@reason-machines/cli-linux-arm64-musl 0.2.315 → 0.2.316

package/bin/vm-hands/{vm-hands-entry-lite-79ww0h62.js → vm-hands-entry-lite-gmhdbe8v.js}

@@ -1,9 +1,9 @@
 // @bun
-import{t as d0}from"./vm-hands-entry-lite-bswnp5ve.js";import{A as Y5,B as G5,C as A7,D as R7,E as v3,F as a5,G as V5,H as _0,I as l$,J as p$,K as S0,L as J2,M as i5,N as n0,O as q6,P as Z3,Q as J6,U as Z6,ba as I7,ca as x7,da as E7,ea as S7,fa as u3,y as d6,z as l6}from"./vm-hands-entry-lite-t4hkghhm.js";import{Aa as B5,Ba as K5,Ca as W7,Da as L7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as F5,Ka as j7,La as W$,Oa as V4,Pa as H4,Qa as RJ,Ra as CJ,Sa as PJ,Ta as y0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as z7,db as N6,fb as h8,ha as n7,ib as u2,ka as j5,kb as s5,la as z5,lb as T3,nb as f5,oa as _5,qa as x5,rb as O7,sb as N3,ta as E5,ya as k5,za as y5}from"./vm-hands-entry-lite-c3jqrn7n.js";import{Ab as S5,Bb as w5,Ib as b5}from"./vm-hands-entry-lite-rrk5g62b.js";import{Nb as H5}from"./vm-hands-entry-lite-ya1a2eep.js";import{Ub as c5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Ac as G4,Ec as r5,Hc as C7,Kc as p6,Lc as c6,mc as i1,nc as G1,oc as F1,pc as L$,qc as VJ,rc as xJ,sc as EJ,tc as D$,uc as SJ,vc as e3,wc as wJ,xc as Y4,yc as W1,zc as E8}from"./vm-hands-entry-lite-v2wx52wn.js";import{Bd as X5,Hd as $$,Rd as F2,Vc as b2,Zc as _7,_c as F7}from"./vm-hands-entry-lite-btwvn63p.js";import{ae as G}from"./vm-hands-entry-lite-q6fshf3h.js";import{ie as IJ,je as o2,me as P7,pe as n$,re as rJ,se as tJ,xe as $6}from"./vm-hands-entry-lite-msgz8sgz.js";import{$e as h1,Be as k0,Ce as k$,Ee as x0,Fe as j4,He as e0,Ie as z0,Je as y9,Ke as OJ,Le as AJ,Me as E2,Ne as q2,Oe as f3,Pe as I8,Qe as x8,Re as Y$,Se as v$,Te as Y0,Ue as T2,Ve as k7,We as y7,Xe as e1,Ye as R4,_e as Q3,af as v0,bf as y$,cf as X3,ff as m1}from"./vm-hands-entry-lite-pf1ft65e.js";import{jf as I5}from"./vm-hands-entry-lite-q2pb31vh.js";import{ig as WJ,lg as n5,mg as h3,og as N5}from"./vm-hands-entry-lite-53cyjs1a.js";import{Xg as Z2,Yg as p5}from"./vm-hands-entry-lite-7k65s010.js";import{_g as V0,ah as K7}from"./vm-hands-entry-lite-em388nee.js";import{yh as r}from"./vm-hands-entry-lite-5z6prrcd.js";import{Fh as D7}from"./vm-hands-entry-lite-wgx7z7gt.js";import{Kh as g0}from"./vm-hands-entry-lite-xsq25kmd.js";import{spawn as bJ,spawnSync as eK}from"child_process";import{closeSync as kJ,mkdirSync as $V,openSync as yJ,readdirSync as JV,realpathSync as B1,rmSync as z$}from"fs";import{hostname as ZV}from"os";import{dirname as $9,join as F0,resolve as QV}from"path";var eJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function U9($){let J=typeof $==="string"?eJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as BZ,randomBytes as z9}from"crypto";import{createInterface as KZ}from"readline";import{randomBytes as $Z}from"crypto";import{chmodSync as M9,existsSync as T9,lstatSync as JZ,mkdirSync as ZZ,readFileSync as _9,renameSync as QZ,unlinkSync as F9,writeFileSync as W9}from"fs";import{homedir as XZ}from"os";import{dirname as YZ,join as q9}from"path";function $1($=process.env,J=XZ()){let Z=$.XDG_CONFIG_HOME?.trim()||q9(J,".config"),X=x0({env:$})==="staging"?["staging"]:[];return q9(q2(Z,...X),"credentials.json")}function L9($,J=$1()){return ZZ(YZ(J),{recursive:!0,mode:448}),W9(J,`${JSON.stringify($,null,2)}
-`,{mode:384}),M9(J,384),J}function I$($=$1()){if(!T9($))return null;try{let J=_9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=e0(Q);if(X!==Q)GZ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function GZ($,J,Z){let Q=`${$}.${process.pid}.${$Z(6).toString("hex")}.tmp`;try{let X=JZ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(W9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
-`,{mode:384,flag:"wx"}),M9(Q,384),_9($,"utf8")!==J)throw Error("credentials_changed");QZ(Q,$)}catch{try{F9(Q)}catch{}}}function D9($=$1()){if(!T9($))return!1;return F9($),!0}var j9=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var gV=j9.filter(($)=>$!=="network:read"&&$!=="network:write");class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function A9(){let $=z9(48).toString("base64url"),J=BZ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:z9(32).toString("base64url")}}function VZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function HZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw VZ(Y,`OAuth token request failed (${X.status})`);return Y}var NZ=1e4;async function UZ($,J={}){let Z=J.fetchImpl??fetch,Q=await HZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(NZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return L9(X,J.path??$1()),X}var M2=new Map;function O9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function k1($={}){let J=$.path??$1(),Z=I$(J);if(!Z)return null;let Q=$.apiOrigin??k0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),B=M2.get(Y);if(B)return O9(B,$.signal);let V;return V=UZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=I$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return k1({fetchImpl:$.fetchImpl,path:J});return D9(J),null}).finally(()=>{if(M2.get(Y)===V)M2.delete(Y)}),M2.set(Y,V),O9(V,$.signal)}function R9($,J){return new Promise((Z)=>{let Q=KZ({input:$}),X=!1,Y=(V)=>{if(X)return;X=!0,J.removeEventListener("abort",B),Q.close(),$.pause(),Z(V)},B=()=>Y(null);J.addEventListener("abort",B,{once:!0}),Q.once("line",(V)=>Y(V)),Q.once("close",()=>Y(null))})}var qZ=G.object({label:G.string(),used_percent:G.number().min(0).max(100).nullable(),resets_at:G.string().nullable(),exhausted:G.boolean().nullable()}),MZ=G.object({groups:G.array(G.object({selectable:G.boolean().optional(),accounts:G.array(G.object({source_id:G.string().min(1),model_ids:G.array(G.string().min(1)).optional()}))}))});function TZ($){let J=MZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var _Z=["minimal","low","medium","high","xhigh","max"],FZ=G.object({id:G.string().min(1),kind:G.string(),name:G.string(),custom_name:G.string().nullish(),status:G.string(),online:G.boolean(),compatible:G.boolean().optional(),compatibility_reason:G.string().nullish(),folder_lane_of:G.string().nullish(),roots:G.array(G.object({id:G.string().min(1),label:G.string()}))}),WZ=G.object({devices:G.array(FZ),end_cursor:G.string().nullish(),has_next_page:G.boolean().optional()}),LZ=G.object({id:G.string().min(1),name:G.string()}),DZ=G.object({items:G.array(LZ)}),jZ=G.object({id:G.string().min(1),name:G.string(),main:G.boolean(),mine:G.boolean(),session_id:G.string().nullish(),appearance:G.object({color:G.string().nullish()}).nullish().catch(null)}),zZ=G.object({items:G.array(jZ)}),OZ=G.object({skill_id:G.string().min(1),name:G.string(),description:G.string().nullish(),activation_keywords:G.array(G.string()).default([]),is_enabled:G.boolean().default(!0)}),AZ=G.object({items:G.array(OZ).default([])}),RZ=G.object({id:G.string().min(1),kind:G.string(),enabled:G.boolean(),schedule:G.object({expression:G.string().nullish(),every_seconds:G.number().nullish(),next_run_at:G.string().nullish()}).nullish(),github:G.object({event:G.string().nullish(),action:G.string().nullish(),repo:G.string().nullish()}).nullish(),last_fired_at:G.string().nullish()}),P9=G.object({id:G.string().min(1),name:G.string().nullish(),instructions:G.string().nullish(),enabled:G.boolean(),triggers:G.array(RZ).default([])}),CZ=G.object({items:G.array(P9).default([]),end_cursor:G.string().nullish(),has_next_page:G.boolean().optional()}),PZ=G.object({id:G.string().min(1),slug:G.string().nullish(),name:G.string(),description:G.string().nullish(),transport:G.string().nullish(),url:G.string().nullish(),enabled:G.boolean()}),IZ=G.object({items:G.array(PZ).default([])}),xZ=G.object({status:G.string(),summary:G.string().nullish(),category:G.string().nullish(),outcome:G.string().nullish(),message_count:G.number().nullish(),pr_url:G.string().nullish(),cost_usd:G.number().nullish(),generated_at:G.string().nullish()}),C9=G.object({tags:G.array(G.string()).default([])}),EZ=G.enum(["linux","macos"]),I9=G.object({id:G.string().min(1),name:G.string().min(1),platform:EZ.nullable(),workers:G.object({total:G.number().int(),online:G.number().int(),busy:G.number().int(),idle:G.number().int()}),sessions:G.object({queued:G.number().int(),running:G.number().int()})}),SZ=G.object({machines:G.array(I9)}),wZ=G.object({machine:I9}),bZ=G.object({deleted:G.literal(!0),revoked_workers:G.number().int(),revoked_tokens:G.number().int()}),kZ=G.object({token:G.object({id:G.string().min(1),machine_id:G.string().min(1),token_prefix:G.string()}),secret:G.string().startsWith("rmt_")}),x9=G.looseObject({machine_id:G.string().min(1),machine_name:G.string().min(1)}),yZ=x9.extend({organization_id:G.string().min(1)}),cV=G.object({id:G.string().min(1),name:G.string().min(1),state:G.enum(["waiting","placed"]),queue_position:G.number().int().nullable()});var sV=G.union([G.object({kind:G.literal("cloud")}),G.object({kind:G.enum(["mac","headless"]),device_id:G.string().min(1),root_id:G.string().min(1)})]);function P0($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var fZ=G.object({error:G.object({type:G.string(),message:G.string()})});function E9($,J,Z){let Q=fZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,B=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",V=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${B}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(V)&&V>=0?V*1000:void 0)}async function S9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw E9(J.status,Z,J.headers.get("retry-after"));return P0(yZ,Z,"invalid_machine_ticket")}class U1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.raw?{"content-type":J.raw.contentType}:J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.raw?J.raw.bytes:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let B=await k1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(B)return this.credentials=B,this.request($,J,!0)}if(!X.ok)throw E9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return P0(SZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return P0(wZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return P0(bZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return P0(kZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return P0(x9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=DZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listReasons(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons`);return P0(zZ,$,"invalid_reason_list").items}async openReasonConversation($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons/${encodeURIComponent($)}/conversation`,{method:"POST"});return P0(G.object({session_id:G.string().min(1)}),J,"invalid_reason_conversation").session_id}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return P0(AZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=WZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...B})=>({...B,...Array.isArray(Q)?{reasoning_efforts:_Z.filter((V)=>Q.includes(V))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return U9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=qZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=TZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($,J){let Z=J?.fields.length?`?fields=${encodeURIComponent(J.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${Z}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.branch?{branch:$.branch}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},...$.longRunning?{long_running:{enabled:!0}}:{},...$.spendLimitRcu?{spend_limit_rcu:$.spendLimitRcu}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((B)=>X.components[B]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($,J){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments${J?`?view=${J}`:""}`)).items??[]}catch(Z){if(Z instanceof G0&&(Z.status===403||Z.status===404))return[];throw Z}}async requireSessionAttachments(){let $=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if($.session_attachments!==!0){let J=typeof $.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test($.reason_version)?`Agent ${$.reason_version}`:null,Z=typeof $.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test($.commit_sha)?`server ${$.commit_sha.slice(0,12)}`:null,Q=[J,Z].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${Q?` (${Q})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{},...Z.delivery?{delivery:Z.delivery}:{}}})}async steerQueuedMessage($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages/${encodeURIComponent(J)}/steer`,{method:"POST",body:{}})}async withdrawQueuedMessage($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages/${encodeURIComponent(J)}/queued`,{method:"DELETE"})}async getConversation($){let J=[],Z=null;for(let Q=0;Q<50;Q+=1){let X=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/conversation${Z?`?after=${encodeURIComponent(Z)}`:""}`);if(J.push(...X.items??[]),!X.has_next_page||!X.end_cursor)break;Z=X.end_cursor}return J}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}sessionAction($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/${J}`,{method:"POST",body:Z})}renameSession($,J){return this.sessionAction($,"rename",{title:J||null})}moveSessionToProject($,J){return this.sessionAction($,"project",{project_id:J})}compactSession($){return this.sessionAction($,"compact")}retrySession($){return this.sessionAction($,"retry")}rewindSession($,J){return this.sessionAction($,"rewind",{message_id:J.messageId,content:J.content,request_id:J.requestId})}forkSession($,J){return this.sessionAction($,"fork",{...J.message?{message:J.message}:{},client_session_id:J.clientSessionId})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}sessionPath($,J=""){return`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${J}`}async archiveSession($){await this.request(this.sessionPath($,"/archive"),{method:"POST",body:{}})}async unarchiveSession($){await this.request(this.sessionPath($,"/unarchive"),{method:"POST",body:{}})}async deleteSession($){await this.request(this.sessionPath($),{method:"DELETE"})}async listSessionTags($){return P0(C9,await this.request(this.sessionPath($,"/tags")),"invalid_session_tags").tags}async appendSessionTags($,J){let Z=await this.request(this.sessionPath($,"/tags"),{method:"POST",body:{tags:J}});return P0(C9,Z,"invalid_session_tags").tags}async sessionInsight($,J=!1){let Z=await this.request(this.sessionPath($,J?"/insights/generate":"/insights"),J?{method:"POST",body:{}}:{});return P0(xZ,Z,"invalid_session_insight")}async listAutomations(){let $=[],J=null;for(let Z=0;Z<20;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations?first=100${J?`&after=${encodeURIComponent(J)}`:""}`),X=P0(CZ,Q,"invalid_automation_list");if($.push(...X.items),J=X.has_next_page?X.end_cursor??null:null,!J)break}return $}async createScheduledAutomation($,J){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations`,Q=P0(P9,await this.request(Z,{method:"POST",body:{name:$.name,instructions:$.instructions,...$.repo?{repo:$.repo.full_name,provider:$.repo.provider}:{}}}),"invalid_automation");try{await this.request(`${Z}/${encodeURIComponent(Q.id)}/triggers`,{method:"POST",body:J})}catch(X){throw await this.deleteAutomation(Q.id).catch(()=>{return}),X}return Q}async setAutomationEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"PATCH",body:{enabled:J}})}async deleteAutomation($){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"DELETE"})}async transcribe($,J){let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/transcribe`,{method:"POST",raw:{bytes:$,contentType:J}});return P0(G.object({transcript:G.string()}),Z,"invalid_transcript").transcript}async listMcpServers(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/mcp-servers`);return P0(IZ,$,"invalid_mcp_server_list").items}async setSkillEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills/${encodeURIComponent($)}`,{method:"PUT",body:{is_enabled:J}})}}function y1($,J){let Z=k0($,"REASON_API_URL")?.trim();if(!Z)return j4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function hZ($){return k0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function z4($){return k0($,"REASON_API_KEY")?.trim()||void 0}async function w9($,J){let Z=$.env??process.env,Q=z4(Z);if(!Q)return($.getCredentials??k1)({apiOrigin:hZ(Z),signal:J});let X=y1(Z,$.channel??x0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),B=await Y.json().catch(()=>({})),V=n0(B)?B:{};if(!Y.ok){let N=typeof V.detail==="string"?V.detail:typeof V.message==="string"?V.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof V.error==="string"?V.error:"api_key_auth_failed",N)}if(typeof V.org_id!=="string"||!V.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(V.scopes)?V.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:V.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as mZ}from"crypto";import{unlinkSync as vZ}from"fs";import{platform as gZ}from"os";import{join as uZ}from"path";var b9=G.discriminatedUnion("store",[G.strictObject({version:G.literal(1),store:G.literal("keychain")}),G.strictObject({version:G.literal(1),store:G.literal("file"),api_key:G.string().min(1).max(4096)})]),f1=($)=>uZ($,"api-key.json");function O1($){let J=mZ("sha256").update(`reason-connect-api-key
-${$}`).digest("hex");return new e1(T2(),gZ(),J)}function O4($,J,Z=O1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=O1($)){if(!u(f1($)))return null;let Z=b9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function k9($,J=O1($)){if(!u(f1($)))return;if(b9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}vZ(f1($))}async function A4($,J){let Z;try{Z=await w9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:y0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as GQ,renameSync as BQ,rmSync as v1}from"fs";import{join as M0}from"path";import{createHash as dZ}from"crypto";import{realpathSync as lZ,statSync as pZ,unlinkSync as _2}from"fs";import{platform as cZ}from"os";import{join as f0}from"path";function d($){return{state:f0(g($),"device.json"),control:f0(g($),"control.json"),lock:f0(g($),"lifecycle.lock"),socket:f0(g($),"control.sock"),daemon:f0(g($),"daemon.json"),releaseCheck:f0(g($),"release-check.json"),updateDeferral:f0(g($),"update-deferral.json"),firstHeartbeat:f0(g($),"first-heartbeat.json")}}var sZ=G.object({version:G.literal(1),device_id:G.string().min(1).max(160),offer:G.unknown().optional(),enrollment_ms:G.number().int().nonnegative().max($$).optional()});function f9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function C4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=sZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=f0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?P4($):new R4(g($))}function W2($,J){T0($,!0),nZ($);let Z=J??P4($),Q=new R4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function P4($){return new e1(T2(),cZ(),aZ($))}function aZ($){let J=I4($);return dZ("sha256").update(`reason-worker
-${J?.directory??g($)}`).digest("hex")}function S$($,J){c(f0(g($),w$),{version:1,directory:I4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function h9($){return u(f0(g($),w$))}var iZ=G.strictObject({version:G.literal(1),directory:G.string().min(1),devicePublicKey:G.string().min(1)});function I4($){let J=f0(g($),w$);if(!u(J))return null;let Z=iZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function nZ($){let J=f0(g($),w$);if(!u(J))return;if(I4($))try{let Z=P4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof Y0))throw Z}_2(J)}function q1($){let J=lZ($.workspaceRoot);if(J!==$.workspaceRoot||!pZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&y9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var m9=G.strictObject({version:G.literal(1),drained:G.boolean(),revoked:G.boolean()});function $0($){let J=d($).control;return u(J)?m9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function E0($,J){c(d($).control,m9.parse(J))}function h0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=f0(g($),w$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var rZ=G.strictObject({read:G.boolean(),write:G.boolean(),execute:G.boolean(),discover_environment:G.boolean(),expose_mcp:G.literal(!1)}),x4=G.strictObject({version:G.literal(1),organization_id:G.string().min(1).max(160),enrollment_ticket:G.string().min(1).max(4096),code_verifier:G.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:G.string().regex(/^[a-f0-9]{64}$/),root:G.strictObject({path_fingerprint:G.string().regex(/^[a-f0-9]{64}$/),permissions:rZ,execution_mode:G.enum(["confined","host"]).default("confined")}),folders:G.array(G.strictObject({path_fingerprint:G.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),tZ=G.object({device_id:G.string().min(1).max(160),organization_id:G.string().min(1).max(160),auth_scheme:G.literal("p256"),protocol_version:G.literal(2),roots:G.array(G.object({id:G.string().min(1),label:G.string(),path_fingerprint:G.string()})).min(1).max(32),headless:G.object({lifecycle:G.enum(["persistent","ephemeral"]),expires_at:G.iso.datetime({offset:!0})}),first_heartbeat:G.unknown().optional()}),E4=30000;class J1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function oZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(E4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new J1(X?.error==="device_revoked")}return Q.json()}async function S4($,J,Z,Q){d0();let X=x4.parse(JSON.parse(s(J)));return Z1($,X,Z,Q)}async function Z1($,J,Z,Q=(Y,B)=>oZ(Y,B,y0($.proxy)),X=performance.now()){let Y=g9($,J,Z),B=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(B,X)}async function v9($,J,Z,Q,X=performance.now()){let Y=g9($,J,Z),B=await Q(Y.request,J.code_verifier);return B===null?null:Y.receipt(B,X)}function g9($,J,Z){if(d0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],B;try{B=Z.loadPublicKey()}catch{B=Z.createFreshPublicKey()}return{request:{device_public_key:B,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=tZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let H=F2(q.first_heartbeat);try{f9($,q.device_id,{...H?{offer:H}:{},enrollmentMs:Math.min($$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:B,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as eZ,randomUUID as $Q}from"crypto";import{unlinkSync as JQ}from"fs";import{join as ZQ}from"path";var u9=G.strictObject({version:G.literal(1),install_id:G.uuid(),fingerprint_key:G.string().regex(/^[a-f0-9]{64}$/)}),QQ=G.object({enrollment_ticket:G.string().min(1).max(4096),expires_at:G.iso.datetime({offset:!0}),device_kind:G.literal("headless"),lifecycle:G.enum(["persistent","ephemeral"]),device_expires_at:G.iso.datetime({offset:!0})});function w4($){return QQ.parse($)}var XQ=G.object({credentialKind:G.enum(["oauth","api_key"]).optional(),apiOrigin:G.url(),clientId:G.string(),accessToken:G.string().min(1).max(32768),refreshToken:G.string().max(32768),expiresAt:G.iso.datetime({offset:!0}),scopes:G.array(G.string().max(128)).max(128),orgId:G.string().min(1).max(160)});function A1($){return $1(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function R1($,J=A1($)){if(!u(J))return null;let Z=XQ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=y0($.proxy),X=Object.assign((B,V)=>Q(B,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await k1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function d9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=C1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function l9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let B=C1($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await v9($,B.direct(J.orgId),Q,(N,q)=>V({approval:B.request,code_verifier:q,registration:N}).catch((H)=>{throw YQ(H)}),Y);if(K)return K}return Z1($,B.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(B.request)),Q,X,Y)}function YQ($){if(!($ instanceof G0))return $;if($.status===409)return new J1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new J1(!1);return $}var b$=($)=>ZQ(g($),"enrollment-install.json");function p9($){if(u(b$($)))JQ(b$($))}function C1($,{stored:J=!0}={}){d0();let Z=b$($),Q=J&&u(Z)?u9.parse(JSON.parse(s(Z))):{version:1,install_id:$Q(),fingerprint_key:eZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),B=m1([$.workspaceRoot],X,Y)[0];if(B.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((H)=>{let U=m1([H],X,Y)[0];if(U.path!==H)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=A9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[B.pathFingerprint,...V.map((H)=>H.path_fingerprint)].map((H)=>({path_fingerprint:H,permissions:X,execution_mode:$.executionMode}))},q=(H)=>({version:1,organization_id:H,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:B.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(H){e(g(H),!0),c(b$(H),Q)},complete(H,U){let M=w4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(H),enrollment_ticket:M.enrollment_ticket}},direct:q}}function c9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=u9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,i9=600000,n9=15000,s9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,M1=($)=>M0(g($),"workspaces"),r9="account.json",b4=($)=>u(M0($,r9));function m0($){let J;try{J=GQ(M1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=M0(M1($),Z),X=M0(Q,"worker.json"),Y=null;try{let B=J0.safeParse(JSON.parse(s(X)));if(B.success&&B.data.stateDirectory===Q)Y=B.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:b4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:M0(M1($),Z)});return e(Q.stateDirectory,!0),c(M0(Q.stateDirectory,r9),{version:1}),{config:Q,configPath:M0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),E0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||m0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var k4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function a9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of k4)v1(M0(g(J),Y),{force:!0});for(let Y of k4){let B=M0(g($),Y);if(u(B))BQ(B,M0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");v0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function y4($){for(let J of m0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))h0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(h4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(H)=>Number(Date.parse(H.worker?.expiresAt??"")>X+60000),V=m0($).flatMap((H)=>{if(!H.account||!H.config)return[];try{if($0(H.config).revoked)return[];let U=t(H.config);return U&&U.orgId.toLowerCase()===H.organizationId&&(!Q||Y(U))?[{...H,config:H.config,state:U}]:[]}catch{return[]}}).sort((H,U)=>Number(U.organizationId===J)-Number(H.organizationId===J)||Y(U.state)-Y(H.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==V.organizationId){let H=j2($,N);a9($,H.config),c(H.configPath,H.config)}else if(u(g($))){try{if(u(d($).state))h0($)}catch{}for(let H of k4)v1(M0(g($),H),{force:!0})}y4($);let q=J0.parse({...V.config,stateDirectory:$.stateDirectory});return a9(V.config,q),c(M0($.stateDirectory,"worker.json"),q),v1(V.directory,{recursive:!0,force:!0}),q}var f4={before($){for(let{config:J}of m0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of m0(J)){if(Y)continue;try{let B=J0.parse(JSON.parse(s(X)));if(B.stateDirectory!==M0(M1($),Z))continue;let V=J0.parse({...B,stateDirectory:Q}),K=T0(V),N=h1(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(B))v0({...N,worker:{...N.worker,configDigest:U0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},h4=($)=>M0(M1($),"listed.json");function t9($){try{let J=JSON.parse(s(h4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function o9($,J){let Z=m0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=t9($),B=Y&&!Y.listed?Y.reason:null,V=B||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(B||Y&&!Y.listed))return{workspaces:null,off:B};return{off:B,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:q})=>{let H=!1,U=null,M=!1;try{H=N?$0(N).revoked:!1,U=N&&!H?t(N):null,M=J&&!!U&&y$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:H?"removed":M?"connected":"not_running",blocked:!q&&!H&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function e9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),B=new Map,V=null,K=!1,N=t9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...R}=J,x=Z.roots.slice(1).map((C)=>C.path);return J0.parse({...R,...x.length?{folders:x}:{},stateDirectory:M0(M1(J),W)})},H=async(W)=>{let L=B.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let R=new AbortController,x=()=>R.abort();if(X.addEventListener("abort",x,{once:!0}),X.aborted)R.abort();let C={...W,controller:R,claims:0,done:Promise.resolve(),account:L};C.done=$.serve(W,R.signal,(P)=>{C.claims=P}).then(()=>{return},(P)=>{if(L&&P instanceof _0&&P.status===401&&s9.has(P.code)){try{E0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer (${P.code}); run \`reason connect\` signed in as that account to connect it again
+import{t as d0}from"./vm-hands-entry-lite-xf6schkk.js";import{A as G5,B as B5,C as R7,D as C7,E as v3,F as i5,G as H5,H as _0,I as l$,J as p$,K as S0,L as J2,M as n5,N as n0,O as M6,P as Z3,Q as Z6,U as Q6,ba as x7,ca as E7,da as S7,ea as w7,fa as u3,y as l6,z as p6}from"./vm-hands-entry-lite-tdpqhm9j.js";import{Aa as K5,Ba as V5,Ca as L7,Da as D7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as W5,Ka as z7,La as W$,Oa as V4,Pa as H4,Qa as CJ,Ra as PJ,Sa as IJ,Ta as y0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as O7,db as U6,fb as h8,ha as r7,ib as u2,ka as z5,kb as a5,la as O5,lb as T3,nb as h5,oa as F5,qa as E5,rb as A7,sb as N3,ta as S5,ya as y5,za as f5}from"./vm-hands-entry-lite-460d1y2d.js";import{Ab as w5,Bb as b5,Ib as k5}from"./vm-hands-entry-lite-q8b738zj.js";import{Nb as N5}from"./vm-hands-entry-lite-93ejmwqn.js";import{Ub as s5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{mc as Y5}from"./vm-hands-entry-lite-3rx6cm14.js";import{Ac as bJ,Bc as Y4,Cc as W1,Dc as E8,Ec as G4,Ic as t5,Lc as P7,Oc as c6,Pc as s6,qc as i1,rc as G1,sc as F1,tc as L$,uc as HJ,vc as EJ,wc as SJ,xc as D$,yc as wJ,zc as e3}from"./vm-hands-entry-lite-36ey39qm.js";import{Fd as X5,Ld as $$,Vd as F2,Zc as b2,bd as F7,cd as W7}from"./vm-hands-entry-lite-n4xx6qfr.js";import{ee as G}from"./vm-hands-entry-lite-kqn1bkrr.js";import{Be as J6,me as xJ,ne as o2,qe as I7,te as n$,ve as tJ,we as oJ}from"./vm-hands-entry-lite-a8r490bb.js";import{$e as e1,Fe as k0,Ge as k$,Ie as x0,Je as j4,Le as e0,Me as z0,Ne as y9,Oe as AJ,Pe as RJ,Qe as E2,Re as q2,Se as f3,Te as I8,Ue as x8,Ve as Y$,We as v$,Xe as Y0,Ye as T2,Ze as y7,_e as f7,af as R4,cf as Q3,df as h1,ef as v0,ff as y$,gf as X3,jf as m1}from"./vm-hands-entry-lite-wh0qp1gf.js";import{nf as x5}from"./vm-hands-entry-lite-yhz6sv35.js";import{mg as LJ,pg as r5,qg as h3,sg as U5}from"./vm-hands-entry-lite-vy57b2t2.js";import{$g as Z2,ah as c5}from"./vm-hands-entry-lite-mzxhng4z.js";import{ch as V0,eh as V7}from"./vm-hands-entry-lite-cp1wqjs5.js";import{Ch as r}from"./vm-hands-entry-lite-8759hszg.js";import{Jh as j7}from"./vm-hands-entry-lite-14t846kp.js";import{Oh as g0}from"./vm-hands-entry-lite-v6tkjqb1.js";import{spawn as kJ,spawnSync as $V}from"child_process";import{closeSync as yJ,mkdirSync as JV,openSync as fJ,readdirSync as ZV,realpathSync as B1,rmSync as z$}from"fs";import{hostname as QV}from"os";import{dirname as $9,join as F0,resolve as XV}from"path";var $Z=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function U9($){let J=typeof $==="string"?$Z.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as KZ,randomBytes as z9}from"crypto";import{createInterface as VZ}from"readline";import{randomBytes as JZ}from"crypto";import{chmodSync as M9,existsSync as T9,lstatSync as ZZ,mkdirSync as QZ,readFileSync as _9,renameSync as XZ,unlinkSync as F9,writeFileSync as W9}from"fs";import{homedir as YZ}from"os";import{dirname as GZ,join as q9}from"path";function $1($=process.env,J=YZ()){let Z=$.XDG_CONFIG_HOME?.trim()||q9(J,".config"),X=x0({env:$})==="staging"?["staging"]:[];return q9(q2(Z,...X),"credentials.json")}function L9($,J=$1()){return QZ(GZ(J),{recursive:!0,mode:448}),W9(J,`${JSON.stringify($,null,2)}
+`,{mode:384}),M9(J,384),J}function I$($=$1()){if(!T9($))return null;try{let J=_9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=e0(Q);if(X!==Q)BZ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function BZ($,J,Z){let Q=`${$}.${process.pid}.${JZ(6).toString("hex")}.tmp`;try{let X=ZZ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(W9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
+`,{mode:384,flag:"wx"}),M9(Q,384),_9($,"utf8")!==J)throw Error("credentials_changed");XZ(Q,$)}catch{try{F9(Q)}catch{}}}function D9($=$1()){if(!T9($))return!1;return F9($),!0}var j9=["run","mcp:read","mcp:write","secrets:read","secrets:write","sessions:read","sessions:debug","devices:read","devices:write","devices:use","ssh:write","knowledge:read","memory:read","memory:write","skills:read","skills:write","repos:read","repos:write","reviews:read","reviews:write","deployment:read","analytics:read","org:read","org:write","attachments:read","attachments:write","guardrails:read","guardrails:write","network:read","network:write","automations:read","automations:write","agent_auth:read"];var uV=j9.filter(($)=>$!=="network:read"&&$!=="network:write");class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function A9(){let $=z9(48).toString("base64url"),J=KZ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:z9(32).toString("base64url")}}function HZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function NZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw HZ(Y,`OAuth token request failed (${X.status})`);return Y}var UZ=1e4;async function qZ($,J={}){let Z=J.fetchImpl??fetch,Q=await NZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(UZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return L9(X,J.path??$1()),X}var M2=new Map;function O9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function k1($={}){let J=$.path??$1(),Z=I$(J);if(!Z)return null;let Q=$.apiOrigin??k0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),B=M2.get(Y);if(B)return O9(B,$.signal);let V;return V=qZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=I$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return k1({fetchImpl:$.fetchImpl,path:J});return D9(J),null}).finally(()=>{if(M2.get(Y)===V)M2.delete(Y)}),M2.set(Y,V),O9(V,$.signal)}function R9($,J){return new Promise((Z)=>{let Q=VZ({input:$}),X=!1,Y=(V)=>{if(X)return;X=!0,J.removeEventListener("abort",B),Q.close(),$.pause(),Z(V)},B=()=>Y(null);J.addEventListener("abort",B,{once:!0}),Q.once("line",(V)=>Y(V)),Q.once("close",()=>Y(null))})}var MZ=G.object({label:G.string(),used_percent:G.number().min(0).max(100).nullable(),resets_at:G.string().nullable(),exhausted:G.boolean().nullable()}),TZ=G.object({groups:G.array(G.object({selectable:G.boolean().optional(),accounts:G.array(G.object({source_id:G.string().min(1),model_ids:G.array(G.string().min(1)).optional()}))}))});function _Z($){let J=TZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var FZ=["minimal","low","medium","high","xhigh","max"],WZ=G.object({id:G.string().min(1),kind:G.string(),name:G.string(),custom_name:G.string().nullish(),status:G.string(),online:G.boolean(),compatible:G.boolean().optional(),compatibility_reason:G.string().nullish(),folder_lane_of:G.string().nullish(),roots:G.array(G.object({id:G.string().min(1),label:G.string()}))}),LZ=G.object({devices:G.array(WZ),end_cursor:G.string().nullish(),has_next_page:G.boolean().optional()}),DZ=G.object({id:G.string().min(1),name:G.string()}),jZ=G.object({items:G.array(DZ)}),zZ=G.object({id:G.string().min(1),name:G.string(),main:G.boolean(),mine:G.boolean(),session_id:G.string().nullish(),appearance:G.object({color:G.string().nullish()}).nullish().catch(null)}),OZ=G.object({items:G.array(zZ)}),AZ=G.object({skill_id:G.string().min(1),name:G.string(),description:G.string().nullish(),activation_keywords:G.array(G.string()).default([]),is_enabled:G.boolean().default(!0)}),RZ=G.object({items:G.array(AZ).default([])}),CZ=G.object({id:G.string().min(1),kind:G.string(),enabled:G.boolean(),schedule:G.object({expression:G.string().nullish(),every_seconds:G.number().nullish(),next_run_at:G.string().nullish()}).nullish(),github:G.object({event:G.string().nullish(),action:G.string().nullish(),repo:G.string().nullish()}).nullish(),last_fired_at:G.string().nullish()}),P9=G.object({id:G.string().min(1),name:G.string().nullish(),instructions:G.string().nullish(),enabled:G.boolean(),triggers:G.array(CZ).default([])}),PZ=G.object({items:G.array(P9).default([]),end_cursor:G.string().nullish(),has_next_page:G.boolean().optional()}),IZ=G.object({id:G.string().min(1),slug:G.string().nullish(),name:G.string(),description:G.string().nullish(),transport:G.string().nullish(),url:G.string().nullish(),enabled:G.boolean()}),xZ=G.object({items:G.array(IZ).default([])}),EZ=G.object({status:G.string(),summary:G.string().nullish(),category:G.string().nullish(),outcome:G.string().nullish(),message_count:G.number().nullish(),pr_url:G.string().nullish(),cost_usd:G.number().nullish(),generated_at:G.string().nullish()}),C9=G.object({tags:G.array(G.string()).default([])}),SZ=G.enum(["linux","macos"]),I9=G.object({id:G.string().min(1),name:G.string().min(1),platform:SZ.nullable(),workers:G.object({total:G.number().int(),online:G.number().int(),busy:G.number().int(),idle:G.number().int()}),sessions:G.object({queued:G.number().int(),running:G.number().int()})}),wZ=G.object({machines:G.array(I9)}),bZ=G.object({machine:I9}),kZ=G.object({deleted:G.literal(!0),revoked_workers:G.number().int(),revoked_tokens:G.number().int()}),yZ=G.object({token:G.object({id:G.string().min(1),machine_id:G.string().min(1),token_prefix:G.string()}),secret:G.string().startsWith("rmt_")}),x9=G.looseObject({machine_id:G.string().min(1),machine_name:G.string().min(1)}),fZ=x9.extend({organization_id:G.string().min(1)}),sV=G.object({id:G.string().min(1),name:G.string().min(1),state:G.enum(["waiting","placed"]),queue_position:G.number().int().nullable()});var aV=G.union([G.object({kind:G.literal("cloud")}),G.object({kind:G.enum(["mac","headless"]),device_id:G.string().min(1),root_id:G.string().min(1)})]);function P0($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var hZ=G.object({error:G.object({type:G.string(),message:G.string()})});function E9($,J,Z){let Q=hZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,B=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",V=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${B}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(V)&&V>=0?V*1000:void 0)}async function S9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw E9(J.status,Z,J.headers.get("retry-after"));return P0(fZ,Z,"invalid_machine_ticket")}class U1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.raw?{"content-type":J.raw.contentType}:J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.raw?J.raw.bytes:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let B=await k1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(B)return this.credentials=B,this.request($,J,!0)}if(!X.ok)throw E9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return P0(wZ,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return P0(bZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return P0(kZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return P0(yZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return P0(x9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=jZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listReasons(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons`);return P0(OZ,$,"invalid_reason_list").items}async openReasonConversation($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/reasons/${encodeURIComponent($)}/conversation`,{method:"POST"});return P0(G.object({session_id:G.string().min(1)}),J,"invalid_reason_conversation").session_id}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return P0(RZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=LZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...B})=>({...B,...Array.isArray(Q)?{reasoning_efforts:FZ.filter((V)=>Q.includes(V))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return U9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=MZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=_Z(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($,J){let Z=J?.fields.length?`?fields=${encodeURIComponent(J.fields.join(","))}`:"";return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${Z}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.branch?{branch:$.branch}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},...$.longRunning?{long_running:{enabled:!0}}:{},...$.spendLimitRcu?{spend_limit_rcu:$.spendLimitRcu}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((B)=>X.components[B]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($,J){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments${J?`?view=${J}`:""}`)).items??[]}catch(Z){if(Z instanceof G0&&(Z.status===403||Z.status===404))return[];throw Z}}async requireSessionAttachments(){let $=await this.request("/deployment",{headers:{"cache-control":"no-cache"}});if($.session_attachments!==!0){let J=typeof $.reason_version==="string"&&/^\d+\.\d+(?:\.\d+)?$/.test($.reason_version)?`Agent ${$.reason_version}`:null,Z=typeof $.commit_sha==="string"&&/^[a-f0-9]{40,64}$/i.test($.commit_sha)?`server ${$.commit_sha.slice(0,12)}`:null,Q=[J,Z].filter(Boolean).join(", ");throw Error(`This server does not support Session image attachments: ${new URL(this.credentials.apiOrigin).host}${Q?` (${Q})`:""}. The API server needs an attachment-capable deployment; updating the Agent version alone is not enough. Your image was not sent; retry after the server update.`)}}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{},...Z.delivery?{delivery:Z.delivery}:{}}})}async steerQueuedMessage($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages/${encodeURIComponent(J)}/steer`,{method:"POST",body:{}})}async withdrawQueuedMessage($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages/${encodeURIComponent(J)}/queued`,{method:"DELETE"})}async getConversation($){let J=[],Z=null;for(let Q=0;Q<50;Q+=1){let X=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/conversation${Z?`?after=${encodeURIComponent(Z)}`:""}`);if(J.push(...X.items??[]),!X.has_next_page||!X.end_cursor)break;Z=X.end_cursor}return J}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}sessionAction($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/${J}`,{method:"POST",body:Z})}renameSession($,J){return this.sessionAction($,"rename",{title:J||null})}moveSessionToProject($,J){return this.sessionAction($,"project",{project_id:J})}compactSession($){return this.sessionAction($,"compact")}retrySession($){return this.sessionAction($,"retry")}rewindSession($,J){return this.sessionAction($,"rewind",{message_id:J.messageId,content:J.content,request_id:J.requestId})}forkSession($,J){return this.sessionAction($,"fork",{...J.message?{message:J.message}:{},client_session_id:J.clientSessionId})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}sessionPath($,J=""){return`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}${J}`}async archiveSession($){await this.request(this.sessionPath($,"/archive"),{method:"POST",body:{}})}async unarchiveSession($){await this.request(this.sessionPath($,"/unarchive"),{method:"POST",body:{}})}async deleteSession($){await this.request(this.sessionPath($),{method:"DELETE"})}async listSessionTags($){return P0(C9,await this.request(this.sessionPath($,"/tags")),"invalid_session_tags").tags}async appendSessionTags($,J){let Z=await this.request(this.sessionPath($,"/tags"),{method:"POST",body:{tags:J}});return P0(C9,Z,"invalid_session_tags").tags}async sessionInsight($,J=!1){let Z=await this.request(this.sessionPath($,J?"/insights/generate":"/insights"),J?{method:"POST",body:{}}:{});return P0(EZ,Z,"invalid_session_insight")}async listAutomations(){let $=[],J=null;for(let Z=0;Z<20;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations?first=100${J?`&after=${encodeURIComponent(J)}`:""}`),X=P0(PZ,Q,"invalid_automation_list");if($.push(...X.items),J=X.has_next_page?X.end_cursor??null:null,!J)break}return $}async createScheduledAutomation($,J){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations`,Q=P0(P9,await this.request(Z,{method:"POST",body:{name:$.name,instructions:$.instructions,...$.repo?{repo:$.repo.full_name,provider:$.repo.provider}:{}}}),"invalid_automation");try{await this.request(`${Z}/${encodeURIComponent(Q.id)}/triggers`,{method:"POST",body:J})}catch(X){throw await this.deleteAutomation(Q.id).catch(()=>{return}),X}return Q}async setAutomationEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"PATCH",body:{enabled:J}})}async deleteAutomation($){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/automations/${encodeURIComponent($)}`,{method:"DELETE"})}async transcribe($,J){let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/transcribe`,{method:"POST",raw:{bytes:$,contentType:J}});return P0(G.object({transcript:G.string()}),Z,"invalid_transcript").transcript}async listMcpServers(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/mcp-servers`);return P0(xZ,$,"invalid_mcp_server_list").items}async setSkillEnabled($,J){await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills/${encodeURIComponent($)}`,{method:"PUT",body:{is_enabled:J}})}}function y1($,J){let Z=k0($,"REASON_API_URL")?.trim();if(!Z)return j4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function mZ($){return k0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function z4($){return k0($,"REASON_API_KEY")?.trim()||void 0}async function w9($,J){let Z=$.env??process.env,Q=z4(Z);if(!Q)return($.getCredentials??k1)({apiOrigin:mZ(Z),signal:J});let X=y1(Z,$.channel??x0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),B=await Y.json().catch(()=>({})),V=n0(B)?B:{};if(!Y.ok){let N=typeof V.detail==="string"?V.detail:typeof V.message==="string"?V.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof V.error==="string"?V.error:"api_key_auth_failed",N)}if(typeof V.org_id!=="string"||!V.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(V.scopes)?V.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:V.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as vZ}from"crypto";import{unlinkSync as gZ}from"fs";import{platform as uZ}from"os";import{join as dZ}from"path";var b9=G.discriminatedUnion("store",[G.strictObject({version:G.literal(1),store:G.literal("keychain")}),G.strictObject({version:G.literal(1),store:G.literal("file"),api_key:G.string().min(1).max(4096)})]),f1=($)=>dZ($,"api-key.json");function O1($){let J=vZ("sha256").update(`reason-connect-api-key
