@reason-machines/cli-linux-arm64-musl 0.2.298 → 0.2.300

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. package/bin/ara +2 -2
  2. package/bin/vm-hands/{connect-cli-p95fxdgr.js → connect-cli-112t8nba.js} +1 -1
  3. package/bin/vm-hands/{local-automation-s5zecph1.js → local-automation-0km8gw3g.js} +1 -1
  4. package/bin/vm-hands/{local-capabilities-6db70n7r.js → local-capabilities-ekay0tz7.js} +1 -1
  5. package/bin/vm-hands/{local-display-session-kgbmkyr3.js → local-display-session-qq4j2sjd.js} +1 -1
  6. package/bin/vm-hands/{permissions-5hds6y15.js → permissions-dyb6jxrf.js} +1 -1
  7. package/bin/vm-hands/{status-ztcff0pg.js → status-k08x0y1r.js} +2 -2
  8. package/bin/vm-hands/{version-rq835sza.js → version-32dd10vh.js} +1 -1
  9. package/bin/vm-hands/{vm-hands-entry-lite-kmev17ew.js → vm-hands-entry-lite-2tvtx2e5.js} +1 -1
  10. package/bin/vm-hands/{vm-hands-entry-lite-5k7y54yr.js → vm-hands-entry-lite-57j0ypf9.js} +1 -1
  11. package/bin/vm-hands/{vm-hands-entry-lite-whwbnf1f.js → vm-hands-entry-lite-7998azms.js} +1 -1
  12. package/bin/vm-hands/{vm-hands-entry-lite-1m2stzzt.js → vm-hands-entry-lite-mt4ef3jp.js} +1 -1
  13. package/bin/vm-hands/{vm-hands-entry-lite-s8esw207.js → vm-hands-entry-lite-sr71rkqf.js} +1 -1
  14. package/bin/vm-hands/{vm-hands-entry-lite-8fyehwem.js → vm-hands-entry-lite-vzy4pdg2.js} +1 -1
  15. package/bin/vm-hands/{vm-hands-entry-lite-263wm7x4.js → vm-hands-entry-lite-w0m3nmqy.js} +2 -2
  16. package/bin/vm-hands/{vm-hands-entry-lite-by1q0rtp.js → vm-hands-entry-lite-wfk7z36h.js} +90 -90
  17. package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
  18. package/bin/vm-hands/{vm-hands-executor-2k6g372d.js → vm-hands-executor-tnjbydbw.js} +1 -1
  19. package/bin/vm-hands/{vm-hands-op-runner-1za5t3h1.js → vm-hands-op-runner-cqax87f6.js} +1 -1
  20. package/bin/vm-hands/{vm-hands-runtime-szb9kzez.js → vm-hands-runtime-5vjhqmc1.js} +2 -2
  21. package/package.json +1 -1
package/bin/vm-hands/{vm-hands-entry-lite-by1q0rtp.js → vm-hands-entry-lite-wfk7z36h.js} RENAMED
@@ -1,32 +1,32 @@
1
1
  // @bun
2
- import{t as u0}from"./vm-hands-entry-lite-bswnp5ve.js";import{A as Q5,B as X5,C as z7,D as O7,E as v3,F as c5,G as B5,H as _0,I as l$,J as p$,K as E0,L as J2,M as s5,N as i0,O as N6,P as Z3,Q as e5,U as $6,ba as C7,ca as I7,da as P7,ea as x7,fa as u3,y as g6,z as u6}from"./vm-hands-entry-lite-8fyehwem.js";import{Aa as Y5,Ba as G5,Ca as _7,Da as F7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as T5,Ka as L7,La as W$,Oa as V4,Pa as H4,Qa as OJ,Ra as AJ,Sa as RJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as D7,db as V6,fb as y8,ha as a7,ib as u2,ka as L5,kb as p5,la as D5,lb as T3,nb as k5,oa as M5,qa as I5,rb as j7,sb as N3,ta as P5,ya as w5,za as b5}from"./vm-hands-entry-lite-whwbnf1f.js";import{Ab as x5,Bb as E5,Ib as S5}from"./vm-hands-entry-lite-rrk5g62b.js";import{Nb as K5}from"./vm-hands-entry-lite-ya1a2eep.js";import{Ub as l5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Ac as G4,Ec as i5,Hc as A7,Kc as d6,Lc as l6,mc as i1,nc as Y1,oc as _1,pc as L$,qc as BJ,rc as IJ,sc as PJ,tc as D$,uc as xJ,vc as e3,wc as EJ,xc as Y4,yc as F1,zc as P8}from"./vm-hands-entry-lite-kmev17ew.js";import{Bd as Z5,Hd as $$,Rd as F2,Vc as b2,Zc as M7,_c as T7}from"./vm-hands-entry-lite-8st97h7b.js";import{ae as B}from"./vm-hands-entry-lite-q6fshf3h.js";import{ie as CJ,je as o2,me as R7,pe as n$,re as iJ,se as nJ,xe as o5}from"./vm-hands-entry-lite-1m2stzzt.js";import{$e as h1,Be as b0,Ce as k$,Ee as P0,Fe as j4,He as o0,Ie as z0,Je as b9,Ke as jJ,Le as zJ,Me as E2,Ne as q2,Oe as f3,Pe as C8,Qe as I8,Re as Y$,Se as v$,Te as Y0,Ue as T2,Ve as w7,We as b7,Xe as e1,Ye as R4,_e as Q3,af as m0,bf as y$,cf as X3,ff as m1}from"./vm-hands-entry-lite-pf1ft65e.js";import{jf as C5}from"./vm-hands-entry-lite-q2pb31vh.js";import{ig as _J,lg as a5,mg as h3,og as V5}from"./vm-hands-entry-lite-263wm7x4.js";import{Xg as Z2,Yg as d5}from"./vm-hands-entry-lite-7k65s010.js";import{_g as V0,ah as G7}from"./vm-hands-entry-lite-em388nee.js";import{yh as r}from"./vm-hands-entry-lite-5k7y54yr.js";import{Fh as W7}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as v0}from"./vm-hands-entry-lite-xsq25kmd.js";import{spawn as SJ,spawnSync as pK}from"child_process";import{closeSync as wJ,mkdirSync as cK,openSync as bJ,readdirSync as sK,realpathSync as G1,rmSync as z$}from"fs";import{hostname as aK}from"os";import{dirname as $9,join as F0,resolve as iK}from"path";var tJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function U9($){let J=typeof $==="string"?tJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as YZ,randomBytes as z9}from"crypto";import{createInterface as GZ}from"readline";import{randomBytes as oJ}from"crypto";import{chmodSync as M9,existsSync as T9,lstatSync as eJ,mkdirSync as $Z,readFileSync as _9,renameSync as JZ,unlinkSync as F9,writeFileSync as W9}from"fs";import{homedir as ZZ}from"os";import{dirname as QZ,join as q9}from"path";function e0($=process.env,J=ZZ()){let Z=$.XDG_CONFIG_HOME?.trim()||q9(J,".config"),X=P0({env:$})==="staging"?["staging"]:[];return q9(q2(Z,...X),"credentials.json")}function L9($,J=e0()){return $Z(QZ(J),{recursive:!0,mode:448}),W9(J,`${JSON.stringify($,null,2)}
3
- `,{mode:384}),M9(J,384),J}function P$($=e0()){if(!T9($))return null;try{let J=_9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=o0(Q);if(X!==Q)XZ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function XZ($,J,Z){let Q=`${$}.${process.pid}.${oJ(6).toString("hex")}.tmp`;try{let X=eJ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(W9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
4
- `,{mode:384,flag:"wx"}),M9(Q,384),_9($,"utf8")!==J)throw Error("credentials_changed");JZ(Q,$)}catch{try{F9(Q)}catch{}}}function D9($=e0()){if(!T9($))return!1;return F9($),!0}var j9=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var SV=j9.filter(($)=>$!=="network:read"&&$!=="network:write");class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function A9(){let $=z9(48).toString("base64url"),J=YZ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:z9(32).toString("base64url")}}function BZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function KZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw BZ(Y,`OAuth token request failed (${X.status})`);return Y}var VZ=1e4;async function HZ($,J={}){let Z=J.fetchImpl??fetch,Q=await KZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(VZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return L9(X,J.path??e0()),X}var M2=new Map;function O9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function b1($={}){let J=$.path??e0(),Z=P$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=M2.get(Y);if(G)return O9(G,$.signal);let V;return V=HZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=P$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return b1({fetchImpl:$.fetchImpl,path:J});return D9(J),null}).finally(()=>{if(M2.get(Y)===V)M2.delete(Y)}),M2.set(Y,V),O9(V,$.signal)}function R9($,J){return new Promise((Z)=>{let Q=GZ({input:$}),X=!1,Y=(V)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(V)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(V)=>Y(V)),Q.once("close",()=>Y(null))})}var NZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),UZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function qZ($){let J=UZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var MZ=["minimal","low","medium","high","xhigh","max"],TZ=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),_Z=B.object({devices:B.array(TZ),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),FZ=B.object({id:B.string().min(1),name:B.string()}),WZ=B.object({items:B.array(FZ)}),LZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),DZ=B.object({items:B.array(LZ).default([])}),jZ=B.enum(["linux","macos"]),C9=B.object({id:B.string().min(1),name:B.string().min(1),platform:jZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),zZ=B.object({machines:B.array(C9)}),OZ=B.object({machine:C9}),AZ=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),RZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),I9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),CZ=I9.extend({organization_id:B.string().min(1)}),fV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var hV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function k1($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var IZ=B.object({error:B.object({type:B.string(),message:B.string()})});function P9($,J,Z){let Q=IZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",V=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(V)&&V>=0?V*1000:void 0)}async function x9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw P9(J.status,Z,J.headers.get("retry-after"));return k1(CZ,Z,"invalid_machine_ticket")}class N1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await b1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw P9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return k1(zZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return k1(OZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return k1(AZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return k1(RZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return k1(I9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=WZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return k1(DZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=_Z.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:MZ.filter((V)=>Q.includes(V))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return U9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=NZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=qZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($,J){let Z=J?.fields.length?`?fields=${encodeURIComponent(J.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${Z}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments`)).items??[]}catch(J){if(J instanceof G0&&(J.status===403||J.status===404))return[];throw J}}async requireSessionAttachments(){let $=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if($.session_attachments!==!0){let J=typeof $.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test($.reason_version)?`Agent ${$.reason_version}`:null,Z=typeof $.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test($.commit_sha)?`server ${$.commit_sha.slice(0,12)}`:null,Q=[J,Z].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${Q?` (${Q})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return j4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function PZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function z4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function E9($,J){let Z=$.env??process.env,Q=z4(Z);if(!Q)return($.getCredentials??b1)({apiOrigin:PZ(Z),signal:J});let X=y1(Z,$.channel??P0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),G=await Y.json().catch(()=>({})),V=i0(G)?G:{};if(!Y.ok){let N=typeof V.detail==="string"?V.detail:typeof V.message==="string"?V.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof V.error==="string"?V.error:"api_key_auth_failed",N)}if(typeof V.org_id!=="string"||!V.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(V.scopes)?V.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:V.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as xZ}from"crypto";import{unlinkSync as EZ}from"fs";import{platform as SZ}from"os";import{join as wZ}from"path";var S9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>wZ($,"api-key.json");function z1($){let J=xZ("sha256").update(`reason-connect-api-key
5
- ${$}`).digest("hex");return new e1(T2(),SZ(),J)}function O4($,J,Z=z1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function l0($,J=z1($)){if(!u(f1($)))return null;let Z=S9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function w9($,J=z1($)){if(!u(f1($)))return;if(S9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}EZ(f1($))}async function A4($,J){let Z;try{Z=await E9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as tZ,renameSync as oZ,rmSync as v1}from"fs";import{join as M0}from"path";import{createHash as bZ}from"crypto";import{realpathSync as kZ,statSync as yZ,unlinkSync as _2}from"fs";import{platform as fZ}from"os";import{join as y0}from"path";function d($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var hZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max($$).optional()});function k9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function C4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=hZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?I4($):new R4(g($))}function W2($,J){T0($,!0),gZ($);let Z=J??I4($),Q=new R4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function I4($){return new e1(T2(),fZ(),mZ($))}function mZ($){let J=P4($);return bZ("sha256").update(`reason-worker
6
- ${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,directory:P4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function y9($){return u(y0(g($),w$))}var vZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function P4($){let J=y0(g($),w$);if(!u(J))return null;let Z=vZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function gZ($){let J=y0(g($),w$);if(!u(J))return;if(P4($))try{let Z=I4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof Y0))throw Z}_2(J)}function U1($){let J=kZ($.workspaceRoot);if(J!==$.workspaceRoot||!yZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&b9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var f9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=d($).control;return u(J)?f9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(d($).control,f9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),w$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var uZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),x4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:uZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),dZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),E4=30000;class $1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function lZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(E4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new $1(X?.error==="device_revoked")}return Q.json()}async function S4($,J,Z,Q){u0();let X=x4.parse(JSON.parse(s(J)));return J1($,X,Z,Q)}async function J1($,J,Z,Q=(Y,G)=>lZ(Y,G,k0($.proxy)),X=performance.now()){let Y=m9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function h9($,J,Z,Q,X=performance.now()){let Y=m9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function m9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=dZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let H=F2(q.first_heartbeat);try{k9($,q.device_id,{...H?{offer:H}:{},enrollmentMs:Math.min($$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as pZ,randomUUID as cZ}from"crypto";import{unlinkSync as sZ}from"fs";import{join as aZ}from"path";var v9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),iZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function w4($){return iZ.parse($)}var nZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function O1($){return e0(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function A1($,J=O1($)){if(!u(J))return null;let Z=nZ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await b1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function g9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=R1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function u9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=R1($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await h9($,G.direct(J.orgId),Q,(N,q)=>V({approval:G.request,code_verifier:q,registration:N}).catch((H)=>{throw rZ(H)}),Y);if(K)return K}return J1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function rZ($){if(!($ instanceof G0))return $;if($.status===409)return new $1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new $1(!1);return $}var b$=($)=>aZ(g($),"enrollment-install.json");function d9($){if(u(b$($)))sZ(b$($))}function R1($,{stored:J=!0}={}){u0();let Z=b$($),Q=J&&u(Z)?v9.parse(JSON.parse(s(Z))):{version:1,install_id:cZ(),fingerprint_key:pZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((H)=>{let U=m1([H],X,Y)[0];if(U.path!==H)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=A9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((H)=>H.path_fingerprint)].map((H)=>({path_fingerprint:H,permissions:X,execution_mode:$.executionMode}))},q=(H)=>({version:1,organization_id:H,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(H){e(g(H),!0),c(b$(H),Q)},complete(H,U){let M=w4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(H),enrollment_ticket:M.enrollment_ticket}},direct:q}}function l9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=v9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,s9=600000,a9=15000,p9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,q1=($)=>M0(g($),"workspaces"),i9="account.json",b4=($)=>u(M0($,i9));function h0($){let J;try{J=tZ(q1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=M0(q1($),Z),X=M0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:b4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:M0(q1($),Z)});return e(Q.stateDirectory,!0),c(M0(Q.stateDirectory,i9),{version:1}),{config:Q,configPath:M0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var k4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function c9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of k4)v1(M0(g(J),Y),{force:!0});for(let Y of k4){let G=M0(g($),Y);if(u(G))oZ(G,M0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function y4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(h4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(H)=>Number(Date.parse(H.worker?.expiresAt??"")>X+60000),V=h0($).flatMap((H)=>{if(!H.account||!H.config)return[];try{if($0(H.config).revoked)return[];let U=t(H.config);return U&&U.orgId.toLowerCase()===H.organizationId&&(!Q||Y(U))?[{...H,config:H.config,state:U}]:[]}catch{return[]}}).sort((H,U)=>Number(U.organizationId===J)-Number(H.organizationId===J)||Y(U.state)-Y(H.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==V.organizationId){let H=j2($,N);c9($,H.config),c(H.configPath,H.config)}else if(u(g($))){try{if(u(d($).state))f0($)}catch{}for(let H of k4)v1(M0(g($),H),{force:!0})}y4($);let q=J0.parse({...V.config,stateDirectory:$.stateDirectory});return c9(V.config,q),c(M0($.stateDirectory,"worker.json"),q),v1(V.directory,{recursive:!0,force:!0}),q}var f4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==M0(q1($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=T0(V),N=h1(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},h4=($)=>M0(q1($),"listed.json");function n9($){try{let J=JSON.parse(s(h4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function r9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=n9($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:q})=>{let H=!1,U=null,M=!1;try{H=N?$0(N).revoked:!1,U=N&&!H?t(N):null,M=J&&!!U&&y$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:H?"removed":M?"connected":"not_running",blocked:!q&&!H&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function t9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=n9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...R}=J,x=Z.roots.slice(1).map((C)=>C.path);return J0.parse({...R,...x.length?{folders:x}:{},stateDirectory:M0(q1(J),W)})},H=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let R=new AbortController,x=()=>R.abort();if(X.addEventListener("abort",x,{once:!0}),X.aborted)R.abort();let C={...W,controller:R,claims:0,done:Promise.resolve(),account:L};C.done=$.serve(W,R.signal,(I)=>{C.claims=I}).then(()=>{return},(I)=>{if(L&&I instanceof _0&&I.status===401&&p9.has(I.code)){try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer (${I.code}); run \`reason connect\` signed in as that account to connect it again
7
- `)}else if(I instanceof _0&&I.status===401&&p9.has(I.code)){try{f0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
2
+ import{t as u0}from"./vm-hands-entry-lite-bswnp5ve.js";import{A as X5,B as Y5,C as O7,D as A7,E as v3,F as s5,G as K5,H as _0,I as l$,J as p$,K as E0,L as J2,M as a5,N as n0,O as U6,P as Z3,Q as $6,U as J6,ba as P7,ca as I7,da as x7,ea as E7,fa as u3,y as u6,z as d6}from"./vm-hands-entry-lite-vzy4pdg2.js";import{Aa as G5,Ba as B5,Ca as F7,Da as W7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as _5,Ka as D7,La as W$,Oa as V4,Pa as H4,Qa as AJ,Ra as RJ,Sa as CJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as j7,db as H6,fb as f8,ha as i7,ib as u2,ka as D5,kb as c5,la as j5,lb as T3,nb as y5,oa as T5,qa as I5,rb as z7,sb as N3,ta as x5,ya as b5,za as k5}from"./vm-hands-entry-lite-7998azms.js";import{Ab as E5,Bb as S5,Ib as w5}from"./vm-hands-entry-lite-rrk5g62b.js";import{Nb as V5}from"./vm-hands-entry-lite-ya1a2eep.js";import{Ub as p5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Ac as G4,Ec as n5,Hc as R7,Kc as l6,Lc as p6,mc as i1,nc as G1,oc as F1,pc as L$,qc as KJ,rc as IJ,sc as xJ,tc as D$,uc as EJ,vc as e3,wc as SJ,xc as Y4,yc as W1,zc as x8}from"./vm-hands-entry-lite-2tvtx2e5.js";import{Bd as Q5,Hd as $$,Rd as F2,Vc as b2,Zc as T7,_c as _7}from"./vm-hands-entry-lite-8st97h7b.js";import{ae as B}from"./vm-hands-entry-lite-q6fshf3h.js";import{ie as PJ,je as o2,me as C7,pe as n$,re as nJ,se as rJ,xe as e5}from"./vm-hands-entry-lite-mt4ef3jp.js";import{$e as h1,Be as b0,Ce as k$,Ee as I0,Fe as j4,He as e0,Ie as z0,Je as k9,Ke as zJ,Le as OJ,Me as E2,Ne as q2,Oe as f3,Pe as P8,Qe as I8,Re as Y$,Se as v$,Te as Y0,Ue as T2,Ve as b7,We as k7,Xe as e1,Ye as R4,_e as Q3,af as m0,bf as y$,cf as X3,ff as m1}from"./vm-hands-entry-lite-pf1ft65e.js";import{jf as P5}from"./vm-hands-entry-lite-q2pb31vh.js";import{ig as FJ,lg as i5,mg as h3,og as H5}from"./vm-hands-entry-lite-w0m3nmqy.js";import{Xg as Z2,Yg as l5}from"./vm-hands-entry-lite-7k65s010.js";import{_g as V0,ah as B7}from"./vm-hands-entry-lite-em388nee.js";import{yh as r}from"./vm-hands-entry-lite-57j0ypf9.js";import{Fh as L7}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as v0}from"./vm-hands-entry-lite-xsq25kmd.js";import{spawn as wJ,spawnSync as tK}from"child_process";import{closeSync as bJ,mkdirSync as oK,openSync as kJ,readdirSync as eK,realpathSync as B1,rmSync as z$}from"fs";import{hostname as $V}from"os";import{dirname as $9,join as F0,resolve as JV}from"path";var oJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function U9($){let J=typeof $==="string"?oJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as GZ,randomBytes as z9}from"crypto";import{createInterface as BZ}from"readline";import{randomBytes as eJ}from"crypto";import{chmodSync as M9,existsSync as T9,lstatSync as $Z,mkdirSync as JZ,readFileSync as _9,renameSync as ZZ,unlinkSync as F9,writeFileSync as W9}from"fs";import{homedir as QZ}from"os";import{dirname as XZ,join as q9}from"path";function $1($=process.env,J=QZ()){let Z=$.XDG_CONFIG_HOME?.trim()||q9(J,".config"),X=I0({env:$})==="staging"?["staging"]:[];return q9(q2(Z,...X),"credentials.json")}function L9($,J=$1()){return JZ(XZ(J),{recursive:!0,mode:448}),W9(J,`${JSON.stringify($,null,2)}
3
+ `,{mode:384}),M9(J,384),J}function I$($=$1()){if(!T9($))return null;try{let J=_9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=e0(Q);if(X!==Q)YZ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function YZ($,J,Z){let Q=`${$}.${process.pid}.${eJ(6).toString("hex")}.tmp`;try{let X=$Z($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(W9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
4
+ `,{mode:384,flag:"wx"}),M9(Q,384),_9($,"utf8")!==J)throw Error("credentials_changed");ZZ(Q,$)}catch{try{F9(Q)}catch{}}}function D9($=$1()){if(!T9($))return!1;return F9($),!0}var j9=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var mV=j9.filter(($)=>$!=="network:read"&&$!=="network:write");class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function A9(){let $=z9(48).toString("base64url"),J=GZ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:z9(32).toString("base64url")}}function KZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function VZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw KZ(Y,`OAuth token request failed (${X.status})`);return Y}var HZ=1e4;async function NZ($,J={}){let Z=J.fetchImpl??fetch,Q=await VZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(HZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return L9(X,J.path??$1()),X}var M2=new Map;function O9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function k1($={}){let J=$.path??$1(),Z=I$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=M2.get(Y);if(G)return O9(G,$.signal);let V;return V=NZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=I$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return k1({fetchImpl:$.fetchImpl,path:J});return D9(J),null}).finally(()=>{if(M2.get(Y)===V)M2.delete(Y)}),M2.set(Y,V),O9(V,$.signal)}function R9($,J){return new Promise((Z)=>{let Q=BZ({input:$}),X=!1,Y=(V)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(V)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(V)=>Y(V)),Q.once("close",()=>Y(null))})}var UZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),qZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function MZ($){let J=qZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var TZ=["minimal","low","medium","high","xhigh","max"],_Z=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),FZ=B.object({devices:B.array(_Z),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),WZ=B.object({id:B.string().min(1),name:B.string()}),LZ=B.object({items:B.array(WZ)}),DZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),jZ=B.object({items:B.array(DZ).default([])}),zZ=B.object({id:B.string().min(1),kind:B.string(),enabled:B.boolean(),schedule:B.object({expression:B.string().nullish(),every_seconds:B.number().nullish(),next_run_at:B.string().nullish()}).nullish(),github:B.object({event:B.string().nullish(),action:B.string().nullish(),repo:B.string().nullish()}).nullish(),last_fired_at:B.string().nullish()}),OZ=B.object({id:B.string().min(1),name:B.string().nullish(),instructions:B.string().nullish(),enabled:B.boolean(),triggers:B.array(zZ).default([])}),AZ=B.object({items:B.array(OZ).default([]),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),RZ=B.object({id:B.string().min(1),slug:B.string().nullish(),name:B.string(),description:B.string().nullish(),transport:B.string().nullish(),url:B.string().nullish(),enabled:B.boolean()}),CZ=B.object({items:B.array(RZ).default([])}),PZ=B.object({status:B.string(),summary:B.string().nullish(),category:B.string().nullish(),outcome:B.string().nullish(),message_count:B.number().nullish(),pr_url:B.string().nullish(),cost_usd:B.number().nullish(),generated_at:B.string().nullish()}),C9=B.object({tags:B.array(B.string()).default([])}),IZ=B.enum(["linux","macos"]),P9=B.object({id:B.string().min(1),name:B.string().min(1),platform:IZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),xZ=B.object({machines:B.array(P9)}),EZ=B.object({machine:P9}),SZ=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),wZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),I9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),bZ=I9.extend({organization_id:B.string().min(1)}),lV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var pV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function l0($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var kZ=B.object({error:B.object({type:B.string(),message:B.string()})});function x9($,J,Z){let Q=kZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",V=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(V)&&V>=0?V*1000:void 0)}async function E9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw x9(J.status,Z,J.headers.get("retry-after"));return l0(bZ,Z,"invalid_machine_ticket")}class U1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await k1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw x9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return l0(xZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return l0(EZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return l0(SZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return l0(wZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return l0(I9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=LZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return l0(jZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=FZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:TZ.filter((V)=>Q.includes(V))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return U9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=UZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=MZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($,J){let Z=J?.fields.length?`?fields=${encodeURIComponent(J.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${Z}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($,J){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments${J?`?view=${J}`:""}`)).items??[]}catch(Z){if(Z instanceof G0&&(Z.status===403||Z.status===404))return[];throw Z}}async requireSessionAttachments(){let $=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if($.session_attachments!==!0){let J=typeof $.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test($.reason_version)?`Agent ${$.reason_version}`:null,Z=typeof $.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test($.commit_sha)?`server ${$.commit_sha.slice(0,12)}`:null,Q=[J,Z].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${Q?` (${Q})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}sessionPath($,J=""){return`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${J}`}async archiveSession($){await this.request(this.sessionPath($,"/archive"),{method:"POST",body:{}})}async unarchiveSession($){await this.request(this.sessionPath($,"/unarchive"),{method:"POST",body:{}})}async deleteSession($){await this.request(this.sessionPath($),{method:"DELETE"})}async listSessionTags($){return l0(C9,await this.request(this.sessionPath($,"/tags")),"invalid_session_tags").tags}async appendSessionTags($,J){let Z=await this.request(this.sessionPath($,"/tags"),{method:"POST",body:{tags:J}});return l0(C9,Z,"invalid_session_tags").tags}async sessionInsight($,J=!1){let Z=await this.request(this.sessionPath($,J?"/insights/generate":"/insights"),J?{method:"POST",body:{}}:{});return l0(PZ,Z,"invalid_session_insight")}async listAutomations(){let $=[],J=null;for(let Z=0;Z<20;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations?first=100${J?`&after=${encodeURIComponent(J)}`:""}`),X=l0(AZ,Q,"invalid_automation_list");if($.push(...X.items),J=X.has_next_page?X.end_cursor??null:null,!J)break}return $}async setAutomationEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"PATCH",body:{enabled:J}})}async deleteAutomation($){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"DELETE"})}async listMcpServers(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/mcp-servers`);return l0(CZ,$,"invalid_mcp_server_list").items}async setSkillEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills/${encodeURIComponent($)}`,{method:"PUT",body:{is_enabled:J}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return j4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function yZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function z4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function S9($,J){let Z=$.env??process.env,Q=z4(Z);if(!Q)return($.getCredentials??k1)({apiOrigin:yZ(Z),signal:J});let X=y1(Z,$.channel??I0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),G=await Y.json().catch(()=>({})),V=n0(G)?G:{};if(!Y.ok){let N=typeof V.detail==="string"?V.detail:typeof V.message==="string"?V.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof V.error==="string"?V.error:"api_key_auth_failed",N)}if(typeof V.org_id!=="string"||!V.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(V.scopes)?V.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:V.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as fZ}from"crypto";import{unlinkSync as hZ}from"fs";import{platform as mZ}from"os";import{join as vZ}from"path";var w9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>vZ($,"api-key.json");function O1($){let J=fZ("sha256").update(`reason-connect-api-key
5
+ ${$}`).digest("hex");return new e1(T2(),mZ(),J)}function O4($,J,Z=O1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=O1($)){if(!u(f1($)))return null;let Z=w9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function b9($,J=O1($)){if(!u(f1($)))return;if(w9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}hZ(f1($))}async function A4($,J){let Z;try{Z=await S9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as XQ,renameSync as YQ,rmSync as v1}from"fs";import{join as M0}from"path";import{createHash as gZ}from"crypto";import{realpathSync as uZ,statSync as dZ,unlinkSync as _2}from"fs";import{platform as lZ}from"os";import{join as y0}from"path";function d($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var pZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max($$).optional()});function y9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function C4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=pZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?P4($):new R4(g($))}function W2($,J){T0($,!0),aZ($);let Z=J??P4($),Q=new R4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function P4($){return new e1(T2(),lZ(),cZ($))}function cZ($){let J=I4($);return gZ("sha256").update(`reason-worker
6
+ ${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,directory:I4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function f9($){return u(y0(g($),w$))}var sZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function I4($){let J=y0(g($),w$);if(!u(J))return null;let Z=sZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function aZ($){let J=y0(g($),w$);if(!u(J))return;if(I4($))try{let Z=P4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof Y0))throw Z}_2(J)}function q1($){let J=uZ($.workspaceRoot);if(J!==$.workspaceRoot||!dZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&k9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var h9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=d($).control;return u(J)?h9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(d($).control,h9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),w$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var iZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),x4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:iZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),nZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),E4=30000;class J1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function rZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(E4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new J1(X?.error==="device_revoked")}return Q.json()}async function S4($,J,Z,Q){u0();let X=x4.parse(JSON.parse(s(J)));return Z1($,X,Z,Q)}async function Z1($,J,Z,Q=(Y,G)=>rZ(Y,G,k0($.proxy)),X=performance.now()){let Y=v9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function m9($,J,Z,Q,X=performance.now()){let Y=v9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function v9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=nZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let H=F2(q.first_heartbeat);try{y9($,q.device_id,{...H?{offer:H}:{},enrollmentMs:Math.min($$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as tZ,randomUUID as oZ}from"crypto";import{unlinkSync as eZ}from"fs";import{join as $Q}from"path";var g9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),JQ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function w4($){return JQ.parse($)}var ZQ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function A1($){return $1(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function R1($,J=A1($)){if(!u(J))return null;let Z=ZQ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await k1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function u9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=C1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function d9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=C1($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await m9($,G.direct(J.orgId),Q,(N,q)=>V({approval:G.request,code_verifier:q,registration:N}).catch((H)=>{throw QQ(H)}),Y);if(K)return K}return Z1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function QQ($){if(!($ instanceof G0))return $;if($.status===409)return new J1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new J1(!1);return $}var b$=($)=>$Q(g($),"enrollment-install.json");function l9($){if(u(b$($)))eZ(b$($))}function C1($,{stored:J=!0}={}){u0();let Z=b$($),Q=J&&u(Z)?g9.parse(JSON.parse(s(Z))):{version:1,install_id:oZ(),fingerprint_key:tZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((H)=>{let U=m1([H],X,Y)[0];if(U.path!==H)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=A9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((H)=>H.path_fingerprint)].map((H)=>({path_fingerprint:H,permissions:X,execution_mode:$.executionMode}))},q=(H)=>({version:1,organization_id:H,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(H){e(g(H),!0),c(b$(H),Q)},complete(H,U){let M=w4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(H),enrollment_ticket:M.enrollment_ticket}},direct:q}}function p9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=g9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,a9=600000,i9=15000,c9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,M1=($)=>M0(g($),"workspaces"),n9="account.json",b4=($)=>u(M0($,n9));function h0($){let J;try{J=XQ(M1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=M0(M1($),Z),X=M0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:b4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:M0(M1($),Z)});return e(Q.stateDirectory,!0),c(M0(Q.stateDirectory,n9),{version:1}),{config:Q,configPath:M0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var k4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function s9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of k4)v1(M0(g(J),Y),{force:!0});for(let Y of k4){let G=M0(g($),Y);if(u(G))YQ(G,M0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function y4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(h4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(H)=>Number(Date.parse(H.worker?.expiresAt??"")>X+60000),V=h0($).flatMap((H)=>{if(!H.account||!H.config)return[];try{if($0(H.config).revoked)return[];let U=t(H.config);return U&&U.orgId.toLowerCase()===H.organizationId&&(!Q||Y(U))?[{...H,config:H.config,state:U}]:[]}catch{return[]}}).sort((H,U)=>Number(U.organizationId===J)-Number(H.organizationId===J)||Y(U.state)-Y(H.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==V.organizationId){let H=j2($,N);s9($,H.config),c(H.configPath,H.config)}else if(u(g($))){try{if(u(d($).state))f0($)}catch{}for(let H of k4)v1(M0(g($),H),{force:!0})}y4($);let q=J0.parse({...V.config,stateDirectory:$.stateDirectory});return s9(V.config,q),c(M0($.stateDirectory,"worker.json"),q),v1(V.directory,{recursive:!0,force:!0}),q}var f4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==M0(M1($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=T0(V),N=h1(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},h4=($)=>M0(M1($),"listed.json");function r9($){try{let J=JSON.parse(s(h4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function t9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=r9($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:q})=>{let H=!1,U=null,M=!1;try{H=N?$0(N).revoked:!1,U=N&&!H?t(N):null,M=J&&!!U&&y$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:H?"removed":M?"connected":"not_running",blocked:!q&&!H&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function o9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=r9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...R}=J,x=Z.roots.slice(1).map((C)=>C.path);return J0.parse({...R,...x.length?{folders:x}:{},stateDirectory:M0(M1(J),W)})},H=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let R=new AbortController,x=()=>R.abort();if(X.addEventListener("abort",x,{once:!0}),X.aborted)R.abort();let C={...W,controller:R,claims:0,done:Promise.resolve(),account:L};C.done=$.serve(W,R.signal,(P)=>{C.claims=P}).then(()=>{return},(P)=>{if(L&&P instanceof _0&&P.status===401&&c9.has(P.code)){try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer (${P.code}); run \`reason connect\` signed in as that account to connect it again
