npm - @reason-machines/cli-linux-arm64-musl - Versions diffs - 0.2.335 → 0.2.337 - Mend

@reason-machines/cli-linux-arm64-musl 0.2.335 → 0.2.337

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (76) hide show

package/bin/vm-hands/{vm-hands-entry-lite-qx8702e7.js → vm-hands-entry-lite-hybhzkvj.js} RENAMED Viewed

@@ -1,7 +1,7 @@
 // @bun
-import{t as v0}from"./vm-hands-entry-lite-hj6jjk24.js";import{u as Q2,w as B7,x as X4}from"./vm-hands-entry-lite-dtcpbbkc.js";import{A as K7,B as H4,C as M4,D as m6,E as m0,I as v6,J as R$,z as q2}from"./vm-hands-entry-lite-feaxcj0x.js";import{$ as m1,Q as FJ,R as LJ,S as k8,T as y8,U as eJ,V as $6,W as S9,X as O5,Y as m8,Z as T0,_ as h1,aa as P0,ba as n1,ca as z5,da as d5,ea as i3,fa as x5,ja as S5,sa as Q6,ta as X6,ua as Y6,va as G6,wa as w9}from"./vm-hands-entry-lite-dea36bpb.js";import{$a as rJ,Ba as r8,Bb as D5,Ca as t8,Cb as K9,Eb as N5,Fa as c8,Ha as X5,Ib as oJ,Jb as Q9,Ka as Y5,Pa as U5,Qa as V5,Ra as f8,Sa as h8,Ta as aJ,Ua as iJ,Wa as u,Xa as e,Ya as s,Za as c,_a as s8,ab as M1,db as Q3,eb as X3,fb as Q7,gb as X7,hb as Y7,ib as S0,jb as J0,kb as g,lb as b9,mb as A1,nb as Z2,ob as N0,pb as tJ,ub as g5,wb as N8,ya as A6,zb as y2}from"./vm-hands-entry-lite-5q96en2m.js";import{Ob as v8}from"./vm-hands-entry-lite-7kzy7rxj.js";import{Vb as W5}from"./vm-hands-entry-lite-h01d2fbm.js";import{bc as G5,cc as K5,jc as B5}from"./vm-hands-entry-lite-5n6vc7je.js";import{pc as V$}from"./vm-hands-entry-lite-ffgjezmx.js";import{Ec as w8}from"./vm-hands-entry-lite-4b8f37q4.js";import{Ic as p$,Jc as J$,Kc as I$,Lc as T1,Mc as g6,Nc as U7,Oc as V7,Pc as _1,Qc as N7,Rc as c9,Sc as q7,Tc as e2,Uc as q$,Vc as X8,Wc as $3,_c as R5,bd as J6,ed as jJ,fd as WJ}from"./vm-hands-entry-lite-qbr9m7zh.js";import{Xd as b8,be as r$,le as V2,pd as C2,td as cJ,ud as sJ}from"./vm-hands-entry-lite-9k57wmkv.js";import{we as U}from"./vm-hands-entry-lite-mtp2h66e.js";import{Ae as s2,De as Z6,Ge as l1,Ie as x7,Je as S7,Oe as E5,ze as G7}from"./vm-hands-entry-lite-hzqdhpr9.js";import{Ue as r1,Ve as j5}from"./vm-hands-entry-lite-tf5mepq5.js";import{$e as A5,Ye as n6,af as E9,cf as g8}from"./vm-hands-entry-lite-zykqwmp1.js";import{pf as r}from"./vm-hands-entry-lite-m0epceqg.js";import{$f as U6,Yf as w1,Zf as Y0,_f as B2,ag as V6,bg as n$,cg as F3,eg as n3,fg as w$,gg as y0,hg as E1,ig as r3,lg as k$}from"./vm-hands-entry-lite-dhzcvvt2.js";import{pg as Q5}from"./vm-hands-entry-lite-cnmd8nft.js";import{Ah as Z7,Bh as P9,Ch as Z8,Dh as Q8,Eh as J1,nh as D$,oh as P1,qh as $$,th as O$,uh as C0,vh as K4,wh as $7,xh as J7,zh as A2}from"./vm-hands-entry-lite-mm72ht4e.js";import{Fh as B0,Hh as hJ}from"./vm-hands-entry-lite-s64raarx.js";import{fi as nJ}from"./vm-hands-entry-lite-983czfdb.js";import{ki as f0}from"./vm-hands-entry-lite-070nd0vy.js";import{qi as iK}from"./vm-hands-entry-lite-px64jhhn.js";import{spawn as H7,spawnSync as nK}from"child_process";import{closeSync as M7,mkdirSync as rK,openSync as T7,readdirSync as tK,realpathSync as Z$,rmSync as L1}from"fs";import{hostname as oK}from"os";import{dirname as s9,join as _0,resolve as eK}from"path";import{createHash as w7}from"crypto";import{unlinkSync as k7}from"fs";import{platform as y7}from"os";import{join as f7}from"path";var Y4=U.discriminatedUnion("store",[U.strictObject({version:U.literal(1),store:U.literal("keychain")}),U.strictObject({version:U.literal(1),store:U.literal("file"),api_key:U.string().min(1).max(4096)})]),b$=($)=>f7($,"api-key.json");function F$($){let J=w7("sha256").update(`reason-connect-api-key
-${$}`).digest("hex");return new n$(B2(),y7(),J)}function T3($,J,Z=F$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(b$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(b$($),{version:1,store:"file",api_key:J})}function u0($,J=F$($)){if(!u(b$($)))return null;let Z=Y4.parse(JSON.parse(s(b$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function G4($,J=F$($)){if(!u(b$($)))return;if(Y4.parse(JSON.parse(s(b$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}k7(b$($))}async function _3($,J){let Z;try{Z=await X4({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:S0($.proxy)})}catch(Q){if(Q instanceof m0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as JZ,renameSync as ZZ,rmSync as y$}from"fs";import{join as H0}from"path";import{createHash as h7}from"crypto";import{realpathSync as m7,statSync as v7,unlinkSync as U2}from"fs";import{platform as g7}from"os";import{join as b0}from"path";function d($){return{state:b0(g($),"device.json"),control:b0(g($),"control.json"),lock:b0(g($),"lifecycle.lock"),socket:b0(g($),"control.sock"),daemon:b0(g($),"daemon.json"),releaseCheck:b0(g($),"release-check.json"),updateDeferral:b0(g($),"update-deferral.json"),firstHeartbeat:b0(g($),"first-heartbeat.json")}}var u7=U.object({version:U.literal(1),device_id:U.string().min(1).max(160),offer:U.unknown().optional(),enrollment_ms:U.number().int().nonnegative().max(r$).optional()});function B4($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function L3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=u7.safeParse(JSON.parse(s(Z)));if(U2(Z),!Q.success||Q.data.device_id!==J)return null;let X=V2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function M0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=b0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?j3($):new F3(g($))}function N2($,J){M0($,!0),p7($);let Z=J??j3($),Q=new F3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function j3($){return new n$(B2(),g7(),d7($))}function d7($){let J=W3($);return h7("sha256").update(`reason-worker