+${$}`).digest("hex");return new e1(T2(),uZ(),J)}function O4($,J,Z=O1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=O1($)){if(!u(f1($)))return null;let Z=b9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function k9($,J=O1($)){if(!u(f1($)))return;if(b9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}gZ(f1($))}async function A4($,J){let Z;try{Z=await w9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:y0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as BQ,renameSync as KQ,rmSync as v1}from"fs";import{join as M0}from"path";import{createHash as lZ}from"crypto";import{realpathSync as pZ,statSync as cZ,unlinkSync as _2}from"fs";import{platform as sZ}from"os";import{join as f0}from"path";function d($){return{state:f0(g($),"device.json"),control:f0(g($),"control.json"),lock:f0(g($),"lifecycle.lock"),socket:f0(g($),"control.sock"),daemon:f0(g($),"daemon.json"),releaseCheck:f0(g($),"release-check.json"),updateDeferral:f0(g($),"update-deferral.json"),firstHeartbeat:f0(g($),"first-heartbeat.json")}}var aZ=G.object({version:G.literal(1),device_id:G.string().min(1).max(160),offer:G.unknown().optional(),enrollment_ms:G.number().int().nonnegative().max($$).optional()});function f9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function C4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=aZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=f0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?P4($):new R4(g($))}function W2($,J){T0($,!0),rZ($);let Z=J??P4($),Q=new R4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function P4($){return new e1(T2(),sZ(),iZ($))}function iZ($){let J=I4($);return lZ("sha256").update(`reason-worker
+${J?.directory??g($)}`).digest("hex")}function S$($,J){c(f0(g($),w$),{version:1,directory:I4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function h9($){return u(f0(g($),w$))}var nZ=G.strictObject({version:G.literal(1),directory:G.string().min(1),devicePublicKey:G.string().min(1)});function I4($){let J=f0(g($),w$);if(!u(J))return null;let Z=nZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function rZ($){let J=f0(g($),w$);if(!u(J))return;if(I4($))try{let Z=P4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof Y0))throw Z}_2(J)}function q1($){let J=pZ($.workspaceRoot);if(J!==$.workspaceRoot||!cZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&y9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var m9=G.strictObject({version:G.literal(1),drained:G.boolean(),revoked:G.boolean()});function $0($){let J=d($).control;return u(J)?m9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function E0($,J){c(d($).control,m9.parse(J))}function h0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=f0(g($),w$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var tZ=G.strictObject({read:G.boolean(),write:G.boolean(),execute:G.boolean(),discover_environment:G.boolean(),expose_mcp:G.literal(!1)}),x4=G.strictObject({version:G.literal(1),organization_id:G.string().min(1).max(160),enrollment_ticket:G.string().min(1).max(4096),code_verifier:G.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:G.string().regex(/^[a-f0-9]{64}$/),root:G.strictObject({path_fingerprint:G.string().regex(/^[a-f0-9]{64}$/),permissions:tZ,execution_mode:G.enum(["confined","host"]).default("confined")}),folders:G.array(G.strictObject({path_fingerprint:G.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),oZ=G.object({device_id:G.string().min(1).max(160),organization_id:G.string().min(1).max(160),auth_scheme:G.literal("p256"),protocol_version:G.literal(2),roots:G.array(G.object({id:G.string().min(1),label:G.string(),path_fingerprint:G.string()})).min(1).max(32),headless:G.object({lifecycle:G.enum(["persistent","ephemeral"]),expires_at:G.iso.datetime({offset:!0})}),first_heartbeat:G.unknown().optional()}),E4=30000;class J1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function eZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(E4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new J1(X?.error==="device_revoked")}return Q.json()}async function S4($,J,Z,Q){d0();let X=x4.parse(JSON.parse(s(J)));return Z1($,X,Z,Q)}async function Z1($,J,Z,Q=(Y,B)=>eZ(Y,B,y0($.proxy)),X=performance.now()){let Y=g9($,J,Z),B=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(B,X)}async function v9($,J,Z,Q,X=performance.now()){let Y=g9($,J,Z),B=await Q(Y.request,J.code_verifier);return B===null?null:Y.receipt(B,X)}function g9($,J,Z){if(d0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],B;try{B=Z.loadPublicKey()}catch{B=Z.createFreshPublicKey()}return{request:{device_public_key:B,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=oZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let H=F2(q.first_heartbeat);try{f9($,q.device_id,{...H?{offer:H}:{},enrollmentMs:Math.min($$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:B,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as $Q,randomUUID as JQ}from"crypto";import{unlinkSync as ZQ}from"fs";import{join as QQ}from"path";var u9=G.strictObject({version:G.literal(1),install_id:G.uuid(),fingerprint_key:G.string().regex(/^[a-f0-9]{64}$/)}),XQ=G.object({enrollment_ticket:G.string().min(1).max(4096),expires_at:G.iso.datetime({offset:!0}),device_kind:G.literal("headless"),lifecycle:G.enum(["persistent","ephemeral"]),device_expires_at:G.iso.datetime({offset:!0})});function w4($){return XQ.parse($)}var YQ=G.object({credentialKind:G.enum(["oauth","api_key"]).optional(),apiOrigin:G.url(),clientId:G.string(),accessToken:G.string().min(1).max(32768),refreshToken:G.string().max(32768),expiresAt:G.iso.datetime({offset:!0}),scopes:G.array(G.string().max(128)).max(128),orgId:G.string().min(1).max(160)});function A1($){return $1(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function R1($,J=A1($)){if(!u(J))return null;let Z=YQ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=y0($.proxy),X=Object.assign((B,V)=>Q(B,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await k1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function d9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=C1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function l9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let B=C1($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await v9($,B.direct(J.orgId),Q,(N,q)=>V({approval:B.request,code_verifier:q,registration:N}).catch((H)=>{throw GQ(H)}),Y);if(K)return K}return Z1($,B.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(B.request)),Q,X,Y)}function GQ($){if(!($ instanceof G0))return $;if($.status===409)return new J1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new J1(!1);return $}var b$=($)=>QQ(g($),"enrollment-install.json");function p9($){if(u(b$($)))ZQ(b$($))}function C1($,{stored:J=!0}={}){d0();let Z=b$($),Q=J&&u(Z)?u9.parse(JSON.parse(s(Z))):{version:1,install_id:JQ(),fingerprint_key:$Q(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),B=m1([$.workspaceRoot],X,Y)[0];if(B.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((H)=>{let U=m1([H],X,Y)[0];if(U.path!==H)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=A9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[B.pathFingerprint,...V.map((H)=>H.path_fingerprint)].map((H)=>({path_fingerprint:H,permissions:X,execution_mode:$.executionMode}))},q=(H)=>({version:1,organization_id:H,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:B.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(H){e(g(H),!0),c(b$(H),Q)},complete(H,U){let M=w4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(H),enrollment_ticket:M.enrollment_ticket}},direct:q}}function c9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=u9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,i9=600000,n9=15000,s9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,M1=($)=>M0(g($),"workspaces"),r9="account.json",b4=($)=>u(M0($,r9));function m0($){let J;try{J=BQ(M1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=M0(M1($),Z),X=M0(Q,"worker.json"),Y=null;try{let B=J0.safeParse(JSON.parse(s(X)));if(B.success&&B.data.stateDirectory===Q)Y=B.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:b4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:M0(M1($),Z)});return e(Q.stateDirectory,!0),c(M0(Q.stateDirectory,r9),{version:1}),{config:Q,configPath:M0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),E0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||m0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var k4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function a9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of k4)v1(M0(g(J),Y),{force:!0});for(let Y of k4){let B=M0(g($),Y);if(u(B))KQ(B,M0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");v0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function y4($){for(let J of m0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))h0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(h4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(H)=>Number(Date.parse(H.worker?.expiresAt??"")>X+60000),V=m0($).flatMap((H)=>{if(!H.account||!H.config)return[];try{if($0(H.config).revoked)return[];let U=t(H.config);return U&&U.orgId.toLowerCase()===H.organizationId&&(!Q||Y(U))?[{...H,config:H.config,state:U}]:[]}catch{return[]}}).sort((H,U)=>Number(U.organizationId===J)-Number(H.organizationId===J)||Y(U.state)-Y(H.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==V.organizationId){let H=j2($,N);a9($,H.config),c(H.configPath,H.config)}else if(u(g($))){try{if(u(d($).state))h0($)}catch{}for(let H of k4)v1(M0(g($),H),{force:!0})}y4($);let q=J0.parse({...V.config,stateDirectory:$.stateDirectory});return a9(V.config,q),c(M0($.stateDirectory,"worker.json"),q),v1(V.directory,{recursive:!0,force:!0}),q}var f4={before($){for(let{config:J}of m0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of m0(J)){if(Y)continue;try{let B=J0.parse(JSON.parse(s(X)));if(B.stateDirectory!==M0(M1($),Z))continue;let V=J0.parse({...B,stateDirectory:Q}),K=T0(V),N=h1(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(B))v0({...N,worker:{...N.worker,configDigest:U0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},h4=($)=>M0(M1($),"listed.json");function t9($){try{let J=JSON.parse(s(h4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function o9($,J){let Z=m0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=t9($),B=Y&&!Y.listed?Y.reason:null,V=B||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(B||Y&&!Y.listed))return{workspaces:null,off:B};return{off:B,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:q})=>{let H=!1,U=null,M=!1;try{H=N?$0(N).revoked:!1,U=N&&!H?t(N):null,M=J&&!!U&&y$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:H?"removed":M?"connected":"not_running",blocked:!q&&!H&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function e9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),B=new Map,V=null,K=!1,N=t9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...R}=J,x=Z.roots.slice(1).map((C)=>C.path);return J0.parse({...R,...x.length?{folders:x}:{},stateDirectory:M0(M1(J),W)})},H=async(W)=>{let L=B.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let R=new AbortController,x=()=>R.abort();if(X.addEventListener("abort",x,{once:!0}),X.aborted)R.abort();let C={...W,controller:R,claims:0,done:Promise.resolve(),account:L};C.done=$.serve(W,R.signal,(P)=>{C.claims=P}).then(()=>{return},(P)=>{if(L&&P instanceof _0&&P.status===401&&s9.has(P.code)){try{E0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer (${P.code}); run \`reason connect\` signed in as that account to connect it again
 `)}else if(P instanceof _0&&P.status===401&&s9.has(P.code)){try{h0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
 `)}else if(!R.signal.aborted)Y(`Reason worker: workspace ${W.organizationId} stopped (worker_workspace_failed); it starts again on the next check
 `)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",x),C.claims=0,B.get(W.organizationId)===C)B.delete(W.organizationId);let P=W.config.stateDirectory;if(L&&!b4(P)&&!u(M0(P,"worker.json")))v1(P,{recursive:!0,force:!0})}),B.set(W.organizationId,C)},M=(W,L)=>{if(!L)return null;try{let R=q(W),x=t(L);if(!x||x.orgId!==W||Date.parse(x.worker?.expiresAt??"")<=Date.now()+60000||L.name!==R.name||L.executionMode!==R.executionMode||!z0(L.apiOrigin,R.apiOrigin)||x.roots.map((C)=>C.path).join(`
@@ -12,21 +12,21 @@ ${J?.directory??g($)}`).digest("hex")}function S$($,J){c(f0(g($),w$),{version:1,
 `)}for(let A of I){if(X.aborted)return!0;if(x(A))continue;try{let b=B.get(A);if(h.get(A)){if(b&&b.claims===0)await H(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
 `);continue}let w=M(A,R.get(A)?.config??null);if(w&&b)continue;if(!w){if(b&&b.claims>0)continue;if(await H(A),w=await j(A),w)Y(`Reason worker: connected in workspace ${A}
 `)}if(w&&!X.aborted)U(w)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
-`)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(M1(J),!0),c(h4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(V)K=!0;else V=O().finally(()=>{V=null});return V},claims:()=>[...B.values()].reduce((W,L)=>W+L.claims,0),async settled(){await V,await Promise.all([...B.values()].map((W)=>W.done))}}}import{dirname as yQ}from"path";import{randomUUID as J$}from"crypto";import{chmodSync as Q8,closeSync as Z$,constants as Q$,existsSync as MQ,fstatSync as X8,lstatSync as Y8,mkdirSync as G8,openSync as B8,readFileSync as K8,readdirSync as V8,readlinkSync as wN,realpathSync as bN,renameSync as X$,rmSync as m4,statSync as H8,symlinkSync as kN,unlinkSync as m$,writeFileSync as v4}from"fs";import{basename as fN,dirname as N8,isAbsolute as TQ,join as D0,relative as hN,resolve as mN,sep as vN}from"path";import{createRequire as _Q}from"module";var U8=1,q8=1,FQ=128,WQ=65536;var LQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var $8=/^[a-z0-9_.-]{1,80}$/,DQ=64;var jQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function M8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function T8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&LQ.test($)}function _8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function u4($){G8($,{recursive:!0,mode:448}),Q8($,448)}function zQ($,J){u4(N8($));let Z=`${$}.${process.pid}.${J$()}.tmp`;try{v4(Z,J,{mode:384,flag:"wx"}),Q8(Z,384),X$(Z,$)}finally{if(MQ(Z))m$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new v$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=k0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?k0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,B=$.root!==void 0||Boolean(X&&TQ(X))?null:D0($.home??V0(),"Library","Application Support"),V=$.root??(B?D0(B,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...B?{legacyRoot:D0(B,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(V,"versions"),current:D0(V,"current"),previous:D0(V,"previous"),brokerLock:D0(V,"broker.lock"),transitionLock:D0(V,"transition.lock"),lifecycleEvents:D0(V,"lifecycle-events")}}function OQ($){return M8($)&&T8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===U8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&_8($.started_at)&&R2($.runtime_version)}function F8($,J){try{let Z=Y8($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=B8(D0($,J),Q$.O_RDONLY|Q$.O_NOFOLLOW|Q$.O_NONBLOCK);try{let X=X8(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return K8(Q,"utf8")}finally{Z$(Q)}}catch{return null}}function g4($){try{let J=JSON.parse(F8($,"owner.json")??"null");return OQ(J)?J:null}catch{return null}}function W8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var J8="lease",AQ=2,RQ=4,h$;function CQ(){if(h$!==void 0)return h$;if(h$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=_Q(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return h$={flock:(B,V)=>X.symbols.flock(B,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},h$}catch{}return null}function PQ($){let J=CQ();if(!J)return null;let Z=B8(`${$}.lease`,Q$.O_RDWR|Q$.O_CREAT|Q$.O_NOFOLLOW,384);try{let Q=X8(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return Z$(Z),"busy";if(J.flock(Z,AQ|RQ)===0)return Z;let X=J.errno();return Z$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw Z$(Z),Q}}function Q1($){u4(N8($.path));let J=PQ($.path);if(J==="busy")return{acquired:!1,owner:g4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=IQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)Z$(J)}}function IQ($,J){let Z=$.alive??W8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:U8,pid:$.pid??process.pid,nonce:$.nonce?.()??J$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},B=`${$.path}.init-${process.pid}-${J$()}`,V=!1;try{if(G8(B,{mode:448}),v4(D0(B,"owner.json"),`${JSON.stringify(Y)}
+`)}}return!0},F=null,O=async()=>{let W=!1;do K=!1,W=await z().catch(()=>!1);while(K&&!X.aborted);let L=JSON.stringify({version:1,...N});if(F!==L)try{e(M1(J),!0),c(h4(J),JSON.parse(L)),F=L}catch{}return W};return{check(){if(V)K=!0;else V=O().finally(()=>{V=null});return V},claims:()=>[...B.values()].reduce((W,L)=>W+L.claims,0),async settled(){await V,await Promise.all([...B.values()].map((W)=>W.done))}}}import{dirname as fQ}from"path";import{randomUUID as J$}from"crypto";import{chmodSync as Q8,closeSync as Z$,constants as Q$,existsSync as TQ,fstatSync as X8,lstatSync as Y8,mkdirSync as G8,openSync as B8,readFileSync as K8,readdirSync as V8,readlinkSync as bN,realpathSync as kN,renameSync as X$,rmSync as m4,statSync as H8,symlinkSync as yN,unlinkSync as m$,writeFileSync as v4}from"fs";import{basename as hN,dirname as N8,isAbsolute as _Q,join as D0,relative as mN,resolve as vN,sep as gN}from"path";import{createRequire as FQ}from"module";var U8=1,q8=1,WQ=128,LQ=65536;var DQ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var $8=/^[a-z0-9_.-]{1,80}$/,jQ=64;var zQ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function M8($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function T8($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function R2($){return typeof $==="string"&&DQ.test($)}function _8($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function u4($){G8($,{recursive:!0,mode:448}),Q8($,448)}function OQ($,J){u4(N8($));let Z=`${$}.${process.pid}.${J$()}.tmp`;try{v4(Z,J,{mode:384,flag:"wx"}),Q8(Z,384),X$(Z,$)}finally{if(TQ(Z))m$(Z)}}function C2($={}){if(($.platform??process.platform)!=="darwin")throw new v$("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=k0(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?k0(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,B=$.root!==void 0||Boolean(X&&_Q(X))?null:D0($.home??V0(),"Library","Application Support"),V=$.root??(B?D0(B,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...B?{legacyRoot:D0(B,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:D0(V,"versions"),current:D0(V,"current"),previous:D0(V,"previous"),brokerLock:D0(V,"broker.lock"),transitionLock:D0(V,"transition.lock"),lifecycleEvents:D0(V,"lifecycle-events")}}function AQ($){return M8($)&&T8($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===U8&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&_8($.started_at)&&R2($.runtime_version)}function F8($,J){try{let Z=Y8($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=B8(D0($,J),Q$.O_RDONLY|Q$.O_NOFOLLOW|Q$.O_NONBLOCK);try{let X=X8(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return K8(Q,"utf8")}finally{Z$(Q)}}catch{return null}}function g4($){try{let J=JSON.parse(F8($,"owner.json")??"null");return AQ(J)?J:null}catch{return null}}function W8($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var J8="lease",RQ=2,CQ=4,h$;function PQ(){if(h$!==void 0)return h$;if(h$=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=FQ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return h$={flock:(B,V)=>X.symbols.flock(B,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},h$}catch{}return null}function IQ($){let J=PQ();if(!J)return null;let Z=B8(`${$}.lease`,Q$.O_RDWR|Q$.O_CREAT|Q$.O_NOFOLLOW,384);try{let Q=X8(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return Z$(Z),"busy";if(J.flock(Z,RQ|CQ)===0)return Z;let X=J.errno();return Z$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw Z$(Z),Q}}function Q1($){u4(N8($.path));let J=IQ($.path);if(J==="busy")return{acquired:!1,owner:g4($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=xQ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)Z$(J)}}function xQ($,J){let Z=$.alive??W8,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:U8,pid:$.pid??process.pid,nonce:$.nonce?.()??J$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},B=`${$.path}.init-${process.pid}-${J$()}`,V=!1;try{if(G8(B,{mode:448}),v4(D0(B,"owner.json"),`${JSON.stringify(Y)}
 `,{mode:384,flag:"wx"}),J!==null)v4(D0(B,J8),`flock
-`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw Y8($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}X$(B,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,g4($.path)?.nonce===Y.nonce)m4($.path,{recursive:!0,force:!0});if(J!==null)Z$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=g4($.path),H=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?H-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&F8($.path,J8)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${J$()}`;try{X$($.path,T),m4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!V)m4(B,{recursive:!0,force:!0})}}throw new v$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function L8($){return M8($)&&T8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===q8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&_8($.occurred_at)&&typeof $.event==="string"&&jQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&$8.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=DQ&&$.capabilities.every((J)=>typeof J==="string"&&$8.test(J)))}var xQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,EQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,SQ=300000,A2=0n;function wQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function D8($){try{return V8($.lifecycleEvents).filter((J)=>xQ.test(J)).sort()}catch{return[]}}function Z8($){try{let J=JSON.parse(K8($,"utf8"));return L8(J)?J:null}catch{return null}}function bQ($,J=W8,Z=Date.now()){let Q;try{Q=V8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(EQ);if(!Y)continue;let B=D0($.lifecycleEvents,X),V=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-H8(B).mtimeMs>=SQ}catch{continue}if(!K)continue;try{X$(B,V)}catch(N){let q=N.code;if(q==="EEXIST")m$(B);else if(q!=="ENOENT")throw N}}}function kQ($){let Z=D8($).flatMap((X)=>{try{return[{name:X,size:H8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>FQ||Q>WQ){let X=Z.shift();if(!X)break;try{m$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function g$($,J,Z={}){let Q={schema_version:q8,event_id:Z.eventId?.()??J$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!L8(Q))throw new v$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return u4($.lifecycleEvents),zQ(D0($.lifecycleEvents,wQ(Q)),`${JSON.stringify(Q)}
-`),kQ($),Q}async function j8($,J,Z){bQ($);let Q=0;for(let X of D8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=Z8(Y);if(!K||!Z(K))continue}let B=`${Y}.sending-${process.pid}-${J$()}`;try{X$(Y,B)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=Z8(B);if(!V){m$(B);continue}try{await J(V),m$(B),Q+=1}catch{try{X$(B,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function A8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!fQ($.saved))return J;let Z=$.saved,Q=(B,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:B,...V?{code:`worker_api_origin_move_${B}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?Y$():$.native;if(!X)return J;let Y=[];try{let B=X.lock(yQ($.configPath));if(!B)return J;if(Y.push(B),u(g(Z))){let q=Q1({path:d(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=R8(V),N={saved:V,configPath:$.configPath};if(!P2(V)&&K.length===0)return Q("unchanged"),N;if(P2(V)){let q=z8(V);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,z8(q.config))}catch(H){Q("failed",`workspace:${O8(H)}`)}return Q("moved"),N}catch(B){return Q("failed",O8(B)),J}finally{for(let B of Y.reverse())B()}}function P2($){return e0($.apiOrigin)!==$.apiOrigin}function R8($){return m0($).filter((J)=>J.config!==null&&P2(J.config))}function fQ($){return P2($)||R8($).length>0}function z8($){let J=J0.parse({...$,apiOrigin:e0($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)v0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function O8($){if($ instanceof Y0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as hQ,lstatSync as p4,readdirSync as S8,readlinkSync as mQ,unlinkSync as vQ}from"fs";import{join as O0,sep as gQ}from"path";var I2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function w8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),B=O0(Z,"reason",...X),V=(H,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:H,...U?{code:`worker_state_rehome_${H}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?Y$():$.native,N=$.saved,q=[];try{if(N&&P8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:B};if(!d4(K,B,j,q))return J;return C8(N,j,$.host,V)}if(N&&P8(Q)&&N.stateDirectory===B&&h9(N)&&d4(K,B,N,q))return b8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!G$(Q)?.isDirectory())return J;if(sQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,I2),{version:r});return V("skipped",j),J},M=[Y];for(let j of dQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!uQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!d4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(I8(Z)!==null)return U("conflicting_identity");if(x8(Z)!==null)return U("conflicting_files");if(G$(B)&&(!G$(B).isDirectory()||S8(B).length>0))return U("connection_folder_taken");S$(N,T.devicePublicKey),f4.before(N);let _=p0(Y);if(_&&l4(Y))lQ(B,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&l4(Y))k8(B);return U(D.problem??"config_folder_kept")}return C8(N,{...N,stateDirectory:B},$.host,V)}catch(H){try{if(G$(Y)?.isDirectory())c(O0(Y,I2),{version:r})}catch{}return V("failed",aQ(H)),cQ(N,Y,B,J)}finally{for(let H of q.reverse())H()}}function C8($,J,Z,Q){let X=p4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)hQ(J.stateDirectory,448);let Y=T0(J),B=h1(d(J).state,{proofStore:Y,repair:!1});if(!B?.worker)throw new x2("identity_missing");let V=U0(J);if(B.worker.configDigest===U0($))v0({...B,worker:{...B.worker,configDigest:V}},d(J).state,{proofStore:Y});else if(B.worker.configDigest!==V)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),f4.after($,J),b8($,J,Z);let K=O0(J.stateDirectory,I2);if(u(K))vQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function b8($,J,Z){if(E8($,J,Z,"connect"),!l4(J.stateDirectory))return;let Q=pQ(O1($.stateDirectory));if(!Q)return;let X=O1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);k8($.stateDirectory)}function d4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Q1({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function uQ($,J,Z){if(u(g(J))){let X=Q1({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=G$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function dQ($,J){let Z=[$,...S8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let B=O0(X,Y);if(B===J||!G$(O0(B,"worker.json")))continue;let V=y8(B);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+gQ))Q.push({directory:B,config:V})}return Q}function l4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function lQ($,J){let Z=O1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function k8($){try{O1($).deleteBinding()}catch(J){if(!(J instanceof Y0))throw J}}function pQ($){try{return $.loadBinding()}catch(J){if(J instanceof Y0)return null;throw J}}function cQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=y8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function P8($){try{return p4($).isSymbolicLink()&&mQ($)==="reason"}catch{return!1}}function sQ($){try{let J=JSON.parse(s(O0($,I2)));return typeof J.version==="string"?J.version:null}catch{return null}}function y8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function G$($){try{return p4($)}catch{return null}}function aQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof Y0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as iQ}from"fs";function S2($){try{let J=JSON.parse(iQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function f8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as EK}from"crypto";import{readdirSync as SK,realpathSync as HJ,statSync as wK}from"fs";import{hostname as bK}from"os";import{join as r1,resolve as kK}from"path";var w2="cloud",nQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function u$($){return nQ.test($)&&!h8.test($)}var rQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function B$($){return rQ[$]}import{chmodSync as tQ,lstatSync as k2,mkdtempSync as oQ,realpathSync as u8,rmdirSync as eQ,rmSync as $X,unlinkSync as JX}from"fs";import{createConnection as ZX,createServer as QX}from"net";import{basename as m8,dirname as v8,join as g1}from"path";var XX=G.enum(["status","drain","resume","stop","reload_roots"]),YX=G.strictObject({version:G.literal(1),instanceId:G.string(),deviceId:G.string(),phase:G.enum(["starting","running","reconnecting","stopping"]),drained:G.boolean(),activeClaims:G.number().int().nonnegative(),activeSessions:G.number().int().nonnegative().optional(),executionEligible:G.boolean(),supportedOperations:G.array(G.enum(b2)).max(b2.length).optional(),capabilityReadiness:G.partialRecord(G.enum(b2),G.boolean()).optional(),lastHeartbeat:G.string().nullable(),expiresAt:G.string()}),GX=G.strictObject({nonce:G.string(),action:XX}),BX=G.object({nonce:G.uuid()}),d8=G.strictObject({version:G.literal(1),nonce:G.uuid(),socketPath:G.string().max(100)});function l8($){return g1(d($).lock,"control.json")}function y2($){return e(d($).lock),BX.parse(JSON.parse(s(g1(d($).lock,"owner.json"))))}function g8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function p8($,J){let Z=l8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return g8(Y)?Y:null}let Q=d8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=v8(Q.socketPath);if(v8(X)!==u8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(m8(X))||m8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),g8(Q.socketPath)?Q.socketPath:null}async function f2($,J,Z){if(y2($).nonce!==J)throw Error("worker_instance_changed");let Q=l8($);if(u(Q))throw Error("worker_control_already_serving");let X=oQ(g1(u8("/tmp"),"ara-worker-")),Y=g1(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let B=new Set,V=QX((H)=>{B.add(H),H.once("close",()=>B.delete(H)),H.setTimeout(2000,()=>H.destroy());let U="",M=!1;H.on("error",()=>H.destroy()),H.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){H.destroy();return}if(!U.includes(`
-`))return;M=!0;try{let _=GX.parse(JSON.parse(U));if(_.nonce!==J){H.destroy();return}H.end(JSON.stringify(Z(_.action))+`
-`)}catch{H.destroy()}})});V.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let H of B)H.destroy();if(await new Promise((H)=>V.close(()=>H())),K&&u(Q)){let H=k2(Q);if(H.isFile()&&H.dev===K.dev&&H.ino===K.ino)try{let U=d8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)JX(Q)}catch{}}try{eQ(X)}catch{}};try{if(await new Promise((H,U)=>{V.once("error",U),V.listen(Y,()=>{tQ(Y,384),H()})}),y2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(H){throw await q(),H}}function c8($,J){try{let Z=JSON.parse(s(g1(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function d$($){return c8($,"runtime_version")}function KX($){return c8($,"nonce")}function s8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(g1(d($).lock,"owner.json")))return"no_lock";return p8($,y2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var VX=21600000,HX=G.strictObject({instance:G.string().nullable(),since:G.number().int().nonnegative()});function NX($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=HX.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{$X(d($).updateDeferral,{force:!0})}catch{}}async function h2($,J,Z=()=>!1){let Q=KX($),X=NX($,Q);if(J!==void 0){let N=d$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let B=Date.now(),V=X;if(V===null){V=B;try{c(d($).updateDeferral,{instance:Q,since:V})}catch{}}let K=B-V;return{state:K<VX?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=d($);if(!u(g1(Z.lock,"owner.json")))return null;let Q=y2($),X=p8($,Q.nonce);if(!X)return null;return new Promise((Y,B)=>{let V=ZX(X),K="",N=!1,q=(H,U)=>{if(N)return;if(N=!0,V.destroy(),U)B(U);else Y(H)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
-`)),V.on("data",(H)=>{if(K+=H.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(H)=>{if("code"in H&&["ECONNREFUSED","ENOENT"].includes(String(H.code)))q(null);else q(null,H.message==="worker_control_timeout"?H:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let H=YX.parse(JSON.parse(K));if(H.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(H)}catch{q(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as qB}from"crypto";import{homedir as U7}from"os";import{spawn as UX}from"child_process";async function a8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,B=Promise.resolve(),V=(H)=>{if(Q===H)return;Q=H,J.onStatusChange?.(H)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,B=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let H=(J.spawn??UX)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=H,H.once("exit",()=>{if(!X&&Z===H)V("failed"),K()}),await new Promise((U,M)=>{H.once("spawn",U),H.once("error",M)}),H.exitCode===null&&H.signalCode===null)V("held")}catch{V("failed"),K()}};B=N(),await B;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await B;let H=Z;if(!H||H.exitCode!==null||H.signalCode!==null||!H.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{H.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);H.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{H.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class m2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as FX}from"fs";import{constants as s4}from"fs";import{open as qX}from"fs/promises";import{join as MX}from"path";var TX={platform:process.platform,home:V0,async openFile($){let J=await qX($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function i8($=TX){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(MX($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function _X($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,B=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),B])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function n8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await _X($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?l$(X.status):p$(X));if(Y){let B=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+B}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var WX=1000,LX=250,DX=N5(FX(process.execPath)),r8=null,t8=null;function U5($){if(process.platform!=="darwin")return{};return t8??=i8().then((J)=>{r8={status:J,checkedAt:$().getTime()}}).finally(()=>{t8=null}),{fullDiskAccess:{...r8??{status:"unknown",checkedAt:$().getTime()},executablePath:DX}}}var o8=8,jX=2000,zX=2000,G3=8000,e8=3,OX=250,$5=1000,J5=30000,AX=0.2,RX=30000,CX=21600000,PX=300000,IX=3600000,xX=0.1,q5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function EX($){return Math.min(e8,Math.max(1,$??e8))}function SX($){return typeof $.reason_code==="string"&&q5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof g0&&($.reason.code==="cancelled"||q5.has($.reason.code))?$.reason.code:"cancelled"}function Z5($){return $ instanceof g0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function M5($){return $.capability==="hands.connect"&&(K5($.payload)||B5($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*xX)))}function wX($,J=Math.random){let Z=Math.min(J5,$5*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*AX*(Q*2-1);return Math.min(J5,Math.max($5,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function bX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function r0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function kX($){if($ instanceof g2||$ instanceof K$||$ instanceof s$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function c$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(r0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:kX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)c$($,J,Q);throw Q}}class s$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,B=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,H,U=new Promise((_,D)=>{let j=()=>{let F=new s$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(H=()=>z(Math.max(0,Math.min(N-performance.now(),jX))),z(K),$.signal.addEventListener("abort",H,{once:!0}),$.signal.aborted)H()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,B),U]);break}catch(_){if(B.aborted||$.signal.aborted||S0(_)||r0(_)||!yX(_)||performance.now()>=N)throw c$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw c$($,"completion",_),_;try{await V(D,B)}catch{throw c$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",H),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function yX($){if(S0($))return!1;if(r0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof s$)return!1;return!0}return!1}class g2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function v2($){if($ instanceof g2)return!0;return $ instanceof _0?l$($.status):p$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function fX($,J,Z,Q,X){let Y=new AbortController,B,V=()=>{return},K=new Promise((q,H)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),H(M)};if(V=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,H)=>{B=setTimeout(()=>{let U=new g2;Y.abort(U),H(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(B!==void 0)clearTimeout(B);V()}}async function Q5($,J,Z,Q,X,Y){let B=EX($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??OX,N=Y.remainingMs(),q=Math.min(N,B*V+K*B*(B-1)/2);for(let H=0;H<B;H+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(V,Y.remainingMs()),M=await fX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:H},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||H+1>=B||r0(U)||S0(U)||!v2(U)){if(!Q.aborted)c$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(H+1),q*(H+1)/B-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function hX($,J,Z,Q,X){let Y=M5(J),B=new AbortController,V=new AbortController,K=()=>{B.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,H,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,R={},x=(S)=>{j=!0,D.abort(S),B.abort(S),V.abort(S)},C=(S)=>{if(z)return z;let y=structuredClone(S),l=M;return z=(async()=>{let k=new AbortController,I=k.signal;I.throwIfAborted();let E,A=()=>{},b=new Promise((w,n)=>{if(A=()=>n(I.reason),I.addEventListener("abort",A,{once:!0}),E=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),I.aborted)A()});try{for(let w=0;w<3;w+=1){I.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[y],signal:I,transientRetryOwner:"caller"})),b]);if(I.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(S0(n))X(n);let o=n instanceof _0?l$(n.status):p$(n);if(I.aborted||!o||w===2)throw n;let N0=Math.max(500*2**w,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,I),b])}}}finally{clearTimeout(E),I.removeEventListener("abort",A),k.abort()}})(),z},P=(S,y,l)=>{let k=(E)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:y,events:S,signal:E,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&r0(A))x(A);if(l&&(S0(A)||r0(A))){if(S0(A))X(A);B.abort(A),V.abort(A),D.abort(A)}throw A});if(!l)return async(E)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(E)).next_event_seq;return}E.throwIfAborted();let A=()=>{},b=new Promise((w,n)=>{A=()=>n(E.reason),E.addEventListener("abort",A,{once:!0})});try{let w=await Promise.race([k(E),b]);E.throwIfAborted(),M=w.next_event_seq}finally{E.removeEventListener("abort",A)}};let I=n8({send:k,lease:L,sleep:Z,retryAfterMs:(E)=>J3(E,($.now?.()??new Date).getTime())});return async(E)=>{let A=await I(E);if(A.next_event_seq!==y+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,y)=>{let l=S??await Q5($,J,{controlAckSeq:U,waitMs:y},V.signal,Z,L),k=null,I=!1;for(let E=0;E<10;E+=1){let A=U+1;for(let b of l.controls){if(b.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(b.kind==="cancel"||b.kind==="operation.cancel")k??=SX(b.payload),B.abort(new g0(k,"Reason closed the Device operation."));if(b.kind!=="cancel"&&b.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let w,n,o=new Promise((N0,j0)=>{w=N0,n=j0});o.catch(()=>{}),R.current={promise:o,resolve:w,reject:n}}try{I||=!await $.onControl?.(J,b)}catch(w){if(w instanceof g0)q??=Z5(w);throw R.current?.reject(w),w}}U=b.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:I}}try{l=await Q5($,J,{controlAckSeq:U},V.signal,Z,L),R.current?.resolve()}catch(b){if(R.current?.reject(b),!k||r0(b)||S0(b))throw b;return{cancellationReason:k,unsupported:I}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)L=new m2(J.lease_until,()=>($.now?.