7
+ `)}else if(P instanceof _0&&P.status===401&&c9.has(P.code)){try{f0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
8
8
  `)}else if(!R.signal.aborted)Y(`Reason worker: workspace ${W.organizationId} stopped (worker_workspace_failed); it starts again on the next check
9
- `)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",x),C.claims=0,G.get(W.organizationId)===C)G.delete(W.organizationId);let I=W.config.stateDirectory;if(L&&!b4(I)&&!u(M0(I,"worker.json")))v1(I,{recursive:!0,force:!0})}),G.set(W.organizationId,C)},M=(W,L)=>{if(!L)return null;try{let R=q(W),x=t(L);if(!x||x.orgId!==W||Date.parse(x.worker?.expiresAt??"")<=Date.now()+60000||L.name!==R.name||L.executionMode!==R.executionMode||!z0(L.apiOrigin,R.apiOrigin)||x.roots.map((C)=>C.path).join(`
9
+ `)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",x),C.claims=0,G.get(W.organizationId)===C)G.delete(W.organizationId);let P=W.config.stateDirectory;if(L&&!b4(P)&&!u(M0(P,"worker.json")))v1(P,{recursive:!0,force:!0})}),G.set(W.organizationId,C)},M=(W,L)=>{if(!L)return null;try{let R=q(W),x=t(L);if(!x||x.orgId!==W||Date.parse(x.worker?.expiresAt??"")<=Date.now()+60000||L.name!==R.name||L.executionMode!==R.executionMode||!z0(L.apiOrigin,R.apiOrigin)||x.roots.map((C)=>C.path).join(`
10
10
  `)!==Z.roots.map((C)=>C.path).join(`
11
- `))return null;return{organizationId:W,config:L,state:x,proofStore:T0(L)}}catch{return null}},T=(W,L)=>{if(!L)return null;try{if($0(L).revoked)return null;let R=t(L);if(!R||R.orgId.toLowerCase()!==W||Date.parse(R.worker?.expiresAt??"")<=Date.now()+60000||L.executionMode!==J.executionMode||!z0(L.apiOrigin,J.apiOrigin))return null;return{organizationId:W,config:L,state:R,proofStore:T0(L)}}catch{return null}},_=(W,L)=>W.deviceId===L.deviceId&&W.devicePublicKey===L.devicePublicKey&&JSON.stringify(W.roots.map((R)=>[R.id,R.path]))===JSON.stringify(L.roots.map((R)=>[R.id,R.path])),D=async(W)=>{for(let[L,R]of W){if(X.aborted)return;let x=G.get(L),C=T(L,R.config);if(x&&C&&_(x.state,C.state))continue;if(x){if(x.claims>0)continue;await H(L)}if(C&&!X.aborted)U(C,!0)}for(let[L,R]of G)if(R.account&&!W.has(L)&&R.claims===0)await H(L)},j=async(W)=>{let L=q(W),R=J0.parse({...L,stateDirectory:J.stateDirectory});if(!u(M0(g(J),"enrollment-install.json")))return null;let x=R1(R),C=await Q.ownerWorkspaceEnrollment(Z,{organization_id:W,install_id:x.request.install_id,code_challenge:x.request.code_challenge},X),I=x.complete(W,C);if(e(g(L),!0),u(d(L).state))f0(L);let h=W2(L);try{let S=await J1(L,I,h,$.enroll);return m0(S,d(L).state,{proofStore:h}),x0(L,{version:1,drained:!1,revoked:!1}),c(M0(L.stateDirectory,"worker.json"),L),{organizationId:W,config:L,state:S,proofStore:h}}catch(S){if(S instanceof $1&&S.deviceRemoved)return x0(L,{version:1,drained:!0,revoked:!0}),c(M0(L.stateDirectory,"worker.json"),L),null;throw S}},z=async()=>{let W=h0(J),L=new Map(W.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await D(L);let R=new Map(W.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),x=(A)=>L.has(A)||G.get(A)?.account===!0||b4(M0(q1(J),A)),C=(A)=>{let b=R.get(A)?.config;try{return b?$0(b).revoked:!1}catch{return!1}};for(let[A,b]of R){if(G.has(A)||C(A)||N.blocked.includes(A))continue;let w=M(A,b.config);if(w&&!X.aborted)U(w)}let I;try{I=await Q.ownerWorkspaces(Z,X)}catch(A){return N={listed:!1,blocked:N.blocked,...N.names?{names:N.names}:{},reason:A instanceof _0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let h=new Map(I.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>D2.test(A)&&A!==Z.orgId.toLowerCase()&&!x(A))),S=[...h.keys()].filter((A)=>R.has(A)?!C(A):!h.get(A)).slice(0,L2),y=[...G.values()].filter((A)=>!A.account&&A.claims>0&&!S.includes(A.organizationId)).length,l=S.filter((A)=>!R.has(A)),k=l.slice(l.length-Math.min(Math.max(0,S.length+y-L2),l.length)),P=S.filter((A)=>!k.includes(A)),E=Object.fromEntries(I.flatMap((A)=>A.name&&P.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));N={listed:!0,reason:null,blocked:P.filter((A)=>h.get(A)),names:E};for(let A of new Set([...R.keys(),...G.keys()])){if(P.includes(A)||x(A))continue;if(h.has(A)&&C(A))continue;if((G.get(A)?.claims??0)>0)continue;await H(A);let b=R.get(A)?.config;try{if(b&&u(d(b).state))f0(b)}catch{}v1(M0(q1(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
12
- `)}for(let A of P){if(X.aborted)return!0;if(x(A))continue;try{let b=G.get(A);if(h.get(A)){if(b&&b.claims===0)await H(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
11
+ `))return null;return{organizationId:W,config:L,state:x,proofStore:T0(L)}}catch{return null}},T=(W,L)=>{if(!L)return null;try{if($0(L).revoked)return null;let R=t(L);if(!R||R.orgId.toLowerCase()!==W||Date.parse(R.worker?.expiresAt??"")<=Date.now()+60000||L.executionMode!==J.executionMode||!z0(L.apiOrigin,J.apiOrigin))return null;return{organizationId:W,config:L,state:R,proofStore:T0(L)}}catch{return null}},_=(W,L)=>W.deviceId===L.deviceId&&W.devicePublicKey===L.devicePublicKey&&JSON.stringify(W.roots.map((R)=>[R.id,R.path]))===JSON.stringify(L.roots.map((R)=>[R.id,R.path])),D=async(W)=>{for(let[L,R]of W){if(X.aborted)return;let x=G.get(L),C=T(L,R.config);if(x&&C&&_(x.state,C.state))continue;if(x){if(x.claims>0)continue;await H(L)}if(C&&!X.aborted)U(C,!0)}for(let[L,R]of G)if(R.account&&!W.has(L)&&R.claims===0)await H(L)},j=async(W)=>{let L=q(W),R=J0.parse({...L,stateDirectory:J.stateDirectory});if(!u(M0(g(J),"enrollment-install.json")))return null;let x=C1(R),C=await Q.ownerWorkspaceEnrollment(Z,{organization_id:W,install_id:x.request.install_id,code_challenge:x.request.code_challenge},X),P=x.complete(W,C);if(e(g(L),!0),u(d(L).state))f0(L);let h=W2(L);try{let S=await Z1(L,P,h,$.enroll);return m0(S,d(L).state,{proofStore:h}),x0(L,{version:1,drained:!1,revoked:!1}),c(M0(L.stateDirectory,"worker.json"),L),{organizationId:W,config:L,state:S,proofStore:h}}catch(S){if(S instanceof J1&&S.deviceRemoved)return x0(L,{version:1,drained:!0,revoked:!0}),c(M0(L.stateDirectory,"worker.json"),L),null;throw S}},z=async()=>{let W=h0(J),L=new Map(W.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await D(L);let R=new Map(W.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),x=(A)=>L.has(A)||G.get(A)?.account===!0||b4(M0(M1(J),A)),C=(A)=>{let b=R.get(A)?.config;try{return b?$0(b).revoked:!1}catch{return!1}};for(let[A,b]of R){if(G.has(A)||C(A)||N.blocked.includes(A))continue;let w=M(A,b.config);if(w&&!X.aborted)U(w)}let P;try{P=await Q.ownerWorkspaces(Z,X)}catch(A){return N={listed:!1,blocked:N.blocked,...N.names?{names:N.names}:{},reason:A instanceof _0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let h=new Map(P.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>D2.test(A)&&A!==Z.orgId.toLowerCase()&&!x(A))),S=[...h.keys()].filter((A)=>R.has(A)?!C(A):!h.get(A)).slice(0,L2),y=[...G.values()].filter((A)=>!A.account&&A.claims>0&&!S.includes(A.organizationId)).length,l=S.filter((A)=>!R.has(A)),k=l.slice(l.length-Math.min(Math.max(0,S.length+y-L2),l.length)),I=S.filter((A)=>!k.includes(A)),E=Object.fromEntries(P.flatMap((A)=>A.name&&I.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));N={listed:!0,reason:null,blocked:I.filter((A)=>h.get(A)),names:E};for(let A of new Set([...R.keys(),...G.keys()])){if(I.includes(A)||x(A))continue;if(h.has(A)&&C(A))continue;if((G.get(A)?.claims??0)>0)continue;await H(A);let b=R.get(A)?.config;try{if(b&&u(d(b).state))f0(b)}catch{}v1(M0(M1(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
12
+ `)}for(let A of I){if(X.aborted)return!0;if(x(A))continue;try{let b=G.get(A);if(h.get(A)){if(b&&b.claims===0)await H(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
13
13
  `);continue}let w=M(A,R.get(A)?.config??null);if(w&&b)continue;if(!w){if(b&&b.claims>0)continue;if(await H(A),w=await j(A),w)Y(`Reason worker: connected in workspace ${A}
14
14
  `)}if(w&&!X.aborted)U(w)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
15
- `)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(q1(J),!0),c(h4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(V)K=!0;else V=O().finally(()=>{V=null});return V},claims:()=>[...G.values()].reduce((W,L)=>W+L.claims,0),async settled(){await V,await Promise.all([...G.values()].map((W)=>W.done))}}}import{dirname as CQ}from"path";import{randomUUID as J$}from"crypto";import{chmodSync as J8,closeSync as Z$,constants as Q$,existsSync as YQ,fstatSync as Z8,lstatSync as Q8,mkdirSync as X8,openSync as Y8,readFileSync as G8,readdirSync as B8,readlinkSync as ON,realpathSync as AN,renameSync as X$,rmSync as m4,statSync as K8,symlinkSync as RN,unlinkSync as m$,writeFileSync as v4}from"fs";import{basename as IN,dirname as V8,isAbsolute as GQ,join as D0,relative as PN,resolve as xN,sep as EN}from"path";import{createRequire as BQ}from"module";var H8=1,N8=1,KQ=128,VQ=65536;var HQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var o9=/^[a-z0-9_.-]{1,80}$/,NQ=64;var UQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function U8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function q8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&HQ.test($)}function M8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function u4($){X8($,{recursive:!0,mode:448}),J8($,448)}function qQ($,J){u4(V8($));let Z=`${$}.${process.pid}.${J$()}.tmp`;try{v4(Z,J,{mode:384,flag:"wx"}),J8(Z,384),X$(Z,$)}finally{if(YQ(Z))m$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new v$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=b0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?b0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&GQ(X))?null:D0($.home??V0(),"Library","Application Support"),V=$.root??(G?D0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...G?{legacyRoot:D0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(V,"versions"),current:D0(V,"current"),previous:D0(V,"previous"),brokerLock:D0(V,"broker.lock"),transitionLock:D0(V,"transition.lock"),lifecycleEvents:D0(V,"lifecycle-events")}}function MQ($){return U8($)&&q8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===H8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&M8($.started_at)&&R2($.runtime_version)}function T8($,J){try{let Z=Q8($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=Y8(D0($,J),Q$.O_RDONLY|Q$.O_NOFOLLOW|Q$.O_NONBLOCK);try{let X=Z8(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return G8(Q,"utf8")}finally{Z$(Q)}}catch{return null}}function g4($){try{let J=JSON.parse(T8($,"owner.json")??"null");return MQ(J)?J:null}catch{return null}}function _8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var e9="lease",TQ=2,_Q=4,h$;function FQ(){if(h$!==void 0)return h$;if(h$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=BQ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return h$={flock:(G,V)=>X.symbols.flock(G,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},h$}catch{}return null}function WQ($){let J=FQ();if(!J)return null;let Z=Y8(`${$}.lease`,Q$.O_RDWR|Q$.O_CREAT|Q$.O_NOFOLLOW,384);try{let Q=Z8(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return Z$(Z),"busy";if(J.flock(Z,TQ|_Q)===0)return Z;let X=J.errno();return Z$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw Z$(Z),Q}}function Z1($){u4(V8($.path));let J=WQ($.path);if(J==="busy")return{acquired:!1,owner:g4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=LQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)Z$(J)}}function LQ($,J){let Z=$.alive??_8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:H8,pid:$.pid??process.pid,nonce:$.nonce?.()??J$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${J$()}`,V=!1;try{if(X8(G,{mode:448}),v4(D0(G,"owner.json"),`${JSON.stringify(Y)}
16
- `,{mode:384,flag:"wx"}),J!==null)v4(D0(G,e9),`flock
17
- `,{mode:384,flag:"wx"});$.beforePublish?.();try{throw Q8($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}X$(G,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,g4($.path)?.nonce===Y.nonce)m4($.path,{recursive:!0,force:!0});if(J!==null)Z$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=g4($.path),H=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?H-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&T8($.path,e9)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${J$()}`;try{X$($.path,T),m4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!V)m4(G,{recursive:!0,force:!0})}}throw new v$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function F8($){return U8($)&&q8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===N8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&M8($.occurred_at)&&typeof $.event==="string"&&UQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&o9.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=NQ&&$.capabilities.every((J)=>typeof J==="string"&&o9.test(J)))}var DQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,jQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,zQ=300000,A2=0n;function OQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function W8($){try{return B8($.lifecycleEvents).filter((J)=>DQ.test(J)).sort()}catch{return[]}}function $8($){try{let J=JSON.parse(G8($,"utf8"));return F8(J)?J:null}catch{return null}}function AQ($,J=_8,Z=Date.now()){let Q;try{Q=B8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(jQ);if(!Y)continue;let G=D0($.lifecycleEvents,X),V=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-K8(G).mtimeMs>=zQ}catch{continue}if(!K)continue;try{X$(G,V)}catch(N){let q=N.code;if(q==="EEXIST")m$(G);else if(q!=="ENOENT")throw N}}}function RQ($){let Z=W8($).flatMap((X)=>{try{return[{name:X,size:K8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>KQ||Q>VQ){let X=Z.shift();if(!X)break;try{m$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function g$($,J,Z={}){let Q={schema_version:N8,event_id:Z.eventId?.()??J$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!F8(Q))throw new v$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return u4($.lifecycleEvents),qQ(D0($.lifecycleEvents,OQ(Q)),`${JSON.stringify(Q)}
18
- `),RQ($),Q}async function L8($,J,Z){AQ($);let Q=0;for(let X of W8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=$8(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${J$()}`;try{X$(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=$8(G);if(!V){m$(G);continue}try{await J(V),m$(G),Q+=1}catch{try{X$(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function z8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!IQ($.saved))return J;let Z=$.saved,Q=(G,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...V?{code:`worker_api_origin_move_${G}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?Y$():$.native;if(!X)return J;let Y=[];try{let G=X.lock(CQ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let q=Z1({path:d(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=O8(V),N={saved:V,configPath:$.configPath};if(!I2(V)&&K.length===0)return Q("unchanged"),N;if(I2(V)){let q=D8(V);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,D8(q.config))}catch(H){Q("failed",`workspace:${j8(H)}`)}return Q("moved"),N}catch(G){return Q("failed",j8(G)),J}finally{for(let G of Y.reverse())G()}}function I2($){return o0($.apiOrigin)!==$.apiOrigin}function O8($){return h0($).filter((J)=>J.config!==null&&I2(J.config))}function IQ($){return I2($)||O8($).length>0}function D8($){let J=J0.parse({...$,apiOrigin:o0($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)m0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function j8($){if($ instanceof Y0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as PQ,lstatSync as p4,readdirSync as x8,readlinkSync as xQ,unlinkSync as EQ}from"fs";import{join as O0,sep as SQ}from"path";var P2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function E8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),G=O0(Z,"reason",...X),V=(H,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:H,...U?{code:`worker_state_rehome_${H}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?Y$():$.native,N=$.saved,q=[];try{if(N&&R8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:G};if(!d4(K,G,j,q))return J;return A8(N,j,$.host,V)}if(N&&R8(Q)&&N.stateDirectory===G&&y9(N)&&d4(K,G,N,q))return S8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!G$(Q)?.isDirectory())return J;if(hQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,P2),{version:r});return V("skipped",j),J},M=[Y];for(let j of bQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!wQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!d4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(C8(Z)!==null)return U("conflicting_identity");if(I8(Z)!==null)return U("conflicting_files");if(G$(G)&&(!G$(G).isDirectory()||x8(G).length>0))return U("connection_folder_taken");S$(N,T.devicePublicKey),f4.before(N);let _=l0(Y);if(_&&l4(Y))kQ(G,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&l4(Y))w8(G);return U(D.problem??"config_folder_kept")}return A8(N,{...N,stateDirectory:G},$.host,V)}catch(H){try{if(G$(Y)?.isDirectory())c(O0(Y,P2),{version:r})}catch{}return V("failed",mQ(H)),fQ(N,Y,G,J)}finally{for(let H of q.reverse())H()}}function A8($,J,Z,Q){let X=p4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)PQ(J.stateDirectory,448);let Y=T0(J),G=h1(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new x2("identity_missing");let V=U0(J);if(G.worker.configDigest===U0($))m0({...G,worker:{...G.worker,configDigest:V}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==V)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),f4.after($,J),S8($,J,Z);let K=O0(J.stateDirectory,P2);if(u(K))EQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function S8($,J,Z){if(P8($,J,Z,"connect"),!l4(J.stateDirectory))return;let Q=yQ(z1($.stateDirectory));if(!Q)return;let X=z1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);w8($.stateDirectory)}function d4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Z1({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function wQ($,J,Z){if(u(g(J))){let X=Z1({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=G$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function bQ($,J){let Z=[$,...x8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=O0(X,Y);if(G===J||!G$(O0(G,"worker.json")))continue;let V=b8(G);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+SQ))Q.push({directory:G,config:V})}return Q}function l4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function kQ($,J){let Z=z1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function w8($){try{z1($).deleteBinding()}catch(J){if(!(J instanceof Y0))throw J}}function yQ($){try{return $.loadBinding()}catch(J){if(J instanceof Y0)return null;throw J}}function fQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=b8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function R8($){try{return p4($).isSymbolicLink()&&xQ($)==="reason"}catch{return!1}}function hQ($){try{let J=JSON.parse(s(O0($,P2)));return typeof J.version==="string"?J.version:null}catch{return null}}function b8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function G$($){try{return p4($)}catch{return null}}function mQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof Y0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as vQ}from"fs";function S2($){try{let J=JSON.parse(vQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function k8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as jK}from"crypto";import{readdirSync as zK,realpathSync as KJ,statSync as OK}from"fs";import{hostname as AK}from"os";import{join as r1,resolve as RK}from"path";var w2="cloud",gQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function u$($){return gQ.test($)&&!y8.test($)}var uQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function B$($){return uQ[$]}import{chmodSync as dQ,lstatSync as k2,mkdtempSync as lQ,realpathSync as v8,rmdirSync as pQ,rmSync as cQ,unlinkSync as sQ}from"fs";import{createConnection as aQ,createServer as iQ}from"net";import{basename as f8,dirname as h8,join as g1}from"path";var nQ=B.enum(["status","drain","resume","stop","reload_roots"]),rQ=B.strictObject({version:B.literal(1),instanceId:B.string(),deviceId:B.string(),phase:B.enum(["starting","running","reconnecting","stopping"]),drained:B.boolean(),activeClaims:B.number().int().nonnegative(),activeSessions:B.number().int().nonnegative().optional(),executionEligible:B.boolean(),supportedOperations:B.array(B.enum(b2)).max(b2.length).optional(),capabilityReadiness:B.partialRecord(B.enum(b2),B.boolean()).optional(),lastHeartbeat:B.string().nullable(),expiresAt:B.string()}),tQ=B.strictObject({nonce:B.string(),action:nQ}),oQ=B.object({nonce:B.uuid()}),g8=B.strictObject({version:B.literal(1),nonce:B.uuid(),socketPath:B.string().max(100)});function u8($){return g1(d($).lock,"control.json")}function y2($){return e(d($).lock),oQ.parse(JSON.parse(s(g1(d($).lock,"owner.json"))))}function m8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function d8($,J){let Z=u8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return m8(Y)?Y:null}let Q=g8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=h8(Q.socketPath);if(h8(X)!==v8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(f8(X))||f8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),m8(Q.socketPath)?Q.socketPath:null}async function f2($,J,Z){if(y2($).nonce!==J)throw Error("worker_instance_changed");let Q=u8($);if(u(Q))throw Error("worker_control_already_serving");let X=lQ(g1(v8("/tmp"),"ara-worker-")),Y=g1(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,V=iQ((H)=>{G.add(H),H.once("close",()=>G.delete(H)),H.setTimeout(2000,()=>H.destroy());let U="",M=!1;H.on("error",()=>H.destroy()),H.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){H.destroy();return}if(!U.includes(`
19
- `))return;M=!0;try{let _=tQ.parse(JSON.parse(U));if(_.nonce!==J){H.destroy();return}H.end(JSON.stringify(Z(_.action))+`
20
- `)}catch{H.destroy()}})});V.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let H of G)H.destroy();if(await new Promise((H)=>V.close(()=>H())),K&&u(Q)){let H=k2(Q);if(H.isFile()&&H.dev===K.dev&&H.ino===K.ino)try{let U=g8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)sQ(Q)}catch{}}try{pQ(X)}catch{}};try{if(await new Promise((H,U)=>{V.once("error",U),V.listen(Y,()=>{dQ(Y,384),H()})}),y2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(H){throw await q(),H}}function l8($,J){try{let Z=JSON.parse(s(g1(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function d$($){return l8($,"runtime_version")}function eQ($){return l8($,"nonce")}function p8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(g1(d($).lock,"owner.json")))return"no_lock";return d8($,y2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var $X=21600000,JX=B.strictObject({instance:B.string().nullable(),since:B.number().int().nonnegative()});function ZX($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=JX.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{cQ(d($).updateDeferral,{force:!0})}catch{}}async function h2($,J,Z=()=>!1){let Q=eQ($),X=ZX($,Q);if(J!==void 0){let N=d$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),V=X;if(V===null){V=G;try{c(d($).updateDeferral,{instance:Q,since:V})}catch{}}let K=G-V;return{state:K<$X?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=d($);if(!u(g1(Z.lock,"owner.json")))return null;let Q=y2($),X=d8($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let V=aQ(X),K="",N=!1,q=(H,U)=>{if(N)return;if(N=!0,V.destroy(),U)G(U);else Y(H)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
21
- `)),V.on("data",(H)=>{if(K+=H.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(H)=>{if("code"in H&&["ECONNREFUSED","ENOENT"].includes(String(H.code)))q(null);else q(null,H.message==="worker_control_timeout"?H:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let H=rQ.parse(JSON.parse(K));if(H.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(H)}catch{q(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as XB}from"crypto";import{homedir as H7}from"os";import{spawn as QX}from"child_process";async function c8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),V=(H)=>{if(Q===H)return;Q=H,J.onStatusChange?.(H)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let H=(J.spawn??QX)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=H,H.once("exit",()=>{if(!X&&Z===H)V("failed"),K()}),await new Promise((U,M)=>{H.once("spawn",U),H.once("error",M)}),H.exitCode===null&&H.signalCode===null)V("held")}catch{V("failed"),K()}};G=N(),await G;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await G;let H=Z;if(!H||H.exitCode!==null||H.signalCode!==null||!H.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{H.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);H.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{H.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class m2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as KX}from"fs";import{constants as s4}from"fs";import{open as XX}from"fs/promises";import{join as YX}from"path";var GX={platform:process.platform,home:V0,async openFile($){let J=await XX($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function s8($=GX){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(YX($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function BX($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function a8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await BX($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?l$(X.status):p$(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var VX=1000,HX=250,NX=V5(KX(process.execPath)),i8=null,n8=null;function H5($){if(process.platform!=="darwin")return{};return n8??=s8().then((J)=>{i8={status:J,checkedAt:$().getTime()}}).finally(()=>{n8=null}),{fullDiskAccess:{...i8??{status:"unknown",checkedAt:$().getTime()},executablePath:NX}}}var r8=8,UX=2000,qX=2000,G3=8000,t8=3,MX=250,o8=1000,e8=30000,TX=0.2,_X=30000,FX=21600000,WX=300000,LX=3600000,DX=0.1,N5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function jX($){return Math.min(t8,Math.max(1,$??t8))}function zX($){return typeof $.reason_code==="string"&&N5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof v0&&($.reason.code==="cancelled"||N5.has($.reason.code))?$.reason.code:"cancelled"}function $5($){return $ instanceof v0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function U5($){return $.capability==="hands.connect"&&(G5($.payload)||Y5($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*DX)))}function OX($,J=Math.random){let Z=Math.min(e8,o8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*TX*(Q*2-1);return Math.min(e8,Math.max(o8,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function AX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function n0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function RX($){if($ instanceof g2||$ instanceof K$||$ instanceof s$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function c$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(n0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:RX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)c$($,J,Q);throw Q}}class s$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,H,U=new Promise((_,D)=>{let j=()=>{let F=new s$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(H=()=>z(Math.max(0,Math.min(N-performance.now(),UX))),z(K),$.signal.addEventListener("abort",H,{once:!0}),$.signal.aborted)H()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),U]);break}catch(_){if(G.aborted||$.signal.aborted||E0(_)||n0(_)||!CX(_)||performance.now()>=N)throw c$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw c$($,"completion",_),_;try{await V(D,G)}catch{throw c$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",H),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function CX($){if(E0($))return!1;if(n0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof s$)return!1;return!0}return!1}class g2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function v2($){if($ instanceof g2)return!0;return $ instanceof _0?l$($.status):p$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function IX($,J,Z,Q,X){let Y=new AbortController,G,V=()=>{return},K=new Promise((q,H)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),H(M)};if(V=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,H)=>{G=setTimeout(()=>{let U=new g2;Y.abort(U),H(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);V()}}async function J5($,J,Z,Q,X,Y){let G=jX($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??MX,N=Y.remainingMs(),q=Math.min(N,G*V+K*G*(G-1)/2);for(let H=0;H<G;H+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(V,Y.remainingMs()),M=await IX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:H},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||H+1>=G||n0(U)||E0(U)||!v2(U)){if(!Q.aborted)c$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(H+1),q*(H+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function PX($,J,Z,Q,X){let Y=U5(J),G=new AbortController,V=new AbortController,K=()=>{G.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,H,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,R={},x=(S)=>{j=!0,D.abort(S),G.abort(S),V.abort(S)},C=(S)=>{if(z)return z;let y=structuredClone(S),l=M;return z=(async()=>{let k=new AbortController,P=k.signal;P.throwIfAborted();let E,A=()=>{},b=new Promise((w,n)=>{if(A=()=>n(P.reason),P.addEventListener("abort",A,{once:!0}),E=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),P.aborted)A()});try{for(let w=0;w<3;w+=1){P.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[y],signal:P,transientRetryOwner:"caller"})),b]);if(P.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(E0(n))X(n);let o=n instanceof _0?l$(n.status):p$(n);if(P.aborted||!o||w===2)throw n;let N0=Math.max(500*2**w,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,P),b])}}}finally{clearTimeout(E),P.removeEventListener("abort",A),k.abort()}})(),z},I=(S,y,l)=>{let k=(E)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:y,events:S,signal:E,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&n0(A))x(A);if(l&&(E0(A)||n0(A))){if(E0(A))X(A);G.abort(A),V.abort(A),D.abort(A)}throw A});if(!l)return async(E)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(E)).next_event_seq;return}E.throwIfAborted();let A=()=>{},b=new Promise((w,n)=>{A=()=>n(E.reason),E.addEventListener("abort",A,{once:!0})});try{let w=await Promise.race([k(E),b]);E.throwIfAborted(),M=w.next_event_seq}finally{E.removeEventListener("abort",A)}};let P=a8({send:k,lease:L,sleep:Z,retryAfterMs:(E)=>J3(E,($.now?.()??new Date).getTime())});return async(E)=>{let A=await P(E);if(A.next_event_seq!==y+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,y)=>{let l=S??await J5($,J,{controlAckSeq:U,waitMs:y},V.signal,Z,L),k=null,P=!1;for(let E=0;E<10;E+=1){let A=U+1;for(let b of l.controls){if(b.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(b.kind==="cancel"||b.kind==="operation.cancel")k??=zX(b.payload),G.abort(new v0(k,"Reason closed the Device operation."));if(b.kind!=="cancel"&&b.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let w,n,o=new Promise((N0,j0)=>{w=N0,n=j0});o.catch(()=>{}),R.current={promise:o,resolve:w,reject:n}}try{P||=!await $.onControl?.(J,b)}catch(w){if(w instanceof v0)q??=$5(w);throw R.current?.reject(w),w}}U=b.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:P}}try{l=await J5($,J,{controlAckSeq:U},V.signal,Z,L),R.current?.resolve()}catch(b){if(R.current?.reject(b),!k||n0(b)||E0(b))throw b;return{cancellationReason:k,unsupported:P}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)L=new m2(J.lease_until,()=>($.now?.()??new Date).getTime(),(y)=>{if(!G.signal.aborted)N=y;G.abort(y),V.abort(y)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(y){if(!e4(J)||n0(y)||E0(y))throw y;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let y=S.cancellationReason??i4($.signal);G.abort(new v0(y,"Reason closed the Device operation.")),H={status:"cancelled",error_code:y}}else if(S.unsupported)G.abort(),H={status:"failed",error_code:"control_unsupported"};else{let y=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?qX:15000),P=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),E=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!E){if(await Z(k,V.signal),V.signal.aborted)return}let A=await h(void 0,E?P:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new v0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(E0(A))X(A);if(n0(A))N=A,x(A);if(!V.signal.aborted)N=A,G.abort();return}})();try{if(L?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(L?.remainingMs()??0)>0),H=await $.onClaim(J,G.signal,async(k)=>{if(e4(J))return;let P=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",E=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=E||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,D.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,b={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:E?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:b,settle:(j0)=>j0===void 0?o():N0(j0)})});let w=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(P)await C(b);return}if(F!==null){if(k.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),W1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await I([b],M,!0)(j0),F=null}catch(L1){throw F=L1??Error("Hands stop receipt could not be confirmed."),L1}finally{clearTimeout(W1),N0.abort()}return}if(E&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new m2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{G.abort(j0),V.abort(j0)})}let o=M;if(E)W=I([...w.map((N0)=>N0.wireEvent),b],o,!0),await W(A),W=void 0;else await I([...w.map((N0)=>N0.wireEvent),b],o,!1)(A)});n.then(()=>{for(let o of w)o.settle()},(o)=>{for(let N0 of w)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(E0(o))X(o);if(E){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),V.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(k){H=G.signal.aborted?{status:"cancelled",error_code:i4(G.signal)}:{status:"failed",error_code:$5(k)}}finally{Q.authorized=()=>!1,D.abort();for(let k of _.splice(0))k.settle();V.abort(),await y}let l=Q5(J.capability)?X5(H.result,J.operation_id):null;if(N){if(E0(N))throw N;H={status:"failed",error_code:q??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&H.status==="succeeded")H={status:"cancelled",error_code:i4(G.signal),...l?{result:l}:{}}}if(L?.close(),E0($.signal.reason))throw $.signal.reason;await $3($,J,H)}finally{L?.close(),D.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??y$,Y=$.statusPath??Q3(),G=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...H5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),q=0,H,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),K5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??c8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await xX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,H=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(E0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=OX(q,$.reconnectRandom);H??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:H},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function xX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??y$,G=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let H=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(r8,U):r8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,X0=0;for(let{claim:S1}of z.values()){let V1=S1.capability==="hands.connect"?S1.payload[Z5]:void 0;if(typeof V1==="string"){if(v.has(V1))continue;v.add(V1)}X0+=1}return X0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(G).getTime()+n4(K.initialDelayMs??_X,H):Number.POSITIVE_INFINITY,x=null,C=!1,I=$.firstHeartbeat,h=I?.account_root_metadata_supported===!0,S=I?.workspace_root_metadata_supported===!0,y=I?.account_root_path_supported===!0,l=I?.home_contained_roots_supported===!0,k=I?.root_paths_supported===!0,P=I?.startup_supported===!0,E=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,b,w=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...H5(J),...V?{lastUsedAt:V}:{},...x?{organizationId:x.organization_id,organizationName:x.organization_name,organizationSlug:x.organization_slug}:{}}),o=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!w)b??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...P&&!w&&b?{startup:b}:{},capabilities:v?B5($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:y,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},N0=()=>{if(C||!$.client.identity)return;C=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;x=v;let X0=Y(Q);if(!X0)return;X({...X0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,y=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,P=v.startup_supported===!0,E=!1},W1=(v)=>{if(v.startup)w=!0},L1=(v,X0)=>{if(!(X0 instanceof _0&&X0.status===400&&X0.code==="invalid_heartbeat")||!v.startup&&!E)throw X0;if(w=!0,E)h=S=y=!1,l=k=P=E=!1;return null},O$=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},x1=!1,t1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(x1)t1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((X0)=>L1(v,X0))).then((X0)=>{if(!X0)return;W1(v),j0(X0),O$(X0)},()=>{return})});let D1=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let B1=!1,E1=$.maxConsecutiveHeartbeatFailures??3,K1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,X0=o(),S1=A;A=void 0,x1=!0,t1=!1;try{let i=await V$($,"heartbeat",()=>$.client.heartbeat($.state,X0,N.signal,...S1?[S1]:[]).catch((K0)=>L1(X0,K0)));if(x1=!1,!i)continue;v=i,W1(X0),K1=0}catch(i){if(x1=!1,$.signal.aborted)break;if(!v2(i))throw i;if(K1+=1,K1>=E1&&!W())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(X0.capabilities).length)continue;if(t1)continue;if(O$(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let i=new AbortController,K0=()=>i.abort($.signal.reason);if($.signal.aborted)K0();else $.signal.addEventListener("abort",K0,{once:!0});let R0;try{R0=K.check(i.signal)}catch(C0){R0=Promise.reject(C0)}let H1=R0.then((C0)=>({kind:"completed",result:C0}),(C0)=>({kind:"failed",error:C0})),o1;try{while(!0){let C0=await AX(H1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(C0.kind==="failed")throw new r4(C0.error);if(C0.kind==="completed"){o1=C0.result;break}try{let S0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,S0,N.signal).catch((H2)=>L1(S0,H2)));if(!R$)continue;v=R$,W1(S0),O$(v),K1=0}catch(S0){if($.signal.aborted)throw S0;if(!v2(S0))throw S0;if(K1+=1,K1>=E1&&!W())throw S0}}}catch(C0){i.abort(C0);let S0=await H1;if(S0.kind==="completed"&&S0.result==="activated")o1="activated";else throw C0}finally{$.signal.removeEventListener("abort",K0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,o1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+n4(K.intervalMs??FX,H)}catch(i){if(!(i instanceof r4))throw i;T+=1;let K0=K.retryBaseMs??WX,R0=K.retryMaxMs??LX,H1=Math.min(R0,K0*2**Math.min(T-1,8));R=J().getTime()+n4(H1,H)}if($.signal.aborted)break;if(_&&L())break;if(_){await D1($.heartbeatIntervalMs??15000);continue}let V1=$.client.sessionCadence?.($.state)??null,w1=V1?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await D1(w1);continue}if(F()>=M){let i=new AbortController;O=i;try{await Z(w1,AbortSignal.any([$.signal,i.signal]))}catch(K0){if(!i.signal.aborted)throw K0}finally{if(O===i)O=null}continue}let g0,A$=V1?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),f=performance.now();try{g0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:A$,signal:N.signal}))}catch(i){if($.signal.aborted||!v2(i)||!W())throw i;await D1(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!g0){if(performance.now()-f<A$-HX)await D1(VX);continue}if($.claimable?.()===!1){await $3($,g0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:g0.operation_id,runId:g0.run_id,attemptId:g0.attempt_id,capability:g0.capability});let a,q0={authorized:()=>!1,claim:g0};if(a=PX({...$,signal:N.signal},g0,Z,q0,j).catch((i)=>{if(E0(i))j(i);else if(!n0(i)&&[...z].some(([K0,R0])=>K0!==a&&R0.authorized())){if(i instanceof s$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!n0(i)&&D===null)D=i}).finally(()=>{z.delete(a),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(a,q0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),U5(g0)){if(await a,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),B1=!0;let X0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:X0},Q),$.onEvent?.({type:"error",message:X0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!B1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as GY}from"child_process";import{constants as m5,existsSync as BY,mkdtempSync as n5,rmSync as KY}from"fs";import{access as v5,open as VY,readFile as g5,readlink as HY,readdir as u5,unlink as NY,rmdir as UY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as u1}from"crypto";import{chmodSync as EX,closeSync as SX,fsyncSync as wX,openSync as bX,readFileSync as kX,rmdirSync as q5,unlinkSync as _5,writeFileSync as yX}from"fs";import{createConnection as fX,createServer as hX}from"net";import{dirname as mX,join as vX}from"path";var gX=5000;async function F5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:u1()},X={runId:u1(),deviceId:u1(),rootId:u1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=T5(J,X),G={version:1,snapshot_id:u1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{_5(Y.path)}catch{}}}async function W5($,J,Z=M5){if(J.aborted)return!1;let Q,X,Y=new Set,G=u1(),V=hX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(G)});V.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),H=setTimeout(N,gX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${u1()}`}),X=vX(Q.journalDirectory,"readiness.json");let U=bX(X,"wx",384);try{yX(U,G),wX(U)}finally{SX(U)}if(kX(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{EX(Q.socketPath,384)}catch{T(!1);return}K=fX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(H),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>V.close(()=>U())),Q?.disposeSocket(),X)try{_5(X)}catch{}if(Q){try{q5(Q.journalDirectory)}catch{}try{q5(mX(Q.journalDirectory))}catch{}}}}import{spawn as uX}from"child_process";import{randomUUID as d1}from"crypto";import{basename as dX}from"path";import{fileURLToPath as lX}from"url";function pX(){let $=dX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",lX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function j5($,J,Z=pX()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=uX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>G.once("close",()=>{V=!0,F()}));G.on("error",X);let N,q,H=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