-${J?.directory??g($)}`).digest("hex")}function R1($,J){c(b0(g($),I1),{version:1,directory:W3($)?.directory??g($),devicePublicKey:J})}var I1="keychain-scope.json";function U4($){return u(b0(g($),I1))}var l7=U.strictObject({version:U.literal(1),directory:U.string().min(1),devicePublicKey:U.string().min(1)});function W3($){let J=b0(g($),I1);if(!u(J))return null;let Z=l7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function p7($){let J=b0(g($),I1);if(!u(J))return;if(W3($))try{let Z=j3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof Y0))throw Z}U2(J)}function K$($){let J=m7($.workspaceRoot);if(J!==$.workspaceRoot||!v7(J).isDirectory()||!A1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=w$(d($).state,{proofStore:M0($),repair:!1}),Z=J!==null&&K4($.apiOrigin,J.apiOrigin),Q=Z?[N0($),N0({...$,apiOrigin:J.apiOrigin})]:[N0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var V4=U.strictObject({version:U.literal(1),drained:U.boolean(),revoked:U.boolean()});function $0($){let J=d($).control;return u(J)?V4.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function I0($,J){c(d($).control,V4.parse(J))}function w0($){let J=M0($);J.deleteBinding(),J.deleteKey();let Z=b0(g($),I1);if(u(Z))U2(Z);let Q=d($).state;if(u(Q))U2(Q)}var c7=U.strictObject({read:U.boolean(),write:U.boolean(),execute:U.boolean(),discover_environment:U.boolean(),expose_mcp:U.literal(!1)}),D3=U.strictObject({version:U.literal(1),organization_id:U.string().min(1).max(160),enrollment_ticket:U.string().min(1).max(4096),code_verifier:U.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/),root:U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),permissions:c7,execution_mode:U.enum(["confined","host"]).default("confined")}),folders:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),s7=U.object({device_id:U.string().min(1).max(160),organization_id:U.string().min(1).max(160),auth_scheme:U.literal("p256"),protocol_version:U.literal(2),roots:U.array(U.object({id:U.string().min(1),label:U.string(),path_fingerprint:U.string()})).min(1).max(32),headless:U.object({lifecycle:U.enum(["persistent","ephemeral"]),expires_at:U.iso.datetime({offset:!0})}),first_heartbeat:U.unknown().optional()}),O3=30000;class n0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function a7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(O3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new n0(X?.error==="device_revoked")}return Q.json()}async function z3($,J,Z,Q){v0();let X=D3.parse(JSON.parse(s(J)));return r0($,X,Z,Q)}async function r0($,J,Z,Q=(Y,G)=>a7(Y,G,S0($.proxy)),X=performance.now()){let Y=q4($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function N4($,J,Z,Q,X=performance.now()){let Y=q4($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function q4($,J,Z){if(v0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=k$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let H=k$([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(H.path!==K||H.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return H});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let H=s7.parse(K);if(H.organization_id!==J.organization_id||H.roots.length!==Y.length||H.roots.some((q,M)=>q.path_fingerprint!==Y[M].pathFingerprint)||H.headless.lifecycle!==$.lifetime||Date.parse(H.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let B=V2(H.first_heartbeat);try{B4($,H.device_id,{...B?{offer:B}:{},enrollmentMs:Math.min(r$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:H.organization_id,deviceId:H.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:N0($),lifetime:$.lifetime,expiresAt:H.headless.expires_at},roots:H.roots.map((q,M)=>({id:q.id,label:q.label,path:Y[M].path,pathFingerprint:q.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as i7,randomUUID as n7}from"crypto";import{unlinkSync as r7}from"fs";import{join as t7}from"path";var T4=U.strictObject({version:U.literal(1),install_id:U.uuid(),fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/)}),o7=U.object({enrollment_ticket:U.string().min(1).max(4096),expires_at:U.iso.datetime({offset:!0}),device_kind:U.literal("headless"),lifecycle:U.enum(["persistent","ephemeral"]),device_expires_at:U.iso.datetime({offset:!0})});function A3($){return o7.parse($)}var e7=U.object({credentialKind:U.enum(["oauth","api_key"]).optional(),apiOrigin:U.url(),clientId:U.string(),accessToken:U.string().min(1).max(32768),refreshToken:U.string().max(32768),expiresAt:U.iso.datetime({offset:!0}),scopes:U.array(U.string().max(128)).max(128),orgId:U.string().min(1).max(160)});function L$($){return q2(P1("REASON_CLI_CHANNEL",$.channel),B0())}async function j$($,J=L$($)){if(!u(J))return null;let Z=e7.parse(JSON.parse(s(J)));if(!C0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=S0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await M4({path:J,fetchImpl:X});if(Y&&!C0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function _4($,J,Z){if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=W$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function F4($,J,Z,Q,X){let Y=performance.now();if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=W$($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await N4($,G.direct(J.orgId),Q,(N,H)=>V({approval:G.request,code_verifier:H,registration:N}).catch((B)=>{throw $Z(B)}),Y);if(K)return K}return r0($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function $Z($){if(!($ instanceof m0))return $;if($.status===409)return new n0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new n0(!1);return $}var C1=($)=>t7(g($),"enrollment-install.json");function L4($){if(u(C1($)))r7(C1($))}function W$($,{stored:J=!0}={}){v0();let Z=C1($),Q=J&&u(Z)?T4.parse(JSON.parse(s(Z))):{version:1,install_id:n7(),fingerprint_key:i7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=k$([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((B)=>{let q=k$([B],X,Y)[0];if(q.path!==B)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:q.pathFingerprint}}),K=H4(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((B)=>B.path_fingerprint)].map((B)=>({path_fingerprint:B,permissions:X,execution_mode:$.executionMode}))},H=(B)=>({version:1,organization_id:B,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(B){e(g(B),!0),c(C1(B),Q)},complete(B,q){let M=A3(q);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...H(B),enrollment_ticket:M.enrollment_ticket}},direct:H}}function j4($,J,Z){let Q=C1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=T4.parse(JSON.parse(s(Q)));return k$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var H2=8,O4=600000,z4=15000,W4=new Set(["device_revoked","invalid_device_credential"]),M2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,B$=($)=>H0(g($),"workspaces"),A4="account.json",R3=($)=>u(H0($,A4));function k0($){let J;try{J=JZ(B$($))}catch{return[]}return J.filter((Z)=>M2.test(Z)).sort().map((Z)=>{let Q=H0(B$($),Z),X=H0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:R3(Q)}})}function T2($,J){let Z=J.toLowerCase();if(!M2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:H0(B$($),Z)});return e(Q.stateDirectory,!0),c(H0(Q.stateDirectory,A4),{version:1}),{config:Q,configPath:H0(Q.stateDirectory,"worker.json")}}function _2($,J){try{let{config:Z,configPath:Q}=T2($,J);e(g(Z),!0),I0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function x1($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||k0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var I3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function D4($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");R1($,Z.devicePublicKey),e(g(J),!0);for(let Y of I3)y$(H0(g(J),Y),{force:!0});for(let Y of I3){let G=H0(g($),Y);if(u(G))ZZ(G,H0(g(J),Y))}let Q=M0(J),X=w$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");y0({...X,worker:{...X.worker,configDigest:N0(J)}},d(J).state,{proofStore:Q})}function C3($){for(let J of k0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))w0(J.config)}catch{}y$(J.directory,{recursive:!0,force:!0})}y$(E3($),{force:!0})}function F2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(B)=>Number(Date.parse(B.worker?.expiresAt??"")