{command:$,prefix:X?[Q]:[]}}function Q5($={}){let{command:Q,prefix:Z}=w8($.executablePath,$.sourceEntrypoint),X=$.spawnProcess??q3,J=$.now??Date.now,G=null,z=0,V=!1,Y=(U)=>{try{U.kill("SIGKILL")}catch{}},H=()=>{if(V||G)return;let U;try{U=X(Q,[...Z,"__device","__hands-worker","--handoff-fd",String(O3)],{cwd:"/",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin"},shell:!1,stdio:["pipe","ignore","pipe"]})}catch{return}G=U,z=J(),U.on("error",()=>{if(G===U)G=null}),U.once("exit",(F,K)=>{if(G!==U)return;G=null,$.log?.("hands.worker_prespawn_exited",{exit_code:F,exit_signal:K})}),$.log?.("hands.worker_prespawned",{pid:U.pid??null})};return{arm:H,take(U){let F=G;if(!F||V)return null;let K=U.args.at(-1),L=U.options.env,B=U.options.cwd,W=[...Z,"__device","__hands-worker","--config"];if(U.command!==Q||U.args.length!==W.length+1||W.some((_,R)=>U.args[R]!==_)||typeof K!=="string"||!L||typeof B!=="string"||U.options.shell||JSON.stringify(U.options.stdio)!==JSON.stringify(["ignore","ignore","pipe"]))return null;G=null;let j=F.stdin,O={configPath:K,cwd:B,env:Object.fromEntries(Object.entries(L).filter((_)=>typeof _[1]==="string"))},q=JSON.stringify(O);if(F.exitCode!==null||F.signalCode!==null||!j||j.destroyed||J()-z>=D3-_3||Buffer.byteLength(q,"utf8")>A3)return Y(F),null;return j.on("error",()=>{return}),j.end(q),F.once("exit",()=>{H()}),$.log?.("hands.worker_prespawn_taken",{pid:F.pid??null}),F},adopt(U){U.once("exit",()=>{H()})},close(){if(V=!0,G)Y(G);G=null}}}import{accessSync as S3,constants as w3,statSync as b3}from"fs";import{homedir as k3,tmpdir as f3,userInfo as g3}from"os";var x3=new Set(["ALL_PROXY","BUN_BE_BUN","BUN_OPTIONS","CURL_CA_BUNDLE","GIT_SSL_CAINFO","GRPC_DEFAULT_SSL_ROOTS_FILE_PATH","HTTPS_PROXY","HTTP_PROXY","NO_PROXY","NODE_EXTRA_CA_CERTS","NODE_OPTIONS","NODE_TLS_REJECT_UNAUTHORIZED","REQUESTS_CA_BUNDLE","SSLKEYLOGFILE","SSL_CERT_DIR","SSL_CERT_FILE","all_proxy","http_proxy","https_proxy","no_proxy"]);var P3=["BUN_CONFIG_","BUN_INSPECT","DYLD_","NODE_DEBUG"],I3=new Set(["BUN_INSTALL"]);var R3=/^--(?:max-old-space-size|max-semi-space-size|stack-size)=\d{1,9}$/;function E3($){return($??"").split(/\s+/).filter(Boolean).every((Q)=>R3.test(Q.replaceAll("_","-")))}function IQ($){return Object.keys($).filter((Q)=>x3.has(Q)&&!(Q==="NODE_OPTIONS"&&E3($[Q]))||P3.some((Z)=>Q.startsWith(Z))||Q.startsWith("BUN_")&&!I3.has(Q)).sort()}var m3=new Set(["HOME","PATH","PWD","OLDPWD","SHLVL","_","TMPDIR","TMP","TEMP","SHELL","BASH_ENV","ENV","ZDOTDIR","PROMPT_COMMAND","IFS","CDPATH","GLOBIGNORE","SHELLOPTS","BASHOPTS","NODE_PATH"]),y3=/^(?:ARA_|REASON_|PI_|GIT_|GH_|GITHUB_|LD_|DYLD_|BUN_|BASH_FUNC_|SSH_)/,h3=/TOKEN|SECRET|PASSW|PASSPHRASE|CREDENTIAL|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|AUTH/i,v3=/^[A-Za-z_][A-Za-z0-9_]*$/;function SQ($=process.env){let Q=(J)=>{if(!J.startsWith("/")||/[\0\r\n]/.test(J)||J.length>32768)throw Error("invalid_host_execution_environment");return J};if($.PATH!==void 0&&(/[\0\r\n]/.test($.PATH)||$.PATH.length>32768))throw Error("invalid_host_execution_environment");let Z=new Set(IQ($)),X=Object.fromEntries(Object.entries($).filter((J)=>{let[G,z]=J;return typeof z==="string"&&z.length<=32768&&!z.includes("\x00")&&G.length<=128&&v3.test(G)&&!Z.has(G)&&!m3.has(G)&&!y3.test(G)&&!h3.test(G)}).sort(([J],[G])=>J.localeCompare(G)).slice(0,512));return{home:Q($.HOME||k3()),path:EQ($.PATH??"").join(":")||RQ,temporaryDirectory:Q($.TMPDIR||$.TMP||$.TEMP||f3()),variables:X}}function wQ($=process.env,Q=()=>g3().shell){let Z=(J)=>{if(!J||!/^\/[A-Za-z0-9._/-]*\/(?:bash|zsh)$/.test(J))return!1;try{return S3(J,w3.X_OK),b3(J).isFile()}catch{return!1}};if(Z($.SHELL))return $.SHELL;let X;try{X=Q()}catch{X=void 0}return Z(X)?X:"/bin/zsh"}import{readFileSync as fQ,realpathSync as bQ,statSync as c3}from"fs";import{homedir as d3}from"os";import{dirname as p3,isAbsolute as u3,join as A9,sep as l3}from"path";var P5="--proxy",I5="--proxy-ca-file",s3=262144;class J0 extends Error{}function k8($){let Q;try{Q=new URL($)}catch{throw new J0("The proxy must be a URL like https://proxy.example.com:3128.")}if(Q.protocol!=="https:"&&Q.protocol!=="http:")throw new J0("The proxy URL must use the https or http scheme.");if(!Q.hostname)throw new J0("The proxy URL must name a host.");if(Q.port!==""&&Number(Q.port)<1)throw new J0("The proxy URL must use a port between 1 and 65535.");if(Q.pathname!==""&&Q.pathname!=="/"||Q.search||Q.hash)throw new J0("The proxy URL must not carry a path, query, or fragment.");return Q.toString()}function R5($){let Q=new URL($.url),Z=Q.port||(Q.protocol==="https:"?"443":"80");return`${Q.hostname}:${Z}`}function n3($={}){let Q=$.home??d3(),Z=$.statePath??kQ();return[p3(Z),A9(Q,".ssh"),A9(Q,".aws"),A9(Q,".gnupg"),A9(Q,".kube"),A9(Q,"Library","Keychains")]}function i3($,Q){return Q===$||Q.startsWith($+l3)}function o3($,Q={}){if(!u3($))throw new J0("The proxy CA file must be an absolute path.");let Z,X,J;try{Z=bQ($);let V=c3(Z);X=V.size,J=V.isFile()}catch{throw new J0("The proxy CA file does not exist or is not readable.")}if(!J)throw new J0("The proxy CA file must be a regular file.");if(X>s3)throw new J0("The proxy CA file must be 256 KB or smaller.");let G=n3(Q).flatMap((V)=>{try{let Y=bQ(V);return Y===V?[V]:[V,Y]}catch{return[V]}});for(let V of[$,Z])if(G.some((Y)=>i3(Y,V)))throw new J0("The proxy CA file must not live inside a credential directory.");let z;try{z=fQ(Z,"utf8")}catch{throw new J0("The proxy CA file is not readable.")}if(!z.includes("-----BEGIN CERTIFICATE-----"))throw new J0("The proxy CA file must be a PEM certificate bundle.");return Z}function E5($,Q={}){if(!$.proxyUrl)throw new J0("A proxy URL is required.");let Z=k8($.proxyUrl),X=$.caFile===void 0?void 0:o3($.caFile,Q);return{version:n9,url:Z,...X===void 0?{}:{caFile:X}}}function S5($,Q=fetch){if(!$)return Q;let Z,X=!1;return(G,z)=>{if(!X){if($.caFile)try{Z=fQ($.caFile,"utf8")}catch{throw new J0(`The configured proxy CA file is not readable: ${$.caFile}`)}X=!0}let V={...z,proxy:$.url,...Z===void 0?{}:{tls:{ca:Z}}};return Q(G,V)}}import{createHash as a3}from"crypto";import{isAbsolute as mQ,join as yQ,relative as hQ,resolve as o9,sep as vQ}from"path";var i9=x.string().min(1).refine(mQ,"absolute path required"),f8=x.strictObject({version:x.literal(1),apiOrigin:x.url(),channel:x.enum(["staging","production"]),stateDirectory:i9,workspaceRoot:i9,lifetime:x.enum(["persistent","ephemeral"]),executionMode:x.enum(["confined","host"]).default("confined"),name:x.string().min(1).max(160).default("Reason headless worker"),slots:x.number().int().min(1).max(4).default(1),shutdownGraceMs:x.number().int().min(0).max(300000).default(30000),proxy:x.strictObject({version:x.literal(n9),url:x.string().refine(($)=>{try{return k8($)===$}catch{return!1}},"invalid proxy URL"),caFile:i9.optional()}).optional(),userChrome:x.boolean().optional(),cloudSessions:x.literal(!0).optional(),localLogins:x.boolean().optional(),folders:x.array(i9).min(1).max(31).optional()}),r3=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,v5=x.discriminatedUnion("channel",[f8,f8.extend({channel:x.literal("pr"),apiOrigin:x.string(),prEnvironment:x.string()}),f8.extend({channel:x.literal("local-qa"),apiOrigin:x.string()})]).superRefine(($,Q)=>{if($.channel==="local-qa"){if(!r3.test($.apiOrigin))Q.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else if($.channel==="pr"){let X=$.prEnvironment,J=/^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.up\.railway\.app$/.exec($.apiOrigin),G=J?.[1]?.match(/(?:^|-)pr-[0-9]+(?=-|$)/g)?.map((z)=>z.replace(/^-/,""));if(!X||/^pr-[1-9][0-9]*$/.exec(X)?.[0]!==X||J?.[0]!==$.apiOrigin||G?.length!==1||G[0]!==X)Q.addIssue({code:"custom",message:"PR worker requires explicit prEnvironment and an exact same-PR HTTPS Railway origin"})}else{let X=new URL($.apiOrigin);if(X.origin!==$.apiOrigin||X.username||X.password||X.protocol!=="https:"&&!(X.protocol==="http:"&&g8(X.origin))||!g8(X.origin)&&!gQ($.channel,X.origin))Q.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!x9($.workspaceRoot,$.stateDirectory))Q.addIssue({code:"custom",message:"state and workspace must be disjoint"});let Z=$.folders??[];if(new Set([$.workspaceRoot,...Z]).size!==Z.length+1||Z.some((X)=>!x9(X,$.stateDirectory)))Q.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function t3($){return yQ($.stateDirectory,`headless-${$.channel==="pr"?$.prEnvironment:$.channel}`)}function c5($,Q={},Z={}){let X=$.executionMode==="host"?"unsandboxed":"sandboxed";return{worker:Object.freeze({executionMode:X,runtimeDirectory:t3($),handsSlots:$.slots,readiness:Object.freeze({...Q}),...Z.persistentTerminals?{persistentTerminals:!0}:{},...Z.probing?.length?{probing:Object.freeze([...Z.probing])}:{},...Z.displayVideo?{displayVideo:!0}:{},...Z.handsBrowser&&Q["hands.connect"]===!0?{handsBrowser:!0}:{},...Z.githubSignedIn===void 0?{}:{githubSignedIn:Z.githubSignedIn},...$.userChrome!==!1&&Z.userChrome?{userChrome:Z.userChrome}:{},...$.cloudSessions&&Q["automation.call.v1"]===!0?{cloudSessions:!0}:{}}),proxy:$.proxy??null}}function x9($,Q){if(w0(Q,$))return!1;return!w0($,Q)||b0(yQ(vQ,hQ(o9($),o9(Q))))}function w0($,Q){let Z=hQ(o9($),o9(Q));return Z===""||Z!==".."&&!Z.startsWith(`..${vQ}`)&&!mQ(Z)}function d5($){let{proxy:Q,userChrome:Z,cloudSessions:X,localLogins:J,folders:G,...z}=$;return a3("sha256").update(JSON.stringify(z)).digest("hex")}import{readdir as e3}from"fs/promises";var $1=15000;function Q1($){let Q=$ instanceof Error&&"code"in $?$.code:null;return Q==="EPERM"||Q==="EACCES"}function Z1($){return new C("folder_access_denied",`macOS blocked Reason from opening ${$}. Allow Reason in System Settings \u203A Privacy & Security \u203A Files and Folders `+"(or Full Disk Access), then try again.")}async function cQ($,{timeoutMs:Q=$1,open:Z=(X)=>e3(X)}={}){let X,J=new Promise((G)=>{X=setTimeout(()=>G("pending"),Q)});try{if(await Promise.race([Z($).then(()=>"open"),J])==="pending")throw new C("folder_access_pending",`macOS is asking whether Reason may open ${$}. Answer the prompt on this Mac, then try again.`)}catch(G){if(Q1(G))throw Z1($);if(G instanceof C)throw G}finally{clearTimeout(X)}}import{chmodSync as b1,closeSync as k1,constants as s8,fstatSync as f1,lstatSync as VZ,openSync as g1,readSync as m1,realpathSync as n8,unlinkSync as y1}from"fs";import{lookup as h1}from"dns/promises";import{createRequire as v1}from"module";import{request as c1}from"http";import{request as d1}from"https";import l0 from"net";import{platform as LZ}from"os";import{basename as p1,extname as u1,isAbsolute as HZ,relative as i8,resolve as G9,sep as o8}from"path";var dQ=String.raw`
+async (roots) => {
+  "use strict";
+  const version = 2;
+  if (globalThis.__araHandsRepl && globalThis.__araHandsRepl.version === version) return;
+  const hostCall = globalThis.__araHandsRpc;
+  if (typeof hostCall !== "function") throw new Error("Reason Hands browser bridge is not installed");
+  try { delete globalThis.__araHandsRpc; } catch (error) {
+    if (!(error instanceof TypeError)) throw error;
+  }
+
+  const handles = new WeakMap();
+  const bytes = new WeakMap();
+  const routes = new WeakMap();
+  const derived = new Set([
+    "browser", "context", "frame", "frameLocator", "getByAltText", "getByLabel",
+    "getByPlaceholder", "getByRole", "getByTestId", "getByText", "getByTitle",
+    "contentFrame", "locator", "nth", "mainFrame", "newContext", "newPage", "opener", "owner", "page", "parentFrame",
+  ]);
+  const locatorMethods = new Set([
+    "all", "allInnerTexts", "allTextContents", "and", "ariaSnapshot", "blur",
+    "boundingBox", "check", "clear", "click", "contentFrame", "count", "dblclick",
+    "dragTo", "evaluate", "evaluateAll", "fill", "filter", "focus", "getAttribute",
+    "hover", "innerHTML", "innerText", "inputValue", "isChecked", "isEditable",
+    "isEnabled", "isHidden", "isVisible", "or", "page", "press", "pressSequentially",
+    "screenshot", "scrollIntoViewIfNeeded", "selectOption", "setInputFiles", "tap",
+    "textContent", "type", "uncheck", "waitFor",
+  ]);
+  const pageMethods = new Set([
+    "addInitScript", "addScriptTag", "addStyleTag", "bringToFront", "close", "content",
+    "emulateMedia", "evaluate", "frameLocator", "frames", "goBack", "goForward", "goto",
+    "isClosed", "pdf", "reload", "route", "screenshot", "captureScreenshot", "selectOption", "setContent",
+    "setDefaultNavigationTimeout", "setDefaultTimeout", "setExtraHTTPHeaders", "setInputFiles",
+    "setViewportSize", "title", "unroute", "url", "viewportSize", "waitForFunction",
+    "waitForLoadState", "waitForNavigation", "waitForTimeout", "waitForURL",
+  ]);
+  const contextMethods = new Set([
+    "startRecording", "stopRecording",
+    "addCookies", "addInitScript", "clearCookies", "clearPermissions", "close", "cookies",
+    "grantPermissions", "pages", "route", "setDefaultNavigationTimeout", "setDefaultTimeout",
+    "setExtraHTTPHeaders", "setGeolocation", "setHTTPCredentials", "setOffline",
+    "setViewportSize", "storageState", "unroute", "viewportSize",
+  ]);
+  const browserMethods = new Set(["close", "contexts", "isConnected", "version"]);
+  const frameMethods = new Set([
+    "addScriptTag", "addStyleTag", "childFrames", "content", "evaluate", "frameLocator",
+    "goto", "isDetached", "name", "parentFrame", "setContent", "title", "url",
+    "waitForFunction", "waitForLoadState", "waitForNavigation", "waitForTimeout", "waitForURL",
+  ]);
+
+  function record(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+  }
+  function handle(value) {
+    return record(value) && value.$handsRepl === "handle"
+      && typeof value.id === "string" && typeof value.kind === "string";
+  }
+  function clone(value, stack) {
+    if (value === null || typeof value === "boolean" || typeof value === "string") return value;
+    if (typeof value === "number") {
+      if (!Number.isFinite(value)) throw new TypeError("Reason Hands bridge accepts only finite numbers");
+      return value;
+    }
+    if (!value || typeof value !== "object") throw new TypeError("Reason Hands bridge accepts only JSON data");
+    if (stack.has(value)) throw new TypeError("Reason Hands bridge does not accept cyclic data");
+    stack.add(value);
+    try {
+      if (Array.isArray(value)) return value.map((item) => clone(item, stack));
+      if (!record(value)) throw new TypeError("Reason Hands bridge accepts only plain objects");
+      const output = Object.create(null);
+      for (const key of Object.keys(value)) {
+        if (key === "__proto__" || key === "constructor" || key === "prototype") {
+          throw new TypeError("Reason Hands bridge rejects unsafe object keys");
+        }
+        output[key] = clone(value[key], stack);
+      }
+      return output;
+    } finally { stack.delete(value); }
+  }
+  function data(value) { return clone(value, new WeakSet()); }
+  function refOf(value) {
+    const ref = value && typeof value === "object" ? handles.get(value) : undefined;
+    if (!ref) throw new TypeError("Reason Hands operation needs a browser target");
+    return ref;
+  }
+  async function wire(value) {
+    const target = value && typeof value === "object" ? handles.get(value) : undefined;
+    if (target) return (await target).handle;
+    const binary = value && typeof value === "object" ? bytes.get(value) : undefined;
+    if (binary) return binary;
+    const route = value && typeof value === "object" ? routes.get(value) : undefined;
+    if (route) return route;
+    if (value === null || typeof value === "boolean" || typeof value === "string") return value;
+    if (typeof value === "number") {
+      if (!Number.isFinite(value)) throw new TypeError("Reason Hands bridge accepts only finite numbers");
+      return value;
+    }
+    if (Array.isArray(value)) return await Promise.all(value.map(wire));
+    if (!record(value)) throw new TypeError("Reason Hands bridge accepts only JSON data");
+    const output = Object.create(null);
+    for (const key of Object.keys(value)) output[key] = await wire(value[key]);
+    return output;
+  }
+  function decode(value) {
+    if (handle(value)) return makeTarget(value);
+    if (record(value) && value.$handsRepl === "bytes" && typeof value.base64 === "string") {
+      const output = Object.freeze({ $handsRepl: "bytes", base64: value.base64 });
+      bytes.set(output, output);
+      return output;
+    }
+    if (record(value) && value.$handsRepl === "undefined") return undefined;
+    if (Array.isArray(value)) return value.map(decode);
+    if (!record(value)) return value;
+    const output = Object.create(null);
+    for (const key of Object.keys(value)) output[key] = decode(value[key]);
+    return output;
+  }
+  async function rpc(request) { return decode(await hostCall(request)); }
+  async function invoke(ref, method, args) {
+    return await rpc({ type: "call", target: ref.handle, method, args: await Promise.all(args.map(wire)) });
+  }
+  function targetFrom(value) {
+    const ref = value && typeof value === "object" ? handles.get(value) : undefined;
+    if (!ref) throw new Error("Reason Hands bridge received an invalid target");
+    return ref;
+  }
+  function lazy(refPromise) {
+    const object = Object.create(null);
+    const ready = Promise.resolve(refPromise);
+    const proxy = new Proxy(object, {
+      get(_object, key) {
+        if (key === "then") return (resolve, reject) => {
+          // Derived targets carry the bridge's internal { handle, kind } ref,
+          // not the wire handle accepted by makeTarget. Passing the wrapper
+          // used to throw inside this detached fulfillment callback; because
+          // that rejection was not forwarded to the thenable consumer, every
+          // await context.newPage() / await page.context() hung until an
+          // outer tool deadline destroyed the evaluator execution context.