()??new Date).getTime(),(y)=>{if(!B.signal.aborted)N=y;B.abort(y),V.abort(y)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(y){if(!e4(J)||r0(y)||S0(y))throw y;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let y=S.cancellationReason??i4($.signal);B.abort(new g0(y,"Reason closed the Device operation.")),H={status:"cancelled",error_code:y}}else if(S.unsupported)B.abort(),H={status:"failed",error_code:"control_unsupported"};else{let y=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?zX:15000),I=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),E=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!E){if(await Z(k,V.signal),V.signal.aborted)return}let A=await h(void 0,E?I:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");B.abort(A.cancellationReason?new g0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(S0(A))X(A);if(r0(A))N=A,x(A);if(!V.signal.aborted)N=A,B.abort();return}})();try{if(L?.assertCurrent(),B.signal.throwIfAborted(),Q.authorized=()=>!B.signal.aborted&&(Y||(L?.remainingMs()??0)>0),H=await $.onClaim(J,B.signal,async(k)=>{if(e4(J))return;let I=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",E=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=E||J.capability==="inference.custom.v1"?AbortSignal.any([B.signal,D.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,b={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:E?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:b,settle:(j0)=>j0===void 0?o():N0(j0)})});let w=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(I)await C(b);return}if(F!==null){if(k.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),L1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await P([b],M,!0)(j0),F=null}catch(D1){throw F=D1??Error("Hands stop receipt could not be confirmed."),D1}finally{clearTimeout(L1),N0.abort()}return}if(E&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new m2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{B.abort(j0),V.abort(j0)})}let o=M;if(E)W=P([...w.map((N0)=>N0.wireEvent),b],o,!0),await W(A),W=void 0;else await P([...w.map((N0)=>N0.wireEvent),b],o,!1)(A)});n.then(()=>{for(let o of w)o.settle()},(o)=>{for(let N0 of w)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(S0(o))X(o);if(E){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)B.abort(o),V.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(k){H=B.signal.aborted?{status:"cancelled",error_code:i4(B.signal)}:{status:"failed",error_code:Z5(k)}}finally{Q.authorized=()=>!1,D.abort();for(let k of _.splice(0))k.settle();V.abort(),await y}let l=Y5(J.capability)?G5(H.result,J.operation_id):null;if(N){if(S0(N))throw N;H={status:"failed",error_code:q??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(B.signal.aborted&&H.status==="succeeded")H={status:"cancelled",error_code:i4(B.signal),...l?{result:l}:{}}}if(L?.close(),S0($.signal.reason))throw $.signal.reason;await $3($,J,H)}finally{L?.close(),D.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??y$,Y=$.statusPath??Q3(),B=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:B,...U5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),q=0,H,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),H5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??a8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await mX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:B,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,H=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(S0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=wX(q,$.reconnectRandom);H??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:H},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function mX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??y$,B=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let H=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(o8,U):o8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,X0=0;for(let{claim:w1}of z.values()){let H1=w1.capability==="hands.connect"?w1.payload[X5]:void 0;if(typeof H1==="string"){if(v.has(H1))continue;v.add(H1)}X0+=1}return X0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(B).getTime()+n4(K.initialDelayMs??RX,H):Number.POSITIVE_INFINITY,x=null,C=!1,P=$.firstHeartbeat,h=P?.account_root_metadata_supported===!0,S=P?.workspace_root_metadata_supported===!0,y=P?.account_root_path_supported===!0,l=P?.home_contained_roots_supported===!0,k=P?.root_paths_supported===!0,I=P?.startup_supported===!0,E=P!==void 0,A=P?{challenge:P.challenge,expires_at:P.expires_at}:void 0,b,w=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:B,...U5(J),...V?{lastUsedAt:V}:{},...x?{organizationId:x.organization_id,organizationName:x.organization_name,organizationSlug:x.organization_slug}:{}}),o=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!w)b??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...I&&!w&&b?{startup:b}:{},capabilities:v?V5($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:y,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},N0=()=>{if(C||!$.client.identity)return;C=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;x=v;let X0=Y(Q);if(!X0)return;X({...X0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,y=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,I=v.startup_supported===!0,E=!1},L1=(v)=>{if(v.startup)w=!0},D1=(v,X0)=>{if(!(X0 instanceof _0&&X0.status===400&&X0.code==="invalid_heartbeat")||!v.startup&&!E)throw X0;if(w=!0,E)h=S=y=!1,l=k=I=E=!1;return null},O$=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},E1=!1,t1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(E1)t1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((X0)=>D1(v,X0))).then((X0)=>{if(!X0)return;L1(v),j0(X0),O$(X0)},()=>{return})});let j1=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let K1=!1,S1=$.maxConsecutiveHeartbeatFailures??3,V1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,X0=o(),w1=A;A=void 0,E1=!0,t1=!1;try{let i=await V$($,"heartbeat",()=>$.client.heartbeat($.state,X0,N.signal,...w1?[w1]:[]).catch((K0)=>D1(X0,K0)));if(E1=!1,!i)continue;v=i,L1(X0),V1=0}catch(i){if(E1=!1,$.signal.aborted)break;if(!v2(i))throw i;if(V1+=1,V1>=S1&&!W())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(X0.capabilities).length)continue;if(t1)continue;if(O$(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let i=new AbortController,K0=()=>i.abort($.signal.reason);if($.signal.aborted)K0();else $.signal.addEventListener("abort",K0,{once:!0});let R0;try{R0=K.check(i.signal)}catch(C0){R0=Promise.reject(C0)}let N1=R0.then((C0)=>({kind:"completed",result:C0}),(C0)=>({kind:"failed",error:C0})),o1;try{while(!0){let C0=await bX(N1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(C0.kind==="failed")throw new r4(C0.error);if(C0.kind==="completed"){o1=C0.result;break}try{let w0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,w0,N.signal).catch((H2)=>D1(w0,H2)));if(!R$)continue;v=R$,L1(w0),O$(v),V1=0}catch(w0){if($.signal.aborted)throw w0;if(!v2(w0))throw w0;if(V1+=1,V1>=S1&&!W())throw w0}}}catch(C0){i.abort(C0);let w0=await N1;if(w0.kind==="completed"&&w0.result==="activated")o1="activated";else throw C0}finally{$.signal.removeEventListener("abort",K0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,o1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+n4(K.intervalMs??CX,H)}catch(i){if(!(i instanceof r4))throw i;T+=1;let K0=K.retryBaseMs??PX,R0=K.retryMaxMs??IX,N1=Math.min(R0,K0*2**Math.min(T-1,8));R=J().getTime()+n4(N1,H)}if($.signal.aborted)break;if(_&&L())break;if(_){await j1($.heartbeatIntervalMs??15000);continue}let H1=$.client.sessionCadence?.($.state)??null,b1=H1?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await j1(b1);continue}if(F()>=M){let i=new AbortController;O=i;try{await Z(b1,AbortSignal.any([$.signal,i.signal]))}catch(K0){if(!i.signal.aborted)throw K0}finally{if(O===i)O=null}continue}let u0,A$=H1?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),f=performance.now();try{u0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:A$,signal:N.signal}))}catch(i){if($.signal.aborted||!v2(i)||!W())throw i;await j1(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!u0){if(performance.now()-f<A$-LX)await j1(WX);continue}if($.claimable?.()===!1){await $3($,u0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:u0.operation_id,runId:u0.run_id,attemptId:u0.attempt_id,capability:u0.capability});let a,q0={authorized:()=>!1,claim:u0};if(a=hX({...$,signal:N.signal},u0,Z,q0,j).catch((i)=>{if(S0(i))j(i);else if(!r0(i)&&[...z].some(([K0,R0])=>K0!==a&&R0.authorized())){if(i instanceof s$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!r0(i)&&D===null)D=i}).finally(()=>{z.delete(a),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(a,q0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),M5(u0)){if(await a,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),K1=!0;let X0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:X0},Q),$.onEvent?.({type:"error",message:X0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!K1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as TY}from"child_process";import{constants as g5,existsSync as _Y,mkdtempSync as t5,rmSync as FY}from"fs";import{access as u5,open as WY,readFile as d5,readlink as LY,readdir as l5,unlink as DY,rmdir as jY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as u1}from"crypto";import{chmodSync as vX,closeSync as gX,fsyncSync as uX,openSync as dX,readFileSync as lX,rmdirSync as T5,unlinkSync as W5,writeFileSync as pX}from"fs";import{createConnection as cX,createServer as sX}from"net";import{dirname as aX,join as iX}from"path";var nX=5000;async function L5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:u1()},X={runId:u1(),deviceId:u1(),rootId:u1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=F5(J,X),B={version:1,snapshot_id:u1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(B).installed&&Y.current().snapshot_id===B.snapshot_id&&!Z.aborted}catch{return!1}finally{try{W5(Y.path)}catch{}}}async function D5($,J,Z=_5){if(J.aborted)return!1;let Q,X,Y=new Set,B=u1(),V=sX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(B)});V.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),H=setTimeout(N,nX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${u1()}`}),X=iX(Q.journalDirectory,"readiness.json");let U=dX(X,"wx",384);try{pX(U,B),uX(U)}finally{gX(U)}if(lX(X,"utf8")!==B||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{vX(Q.socketPath,384)}catch{T(!1);return}K=cX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>B.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===B)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(H),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>V.close(()=>U())),Q?.disposeSocket(),X)try{W5(X)}catch{}if(Q){try{T5(Q.journalDirectory)}catch{}try{T5(aX(Q.journalDirectory))}catch{}}}}import{spawn as rX}from"child_process";import{randomUUID as d1}from"crypto";import{basename as tX}from"path";import{fileURLToPath as oX}from"url";function eX(){let $=tX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",oX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function O5($,J,Z=eX()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),B=rX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>B.once("close",()=>{V=!0,F()}));B.on("error",X);let N,q,H=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;B.stdout.setEncoding("utf8"),B.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
+`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw Y8($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}X$(B,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,g4($.path)?.nonce===Y.nonce)m4($.path,{recursive:!0,force:!0});if(J!==null)Z$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let q=g4($.path),H=($.now?.()??new Date).getTime(),U=q&&$.staleAfterMs!==void 0?H-Date.parse(q.started_at)<$.staleAfterMs:!1,M=q!==null&&!(J!==null&&F8($.path,J8)!==null)&&Z(q.pid);if(!q||M||U)return{acquired:!1,owner:q,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${J$()}`;try{X$($.path,T),m4(T,{recursive:!0,force:!0}),Q=!0}catch(_){let D=_.code;if(!["ENOENT","EEXIST"].includes(D??""))throw _}}finally{if(!V)m4(B,{recursive:!0,force:!0})}}throw new v$("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function L8($){return M8($)&&T8($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===q8&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&_8($.occurred_at)&&typeof $.event==="string"&&zQ.includes($.event)&&R2($.runtime_version)&&($.from_version===void 0||R2($.from_version))&&($.to_version===void 0||R2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&$8.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=jQ&&$.capabilities.every((J)=>typeof J==="string"&&$8.test(J)))}var EQ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,SQ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,wQ=300000,A2=0n;function bQ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return A2=J>A2?J:A2+1n,`${String(A2).padStart(22,"0")}-${$.event_id}.json`}function D8($){try{return V8($.lifecycleEvents).filter((J)=>EQ.test(J)).sort()}catch{return[]}}function Z8($){try{let J=JSON.parse(K8($,"utf8"));return L8(J)?J:null}catch{return null}}function kQ($,J=W8,Z=Date.now()){let Q;try{Q=V8($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(SQ);if(!Y)continue;let B=D0($.lifecycleEvents,X),V=D0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-H8(B).mtimeMs>=wQ}catch{continue}if(!K)continue;try{X$(B,V)}catch(N){let q=N.code;if(q==="EEXIST")m$(B);else if(q!=="ENOENT")throw N}}}function yQ($){let Z=D8($).flatMap((X)=>{try{return[{name:X,size:H8(D0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>WQ||Q>LQ){let X=Z.shift();if(!X)break;try{m$(D0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function g$($,J,Z={}){let Q={schema_version:q8,event_id:Z.eventId?.()??J$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!L8(Q))throw new v$("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return u4($.lifecycleEvents),OQ(D0($.lifecycleEvents,bQ(Q)),`${JSON.stringify(Q)}
+`),yQ($),Q}async function j8($,J,Z){kQ($);let Q=0;for(let X of D8($)){let Y=D0($.lifecycleEvents,X);if(Z){let K=Z8(Y);if(!K||!Z(K))continue}let B=`${Y}.sending-${process.pid}-${J$()}`;try{X$(Y,B)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=Z8(B);if(!V){m$(B);continue}try{await J(V),m$(B),Q+=1}catch{try{X$(B,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function A8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!hQ($.saved))return J;let Z=$.saved,Q=(B,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:B,...V?{code:`worker_api_origin_move_${B}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?Y$():$.native;if(!X)return J;let Y=[];try{let B=X.lock(fQ($.configPath));if(!B)return J;if(Y.push(B),u(g(Z))){let q=Q1({path:d(Z).lock,runtimeVersion:r});if(!q.acquired)return J;Y.push(()=>q.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=R8(V),N={saved:V,configPath:$.configPath};if(!P2(V)&&K.length===0)return Q("unchanged"),N;if(P2(V)){let q=z8(V);c($.configPath,q),N={saved:q,configPath:$.configPath}}for(let q of K)try{c(q.configPath,z8(q.config))}catch(H){Q("failed",`workspace:${O8(H)}`)}return Q("moved"),N}catch(B){return Q("failed",O8(B)),J}finally{for(let B of Y.reverse())B()}}function P2($){return e0($.apiOrigin)!==$.apiOrigin}function R8($){return m0($).filter((J)=>J.config!==null&&P2(J.config))}function hQ($){return P2($)||R8($).length>0}function z8($){let J=J0.parse({...$,apiOrigin:e0($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=U0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)v0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function O8($){if($ instanceof Y0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as mQ,lstatSync as p4,readdirSync as S8,readlinkSync as vQ,unlinkSync as gQ}from"fs";import{join as O0,sep as uQ}from"path";var I2="rehome.json";class x2 extends Error{code;constructor($){super($);this.code=$}}function w8($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),B=O0(Z,"reason",...X),V=(H,U)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:H,...U?{code:`worker_state_rehome_${H}:${U}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?Y$():$.native,N=$.saved,q=[];try{if(N&&P8(Q)&&N.stateDirectory===Y){let j={...N,stateDirectory:B};if(!d4(K,B,j,q))return J;return C8(N,j,$.host,V)}if(N&&P8(Q)&&N.stateDirectory===B&&h9(N)&&d4(K,B,N,q))return b8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!G$(Q)?.isDirectory())return J;if(aQ(Y)===r)return J;let U=(j,z=!0)=>{if(z)c(O0(Y,I2),{version:r});return V("skipped",j),J},M=[Y];for(let j of lQ(Q,Y)){if(j.config?.lifetime!=="ephemeral")return U("several_connections");if(!dQ(j.directory,j.config,q))return U("once_running",!1);M.push(j.directory)}if(!K)return U("config_rename_unavailable:no_native");if(!d4(K,Y,N,q))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(I8(Z)!==null)return U("conflicting_identity");if(x8(Z)!==null)return U("conflicting_files");if(G$(B)&&(!G$(B).isDirectory()||S8(B).length>0))return U("connection_folder_taken");S$(N,T.devicePublicKey),f4.before(N);let _=p0(Y);if(_&&l4(Y))pQ(B,_);let D=E2(Z,K,M);if(D.state!=="renamed"&&D.state!=="linked"){if(_&&l4(Y))k8(B);return U(D.problem??"config_folder_kept")}return C8(N,{...N,stateDirectory:B},$.host,V)}catch(H){try{if(G$(Y)?.isDirectory())c(O0(Y,I2),{version:r})}catch{}return V("failed",iQ(H)),sQ(N,Y,B,J)}finally{for(let H of q.reverse())H()}}function C8($,J,Z,Q){let X=p4(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)mQ(J.stateDirectory,448);let Y=T0(J),B=h1(d(J).state,{proofStore:Y,repair:!1});if(!B?.worker)throw new x2("identity_missing");let V=U0(J);if(B.worker.configDigest===U0($))v0({...B,worker:{...B.worker,configDigest:V}},d(J).state,{proofStore:Y});else if(B.worker.configDigest!==V)throw new x2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),f4.after($,J),b8($,J,Z);let K=O0(J.stateDirectory,I2);if(u(K))gQ(K);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function b8($,J,Z){if(E8($,J,Z,"connect"),!l4(J.stateDirectory))return;let Q=cQ(O1($.stateDirectory));if(!Q)return;let X=O1(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);k8($.stateDirectory)}function d4($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Q1({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function dQ($,J,Z){if(u(g(J))){let X=Q1({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=G$(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function lQ($,J){let Z=[$,...S8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let B=O0(X,Y);if(B===J||!G$(O0(B,"worker.json")))continue;let V=y8(B);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+uQ))Q.push({directory:B,config:V})}return Q}function l4($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function pQ($,J){let Z=O1($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function k8($){try{O1($).deleteBinding()}catch(J){if(!(J instanceof Y0))throw J}}function cQ($){try{return $.loadBinding()}catch(J){if(J instanceof Y0)return null;throw J}}function sQ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=y8(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function P8($){try{return p4($).isSymbolicLink()&&vQ($)==="reason"}catch{return!1}}function aQ($){try{let J=JSON.parse(s(O0($,I2)));return typeof J.version==="string"?J.version:null}catch{return null}}function y8($){try{let J=O0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function G$($){try{return p4($)}catch{return null}}function iQ($){if($ instanceof x2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof Y0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as nQ}from"fs";function S2($){try{let J=JSON.parse(nQ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function f8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as SK}from"crypto";import{readdirSync as wK,realpathSync as NJ,statSync as bK}from"fs";import{hostname as kK}from"os";import{join as r1,resolve as yK}from"path";var w2="cloud",rQ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function u$($){return rQ.test($)&&!h8.test($)}var tQ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function B$($){return tQ[$]}import{chmodSync as oQ,lstatSync as k2,mkdtempSync as eQ,realpathSync as u8,rmdirSync as $X,rmSync as JX,unlinkSync as ZX}from"fs";import{createConnection as QX,createServer as XX}from"net";import{basename as m8,dirname as v8,join as g1}from"path";var YX=G.enum(["status","drain","resume","stop","reload_roots"]),GX=G.strictObject({version:G.literal(1),instanceId:G.string(),deviceId:G.string(),phase:G.enum(["starting","running","reconnecting","stopping"]),drained:G.boolean(),activeClaims:G.number().int().nonnegative(),activeSessions:G.number().int().nonnegative().optional(),executionEligible:G.boolean(),supportedOperations:G.array(G.enum(b2)).max(b2.length).optional(),capabilityReadiness:G.partialRecord(G.enum(b2),G.boolean()).optional(),lastHeartbeat:G.string().nullable(),expiresAt:G.string()}),BX=G.strictObject({nonce:G.string(),action:YX}),KX=G.object({nonce:G.uuid()}),d8=G.strictObject({version:G.literal(1),nonce:G.uuid(),socketPath:G.string().max(100)});function l8($){return g1(d($).lock,"control.json")}function y2($){return e(d($).lock),KX.parse(JSON.parse(s(g1(d($).lock,"owner.json"))))}function g8($){if(!u($))return!1;let J=k2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function p8($,J){let Z=l8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!k2(Y).isSocket())return null;return g8(Y)?Y:null}let Q=d8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=v8(Q.socketPath);if(v8(X)!==u8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(m8(X))||m8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),g8(Q.socketPath)?Q.socketPath:null}async function f2($,J,Z){if(y2($).nonce!==J)throw Error("worker_instance_changed");let Q=l8($);if(u(Q))throw Error("worker_control_already_serving");let X=eQ(g1(u8("/tmp"),"ara-worker-")),Y=g1(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let B=new Set,V=XX((H)=>{B.add(H),H.once("close",()=>B.delete(H)),H.setTimeout(2000,()=>H.destroy());let U="",M=!1;H.on("error",()=>H.destroy()),H.on("data",(T)=>{if(M)return;if(U+=T.toString(),Buffer.byteLength(U)>4096){H.destroy();return}if(!U.includes(`
+`))return;M=!0;try{let _=BX.parse(JSON.parse(U));if(_.nonce!==J){H.destroy();return}H.end(JSON.stringify(Z(_.action))+`
+`)}catch{H.destroy()}})});V.maxConnections=32;let K,N=!1,q=async()=>{if(N)return;N=!0;for(let H of B)H.destroy();if(await new Promise((H)=>V.close(()=>H())),K&&u(Q)){let H=k2(Q);if(H.isFile()&&H.dev===K.dev&&H.ino===K.ino)try{let U=d8.parse(JSON.parse(s(Q)));if(U.nonce===J&&U.socketPath===Y)ZX(Q)}catch{}}try{$X(X)}catch{}};try{if(await new Promise((H,U)=>{V.once("error",U),V.listen(Y,()=>{oQ(Y,384),H()})}),y2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=k2(Q),q}catch(H){throw await q(),H}}function c8($,J){try{let Z=JSON.parse(s(g1(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function d$($){return c8($,"runtime_version")}function VX($){return c8($,"nonce")}function s8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(g1(d($).lock,"owner.json")))return"no_lock";return p8($,y2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var HX=21600000,NX=G.strictObject({instance:G.string().nullable(),since:G.number().int().nonnegative()});function UX($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=NX.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;c4($)}catch{}return null}function c4($){try{JX(d($).updateDeferral,{force:!0})}catch{}}async function h2($,J,Z=()=>!1){let Q=VX($),X=UX($,Q);if(J!==void 0){let N=d$($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await H0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let B=Date.now(),V=X;if(V===null){V=B;try{c(d($).updateDeferral,{instance:Q,since:V})}catch{}}let K=B-V;return{state:K<HX?"busy":"drained",sessions:Y,waitedMs:K}}async function H0($,J){let Z=d($);if(!u(g1(Z.lock,"owner.json")))return null;let Q=y2($),X=p8($,Q.nonce);if(!X)return null;return new Promise((Y,B)=>{let V=QX(X),K="",N=!1,q=(H,U)=>{if(N)return;if(N=!0,V.destroy(),U)B(U);else Y(H)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
+`)),V.on("data",(H)=>{if(K+=H.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(H)=>{if("code"in H&&["ECONNREFUSED","ENOENT"].includes(String(H.code)))q(null);else q(null,H.message==="worker_control_timeout"?H:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let H=GX.parse(JSON.parse(K));if(H.instanceId!==Q.nonce)throw Error("worker_instance_changed");q(H)}catch{q(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>q(null,Error("worker_control_unavailable")))})}import{randomUUID as MB}from"crypto";import{homedir as q7}from"os";import{spawn as qX}from"child_process";async function a8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,B=Promise.resolve(),V=(H)=>{if(Q===H)return;Q=H,J.onStatusChange?.(H)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,B=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let H=(J.spawn??qX)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=H,H.once("exit",()=>{if(!X&&Z===H)V("failed"),K()}),await new Promise((U,M)=>{H.once("spawn",U),H.once("error",M)}),H.exitCode===null&&H.signalCode===null)V("held")}catch{V("failed"),K()}};B=N(),await B;let q;return{get status(){return Q},release(){return q??=(async()=>{X=!0,clearTimeout(Y),await B;let H=Z;if(!H||H.exitCode!==null||H.signalCode!==null||!H.pid)return Q="failed","released";let U=await new Promise((M)=>{let T,_=setTimeout(()=>{try{H.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);H.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{H.kill("SIGTERM")}catch{}});if(U==="released")Q="failed";return U})()}}}class K$ extends Error{constructor(){super("Reason Device operation lease expired.")}}class m2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new K$;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new K$;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new K$)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as WX}from"fs";import{constants as s4}from"fs";import{open as MX}from"fs/promises";import{join as TX}from"path";var _X={platform:process.platform,home:V0,async openFile($){let J=await MX($,s4.O_RDONLY|s4.O_NOFOLLOW|s4.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function i8($=_X){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(TX($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class a4 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function FX($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,B=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new a4;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),B])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function n8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await FX($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof a4||(X instanceof _0?l$(X.status):p$(X));if(Y){let B=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+B}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function Y3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var LX=1000,DX=250,jX=U5(WX(process.execPath)),r8=null,t8=null;function q5($){if(process.platform!=="darwin")return{};return t8??=i8().then((J)=>{r8={status:J,checkedAt:$().getTime()}}).finally(()=>{t8=null}),{fullDiskAccess:{...r8??{status:"unknown",checkedAt:$().getTime()},executablePath:jX}}}var o8=8,zX=2000,OX=2000,G3=8000,e8=3,AX=250,$5=1000,J5=30000,RX=0.2,CX=30000,PX=21600000,IX=300000,xX=3600000,EX=0.1,M5=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function SX($){return Math.min(e8,Math.max(1,$??e8))}function wX($){return typeof $.reason_code==="string"&&M5.has($.reason_code)?$.reason_code:"cancelled"}function i4($){return $.reason instanceof g0&&($.reason.code==="cancelled"||M5.has($.reason.code))?$.reason.code:"cancelled"}function Z5($){return $ instanceof g0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function T5($){return $.capability==="hands.connect"&&(V5($.payload)||K5($.payload))}function n4($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*EX)))}function bX($,J=Math.random){let Z=Math.min(J5,$5*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*RX*(Q*2-1);return Math.min(J5,Math.max($5,Math.round(Z+X)))}function B3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class r4 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function kX($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function t4($){return $ instanceof Error?$.message:String($)}function o4($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function r0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function e4($){return $.capability==="environment.install"}function yX($){if($ instanceof g2||$ instanceof K$||$ instanceof s$)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function c$($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(r0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:yX(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function V$($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)c$($,J,Q);throw Q}}class s$ extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function $3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Y5(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:e4(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,B=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??B3,K=$.operationCompletionTimeoutMs??G3,N=performance.now()+K,q,H,U=new Promise((_,D)=>{let j=()=>{let F=new s$;Y.abort(F),D(F)},z=(F)=>{clearTimeout(q),q=setTimeout(j,F)};if(H=()=>z(Math.max(0,Math.min(N-performance.now(),zX))),z(K),$.signal.addEventListener("abort",H,{once:!0}),$.signal.aborted)H()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,B),U]);break}catch(_){if(B.aborted||$.signal.aborted||S0(_)||r0(_)||!fX(_)||performance.now()>=N)throw c$($,"completion",_),_;T+=1;let D=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(D<=0)throw c$($,"completion",_),_;try{await V(D,B)}catch{throw c$($,"completion",_),_}}}finally{clearTimeout(q),$.signal.removeEventListener("abort",H),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function fX($){if(S0($))return!1;if(r0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof s$)return!1;return!0}return!1}class g2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function v2($){if($ instanceof g2)return!0;return $ instanceof _0?l$($.status):p$($)}function J3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function hX($,J,Z,Q,X){let Y=new AbortController,B,V=()=>{return},K=new Promise((q,H)=>{let U=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),H(M)};if(V=()=>Q.removeEventListener("abort",U),Q.aborted)U();else Q.addEventListener("abort",U,{once:!0})}),N=new Promise((q,H)=>{B=setTimeout(()=>{let U=new g2;Y.abort(U),H(U)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(B!==void 0)clearTimeout(B);V()}}async function Q5($,J,Z,Q,X,Y){let B=SX($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??G3,K=$.operationHeartbeatRetryDelayMs??AX,N=Y.remainingMs(),q=Math.min(N,B*V+K*B*(B-1)/2);for(let H=0;H<B;H+=1)try{Q.throwIfAborted(),Y.assertCurrent();let U=Math.min(V,Y.remainingMs()),M=await hX($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(U-1000))),clientRetryCount:H},Q,U);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(U){if(Q.aborted||H+1>=B||r0(U)||S0(U)||!v2(U)){if(!Q.aborted)c$($,"operation_heartbeat",U);throw U}let M=N-Y.remainingMs(),T=J3(U,($.now?.()??new Date).getTime()),_=Math.max(K*(H+1),q*(H+1)/B-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function mX($,J,Z,Q,X){let Y=T5(J),B=new AbortController,V=new AbortController,K=()=>{B.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,q,H,U=-1,M=0,T=Promise.resolve(),_=[],D=new AbortController,j=!1,z,F=null,O=!1,W,L,R={},x=(S)=>{j=!0,D.abort(S),B.abort(S),V.abort(S)},C=(S)=>{if(z)return z;let y=structuredClone(S),l=M;return z=(async()=>{let k=new AbortController,I=k.signal;I.throwIfAborted();let E,A=()=>{},b=new Promise((w,n)=>{if(A=()=>n(I.reason),I.addEventListener("abort",A,{once:!0}),E=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),I.aborted)A()});try{for(let w=0;w<3;w+=1){I.throwIfAborted();try{let n=await Promise.race([V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[y],signal:I,transientRetryOwner:"caller"})),b]);if(I.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(S0(n))X(n);let o=n instanceof _0?l$(n.status):p$(n);if(I.aborted||!o||w===2)throw n;let N0=Math.max(500*2**w,J3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(N0,I),b])}}}finally{clearTimeout(E),I.removeEventListener("abort",A),k.abort()}})(),z},P=(S,y,l)=>{let k=(E)=>V$($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:y,events:S,signal:E,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&r0(A))x(A);if(l&&(S0(A)||r0(A))){if(S0(A))X(A);B.abort(A),V.abort(A),D.abort(A)}throw A});if(!l)return async(E)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(E)).next_event_seq;return}E.throwIfAborted();let A=()=>{},b=new Promise((w,n)=>{A=()=>n(E.reason),E.addEventListener("abort",A,{once:!0})});try{let w=await Promise.race([k(E),b]);E.throwIfAborted(),M=w.next_event_seq}finally{E.removeEventListener("abort",A)}};let I=n8({send:k,lease:L,sleep:Z,retryAfterMs:(E)=>J3(E,($.now?.()??new Date).getTime())});return async(E)=>{let A=await I(E);if(A.next_event_seq!==y+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,y)=>{let l=S??await Q5($,J,{controlAckSeq:U,waitMs:y},V.signal,Z,L),k=null,I=!1;for(let E=0;E<10;E+=1){let A=U+1;for(let b of l.controls){if(b.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(b.kind==="cancel"||b.kind==="operation.cancel")k??=wX(b.payload),B.abort(new g0(k,"Reason closed the Device operation."));if(b.kind!=="cancel"&&b.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let w,n,o=new Promise((N0,j0)=>{w=N0,n=j0});o.catch(()=>{}),R.current={promise:o,resolve:w,reject:n}}try{I||=!await $.onControl?.(J,b)}catch(w){if(w instanceof g0)q??=Z5(w);throw R.current?.reject(w),w}}U=b.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==U+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:I}}try{l=await Q5($,J,{controlAckSeq:U},V.signal,Z,L),R.current?.resolve()}catch(b){if(R.current?.reject(b),!k||r0(b)||S0(b))throw b;return{cancellationReason:k,unsupported:I}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)L=new m2(J.lease_until,()=>($.now?.()??new Date).getTime(),(y)=>{if(!B.signal.aborted)N=y;B.abort(y),V.abort(y)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||Z3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(y){if(!e4(J)||r0(y)||S0(y))throw y;await $3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let y=S.cancellationReason??i4($.signal);B.abort(new g0(y,"Reason closed the Device operation.")),H={status:"cancelled",error_code:y}}else if(S.unsupported)B.abort(),H={status:"failed",error_code:"control_unsupported"};else{let y=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?OX:15000),I=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??G3)-1000)),E=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!E){if(await Z(k,V.signal),V.signal.aborted)return}let A=await h(void 0,E?I:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");B.abort(A.cancellationReason?new g0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(S0(A))X(A);if(r0(A))N=A,x(A);if(!V.signal.aborted)N=A,B.abort();return}})();try{if(L?.assertCurrent(),B.signal.throwIfAborted(),Q.authorized=()=>!B.signal.aborted&&(Y||(L?.remainingMs()??0)>0),H=await $.onClaim(J,B.signal,async(k)=>{if(e4(J))return;let I=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",E=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=E||J.capability==="inference.custom.v1"?AbortSignal.any([B.signal,D.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,D.signal]):$.signal,b={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:E?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(Z3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,N0)=>{_.push({wireEvent:b,settle:(j0)=>j0===void 0?o():N0(j0)})});let w=_;_=[];let n=T.then(async()=>{if((j||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(I)await C(b);return}if(F!==null){if(k.kind!=="hands.stopped"||!O||!W)throw F;let N0=new AbortController,j0=AbortSignal.any([$.signal,D.signal,N0.signal]),L1=setTimeout(()=>N0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);O=!1;try{await W(j0),W=void 0,await P([b],M,!0)(j0),F=null}catch(D1){throw F=D1??Error("Hands stop receipt could not be confirmed."),D1}finally{clearTimeout(L1),N0.abort()}return}if(E&&!L){let N0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));L=new m2(new Date(N0).toISOString(),()=>($.now?.()??new Date).getTime(),(j0)=>{B.abort(j0),V.abort(j0)})}let o=M;if(E)W=P([...w.map((N0)=>N0.wireEvent),b],o,!0),await W(A),W=void 0;else await P([...w.map((N0)=>N0.wireEvent),b],o,!1)(A)});n.then(()=>{for(let o of w)o.settle()},(o)=>{for(let N0 of w)N0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(S0(o))X(o);if(E){if(F===null)O=A.aborted&&!D.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)B.abort(o),V.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(k){H=B.signal.aborted?{status:"cancelled",error_code:i4(B.signal)}:{status:"failed",error_code:Z5(k)}}finally{Q.authorized=()=>!1,D.abort();for(let k of _.splice(0))k.settle();V.abort(),await y}let l=G5(J.capability)?B5(H.result,J.operation_id):null;if(N){if(S0(N))throw N;H={status:"failed",error_code:q??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(B.signal.aborted&&H.status==="succeeded")H={status:"cancelled",error_code:i4(B.signal),...l?{result:l}:{}}}if(L?.close(),S0($.signal.reason))throw $.signal.reason;await $3($,J,H)}finally{L?.close(),D.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function K3($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.saveStatus??X3,X=$.loadStatus??y$,Y=$.statusPath??Q3(),B=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:B,...q5(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),q=0,H,U=!1,M,T,_,D=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),N5();try{let j=async()=>{let z=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||z===T)return;if(M&&T){let W=await M.release();if($.onEvent?.({type:"idle_sleep",status:W,policy:T}),W==="failed")return;M=void 0,T=void 0,K=!1;let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y)}if(!z)return;T=z;let F=!0;M=await($.acquireAwakeHold??a8)(z,{onStatusChange:(W)=>{if(F)return;K=W==="held";let L=X(Y);if(L)Q({...L,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:W,policy:z})}}),F=!1,K=M.status==="held";let O=X(Y);if(O)Q({...O,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:z})};if(await j(),$.readIdleSleepPolicy)_=setInterval(()=>{D=D.then(j).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let z=!1;try{await vX({...$,saveStatus:(F,O)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:B,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},O)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&q>0&&!z){z=!0;let O=q;q=0,H=void 0,$.onEvent?.({type:"reconnected",attempts:O})}$.onEvent?.(F)}});return}catch(F){if(o4(F,$.signal))return;if(S0(F)){U=!0;let W=$.state.worker?"worker_connection_failed":t4(F);throw Q({...N(),state:"error",error:W},Y),$.onEvent?.({type:"error",message:W}),F}q+=1;let O=bX(q,$.reconnectRandom);H??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:H},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":t4(F),attempt:q,retryInMs:O}),await Z(O,$.signal)}}}catch(j){if(!o4(j,$.signal))throw j}finally{if($.client.close?.(),clearInterval(_),await D,M&&T){let j=await M.release();K=j==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:j,policy:T})}if(!U)Q({...N(),state:"stopped"},Y);else{let j=X(Y);if(j)Q({...j,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function vX($){let J=$.now??(()=>new Date),Z=$.sleep??B3,Q=$.statusPath??Q3(),X=$.saveStatus??X3,Y=$.loadStatus??y$,B=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,q=()=>N.abort($.signal.reason);if($.signal.aborted)q();else $.signal.addEventListener("abort",q,{once:!0});let H=K?.random??Math.random,U=$.maxConcurrentClaims,M=typeof U==="number"&&Number.isSafeInteger(U)&&U>0?Math.min(o8,U):o8,T=0,_=!1,D=null,j=(v)=>{D??=v,N.abort(v)},z=new Map,F=()=>{let v=new Set,X0=0;for(let{claim:w1}of z.values()){let H1=w1.capability==="hands.connect"?w1.payload[X5]:void 0;if(typeof H1==="string"){if(v.has(H1))continue;v.add(H1)}X0+=1}return X0},O=null,W=()=>[...z.values()].some((v)=>v.authorized()),L=()=>[...z.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(B).getTime()+n4(K.initialDelayMs??CX,H):Number.POSITIVE_INFINITY,x=null,C=!1,P=$.firstHeartbeat,h=P?.account_root_metadata_supported===!0,S=P?.workspace_root_metadata_supported===!0,y=P?.account_root_path_supported===!0,l=P?.home_contained_roots_supported===!0,k=P?.root_paths_supported===!0,I=P?.startup_supported===!0,E=P!==void 0,A=P?{challenge:P.challenge,expires_at:P.expires_at}:void 0,b,w=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:B,...q5(J),...V?{lastUsedAt:V}:{},...x?{organizationId:x.organization_id,organizationName:x.organization_name,organizationSlug:x.organization_slug}:{}}),o=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!w)b??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...I&&!w&&b?{startup:b}:{},capabilities:v?H5($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:y,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},N0=()=>{if(C||!$.client.identity)return;C=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;x=v;let X0=Y(Q);if(!X0)return;X({...X0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},j0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,y=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,I=v.startup_supported===!0,E=!1},L1=(v)=>{if(v.startup)w=!0},D1=(v,X0)=>{if(!(X0 instanceof _0&&X0.status===400&&X0.code==="invalid_heartbeat")||!v.startup&&!E)throw X0;if(w=!0,E)h=S=y=!1,l=k=I=E=!1;return null},O$=(v)=>{j0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),N0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},E1=!1,t1=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(E1)t1=!0;let v=o();V$($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((X0)=>D1(v,X0))).then((X0)=>{if(!X0)return;L1(v),j0(X0),O$(X0)},()=>{return})});let j1=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let K1=!1,S1=$.maxConsecutiveHeartbeatFailures??3,V1=0;try{while(!$.signal.aborted){if(D)throw D;if(_&&L())break;let v,X0=o(),w1=A;A=void 0,E1=!0,t1=!1;try{let i=await V$($,"heartbeat",()=>$.client.heartbeat($.state,X0,N.signal,...w1?[w1]:[]).catch((K0)=>D1(X0,K0)));if(E1=!1,!i)continue;v=i,L1(X0),V1=0}catch(i){if(E1=!1,$.signal.aborted)break;if(!v2(i))throw i;if(V1+=1,V1>=S1&&!W())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(j0(v),Object.keys(o().capabilities).length>Object.keys(X0.capabilities).length)continue;if(t1)continue;if(O$(v),D)throw D;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let i=new AbortController,K0=()=>i.abort($.signal.reason);if($.signal.aborted)K0();else $.signal.addEventListener("abort",K0,{once:!0});let R0;try{R0=K.check(i.signal)}catch(C0){R0=Promise.reject(C0)}let N1=R0.then((C0)=>({kind:"completed",result:C0}),(C0)=>({kind:"failed",error:C0})),o1;try{while(!0){let C0=await kX(N1,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(C0.kind==="failed")throw new r4(C0.error);if(C0.kind==="completed"){o1=C0.result;break}try{let w0=o(),R$=await V$($,"heartbeat",()=>$.client.heartbeat($.state,w0,N.signal).catch((H2)=>D1(w0,H2)));if(!R$)continue;v=R$,L1(w0),O$(v),V1=0}catch(w0){if($.signal.aborted)throw w0;if(!v2(w0))throw w0;if(V1+=1,V1>=S1&&!W())throw w0}}}catch(C0){i.abort(C0);let w0=await N1;if(w0.kind==="completed"&&w0.result==="activated")o1="activated";else throw C0}finally{$.signal.removeEventListener("abort",K0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,o1==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+n4(K.intervalMs??PX,H)}catch(i){if(!(i instanceof r4))throw i;T+=1;let K0=K.retryBaseMs??IX,R0=K.retryMaxMs??xX,N1=Math.min(R0,K0*2**Math.min(T-1,8));R=J().getTime()+n4(N1,H)}if($.signal.aborted)break;if(_&&L())break;if(_){await j1($.heartbeatIntervalMs??15000);continue}let H1=$.client.sessionCadence?.($.state)??null,b1=H1?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await j1(b1);continue}if(F()>=M){let i=new AbortController;O=i;try{await Z(b1,AbortSignal.any([$.signal,i.signal]))}catch(K0){if(!i.signal.aborted)throw K0}finally{if(O===i)O=null}continue}let u0,A$=H1?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),f=performance.now();try{u0=await V$($,"claim",()=>$.client.claimOperation($.state,{waitMs:A$,signal:N.signal}))}catch(i){if($.signal.aborted||!v2(i)||!W())throw i;await j1(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(D)throw D;if(!u0){if(performance.now()-f<A$-DX)await j1(LX);continue}if($.claimable?.()===!1){await $3($,u0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:u0.operation_id,runId:u0.run_id,attemptId:u0.attempt_id,capability:u0.capability});let a,q0={authorized:()=>!1,claim:u0};if(a=mX({...$,signal:N.signal},u0,Z,q0,j).catch((i)=>{if(S0(i))j(i);else if(!r0(i)&&[...z].some(([K0,R0])=>K0!==a&&R0.authorized())){if(i instanceof s$)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!r0(i)&&D===null)D=i}).finally(()=>{z.delete(a),O?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:z.size})}),z.set(a,q0),$.onEvent?.({type:"claims_changed",activeClaims:z.size}),T5(u0)){if(await a,D)throw D}}}catch(v){if(!o4(v,$.signal)){N.abort(v),K1=!0;let X0=$.state.worker?"worker_connection_failed":t4(v);throw X({...n(),state:"error",error:X0},Q),$.onEvent?.({type:"error",message:X0}),v}}finally{if(N.abort(),await Promise.allSettled(z.keys()),$.signal.removeEventListener("abort",q),!K1)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as _Y}from"child_process";import{constants as u5,existsSync as FY,mkdtempSync as o5,rmSync as WY}from"fs";import{access as d5,open as LY,readFile as l5,readlink as DY,readdir as p5,unlink as jY,rmdir as zY}from"fs/promises";import{basename as U3,join as M3}from"path";import{randomUUID as u1}from"crypto";import{chmodSync as gX,closeSync as uX,fsyncSync as dX,openSync as lX,readFileSync as pX,rmdirSync as _5,unlinkSync as L5,writeFileSync as cX}from"fs";import{createConnection as sX,createServer as aX}from"net";import{dirname as iX,join as nX}from"path";var rX=5000;async function D5($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:u1()},X={runId:u1(),deviceId:u1(),rootId:u1(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=W5(J,X),B={version:1,snapshot_id:u1(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(B).installed&&Y.current().snapshot_id===B.snapshot_id&&!Z.aborted}catch{return!1}finally{try{L5(Y.path)}catch{}}}async function j5($,J,Z=F5){if(J.aborted)return!1;let Q,X,Y=new Set,B=u1(),V=aX((U)=>{Y.add(U),U.once("close",()=>Y.delete(U)),U.on("error",()=>U.destroy()),U.end(B)});V.maxConnections=1;let K,N,q=new Promise((U)=>{N=()=>U(!1)}),H=setTimeout(N,rX);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${u1()}`}),X=nX(Q.journalDirectory,"readiness.json");let U=lX(X,"wx",384);try{cX(U,B),dX(U)}finally{uX(U)}if(pX(X,"utf8")!==B||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{gX(Q.socketPath,384)}catch{T(!1);return}K=sX(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(D)=>{if(_+=D,_.length>B.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===B)),K.once("close",()=>T(!1))})});return await Promise.race([M,q])&&!J.aborted}catch{return!1}finally{clearTimeout(H),J.removeEventListener("abort",N),K?.destroy();for(let U of Y)U.destroy();if(await new Promise((U)=>V.close(()=>U())),Q?.disposeSocket(),X)try{L5(X)}catch{}if(Q){try{_5(Q.journalDirectory)}catch{}try{_5(iX(Q.journalDirectory))}catch{}}}}import{spawn as tX}from"child_process";import{randomUUID as d1}from"crypto";import{basename as oX}from"path";import{fileURLToPath as eX}from"url";function $Y(){let $=oX(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",eX(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function A5($,J,Z=$Y()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),B=tX(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>B.once("close",()=>{V=!0,F()}));B.on("error",X);let N,q,H=new Promise((F)=>{N=F}),U=new Promise((F)=>{q=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,D=!1;B.stdout.setEncoding("utf8"),B.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