>X+60000),V=k0($).flatMap((B)=>{if(!B.account||!B.config)return[];try{if($0(B.config).revoked)return[];let q=t(B.config);return q&&q.orgId.toLowerCase()===B.organizationId&&(!Q||Y(q))?[{...B,config:B.config,state:q}]:[]}catch{return[]}}).sort((B,q)=>Number(q.organizationId===J)-Number(B.organizationId===J)||Y(q.state)-Y(B.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&M2.test(N)&&N!==V.organizationId){let B=T2($,N);D4($,B.config),c(B.configPath,B.config)}else if(u(g($))){try{if(u(d($).state))w0($)}catch{}for(let B of I3)y$(H0(g($),B),{force:!0})}C3($);let H=J0.parse({...V.config,stateDirectory:$.stateDirectory});return D4(V.config,H),c(H0($.stateDirectory,"worker.json"),H),y$(V.directory,{recursive:!0,force:!0}),H}var P3={before($){for(let{config:J}of k0($))try{let Z=J?t(J):null;if(J&&Z)R1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of k0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==H0(B$($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=M0(V),N=w$(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===N0(G))y0({...N,worker:{...N.worker,configDigest:N0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},E3=($)=>H0(B$($),"listed.json");function R4($){try{let J=JSON.parse(s(E3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function I4($,J){let Z=k0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=R4($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:H})=>{let B=!1,q=null,M=!1;try{B=N?$0(N).revoked:!1,q=N&&!B?t(N):null,M=J&&!!q&&E1(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:q?.deviceId??null,name:Y?.names?.[K]??null,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,state:B?"removed":M?"connected":"not_running",blocked:!H&&!B&&!M&&(Y?.blocked.includes(K)??!1),...H?{account:!0}:{}}})}}function C4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=R4(J)??{listed:!1,reason:null,blocked:[]},H=(L)=>{let{folders:W,...R}=J,E=Z.roots.slice(1).map((I)=>I.path);return J0.parse({...R,...E.length?{folders:E}:{},stateDirectory:H0(B$(J),L)})},B=async(L)=>{let W=G.get(L);if(!W)return;W.controller.abort(),await W.done},q=(L,W=!1)=>{let R=new AbortController,E=()=>R.abort();if(X.addEventListener("abort",E,{once:!0}),X.aborted)R.abort();let I={...L,controller:R,claims:0,done:Promise.resolve(),account:W};I.done=$.serve(L,R.signal,(C)=>{I.claims=C}).then(()=>{return},(C)=>{if(W&&C instanceof T0&&C.status===401&&W4.has(C.code)){try{I0(L.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${L.organizationId} (another account's) no longer accepts this computer (${C.code}); run \`reason connect\` signed in as that account to connect it again
+import{t as v0}from"./vm-hands-entry-lite-ytwa3p73.js";import{u as Q2,w as U7,x as X4}from"./vm-hands-entry-lite-hmva2yc7.js";import{A as B7,B as H4,C as M4,D as v6,E as m0,I as g6,J as R$,z as q2}from"./vm-hands-entry-lite-2wa0aq74.js";import{$ as m1,Q as FJ,R as LJ,S as k8,T as y8,U as eJ,V as $6,W as S9,X as O5,Y as m8,Z as T0,_ as h1,aa as P0,ba as n1,ca as z5,da as d5,ea as i3,fa as x5,ja as S5,sa as Q6,ta as X6,ua as Y6,va as G6,wa as w9}from"./vm-hands-entry-lite-3fddeh8v.js";import{$a as rJ,Ba as r8,Bb as D5,Ca as t8,Cb as K9,Eb as N5,Fa as c8,Ha as X5,Ib as oJ,Jb as Q9,Ka as Y5,Pa as U5,Qa as V5,Ra as f8,Sa as h8,Ta as aJ,Ua as iJ,Wa as u,Xa as e,Ya as s,Za as c,_a as s8,ab as M1,db as Q3,eb as X3,fb as X7,gb as Y7,hb as G7,ib as S0,jb as J0,kb as g,lb as b9,mb as A1,nb as Z2,ob as N0,pb as tJ,ub as g5,wb as N8,ya as A6,zb as y2}from"./vm-hands-entry-lite-bpvxdk3g.js";import{Ob as v8}from"./vm-hands-entry-lite-z55phtry.js";import{Vb as W5}from"./vm-hands-entry-lite-h01d2fbm.js";import{bc as G5,cc as K5,jc as B5}from"./vm-hands-entry-lite-y9rzr1a3.js";import{pc as V$}from"./vm-hands-entry-lite-ffgjezmx.js";import{Ec as w8}from"./vm-hands-entry-lite-1hpmjd5x.js";import{Ic as p$,Jc as J$,Kc as I$,Lc as T1,Mc as u6,Nc as V7,Oc as N7,Pc as _1,Qc as q7,Rc as c9,Sc as H7,Tc as e2,Uc as q$,Vc as X8,Wc as $3,_c as R5,bd as J6,ed as jJ,fd as WJ}from"./vm-hands-entry-lite-ewpfck9v.js";import{Xd as b8,be as k6,ce as r$,me as V2,pd as C2,td as cJ,ud as sJ}from"./vm-hands-entry-lite-jgjvs1tq.js";import{xe as U}from"./vm-hands-entry-lite-y06rgq4n.js";import{Ae as K7,Be as s2,Ee as Z6,He as l1,Je as S7,Ke as b7,Pe as E5}from"./vm-hands-entry-lite-4kwqp4rz.js";import{Ve as r1,We as j5}from"./vm-hands-entry-lite-d8myh0nx.js";import{Ze as r6,af as A5,bf as E9,df as g8}from"./vm-hands-entry-lite-hkw64faw.js";import{qf as r}from"./vm-hands-entry-lite-547nmvs3.js";import{$f as B2,Zf as w1,_f as Y0,ag as U6,bg as V6,cg as n$,dg as F3,fg as n3,gg as w$,hg as y0,ig as E1,jg as r3,mg as k$}from"./vm-hands-entry-lite-kh7w4cpj.js";import{qg as Q5}from"./vm-hands-entry-lite-h12jx2e8.js";import{Ah as A2,Bh as Q7,Ch as P9,Dh as Z8,Eh as Q8,Fh as J1,oh as D$,ph as P1,rh as $$,uh as O$,vh as C0,wh as K4,xh as J7,yh as Z7}from"./vm-hands-entry-lite-vx5y8jc7.js";import{Gh as B0,Ih as hJ}from"./vm-hands-entry-lite-tcewjhvf.js";import{gi as nJ}from"./vm-hands-entry-lite-rwp6km63.js";import{li as f0}from"./vm-hands-entry-lite-sjfdhffh.js";import{ri as nK}from"./vm-hands-entry-lite-ah89nzd4.js";import{spawn as M7,spawnSync as rK}from"child_process";import{closeSync as T7,mkdirSync as tK,openSync as _7,readdirSync as oK,realpathSync as Z$,rmSync as L1}from"fs";import{hostname as eK}from"os";import{dirname as s9,join as _0,resolve as $B}from"path";import{createHash as k7}from"crypto";import{unlinkSync as y7}from"fs";import{platform as f7}from"os";import{join as h7}from"path";var Y4=U.discriminatedUnion("store",[U.strictObject({version:U.literal(1),store:U.literal("keychain")}),U.strictObject({version:U.literal(1),store:U.literal("file"),api_key:U.string().min(1).max(4096)})]),b$=($)=>h7($,"api-key.json");function F$($){let J=k7("sha256").update(`reason-connect-api-key