+          ready.then((ref) => {
+            try { resolve(makeTarget(ref.handle)); } catch (error) { reject(error); }
+          }, reject);
+        };
+        if (typeof key !== "string") return undefined;
+        if (key === "first" || key === "last") return lazy(ready.then(async (ref) => targetFrom(await invoke(ref, key, []))));
+        if (derived.has(key)) return (...args) => lazy(ready.then(async (ref) => targetFrom(await invoke(ref, key, args))));
+        if (key === "evaluate" || key === "evaluateAll") return (source, argument) => ready.then((ref) => evaluateInTarget(ref, source, argument));
+        return (...args) => ready.then((ref) => invoke(ref, key, args));
+      },
+    });
+    handles.set(proxy, ready);
+    return proxy;
+  }
+  function makeTarget(handleValue) {
+    if (!handle(handleValue)) throw new Error("Reason Hands bridge received an invalid handle");
+    const ref = { handle: Object.freeze({ $handsRepl: "handle", id: handleValue.id, kind: handleValue.kind }), kind: handleValue.kind };
+    const object = Object.create(null);
+    // Preserve the existing synchronous viewport facade. URL reads use the
+    // dispatcher: a human can navigate the real page without an agent goto,
+    // and a new evaluator must not invent about:blank for that live page.
+    const meta = {
+      viewport: ref.kind === "page" && ref.handle.id === roots.page.id
+        ? { width: 1440, height: 900 }
+        : undefined,
+    };
+    const invokeDerived = (method, args) => lazy(Promise.resolve(invoke(ref, method, args)).then(targetFrom));
+    const get = (_object, key) => {
+      if (key === "first" || key === "last") return invokeDerived(key, []);
+      if (typeof key !== "string") return undefined;
+      if (key === "evaluate" || key === "evaluateAll") return (source, argument) => evaluateInTarget(ref, source, argument);
+      if (ref.kind === "page" && key === "viewportSize" && meta.viewport) {
+        return () => ({ ...meta.viewport });
+      }
+      if (ref.kind === "page" && key === "setViewportSize") {
+        return (next) => invoke(ref, key, [next]).then((value) => {
+          if (record(next) && typeof next.width === "number" && typeof next.height === "number") {
+            meta.viewport = { width: next.width, height: next.height };
+          }
+          return value;
+        });
+      }
+      if ((ref.kind === "page" || ref.kind === "context") && key === "route") {
+        return async (url, handler) => {
+          if (typeof handler !== "function") return await invoke(ref, key, [url, handler]);
+          let fulfillment;
+          const route = Object.freeze({
+            fulfill: async (options) => {
+              if (fulfillment) throw new TypeError("route() can register one fulfillment action");
+              fulfillment = routeFulfill(options);
+            },
+          });
+          await handler(route);
+          if (!fulfillment) {
+            throw new TypeError("route() supports a data-only route.fulfill({ ... }) callback");
+          }
+          return await invoke(ref, key, [url, fulfillment]);
+        };
+      }
+      if (derived.has(key)) return (...args) => invokeDerived(key, args);
+      const methods = ref.kind === "browser" ? browserMethods
+        : ref.kind === "context" ? contextMethods
+          : ref.kind === "page" ? pageMethods
+            : ref.kind === "frame" ? frameMethods
+              : locatorMethods;
+      if (!methods.has(key)) return undefined;
+      return (...args) => invoke(ref, key, args);
+    };
+    const proxy = new Proxy(object, { get });
+    handles.set(proxy, Promise.resolve(ref));
+    return proxy;
+  }
+  async function evaluateInTarget(ref, source, argument) {
+    const text = typeof source === "function" ? Function.prototype.toString.call(source) : source;
+    if (typeof text !== "string" || !text.trim()) throw new TypeError("evaluate() needs a function or expression string");
+    const value = argument === undefined ? undefined : JSON.stringify(await wire(argument));
+    let renderer;
+    if (ref.kind === "locator") {
+      renderer = typeof source === "function"
+        ? "(element) => (" + text + ")(element" + (value === undefined ? "" : ", " + value) + ")"
+        : text;
+    } else {
+      renderer = typeof source === "function"
+        ? "(" + text + ")(" + (value === undefined ? "" : value) + ")"
+        : value === undefined ? text : "(" + text + ")(" + value + ")";
+    }
+    return await invoke(ref, "evaluate", [renderer]);
+  }
+  function routeFulfill(options) {
+    const token = Object.freeze(Object.create(null));
+    routes.set(token, { $handsRepl: "routeFulfill", options: data(options) });
+    return token;
+  }
+  const replConsole = Object.freeze({
+    log: (...values) => { logs.push(values.map(render).join(" ")); },
+    info: (...values) => { logs.push(values.map(render).join(" ")); },
+    warn: (...values) => { logs.push("[warn] " + values.map(render).join(" ")); },
+    error: (...values) => { logs.push("[error] " + values.map(render).join(" ")); },
+  });
+  function render(value) {
+    if (value === undefined) return "undefined";
+    if (typeof value === "string") return value;
+    try { const text = JSON.stringify(value); return text === undefined ? String(value) : text; } catch { return "[unrenderable]"; }
+  }
+  const logs = [];
+  const browser = makeTarget(roots && roots.browser);
+  const context = makeTarget(roots && roots.context);
+  const page = makeTarget(roots && roots.page);
+  const state = Object.create(null);
+  async function a11y(target) {
+    const ref = target === undefined ? await refOf(page) : await refOf(target);
+    return await rpc({ type: "a11y", target: ref.handle });
+  }
+  async function view(source, options) {
+    return await rpc({ type: "view", source: await wire(source), options: options === undefined ? Object.create(null) : await wire(options) });
+  }
+  async function evaluate(code) {
+    if (typeof code !== "string") throw new TypeError("Reason Hands REPL code must be a string");
+    logs.length = 0;
+    let program;
+    let statementList = false;
+    try { program = new Function('"use strict"; return (async () => await (' + code + "\n))();"); }
+    catch {
+      statementList = true;
+      const strictCode = '"use strict";\n' + code;
+      program = new Function(
+        '"use strict"; return (async () => (0, eval)(' + JSON.stringify(strictCode) + '))();',
+      );
+    }
+    let value;
+    try {
+      value = await program();
+    } catch (error) {
+      // Indirect eval preserves a statement-list completion value but cannot
+      // parse top-level await or return. Those programs retain the prior async
+      // block behavior; a syntax failure occurs before any user code executes.
+      if (!statementList || !(error instanceof SyntaxError)) throw error;
+      program = new Function('"use strict"; return (async () => {' + code + "\n})();");
+      value = await program();
+    }
+    const output = render(value);
+    return logs.length === 0 ? output : value === undefined ? logs.join("\n") : logs.join("\n") + "\n" + output;
+  }
+  function install(name, value) { Object.defineProperty(globalThis, name, { value, configurable: false, enumerable: false, writable: false }); }
+  install("browser", browser); install("context", context); install("page", page);
+  install("state", state); install("browserState", state);
+  install("a11y", a11y); install("view", view); install("routeFulfill", routeFulfill); install("console", replConsole);
+  install("__araHandsRepl", Object.freeze({ version, evaluate }));
+}
+`.trim(),pQ=String.raw`
+async (input) => {
+  const bridge = globalThis.__araHandsRepl;
+  if (!bridge || typeof bridge.evaluate !== "function") throw new Error("Reason Hands browser bridge is not installed");
+  return await bridge.evaluate(typeof input === "string" ? input : input && input.code);
+}
+`.trim();import{Buffer as X9}from"buffer";import{randomUUID as X1}from"crypto";class nQ extends Error{code;constructor($){super($==="hands_repl_private_profile_attribute_denied"?"Private browser attribute read denied.":$);this.code=$;this.name="HandsReplBrowserDispatcherError"}}var iQ=new Set(["__defineGetter__","__defineSetter__","__lookupGetter__","__lookupSetter__","__proto__","constructor","prototype"]),uQ=/^hands_[A-Za-z0-9_-]{8,128}$/,J1=2048,oQ=32,aQ=1e4,Y1=new Set(["href","src","alt","title","role","aria-label","aria-expanded","aria-checked","aria-selected","aria-disabled","placeholder","type","name","data-testid"]);function G1($){let Q=$.split("+"),Z=(Q.pop()??"").replace(/^Key/,"").toLowerCase();if(Z==="f12")return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&["l","n","t","j","i","p","s","w","u","o","r","tab","pageup","pagedown"].includes(Z))return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&Q.includes("Shift")&&Z==="c")return!0;return Q.includes("Alt")&&["d","arrowleft","arrowright","home"].includes(Z)}var z1=($)=>{let Q=$.closest("a[href],area[href]");return{password:$.tagName==="INPUT"&&$.type==="password",executableLink:Boolean(Q&&!/^(https?:|about:blank)/i.test(Q.href))}},rQ={browser:{close:{returns:"void"},contexts:{returns:"context[]"},isConnected:{returns:"json"},version:{returns:"json"}},context:{addCookies:{returns:"void"},addInitScript:{returns:"void"},browser:{returns:"browser"},clearCookies:{returns:"void"},clearPermissions:{returns:"void"},close:{returns:"void"},cookies:{returns:"json"},grantPermissions:{returns:"void"},newPage:{returns:"page"},pages:{returns:"page[]"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setGeolocation:{returns:"void"},setHTTPCredentials:{returns:"void"},setOffline:{returns:"void"},setViewportSize:{returns:"void"},storageState:{returns:"json"},viewportSize:{returns:"json",special:"contextViewportSize"}},page:{addInitScript:{returns:"void"},addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},bringToFront:{returns:"void"},close:{returns:"void"},content:{returns:"json"},context:{returns:"context"},emulateMedia:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},frame:{returns:"frame"},frameLocator:{returns:"frameLocator"},frames:{returns:"frame[]"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goBack:{returns:"void"},goForward:{returns:"void"},goto:{returns:"void"},isClosed:{returns:"json"},locator:{returns:"locator"},mainFrame:{returns:"frame"},opener:{returns:"page"},pdf:{returns:"bytes"},reload:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setContent:{returns:"void"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setInputFiles:{returns:"void"},setViewportSize:{returns:"void"},title:{returns:"json"},url:{returns:"json"},viewportSize:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},locator:{all:{returns:"locator[]"},allInnerTexts:{returns:"json"},allTextContents:{returns:"json"},and:{returns:"locator"},ariaSnapshot:{returns:"json"},blur:{returns:"void"},boundingBox:{returns:"json"},check:{returns:"void"},clear:{returns:"void"},click:{returns:"void"},contentFrame:{returns:"frameLocator"},count:{returns:"json"},dblclick:{returns:"void"},dragTo:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},evaluateAll:{returns:"json",requiresStringSource:!0},fill:{returns:"void"},filter:{returns:"locator"},first:{returns:"locator",special:"property"},focus:{returns:"void"},getAttribute:{returns:"json"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},hover:{returns:"void"},innerHTML:{returns:"json"},innerText:{returns:"json"},inputValue:{returns:"json"},isChecked:{returns:"json"},isEditable:{returns:"json"},isEnabled:{returns:"json"},isHidden:{returns:"json"},isVisible:{returns:"json"},last:{returns:"locator",special:"property"},locator:{returns:"locator"},nth:{returns:"locator"},or:{returns:"locator"},page:{returns:"page"},press:{returns:"void"},pressSequentially:{returns:"void"},scrollIntoViewIfNeeded:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setInputFiles:{returns:"void"},tap:{returns:"void"},textContent:{returns:"json"},type:{returns:"void"},uncheck:{returns:"void"},waitFor:{returns:"void"}},frame:{addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},childFrames:{returns:"frame[]"},content:{returns:"json"},evaluate:{returns:"json",requiresStringSource:!0},frameLocator:{returns:"frameLocator"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goto:{returns:"void"},isDetached:{returns:"json"},locator:{returns:"locator"},name:{returns:"json"},page:{returns:"page"},parentFrame:{returns:"frame"},setContent:{returns:"void"},title:{returns:"json"},url:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},frameLocator:{getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},locator:{returns:"locator"},owner:{returns:"locator"}}};function I($){throw new nQ($)}function z0($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Q=Object.getPrototypeOf($);return Q===Object.prototype||Q===null}function J9($,Q=0,Z={nodes:0}){if(Q>oQ||++Z.nodes>aQ)I("hands_repl_json_too_complex");if($===null||typeof $==="boolean"||typeof $==="string")return;if(typeof $==="number"){if(!Number.isFinite($))I("hands_repl_invalid_json");return}if(Array.isArray($)){for(let X of $)J9(X,Q+1,Z);return}if(!z0($))I("hands_repl_invalid_json");for(let[X,J]of Object.entries($)){if(iQ.has(X))I("hands_repl_invalid_json");J9(J,Q+1,Z)}}function m8($){return typeof $==="string"&&Object.hasOwn(rQ,$)}function K1($){if(!$.endsWith("[]"))return null;let Q=$.slice(0,-2);return m8(Q)?Q:null}function lQ($){return z0($)&&Object.keys($).length===2&&$.$handsRepl==="bytes"&&typeof $.base64==="string"}function V1($){return z0($)&&Object.keys($).length===1&&$.$handsRepl==="undefined"}function sQ($){return z0($)&&Object.keys($).length===2&&$.$handsRepl==="routeFulfill"&&"options"in $}function k0($){return!!$&&typeof $==="object"}function a9(){return Object.freeze({$handsRepl:"undefined"})}function H1($){if(!X9.isBuffer($)&&!($ instanceof Uint8Array))I("hands_repl_expected_bytes");return Object.freeze({$handsRepl:"bytes",base64:X9.from($).toString("base64")})}function tQ($){if(!k0($.browser)||!k0($.context)||!k0($.page))I("hands_repl_invalid_roots");if(typeof $.a11y!=="function"||typeof $.view!=="function")I("hands_repl_invalid_callbacks");let Q=$.maxHandles??J1;if(!Number.isInteger(Q)||Q<3||Q>1e5)I("hands_repl_invalid_handle_limit");let Z=new Map,X=new WeakMap,J=$.createOpaqueId??X1,G=(K,L)=>{if(!k0(L))I("hands_repl_expected_target");let B=X.get(L)?.get(K);if(B)return B;if(Z.size>=Q)I("hands_repl_handle_limit");let W="";for(let q=0;q<16;q+=1){let _=`hands_${J()}`;if(uQ.test(_)&&!Z.has(_)){W=_;break}}if(!W)I("hands_repl_invalid_opaque_id");let j=Object.freeze({$handsRepl:"handle",id:W,kind:K});Z.set(W,{kind:K,target:L});let O=X.get(L);if(!O)O=new Map,X.set(L,O);return O.set(K,j),j},z=Object.freeze({browser:G("browser",$.browser),context:G("context",$.context),page:G("page",$.page)}),V=(K)=>{if(!z0(K)||Object.keys(K).length!==3||K.$handsRepl!=="handle"||typeof K.id!=="string"||!uQ.test(K.id)||!m8(K.kind))I("hands_repl_invalid_handle");let L=Z.get(K.id);if(!L||L.kind!==K.kind)I("hands_repl_unknown_handle");return L},Y=(K,L=0,B=new Set)=>{if(L>oQ)I("hands_repl_json_too_complex");if(K===void 0)return a9();if(K===null||typeof K==="boolean"||typeof K==="string")return K;if(typeof K==="number"){if(!Number.isFinite(K))I("hands_repl_non_json_result");return K}if(Array.isArray(K)){if(B.has(K))I("hands_repl_cyclic_result");B.add(K);try{return K.map((W)=>Y(W,L+1,B))}finally{B.delete(K)}}if(!z0(K))I("hands_repl_non_json_result");if(B.has(K))I("hands_repl_cyclic_result");B.add(K);try{let W=Object.create(null);for(let j of Object.keys(K)){let O=Object.getOwnPropertyDescriptor(K,j);if(!O||!("value"in O))continue;W[j]=Y(O.value,L+1,B)}return W}finally{B.delete(K)}},H=(K,L)=>{if(L==="void")return a9();if(L==="json")return Y(K);if(L==="bytes")return H1(K);let B=K1(L);if(B){if(!Array.isArray(K))I("hands_repl_expected_target_list");if(B==="context"&&K.some((W)=>W!==$.context))I("hands_repl_foreign_context");return K.map((W)=>G(B,W))}if(K===null||K===void 0)return a9();if(!m8(L))I("hands_repl_invalid_return_kind");if(L==="context"&&K!==$.context)I("hands_repl_foreign_context");return G(L,K)},U=(K)=>{if(z0(K)&&K.