 `)){let O=T.indexOf(`
-`),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([H,M]);if(!F||!B.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=d1(),L={organizationId:d1(),userId:d1(),runId:d1(),deviceId:d1(),rootId:d1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:d1(),port:F.port,expiresAtMs:O},R={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:B.pid,processGroupId:B.pid,executorLaunchId:W}}},x=z5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});j=await j5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:x,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),B.stdin.destroy(),!V)B.kill("SIGKILL");await K}return z&&V}import{execFileSync as d2}from"child_process";import{randomUUID as c0}from"crypto";import{chmodSync as A5,chownSync as h5,closeSync as V3,constants as T1,existsSync as $Y,fstatSync as m5,mkdirSync as R5,mkdtempSync as JY,openSync as H3,readFileSync as ZY,readSync as QY,realpathSync as XY,rmdirSync as YY,rmSync as GY}from"fs";import{join as l1}from"path";import{fileURLToPath as BY}from"url";var C5=1e4,KY=!1;function l2(){if(process.platform!=="linux")return!1;return KY||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=d2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var VY=Buffer.from([0,255,3,4]);function P5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function HY($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function a$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=u2(),{directory:Q,root:X,runtimeDirectory:Y}=qY(Z),B=new AbortController,V=()=>B.abort();$.addEventListener("abort",V,{once:!0});let K;B.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,C5),q={organization_id:c0(),user_id:c0(),device_id:c0()},H=c0(),U=c0(),M=c0(),T=c0(),_=Date.now()+C5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=c0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,R=!1,x=!1,C,P,h,S=async(l)=>{while(!l()){if(B.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(B.signal.aborted)throw Error("pty_probe_cancelled")},y=!1;try{K=NY(Q,Z),C=Bun.serve({hostname:"127.0.0.1",port:0,fetch(I,E){let A=new URL(I.url).pathname,b=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(b&&E.upgrade(I,{data:{lane:b}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(I){if(I.data.lane==="pty")z=I},message(I,E){if(I.data.lane!=="pty")return;if(typeof E==="string"){try{if(JSON.parse(E).t==="open")W=!0}catch{V()}return}if(F.length+E.length>8192){V();return}F=Buffer.concat([F,E])}}});let l=`ws://127.0.0.1:${C.port}`;if(P=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:H,operationId:c0(),attemptId:c0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:B.signal,payload:{relay_url:`${l}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:I5,hands_worker_version:S5,hands_worker_artifact_sha256:b5,hands_worker_entrypoint:w5,target_generation:1,target_fence_id:M,environment_binding:D,[k5]:y5},emitEvent:async(I)=>{if(I==="hands.started")x=!0;if(I==="hands.ready")L=!0;if(I==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:f5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:BY(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)V()}),await S(()=>L),x5({root:X,runId:H,payload:{version:1,snapshot_id:T,revision:1,run_id:H,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),h=E5({root:X,runId:H,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:B.signal,session:{jobId:`pty-${c0()}`,sessionId:"pty-readiness",operationId:c0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${j}`},emit:async(I,E)=>{if(I==="pty.ready")O=E}}).catch(()=>{V()}),await S(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${P5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${P5("foreground")}; ${K.wait("foreground")}'
-`)),await S(()=>$Y(l1(X,"foreground.pid"))&&F.includes(VY)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((I)=>UY(l1(X,I)));if(new Set(k).size!==2||k.some((I)=>!Number.isSafeInteger(I)||I<2||I===O.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((I)=>HY(ZY(`/proc/${I}/stat`,"utf8"),I,O.job.process.pid)))return!1}else{let E=d2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((A)=>A.trim().split(/\s+/).map(Number));if(E.length!==2||new Set(E.map(([A])=>A)).size!==2||E.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await h,B.signal.aborted)return!1;for(let I of[O.job.process.pid,...k])try{return process.kill(I,0),!1}catch(E){if(!(E instanceof Error&&("code"in E)&&E.code==="ESRCH"))return!1}y=!0}catch{y=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await P,await C?.stop(!0),!x||R)MY({directory:Q,root:X},Z)}return y&&R&&!$.aborted}function NY($,J){let Z={foreground:l1($,"foreground.lifeline"),background:l1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");d2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let B=H3(Y,T1.O_RDONLY|T1.O_NONBLOCK|T1.O_NOFOLLOW);try{if(Q.push(H3(Y,T1.O_WRONLY|T1.O_NONBLOCK|T1.O_NOFOLLOW)),!m5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(B)}if(J)h5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function v5($=(J)=>a$(J)){let J=new AbortController,Z=JSON.stringify(u2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(u2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((B)=>{Y=setTimeout(B,X)})]),clearTimeout(Y)}}}function UY($){let J;try{J=H3($,T1.O_RDONLY|T1.O_NOFOLLOW|T1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=m5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=QY(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function qY($,J=XY("/tmp")){let Z=JY(l1(J,"reason-pty-probe-")),Q=l1(Z,"workspace"),X=l1(Z,"private");if(R5(Q,{mode:448}),R5(X,{mode:448}),$)A5(Z,493),A5(Q,493),h5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function MY($,J){if(J)try{d2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),YY($.root)}catch{return}GY($.directory,{recursive:!0,force:!0})}var o5=5000,p1="ARA_WORKER_PROBE_READY";function zY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{TY($,J,{cwd:Z,env:Q,signal:X,timeout:o5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(B,V)=>Y(!B&&!X.aborted&&V===p1))})}function OY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function AY($,J){let Z=c5({home:J,temporaryDirectory:J}),Q=(Y,B,V)=>zY(Y,B,$.workspaceRoot,Z,V),X=async(Y,B,V,K=(q)=>q===p1,N=!1)=>{let q=await Z6(Y,B,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:o5,signal:V});return!V.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await u5($.workspaceRoot,g5.R_OK),await l5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await u5($.workspaceRoot,g5.W_OK),Y.aborted)return!1;let B=t5(M3($.workspaceRoot,".ara-worker-probe-")),V=M3(B,"receipt");try{let K=await WY(V,"wx",384);try{await K.writeFile(p1),await K.sync()}finally{await K.close()}return await d5(V,"utf8")===p1&&!Y.aborted}finally{await DY(V).catch(()=>{}),await jY(B).catch(()=>{})}},confinedShell:(Y)=>X(J6(),["-c",`printf ${p1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(B)=>/^git version \S+/.test(B)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
-`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[B,V,K]=await Promise.all([LY("/proc/self/cwd"),l5("/proc/self/fd"),d5("/proc/net/tcp","utf8")]);return!Y.aborted&&B.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${p1}`],Y),jobs:(Y)=>D5($,Y),environment:(Y)=>L5($,J,Y),preview:(Y)=>O5(J,Y),boundPty:(Y)=>a$(Y),desktopDisplay:()=>$6(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
-`);return r5()},desktopBrowser:async()=>n$()?.features.browser===!0,fullControlShell:(Y)=>{let B=i5(),V=OY(B,`printf ${p1}`);return V?Q(B,V,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&n$()?.features.computer===!0?n5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function RY($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return i$($,J,Z,Q,X).final}function i$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,B){let V,K;try{if(q1($),d0(),!J)e(g($),!0),V=t5(M3(g($),"probe-")),J=AY($,V);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",H=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(B).then(()=>Promise.all(q?[N("preview"),H,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,R,x,C,P]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!R||!x||!C)&&!B)await U;if(q){if(!R)R=await N("bash");if(!x)x=await N("jobs");if(!C)C=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:R,jobs:x,environment:C,full:P}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:R,processes:x,bash:C,jobs:P,environment:h,full:S}=z,{preview:y,boundPty:l,desktopDisplay:k,desktopAutomation:I,desktopBrowser:E}=F,A=s5(),b=q&&process.platform==="darwin"&&S&&_Y("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&R&&X,"process.list":(process.platform==="linux"||L)&&x,"ports.list":(process.platform==="linux"||L)&&x,"exec.full":C&&S&&X,"hands.connect":O&&W&&C&&P,"jobs.control":O&&W&&C&&P,"pty.start":O&&W&&C&&P&&h&&l,"environment.install":O&&W&&C&&P&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&C&&P&&h,"tunnel.open":O&&W&&C&&P&&h&&y,"tunnel.close":O&&W&&C&&P&&h&&y,"preview.serve.v1":O&&C&&P&&y&&S,"display.stream.v1":k,"automation.call.v1":I,"simulator.call.v1":b,"simulator.stream.v1":b,"browser.pr-proof.v1":I&&E&&p5()===null,"workspace.setup.v1":q&&a5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([H,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,R]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:R})}finally{if(V)FY(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await H||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var CY=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],PY=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return CY.filter((Z)=>J[Z]!==!0)}function e5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>RY($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
-`),(async()=>{for(let Y of $.delaysMs??PY){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let B;try{B=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=q3($.config,Q).filter((K)=>B[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
-`),$.onReady(Q,V);if(q3($.config,Q).length===0)return}})()}import{execFile as AG}from"child_process";import{createHash as RG,randomUUID as b3}from"crypto";import{lstat as CG,readdir as v6,readFile as s6,realpath as PG,stat as IG}from"fs/promises";import{basename as xG,join as S3}from"path";import{promisify as EG}from"util";import{createConnection as IY}from"net";import{endianness as Y6}from"os";var r$=4,W3=1e4;class P1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=IY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},B=xY({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(B),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=r$){let J=Y6()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=r$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(r$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!t0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),t0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class p2{client;cdp;constructor($){this.client="client"in $?$.client:new P1($),this.cdp=new K6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=EY(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new G6(this,$)}getTabs(){return this.client.getTabs()}}class G6{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new B6(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class B6{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class K6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(t0(Q)&&t0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return t0(Q)&&t0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";Q6(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),B=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(t0(B)&&typeof B.errorText==="string"&&B.errorText)throw Error(`Browser failed to navigate tab ${$}: ${B.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if(X6(K,Q))return;throw V}),B}async waitForLoadState($,J={}){let Z=J.state??"load";Q6(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(X6(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return t0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let B=!1,V=null,K,N=()=>{if(B)return!1;return B=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(H){if(N())Y(H instanceof Error?H:Error(String(H)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=SY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function xY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(r$+J.length);if(Y6()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,r$),Z}function t0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function EY($,J){if(!t0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function Q6($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function X6($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function SY($,J){if($.method!=="onCDPEvent"||!t0($.params))return null;let Z=$.params.source;if(!t0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as wY}from"crypto";function V6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${wY("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as jG}from"async_hooks";import{isDeepStrictEqual as h6}from"util";import{createHash as zG}from"crypto";var bY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var kY=new Set(["png","jpg","jpeg","gif","webp"]),yY=new Set(["webm","mp4"]);function fY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function H6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=fY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=bY.exec(Z.pathname);if(!Y)return null;let B=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!B||!V||!K||!N)return null;let q=kY.has(N)?"image":yY.has(N)?"video":null;if(!q)return null;let H=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:B,artifactId:V,fileName:`${K}.${N}`,kind:q,phase:H?.[1]==="before"||H?.[1]==="after"?H[1]:null}}var hY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,c2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),c1=()=>{throw Error("cloud_browser_media_request_invalid")};function s2($){if(!c2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!hY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return c1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return c1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!N6(J.origin,{mode:"public_web"}).allowed)return c1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!c2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return c1();let B=H6(Y.url,J.origin);if(!B||new URL(B.url).origin!==J.origin||B.runId!==Z||B.kind!==Y.kind||B.url!==Y.url||Q.has(Y.url))return c1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return c1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return c1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function U6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!c2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let B=J.media[Y];if(!c2(X)||X.url!==B.url||X.sourceUrl!==B.sourceUrl||X.kind!==B.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||B.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...B,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...B.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=G.string().uuid(),H$=G.string().regex(/^[a-f0-9]{64}$/),a1=G.iso.datetime({precision:3}),D3=G.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),M6=G.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),s0=G.object({kind:G.literal("primary_mac"),version:G.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:G.string().min(1).max(64),binding:G.enum(["workspace_source","mcp_control"]),targetRevision:G.number().int().nonnegative(),generation:L0,profile:G.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:G.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),mY=G.custom().transform(($,J)=>{try{return q6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),G.NEVER}}),N$=G.object({version:G.literal(1),owner:s0,contextId:L0,preparedAt:a1,expiresAt:a1,prUrl:M6,headSha:G.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:G.enum(["image","video"]),visualPlan:mY.optional(),uploadOrigin:G.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=G.object({version:G.literal(1),producer:G.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:G.number().int().positive(),startedAt:a1,finishedAt:a1,sha256:H$,media:G.discriminatedUnion("contentType",[G.object({contentType:G.literal("image/png"),sizeBytes:G.number().int().min(24).max(8388608),width:G.number().int().min(1).max(4096),height:G.number().int().min(1).max(4096)}).strict(),G.object({contentType:G.literal("video/webm"),sizeBytes:G.number().int().min(128).max(10485760),durationSeconds:G.number().min(0.05).max(15),frameCount:G.number().int().min(1).max(450),receivedFrameCount:G.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),DM=G.discriminatedUnion("action",[G.object({action:G.literal("screenshot"),context_id:L0,tab_id:G.number().int().positive()}).strict(),G.object({action:G.literal("start_video"),context_id:L0,tab_id:G.number().int().positive(),seconds:G.number().int().min(1).max(15)}).strict(),G.object({action:G.literal("stop_video"),recording_operation_id:L0}).strict()]),i2=G.object({login:G.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:G.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),a2=G.string().regex(/^[1-9][0-9]{0,19}$/),t$=G.object({version:G.literal(1),owner:s0,expectedActorId:a2.nullable(),repositoryId:a2,repositoryFullName:G.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),vY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=G.discriminatedUnion("status",[t$.extend({status:G.literal("ready"),observedActor:i2,checkedAt:a1}),t$.extend({status:G.literal("not_ready"),reason:G.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:G.enum(vY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),s1=G.object({version:G.literal(1),owner:s0,expectedActorId:a2.nullable(),authenticatedActor:i2,attemptId:L0,captureId:L0,prUrl:M6,repositoryId:a2,headSha:G.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:G.number().int().min(128).max(10485760),contentType:G.literal("video/webm")}).strict(),T6=G.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=G.discriminatedUnion("status",[s1.extend({status:G.literal("not_attempted"),reason:G.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),s1.extend({status:G.literal("uncertain"),reason:G.literal("upload_outcome_unknown")}),s1.extend({status:G.literal("uploaded"),observedActor:i2,nativeUrl:T6,uploadedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),o$=s1.extend({nativeUrl:T6,observedActor:i2,bodySha256:H$}),A3=G.discriminatedUnion("status",[o$.extend({status:G.literal("incomplete"),reason:G.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),o$.extend({status:G.literal("verified"),sourceSha256:H$,width:G.number().int().min(1).max(4096),height:G.number().int().min(1).max(4096),durationSeconds:G.number().positive().max(30),advancedSeconds:G.number().min(0.05).max(10),advancedFrames:G.number().int().positive(),playbackRestored:G.literal(!0),verifiedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),gY=G.custom().transform(($,J)=>{try{let Z=s2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),G.NEVER}}),uY=G.discriminatedUnion("action",[G.object({action:G.literal("auth_check"),input:t$}).strict(),G.object({action:G.literal("prepare"),context:N$}).strict(),G.object({action:G.literal("capture_png"),owner:s0,contextId:L0,tabId:G.number().int().positive()}).strict(),G.object({action:G.literal("start_video"),owner:s0,contextId:L0,tabId:G.number().int().positive(),seconds:G.number().int().min(1).max(15)}).strict(),G.object({action:G.literal("inspect_capture"),owner:s0,captureId:L0}).strict(),G.object({action:G.literal("publish_video"),input:s1}).strict(),G.object({action:G.literal("verify_png_media"),owner:s0,media:gY}).strict().refine(($)=>$.media.runId===$.owner.runId),G.object({action:G.literal("verify_saved_media"),input:o$}).strict(),G.object({action:G.literal("publish_png"),owner:s0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:G.number().int().min(24).max(8388608),storagePath:G.string().max(512),uploadUrl:G.string().url().max(8192)}).strict()]);var _6="pr-proof.stop.v1",R3=G.object({requestId:L0,command:uY}).strict();import{createHash as dY,randomUUID as lY}from"crypto";import{isDeepStrictEqual as q$}from"util";var F6=G.object({operationId:G.string().uuid(),attemptId:G.string().uuid(),contextId:G.string().uuid(),tabId:G.number().int().positive()}).strict(),B0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>dY("sha256").update($).digest("hex");function W6($){let J=s0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw B0();if(await $.assertCurrent(),X)throw B0()},B=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw B0();return M},V=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,B0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>V(D)))).some((D)=>D.status==="rejected"))throw B0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function H(U,M){let T=F6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw B0();await Y(),U.signal.throwIfAborted(),await K();let _=B(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw B0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw B0();let x=await D.completion;if(await Y(),B(T.contextId),D.controller.signal.aborted)throw B0();return structuredClone(x)}if(Q.size>=16||[...Q.values()].some((x)=>!x.receipt&&!x.controller.signal.aborted&&x.claim.tabId===T.tabId))throw B0();let j,z,F=new Promise((x,C)=>{j=x,z=C});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{V(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),B(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},R;try{await L();let x;if(M==="image"){let C=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let P=new Date().toISOString();if(await L(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw B0();x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:lY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C,finishedAt:P,sha256:C3(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),B0();await O.host.start(),O.started=!0;let C=O.host.completed();if(C.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let P=await C;if(O.stop)await O.stop;await L();let h=await O.host.read(P.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(P,h.capture)||!q$(P.owner,S)||R.length!==P.sizeBytes||C3(R)!==P.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw B0();await O.host.close(),await L(),x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:P.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:P.startedAt,finishedAt:P.finishedAt,sha256:P.sha256,media:{contentType:"video/webm",sizeBytes:P.sizeBytes,durationSeconds:P.durationSeconds,frameCount:P.frameCount,receivedFrameCount:P.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((C,P)=>C+(P.bytes?.length??0),R.length)>20971520)throw B0();return O.bytes=Buffer.from(R),O.receipt=x,j(x),structuredClone(x)}catch(x){let C=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&x instanceof Error&&x.message==="mac_recording_worker_failed:no_frames"?new g0("proof_capture_no_frames","The owned tab emitted no recording frames."):B0();throw await V(O).catch(()=>{}),z(C),C}finally{R?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw B0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw B0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw B0();return structuredClone(T)}if(Z.size>=4)throw B0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>H(U,"image"),record:(U)=>H(U,"video"),async stop(U){let M=F6.parse(U);await Y(),B(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw B0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw B0();if(B(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw B0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw B0();return B(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw B0()}}}import{createHash as z6,randomUUID as oY}from"crypto";import{isDeepStrictEqual as e$}from"util";import{realpath as eY}from"fs/promises";var L6=String.raw`async (media) => {
+`),W=T.slice(0,O);T=T.slice(O+1);try{if(!D){let L=JSON.parse(W);if(!L||Object.keys(L).length!==2||!Number.isInteger(L.port)||L.port<1024||L.port>65535||typeof L.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(L.token))throw Error("probe_receipt_invalid");D=!0,N({port:L.port,token:L.token})}else if(W==="ready")q(!0);else X()}catch{X()}}}),K.then(X);let j,z=!1;try{let F=await Promise.race([H,M]);if(!F||!B.pid||Q.signal.aborted||J.aborted)return!1;let O=Date.now()+4500,W=d1(),L={organizationId:d1(),userId:d1(),runId:d1(),deviceId:d1(),rootId:d1(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:d1(),port:F.port,expiresAtMs:O},R={binding:L,executorLaunchId:W,job:{jobId:L.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:O,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:B.pid,processGroupId:B.pid,executorLaunchId:W}}},x=O5({binding:L,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});j=await z5({binding:L,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:x,signal:Q.signal}),z=await Promise.race([U,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{z=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),j?.close(),Q.abort(),B.stdin.destroy(),!V)B.kill("SIGKILL");await K}return z&&V}import{execFileSync as d2}from"child_process";import{randomUUID as c0}from"crypto";import{chmodSync as R5,chownSync as m5,closeSync as V3,constants as T1,existsSync as JY,fstatSync as v5,mkdirSync as C5,mkdtempSync as ZY,openSync as H3,readFileSync as QY,readSync as XY,realpathSync as YY,rmdirSync as GY,rmSync as BY}from"fs";import{join as l1}from"path";import{fileURLToPath as KY}from"url";var P5=1e4,VY=!1;function l2(){if(process.platform!=="linux")return!1;return VY||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=d2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var HY=Buffer.from([0,255,3,4]);function I5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function NY($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function a$($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=u2(),{directory:Q,root:X,runtimeDirectory:Y}=MY(Z),B=new AbortController,V=()=>B.abort();$.addEventListener("abort",V,{once:!0});let K;B.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,P5),q={organization_id:c0(),user_id:c0(),device_id:c0()},H=c0(),U=c0(),M=c0(),T=c0(),_=Date.now()+P5,D={kind:"workspace_source",target_revision:0,root_grant_revision:1},j=c0().replaceAll("-",""),z,F=Buffer.alloc(0),O,W=!1,L=!1,R=!1,x=!1,C,P,h,S=async(l)=>{while(!l()){if(B.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(B.signal.aborted)throw Error("pty_probe_cancelled")},y=!1;try{K=UY(Q,Z),C=Bun.serve({hostname:"127.0.0.1",port:0,fetch(I,E){let A=new URL(I.url).pathname,b=A===`/device/hands/${j}`?"hands":A===`/device/pty/${j}`?"pty":null;if(b&&E.upgrade(I,{data:{lane:b}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(I){if(I.data.lane==="pty")z=I},message(I,E){if(I.data.lane!=="pty")return;if(typeof E==="string"){try{if(JSON.parse(E).t==="open")W=!0}catch{V()}return}if(F.length+E.length>8192){V();return}F=Buffer.concat([F,E])}}});let l=`ws://127.0.0.1:${C.port}`;if(P=N3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:H,operationId:c0(),attemptId:c0(),claimOwner:q,deviceIdentity:{deviceId:q.device_id,rootId:U,apiOrigin:"https://worker-probe.invalid"},signal:B.signal,payload:{relay_url:`${l}/device/hands/${j}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:x5,hands_worker_version:w5,hands_worker_artifact_sha256:k5,hands_worker_entrypoint:b5,target_generation:1,target_fence_id:M,environment_binding:D,[y5]:f5},emitEvent:async(I)=>{if(I==="hands.started")x=!0;if(I==="hands.ready")L=!0;if(I==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:h5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:KY(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!L)V()}),await S(()=>L),E5({root:X,runId:H,payload:{version:1,snapshot_id:T,revision:1,run_id:H,root_id:U,device_id:q.device_id,binding:{...D,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:j},git:null}}),h=S5({root:X,runId:H,rootId:U,deviceId:q.device_id,owner:q,workspace:{kind:"root"},authority:{device_id:q.device_id,binding:D.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:B.signal,session:{jobId:`pty-${c0()}`,sessionId:"pty-readiness",operationId:c0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${j}`},emit:async(I,E)=>{if(I==="pty.ready")O=E}}).catch(()=>{V()}),await S(()=>Boolean(O&&z&&W)),z.send(JSON.stringify({t:"resize",cols:100,rows:30})),z.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${j}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${I5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${I5("foreground")}; ${K.wait("foreground")}'
+`)),await S(()=>JY(l1(X,"foreground.pid"))&&F.includes(HY)),!F.includes("30 100")||O.job.environmentSnapshotId!==T||O.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((I)=>qY(l1(X,I)));if(new Set(k).size!==2||k.some((I)=>!Number.isSafeInteger(I)||I<2||I===O.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((I)=>NY(QY(`/proc/${I}/stat`,"utf8"),I,O.job.process.pid)))return!1}else{let E=d2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((A)=>A.trim().split(/\s+/).map(Number));if(E.length!==2||new Set(E.map(([A])=>A)).size!==2||E.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(z.send(JSON.stringify({t:"close"})),await h,B.signal.aborted)return!1;for(let I of[O.job.process.pid,...k])try{return process.kill(I,0),!1}catch(E){if(!(E instanceof Error&&("code"in E)&&E.code==="ESRCH"))return!1}y=!0}catch{y=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await P,await C?.stop(!0),!x||R)TY({directory:Q,root:X},Z)}return y&&R&&!$.aborted}function UY($,J){let Z={foreground:l1($,"foreground.lifeline"),background:l1($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");d2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))V3(Y)};try{for(let Y of Object.values(Z)){let B=H3(Y,T1.O_RDONLY|T1.O_NONBLOCK|T1.O_NOFOLLOW);try{if(Q.push(H3(Y,T1.O_WRONLY|T1.O_NONBLOCK|T1.O_NOFOLLOW)),!v5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{V3(B)}if(J)m5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function g5($=(J)=>a$(J)){let J=new AbortController,Z=JSON.stringify(u2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(u2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((B)=>{Y=setTimeout(B,X)})]),clearTimeout(Y)}}}function qY($){let J;try{J=H3($,T1.O_RDONLY|T1.O_NOFOLLOW|T1.O_NONBLOCK)}catch{return Number.NaN}try{let Z=v5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=XY(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{V3(J)}}function MY($,J=YY("/tmp")){let Z=ZY(l1(J,"reason-pty-probe-")),Q=l1(Z,"workspace"),X=l1(Z,"private");if(C5(Q,{mode:448}),C5(X,{mode:448}),$)R5(Z,493),R5(Q,493),m5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function TY($,J){if(J)try{d2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),GY($.root)}catch{return}BY($.directory,{recursive:!0,force:!0})}var e5=5000,p1="ARA_WORKER_PROBE_READY";function OY($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{_Y($,J,{cwd:Z,env:Q,signal:X,timeout:e5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(B,V)=>Y(!B&&!X.aborted&&V===p1))})}function AY($,J){if(U3($)==="bash")return["--noprofile","--norc","-c",J];if(U3($)==="zsh"||U3($)==="sh")return["-f","-c",J];return null}function RY($,J){let Z=s5({home:J,temporaryDirectory:J}),Q=(Y,B,V)=>OY(Y,B,$.workspaceRoot,Z,V),X=async(Y,B,V,K=(q)=>q===p1,N=!1)=>{let q=await Q6(Y,B,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:e5,signal:V});return!V.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&K(q.stdout)};return{workspaceRead:async(Y)=>{return await d5($.workspaceRoot,u5.R_OK),await p5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await d5($.workspaceRoot,u5.W_OK),Y.aborted)return!1;let B=o5(M3($.workspaceRoot,".ara-worker-probe-")),V=M3(B,"receipt");try{let K=await LY(V,"wx",384);try{await K.writeFile(p1),await K.sync()}finally{await K.close()}return await l5(V,"utf8")===p1&&!Y.aborted}finally{await jY(V).catch(()=>{}),await zY(B).catch(()=>{})}},confinedShell:(Y)=>X(Z6(),["-c",`printf ${p1}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(B)=>/^git version \S+/.test(B)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
+`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[B,V,K]=await Promise.all([DY("/proc/self/cwd"),p5("/proc/self/fd"),l5("/proc/net/tcp","utf8")]);return!Y.aborted&&B.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${p1}`],Y),jobs:(Y)=>j5($,Y),environment:(Y)=>D5($,J,Y),preview:(Y)=>A5(J,Y),boundPty:(Y)=>a$(Y),desktopDisplay:()=>J6(),desktopAutomation:async()=>{let Y=_3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
+`);return t5()},desktopBrowser:async()=>n$()?.features.browser===!0,fullControlShell:(Y)=>{let B=n5(),V=AY(B,`printf ${p1}`);return V?Q(B,V,Y):Promise.resolve(!1)}}}function _3(){return process.platform==="darwin"&&n$()?.features.computer===!0?r5():null}var F3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function CY($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3()){return i$($,J,Z,Q,X).final}function i$($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=T3(),Y,B){let V,K;try{if(q1($),d0(),!J)e(g($),!0),V=o5(M3(g($),"probe-")),J=RY($,V);K=J}catch(z){let F=Promise.reject(z);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(z,F)=>{if(Z.aborted||!F&&!K[z])return!1;let O,W=new Promise((L)=>{O=()=>L(!1)});Z.addEventListener("abort",O,{once:!0});try{return await Promise.race([F??K[z](Z),W])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",O)}},q=$.executionMode==="host",H=q?N("boundPty",Y):Promise.resolve(!1),U=Promise.resolve(B).then(()=>Promise.all(q?[N("preview"),H,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[z,F,O,W,L,R,x,C,P]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...q?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(q&&(!R||!x||!C)&&!B)await U;if(q){if(!R)R=await N("bash");if(!x)x=await N("jobs");if(!C)C=await N("environment")}return{read:z,write:F,shell:O,git:W,processes:L,bash:R,jobs:x,environment:C,full:P}})(),T=(z,F)=>{let{read:O,write:W,shell:L,git:R,processes:x,bash:C,jobs:P,environment:h,full:S}=z,{preview:y,boundPty:l,desktopDisplay:k,desktopAutomation:I,desktopBrowser:E}=F,A=a5(),b=q&&process.platform==="darwin"&&S&&FY("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":O,"fs.write":W,"inference.custom.v1":q&&O,"fs.export":O&&A,"fs.import":W&&A,"exec.run":L&&X,"git.run":L&&R&&X,"process.list":(process.platform==="linux"||L)&&x,"ports.list":(process.platform==="linux"||L)&&x,"exec.full":C&&S&&X,"hands.connect":O&&W&&C&&P,"jobs.control":O&&W&&C&&P,"pty.start":O&&W&&C&&P&&h&&l,"environment.install":O&&W&&C&&P&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&O&&W&&C&&P&&h,"tunnel.open":O&&W&&C&&P&&h&&y,"tunnel.close":O&&W&&C&&P&&h&&y,"preview.serve.v1":O&&C&&P&&y&&S,"display.stream.v1":k,"automation.call.v1":I,"simulator.call.v1":b,"simulator.stream.v1":b,"browser.pr-proof.v1":I&&E&&c5()===null,"workspace.setup.v1":q&&i5()})},_=M.then(async(z)=>T(z,{preview:!1,boundPty:await Promise.race([H,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),D=(async()=>{try{let z=await M,[F,O,W,L,R]=await U;if(q&&!O&&z.read&&z.write&&z.bash&&z.jobs&&z.environment)O=await N("boundPty");return T(z,{preview:F,boundPty:O,desktopDisplay:W,desktopAutomation:L,desktopBrowser:R})}finally{if(V)WY(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let j=(async()=>{let z=await M;if(!(z.read&&z.write&&z.bash&&z.jobs&&z.environment))return!1;return await H||(await D)["pty.start"]===!0})();return j.catch(()=>{}),{initial:_,final:D,pty:j}}var PY=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],IY=[60000,300000,900000];function q3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return PY.filter((Z)=>J[Z]!==!0)}function $6($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>CY($.config,void 0,Y,$.permissions)),Q=$.readiness,X=q3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
+`),(async()=>{for(let Y of $.delaysMs??IY){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let B;try{B=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=q3($.config,Q).filter((K)=>B[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