+${$}`).digest("hex");return new n$(B2(),f7(),J)}function T3($,J,Z=F$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(b$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(b$($),{version:1,store:"file",api_key:J})}function u0($,J=F$($)){if(!u(b$($)))return null;let Z=Y4.parse(JSON.parse(s(b$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function G4($,J=F$($)){if(!u(b$($)))return;if(Y4.parse(JSON.parse(s(b$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}y7(b$($))}async function _3($,J){let Z;try{Z=await X4({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:S0($.proxy)})}catch(Q){if(Q instanceof m0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as ZZ,renameSync as QZ,rmSync as y$}from"fs";import{join as H0}from"path";import{createHash as m7}from"crypto";import{realpathSync as v7,statSync as g7,unlinkSync as U2}from"fs";import{platform as u7}from"os";import{join as b0}from"path";function d($){return{state:b0(g($),"device.json"),control:b0(g($),"control.json"),lock:b0(g($),"lifecycle.lock"),socket:b0(g($),"control.sock"),daemon:b0(g($),"daemon.json"),releaseCheck:b0(g($),"release-check.json"),updateDeferral:b0(g($),"update-deferral.json"),firstHeartbeat:b0(g($),"first-heartbeat.json")}}var d7=U.object({version:U.literal(1),device_id:U.string().min(1).max(160),offer:U.unknown().optional(),enrollment_ms:U.number().int().nonnegative().max(r$).optional()});function B4($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function L3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=d7.safeParse(JSON.parse(s(Z)));if(U2(Z),!Q.success||Q.data.device_id!==J)return null;let X=V2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function M0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=b0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?j3($):new F3(g($))}function N2($,J){M0($,!0),c7($);let Z=J??j3($),Q=new F3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function j3($){return new n$(B2(),u7(),l7($))}function l7($){let J=W3($);return m7("sha256").update(`reason-worker
+${J?.directory??g($)}`).digest("hex")}function R1($,J){c(b0(g($),I1),{version:1,directory:W3($)?.directory??g($),devicePublicKey:J})}var I1="keychain-scope.json";function U4($){return u(b0(g($),I1))}var p7=U.strictObject({version:U.literal(1),directory:U.string().min(1),devicePublicKey:U.string().min(1)});function W3($){let J=b0(g($),I1);if(!u(J))return null;let Z=p7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function c7($){let J=b0(g($),I1);if(!u(J))return;if(W3($))try{let Z=j3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof Y0))throw Z}U2(J)}function K$($){let J=v7($.workspaceRoot);if(J!==$.workspaceRoot||!g7(J).isDirectory()||!A1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=w$(d($).state,{proofStore:M0($),repair:!1}),Z=J!==null&&K4($.apiOrigin,J.apiOrigin),Q=Z?[N0($),N0({...$,apiOrigin:J.apiOrigin})]:[N0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var V4=U.strictObject({version:U.literal(1),drained:U.boolean(),revoked:U.boolean()});function $0($){let J=d($).control;return u(J)?V4.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function I0($,J){c(d($).control,V4.parse(J))}function w0($){let J=M0($);J.deleteBinding(),J.deleteKey();let Z=b0(g($),I1);if(u(Z))U2(Z);let Q=d($).state;if(u(Q))U2(Q)}var s7=U.strictObject({read:U.boolean(),write:U.boolean(),execute:U.boolean(),discover_environment:U.boolean(),expose_mcp:U.literal(!1)}),D3=U.strictObject({version:U.literal(1),organization_id:U.string().min(1).max(160),enrollment_ticket:U.string().min(1).max(4096),code_verifier:U.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/),root:U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),permissions:s7,execution_mode:U.enum(["confined","host"]).default("confined")}),folders:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),a7=U.object({device_id:U.string().min(1).max(160),organization_id:U.string().min(1).max(160),auth_scheme:U.literal("p256"),protocol_version:U.literal(2),roots:U.array(U.object({id:U.string().min(1),label:U.string(),path_fingerprint:U.string()})).min(1).max(32),headless:U.object({lifecycle:U.enum(["persistent","ephemeral"]),expires_at:U.iso.datetime({offset:!0})}),first_heartbeat:U.unknown().optional()}),O3=30000;class n0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function i7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(O3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new n0(X?.error==="device_revoked")}return Q.json()}async function z3($,J,Z,Q){v0();let X=D3.parse(JSON.parse(s(J)));return r0($,X,Z,Q)}async function r0($,J,Z,Q=(Y,G)=>i7(Y,G,S0($.proxy)),X=performance.now()){let Y=q4($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function N4($,J,Z,Q,X=performance.now()){let Y=q4($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function q4($,J,Z){if(v0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=k$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let H=k$([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(H.path!==K||H.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return H});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let H=a7.parse(K);if(H.organization_id!==J.organization_id||H.roots.length!==Y.length||H.roots.some((q,M)=>q.path_fingerprint!==Y[M].pathFingerprint)||H.headless.lifecycle!==$.lifetime||Date.parse(H.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let B=V2(H.first_heartbeat);try{B4($,H.device_id,{...B?{offer:B}:{},enrollmentMs:Math.min(r$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:H.organization_id,deviceId:H.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:N0($),lifetime:$.lifetime,expiresAt:H.headless.expires_at},roots:H.roots.map((q,M)=>({id:q.id,label:q.label,path:Y[M].path,pathFingerprint:q.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as n7,randomUUID as r7}from"crypto";import{unlinkSync as t7}from"fs";import{join as o7}from"path";var T4=U.strictObject({version:U.literal(1),install_id:U.uuid(),fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/)}),e7=U.object({enrollment_ticket:U.string().min(1).max(4096),expires_at:U.iso.datetime({offset:!0}),device_kind:U.literal("headless"),lifecycle:U.enum(["persistent","ephemeral"]),device_expires_at:U.iso.datetime({offset:!0})});function A3($){return e7.parse($)}var $Z=U.object({credentialKind:U.enum(["oauth","api_key"]).optional(),apiOrigin:U.url(),clientId:U.string(),accessToken:U.string().min(1).max(32768),refreshToken:U.string().max(32768),expiresAt:U.iso.datetime({offset:!0}),scopes:U.array(U.string().max(128)).max(128),orgId:U.string().min(1).max(160)});function L$($){return q2(P1("REASON_CLI_CHANNEL",$.channel),B0())}async function j$($,J=L$($)){if(!u(J))return null;let Z=$Z.parse(JSON.parse(s(J)));if(!C0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=S0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await M4({path:J,fetchImpl:X});if(Y&&!C0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function _4($,J,Z){if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=W$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function F4($,J,Z,Q,X){let Y=performance.now();if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=W$($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await N4($,G.direct(J.orgId),Q,(N,H)=>V({approval:G.request,code_verifier:H,registration:N}).catch((B)=>{throw JZ(B)}),Y);if(K)return K}return r0($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function JZ($){if(!