$handsRepl==="handle")return V(K).target;if(lQ(K))return X9.from(K.base64,"base64");if(V1(K))return;if(sQ(K))I("hands_repl_route_fulfill_only");if(Array.isArray(K))return K.map(U);if(!z0(K))return K;let L=Object.create(null);for(let[B,W]of Object.entries(K))L[B]=U(W);return L};return Object.freeze({roots:z,dispatch:async(K)=>{if(!z0(K)||typeof K.type!=="string")I("hands_repl_invalid_request");if(K.type==="a11y"){let T=K.target===void 0?Z.get(z.page.id):V(K.target);if(!T||T.kind!=="page"&&T.kind!=="locator")I("hands_repl_invalid_a11y_target");return Y(await $.a11y(T.target))}if(K.type==="view"){if(J9(K.source),K.options!==void 0)J9(K.options);let T=lQ(K.source)?X9.from(K.source.base64,"base64"):K.source;if($.privateProfile&&!X9.isBuffer(T))I("hands_repl_profile_requires_image_bytes");return Y(await $.view(T,K.options))}if(K.type!=="call")I("hands_repl_invalid_request");if(typeof K.method!=="string"||K.method.length===0||K.method.length>128)I("hands_repl_invalid_method");if(iQ.has(K.method))I("hands_repl_forbidden_method");let L=V(K.target),B=K.args??[];if(!Array.isArray(B))I("hands_repl_invalid_arguments");if(J9(B),L.kind==="page"&&K.method==="captureScreenshot"){if(B.length!==0)I("hands_repl_invalid_arguments");if(!$.screenshotExport)I("hands_repl_screenshot_export_unavailable");return Y(await $.screenshotExport(L.target))}if(L.kind==="context"&&["startRecording","stopRecording"].includes(K.method)){if(!$.recording||L.target!==$.context)I("hands_repl_recording_unavailable");if(B.length>(K.method==="startRecording"?1:0))I("hands_repl_invalid_arguments");return Y(K.method==="startRecording"?await $.recording.start(B[0]):await $.recording.stop())}if($.privateProfile){let T=K.method;if(["evaluate","evaluateAll","waitForFunction","addInitScript","addScriptTag","addStyleTag","setContent","setInputFiles","route","content","cookies","storageState","addCookies","clearCookies","setExtraHTTPHeaders","setHTTPCredentials","grantPermissions","clearPermissions","innerHTML","textContent","allTextContents"].includes(T)||L.kind==="browser"&&T==="close"||L.kind==="context"&&T==="close")I("hands_repl_private_profile_method_denied");if(L.kind==="browser"&&T==="contexts")return H([$.context],"context[]");if((T==="screenshot"||T==="pdf")&&z0(B[0])&&(("path"in B[0])||("style"in B[0])))I("hands_repl_private_profile_path_denied");if(T==="goto"){if(typeof B[0]!=="string")I("hands_repl_private_profile_url_denied");try{let k=new URL(B[0]);if(!["http:","https:"].includes(k.protocol)&&B[0]!=="about:blank")I("hands_repl_private_profile_url_denied")}catch{I("hands_repl_private_profile_url_denied")}}if(T==="getAttribute"&&(typeof B[0]!=="string"||!Y1.has(B[0].toLowerCase())))I("hands_repl_private_profile_attribute_denied");if(L.kind==="locator"&&["innerText","allInnerTexts","getAttribute"].includes(T)){let k=[L.target];if(T==="allInnerTexts"){let m=Reflect.get(L.target,"all");if(typeof m!=="function")I("hands_repl_private_profile_probe_unavailable");let E=await Reflect.apply(m,L.target,[]);if(!Array.isArray(E)||E.length>aQ||!E.every(k0))I("hands_repl_private_profile_probe_unavailable");k=E}for(let m of k){let E=Reflect.get(m,"isVisible");if(typeof E!=="function"||!await Reflect.apply(E,m,[]))I("hands_repl_private_profile_hidden_value_denied")}}if(T==="press"&&typeof B[0]==="string"&&G1(B[0]))I("hands_repl_private_profile_browser_shortcut_denied");if(L.kind==="locator"&&["inputValue","click","dblclick","tap","press"].includes(T)){let k=Reflect.get(L.target,"evaluate");if(typeof k!=="function")I("hands_repl_private_profile_probe_unavailable");let m=await Reflect.apply(k,L.target,[z1]);if(!z0(m)||typeof m.password!=="boolean"||typeof m.executableLink!=="boolean")I("hands_repl_private_profile_probe_unavailable");if(T==="inputValue"&&m.password)I("hands_repl_private_profile_password_denied");if(T!=="inputValue"&&m.executableLink)I("hands_repl_private_profile_url_denied");if(T==="inputValue"){let E=Reflect.get(L.target,"isVisible");if(typeof E!=="function"||!await Reflect.apply(E,L.target,[]))I("hands_repl_private_profile_hidden_value_denied")}}}let W=rQ[L.kind][K.method];if(!W)I("hands_repl_method_not_allowed");if(W.requiresStringSource&&typeof B[0]!=="string")I("hands_repl_string_source_required");if(L.kind==="browser"&&K.method==="contexts")return[z.context];if(["addInitScript","addScriptTag","addStyleTag","screenshot","pdf","storageState"].includes(K.method)&&B.some((T)=>z0(T)&&("path"in T)))I("hands_repl_file_path_not_allowed");if(K.method==="goto"&&typeof B[0]==="string"){let T;try{T=new URL(B[0]).protocol}catch{I("hands_repl_invalid_url")}if(!["http:","https:","data:","about:","blob:"].includes(T))I("hands_repl_file_path_not_allowed")}if(W.special==="contextViewportSize"){let T=Reflect.get(L.target,"pages");if(typeof T!=="function")I("hands_repl_method_unavailable");let k=await Reflect.apply(T,L.target,[]),m=Array.isArray(k)?k[0]:void 0,E=k0(m)?Reflect.get(m,"viewportSize"):void 0;if(typeof E!=="function")return a9();return H(await Reflect.apply(E,m,[]),W.returns)}if(W.special==="property"){let T=Reflect.get(L.target,K.method);return H(typeof T==="function"?Reflect.apply(T,L.target,[]):T,W.returns)}let j=Reflect.get(L.target,K.method);if(typeof j!=="function")I("hands_repl_method_unavailable");if(W.special==="route"){let T=B[1];if(!sQ(T))I("hands_repl_invalid_route_handler");J9(T.options);let k=U(T.options),m=async(M)=>{if(!k0(M))I("hands_repl_invalid_route");let D=Reflect.get(M,"fulfill");if(typeof D!=="function")I("hands_repl_invalid_route");await Reflect.apply(D,M,[k])},E=[U(B[0]??null),m],N=await Reflect.apply(j,L.target,E);return H(N,W.returns)}let O=B.map(U);if(K.method==="setInputFiles"){let T=L.kind==="locator"?0:1,k=async(E)=>{if(typeof E!=="string"){if(!z0(E)||typeof E.name!=="string"||typeof E.mimeType!=="string"||!X9.isBuffer(E.buffer))I("hands_repl_invalid_file_input");return E}if(!$.readWorkspaceFile)I("hands_repl_workspace_required");return $.readWorkspaceFile(E)},m=O[T];O[T]=Array.isArray(m)?await Promise.all(m.map(k)):await k(m)}if(K.method==="goto")await $.beforeNavigation?.();let q=$.actionRecorder?.(),_=await Reflect.apply(j,L.target,O),P={click:"Click browser element",tap:"Click browser element",dblclick:"Double click browser element",fill:"Type text",type:"Type text",pressSequentially:"Type text",clear:"Clear browser field",press:"Press key",scrollIntoViewIfNeeded:"Scroll browser element into view",dragTo:"Drag on computer",selectOption:"Select browser option",check:"Check browser control",uncheck:"Uncheck browser control",hover:"Hover browser element",focus:"Focus browser element",goto:"Open browser page",reload:"Reload browser page",goBack:"Go back in browser",goForward:"Go forward in browser",screenshot:"Take browser screenshot"}[K.method];if(P){let T=Reflect.get(L.target,"page"),k=L.kind==="page"?L.target:typeof T==="function"?Reflect.apply(T,L.target,[]):void 0;q?.(P,k0(k)?k:void 0)}return H(_,W.returns)}})}import{isIP as XZ}from"net";import{Resolver as F1}from"dns/promises";import{isIP as t9}from"net";var U1=[["0.0.0.0",8],["10.0.0.0",8],["100.64.0.0",10],["127.0.0.0",8],["169.254.0.0",16],["172.16.0.0",12],["192.0.0.0",24],["192.0.2.0",24],["192.168.0.0",16],["198.18.0.0",15],["198.51.100.0",24],["203.0.113.0",24],["224.0.0.0",4],["240.0.0.0",4]];function y8($){if(t9($)!==4)return null;let Q=$.split(".");if(Q.length!==4)return null;let Z=0;for(let X of Q){let J=Number(X);if(!Number.isInteger(J)||J<0||J>255)return null;Z=Z*256+J}return Z>>>0}function W1($,Q,Z){let X=y8(Q);if(X===null)return!1;let J=Z===0?0:4294967295<<32-Z>>>0;return($&J)>>>0===(X&J)>>>0}function eQ($){let Q=y8($);if(Q===null)return!0;return U1.some(([Z,X])=>W1(Q,Z,X))}function B1($){if(t9($)!==6)return null;let Q=$.toLowerCase(),Z=Q.indexOf("%");if(Z>=0)Q=Q.slice(0,Z);let X=[],J=Q.lastIndexOf(":"),G=J>=0?Q.slice(J+1):"";if(G.includes(".")){let K=y8(G);if(K===null)return null;X=[K>>>16&65535,K&65535],Q=Q.slice(0,J+1)+"0:0"}let z=Q.split("::");if(z.length>2)return null;let V=(K)=>{if(K==="")return[];let L=[];for(let B of K.split(":")){if(B===""||B.length>4||!/^[0-9a-f]+$/.test(B))return null;L.push(Number.parseInt(B,16))}return L},Y=V(z[0]??"");if(Y===null)return null;if(z.length===1){let K=Y;if(K.length!==8)return null;return X.length>0?K.slice(0,6).concat(X):K}let H=V(z[1]??"");if(H===null)return null;let U=8-Y.length-H.length;if(U<0)return null;let F=Y.concat(Array(U).fill(0),H);if(F.length!==8)return null;return X.length>0?F.slice(0,6).concat(X):F}function L1($,Q){return`${$>>8&255}.${$&255}.${Q>>8&255}.${Q&255}`}function N1($){let Q=B1($);if(Q===null)return!0;let[Z,X,J]=Q;if((Z&57344)!==8192)return!0;if(Z===8193&&(X&65024)===0)return!0;if(Z===8193&&X===3512)return!0;if(Z===16383&&(X&61440)===0)return!0;if(Z===8194)return eQ(L1(X,J));return!1}function $Z($){return $.replace(/^\[|\]$/g,"")}function r9($){let Q=$Z($.trim()),Z=t9(Q);if(Z===4)return eQ(Q);if(Z===6)return N1(Q);return!0}function QZ($){if($ instanceof Error&&$.name==="TimeoutError")return"dns_timeout";switch(typeof $==="object"&&$!==null&&"code"in $?$.code:void 0){case"ENOTFOUND":return"dns_not_found";case"ENODATA":return"dns_empty";case"EAI_AGAIN":case"ESERVFAIL":case"ECONNREFUSED":return"dns_temporary";case"ETIMEOUT":case"ETIMEDOUT":return"dns_timeout";default:return"dns_failed"}}var ZZ=5000;function M1($){return async(Q,Z)=>{if(Z?.aborted)throw Error("aborted");let X=new F1({timeout:ZZ,tries:1});if($)X.setServers($);let J=()=>X.cancel();Z?.addEventListener("abort",J,{once:!0});try{let[G,z]=await Promise.allSettled([X.resolve4(Q),X.resolve6(Q)]),V=[...G.status==="fulfilled"?G.value:[],...z.status==="fulfilled"?z.value:[]];if(V.length>0)return V;let Y=[G,z].flatMap((U)=>U.status==="rejected"?[U.reason]:[]);throw Y.find((U)=>["dns_temporary","dns_timeout"].includes(QZ(U)))??Y[0]??Object.assign(Error("DNS returned no addresses"),{code:"ENODATA"})}finally{Z?.removeEventListener("abort",J)}}}var j1=M1();async function C1($,Q,Z,X){if(X?.aborted)throw Error("aborted");let J=new AbortController,G,z,V=Q($,J.signal);V.catch(()=>{});try{return await Promise.race([V,new Promise((Y,H)=>{if(G=setTimeout(()=>H(new DOMException("DNS lookup timed out","TimeoutError")),Z),X)z=()=>H(Error("aborted")),X.addEventListener("abort",z,{once:!0})})])}finally{if(G!==void 0)clearTimeout(G);if(X&&z)X.removeEventListener("abort",z);J.abort()}}async function e5($,Q=j1,Z){let X=$Z($);if(t9(X))return r9(X)?{ok:!1,reason:"non_public_ip"}:{ok:!0,addresses:[X]};let J;try{J=await C1(X,Q,ZZ,Z)}catch(G){return{ok:!1,reason:Z?.aborted?Z.reason instanceof Error&&Z.reason.name==="TimeoutError"?"dns_timeout":"aborted":QZ(G)}}if(J.length===0)return{ok:!1,reason:"dns_empty"};if(J.some(r9))return{ok:!1,reason:"non_public_ip"};return{ok:!0,addresses:J}}var q1=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;function h8($){return $.length<=253&&q1.test($.toLowerCase())}function T1($,Q){let Z=$.trim().toLowerCase();if(!h8(Z))return!1;if(Z.startsWith("*.")){let X=Z.slice(2);return Q===X||Q.endsWith(`.${X}`)}return Z===Q}function O1($){let Q=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec($);if(!Q)return null;let Z=Q.slice(1).map(Number);return Z.some((X)=>X>255)?null:Z}function v8($,Q=[]){let Z=(X)=>{if(X=X.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,""),!X.includes(":"))return X;try{X=new URL(`http://[${X}]/`).hostname.slice(1,-1)}catch{return X}let J=/^::ffff:([\da-f]+):([\da-f]+)$/.exec(X);if(!J)return X;let G=parseInt(J[1],16),z=parseInt(J[2],16);return`${G>>8}.${G&255}.${z>>8}.${z&255}`};return Q.some((X)=>Z(X)===Z($))}function u0($){$=$.toLowerCase().replace(/^\[|\]$/g,"");let Q=O1($);if(Q){let[G,z,V]=Q;if(G===127)return"loopback";return G===0||G===10||G>=224||G===100&&z>=64&&z<=127||G===169&&z===254||G===172&&z>=16&&z<=31||G===192&&(z===168||z===0&&(V===0||V===2)||z===88&&V===99)||G===198&&(z===18||z===19||z===51&&V===100)||G===203&&z===0&&V===113?"private":"public"}if(!$.includes(":"))return"hostname";try{$=new URL(`http://[${$}]/`).hostname.slice(1,-1)}catch{return"private"}if($==="::1")return"loopback";let Z=/^::ffff:([\da-f]+):([\da-f]+)$/.exec($);if(Z){let G=parseInt(Z[1],16),z=parseInt(Z[2],16);return u0(`${G>>8}.${G&255}.${z>>8}.${z&255}`)==="public"?"public":"private"}let[X,J=0]=$.split(":").map((G)=>parseInt(G||"0",16));return X<8192||X>16383||X===8194||X===8193&&(J<512||J===3512)||X===16383&&J<4096?"private":"public"}function P9($,Q){let Z;try{Z=new URL($)}catch{return{allowed:!1,url:$,host:null,reason:"invalid_url"}}if(["about:","data:","blob:"].includes(Z.protocol))return{allowed:!0,url:$,host:null,reason:"local_document"};if(!["http:","https:","ws:","wss:"].includes(Z.protocol))return{allowed:!1,url:$,host:Z.hostname||null,reason:"unsupported_protocol"};let X=Z.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,"");if(Q.mode==="off")return{allowed:!0,url:$,host:X,reason:"policy_off"};let J=(V)=>({allowed:!1,url:$,host:X,reason:V});if(Z.username||Z.password)return J("invalid_url");if(Q.mode==="public_web"){let V=u0(X)!=="public"&&u0(X)!=="hostname"||X==="localhost"||/\.(?:localhost|local|internal|arpa)$/.test(X)||!X.includes(".")&&!XZ(X)||Boolean(XZ(X)&&r9(X));return{allowed:!V,url:$,host:X,reason:V?"private_network":"public_web"}}let G=Number(Z.port||(["https:","wss:"].includes(Z.protocol)?443:80));if(Q.deniedPorts?.includes(G)||v8(X,Q.deniedHosts))return J("destination_not_allowed");let z=u0(X);if(z==="private"||["local","internal","arpa"].some((V)=>X===V||X.endsWith(`.${V}`)))return J("private_network");if(z==="loopback"||X==="localhost"||X.endsWith(".localhost"))return Q.allowedLoopbackPorts?.includes(G)?{allowed:!0,url:$,host:X,reason:"loopback"}:J("destination_not_allowed");if(Q.allowedDomains.some((V)=>T1(V,X)))return{allowed:!0,url:$,host:X,reason:"allowed_domain"};return{allowed:!1,url:$,host:X,reason:"destination_not_allowed"}}import YZ from"child_process";import{accessSync as _1,constants as A1,readFileSync as x1,statSync as P1}from"fs";import{createRequire as I1}from"module";import{isAbsolute as c8,join as R1}from"path";var d8=Object.freeze({schemaVersion:1,driver:"playwright-core",driverVersion:GZ.dependencies["playwright-core"],browser:"chromium"}),zZ=["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome","/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge","/Applications/Brave Browser.app/Contents/MacOS/Brave Browser","/Applications/Chromium.app/Contents/MacOS/Chromium"],p8=["/usr/bin/chromium","/usr/bin/chromium-browser","/usr/bin/google-chrome","/usr/bin/google-chrome-stable"];function I9($){try{return _1($,A1.X_OK),c8($)&&P1($).isFile()}catch{return!1}}function u8($,Q=process.platform){let Z=Q==="darwin"?zZ:Q==="linux"?p8:null;return Z?($??Z).find(I9)??null:null}function E1(){if(!process.versions.bun)return;let $=Symbol.for("ara.headless-browser.bun-pipe-owners");if(Object.hasOwn(globalThis,$))return;let Q=[];YZ.spawn=new Proxy(YZ.spawn,{apply(Z,X,J){let G=Reflect.apply(Z,X,J),z=J[1],V=J[2]?.stdio;if(Array.isArray(z)&&z.includes("--remote-debugging-pipe")&&Array.isArray(V)&&V[3]==="pipe"&&V[4]==="pipe")Q.push(G);return G}}),Object.defineProperty(globalThis,$,{value:Q})}async function e9($){if(E1(),$!==void 0){if(!c8($))throw Error("hands_browser_driver_path_must_be_absolute");let X=R1($,"package.json"),J=JSON.parse(x1(X,"utf8"));if(J.name!==d8.driver)throw Error("hands_browser_wrong_driver");let G=I1(X)($),z=G.default?.chromium??G.chromium;if(!z)throw Error("hands_browser_missing_chromium");return{version:J.version,chromium:z}}let[Q,Z]=await Promise.all([import("./index-bwnyk312.js"),import("./package-q8gdr1z1.js").then((m)=>D1(m.default,1))]);return{version:Z.default.version,chromium:Q.chromium}}var S1=($,Q=d8.driverVersion)=>({status:"unavailable",reason:$,expectedDriverVersion:Q}),w1=($)=>$.loadDriver?.()??e9($.driverModuleDirectory);async function Y9($={}){return KZ($,d8.driverVersion)}async function l8($,Q={}){if($.driverVersion!=="1.61.1"||!c8($.driverModuleDirectory))throw Error("hands_browser_invalid_managed_compatibility");return KZ({...Q,driverModuleDirectory:$.driverModuleDirectory,allowSystemBrowser:!0},$.driverVersion)}async function KZ($,Q){let Z=(Y)=>S1(Y,Q),X=$.platform??process.platform;if(X!=="linux"&&X!=="darwin")return Z("unsupported_platform");let J;try{J=await w1($)}catch{return Z("driver_missing")}if(J.version!==Q)return Z("driver_version_mismatch");let G=(Y,H)=>({status:"resolved",executablePath:Y,source:H,driverVersion:J.version});if($.executablePath!==void 0)return I9($.executablePath)?G($.executablePath,"configured"):Z("executable_missing");let z=J.chromium.executablePath();if(I9(z))return G(z,"managed");let V=$.allowSystemBrowser===!0?u8($.systemCandidates,X):null;return V?G(V,"system"):Z("executable_missing")}var l1=["/usr/local/bin/chromium",...p8];function s1($,Q=LZ()){return u8($??(Q==="linux"?l1:void 0),Q)}async function n1(){try{return(await e9()).chromium}catch{return v1(import.meta.url)("playwright-core").chromium}}var i1=1048576,o1=105000,a1=20000,FZ=5000,r1=2000,t1=1000,e1=30000,UZ=81920,$6={".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".gif":"image/gif"};async function Q6($,Q){let Z=new URL($.url()),X={...await $.allHeaders(),host:Z.host};for(let J of Object.keys(X))if(/^(?:proxy-|connection$|upgrade$|transfer-encoding$|content-length$)/i.test(J))delete X[J];return new Promise((J,G)=>{let V=(Z.protocol==="https:"?d1:c1)(Z,{method:$.method(),headers:X,agent:!1,lookup:(H,U,F)=>{let K=l0.isIP(Q);if(U.all)F(null,[{address:Q,family:K}]);else F(null,Q,K)}},(H)=>{let U=[],F=0;H.on("data",(K)=>{if(F+=K.length,F>33554432)V.destroy(Error("hands_browser_response_too_large"));else U.push(K)}),H.on("error",G),H.on("end",()=>{let K={};for(let[L,B]of Object.entries(H.headers))if(B!==void 0&&!["transfer-encoding","connection","content-length"].includes(L))K[L]=Array.isArray(B)?B.join(`