15
+ `)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(M1(J),!0),c(h4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(V)K=!0;else V=O().finally(()=>{V=null});return V},claims:()=>[...G.values()].reduce((W,L)=>W+L.claims,0),async settled(){await V,await Promise.all([...G.values()].map((W)=>W.done))}}}import{dirname as bQ}from"path";import{randomUUID as J$}from"crypto";import{chmodSync as Z8,closeSync as Z$,constants as Q$,existsSync as UQ,fstatSync as Q8,lstatSync as X8,mkdirSync as Y8,openSync as G8,readFileSync as B8,readdirSync as K8,readlinkSync as EN,realpathSync as SN,renameSync as X$,rmSync as m4,statSync as V8,symlinkSync as wN,unlinkSync as m$,writeFileSync as v4}from"fs";import{basename as kN,dirname as H8,isAbsolute as qQ,join as D0,relative as yN,resolve as fN,sep as hN}from"path";import{createRequire as MQ}from"module";var N8=1,U8=1,TQ=128,_Q=65536;var FQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var e9=/^[a-z0-9_.-]{1,80}$/,WQ=64;var LQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function q8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function M8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&FQ.test($)}function T8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function u4($){Y8($,{recursive:!0,mode:448}),Z8($,448)}function DQ($,J){u4(H8($));let Z=`${$}.${process.pid}.${J$()}.tmp`;try{v4(Z,J,{mode:384,flag:"wx"}),Z8(Z,384),X$(Z,$)}finally{if(UQ(Z))m$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new v$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=b0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?b0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&qQ(X))?null:D0($.home??V0(),"Library","Application Support"),V=$.root??(G?D0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...G?{legacyRoot:D0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(V,"versions"),current:D0(V,"current"),previous:D0(V,"previous"),brokerLock:D0(V,"broker.lock"),transitionLock:D0(V,"transition.lock"),lifecycleEvents:D0(V,"lifecycle-events")}}function jQ($){return q8($)&&M8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===N8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&T8($.started_at)&&R2($.runtime_version)}function _8($,J){try{let Z=X8($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=G8(D0($,J),Q$.O_RDONLY|Q$.O_NOFOLLOW|Q$.O_NONBLOCK);try{let X=Q8(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return B8(Q,"utf8")}finally{Z$(Q)}}catch{return null}}function g4($){try{let J=JSON.parse(_8($,"owner.json")??"null");return jQ(J)?J:null}catch{return null}}function F8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var $8="lease",zQ=2,OQ=4,h$;function AQ(){if(h$!==void 0)return h$;if(h$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=MQ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return h$={flock:(G,V)=>X.symbols.flock(G,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},h$}catch{}return null}function RQ($){let J=AQ();if(!J)return null;let Z=G8(`${$}.lease`,Q$.O_RDWR|Q$.O_CREAT|Q$.O_NOFOLLOW,384);try{let Q=Q8(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return Z$(Z),"busy";if(J.flock(Z,zQ|OQ)===0)return Z;let X=J.errno();return Z$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw Z$(Z),Q}}function Q1($){u4(H8($.path));let J=RQ($.path);if(J==="busy")return{acquired:!1,owner:g4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=CQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)Z$(J)}}function CQ($,J){let Z=$.alive??F8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:N8,pid:$.pid??process.pid,nonce:$.nonce?.()??J$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${J$()}`,V=!1;try{if(Y8(G,{mode:448}),v4(D0(G,"owner.json"),`${JSON.stringify(Y)}
16
+ `,{mode:384,flag:"wx"}),J!==null)v4(D0(G,$8),`flock
17
+ `,{mode:384,flag:"wx"});$.beforePublish?.();try{throw X8($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}X$(G,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,g4($.path)?.nonce===Y.nonce)m4($.path,{recursive:!0,force:!0});if(J!==null)Z$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=g4($.path),H=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?H-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&_8($.path,$8)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${J$()}`;try{X$($.path,T),m4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!V)m4(G,{recursive:!0,force:!0})}}throw new v$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function W8($){return q8($)&&M8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===U8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&T8($.occurred_at)&&typeof $.event==="string"&&LQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&e9.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=WQ&&$.capabilities.every((J)=>typeof J==="string"&&e9.test(J)))}var PQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,IQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,xQ=300000,A2=0n;function EQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function L8($){try{return K8($.lifecycleEvents).filter((J)=>PQ.test(J)).sort()}catch{return[]}}function J8($){try{let J=JSON.parse(B8($,"utf8"));return W8(J)?J:null}catch{return null}}function SQ($,J=F8,Z=Date.now()){let Q;try{Q=K8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(IQ);if(!Y)continue;let G=D0($.lifecycleEvents,X),V=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-V8(G).mtimeMs>=xQ}catch{continue}if(!K)continue;try{X$(G,V)}catch(N){let q=N.code;if(q==="EEXIST")m$(G);else if(q!=="ENOENT")throw N}}}function wQ($){let Z=L8($).flatMap((X)=>{try{return[{name:X,size:V8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>TQ||Q>_Q){let X=Z.shift();if(!X)break;try{m$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function g$($,J,Z={}){let Q={schema_version:U8,event_id:Z.eventId?.()??J$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!W8(Q))throw new v$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return u4($.lifecycleEvents),DQ(D0($.lifecycleEvents,EQ(Q)),`${JSON.stringify(Q)}
18
+ `),wQ($),Q}async function D8($,J,Z){SQ($);let Q=0;for(let X of L8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=J8(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${J$()}`;try{X$(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=J8(G);if(!V){m$(G);continue}try{await J(V),m$(G),Q+=1}catch{try{X$(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function O8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!kQ($.saved))return J;let Z=$.saved,Q=(G,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...V?{code:`worker_api_origin_move_${G}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?Y$():$.native;if(!X)return J;let Y=[];try{let G=X.lock(bQ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let q=Q1({path:d(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=A8(V),N={saved:V,configPath:$.configPath};if(!P2(V)&&K.length===0)return Q("unchanged"),N;if(P2(V)){let q=j8(V);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,j8(q.config))}catch(H){Q("failed",`workspace:${z8(H)}`)}return Q("moved"),N}catch(G){return Q("failed",z8(G)),J}finally{for(let G of Y.reverse())G()}}function P2($){return e0($.apiOrigin)!==$.apiOrigin}function A8($){return h0($).filter((J)=>J.config!==null&&P2(J.config))}function kQ($){return P2($)||A8($).length>0}function j8($){let J=J0.parse({...$,apiOrigin:e0($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)m0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function z8($){if($ instanceof Y0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as yQ,lstatSync as p4,readdirSync as E8,readlinkSync as fQ,unlinkSync as hQ}from"fs";import{join as O0,sep as mQ}from"path";var I2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function S8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),G=O0(Z,"reason",...X),V=(H,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:H,...U?{code:`worker_state_rehome_${H}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?Y$():$.native,N=$.saved,q=[];try{if(N&&C8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:G};if(!d4(K,G,j,q))return J;return R8(N,j,$.host,V)}if(N&&C8(Q)&&N.stateDirectory===G&&f9(N)&&d4(K,G,N,q))return w8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!G$(Q)?.isDirectory())return J;if(pQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,I2),{version:r});return V("skipped",j),J},M=[Y];for(let j of gQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!vQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!d4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(P8(Z)!==null)return U("conflicting_identity");if(I8(Z)!==null)return U("conflicting_files");if(G$(G)&&(!G$(G).isDirectory()||E8(G).length>0))return U("connection_folder_taken");S$(N,T.devicePublicKey),f4.before(N);let _=p0(Y);if(_&&l4(Y))uQ(G,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&l4(Y))b8(G);return U(D.problem??"config_folder_kept")}return R8(N,{...N,stateDirectory:G},$.host,V)}catch(H){try{if(G$(Y)?.isDirectory())c(O0(Y,I2),{version:r})}catch{}return V("failed",cQ(H)),lQ(N,Y,G,J)}finally{for(let H of q.reverse())H()}}function R8($,J,Z,Q){let X=p4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)yQ(J.stateDirectory,448);let Y=T0(J),G=h1(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new x2("identity_missing");let V=U0(J);if(G.worker.configDigest===U0($))m0({...G,worker:{...G.worker,configDigest:V}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==V)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),f4.after($,J),w8($,J,Z);let K=O0(J.stateDirectory,I2);if(u(K))hQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function w8($,J,Z){if(x8($,J,Z,"connect"),!l4(J.stateDirectory))return;let Q=dQ(O1($.stateDirectory));if(!Q)return;let X=O1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);b8($.stateDirectory)}function d4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Q1({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function vQ($,J,Z){if(u(g(J))){let X=Q1({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=G$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function gQ($,J){let Z=[$,...E8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=O0(X,Y);if(G===J||!G$(O0(G,"worker.json")))continue;let V=k8(G);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+mQ))Q.push({directory:G,config:V})}return Q}function l4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function uQ($,J){let Z=O1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function b8($){try{O1($).deleteBinding()}catch(J){if(!(J instanceof Y0))throw J}}function dQ($){try{return $.loadBinding()}catch(J){if(J instanceof Y0)return null;throw J}}function lQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=k8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function C8($){try{return p4($).isSymbolicLink()&&fQ($)==="reason"}catch{return!1}}function pQ($){try{let J=JSON.parse(s(O0($,I2)));return typeof J.version==="string"?J.version:null}catch{return null}}function k8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function G$($){try{return p4($)}catch{return null}}function cQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof Y0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as sQ}from"fs";function S2($){try{let J=JSON.parse(sQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function y8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as IK}from"crypto";import{readdirSync as xK,realpathSync as VJ,statSync as EK}from"fs";import{hostname as SK}from"os";import{join as r1,resolve as wK}from"path";var w2="cloud",aQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function u$($){return aQ.test($)&&!f8.test($)}var iQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function B$($){return iQ[$]}import{chmodSync as nQ,lstatSync as k2,mkdtempSync as rQ,realpathSync as g8,rmdirSync as tQ,rmSync as oQ,unlinkSync as eQ}from"fs";import{createConnection as $X,createServer as JX}from"net";import{basename as h8,dirname as m8,join as g1}from"path";var ZX=B.enum(["status","drain","resume","stop","reload_roots"]),QX=B.strictObject({version:B.literal(1),instanceId:B.string(),deviceId:B.string(),phase:B.enum(["starting","running","reconnecting","stopping"]),drained:B.boolean(),activeClaims:B.number().int().nonnegative(),activeSessions:B.number().int().nonnegative().optional(),executionEligible:B.boolean(),supportedOperations:B.array(B.enum(b2)).max(b2.length).optional(),capabilityReadiness:B.partialRecord(B.enum(b2),B.boolean()).optional(),lastHeartbeat:B.string().nullable(),expiresAt:B.string()}),XX=B.strictObject({nonce:B.string(),action:ZX}),YX=B.object({nonce:B.uuid()}),u8=B.strictObject({version:B.literal(1),nonce:B.uuid(),socketPath:B.string().max(100)});function d8($){return g1(d($).lock,"control.json")}function y2($){return e(d($).lock),YX.parse(JSON.parse(s(g1(d($).lock,"owner.json"))))}function v8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function l8($,J){let Z=d8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return v8(Y)?Y:null}let Q=u8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=m8(Q.socketPath);if(m8(X)!==g8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(h8(X))||h8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),v8(Q.socketPath)?Q.socketPath:null}async function f2($,J,Z){if(y2($).nonce!==J)throw Error("worker_instance_changed");let Q=d8($);if(u(Q))throw Error("worker_control_already_serving");let X=rQ(g1(g8("/tmp"),"ara-worker-")),Y=g1(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,V=JX((H)=>{G.add(H),H.once("close",()=>G.delete(H)),H.setTimeout(2000,()=>H.destroy());let U="",M=!1;H.on("error",()=>H.destroy()),H.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){H.destroy();return}if(!U.includes(`
19
+ `))return;M=!0;try{let _=XX.parse(JSON.parse(U));if(_.nonce!==J){H.destroy();return}H.end(JSON.stringify(Z(_.action))+`
20
+ `)}catch{H.destroy()}})});V.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let H of G)H.destroy();if(await new Promise((H)=>V.close(()=>H())),K&&u(Q)){let H=k2(Q);if(H.isFile()&&H.dev===K.dev&&H.ino===K.ino)try{let U=u8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)eQ(Q)}catch{}}try{tQ(X)}catch{}};try{if(await new Promise((H,U)=>{V.once("error",U),V.listen(Y,()=>{nQ(Y,384),H()})}),y2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(H){throw await q(),H}}function p8($,J){try{let Z=JSON.parse(s(g1(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function d$($){return p8($,"runtime_version")}function GX($){return p8($,"nonce")}function c8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(g1(d($).lock,"owner.json")))return"no_lock";return l8($,y2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var BX=21600000,KX=B.strictObject({instance:B.string().nullable(),since:B.number().int().nonnegative()});function VX($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=KX.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{oQ(d($).updateDeferral,{force:!0})}catch{}}async function h2($,J,Z=()=>!1){let Q=GX($),X=VX($,Q);if(J!==void 0){let N=d$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),V=X;if(V===null){V=G;try{c(d($).updateDeferral,{instance:Q,since:V})}catch{}}let K=G-V;return{state:K<BX?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=d($);if(!u(g1(Z.lock,"owner.json")))return null;let Q=y2($),X=l8($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let V=$X(X),K="",N=!1,q=(H,U)=>{if(N)return;if(N=!0,V.destroy(),U)G(U);else Y(H)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
21
+ `)),V.on("data",(H)=>{if(K+=H.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(H)=>{if("code"in H&&["ECONNREFUSED","ENOENT"].includes(String(H.code)))q(null);else q(null,H.message==="worker_control_timeout"?H:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let H=QX.parse(JSON.parse(K));if(H.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(H)}catch{q(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as NB}from"crypto";import{homedir as N7}from"os";import{spawn as HX}from"child_process";async function s8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),V=(H)=>{if(Q===H)return;Q=H,J.onStatusChange?.(H)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let H=(J.spawn??HX)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=H,H.once("exit",()=>{if(!X&&Z===H)V("failed"),K()}),await new Promise((U,M)=>{H.once("spawn",U),H.once("error",M)}),H.exitCode===null&&H.signalCode===null)V("held")}catch{V("failed"),K()}};G=N(),await G;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await G;let H=Z;if(!H||H.exitCode!==null||H.signalCode!==null||!H.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{H.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);H.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{H.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class m2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as TX}from"fs";import{constants as s4}from"fs";import{open as NX}from"fs/promises";import{join as UX}from"path";var qX={platform:process.platform,home:V0,async openFile($){let J=await NX($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function a8($=qX){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(UX($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function MX($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function i8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await MX($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?l$(X.status):p$(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var _X=1000,FX=250,WX=H5(TX(process.execPath)),n8=null,r8=null;function N5($){if(process.platform!=="darwin")return{};return r8??=a8().then((J)=>{n8={status:J,checkedAt:$().getTime()}}).finally(()=>{r8=null}),{fullDiskAccess:{...n8??{status:"unknown",checkedAt:$().getTime()},executablePath:WX}}}var t8=8,LX=2000,DX=2000,G3=8000,o8=3,jX=250,e8=1000,$5=30000,zX=0.2,OX=30000,AX=21600000,RX=300000,CX=3600000,PX=0.1,U5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function IX($){return Math.min(o8,Math.max(1,$??o8))}function xX($){return typeof $.reason_code==="string"&&U5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof v0&&($.reason.code==="cancelled"||U5.has($.reason.code))?$.reason.code:"cancelled"}function J5($){return $ instanceof v0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function q5($){return $.capability==="hands.connect"&&(B5($.payload)||G5($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*PX)))}function EX($,J=Math.random){let Z=Math.min($5,e8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*zX*(Q*2-1);return Math.min($5,Math.max(e8,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function SX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function r0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function wX($){if($ instanceof g2||$ instanceof K$||$ instanceof s$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function c$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(r0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:wX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)c$($,J,Q);throw Q}}class s$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,H,U=new Promise((_,D)=>{let j=()=>{let F=new s$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(H=()=>z(Math.max(0,Math.min(N-performance.now(),LX))),z(K),$.signal.addEventListener("abort",H,{once:!0}),$.signal.aborted)H()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),U]);break}catch(_){if(G.aborted||$.signal.aborted||E0(_)||r0(_)||!bX(_)||performance.now()>=N)throw c$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw c$($,"completion",_),_;try{await V(D,G)}catch{throw c$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",H),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function bX($){if(E0($))return!1;if(r0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof s$)return!1;return!0}return!1}class g2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function v2($){if($ instanceof g2)return!0;return $ instanceof _0?l$($.status):p$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function kX($,J,Z,Q,X){let Y=new AbortController,G,V=()=>{return},K=new Promise((q,H)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),H(M)};if(V=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,H)=>{G=setTimeout(()=>{let U=new g2;Y.abort(U),H(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);V()}}async function Z5($,J,Z,Q,X,Y){let G=IX($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??jX,N=Y.remainingMs(),q=Math.min(N,G*V+K*G*(G-1)/2);for(let H=0;H<G;H+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(V,Y.remainingMs()),M=await kX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:H},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||H+1>=G||r0(U)||E0(U)||!v2(U)){if(!Q.aborted)c$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(H+1),q*(H+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function yX($,J,Z,Q,X){let Y=q5(J),G=new AbortController,V=new AbortController,K=()=>{G.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,H,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,R={},x=(S)=>{j=!0,D.abort(S),G.abort(S),V.abort(S)},C=(S)=>{if(z)return z;let y=structuredClone(S),l=M;return z=(async()=>{let k=new AbortController,I=k.signal;I.throwIfAborted();let E,A=()=>{},b=new Promise((w,n)=>{if(A=()=>n(I.reason),I.addEventListener("abort",A,{once:!0}),E=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),I.aborted)A()});try{for(let w=0;w<3;w+=1){I.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[y],signal:I,transientRetryOwner:"caller"})),b]);if(I.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(E0(n))X(n);let o=n instanceof _0?l$(n.status):p$(n);if(I.aborted||!o||w===2)throw n;let N0=Math.max(500*2**w,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,I),b])}}}finally{clearTimeout(E),I.removeEventListener("abort",A),k.abort()}})(),z},P=(S,y,l)=>{let k=(E)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:y,events:S,signal:E,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&r0(A))x(A);if(l&&(E0(A)||r0(A))){if(E0(A))X(A);G.abort(A),V.abort(A),D.abort(A)}throw A});if(!l)return async(E)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(E)).next_event_seq;return}E.throwIfAborted();let A=()=>{},b=new Promise((w,n)=>{A=()=>n(E.reason),E.addEventListener("abort",A,{once:!0})});try{let w=await Promise.race([k(E),b]);E.throwIfAborted(),M=w.next_event_seq}finally{E.removeEventListener("abort",A)}};let I=i8({send:k,lease:L,sleep:Z,retryAfterMs:(E)=>J3(E,($.now?.()??new Date).getTime())});return async(E)=>{let A=await I(E);if(A.next_event_seq!==y+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,y)=>{let l=S??await Z5($,J,{controlAckSeq:U,waitMs:y},V.signal,Z,L),k=null,I=!1;for(let E=0;E<10;E+=1){let A=U+1;for(let b of l.controls){if(b.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(b.kind==="cancel"||b.kind==="operation.cancel")k??=xX(b.payload),G.abort(new v0(k,"Reason closed the Device operation."));if(b.kind!=="cancel"&&b.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let w,n,o=new Promise((N0,j0)=>{w=N0,n=j0});o.catch(()=>{}),R.current={promise:o,resolve:w,reject:n}}try{I||=!await $.onControl?.(J,b)}catch(w){if(w instanceof v0)q??=J5(w);throw R.current?.reject(w),w}}U=b.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:I}}try{l=await Z5($,J,{controlAckSeq:U},V.signal,Z,L),R.current?.resolve()}catch(b){if(R.current?.reject(b),!k||r0(b)||E0(b))throw b;return{cancellationReason:k,unsupported:I}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)L=new m2(J.lease_until,()=>($.now?.()??new Date).getTime(),(y)=>{if(!G.signal.aborted)N=y;G.abort(y),V.abort(y)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(y){if(!e4(J)||r0(y)||E0(y))throw y;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let y=S.cancellationReason??i4($.signal);G.abort(new v0(y,"Reason closed the Device operation.")),H={status:"cancelled",error_code:y}}else if(S.unsupported)G.abort(),H={status:"failed",error_code:"control_unsupported"};else{let y=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?DX:15000),I=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),E=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!E){if(await Z(k,V.signal),V.signal.aborted)return}let A=await h(void 0,E?I:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new v0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(E0(A))X(A);if(r0(A))N=A,x(A);if(!V.signal.aborted)N=A,G.abort();return}})();try{if(L?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(L?.remainingMs()??0)>0),H=await $.onClaim(J,G.signal,async(k)=>{if(e4(J))return;let I=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",E=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=E||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,D.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,b={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:E?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:b,settle:(j0)=>j0===void 0?o():N0(j0)})});let w=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(I)await C(b);return}if(F!==null){if(k.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),L1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await P([b],M,!0)(j0),F=null}catch(D1){throw F=D1??Error("Hands stop receipt could not be confirmed."),D1}finally{clearTimeout(L1),N0.abort()}return}if(E&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new m2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{G.abort(j0),V.abort(j0)})}let o=M;if(E)W=P([...w.map((N0)=>N0.wireEvent),b],o,!0),await W(A),W=void 0;else await P([...w.map((N0)=>N0.wireEvent),b],o,!1)(A)});n.then(()=>{for(let o of w)o.settle()},(o)=>{for(let N0 of w)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(E0(o))X(o);if(E){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),V.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(k){H=G.signal.aborted?{status:"cancelled",error_code:i4(G.signal)}:{status:"failed",error_code:J5(k)}}finally{Q.authorized=()=>!1,D.abort();for(let k of _.splice(0))k.settle();V.abort(),await y}let l=X5(J.capability)?Y5(H.result,J.operation_id):null;if(N){if(E0(N))throw N;H={status:"failed",error_code:q??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&H.status==="succeeded")H={status:"cancelled",error_code:i4(G.signal),...l?{result:l}:{}}}if(L?.close(),E0($.signal.reason))throw $.signal.reason;await $3($,J,H)}finally{L?.close(),D.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??y$,Y=$.statusPath??Q3(),G=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...N5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),q=0,H,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),V5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??s8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await fX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,H=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(E0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=EX(q,$.reconnectRandom);H??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:H},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function fX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??y$,G=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let H=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(t8,U):t8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,X0=0;for(let{claim:w1}of z.values()){let H1=w1.capability==="hands.connect"?w1.payload[Q5]:void 0;if(typeof H1==="string"){if(v.has(H1))continue;v.add(H1)}X0+=1}return X0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(G).getTime()+n4(K.initialDelayMs??OX,H):Number.POSITIVE_INFINITY,x=null,C=!1,P=$.firstHeartbeat,h=P?.account_root_metadata_supported===!0,S=P?.workspace_root_metadata_supported===!0,y=P?.account_root_path_supported===!0,l=P?.home_contained_roots_supported===!0,k=P?.root_paths_supported===!0,I=P?.startup_supported===!0,E=P!==void 0,A=P?{challenge:P.challenge,expires_at:P.expires_at}:void 0,b,w=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...N5(J),...V?{lastUsedAt:V}:{},...x?{organizationId:x.organization_id,organizationName:x.organization_name,organizationSlug:x.organization_slug}:{}}),o=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!w)b??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...I&&!w&&b?{startup:b}:{},capabilities:v?K5($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:y,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},N0=()=>{if(C||!$.client.identity)return;C=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;x=v;let X0=Y(Q);if(!X0)return;X({...X0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,y=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,I=v.startup_supported===!0,E=!1},L1=(v)=>{if(v.startup)w=!0},D1=(v,X0)=>{if(!(X0 instanceof _0&&X0.status===400&&X0.code==="invalid_heartbeat")||!v.startup&&!E)throw X0;if(w=!0,E)h=S=y=!1,l=k=I=E=!1;return null},O$=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},E1=!1,t1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(E1)t1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((X0)=>D1(v,X0))).then((X0)=>{if(!X0)return;L1(v),j0(X0),O$(X0)},()=>{return})});let j1=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let K1=!1,S1=$.maxConsecutiveHeartbeatFailures??3,V1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,X0=o(),w1=A;A=void 0,E1=!0,t1=!1;try{let i=await V$($,"heartbeat",()=>$.client.heartbeat($.state,X0,N.signal,...w1?[w1]:[]).catch((K0)=>D1(X0,K0)));if(E1=!1,!i)continue;v=i,L1(X0),V1=0}catch(i){if(E1=!1,$.signal.aborted)break;if(!v2(i))throw i;if(V1+=1,V1>=S1&&!W())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(X0.capabilities).length)continue;if(t1)continue;if(O$(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let i=new AbortController,K0=()=>i.abort($.signal.reason);if($.signal.aborted)K0();else $.signal.addEventListener("abort",K0,{once:!0});let R0;try{R0=K.check(i.signal)}catch(C0){R0=Promise.reject(C0)}let N1=R0.then((C0)=>({kind:"completed",result:C0}),(C0)=>({kind:"failed",error:C0})),o1;try{while(!0){let C0=await SX(N1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(C0.kind==="failed")throw new r4(C0.error);if(C0.kind==="completed"){o1=C0.result;break}try{let S0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,S0,N.signal).catch((H2)=>D1(S0,H2)));if(!R$)continue;v=R$,L1(S0),O$(v),V1=0}catch(S0){if($.signal.aborted)throw S0;if(!v2(S0))throw S0;if(V1+=1,V1>=S1&&!W())throw S0}}}catch(C0){i.abort(C0);let S0=await N1;if(S0.kind==="completed"&&S0.result==="activated")o1="activated";else throw C0}finally{$.signal.removeEventListener("abort",K0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,o1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+n4(K.intervalMs??AX,H)}catch(i){if(!(i instanceof r4))throw i;T+=1;let K0=K.retryBaseMs??RX,R0=K.retryMaxMs??CX,N1=Math.min(R0,K0*2**Math.min(T-1,8));R=J().getTime()+n4(N1,H)}if($.signal.aborted)break;if(_&&L())break;if(_){await j1($.heartbeatIntervalMs??15000);continue}let H1=$.client.sessionCadence?.($.state)??null,b1=H1?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await j1(b1);continue}if(F()>=M){let i=new AbortController;O=i;try{await Z(b1,AbortSignal.any([$.signal,i.signal]))}catch(K0){if(!i.signal.aborted)throw K0}finally{if(O===i)O=null}continue}let g0,A$=H1?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),f=performance.now();try{g0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:A$,signal:N.signal}))}catch(i){if($.signal.aborted||!v2(i)||!W())throw i;await j1(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!g0){if(performance.now()-f<A$-FX)await j1(_X);continue}if($.claimable?.()===!1){await $3($,g0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:g0.operation_id,runId:g0.run_id,attemptId:g0.attempt_id,capability:g0.capability});let a,q0={authorized:()=>!1,claim:g0};if(a=yX({...$,signal:N.signal},g0,Z,q0,j).catch((i)=>{if(E0(i))j(i);else if(!r0(i)&&[...z].some(([K0,R0])=>K0!==a&&R0.authorized())){if(i instanceof s$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!r0(i)&&D===null)D=i}).finally(()=>{z.delete(a),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(a,q0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),q5(g0)){if(await a,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),K1=!0;let X0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:X0},Q),$.onEvent?.({type:"error",message:X0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!K1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as qY}from"child_process";import{constants as v5,existsSync as MY,mkdtempSync as r5,rmSync as TY}from"fs";import{access as g5,open as _Y,readFile as u5,readlink as FY,readdir as d5,unlink as WY,rmdir as LY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as u1}from"crypto";import{chmodSync as hX,closeSync as mX,fsyncSync as vX,openSync as gX,readFileSync as uX,rmdirSync as M5,unlinkSync as F5,writeFileSync as dX}from"fs";import{createConnection as lX,createServer as pX}from"net";import{dirname as cX,join as sX}from"path";var aX=5000;async function W5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:u1()},X={runId:u1(),deviceId:u1(),rootId:u1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=_5(J,X),G={version:1,snapshot_id:u1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{F5(Y.path)}catch{}}}async function L5($,J,Z=T5){if(J.aborted)return!1;let Q,X,Y=new Set,G=u1(),V=pX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(G)});V.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),H=setTimeout(N,aX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${u1()}`}),X=sX(Q.journalDirectory,"readiness.json");let U=gX(X,"wx",384);try{dX(U,G),vX(U)}finally{mX(U)}if(uX(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{hX(Q.socketPath,384)}catch{T(!1);return}K=lX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(H),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>V.close(()=>U())),Q?.disposeSocket(),X)try{F5(X)}catch{}if(Q){try{M5(Q.journalDirectory)}catch{}try{M5(cX(Q.journalDirectory))}catch{}}}}import{spawn as iX}from"child_process";import{randomUUID as d1}from"crypto";import{basename as nX}from"path";import{fileURLToPath as rX}from"url";function tX(){let $=nX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",rX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function z5($,J,Z=tX()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=iX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>G.once("close",()=>{V=!0,F()}));G.on("error",X);let N,q,H=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
22
22
  `)){let O=T.indexOf(`
23
- `),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([H,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=d1(),L={organizationId:d1(),userId:d1(),runId:d1(),deviceId:d1(),rootId:d1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:d1(),port:F.port,expiresAtMs:O},R={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:W}}},x=D5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});j=await L5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:x,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),G.stdin.destroy(),!V)G.kill("SIGKILL");await K}return z&&V}import{execFileSync as d2}from"child_process";import{randomUUID as p0}from"crypto";import{chmodSync as z5,chownSync as y5,closeSync as V3,constants as M1,existsSync as cX,fstatSync as f5,mkdirSync as O5,mkdtempSync as sX,openSync as H3,readFileSync as aX,readSync as iX,realpathSync as nX,rmdirSync as rX,rmSync as tX}from"fs";import{join as l1}from"path";import{fileURLToPath as oX}from"url";var A5=1e4,eX=!1;function l2(){if(process.platform!=="linux")return!1;return eX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=d2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var $Y=Buffer.from([0,255,3,4]);function R5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function JY($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function a$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=u2(),{directory:Q,root:X,runtimeDirectory:Y}=XY(Z),G=new AbortController,V=()=>G.abort();$.addEventListener("abort",V,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,A5),q={organization_id:p0(),user_id:p0(),device_id:p0()},H=p0(),U=p0(),M=p0(),T=p0(),_=Date.now()+A5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=p0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,R=!1,x=!1,C,I,h,S=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},y=!1;try{K=ZY(Q,Z),C=Bun.serve({hostname:"127.0.0.1",port:0,fetch(P,E){let A=new URL(P.url).pathname,b=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(b&&E.upgrade(P,{data:{lane:b}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(P){if(P.data.lane==="pty")z=P},message(P,E){if(P.data.lane!=="pty")return;if(typeof E==="string"){try{if(JSON.parse(E).t==="open")W=!0}catch{V()}return}if(F.length+E.length>8192){V();return}F=Buffer.concat([F,E])}}});let l=`ws://127.0.0.1:${C.port}`;if(I=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:H,operationId:p0(),attemptId:p0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:C5,hands_worker_version:x5,hands_worker_artifact_sha256:S5,hands_worker_entrypoint:E5,target_generation:1,target_fence_id:M,environment_binding:D,[w5]:b5},emitEvent:async(P)=>{if(P==="hands.started")x=!0;if(P==="hands.ready")L=!0;if(P==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:k5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:oX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)V()}),await S(()=>L),I5({root:X,runId:H,payload:{version:1,snapshot_id:T,revision:1,run_id:H,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),h=P5({root:X,runId:H,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${p0()}`,sessionId:"pty-readiness",operationId:p0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${j}`},emit:async(P,E)=>{if(P==="pty.ready")O=E}}).catch(()=>{V()}),await S(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${R5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${R5("foreground")}; ${K.wait("foreground")}'