+`),$.onReady(Q,V);if(q3($.config,Q).length===0)return}})()}import{execFile as RG}from"child_process";import{createHash as CG,randomUUID as b3}from"crypto";import{lstat as PG,readdir as g6,readFile as a6,realpath as IG,stat as xG}from"fs/promises";import{basename as EG,join as S3}from"path";import{promisify as SG}from"util";import{createConnection as xY}from"net";import{endianness as G6}from"os";var r$=4,W3=1e4;class P1{socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=xY(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},B=EY({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let q=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:q})});return Z.write(B),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=r$){let J=G6()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=r$+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(r$,Z);this.#$=this.#$.subarray(Z),this.#B(JSON.parse(Q.toString("utf8")))}}#B($){if(!t0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),t0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class p2{client;cdp;constructor($){this.client="client"in $?$.client:new P1($),this.cdp=new V6(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=SY(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new B6(this,$)}getTabs(){return this.client.getTabs()}}class B6{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new K6(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class K6{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class V6{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(t0(Q)&&t0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return t0(Q)&&t0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";X6(Q);let X=Z.timeoutMs??W3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),B=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(t0(B)&&typeof B.errorText==="string"&&B.errorText)throw Error(`Browser failed to navigate tab ${$}: ${B.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if(Y6(K,Q))return;throw V}),B}async waitForLoadState($,J={}){let Z=J.state??"load";X6(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(Y6(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??W3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return t0(J)?{href:L3(J.href),readyState:L3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??W3;return new Promise((X,Y)=>{let B=!1,V=null,K,N=()=>{if(B)return!1;return B=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((q)=>{try{if(J(q)){if(N())X(q)}}catch(H){if(N())Y(H instanceof Error?H:Error(String(H)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=wY(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function EY($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(r$+J.length);if(G6()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,r$),Z}function t0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function SY($,J){if(!t0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function X6($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function Y6($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function wY($,J){if($.method!=="onCDPEvent"||!t0($.params))return null;let Z=$.params.source;if(!t0(Z)||Z.tabId!==J)return null;return{method:L3($.params.method)}}function L3($){return typeof $==="string"?$:void 0}import{createHash as bY}from"crypto";function H6($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${bY("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as zG}from"async_hooks";import{isDeepStrictEqual as m6}from"util";import{createHash as OG}from"crypto";var kY=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var yY=new Set(["png","jpg","jpeg","gif","webp"]),fY=new Set(["webm","mp4"]);function hY($){if(!$)return null;try{return new URL($).origin}catch{return null}}function N6($,J){let Z;try{Z=new URL($)}catch{return null}let Q=hY(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=kY.exec(Z.pathname);if(!Y)return null;let B=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!B||!V||!K||!N)return null;let q=yY.has(N)?"image":fY.has(N)?"video":null;if(!q)return null;let H=/^(before|after)[\s:_-]+/.exec(K),U=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:U,runId:B,artifactId:V,fileName:`${K}.${N}`,kind:q,phase:H?.[1]==="before"||H?.[1]==="after"?H[1]:null}}var mY=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,c2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),c1=()=>{throw Error("cloud_browser_media_request_invalid")};function s2($){if(!c2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!mY.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return c1();let J;try{J=new URL($.configuredMediaOrigin)}catch{return c1()}if(J.protocol!=="https:"||J.username||J.password||J.port||!U6(J.origin,{mode:"public_web"}).allowed)return c1();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!c2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return c1();let B=N6(Y.url,J.origin);if(!B||new URL(B.url).origin!==J.origin||B.runId!==Z||B.kind!==Y.kind||B.url!==Y.url||Q.has(Y.url))return c1();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return c1()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return c1()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function q6($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!c2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let B=J.media[Y];if(!c2(X)||X.url!==B.url||X.sourceUrl!==B.sourceUrl||X.kind!==B.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||B.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...B,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...B.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var j3="browser.pr-proof.v1",L0=G.string().uuid(),H$=G.string().regex(/^[a-f0-9]{64}$/),a1=G.iso.datetime({precision:3}),D3=G.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),T6=G.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),s0=G.object({kind:G.literal("primary_mac"),version:G.literal(1),organizationId:D3,userId:D3,sessionId:D3,runId:L0,deviceId:L0,rootId:L0,rootRevision:G.string().min(1).max(64),binding:G.enum(["workspace_source","mcp_control"]),targetRevision:G.number().int().nonnegative(),generation:L0,profile:G.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:G.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),vY=G.custom().transform(($,J)=>{try{return M6($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),G.NEVER}}),N$=G.object({version:G.literal(1),owner:s0,contextId:L0,preparedAt:a1,expiresAt:a1,prUrl:T6,headSha:G.string().regex(/^[a-f0-9]{40}$/),skillDigest:H$,evidenceKind:G.enum(["image","video"]),visualPlan:vY.optional(),uploadOrigin:G.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),z3=G.object({version:G.literal(1),producer:G.literal("primary_mac"),context:N$,captureId:L0,operationId:L0,attemptId:L0,tabId:G.number().int().positive(),startedAt:a1,finishedAt:a1,sha256:H$,media:G.discriminatedUnion("contentType",[G.object({contentType:G.literal("image/png"),sizeBytes:G.number().int().min(24).max(8388608),width:G.number().int().min(1).max(4096),height:G.number().int().min(1).max(4096)}).strict(),G.object({contentType:G.literal("video/webm"),sizeBytes:G.number().int().min(128).max(10485760),durationSeconds:G.number().min(0.05).max(15),frameCount:G.number().int().min(1).max(450),receivedFrameCount:G.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),zM=G.discriminatedUnion("action",[G.object({action:G.literal("screenshot"),context_id:L0,tab_id:G.number().int().positive()}).strict(),G.object({action:G.literal("start_video"),context_id:L0,tab_id:G.number().int().positive(),seconds:G.number().int().min(1).max(15)}).strict(),G.object({action:G.literal("stop_video"),recording_operation_id:L0}).strict()]),i2=G.object({login:G.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:G.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),a2=G.string().regex(/^[1-9][0-9]{0,19}$/),t$=G.object({version:G.literal(1),owner:s0,expectedActorId:a2.nullable(),repositoryId:a2,repositoryFullName:G.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),gY=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],O3=G.discriminatedUnion("status",[t$.extend({status:G.literal("ready"),observedActor:i2,checkedAt:a1}),t$.extend({status:G.literal("not_ready"),reason:G.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:G.enum(gY).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),s1=G.object({version:G.literal(1),owner:s0,expectedActorId:a2.nullable(),authenticatedActor:i2,attemptId:L0,captureId:L0,prUrl:T6,repositoryId:a2,headSha:G.string().regex(/^[a-f0-9]{40}$/),sha256:H$,sizeBytes:G.number().int().min(128).max(10485760),contentType:G.literal("video/webm")}).strict(),_6=G.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),U$=G.discriminatedUnion("status",[s1.extend({status:G.literal("not_attempted"),reason:G.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),s1.extend({status:G.literal("uncertain"),reason:G.literal("upload_outcome_unknown")}),s1.extend({status:G.literal("uploaded"),observedActor:i2,nativeUrl:_6,uploadedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),o$=s1.extend({nativeUrl:_6,observedActor:i2,bodySha256:H$}),A3=G.discriminatedUnion("status",[o$.extend({status:G.literal("incomplete"),reason:G.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),o$.extend({status:G.literal("verified"),sourceSha256:H$,width:G.number().int().min(1).max(4096),height:G.number().int().min(1).max(4096),durationSeconds:G.number().positive().max(30),advancedSeconds:G.number().min(0.05).max(10),advancedFrames:G.number().int().positive(),playbackRestored:G.literal(!0),verifiedAt:a1})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),uY=G.custom().transform(($,J)=>{try{let Z=s2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),G.NEVER}}),dY=G.discriminatedUnion("action",[G.object({action:G.literal("auth_check"),input:t$}).strict(),G.object({action:G.literal("prepare"),context:N$}).strict(),G.object({action:G.literal("capture_png"),owner:s0,contextId:L0,tabId:G.number().int().positive()}).strict(),G.object({action:G.literal("start_video"),owner:s0,contextId:L0,tabId:G.number().int().positive(),seconds:G.number().int().min(1).max(15)}).strict(),G.object({action:G.literal("inspect_capture"),owner:s0,captureId:L0}).strict(),G.object({action:G.literal("publish_video"),input:s1}).strict(),G.object({action:G.literal("verify_png_media"),owner:s0,media:uY}).strict().refine(($)=>$.media.runId===$.owner.runId),G.object({action:G.literal("verify_saved_media"),input:o$}).strict(),G.object({action:G.literal("publish_png"),owner:s0,attemptId:L0,captureId:L0,sha256:H$,sizeBytes:G.number().int().min(24).max(8388608),storagePath:G.string().max(512),uploadUrl:G.string().url().max(8192)}).strict()]);var F6="pr-proof.stop.v1",R3=G.object({requestId:L0,command:dY}).strict();import{createHash as lY,randomUUID as pY}from"crypto";import{isDeepStrictEqual as q$}from"util";var W6=G.object({operationId:G.string().uuid(),attemptId:G.string().uuid(),contextId:G.string().uuid(),tabId:G.number().int().positive()}).strict(),B0=()=>Error("mac_pr_proof_capture_unavailable"),C3=($)=>lY("sha256").update($).digest("hex");function L6($){let J=s0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw B0();if(await $.assertCurrent(),X)throw B0()},B=(U)=>{let M=Z.get(U);if(!M||Date.parse(M.expiresAt)<=Date.now())throw B0();return M},V=(U)=>U.disposal??=(async()=>{U.controller.abort(),U.bytes?.fill(0),U.bytes=void 0,U.receipt=void 0;try{await U.host?.close()}catch{throw X=!0,B0()}})(),K=async()=>{for(let[U,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,D])=>D.claim.contextId===U);if((await Promise.allSettled(T.map(([,D])=>V(D)))).some((D)=>D.status==="rejected"))throw B0();for(let[D]of T)Q.delete(D);Z.delete(U)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let q=(U)=>{if(U.stopRequested=!0,U.started&&U.host&&!U.stop)U.stop=U.host.stop(),U.stop.catch(()=>U.controller.abort())};async function H(U,M){let T=W6.parse(U.claim);if(M==="video"&&(!Number.isInteger(U.seconds)||U.seconds<1||U.seconds>15))throw B0();await Y(),U.signal.throwIfAborted(),await K();let _=B(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw B0();let D=Q.get(T.operationId);if(D){if(!q$(D.claim,T)||D.kind!==M||D.seconds!==U.seconds||D.controller.signal.aborted)throw B0();let x=await D.completion;if(await Y(),B(T.contextId),D.controller.signal.aborted)throw B0();return structuredClone(x)}if(Q.size>=16||[...Q.values()].some((x)=>!x.receipt&&!x.controller.signal.aborted&&x.claim.tabId===T.tabId))throw B0();let j,z,F=new Promise((x,C)=>{j=x,z=C});F.catch(()=>{});let O={claim:T,kind:M,seconds:U.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,O);let W=()=>{V(O).catch(()=>{})};U.signal.addEventListener("abort",W,{once:!0});let L=async()=>{await Y(),B(T.contextId),U.signal.throwIfAborted(),O.controller.signal.throwIfAborted()},R;try{await L();let x;if(M==="image"){let C=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,O.controller.signal);let P=new Date().toISOString();if(await L(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw B0();x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:pY(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C,finishedAt:P,sha256:C3(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(O.host=await $.createVideo(structuredClone(_),T.tabId,U.seconds,O.controller.signal),O.controller.signal.aborted||U.signal.aborted||X)throw await O.host.close(),B0();await O.host.start(),O.started=!0;let C=O.host.completed();if(C.catch(()=>{}),await L(),await U.started?.(),O.stopRequested)q(O);let P=await C;if(O.stop)await O.stop;await L();let h=await O.host.read(P.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q$(P,h.capture)||!q$(P.owner,S)||R.length!==P.sizeBytes||C3(R)!==P.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw B0();await O.host.close(),await L(),x=z3.parse({version:1,producer:"primary_mac",context:_,captureId:P.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:P.startedAt,finishedAt:P.finishedAt,sha256:P.sha256,media:{contentType:"video/webm",sizeBytes:P.sizeBytes,durationSeconds:P.durationSeconds,frameCount:P.frameCount,receivedFrameCount:P.receivedFrameCount}})}if(await L(),[...Q.values()].reduce((C,P)=>C+(P.bytes?.length??0),R.length)>20971520)throw B0();return O.bytes=Buffer.from(R),O.receipt=x,j(x),structuredClone(x)}catch(x){let C=M==="video"&&!U.signal.aborted&&!O.controller.signal.aborted&&x instanceof Error&&x.message==="mac_recording_worker_failed:no_frames"?new g0("proof_capture_no_frames","The owned tab emitted no recording frames."):B0();throw await V(O).catch(()=>{}),z(C),C}finally{R?.fill(0),U.signal.removeEventListener("abort",W)}}return{async prepare(U){let M=N$.parse(U);if(!q$(M.owner,J))throw B0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw B0();let T=Z.get(M.contextId);if(T){if(!q$(T,M))throw B0();return structuredClone(T)}if(Z.size>=4)throw B0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(U)=>H(U,"image"),record:(U)=>H(U,"video"),async stop(U){let M=W6.parse(U);await Y(),B(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!q$(M,T.claim)||T.controller.signal.aborted)throw B0();q(T)},async publicationCapture(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw B0();if(B(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||C3(M.bytes)!==M.receipt.sha256)throw B0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(U){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===U);if(!M?.receipt||M.controller.signal.aborted)throw B0();return B(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let U=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),U.some((M)=>M.status==="rejected"))throw B0()}}}import{createHash as O6,randomUUID as eY}from"crypto";import{isDeepStrictEqual as e$}from"util";import{realpath as $G}from"fs/promises";var D6=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -73,24 +73,24 @@ ${J?.directory??g($)}`).digest("hex")}function S$($,J){c(f0(g($),w$),{version:1,
     }
   }));
   return { verified: true, items };
-}`;var D6=function($){let J=this??globalThis,Z=10485760,Q=(B,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===B.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==B.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,H={login:K,id:q};if(B.expectedActorId!==null&&q!==B.expectedActorId||B.authenticatedActor&&(K!==B.authenticatedActor.login||q!==B.authenticatedActor.id)||B.observedActor&&(K!==B.observedActor.login||q!==B.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==B.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==B.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(B.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==B.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:H}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let B=$.expected,V=Q(B,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==B.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],B.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let H=J.document.querySelector("#fc-new_comment_field");if(!H)return{dispatched:!1,reason:"attachment_unavailable"};return H.files=q.files,H.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let B=Q($.expected,!1);if(!B.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:B.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let B=X.nativeUrl.split("/").pop(),V=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+B+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(V));if(q.length!==1)throw Error("saved_player_missing");let H=q[0],U={muted:H.muted,volume:H.volume,rate:H.playbackRate,preload:H.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(H.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(H.muted=!0,H.playbackRate=1,H.currentTime=0,H.readyState<2)H.preload="auto",H.load();await D(()=>H.readyState>=2&&H.videoWidth>0&&H.videoHeight>0);let j=H.currentSrc;if(!V(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!V(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let y=await _(O.read());if(y.done)break;if(L+=y.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(y.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(L),x=0;for(let y of W)R.set(y,x),x+=y.length;let C=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((y)=>y.toString(16).padStart(2,"0")).join("");if(C!==X.sha256||H.currentSrc!==j||!N.contains(H))throw Error("source_changed");let P=H.currentTime,h=H.getVideoPlaybackQuality().totalVideoFrames;if(await _(H.play()),await D(()=>H.currentTime-P>=0.05&&H.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||H.currentSrc!==j||!N.contains(H)||H.error)throw Error("player_changed");return{status:"verified",sourceSha256:C,width:H.videoWidth,height:H.videoHeight,durationSeconds:H.duration,advancedSeconds:H.currentTime-P,advancedFrames:H.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),H.pause(),H.currentTime=0,H.muted=U.muted,H.volume=U.volume,H.playbackRate=U.rate,H.preload=U.preload,!H.paused||H.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as pY}from"child_process";import{lstat as cY,realpath as sY}from"fs/promises";import{join as j6,resolve as aY}from"path";import{promisify as iY}from"util";var nY=iY(pY);async function rY($,J){let Z=await sY($),{stdout:Q}=await nY(j6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return G.array(G.object({browser:G.string(),directory:G.string(),connected:G.boolean().optional(),source:G.string(),socketPath:G.string().optional(),instanceId:G.string().optional(),extensionId:G.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&aY(Y.source)===j6(Z,"Reason Browser Use","manifest.json"))}async function n2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await rY($,Z)).filter((B)=>B.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await cY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as tY}from"crypto";function M$($){return`reason-browser-${tY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var O6=G.discriminatedUnion("ok",[G.object({ok:G.literal(!0),actor:G.object({login:G.string(),id:G.string().nullable()}).strict()}).strict(),G.object({ok:G.literal(!1),reason:G.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),A6=G.object({version:G.literal("0.1.42"),metadata:G.object({extensionId:G.string(),extensionInstanceId:G.string(),nativeHostName:G.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function P3($){let J=s0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await $G($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${oY()}`,Y=!1,B=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(q)=>{if(!e$(J,q.owner))throw Z0();await B()},K=async(q)=>{await V(q);let H=await $.readVideo(q.captureId);try{await B();let U=H.capture;if(!e$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||H.bytes.length!==q.sizeBytes||H.bytes.length<128||H.bytes.length>10485760||H.bytes.readUInt32BE(0)!==440786851||z6("sha256").update(H.bytes).digest("hex")!==q.sha256)throw Z0();return H}catch(U){throw H.bytes.fill(0),U}};async function N(q,H,U){await B();let M=await Z.discover(AbortSignal.timeout(5000)),T=new p2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await B(),D)throw Z0()};try{await F(T.connect());let W=A6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((C)=>{if(D)C.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let x=await F(H(_,async(C)=>{await O();let P=await F(_.evaluate(`(${D6.toString()})(${JSON.stringify(C)})`,{awaitPromise:!0}));return await O(),P},O));return await O(),x}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,R)=>{W=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await B()}}return{async screenshot(q,H,U){let M=N$.parse(q);if(await V(M),!Number.isSafeInteger(H)||H<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new p2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=A6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!G.array(G.object({id:G.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===H))throw Z0();await B(),U.throwIfAborted();let F=G.object({data:G.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(H,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await B(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let H=s2(q);if(H.runId!==J.runId||H.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(H.media.map((C)=>C.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,R=(C,P)=>{if(L.size>=32){F=!0;return}let h=_.executeCdp(U.id,C,P);L.add(h),h.catch(()=>{F=!0}).finally(()=>L.delete(h))},x=_.onNotification((C)=>{if(C.method!=="onCDPEvent"||!n0(C.params)||!n0(C.params.source)||C.params.source.tabId!==U.id||!n0(C.params.params))return;let P=C.params.params;if(++O>512){F=!0;return}if(C.params.method==="Fetch.requestPaused"){let y=typeof P.requestId==="string"&&n0(P.request)&&P.request.method==="GET"&&typeof P.request.url==="string"&&D.has(P.request.url)&&P.resourceType==="Image";if(typeof P.requestId!=="string"){F=!0;return}if(!y)F=!0;R(y?"Fetch.continueRequest":"Fetch.failRequest",{requestId:P.requestId,...y?{}:{errorReason:"BlockedByClient"}})}if(C.params.method==="Network.requestWillBeSent"&&P.redirectResponse)F=!0;if(C.params.method==="Network.loadingFailed")F=!0;if(C.params.method==="Network.loadingFinished"&&typeof P.requestId==="string")z.add(P.requestId);if(C.params.method!=="Network.responseReceived")return;if(!n0(P.response)||typeof P.response.url!=="string"||!D.has(P.response.url)||typeof P.requestId!=="string"||!n0(P.response.headers)||P.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(P.response.headers).map(([y,l])=>[y.toLowerCase(),l])),S=Number(h["content-length"]);if(j.has(P.response.url)||P.response.status!==200||P.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}j.set(P.response.url,{id:P.requestId,length:S})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let C=G.object({frameTree:G.object({frame:G.object({id:G.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),P=[...new Set(H.media.map((y)=>new URL(y.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:C.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${P}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new g0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await U.evaluate(`(${L6})(${JSON.stringify(H.media)})`,{awaitPromise:!0})}catch{throw new g0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!n0(h)||!Array.isArray(h.items)||h.items.length!==H.media.length)throw Z0();await Promise.all(L);let S=[];for(let y=0;y<H.media.length;y++){await B();let l=j.get(H.media[y].sourceUrl);if(F||!l||!z.has(l.id))throw Z0();let k=G.object({base64Encoded:G.literal(!0),body:G.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:l.id})),I=Buffer.from(k.body,"base64");try{let E=h.items[y];if(I.length!==l.length||I.toString("base64")!==k.body||!n0(E))throw Z0();S.push({...E,sourceSha256:z6("sha256").update(I).digest("hex")})}finally{I.fill(0)}}if(F)throw Z0();return U6({verified:!0,items:S},H)}finally{if(x(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new g0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let H=t$.parse(q);await V(H);let U="browser_unavailable";try{return await N(`https://github.com/${H.repositoryFullName}`,async(M,T)=>{let _=O6.parse(await T({operation:"preflight",expected:{...H,prUrl:`https://github.com/${H.repositoryFullName}`}}));return O3.parse(_.ok?{...H,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...H,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...H,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...H,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let H=s1.parse(q);if(await V(H),H.expectedActorId!==null&&H.authenticatedActor.id!==H.expectedActorId)throw Z0();let U=Q.get(H.attemptId);if(U){if(!e$(U.binding,H))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(H),result:U$.parse({...H,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(H.attemptId,M);let T=!1,_="dispatch";try{(await K(H)).bytes.fill(0),M.result=await N(H.prUrl,async(D,j)=>{let z=O6.parse(await j({operation:"identity",expected:H}));if(!z.ok)return U$.parse({...H,status:"not_attempted",reason:z.reason});let F=await K(H),O;try{T=!0,O=G.discriminatedUnion("dispatched",[G.object({dispatched:G.literal(!0),actor:G.object({login:G.string(),id:G.string().nullable()}).strict()}).strict(),G.object({dispatched:G.literal(!1),reason:G.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:H,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...H,status:"not_attempted",reason:O.reason});if(!e$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...H,observedActor:z.actor}});if(L!==null){let R=G.object({nativeUrl:G.string(),actor:G.object({login:G.string(),id:G.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await B(),U$.parse({...H,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
-`);M.result=U$.parse({...H,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let H=o$.parse(q);await V(H);try{return(await K(H)).bytes.fill(0),await N(H.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:H});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...H,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(H).some(([D,j])=>!e$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...H,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function $G($,J){let Z=await eY($);return{async discover(Q){let X=await n2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as DG}from"fs/promises";var eM=G.object({version:G.literal(1),recording_operation_id:G.string().uuid(),proof_ready:G.literal(!1),acknowledged_at:G.iso.datetime()}).strict(),r2=G.object({action:G.literal("start"),request_id:G.string().uuid(),profile:G.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:G.number().int().positive(),seconds:G.number().int().min(1).max(15)}).strict(),R6=G.object({action:G.literal("inspect"),recording_operation_id:G.string().uuid()}).strict(),$T=G.discriminatedUnion("action",[r2,R6]),C6=G.object({recording_operation_id:G.string().uuid()}).strict(),I3={device_id:G.string().uuid(),root_id:G.string().uuid()},JG=G.discriminatedUnion("action",[r2.extend(I3),R6.extend(I3),C6.extend({...I3,action:G.literal("stop")})]),JT=G.toJSONSchema(JG),ZT=G.object({version:G.literal(1),recordingId:G.string().uuid(),proofReady:G.literal(!1),capture:G.object({captureId:G.string().uuid(),contentType:G.literal("video/webm"),sha256:G.string().regex(/^[a-f0-9]{64}$/),sizeBytes:G.number().int().min(128).max(10485760),startedAt:G.iso.datetime(),finishedAt:G.iso.datetime(),durationSeconds:G.number().min(0.05).max(15),frameCount:G.number().int().min(1).max(450),receivedFrameCount:G.number().int().min(1).max(2000),owner:G.object({runId:G.string().uuid(),deviceId:G.string().uuid(),rootId:G.string().uuid(),rootRevision:G.string().max(64),profile:G.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:G.string().min(1).max(1024),generation:G.string().uuid(),browserScope:G.string().max(128),tabId:G.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var UT=r2.extend({action:G.enum(["start","inspect"]),recording_boot_generation:G.string().uuid(),recording_operation_id:G.string().uuid().optional(),recording_attempt_id:G.string().uuid().optional()}).strict();import{createHash as NG,randomUUID as UG}from"crypto";import{mkdtemp as qG,realpath as MG,rm as k6}from"fs/promises";import{tmpdir as TG}from"os";import{join as _G}from"path";import{spawn as FG}from"child_process";import{isDeepStrictEqual as WG}from"util";import{createHash as ZG}from"crypto";import{execFile as QG}from"child_process";import{chmod as XG,lstat as I6,mkdtemp as YG,readFile as x6,realpath as E6,rm as GG,writeFile as P6}from"fs/promises";import{tmpdir as BG}from"os";import{isAbsolute as KG,join as t2}from"path";import{promisify as VG}from"util";var x3=VG(QG),HG=($)=>ZG("sha256").update($).digest("hex");async function X1($){if(!KG($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await E6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await I6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||HG(await x6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function $2($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([X1(Z.ffmpeg),X1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([X1(Z.ffmpeg),X1(Z.ffprobe)]);let B=await E6(await YG(t2(J??BG(),"reason-owned-recording-")));await XG(B,448);let V=t2(B,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await P6(t2(B,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await P6(t2(B,"frames.ffconcat"),N.join(`
+}`;var j6=function($){let J=this??globalThis,Z=10485760,Q=(B,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===B.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==B.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),q=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,H={login:K,id:q};if(B.expectedActorId!==null&&q!==B.expectedActorId||B.authenticatedActor&&(K!==B.authenticatedActor.login||q!==B.authenticatedActor.id)||B.observedActor&&(K!==B.observedActor.login||q!==B.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==B.repositoryId)return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('link[rel="canonical"]');if(U&&U.href!==B.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),D=M?.closest("form"),j=new J.URL(B.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==B.repositoryId||!D||new J.URL(D.action,J.location.href).origin!=="https://github.com"||new J.URL(D.action,J.location.href).pathname!==j)return{ok:!1,reason:"attachment_unavailable"};let z=_.getAttribute("data-upload-policy-url");if(!z||new J.URL(z,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:H}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let B=$.expected,V=Q(B,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(U)=>U.charCodeAt(0));if(K.length!==B.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],B.captureId+".webm",{type:"video/webm"}),q=new J.DataTransfer;q.items.add(N);let H=J.document.querySelector("#fc-new_comment_field");if(!H)return{dispatched:!1,reason:"attachment_unavailable"};return H.files=q.files,H.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let B=Q($.expected,!1);if(!B.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:B.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let B=X.nativeUrl.split("/").pop(),V=(j)=>{try{let z=new J.URL(j,J.location.href);if(z.protocol!=="https:"||z.username||z.password||z.port||z.hash)return!1;if(z.origin==="https://github.com")return z.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(z.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+B+"\\.(webm|mp4)$").test(z.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((j)=>/^issue-[1-9][0-9]*$/.test(j.closest('[id^="issue-"]')?.id||"")&&!j.closest("form")&&!j.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],q=[...N.querySelectorAll("video")].filter((j)=>[j.currentSrc,j.src,...[...j.querySelectorAll("source")].map((z)=>z.src)].some(V));if(q.length!==1)throw Error("saved_player_missing");let H=q[0],U={muted:H.muted,volume:H.volume,rate:H.playbackRate,preload:H.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(j)=>J.Promise.race([j,new J.Promise((z,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),D=async(j)=>{while(!j()){if(H.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((z)=>J.setTimeout(z,25))}};try{if(H.muted=!0,H.playbackRate=1,H.currentTime=0,H.readyState<2)H.preload="auto",H.load();await D(()=>H.readyState>=2&&H.videoWidth>0&&H.videoHeight>0);let j=H.currentSrc;if(!V(j))throw Error("source_unbound");let z=await _(J.fetch(j,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(z.status!==200||!V(z.url)||z.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(z.headers.get("content-type")||"")||!z.body)throw Error("source_unverifiable");let F=z.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let O=z.body.getReader(),W=[],L=0;try{for(;;){let y=await _(O.read());if(y.done)break;if(L+=y.value.length,L>10485760||L>X.sizeBytes)throw Error("source_too_large");W.push(y.value)}}finally{await O.cancel().catch(()=>{}),O.releaseLock()}if(L!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(L),x=0;for(let y of W)R.set(y,x),x+=y.length;let C=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((y)=>y.toString(16).padStart(2,"0")).join("");if(C!==X.sha256||H.currentSrc!==j||!N.contains(H))throw Error("source_changed");let P=H.currentTime,h=H.getVideoPlaybackQuality().totalVideoFrames;if(await _(H.play()),await D(()=>H.currentTime-P>=0.05&&H.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||H.currentSrc!==j||!N.contains(H)||H.error)throw Error("player_changed");return{status:"verified",sourceSha256:C,width:H.videoWidth,height:H.videoHeight,durationSeconds:H.duration,advancedSeconds:H.currentTime-P,advancedFrames:H.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),H.pause(),H.currentTime=0,H.muted=U.muted,H.volume=U.volume,H.playbackRate=U.rate,H.preload=U.preload,!H.paused||H.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as cY}from"child_process";import{lstat as sY,realpath as aY}from"fs/promises";import{join as z6,resolve as iY}from"path";import{promisify as nY}from"util";var rY=nY(cY);async function tY($,J){let Z=await aY($),{stdout:Q}=await rY(z6(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return G.array(G.object({browser:G.string(),directory:G.string(),connected:G.boolean().optional(),source:G.string(),socketPath:G.string().optional(),instanceId:G.string().optional(),extensionId:G.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&iY(Y.source)===z6(Z,"Reason Browser Use","manifest.json"))}async function n2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await tY($,Z)).filter((B)=>B.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await sY(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as oY}from"crypto";function M$($){return`reason-browser-${oY("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var A6=G.discriminatedUnion("ok",[G.object({ok:G.literal(!0),actor:G.object({login:G.string(),id:G.string().nullable()}).strict()}).strict(),G.object({ok:G.literal(!1),reason:G.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),R6=G.object({version:G.literal("0.1.42"),metadata:G.object({extensionId:G.string(),extensionInstanceId:G.string(),nativeHostName:G.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function P3($){let J=s0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await JG($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${eY()}`,Y=!1,B=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(q)=>{if(!e$(J,q.owner))throw Z0();await B()},K=async(q)=>{await V(q);let H=await $.readVideo(q.captureId);try{await B();let U=H.capture;if(!e$(U.context.owner,J)||U.captureId!==q.captureId||U.context.prUrl!==q.prUrl||U.context.headSha!==q.headSha||U.media.contentType!=="video/webm"||U.media.sizeBytes!==q.sizeBytes||U.sha256!==q.sha256||H.bytes.length!==q.sizeBytes||H.bytes.length<128||H.bytes.length>10485760||H.bytes.readUInt32BE(0)!==440786851||O6("sha256").update(H.bytes).digest("hex")!==q.sha256)throw Z0();return H}catch(U){throw H.bytes.fill(0),U}};async function N(q,H,U){await B();let M=await Z.discover(AbortSignal.timeout(5000)),T=new p2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,D=!1,j,z=new Promise((W,L)=>{j=setTimeout(()=>{D=!0,L(Z0())},60000)});z.catch(()=>{});let F=(W)=>Promise.race([W,z]),O=async()=>{if(D)throw Z0();if(await B(),D)throw Z0()};try{await F(T.connect());let W=R6.parse(await F(T.client.getInfo()));if(W.metadata.extensionId!==M.extensionId||W.metadata.extensionInstanceId!==M.instanceId||!W.metadata.nativeHostName)throw Z0();await O(),U?.("connected");let L=T.newTab();L.then((C)=>{if(D)C.close().catch(()=>{Y=!0})},()=>{}),_=await F(L),await O(),await F(_.goto(q,{waitUntil:"domcontentloaded",timeoutMs:15000})),await O(),U?.("loaded");let x=await F(H(_,async(C)=>{await O();let P=await F(_.evaluate(`(${j6.toString()})(${JSON.stringify(C)})`,{awaitPromise:!0}));return await O(),P},O));return await O(),x}finally{D=!0,clearTimeout(j);try{if(_){let W;try{await Promise.race([_.close(),new Promise((L,R)=>{W=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(W)}}}catch{throw Y=!0,Z0()}finally{T.close()}await B()}}return{async screenshot(q,H,U){let M=N$.parse(q);if(await V(M),!Number.isSafeInteger(H)||H<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();U.throwIfAborted();let T=await Z.discover(U),_=new p2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),D;try{await _.connect();let j=R6.parse(await _.client.getInfo());if(j.metadata.extensionId!==T.extensionId||j.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!G.array(G.object({id:G.number()})).max(256).parse(await _.getTabs()).some((O)=>O.id===H))throw Z0();await B(),U.throwIfAborted();let F=G.object({data:G.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(H,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(D=Buffer.from(F.data,"base64"),D.toString("base64")!==F.data||D.length>8388608)throw Z0();if(await B(),U.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return D}catch{throw D?.fill(0),Z0()}finally{_.close()}},async verifyImages(q){let H=s2(q);if(H.runId!==J.runId||H.media.some((U)=>U.kind!=="image"))throw Z0();return N("about:blank",async(U,M,T)=>{let _=U.browser.client,D=new Set(H.media.map((C)=>C.sourceUrl)),j=new Map,z=new Set,F=!1,O=0,W=!1,L=new Set,R=(C,P)=>{if(L.size>=32){F=!0;return}let h=_.executeCdp(U.id,C,P);L.add(h),h.catch(()=>{F=!0}).finally(()=>L.delete(h))},x=_.onNotification((C)=>{if(C.method!=="onCDPEvent"||!n0(C.params)||!n0(C.params.source)||C.params.source.tabId!==U.id||!n0(C.params.params))return;let P=C.params.params;if(++O>512){F=!0;return}if(C.params.method==="Fetch.requestPaused"){let y=typeof P.requestId==="string"&&n0(P.request)&&P.request.method==="GET"&&typeof P.request.url==="string"&&D.has(P.request.url)&&P.resourceType==="Image";if(typeof P.requestId!=="string"){F=!0;return}if(!y)F=!0;R(y?"Fetch.continueRequest":"Fetch.failRequest",{requestId:P.requestId,...y?{}:{errorReason:"BlockedByClient"}})}if(C.params.method==="Network.requestWillBeSent"&&P.redirectResponse)F=!0;if(C.params.method==="Network.loadingFailed")F=!0;if(C.params.method==="Network.loadingFinished"&&typeof P.requestId==="string")z.add(P.requestId);if(C.params.method!=="Network.responseReceived")return;if(!n0(P.response)||typeof P.response.url!=="string"||!D.has(P.response.url)||typeof P.requestId!=="string"||!n0(P.response.headers)||P.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(P.response.headers).map(([y,l])=>[y.toLowerCase(),l])),S=Number(h["content-length"]);if(j.has(P.response.url)||P.response.status!==200||P.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}j.set(P.response.url,{id:P.requestId,length:S})});try{await _.executeCdp(U.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(U.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(U.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(U.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let C=G.object({frameTree:G.object({frame:G.object({id:G.string().min(1).max(256)})})}).parse(await _.executeCdp(U.id,"Page.getFrameTree",{})),P=[...new Set(H.media.map((y)=>new URL(y.sourceUrl).origin))].join(" ");await _.executeCdp(U.id,"Page.setDocumentContent",{frameId:C.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${P}; style-src 'none'"><body></body>`}),await T(),W=!0;try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new g0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await U.evaluate(`(${D6})(${JSON.stringify(H.media)})`,{awaitPromise:!0})}catch{throw new g0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!n0(h)||!Array.isArray(h.items)||h.items.length!==H.media.length)throw Z0();await Promise.all(L);let S=[];for(let y=0;y<H.media.length;y++){await B();let l=j.get(H.media[y].sourceUrl);if(F||!l||!z.has(l.id))throw Z0();let k=G.object({base64Encoded:G.literal(!0),body:G.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(U.id,"Network.getResponseBody",{requestId:l.id})),I=Buffer.from(k.body,"base64");try{let E=h.items[y];if(I.length!==l.length||I.toString("base64")!==k.body||!n0(E))throw Z0();S.push({...E,sourceSha256:O6("sha256").update(I).digest("hex")})}finally{I.fill(0)}}if(F)throw Z0();return q6({verified:!0,items:S},H)}finally{if(x(),await Promise.allSettled(L),W)try{await _.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new g0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(q){let H=t$.parse(q);await V(H);let U="browser_unavailable";try{return await N(`https://github.com/${H.repositoryFullName}`,async(M,T)=>{let _=A6.parse(await T({operation:"preflight",expected:{...H,prUrl:`https://github.com/${H.repositoryFullName}`}}));return O3.parse(_.ok?{...H,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...H,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...H,status:"not_ready",reason:_.reason})},(M)=>{U=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return O3.parse({...H,status:"not_ready",reason:"unavailable",cause:U})}},async publish(q){let H=s1.parse(q);if(await V(H),H.expectedActorId!==null&&H.authenticatedActor.id!==H.expectedActorId)throw Z0();let U=Q.get(H.attemptId);if(U){if(!e$(U.binding,H))throw Z0();return structuredClone(U.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(H),result:U$.parse({...H,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(H.attemptId,M);let T=!1,_="dispatch";try{(await K(H)).bytes.fill(0),M.result=await N(H.prUrl,async(D,j)=>{let z=A6.parse(await j({operation:"identity",expected:H}));if(!z.ok)return U$.parse({...H,status:"not_attempted",reason:z.reason});let F=await K(H),O;try{T=!0,O=G.discriminatedUnion("dispatched",[G.object({dispatched:G.literal(!0),actor:G.object({login:G.string(),id:G.string().nullable()}).strict()}).strict(),G.object({dispatched:G.literal(!1),reason:G.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await j({operation:"upload",expected:H,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!O.dispatched)return T=!1,U$.parse({...H,status:"not_attempted",reason:O.reason});if(!e$(O.actor,z.actor))throw _="actor_changed",Z0();_="result";let W=performance.now();while(performance.now()-W<30000){let L=await j({operation:"upload_result",expected:{...H,observedActor:z.actor}});if(L!==null){let R=G.object({nativeUrl:G.string(),actor:G.object({login:G.string(),id:G.string().nullable()}).strict()}).strict().parse(L);return _="finalize",await B(),U$.parse({...H,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
+`);M.result=U$.parse({...H,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(q){let H=o$.parse(q);await V(H);try{return(await K(H)).bytes.fill(0),await N(H.prUrl,async(U,M)=>{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:H});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=A3.parse({...H,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(H).some(([D,j])=>!e$(j,_[D])))throw Z0();return _}finally{await U.browser.client.executeCdp(U.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return A3.parse({...H,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function JG($,J){let Z=await $G($);return{async discover(Q){let X=await n2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:M$(J.runId)}}import{realpath as jG}from"fs/promises";var JT=G.object({version:G.literal(1),recording_operation_id:G.string().uuid(),proof_ready:G.literal(!1),acknowledged_at:G.iso.datetime()}).strict(),r2=G.object({action:G.literal("start"),request_id:G.string().uuid(),profile:G.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:G.number().int().positive(),seconds:G.number().int().min(1).max(15)}).strict(),C6=G.object({action:G.literal("inspect"),recording_operation_id:G.string().uuid()}).strict(),ZT=G.discriminatedUnion("action",[r2,C6]),P6=G.object({recording_operation_id:G.string().uuid()}).strict(),I3={device_id:G.string().uuid(),root_id:G.string().uuid()},ZG=G.discriminatedUnion("action",[r2.extend(I3),C6.extend(I3),P6.extend({...I3,action:G.literal("stop")})]),QT=G.toJSONSchema(ZG),XT=G.object({version:G.literal(1),recordingId:G.string().uuid(),proofReady:G.literal(!1),capture:G.object({captureId:G.string().uuid(),contentType:G.literal("video/webm"),sha256:G.string().regex(/^[a-f0-9]{64}$/),sizeBytes:G.number().int().min(128).max(10485760),startedAt:G.iso.datetime(),finishedAt:G.iso.datetime(),durationSeconds:G.number().min(0.05).max(15),frameCount:G.number().int().min(1).max(450),receivedFrameCount:G.number().int().min(1).max(2000),owner:G.object({runId:G.string().uuid(),deviceId:G.string().uuid(),rootId:G.string().uuid(),rootRevision:G.string().max(64),profile:G.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:G.string().min(1).max(1024),generation:G.string().uuid(),browserScope:G.string().max(128),tabId:G.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var MT=r2.extend({action:G.enum(["start","inspect"]),recording_boot_generation:G.string().uuid(),recording_operation_id:G.string().uuid().optional(),recording_attempt_id:G.string().uuid().optional()}).strict();import{createHash as UG,randomUUID as qG}from"crypto";import{mkdtemp as MG,realpath as TG,rm as y6}from"fs/promises";import{tmpdir as _G}from"os";import{join as FG}from"path";import{spawn as WG}from"child_process";import{isDeepStrictEqual as LG}from"util";import{createHash as QG}from"crypto";import{execFile as XG}from"child_process";import{chmod as YG,lstat as x6,mkdtemp as GG,readFile as E6,realpath as S6,rm as BG,writeFile as I6}from"fs/promises";import{tmpdir as KG}from"os";import{isAbsolute as VG,join as t2}from"path";import{promisify as HG}from"util";var x3=HG(XG),NG=($)=>QG("sha256").update($).digest("hex");async function X1($){if(!VG($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await S6($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await x6($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||NG(await E6($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function $2($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([X1(Z.ffmpeg),X1(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([X1(Z.ffmpeg),X1(Z.ffprobe)]);let B=await S6(await GG(t2(J??KG(),"reason-owned-recording-")));await YG(B,448);let V=t2(B,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[D,j]of Q.entries()){let z=`${D}.jpg`;await I6(t2(B,z),j.jpeg,{mode:384,flag:"wx"});let F=Q[D+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${z}'`,`duration ${Math.max(0.001,F-j.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await I6(t2(B,"frames.ffconcat"),N.join(`