($ instanceof m0))return $;if($.status===409)return new n0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new n0(!1);return $}var C1=($)=>o7(g($),"enrollment-install.json");function L4($){if(u(C1($)))t7(C1($))}function W$($,{stored:J=!0}={}){v0();let Z=C1($),Q=J&&u(Z)?T4.parse(JSON.parse(s(Z))):{version:1,install_id:r7(),fingerprint_key:n7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=k$([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((B)=>{let q=k$([B],X,Y)[0];if(q.path!==B)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:q.pathFingerprint}}),K=H4(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((B)=>B.path_fingerprint)].map((B)=>({path_fingerprint:B,permissions:X,execution_mode:$.executionMode}))},H=(B)=>({version:1,organization_id:B,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(B){e(g(B),!0),c(C1(B),Q)},complete(B,q){let M=A3(q);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...H(B),enrollment_ticket:M.enrollment_ticket}},direct:H}}function j4($,J,Z){let Q=C1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=T4.parse(JSON.parse(s(Q)));return k$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var H2=8,O4=600000,z4=15000,W4=new Set(["device_revoked","invalid_device_credential"]),M2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,B$=($)=>H0(g($),"workspaces"),A4="account.json",R3=($)=>u(H0($,A4));function k0($){let J;try{J=ZZ(B$($))}catch{return[]}return J.filter((Z)=>M2.test(Z)).sort().map((Z)=>{let Q=H0(B$($),Z),X=H0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:R3(Q)}})}function T2($,J){let Z=J.toLowerCase();if(!M2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:H0(B$($),Z)});return e(Q.stateDirectory,!0),c(H0(Q.stateDirectory,A4),{version:1}),{config:Q,configPath:H0(Q.stateDirectory,"worker.json")}}function _2($,J){try{let{config:Z,configPath:Q}=T2($,J);e(g(Z),!0),I0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function x1($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||k0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var I3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function D4($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");R1($,Z.devicePublicKey),e(g(J),!0);for(let Y of I3)y$(H0(g(J),Y),{force:!0});for(let Y of I3){let G=H0(g($),Y);if(u(G))QZ(G,H0(g(J),Y))}let Q=M0(J),X=w$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");y0({...X,worker:{...X.worker,configDigest:N0(J)}},d(J).state,{proofStore:Q})}function C3($){for(let J of k0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))w0(J.config)}catch{}y$(J.directory,{recursive:!0,force:!0})}y$(E3($),{force:!0})}function F2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(B)=>Number(Date.parse(B.worker?.expiresAt??"")>X+60000),V=k0($).flatMap((B)=>{if(!B.account||!B.config)return[];try{if($0(B.config).revoked)return[];let q=t(B.config);return q&&q.orgId.toLowerCase()===B.organizationId&&(!Q||Y(q))?[{...B,config:B.config,state:q}]:[]}catch{return[]}}).sort((B,q)=>Number(q.organizationId===J)-Number(B.organizationId===J)||Y(q.state)-Y(B.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&M2.test(N)&&N!==V.organizationId){let B=T2($,N);D4($,B.config),c(B.configPath,B.config)}else if(u(g($))){try{if(u(d($).state))w0($)}catch{}for(let B of I3)y$(H0(g($),B),{force:!0})}C3($);let H=J0.parse({...V.config,stateDirectory:$.stateDirectory});return D4(V.config,H),c(H0($.stateDirectory,"worker.json"),H),y$(V.directory,{recursive:!0,force:!0}),H}var P3={before($){for(let{config:J}of k0($))try{let Z=J?t(J):null;if(J&&Z)R1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of k0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==H0(B$($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=M0(V),N=w$(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===N0(G))y0({...N,worker:{...N.worker,configDigest:N0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},E3=($)=>H0(B$($),"listed.json");function R4($){try{let J=JSON.parse(s(E3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function I4($,J){let Z=k0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=R4($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:H})=>{let B=!1,q=null,M=!1;try{B=N?$0(N).revoked:!1,q=N&&!B?t(N):null,M=J&&!!q&&E1(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:q?.deviceId??null,name:Y?.names?.[K]??null,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,state:B?"removed":M?"connected":"not_running",blocked:!H&&!B&&!M&&(Y?.blocked.includes(K)??!1),...H?{account:!0}:{}}})}}function C4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=R4(J)??{listed:!1,reason:null,blocked:[]},H=(L)=>{let{folders:W,...R}=J,E=Z.roots.slice(1).map((I)=>I.path);return J0.parse({...R,...E.length?{folders:E}:{},stateDirectory:H0(B$(J),L)})},B=async(L)=>{let W=G.get(L);if(!W)return;W.controller.abort(),await W.done},q=(L,W=!1)=>{let R=new AbortController,E=()=>R.abort();if(X.addEventListener("abort",E,{once:!0}),X.aborted)R.abort();let I={...L,controller:R,claims:0,done:Promise.resolve(),account:W};I.done=$.serve(L,R.signal,(C)=>{I.claims=C}).then(()=>{return},(C)=>{if(W&&C instanceof T0&&C.status===401&&W4.has(C.code)){try{I0(L.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${L.organizationId} (another account's) no longer accepts this computer (${C.code}); run \`reason connect\` signed in as that account to connect it again
 `)}else if(C instanceof T0&&C.status===401&&W4.has(C.code)){try{w0(L.config)}catch{}Y(`Reason worker: workspace ${L.organizationId} no longer accepts this computer
 `)}else if(!R.signal.aborted)Y(`Reason worker: workspace ${L.organizationId} stopped (worker_workspace_failed); it starts again on the next check