24
- `)),await S(()=>cX(l1(X,"foreground.pid"))&&F.includes($Y)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((P)=>QY(l1(X,P)));if(new Set(k).size!==2||k.some((P)=>!Number.isSafeInteger(P)||P<2||P===O.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((P)=>JY(aX(`/proc/${P}/stat`,"utf8"),P,O.job.process.pid)))return!1}else{let E=d2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
25
- `).map((A)=>A.trim().split(/\s+/).map(Number));if(E.length!==2||new Set(E.map(([A])=>A)).size!==2||E.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await h,G.signal.aborted)return!1;for(let P of[O.job.process.pid,...k])try{return process.kill(P,0),!1}catch(E){if(!(E instanceof Error&&("code"in E)&&E.code==="ESRCH"))return!1}y=!0}catch{y=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await I,await C?.stop(!0),!x||R)YY({directory:Q,root:X},Z)}return y&&R&&!$.aborted}function ZY($,J){let Z={foreground:l1($,"foreground.lifeline"),background:l1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");d2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let G=H3(Y,M1.O_RDONLY|M1.O_NONBLOCK|M1.O_NOFOLLOW);try{if(Q.push(H3(Y,M1.O_WRONLY|M1.O_NONBLOCK|M1.O_NOFOLLOW)),!f5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(G)}if(J)y5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function h5($=(J)=>a$(J)){let J=new AbortController,Z=JSON.stringify(u2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(u2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function QY($){let J;try{J=H3($,M1.O_RDONLY|M1.O_NOFOLLOW|M1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=f5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=iX(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function XY($,J=nX("/tmp")){let Z=sX(l1(J,"reason-pty-probe-")),Q=l1(Z,"workspace"),X=l1(Z,"private");if(O5(Q,{mode:448}),O5(X,{mode:448}),$)z5(Z,493),z5(Q,493),y5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function YY($,J){if(J)try{d2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),rX($.root)}catch{return}tX($.directory,{recursive:!0,force:!0})}var r5=5000,p1="ARA_WORKER_PROBE_READY";function qY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{GY($,J,{cwd:Z,env:Q,signal:X,timeout:r5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,V)=>Y(!G&&!X.aborted&&V===p1))})}function MY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function TY($,J){let Z=l5({home:J,temporaryDirectory:J}),Q=(Y,G,V)=>qY(Y,G,$.workspaceRoot,Z,V),X=async(Y,G,V,K=(q)=>q===p1,N=!1)=>{let q=await $6(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:r5,signal:V});return!V.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await v5($.workspaceRoot,m5.R_OK),await u5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await v5($.workspaceRoot,m5.W_OK),Y.aborted)return!1;let G=n5(M3($.workspaceRoot,".ara-worker-probe-")),V=M3(G,"receipt");try{let K=await VY(V,"wx",384);try{await K.writeFile(p1),await K.sync()}finally{await K.close()}return await g5(V,"utf8")===p1&&!Y.aborted}finally{await NY(V).catch(()=>{}),await UY(G).catch(()=>{})}},confinedShell:(Y)=>X(e5(),["-c",`printf ${p1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
26
- `)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,V,K]=await Promise.all([HY("/proc/self/cwd"),u5("/proc/self/fd"),g5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${p1}`],Y),jobs:(Y)=>W5($,Y),environment:(Y)=>F5($,J,Y),preview:(Y)=>j5(J,Y),boundPty:(Y)=>a$(Y),desktopDisplay:()=>o5(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
27
- `);return i5()},desktopBrowser:async()=>n$()?.features.browser===!0,fullControlShell:(Y)=>{let G=s5(),V=MY(G,`printf ${p1}`);return V?Q(G,V,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&n$()?.features.computer===!0?a5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function _Y($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return i$($,J,Z,Q,X).final}function i$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,G){let V,K;try{if(U1($),u0(),!J)e(g($),!0),V=n5(M3(g($),"probe-")),J=TY($,V);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",H=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(G).then(()=>Promise.all(q?[N("preview"),H,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,R,x,C,I]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!R||!x||!C)&&!G)await U;if(q){if(!R)R=await N("bash");if(!x)x=await N("jobs");if(!C)C=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:R,jobs:x,environment:C,full:I}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:R,processes:x,bash:C,jobs:I,environment:h,full:S}=z,{preview:y,boundPty:l,desktopDisplay:k,desktopAutomation:P,desktopBrowser:E}=F,A=p5(),b=q&&process.platform==="darwin"&&S&&BY("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&R&&X,"process.list":(process.platform==="linux"||L)&&x,"ports.list":(process.platform==="linux"||L)&&x,"exec.full":C&&S&&X,"hands.connect":O&&W&&C&&I,"jobs.control":O&&W&&C&&I,"pty.start":O&&W&&C&&I&&h&&l,"environment.install":O&&W&&C&&I&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&C&&I&&h,"tunnel.open":O&&W&&C&&I&&h&&y,"tunnel.close":O&&W&&C&&I&&h&&y,"preview.serve.v1":O&&C&&I&&y&&S,"display.stream.v1":k,"automation.call.v1":P,"simulator.call.v1":b,"simulator.stream.v1":b,"browser.pr-proof.v1":P&&E&&d5()===null,"workspace.setup.v1":q&&c5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([H,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,R]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:R})}finally{if(V)KY(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await H||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var FY=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],WY=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return FY.filter((Z)=>J[Z]!==!0)}function t5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>_Y($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
28
- `),(async()=>{for(let Y of $.delaysMs??WY){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=q3($.config,Q).filter((K)=>G[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
29
- `),$.onReady(Q,V);if(q3($.config,Q).length===0)return}})()}import{execFile as TG}from"child_process";import{createHash as _G,randomUUID as b3}from"crypto";import{lstat as FG,readdir as h6,readFile as p6,realpath as WG,stat as LG}from"fs/promises";import{basename as DG,join as S3}from"path";import{promisify as jG}from"util";import{createConnection as LY}from"net";import{endianness as Q6}from"os";var r$=4,W3=1e4;class C1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=LY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=DY({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(G),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=r$){let J=Q6()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=r$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(r$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!r0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),r0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class p2{client;cdp;constructor($){this.client="client"in $?$.client:new C1($),this.cdp=new G6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=jY(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new X6(this,$)}getTabs(){return this.client.getTabs()}}class X6{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new Y6(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class Y6{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class G6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(r0(Q)&&r0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return r0(Q)&&r0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";J6(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(r0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if(Z6(K,Q))return;throw V}),G}async waitForLoadState($,J={}){let Z=J.state??"load";J6(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(Z6(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return r0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let G=!1,V=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(H){if(N())Y(H instanceof Error?H:Error(String(H)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=zY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function DY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(r$+J.length);if(Q6()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,r$),Z}function r0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function jY($,J){if(!r0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function J6($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function Z6($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function zY($,J){if($.method!=="onCDPEvent"||!r0($.params))return null;let Z=$.params.source;if(!r0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as OY}from"crypto";function B6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${OY("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as UG}from"async_hooks";import{isDeepStrictEqual as y6}from"util";import{createHash as qG}from"crypto";var AY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var RY=new Set(["png","jpg","jpeg","gif","webp"]),CY=new Set(["webm","mp4"]);function IY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function K6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=IY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=AY.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!V||!K||!N)return null;let q=RY.has(N)?"image":CY.has(N)?"video":null;if(!q)return null;let H=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:G,artifactId:V,fileName:`${K}.${N}`,kind:q,phase:H?.[1]==="before"||H?.[1]==="after"?H[1]:null}}var PY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,c2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),c1=()=>{throw Error("cloud_browser_media_request_invalid")};function s2($){if(!c2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!PY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return c1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return c1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!V6(J.origin,{mode:"public_web"}).allowed)return c1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!c2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return c1();let G=K6(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return c1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return c1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return c1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function H6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!c2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!c2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=B.string().uuid(),H$=B.string().regex(/^[a-f0-9]{64}$/),a1=B.iso.datetime({precision:3}),D3=B.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),U6=B.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),c0=B.object({kind:B.literal("primary_mac"),version:B.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:B.string().min(1).max(64),binding:B.enum(["workspace_source","mcp_control"]),targetRevision:B.number().int().nonnegative(),generation:L0,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),xY=B.custom().transform(($,J)=>{try{return N6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),B.NEVER}}),N$=B.object({version:B.literal(1),owner:c0,contextId:L0,preparedAt:a1,expiresAt:a1,prUrl:U6,headSha:B.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:B.enum(["image","video"]),visualPlan:xY.optional(),uploadOrigin:B.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=B.object({version:B.literal(1),producer:B.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:B.number().int().positive(),startedAt:a1,finishedAt:a1,sha256:H$,media:B.discriminatedUnion("contentType",[B.object({contentType:B.literal("image/png"),sizeBytes:B.number().int().min(24).max(8388608),width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096)}).strict(),B.object({contentType:B.literal("video/webm"),sizeBytes:B.number().int().min(128).max(10485760),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),NM=B.discriminatedUnion("action",[B.object({action:B.literal("screenshot"),context_id:L0,tab_id:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),context_id:L0,tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("stop_video"),recording_operation_id:L0}).strict()]),i2=B.object({login:B.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:B.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),a2=B.string().regex(/^[1-9][0-9]{0,19}$/),t$=B.object({version:B.literal(1),owner:c0,expectedActorId:a2.nullable(),repositoryId:a2,repositoryFullName:B.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),EY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=B.discriminatedUnion("status",[t$.extend({status:B.literal("ready"),observedActor:i2,checkedAt:a1}),t$.extend({status:B.literal("not_ready"),reason:B.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:B.enum(EY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),s1=B.object({version:B.literal(1),owner:c0,expectedActorId:a2.nullable(),authenticatedActor:i2,attemptId:L0,captureId:L0,prUrl:U6,repositoryId:a2,headSha:B.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:B.number().int().min(128).max(10485760),contentType:B.literal("video/webm")}).strict(),q6=B.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=B.discriminatedUnion("status",[s1.extend({status:B.literal("not_attempted"),reason:B.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),s1.extend({status:B.literal("uncertain"),reason:B.literal("upload_outcome_unknown")}),s1.extend({status:B.literal("uploaded"),observedActor:i2,nativeUrl:q6,uploadedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),o$=s1.extend({nativeUrl:q6,observedActor:i2,bodySha256:H$}),A3=B.discriminatedUnion("status",[o$.extend({status:B.literal("incomplete"),reason:B.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),o$.extend({status:B.literal("verified"),sourceSha256:H$,width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096),durationSeconds:B.number().positive().max(30),advancedSeconds:B.number().min(0.05).max(10),advancedFrames:B.number().int().positive(),playbackRestored:B.literal(!0),verifiedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),SY=B.custom().transform(($,J)=>{try{let Z=s2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),B.NEVER}}),wY=B.discriminatedUnion("action",[B.object({action:B.literal("auth_check"),input:t$}).strict(),B.object({action:B.literal("prepare"),context:N$}).strict(),B.object({action:B.literal("capture_png"),owner:c0,contextId:L0,tabId:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),owner:c0,contextId:L0,tabId:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("inspect_capture"),owner:c0,captureId:L0}).strict(),B.object({action:B.literal("publish_video"),input:s1}).strict(),B.object({action:B.literal("verify_png_media"),owner:c0,media:SY}).strict().refine(($)=>$.media.runId===$.owner.runId),B.object({action:B.literal("verify_saved_media"),input:o$}).strict(),B.object({action:B.literal("publish_png"),owner:c0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:B.number().int().min(24).max(8388608),storagePath:B.string().max(512),uploadUrl:B.string().url().max(8192)}).strict()]);var M6="pr-proof.stop.v1",R3=B.object({requestId:L0,command:wY}).strict();import{createHash as bY,randomUUID as kY}from"crypto";import{isDeepStrictEqual as q$}from"util";var T6=B.object({operationId:B.string().uuid(),attemptId:B.string().uuid(),contextId:B.string().uuid(),tabId:B.number().int().positive()}).strict(),B0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>bY("sha256").update($).digest("hex");function _6($){let J=c0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw B0();if(await $.assertCurrent(),X)throw B0()},G=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw B0();return M},V=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,B0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>V(D)))).some((D)=>D.status==="rejected"))throw B0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function H(U,M){let T=T6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw B0();await Y(),U.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw B0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw B0();let x=await D.completion;if(await Y(),G(T.contextId),D.controller.signal.aborted)throw B0();return structuredClone(x)}if(Q.size>=16||[...Q.values()].some((x)=>!x.receipt&&!x.controller.signal.aborted&&x.claim.tabId===T.tabId))throw B0();let j,z,F=new Promise((x,C)=>{j=x,z=C});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{V(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),G(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},R;try{await L();let x;if(M==="image"){let C=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let I=new Date().toISOString();if(await L(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw B0();x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:kY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C,finishedAt:I,sha256:C3(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),B0();await O.host.start(),O.started=!0;let C=O.host.completed();if(C.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let I=await C;if(O.stop)await O.stop;await L();let h=await O.host.read(I.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(I,h.capture)||!q$(I.owner,S)||R.length!==I.sizeBytes||C3(R)!==I.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw B0();await O.host.close(),await L(),x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((C,I)=>C+(I.bytes?.length??0),R.length)>20971520)throw B0();return O.bytes=Buffer.from(R),O.receipt=x,j(x),structuredClone(x)}catch(x){let C=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&x instanceof Error&&x.message==="mac_recording_worker_failed:no_frames"?new v0("proof_capture_no_frames","The owned tab emitted no recording frames."):B0();throw await V(O).catch(()=>{}),z(C),C}finally{R?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw B0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw B0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw B0();return structuredClone(T)}if(Z.size>=4)throw B0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>H(U,"image"),record:(U)=>H(U,"video"),async stop(U){let M=T6.parse(U);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw B0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw B0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw B0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw B0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw B0()}}}import{createHash as D6,randomUUID as lY}from"crypto";import{isDeepStrictEqual as e$}from"util";import{realpath as pY}from"fs/promises";var F6=String.raw`async (media) => {
23
+ `),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([H,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=d1(),L={organizationId:d1(),userId:d1(),runId:d1(),deviceId:d1(),rootId:d1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:d1(),port:F.port,expiresAtMs:O},R={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:W}}},x=j5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});j=await D5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:x,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),G.stdin.destroy(),!V)G.kill("SIGKILL");await K}return z&&V}import{execFileSync as d2}from"child_process";import{randomUUID as c0}from"crypto";import{chmodSync as O5,chownSync as f5,closeSync as V3,constants as T1,existsSync as oX,fstatSync as h5,mkdirSync as A5,mkdtempSync as eX,openSync as H3,readFileSync as $Y,readSync as JY,realpathSync as ZY,rmdirSync as QY,rmSync as XY}from"fs";import{join as l1}from"path";import{fileURLToPath as YY}from"url";var R5=1e4,GY=!1;function l2(){if(process.platform!=="linux")return!1;return GY||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=d2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var BY=Buffer.from([0,255,3,4]);function C5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function KY($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function a$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=u2(),{directory:Q,root:X,runtimeDirectory:Y}=NY(Z),G=new AbortController,V=()=>G.abort();$.addEventListener("abort",V,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,R5),q={organization_id:c0(),user_id:c0(),device_id:c0()},H=c0(),U=c0(),M=c0(),T=c0(),_=Date.now()+R5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=c0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,R=!1,x=!1,C,P,h,S=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},y=!1;try{K=VY(Q,Z),C=Bun.serve({hostname:"127.0.0.1",port:0,fetch(I,E){let A=new URL(I.url).pathname,b=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(b&&E.upgrade(I,{data:{lane:b}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(I){if(I.data.lane==="pty")z=I},message(I,E){if(I.data.lane!=="pty")return;if(typeof E==="string"){try{if(JSON.parse(E).t==="open")W=!0}catch{V()}return}if(F.length+E.length>8192){V();return}F=Buffer.concat([F,E])}}});let l=`ws://127.0.0.1:${C.port}`;if(P=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:H,operationId:c0(),attemptId:c0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:P5,hands_worker_version:E5,hands_worker_artifact_sha256:w5,hands_worker_entrypoint:S5,target_generation:1,target_fence_id:M,environment_binding:D,[b5]:k5},emitEvent:async(I)=>{if(I==="hands.started")x=!0;if(I==="hands.ready")L=!0;if(I==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:y5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:YY(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)V()}),await S(()=>L),I5({root:X,runId:H,payload:{version:1,snapshot_id:T,revision:1,run_id:H,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),h=x5({root:X,runId:H,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${c0()}`,sessionId:"pty-readiness",operationId:c0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${j}`},emit:async(I,E)=>{if(I==="pty.ready")O=E}}).catch(()=>{V()}),await S(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${C5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${C5("foreground")}; ${K.wait("foreground")}'
24
+ `)),await S(()=>oX(l1(X,"foreground.pid"))&&F.includes(BY)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((I)=>HY(l1(X,I)));if(new Set(k).size!==2||k.some((I)=>!Number.isSafeInteger(I)||I<2||I===O.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((I)=>KY($Y(`/proc/${I}/stat`,"utf8"),I,O.job.process.pid)))return!1}else{let E=d2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
25
+ `).map((A)=>A.trim().split(/\s+/).map(Number));if(E.length!==2||new Set(E.map(([A])=>A)).size!==2||E.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await h,G.signal.aborted)return!1;for(let I of[O.job.process.pid,...k])try{return process.kill(I,0),!1}catch(E){if(!(E instanceof Error&&("code"in E)&&E.code==="ESRCH"))return!1}y=!0}catch{y=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await P,await C?.stop(!0),!x||R)UY({directory:Q,root:X},Z)}return y&&R&&!$.aborted}function VY($,J){let Z={foreground:l1($,"foreground.lifeline"),background:l1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");d2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let G=H3(Y,T1.O_RDONLY|T1.O_NONBLOCK|T1.O_NOFOLLOW);try{if(Q.push(H3(Y,T1.O_WRONLY|T1.O_NONBLOCK|T1.O_NOFOLLOW)),!h5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(G)}if(J)f5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function m5($=(J)=>a$(J)){let J=new AbortController,Z=JSON.stringify(u2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(u2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function HY($){let J;try{J=H3($,T1.O_RDONLY|T1.O_NOFOLLOW|T1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=h5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=JY(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function NY($,J=ZY("/tmp")){let Z=eX(l1(J,"reason-pty-probe-")),Q=l1(Z,"workspace"),X=l1(Z,"private");if(A5(Q,{mode:448}),A5(X,{mode:448}),$)O5(Z,493),O5(Q,493),f5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function UY($,J){if(J)try{d2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),QY($.root)}catch{return}XY($.directory,{recursive:!0,force:!0})}var t5=5000,p1="ARA_WORKER_PROBE_READY";function DY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{qY($,J,{cwd:Z,env:Q,signal:X,timeout:t5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,V)=>Y(!G&&!X.aborted&&V===p1))})}function jY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function zY($,J){let Z=p5({home:J,temporaryDirectory:J}),Q=(Y,G,V)=>DY(Y,G,$.workspaceRoot,Z,V),X=async(Y,G,V,K=(q)=>q===p1,N=!1)=>{let q=await J6(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:t5,signal:V});return!V.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await g5($.workspaceRoot,v5.R_OK),await d5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await g5($.workspaceRoot,v5.W_OK),Y.aborted)return!1;let G=r5(M3($.workspaceRoot,".ara-worker-probe-")),V=M3(G,"receipt");try{let K=await _Y(V,"wx",384);try{await K.writeFile(p1),await K.sync()}finally{await K.close()}return await u5(V,"utf8")===p1&&!Y.aborted}finally{await WY(V).catch(()=>{}),await LY(G).catch(()=>{})}},confinedShell:(Y)=>X($6(),["-c",`printf ${p1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
26
+ `)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,V,K]=await Promise.all([FY("/proc/self/cwd"),d5("/proc/self/fd"),u5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${p1}`],Y),jobs:(Y)=>L5($,Y),environment:(Y)=>W5($,J,Y),preview:(Y)=>z5(J,Y),boundPty:(Y)=>a$(Y),desktopDisplay:()=>e5(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
27
+ `);return n5()},desktopBrowser:async()=>n$()?.features.browser===!0,fullControlShell:(Y)=>{let G=a5(),V=jY(G,`printf ${p1}`);return V?Q(G,V,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&n$()?.features.computer===!0?i5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function OY($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return i$($,J,Z,Q,X).final}function i$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,G){let V,K;try{if(q1($),u0(),!J)e(g($),!0),V=r5(M3(g($),"probe-")),J=zY($,V);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",H=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(G).then(()=>Promise.all(q?[N("preview"),H,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,R,x,C,P]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!R||!x||!C)&&!G)await U;if(q){if(!R)R=await N("bash");if(!x)x=await N("jobs");if(!C)C=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:R,jobs:x,environment:C,full:P}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:R,processes:x,bash:C,jobs:P,environment:h,full:S}=z,{preview:y,boundPty:l,desktopDisplay:k,desktopAutomation:I,desktopBrowser:E}=F,A=c5(),b=q&&process.platform==="darwin"&&S&&MY("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&R&&X,"process.list":(process.platform==="linux"||L)&&x,"ports.list":(process.platform==="linux"||L)&&x,"exec.full":C&&S&&X,"hands.connect":O&&W&&C&&P,"jobs.control":O&&W&&C&&P,"pty.start":O&&W&&C&&P&&h&&l,"environment.install":O&&W&&C&&P&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&C&&P&&h,"tunnel.open":O&&W&&C&&P&&h&&y,"tunnel.close":O&&W&&C&&P&&h&&y,"preview.serve.v1":O&&C&&P&&y&&S,"display.stream.v1":k,"automation.call.v1":I,"simulator.call.v1":b,"simulator.stream.v1":b,"browser.pr-proof.v1":I&&E&&l5()===null,"workspace.setup.v1":q&&s5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([H,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,R]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:R})}finally{if(V)TY(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await H||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var AY=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],RY=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return AY.filter((Z)=>J[Z]!==!0)}function o5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>OY($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
28
+ `),(async()=>{for(let Y of $.delaysMs??RY){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=q3($.config,Q).filter((K)=>G[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
29
+ `),$.onReady(Q,V);if(q3($.config,Q).length===0)return}})()}import{execFile as zG}from"child_process";import{createHash as OG,randomUUID as b3}from"crypto";import{lstat as AG,readdir as m6,readFile as c6,realpath as RG,stat as CG}from"fs/promises";import{basename as PG,join as S3}from"path";import{promisify as IG}from"util";import{createConnection as CY}from"net";import{endianness as X6}from"os";var r$=4,W3=1e4;class P1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=CY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=PY({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(G),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=r$){let J=X6()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=r$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(r$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!t0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),t0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class p2{client;cdp;constructor($){this.client="client"in $?$.client:new P1($),this.cdp=new B6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=IY(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new Y6(this,$)}getTabs(){return this.client.getTabs()}}class Y6{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new G6(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class G6{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class B6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(t0(Q)&&t0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return t0(Q)&&t0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";Z6(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(t0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if(Q6(K,Q))return;throw V}),G}async waitForLoadState($,J={}){let Z=J.state??"load";Z6(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(Q6(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return t0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let G=!1,V=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(H){if(N())Y(H instanceof Error?H:Error(String(H)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=xY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function PY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(r$+J.length);if(X6()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,r$),Z}function t0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function IY($,J){if(!t0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function Z6($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function Q6($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function xY($,J){if($.method!=="onCDPEvent"||!t0($.params))return null;let Z=$.params.source;if(!t0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as EY}from"crypto";function K6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${EY("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as LG}from"async_hooks";import{isDeepStrictEqual as f6}from"util";import{createHash as DG}from"crypto";var SY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var wY=new Set(["png","jpg","jpeg","gif","webp"]),bY=new Set(["webm","mp4"]);function kY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function V6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=kY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=SY.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!V||!K||!N)return null;let q=wY.has(N)?"image":bY.has(N)?"video":null;if(!q)return null;let H=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:G,artifactId:V,fileName:`${K}.${N}`,kind:q,phase:H?.[1]==="before"||H?.[1]==="after"?H[1]:null}}var yY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,c2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),c1=()=>{throw Error("cloud_browser_media_request_invalid")};function s2($){if(!c2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!yY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return c1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return c1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!H6(J.origin,{mode:"public_web"}).allowed)return c1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!c2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return c1();let G=V6(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return c1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return c1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return c1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function N6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!c2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!c2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=B.string().uuid(),H$=B.string().regex(/^[a-f0-9]{64}$/),a1=B.iso.datetime({precision:3}),D3=B.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),q6=B.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),s0=B.object({kind:B.literal("primary_mac"),version:B.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:B.string().min(1).max(64),binding:B.enum(["workspace_source","mcp_control"]),targetRevision:B.number().int().nonnegative(),generation:L0,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),fY=B.custom().transform(($,J)=>{try{return U6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),B.NEVER}}),N$=B.object({version:B.literal(1),owner:s0,contextId:L0,preparedAt:a1,expiresAt:a1,prUrl:q6,headSha:B.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:B.enum(["image","video"]),visualPlan:fY.optional(),uploadOrigin:B.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=B.object({version:B.literal(1),producer:B.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:B.number().int().positive(),startedAt:a1,finishedAt:a1,sha256:H$,media:B.discriminatedUnion("contentType",[B.object({contentType:B.literal("image/png"),sizeBytes:B.number().int().min(24).max(8388608),width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096)}).strict(),B.object({contentType:B.literal("video/webm"),sizeBytes:B.number().int().min(128).max(10485760),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),WM=B.discriminatedUnion("action",[B.object({action:B.literal("screenshot"),context_id:L0,tab_id:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),context_id:L0,tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("stop_video"),recording_operation_id:L0}).strict()]),i2=B.object({login:B.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:B.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),a2=B.string().regex(/^[1-9][0-9]{0,19}$/),t$=B.object({version:B.literal(1),owner:s0,expectedActorId:a2.nullable(),repositoryId:a2,repositoryFullName:B.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),hY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=B.discriminatedUnion("status",[t$.extend({status:B.literal("ready"),observedActor:i2,checkedAt:a1}),t$.extend({status:B.literal("not_ready"),reason:B.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:B.enum(hY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),s1=B.object({version:B.literal(1),owner:s0,expectedActorId:a2.nullable(),authenticatedActor:i2,attemptId:L0,captureId:L0,prUrl:q6,repositoryId:a2,headSha:B.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:B.number().int().min(128).max(10485760),contentType:B.literal("video/webm")}).strict(),M6=B.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=B.discriminatedUnion("status",[s1.extend({status:B.literal("not_attempted"),reason:B.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),s1.extend({status:B.literal("uncertain"),reason:B.literal("upload_outcome_unknown")}),s1.extend({status:B.literal("uploaded"),observedActor:i2,nativeUrl:M6,uploadedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),o$=s1.extend({nativeUrl:M6,observedActor:i2,bodySha256:H$}),A3=B.discriminatedUnion("status",[o$.extend({status:B.literal("incomplete"),reason:B.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),o$.extend({status:B.literal("verified"),sourceSha256:H$,width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096),durationSeconds:B.number().positive().max(30),advancedSeconds:B.number().min(0.05).max(10),advancedFrames:B.number().int().positive(),playbackRestored:B.literal(!0),verifiedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),mY=B.custom().transform(($,J)=>{try{let Z=s2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),B.NEVER}}),vY=B.discriminatedUnion("action",[B.object({action:B.literal("auth_check"),input:t$}).strict(),B.object({action:B.literal("prepare"),context:N$}).strict(),B.object({action:B.literal("capture_png"),owner:s0,contextId:L0,tabId:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),owner:s0,contextId:L0,tabId:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("inspect_capture"),owner:s0,captureId:L0}).strict(),B.object({action:B.literal("publish_video"),input:s1}).strict(),B.object({action:B.literal("verify_png_media"),owner:s0,media:mY}).strict().refine(($)=>$.media.runId===$.owner.runId),B.object({action:B.literal("verify_saved_media"),input:o$}).strict(),B.object({action:B.literal("publish_png"),owner:s0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:B.number().int().min(24).max(8388608),storagePath:B.string().max(512),uploadUrl:B.string().url().max(8192)}).strict()]);var T6="pr-proof.stop.v1",R3=B.object({requestId:L0,command:vY}).strict();import{createHash as gY,randomUUID as uY}from"crypto";import{isDeepStrictEqual as q$}from"util";var _6=B.object({operationId:B.string().uuid(),attemptId:B.string().uuid(),contextId:B.string().uuid(),tabId:B.number().int().positive()}).strict(),B0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>gY("sha256").update($).digest("hex");function F6($){let J=s0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw B0();if(await $.assertCurrent(),X)throw B0()},G=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw B0();return M},V=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,B0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>V(D)))).some((D)=>D.status==="rejected"))throw B0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function H(U,M){let T=_6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw B0();await Y(),U.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw B0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw B0();let x=await D.completion;if(await Y(),G(T.contextId),D.controller.signal.aborted)throw B0();return structuredClone(x)}if(Q.size>=16||[...Q.values()].some((x)=>!x.receipt&&!x.controller.signal.aborted&&x.claim.tabId===T.tabId))throw B0();let j,z,F=new Promise((x,C)=>{j=x,z=C});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{V(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),G(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},R;try{await L();let x;if(M==="image"){let C=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let P=new Date().toISOString();if(await L(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw B0();x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:uY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C,finishedAt:P,sha256:C3(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),B0();await O.host.start(),O.started=!0;let C=O.host.completed();if(C.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let P=await C;if(O.stop)await O.stop;await L();let h=await O.host.read(P.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(P,h.capture)||!q$(P.owner,S)||R.length!==P.sizeBytes||C3(R)!==P.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw B0();await O.host.close(),await L(),x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:P.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:P.startedAt,finishedAt:P.finishedAt,sha256:P.sha256,media:{contentType:"video/webm",sizeBytes:P.sizeBytes,durationSeconds:P.durationSeconds,frameCount:P.frameCount,receivedFrameCount:P.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((C,P)=>C+(P.bytes?.length??0),R.length)>20971520)throw B0();return O.bytes=Buffer.from(R),O.receipt=x,j(x),structuredClone(x)}catch(x){let C=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&x instanceof Error&&x.message==="mac_recording_worker_failed:no_frames"?new v0("proof_capture_no_frames","The owned tab emitted no recording frames."):B0();throw await V(O).catch(()=>{}),z(C),C}finally{R?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw B0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw B0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw B0();return structuredClone(T)}if(Z.size>=4)throw B0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>H(U,"image"),record:(U)=>H(U,"video"),async stop(U){let M=_6.parse(U);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw B0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw B0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw B0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw B0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw B0()}}}import{createHash as j6,randomUUID as rY}from"crypto";import{isDeepStrictEqual as e$}from"util";import{realpath as tY}from"fs/promises";var W6=String.raw`async (media) => {