+`):B;J({status:H.statusCode??502,headers:K,body:Buffer.concat(U)})})}),Y=setTimeout(()=>V.destroy(Error("hands_browser_fetch_timeout")),e1);V.once("close",()=>clearTimeout(Y)),V.on("error",G),V.end($.postDataBuffer()??void 0)})}async function Z6($,Q,Z=()=>{},X={lookup:(J)=>h1(J,{all:!0}),fetch:Q6}){let J=new WeakSet,G=new WeakMap,z=(V)=>{let Y=G.get(V);if(Y)return Y;let H=(async()=>{if(!$.newCDPSession)return;let U=await $.newCDPSession(V),F=new Map;U.on("Network.loadingFinished",({requestId:K})=>F.delete(K)),U.on("Network.loadingFailed",({requestId:K})=>F.delete(K)),U.on("Fetch.requestPaused",async(K)=>{let L=K.networkId??K.requestId,B=K.redirectedRequestId?(F.get(L)??0)+1:0;F.set(L,B);let W=P9(K.request.url,Q),j=Q.mode==="enforce"&&Boolean(K.redirectedRequestId)&&W.host!==null&&!l0.isIP(W.host),O=!W.allowed?W:j?{...W,allowed:!1,reason:"destination_not_allowed"}:B>20?{...W,allowed:!1,reason:"redirect_not_supported"}:null;try{if(O)Z(O),await U.send("Fetch.failRequest",{requestId:K.requestId,errorReason:"BlockedByClient"});else await U.send("Fetch.continueRequest",{requestId:K.requestId})}catch{await U.send("Fetch.failRequest",{requestId:K.requestId,errorReason:"Failed"}).catch(()=>{})}}),await U.send("Network.enable"),await U.send("Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]}),J.add(V)})();return G.set(V,H),H};return await $.route("**/*",async(V)=>{let Y=V.request().url(),H=P9(Y,Q);if(H.allowed&&Q.mode==="public_web"){await V.continue();return}let U=V.request();if(H.allowed&&H.host&&l0.isIP(H.host)&&U.isNavigationRequest?.()){let F=U.frame();if(J.has(F.page())&&F===F.page().mainFrame()){await V.continue();return}}if(H.allowed&&(Q.mode==="off"||H.reason==="local_document")){await V.continue();return}if(H.allowed&&H.host)try{let F=H.host,K=u0(F),L,B=await(async()=>{if(K!=="hostname")return[{address:F,family:l0.isIP(F)}];if(H.reason==="loopback")return[{address:"127.0.0.1",family:4}];try{return await Promise.race([X.lookup(F),new Promise((W,j)=>{L=setTimeout(()=>j(Error("hands_browser_dns_timeout")),5000)})])}finally{if(L)clearTimeout(L)}})();if(!B.length||B.some(({address:W})=>{let j=u0(W);return!l0.isIP(W)||Q.mode==="enforce"&&v8(W,Q.deniedHosts)||(H.reason==="loopback"?j!=="loopback":j!=="public")}))H={...H,allowed:!1,reason:"private_network"};else{let W=await X.fetch(V.request(),B[0].address);if(W.status>=300&&W.status<400){let j=W.headers.location??Y;try{j=new URL(j,Y).href}catch{}let O=P9(j,Q);H=O.allowed?{...O,allowed:!1,reason:"redirect_not_supported"}:O}else{await V.fulfill(W);return}}}catch{await V.abort("failed");return}Z(H),await V.abort("blockedbyclient")}),await $.routeWebSocket("**/*",async(V)=>{let Y=P9(V.url(),Q);if(Q.mode==="enforce"&&Y.allowed&&(!Y.host||!l0.isIP(Y.host)))Y={...Y,allowed:!1,reason:"destination_not_allowed"};if(Y.allowed){V.connectToServer();return}Z(Y),await V.close({code:1008,reason:"Reason egress policy denied"})}),Q.mode==="off"?void 0:{preparePage:z}}async function NZ($,Q=LZ(),Z){if(Z){let J=await l8(Z,{platform:Q,systemCandidates:$});return J.status==="resolved"?J.executablePath:null}if($!==void 0){let J=s1($,Q);if(J)return J}let X=await Y9({platform:Q,systemCandidates:$,allowSystemBrowser:!0});return X.status==="resolved"?X.executablePath:null}function WZ($,Q){if(!$)throw Error("hands_repl_workspace_required");let Z=n8($),X=G9($),J=i8(X,G9(X,Q)),z=J!==".."&&!J.startsWith(`..${o8}`)&&!HZ(J)?G9(Z,J):G9(Z,Q);if(b0(G9(X,Q))||b0(z))throw Error("hands_repl_protected_path");let V=(B)=>{let W=i8(Z,B);return W!==""&&W!==".."&&!W.startsWith(`..${o8}`)&&!HZ(W)},Y=n8(z);if(b0(Y))throw Error("hands_repl_protected_path");if(!V(z)||!V(Y))throw Error("hands_repl_file_outside_workspace");let H=i8(Z,z).split(o8),U=[Z,...H.map((B,W)=>G9(Z,...H.slice(0,W+1)))],F=U.map((B)=>VZ(B));if(F.some((B)=>B.isSymbolicLink()))throw Error("hands_repl_file_symlink");let K=F[F.length-1];if(!K.isFile()||K.nlink!==1||K.size>16777216)throw Error("hands_repl_file_not_regular_or_too_large");let L=g1(z,s8.O_RDONLY|s8.O_NOFOLLOW|s8.O_NONBLOCK);try{let B=f1(L);if(B.dev!==K.dev||B.ino!==K.ino||!B.isFile())throw Error("hands_repl_file_changed");for(let q=0;q<U.length;q++){let _=VZ(U[q]);if(_.dev!==F[q].dev||_.ino!==F[q].ino||_.isSymbolicLink())throw Error("hands_repl_file_changed")}if(!V(n8(z)))throw Error("hands_repl_file_outside_workspace");let W=Buffer.alloc(16777217),j=0;while(j<W.length){let q=m1(L,W,j,W.length-j,null);if(!q)break;j+=q}if(j===W.length)throw Error("hands_repl_file_too_large");let O=W.subarray(0,j);return{name:p1(z),mimeType:$6[u1(z).toLowerCase()]??"application/octet-stream",buffer:O}}finally{k1(L)}}function z9($,Q){$.end(`${JSON.stringify(Q)}
+`)}function $8($){try{y1($)}catch{}}async function MZ($){if($.managedBrowser&&$.driverModuleDirectory!==void 0)throw Error("hands_browser_ambiguous_driver_configuration");let Q=$.launch||$.targetContext?null:$.managedBrowser?await l8($.managedBrowser,{executablePath:$.browserExecutablePath}):await Y9({executablePath:$.browserExecutablePath,driverModuleDirectory:$.driverModuleDirectory});if(Q?.status==="unavailable")throw Error(`hands_browser_${Q.reason}`);let Z=Q?.status==="resolved"?Q.executablePath:$.browserExecutablePath;if(!Z||!I9(Z))throw Error("hands_browser_unavailable");let X=$.launch??(async(N)=>($.targetContext?await n1():(await e9($.managedBrowser?.driverModuleDirectory??$.driverModuleDirectory)).chromium).launch(N)),J=[],G={},z=null,V=null,Y=null,H=null,U=!1,F=null,K=new Map,L=new WeakMap,B=null,W=()=>{if(U)throw Error("hands_repl_stopped");if(H)throw H},j=(N)=>{let M=L.get(N);if(M)return M;let D=Promise.resolve().then(()=>N.close()).then(()=>{K.delete(N)});return L.set(N,D),D},O=async()=>{let N=[...K.entries()].reverse(),M=B??=performance.now()+t1,D=Promise.allSettled(N.filter(([,A])=>A==="context").map(([A])=>j(A))),S;try{await Promise.race([D,new Promise((A)=>{S=setTimeout(A,Math.max(0,M-performance.now()))})])}finally{if(S)clearTimeout(S)}let b=await Promise.allSettled(N.map(([A])=>j(A))),f=[];for(let[A,g]of b.entries()){if(g.status!=="rejected")continue;let c=g.reason instanceof Error&&["Error","TimeoutError","ProtocolError"].includes(g.reason.name)?g.reason.name:"unknown";f.push(Error(`hands_repl_close_failed: ${N[A][1]}: ${c}`))}if(f.length)throw AggregateError(f,"hands_repl_stop_unconfirmed")},q=(N,M)=>{if(K.set(N,M),U||H)j(N).catch(()=>{return}),W();return N},_=async()=>{let N=await X({executablePath:Z,headless:!0,chromiumSandbox:$.managedBrowser===void 0,args:["--disable-background-networking","--disable-quic","--disable-dev-shm-usage","--disable-gpu","--disable-software-rasterizer","--dns-prefetch-disable","--force-webrtc-ip-handling-policy=disable_non_proxied_udp","--no-pings"]}),M=null;try{q(N,"browser"),M=$.targetContext??q(await N.newContext({viewport:{width:1440,height:900},screen:{width:1440,height:900},serviceWorkers:"block",acceptDownloads:!1}),"context");let D=await Z6(M,$.networkPolicy??{mode:"off"},$.onEgressDenied);if(W(),D){let w=M.newPage.bind(M);M.newPage=async()=>{let y=await w();return await D.preparePage(y),y}}let b=M.pages()[0]??await M.newPage();await D?.preparePage(b),W();let f=async(w=b)=>{let y=w;if(typeof y.ariaSnapshot==="function")return y.ariaSnapshot({timeout:1e4});return b.locator("body").innerText({timeout:1e4})},A=async(w,y={})=>{let d=y&&typeof y==="object"&&!Array.isArray(y)?y:{},l,G0="image/png";if(Buffer.isBuffer(w)||w instanceof Uint8Array)l=Buffer.from(w);else if(typeof w==="string"&&(w.startsWith("data:")||/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(w)))l=Buffer.from(w.replace(/^data:[^,]*,/,""),"base64");else if(typeof w==="string"){let q0=WZ($.workspaceRoot,w);l=q0.buffer,G0=q0.mimeType}else throw Error("view() needs a Buffer, a base64 string, or a path to an image file");if(l.length===0)throw Error("view(): the image is empty");let N0=String(d.label??"").replace(/[\r\n>]+/g," ").trim().slice(0,120),F0=Number(d.maxWidth)||1024,U0=Number(d.quality)||72,y0=$.targetContext?await N.newPage():await M.newPage();try{let q0=`data:${G0};base64,${l.toString("base64")}`;for(let r=0;r<5;r+=1){let M0=await y0.evaluate(async(W0)=>{let j0=new Image;j0.src=W0.url,await j0.decode();let h0=Math.min(1,W0.maxWidth/j0.naturalWidth),Y0=document.createElement("canvas");Y0.width=Math.max(1,Math.round(j0.naturalWidth*h0)),Y0.height=Math.max(1,Math.round(j0.naturalHeight*h0));let X0=Y0.getContext("2d");if(!X0)throw Error("view(): canvas unavailable");return X0.fillStyle="#ffffff",X0.fillRect(0,0,Y0.width,Y0.height),X0.drawImage(j0,0,0,Y0.width,Y0.height),{data:Y0.toDataURL("image/jpeg",W0.q/100).split(",")[1]??"",width:Y0.width,height:Y0.height,sourceWidth:j0.naturalWidth,sourceHeight:j0.naturalHeight}},{url:q0,maxWidth:F0,q:U0}),r0=Buffer.from(M0.data,"base64");if(r0.length<=UZ){let W0=N0||"image";return`<<<ARA_VIEW_IMAGE ${M0.data} image/jpeg ${W0}>>>
+Viewing ${W0} (${M0.sourceWidth}x${M0.sourceHeight} source, sent at ${M0.width}x${M0.height}, ${Math.round(r0.length/1024)}KB).`}if(F0>640)F0=Math.round(F0*0.75);else U0=Math.max(30,U0-15)}throw Error(`view(): could not reduce the image under ${Math.round(UZ/1024)}KB`)}finally{await y0.close().catch(()=>{return})}},g=tQ({browser:$.targetContext?.browser()??N,context:M,page:b,a11y:f,view:A,readWorkspaceFile:(w)=>WZ($.workspaceRoot,w),privateProfile:$.privateProfile,beforeNavigation:$.beforeNavigation,recording:$.recording,screenshotExport:$.screenshotExport,actionRecorder:()=>{let w=J,y=G;return(d,l)=>{if(w.length<BZ)w.push(d);if(l)y.page=l}}}),c=async(w)=>{W();let y=q(await N.newContext({serviceWorkers:"block",acceptDownloads:!1}),"context");try{await y.route("**/*",(l)=>l.abort()),W(),await y.routeWebSocket("**/*",(l)=>l.close({code:1008,reason:"Reason evaluator network denied"})),W(),await y.exposeBinding("__araHandsRpc",async(l,G0)=>$.onBrowserOperation?$.onBrowserOperation(w,()=>g.dispatch(G0)):g.dispatch(G0)),W();let d=await y.newPage();return W(),await d.goto("data:text/html,<title>Reason Hands evaluator</title>"),W(),await d.evaluate(`(${dQ})(${JSON.stringify(g.roots)})`),{context:y,page:d,runId:w}}catch(d){throw await j(y).catch(()=>{return}),d}},u=await c(),a={browser:N,context:M,page:b,evaluator:u,async captureProgressFrame(w){return A(await w.screenshot({type:"jpeg",quality:65,timeout:2000}),{label:"Screen after browser action"})},async resetEvaluator(w){await j(a.evaluator.context),a.evaluator=await c(w)}};return W(),a}catch(D){throw await O().catch(()=>{return}),D}},R=async()=>{if(W(),z)return z;if(!Y){V=_();let N;Y=Promise.race([V,new Promise((M,D)=>{N=setTimeout(()=>D(Error("hands_browser_unavailable: startup timed out")),a1)})]).then((M)=>{return W(),z=M,M}).catch(async()=>{H=Error("hands_browser_unavailable: startup failed or timed out");let M;try{await Promise.race([O(),new Promise((D,S)=>{M=setTimeout(()=>S(Error("hands_repl_stop_timeout")),FZ)})])}catch{H=Error("hands_browser_unavailable: startup cleanup unconfirmed")}finally{if(M)clearTimeout(M)}throw H}).finally(()=>{if(N)clearTimeout(N)})}return Y},P=async(N,M,D=!1)=>{let S=await R(),b=G;if($.onBrowserOperation&&S.evaluator.runId!==M)await S.resetEvaluator(M);let A=(async()=>{let u=await S.evaluator.page.evaluate(`(${pQ})(${JSON.stringify({code:N})})`);if(typeof u!=="string")throw Error("hands_repl_invalid_evaluator_output");let a=b.page;if(D&&a&&!u.includes("<<<ARA_VIEW_IMAGE")){let w=()=>S.captureProgressFrame(a);try{let y=await($.onBrowserOperation?$.onBrowserOperation(M,w):w());return b.automaticProgressImage=!0,`${u}
+${y}`}catch{return`${u}
+Screen capture unavailable.`}}return u})(),g,c=new Promise((u,a)=>{g=setTimeout(()=>a(Error("REPL evaluation timed out after 105 seconds")),o1)});try{return await Promise.race([A,c])}catch(u){if(u instanceof Error&&u.message.includes("timed out"))A.catch(()=>{return}),await S.resetEvaluator(M).catch(()=>{return});throw u}finally{if(g)clearTimeout(g)}},T=Promise.resolve(),k=new Set,m=new Set;$8($.socketPath);let E=l0.createServer((N)=>{k.add(N),N.once("close",()=>{k.delete(N),m.delete(N)}),N.setEncoding("utf8");let M="",D=!1;N.on("data",(S)=>{if(D)return;if(M+=S,M.length>i1){D=!0,z9(N,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let b=M.indexOf(`
+`);if(b===-1)return;D=!0;let f=M.slice(0,b);if($.onControl)try{let A=JSON.parse(f);if(typeof A.action==="string"&&A.action!=="evaluate")m.add(N)}catch{}T=T.then(async()=>{if(N.destroyed)return;J=[],G={};try{let A=JSON.parse(f);if(A.action==="probe"){let w=await R();await P("undefined",w.evaluator.runId),z9(N,{ok:!0,output:"ARA_HANDS_REPL_READY"});return}if(typeof A.action==="string"&&A.action!=="evaluate"&&$.onControl){z9(N,{ok:!0,output:await $.onControl(A.action,A)});return}if(A.action!=="evaluate"||typeof A.code!=="string")throw Error("Invalid REPL request");let g=A.code,c=typeof A.runId==="string"?A.runId:void 0,u=()=>P(g,c,A.includeProgressCapture===!0),a=await($.onEvaluate?$.onEvaluate(A,u):u());z9(N,{ok:!0,output:a,browserActions:J,...G.automaticProgressImage?{automaticProgressImage:!0}:{}})}catch(A){z9(N,{ok:!1,error:A instanceof Error?A.message:String(A),stack:A instanceof Error?A.stack:void 0,browserActions:J})}}).catch((A)=>{z9(N,{ok:!1,error:A instanceof Error?A.message:String(A)})})})});try{await new Promise((N,M)=>{E.once("error",M),E.listen($.socketPath,()=>{E.off("error",M);try{b1($.socketPath,384),N()}catch(D){E.close(()=>M(D))}})})}catch(N){throw $8($.socketPath),N}return{socketPath:$.socketPath,browserExecutablePath:Z,stop(){if(F)return F;U=!0;let N=m.size?setTimeout(()=>{for(let b of m)b.destroy()},r1):void 0,M=new Promise((b)=>E.close(()=>{if(N)clearTimeout(N);b()}));for(let b of k)if(!m.has(b))b.destroy();T.catch(()=>{return});let D=async()=>{await M,$8($.socketPath);let b=[O()];if(V)b.push(V.then(()=>{return},()=>{return}));let f=await Promise.allSettled(b),A=await Promise.allSettled([O()]),g=[...f,...A].filter((c)=>c.status==="rejected");if(g.length)throw AggregateError(g.map((c)=>c.reason),"hands_repl_stop_unconfirmed")},S;return F=Promise.race([D(),new Promise((b,f)=>{S=setTimeout(()=>f(Error("hands_repl_stop_timeout")),FZ)})]).finally(()=>{if(S)clearTimeout(S);$8($.socketPath)}),F}}}var X6=["private_runtime","runtime_root","temporary_directory","granted_root","workspace_layout","jobs","browser_socket","relay_url","environment_owner","job_environment","config_write"],J6=["ENOENT","EACCES","EPERM","EINVAL","ENOTDIR","EISDIR","ELOOP","EROFS","ENOSPC","EMFILE","ENFILE","EEXIST"];function jZ($,Q){if(!$||!X6.includes($))return null;let Z=typeof Q==="object"&&Q!==null&&"code"in Q?Q.code:null;return{workspace_stage:$,workspace_errno:typeof Z==="string"&&J6.includes(Z)?Z:"unknown"}}import{lstatSync as Y6,readFileSync as G6}from"fs";var z6="/run/sc/egress-guard",K6=10002,a8=10003;function CZ($=process.platform,Q=z6){if($!=="linux")return!1;try{let Z=Y6(Q);if(!Z.isFile()||Z.uid!==0||(Z.mode&18)!==0)return!1;return G6(Q,"utf8")===`v1 ${K6} ${a8}