 `)+`
-`,{mode:384,flag:"wx"});let q={cwd:B,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],q),K="output";let H=await I6(V);if(!H.isFile()||H.isSymbolicLink()||H.nlink!==1||H.size<128||H.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],q),K="pin",await Promise.all([X1(Z.ffmpeg),X1(Z.ffprobe)]),await x6(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await GG(B,{recursive:!0,force:!0})}}}}var w6=G.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var Y1=G.string().min(1).max(1024),S6=G.object({path:Y1,sha256:G.string().regex(/^[a-f0-9]{64}$/)}).strict(),b6=G.object({owner:G.object({runId:Y1,deviceId:Y1,rootId:Y1,rootRevision:Y1,profile:G.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:Y1,generation:Y1,browserScope:Y1,tabId:G.number().int().positive()}).strict(),socketPath:Y1,extensionId:G.string().regex(/^[a-p]{32}$/),nativeHostName:Y1,seconds:G.number().int().min(1).max(15),encoder:G.object({ffmpeg:S6,ffprobe:S6}).strict()}).strict();var LG=15728640,I1=()=>Error("mac_recording_worker_failed");function y6($){let J=b6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,B=null,V=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(I1()),M)})])}finally{clearTimeout(T)}},N=()=>B??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,H=async()=>{if(X)throw I1();if(await K($.assertCurrent()),X)throw I1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await H(),await X1({path:Z.path,sha256:Z.sha256}),await H(),B=null;let U=await MG(await qG(_G(TG(),"reason-recording-host-")));try{await H()}catch(I){throw await k6(U,{recursive:!0,force:!0}),I}let M=FG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((I)=>M.once("close",()=>I())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(I){if(I.code!=="ESRCH")throw I}},D=null;V=()=>D??=(async()=>{try{_()}catch(I){if(I.code!=="EPERM")throw I}await T;try{for(let I=0;;I++)try{_();break}catch(E){if(E.code!=="EPERM"||I>=20)throw E;await new Promise((A)=>setTimeout(A,25))}}finally{await k6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,R,x=new Promise((I,E)=>{L=I,R=E}),C,P,h=new Promise((I,E)=>{C=I,P=E});h.catch(()=>{});let S=(I=I1())=>{if(F)return;F=!0,clearTimeout(y),clearInterval(k),N().then(()=>{R(I),P(I)},(E)=>{R(E),P(E)})},y=setTimeout(()=>S(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,H().catch(()=>S()).finally(()=>{l=!1})},250);q={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
-`)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(I)=>{if(F)return;if(z+=I.length,z>LG){S();return}j+=I.toString("utf8");let E;while((E=j.indexOf(`
-`))!==-1){let A=j.slice(0,E);j=j.slice(E+1);try{let b=JSON.parse(A);if(b.type==="failed"&&Object.keys(b).sort().join(",")==="reason,type"){let o=w6.safeParse(b.reason);S(o.success?Error(`mac_recording_worker_failed:${o.data}`):I1());return}if(b.type==="unsupported"&&!O){S(Error("mac_recording_encoder_unavailable"));return}if(b.type==="started"&&!O&&Object.keys(b).length===1){O=!0,L({recording:!0});continue}if(!O||b.type!=="capture"||W||Object.keys(b).sort().join(",")!=="bytes,capture,type")throw I1();let w=b.capture;if(!w||Object.keys(w).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof w.sha256!=="string"||typeof w.startedAt!=="string"||typeof w.finishedAt!=="string"||!WG(w.owner,J.owner)||w.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(w.sha256)||!Number.isSafeInteger(w.sizeBytes)||w.sizeBytes<128||w.sizeBytes>10485760||!Number.isSafeInteger(w.frameCount)||w.frameCount<1||w.frameCount>450||!Number.isSafeInteger(w.receivedFrameCount)||w.receivedFrameCount<w.frameCount||w.receivedFrameCount>2000||!Number.isFinite(w.durationSeconds)||w.durationSeconds<0.05||w.durationSeconds>J.seconds||!Number.isFinite(Date.parse(w.startedAt))||!Number.isFinite(Date.parse(w.finishedAt))||Math.abs((Date.parse(w.finishedAt)-Date.parse(w.startedAt))/1000-w.durationSeconds)>0.1||typeof b.bytes!=="string"||b.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(b.bytes))throw I1();let n=Buffer.from(b.bytes,"base64");if(n.length!==w.sizeBytes||NG("sha256").update(n).digest("hex")!==w.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw I1();W={capture:Object.freeze({...w,captureId:UG(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(I)=>{if(F)return;if(I!==0||!W||j.trim()){S();return}let E=W;H().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(y),clearInterval(k),Q.set(E.capture.captureId,E);while(Q.size>2)Q.delete(Q.keys().next().value);C(E.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
-`);try{return await x}catch(I){throw q=null,I}}finally{Y=!1}},async completed(){if(await H(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await H();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await H();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var f6=G.object({version:G.literal("0.1.42"),metadata:G.object({extensionId:G.string(),extensionInstanceId:G.string(),nativeHostName:G.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await DG($.automationDirectory);J=(Q,X)=>n2(Z,Q,X)}if(await X1({path:$.worker.path,sha256:$.worker.sha256}),!await $2($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let B=await J(Z,Y),V=new P1({socketPath:B.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=f6.parse(await V.getInfo()),K.metadata.extensionId!==B.extensionId||K.metadata.extensionInstanceId!==B.instanceId)throw Error("mac_recording_profile_changed");if(!G.array(G.object({id:G.number()})).parse(await V.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:B.instanceId,async createHost(N,q,H){let U=new P1({socketPath:B.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return y6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:B.socketPath,extensionId:B.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){H.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=f6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==B.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),OG=G.object({operationId:G.string().uuid()}).strict();function m6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=G.array(G.object({profile:G.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:G.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!G.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,B=!1,V=new jG,K=async(U)=>{let M=V.getStore();if(B||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),B)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=W6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let R=await $.resolveBrowser(U.profile,O,j,L);if(R.extensionInstanceId!==U.extensionInstanceId)throw A0();return R.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),B)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!h6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},H=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{B=!0})},1000);return H.unref(),{generation:$.generation,async execute(U,M,T){return V.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!h6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let R=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||zG("sha256").update(R.bytes).digest("hex")!==_.sha256)throw A0();await z();let x={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,x);try{let C=await fetch(L,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await C.body?.cancel(),await z(),C.ok)x.result={...x.result,status:"uploaded"}}catch{}F=x.result}finally{R.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==_6)return!1;let T=OG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await V.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){B=!0,clearInterval(H);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var SG="__browser-recorder",wG=EG(AG),bG="/tmp/open-browser-use",kG=33554432,yG=G.object({version:G.literal("0.1.42"),metadata:G.object({extensionId:G.literal(o2),extensionInstanceId:G.string().min(1).max(1024)})}),g6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:n$,ensureBrowser:p6,socketDirectory:bG,async identity($){let J=new P1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function u6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw g6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(c6(Z),"Default","Local Extension Settings",o2),X=(await v6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await v6(J.socketDirectory)).filter((B)=>B.endsWith(".sock"))){$.throwIfAborted();let B=S3(J.socketDirectory,Y);try{let V=await CG(B);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=yG.parse(await J.identity(B)).metadata.extensionInstanceId;for(let N of X)if((await IG(N)).size<=kG&&(await s6(N)).includes(K))return{socketPath:B,instanceId:K,extensionId:o2}}catch{}}throw g6()}async function w3($){let J=await PG($);return{path:J,sha256:RG("sha256").update(await s6(J)).digest("hex")}}async function a6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await wG(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await $2(Y))return{error:"worker_recording_encoder_unqualified"};let B=$.recorder??{path:process.execPath,args:[...xG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],SG]};return{worker:{...await w3(B.path),args:B.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function i6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=d6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),B=$.recording?l6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(H)=>V6(H.organizationId,H.sessionId,H.deviceId,1),K=$.recording,N,q=m6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(H,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>u6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(H,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>fG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(H)=>P3({...H,endpoint:(U)=>({discover:(M)=>u6(M,Z),tabScope:V(U)})})});return{capability:B,broker:q}}function fG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as eG}from"child_process";import{execFile as hG}from"child_process";import{readFile as mG}from"fs/promises";import{join as o0}from"path";var vG="Claude Code-credentials",gG="/usr/bin/security",uG=120000,dG=8192,e2={exec:($,J,Z)=>new Promise((Q)=>{hG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let B=X?typeof X.code==="number"?X.code:1:0;Q({code:B,stdout:String(Y??"")})})}),readText:async($)=>{try{return await mG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=dG?$:null}function lG($,J){return $.CLAUDE_CONFIG_DIR||o0(J,".claude")}function pG($,J){return $.CODEX_HOME||o0(J,".codex")}function n6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function cG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function sG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:cG(Z)??Date.now()}}catch{return null}}function aG($,J){return o0($.XDG_DATA_HOME||o0(J,".local","share"),"opencode","auth.json")}var iG={anthropic:"anthropic",openai:"openai-codex"};function nG($){return e6($,iG)}function e6($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let B=Z[X];if(B?.type!=="oauth")continue;let V=T$(B.access),K=T$(B.refresh),N=typeof B.expires==="number"&&Number.isFinite(B.expires)?B.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function rG($){return e6($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function tG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?o0(J,Z.slice(2)):Z||o0(J,".pi","agent")}async function $7($,J,Z=e2){let Q=[],X=await Z.exec(gG,["find-generic-password","-s",vG,"-w"],uG),Y=Date.now()+300000,B=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(B(X.code===0?n6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))B(n6(await Z.readText(o0(lG($,J),".credentials.json"))));let V=sG(await Z.readText(o0(pG($,J),"auth.json")));B(V),B(oG(await Z.readText(o0($.GROK_HOME||o0(J,".grok"),"auth.json"))));for(let K of nG(await Z.readText(aG($,J))))B(K);for(let K of rG(await Z.readText(o0(tG($,J),"auth.json"))))B(K);return Q}function J7($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var r6="https://auth.x.ai",t6="b1a00492-073a-47ea-816f-4c329264a828",o6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function oG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${r6}::${t6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==r6||Q.oidc_client_id!==t6||!o6(Q.key)||!o6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var Z7=330000,$B=300000,JB=60000;function ZB($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+Z7)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function QB($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*Z7)?JB:$B}var XB=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function Q7($){let J=new Map,Z=$.wait??XB,Q=$.stores??(process.platform==="darwin"?e2:{...e2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=J7(await $7($.environment??process.env,$.home,Q));for(let Y of ZB(X,J)){if($.signal.aborted)return;let B=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:B.ok,...B.ok?{}:{error:B.error}})}}catch{}await Z(QB(J),$.signal)}}function X7($=process.env){return new Promise((J)=>{eG("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as YB,spawn as k_,spawnSync as y_}from"child_process";import{chmodSync as h_,existsSync as GB,mkdirSync as m_,readFileSync as v_,renameSync as g_,rmSync as u_,statSync as d_,writeFileSync as l_}from"fs";import{dirname as c_,isAbsolute as s_,join as y3}from"path";var Y7=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function G7($,J){if(!Y7.test($)||!Y7.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var BB="com.reasonmachines.updater",KB=["so.ara.updater","so.reason.updater"];function VB($){let J=$==="staging"?".staging":"";return{label:`${BB}${J}`,legacyLabels:[...KB].reverse().map((Z)=>`${Z}${J}`)}}function HB($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function NB($,J){return new Promise((Z)=>{YB($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function V7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=VB($.channel),B=$.configHome??K7(Q),V=[X,...Y].filter((H)=>{let U=HB(H,Q,B);return GB(J==="darwin"?U.launchAgent:U.systemdService)});if(V.length===0)return"absent";let K=$.command??NB,N=V[0];if(V.length>1){for(let H of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${H}`]):await K("systemctl",["--user","is-enabled",`${H}.timer`]))===0){N=H;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var B7=60000;function H7($){let J=(X,Y)=>{try{return G7(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let B=setTimeout(X,Y);B.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(B),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),B=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(B7-1,Math.floor(B*B7)))}}var UB=30000;async function N7($){return($.flush??j8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(UB);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var q7=25000,MB=5000,TB=600000,_B=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return d0(),x7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var M7=5000,FB=600000;function WB($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[i1])return null;try{return C2({platform:J})}catch{return null}}function LB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function DB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)g$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)g$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Q2($,J,Z,Q,X={}){if(d0(),$.executionMode==="host")Z2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let B=$0($);if(B.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?P7():Promise.resolve(!1),q=z7(),H=X.prestartedReadiness??i$($,X.readinessProbes,V,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?H.initial:H.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??X7)().catch(()=>!1):null,D=new AbortController,j=null,z=async(f,a)=>{let i=($.userChrome??X.ownComputer===!0)&&f["automation.call.v1"]===!0?C7():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
-`);let K0=g3($,f,{displayVideo:f["display.stream.v1"]===!0&&await N(),handsBrowser:f["hands.connect"]===!0&&q,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:f["pty.start"]===!0&&l2(),probing:a});if(!j&&K0.worker.readiness?.["browser.pr-proof.v1"]===!0){let R0=await a6();if(j||D.signal.aborted)return K0;process.stderr.write("error"in R0?`Reason worker: PR video proof unavailable (${R0.error})
+`,{mode:384,flag:"wx"});let q={cwd:B,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await x3(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],q),K="output";let H=await x6(V);if(!H.isFile()||H.isSymbolicLink()||H.nlink!==1||H.size<128||H.size>10485760)throw Error();K="probe";let{stdout:U}=await x3(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],q),M=JSON.parse(U),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await x3(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],q),K="pin",await Promise.all([X1(Z.ffmpeg),X1(Z.ffprobe)]),await E6(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await BG(B,{recursive:!0,force:!0})}}}}var b6=G.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var Y1=G.string().min(1).max(1024),w6=G.object({path:Y1,sha256:G.string().regex(/^[a-f0-9]{64}$/)}).strict(),k6=G.object({owner:G.object({runId:Y1,deviceId:Y1,rootId:Y1,rootRevision:Y1,profile:G.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:Y1,generation:Y1,browserScope:Y1,tabId:G.number().int().positive()}).strict(),socketPath:Y1,extensionId:G.string().regex(/^[a-p]{32}$/),nativeHostName:Y1,seconds:G.number().int().min(1).max(15),encoder:G.object({ffmpeg:w6,ffprobe:w6}).strict()}).strict();var DG=15728640,I1=()=>Error("mac_recording_worker_failed");function f6($){let J=k6.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,B=null,V=async()=>{},K=async(U,M=3000)=>{let T;try{return await Promise.race([U,new Promise((_,D)=>{T=setTimeout(()=>D(I1()),M)})])}finally{clearTimeout(T)}},N=()=>B??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((U)=>{X=!0;let M=U&&typeof U==="object"&&"code"in U?U.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),q=null,H=async()=>{if(X)throw I1();if(await K($.assertCurrent()),X)throw I1()};return{async start(){if(Y||q)throw Error("mac_recording_already_active");Y=!0;try{await H(),await X1({path:Z.path,sha256:Z.sha256}),await H(),B=null;let U=await TG(await MG(FG(_G(),"reason-recording-host-")));try{await H()}catch(I){throw await y6(U,{recursive:!0,force:!0}),I}let M=WG(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((I)=>M.once("close",()=>I())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(I){if(I.code!=="ESRCH")throw I}},D=null;V=()=>D??=(async()=>{try{_()}catch(I){if(I.code!=="EPERM")throw I}await T;try{for(let I=0;;I++)try{_();break}catch(E){if(E.code!=="EPERM"||I>=20)throw E;await new Promise((A)=>setTimeout(A,25))}}finally{await y6(U,{recursive:!0,force:!0})}})();let j="",z=0,F=!1,O=!1,W=null,L,R,x=new Promise((I,E)=>{L=I,R=E}),C,P,h=new Promise((I,E)=>{C=I,P=E});h.catch(()=>{});let S=(I=I1())=>{if(F)return;F=!0,clearTimeout(y),clearInterval(k),N().then(()=>{R(I),P(I)},(E)=>{R(E),P(E)})},y=setTimeout(()=>S(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,H().catch(()=>S()).finally(()=>{l=!1})},250);q={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
+`)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(I)=>{if(F)return;if(z+=I.length,z>DG){S();return}j+=I.toString("utf8");let E;while((E=j.indexOf(`
+`))!==-1){let A=j.slice(0,E);j=j.slice(E+1);try{let b=JSON.parse(A);if(b.type==="failed"&&Object.keys(b).sort().join(",")==="reason,type"){let o=b6.safeParse(b.reason);S(o.success?Error(`mac_recording_worker_failed:${o.data}`):I1());return}if(b.type==="unsupported"&&!O){S(Error("mac_recording_encoder_unavailable"));return}if(b.type==="started"&&!O&&Object.keys(b).length===1){O=!0,L({recording:!0});continue}if(!O||b.type!=="capture"||W||Object.keys(b).sort().join(",")!=="bytes,capture,type")throw I1();let w=b.capture;if(!w||Object.keys(w).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof w.sha256!=="string"||typeof w.startedAt!=="string"||typeof w.finishedAt!=="string"||!LG(w.owner,J.owner)||w.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(w.sha256)||!Number.isSafeInteger(w.sizeBytes)||w.sizeBytes<128||w.sizeBytes>10485760||!Number.isSafeInteger(w.frameCount)||w.frameCount<1||w.frameCount>450||!Number.isSafeInteger(w.receivedFrameCount)||w.receivedFrameCount<w.frameCount||w.receivedFrameCount>2000||!Number.isFinite(w.durationSeconds)||w.durationSeconds<0.05||w.durationSeconds>J.seconds||!Number.isFinite(Date.parse(w.startedAt))||!Number.isFinite(Date.parse(w.finishedAt))||Math.abs((Date.parse(w.finishedAt)-Date.parse(w.startedAt))/1000-w.durationSeconds)>0.1||typeof b.bytes!=="string"||b.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(b.bytes))throw I1();let n=Buffer.from(b.bytes,"base64");if(n.length!==w.sizeBytes||UG("sha256").update(n).digest("hex")!==w.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw I1();W={capture:Object.freeze({...w,captureId:qG(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(I)=>{if(F)return;if(I!==0||!W||j.trim()){S();return}let E=W;H().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(y),clearInterval(k),Q.set(E.capture.captureId,E);while(Q.size>2)Q.delete(Q.keys().next().value);C(E.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:U})+`
+`);try{return await x}catch(I){throw q=null,I}}finally{Y=!1}},async completed(){if(await H(),!q)throw Error("mac_recording_not_active");return q.completion},async stop(){await H();let U=q;if(!U)throw Error("mac_recording_not_started");U.stop();try{return await U.completion}finally{if(q===U)q=null}},async read(U){await H();let M=Q.get(U);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let U=q;U?.cancel(),Q.clear();try{await N(),await U?.completion.catch(()=>{})}finally{q=null}}}}var h6=G.object({version:G.literal("0.1.42"),metadata:G.object({extensionId:G.string(),extensionInstanceId:G.string(),nativeHostName:G.string()})});async function E3($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await jG($.automationDirectory);J=(Q,X)=>n2(Z,Q,X)}if(await X1({path:$.worker.path,sha256:$.worker.sha256}),!await $2($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let B=await J(Z,Y),V=new P1({socketPath:B.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=h6.parse(await V.getInfo()),K.metadata.extensionId!==B.extensionId||K.metadata.extensionInstanceId!==B.instanceId)throw Error("mac_recording_profile_changed");if(!G.array(G.object({id:G.number()})).parse(await V.getTabs()).some((q)=>q.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:B.instanceId,async createHost(N,q,H){let U=new P1({socketPath:B.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return f6({worker:$.worker,configuration:{owner:N.browser,seconds:q,encoder:$.encoder,socketPath:B.socketPath,extensionId:B.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){H.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await U.connect();let T=h6.parse(await U.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==B.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await U.executeCdp(Q,"Page.stopScreencast",{})}finally{U.close()}}})}}}}var A0=()=>Error("mac_pr_proof_unavailable"),AG=G.object({operationId:G.string().uuid()}).strict();function v6($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=G.array(G.object({profile:G.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:G.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!G.string().uuid().safeParse($.generation).success||new Set(Z.map((U)=>U.profile)).size!==Z.length)throw A0();if(!$.qualifiedProfiles){let U=new URL($.uploadOrigin);if(!$.resolveBrowser||U.protocol!=="https:"||U.origin!==$.uploadOrigin||U.username||U.password)throw A0()}let Q=new Map,X=new Map,Y=new Map,B=!1,V=new zG,K=async(U)=>{let M=V.getStore();if(B||!U&&!M)throw A0();if(M?.signal.throwIfAborted(),await $.assertCurrent(U??M.claim),B)throw A0();M?.signal.throwIfAborted()},N=(U,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(U.capability!==j3||!U.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==U.owner.organization_id||T.userId!==U.owner.user_id||T.deviceId!==U.owner.device_id||T.rootId!==U.root_id||T.runId!==U.run_id)throw A0();return T},q=async(U)=>{await K();let M=JSON.stringify([U.runId,U.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw A0();T=(async()=>{let D,j=$.browserScope?.(U)??M$(U.runId),z=await $.createBrowser({owner:U,assertCurrent:()=>K(),readVideo:(F)=>D.publicationCapture(F)});if(D=L6({owner:U,browserScope:j,assertCurrent:()=>K(),screenshot:z.screenshot,async createVideo(F,O,W,L){if(!$.resolveBrowser)throw A0();let R=await $.resolveBrowser(U.profile,O,j,L);if(R.extensionInstanceId!==U.extensionInstanceId)throw A0();return R.createHost({organizationId:U.organizationId,userId:U.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:U.runId,deviceId:U.deviceId,rootId:U.rootId,rootRevision:U.rootRevision,generation:U.generation,profile:U.profile,extensionInstanceId:U.extensionInstanceId,browserScope:j,tabId:O}},W,L)}}),B)throw z.close(),await D.close(),A0();return{owner:structuredClone(U),browser:z,capture:D,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!m6(_.owner,U)||_.expiresAt<=Date.now())throw A0();return _},H=setInterval(()=>{for(let[U,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(U)===M)Q.delete(U)}).catch(()=>{B=!0})},1000);return H.unref(),{generation:$.generation,async execute(U,M,T){return V.run({claim:U,signal:M},async()=>{let _=R3.parse(U.payload).command,D=N(U,_);if(await K(U),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let j=await q(D),z=async()=>{await K(U),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await j.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw A0();F=await j.capture.prepare(_.context);break;case"capture_png":F=await j.capture.screenshot({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let O={runtime:j,contextId:_.contextId,attemptId:U.attempt_id,tabId:_.tabId,signal:M};if(X.has(U.operation_id))throw A0();X.set(U.operation_id,O);try{F=await j.capture.record({claim:{operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await z(),await T({version:1,operationId:U.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(U.operation_id)}break}case"inspect_capture":F=await j.capture.inspect(_.captureId);break;case"publish_video":F=await j.browser.publish(_.input);break;case"verify_saved_media":F=await j.browser.verify(_.input);break;case"verify_png_media":F=await j.browser.verifyImages(_.media);break;case"publish_png":{let O=`${D.runId}:${_.attemptId}`,W=Y.get(O);if(W){if(!m6(W.request,_))throw A0();F=W.result;break}if(Y.size>=16)throw A0();let L=new URL(_.uploadUrl);if(L.protocol!=="https:"||L.username||L.password||L.hash||L.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${D.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw A0();let R=await j.capture.publicationCapture(_.captureId);try{if(L.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||OG("sha256").update(R.bytes).digest("hex")!==_.sha256)throw A0();await z();let x={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(O,x);try{let C=await fetch(L,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await C.body?.cancel(),await z(),C.ok)x.result={...x.result,status:"uploaded"}}catch{}F=x.result}finally{R.bytes.fill(0)}break}}return await z(),structuredClone(F)})},async control(U,M){if(U.capability!==j3||M.kind!==F6)return!1;let T=AG.safeParse(M.payload),_=X.get(U.operation_id);if(!T.success||T.data.operationId!==U.operation_id||!_||_.attemptId!==U.attempt_id)return!1;let D=R3.parse(U.payload).command;return N(U,D),await K(U),await V.run({claim:U,signal:_.signal},()=>_.runtime.capture.stop({operationId:U.operation_id,attemptId:U.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){B=!0,clearInterval(H);let U=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),U.some((M)=>M.status==="rejected"))throw A0()}}}var wG="__browser-recorder",bG=SG(RG),kG="/tmp/open-browser-use",yG=33554432,fG=G.object({version:G.literal("0.1.42"),metadata:G.object({extensionId:G.literal(o2),extensionInstanceId:G.string().min(1).max(1024)})}),u6=()=>Error("worker_pr_proof_browser_unavailable"),k3={components:n$,ensureBrowser:c6,socketDirectory:kG,async identity($){let J=new P1({socketPath:$,sessionId:`reason-proof-qualification-${b3()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function d6($,J=k3){let Z=J.components();if(!Z?.features.browser)throw u6();await J.ensureBrowser(Z),$.throwIfAborted();let Q=S3(s6(Z),"Default","Local Extension Settings",o2),X=(await g6(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>S3(Q,Y));for(let Y of(await g6(J.socketDirectory)).filter((B)=>B.endsWith(".sock"))){$.throwIfAborted();let B=S3(J.socketDirectory,Y);try{let V=await PG(B);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=fG.parse(await J.identity(B)).metadata.extensionInstanceId;for(let N of X)if((await xG(N)).size<=yG&&(await a6(N)).includes(K))return{socketPath:B,instanceId:K,extensionId:o2}}catch{}}throw u6()}async function w3($){let J=await IG($);return{path:J,sha256:CG("sha256").update(await a6(J)).digest("hex")}}async function i6($={}){let J={...k3,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await w3(Z.ffmpeg),{stdout:X}=await bG(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await w3(Z.ffprobe)};if(!await $2(Y))return{error:"worker_recording_encoder_unqualified"};let B=$.recorder??{path:process.execPath,args:[...EG(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],wG]};return{worker:{...await w3(B.path),args:B.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function n6($,J={}){let Z={...k3,...J},Q=b3(),X=b3(),Y=l6.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),B=$.recording?p6.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(H)=>H6(H.organizationId,H.sessionId,H.deviceId,1),K=$.recording,N,q=v6({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(H,U,M,T)=>{N??=E3({...K,assertCurrent:()=>$.assertCurrent(),discover:(D,j)=>d6(j,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(H,U,M,T);return{extensionInstanceId:X,createHost:async(D,j,z)=>hG(await _.createHost({...D,browser:{...D.browser,extensionInstanceId:_.extensionInstanceId}},j,z),X)}}}:{},createBrowser:(H)=>P3({...H,endpoint:(U)=>({discover:(M)=>d6(M,Z),tabScope:V(U)})})});return{capability:B,broker:q}}function hG($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as $B}from"child_process";import{execFile as mG}from"child_process";import{readFile as vG}from"fs/promises";import{join as o0}from"path";var gG="Claude Code-credentials",uG="/usr/bin/security",dG=120000,lG=8192,e2={exec:($,J,Z)=>new Promise((Q)=>{mG($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let B=X?typeof X.code==="number"?X.code:1:0;Q({code:B,stdout:String(Y??"")})})}),readText:async($)=>{try{return await vG($,"utf8")}catch{return null}}};function T$($){return typeof $==="string"&&$.length>0&&$.length<=lG?$:null}function pG($,J){return $.CLAUDE_CONFIG_DIR||o0(J,".claude")}function cG($,J){return $.CODEX_HOME||o0(J,".codex")}function r6($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=T$(J?.accessToken),Q=T$(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function sG($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function aG($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=T$(J.tokens?.access_token),Q=T$(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:sG(Z)??Date.now()}}catch{return null}}function iG($,J){return o0($.XDG_DATA_HOME||o0(J,".local","share"),"opencode","auth.json")}var nG={anthropic:"anthropic",openai:"openai-codex"};function rG($){return $7($,nG)}function $7($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let B=Z[X];if(B?.type!=="oauth")continue;let V=T$(B.access),K=T$(B.refresh),N=typeof B.expires==="number"&&Number.isFinite(B.expires)?B.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function tG($){return $7($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function oG($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?o0(J,Z.slice(2)):Z||o0(J,".pi","agent")}async function J7($,J,Z=e2){let Q=[],X=await Z.exec(uG,["find-generic-password","-s",gG,"-w"],dG),Y=Date.now()+300000,B=(K)=>{if(!K)return;let N=Q.findIndex((q)=>q.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(B(X.code===0?r6(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))B(r6(await Z.readText(o0(pG($,J),".credentials.json"))));let V=aG(await Z.readText(o0(cG($,J),"auth.json")));B(V),B(eG(await Z.readText(o0($.GROK_HOME||o0(J,".grok"),"auth.json"))));for(let K of rG(await Z.readText(iG($,J))))B(K);for(let K of tG(await Z.readText(o0(oG($,J),"auth.json"))))B(K);return Q}function Z7($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var t6="https://auth.x.ai",o6="b1a00492-073a-47ea-816f-4c329264a828",e6=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function eG($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${t6}::${o6}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==t6||Q.oidc_client_id!==o6||!e6(Q.key)||!e6(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var Q7=330000,JB=300000,ZB=60000;function QB($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+Q7)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function XB($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*Q7)?ZB:JB}var YB=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function X7($){let J=new Map,Z=$.wait??YB,Q=$.stores??(process.platform==="darwin"?e2:{...e2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=Z7(await J7($.environment??process.env,$.home,Q));for(let Y of QB(X,J)){if($.signal.aborted)return;let B=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:B.ok,...B.ok?{}:{error:B.error}})}}catch{}await Z(XB(J),$.signal)}}function Y7($=process.env){return new Promise((J)=>{$B("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as GB,spawn as f_,spawnSync as h_}from"child_process";import{chmodSync as v_,existsSync as BB,mkdirSync as g_,readFileSync as u_,renameSync as d_,rmSync as l_,statSync as p_,writeFileSync as c_}from"fs";import{dirname as a_,isAbsolute as i_,join as y3}from"path";var G7=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function B7($,J){if(!G7.test($)||!G7.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var KB="com.reasonmachines.updater",VB=["so.ara.updater","so.reason.updater"];function HB($){let J=$==="staging"?".staging":"";return{label:`${KB}${J}`,legacyLabels:[...VB].reverse().map((Z)=>`${Z}${J}`)}}function NB($,J,Z){return{launchAgent:y3(J,"Library","LaunchAgents",`${$}.plist`),systemdService:y3(Z,"systemd","user",`${$}.service`),systemdTimer:y3(Z,"systemd","user",`${$}.timer`)}}function UB($,J){return new Promise((Z)=>{GB($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function H7($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??V0(),{label:X,legacyLabels:Y}=HB($.channel),B=$.configHome??V7(Q),V=[X,...Y].filter((H)=>{let U=NB(H,Q,B);return BB(J==="darwin"?U.launchAgent:U.systemdService)});if(V.length===0)return"absent";let K=$.command??UB,N=V[0];if(V.length>1){for(let H of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${H}`]):await K("systemctl",["--user","is-enabled",`${H}.timer`]))===0){N=H;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var K7=60000;function N7($){let J=(X,Y)=>{try{return B7(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let B=setTimeout(X,Y);B.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(B),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),B=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(K7-1,Math.floor(B*K7)))}}var qB=30000;async function U7($){return($.flush??j8)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(qB);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var M7=25000,TB=5000,_B=600000,FB=["display.stream.v1","pty.start"];function m3($,J,Z=g3($),Q){return d0(),E7(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var T7=5000,WB=600000;function LB($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[i1])return null;try{return C2({platform:J})}catch{return null}}function DB($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function jB($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=_3();if(Z.length>0)g$($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)g$($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function Q2($,J,Z,Q,X={}){if(d0(),$.executionMode==="host")Z2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let B=$0($);if(B.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?I7():Promise.resolve(!1),q=O7(),H=X.prestartedReadiness??i$($,X.readinessProbes,V,J.roots[0].permissions),U=X.deferOptionalLanes===!0,M=await(U?H.initial:H.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??Y7)().catch(()=>!1):null,D=new AbortController,j=null,z=async(f,a)=>{let i=($.userChrome??X.ownComputer===!0)&&f["automation.call.v1"]===!0?P7():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
+`);let K0=g3($,f,{displayVideo:f["display.stream.v1"]===!0&&await N(),handsBrowser:f["hands.connect"]===!0&&q,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:f["pty.start"]===!0&&l2(),probing:a});if(!j&&K0.worker.readiness?.["browser.pr-proof.v1"]===!0){let R0=await i6();if(j||D.signal.aborted)return K0;process.stderr.write("error"in R0?`Reason worker: PR video proof unavailable (${R0.error})
 `:`Reason worker: PR video proof ready (ffmpeg ${R0.encoder.ffmpeg.path})
-`),j=i6({assertCurrent:async()=>{if(!k())throw Error("proof_authority_lost")},...!("error"in R0)?{recording:R0}:{}})}return K0},F=await z(M,U?F3.filter((f)=>M[f]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,R=0,x="starting",C=null,P=!1,h=!1,S=null,y,l=()=>!B.drained&&Date.parse(Y)>Date.now()&&O.supported_operations.some((f)=>F.worker.readiness?.[f]===!0),k=()=>!W&&l(),I=null,E=()=>L+(I?.claims()??0),A=null,b=new Set,w=(f)=>{let a=f.capabilities.root_paths;if(Object.assign(f.capabilities,m3(f.config,f.state,F,j?.capability)),a)f.capabilities.root_paths=a},n=(f)=>{F=f,w({config:$,state:J,capabilities:O}),A?.();for(let a of b)w(a),a.heartbeatNow?.()},o=new Set,N0=new Set,j0=setInterval(()=>{let f=new Set;for(let a of[{state:J,capabilities:O},...b])for(let q0 of _B){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let K0=`${a.state.deviceId} ${q0}`;if(f.add(K0),!o.has(K0)||N0.has(K0))continue;N0.add(K0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
-`)}o.clear();for(let a of f)o.add(a)},TB);j0.unref();let L1=(f)=>{if(!X.readinessProbes)e5({config:$,readiness:f,signal:D.signal,idle:()=>E()===0,permissions:J.roots[0].permissions,onReady:(a)=>{z(a,[]).then(n)}})},D1=U?H.final.then(async(f)=>{if(D.signal.aborted)return;n(await z(f,[]));let a=F3.filter((q0)=>f[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
-`),L1(f)},()=>{}):Promise.resolve();if(!U)L1(M);_?.then(async(f)=>{T=f;for(;;){let a=F,q0=await z(a.worker.readiness??{},a.worker.probing??[]);if(D.signal.aborted)return;if(F!==a)continue;n(q0);return}});let O$=U&&F.worker.probing?.includes("pty.start")?H.pty.then(async(f)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!a())return;let q0=await z({...F.worker.readiness,"pty.start":f},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(D.signal.aborted||!a())return;n(q0)},()=>{}):Promise.resolve(),E1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:x,drained:B.drained||W||P,activeClaims:E(),activeSessions:R,lastHeartbeat:C,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:k()&&!P&&x==="running"}),t1=!1,j1=()=>{t1=!0,K1()},K1=()=>{if(W)return;if(W=!0,x="stopping",S?.close(),E()===0)D.abort();else y=setTimeout(()=>D.abort(),$.shutdownGraceMs)},S1=$.channel==="production"||$.channel==="staging"?$.channel:null,V1=d($).releaseCheck,v=X.publishedRelease??(S1&&$.lifetime==="persistent"?H7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let f=JSON.parse(s(V1));return typeof f==="string"?f:null}catch{return null}})(),check:async(f)=>{try{c(V1,f)}catch{}let a=await V7({channel:S1});process.stderr.write(a==="started"?`Reason worker: CLI ${f} is published; the updater is checking now.
+`),j=n6({assertCurrent:async()=>{if(!k())throw Error("proof_authority_lost")},...!("error"in R0)?{recording:R0}:{}})}return K0},F=await z(M,U?F3.filter((f)=>M[f]!==!0):[]),O=m3($,J,F,j?.capability);X.onStartup?.("inventory_completed");let W=!1,L=0,R=0,x="starting",C=null,P=!1,h=!1,S=null,y,l=()=>!B.drained&&Date.parse(Y)>Date.now()&&O.supported_operations.some((f)=>F.worker.readiness?.[f]===!0),k=()=>!W&&l(),I=null,E=()=>L+(I?.claims()??0),A=null,b=new Set,w=(f)=>{let a=f.capabilities.root_paths;if(Object.assign(f.capabilities,m3(f.config,f.state,F,j?.capability)),a)f.capabilities.root_paths=a},n=(f)=>{F=f,w({config:$,state:J,capabilities:O}),A?.();for(let a of b)w(a),a.heartbeatNow?.()},o=new Set,N0=new Set,j0=setInterval(()=>{let f=new Set;for(let a of[{state:J,capabilities:O},...b])for(let q0 of FB){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let K0=`${a.state.deviceId} ${q0}`;if(f.add(K0),!o.has(K0)||N0.has(K0))continue;N0.add(K0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
+`)}o.clear();for(let a of f)o.add(a)},_B);j0.unref();let L1=(f)=>{if(!X.readinessProbes)$6({config:$,readiness:f,signal:D.signal,idle:()=>E()===0,permissions:J.roots[0].permissions,onReady:(a)=>{z(a,[]).then(n)}})},D1=U?H.final.then(async(f)=>{if(D.signal.aborted)return;n(await z(f,[]));let a=F3.filter((q0)=>f[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
+`),L1(f)},()=>{}):Promise.resolve();if(!U)L1(M);_?.then(async(f)=>{T=f;for(;;){let a=F,q0=await z(a.worker.readiness??{},a.worker.probing??[]);if(D.signal.aborted)return;if(F!==a)continue;n(q0);return}});let O$=U&&F.worker.probing?.includes("pty.start")?H.pty.then(async(f)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(D.signal.aborted||!a())return;let q0=await z({...F.worker.readiness,"pty.start":f},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(D.signal.aborted||!a())return;n(q0)},()=>{}):Promise.resolve(),E1=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:x,drained:B.drained||W||P,activeClaims:E(),activeSessions:R,lastHeartbeat:C,expiresAt:Y,supportedOperations:[...O.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:k()&&!P&&x==="running"}),t1=!1,j1=()=>{t1=!0,K1()},K1=()=>{if(W)return;if(W=!0,x="stopping",S?.close(),E()===0)D.abort();else y=setTimeout(()=>D.abort(),$.shutdownGraceMs)},S1=$.channel==="production"||$.channel==="staging"?$.channel:null,V1=d($).releaseCheck,v=X.publishedRelease??(S1&&$.lifetime==="persistent"?N7({currentVersion:r,signal:D.signal,actedOn:(()=>{try{let f=JSON.parse(s(V1));return typeof f==="string"?f:null}catch{return null}})(),check:async(f)=>{try{c(V1,f)}catch{}let a=await H7({channel:S1});process.stderr.write(a==="started"?`Reason worker: CLI ${f} is published; the updater is checking now.
 `:a==="absent"?`Reason worker: CLI ${f} is published; no updater is installed for it here.