30
30
  const deadline = (promise) => {
31
31
  let timer;
32
32
  return Promise.race([promise, new Promise((_, reject) => {
@@ -73,24 +73,24 @@ ${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,
73
73
  }
74
74
  }));
75
75
  return { verified: true, items };
76
- }`;var W6=function($){let J=this??globalThis,Z=10485760,Q=(G,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,H={login:K,id:q};if(G.expectedActorId!==null&&q!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||q!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||q!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:H}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,V=Q(G,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let H=J.document.querySelector("#fc-new_comment_field");if(!H)return{dispatched:!1,reason:"attachment_unavailable"};return H.files=q.files,H.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),V=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(V));if(q.length!==1)throw Error("saved_player_missing");let H=q[0],U={muted:H.muted,volume:H.volume,rate:H.playbackRate,preload:H.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(H.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(H.muted=!0,H.playbackRate=1,H.currentTime=0,H.readyState<2)H.preload="auto",H.load();await D(()=>H.readyState>=2&&H.videoWidth>0&&H.videoHeight>0);let j=H.currentSrc;if(!V(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!V(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let y=await _(O.read());if(y.done)break;if(L+=y.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(y.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(L),x=0;for(let y of W)R.set(y,x),x+=y.length;let C=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((y)=>y.toString(16).padStart(2,"0")).join("");if(C!==X.sha256||H.currentSrc!==j||!N.contains(H))throw Error("source_changed");let I=H.currentTime,h=H.getVideoPlaybackQuality().totalVideoFrames;if(await _(H.play()),await D(()=>H.currentTime-I>=0.05&&H.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||H.currentSrc!==j||!N.contains(H)||H.error)throw Error("player_changed");return{status:"verified",sourceSha256:C,width:H.videoWidth,height:H.videoHeight,durationSeconds:H.duration,advancedSeconds:H.currentTime-I,advancedFrames:H.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),H.pause(),H.currentTime=0,H.muted=U.muted,H.volume=U.volume,H.playbackRate=U.rate,H.preload=U.preload,!H.paused||H.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as yY}from"child_process";import{lstat as fY,realpath as hY}from"fs/promises";import{join as L6,resolve as mY}from"path";import{promisify as vY}from"util";var gY=vY(yY);async function uY($,J){let Z=await hY($),{stdout:Q}=await gY(L6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return B.array(B.object({browser:B.string(),directory:B.string(),connected:B.boolean().optional(),source:B.string(),socketPath:B.string().optional(),instanceId:B.string().optional(),extensionId:B.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&mY(Y.source)===L6(Z,"Reason Browser Use","manifest.json"))}async function n2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await uY($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await fY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as dY}from"crypto";function M$($){return`reason-browser-${dY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var j6=B.discriminatedUnion("ok",[B.object({ok:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({ok:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),z6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function I3($){let J=c0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await cY($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${lY()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(q)=>{if(!e$(J,q.owner))throw Z0();await G()},K=async(q)=>{await V(q);let H=await $.readVideo(q.captureId);try{await G();let U=H.capture;if(!e$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||H.bytes.length!==q.sizeBytes||H.bytes.length<128||H.bytes.length>10485760||H.bytes.readUInt32BE(0)!==440786851||D6("sha256").update(H.bytes).digest("hex")!==q.sha256)throw Z0();return H}catch(U){throw H.bytes.fill(0),U}};async function N(q,H,U){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new p2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await G(),D)throw Z0()};try{await F(T.connect());let W=z6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((C)=>{if(D)C.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let x=await F(H(_,async(C)=>{await O();let I=await F(_.evaluate(`(${W6.toString()})(${JSON.stringify(C)})`,{awaitPromise:!0}));return await O(),I},O));return await O(),x}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,R)=>{W=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(q,H,U){let M=N$.parse(q);if(await V(M),!Number.isSafeInteger(H)||H<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new p2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=z6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!B.array(B.object({id:B.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===H))throw Z0();await G(),U.throwIfAborted();let F=B.object({data:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(H,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await G(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let H=s2(q);if(H.runId!==J.runId||H.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(H.media.map((C)=>C.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,R=(C,I)=>{if(L.size>=32){F=!0;return}let h=_.executeCdp(U.id,C,I);L.add(h),h.catch(()=>{F=!0}).finally(()=>L.delete(h))},x=_.onNotification((C)=>{if(C.method!=="onCDPEvent"||!i0(C.params)||!i0(C.params.source)||C.params.source.tabId!==U.id||!i0(C.params.params))return;let I=C.params.params;if(++O>512){F=!0;return}if(C.params.method==="Fetch.requestPaused"){let y=typeof I.requestId==="string"&&i0(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&D.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!y)F=!0;R(y?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...y?{}:{errorReason:"BlockedByClient"}})}if(C.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(C.params.method==="Network.loadingFailed")F=!0;if(C.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")z.add(I.requestId);if(C.params.method!=="Network.responseReceived")return;if(!i0(I.response)||typeof I.response.url!=="string"||!D.has(I.response.url)||typeof I.requestId!=="string"||!i0(I.response.headers)||I.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(I.response.headers).map(([y,l])=>[y.toLowerCase(),l])),S=Number(h["content-length"]);if(j.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}j.set(I.response.url,{id:I.requestId,length:S})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let C=B.object({frameTree:B.object({frame:B.object({id:B.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),I=[...new Set(H.media.map((y)=>new URL(y.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:C.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new v0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await U.evaluate(`(${F6})(${JSON.stringify(H.media)})`,{awaitPromise:!0})}catch{throw new v0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!i0(h)||!Array.isArray(h.items)||h.items.length!==H.media.length)throw Z0();await Promise.all(L);let S=[];for(let y=0;y<H.media.length;y++){await G();let l=j.get(H.media[y].sourceUrl);if(F||!l||!z.has(l.id))throw Z0();let k=B.object({base64Encoded:B.literal(!0),body:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:l.id})),P=Buffer.from(k.body,"base64");try{let E=h.items[y];if(P.length!==l.length||P.toString("base64")!==k.body||!i0(E))throw Z0();S.push({...E,sourceSha256:D6("sha256").update(P).digest("hex")})}finally{P.fill(0)}}if(F)throw Z0();return H6({verified:!0,items:S},H)}finally{if(x(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new v0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let H=t$.parse(q);await V(H);let U="browser_unavailable";try{return await N(`https://github.com/${H.repositoryFullName}`,async(M,T)=>{let _=j6.parse(await T({operation:"preflight",expected:{...H,prUrl:`https://github.com/${H.repositoryFullName}`}}));return O3.parse(_.ok?{...H,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...H,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...H,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...H,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let H=s1.parse(q);if(await V(H),H.expectedActorId!==null&&H.authenticatedActor.id!==H.expectedActorId)throw Z0();let U=Q.get(H.attemptId);if(U){if(!e$(U.binding,H))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(H),result:U$.parse({...H,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(H.attemptId,M);let T=!1,_="dispatch";try{(await K(H)).bytes.fill(0),M.result=await N(H.prUrl,async(D,j)=>{let z=j6.parse(await j({operation:"identity",expected:H}));if(!z.ok)return U$.parse({...H,status:"not_attempted",reason:z.reason});let F=await K(H),O;try{T=!0,O=B.discriminatedUnion("dispatched",[B.object({dispatched:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({dispatched:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:H,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...H,status:"not_attempted",reason:O.reason});if(!e$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...H,observedActor:z.actor}});if(L!==null){let R=B.object({nativeUrl:B.string(),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await G(),U$.parse({...H,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
77
- `);M.result=U$.parse({...H,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let H=o$.parse(q);await V(H);try{return(await K(H)).bytes.fill(0),await N(H.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:H});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...H,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(H).some(([D,j])=>!e$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...H,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function cY($,J){let Z=await pY($);return{async discover(Q){let X=await n2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as NG}from"fs/promises";var pM=B.object({version:B.literal(1),recording_operation_id:B.string().uuid(),proof_ready:B.literal(!1),acknowledged_at:B.iso.datetime()}).strict(),r2=B.object({action:B.literal("start"),request_id:B.string().uuid(),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),O6=B.object({action:B.literal("inspect"),recording_operation_id:B.string().uuid()}).strict(),cM=B.discriminatedUnion("action",[r2,O6]),A6=B.object({recording_operation_id:B.string().uuid()}).strict(),P3={device_id:B.string().uuid(),root_id:B.string().uuid()},sY=B.discriminatedUnion("action",[r2.extend(P3),O6.extend(P3),A6.extend({...P3,action:B.literal("stop")})]),sM=B.toJSONSchema(sY),aM=B.object({version:B.literal(1),recordingId:B.string().uuid(),proofReady:B.literal(!1),capture:B.object({captureId:B.string().uuid(),contentType:B.literal("video/webm"),sha256:B.string().regex(/^[a-f0-9]{64}$/),sizeBytes:B.number().int().min(128).max(10485760),startedAt:B.iso.datetime(),finishedAt:B.iso.datetime(),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000),owner:B.object({runId:B.string().uuid(),deviceId:B.string().uuid(),rootId:B.string().uuid(),rootRevision:B.string().max(64),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024),generation:B.string().uuid(),browserScope:B.string().max(128),tabId:B.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var QT=r2.extend({action:B.enum(["start","inspect"]),recording_boot_generation:B.string().uuid(),recording_operation_id:B.string().uuid().optional(),recording_attempt_id:B.string().uuid().optional()}).strict();import{createHash as ZG,randomUUID as QG}from"crypto";import{mkdtemp as XG,realpath as YG,rm as w6}from"fs/promises";import{tmpdir as GG}from"os";import{join as BG}from"path";import{spawn as KG}from"child_process";import{isDeepStrictEqual as VG}from"util";import{createHash as aY}from"crypto";import{execFile as iY}from"child_process";import{chmod as nY,lstat as C6,mkdtemp as rY,readFile as I6,realpath as P6,rm as tY,writeFile as R6}from"fs/promises";import{tmpdir as oY}from"os";import{isAbsolute as eY,join as t2}from"path";import{promisify as $G}from"util";var x3=$G(iY),JG=($)=>aY("sha256").update($).digest("hex");async function Q1($){if(!eY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await P6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await C6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||JG(await I6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function $2($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([Q1(Z.ffmpeg),Q1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([Q1(Z.ffmpeg),Q1(Z.ffprobe)]);let G=await P6(await rY(t2(J??oY(),"reason-owned-recording-")));await nY(G,448);let V=t2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await R6(t2(G,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await R6(t2(G,"frames.ffconcat"),N.join(`
76
+ }`;var L6=function($){let J=this??globalThis,Z=10485760,Q=(G,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,H={login:K,id:q};if(G.expectedActorId!==null&&q!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||q!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||q!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:H}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,V=Q(G,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let H=J.document.querySelector("#fc-new_comment_field");if(!H)return{dispatched:!1,reason:"attachment_unavailable"};return H.files=q.files,H.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),V=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(V));if(q.length!==1)throw Error("saved_player_missing");let H=q[0],U={muted:H.muted,volume:H.volume,rate:H.playbackRate,preload:H.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(H.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(H.muted=!0,H.playbackRate=1,H.currentTime=0,H.readyState<2)H.preload="auto",H.load();await D(()=>H.readyState>=2&&H.videoWidth>0&&H.videoHeight>0);let j=H.currentSrc;if(!V(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!V(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let y=await _(O.read());if(y.done)break;if(L+=y.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(y.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(L),x=0;for(let y of W)R.set(y,x),x+=y.length;let C=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((y)=>y.toString(16).padStart(2,"0")).join("");if(C!==X.sha256||H.currentSrc!==j||!N.contains(H))throw Error("source_changed");let P=H.currentTime,h=H.getVideoPlaybackQuality().totalVideoFrames;if(await _(H.play()),await D(()=>H.currentTime-P>=0.05&&H.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||H.currentSrc!==j||!N.contains(H)||H.error)throw Error("player_changed");return{status:"verified",sourceSha256:C,width:H.videoWidth,height:H.videoHeight,durationSeconds:H.duration,advancedSeconds:H.currentTime-P,advancedFrames:H.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),H.pause(),H.currentTime=0,H.muted=U.muted,H.volume=U.volume,H.playbackRate=U.rate,H.preload=U.preload,!H.paused||H.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as dY}from"child_process";import{lstat as lY,realpath as pY}from"fs/promises";import{join as D6,resolve as cY}from"path";import{promisify as sY}from"util";var aY=sY(dY);async function iY($,J){let Z=await pY($),{stdout:Q}=await aY(D6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return B.array(B.object({browser:B.string(),directory:B.string(),connected:B.boolean().optional(),source:B.string(),socketPath:B.string().optional(),instanceId:B.string().optional(),extensionId:B.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&cY(Y.source)===D6(Z,"Reason Browser Use","manifest.json"))}async function n2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await iY($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await lY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as nY}from"crypto";function M$($){return`reason-browser-${nY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var z6=B.discriminatedUnion("ok",[B.object({ok:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({ok:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),O6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function P3($){let J=s0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await oY($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${rY()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(q)=>{if(!e$(J,q.owner))throw Z0();await G()},K=async(q)=>{await V(q);let H=await $.readVideo(q.captureId);try{await G();let U=H.capture;if(!e$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||H.bytes.length!==q.sizeBytes||H.bytes.length<128||H.bytes.length>10485760||H.bytes.readUInt32BE(0)!==440786851||j6("sha256").update(H.bytes).digest("hex")!==q.sha256)throw Z0();return H}catch(U){throw H.bytes.fill(0),U}};async function N(q,H,U){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new p2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await G(),D)throw Z0()};try{await F(T.connect());let W=O6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((C)=>{if(D)C.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let x=await F(H(_,async(C)=>{await O();let P=await F(_.evaluate(`(${L6.toString()})(${JSON.stringify(C)})`,{awaitPromise:!0}));return await O(),P},O));return await O(),x}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,R)=>{W=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(q,H,U){let M=N$.parse(q);if(await V(M),!Number.isSafeInteger(H)||H<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new p2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=O6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!B.array(B.object({id:B.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===H))throw Z0();await G(),U.throwIfAborted();let F=B.object({data:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(H,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await G(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let H=s2(q);if(H.runId!==J.runId||H.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(H.media.map((C)=>C.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,R=(C,P)=>{if(L.size>=32){F=!0;return}let h=_.executeCdp(U.id,C,P);L.add(h),h.catch(()=>{F=!0}).finally(()=>L.delete(h))},x=_.onNotification((C)=>{if(C.method!=="onCDPEvent"||!n0(C.params)||!n0(C.params.source)||C.params.source.tabId!==U.id||!n0(C.params.params))return;let P=C.params.params;if(++O>512){F=!0;return}if(C.params.method==="Fetch.requestPaused"){let y=typeof P.requestId==="string"&&n0(P.request)&&P.request.method==="GET"&&typeof P.request.url==="string"&&D.has(P.request.url)&&P.resourceType==="Image";if(typeof P.requestId!=="string"){F=!0;return}if(!y)F=!0;R(y?"Fetch.continueRequest":"Fetch.failRequest",{requestId:P.requestId,...y?{}:{errorReason:"BlockedByClient"}})}if(C.params.method==="Network.requestWillBeSent"&&P.redirectResponse)F=!0;if(C.params.method==="Network.loadingFailed")F=!0;if(C.params.method==="Network.loadingFinished"&&typeof P.requestId==="string")z.add(P.requestId);if(C.params.method!=="Network.responseReceived")return;if(!n0(P.response)||typeof P.response.url!=="string"||!D.has(P.response.url)||typeof P.requestId!=="string"||!n0(P.response.headers)||P.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(P.response.headers).map(([y,l])=>[y.toLowerCase(),l])),S=Number(h["content-length"]);if(j.has(P.response.url)||P.response.status!==200||P.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}j.set(P.response.url,{id:P.requestId,length:S})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let C=B.object({frameTree:B.object({frame:B.object({id:B.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),P=[...new Set(H.media.map((y)=>new URL(y.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:C.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${P}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new v0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await U.evaluate(`(${W6})(${JSON.stringify(H.media)})`,{awaitPromise:!0})}catch{throw new v0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!n0(h)||!Array.isArray(h.items)||h.items.length!==H.media.length)throw Z0();await Promise.all(L);let S=[];for(let y=0;y<H.media.length;y++){await G();let l=j.get(H.media[y].sourceUrl);if(F||!l||!z.has(l.id))throw Z0();let k=B.object({base64Encoded:B.literal(!0),body:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:l.id})),I=Buffer.from(k.body,"base64");try{let E=h.items[y];if(I.length!==l.length||I.toString("base64")!==k.body||!n0(E))throw Z0();S.push({...E,sourceSha256:j6("sha256").update(I).digest("hex")})}finally{I.fill(0)}}if(F)throw Z0();return N6({verified:!0,items:S},H)}finally{if(x(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new v0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let H=t$.parse(q);await V(H);let U="browser_unavailable";try{return await N(`https://github.com/${H.repositoryFullName}`,async(M,T)=>{let _=z6.parse(await T({operation:"preflight",expected:{...H,prUrl:`https://github.com/${H.repositoryFullName}`}}));return O3.parse(_.ok?{...H,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...H,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...H,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...H,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let H=s1.parse(q);if(await V(H),H.expectedActorId!==null&&H.authenticatedActor.id!==H.expectedActorId)throw Z0();let U=Q.get(H.attemptId);if(U){if(!e$(U.binding,H))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(H),result:U$.parse({...H,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(H.attemptId,M);let T=!1,_="dispatch";try{(await K(H)).bytes.fill(0),M.result=await N(H.prUrl,async(D,j)=>{let z=z6.parse(await j({operation:"identity",expected:H}));if(!z.ok)return U$.parse({...H,status:"not_attempted",reason:z.reason});let F=await K(H),O;try{T=!0,O=B.discriminatedUnion("dispatched",[B.object({dispatched:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({dispatched:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:H,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...H,status:"not_attempted",reason:O.reason});if(!e$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...H,observedActor:z.actor}});if(L!==null){let R=B.object({nativeUrl:B.string(),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await G(),U$.parse({...H,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
77
+ `);M.result=U$.parse({...H,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let H=o$.parse(q);await V(H);try{return(await K(H)).bytes.fill(0),await N(H.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:H});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...H,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(H).some(([D,j])=>!e$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...H,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function oY($,J){let Z=await tY($);return{async discover(Q){let X=await n2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as WG}from"fs/promises";var tM=B.object({version:B.literal(1),recording_operation_id:B.string().uuid(),proof_ready:B.literal(!1),acknowledged_at:B.iso.datetime()}).strict(),r2=B.object({action:B.literal("start"),request_id:B.string().uuid(),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),A6=B.object({action:B.literal("inspect"),recording_operation_id:B.string().uuid()}).strict(),oM=B.discriminatedUnion("action",[r2,A6]),R6=B.object({recording_operation_id:B.string().uuid()}).strict(),I3={device_id:B.string().uuid(),root_id:B.string().uuid()},eY=B.discriminatedUnion("action",[r2.extend(I3),A6.extend(I3),R6.extend({...I3,action:B.literal("stop")})]),eM=B.toJSONSchema(eY),$T=B.object({version:B.literal(1),recordingId:B.string().uuid(),proofReady:B.literal(!1),capture:B.object({captureId:B.string().uuid(),contentType:B.literal("video/webm"),sha256:B.string().regex(/^[a-f0-9]{64}$/),sizeBytes:B.number().int().min(128).max(10485760),startedAt:B.iso.datetime(),finishedAt:B.iso.datetime(),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000),owner:B.object({runId:B.string().uuid(),deviceId:B.string().uuid(),rootId:B.string().uuid(),rootRevision:B.string().max(64),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024),generation:B.string().uuid(),browserScope:B.string().max(128),tabId:B.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var HT=r2.extend({action:B.enum(["start","inspect"]),recording_boot_generation:B.string().uuid(),recording_operation_id:B.string().uuid().optional(),recording_attempt_id:B.string().uuid().optional()}).strict();import{createHash as VG,randomUUID as HG}from"crypto";import{mkdtemp as NG,realpath as UG,rm as b6}from"fs/promises";import{tmpdir as qG}from"os";import{join as MG}from"path";import{spawn as TG}from"child_process";import{isDeepStrictEqual as _G}from"util";import{createHash as $G}from"crypto";import{execFile as JG}from"child_process";import{chmod as ZG,lstat as P6,mkdtemp as QG,readFile as I6,realpath as x6,rm as XG,writeFile as C6}from"fs/promises";import{tmpdir as YG}from"os";import{isAbsolute as GG,join as t2}from"path";import{promisify as BG}from"util";var x3=BG(JG),KG=($)=>$G("sha256").update($).digest("hex");async function X1($){if(!GG($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await x6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await P6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||KG(await I6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function $2($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([X1(Z.ffmpeg),X1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([X1(Z.ffmpeg),X1(Z.ffprobe)]);let G=await x6(await QG(t2(J??YG(),"reason-owned-recording-")));await ZG(G,448);let V=t2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await C6(t2(G,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await C6(t2(G,"frames.ffconcat"),N.join(`
78
78
  `)+`
79
- `,{mode:384,flag:"wx"});let q={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],q),K="output";let H=await C6(V);if(!H.isFile()||H.isSymbolicLink()||H.nlink!==1||H.size<128||H.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],q),K="pin",await Promise.all([Q1(Z.ffmpeg),Q1(Z.ffprobe)]),await I6(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await tY(G,{recursive:!0,force:!0})}}}}var E6=B.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var X1=B.string().min(1).max(1024),x6=B.object({path:X1,sha256:B.string().regex(/^[a-f0-9]{64}$/)}).strict(),S6=B.object({owner:B.object({runId:X1,deviceId:X1,rootId:X1,rootRevision:X1,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:X1,generation:X1,browserScope:X1,tabId:B.number().int().positive()}).strict(),socketPath:X1,extensionId:B.string().regex(/^[a-p]{32}$/),nativeHostName:X1,seconds:B.number().int().min(1).max(15),encoder:B.object({ffmpeg:x6,ffprobe:x6}).strict()}).strict();var HG=15728640,I1=()=>Error("mac_recording_worker_failed");function b6($){let J=S6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,V=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(I1()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,H=async()=>{if(X)throw I1();if(await K($.assertCurrent()),X)throw I1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await H(),await Q1({path:Z.path,sha256:Z.sha256}),await H(),G=null;let U=await YG(await XG(BG(GG(),"reason-recording-host-")));try{await H()}catch(P){throw await w6(U,{recursive:!0,force:!0}),P}let M=KG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((P)=>M.once("close",()=>P())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(P){if(P.code!=="ESRCH")throw P}},D=null;V=()=>D??=(async()=>{try{_()}catch(P){if(P.code!=="EPERM")throw P}await T;try{for(let P=0;;P++)try{_();break}catch(E){if(E.code!=="EPERM"||P>=20)throw E;await new Promise((A)=>setTimeout(A,25))}}finally{await w6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,R,x=new Promise((P,E)=>{L=P,R=E}),C,I,h=new Promise((P,E)=>{C=P,I=E});h.catch(()=>{});let S=(P=I1())=>{if(F)return;F=!0,clearTimeout(y),clearInterval(k),N().then(()=>{R(P),I(P)},(E)=>{R(E),I(E)})},y=setTimeout(()=>S(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,H().catch(()=>S()).finally(()=>{l=!1})},250);q={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
80
- `)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(P)=>{if(F)return;if(z+=P.length,z>HG){S();return}j+=P.toString("utf8");let E;while((E=j.indexOf(`
81
- `))!==-1){let A=j.slice(0,E);j=j.slice(E+1);try{let b=JSON.parse(A);if(b.type==="failed"&&Object.keys(b).sort().join(",")==="reason,type"){let o=E6.safeParse(b.reason);S(o.success?Error(`mac_recording_worker_failed:${o.data}`):I1());return}if(b.type==="unsupported"&&!O){S(Error("mac_recording_encoder_unavailable"));return}if(b.type==="started"&&!O&&Object.keys(b).length===1){O=!0,L({recording:!0});continue}if(!O||b.type!=="capture"||W||Object.keys(b).sort().join(",")!=="bytes,capture,type")throw I1();let w=b.capture;if(!w||Object.keys(w).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof w.sha256!=="string"||typeof w.startedAt!=="string"||typeof w.finishedAt!=="string"||!VG(w.owner,J.owner)||w.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(w.sha256)||!Number.isSafeInteger(w.sizeBytes)||w.sizeBytes<128||w.sizeBytes>10485760||!Number.isSafeInteger(w.frameCount)||w.frameCount<1||w.frameCount>450||!Number.isSafeInteger(w.receivedFrameCount)||w.receivedFrameCount<w.frameCount||w.receivedFrameCount>2000||!Number.isFinite(w.durationSeconds)||w.durationSeconds<0.05||w.durationSeconds>J.seconds||!Number.isFinite(Date.parse(w.startedAt))||!Number.isFinite(Date.parse(w.finishedAt))||Math.abs((Date.parse(w.finishedAt)-Date.parse(w.startedAt))/1000-w.durationSeconds)>0.1||typeof b.bytes!=="string"||b.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(b.bytes))throw I1();let n=Buffer.from(b.bytes,"base64");if(n.length!==w.sizeBytes||ZG("sha256").update(n).digest("hex")!==w.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw I1();W={capture:Object.freeze({...w,captureId:QG(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(P)=>{if(F)return;if(P!==0||!W||j.trim()){S();return}let E=W;H().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(y),clearInterval(k),Q.set(E.capture.captureId,E);while(Q.size>2)Q.delete(Q.keys().next().value);C(E.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
82
- `);try{return await x}catch(P){throw q=null,P}}finally{Y=!1}},async completed(){if(await H(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await H();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await H();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var k6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await NG($.automationDirectory);J=(Q,X)=>n2(Z,Q,X)}if(await Q1({path:$.worker.path,sha256:$.worker.sha256}),!await $2($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),V=new C1({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=k6.parse(await V.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!B.array(B.object({id:B.number()})).parse(await V.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:G.instanceId,async createHost(N,q,H){let U=new C1({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return b6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){H.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=k6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),MG=B.object({operationId:B.string().uuid()}).strict();function f6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=B.array(B.object({profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:B.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!B.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,G=!1,V=new UG,K=async(U)=>{let M=V.getStore();if(G||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),G)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=_6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let R=await $.resolveBrowser(U.profile,O,j,L);if(R.extensionInstanceId!==U.extensionInstanceId)throw A0();return R.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),G)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!y6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},H=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{G=!0})},1000);return H.unref(),{generation:$.generation,async execute(U,M,T){return V.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!y6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let R=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||qG("sha256").update(R.bytes).digest("hex")!==_.sha256)throw A0();await z();let x={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,x);try{let C=await fetch(L,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await C.body?.cancel(),await z(),C.ok)x.result={...x.result,status:"uploaded"}}catch{}F=x.result}finally{R.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==M6)return!1;let T=MG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await V.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(H);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var zG="__browser-recorder",OG=jG(TG),AG="/tmp/open-browser-use",RG=33554432,CG=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.literal(o2),extensionInstanceId:B.string().min(1).max(1024)})}),m6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:n$,ensureBrowser:d6,socketDirectory:AG,async identity($){let J=new C1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function v6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw m6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(l6(Z),"Default","Local Extension Settings",o2),X=(await h6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await h6(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=S3(J.socketDirectory,Y);try{let V=await FG(G);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=CG.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await LG(N)).size<=RG&&(await p6(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:o2}}catch{}}throw m6()}async function w3($){let J=await WG($);return{path:J,sha256:_G("sha256").update(await p6(J)).digest("hex")}}async function c6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await OG(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await $2(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...DG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],zG]};return{worker:{...await w3(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function s6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=g6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?u6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(H)=>B6(H.organizationId,H.sessionId,H.deviceId,1),K=$.recording,N,q=f6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(H,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>v6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(H,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>IG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(H)=>I3({...H,endpoint:(U)=>({discover:(M)=>v6(M,Z),tabScope:V(U)})})});return{capability:G,broker:q}}function IG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as pG}from"child_process";import{execFile as PG}from"child_process";import{readFile as xG}from"fs/promises";import{join as t0}from"path";var EG="Claude Code-credentials",SG="/usr/bin/security",wG=120000,bG=8192,e2={exec:($,J,Z)=>new Promise((Q)=>{PG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await xG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=bG?$:null}function kG($,J){return $.CLAUDE_CONFIG_DIR||t0(J,".claude")}function yG($,J){return $.CODEX_HOME||t0(J,".codex")}function a6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function fG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function hG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:fG(Z)??Date.now()}}catch{return null}}function mG($,J){return t0($.XDG_DATA_HOME||t0(J,".local","share"),"opencode","auth.json")}var vG={anthropic:"anthropic",openai:"openai-codex"};function gG($){return t6($,vG)}function t6($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let V=T$(G.access),K=T$(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function uG($){return t6($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function dG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?t0(J,Z.slice(2)):Z||t0(J,".pi","agent")}async function o6($,J,Z=e2){let Q=[],X=await Z.exec(SG,["find-generic-password","-s",EG,"-w"],wG),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?a6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(a6(await Z.readText(t0(kG($,J),".credentials.json"))));let V=hG(await Z.readText(t0(yG($,J),"auth.json")));G(V),G(lG(await Z.readText(t0($.GROK_HOME||t0(J,".grok"),"auth.json"))));for(let K of gG(await Z.readText(mG($,J))))G(K);for(let K of uG(await Z.readText(t0(dG($,J),"auth.json"))))G(K);return Q}function e6($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var i6="https://auth.x.ai",n6="b1a00492-073a-47ea-816f-4c329264a828",r6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function lG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${i6}::${n6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==i6||Q.oidc_client_id!==n6||!r6(Q.key)||!r6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var $7=330000,cG=300000,sG=60000;function aG($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+$7)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function iG($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*$7)?sG:cG}var nG=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function J7($){let J=new Map,Z=$.wait??nG,Q=$.stores??(process.platform==="darwin"?e2:{...e2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=e6(await o6($.environment??process.env,$.home,Q));for(let Y of aG(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(iG(J),$.signal)}}function Z7($=process.env){return new Promise((J)=>{pG("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as rG,spawn as R_,spawnSync as C_}from"child_process";import{chmodSync as P_,existsSync as tG,mkdirSync as x_,readFileSync as E_,renameSync as S_,rmSync as w_,statSync as b_,writeFileSync as k_}from"fs";import{dirname as f_,isAbsolute as h_,join as y3}from"path";var Q7=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function X7($,J){if(!Q7.test($)||!Q7.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var oG="com.reasonmachines.updater",eG=["so.ara.updater","so.reason.updater"];function $B($){let J=$==="staging"?".staging":"";return{label:`${oG}${J}`,legacyLabels:[...eG].reverse().map((Z)=>`${Z}${J}`)}}function JB($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function ZB($,J){return new Promise((Z)=>{rG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function B7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=$B($.channel),G=$.configHome??G7(Q),V=[X,...Y].filter((H)=>{let U=JB(H,Q,G);return tG(J==="darwin"?U.launchAgent:U.systemdService)});if(V.length===0)return"absent";let K=$.command??ZB,N=V[0];if(V.length>1){for(let H of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${H}`]):await K("systemctl",["--user","is-enabled",`${H}.timer`]))===0){N=H;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var Y7=60000;function K7($){let J=(X,Y)=>{try{return X7(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(Y7-1,Math.floor(G*Y7)))}}var QB=30000;async function V7($){return($.flush??L8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(QB);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var N7=25000,YB=5000,GB=600000,BB=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return u0(),I7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var U7=5000,KB=600000;function VB($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[i1])return null;try{return C2({platform:J})}catch{return null}}function HB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function NB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)g$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)g$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Q2($,J,Z,Q,X={}){if(u0(),$.executionMode==="host")Z2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?R7():Promise.resolve(!1),q=D7(),H=X.prestartedReadiness??i$($,X.readinessProbes,V,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?H.initial:H.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??Z7)().catch(()=>!1):null,D=new AbortController,j=null,z=async(f,a)=>{let i=($.userChrome??X.ownComputer===!0)&&f["automation.call.v1"]===!0?A7():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