 `)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",E),I.claims=0,G.get(L.organizationId)===I)G.delete(L.organizationId);let C=L.config.stateDirectory;if(W&&!R3(C)&&!u(H0(C,"worker.json")))y$(C,{recursive:!0,force:!0})}),G.set(L.organizationId,I)},M=(L,W)=>{if(!W)return null;try{let R=H(L),E=t(W);if(!E||E.orgId!==L||Date.parse(E.worker?.expiresAt??"")<=Date.now()+60000||W.name!==R.name||W.executionMode!==R.executionMode||!C0(W.apiOrigin,R.apiOrigin)||E.roots.map((I)=>I.path).join(`
@@ -10,21 +10,21 @@ ${J?.directory??g($)}`).digest("hex")}function R1($,J){c(b0(g($),I1),{version:1,
 `)}for(let A of P){if(X.aborted)return!0;if(E(A))continue;try{let w=G.get(A);if(h.get(A)){if(w&&w.claims===0)await B(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
 `);continue}let b=M(A,R.get(A)?.config??null);if(b&&w)continue;if(!b){if(w&&w.claims>0)continue;if(await B(A),b=await D(A),b)Y(`Reason worker: connected in workspace ${A}
 `)}if(b&&!X.aborted)q(b)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
-`)}}return!0},F=null,z=async()=>{let L=!1;do K=!1,L=await O().catch(()=>!1);while(K&&!X.aborted);let W=JSON.stringify({version:1,...N});if(F!==W)try{e(B$(J),!0),c(E3(J),JSON.parse(W)),F=W}catch{}return L};return{check(){if(V)K=!0;else V=z().finally(()=>{V=null});return V},claims:()=>[...G.values()].reduce((L,W)=>L+W.claims,0),async settled(){await V,await Promise.all([...G.values()].map((L)=>L.done))}}}import{dirname as xZ}from"path";import{randomUUID as t$}from"crypto";import{chmodSync as S4,closeSync as o$,constants as e$,existsSync as UZ,fstatSync as b4,lstatSync as w4,mkdirSync as k4,openSync as y4,readFileSync as f4,readdirSync as h4,readlinkSync as oU,realpathSync as eU,renameSync as $1,rmSync as x3,statSync as m4,symlinkSync as $V,unlinkSync as b1,writeFileSync as S3}from"fs";import{basename as ZV,dirname as v4,isAbsolute as VZ,join as j0,relative as QV,resolve as XV,sep as YV}from"path";import{createRequire as NZ}from"module";var g4=1,u4=1,qZ=128,HZ=65536;var MZ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var P4=/^[a-z0-9_.-]{1,80}$/,TZ=64;var _Z=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function d4($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function l4($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function j2($){return typeof $==="string"&&MZ.test($)}function p4($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function w3($){k4($,{recursive:!0,mode:448}),S4($,448)}function FZ($,J){w3(v4($));let Z=`${$}.${process.pid}.${t$()}.tmp`;try{S3(Z,J,{mode:384,flag:"wx"}),S4(Z,384),$1(Z,$)}finally{if(UZ(Z))b1(Z)}}function W2($={}){if(($.platform??process.platform)!=="darwin")throw new w1("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=D$(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?D$(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&VZ(X))?null:j0($.home??B0(),"Library","Application Support"),V=$.root??(G?j0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...G?{legacyRoot:j0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:j0(V,"versions"),current:j0(V,"current"),previous:j0(V,"previous"),brokerLock:j0(V,"broker.lock"),transitionLock:j0(V,"transition.lock"),lifecycleEvents:j0(V,"lifecycle-events")}}function LZ($){return d4($)&&l4($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===g4&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&p4($.started_at)&&j2($.runtime_version)}function c4($,J){try{let Z=w4($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=y4(j0($,J),e$.O_RDONLY|e$.O_NOFOLLOW|e$.O_NONBLOCK);try{let X=b4(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return f4(Q,"utf8")}finally{o$(Q)}}catch{return null}}function b3($){try{let J=JSON.parse(c4($,"owner.json")??"null");return LZ(J)?J:null}catch{return null}}function s4($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var E4="lease",jZ=2,WZ=4,S1;function DZ(){if(S1!==void 0)return S1;if(S1=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=NZ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return S1={flock:(G,V)=>X.symbols.flock(G,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},S1}catch{}return null}function OZ($){let J=DZ();if(!J)return null;let Z=y4(`${$}.lease`,e$.O_RDWR|e$.O_CREAT|e$.O_NOFOLLOW,384);try{let Q=b4(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return o$(Z),"busy";if(J.flock(Z,jZ|WZ)===0)return Z;let X=J.errno();return o$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw o$(Z),Q}}function t0($){w3(v4($.path));let J=OZ($.path);if(J==="busy")return{acquired:!1,owner:b3($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=zZ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)o$(J)}}function zZ($,J){let Z=$.alive??s4,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:g4,pid:$.pid??process.pid,nonce:$.nonce?.()??t$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${t$()}`,V=!1;try{if(k4(G,{mode:448}),S3(j0(G,"owner.json"),`${JSON.stringify(Y)}
+`)}}return!0},F=null,z=async()=>{let L=!1;do K=!1,L=await O().catch(()=>!1);while(K&&!X.aborted);let W=JSON.stringify({version:1,...N});if(F!==W)try{e(B$(J),!0),c(E3(J),JSON.parse(W)),F=W}catch{}return L};return{check(){if(V)K=!0;else V=z().finally(()=>{V=null});return V},claims:()=>[...G.values()].reduce((L,W)=>L+W.claims,0),async settled(){await V,await Promise.all([...G.values()].map((L)=>L.done))}}}import{dirname as SZ}from"path";import{randomUUID as t$}from"crypto";import{chmodSync as S4,closeSync as o$,constants as e$,existsSync as VZ,fstatSync as b4,lstatSync as w4,mkdirSync as k4,openSync as y4,readFileSync as f4,readdirSync as h4,readlinkSync as eU,realpathSync as $V,renameSync as $1,rmSync as x3,statSync as m4,symlinkSync as JV,unlinkSync as b1,writeFileSync as S3}from"fs";import{basename as QV,dirname as v4,isAbsolute as NZ,join as j0,relative as XV,resolve as YV,sep as GV}from"path";import{createRequire as qZ}from"module";var g4=1,u4=1,HZ=128,MZ=65536;var TZ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var P4=/^[a-z0-9_.-]{1,80}$/,_Z=64;var FZ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function d4($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function l4($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function j2($){return typeof $==="string"&&TZ.test($)}function p4($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function w3($){k4($,{recursive:!0,mode:448}),S4($,448)}function LZ($,J){w3(v4($));let Z=`${$}.${process.pid}.${t$()}.tmp`;try{S3(Z,J,{mode:384,flag:"wx"}),S4(Z,384),$1(Z,$)}finally{if(VZ(Z))b1(Z)}}function W2($={}){if(($.platform??process.platform)!