+`}catch{return!1}}var V6=/^(\/.+)-sidechat-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;function qZ($){let Q=V6.exec($.replace(/\/+$/,""));return Q?`${Q[1]}/repo`:null}import{randomUUID as Y7}from"crypto";import{spawn as G7,spawnSync as z7}from"child_process";import{chmodSync as w9,closeSync as K7,constants as V$,fchmodSync as V7,fstatSync as H7,openSync as F7,copyFileSync as U7,existsSync as F$,lstatSync as t,statSync as b9,mkdtempSync as W7,mkdirSync as L9,realpathSync as n,renameSync as V8,rmSync as B7,writeFileSync as H8}from"fs";import{homedir as L7,tmpdir as Q4}from"os";import{basename as N7,dirname as V0,join as o,resolve as Z4}from"path";var H6={"navigation.ara-egress.invalid":"canary_navigation","fetch.ara-egress.invalid":"canary_fetch","subresource.ara-egress.invalid":"canary_subresource","codeload.github.com":"canary_redirect","websocket.ara-egress.invalid":"canary_websocket"};function TZ($){return $===null?"other":H6[$]??"other"}function H0($,Q){if($===void 0||Q===void 0)return null;let Z=Math.round(Q-$);return Number.isSafeInteger(Z)&&Z>=0&&Z<=600000?Z:null}var p="workspace_mode",f0="granted_root",B0="project_root",K9="terminal_root",V9="terminal_benchmark_tool_profile",F6=["bash","bash-node-repl","bash-node-repl-files"],OZ="hands_node_repl_persistent_execution_unsupported";function DZ($){return $==="bash"?null:"hands_node_repl_persistent_execution_unsupported"}function r8($){return F6.includes($)}function wX($){return _Z($)&&$.workspace_mode==="terminal_root"&&r8($.terminal_benchmark_tool_profile)}var L0="tool_scoped_standby";function bX($){return _Z($)&&$[L0]===!0}function _Z($){return typeof $==="object"&&$!==null&&!Array.isArray($)}var yX=x.object({device_id:x.string().uuid(),root_id:x.string().uuid()}),e8=/^reason\/[0-9a-f]{8}$/,U6=x.strictObject({source_path:x.string().refine(s0).optional(),branch:x.string().regex(e8)}),hX=x.object({checkout_mode:x.enum(["worktree","direct"]).optional(),project_workspace_source:x.object({kind:x.literal("local_device"),device_id:x.string().uuid(),root_id:x.string().uuid(),path:x.string().refine(s0).optional(),worktree:U6.optional()})});import{execFile as W6}from"child_process";var B6=20000,L6=1e4,AZ=/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/,N6=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","gc.auto=0","-c","maintenance.auto=false"];async function xZ($,Q=M6){let Z=(j,O=L6)=>Q([...N6,"-C",$,...j],O),X=async(j)=>{let O=await Z(j);return O.status===0?O.stdout.trim():null},J=await X(["rev-parse","--verify","--quiet","HEAD^{commit}"]);if(!J||!AZ.test(J))return null;let G=J.slice(0,12),z=(j)=>({commit:J,from:"head",note:`reason: started from ${j}`}),V=await X(["symbolic-ref","--quiet","HEAD"]);if(!V?.startsWith("refs/heads/"))return z(`the checkout's detached HEAD ${G}`);let Y=V.slice(11),H=await Z(["--no-optional-locks","status","--porcelain=v1","--untracked-files=no"]);if(H.status!==0||H.stdout.trim())return z(`${Y} at ${G}: the checkout has uncommitted changes, which stay there`);let U=await X(["config","--get",`branch.${Y}.remote`]),F=await X(["config","--get",`branch.${Y}.merge`]);if(!U||!F?.startsWith("refs/")||U.startsWith("-"))return z(`${Y} at ${G}: it has no upstream to catch up with`);let K=U==="."||(await Z(["fetch","--quiet","--no-tags","--no-write-fetch-head","--no-recurse-submodules",U,F],B6)).status===0,L=await X(["rev-parse","--abbrev-ref","--symbolic-full-name","@{upstream}"]),B=L?await X(["rev-parse","--verify","--quiet","@{upstream}^{commit}"]):null;if(!L||!B||!AZ.test(B))return z(`${Y} at ${G}: ${K?"it has no upstream to catch up with":`fetching ${U} failed`}`);if(!K)return z(`${Y} at ${G}: fetching ${L} failed, so it may be behind`);if(B===J)return z(`${Y} at ${G}, the same commit as ${L} after fetching it`);if((await Z(["merge-base","--is-ancestor",J,B])).status!==0)return z(`${Y} at ${G}: it has commits that ${L} does not`);let W=await X(["rev-list","--count",`${J}..${B}`]);return{commit:B,from:"upstream",note:`reason: started from ${L} at ${B.slice(0,12)}, fetched just now: ${Y} had no commits of its own and was ${W??"some"} commits behind it`}}function M6($,Q){return new Promise((Z)=>{W6("git",$,{encoding:"utf8",timeout:Q,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(X,J)=>{let G=X?typeof X.code==="number"?X.code:null:0;Z({status:G,stdout:String(J??"")})})})}import{execFile as j6}from"child_process";import{lstatSync as Z$,readdirSync as $$,readFileSync as RZ,realpathSync as Q8,rmdirSync as PZ,unlinkSync as C6,writeFileSync as q6}from"fs";import{readFile as T6}from"fs/promises";import{join as A0,resolve as IZ}from"path";var R9=".reason-device",O6=86400000,D6=500,_6=60000;function EZ($,Q,Z){let X=Q.split("/"),J=H9.split("/");if(X.length!==J.length+2||J.some((G,z)=>X[z]!==G)||!Z8.test(X[J.length]))return;try{let G=SZ($,X[J.length]);q6(A0(G,R9),Z,{flag:"wx",mode:384})}catch{}}function SZ($,Q){let Z=()=>new C("session_worktree_outside_workspace","Reason removes only Session folders in ~/.reason/workspace/sessions.");if(!Z8.test(Q))throw Z();let X=A0(Q8($),H9),J=A0(X,Q);if(!Z$(J).isDirectory()||Q8(J)!==J)throw Z();return J}async function A6($,Q,Z=P6){let X;try{X=SZ($,Q)}catch(J){if(Q$(J))return!0;throw J}for(let J of $$(X,{withFileTypes:!0})){if(J.name===R9||!J.isDirectory())continue;let G=A0(X,J.name),z=await x6(G);if(z){let V=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false",`--git-dir=${z}`,"worktree"];if((await Z([...V,"remove","--force",G])).status===0)await Z([...V,"prune"])}else try{PZ(G)}catch{}}if($$(X).some((J)=>J!==R9))return!1;try{C6(A0(X,R9))}catch(J){if(!Q$(J))throw J}return PZ(X),!0}async function x6($){try{let Q=A0($,".git");if(!Z$(Q).isFile())return null;let Z=/^gitdir: (.+)$/m.exec(RZ(Q,"utf8"));if(!Z)return null;let X=IZ($,Z[1].trim());return IZ(X,(await T6(A0(X,"commondir"),"utf8")).trim())}catch{return null}}async function oX($){let Q;try{if(Q=A0(Q8($.home),H9),!Z$(Q).isDirectory())return{status:"skipped",reason:"workspace_untrusted"};if(Q8(Q)!==Q)return{status:"skipped",reason:"workspace_untrusted"}}catch(G){if(Q$(G))return{status:"skipped",reason:"no_workspace"};throw G}let Z=$$(Q,{withFileTypes:!0}).filter((G)=>G.isDirectory()&&Z8.test(G.name)).map((G)=>G.name).filter((G)=>{try{return RZ(A0(Q,G,R9),"utf8")===$.deviceId}catch{return!1}}).sort().slice(0,D6);if(!Z.length)return{status:"done",removed:[],kept:[],failed:[]};let X=await $.liveIds(Z);if(X===null)return{status:"skipped",reason:"server_unsupported"};let J={status:"done",removed:[],kept:Z.filter((G)=>X.includes(G)),failed:[]};for(let G of Z.filter((z)=>!X.includes(z)))(await A6($.home,G,$.runGit).catch(()=>!1)?J.removed:J.failed).push(G);return J}function aX($,Q,Z=O6){if(Q.aborted)return;let X=!1,J=()=>{if(X||Q.aborted)return;X=!0,$().catch(()=>{return}).finally(()=>{X=!1})},G=setInterval(J,Z);G.unref?.(),Q.addEventListener("abort",()=>clearInterval(G),{once:!0}),J()}function Q$($){return typeof $==="object"&&$!==null&&$.code==="ENOENT"}function P6($){return new Promise((Q)=>{j6("git",$,{encoding:"utf8",timeout:_6,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(Z,X,J)=>{let G=Z&&typeof Z.code==="number"?Z.code:null;Q({status:Z?G??1:0,stderr:J??""})})})}import{createHash as I6}from"crypto";import{join as R6}from"path";function E6($){return X8($)}function x0(){throw new C("environment_unavailable","The private Session environment is unavailable or stale.")}function J8($){return I6("sha256").update(JSON.stringify({...$,variables:Object.fromEntries(Object.entries($.variables).sort(([Q],[Z])=>Q.localeCompare(Z)))})).digest("hex")}function wZ($,Q){D9($);let Z=R6($,"environment.json"),X,J=new Set,G=(V,Y)=>`${Y}:${V}`,z=(V)=>{let Y=jQ.safeParse(V);if(!Y.success)return x0();let H=Y.data,U=Q.identity(),F=Date.parse(H.expires_at);if(!U||H.run_id!==Q.runId||H.device_id!==Q.deviceId||H.root_id!==Q.rootId||H.binding.kind!==Q.binding.kind||H.binding.target_revision!==Q.binding.target_revision||H.binding.root_grant_revision!==Q.binding.root_grant_revision||H.binding.target_generation!==U.generation||H.binding.target_fence_id!==U.fenceId||F<=Date.now()||F>Q.expiresAtMs||Q.expiresAtMs<=Date.now()||Object.keys(H.variables).some((K)=>!E6(K)))return x0();if(H.git){let K=new URL(Q.apiOrigin),L=new URL(H.git.base_url),B=Date.parse(H.git.expires_at);if(L.origin!==K.origin)throw new C("environment_git_origin_mismatch","The delivered Git broker is not on this worker's API origin.");if(!["/git","/git/"].includes(L.pathname)||L.username||L.password||L.search||L.hash||B<=Date.now()||B>F)return x0()}if(H.cloud_access&&!NQ(H.cloud_access,Q.apiOrigin))throw new C("environment_cloud_access_origin_mismatch","The delivered cloud access is not on this worker's API origin.");return H};return{path:Z,install(V){let Y=z(V),H=J8(Y);if(X&&(Y.revision<X.revision||Y.revision===X.revision&&(H!==X.hash||Y.snapshot_id!==X.snapshotId)))return x0();if(!X||Y.revision>X.revision){if(PQ(Z,Y,_0.snapshotBytes),J8(z(JSON.parse(_9(Z,_0.snapshotBytes))))!==H)return x0();let U=X;if(X={revision:Y.revision,hash:H,snapshotId:Y.snapshot_id,generation:Y.binding.target_generation},U&&U.generation<X.generation)J.add(G(U.snapshotId,U.revision))}else if(J8(z(JSON.parse(_9(Z,_0.snapshotBytes))))!==X.hash)return x0();return{installed:!0,snapshot_id:Y.snapshot_id,installed_revision:Y.revision}},current(){if(!X)return x0();try{let V=z(JSON.parse(_9(Z,_0.snapshotBytes)));if(J8(V)!==X.hash)return x0();return V}catch{return x0()}},carried:(V,Y)=>J.has(G(V,Y))}}var F9=Object.freeze([Object.freeze({version:"0.2.61",artifact_sha256:"02ffcd514bf7cc0a9e73d4ce31ecea32709429cd0adf79e7062c1b70ff9ab8b8",legacy_linux_x64_sha256:"cdc0828abde3157e39afc6a64e033deee52ff7cfb09b55a42e60394df24980b9"}),Object.freeze({version:"0.2.62",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d",legacy_linux_x64_sha256:"cce594365d518b680abfb2378d234c8ef4e3daf257df83adef650a4523fb2d92"}),Object.freeze({version:"0.2.63",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d"}),Object.freeze({version:"0.2.64",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.65",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.66",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.67",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.68",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.69",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.70",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.71",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.72",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.73",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.74",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.75",artifact_sha256:"a6e0648894f1f4876affd77c0ff42642c1f9cbe9bb752de19d7a97a5fb3b820e"}),Object.freeze({version:"0.2.76",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.77",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.78",artifact_sha256:"0a7a7ece14850a28b8f972d66e4eef570eb2bb75d58f8a82f4e9afe91424e27f",pi_tools_v1:!0}),Object.freeze({version:"0.2.79",artifact_sha256:"96f52656b454fc5b9ffe520f5c5d55720b5173eb084cd326d2710e434623897b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.80",artifact_sha256:"6ee0ed70889e2771bd9b239ee039b549361b56ce870e08956ec7cce7fa199cd7",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.81",artifact_sha256:"c8909b36f4ee9316c0c3e298cb9adb5fc821a6ec5ca365cab60043eb942c258a",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.82",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.83",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.84",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.85",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.86",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.87",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.88",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.89",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.90",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.91",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.92",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.93",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.94",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.95",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.96",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.97",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.98",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.99",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.100",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.101",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.102",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.103",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.104",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.105",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.106",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.107",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.108",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.109",artifact_sha256:"7a82b33611b9f47478fb181d0da6f49a04f7e4bc401a7752530fecffb2dc5864",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.110",artifact_sha256:"00b7dcc9078a7d7ea4814414fbf92dcf9ba3b0fd51186aac1b967e9ae306a377",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.111",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.112",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.113",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.114",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.115",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.116",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.117",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.118",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.119",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.120",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.121",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.122",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.123",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.124",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.125",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.126",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.127",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.128",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.129",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.130",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.131",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.132",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.133",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.134",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.135",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.136",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.137",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.138",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.139",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.140",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.141",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.142",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.143",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.144",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.145",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.146",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.147",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.148",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.149",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.150",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.151",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.152",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.153",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.154",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.155",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.156",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.157",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.158",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.159",artifact_sha256:"cc806ca6df14c39d45a944d1e1db9827dae35b3e66e0265ededb3eea3d883dcb",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.160",artifact_sha256:"0b8f6c4598a19acbeff93929efc237dbc4e356ccb26abf6957e297bfc1b551e8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.161",artifact_sha256:"d570f5035bfc5916c31f4954ce5bcc00013eec83edb020edbbfbd3260b9c17d0",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.162",artifact_sha256:"6e52c44af7a3ea3633a4dc28aa63696143cd80044bca7f67a57c4c156985566f",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.163",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.164",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.165",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.166",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.167",artifact_sha256:"62658de309f9b9c8fd70041c83898d8625d85fed303ac6e60c3a17afc85477e2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.168",artifact_sha256:"24d7efe74218b862a90f48cf71dc59dce1d0dba29b167168aca06649bbfab364",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.169",artifact_sha256:"83879d03741c3f37c1502535d128685421cd7a498bc22543516a23ef2b21e496",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.170",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.171",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.172",artifact_sha256:"7a01a820961bd03b31007e46ba4f09df0a621ea5bfc9ee84548d6acdfd750169",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.173",artifact_sha256:"82c9ece017e109cf8b4b54734ac7a81b1ecb2ff35a426998369b6c3e690fd1ae",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.174",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.175",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.176",artifact_sha256:"ba3e211489877d0622aeca87be98e235d245f39d2b57f275cd924168d05f98ce",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0})]),S6="16befed856b4414dee65733e82549e1db74fe0ff3841d2571cfd8605d3ee970b",w6=Object.freeze(["ea63410f321f70848139a63ddcaa9f3f0a48daa3641898cc1db9f0e15ddfbb13","6cd101ddb09f87ed6996aa92a93911b1759b5ae33e9579c3dff8225ecfcbe1b6",S6]),bZ=Object.freeze(["0f57db3036c275f78064796a72827d0f47fe702475e5feebb31e1569bcb5a0cf","38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2"]),UJ=Object.freeze(["pi_tools_v1","background_bash_v1","machine_sdk_v1","pi_tools_confinement_v1","home_folder_v1"]),WJ=new