83
- `);let K0=g3($,f,{displayVideo:f["display.stream.v1"]===!0&&await N(),handsBrowser:f["hands.connect"]===!0&&q,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:f["pty.start"]===!0&&l2(),probing:a});if(!j&&K0.worker.readiness?.["browser.pr-proof.v1"]===!0){let R0=await c6();if(j||D.signal.aborted)return K0;process.stderr.write("error"in R0?`Reason worker: PR video proof unavailable (${R0.error})
79
+ `,{mode:384,flag:"wx"});let q={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],q),K="output";let H=await P6(V);if(!H.isFile()||H.isSymbolicLink()||H.nlink!==1||H.size<128||H.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],q),K="pin",await Promise.all([X1(Z.ffmpeg),X1(Z.ffprobe)]),await I6(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await XG(G,{recursive:!0,force:!0})}}}}var S6=B.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var Y1=B.string().min(1).max(1024),E6=B.object({path:Y1,sha256:B.string().regex(/^[a-f0-9]{64}$/)}).strict(),w6=B.object({owner:B.object({runId:Y1,deviceId:Y1,rootId:Y1,rootRevision:Y1,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:Y1,generation:Y1,browserScope:Y1,tabId:B.number().int().positive()}).strict(),socketPath:Y1,extensionId:B.string().regex(/^[a-p]{32}$/),nativeHostName:Y1,seconds:B.number().int().min(1).max(15),encoder:B.object({ffmpeg:E6,ffprobe:E6}).strict()}).strict();var FG=15728640,I1=()=>Error("mac_recording_worker_failed");function k6($){let J=w6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,V=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(I1()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,H=async()=>{if(X)throw I1();if(await K($.assertCurrent()),X)throw I1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await H(),await X1({path:Z.path,sha256:Z.sha256}),await H(),G=null;let U=await UG(await NG(MG(qG(),"reason-recording-host-")));try{await H()}catch(I){throw await b6(U,{recursive:!0,force:!0}),I}let M=TG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((I)=>M.once("close",()=>I())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(I){if(I.code!=="ESRCH")throw I}},D=null;V=()=>D??=(async()=>{try{_()}catch(I){if(I.code!=="EPERM")throw I}await T;try{for(let I=0;;I++)try{_();break}catch(E){if(E.code!=="EPERM"||I>=20)throw E;await new Promise((A)=>setTimeout(A,25))}}finally{await b6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,R,x=new Promise((I,E)=>{L=I,R=E}),C,P,h=new Promise((I,E)=>{C=I,P=E});h.catch(()=>{});let S=(I=I1())=>{if(F)return;F=!0,clearTimeout(y),clearInterval(k),N().then(()=>{R(I),P(I)},(E)=>{R(E),P(E)})},y=setTimeout(()=>S(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,H().catch(()=>S()).finally(()=>{l=!1})},250);q={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
80
+ `)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(I)=>{if(F)return;if(z+=I.length,z>FG){S();return}j+=I.toString("utf8");let E;while((E=j.indexOf(`
81
+ `))!==-1){let A=j.slice(0,E);j=j.slice(E+1);try{let b=JSON.parse(A);if(b.type==="failed"&&Object.keys(b).sort().join(",")==="reason,type"){let o=S6.safeParse(b.reason);S(o.success?Error(`mac_recording_worker_failed:${o.data}`):I1());return}if(b.type==="unsupported"&&!O){S(Error("mac_recording_encoder_unavailable"));return}if(b.type==="started"&&!O&&Object.keys(b).length===1){O=!0,L({recording:!0});continue}if(!O||b.type!=="capture"||W||Object.keys(b).sort().join(",")!=="bytes,capture,type")throw I1();let w=b.capture;if(!w||Object.keys(w).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof w.sha256!=="string"||typeof w.startedAt!=="string"||typeof w.finishedAt!=="string"||!_G(w.owner,J.owner)||w.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(w.sha256)||!Number.isSafeInteger(w.sizeBytes)||w.sizeBytes<128||w.sizeBytes>10485760||!Number.isSafeInteger(w.frameCount)||w.frameCount<1||w.frameCount>450||!Number.isSafeInteger(w.receivedFrameCount)||w.receivedFrameCount<w.frameCount||w.receivedFrameCount>2000||!Number.isFinite(w.durationSeconds)||w.durationSeconds<0.05||w.durationSeconds>J.seconds||!Number.isFinite(Date.parse(w.startedAt))||!Number.isFinite(Date.parse(w.finishedAt))||Math.abs((Date.parse(w.finishedAt)-Date.parse(w.startedAt))/1000-w.durationSeconds)>0.1||typeof b.bytes!=="string"||b.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(b.bytes))throw I1();let n=Buffer.from(b.bytes,"base64");if(n.length!==w.sizeBytes||VG("sha256").update(n).digest("hex")!==w.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw I1();W={capture:Object.freeze({...w,captureId:HG(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(I)=>{if(F)return;if(I!==0||!W||j.trim()){S();return}let E=W;H().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(y),clearInterval(k),Q.set(E.capture.captureId,E);while(Q.size>2)Q.delete(Q.keys().next().value);C(E.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
82
+ `);try{return await x}catch(I){throw q=null,I}}finally{Y=!1}},async completed(){if(await H(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await H();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await H();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var y6=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await WG($.automationDirectory);J=(Q,X)=>n2(Z,Q,X)}if(await X1({path:$.worker.path,sha256:$.worker.sha256}),!await $2($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),V=new P1({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=y6.parse(await V.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!B.array(B.object({id:B.number()})).parse(await V.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:G.instanceId,async createHost(N,q,H){let U=new P1({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return k6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){H.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=y6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),jG=B.object({operationId:B.string().uuid()}).strict();function h6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=B.array(B.object({profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:B.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!B.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,G=!1,V=new LG,K=async(U)=>{let M=V.getStore();if(G||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),G)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=F6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let R=await $.resolveBrowser(U.profile,O,j,L);if(R.extensionInstanceId!==U.extensionInstanceId)throw A0();return R.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),G)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!f6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},H=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{G=!0})},1000);return H.unref(),{generation:$.generation,async execute(U,M,T){return V.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!f6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let R=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||DG("sha256").update(R.bytes).digest("hex")!==_.sha256)throw A0();await z();let x={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,x);try{let C=await fetch(L,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await C.body?.cancel(),await z(),C.ok)x.result={...x.result,status:"uploaded"}}catch{}F=x.result}finally{R.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==T6)return!1;let T=jG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await V.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(H);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var xG="__browser-recorder",EG=IG(zG),SG="/tmp/open-browser-use",wG=33554432,bG=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.literal(o2),extensionInstanceId:B.string().min(1).max(1024)})}),v6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:n$,ensureBrowser:l6,socketDirectory:SG,async identity($){let J=new P1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function g6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw v6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(p6(Z),"Default","Local Extension Settings",o2),X=(await m6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await m6(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=S3(J.socketDirectory,Y);try{let V=await AG(G);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=bG.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await CG(N)).size<=wG&&(await c6(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:o2}}catch{}}throw v6()}async function w3($){let J=await RG($);return{path:J,sha256:OG("sha256").update(await c6(J)).digest("hex")}}async function s6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await EG(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await $2(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...PG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],xG]};return{worker:{...await w3(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function a6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=u6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?d6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(H)=>K6(H.organizationId,H.sessionId,H.deviceId,1),K=$.recording,N,q=h6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(H,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>g6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(H,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>kG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(H)=>P3({...H,endpoint:(U)=>({discover:(M)=>g6(M,Z),tabScope:V(U)})})});return{capability:G,broker:q}}function kG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as tG}from"child_process";import{execFile as yG}from"child_process";import{readFile as fG}from"fs/promises";import{join as o0}from"path";var hG="Claude Code-credentials",mG="/usr/bin/security",vG=120000,gG=8192,e2={exec:($,J,Z)=>new Promise((Q)=>{yG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await fG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=gG?$:null}function uG($,J){return $.CLAUDE_CONFIG_DIR||o0(J,".claude")}function dG($,J){return $.CODEX_HOME||o0(J,".codex")}function i6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function lG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function pG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:lG(Z)??Date.now()}}catch{return null}}function cG($,J){return o0($.XDG_DATA_HOME||o0(J,".local","share"),"opencode","auth.json")}var sG={anthropic:"anthropic",openai:"openai-codex"};function aG($){return o6($,sG)}function o6($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let V=T$(G.access),K=T$(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function iG($){return o6($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function nG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?o0(J,Z.slice(2)):Z||o0(J,".pi","agent")}async function e6($,J,Z=e2){let Q=[],X=await Z.exec(mG,["find-generic-password","-s",hG,"-w"],vG),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?i6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(i6(await Z.readText(o0(uG($,J),".credentials.json"))));let V=pG(await Z.readText(o0(dG($,J),"auth.json")));G(V),G(rG(await Z.readText(o0($.GROK_HOME||o0(J,".grok"),"auth.json"))));for(let K of aG(await Z.readText(cG($,J))))G(K);for(let K of iG(await Z.readText(o0(nG($,J),"auth.json"))))G(K);return Q}function $7($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var n6="https://auth.x.ai",r6="b1a00492-073a-47ea-816f-4c329264a828",t6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function rG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${n6}::${r6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==n6||Q.oidc_client_id!==r6||!t6(Q.key)||!t6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var J7=330000,oG=300000,eG=60000;function $B($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+J7)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function JB($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*J7)?eG:oG}var ZB=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function Z7($){let J=new Map,Z=$.wait??ZB,Q=$.stores??(process.platform==="darwin"?e2:{...e2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=$7(await e6($.environment??process.env,$.home,Q));for(let Y of $B(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(JB(J),$.signal)}}function Q7($=process.env){return new Promise((J)=>{tG("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as QB,spawn as w_,spawnSync as b_}from"child_process";import{chmodSync as y_,existsSync as XB,mkdirSync as f_,readFileSync as h_,renameSync as m_,rmSync as v_,statSync as g_,writeFileSync as u_}from"fs";import{dirname as l_,isAbsolute as p_,join as y3}from"path";var X7=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function Y7($,J){if(!X7.test($)||!X7.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var YB="com.reasonmachines.updater",GB=["so.ara.updater","so.reason.updater"];function BB($){let J=$==="staging"?".staging":"";return{label:`${YB}${J}`,legacyLabels:[...GB].reverse().map((Z)=>`${Z}${J}`)}}function KB($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function VB($,J){return new Promise((Z)=>{QB($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function K7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=BB($.channel),G=$.configHome??B7(Q),V=[X,...Y].filter((H)=>{let U=KB(H,Q,G);return XB(J==="darwin"?U.launchAgent:U.systemdService)});if(V.length===0)return"absent";let K=$.command??VB,N=V[0];if(V.length>1){for(let H of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${H}`]):await K("systemctl",["--user","is-enabled",`${H}.timer`]))===0){N=H;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var G7=60000;function V7($){let J=(X,Y)=>{try{return Y7(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(G7-1,Math.floor(G*G7)))}}var HB=30000;async function H7($){return($.flush??D8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(HB);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var U7=25000,UB=5000,qB=600000,MB=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return u0(),I7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var q7=5000,TB=600000;function _B($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[i1])return null;try{return C2({platform:J})}catch{return null}}function FB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function WB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)g$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)g$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Q2($,J,Z,Q,X={}){if(u0(),$.executionMode==="host")Z2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?C7():Promise.resolve(!1),q=j7(),H=X.prestartedReadiness??i$($,X.readinessProbes,V,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?H.initial:H.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??Q7)().catch(()=>!1):null,D=new AbortController,j=null,z=async(f,a)=>{let i=($.userChrome??X.ownComputer===!0)&&f["automation.call.v1"]===!0?R7():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
83
+ `);let K0=g3($,f,{displayVideo:f["display.stream.v1"]===!0&&await N(),handsBrowser:f["hands.connect"]===!0&&q,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:f["pty.start"]===!0&&l2(),probing:a});if(!j&&K0.worker.readiness?.["browser.pr-proof.v1"]===!0){let R0=await s6();if(j||D.signal.aborted)return K0;process.stderr.write("error"in R0?`Reason worker: PR video proof unavailable (${R0.error})
84
84
  `:`Reason worker: PR video proof ready (ffmpeg ${R0.encoder.ffmpeg.path})
85
- `),j=s6({assertCurrent:async()=>{if(!k())throw Error("proof_authority_lost")},...!("error"in R0)?{recording:R0}:{}})}return K0},F=await z(M,U?F3.filter((f)=>M[f]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,R=0,x="starting",C=null,I=!1,h=!1,S=null,y,l=()=>!G.drained&&Date.parse(Y)>Date.now()&&O.supported_operations.some((f)=>F.worker.readiness?.[f]===!0),k=()=>!W&&l(),P=null,E=()=>L+(P?.claims()??0),A=null,b=new Set,w=(f)=>{let a=f.capabilities.root_paths;if(Object.assign(f.capabilities,m3(f.config,f.state,F,j?.capability)),a)f.capabilities.root_paths=a},n=(f)=>{F=f,w({config:$,state:J,capabilities:O}),A?.();for(let a of b)w(a),a.heartbeatNow?.()},o=new Set,N0=new Set,j0=setInterval(()=>{let f=new Set;for(let a of[{state:J,capabilities:O},...b])for(let q0 of BB){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let K0=`${a.state.deviceId} ${q0}`;if(f.add(K0),!o.has(K0)||N0.has(K0))continue;N0.add(K0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
86
- `)}o.clear();for(let a of f)o.add(a)},GB);j0.unref();let W1=(f)=>{if(!X.readinessProbes)t5({config:$,readiness:f,signal:D.signal,idle:()=>E()===0,permissions:J.roots[0].permissions,onReady:(a)=>{z(a,[]).then(n)}})},L1=U?H.final.then(async(f)=>{if(D.signal.aborted)return;n(await z(f,[]));let a=F3.filter((q0)=>f[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
87
- `),W1(f)},()=>{}):Promise.resolve();if(!U)W1(M);_?.then(async(f)=>{T=f;for(;;){let a=F,q0=await z(a.worker.readiness??{},a.worker.probing??[]);if(D.signal.aborted)return;if(F!==a)continue;n(q0);return}});let O$=U&&F.worker.probing?.includes("pty.start")?H.pty.then(async(f)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!a())return;let q0=await z({...F.worker.readiness,"pty.start":f},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(D.signal.aborted||!a())return;n(q0)},()=>{}):Promise.resolve(),x1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:x,drained:G.drained||W||I,activeClaims:E(),activeSessions:R,lastHeartbeat:C,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:k()&&!I&&x==="running"}),t1=!1,D1=()=>{t1=!0,B1()},B1=()=>{if(W)return;if(W=!0,x="stopping",S?.close(),E()===0)D.abort();else y=setTimeout(()=>D.abort(),$.shutdownGraceMs)},E1=$.channel==="production"||$.channel==="staging"?$.channel:null,K1=d($).releaseCheck,v=X.publishedRelease??(E1&&$.lifetime==="persistent"?K7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let f=JSON.parse(s(K1));return typeof f==="string"?f:null}catch{return null}})(),check:async(f)=>{try{c(K1,f)}catch{}let a=await B7({channel:E1});process.stderr.write(a==="started"?`Reason worker: CLI ${f} is published; the updater is checking now.
85
+ `),j=a6({assertCurrent:async()=>{if(!k())throw Error("proof_authority_lost")},...!("error"in R0)?{recording:R0}:{}})}return K0},F=await z(M,U?F3.filter((f)=>M[f]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,R=0,x="starting",C=null,P=!1,h=!1,S=null,y,l=()=>!G.drained&&Date.parse(Y)>Date.now()&&O.supported_operations.some((f)=>F.worker.readiness?.[f]===!0),k=()=>!W&&l(),I=null,E=()=>L+(I?.claims()??0),A=null,b=new Set,w=(f)=>{let a=f.capabilities.root_paths;if(Object.assign(f.capabilities,m3(f.config,f.state,F,j?.capability)),a)f.capabilities.root_paths=a},n=(f)=>{F=f,w({config:$,state:J,capabilities:O}),A?.();for(let a of b)w(a),a.heartbeatNow?.()},o=new Set,N0=new Set,j0=setInterval(()=>{let f=new Set;for(let a of[{state:J,capabilities:O},...b])for(let q0 of MB){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let K0=`${a.state.deviceId} ${q0}`;if(f.add(K0),!o.has(K0)||N0.has(K0))continue;N0.add(K0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
86
+ `)}o.clear();for(let a of f)o.add(a)},qB);j0.unref();let L1=(f)=>{if(!X.readinessProbes)o5({config:$,readiness:f,signal:D.signal,idle:()=>E()===0,permissions:J.roots[0].permissions,onReady:(a)=>{z(a,[]).then(n)}})},D1=U?H.final.then(async(f)=>{if(D.signal.aborted)return;n(await z(f,[]));let a=F3.filter((q0)=>f[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
87
+ `),L1(f)},()=>{}):Promise.resolve();if(!U)L1(M);_?.then(async(f)=>{T=f;for(;;){let a=F,q0=await z(a.worker.readiness??{},a.worker.probing??[]);if(D.signal.aborted)return;if(F!==a)continue;n(q0);return}});let O$=U&&F.worker.probing?.includes("pty.start")?H.pty.then(async(f)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!a())return;let q0=await z({...F.worker.readiness,"pty.start":f},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(D.signal.aborted||!a())return;n(q0)},()=>{}):Promise.resolve(),E1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:x,drained:G.drained||W||P,activeClaims:E(),activeSessions:R,lastHeartbeat:C,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:k()&&!P&&x==="running"}),t1=!1,j1=()=>{t1=!0,K1()},K1=()=>{if(W)return;if(W=!0,x="stopping",S?.close(),E()===0)D.abort();else y=setTimeout(()=>D.abort(),$.shutdownGraceMs)},S1=$.channel==="production"||$.channel==="staging"?$.channel:null,V1=d($).releaseCheck,v=X.publishedRelease??(S1&&$.lifetime==="persistent"?V7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let f=JSON.parse(s(V1));return typeof f==="string"?f:null}catch{return null}})(),check:async(f)=>{try{c(V1,f)}catch{}let a=await K7({channel:S1});process.stderr.write(a==="started"?`Reason worker: CLI ${f} is published; the updater is checking now.
88
88
  `:a==="absent"?`Reason worker: CLI ${f} is published; no updater is installed for it here.
89
89
  `:`Reason worker: CLI ${f} is published; the updater did not start, so its next scheduled check takes it.
90
- `)}}):void 0),X0=(f)=>{if(f==="stop")D1();if(f==="reload_roots"){let a=t($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=C7(J.roots,H7());if(q0)O.root_paths=q0;else delete O.root_paths;P?.check()}if(f==="drain"||f==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:f==="drain"},x0($,G)}return x1()};X.prestartedControl?.handle(X0);let S1=X.prestartedControl?await X.prestartedControl.closed:await f2($,Q,X0),V1,w1=!1,g0=()=>{let f=Date.parse(Y)-Date.now();if(f>0){V1=setTimeout(g0,Math.min(f,2147483647));return}W=!0,S?.close(),w1=!0,x="stopping",D.abort(Error("worker_credential_expired"))};g0(),X.signal?.addEventListener("abort",B1,{once:!0});let A$=X.processSignals!==!1;if(A$)process.once("SIGTERM",B1),process.once("SIGINT",D1);if(X.signal?.aborted)B1();try{X.onStartup?.("control_ready");let f=X.client??new J2(o0($.apiOrigin),k0($.proxy,q7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=C4($,J.deviceId),i=X.startupTiming,K0=i?()=>({...i(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,R0=(m)=>{let s0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&s0)(X.handOverLocalLogins??J7)({state:m.state,client:{localSubscription:s0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=H7(),w0=m.client.liveSessionWorktrees?.bind(m.client);if(w0)F7(()=>_7({home:W0,deviceId:m.state.deviceId,liveIds:(j1)=>w0(m.state,j1,m.signal)}),m.signal)};R0({state:J,client:f,signal:D.signal});let H1=VB($,X.platform??process.platform),o1=f.deviceLifecycle?.bind(f),C0=Promise.resolve(),S0=0,R$=()=>{if(!H1||!o1||W||Date.now()<S0)return;S0=Date.now()+KB,C0=C0.then(()=>V7({paths:H1,device:J,client:{deviceLifecycle:o1},accept:HB,signal:D.signal})).catch(()=>{return})};if(R$(),H1)H.final.then((m)=>NB(H1,m),()=>{});let H2=(m,s0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+z7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:N7,operationCompletionTimeoutMs:N7,maxConsecutiveHeartbeatFailures:3,claimable:k,advertised:l,onClaim:async(W0,w0,j1)=>{let I$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let a0=F.worker.probing??[],H9=a0.includes(W0.capability)?L1:W0.capability==="hands.connect"&&$.executionMode==="host"&&a0.includes("pty.start")?O$:null;if(H9){let U2,D4=()=>{};await Promise.race([H9,new Promise((N9)=>{U2=setTimeout(N9,YB),D4=()=>N9(),w0.addEventListener("abort",D4,{once:!0})})]),clearTimeout(U2),w0.removeEventListener("abort",D4)}let N2=W0.capability==="hands.connect",L4=N2?S:null,rJ={signal:w0,emit:j1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(U2)=>m.client.operationCustomEndpointCredential(m.state,W0,U2)}:{},...N2?{handsLaunch:{claimedAtMs:I$,...L4?{takePrespawnedWorker:L4.take,adoptSpawnedWorker:L4.adopt}:{}}}:{}};if(N2)R+=1;try{return await(X.execute??u3)(m.state,W0,rJ)}finally{if(N2)R-=1}},onControl:async(W0,w0)=>await P7(m.state,W0,w0,m.client)||await x7(m.state,W0,w0)||await O7(W0,w0)||await j?.broker.control(W0,w0)||!1,onEvent:s0}),B9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:XB(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(U7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,K9=f.ownerWorkspaces?.bind(f),V9=f.ownerWorkspaceEnrollment?.bind(f);if(C$&&K9&&V9)P=t9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:K9,ownerWorkspaceEnrollment:V9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,s0,W0)=>{let w0=C4(m.config,m.state.deviceId),j1={config:m.config,state:m.state,signal:s0,statusPath:d(m.config).daemon,...w0?.offer?{firstHeartbeat:w0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new J2(o0($.apiOrigin),k0($.proxy,q7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};R0(j1);let I$={...j1,heartbeatNow:null};b.add(I$);try{await K3({registerHeartbeatNow:(a0)=>{I$.heartbeatNow=a0},...H2(j1,(a0)=>{if(a0.type==="completed")v3(a0.operationId,a0.status);if(a0.type==="claims_changed"){if(W0(a0.activeClaims),W&&E()===0)D.abort()}if(a0.type==="stopped")W0(0)})})}finally{b.delete(I$)}if(W&&!w1)await B9(j1)}});let _4=0,F4=0,W4=C$?.intervalMs??s9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>E()>0?S2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...K0?{startup:K0}:{},...H2({state:J,client:f,capabilities:O,signal:D.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&E()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=L7({log:(s0,W0)=>{process.stderr.write(`${JSON.stringify({event:s0,...W0})}
91
- `)}}),S.arm(),setTimeout(j7,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(P&&!W&&Date.now()>=_4)_4=Date.now()+W4,P.check().then((s0)=>{F4=s0?0:F4+1,_4=Date.now()+(s0?W4:Math.min(W4,a9*2**Math.min(F4-1,10)))});if(C=m.serverTime,I=m.drain,R$(),!W&&E1)v?.(m.latestCliVersions?.[E1]);if(!W)x="running";if(!W&&!h&&x1().executionEligible){if(h=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)x="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await P?.settled(),W&&!w1&&$.lifetime==="ephemeral")await f.disconnect?.(J,AbortSignal.timeout(U7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
92
- `)});else if(W&&!w1)await B9({state:J,client:f});if(t1)await W7().catch(()=>{return})}catch(f){if(!(f instanceof _0&&f.status===401))throw f;if(x0($,{...G,revoked:!0}),f.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(V1),clearInterval(j0),y)clearTimeout(y);if(A$)process.removeListener("SIGTERM",B1),process.removeListener("SIGINT",D1);X.signal?.removeEventListener("abort",B1),D.abort(),S?.close(),await P?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await S1()}}function q7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(M7,T7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as UB,sign as qB}from"crypto";var E7=65536,MB=65536;function TB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new Y0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new Y0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!w7(X))throw new Y0("invalid_public_key");return X}function S7(){try{let{privateKey:$,publicKey:J}=UB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:TB(J)}}catch($){if($ instanceof Y0)throw $;throw new Y0("proof_key_generation_failed")}}class X2{keyPair=S7();binding=null;loadPublicKey(){if(!this.keyPair)throw new Y0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=S7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>MB)throw new Y0("proof_sign_failed");let J;try{J=qB("sha256",$,this.keyPair.privateKey)}catch{throw new Y0("proof_sign_failed")}if(!b7(J))throw new Y0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>E7)throw new Y0("invalid_binding");if(this.binding)throw new Y0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>E7)throw new Y0("invalid_binding");if(!this.binding)throw new Y0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as zB,spawn as OB}from"child_process";import{isAbsolute as AB}from"path";import{promisify as RB}from"util";var Y2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class G2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=Y2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
93
- `;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as _B}from"crypto";import{unlinkSync as FB}from"fs";import{join as WB}from"path";var B2=1,$4=45000,LB=B.strictObject({type:B.literal("configure"),protocol:B.literal(B2),version:B.string(),config:J0}),DB=B.strictObject({type:B.literal("ticket"),organizationId:B.string().min(1).max(160),receipt:B.unknown()}),jB=B.strictObject({type:B.enum(["ping","stop"])});async function k7($={}){let J=$.clock??Y2,Z=new G2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,V,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:H,version:U}=LB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(U1(H),e(g(H),!0),V=Z1({path:d(H).lock,runtimeVersion:r}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=WB(g(H),`ssh-preflight-${_B()}.json`);try{c(M,{version:1}),s(M)}finally{try{FB(M)}catch{}}let T=t(H),_=$0(H);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&H.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:B2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=H.lifetime==="ephemeral"?K=new X2:T0(H,!0);if(!T){let W=R1(H);await Z.send({type:"ticket-request",request:W.request});let L=DB.parse(await Z.receive(70000,Q.signal)),R=W.complete(L.organizationId,L.receipt);if(T=await J1(H,R,D,$.enroll),H.lifetime==="persistent")m0(T,d(H).state,{proofStore:D});x0(H,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(jB.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min($4,$.startupTimeoutMs??$4)),()=>{F=!0,Y()});let O=V.owner.nonce;if(await Q2(H,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(H,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:H.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(H){let U=H instanceof Error&&/^worker_[a-z_]+$/.test(H.message)?H.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>AB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,CB=B.strictObject({type:B.literal("hello"),protocol:B.literal(B2),version:B.string(),platform:B.enum(["linux","darwin"]),architecture:B.enum(["arm64","x64"]),enrolled:B.boolean()}),IB=B.strictObject({type:B.literal("ticket-request"),request:B.strictObject({install_id:B.uuid(),code_challenge:B.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:B.enum(["persistent","ephemeral"]),roots:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),execution_mode:B.enum(["confined","host"]),permissions:B.strictObject({read:B.literal(!0),write:B.literal(!0),execute:B.literal(!0),discover_environment:B.literal(!0),expose_mcp:B.literal(!1)})})).length(1)})}),y7=B.discriminatedUnion("type",[B.strictObject({type:B.literal("running"),deviceId:B.string().min(1).max(160),expiresAt:B.iso.datetime({offset:!0}),lifetime:B.enum(["persistent","ephemeral"]),supervision:B.literal("ssh-foreground")}),B.strictObject({type:B.literal("pong")}),B.strictObject({type:B.literal("stopped")})]),PB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function J4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&PB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function f7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
90
+ `)}}):void 0),X0=(f)=>{if(f==="stop")j1();if(f==="reload_roots"){let a=t($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=P7(J.roots,N7());if(q0)O.root_paths=q0;else delete O.root_paths;I?.check()}if(f==="drain"||f==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:f==="drain"},x0($,G)}return E1()};X.prestartedControl?.handle(X0);let w1=X.prestartedControl?await X.prestartedControl.closed:await f2($,Q,X0),H1,b1=!1,g0=()=>{let f=Date.parse(Y)-Date.now();if(f>0){H1=setTimeout(g0,Math.min(f,2147483647));return}W=!0,S?.close(),b1=!0,x="stopping",D.abort(Error("worker_credential_expired"))};g0(),X.signal?.addEventListener("abort",K1,{once:!0});let A$=X.processSignals!==!1;if(A$)process.once("SIGTERM",K1),process.once("SIGINT",j1);if(X.signal?.aborted)K1();try{X.onStartup?.("control_ready");let f=X.client??new J2(e0($.apiOrigin),k0($.proxy,M7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=C4($,J.deviceId),i=X.startupTiming,K0=i?()=>({...i(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,R0=(m)=>{let a0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&a0)(X.handOverLocalLogins??Z7)({state:m.state,client:{localSubscription:a0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=N7(),w0=m.client.liveSessionWorktrees?.bind(m.client);if(w0)W7(()=>F7({home:W0,deviceId:m.state.deviceId,liveIds:(z1)=>w0(m.state,z1,m.signal)}),m.signal)};R0({state:J,client:f,signal:D.signal});let N1=_B($,X.platform??process.platform),o1=f.deviceLifecycle?.bind(f),C0=Promise.resolve(),S0=0,R$=()=>{if(!N1||!o1||W||Date.now()<S0)return;S0=Date.now()+TB,C0=C0.then(()=>H7({paths:N1,device:J,client:{deviceLifecycle:o1},accept:FB,signal:D.signal})).catch(()=>{return})};if(R$(),N1)H.final.then((m)=>WB(N1,m),()=>{});let H2=(m,a0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+O7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:U7,operationCompletionTimeoutMs:U7,maxConsecutiveHeartbeatFailures:3,claimable:k,advertised:l,onClaim:async(W0,w0,z1)=>{let P$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let i0=F.worker.probing??[],H9=i0.includes(W0.capability)?D1:W0.capability==="hands.connect"&&$.executionMode==="host"&&i0.includes("pty.start")?O$:null;if(H9){let U2,D4=()=>{};await Promise.race([H9,new Promise((N9)=>{U2=setTimeout(N9,UB),D4=()=>N9(),w0.addEventListener("abort",D4,{once:!0})})]),clearTimeout(U2),w0.removeEventListener("abort",D4)}let N2=W0.capability==="hands.connect",L4=N2?S:null,tJ={signal:w0,emit:z1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(U2)=>m.client.operationCustomEndpointCredential(m.state,W0,U2)}:{},...N2?{handsLaunch:{claimedAtMs:P$,...L4?{takePrespawnedWorker:L4.take,adoptSpawnedWorker:L4.adopt}:{}}}:{}};if(N2)R+=1;try{return await(X.execute??u3)(m.state,W0,tJ)}finally{if(N2)R-=1}},onControl:async(W0,w0)=>await x7(m.state,W0,w0,m.client)||await E7(m.state,W0,w0)||await A7(W0,w0)||await j?.broker.control(W0,w0)||!1,onEvent:a0}),B9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:NB(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(q7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,K9=f.ownerWorkspaces?.bind(f),V9=f.ownerWorkspaceEnrollment?.bind(f);if(C$&&K9&&V9)I=o9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:K9,ownerWorkspaceEnrollment:V9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,a0,W0)=>{let w0=C4(m.config,m.state.deviceId),z1={config:m.config,state:m.state,signal:a0,statusPath:d(m.config).daemon,...w0?.offer?{firstHeartbeat:w0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new J2(e0($.apiOrigin),k0($.proxy,M7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};R0(z1);let P$={...z1,heartbeatNow:null};b.add(P$);try{await K3({registerHeartbeatNow:(i0)=>{P$.heartbeatNow=i0},...H2(z1,(i0)=>{if(i0.type==="completed")v3(i0.operationId,i0.status);if(i0.type==="claims_changed"){if(W0(i0.activeClaims),W&&E()===0)D.abort()}if(i0.type==="stopped")W0(0)})})}finally{b.delete(P$)}if(W&&!b1)await B9(z1)}});let _4=0,F4=0,W4=C$?.intervalMs??a9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>E()>0?S2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...K0?{startup:K0}:{},...H2({state:J,client:f,capabilities:O,signal:D.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&E()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=D7({log:(a0,W0)=>{process.stderr.write(`${JSON.stringify({event:a0,...W0})}
91
+ `)}}),S.arm(),setTimeout(z7,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(I&&!W&&Date.now()>=_4)_4=Date.now()+W4,I.check().then((a0)=>{F4=a0?0:F4+1,_4=Date.now()+(a0?W4:Math.min(W4,i9*2**Math.min(F4-1,10)))});if(C=m.serverTime,P=m.drain,R$(),!W&&S1)v?.(m.latestCliVersions?.[S1]);if(!W)x="running";if(!W&&!h&&E1().executionEligible){if(h=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)x="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await I?.settled(),W&&!b1&&$.lifetime==="ephemeral")await f.disconnect?.(J,AbortSignal.timeout(q7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
92
+ `)});else if(W&&!b1)await B9({state:J,client:f});if(t1)await L7().catch(()=>{return})}catch(f){if(!(f instanceof _0&&f.status===401))throw f;if(x0($,{...G,revoked:!0}),f.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(H1),clearInterval(j0),y)clearTimeout(y);if(A$)process.removeListener("SIGTERM",K1),process.removeListener("SIGINT",j1);X.signal?.removeEventListener("abort",K1),D.abort(),S?.close(),await I?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await w1()}}function M7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(T7,_7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as LB,sign as DB}from"crypto";var S7=65536,jB=65536;function zB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new Y0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new Y0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!b7(X))throw new Y0("invalid_public_key");return X}function w7(){try{let{privateKey:$,publicKey:J}=LB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:zB(J)}}catch($){if($ instanceof Y0)throw $;throw new Y0("proof_key_generation_failed")}}class X2{keyPair=w7();binding=null;loadPublicKey(){if(!this.keyPair)throw new Y0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=w7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>jB)throw new Y0("proof_sign_failed");let J;try{J=DB("sha256",$,this.keyPair.privateKey)}catch{throw new Y0("proof_sign_failed")}if(!k7(J))throw new Y0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>S7)throw new Y0("invalid_binding");if(this.binding)throw new Y0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>S7)throw new Y0("invalid_binding");if(!this.binding)throw new Y0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as xB,spawn as EB}from"child_process";import{isAbsolute as SB}from"path";import{promisify as wB}from"util";var Y2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class G2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=Y2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