=="darwin")throw new w1("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=D$(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?D$(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&NZ(X))?null:j0($.home??B0(),"Library","Application Support"),V=$.root??(G?j0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...G?{legacyRoot:j0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:j0(V,"versions"),current:j0(V,"current"),previous:j0(V,"previous"),brokerLock:j0(V,"broker.lock"),transitionLock:j0(V,"transition.lock"),lifecycleEvents:j0(V,"lifecycle-events")}}function jZ($){return d4($)&&l4($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===g4&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&p4($.started_at)&&j2($.runtime_version)}function c4($,J){try{let Z=w4($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=y4(j0($,J),e$.O_RDONLY|e$.O_NOFOLLOW|e$.O_NONBLOCK);try{let X=b4(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return f4(Q,"utf8")}finally{o$(Q)}}catch{return null}}function b3($){try{let J=JSON.parse(c4($,"owner.json")??"null");return jZ(J)?J:null}catch{return null}}function s4($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var E4="lease",WZ=2,DZ=4,S1;function OZ(){if(S1!==void 0)return S1;if(S1=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=qZ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return S1={flock:(G,V)=>X.symbols.flock(G,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},S1}catch{}return null}function zZ($){let J=OZ();if(!J)return null;let Z=y4(`${$}.lease`,e$.O_RDWR|e$.O_CREAT|e$.O_NOFOLLOW,384);try{let Q=b4(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return o$(Z),"busy";if(J.flock(Z,WZ|DZ)===0)return Z;let X=J.errno();return o$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw o$(Z),Q}}function t0($){w3(v4($.path));let J=zZ($.path);if(J==="busy")return{acquired:!1,owner:b3($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=AZ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)o$(J)}}function AZ($,J){let Z=$.alive??s4,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:g4,pid:$.pid??process.pid,nonce:$.nonce?.()??t$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${t$()}`,V=!1;try{if(k4(G,{mode:448}),S3(j0(G,"owner.json"),`${JSON.stringify(Y)}
 `,{mode:384,flag:"wx"}),J!==null)S3(j0(G,E4),`flock
-`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw w4($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}$1(G,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,b3($.path)?.nonce===Y.nonce)x3($.path,{recursive:!0,force:!0});if(J!==null)o$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let H=b3($.path),B=($.now?.()??new Date).getTime(),q=H&&$.staleAfterMs!==void 0?B-Date.parse(H.started_at)<$.staleAfterMs:!1,M=H!==null&&!(J!==null&&c4($.path,E4)!==null)&&Z(H.pid);if(!H||M||q)return{acquired:!1,owner:H,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${t$()}`;try{$1($.path,T),x3(T,{recursive:!0,force:!0}),Q=!0}catch(_){let j=_.code;if(!["ENOENT","EEXIST"].includes(j??""))throw _}}finally{if(!V)x3(G,{recursive:!0,force:!0})}}throw new w1("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function a4($){return d4($)&&l4($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===u4&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&p4($.occurred_at)&&typeof $.event==="string"&&_Z.includes($.event)&&j2($.runtime_version)&&($.from_version===void 0||j2($.from_version))&&($.to_version===void 0||j2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&P4.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=TZ&&$.capabilities.every((J)=>typeof J==="string"&&P4.test(J)))}var AZ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,RZ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,IZ=300000,L2=0n;function CZ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return L2=J>L2?J:L2+1n,`${String(L2).padStart(22,"0")}-${$.event_id}.json`}function i4($){try{return h4($.lifecycleEvents).filter((J)=>AZ.test(J)).sort()}catch{return[]}}function x4($){try{let J=JSON.parse(f4($,"utf8"));return a4(J)?J:null}catch{return null}}function PZ($,J=s4,Z=Date.now()){let Q;try{Q=h4($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(RZ);if(!Y)continue;let G=j0($.lifecycleEvents,X),V=j0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-m4(G).mtimeMs>=IZ}catch{continue}if(!K)continue;try{$1(G,V)}catch(N){let H=N.code;if(H==="EEXIST")b1(G);else if(H!=="ENOENT")throw N}}}function EZ($){let Z=i4($).flatMap((X)=>{try{return[{name:X,size:m4(j0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>qZ||Q>HZ){let X=Z.shift();if(!X)break;try{b1(j0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function k1($,J,Z={}){let Q={schema_version:u4,event_id:Z.eventId?.()??t$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!a4(Q))throw new w1("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return w3($.lifecycleEvents),FZ(j0($.lifecycleEvents,CZ(Q)),`${JSON.stringify(Q)}
-`),EZ($),Q}async function n4($,J,Z){PZ($);let Q=0;for(let X of i4($)){let Y=j0($.lifecycleEvents,X);if(Z){let K=x4(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${t$()}`;try{$1(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=x4(G);if(!V){b1(G);continue}try{await J(V),b1(G),Q+=1}catch{try{$1(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function o4($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!SZ($.saved))return J;let Z=$.saved,Q=(G,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...V?{code:`worker_api_origin_move_${G}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?J1():$.native;if(!X)return J;let Y=[];try{let G=X.lock(xZ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let H=t0({path:d(Z).lock,runtimeVersion:r});if(!H.acquired)return J;Y.push(()=>H.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=e4(V),N={saved:V,configPath:$.configPath};if(!D2(V)&&K.length===0)return Q("unchanged"),N;if(D2(V)){let H=r4(V);c($.configPath,H),N={saved:H,configPath:$.configPath}}for(let H of K)try{c(H.configPath,r4(H.config))}catch(B){Q("failed",`workspace:${t4(B)}`)}return Q("moved"),N}catch(G){return Q("failed",t4(G)),J}finally{for(let G of Y.reverse())G()}}function D2($){return O$($.apiOrigin)!==$.apiOrigin}function e4($){return k0($).filter((J)=>J.config!==null&&D2(J.config))}function SZ($){return D2($)||e4($).length>0}function r4($){let J=J0.parse({...