Set([K0,...F9.map(($)=>$.artifact_sha256),...w6,...bZ]);var BJ=new Set([K0,...F9.filter(($)=>$.pi_tools_v1).map(($)=>$.artifact_sha256),...bZ]);var LJ=new Set([K0,...F9.filter(($)=>$.pi_tools_confinement_v1).map(($)=>$.artifact_sha256)]);var NJ=new Set([K0,...F9.filter(($)=>$.home_folder_v1).map(($)=>$.artifact_sha256)]);var MJ=new Set([K0,...F9.filter(($)=>$.background_bash_v1).map(($)=>$.artifact_sha256)]);var jJ=new Set([K0,...F9.filter(($)=>$.machine_sdk_v1).map(($)=>$.artifact_sha256)]);var b6=[n0,"reason-hands-worker.cjs"];function kZ($){return typeof $==="string"&&b6.includes($)}var k6;function fZ(){return k6??{kind:"unavailable",status:"unsupported_entrypoint",sha256:null,observed_at_ms:null}}import{closeSync as f6,constants as X$,fstatSync as gZ,lstatSync as g6,openSync as m6,readSync as y6,realpathSync as h6,watch as v6}from"fs";import{dirname as mZ}from"path";function Y8($,Q){let Z;try{let X=mZ($),J=g6(X);if(!J.isDirectory()||J.isSymbolicLink()||J.uid!==process.getuid?.()||(J.mode&18)!==0||h6(X)!==X)return null;Z=m6($,X$.O_RDONLY|X$.O_NOFOLLOW|X$.O_NONBLOCK);let G=gZ(Z);if(!G.isFile()||G.nlink!==1||G.uid!==process.getuid?.()||(G.mode&63)!==0||G.size<1||G.size>8192)return null;let z=Buffer.alloc(8193),V=y6(Z,z,0,z.length,0),Y=gZ(Z);if(V!==G.size||Y.size!==G.size||Y.nlink!==1||Y.mtimeMs!==G.mtimeMs||Y.ctimeMs!==G.ctimeMs)return null;let H=JSON.parse(z.subarray(0,V).toString("utf8"));if(!H||H.pid!==Q.pid||!Number.isSafeInteger(H.pid)||H.pid<1||H.launchId!==Q.launchId||H.workerVersion!==Q.workerVersion||H.protocolVersion!==Q.protocolVersion||H.workerArtifactSha256!==Q.workerArtifactSha256||H.workerEntrypoint!==Q.workerEntrypoint||H.workspaceAliasReady!==!0||!S0(H.targetGeneration)||!S0(H.generation)||!O0(H.fenceId))return null;return{...Q,generation:H.generation,targetGeneration:H.targetGeneration,fenceId:H.fenceId,workspaceAliasReady:!0}}catch{return null}finally{if(Z!==void 0)f6(Z)}}var c6=($,Q,Z)=>{let X=v6($,{persistent:!1},Q);return X.on("error",Z),X};function yZ($){let Q=new AbortController,Z=$.initial,X=Z.targetGeneration,J=!1,G=!1,z,V,Y=()=>{if(G)return;G=!0,z?.close(),z=void 0,clearInterval(V),$.signal.removeEventListener("abort",Y),Q.abort()},H=()=>{if(G)return;if(!$.isAlive()){Y();return}let U=Y8($.path,$.initial);if(!U||U.generation<Z.generation||U.targetGeneration<Z.targetGeneration||U.targetGeneration===Z.targetGeneration&&U.fenceId!==Z.fenceId)return;if(Z=U,J||U.targetGeneration<=X)return;X=U.targetGeneration,J=!0,Promise.resolve().then(()=>{return Q.signal.throwIfAborted(),$.publish(U,Q.signal)}).catch(()=>{if(!G)Y(),$.failed?.()}).finally(()=>{J=!1,H()})};if($.signal.aborted)return Y(),{stop:Y};$.signal.addEventListener("abort",Y,{once:!0});try{z=($.watch??c6)(mZ($.path),H,()=>{z?.close(),z=void 0})}catch{}return V=setInterval(H,1000),V.unref?.(),H(),{stop:Y}}import{spawn as d6}from"child_process";import{chmodSync as p6,mkdtempSync as u6,realpathSync as l6,rmSync as s6,unlinkSync as n6,writeFileSync as i6}from"fs";import o6 from"net";import{platform as a6,tmpdir as r6}from"os";import{join as hZ}from"path";var vZ=1048576,G$=105000,t6=2000,e6=String.raw`
+const { writeSync } = require("node:fs");
+const { createRequire } = require("node:module");
+const { join } = require("node:path");
+const { createInterface } = require("node:readline");
+const { formatWithOptions, inspect } = require("node:util");
+const vm = require("node:vm");
+
+const timeoutMs = ${G$};
+const maxLogChars = 524288;
+let activeOutput = [];
+let activeOutputChars = 0;
+function appendOutput(value) {
+  if (activeOutputChars >= maxLogChars) return;
+  const kept = String(value).slice(0, maxLogChars - activeOutputChars);
+  activeOutput.push(kept);
+  activeOutputChars += kept.length;
+}
+const replConsole = Object.fromEntries(
+  ["log", "info", "warn", "error", "debug"].map((method) => [
+    method,
+    (...args) => {
+      const formatted = formatWithOptions({ colors: false }, ...args);
+      appendOutput(formatted + "\n");
+    },
+  ]),
+);
+const originalProcessKill = process.kill.bind(process);
+function selfOnlyProcessKill(pid, signal) {
+  if (pid !== process.pid) {
+    const error = new Error("kill EPERM");
+    error.code = "EPERM";
+    error.errno = -1;
+    error.syscall = "kill";
+    throw error;
+  }
+  return originalProcessKill(pid, signal);
+}
+Object.defineProperty(process, "kill", {
+  value: selfOnlyProcessKill,
+  configurable: false,
+  enumerable: true,
+  writable: false,
+});
+Object.defineProperty(process, "_kill", {
+  value: selfOnlyProcessKill,
+  configurable: false,
+  enumerable: false,
+  writable: false,
+});
+const localRequire = createRequire(join(process.cwd(), "__ara_hands_node_repl__.js"));
+const context = vm.createContext({
+  AbortController,
+  AbortSignal,
+  Buffer,
+  URL,
+  URLSearchParams,
+  clearImmediate,
+  clearInterval,
+  clearTimeout,
+  console: replConsole,
+  fetch,
+  process,
+  queueMicrotask,
+  require: localRequire,
+  setImmediate,
+  setInterval,
+  setTimeout,
+  structuredClone,
+});
+
+async function evaluate(code) {
+  activeOutput = [];
+  activeOutputChars = 0;
+  const originalStdoutWrite = process.stdout.write;
+  process.stdout.write = function(chunk, encoding, callback) {
+    const normalizedEncoding = typeof encoding === "string" ? encoding : undefined;
+    appendOutput(Buffer.isBuffer(chunk) ? chunk.toString(normalizedEncoding) : chunk);
+    const completed = typeof encoding === "function" ? encoding : callback;
+    if (typeof completed === "function") queueMicrotask(completed);
+    return true;
+  };
+  const script = new vm.Script(code, { filename: "reason-hands-node-repl.js" });
+  let timer;
+  try {
+    const value = script.runInContext(context, { timeout: timeoutMs });
+    const resolved = await Promise.race([
+      Promise.resolve(value),
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("REPL evaluation timed out after 105 seconds")),
+          timeoutMs,
+        );
+      }),
+    ]);
+    const inspected = inspect(resolved, {
+      depth: 8,
+      colors: false,
+      maxArrayLength: 200,
+      maxStringLength: 16_000,
+      breakLength: 120,
+    });
+    const emitted = activeOutput.join("");
+    return emitted.length === 0
+      ? inspected
+      : emitted + (emitted.endsWith("\n") ? "" : "\n") + inspected;
+  } finally {
+    if (timer) clearTimeout(timer);
+    process.stdout.write = originalStdoutWrite;
+  }
+}
+
+// Ordinary stdout is just an untrusted result stream, not a control authority.
+// The parent must terminate and reap this process before accepting any result.
+function respond(payload) { writeSync(1, JSON.stringify(payload) + "\n"); }
+
+let queue = Promise.resolve();
+const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
+lines.on("line", (line) => {
+  queue = queue.then(async () => {
+    try {
+      const request = JSON.parse(line);
+      if (request.action === "probe") {
+        respond({ ok: true, output: "ARA_HANDS_REPL_READY" });
+        return;
+      }
+      if (request.action !== "evaluate" || typeof request.code !== "string") {
+        throw new Error("Invalid REPL request");
+      }
+      respond({ ok: true, output: await evaluate(request.code) });
+    } catch (error) {
+      respond({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+        stack: error instanceof Error ? error.stack : undefined,
+      });
+    }
+  }).catch((error) => respond({ ok: false, error: String(error) }));
+});
+`;function $7($=process.execPath,Q=process.versions.bun){return Q?"node":$}function J$($){try{n6($)}catch{}}function G8($,Q){$.end(`${JSON.stringify(Q)}
+`)}function Y$($){return JSON.stringify($)}function Q7($){let Q=u6(hZ(r6(),"reason-node-repl-")),Z=hZ(Q,"node-repl.sb"),J=["(version 1)","(deny default)",'(import "system.sb")',"(allow process*)","(deny network*)",`(allow file-read* ${["/System","/usr","/bin","/opt/homebrew","/usr/local"].map((z)=>`(subpath ${Y$(z)})`).join(" ")})`,`(allow file-read* file-write* (subpath ${Y$($.workRoot)}) (subpath ${Y$(Q)}))`].join(`
+`);i6(Z,J,{mode:384});let G=!1;return{command:"/usr/bin/sandbox-exec",args:["-f",Z,$.nodeExecutable,...$.nodeArgs],cwd:$.workRoot,env:{...$.environment,TMPDIR:Q},async cleanup(){if(G)return;G=!0,s6(Q,{recursive:!0,force:!0})}}}async function Z7($){let Q=l6($.workRoot),Z=$.nodeExecutable??$7(),X=["--max-old-space-size=512","--permission",`--allow-fs-read=${Q}`,`--allow-fs-write=${Q}`,"-e",e6],J=z8({home:Q,temporaryDirectory:Q}),G=$.platformName??a6();if(G==="linux")return{command:Z,args:X,cwd:Q,env:J,async cleanup(){}};if(G==="darwin")return Q7({nodeExecutable:Z,nodeArgs:X,workRoot:Q,environment:J});throw Error("hands_node_repl_platform_unsupported")}async function E9($){let Q;try{await Promise.race([$,new Promise((Z,X)=>{Q=setTimeout(()=>X(Error("hands_node_repl_child_cleanup_timeout")),t6)})])}finally{clearTimeout(Q)}}async function cZ($){if($.executionMode!=="single-evaluation")throw Error(OZ);let Q=await Z7($),Z;try{Z=d6(Q.command,Q.args,{cwd:Q.cwd,env:Q.env,stdio:["pipe","pipe","pipe"]})}catch(q){throw await Q.cleanup(),q}let X=new Promise((q)=>Z.once("close",()=>q())),J;Z.once("error",(q)=>{J=q});let G=!1,z=!1,V="";Z.stderr.setEncoding("utf8"),Z.stderr.on("data",(q)=>{V=`${V}${q}`.slice(-16384)});let Y=Z.stdout,H,U=(q,_,R)=>{if(R)q.failure??=R;if(q.finishing)return;q.finishing=!0,z=!0,Z.kill("SIGKILL"),E9(X).then(()=>{if(q.failure)q.reject(q.failure);else q.resolve(_??{})},(P)=>q.reject(P))},F=()=>{if(z=!0,H)U(H,void 0,Error("hands_node_repl_state_lost"));else Z.kill("SIGKILL")},K="";Y?.setEncoding("utf8"),Y?.on("data",(q)=>{if(H?.finishing||z)return;if(K+=q,K.length>vZ){F();return}while(!0){let _=K.indexOf(`
+`);if(_===-1)return;let R=K.slice(0,_);K=K.slice(_+1);let P=H;if(!P){F();return}try{let T=JSON.parse(R);if(P.action==="probe")P.resolve(T);else{U(P,T);return}}catch{U(P,void 0,Error("invalid_hands_node_repl_child_response"));return}}});let L=(q)=>{let _=V.trim(),R=q??Error(_?`hands_node_repl_child_exited:${_}`:"hands_node_repl_child_exited");if(z=!0,H&&!H.finishing)U(H,void 0,R)};Z.once("error",L),Z.once("close",()=>L()),Z.stdin.on("error",L);let B=(q)=>new Promise((_,R)=>{if(G||z||Z.exitCode!==null||Z.signalCode!==null){R(Error(z?"hands_node_repl_state_lost":"hands_node_repl_stopped"));return}let P=setTimeout(F,q.action==="probe"?1e4:Math.max(1,Math.min($.evaluationTimeoutMs??G$-1000,G$-1000))),T={action:q.action,finishing:!1,resolve(k){if(H===T)H=void 0;clearTimeout(P),_(k)},reject(k){if(H===T)H=void 0;clearTimeout(P),R(k)}};H=T,Z.stdin.write(`${JSON.stringify(q)}
+`,(k)=>{if(!k)return;U(T,void 0,k)})});try{if(!Y){if(Z.pid===void 0)await E9(X);throw J??Error("hands_node_repl_control_pipe_missing")}let q=await B({action:"probe"});if(q.ok!==!0||q.output!=="ARA_HANDS_REPL_READY")throw Error("hands_node_repl_probe_failed")}catch(q){G=!0,Z.kill("SIGKILL");try{await E9(X)}finally{await Q.cleanup()}throw q}let W=Promise.resolve(),j=new Set;J$($.socketPath);let O=o6.createServer((q)=>{j.add(q),q.once("close",()=>j.delete(q)),q.setEncoding("utf8");let _="",R=!1,P=!1;q.once("close",()=>{if(P)F()}),q.on("error",()=>q.destroy()),q.on("data",(T)=>{if(R)return;if(_+=T,_.length>vZ){R=!0,G8(q,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let k=_.indexOf(`
+`);if(k===-1)return;R=!0;let m=_.slice(0,k);W=W.then(async()=>{if(q.destroyed)return;try{let E=JSON.parse(m);if(E.action!=="evaluate"||typeof E.code!=="string")throw Error("Invalid REPL request");P=!0;let N=await B({action:"evaluate",code:E.code});if(P=!1,N.ok!==!0||typeof N.output!=="string")throw Error(typeof N.error==="string"?N.error:"hands_node_repl_failed");G8(q,{ok:!0,output:N.output})}catch(E){P=!1,G8(q,{ok:!1,error:E instanceof Error?E.message:String(E),stack:E instanceof Error?E.stack:void 0})}}).catch((E)=>{G8(q,{ok:!1,error:E instanceof Error?E.message:String(E)})})})});try{await new Promise((q,_)=>{O.once("error",_),O.listen($.socketPath,()=>{O.off("error",_);try{p6($.socketPath,384),q()}catch(R){O.close(()=>_(R))}})})}catch(q){G=!0,Z.kill("SIGKILL");try{await E9(X)}finally{await Q.cleanup(),J$($.socketPath)}throw q}return{socketPath:$.socketPath,async stop(){if(G)return;G=!0;let q=new Promise((_)=>O.close(()=>_()));for(let _ of j)_.destroy();await q,W.catch(()=>{return}),F();try{await E9(X)}finally{await Q.cleanup(),J$($.socketPath)}}}}var z$=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var dZ="/workspace",pZ="/var/lib/reason/sessions",X7="/var/lib/reason/session-controls";function uZ($){let Q=`${pZ}/`;if(!$.startsWith(Q))return null;let Z=$.slice(Q.length);if(!z$.test(Z)||Z!==Z.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${X7}/${Z}/job.env`}function J7($){if(!z$.test($))throw Error("personal_computer_invalid_identity");return $.toLowerCase()}function K8($){let Q=J7($);return{runtimeRoot:`${pZ}/${Q}`,workspaceRoot:`${dZ}/sessions/${Q}`,sharedRoot:dZ}}var lZ="/root/.ara/cloud-browser/repl.sock";function K$($){return $==="compute"}function sZ($,Q,Z="linux"){if($)K8($);if(Z!=="linux")throw Error("cloud_browser_os_invalid");if(Q!==void 0&&(!$||!/^[1-9][0-9]{0,18}$/.test(Q)))throw Error("cloud_browser_generation_invalid");let X=$?`/var/lib/reason/browsers/${$.toLowerCase()}`:"/root/.ara/cloud-browser",J=$?`${X}/${Q?`g${Q}`:"current"}`:X,G=$?`/root/.b/${$.toLowerCase().replaceAll("-","")}`:X;return{temporarySessionDirectory:G,temporaryDirectory:$?`${G}/${Q??"current"}`:`${J}/tmp`,directory:J,sessionDirectory:X,config:`${J}/config.json`,status:`${J}/status.json`,socket:`${J}/repl.sock`,bundle:`${J}/driver.mjs`,processName:$?`ara-browser-${$.toLowerCase()}${Q?`-${Q}`:""}`:"ara-cloud-browser"}}var H$="browser_egress",nZ=WQ,M7=45000,j7=d9+1500,m0=/^[A-Za-z0-9._:-]{1,160}$/,C7="/run/ara-hands";function q7($,Q,Z=Q4()){if($==="darwin")return{temporaryRoot:Z,prepareRoot:!1,sessionMode:448};return{temporaryRoot:Q??C7,prepareRoot:!0,sessionMode:457}}function iZ($,Q=process.platform,Z=process.geteuid?.()){return $===!0&&Q==="linux"&&Z===0}function W$($=rZ(),Q=process.platform,Z=process.geteuid?.