93
+ `;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as OB}from"crypto";import{unlinkSync as AB}from"fs";import{join as RB}from"path";var B2=1,$4=45000,CB=B.strictObject({type:B.literal("configure"),protocol:B.literal(B2),version:B.string(),config:J0}),PB=B.strictObject({type:B.literal("ticket"),organizationId:B.string().min(1).max(160),receipt:B.unknown()}),IB=B.strictObject({type:B.enum(["ping","stop"])});async function y7($={}){let J=$.clock??Y2,Z=new G2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,V,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:H,version:U}=CB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(q1(H),e(g(H),!0),V=Q1({path:d(H).lock,runtimeVersion:r}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=RB(g(H),`ssh-preflight-${OB()}.json`);try{c(M,{version:1}),s(M)}finally{try{AB(M)}catch{}}let T=t(H),_=$0(H);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&H.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:B2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=H.lifetime==="ephemeral"?K=new X2:T0(H,!0);if(!T){let W=C1(H);await Z.send({type:"ticket-request",request:W.request});let L=PB.parse(await Z.receive(70000,Q.signal)),R=W.complete(L.organizationId,L.receipt);if(T=await Z1(H,R,D,$.enroll),H.lifetime==="persistent")m0(T,d(H).state,{proofStore:D});x0(H,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(IB.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min($4,$.startupTimeoutMs??$4)),()=>{F=!0,Y()});let O=V.owner.nonce;if(await Q2(H,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(H,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:H.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(H){let U=H instanceof Error&&/^worker_[a-z_]+$/.test(H.message)?H.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>SB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,bB=B.strictObject({type:B.literal("hello"),protocol:B.literal(B2),version:B.string(),platform:B.enum(["linux","darwin"]),architecture:B.enum(["arm64","x64"]),enrolled:B.boolean()}),kB=B.strictObject({type:B.literal("ticket-request"),request:B.strictObject({install_id:B.uuid(),code_challenge:B.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:B.enum(["persistent","ephemeral"]),roots:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),execution_mode:B.enum(["confined","host"]),permissions:B.strictObject({read:B.literal(!0),write:B.literal(!0),execute:B.literal(!0),discover_environment:B.literal(!0),expose_mcp:B.literal(!1)})})).length(1)})}),f7=B.discriminatedUnion("type",[B.strictObject({type:B.literal("running"),deviceId:B.string().min(1).max(160),expiresAt:B.iso.datetime({offset:!0}),lifetime:B.enum(["persistent","ephemeral"]),supervision:B.literal("ssh-foreground")}),B.strictObject({type:B.literal("pong")}),B.strictObject({type:B.literal("stopped")})]),yB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function J4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&yB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function h7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
94
94
  a=${d3($.remoteCli)}
95
95
  [ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
96
96
  p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
@@ -101,11 +101,11 @@ elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
101
101
  else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
102
102
  h=\${h%% *}
103
103
  [ "$h" = ${d3($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
104
- exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function h7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,f7($)]}function xB($){return h7($,!1)}function m7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function EB($){let J;try{({stdout:J}=await RB(zB)("/usr/bin/ssh",["-G",...h7($,!0)],{env:m7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
105
- `)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function SB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function wB($){await EB($);let J=OB("/usr/bin/ssh",xB($),{stdio:["pipe","pipe","pipe"],env:m7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=SB(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function bB($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let V=$[G];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let V=J.get(G);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");f7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(K2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function kB($,J,Z,Q,X){let{request:Y}=IB.parse(J4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{G();let N=Z??O1(J),q=await(Q.enrollmentCredentials??A1)(J,N);if(G(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let H=Q.createTicketClient?.(q)??new N1(q,{credentialsPath:N}),U=w4(await H.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([V,new Promise((q,H)=>{if(K=()=>H(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function v7($,J={}){let{config:Z,target:Q,credentialPath:X}=bB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??Y2,G=await(J.sshTransport??wB)(Q),V=new G2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),q,H;if(G.result.then((U)=>{H=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:B2,version:r,config:Z});let U=CB.parse(J4(await V.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await kB(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));q=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:E4)+$4+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=y7.parse(J4(await V.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
106
- `)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(y7.parse(J4(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=H??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),V.dispose()}}import{createConnection as vB}from"net";import{WebSocket as Z4}from"ws";var yB=1,F$=65536,g7=4096,u7=67108864,d7=4194304,_$=B.uuid(),fB=B.strictObject({kind:B.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:B.literal("install"),generation:B.number().int().positive(),transport:B.literal("reverse_ssh"),expiresAt:B.iso.datetime({offset:!0}),maxDurationMs:B.literal(300000),maxChannels:B.literal(1),allowTcpForwarding:B.literal(!1),allowPty:B.literal(!1)}),hB=B.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var mB=B.strictObject({protocol:B.literal(yB),type:B.literal("ssh_install_relay"),authorityToken:B.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:fB,relayUrl:hB,endpoint:B.strictObject({host:B.literal("127.0.0.1"),port:B.literal(22)})});function p3($,J=Date.now()){let Z=mB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function l7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function p7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var c7="ssh_install_relay_closed";function gB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function uB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function dB($,J=c7){try{$.close(1000,J)}catch{$.terminate()}}async function lB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new Z4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>vB({host:"127.0.0.1",port:22})),G,V=!1,K=!1,N=0,q=0,H,U=(W)=>{if(H)clearTimeout(H);H=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),H.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=c7)=>{if(K)return;if(K=!0,H)clearTimeout(H);if($.signal?.removeEventListener("abort",D),G?.destroy(),X.readyState===Z4.OPEN)dB(X,W);else if(X.readyState!==Z4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=g7&&q<=u7},F=(W)=>{if(K||!V||X.readyState!==Z4.OPEN||X.bufferedAmount>d7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=l7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let R=gB(W);if(R>F$||!z(R))return j();if(!V){if(L)return j();try{let C=p7(JSON.parse(String(W)));if(C.type!=="ssh_install_relay_ready"||C.authorityId!==Z.authority.authorityId)return j();V=!0,U(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",j),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{j()}return}if(!L)return j();let x=uB(W);if(!x||!G||G.destroyed||!G.write(x))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function s7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await lB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as pB}from"crypto";var n1="ARA_WORKER_PREVIEW_PROBE";async function i7(){if(typeof Bun>"u")return 1;let $=pB(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,V){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(n1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,V){if(typeof V!=="string"||V.length>8192){G.close();return}if(!G.data.relay){if(V===n1)G.send(n1);else G.close();return}try{let K=a7(V),N=(q)=>G.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>n1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===n1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(n1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===n1&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
104
+ exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function m7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,h7($)]}function fB($){return m7($,!1)}function v7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function hB($){let J;try{({stdout:J}=await wB(xB)("/usr/bin/ssh",["-G",...m7($,!0)],{env:v7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
105
+ `)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function mB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function vB($){await hB($);let J=EB("/usr/bin/ssh",fB($),{stdio:["pipe","pipe","pipe"],env:v7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=mB(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function gB($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let V=$[G];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let V=J.get(G);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");h7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(K2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function uB($,J,Z,Q,X){let{request:Y}=kB.parse(J4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{G();let N=Z??A1(J),q=await(Q.enrollmentCredentials??R1)(J,N);if(G(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let H=Q.createTicketClient?.(q)??new U1(q,{credentialsPath:N}),U=w4(await H.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([V,new Promise((q,H)=>{if(K=()=>H(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function g7($,J={}){let{config:Z,target:Q,credentialPath:X}=gB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??Y2,G=await(J.sshTransport??vB)(Q),V=new G2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),q,H;if(G.result.then((U)=>{H=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:B2,version:r,config:Z});let U=bB.parse(J4(await V.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await uB(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));q=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:E4)+$4+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=f7.parse(J4(await V.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
106
+ `)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(f7.parse(J4(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=H??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),V.dispose()}}import{createConnection as sB}from"net";import{WebSocket as Z4}from"ws";var dB=1,F$=65536,u7=4096,d7=67108864,l7=4194304,_$=B.uuid(),lB=B.strictObject({kind:B.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:B.literal("install"),generation:B.number().int().positive(),transport:B.literal("reverse_ssh"),expiresAt:B.iso.datetime({offset:!0}),maxDurationMs:B.literal(300000),maxChannels:B.literal(1),allowTcpForwarding:B.literal(!1),allowPty:B.literal(!1)}),pB=B.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var cB=B.strictObject({protocol:B.literal(dB),type:B.literal("ssh_install_relay"),authorityToken:B.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:lB,relayUrl:pB,endpoint:B.strictObject({host:B.literal("127.0.0.1"),port:B.literal(22)})});function p3($,J=Date.now()){let Z=cB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function p7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function c7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var s7="ssh_install_relay_closed";function aB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function iB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function nB($,J=s7){try{$.close(1000,J)}catch{$.terminate()}}async function rB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new Z4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>sB({host:"127.0.0.1",port:22})),G,V=!1,K=!1,N=0,q=0,H,U=(W)=>{if(H)clearTimeout(H);H=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),H.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=s7)=>{if(K)return;if(K=!0,H)clearTimeout(H);if($.signal?.removeEventListener("abort",D),G?.destroy(),X.readyState===Z4.OPEN)nB(X,W);else if(X.readyState!==Z4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=u7&&q<=d7},F=(W)=>{if(K||!V||X.readyState!==Z4.OPEN||X.bufferedAmount>l7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=p7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let R=aB(W);if(R>F$||!z(R))return j();if(!V){if(L)return j();try{let C=c7(JSON.parse(String(W)));if(C.type!=="ssh_install_relay_ready"||C.authorityId!==Z.authority.authorityId)return j();V=!0,U(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",j),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{j()}return}if(!L)return j();let x=iB(W);if(!x||!G||G.destroyed||!G.write(x))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function a7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await rB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as tB}from"crypto";var n1="ARA_WORKER_PREVIEW_PROBE";async function n7(){if(typeof Bun>"u")return 1;let $=tB(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,V){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(n1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,V){if(typeof V!=="string"||V.length>8192){G.close();return}if(!G.data.relay){if(V===n1)G.send(n1);else G.close();return}try{let K=i7(V),N=(q)=>G.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>n1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===n1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(n1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===n1&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
107
107
  `);else throw Error("probe_protocol_failed")}catch{G.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
108
- `),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as aB,createReadStream as iB,fstatSync as nB,readFileSync as rB}from"fs";var n7="/run/sc/instance-generation";var cB=/^[1-9][0-9]{0,15}\n?$/;function sB($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function r7($){if(typeof $!=="string"||!cB.test($))return null;let J=Number($.trim());return sB(J)?J:null}var t7=3,tB=600000,oB=65536,eB=500;function o7($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(t7))throw Error("worker_standby_invalid_invocation");return{handoffFd:t7}}function $K($=(J)=>rB(J,"utf8")){try{return r7($(n7))}catch{return null}}function JK($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=x4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var e7={isPipe:($)=>nB($).isFIFO(),stream:($)=>{let J=iB("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function ZK($,J=e7){if(!J.isPipe($.fd)){try{aB($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??tB),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});G.catch(()=>{});let V=J.every(eB,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],H=0;for await(let U of Q.chunks){if(X)throw X;if(H===0)$.onArriving?.();if(H+=U.length,H>oB)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function $J($,J=e7){let Z=$.readGeneration??(()=>$K()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await ZK({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return JK(Y)}var QK=`Usage: reason worker <command> --config PATH [--json]
108
+ `),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as $K,createReadStream as JK,fstatSync as ZK,readFileSync as QK}from"fs";var r7="/run/sc/instance-generation";var oB=/^[1-9][0-9]{0,15}\n?$/;function eB($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function t7($){if(typeof $!=="string"||!oB.test($))return null;let J=Number($.trim());return eB(J)?J:null}var o7=3,XK=600000,YK=65536,GK=500;function e7($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(o7))throw Error("worker_standby_invalid_invocation");return{handoffFd:o7}}function BK($=(J)=>QK(J,"utf8")){try{return t7($(r7))}catch{return null}}function KK($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=x4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var $J={isPipe:($)=>ZK($).isFIFO(),stream:($)=>{let J=JK("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function VK($,J=$J){if(!J.isPipe($.fd)){try{$K($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??XK),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});G.catch(()=>{});let V=J.every(GK,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],H=0;for await(let U of Q.chunks){if(X)throw X;if(H===0)$.onArriving?.();if(H+=U.length,H>YK)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function JJ($,J=$J){let Z=$.readGeneration??(()=>BK()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await VK({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return KK(Y)}var HK=`Usage: reason worker <command> --config PATH [--json]
109
109
 
110
110
  enroll Obtain/redeem a ticket using the current Reason login
111
111
  start Run the existing Device daemon in the foreground
@@ -146,15 +146,15 @@ Pretrust known_hosts. No agent forwarding, automatic installation or detached se
146
146
  SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
147
147
  are not forwarded/supported; running is not a browser-readiness receipt.
148
148
  Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
149
- `;function XK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var YK=1e4,GK=2000,JJ=15000,BK=50;async function QJ($,J,Z,Q,X,Y){let G=new X2,V=new AbortController,K,N,q=new Promise((x,C)=>{K=x,N=C});if(q.catch(()=>{}),u0(),$.executionMode==="host")Z2();Z("enrollment_started");let H=X(G);H.catch(()=>{});let U=null,M=f2($,J,(x)=>{if(!U)throw Error("worker_starting");return U(x)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((x)=>{z=x}),O=setTimeout(()=>z(),YK);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(x)=>{if(x==="ready")W=setTimeout(()=>z(),GK);Q.onStartup?.(x)},R=i$($,Q.readinessProbes,D,q,void 0,j,F);R.final.catch(()=>{});try{let x;try{x=await H}catch(C){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((I)=>I(),()=>{}),C}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(JJ,Date.parse(x.worker?.expiresAt??"")-Date.now()||JJ))),K(x.roots[0].permissions),x0($,{version:1,drained:!1,revoked:!1}),await Q2($,x,G,J,{...Q,onStartup:L,prestartedReadiness:R,prestartedControl:{closed:M,handle:(C)=>{U=C}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),V.abort(),G.deleteBinding(),G.deleteKey(),await M.then((x)=>x(),()=>{})}}async function KK($,J,Z,Q){let{handoffFd:X}=o7($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>a$(T);if(K||!M)return;try{u0(),Z2()}catch{return}if(Y=h5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{l2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??$J)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(V,BK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
150
- `),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:H,enrollment:U}=q;try{e(g(H),!0);let M=await XJ(H,()=>{});try{if(Q("lock_acquired"),t(H))throw Error("worker_ephemeral_requires_fresh_enrollment");return U1(H),await QJ(H,M.owner.nonce,Q,Z,(T)=>J1(H,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function T1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
149
+ `;function NK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var UK=1e4,qK=2000,ZJ=15000,MK=50;async function XJ($,J,Z,Q,X,Y){let G=new X2,V=new AbortController,K,N,q=new Promise((x,C)=>{K=x,N=C});if(q.catch(()=>{}),u0(),$.executionMode==="host")Z2();Z("enrollment_started");let H=X(G);H.catch(()=>{});let U=null,M=f2($,J,(x)=>{if(!U)throw Error("worker_starting");return U(x)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((x)=>{z=x}),O=setTimeout(()=>z(),UK);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(x)=>{if(x==="ready")W=setTimeout(()=>z(),qK);Q.onStartup?.(x)},R=i$($,Q.readinessProbes,D,q,void 0,j,F);R.final.catch(()=>{});try{let x;try{x=await H}catch(C){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((P)=>P(),()=>{}),C}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(ZJ,Date.parse(x.worker?.expiresAt??"")-Date.now()||ZJ))),K(x.roots[0].permissions),x0($,{version:1,drained:!1,revoked:!1}),await Q2($,x,G,J,{...Q,onStartup:L,prestartedReadiness:R,prestartedControl:{closed:M,handle:(C)=>{U=C}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),V.abort(),G.deleteBinding(),G.deleteKey(),await M.then((x)=>x(),()=>{})}}async function TK($,J,Z,Q){let{handoffFd:X}=e7($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>a$(T);if(K||!M)return;try{u0(),Z2()}catch{return}if(Y=m5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{l2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??JJ)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(V,MK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
150
+ `),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:H,enrollment:U}=q;try{e(g(H),!0);let M=await YJ(H,()=>{});try{if(Q("lock_acquired"),t(H))throw Error("worker_ephemeral_requires_fresh_enrollment");return q1(H),await XJ(H,M.owner.nonce,Q,Z,(T)=>Z1(H,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function _1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
151
151
  `),J.onStartup?.(K)},V={...J,onStartup:G,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(H)=>Math.min($$,Math.max(0,Math.round(H))),N=Y.get("readiness_started"),q=Y.get("readiness_completed");return{service_start_to_heartbeat_ms:K(performance.now()),...N!==void 0&&q!==void 0?{readiness_ms:K(q-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
152
- `)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await i7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await v7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await s7();return await k7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await h2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
153
- `),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await KK($,J,V,G);let K=XK($);if(!K)return Z.stdout.write(QK),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
154
- `),H=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!H||!!M,deviceId:H?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:H||M?Date.parse(H?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{U1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":H&&T0(N)instanceof e1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(H||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(HK);return 0}}e(g(N),!0);let U=await XJ(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
155
- `)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")x0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");U1(N);let D=()=>{f0(N),d9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await S4(N,T,O,J.enroll):await ZJ(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof $1)||!O.deviceRemoved)throw O;return D(),j()});return m0(F,d(N).state,{proofStore:z}),x0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new J2(o0(N.apiOrigin),k0(N.proxy),T);if(x0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return f0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(U1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await QJ(N,U.owner.nonce,G,V,async(T)=>K.enrollmentPath?S4(N,K.enrollmentPath,T,J.enroll):ZJ(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Q2(N,M,T0(N),U.owner.nonce,V)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
156
- `);let q=$.includes("--json")?void 0:B$(K instanceof $1&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(q)Z.stderr.write(`${q}
157
- `);return N==="worker_revoked"&&X?0:1}}var VK=60000;async function XJ($,J){let Z=Date.now()+$.shutdownGraceMs+VK,Q=!1;for(;;){let X=Z1({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var HK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function ZJ($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return J1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??O1($),G=await(Z.enrollmentCredentials??A1)($,Y);if(!G)throw Error(X);let V=Z.createTicketClient?.(G)??new N1(G,{credentialsPath:Y,fetchImpl:k0($.proxy)});return u9($,G,V,Q,Z.enroll)}import{spawn as NK}from"child_process";import{existsSync as UK,readFileSync as qK,unlinkSync as MK}from"fs";import{join as TK}from"path";var _K=120,FK=15,WK=5000;function Q4($={}){let J=$.stateDirectory?TK($.stateDirectory,LK):null;if(J)DK(J);let Z=["/bin/bash","/usr/bin/bash"].find((H)=>UK(H));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??_K)),X=$.pid??process.pid,Y=Math.min(FK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${YJ(r)} > ${YJ(J)} 2>/dev/null
152
+ `)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await n7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await g7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await a7();return await y7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await h2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
153
+ `),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await TK($,J,V,G);let K=NK($);if(!K)return Z.stdout.write(HK),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
154
+ `),H=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!H||!!M,deviceId:H?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:H||M?Date.parse(H?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{q1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":H&&T0(N)instanceof e1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(H||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(FK);return 0}}e(g(N),!0);let U=await YJ(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
155
+ `)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")x0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");q1(N);let D=()=>{f0(N),l9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await S4(N,T,O,J.enroll):await QJ(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof J1)||!O.deviceRemoved)throw O;return D(),j()});return m0(F,d(N).state,{proofStore:z}),x0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new J2(e0(N.apiOrigin),k0(N.proxy),T);if(x0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return f0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(q1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await XJ(N,U.owner.nonce,G,V,async(T)=>K.enrollmentPath?S4(N,K.enrollmentPath,T,J.enroll):QJ(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Q2(N,M,T0(N),U.owner.nonce,V)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
156
+ `);let q=$.includes("--json")?void 0:B$(K instanceof J1&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(q)Z.stderr.write(`${q}
157
+ `);return N==="worker_revoked"&&X?0:1}}var _K=60000;async function YJ($,J){let Z=Date.now()+$.shutdownGraceMs+_K,Q=!1;for(;;){let X=Q1({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var FK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function QJ($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return Z1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??A1($),G=await(Z.enrollmentCredentials??R1)($,Y);if(!G)throw Error(X);let V=Z.createTicketClient?.(G)??new U1(G,{credentialsPath:Y,fetchImpl:k0($.proxy)});return d9($,G,V,Q,Z.enroll)}import{spawn as WK}from"child_process";import{existsSync as LK,readFileSync as DK,unlinkSync as jK}from"fs";import{join as zK}from"path";var OK=120,AK=15,RK=5000;function Q4($={}){let J=$.stateDirectory?zK($.stateDirectory,CK):null;if(J)PK(J);let Z=["/bin/bash","/usr/bin/bash"].find((H)=>LK(H));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??OK)),X=$.pid??process.pid,Y=Math.min(AK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${GJ(r)} > ${GJ(J)} 2>/dev/null
158
158
  `:"",V=(H)=>`[ $((SECONDS - started)) -ge ${Math.max(1,H-1)} ]`,K=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
159
159
  while :; do started=$SECONDS
160
160
  IFS= read -r -t ${Q} pulse && continue
@@ -166,8 +166,8 @@ if ${V(Y)} && parent_is_worker; then
166
166
  ${G}kill -KILL ${X}
167
167
  fi
168
168
  exit 0
169
- done`,N=NK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
170
- `),Math.min(WK,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var LK="worker-stalled";function YJ($){return`'${$.replaceAll("'","'\\''")}'`}function DK($){let J;try{J=qK($,"utf8"),MK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{g$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var CK=`Share this computer as a machine
169
+ done`,N=WK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
170
+ `),Math.min(RK,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var CK="worker-stalled";function GJ($){return`'${$.replaceAll("'","'\\''")}'`}function PK($){let J;try{J=DK($,"utf8"),jK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{g$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var bK=`Share this computer as a machine
171
171
 
172
172
  Usage:
173
173
  reason serve This computer, signed in (machine name: its hostname)
@@ -210,29 +210,29 @@ the worker unless --sandbox is set. Settings live in
210
210
  ~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
211
211
  folder served for NAME is its own worker. Use
212
212
  \`reason worker status|revoke --config <that file>\` for advanced control.
213
- `,IK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,PK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,VJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",GJ=["REASON_TOKEN","REASON_MACHINE_TOKEN"],HJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&u$(J)&&J!==w2?J:HJ}class Q0 extends Error{}function xK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let H=$[N+1];if(!H||H.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,H),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!u$(Z)&&!IK.test(Z))throw new Q0(VJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!PK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...V===void 0?{}:{org:V.toLowerCase()}}}function B4($,J){let Z=RK($,J??"."),Q;try{Q=KJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!OK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var X4=($)=>r1($,".reason","workers"),c3=($)=>u(d($).state);function EK($,J,Z){let Q=r1(X4($),J);if(I0(r1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return r1(X4($),`${J}@${jK("sha256").update(Z).digest("hex").slice(0,8)}`)}function NJ($){let{stateDirectory:J}=$;if(K2($.workspaceRoot,J)||K2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function I0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function SK($,J){$.stdout.write(`${J} [y/N] `);let Z=await R9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function K4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var wK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function UJ($){try{return await $()}catch(J){let Z=J instanceof G0?wK[J.code]:void 0;throw Z?Error(Z):J}}async function bK($,J,Z,Q){let X=NJ({...J,name:$.name??HJ,stateDirectory:r1(X4(Z),".token-enrollment")}),Y=R1(X,{stored:!1}),G=await UJ(()=>x9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!u$(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??G.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function kK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??A1)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((V)=>new N1(V)))(Y);return g9(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>UJ(async()=>{try{return await G.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
214
- `)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,V)})})}}async function qJ($,J,Z,Q){let X=await h2($,Q,()=>BJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!F1($,J,Z))return null;return c4($),X}function i3($,J){let Z=X4($);if(!u(Z))return[];let Q=J.toLowerCase();return zK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=r1(Z,X,"worker.json"),V=I0(G);return V?[{path:G,config:V}]:[]})}async function yK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??H0,V=[];for(let K of Y){let N=await G(K.config,"stop")!==null,q=G4(K.config,X),H=N||q!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:H,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
213
+ `,kK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,yK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,HJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",BJ=["REASON_TOKEN","REASON_MACHINE_TOKEN"],NJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&u$(J)&&J!==w2?J:NJ}class Q0 extends Error{}function fK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let H=$[N+1];if(!H||H.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,H),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!u$(Z)&&!kK.test(Z))throw new Q0(HJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!yK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...V===void 0?{}:{org:V.toLowerCase()}}}function B4($,J){let Z=wK($,J??"."),Q;try{Q=VJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!EK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var X4=($)=>r1($,".reason","workers"),c3=($)=>u(d($).state);function hK($,J,Z){let Q=r1(X4($),J);if(P0(r1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return r1(X4($),`${J}@${IK("sha256").update(Z).digest("hex").slice(0,8)}`)}function UJ($){let{stateDirectory:J}=$;if(K2($.workspaceRoot,J)||K2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function P0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function mK($,J){$.stdout.write(`${J} [y/N] `);let Z=await R9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function K4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var vK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function qJ($){try{return await $()}catch(J){let Z=J instanceof G0?vK[J.code]:void 0;throw Z?Error(Z):J}}async function gK($,J,Z,Q){let X=UJ({...J,name:$.name??NJ,stateDirectory:r1(X4(Z),".token-enrollment")}),Y=C1(X,{stored:!1}),G=await qJ(()=>E9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!u$(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??G.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function uK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??R1)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((V)=>new U1(V)))(Y);return u9(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>qJ(async()=>{try{return await G.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
214
+ `)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,V)})})}}async function MJ($,J,Z,Q){let X=await h2($,Q,()=>KJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!W1($,J,Z))return null;return c4($),X}function i3($,J){let Z=X4($);if(!u(Z))return[];let Q=J.toLowerCase();return xK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=r1(Z,X,"worker.json"),V=P0(G);return V?[{path:G,config:V}]:[]})}async function dK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??H0,V=[];for(let K of Y){let N=await G(K.config,"stop")!==null,q=G4(K.config,X),H=N||q!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:H,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
215
215
  `);if(!$.json)Z.stdout.write(H?`Stopping machine "${$.name}" in ${K.config.workspaceRoot}; current work finishes first.
216
216
  `:`Machine "${$.name}" in ${K.config.workspaceRoot} is not running.
217
217
  `)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:V})}
218
- `);return 0}async function MJ($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??T1,X=J.env??process.env,Y=GJ.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of GJ)delete process.env[G];try{let G=xK($,Y);if(!G)return Z.stdout.write(CK),0;let V=KJ(J.home??V0()),K=J.serviceHost??Y1(V);if(G.stop)return await yK({...G,name:G.name},V,Z,J,K);let N=J.channel??P0(),q=B4(J.cwd??process.cwd(),G.dir),H=G.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:G.once,sandbox:G.sandbox},M=G.token?await bK({...G,token:G.token},U,V,J):void 0,T=M?.name??G.name??a3((J.hostname??AK)()),_=EK(V,T,q),D=r1(_,"worker.json"),j=I0(D);if(M&&j&&c3(j)&&$0(j).revoked)f0(j);let z=!M&&j!==null&&c3(j)&&(!b0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=NJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
218
+ `);return 0}async function TJ($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??_1,X=J.env??process.env,Y=BJ.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of BJ)delete process.env[G];try{let G=fK($,Y);if(!G)return Z.stdout.write(bK),0;let V=VJ(J.home??V0()),K=J.serviceHost??G1(V);if(G.stop)return await dK({...G,name:G.name},V,Z,J,K);let N=J.channel??I0(),q=B4(J.cwd??process.cwd(),G.dir),H=G.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:G.once,sandbox:G.sandbox},M=G.token?await gK({...G,token:G.token},U,V,J):void 0,T=M?.name??G.name??a3((J.hostname??SK)()),_=hK(V,T,q),D=r1(_,"worker.json"),j=P0(D);if(M&&j&&c3(j)&&$0(j).revoked)f0(j);let z=!M&&j!==null&&c3(j)&&(!b0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=UJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
219
219
  Run it with: reason serve ${T} ${s3(j)}
220
220
  Or remove it first: reason worker revoke --config ${D}`)}let W=F.lifetime==="persistent"?D$(F,K):null;if(W&&!G.service&&X[i1]!==W.label)return Z.stdout.write(`Machine "${T}" in ${q} already runs as a background service (${W.label}).
221
221
  Logs: ${W.logs}
222
222
  Stop it with: reason stop ${T}
223
- `),0;if(G.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!u$(T))throw new Q0(VJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
224
- `);else if(L&&!G.yes&&!M){let C=`Sessions on "${T}" will run commands in ${q} with your user permissions (no sandbox). Continue?`,I=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!I)throw new Q0(`${C.replace(/ Continue\?$/,"")}
225
- Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>SK(Z,h)))(C))return Z.stderr.write(`Cancelled. Nothing was added.
226
- `),1}if(!O)e(F.stateDirectory,!0),c(D,F);let R={...J.worker,enrollmentInput:kK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
227
- `);let I=await Q(["enroll","--config",D],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(I!==0)return I}if(H){let C;try{C=Y4({config:F,launcher:H,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(I){if(!(I instanceof _1))throw I;throw new Q0(`${I.message}
223
+ `),0;if(G.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!u$(T))throw new Q0(HJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
224
+ `);else if(L&&!G.yes&&!M){let C=`Sessions on "${T}" will run commands in ${q} with your user permissions (no sandbox). Continue?`,P=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!P)throw new Q0(`${C.replace(/ Continue\?$/,"")}
225
+ Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>mK(Z,h)))(C))return Z.stderr.write(`Cancelled. Nothing was added.