 `:`Reason worker: CLI ${f} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),X0=(f)=>{if(f==="stop")j1();if(f==="reload_roots"){let a=t($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=I7(J.roots,U7());if(q0)O.root_paths=q0;else delete O.root_paths;I?.check()}if(f==="drain"||f==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");B={...B,drained:f==="drain"},E0($,B)}return E1()};X.prestartedControl?.handle(X0);let w1=X.prestartedControl?await X.prestartedControl.closed:await f2($,Q,X0),H1,b1=!1,u0=()=>{let f=Date.parse(Y)-Date.now();if(f>0){H1=setTimeout(u0,Math.min(f,2147483647));return}W=!0,S?.close(),b1=!0,x="stopping",D.abort(Error("worker_credential_expired"))};u0(),X.signal?.addEventListener("abort",K1,{once:!0});let A$=X.processSignals!==!1;if(A$)process.once("SIGTERM",K1),process.once("SIGINT",j1);if(X.signal?.aborted)K1();try{X.onStartup?.("control_ready");let f=X.client??new J2(e0($.apiOrigin),y0($.proxy,T7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=C4($,J.deviceId),i=X.startupTiming,K0=i?()=>({...i(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,R0=(m)=>{let a0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&a0)(X.handOverLocalLogins??Q7)({state:m.state,client:{localSubscription:a0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=U7(),b0=m.client.liveSessionWorktrees?.bind(m.client);if(b0)L7(()=>W7({home:W0,deviceId:m.state.deviceId,liveIds:(z1)=>b0(m.state,z1,m.signal)}),m.signal)};R0({state:J,client:f,signal:D.signal});let N1=WB($,X.platform??process.platform),o1=f.deviceLifecycle?.bind(f),C0=Promise.resolve(),w0=0,R$=()=>{if(!N1||!o1||W||Date.now()<w0)return;w0=Date.now()+FB,C0=C0.then(()=>N7({paths:N1,device:J,client:{deviceLifecycle:o1},accept:LB,signal:D.signal})).catch(()=>{return})};if(R$(),N1)H.final.then((m)=>DB(N1,m),()=>{});let H2=(m,a0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+A7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:q7,operationCompletionTimeoutMs:q7,maxConsecutiveHeartbeatFailures:3,claimable:k,advertised:l,onClaim:async(W0,b0,z1)=>{let P$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let i0=F.worker.probing??[],H9=i0.includes(W0.capability)?D1:W0.capability==="hands.connect"&&$.executionMode==="host"&&i0.includes("pty.start")?O$:null;if(H9){let U2,D4=()=>{};await Promise.race([H9,new Promise((N9)=>{U2=setTimeout(N9,MB),D4=()=>N9(),b0.addEventListener("abort",D4,{once:!0})})]),clearTimeout(U2),b0.removeEventListener("abort",D4)}let N2=W0.capability==="hands.connect",L4=N2?S:null,oJ={signal:b0,emit:z1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(U2)=>m.client.operationCustomEndpointCredential(m.state,W0,U2)}:{},...N2?{handsLaunch:{claimedAtMs:P$,...L4?{takePrespawnedWorker:L4.take,adoptSpawnedWorker:L4.adopt}:{}}}:{}};if(N2)R+=1;try{return await(X.execute??u3)(m.state,W0,oJ)}finally{if(N2)R-=1}},onControl:async(W0,b0)=>await E7(m.state,W0,b0,m.client)||await S7(m.state,W0,b0)||await R7(W0,b0)||await j?.broker.control(W0,b0)||!1,onEvent:a0}),B9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:qB(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(M7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,K9=f.ownerWorkspaces?.bind(f),V9=f.ownerWorkspaceEnrollment?.bind(f);if(C$&&K9&&V9)I=e9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:K9,ownerWorkspaceEnrollment:V9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,a0,W0)=>{let b0=C4(m.config,m.state.deviceId),z1={config:m.config,state:m.state,signal:a0,statusPath:d(m.config).daemon,...b0?.offer?{firstHeartbeat:b0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new J2(e0($.apiOrigin),y0($.proxy,T7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};R0(z1);let P$={...z1,heartbeatNow:null};b.add(P$);try{await K3({registerHeartbeatNow:(i0)=>{P$.heartbeatNow=i0},...H2(z1,(i0)=>{if(i0.type==="completed")v3(i0.operationId,i0.status);if(i0.type==="claims_changed"){if(W0(i0.activeClaims),W&&E()===0)D.abort()}if(i0.type==="stopped")W0(0)})})}finally{b.delete(P$)}if(W&&!b1)await B9(z1)}});let _4=0,F4=0,W4=C$?.intervalMs??i9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>E()>0?S2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...K0?{startup:K0}:{},...H2({state:J,client:f,capabilities:O,signal:D.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&E()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=j7({log:(a0,W0)=>{process.stderr.write(`${JSON.stringify({event:a0,...W0})}
-`)}}),S.arm(),setTimeout(O7,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(I&&!W&&Date.now()>=_4)_4=Date.now()+W4,I.check().then((a0)=>{F4=a0?0:F4+1,_4=Date.now()+(a0?W4:Math.min(W4,n9*2**Math.min(F4-1,10)))});if(C=m.serverTime,P=m.drain,R$(),!W&&S1)v?.(m.latestCliVersions?.[S1]);if(!W)x="running";if(!W&&!h&&E1().executionEligible){if(h=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)x="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await I?.settled(),W&&!b1&&$.lifetime==="ephemeral")await f.disconnect?.(J,AbortSignal.timeout(M7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(W&&!b1)await B9({state:J,client:f});if(t1)await D7().catch(()=>{return})}catch(f){if(!(f instanceof _0&&f.status===401))throw f;if(E0($,{...B,revoked:!0}),f.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(H1),clearInterval(j0),y)clearTimeout(y);if(A$)process.removeListener("SIGTERM",K1),process.removeListener("SIGINT",j1);X.signal?.removeEventListener("abort",K1),D.abort(),S?.close(),await I?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await w1()}}function T7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(_7,F7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as jB,sign as zB}from"crypto";var w7=65536,OB=65536;function AB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new Y0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new Y0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!k7(X))throw new Y0("invalid_public_key");return X}function b7(){try{let{privateKey:$,publicKey:J}=jB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:AB(J)}}catch($){if($ instanceof Y0)throw $;throw new Y0("proof_key_generation_failed")}}class X2{keyPair=b7();binding=null;loadPublicKey(){if(!this.keyPair)throw new Y0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=b7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>OB)throw new Y0("proof_sign_failed");let J;try{J=zB("sha256",$,this.keyPair.privateKey)}catch{throw new Y0("proof_sign_failed")}if(!y7(J))throw new Y0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>w7)throw new Y0("invalid_binding");if(this.binding)throw new Y0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>w7)throw new Y0("invalid_binding");if(!this.binding)throw new Y0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as SB,spawn as wB}from"child_process";import{isAbsolute as bB}from"path";import{promisify as kB}from"util";var Y2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class G2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let B=this.waiter;this.waiter=void 0,B.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=Y2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
-`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(B)=>B?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as RB}from"crypto";import{unlinkSync as CB}from"fs";import{join as PB}from"path";var B2=1,$4=45000,IB=G.strictObject({type:G.literal("configure"),protocol:G.literal(B2),version:G.string(),config:J0}),xB=G.strictObject({type:G.literal("ticket"),organizationId:G.string().min(1).max(160),receipt:G.unknown()}),EB=G.strictObject({type:G.enum(["ping","stop"])});async function f7($={}){let J=$.clock??Y2,Z=new G2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),B,V,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:H,version:U}=IB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(q1(H),e(g(H),!0),V=Q1({path:d(H).lock,runtimeVersion:r}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=PB(g(H),`ssh-preflight-${RB()}.json`);try{c(M,{version:1}),s(M)}finally{try{CB(M)}catch{}}let T=t(H),_=$0(H);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&H.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:B2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=H.lifetime==="ephemeral"?K=new X2:T0(H,!0);if(!T){let W=C1(H);await Z.send({type:"ticket-request",request:W.request});let L=xB.parse(await Z.receive(70000,Q.signal)),R=W.complete(L.organizationId,L.receipt);if(T=await Z1(H,R,D,$.enroll),H.lifetime==="persistent")v0(T,d(H).state,{proofStore:D});E0(H,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");B=(async()=>{try{while(!X.signal.aborted){if(EB.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min($4,$.startupTimeoutMs??$4)),()=>{F=!0,Y()});let O=V.owner.nonce;if(await Q2(H,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(H,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:H.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(H){let U=H instanceof Error&&/^worker_[a-z_]+$/.test(H.message)?H.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await B,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>bB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,yB=G.strictObject({type:G.literal("hello"),protocol:G.literal(B2),version:G.string(),platform:G.enum(["linux","darwin"]),architecture:G.enum(["arm64","x64"]),enrolled:G.boolean()}),fB=G.strictObject({type:G.literal("ticket-request"),request:G.strictObject({install_id:G.uuid(),code_challenge:G.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:G.enum(["persistent","ephemeral"]),roots:G.array(G.strictObject({path_fingerprint:G.string().regex(/^[a-f0-9]{64}$/),execution_mode:G.enum(["confined","host"]),permissions:G.strictObject({read:G.literal(!0),write:G.literal(!0),execute:G.literal(!0),discover_environment:G.literal(!0),expose_mcp:G.literal(!1)})})).length(1)})}),h7=G.discriminatedUnion("type",[G.strictObject({type:G.literal("running"),deviceId:G.string().min(1).max(160),expiresAt:G.iso.datetime({offset:!0}),lifetime:G.enum(["persistent","ephemeral"]),supervision:G.literal("ssh-foreground")}),G.strictObject({type:G.literal("pong")}),G.strictObject({type:G.literal("stopped")})]),hB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function J4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&hB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function m7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
+`)}}):void 0),X0=(f)=>{if(f==="stop")j1();if(f==="reload_roots"){let a=t($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=x7(J.roots,q7());if(q0)O.root_paths=q0;else delete O.root_paths;I?.check()}if(f==="drain"||f==="resume"){if(W||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");B={...B,drained:f==="drain"},E0($,B)}return E1()};X.prestartedControl?.handle(X0);let w1=X.prestartedControl?await X.prestartedControl.closed:await f2($,Q,X0),H1,b1=!1,u0=()=>{let f=Date.parse(Y)-Date.now();if(f>0){H1=setTimeout(u0,Math.min(f,2147483647));return}W=!0,S?.close(),b1=!0,x="stopping",D.abort(Error("worker_credential_expired"))};u0(),X.signal?.addEventListener("abort",K1,{once:!0});let A$=X.processSignals!==!1;if(A$)process.once("SIGTERM",K1),process.once("SIGINT",j1);if(X.signal?.aborted)K1();try{X.onStartup?.("control_ready");let f=X.client??new J2(e0($.apiOrigin),y0($.proxy,_7()),Z,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=C4($,J.deviceId),i=X.startupTiming,K0=i?()=>({...i(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,R0=(m)=>{let a0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&a0)(X.handOverLocalLogins??X7)({state:m.state,client:{localSubscription:a0},signal:m.signal,home:V0()}).catch(()=>{return});let W0=q7(),b0=m.client.liveSessionWorktrees?.bind(m.client);if(b0)D7(()=>L7({home:W0,deviceId:m.state.deviceId,liveIds:(z1)=>b0(m.state,z1,m.signal)}),m.signal)};R0({state:J,client:f,signal:D.signal});let N1=LB($,X.platform??process.platform),o1=f.deviceLifecycle?.bind(f),C0=Promise.resolve(),w0=0,R$=()=>{if(!N1||!o1||W||Date.now()<w0)return;w0=Date.now()+WB,C0=C0.then(()=>U7({paths:N1,device:J,client:{deviceLifecycle:o1},accept:DB,signal:D.signal})).catch(()=>{return})};if(R$(),N1)H.final.then((m)=>jB(N1,m),()=>{});let H2=(m,a0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+R7,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:M7,operationCompletionTimeoutMs:M7,maxConsecutiveHeartbeatFailures:3,claimable:k,advertised:l,onClaim:async(W0,b0,z1)=>{let P$=Date.now();if(!m.capabilities.supported_operations.includes(W0.capability))return{status:"failed",error_code:"unsupported_capability"};let i0=F.worker.probing??[],H9=i0.includes(W0.capability)?D1:W0.capability==="hands.connect"&&$.executionMode==="host"&&i0.includes("pty.start")?O$:null;if(H9){let U2,D4=()=>{};await Promise.race([H9,new Promise((N9)=>{U2=setTimeout(N9,TB),D4=()=>N9(),b0.addEventListener("abort",D4,{once:!0})})]),clearTimeout(U2),b0.removeEventListener("abort",D4)}let N2=W0.capability==="hands.connect",L4=N2?S:null,eJ={signal:b0,emit:z1,...F,...j?{proveMac:j.broker.execute}:{},...W0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(U2)=>m.client.operationCustomEndpointCredential(m.state,W0,U2)}:{},...N2?{handsLaunch:{claimedAtMs:P$,...L4?{takePrespawnedWorker:L4.take,adoptSpawnedWorker:L4.adopt}:{}}}:{}};if(N2)R+=1;try{return await(X.execute??u3)(m.state,W0,eJ)}finally{if(N2)R-=1}},onControl:async(W0,b0)=>await S7(m.state,W0,b0,m.client)||await w7(m.state,W0,b0)||await C7(W0,b0)||await j?.broker.control(W0,b0)||!1,onEvent:a0}),B9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:MB(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(T7)).catch(()=>{return})},C$=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,K9=f.ownerWorkspaces?.bind(f),V9=f.ownerWorkspaceEnrollment?.bind(f);if(C$&&K9&&V9)I=e9({config:$,state:J,signal:D.signal,client:{ownerWorkspaces:K9,ownerWorkspaceEnrollment:V9},...C$.enroll?{enroll:C$.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,a0,W0)=>{let b0=C4(m.config,m.state.deviceId),z1={config:m.config,state:m.state,signal:a0,statusPath:d(m.config).daemon,...b0?.offer?{firstHeartbeat:b0.offer}:{},capabilities:m3(m.config,m.state,F,j?.capability),client:C$.client?.(m)??new J2(e0($.apiOrigin),y0($.proxy,_7()),m.proofStore,{deviceSession:Y3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};R0(z1);let P$={...z1,heartbeatNow:null};b.add(P$);try{await K3({registerHeartbeatNow:(i0)=>{P$.heartbeatNow=i0},...H2(z1,(i0)=>{if(i0.type==="completed")v3(i0.operationId,i0.status);if(i0.type==="claims_changed"){if(W0(i0.activeClaims),W&&E()===0)D.abort()}if(i0.type==="stopped")W0(0)})})}finally{b.delete(P$)}if(W&&!b1)await B9(z1)}});let _4=0,F4=0,W4=C$?.intervalMs??i9;if(await K3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>E()>0?S2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...K0?{startup:K0}:{},...H2({state:J,client:f,capabilities:O,signal:D.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(m)=>{if(m.type==="completed")v3(m.operationId,m.status);if(m.type==="claims_changed"){if(L=m.activeClaims,W&&E()===0)D.abort()}if(m.type==="heartbeat"&&!W){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=z7({log:(a0,W0)=>{process.stderr.write(`${JSON.stringify({event:a0,...W0})}
+`)}}),S.arm(),setTimeout(A7,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(I&&!W&&Date.now()>=_4)_4=Date.now()+W4,I.check().then((a0)=>{F4=a0?0:F4+1,_4=Date.now()+(a0?W4:Math.min(W4,n9*2**Math.min(F4-1,10)))});if(C=m.serverTime,P=m.drain,R$(),!W&&S1)v?.(m.latestCliVersions?.[S1]);if(!W)x="running";if(!W&&!h&&E1().executionEligible){if(h=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{h3({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!W)x="reconnecting";if(m.type==="stopped")L=0;X.onEvent?.(m)})}),await I?.settled(),W&&!b1&&$.lifetime==="ephemeral")await f.disconnect?.(J,AbortSignal.timeout(T7)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
+`)});else if(W&&!b1)await B9({state:J,client:f});if(t1)await j7().catch(()=>{return})}catch(f){if(!(f instanceof _0&&f.status===401))throw f;if(E0($,{...B,revoked:!0}),f.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(H1),clearInterval(j0),y)clearTimeout(y);if(A$)process.removeListener("SIGTERM",K1),process.removeListener("SIGINT",j1);X.signal?.removeEventListener("abort",K1),D.abort(),S?.close(),await I?.settled().catch(()=>{return}),await j?.broker.close().catch(()=>{return}),await w1()}}function _7($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(F7,W7),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as zB,sign as OB}from"crypto";var b7=65536,AB=65536;function RB($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new Y0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new Y0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!y7(X))throw new Y0("invalid_public_key");return X}function k7(){try{let{privateKey:$,publicKey:J}=zB("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:RB(J)}}catch($){if($ instanceof Y0)throw $;throw new Y0("proof_key_generation_failed")}}class X2{keyPair=k7();binding=null;loadPublicKey(){if(!this.keyPair)throw new Y0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=k7(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>AB)throw new Y0("proof_sign_failed");let J;try{J=OB("sha256",$,this.keyPair.privateKey)}catch{throw new Y0("proof_sign_failed")}if(!f7(J))throw new Y0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>b7)throw new Y0("invalid_binding");if(this.binding)throw new Y0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>b7)throw new Y0("invalid_binding");if(!this.binding)throw new Y0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as wB,spawn as bB}from"child_process";import{isAbsolute as kB}from"path";import{promisify as yB}from"util";var Y2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class G2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let B=this.waiter;this.waiter=void 0,B.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=Y2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
+`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(B)=>B?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as CB}from"crypto";import{unlinkSync as PB}from"fs";import{join as IB}from"path";var B2=1,$4=45000,xB=G.strictObject({type:G.literal("configure"),protocol:G.literal(B2),version:G.string(),config:J0}),EB=G.strictObject({type:G.literal("ticket"),organizationId:G.string().min(1).max(160),receipt:G.unknown()}),SB=G.strictObject({type:G.enum(["ping","stop"])});async function h7($={}){let J=$.clock??Y2,Z=new G2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),B,V,K,N,q=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:H,version:U}=xB.parse(await Z.receive(30000,Q.signal));if(U!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(q1(H),e(g(H),!0),V=Q1({path:d(H).lock,runtimeVersion:r}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=IB(g(H),`ssh-preflight-${CB()}.json`);try{c(M,{version:1}),s(M)}finally{try{PB(M)}catch{}}let T=t(H),_=$0(H);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&H.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:B2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let D=H.lifetime==="ephemeral"?K=new X2:T0(H,!0);if(!T){let W=C1(H);await Z.send({type:"ticket-request",request:W.request});let L=EB.parse(await Z.receive(70000,Q.signal)),R=W.complete(L.organizationId,L.receipt);if(T=await Z1(H,R,D,$.enroll),H.lifetime==="persistent")v0(T,d(H).state,{proofStore:D});E0(H,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");B=(async()=>{try{while(!X.signal.aborted){if(SB.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let j=!1,z,F=!1;N=J.after(Math.max(1,Math.min($4,$.startupTimeoutMs??$4)),()=>{F=!0,Y()});let O=V.owner.nonce;if(await Q2(H,T,D,O,{...$,signal:Q.signal,onEvent(W){if($.onEvent?.(W),W.type==="heartbeat"&&!j&&!z)z=(async()=>{let L=await H0(H,"status");if(!L?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:L.deviceId,expiresAt:L.expiresAt,lifetime:H.lifetime,supervision:"ssh-foreground"}),j=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await z,F||!j)throw Error("worker_ssh_outbound_or_readiness_failed");return q=!0,0}catch(H){let U=H instanceof Error&&/^worker_[a-z_]+$/.test(H.message)?H.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:U})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await B,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),q)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var l3=($)=>kB($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),d3=($)=>`'${$.replaceAll("'","'\\''")}'`,fB=G.strictObject({type:G.literal("hello"),protocol:G.literal(B2),version:G.string(),platform:G.enum(["linux","darwin"]),architecture:G.enum(["arm64","x64"]),enrolled:G.boolean()}),hB=G.strictObject({type:G.literal("ticket-request"),request:G.strictObject({install_id:G.uuid(),code_challenge:G.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:G.enum(["persistent","ephemeral"]),roots:G.array(G.strictObject({path_fingerprint:G.string().regex(/^[a-f0-9]{64}$/),execution_mode:G.enum(["confined","host"]),permissions:G.strictObject({read:G.literal(!0),write:G.literal(!0),execute:G.literal(!0),discover_environment:G.literal(!0),expose_mcp:G.literal(!1)})})).length(1)})}),m7=G.discriminatedUnion("type",[G.strictObject({type:G.literal("running"),deviceId:G.string().min(1).max(160),expiresAt:G.iso.datetime({offset:!0}),lifetime:G.enum(["persistent","ephemeral"]),supervision:G.literal("ssh-foreground")}),G.strictObject({type:G.literal("pong")}),G.strictObject({type:G.literal("stopped")})]),mB=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function J4($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&mB.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function v7($){if(!l3($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
 a=${d3($.remoteCli)}
 [ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
 p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
@@ -101,11 +101,11 @@ elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
 else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
 h=\${h%% *}
 [ "$h" = ${d3($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function v7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,m7($)]}function mB($){return v7($,!1)}function g7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function vB($){let J;try{({stdout:J}=await kB(SB)("/usr/bin/ssh",["-G",...v7($,!0)],{env:g7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
-`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function gB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function uB($){await vB($);let J=wB("/usr/bin/ssh",mB($),{stdio:["pipe","pipe","pipe"],env:g7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let B=gB(Z);Z="",X({exitCode:Y??1,errorCode:B})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function dB($){let J=new Map,Z=!1;for(let B=0;B<$.length;B++){let V=$[B];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++B];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(B)=>{let V=J.get(B);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");m7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(K2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function lB($,J,Z,Q,X){let{request:Y}=fB.parse(J4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let B=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{B();let N=Z??A1(J),q=await(Q.enrollmentCredentials??R1)(J,N);if(B(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let H=Q.createTicketClient?.(q)??new U1(q,{credentialsPath:N}),U=w4(await H.createHeadlessDeviceEnrollmentTicket(Y));return B(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([V,new Promise((q,H)=>{if(K=()=>H(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);B(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function u7($,J={}){let{config:Z,target:Q,credentialPath:X}=dB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??Y2,B=await(J.sshTransport??uB)(Q),V=new G2(B.output,B.input,Y),K=new AbortController,N=()=>K.abort(),q,H;if(B.result.then((U)=>{H=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:B2,version:r,config:Z});let U=yB.parse(J4(await V.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await lB(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));q=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:E4)+$4+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=h7.parse(J4(await V.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
-`)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(h7.parse(J4(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=H??await Promise.race([B.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),B.close(),V.dispose()}}import{createConnection as iB}from"net";import{WebSocket as Z4}from"ws";var pB=1,F$=65536,d7=4096,l7=67108864,p7=4194304,_$=G.uuid(),cB=G.strictObject({kind:G.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:G.literal("install"),generation:G.number().int().positive(),transport:G.literal("reverse_ssh"),expiresAt:G.iso.datetime({offset:!0}),maxDurationMs:G.literal(300000),maxChannels:G.literal(1),allowTcpForwarding:G.literal(!1),allowPty:G.literal(!1)}),sB=G.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var aB=G.strictObject({protocol:G.literal(pB),type:G.literal("ssh_install_relay"),authorityToken:G.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:cB,relayUrl:sB,endpoint:G.strictObject({host:G.literal("127.0.0.1"),port:G.literal(22)})});function p3($,J=Date.now()){let Z=aB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function c7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function s7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var a7="ssh_install_relay_closed";function nB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function rB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function tB($,J=a7){try{$.close(1000,J)}catch{$.terminate()}}async function oB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new Z4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>iB({host:"127.0.0.1",port:22})),B,V=!1,K=!1,N=0,q=0,H,U=(W)=>{if(H)clearTimeout(H);H=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),H.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=a7)=>{if(K)return;if(K=!0,H)clearTimeout(H);if($.signal?.removeEventListener("abort",D),B?.destroy(),X.readyState===Z4.OPEN)tB(X,W);else if(X.readyState!==Z4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=d7&&q<=l7},F=(W)=>{if(K||!V||X.readyState!==Z4.OPEN||X.bufferedAmount>p7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=c7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let R=nB(W);if(R>F$||!z(R))return j();if(!V){if(L)return j();try{let C=s7(JSON.parse(String(W)));if(C.type!=="ssh_install_relay_ready"||C.authorityId!==Z.authority.authorityId)return j();V=!0,U(Z.authority.maxDurationMs),B=Y(),B.setNoDelay(!0),B.on("data",F),B.on("error",j),B.on("close",()=>_("ssh_install_relay_peer_closed")),B.on("drain",()=>X._socket?.resume()),B.on("connect",()=>{})}catch{j()}return}if(!L)return j();let x=rB(W);if(!x||!B||B.destroyed||!B.write(x))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function i7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await oB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as eB}from"crypto";var n1="ARA_WORKER_PREVIEW_PROBE";async function r7(){if(typeof Bun>"u")return 1;let $=eB(32).toString("base64url"),J,Z=new Promise((B)=>{J=B}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(B,V){let K=new URL(B.url).pathname;if(B.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(n1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(B,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(B,V){if(typeof V!=="string"||V.length>8192){B.close();return}if(!B.data.relay){if(V===n1)B.send(n1);else B.close();return}try{let K=n7(V),N=(q)=>B.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(B.data.http+=Buffer.from(K.data,"base64").toString(),B.data.http.length>n1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&B.data.http===n1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(n1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===n1&&!B.data.reported)B.data.reported=!0,process.stdout.write(`ready
+exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${d3(J)}`}function g7($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!l3($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,v7($)]}function vB($){return g7($,!1)}function u7(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:V0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function gB($){let J;try{({stdout:J}=await yB(wB)("/usr/bin/ssh",["-G",...g7($,!0)],{env:u7(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
+`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function uB($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function dB($){await gB($);let J=bB("/usr/bin/ssh",vB($),{stdio:["pipe","pipe","pipe"],env:u7()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let B=uB(Z);Z="",X({exitCode:Y??1,errorCode:B})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function lB($){let J=new Map,Z=!1;for(let B=0;B<$.length;B++){let V=$[B];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++B];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(B)=>{let V=J.get(B);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!l3(X.sshConfig))throw Error("worker_ssh_invalid_target");v7(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(K2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function pB($,J,Z,Q,X){let{request:Y}=hB.parse(J4(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let B=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{B();let N=Z??A1(J),q=await(Q.enrollmentCredentials??R1)(J,N);if(B(),!q)throw Error("worker_session_login_required");if(!z0(q.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!q.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let H=Q.createTicketClient?.(q)??new U1(q,{credentialsPath:N}),U=w4(await H.createHeadlessDeviceEnrollmentTicket(Y));return B(),{type:"ticket",organizationId:q.orgId,receipt:U}})(),K;try{let N=await Promise.race([V,new Promise((q,H)=>{if(K=()=>H(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);B(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function d7($,J={}){let{config:Z,target:Q,credentialPath:X}=lB($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??Y2,B=await(J.sshTransport??dB)(Q),V=new G2(B.output,B.input,Y),K=new AbortController,N=()=>K.abort(),q,H;if(B.result.then((U)=>{H=U}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:B2,version:r,config:Z});let U=fB.parse(J4(await V.receive(30000,K.signal)));if(U.version!==r)throw Error("worker_ssh_version_mismatch");if(!U.enrolled)await pB(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));q=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(U.enrolled?0:E4)+$4+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),D=m7.parse(J4(await V.receive(_,K.signal)));if(D.type==="running"){if(M||D.lifetime!==Z.lifetime||Date.parse(D.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(D)+`
+`)}if(D.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(U){if(K.signal.aborted){q?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(m7.parse(J4(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(U instanceof Error&&U.message==="worker_ssh_connection_closed"){let M=H??await Promise.race([B.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw U}finally{q?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),B.close(),V.dispose()}}import{createConnection as nB}from"net";import{WebSocket as Z4}from"ws";var cB=1,F$=65536,l7=4096,p7=67108864,c7=4194304,_$=G.uuid(),sB=G.strictObject({kind:G.literal("install_only"),authorityId:_$,organizationId:_$,userId:_$,connectionId:_$,attemptId:_$,purpose:G.literal("install"),generation:G.number().int().positive(),transport:G.literal("reverse_ssh"),expiresAt:G.iso.datetime({offset:!0}),maxDurationMs:G.literal(300000),maxChannels:G.literal(1),allowTcpForwarding:G.literal(!1),allowPty:G.literal(!1)}),aB=G.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!_$.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var iB=G.strictObject({protocol:G.literal(cB),type:G.literal("ssh_install_relay"),authorityToken:G.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:sB,relayUrl:aB,endpoint:G.strictObject({host:G.literal("127.0.0.1"),port:G.literal(22)})});function p3($,J=Date.now()){let Z=iB.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function s7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F$)throw Error("ssh_install_relay_frame_too_large");return J}function a7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:p3(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var i7="ssh_install_relay_closed";function rB($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function tB($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function oB($,J=i7){try{$.close(1000,J)}catch{$.terminate()}}async function eB($){let J=$.now??(()=>Date.now()),Z=p3($.receipt,J()),X=($.createWebSocket??((W)=>new Z4(W,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F$})))(Z.relayUrl),Y=$.connectLocal??(()=>nB({host:"127.0.0.1",port:22})),B,V=!1,K=!1,N=0,q=0,H,U=(W)=>{if(H)clearTimeout(H);H=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,W)),H.unref?.()},M,T=new Promise((W)=>{M=W}),_=(W=i7)=>{if(K)return;if(K=!0,H)clearTimeout(H);if($.signal?.removeEventListener("abort",D),B?.destroy(),X.readyState===Z4.OPEN)oB(X,W);else if(X.readyState!==Z4.CLOSED)X.terminate();M()},D=()=>_("ssh_install_relay_aborted"),j=()=>_("ssh_install_relay_protocol_error"),z=(W)=>{return N+=1,q+=W,W<=F$&&N<=l7&&q<=p7},F=(W)=>{if(K||!V||X.readyState!==Z4.OPEN||X.bufferedAmount>c7||!z(W.length)){j();return}X.send(W,{binary:!0},(L)=>{if(L)j()})};X.on("open",()=>{if(K)return;try{let W=s7({type:"ssh_install_relay_receipt",receipt:Z});X.send(W,{binary:!1},(L)=>{if(L)j()})}catch{j()}}),X.on("message",(W,L)=>{if(K)return;let R=rB(W);if(R>F$||!z(R))return j();if(!V){if(L)return j();try{let C=a7(JSON.parse(String(W)));if(C.type!=="ssh_install_relay_ready"||C.authorityId!==Z.authority.authorityId)return j();V=!0,U(Z.authority.maxDurationMs),B=Y(),B.setNoDelay(!0),B.on("data",F),B.on("error",j),B.on("close",()=>_("ssh_install_relay_peer_closed")),B.on("drain",()=>X._socket?.resume()),B.on("connect",()=>{})}catch{j()}return}if(!L)return j();let x=tB(W);if(!x||!B||B.destroyed||!B.write(x))X._socket?.pause()}),X.on("error",j),X.on("close",()=>_("ssh_install_relay_peer_closed"));let O=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(U(O),$.signal?.addEventListener("abort",D,{once:!0}),$.signal?.aborted)D();return{receipt:Z,closed:T,close:()=>_()}}async function n7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F$)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await eB({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as $K}from"crypto";var n1="ARA_WORKER_PREVIEW_PROBE";async function t7(){if(typeof Bun>"u")return 1;let $=$K(32).toString("base64url"),J,Z=new Promise((B)=>{J=B}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(B,V){let K=new URL(B.url).pathname;if(B.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(n1);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(B,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(B,V){if(typeof V!=="string"||V.length>8192){B.close();return}if(!B.data.relay){if(V===n1)B.send(n1);else B.close();return}try{let K=r7(V),N=(q)=>B.send(JSON.stringify(q));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(B.data.http+=Buffer.from(K.data,"base64").toString(),B.data.http.length>n1.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&B.data.http===n1)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(n1).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===n1&&!B.data.reported)B.data.reported=!0,process.stdout.write(`ready
 `);else throw Error("probe_protocol_failed")}catch{B.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
-`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as ZK,createReadStream as QK,fstatSync as XK,readFileSync as YK}from"fs";var t7="/run/sc/instance-generation";var $K=/^[1-9][0-9]{0,15}\n?$/;function JK($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function o7($){if(typeof $!=="string"||!$K.test($))return null;let J=Number($.trim());return JK(J)?J:null}var e7=3,GK=600000,BK=65536,KK=500;function $J($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(e7))throw Error("worker_standby_invalid_invocation");return{handoffFd:e7}}function VK($=(J)=>YK(J,"utf8")){try{return o7($(t7))}catch{return null}}function HK($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=x4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var JJ={isPipe:($)=>XK($).isFIFO(),stream:($)=>{let J=QK("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function NK($,J=JJ){if(!J.isPipe($.fd)){try{ZK($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??GK),Q=J.stream($.fd),X=null,Y=()=>{},B=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});B.catch(()=>{});let V=J.every(KK,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],H=0;for await(let U of Q.chunks){if(X)throw X;if(H===0)$.onArriving?.();if(H+=U.length,H>BK)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,B]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function ZJ($,J=JJ){let Z=$.readGeneration??(()=>VK()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await NK({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return HK(Y)}var UK=`Usage: reason worker <command> --config PATH [--json]
+`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as QK,createReadStream as XK,fstatSync as YK,readFileSync as GK}from"fs";var o7="/run/sc/instance-generation";var JK=/^[1-9][0-9]{0,15}\n?$/;function ZK($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function e7($){if(typeof $!=="string"||!JK.test($))return null;let J=Number($.trim());return ZK(J)?J:null}var $J=3,BK=600000,KK=65536,VK=500;function JJ($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String($J))throw Error("worker_standby_invalid_invocation");return{handoffFd:$J}}function HK($=(J)=>GK(J,"utf8")){try{return e7($(o7))}catch{return null}}function NK($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=x4.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var ZJ={isPipe:($)=>YK($).isFIFO(),stream:($)=>{let J=XK("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function UK($,J=ZJ){if(!J.isPipe($.fd)){try{QK($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??BK),Q=J.stream($.fd),X=null,Y=()=>{},B=new Promise((K,N)=>{Y=(q)=>{X??=q,N(q)}});B.catch(()=>{});let V=J.every(VK,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let q=[],H=0;for await(let U of Q.chunks){if(X)throw X;if(H===0)$.onArriving?.();if(H+=U.length,H>KK)throw Error("worker_standby_handoff_too_large");q.push(U)}return Buffer.concat(q).toString("utf8")})(),N=await Promise.race([K,B]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function QJ($,J=ZJ){let Z=$.readGeneration??(()=>HK()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await UK({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return NK(Y)}var qK=`Usage: reason worker <command> --config PATH [--json]
 
   enroll                        Obtain/redeem a ticket using the current Reason login
   start                         Run the existing Device daemon in the foreground
@@ -146,15 +146,15 @@ Pretrust known_hosts. No agent forwarding, automatic installation or detached se
 SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
 are not forwarded/supported; running is not a browser-readiness receipt.
 Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function qK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,B=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!B){B=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:B}}var MK=1e4,TK=2000,QJ=15000,_K=50;async function YJ($,J,Z,Q,X,Y){let B=new X2,V=new AbortController,K,N,q=new Promise((x,C)=>{K=x,N=C});if(q.catch(()=>{}),d0(),$.executionMode==="host")Z2();Z("enrollment_started");let H=X(B);H.catch(()=>{});let U=null,M=f2($,J,(x)=>{if(!U)throw Error("worker_starting");return U(x)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((x)=>{z=x}),O=setTimeout(()=>z(),MK);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(x)=>{if(x==="ready")W=setTimeout(()=>z(),TK);Q.onStartup?.(x)},R=i$($,Q.readinessProbes,D,q,void 0,j,F);R.final.catch(()=>{});try{let x;try{x=await H}catch(C){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((P)=>P(),()=>{}),C}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(QJ,Date.parse(x.worker?.expiresAt??"")-Date.now()||QJ))),K(x.roots[0].permissions),E0($,{version:1,drained:!1,revoked:!1}),await Q2($,x,B,J,{...Q,onStartup:L,prestartedReadiness:R,prestartedControl:{closed:M,handle:(C)=>{U=C}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),V.abort(),B.deleteBinding(),B.deleteKey(),await M.then((x)=>x(),()=>{})}}async function FK($,J,Z,Q){let{handoffFd:X}=$J($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,B,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>a$(T);if(K||!M)return;try{d0(),Z2()}catch{return}if(Y=v5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{l2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(B),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??ZJ)({fd:X,onBooted:()=>{Q("standby_booted"),B=setTimeout(V,_K)},onArriving:()=>clearTimeout(B)})}catch(M){clearTimeout(B);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
-`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(B),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:H,enrollment:U}=q;try{e(g(H),!0);let M=await GJ(H,()=>{});try{if(Q("lock_acquired"),t(H))throw Error("worker_ephemeral_requires_fresh_enrollment");return q1(H),await YJ(H,M.owner.nonce,Q,Z,(T)=>Z1(H,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function _1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,B=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
+`;function MK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,B=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!B){B=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:B}}var TK=1e4,_K=2000,XJ=15000,FK=50;async function GJ($,J,Z,Q,X,Y){let B=new X2,V=new AbortController,K,N,q=new Promise((x,C)=>{K=x,N=C});if(q.catch(()=>{}),d0(),$.executionMode==="host")Z2();Z("enrollment_started");let H=X(B);H.catch(()=>{});let U=null,M=f2($,J,(x)=>{if(!U)throw Error("worker_starting");return U(x)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,D=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),j=Y?.matches($)?Y.result:void 0;if(Y&&!j)await Y.stop();if(j)D.addEventListener("abort",()=>void Y.stop(),{once:!0});let z,F=new Promise((x)=>{z=x}),O=setTimeout(()=>z(),TK);D.addEventListener("abort",()=>z(),{once:!0});let W,L=(x)=>{if(x==="ready")W=setTimeout(()=>z(),_K);Q.onStartup?.(x)},R=i$($,Q.readinessProbes,D,q,void 0,j,F);R.final.catch(()=>{});try{let x;try{x=await H}catch(C){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((P)=>P(),()=>{}),C}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(XJ,Date.parse(x.worker?.expiresAt??"")-Date.now()||XJ))),K(x.roots[0].permissions),E0($,{version:1,drained:!1,revoked:!1}),await Q2($,x,B,J,{...Q,onStartup:L,prestartedReadiness:R,prestartedControl:{closed:M,handle:(C)=>{U=C}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(O),clearTimeout(W),V.abort(),B.deleteBinding(),B.deleteKey(),await M.then((x)=>x(),()=>{})}}async function WK($,J,Z,Q){let{handoffFd:X}=JJ($);if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,B,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>a$(T);if(K||!M)return;try{d0(),Z2()}catch{return}if(Y=g5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{l2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(B),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let q;try{q=await(J.receiveStandbyHandoff??QJ)({fd:X,onBooted:()=>{Q("standby_booted"),B=setTimeout(V,FK)},onArriving:()=>clearTimeout(B)})}catch(M){clearTimeout(B);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
+`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(B),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:H,enrollment:U}=q;try{e(g(H),!0);let M=await BJ(H,()=>{});try{if(Q("lock_acquired"),t(H))throw Error("worker_ephemeral_requires_fresh_enrollment");return q1(H),await GJ(H,M.owner.nonce,Q,Z,(T)=>Z1(H,U,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function _1($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,B=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
 `),J.onStartup?.(K)},V={...J,onStartup:B,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(H)=>Math.min($$,Math.max(0,Math.round(H))),N=Y.get("readiness_started"),q=Y.get("readiness_completed");return{service_start_to_heartbeat_ms:K(performance.now()-(Y.get("handoff_received")??0)),...N!==void 0&&q!==void 0?{readiness_ms:K(q-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
-`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await r7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await u7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await i7();return await f7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await h2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
-`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await FK($,J,V,B);let K=qK($);if(!K)return Z.stdout.write(UK),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
-`),H=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!H||!!M,deviceId:H?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:H||M?Date.parse(H?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{q1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":H&&T0(N)instanceof e1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(H||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(LK);return 0}}e(g(N),!0);let U=await GJ(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(K.action==="start")B("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")E0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");q1(N);let D=()=>{h0(N),p9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await S4(N,T,O,J.enroll):await XJ(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof J1)||!O.deviceRemoved)throw O;return D(),j()});return v0(F,d(N).state,{proofStore:z}),E0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new J2(e0(N.apiOrigin),y0(N.proxy),T);if(E0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return h0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(q1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await YJ(N,U.owner.nonce,B,V,async(T)=>K.enrollmentPath?S4(N,K.enrollmentPath,T,J.enroll):XJ(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Q2(N,M,T0(N),U.owner.nonce,V)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
+`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||W$(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await t7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await d7($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await n7();return await h7(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await h2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
+`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await WK($,J,V,B);let K=MK($);if(!K)return Z.stdout.write(qK),0;if(W$(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),q=(M)=>Z.stdout.write(JSON.stringify(M)+`
+`),H=t(N);if(K.action==="status"||K.action==="doctor"){let M=await H0(N,"status"),T=$0(N),_={enrolled:!!H||!!M,deviceId:H?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:H||M?Date.parse(H?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return q(_),0;let D=!0;try{q1(N)}catch{D=!1}return q({..._,workspace:D,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":H&&T0(N)instanceof e1?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),D&&(H||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await H0(N,M);if(T){if(q(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(DK);return 0}}e(g(N),!0);let U=await BJ(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
+`)});try{if(K.action==="start")B("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")E0(N,{...T,drained:K.action==="drain"});return q({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");q1(N);let D=()=>{h0(N),p9(N)};if(_)D();let j=async()=>{let O=W2(N),W=T?await S4(N,T,O,J.enroll):await YJ(N,K.credentialPath,J,O);return{proof:O,enrolled:W}},{proof:z,enrolled:F}=await j().catch((O)=>{if(T||!(O instanceof J1)||!O.deviceRemoved)throw O;return D(),j()});return v0(F,d(N).state,{proofStore:z}),E0(N,{version:1,drained:!1,revoked:!1}),q({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new J2(e0(N.apiOrigin),y0(N.proxy),T);if(E0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return h0(N),q({revoked:!0,localKeyRemoved:!0}),0}if(q1(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await GJ(N,U.owner.nonce,B,V,async(T)=>K.enrollmentPath?S4(N,K.enrollmentPath,T,J.enroll):YJ(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await Q2(N,M,T0(N),U.owner.nonce,V)}return 0}finally{U.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
 `);let q=$.includes("--json")?void 0:B$(K instanceof J1&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(q)Z.stderr.write(`${q}
-`);return N==="worker_revoked"&&X?0:1}}var WK=60000;async function GJ($,J){let Z=Date.now()+$.shutdownGraceMs+WK,Q=!1;for(;;){let X=Q1({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var LK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function XJ($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return Z1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??A1($),B=await(Z.enrollmentCredentials??R1)($,Y);if(!B)throw Error(X);let V=Z.createTicketClient?.(B)??new U1(B,{credentialsPath:Y,fetchImpl:y0($.proxy)});return l9($,B,V,Q,Z.enroll)}import{spawn as DK}from"child_process";import{existsSync as jK,readFileSync as zK,unlinkSync as OK}from"fs";import{join as AK}from"path";var RK=120,CK=15,PK=5000;function Q4($={}){let J=$.stateDirectory?AK($.stateDirectory,IK):null;if(J)xK(J);let Z=["/bin/bash","/usr/bin/bash"].find((H)=>jK(H));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??RK)),X=$.pid??process.pid,Y=Math.min(CK,Q),B=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${BJ(r)} > ${BJ(J)} 2>/dev/null
+`);return N==="worker_revoked"&&X?0:1}}var LK=60000;async function BJ($,J){let Z=Date.now()+$.shutdownGraceMs+LK,Q=!1;for(;;){let X=Q1({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await H0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var DK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function YJ($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return Z1($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??A1($),B=await(Z.enrollmentCredentials??R1)($,Y);if(!B)throw Error(X);let V=Z.createTicketClient?.(B)??new U1(B,{credentialsPath:Y,fetchImpl:y0($.proxy)});return l9($,B,V,Q,Z.enroll)}import{spawn as jK}from"child_process";import{existsSync as zK,readFileSync as OK,unlinkSync as AK}from"fs";import{join as RK}from"path";var CK=120,PK=15,IK=5000;function Q4($={}){let J=$.stateDirectory?RK($.stateDirectory,xK):null;if(J)EK(J);let Z=["/bin/bash","/usr/bin/bash"].find((H)=>zK(H));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??CK)),X=$.pid??process.pid,Y=Math.min(PK,Q),B=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${KJ(r)} > ${KJ(J)} 2>/dev/null
 `:"",V=(H)=>`[ $((SECONDS - started)) -ge ${Math.max(1,H-1)} ]`,K=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
 while :; do started=$SECONDS
 IFS= read -r -t ${Q} pulse && continue
@@ -166,8 +166,8 @@ if ${V(Y)} && parent_is_worker; then
   ${B}kill -KILL ${X}
 fi
 exit 0
-done`,N=DK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
-`),Math.min(PK,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var IK="worker-stalled";function BJ($){return`'${$.replaceAll("'","'\\''")}'`}function xK($){let J;try{J=zK($,"utf8"),OK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{g$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var yK=`Share this computer as a machine
+done`,N=jK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let q=setInterval(()=>N.stdin.write(`
+`),Math.min(IK,Q*1000/4));return q.unref(),N.unref(),{stop(){clearInterval(q),N.stdin.end()}}}var xK="worker-stalled";function KJ($){return`'${$.replaceAll("'","'\\''")}'`}function EK($){let J;try{J=OK($,"utf8"),AK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{g$(C2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var fK=`Share this computer as a machine
 
 Usage:
   reason serve                     This computer, signed in (machine name: its hostname)
@@ -210,20 +210,20 @@ the worker unless --sandbox is set. Settings live in
 ~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
 folder served for NAME is its own worker. Use
 \`reason worker status|revoke --config <that file>\` for advanced control.
-`,fK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,hK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,NJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",KJ=["REASON_TOKEN","REASON_MACHINE_TOKEN"],UJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&u$(J)&&J!==w2?J:UJ}class Q0 extends Error{}function mK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let H=$[N+1];if(!H||H.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,H),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!u$(Z)&&!fK.test(Z))throw new Q0(NJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let B=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(B!==void 0){if(!B.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!hK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...B===void 0?{}:{token:B},...V===void 0?{}:{org:V.toLowerCase()}}}function B4($,J){let Z=kK($,J??"."),Q;try{Q=HJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!wK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var X4=($)=>r1($,".reason","workers"),c3=($)=>u(d($).state);function vK($,J,Z){let Q=r1(X4($),J);if(I0(r1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return r1(X4($),`${J}@${EK("sha256").update(Z).digest("hex").slice(0,8)}`)}function qJ($){let{stateDirectory:J}=$;if(K2($.workspaceRoot,J)||K2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function I0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function gK($,J){$.stdout.write(`${J} [y/N] `);let Z=await R9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function K4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var uK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function MJ($){try{return await $()}catch(J){let Z=J instanceof G0?uK[J.code]:void 0;throw Z?Error(Z):J}}async function dK($,J,Z,Q){let X=qJ({...J,name:$.name??UJ,stateDirectory:r1(X4(Z),".token-enrollment")}),Y=C1(X,{stored:!1}),B=await MJ(()=>S9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!u$(B.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==B.machine_name.toLowerCase())throw new Q0(`This token is for machine "${B.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==B.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${B.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??B.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(B.organization_id,B)}}}function lK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??R1)(X);if(!Y)throw Error("worker_session_login_required");let B=(Z.createApi??((V)=>new U1(V)))(Y);return d9(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>MJ(async()=>{try{return await B.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await B.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
-`)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return B.createMachineEnrollmentTicket($,V)})})}}async function TJ($,J,Z,Q){let X=await h2($,Q,()=>VJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!W1($,J,Z))return null;return c4($),X}function i3($,J){let Z=X4($);if(!u(Z))return[];let Q=J.toLowerCase();return SK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let B=r1(Z,X,"worker.json"),V=I0(B);return V?[{path:B,config:V}]:[]})}async function pK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let B=Q.controlWorker??H0,V=[];for(let K of Y){let N=await B(K.config,"stop")!==null,q=G4(K.config,X),H=N||q!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:H,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
+`,hK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,mK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,UJ="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",VJ=["REASON_TOKEN","REASON_MACHINE_TOKEN"],qJ="my-computer";function a3($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&u$(J)&&J!==w2?J:qJ}class Q0 extends Error{}function vK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let q=$[N];if(q==="--help"||q==="-h"||q==="help")return null;if(q==="--dir"||q==="--token"||q==="--org"){let H=$[N+1];if(!H||H.startsWith("-"))throw new Q0(`Missing value after ${q}.`);if(Q.has(q))throw new Q0(`${q} may be specified only once.`);Q.set(q,H),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(q)){X.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new Q0(`Unknown option: ${q}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=q}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!u$(Z)&&!hK.test(Z))throw new Q0(UJ);if(Z.toLowerCase()===w2)throw new Q0(`"${w2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let B=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(B!==void 0){if(!B.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!mK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...B===void 0?{}:{token:B},...V===void 0?{}:{org:V.toLowerCase()}}}function B4($,J){let Z=yK($,J??"."),Q;try{Q=NJ(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!bK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var X4=($)=>r1($,".reason","workers"),c3=($)=>u(d($).state);function gK($,J,Z){let Q=r1(X4($),J);if(I0(r1(Q,"worker.json"))?.workspaceRoot===Z)return Q;return r1(X4($),`${J}@${SK("sha256").update(Z).digest("hex").slice(0,8)}`)}function MJ($){let{stateDirectory:J}=$;if(K2($.workspaceRoot,J)||K2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function I0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function s3($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function uK($,J){$.stdout.write(`${J} [y/N] `);let Z=await R9($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function K4($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var dK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function TJ($){try{return await $()}catch(J){let Z=J instanceof G0?dK[J.code]:void 0;throw Z?Error(Z):J}}async function lK($,J,Z,Q){let X=MJ({...J,name:$.name??qJ,stateDirectory:r1(X4(Z),".token-enrollment")}),Y=C1(X,{stored:!1}),B=await TJ(()=>S9({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!u$(B.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==B.machine_name.toLowerCase())throw new Q0(`This token is for machine "${B.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==B.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${B.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??B.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(B.organization_id,B)}}}function pK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??R1)(X);if(!Y)throw Error("worker_session_login_required");let B=(Z.createApi??((V)=>new U1(V)))(Y);return d9(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>TJ(async()=>{try{return await B.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof G0)||K.code!=="machine_not_found")throw K}try{await B.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
+`)}catch(K){if(!(K instanceof G0)||K.status!==409)throw K}return B.createMachineEnrollmentTicket($,V)})})}}async function _J($,J,Z,Q){let X=await h2($,Q,()=>HJ($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!W1($,J,Z))return null;return c4($),X}function i3($,J){let Z=X4($);if(!u(Z))return[];let Q=J.toLowerCase();return wK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let B=r1(Z,X,"worker.json"),V=I0(B);return V?[{path:B,config:V}]:[]})}async function cK($,J,Z,Q,X){let Y=i3(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let B=Q.controlWorker??H0,V=[];for(let K of Y){let N=await B(K.config,"stop")!==null,q=G4(K.config,X),H=N||q!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:H,service:q?.label??null}),!$.json&&q)Z.stdout.write(`Removed background service ${q.label} (${K.config.workspaceRoot}); it won't start again.