()){return $&&Q==="linux"&&Z===0?{uid:$.uid,gid:$.gid,home:$.home,username:$.username}:null}function T7($=W$(),Q=CZ){return $&&Q()?a8:null}function wY($=W$(),Q=process.platform,Z=process.geteuid?.()){return Q!=="linux"||Z!==0||$!==null}function bY($=process.platform,Q=process.geteuid?.()){return $!=="linux"||Q!==0}function O7($,Q){if(!Q&&($??"linux")==="linux")return lZ;return sZ(Q,void 0,$??"linux").socket}function D7($){return $[L0]===!0?"sandbox_loopback":"ara_device_wss"}function U9($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function X4($){let Q=$.toLowerCase().replace(/^\[|\]$/g,"");return Q==="localhost"||Q.endsWith(".localhost")||Q==="::1"||Q==="0:0:0:0:0:0:0:1"||Q==="0.0.0.0"||Q.startsWith("127.")}class J4 extends C{expiryDiagnostic;constructor($){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=$}}function _7($){return U9($)&&Object.keys($).every((Q)=>Q==="source_path"||Q==="branch")&&($.source_path===void 0||s0($.source_path))&&typeof $.branch==="string"&&e8.test($.branch)}function A7($,Q,Z){let X=Q===void 0?Date.now():Q,J=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],G=new Set([...J,"workspace_id","legacy_workspace_id",i0,o0,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",p,L0,H$,V9,C0,a0,g0]),z=U9($)?$:null,V=z?.[H$],Y=z?.[V9],H=z?.[a0],U=V===void 0||(z?.[p]===f0||H===S9&&z?.[p]===void 0)&&U9(V)&&Object.keys(V).every((q)=>q==="mode"||q==="allowed_domains")&&V.mode==="enforce"&&Array.isArray(V.allowed_domains)&&V.allowed_domains.length<=256&&V.allowed_domains.every((q)=>typeof q==="string"&&h8(q));if(!U9($)||J.some((q)=>!(q in $))||Object.keys($).some((q)=>!G.has(q))||!U||H!==void 0&&H!==S9||z?.[g0]!==void 0&&z[g0]!==F8||z?.personal_workspace!==void 0&&(z.personal_workspace!==!0||z[p]!==f0)||z?.cloud_browser!==void 0&&(z.cloud_browser!==!0||z[p]!==f0)||z?.sandbox_provider!==void 0&&!K$(z.sandbox_provider)||z?.sandbox_os!==void 0&&z.sandbox_os!=="linux"||Y!==void 0&&(z?.[p]!==K9||!r8(Y))||p in $&&$[p]!==f0&&$[p]!==K9&&$[p]!==B0||L0 in $&&$[L0]!==!0||$.workspace_path!==void 0&&(!s0($.workspace_path)||$[p]!==B0)||$.workspace_worktree!==void 0&&($.workspace_path===void 0||!_7($.workspace_worktree))||typeof $.relay_url!=="string"||typeof $.session_id!=="string"||!m0.test($.session_id)||$.workspace_id!==void 0&&(typeof $.workspace_id!=="string"||!m0.test($.workspace_id))||$.legacy_workspace_id!==void 0&&(typeof $.legacy_workspace_id!=="string"||!m0.test($.legacy_workspace_id))||$[i0]!==void 0&&($[i0]!==U8||(p in $))||$[o0]!==void 0&&($[o0]!==W8||(p in $))||$[C0]!==void 0&&(typeof $[C0]!=="string"||!m0.test($[C0]))||typeof $.environment_id!=="string"||!m0.test($.environment_id)||typeof $.expires_at!=="string"||$.policy_mode!=="full_access"||$.policy_version!==1||$.hands_protocol_version!==W9||$.hands_worker_version!==B9||$.hands_worker_artifact_sha256!==K0||!kZ($.hands_worker_entrypoint)||!S0($.target_generation)||!O0($.target_fence_id))throw new C("invalid_hands_payload","Reason Hands connection payload is invalid.");let F;try{F=new URL($.relay_url)}catch{throw new C("invalid_hands_relay","Reason Hands relay URL is invalid.")}let K=$[L0]===!0,L=X4(F.hostname);if((K?F.protocol!=="ws:"||!L:L?F.protocol!=="ws:":F.protocol!=="wss:")||F.username||F.password||F.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(F.pathname))throw new C("invalid_hands_relay","Reason Hands relay URL is not allowed.");let B=Date.parse($.expires_at),W=Number.isNaN(B)?"parse":new Date(B).toISOString()!==$.expires_at?"noncanonical":B<=X?"expired":B-X>nZ?"over_cap":"accepted",j={version:1,outcome:W,clock_source:Q===void 0?"date_now":"injected",validation_now_ms:Z9(X),expiry_ms:Z9(B),remaining_ms:Number.isSafeInteger(B-X)?B-X:null,maximum_lifetime_ms:nZ,cli_artifact:fZ()};if(W!=="accepted")throw new J4(j);try{Z?.(j)}catch{}let O=$.environment_binding===void 0?void 0:S8.safeParse($.environment_binding);if(O&&!O.success)throw new C("invalid_hands_request","Reason Hands environment binding is invalid.");return{...$.cloud_browser===!0?{cloud_browser:!0}:{},...K$($.sandbox_provider)?{sandbox_provider:$.sandbox_provider}:{},...$.sandbox_os==="linux"?{sandbox_os:$.sandbox_os}:{},...$.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:F.toString(),...O?.success?{environment_binding:O.data}:{},session_id:$.session_id,...$.workspace_id===void 0?{}:{workspace_id:$.workspace_id},...$.legacy_workspace_id===void 0?{}:{legacy_workspace_id:$.legacy_workspace_id},...$[i0]===U8?{[i0]:U8}:{},...$[o0]===W8?{[o0]:W8}:{},...typeof $[C0]==="string"?{[C0]:$[C0]}:{},...$[a0]===S9?{[a0]:S9}:{},...$[g0]===F8?{[g0]:F8}:{},...typeof $.workspace_path==="string"?{workspace_path:$.workspace_path}:{},...U9($.workspace_worktree)?{workspace_worktree:{...typeof $.workspace_worktree.source_path==="string"?{source_path:$.workspace_worktree.source_path}:{},branch:String($.workspace_worktree.branch)}}:{},environment_id:$.environment_id,expires_at:$.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:W9,hands_worker_version:B9,hands_worker_artifact_sha256:K0,hands_worker_entrypoint:n0,target_generation:$.target_generation,target_fence_id:$.target_fence_id,...p in $?{[p]:$[p]}:{},...K?{[L0]:!0}:{},...Y===void 0?{}:{[V9]:Y},...V===void 0?{}:{[H$]:{mode:"enforce",allowed_domains:[...new Set(V.allowed_domains)].sort()}}}}function x7(){let $=new Map;return{acquire(Q,Z){if($.has(Q))return null;let X=[...$.values()],J=(z)=>Z.group!==void 0&&z.group===Z.group;if(Z.exclusive?!X.every(J):X.some((z)=>z.exclusive))return null;if(Z.limit!==void 0&&!X.some(J)&&new Set(X.map((z,V)=>z.group??V)).size>=Z.limit)return null;$.set(Q,Z);let G=!1;return()=>{if(G)return;G=!0,$.delete(Q)}},activeOwners:()=>[...$.keys()]}}var P7=x7();function I7($,Q){L9($,{recursive:!0,mode:448});let Z=n($),X=()=>new C("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let z of Q.split("/")){let V=o(Z,z);try{let H=t(V);if(H.isSymbolicLink()||!H.isDirectory())throw X()}catch(H){if(!(H&&typeof H==="object"&&("code"in H)&&H.code==="ENOENT"))throw H;try{L9(V,{mode:448})}catch(U){if(!(U&&typeof U==="object"&&("code"in U)&&U.code==="EEXIST"))throw U}}let Y=t(V);if(Y.isSymbolicLink()||!Y.isDirectory()||n(V)!==V)throw X();Z=V}let J=t(Z),G=F7(Z,V$.O_RDONLY|V$.O_DIRECTORY|V$.O_NOFOLLOW);try{let z=H7(G);if(!z.isDirectory()||z.dev!==J.dev||z.ino!==J.ino||n(Z)!==Z)throw X();V7(G,448)}finally{K7(G)}return Z}function R7($,Q=aZ(),Z,X,J){if(!m0.test($)||Z!==void 0&&!m0.test(Z))throw new C("invalid_hands_workspace","Reason Hands run identity is invalid.");let G=V0(p0({kind:"managed",workspaceId:$,...X?{base:X}:{},...J?{layout:J}:{}})),z=I7(Q,V0(G)),V=o(z,N7(G)),Y=!1;try{let K=t(V);if(Y=!0,K.isSymbolicLink())throw new C("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}if(J&&!Y)try{let K=o(n(Q),V0(p0({kind:"managed",workspaceId:$,...X?{base:X}:{}}))),L=t(K);if(!L.isSymbolicLink()&&L.isDirectory()&&n(K)===K)V8(K,V),Y=!0}catch{}if(Z&&Z!==$){let K=o(z,Z);try{let L=t(K);if(L.isSymbolicLink()||!L.isDirectory())throw new C("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let B=n(K);if(V0(B)!==z)throw new C("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let W=null;if(Y){W=o(z,`.${$}.previous`);try{throw t(W),new C("invalid_hands_workspace","Reason Hands previous workspace backup already exists.")}catch(j){if(j instanceof C||!(j&&typeof j==="object"&&("code"in j)&&j.code==="ENOENT"))throw j}V8(V,W)}try{V8(B,V)}catch(j){if(W)V8(W,V);throw j}Y=!0}catch(L){if(L instanceof C||!(L&&typeof L==="object"&&("code"in L)&&L.code==="ENOENT"))throw L}}L9(V,{recursive:!0,mode:448}),w9(V,448);let H=n(V);if(V0(H)!==z)throw new C("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let U=o(H,"repo");try{let K=t(U);if(K.isSymbolicLink()||!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(K){if(K instanceof C||!(K&&typeof K==="object"&&("code"in K)&&K.code==="ENOENT"))throw K}L9(U,{recursive:!0,mode:448}),w9(U,448);let F=n(U);if(V0(F)!==H)throw new C("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:H,repoPath:F}}function Y4($){let Q=null;try{Q=t($)}catch{}if(!Q||Q.isSymbolicLink()||!Q.isDirectory()||Q.uid!==0||Q.gid!==0||(Q.mode&4095)!==493)throw new C("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function E7($,Q){let Z="/";for(let X of["",...$.split("/"),...Q.split("/")].filter((J,G)=>G===0||J)){if(X)Z=o(Z,X);let J;try{J=t(Z)}catch{return null}if(J.uid!==0)return J.uid;if((J.mode&2)!==0&&(J.mode&512)===0&&!J.isSymbolicLink())return-1;if(J.isSymbolicLink()||!J.isDirectory())return null}return null}function S7($,Q,Z,X=process.geteuid?.(),J){if(!m0.test(Q))return null;let G,z;try{G=n($),z=V0(p0({kind:"managed",workspaceId:Q,...Z?{base:Z}:{},...J?{layout:J}:{}}))}catch{return null}let V=o(G,z),Y=U$(V)!==null,H=(B)=>new C("cloud_workspace_root_invalid",B),U;if(X===0){let B=E7(G,z);if(B===null)return null;if(!Y)throw new C("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");U=B}else{if(!Y)return null;let B,W;try{B=t(V0(V)),W=t(V)}catch{return null}if(B.isSymbolicLink()||!B.isDirectory()||B.uid===0||W.uid!==0)return null;U=B.uid}let F=G;for(let B of z.split("/")){let W=o(F,B),j=!1;try{let O=t(W);j=!O.isSymbolicLink()&&O.isDirectory()&&n(W)===W}catch{}if(!j)throw H("This cloud Session's workspace root is missing or is not a real directory.");F=W}Y4(V);let K;try{K=G4(V)}catch(B){if(B instanceof C)throw B;throw H("This cloud Session's workspace root changed while Reason Hands checked it.")}let L=null;try{L=b9(K.repoPath).uid}catch{}if(L!==U)throw new C("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return K}function G4($,Q=!1){let Z=n($),X=o(Z,"repo"),J;try{J=t(X)}catch{throw new C("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(Q){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(Z))throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");if(K8(Z.slice(Z.lastIndexOf("/")+1)).runtimeRoot!==Z)throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");let V=n("/workspace"),Y=n(X);if(V!=="/workspace"||!b9(Y).isDirectory()||!Y.startsWith("/workspace/"))throw new C("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:Z,repoPath:Y}}let G=qZ(Z);if(G&&J.isSymbolicLink()){let V=n(X);if(V!==n(G)||!b9(V).isDirectory())throw new C("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:Z,repoPath:V}}if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let z=n(X);if(V0(z)!==Z)throw new C("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:Z,repoPath:z}}function B$($,Q,Z){if(Q!==void 0&&!s0(Q))throw new C("invalid_hands_workspace",`Reason Hands ${Z} is invalid.`);let X=Z4($,Q??".");if(!w0($,X))throw new C("invalid_hands_workspace",`Reason Hands ${Z} escapes its granted root.`);return X}function z4($,Q,Z){if(t8(Q)){let X=n(Z);return{anchor:X,target:Z4(X,Q),boundary:o(X,H9)}}return{anchor:$,target:B$($,Q,"folder"),boundary:$}}function w7($,Q){if(!w0($,Q))throw new C("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let Z=$;for(let X of Q.slice($.length).split("/").filter(Boolean)){Z=o(Z,X);let J=null;try{J=t(Z)}catch(G){if(G.code!=="ENOENT")throw G}if(!J)L9(Z,{mode:448});else if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function K4($,Q){let Z=n(B$($,Q.source_path,"repository"));if(!w0($,Z)||!b9(Z).isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return Z}async function b7($,Q,Z,X=B8()){try{let J=n($);if(F$(z4(J,Q,X).target))return;return await xZ(K4(J,Z))??void 0}catch{return}}function k7($,Q,Z,X,J=f7,G=B8()){let z=n($),{target:V,boundary:Y,anchor:H}=z4(z,Q,G);if(Z&&!F$(V)){let K=K4(z,Z);w7(H,V0(V));let L=["-c","core.hooksPath=/dev/null","-C",K];if(X)J([...L,"update-ref","--create-reflog","-m",X.note,`refs/heads/${Z.branch}`,X.commit,""]);let B=X?J([...L,"worktree","add",V,Z.branch]):J([...L,"worktree","add","-b",Z.branch,V]);if(!X&&B.status!==0&&/already exists/.test(B.stderr)&&!F$(V))B=J([...L,"worktree","add",V,Z.branch]);if(B.status!==0)throw new C(/not a git repository/i.test(B.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let U;try{U=t(V)}catch{throw new C("workspace_folder_missing","This Session's folder no longer exists.")}let F=n(V);if(U.isSymbolicLink()&&!w0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!b9(F).isDirectory()||!w0(Y,F))throw new C("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(b0(F))throw new C("protected_path","Credential and secret folders are unavailable to Sessions.");return F}function f7($){let Q=z7("git",$,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:Q.status,stderr:Q.stderr??""}}function V4($){return uZ($)??U$($)?.jobEnv??o($,"job.env")}function g7($,Q){let Z=V4($),X=t(Z);if(X.isSymbolicLink()||!X.isFile())throw new C("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");U7(Z,Q),w9(Q,384)}function m7($){if($.workspaceMode===B0&&$.workspacePath!==void 0){let z=$.home??B8(),V=k7($.grantedRoot,$.workspacePath,$.workspaceWorktree,$.workspaceWorktreeStart,void 0,z);if($.workspaceWorktree&&$.deviceId)EZ(z,$.workspacePath,$.deviceId);return{workRoot:V,repoPath:V,workspace:{kind:"root",path:$.workspacePath},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if($.workspaceMode===f0)return{...G4($.grantedRoot,$.personalWorkspace),workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if($.workspaceMode===K9||$.workspaceMode===B0){let z=t($.grantedRoot);if(z.isSymbolicLink()||!z.isDirectory())throw new C("invalid_hands_workspace","Reason Hands root must be a real directory.");let V=n($.grantedRoot);return{workRoot:V,repoPath:V,workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let Q=$.workspaceId??$.runId,Z={kind:"managed",workspaceId:Q,...$.workspaceBase?{base:$.workspaceBase}:{},...$.workspaceLayout?{layout:$.workspaceLayout}:{}},X=u9($.grantedRoot,Z,$.home).anchor,J=S7(X,Q,$.workspaceBase,void 0,$.workspaceLayout);if(J)return{...J,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let G=R7(Q,X,$.legacyWorkspaceId,$.workspaceBase,$.workspaceLayout);return{...G,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:V0(G.workRoot),managedWorkspace:!0}}function y7($){let{command:Q,prefix:Z}=w8($.executablePath,$.sourceEntrypoint),X=z8({home:L7(),temporaryDirectory:$.temporaryDirectory,path:$.path});if(X.REASON_DEVICE_ROOT=X.ARA_DEVICE_ROOT=$.grantedRoot,X.REASON_HANDS_WORKSPACE=X.ARA_HANDS_WORKSPACE=$.workRoot,X.REASON_HANDS_REPO=X.ARA_HANDS_REPO=$.root,$.workspacePoolPath)X.REASON_HANDS_WORKSPACE_POOL=X.ARA_HANDS_WORKSPACE_POOL=$.workspacePoolPath;return{command:Q,args:[...Z,"__device","__hands-worker","--config",$.configPath],options:{cwd:$.root,env:X,shell:!1,stdio:["ignore","ignore","pipe"]}}}function h7($,Q){let Z="",X=!1,J=Date.now(),G=0,z=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped","request_cancelled"].map((F)=>`hands.worker.${F}`)),V=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed","cancelled","settled","unsupported","unconfirmed"]),Y=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],H=["peerGeneration","socketState","closeCode"],U=new Set(["event","reason","launchId",...Y,...H]);return(F)=>{for(let K of F.toString().split(/(?<=\n)/)){let L=K.endsWith(`