226
+ `),1}if(!O)e(F.stateDirectory,!0),c(D,F);let R={...J.worker,enrollmentInput:uK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
227
+ `);let P=await Q(["enroll","--config",D],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(P!==0)return P}if(H){let C;try{C=Y4({config:F,launcher:H,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(P){if(!(P instanceof F1))throw P;throw new Q0(`${P.message}
228
228
  This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${s3(F)}
229
229
  Or try the background service again with: reason serve ${T} ${s3(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,` Folder: ${q}`,` Mode: ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,` Service: ${C.label} (starts at ${C.lingering?"boot":"login"}, restarts if it fails)`,` Logs: ${C.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...C.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
230
230
  `)),0}Z.stdout.write([`Reason machine "${T}"`,` Folder: ${q}`,` Mode: ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,` Lifetime: ${F.lifetime==="persistent"?`saved; run \`reason serve ${T}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
231
231
  `));let x=W&&X[i1]===W.label&&!J.runWorker?Q4({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",D],{...R,io:{stdout:Z.stdout,stderr:K4(Z.stderr)},onStartup:(C)=>{if(C==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
232
- `);J.worker?.onStartup?.(C)}})}finally{x?.stop()}}catch(G){if(G instanceof Q0||G instanceof _1){let N=G instanceof _1&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
232
+ `);J.worker?.onStartup?.(C)}})}finally{x?.stop()}}catch(G){if(G instanceof Q0||G instanceof F1){let N=G instanceof F1&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
233
233
  `),2}let V=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:null,K=V?B$(V):void 0;return Z.stderr.write(`Reason: ${V?K?`${K} (${V})`:V:"could not prepare this machine."}
234
- `),1}}var fK=200;var cL=B.strictObject({version:B.literal(1),session_ids:B.array(B.string().min(1).max(200)).max(fK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as TJ}from"child_process";import{readFileSync as hK,rmdirSync as mK,rmSync as vK}from"fs";import{join as n3}from"path";var gK=["Reason.app","Ara Sidecar.app","Ara Device.app"],uK="sidecar_retire_failed";function dK($){return n3($,"Library","Application Support","Ara","Sidecar")}function lK($){try{let J=hK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function FJ($,J={}){let Z=dK($),Q=gK.map((V)=>n3(Z,V)).filter(lK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>TJ("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),G=J.command??((V,K)=>TJ(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
235
- `)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)G(_J,["-u",V]),vK(V,{recursive:!0,force:!0});try{mK(Z)}catch{}}catch{return{status:"failed",code:uK}}return{status:"removed",bundles:Q}}var nK=`Connect this computer to Reason
234
+ `),1}}var lK=200;var oL=B.strictObject({version:B.literal(1),session_ids:B.array(B.string().min(1).max(200)).max(lK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as _J}from"child_process";import{readFileSync as pK,rmdirSync as cK,rmSync as sK}from"fs";import{join as n3}from"path";var aK=["Reason.app","Ara Sidecar.app","Ara Device.app"],iK="sidecar_retire_failed";function nK($){return n3($,"Library","Application Support","Ara","Sidecar")}function rK($){try{let J=pK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function WJ($,J={}){let Z=nK($),Q=aK.map((V)=>n3(Z,V)).filter(rK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>_J("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),G=J.command??((V,K)=>_J(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
235
+ `)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)G(FJ,["-u",V]),sK(V,{recursive:!0,force:!0});try{cK(Z)}catch{}}catch{return{status:"failed",code:iK}}return{status:"removed",bundles:Q}}var ZV=`Connect this computer to Reason
236
236
 
237
237
  Usage:
238
238
  reason connect Your computer, kept connected in the background
@@ -288,7 +288,7 @@ One computer serves several Reason accounts. Signed in as another account than
288
288
  the one it is connected for, reason connect connects it for that account too,
289
289
  as that account's own computer in the workspace it signed in to; the other
290
290
  accounts stay connected. That account's \`reason logout\` removes only its own.
291
- `,rK=`Disconnect this computer from Reason
291
+ `,QV=`Disconnect this computer from Reason
292
292
 
293
293
  Usage:
294
294
  reason disconnect Stop your computer's connection and remove it from Reason, in every
@@ -303,41 +303,41 @@ Usage:
303
303
  Reason (all of it when it is the only account here), and it is not kept
304
304
  disconnected: the next reason "\u2026" connects it again
305
305
  --yes, -y Accepted for scripts; disconnect never asks
306
- `;class p extends Error{}var tK=4,N4={write:()=>!0};function d0($,J,Z=!1){let Q=yJ($,J,Z);return Q.length===1?Q[0]:F0(q2(F0($,".config")),...kJ(J,Z))}var kJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function yJ($,J,Z=!1){let Q=$;try{Q=G1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...kJ(J,Z))).filter(oK)}function oK($){try{if(G1($)!==$)return!1;return I0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var fJ="disconnected.json";function bD($,J){return u(F0(d0($,J),fJ))}function U4($,J,Z){let Q=F0(d0($,J),fJ);if(!Z){z$(Q,{force:!0});return}e($9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function eK($){let J=new Map,Z=new Set;for(let H=0;H<$.length;H+=1){let U=$[H];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",V4,H4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[H+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),H+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(H4)&&!J.has(V4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((H)=>J.has(H));if(Y.length>0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(H,U)=>U===void 0?{}:{[H]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",G===void 0?void 0:G==="on"),...q("cloudSessions",V===void 0?void 0:V==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(V4)),...q("proxyCaFile",J.get(H4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var P1=($)=>u(d($).state),hJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
307
- `;function mJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function $V($){return $===1?"one at a time":`up to ${$} at once`}function vJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=B4($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!E$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!b0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!zJ(X)&&!jJ($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=RJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof OJ))throw V;throw new p(V.message)}let G=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??aK)()),slots:J.sessions??Z?.slots??tK,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function gJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function J9($,J,Z,Q,X){if($0($).revoked){if(P1($))try{f0($)}catch{}y4($);let Y=[];try{Y=sK(g($))}catch{}for(let G of Y)if(G!=="workspaces")z$(F0(g($),G),{recursive:!0,force:!0})}else if(P1($))f0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??T1)(["enroll","--config",J],{...Z9(Q.worker,X),io:{stdout:N4,stderr:Z.stderr}})}function V2($,J,Z){let Q=P$(e0(k$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function JV($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),G=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=I0(Y)}catch{}if(G(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
308
- `);let K=await J9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&P1(X))await q4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function Z9($,J){return J?{...$,enrollmentCredentials:(Z)=>A4(Z,J)}:{...$}}async function Q9($,J,Z,Q,X,Y="connect"){if(await X9($,Q,X,Y),Y==="connect"&&!await sJ($,Z,Q))return!1;if(!await q4($,J,Z,Q))return!1;return w9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function q4($,J,Z,Q){if(!P1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??T1)(["revoke","--config",J],{...Q.worker,io:{stdout:N4,stderr:Y?Z.stderr:N4}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function X9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,G=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&G4($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((q)=>setTimeout(q,250))}}function Y9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...Y9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${mJ($).replace(/^runs /,"")}`,...Q.length>0?[` Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
309
- `)}function t3($,J,Z,Q){return[$,` Name: ${J.name}`,` Folder: ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>` ${X}`),` Sessions: ${$V(J.slots)}`,` Mode: ${mJ(J)}`,...J.proxy?[` Proxy: ${AJ(J.proxy)}`]:[],...Y9(J,Z)?[" Chrome: your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?[" Cloud: your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?[" Logins: your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
310
- `)}async function WJ($,J,Z){let{io:Q,options:X}=Z;if(yJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:$9(J),timestamp:new Date().toISOString()})}
306
+ `;class p extends Error{}var XV=4,N4={write:()=>!0};function d0($,J,Z=!1){let Q=fJ($,J,Z);return Q.length===1?Q[0]:F0(q2(F0($,".config")),...yJ(J,Z))}var yJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function fJ($,J,Z=!1){let Q=$;try{Q=B1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...yJ(J,Z))).filter(YV)}function YV($){try{if(B1($)!==$)return!1;return P0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var hJ="disconnected.json";function gD($,J){return u(F0(d0($,J),hJ))}function U4($,J,Z){let Q=F0(d0($,J),hJ);if(!Z){z$(Q,{force:!0});return}e($9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function GV($){let J=new Map,Z=new Set;for(let H=0;H<$.length;H+=1){let U=$[H];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",V4,H4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[H+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),H+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(H4)&&!J.has(V4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((H)=>J.has(H));if(Y.length>0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(H,U)=>U===void 0?{}:{[H]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",G===void 0?void 0:G==="on"),...q("cloudSessions",V===void 0?void 0:V==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(V4)),...q("proxyCaFile",J.get(H4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var x1=($)=>u(d($).state),mJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
307
+ `;function vJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function BV($){return $===1?"one at a time":`up to ${$} at once`}function gJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=B4($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!E$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!b0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!OJ(X)&&!zJ($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=CJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof AJ))throw V;throw new p(V.message)}let G=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??$V)()),slots:J.sessions??Z?.slots??XV,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function uJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function J9($,J,Z,Q,X){if($0($).revoked){if(x1($))try{f0($)}catch{}y4($);let Y=[];try{Y=eK(g($))}catch{}for(let G of Y)if(G!=="workspaces")z$(F0(g($),G),{recursive:!0,force:!0})}else if(x1($))f0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??_1)(["enroll","--config",J],{...Z9(Q.worker,X),io:{stdout:N4,stderr:Z.stderr}})}function V2($,J,Z){let Q=I$($1(k$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function KV($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),G=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=P0(Y)}catch{}if(G(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
308
+ `);let K=await J9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&x1(X))await q4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function Z9($,J){return J?{...$,enrollmentCredentials:(Z)=>A4(Z,J)}:{...$}}async function Q9($,J,Z,Q,X,Y="connect"){if(await X9($,Q,X,Y),Y==="connect"&&!await aJ($,Z,Q))return!1;if(!await q4($,J,Z,Q))return!1;return b9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function q4($,J,Z,Q){if(!x1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??_1)(["revoke","--config",J],{...Q.worker,io:{stdout:N4,stderr:Y?Z.stderr:N4}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function X9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,G=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&G4($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((q)=>setTimeout(q,250))}}function Y9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...Y9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${vJ($).replace(/^runs /,"")}`,...Q.length>0?[` Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
309
+ `)}function t3($,J,Z,Q){return[$,` Name: ${J.name}`,` Folder: ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>` ${X}`),` Sessions: ${BV(J.slots)}`,` Mode: ${vJ(J)}`,...J.proxy?[` Proxy: ${RJ(J.proxy)}`]:[],...Y9(J,Z)?[" Chrome: your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?[" Cloud: your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?[" Logins: your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
310
+ `)}async function LJ($,J,Z){let{io:Q,options:X}=Z;if(fJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:$9(J),timestamp:new Date().toISOString()})}
311
311
  `);let Y=E2(F0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
312
- `);f3(Z.home,Z.host.platform);let G=E8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(U)=>Q.stderr.write(`${U}
313
- `),host:Z.host}),V=z8({...G,log:(U)=>Q.stderr.write(`${U}
312
+ `);f3(Z.home,Z.host.platform);let G=S8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(U)=>Q.stderr.write(`${U}
313
+ `),host:Z.host}),V=O8({...G,log:(U)=>Q.stderr.write(`${U}
314
314
  `)}),{configPath:K}=V,N=V.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let q=(U,M)=>{let T=T4(Z.home,Z.channel),_;try{let j=null;try{j=M.keep?null:t(N)?.orgId.toLowerCase()??null}catch{}if(_=O2(N,{prefer:V2(Z.home,Z.channel,N),...M}),_&&j)z2(_,j)}finally{T()}if(!_)return!1;N=_;let D="";try{D=` (workspace ${t(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${U}; this computer goes on running Sessions for its other Reason account${D}.
315
- `),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=l0(N.stateDirectory)??void 0,M=U?null:V2(Z.home,Z.channel,N);if(!U&&!(M&&f$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let H=N.executionMode==="confined";if(H||!j$(N)){let U=l0(N.stateDirectory)??void 0;if(Q.stderr.write(H?hJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
316
- `),await J9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=l0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Q4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??T1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return U4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function ZV($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=d0(Y,G,!0),N=vJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),q=gJ(N,Z.apiKey??(J?l0(J.stateDirectory)??void 0:void 0)),H=F0(K,"worker.json");return e(K,!0),c(H,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??T1)(["start","--config",H],{...Z9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:K4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
317
- `);X.worker?.onStartup?.(U)}})}function QV($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),k8(d(J).daemon,$);let X=S2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
318
- `),0}var XV=B.object({root:B.object({id:B.string().min(1).max(160),label:B.string().max(160),path_fingerprint:B.string()})});async function uJ($,J,Z,Q){let X=await(Z9(Q.worker,Z).enrollmentCredentials??A1)($,O1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new N1(X,{credentialsPath:O1($),fetchImpl:k0($.proxy)}),G=(V)=>V instanceof G0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=l9($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((H)=>{if(G(H))throw Error("worker_folders_unavailable");if(H instanceof G0&&H.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw H}),q=XV.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function dJ($,J,Z){m0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:T0($)})}async function lJ($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&l0(J.stateDirectory)===null?V2(Q.home,Q.channel,J):null,K=J&&V&&P1(J)&&!f$(J,V)?h0(J).find((C)=>C.account&&C.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,H=N&&P1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!H||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=B4(T,M)}catch(C){if(U)throw new p(C instanceof Error?C.message:String(C));_=iK(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=H.roots.slice(1).find((C)=>C.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!E$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??l0(N.stateDirectory)??void 0,F=await uJ(N,H,z,Y),O=H.roots.filter((C)=>C.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);dJ(N,H,O);let W=U?[...D.filter((C)=>C!==_),_]:D.filter((C)=>C!==_),{folders:L,...R}=N;if(c(q,J0.parse({...R,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))F1(J,G,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
315
+ `),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=p0(N.stateDirectory)??void 0,M=U?null:V2(Z.home,Z.channel,N);if(!U&&!(M&&f$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let H=N.executionMode==="confined";if(H||!j$(N)){let U=p0(N.stateDirectory)??void 0;if(Q.stderr.write(H?mJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
316
+ `),await J9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=p0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Q4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??_1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return U4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function VV($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=d0(Y,G,!0),N=gJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),q=uJ(N,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),H=F0(K,"worker.json");return e(K,!0),c(H,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??_1)(["start","--config",H],{...Z9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:K4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
317
+ `);X.worker?.onStartup?.(U)}})}function HV($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),y8(d(J).daemon,$);let X=S2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
318
+ `),0}var NV=B.object({root:B.object({id:B.string().min(1).max(160),label:B.string().max(160),path_fingerprint:B.string()})});async function dJ($,J,Z,Q){let X=await(Z9(Q.worker,Z).enrollmentCredentials??R1)($,A1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new U1(X,{credentialsPath:A1($),fetchImpl:k0($.proxy)}),G=(V)=>V instanceof G0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=p9($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((H)=>{if(G(H))throw Error("worker_folders_unavailable");if(H instanceof G0&&H.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw H}),q=NV.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function lJ($,J,Z){m0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:T0($)})}async function pJ($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(Q.home,Q.channel,J):null,K=J&&V&&x1(J)&&!f$(J,V)?h0(J).find((C)=>C.account&&C.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,H=N&&x1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!H||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=B4(T,M)}catch(C){if(U)throw new p(C instanceof Error?C.message:String(C));_=JV(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=H.roots.slice(1).find((C)=>C.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!E$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??p0(N.stateDirectory)??void 0,F=await dJ(N,H,z,Y),O=H.roots.filter((C)=>C.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);lJ(N,H,O);let W=U?[...D.filter((C)=>C!==_),_]:D.filter((C)=>C!==_),{folders:L,...R}=N;if(c(q,J0.parse({...R,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))W1(J,G,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
319
319
  `:`Removed ${_}. Sessions on "${N.name}" no longer run in it.
320
- `),0}async function kD($,J,Z){let Q=o3(Z),X=T4(Q.home,Q.channel);try{let Y=F0(d0(Q.home,Q.channel),"worker.json");return await lJ({once:!1,yes:J,addFolder:$},I0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=G1($.home??V0()),Q=$.env??process.env;return{io:$.io??M4(),options:$,home:Z,channel:$.channel??P0(),environment:Q,apiKey:J??z4(Q),host:$.serviceHost??Y1(Z)}}async function YV($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await uJ($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}dJ(J,X,Y)}var pJ=Symbol("serve here");async function GV($,J,Z,Q){let{io:X,options:Y,home:G,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let P=FJ(G);if(P.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${P.code}).
321
- `)}let q=J&&!Q.apiKey&&l0(J.stateDirectory)===null?V2(G,V,J):null,H=J&&q&&$0(J).revoked&&h0(J).some((P)=>P.account&&P.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=vJ({parsed:$,saved:H,stateDirectory:d0(G,V),lifetime:"persistent",home:G,channel:V,options:Y,environment:K});if(U4(G,V,!1),H?.executionMode==="confined")X.stdout.write(hJ);let M=H?l0(H.stateDirectory):null,T=gJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=H!==null&&P1(H),j=D&&U0(H)===U0(T),z=j&&j$(T),F=H?.userChrome!==!1===(T.userChrome!==!1)&&H?.cloudSessions===T.cloudSessions&&H?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(H).revoked&&!f$(H,q);if(W){if(!j||!F||JSON.stringify(H.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let P=await JV(H,q,X,Y);if(P!==0)return P}let L=W?[` Account: yours too, in workspace ${q}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await A4(T,$.apiKey),O4(T.stateDirectory,$.apiKey)},x=K.PATH||"/usr/local/bin:/usr/bin:/bin",C=z&&JSON.stringify(H?.proxy)===JSON.stringify(T.proxy)&&F?D$(T,N,"connect"):null,I=C?.label===IJ(T.channel),h=I&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)!==null,S=I&&!h&&e3(C,N)&&EJ({config:T,launcher:_,path:x,host:N,kind:"connect"});if((h||S)&&[null,r].includes(d$(T))){await R();let P=xJ(T,N,"connect");if(P==="retired"){let E=S?null:await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!S&&(!E||E.phase==="stopping"))F1(T,N,"connect")}else if(P==="current_not_running")F1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,...S?[" Worker: running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let y=!z&&!W;if(D&&!j)if(H.apiOrigin!==T.apiOrigin||H.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
320
+ `),0}async function uD($,J,Z){let Q=o3(Z),X=T4(Q.home,Q.channel);try{let Y=F0(d0(Q.home,Q.channel),"worker.json");return await pJ({once:!1,yes:J,addFolder:$},P0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=B1($.home??V0()),Q=$.env??process.env;return{io:$.io??M4(),options:$,home:Z,channel:$.channel??I0(),environment:Q,apiKey:J??z4(Q),host:$.serviceHost??G1(Z)}}async function UV($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await dJ($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}lJ(J,X,Y)}var cJ=Symbol("serve here");async function qV($,J,Z,Q){let{io:X,options:Y,home:G,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let I=WJ(G);if(I.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${I.code}).
321
+ `)}let q=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(G,V,J):null,H=J&&q&&$0(J).revoked&&h0(J).some((I)=>I.account&&I.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=gJ({parsed:$,saved:H,stateDirectory:d0(G,V),lifetime:"persistent",home:G,channel:V,options:Y,environment:K});if(U4(G,V,!1),H?.executionMode==="confined")X.stdout.write(mJ);let M=H?p0(H.stateDirectory):null,T=uJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=H!==null&&x1(H),j=D&&U0(H)===U0(T),z=j&&j$(T),F=H?.userChrome!==!1===(T.userChrome!==!1)&&H?.cloudSessions===T.cloudSessions&&H?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(H).revoked&&!f$(H,q);if(W){if(!j||!F||JSON.stringify(H.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let I=await KV(H,q,X,Y);if(I!==0)return I}let L=W?[` Account: yours too, in workspace ${q}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await A4(T,$.apiKey),O4(T.stateDirectory,$.apiKey)},x=K.PATH||"/usr/local/bin:/usr/bin:/bin",C=z&&JSON.stringify(H?.proxy)===JSON.stringify(T.proxy)&&F?D$(T,N,"connect"):null,P=C?.label===IJ(T.channel),h=P&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)!==null,S=P&&!h&&e3(C,N)&&SJ({config:T,launcher:_,path:x,host:N,kind:"connect"});if((h||S)&&[null,r].includes(d$(T))){await R();let I=EJ(T,N,"connect");if(I==="retired"){let E=S?null:await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!S&&(!E||E.phase==="stopping"))W1(T,N,"connect")}else if(I==="current_not_running")W1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,...S?[" Worker: running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let y=!z&&!W;if(D&&!j)if(H.apiOrigin!==T.apiOrigin||H.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
322
322
  `),!await Q9(H,Z,X,Y,N))throw new p("Could not remove this computer's previous connection from Reason. Check your network and try again.")}else if(H.executionMode==="host"&&j$(H))X.stdout.write(`Applying the new settings to this computer\u2026
323
- `),await YV(H,T,O,Y),y=!1;else await X9(H,Y,N);if(y){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
324
- `);let P=await J9(T,Z,X,Y,O);if(P!==0)return P;if(O)O4(T.stateDirectory,O)}else c(Z,T),await R();let l;try{l=Y4({config:T,launcher:_,path:x,host:N,kind:"connect"})}catch(P){if(!(P instanceof _1))throw P;if(P.code!=="worker_service_manager_missing")throw new p(`${P.message}
323
+ `),await UV(H,T,O,Y),y=!1;else await X9(H,Y,N);if(y){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
324
+ `);let I=await J9(T,Z,X,Y,O);if(I!==0)return I;if(O)O4(T.stateDirectory,O)}else c(Z,T),await R();let l;try{l=Y4({config:T,launcher:_,path:x,host:N,kind:"connect"})}catch(I){if(!(I instanceof F1))throw I;if(I.code!=="worker_service_manager_missing")throw new p(`${I.message}
325
325
  This computer is set up; run reason connect again to start it.`);if(Y.serveHere&&K.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
326
- `),pJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await BV(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[` No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new _1(`${P.message}
327
- This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,P.code)}let k=[...L,...l.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...l.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${l.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,k):t3("This computer is connected to Reason",T,N.platform,[` Service: ${l.label} (starts at ${l.lingering?"boot":"login"}, restarts if it fails)`,` Logs: ${l.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...k])),0}async function BV($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??cJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function cJ($,J,Z){let Q=bJ(Z,"a",384);try{let X=SJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{wJ(Q)}}async function sJ($,J,Z,Q=!1){let X=!0;for(let Y of h0($)){if(Q&&Y.account)continue;if(Y.config&&P1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??T1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:N4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function M4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function G9($,J){if($ instanceof p||$ instanceof _1){let X=$ instanceof _1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
326
+ `),cJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await MV(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[` No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new F1(`${I.message}
327
+ This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,I.code)}let k=[...L,...l.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...l.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${l.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,k):t3("This computer is connected to Reason",T,N.platform,[` Service: ${l.label} (starts at ${l.lingering?"boot":"login"}, restarts if it fails)`,` Logs: ${l.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...k])),0}async function MV($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??sJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function sJ($,J,Z){let Q=kJ(Z,"a",384);try{let X=wJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{bJ(Q)}}async function aJ($,J,Z,Q=!1){let X=!0;for(let Y of h0($)){if(Q&&Y.account)continue;if(Y.config&&x1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??_1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:N4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function M4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function G9($,J){if($ instanceof p||$ instanceof F1){let X=$ instanceof F1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
328
328
  `),2}let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:null,Q=Z?B$(Z):void 0;return J.stderr.write(`Reason: ${Z?Q?`${Q} (${Z})`:Z:"could not connect this computer."}
329
- `),1}function LJ($,J){if($.minimal){iJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||nJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??DJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
329
+ `),1}function DJ($,J){if($.minimal){nJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||rJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??jJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
330
330
  `);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
331
- `);let Q=(J.options.installDesktop??DJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
332
- `)}function DJ($,J,Z){if(!Z)return pK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;cK($9(Z.log),{recursive:!0,mode:448});let Q=bJ(Z.log,"w",384);try{let X=SJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{wJ(Q)}return 0}async function yD($,J={}){let Z=J.io??M4();try{let Q=eK($);if(!Q)return Z.stdout.write(nK),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return LJ(Q,o3(J)),await(J.runServe??MJ)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=PJ(G[i1],Y),K=V||Q.once?()=>{return}:T4(X.home,Y);try{let N=F0(d0(X.home,Y),"worker.json"),q=I0(N);if(V)return await WJ(q,N,X);if(Q.keepAwake!==void 0)return QV(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await lJ(Q,q,N,X);if(LJ(Q,X),Q.once)return await ZV(Q,q,X);let H=await GV(Q,q,N,X);if(H!==pJ)return H;return K(),K=()=>{return},await WJ(I0(N),N,X)}finally{K()}}catch(Q){return G9(Q,Z)}}async function fD($,J={}){let Z=J.io??M4();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(rK),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await HV(Q[0],Z,J);return await aJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return G9(Q,Z)}}async function hD($={}){let J=$.io??M4();try{return await aJ(J,$,"logout")}catch(Z){return G9(Z,J)}}async function aJ($,J,Z){let Q=G1(J.home??V0()),X=J.channel??P0(),Y=T4(Q,X);try{return await KV($,J,Z,Q,X)}finally{Y()}}function T4($,J){let Z=d0($,J),Q=u(Z)?Y$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function KV($,J,Z,Q,X){let Y=F0(d0(Q,X),"worker.json"),G=I0(Y);if(!G){if(Z==="disconnect")U4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
333
- `);return 0}if(Z!=="disconnect"){let K=await VV(G,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await Q9(G,Y,$,J,J.serviceHost??Y1(Q))}finally{if(Z!=="temporary")U4(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
331
+ `);let Q=(J.options.installDesktop??jJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
332
+ `)}function jJ($,J,Z){if(!Z)return tK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;oK($9(Z.log),{recursive:!0,mode:448});let Q=kJ(Z.log,"w",384);try{let X=wJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{bJ(Q)}return 0}async function dD($,J={}){let Z=J.io??M4();try{let Q=GV($);if(!Q)return Z.stdout.write(ZV),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return DJ(Q,o3(J)),await(J.runServe??TJ)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=xJ(G[i1],Y),K=V||Q.once?()=>{return}:T4(X.home,Y);try{let N=F0(d0(X.home,Y),"worker.json"),q=P0(N);if(V)return await LJ(q,N,X);if(Q.keepAwake!==void 0)return HV(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await pJ(Q,q,N,X);if(DJ(Q,X),Q.once)return await VV(Q,q,X);let H=await qV(Q,q,N,X);if(H!==cJ)return H;return K(),K=()=>{return},await LJ(P0(N),N,X)}finally{K()}}catch(Q){return G9(Q,Z)}}async function lD($,J={}){let Z=J.io??M4();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(QV),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await FV(Q[0],Z,J);return await iJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return G9(Q,Z)}}async function pD($={}){let J=$.io??M4();try{return await iJ(J,$,"logout")}catch(Z){return G9(Z,J)}}async function iJ($,J,Z){let Q=B1(J.home??V0()),X=J.channel??I0(),Y=T4(Q,X);try{return await TV($,J,Z,Q,X)}finally{Y()}}function T4($,J){let Z=d0($,J),Q=u(Z)?Y$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function TV($,J,Z,Q,X){let Y=F0(d0(Q,X),"worker.json"),G=P0(Y);if(!G){if(Z==="disconnect")U4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
333
+ `);return 0}if(Z!=="disconnect"){let K=await _V(G,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await Q9(G,Y,$,J,J.serviceHost??G1(Q))}finally{if(Z!=="temporary")U4(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
334
334
  `),1;return $.stdout.write(`Disconnected "${G.name}". It no longer runs Sessions; run reason connect to connect it again.
335
- `),0}async function VV($,J,Z,Q,X,Y,G){let V=h0($).filter((D)=>D.account);if(V.length===0)return null;let K=V2(Y,G,$),N=Q.controlWorker??H0,q=V.find((D)=>D.organizationId===K);if(q){if(q.config&&!await q4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
335
+ `),0}async function _V($,J,Z,Q,X,Y,G){let V=h0($).filter((D)=>D.account);if(V.length===0)return null;let K=V2(Y,G,$),N=Q.controlWorker??H0,q=V.find((D)=>D.organizationId===K);if(q){if(q.config&&!await q4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
336
336
  `),1;if(X!=="account"||!q.config)z$(q.directory,{recursive:!0,force:!0});return await N($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${K} for your account. It stays connected for its other Reason accounts.
337
337
  `),0}if(!K&&X==="account")throw new p("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!K||!f$($,K)){if(X==="account"&&K)z2($,K);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
338
- `);return 0}let H=Q.serviceHost??Y1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await X9($,Q,H,"connect",!0),!await sJ($,Z,Q,!0)||!await q4($,J,Z,Q))return F1($,H,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
339
- `),1;let M=O2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&U)z2(M,U);let T=F1(M,H,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
340
- `),0}async function HV($,J,Z){let Q=G1(Z.home??V0()),X=Z.serviceHost??Y1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let V of Y)if(await Q9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
338
+ `);return 0}let H=Q.serviceHost??G1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await X9($,Q,H,"connect",!0),!await aJ($,Z,Q,!0)||!await q4($,J,Z,Q))return W1($,H,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
339
+ `),1;let M=O2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&U)z2(M,U);let T=W1(M,H,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
340
+ `),0}async function FV($,J,Z){let Q=B1(Z.home??V0()),X=Z.serviceHost??G1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let V of Y)if(await Q9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
341
341
  `);else G=!0,J.stderr.write(`Reason: machine "${$}" in ${V.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
342
- `);return G?1:0}async function mD($={}){let J=G1($.home??V0()),Z=I0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??H0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?d$(Z):null,G=$.serviceHost??Y1(J),V=D$(Z,G,"connect"),K=$0(Z).revoked,N=!K&&!X,q=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:H,off:U}=K||l0(Z.stateDirectory)!==null?{workspaces:null,off:null}:r9(Z,X?.phase==="running");return{workspaces:H,workspaces_off:U,workspaces_max:L2+(H?.filter((M)=>M.account).length??0),name:Z.name,device_id:q?.deviceId??null,organization_id:q?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:Y9(Z,G.platform),cloud_sessions:Z.cloudSessions===!0,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,roots:q?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?p8(Z,Q):null,worker_alive:N&&V?e3(V,G):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function vD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=I0(F0(d0(G1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?CJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function gD($={}){try{let J=G1($.home??V0());return I0(F0(d0(J,$.channel??P0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function uD($={}){let J=G1($.home??V0()),Z=I0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;return F1(Z,$.serviceHost??Y1(J),"connect")?.label??null}async function dD($={}){let J=G1($.home??V0()),Z=I0(F0(d0(J,$.channel??P0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??Y1(J),X=await qJ(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return NV(Z,Q,$)}async function NV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&d$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((H)=>setTimeout(H,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??cJ)(G,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
343
- export{e0 as a,N1 as b,E9 as c,d,S2 as e,I0 as f,nK as g,rK as h,d0 as i,bD as j,kD as k,yD as l,fD as m,hD as n,mD as o,vD as p,gD as q,uD as r,dD as s};
342
+ `);return G?1:0}async function cD($={}){let J=B1($.home??V0()),Z=P0(F0(d0(J,$.channel??I0()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??H0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?d$(Z):null,G=$.serviceHost??G1(J),V=D$(Z,G,"connect"),K=$0(Z).revoked,N=!K&&!X,q=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:H,off:U}=K||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:t9(Z,X?.phase==="running");return{workspaces:H,workspaces_off:U,workspaces_max:L2+(H?.filter((M)=>M.account).length??0),name:Z.name,device_id:q?.deviceId??null,organization_id:q?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:Y9(Z,G.platform),cloud_sessions:Z.cloudSessions===!0,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,roots:q?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?c8(Z,Q):null,worker_alive:N&&V?e3(V,G):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function sD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=P0(F0(d0(B1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?PJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function aD($={}){try{let J=B1($.home??V0());return P0(F0(d0(J,$.channel??I0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function iD($={}){let J=B1($.home??V0()),Z=P0(F0(d0(J,$.channel??I0()),"worker.json"));if(!Z)return null;return W1(Z,$.serviceHost??G1(J),"connect")?.label??null}async function nD($={}){let J=B1($.home??V0()),Z=P0(F0(d0(J,$.channel??I0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??G1(J),X=await MJ(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return WV(Z,Q,$)}async function WV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&d$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((H)=>setTimeout(H,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??sJ)(G,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
343
+ export{$1 as a,U1 as b,S9 as c,d,S2 as e,P0 as f,ZV as g,QV as h,d0 as i,gD as j,uD as k,dD as l,lD as m,pD as n,cD as o,sD as p,aD as q,iD as r,nD as s};