 `);if(!$.json)Z.stdout.write(H?`Stopping machine "${$.name}" in ${K.config.workspaceRoot}; current work finishes first.
 `:`Machine "${$.name}" in ${K.config.workspaceRoot} is not running.
 `)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:V})}
-`);return 0}async function _J($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??_1,X=J.env??process.env,Y=KJ.map((B)=>X[B]?.trim()).find(Boolean)||void 0;if(!J.env)for(let B of KJ)delete process.env[B];try{let B=mK($,Y);if(!B)return Z.stdout.write(yK),0;let V=HJ(J.home??V0()),K=J.serviceHost??G1(V);if(B.stop)return await pK({...B,name:B.name},V,Z,J,K);let N=J.channel??x0(),q=B4(J.cwd??process.cwd(),B.dir),H=B.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:B.once,sandbox:B.sandbox},M=B.token?await dK({...B,token:B.token},U,V,J):void 0,T=M?.name??B.name??a3((J.hostname??bK)()),_=vK(V,T,q),D=r1(_,"worker.json"),j=I0(D);if(M&&j&&c3(j)&&$0(j).revoked)h0(j);let z=!M&&j!==null&&c3(j)&&(!k0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=qJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
+`);return 0}async function FJ($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??_1,X=J.env??process.env,Y=VJ.map((B)=>X[B]?.trim()).find(Boolean)||void 0;if(!J.env)for(let B of VJ)delete process.env[B];try{let B=vK($,Y);if(!B)return Z.stdout.write(fK),0;let V=NJ(J.home??V0()),K=J.serviceHost??G1(V);if(B.stop)return await cK({...B,name:B.name},V,Z,J,K);let N=J.channel??x0(),q=B4(J.cwd??process.cwd(),B.dir),H=B.service?L$(K,X):void 0,U={channel:N,apiOrigin:y1(X,N),workspaceRoot:q,once:B.once,sandbox:B.sandbox},M=B.token?await lK({...B,token:B.token},U,V,J):void 0,T=M?.name??B.name??a3((J.hostname??kK)()),_=gK(V,T,q),D=r1(_,"worker.json"),j=I0(D);if(M&&j&&c3(j)&&$0(j).revoked)h0(j);let z=!M&&j!==null&&c3(j)&&(!k0(X,"REASON_API_URL")?.trim()||z0(U.apiOrigin,j.apiOrigin))?j.apiOrigin:void 0,F=MJ({...U,...z?{apiOrigin:z}:{},name:T,stateDirectory:_}),O=j!==null&&c3(j);if(O&&U0(j)!==U0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${j.workspaceRoot}, ${j.executionMode==="host"?"your user permissions":"sandboxed"}).
 Run it with: reason serve ${T} ${s3(j)}
 Or remove it first: reason worker revoke --config ${D}`)}let W=F.lifetime==="persistent"?D$(F,K):null;if(W&&!B.service&&X[i1]!==W.label)return Z.stdout.write(`Machine "${T}" in ${q} already runs as a background service (${W.label}).
   Logs: ${W.logs}
   Stop it with: reason stop ${T}
-`),0;if(B.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!u$(T))throw new Q0(NJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
+`),0;if(B.service&&O&&!W&&await(J.controlWorker??H0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${q}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let L=F.lifetime==="ephemeral"||!O;if(L&&!u$(T))throw new Q0(UJ);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
 `);else if(L&&!B.yes&&!M){let C=`Sessions on "${T}" will run commands in ${q} with your user permissions (no sandbox). Continue?`,P=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!P)throw new Q0(`${C.replace(/ Continue\?$/,"")}
-Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>gK(Z,h)))(C))return Z.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!O)e(F.stateDirectory,!0),c(D,F);let R={...J.worker,enrollmentInput:lK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
+Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>uK(Z,h)))(C))return Z.stderr.write(`Cancelled. Nothing was added.
+`),1}if(!O)e(F.stateDirectory,!0),c(D,F);let R={...J.worker,enrollmentInput:pK(T,M,J,Z)};if(F.lifetime==="persistent"&&!O){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
 `);let P=await Q(["enroll","--config",D],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(P!==0)return P}if(H){let C;try{C=Y4({config:F,launcher:H,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(P){if(!(P instanceof F1))throw P;throw new Q0(`${P.message}
 This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${s3(F)}
 Or try the background service again with: reason serve ${T} ${s3(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${q}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${C.label} (starts at ${C.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${C.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...C.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
@@ -231,8 +231,8 @@ Or try the background service again with: reason serve ${T} ${s3(F)} --service`)
 `));let x=W&&X[i1]===W.label&&!J.runWorker?Q4({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",D],{...R,io:{stdout:Z.stdout,stderr:K4(Z.stderr)},onStartup:(C)=>{if(C==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
 `);J.worker?.onStartup?.(C)}})}finally{x?.stop()}}catch(B){if(B instanceof Q0||B instanceof F1){let N=B instanceof F1&&B.code?` (${B.code})`:"";return Z.stderr.write(`Reason: ${B.message}${N}
 `),2}let V=B instanceof Error&&/^worker_[a-z_]+$/.test(B.message)?B.message:null,K=V?B$(V):void 0;return Z.stderr.write(`Reason: ${V?K?`${K} (${V})`:V:"could not prepare this machine."}
-`),1}}var cK=200;var $D=G.strictObject({version:G.literal(1),session_ids:G.array(G.string().min(1).max(200)).max(cK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as FJ}from"child_process";import{readFileSync as sK,rmdirSync as aK,rmSync as iK}from"fs";import{join as n3}from"path";var nK=["Reason.app","Ara Sidecar.app","Ara Device.app"],rK="sidecar_retire_failed";function tK($){return n3($,"Library","Application Support","Ara","Sidecar")}function oK($){try{let J=sK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function LJ($,J={}){let Z=tK($),Q=nK.map((V)=>n3(Z,V)).filter(oK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>FJ("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),B=J.command??((V,K)=>FJ(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
-`)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)B(WJ,["-u",V]),iK(V,{recursive:!0,force:!0});try{aK(Z)}catch{}}catch{return{status:"failed",code:rK}}return{status:"removed",bundles:Q}}var XV=`Connect this computer to Reason
+`),1}}var sK=200;var ZD=G.strictObject({version:G.literal(1),session_ids:G.array(G.string().min(1).max(200)).max(sK)});function j$($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as WJ}from"child_process";import{readFileSync as aK,rmdirSync as iK,rmSync as nK}from"fs";import{join as n3}from"path";var rK=["Reason.app","Ara Sidecar.app","Ara Device.app"],tK="sidecar_retire_failed";function oK($){return n3($,"Library","Application Support","Ara","Sidecar")}function eK($){try{let J=aK(n3($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function DJ($,J={}){let Z=oK($),Q=rK.map((V)=>n3(Z,V)).filter(eK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>WJ("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),B=J.command??((V,K)=>WJ(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
+`)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)B(LJ,["-u",V]),nK(V,{recursive:!0,force:!0});try{iK(Z)}catch{}}catch{return{status:"failed",code:tK}}return{status:"removed",bundles:Q}}var YV=`Connect this computer to Reason
 
 Usage:
   reason connect                 Your computer, kept connected in the background
@@ -288,7 +288,7 @@ One computer serves several Reason accounts. Signed in as another account than
 the one it is connected for, reason connect connects it for that account too,
 as that account's own computer in the workspace it signed in to; the other
 accounts stay connected. That account's \`reason logout\` removes only its own.
-`,YV=`Disconnect this computer from Reason
+`,GV=`Disconnect this computer from Reason
 
 Usage:
   reason disconnect              Stop your computer's connection and remove it from Reason, in every
@@ -303,41 +303,41 @@ Usage:
                                  Reason (all of it when it is the only account here), and it is not kept
                                  disconnected: the next reason "\u2026" connects it again
   --yes, -y                      Accepted for scripts; disconnect never asks
-`;class p extends Error{}var GV=4,N4={write:()=>!0};function l0($,J,Z=!1){let Q=hJ($,J,Z);return Q.length===1?Q[0]:F0(q2(F0($,".config")),...fJ(J,Z))}var fJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function hJ($,J,Z=!1){let Q=$;try{Q=B1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...fJ(J,Z))).filter(BV)}function BV($){try{if(B1($)!==$)return!1;return I0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var mJ="disconnected.json";function dD($,J){return u(F0(l0($,J),mJ))}function U4($,J,Z){let Q=F0(l0($,J),mJ);if(!Z){z$(Q,{force:!0});return}e($9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function KV($){let J=new Map,Z=new Set;for(let H=0;H<$.length;H+=1){let U=$[H];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",V4,H4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[H+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),H+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(H4)&&!J.has(V4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((H)=>J.has(H));if(Y.length>0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let B=J.get("--user-chrome");if(B!==void 0&&B!=="on"&&B!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(H,U)=>U===void 0?{}:{[H]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",B===void 0?void 0:B==="on"),...q("cloudSessions",V===void 0?void 0:V==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(V4)),...q("proxyCaFile",J.get(H4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var x1=($)=>u(d($).state),vJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function gJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function VV($){return $===1?"one at a time":`up to ${$} at once`}function uJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=B4($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!E$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!k0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!AJ(X)&&!OJ($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=PJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof RJ))throw V;throw new p(V.message)}let B=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...B.length?{folders:B}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??ZV)()),slots:J.sessions??Z?.slots??GV,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function dJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function J9($,J,Z,Q,X){if($0($).revoked){if(x1($))try{h0($)}catch{}y4($);let Y=[];try{Y=JV(g($))}catch{}for(let B of Y)if(B!=="workspaces")z$(F0(g($),B),{recursive:!0,force:!0})}else if(x1($))h0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??_1)(["enroll","--config",J],{...Z9(Q.worker,X),io:{stdout:N4,stderr:Z.stderr}})}function V2($,J,Z){let Q=I$($1(k$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function HV($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),B=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=I0(Y)}catch{}if(B(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let K=await J9(X,Y,Z,Q,void 0);if(K===0&&B(X))return 0;if(K===0&&x1(X))await q4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function Z9($,J){return J?{...$,enrollmentCredentials:(Z)=>A4(Z,J)}:{...$}}async function Q9($,J,Z,Q,X,Y="connect"){if(await X9($,Q,X,Y),Y==="connect"&&!await iJ($,Z,Q))return!1;if(!await q4($,J,Z,Q))return!1;return k9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function q4($,J,Z,Q){if(!x1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??_1)(["revoke","--config",J],{...Q.worker,io:{stdout:N4,stderr:Y?Z.stderr:N4}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function X9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,B=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&G4($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await B()!==null)await new Promise((q)=>setTimeout(q,250))}}function Y9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...Y9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${gJ($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
-`)}function t3($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${VV(J.slots)}`,`  Mode:      ${gJ(J)}`,...J.proxy?[`  Proxy:     ${CJ(J.proxy)}`]:[],...Y9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
-`)}async function DJ($,J,Z){let{io:Q,options:X}=Z;if(hJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:$9(J),timestamp:new Date().toISOString()})}
+`;class p extends Error{}var BV=4,N4={write:()=>!0};function l0($,J,Z=!1){let Q=mJ($,J,Z);return Q.length===1?Q[0]:F0(q2(F0($,".config")),...hJ(J,Z))}var hJ=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function mJ($,J,Z=!1){let Q=$;try{Q=B1($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...hJ(J,Z))).filter(KV)}function KV($){try{if(B1($)!==$)return!1;return I0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var vJ="disconnected.json";function pD($,J){return u(F0(l0($,J),vJ))}function U4($,J,Z){let Q=F0(l0($,J),vJ);if(!Z){z$(Q,{force:!0});return}e($9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function VV($){let J=new Map,Z=new Set;for(let H=0;H<$.length;H+=1){let U=$[H];if(U==="--help"||U==="-h"||U==="help")return null;if(["--to","--token","--folder","--sessions",V4,H4,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(U)){let M=$[H+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${U}.`);if(J.has(U))throw new p(`${U} may be specified only once.`);J.set(U,M),H+=1;continue}if(["--once","--yes","-y","--minimal"].includes(U)){Z.add(U==="-y"?"--yes":U);continue}if(U.startsWith("-"))throw new p(`Unknown option: ${U}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${U}. To add this computer to a team machine, use --to ${U}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(H4)&&!J.has(V4))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((H)=>J.has(H));if(Y.length>0&&(J.size>1||[...Z].some((H)=>H!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let B=J.get("--user-chrome");if(B!==void 0&&B!=="on"&&B!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let q=(H,U)=>U===void 0?{}:{[H]:U};return{...q("to",J.get("--to")),...q("token",J.get("--token")),...q("folder",J.get("--folder")),...q("sessions",Q===void 0?void 0:Number(Q)),...q("keepAwake",X===void 0?void 0:X==="on"),...q("userChrome",B===void 0?void 0:B==="on"),...q("cloudSessions",V===void 0?void 0:V==="on"),...q("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...q("proxy",J.get(V4)),...q("proxyCaFile",J.get(H4)),...q("apiKey",J.get("--api-key")),...q("name",N),...q("apiUrl",J.get("--api-url")),...q("addFolder",J.get("--add-folder")),...q("removeFolder",J.get("--remove-folder"))}}var x1=($)=>u(d($).state),gJ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function uJ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function HV($){return $===1?"one at a time":`up to ${$} at once`}function dJ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=B4($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!E$(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?y1({REASON_API_URL:J.apiUrl},$.channel):Z&&!k0($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:y1($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&z0(X,Z.apiOrigin))X=Z.apiOrigin;if(!RJ(X)&&!AJ($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=IJ({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof CJ))throw V;throw new p(V.message)}let B=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...B.length?{folders:B}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??a3(($.options.hostname??QV)()),slots:J.sessions??Z?.slots??BV,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function lJ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function J9($,J,Z,Q,X){if($0($).revoked){if(x1($))try{h0($)}catch{}y4($);let Y=[];try{Y=ZV(g($))}catch{}for(let B of Y)if(B!=="workspaces")z$(F0(g($),B),{recursive:!0,force:!0})}else if(x1($))h0($);return e($.stateDirectory,!0),c(J,$),(Q.runWorker??_1)(["enroll","--config",J],{...Z9(Q.worker,X),io:{stdout:N4,stderr:Z.stderr}})}function V2($,J,Z){let Q=I$($1(k$("REASON_CLI_CHANNEL",J),$));return Q&&z0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function NV($,J,Z,Q){let{config:X,configPath:Y}=j2($,J),B=(N)=>{try{return N!==null&&j$(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=I0(Y)}catch{}if(B(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let K=await J9(X,Y,Z,Q,void 0);if(K===0&&B(X))return 0;if(K===0&&x1(X))await q4(X,Y,Z,Q);if(z$(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.")}function Z9($,J){return J?{...$,enrollmentCredentials:(Z)=>A4(Z,J)}:{...$}}async function Q9($,J,Z,Q,X,Y="connect"){if(await X9($,Q,X,Y),Y==="connect"&&!await nJ($,Z,Q))return!1;if(!await q4($,J,Z,Q))return!1;return k9($.stateDirectory),z$($.stateDirectory,{recursive:!0,force:!0}),!0}async function q4($,J,Z,Q){if(!x1($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??_1)(["revoke","--config",J],{...Q.worker,io:{stdout:N4,stderr:Y?Z.stderr:N4}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function X9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??H0,B=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&G4($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await B()!==null)await new Promise((q)=>setTimeout(q,250))}}function Y9($,J){return J==="darwin"&&$.userChrome!==!1}function r3($,J,Z){let Q=[...Y9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${uJ($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
+`)}function t3($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${HV(J.slots)}`,`  Mode:      ${uJ(J)}`,...J.proxy?[`  Proxy:     ${PJ(J.proxy)}`]:[],...Y9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
+`)}async function jJ($,J,Z){let{io:Q,options:X}=Z;if(mJ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:$9(J),timestamp:new Date().toISOString()})}
 `);let Y=E2(F0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
 `);f3(Z.home,Z.host.platform);let B=w8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(U)=>Q.stderr.write(`${U}
 `),host:Z.host}),V=A8({...B,log:(U)=>Q.stderr.write(`${U}
 `)}),{configPath:K}=V,N=V.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let q=(U,M)=>{let T=T4(Z.home,Z.channel),_;try{let j=null;try{j=M.keep?null:t(N)?.orgId.toLowerCase()??null}catch{}if(_=O2(N,{prefer:V2(Z.home,Z.channel,N),...M}),_&&j)z2(_,j)}finally{T()}if(!_)return!1;N=_;let D="";try{D=` (workspace ${t(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${U}; this computer goes on running Sessions for its other Reason account${D}.
-`),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=p0(N.stateDirectory)??void 0,M=U?null:V2(Z.home,Z.channel,N);if(!U&&!(M&&f$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let H=N.executionMode==="confined";if(H||!j$(N)){let U=p0(N.stateDirectory)??void 0;if(Q.stderr.write(H?vJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
-`),await J9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=p0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Q4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??_1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return U4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function NV($,J,Z){let{io:Q,options:X,home:Y,channel:B,environment:V}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=l0(Y,B,!0),N=uJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:B,options:X,environment:V}),q=dJ(N,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),H=F0(K,"worker.json");return e(K,!0),c(H,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??_1)(["start","--config",H],{...Z9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:K4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
-`);X.worker?.onStartup?.(U)}})}function UV($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),f8(d(J).daemon,$);let X=S2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var qV=G.object({root:G.object({id:G.string().min(1).max(160),label:G.string().max(160),path_fingerprint:G.string()})});async function lJ($,J,Z,Q){let X=await(Z9(Q.worker,Z).enrollmentCredentials??R1)($,A1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new U1(X,{credentialsPath:A1($),fetchImpl:y0($.proxy)}),B=(V)=>V instanceof G0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=c9($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((H)=>{if(B(H))throw Error("worker_folders_unavailable");if(H instanceof G0&&H.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw H}),q=qV.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(B(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function pJ($,J,Z){v0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:T0($)})}async function cJ($,J,Z,Q){let{io:X,options:Y,host:B}=Q,V=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(Q.home,Q.channel,J):null,K=J&&V&&x1(J)&&!f$(J,V)?m0(J).find((C)=>C.account&&C.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,H=N&&x1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!H||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=B4(T,M)}catch(C){if(U)throw new p(C instanceof Error?C.message:String(C));_=QV(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=H.roots.slice(1).find((C)=>C.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!E$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??p0(N.stateDirectory)??void 0,F=await lJ(N,H,z,Y),O=H.roots.filter((C)=>C.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);pJ(N,H,O);let W=U?[...D.filter((C)=>C!==_),_]:D.filter((C)=>C!==_),{folders:L,...R}=N;if(c(q,J0.parse({...R,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))W1(J,B,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
+`),!0};if($0(N).revoked&&!q("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j$(N)){let U=p0(N.stateDirectory)??void 0,M=U?null:V2(Z.home,Z.channel,N);if(!U&&!(M&&f$(N,M)))q("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let H=N.executionMode==="confined";if(H||!j$(N)){let U=p0(N.stateDirectory)??void 0;if(Q.stderr.write(H?gJ:`Reason: this computer's connection expired; renewing it with ${U?"its API key":"your login"}\u2026
+`),await J9(J0.parse({...N,executionMode:"host"}),K,Q,X,U)!==0)return Q.stderr.write(U?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}for(;;){let U=p0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},M=X.runWorker?null:Q4({stateDirectory:N.stateDirectory}),T=!1,_;try{_=await(X.runWorker??_1)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...U,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{M?.stop()}if(!T)return _;if(!q("this computer's connection was removed from Reason",{keep:!1}))break}return U4(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}async function UV($,J,Z){let{io:Q,options:X,home:Y,channel:B,environment:V}=Z;if(J&&await(X.controlWorker??H0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=l0(Y,B,!0),N=dJ({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:B,options:X,environment:V}),q=lJ(N,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),H=F0(K,"worker.json");return e(K,!0),c(H,q),Q.stdout.write(t3(`Reason: connecting "${q.name}" while this command runs`,q,Z.host.platform,["Connecting\u2026"])),(X.runWorker??_1)(["start","--config",H],{...Z9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:K4(Q.stderr)},onStartup:(U)=>{if(U==="ready")Q.stdout.write(`Connected. Start Sessions on "${q.name}" from Reason. Press Ctrl-C to stop.
+`);X.worker?.onStartup?.(U)}})}function qV($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),f8(d(J).daemon,$);let X=S2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
+`),0}var MV=G.object({root:G.object({id:G.string().min(1).max(160),label:G.string().max(160),path_fingerprint:G.string()})});async function pJ($,J,Z,Q){let X=await(Z9(Q.worker,Z).enrollmentCredentials??R1)($,A1($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new U1(X,{credentialsPath:A1($),fetchImpl:y0($.proxy)}),B=(V)=>V instanceof G0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=c9($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((H)=>{if(B(H))throw Error("worker_folders_unavailable");if(H instanceof G0&&H.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw H}),q=MV.parse(N).root;if(q.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:q.id,label:q.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(B(K))throw Error("worker_folders_unavailable");if(!(K instanceof G0&&K.code==="root_not_found"))throw K})}}}function cJ($,J,Z){v0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:U0($)}},d($).state,{proofStore:T0($)})}async function sJ($,J,Z,Q){let{io:X,options:Y,host:B}=Q,V=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(Q.home,Q.channel,J):null,K=J&&V&&x1(J)&&!f$(J,V)?m0(J).find((C)=>C.account&&C.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,q=K?K.configPath:Z,H=N&&x1(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!H||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let U=$.addFolder!==void 0,M=U?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=B4(T,M)}catch(C){if(U)throw new p(C instanceof Error?C.message:String(C));_=XV(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let D=N.folders??[],j=H.roots.slice(1).find((C)=>C.path===_);if(!U&&!j&&!D.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(U&&!E$(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(U&&!j&&D.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let z=Q.apiKey??p0(N.stateDirectory)??void 0,F=await pJ(N,H,z,Y),O=H.roots.filter((C)=>C.path!==_);if(U)O=[...O,await F.add(_)];else if(j)await F.remove(j.id);cJ(N,H,O);let W=U?[...D.filter((C)=>C!==_),_]:D.filter((C)=>C!==_),{folders:L,...R}=N;if(c(q,J0.parse({...R,...W.length?{folders:W}:{}})),!await(Y.controlWorker??H0)(J,"reload_roots").then(()=>!0,()=>!1))W1(J,B,"connect");return X.stdout.write(U?`Added ${_}. Sessions on "${N.name}" may run in it.
 `:`Removed ${_}. Sessions on "${N.name}" no longer run in it.
-`),0}async function lD($,J,Z){let Q=o3(Z),X=T4(Q.home,Q.channel);try{let Y=F0(l0(Q.home,Q.channel),"worker.json");return await cJ({once:!1,yes:J,addFolder:$},I0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=B1($.home??V0()),Q=$.env??process.env;return{io:$.io??M4(),options:$,home:Z,channel:$.channel??x0(),environment:Q,apiKey:J??z4(Q),host:$.serviceHost??G1(Z)}}async function MV($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let B=await lJ($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await B.add(J.workspaceRoot);await B.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}pJ(J,X,Y)}var sJ=Symbol("serve here");async function TV($,J,Z,Q){let{io:X,options:Y,home:B,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let I=LJ(B);if(I.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${I.code}).
-`)}let q=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(B,V,J):null,H=J&&q&&$0(J).revoked&&m0(J).some((I)=>I.account&&I.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=uJ({parsed:$,saved:H,stateDirectory:l0(B,V),lifetime:"persistent",home:B,channel:V,options:Y,environment:K});if(U4(B,V,!1),H?.executionMode==="confined")X.stdout.write(vJ);let M=H?p0(H.stateDirectory):null,T=dJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=H!==null&&x1(H),j=D&&U0(H)===U0(T),z=j&&j$(T),F=H?.userChrome!==!1===(T.userChrome!==!1)&&H?.cloudSessions===T.cloudSessions&&H?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(H).revoked&&!f$(H,q);if(W){if(!j||!F||JSON.stringify(H.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let I=await HV(H,q,X,Y);if(I!==0)return I}let L=W?[`  Account:   yours too, in workspace ${q}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await A4(T,$.apiKey),O4(T.stateDirectory,$.apiKey)},x=K.PATH||"/usr/local/bin:/usr/bin:/bin",C=z&&JSON.stringify(H?.proxy)===JSON.stringify(T.proxy)&&F?D$(T,N,"connect"):null,P=C?.label===xJ(T.channel),h=P&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)!==null,S=P&&!h&&e3(C,N)&&wJ({config:T,launcher:_,path:x,host:N,kind:"connect"});if((h||S)&&[null,r].includes(d$(T))){await R();let I=SJ(T,N,"connect");if(I==="retired"){let E=S?null:await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!S&&(!E||E.phase==="stopping"))W1(T,N,"connect")}else if(I==="current_not_running")W1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let y=!z&&!W;if(D&&!j)if(H.apiOrigin!==T.apiOrigin||H.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),0}async function cD($,J,Z){let Q=o3(Z),X=T4(Q.home,Q.channel);try{let Y=F0(l0(Q.home,Q.channel),"worker.json");return await sJ({once:!1,yes:J,addFolder:$},I0(Y),Y,Q)===0}finally{X()}}function o3($,J){let Z=B1($.home??V0()),Q=$.env??process.env;return{io:$.io??M4(),options:$,home:Z,channel:$.channel??x0(),environment:Q,apiKey:J??z4(Q),host:$.serviceHost??G1(Z)}}async function TV($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let B=await pJ($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await B.add(J.workspaceRoot);await B.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}cJ(J,X,Y)}var aJ=Symbol("serve here");async function _V($,J,Z,Q){let{io:X,options:Y,home:B,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let I=DJ(B);if(I.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${I.code}).
+`)}let q=J&&!Q.apiKey&&p0(J.stateDirectory)===null?V2(B,V,J):null,H=J&&q&&$0(J).revoked&&m0(J).some((I)=>I.account&&I.organizationId===q)?O2(J,{prefer:q,keep:!1})??J:J,U=dJ({parsed:$,saved:H,stateDirectory:l0(B,V),lifetime:"persistent",home:B,channel:V,options:Y,environment:K});if(U4(B,V,!1),H?.executionMode==="confined")X.stdout.write(gJ);let M=H?p0(H.stateDirectory):null,T=lJ(U,Q.apiKey??M??void 0),_=L$(N,K),D=H!==null&&x1(H),j=D&&U0(H)===U0(T),z=j&&j$(T),F=H?.userChrome!==!1===(T.userChrome!==!1)&&H?.cloudSessions===T.cloudSessions&&H?.localLogins===T.localLogins,O=Q.apiKey??M??void 0,W=q!==null&&D&&!$0(H).revoked&&!f$(H,q);if(W){if(!j||!F||JSON.stringify(H.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.");let I=await NV(H,q,X,Y);if(I!==0)return I}let L=W?[`  Account:   yours too, in workspace ${q}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await A4(T,$.apiKey),O4(T.stateDirectory,$.apiKey)},x=K.PATH||"/usr/local/bin:/usr/bin:/bin",C=z&&JSON.stringify(H?.proxy)===JSON.stringify(T.proxy)&&F?D$(T,N,"connect"):null,P=C?.label===EJ(T.channel),h=P&&await(Y.controlWorker??H0)(T,"status").catch(()=>null)!==null,S=P&&!h&&e3(C,N)&&bJ({config:T,launcher:_,path:x,host:N,kind:"connect"});if((h||S)&&[null,r].includes(d$(T))){await R();let I=wJ(T,N,"connect");if(I==="retired"){let E=S?null:await(Y.controlWorker??H0)(T,"status").catch(()=>null);if(!S&&(!E||E.phase==="stopping"))W1(T,N,"connect")}else if(I==="current_not_running")W1(T,N,"connect");return await(Y.controlWorker??H0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,L):t3("This computer is connected to Reason",T,N.platform,[...L,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let y=!z&&!W;if(D&&!j)if(H.apiOrigin!==T.apiOrigin||H.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
 `),!await Q9(H,Z,X,Y,N))throw new p("Could not remove this computer's previous connection from Reason. Check your network and try again.")}else if(H.executionMode==="host"&&j$(H))X.stdout.write(`Applying the new settings to this computer\u2026
-`),await MV(H,T,O,Y),y=!1;else await X9(H,Y,N);if(y){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
+`),await TV(H,T,O,Y),y=!1;else await X9(H,Y,N);if(y){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
 `);let I=await J9(T,Z,X,Y,O);if(I!==0)return I;if(O)O4(T.stateDirectory,O)}else c(Z,T),await R();let l;try{l=Y4({config:T,launcher:_,path:x,host:N,kind:"connect"})}catch(I){if(!(I instanceof F1))throw I;if(I.code!=="worker_service_manager_missing")throw new p(`${I.message}
 This computer is set up; run reason connect again to start it.`);if(Y.serveHere&&K.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),sJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await _V(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new F1(`${I.message}
-This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,I.code)}let k=[...L,...l.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...l.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${l.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,k):t3("This computer is connected to Reason",T,N.platform,[`  Service:   ${l.label} (starts at ${l.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${l.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...k])),0}async function _V($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??aJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let B=0;B<60;B+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function aJ($,J,Z){let Q=yJ(Z,"a",384);try{let X=bJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{kJ(Q)}}async function iJ($,J,Z,Q=!1){let X=!0;for(let Y of m0($)){if(Q&&Y.account)continue;if(Y.config&&x1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??_1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:N4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function M4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function G9($,J){if($ instanceof p||$ instanceof F1){let X=$ instanceof F1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
+`),aJ;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await FV(T,_,K,Y))return X.stdout.write(r3(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new F1(`${I.message}
+This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,I.code)}let k=[...L,...l.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...l.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${l.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?r3(T,N.platform,k):t3("This computer is connected to Reason",T,N.platform,[`  Service:   ${l.label} (starts at ${l.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${l.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...k])),0}async function FV($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??iJ)(J,Y,F0($.stateDirectory,"connect.log"));for(let B=0;B<60;B+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??H0)($,"status").catch(()=>null))return!0;return!1}function iJ($,J,Z){let Q=fJ(Z,"a",384);try{let X=kJ($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{yJ(Q)}}async function nJ($,J,Z,Q=!1){let X=!0;for(let Y of m0($)){if(Q&&Y.account)continue;if(Y.config&&x1(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??_1)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:N4,stderr:J.stderr}})!==0){X=!1;continue}}z$(Y.directory,{recursive:!0,force:!0})}return X}function M4(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function G9($,J){if($ instanceof p||$ instanceof F1){let X=$ instanceof F1&&$.code?` (${$.code})`:"";return J.stderr.write(`Reason: ${$.message}${X}
 `),2}let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:null,Q=Z?B$(Z):void 0;return J.stderr.write(`Reason: ${Z?Q?`${Q} (${Z})`:Z:"could not connect this computer."}
-`),1}function jJ($,J){if($.minimal){rJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||tJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??zJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
+`),1}function zJ($,J){if($.minimal){tJ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||oJ({home:J.home})!=="install")return;let Z;try{Z=L$(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??OJ)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
 `);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let Q=(J.options.installDesktop??zJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function zJ($,J,Z){if(!Z)return eK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;$V($9(Z.log),{recursive:!0,mode:448});let Q=yJ(Z.log,"w",384);try{let X=bJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{kJ(Q)}return 0}async function pD($,J={}){let Z=J.io??M4();try{let Q=KV($);if(!Q)return Z.stdout.write(XV),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return jJ(Q,o3(J)),await(J.runServe??_J)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:B}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=EJ(B[i1],Y),K=V||Q.once?()=>{return}:T4(X.home,Y);try{let N=F0(l0(X.home,Y),"worker.json"),q=I0(N);if(V)return await DJ(q,N,X);if(Q.keepAwake!==void 0)return UV(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await cJ(Q,q,N,X);if(jJ(Q,X),Q.once)return await NV(Q,q,X);let H=await TV(Q,q,N,X);if(H!==sJ)return H;return K(),K=()=>{return},await DJ(I0(N),N,X)}finally{K()}}catch(Q){return G9(Q,Z)}}async function cD($,J={}){let Z=J.io??M4();try{if($.some((B)=>["--help","-h","help"].includes(B)))return Z.stdout.write(YV),0;let Q=$.filter((B)=>!["--yes","-y","--temporary","--account"].includes(B)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await LV(Q[0],Z,J);return await nJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return G9(Q,Z)}}async function sD($={}){let J=$.io??M4();try{return await nJ(J,$,"logout")}catch(Z){return G9(Z,J)}}async function nJ($,J,Z){let Q=B1(J.home??V0()),X=J.channel??x0(),Y=T4(Q,X);try{return await FV($,J,Z,Q,X)}finally{Y()}}function T4($,J){let Z=l0($,J),Q=u(Z)?Y$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function FV($,J,Z,Q,X){let Y=F0(l0(Q,X),"worker.json"),B=I0(Y);if(!B){if(Z==="disconnect")U4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(Z!=="disconnect"){let K=await WV(B,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await Q9(B,Y,$,J,J.serviceHost??G1(Q))}finally{if(Z!=="temporary")U4(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`);let Q=(J.options.installDesktop??OJ)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
+`)}function OJ($,J,Z){if(!Z)return $V($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;JV($9(Z.log),{recursive:!0,mode:448});let Q=fJ(Z.log,"w",384);try{let X=kJ($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{yJ(Q)}return 0}async function sD($,J={}){let Z=J.io??M4();try{let Q=VV($);if(!Q)return Z.stdout.write(YV),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,q]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(q!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return zJ(Q,o3(J)),await(J.runServe??FJ)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=o3(J,Q.apiKey),{channel:Y,environment:B}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=SJ(B[i1],Y),K=V||Q.once?()=>{return}:T4(X.home,Y);try{let N=F0(l0(X.home,Y),"worker.json"),q=I0(N);if(V)return await jJ(q,N,X);if(Q.keepAwake!==void 0)return qV(Q.keepAwake,q,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await sJ(Q,q,N,X);if(zJ(Q,X),Q.once)return await UV(Q,q,X);let H=await _V(Q,q,N,X);if(H!==aJ)return H;return K(),K=()=>{return},await jJ(I0(N),N,X)}finally{K()}}catch(Q){return G9(Q,Z)}}async function aD($,J={}){let Z=J.io??M4();try{if($.some((B)=>["--help","-h","help"].includes(B)))return Z.stdout.write(GV),0;let Q=$.filter((B)=>!["--yes","-y","--temporary","--account"].includes(B)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await DV(Q[0],Z,J);return await rJ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return G9(Q,Z)}}async function iD($={}){let J=$.io??M4();try{return await rJ(J,$,"logout")}catch(Z){return G9(Z,J)}}async function rJ($,J,Z){let Q=B1(J.home??V0()),X=J.channel??x0(),Y=T4(Q,X);try{return await WV($,J,Z,Q,X)}finally{Y()}}function T4($,J){let Z=l0($,J),Q=u(Z)?Y$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment. (worker_connection_busy)")}async function WV($,J,Z,Q,X){let Y=F0(l0(Q,X),"worker.json"),B=I0(Y);if(!B){if(Z==="disconnect")U4(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(Z!=="disconnect"){let K=await LV(B,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await Q9(B,Y,$,J,J.serviceHost??G1(Q))}finally{if(Z!=="temporary")U4(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
 `),1;return $.stdout.write(`Disconnected "${B.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function WV($,J,Z,Q,X,Y,B){let V=m0($).filter((D)=>D.account);if(V.length===0)return null;let K=V2(Y,B,$),N=Q.controlWorker??H0,q=V.find((D)=>D.organizationId===K);if(q){if(q.config&&!await q4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),0}async function LV($,J,Z,Q,X,Y,B){let V=m0($).filter((D)=>D.account);if(V.length===0)return null;let K=V2(Y,B,$),N=Q.controlWorker??H0,q=V.find((D)=>D.organizationId===K);if(q){if(q.config&&!await q4(q.config,q.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
 `),1;if(X!=="account"||!q.config)z$(q.directory,{recursive:!0,force:!0});return await N($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${K} for your account. It stays connected for its other Reason accounts.
 `),0}if(!K&&X==="account")throw new p("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!K||!f$($,K)){if(X==="account"&&K)z2($,K);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let H=Q.serviceHost??G1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await X9($,Q,H,"connect",!0),!await iJ($,Z,Q,!0)||!await q4($,J,Z,Q))return W1($,H,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`);return 0}let H=Q.serviceHost??G1(Y),U=null;try{U=t($)?.orgId.toLowerCase()??null}catch{}if(await X9($,Q,H,"connect",!0),!await nJ($,Z,Q,!0)||!await q4($,J,Z,Q))return W1($,H,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
 `),1;let M=O2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&U)z2(M,U);let T=W1(M,H,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
-`),0}async function LV($,J,Z){let Q=B1(Z.home??V0()),X=Z.serviceHost??G1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let B=!1;for(let V of Y)if(await Q9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
+`),0}async function DV($,J,Z){let Q=B1(Z.home??V0()),X=Z.serviceHost??G1(Q),Y=i3(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let B=!1;for(let V of Y)if(await Q9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
 `);else B=!0,J.stderr.write(`Reason: machine "${$}" in ${V.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
-`);return B?1:0}async function aD($={}){let J=B1($.home??V0()),Z=I0(F0(l0(J,$.channel??x0()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??H0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?d$(Z):null,B=$.serviceHost??G1(J),V=D$(Z,B,"connect"),K=$0(Z).revoked,N=!K&&!X,q=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:H,off:U}=K||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:o9(Z,X?.phase==="running");return{workspaces:H,workspaces_off:U,workspaces_max:L2+(H?.filter((M)=>M.account).length??0),name:Z.name,device_id:q?.deviceId??null,organization_id:q?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:Y9(Z,B.platform),cloud_sessions:Z.cloudSessions===!0,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,roots:q?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?s8(Z,Q):null,worker_alive:N&&V?e3(V,B):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function iD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=I0(F0(l0(B1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?IJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function nD($={}){try{let J=B1($.home??V0());return I0(F0(l0(J,$.channel??x0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function rD($={}){let J=B1($.home??V0()),Z=I0(F0(l0(J,$.channel??x0()),"worker.json"));if(!Z)return null;return W1(Z,$.serviceHost??G1(J),"connect")?.label??null}async function tD($={}){let J=B1($.home??V0()),Z=I0(F0(l0(J,$.channel??x0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??G1(J),X=await TJ(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return DV(Z,Q,$)}async function DV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&d$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let B;try{B=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((H)=>setTimeout(H,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??aJ)(B,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
-export{$1 as a,U1 as b,w9 as c,d,S2 as e,I0 as f,XV as g,YV as h,l0 as i,dD as j,lD as k,pD as l,cD as m,sD as n,aD as o,iD as p,nD as q,rD as r,tD as s};
+`);return B?1:0}async function nD($={}){let J=B1($.home??V0()),Z=I0(F0(l0(J,$.channel??x0()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??H0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?d$(Z):null,B=$.serviceHost??G1(J),V=D$(Z,B,"connect"),K=$0(Z).revoked,N=!K&&!X,q=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:H,off:U}=K||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:o9(Z,X?.phase==="running");return{workspaces:H,workspaces_off:U,workspaces_max:L2+(H?.filter((M)=>M.account).length??0),name:Z.name,device_id:q?.deviceId??null,organization_id:q?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:Y9(Z,B.platform),cloud_sessions:Z.cloudSessions===!0,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,roots:q?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?s8(Z,Q):null,worker_alive:N&&V?e3(V,B):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function rD($,J,Z=H0){let Q={version:1,status:"unavailable"},X=I0(F0(l0(B1($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?xJ({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function tD($={}){try{let J=B1($.home??V0());return I0(F0(l0(J,$.channel??x0()),"worker.json"))?.userChrome!==!1}catch{return!1}}function oD($={}){let J=B1($.home??V0()),Z=I0(F0(l0(J,$.channel??x0()),"worker.json"));if(!Z)return null;return W1(Z,$.serviceHost??G1(J),"connect")?.label??null}async function eD($={}){let J=B1($.home??V0()),Z=I0(F0(l0(J,$.channel??x0()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??G1(J),X=await _J(Z,Q,"connect",$.current);if(X!==null||D$(Z,Q,"connect"))return X;return jV(Z,Q,$)}async function jV($,J,Z){let Q=Z.controlWorker??H0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&d$($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let B;try{B=L$(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((H)=>setTimeout(H,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...q}=Z.env??process.env;return(Z.startConnection??iJ)(B,q,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
+export{$1 as a,U1 as b,w9 as c,d,S2 as e,I0 as f,YV as g,GV as h,l0 as i,pD as j,cD as k,sD as l,aD as m,iD as n,nD as o,rD as p,tD as q,oD as r,eD as s};