+`);if(!X&&Z.length+K.length<=2048)Z+=K;else X=!0;if(!L)continue;let B=Z;if(Z="",X){X=!1;continue}try{let W=JSON.parse(B);if(!W||typeof W!=="object"||Array.isArray(W)||Object.keys(W).some((j)=>!U.has(j))||!z.has(W.event)||!V.has(W.reason)||W.launchId!==$||Y.some((j)=>!Number.isSafeInteger(W[j])||W[j]<0)||H.some((j)=>W[j]!==null&&(!Number.isSafeInteger(W[j])||W[j]<0)))continue;if(Date.now()-J>=60000)J=Date.now(),G=0;if(G>=122)continue;G+=1,Q(W)}catch{}}}}async function v7($){let Q=$.now()+$.timeoutMs;while($.now()<Q){if($.signal.aborted)throw new C("cancelled","Reason Hands start was cancelled.");if($.spawnFailed?.()||$.child.exitCode!==null||$.child.signalCode!==null)throw new C("hands_worker_exited","Reason Hands exited before ready.");let Z=Y8($.path,{pid:$.child.pid??-1,launchId:$.launchId,workerVersion:B9,protocolVersion:W9,workerArtifactSha256:K0,workerEntrypoint:n0});if(Z?.targetGeneration===$.targetGeneration&&Z.fenceId===$.fenceId)return Z;await new Promise((X)=>setTimeout(X,10))}throw new C("hands_ready_timeout","Reason Hands did not become ready.")}async function c7($,Q){let Z=()=>$.exitCode===0&&$.signalCode===null;if($.exitCode!==null||$.signalCode!==null)return Z()?"stopped":"already_exited";let X=new Promise((z)=>$.once("exit",()=>z()));try{if(!$.kill("SIGTERM"))return Z()?"stopped":"unobserved"}catch{return Z()?"stopped":"unobserved"}if(await oZ(X,Q))return Z()?"stopped":"unobserved";try{$.kill("SIGKILL")}catch{}return await oZ(X,Q)?"forced":"unobserved"}async function oZ($,Q){let Z;try{return await Promise.race([$.then(()=>!0),new Promise((X)=>{Z=setTimeout(()=>X(!1),Q)})])}finally{clearTimeout(Z)}}function d7($){return new Promise((Q)=>{let Z=!1,X=(V)=>{if(Z)return;Z=!0,clearTimeout(z),$.signal.removeEventListener("abort",J),$.child.off("exit",G),Q(V)},J=()=>X("cancelled"),G=()=>X("exited"),z=setTimeout(()=>X("expired"),Math.max(0,$.expiresAt-$.now()));if($.signal.addEventListener("abort",J,{once:!0}),$.child.once("exit",G),$.signal.aborted)J();else if($.child.exitCode!==null||$.child.signalCode!==null)G()})}var H4=$4();function p7($,Q){if(!($ instanceof Error)||$ instanceof C)return!1;let Z=["hands_browser_driver_missing","hands_browser_driver_version_mismatch","hands_browser_executable_missing","hands_browser_unsupported_platform","hands_browser_unavailable"].includes($.message),X=["ENOENT","EACCES","EPERM"].includes($.code??"");if(!Z&&!X)return!1;try{return t(Q),!1}catch(J){return U9(J)&&J.code==="ENOENT"}}function u7($){return $.sandbox_provider==="compute"&&!$.cloud_browser&&!$[L0]&&$[p]===f0}function l7($,Q,Z){return $===void 0?{}:{dispatch_stages:{version:1,claim_to_entered_ms:H0($,Q),...Z===void 0?{}:{worker_prespawned:Z}}}}function kY(){H4().catch(()=>{return}),Y9().catch(()=>{return})}async function fY($,Q={}){let Z=Q.logDiagnostic??((N)=>console.warn(N)),X=new Map,J=(N)=>{let M=Date.now();X.set(N,M);try{Z(JSON.stringify({event:"sandbox.hands_startup",stage:N,timestampMs:M}))}catch{}};J("entered");let G=$.claimEnvironment;$.claimEnvironment=void 0;let z=Q.now??Date.now,V,Y=A7($.payload,Q.now?.(),(N)=>{V=N});if($.managedPty&&($.managedPty.version!==1||!$.headless||!$.runtimeDirectory||![void 0,!0].includes($.managedPty.startupVerified)||!$.deviceIdentity||!$.claimOwner||$.claimOwner.device_id!==$.deviceIdentity.deviceId||!Y.environment_binding||!["darwin","linux"].includes(process.platform)))throw new C("pty_unsupported","Bound PTY requires qualified headless Hands with private jobs and environment.");let H=async(N)=>{let M;try{await Promise.race([N,new Promise((D,S)=>{M=setTimeout(()=>S(new C("hands_event_delivery_unavailable","Hands event delivery did not settle within its deadline.")),Math.max(1,Math.min(Q.eventDeliveryTimeoutMs??5000,5000)))})])}finally{clearTimeout(M)}},U=async(N,M)=>H($.emitEvent(N,M));if($.headless&&(Y.cloud_browser===!0||$.managedBrowser!==void 0||Y[L0]!==void 0||Y[V9]!==void 0||Y[p]!==void 0&&Y[p]!==B0))throw new C("invalid_hands_request","Managed sandbox extensions are unavailable to a headless worker.");let F=W$(),K=Y[g0]===void 0?null:T7(F);if(Y[g0]!==void 0&&(K===null||!$.headless||!iZ($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_model_jobs_egress_unavailable","This worker cannot hold its jobs to the guest egress guard; the Hands did not start.");if(Y[a0]!==void 0&&!($.headless&&iZ($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_confinement_unavailable","Confined Hands need a root Linux worker in host mode.");if(Y.cloud_browser&&process.platform!=="linux")throw new C("cloud_browser_target_invalid","Cloud browser is available only on a cloud machine.");let L=`${$.operationId}:${$.attemptId}`,B=Y[p]===K9,W=$.headless||process.platform==="darwin"&&$.managedBrowser===void 0&&!Y.cloud_browser&&!Y.browser_egress&&!Y[L0]&&(Y[p]===void 0||Y[p]===B0)||u7(Y),j=B?Y[V9]??"bash":null,O=j?DZ(j):null;if(O)throw new C(O,"Persistent Node REPL execution is unavailable; this benchmark profile cannot start.");let q=Y[p],_=$.headless===!0?$.handsSlots??1:void 0,R=(Q.slot??P7).acquire(L,{exclusive:_===1||q!==void 0&&q!==B0,..._!==void 0&&_>1?{limit:_}:{},...$.headless===!0&&Y[C0]!==void 0?{group:Y[C0]}:{}});if(!R)throw new C("hands_slot_busy",_!==void 0&&_>1?`This Reason worker runs at most ${_} sessions at a time.`:"This Reason Device runs one session at a time.");let P=$.headless===!0?tZ($.runId):null,T=null,k=null,m,E;try{J("browser_resolution");let N=$.headless&&Q.browserExecutablePath===void 0?await Y9():null,M=B||Y.cloud_browser?null:Q.browserExecutablePath===void 0?$.headless?N?.status==="resolved"?N.executablePath:null:await NZ(void 0,process.platform,$.managedBrowser):Q.browserExecutablePath;if(!B&&!Y.cloud_browser&&!W&&!M)throw new C("hands_browser_unavailable","Reason Hands requires Chrome, Edge, Brave, Chromium, or a Playwright Chromium install.");J("path_resolution");let D;try{D=await(Q.resolvePathEnvironment??H4)()}catch{D={path:eZ(),source:"fallback"}}if(J("workspace_setup"),process.platform==="darwin"){let s=Y[p]===B0&&Y.workspace_path!==void 0?B$($.root,Y.workspace_worktree?Y.workspace_worktree.source_path:Y.workspace_path,"folder"):null;for(let Z0 of new Set([$.root,...s?[s]:[]]))await cQ(Z0)}let b=Y[p]===f0||Y[p]===K9?q7(process.platform,Q.sandboxRuntimeRoot):null,f=$.headless&&$.runtimeDirectory?$.runtimeDirectory:b?b.temporaryRoot:Q4();if(T="private_runtime",$.headless&&$.runtimeDirectory){D9(f);let s=n($.root);if(!x9(s,f))throw new C("invalid_hands_workspace","Private worker state must not overlap the granted workspace.")}if($.headless&&$.runtimeDirectory&&(!$.deviceIdentity||!Y.environment_binding))throw new C("environment_unavailable","Headless Hands requires a server-bound private environment.");if(T="runtime_root",b?.prepareRoot)L9(f,{recursive:!0,mode:457}),w9(f,457);T="temporary_directory";let A=n(W7(o(f,"reason-hands-session-")));k=A,w9(A,b?.sessionMode??448);let g=o(A,"hands-config.json"),c=o(A,"hands-ready.json"),u=Y7(),a=Y.target_fence_id;T="granted_root";let w=n($.root);T="workspace_layout";let y=Y[p]===B0&&Y.workspace_path!==void 0&&Y.workspace_worktree?await b7(w,Y.workspace_path,Y.workspace_worktree):void 0,{workRoot:d,repoPath:l,jobEnvPath:G0,workspacePoolPath:N0,managedWorkspace:F0,workspace:U0,cloudSessionRoot:y0}=m7({grantedRoot:w,personalWorkspace:Y.personal_workspace===!0,runId:$.runId,workspaceId:Y.workspace_id,legacyWorkspaceId:Y.legacy_workspace_id,workspaceBase:Y[i0],workspaceLayout:Y[o0],temporaryDirectory:A,workspaceMode:Y[p],applicationSupportPath:Q.applicationSupportPath,...Y.workspace_path===void 0?{}:{workspacePath:Y.workspace_path},...Y.workspace_worktree?{workspaceWorktree:Y.workspace_worktree}:{},...y?{workspaceWorktreeStart:y}:{},...$.deviceIdentity?{deviceId:$.deviceIdentity.deviceId}:{}}),q0=D7(Y);T="jobs";let r=$.headless&&$.runtimeDirectory?GQ({runtimeDirectory:$.runtimeDirectory,root:w,runId:$.runId}):void 0;m=r?.disposeSocket;let M0=r?zQ(r):null;if(M0)try{Z(JSON.stringify({event:"hands.journal_owner_retired",run_id:$.runId,reason:M0.reason,prior_executor_launch_id:M0.executorLaunchId}))}catch{}if(r&&[d,l].some((s)=>!x9(s,r.journalDirectory)))throw new C("invalid_hands_workspace","A Session can't work in the folder that holds this worker's settings; start it in a project or repository inside it.");let r0=Y.personal_workspace?d.slice(d.lastIndexOf("/")+1):void 0;if(r0&&r0!==Y.workspace_id)throw new C("invalid_hands_workspace","Personal session identity does not match its Device grant.");T="browser_socket";let W0=Y.cloud_browser?O7(Y.sandbox_os,r0):o(r?V0(r.socketPath):A,"repl.sock");T="relay_url";let j0=X4(new URL(Y.relay_url).hostname),h0=q0==="ara_device_wss"&&!j0?(Q.loadProxy??b8)()?.url:void 0,Y0;T="environment_owner";let X0=$.headless&&$.deviceIdentity&&Y.environment_binding?wZ(A,{runId:$.runId,...$.deviceIdentity,binding:Y.environment_binding,expiresAtMs:Date.parse(Y.expires_at),identity:()=>Y0?.()??null}):void 0;T="job_environment";let N9=!X0&&U0.kind==="managed"&&F0?o(d,"job.env"):null;if(N9)try{H8(N9,"",{mode:384,flag:"wx"})}catch(s){if(!(s instanceof Error&&("code"in s)&&s.code==="EEXIST"))throw s}let L8={url:Y.relay_url,transport:q0,...h0===void 0?{}:{proxyUrl:h0},...$.localGithubConfinement?{localGithubConfinement:!0}:{},...Y[a0]&&X0?{gitCredentialEnvironment:!0}:{},workerVersion:B9,protocolVersion:W9,workerArtifactSha256:K0,workerEntrypoint:n0,targetGeneration:Y.target_generation,fenceId:a,workRoot:d,workspaceAliasPath:d,jobEnvPath:G0,...X0?{environmentSnapshotPath:X0.path,...$.hostExecution?{executionEnvironment:SQ()}:{},environmentExpectedBinding:{runId:$.runId,...$.deviceIdentity,binding:Y.environment_binding}}:N9?{jobEnvSourcePath:N9,workspacePoolPath:V0(d)}:F0?{}:{jobEnvSourcePath:V4(d)},repoPath:l,replSocketPath:W0,...Y.cloud_browser?{browserRunId:$.runId}:{},readyPath:c,launchId:u,expiresAtMs:Date.parse(Y.expires_at),bashTimeoutMs:300000,replTimeoutMs:120000,...r?{managedJobs:{journalDirectory:r.journalDirectory,scopeId:r.scopeId},jobControlSocketPath:r.socketPath}:{},...r&&F?{jobsUser:{...F,...K!==null?{modelGid:K}:{}}}:{},...$.managedPty&&r&&X0?{managedPty:{version:1,...$.managedPty.startupVerified===!0?{persistent:!0}:{},...process.platform==="darwin"?{shell:wQ()}:{}}}:{},...W&&!M?{allowedTools:["bash","read","write","edit"]}:B?{allowedTools:j==="bash"?["bash"]:["bash","repl"]}:{}};if(X0||F0&&!N9)H8(G0,"",{mode:384});else g7(d,G0);T="config_write",H8(g,JSON.stringify(L8),{mode:384}),T=null;let v0={session_id:Y.session_id,environment_id:Y.environment_id,hands_protocol_version:W9,hands_worker_version:B9,hands_worker_artifact_sha256:K0,hands_worker_entrypoint:n0,target_generation:Y.target_generation,target_fence_id:Y.target_fence_id,executor_launch_id:u},k9=null,L$=!1,N$=!1,M$,Q0=null,j$,C$,f9="failed",q$=null,N8=Promise.resolve(),T$=null,M8=async(s,Z0)=>{try{await U(s,Z0)}catch{}};try{J("event_started");let s,Z0=(async()=>{await $.emitEvent("hands.started",{...v0,policy_mode:"full_access",policy_version:1,path_source:D.source}),s=Date.now()})();Z0.catch(()=>{return}),J("worker_setup");let g9=Y.browser_egress?{mode:"enforce",allowedDomains:Y.browser_egress.allowed_domains}:{mode:"off"};if(j&&j!=="bash")k9=await(Q.startNodeRepl??cZ)({socketPath:W0,workRoot:d});else if(!B&&!Y.cloud_browser&&M)k9=await(Q.startRepl??MZ)({socketPath:W0,browserExecutablePath:M,workspaceRoot:l,...$.managedBrowser?{managedBrowser:$.managedBrowser}:{},...$.desktopRecording?{recording:$.desktopRecording}:{},networkPolicy:g9,onEgressDenied:(h)=>{let T0=TZ(h.host);Z(JSON.stringify({event:"sandbox.repl_egress_denied",destination_id:T0,reason:h.reason,run_id:$.runId})),N8=N8.then(()=>U("hands.browser_egress_denied",{destination_id:T0,reason:h.reason})).catch((U4)=>{T$??=U4})}}).catch((h)=>{if(!W||$.signal.aborted||z()>=Date.parse(Y.expires_at)||!p7(h,W0))throw h;return Object.assign(L8,{allowedTools:["bash","read","write","edit"]}),H8(g,JSON.stringify(L8),{mode:384}),N$=!0,null});let O$=y7({configPath:g,root:l,grantedRoot:w,workRoot:d,workspacePoolPath:N0,temporaryDirectory:A,path:D.path,executablePath:Q.executablePath,sourceEntrypoint:Q.sourceEntrypoint}),j8=Date.now(),C8,D$,q8=Q.takePrespawnedWorker?.(O$)??null;if(M$=Q.takePrespawnedWorker?q8!==null:void 0,Q0=q8??(Q.spawnWorker??((h)=>G7(h.command,h.args,h.options)))(O$),!q8)Q.adoptSpawnedWorker?.(Q0);Q0.stderr?.on("data",h7(u,(h)=>{if(h.event==="hands.worker.connecting")C8??=h.timestampMs;else if(h.event==="hands.worker.open")D$??=h.timestampMs;Z(JSON.stringify({...h,run_id:$.runId}))}));let _$=!1;Q0.on("error",()=>{_$=!0}),Q0.once("exit",(h,T0)=>{try{Z(JSON.stringify({event:"hands.worker.exited",run_id:$.runId,launchId:u,exit_code:h,exit_signal:T0}))}catch{}}),E=Q0,J("worker_ready_wait");let M9=await v7({path:c,launchId:u,fenceId:a,targetGeneration:Y.target_generation,child:Q0,spawnFailed:()=>_$,signal:$.signal,timeoutMs:Q.readyTimeoutMs??M7,now:z}),F4=Date.now();if(Y0=()=>{if(!Q0||Q0.exitCode!==null||Q0.signalCode!==null)return null;let h=Y8(c,M9);return h?{generation:h.targetGeneration,fenceId:h.fenceId}:null},r){let h={root:w,runId:$.runId,operationId:$.operationId,scopeId:r.scopeId,socketPath:r.socketPath,generation:M9.targetGeneration,fenceId:M9.fenceId,executorLaunchId:u,expiresAtMs:Date.parse(Y.expires_at),readIdentity:Y0,workspace:U0,localGithubConfinement:$.localGithubConfinement===!0};if(X0)h.environment=X0;if($.claimOwner&&$.deviceIdentity&&$.claimOwner.device_id===$.deviceIdentity.deviceId){let T0=[$.deviceIdentity.apiOrigin,Y.relay_url];if(h0)T0.push(h0);h.previewAuthority={owner:Object.freeze({...$.claimOwner}),rootId:$.deviceIdentity.rootId,relayOrigin:new URL(Y.relay_url).origin,deniedPorts:v$(T0)}}C$=KQ(h)}if(await new Promise((h)=>{setImmediate(h)}),y0)Y4(d);let m9;if(G&&X0){try{let h=X0.install(G);m9={snapshot_id:h.snapshot_id,installed_revision:h.installed_revision}}catch{}try{Z(JSON.stringify({event:"hands.environment_at_claim",run_id:$.runId,installed:m9!==void 0}))}catch{}}G=void 0,J("event_ready");let A$=H(Z0);A$.catch(()=>{return});let x$=Date.now();L$=!0,await U("hands.ready",{...v0,expiry_diagnostic:V,startup_stages:{version:1,browser_resolution_ms:H0(X.get("browser_resolution"),X.get("path_resolution")),path_resolution_ms:H0(X.get("path_resolution"),X.get("workspace_setup")),workspace_setup_ms:H0(X.get("workspace_setup"),X.get("event_started")),repl_setup_ms:H0(X.get("worker_setup"),j8),worker_boot_ms:H0(j8,C8),worker_dial_ms:H0(C8,D$),worker_ready_ms:H0(j8,F4),started_event_ms:H0(X.get("event_started"),s),started_join_wait_ms:H0(X.get("event_ready"),x$),total_ms:H0(X.get("entered"),x$)},...l7($.claimedAtMs,X.get("entered"),M$),...$.managedPty?.startupVerified===!0?{managed_pty:{version:1,execution_mode:"host",descendant_cleanup_verified:!0}}:{},policy_mode:"full_access",policy_version:1,path_source:D.source,connection_generation:M9.generation,...m9?{environment_installed:m9}:{},...W&&!k9?{browser_state:"unavailable",browser_reason_code:N$?"setup_failed":"not_resolved"}:{viewport_width:1440,viewport_height:900}}),await A$,J("ready"),j$=yZ({path:c,initial:M9,signal:$.signal,isAlive:()=>Q0!==null&&Q0.exitCode===null&&Q0.signalCode===null&&z()<Date.parse(Y.expires_at),publish:(h,T0)=>$.emitEvent("hands.reconnected",{...v0,target_generation:h.targetGeneration,target_fence_id:h.fenceId,connection_generation:h.generation},T0),failed:()=>Z(JSON.stringify({event:"hands.worker.generation_proof_failed",run_id:$.runId,executor_launch_id:u}))});let P$=await d7({child:Q0,signal:$.signal,expiresAt:Date.parse(Y.expires_at),now:z});if(P$==="cancelled"){let h=$.signal.reason instanceof C?$.signal.reason.code:"cancelled";throw f9=h,new C(h,"Reason Hands was cancelled.")}if(P$==="exited")throw new C("hands_worker_exited","Reason Hands exited unexpectedly.");return f9="expired",{...v0,policy_mode:"full_access",policy_version:1,ended:"expired"}}catch(s){q$=s;let Z0=s instanceof C?s.code:"hands_failed",g9=Z0==="cancelled"||["run_finished","run_cancelled","driver_handoff","driver_stopped"].includes(Z0);if(f9=g9?Z0:"failed",!g9)await M8("hands.failed",{...v0,reason_code:Z0});throw s}finally{j$?.stop(),C$?.();let s=Q0?await c7(Q0,Q.stopTimeoutMs??j7):null,Z0=!1;await $.desktopRecording?.close();try{await k9?.stop()}catch{Z0=!0}if(await N8,(s==="stopped"||s==="already_exited"&&!L$)&&!Z0)await M8("hands.stopped",{...v0,reason_code:f9});else if(s!==null||Z0){if(await M8("hands.failed",{...v0,reason_code:s==="forced"?"hands_stop_forced":"hands_stop_unconfirmed"}),q$===null||Z0)throw new C("hands_stop_unconfirmed","Reason Hands resource cleanup could not be proven.")}if(T$!==null)throw new C("hands_egress_audit_failed","Reason Hands could not persist a browser egress denial receipt.")}}catch(N){let M=jZ(T,N);if(M)try{Z(JSON.stringify({event:"sandbox.hands_workspace_failed",...M}))}catch{}throw N}finally{try{if(!E||E.exitCode!==null||E.signalCode!==null)m?.();if(k!==null&&(!E||E.exitCode!==null||E.signalCode!==null))B7(k,{recursive:!0,force:!0})}finally{P?.(),R()}}}
+export{v as ga,w$ as ha,b$ as ia,x4 as ja,m$ as ka,h$ as la,v$ as ma,C2 as na,GQ as oa,k2 as pa,f2 as qa,g2 as ra,m2 as sa,y2 as ta,h2 as ua,HQ as va,v2 as wa,d2 as xa,p as ya,B0 as za,wX as Aa,bX as Ba,oX as Ca,aX as Da,jQ as Ea,s9 as Fa,D9 as Ga,_9 as Ha,PQ as Ia,wZ as Ja,Q5 as Ka,IQ as La,SQ as Ma,wQ as Na,P5 as Oa,I5 as Pa,J0 as Qa,R5 as Ra,E5 as Sa,S5 as Ta,v5 as Ua,t3 as Va,c5 as Wa,x9 as Xa,w0 as Ya,d5 as Za,Y9 as _a,Q1 as $a,Z1 as ab,$Z as bb,e5 as cb,P9 as db,s1 as eb,z$ as fb,uZ as gb,iZ as hb,W$ as ib,T7 as jb,wY as kb,bY as lb,J4 as mb,x7 as nb,Y4 as ob,G4 as pb,y7 as qb,kY as rb,fY as sb};