$,apiOrigin:O$($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=N0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)y0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:M0(J)});return J}function t4($){if($ instanceof Y0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as bZ,lstatSync as f3,readdirSync as Y8,readlinkSync as wZ,unlinkSync as kZ}from"fs";import{join as D0,sep as yZ}from"path";var O2="rehome.json";class z2 extends Error{code;constructor($){super($);this.code=$}}function G8($){let J={saved:$.saved,configPath:$.configPath},Z=D0($.home,".config"),Q=D0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=D0(Q,...X),G=D0(Z,"reason",...X),V=(B,q)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:B,...q?{code:`worker_state_rehome_${B}:${q}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?J1():$.native,N=$.saved,H=[];try{if(N&&J8(Q)&&N.stateDirectory===Y){let D={...N,stateDirectory:G};if(!k3(K,G,D,H))return J;return $8(N,D,$.host,V)}if(N&&J8(Q)&&N.stateDirectory===G&&U4(N)&&k3(K,G,N,H))return K8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!Z1(Q)?.isDirectory())return J;if(uZ(Y)===r)return J;let q=(D,O=!0)=>{if(O)c(D0(Y,O2),{version:r});return V("skipped",D),J},M=[Y];for(let D of hZ(Q,Y)){if(D.config?.lifetime!=="ephemeral")return q("several_connections");if(!fZ(D.directory,D.config,H))return q("once_running",!1);M.push(D.directory)}if(!K)return q("config_rename_unavailable:no_native");if(!k3(K,Y,N,H))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(Z8(Z)!==null)return q("conflicting_identity");if(Q8(Z)!==null)return q("conflicting_files");if(Z1(G)&&(!Z1(G).isDirectory()||Y8(G).length>0))return q("connection_folder_taken");R1(N,T.devicePublicKey),P3.before(N);let _=u0(Y);if(_&&y3(Y))mZ(G,_);let j=A2(Z,K,M);if(j.state!=="renamed"&&j.state!=="linked"){if(_&&y3(Y))B8(G);return q(j.problem??"config_folder_kept")}return $8(N,{...N,stateDirectory:G},$.host,V)}catch(B){try{if(Z1(Y)?.isDirectory())c(D0(Y,O2),{version:r})}catch{}return V("failed",dZ(B)),gZ(N,Y,G,J)}finally{for(let B of H.reverse())B()}}function $8($,J,Z,Q){let X=f3(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)bZ(J.stateDirectory,448);let Y=M0(J),G=w$(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new z2("identity_missing");let V=N0(J);if(G.worker.configDigest===N0($))y0({...G,worker:{...G.worker,configDigest:V}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==V)throw new z2("worker_config_binding_mismatch");c(D0(J.stateDirectory,"worker.json"),J),P3.after($,J),K8($,J,Z);let K=D0(J.stateDirectory,O2);if(u(K))kZ(K);return Q("moved"),{saved:J,configPath:D0(J.stateDirectory,"worker.json")}}function K8($,J,Z){if(X8($,J,Z,"connect"),!y3(J.stateDirectory))return;let Q=vZ(F$($.stateDirectory));if(!Q)return;let X=F$(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);B8($.stateDirectory)}function k3($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=t0({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function fZ($,J,Z){if(u(g(J))){let X=t0({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=Z1(D0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function hZ($,J){let Z=[$,...Y8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>D0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=D0(X,Y);if(G===J||!Z1(D0(G,"worker.json")))continue;let V=U8(G);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+yZ))Q.push({directory:G,config:V})}return Q}function y3($){try{return JSON.parse(s(D0($,"api-key.json"))).store==="keychain"}catch{return!1}}function mZ($,J){let Z=F$($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function B8($){try{F$($).deleteBinding()}catch(J){if(!(J instanceof Y0))throw J}}function vZ($){try{return $.loadBinding()}catch(J){if(J instanceof Y0)return null;throw J}}function gZ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=U8(Z);return X?.stateDirectory===Z?{saved:X,configPath:D0(Z,"worker.json")}:Q}function J8($){try{return f3($).isSymbolicLink()&&wZ($)==="reason"}catch{return!1}}function uZ($){try{let J=JSON.parse(s(D0($,O2)));return typeof J.version==="string"?J.version:null}catch{return null}}function U8($){try{let J=D0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function Z1($){try{return f3($)}catch{return null}}function dZ($){if($ instanceof z2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof Y0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as lZ}from"fs";function R2($){try{let J=JSON.parse(lZ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function V8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as RK}from"crypto";import{readdirSync as IK,realpathSync as u6,statSync as CK}from"fs";import{hostname as PK}from"os";import{join as s$,resolve as EK}from"path";var I2="cloud",pZ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function y1($){return pZ.test($)&&!N8.test($)}var cZ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Q1($){return cZ[$]}import{chmodSync as sZ,lstatSync as P2,mkdtempSync as aZ,realpathSync as T8,rmdirSync as iZ,rmSync as nZ,unlinkSync as rZ}from"fs";import{createConnection as tZ,createServer as oZ}from"net";import{basename as q8,dirname as H8,join as f$}from"path";var eZ=U.enum(["status","drain","resume","stop","reload_roots"]),$Q=U.strictObject({version:U.literal(1),instanceId:U.string(),deviceId:U.string(),phase:U.enum(["starting","running","reconnecting","stopping"]),drained:U.boolean(),activeClaims:U.number().int().nonnegative(),activeSessions:U.number().int().nonnegative().optional(),executionEligible:U.boolean(),supportedOperations:U.array(U.enum(C2)).max(C2.length).optional(),capabilityReadiness:U.partialRecord(U.enum(C2),U.boolean()).optional(),lastHeartbeat:U.string().nullable(),expiresAt:U.string()}),JQ=U.strictObject({nonce:U.string(),action:eZ}),ZQ=U.object({nonce:U.uuid()}),_8=U.strictObject({version:U.literal(1),nonce:U.uuid(),socketPath:U.string().max(100)});function F8($){return f$(d($).lock,"control.json")}function E2($){return e(d($).lock),ZQ.parse(JSON.parse(s(f$(d($).lock,"owner.json"))))}function M8($){if(!u($))return!1;let J=P2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function L8($,J){let Z=F8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!P2(Y).isSocket())return null;return M8(Y)?Y:null}let Q=_8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=H8(Q.socketPath);if(H8(X)!==T8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(q8(X))||q8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),M8(Q.socketPath)?Q.socketPath:null}async function x2($,J,Z){if(E2($).nonce!==J)throw Error("worker_instance_changed");let Q=F8($);if(u(Q))throw Error("worker_control_already_serving");let X=aZ(f$(T8("/tmp"),"ara-worker-")),Y=f$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,V=oZ((B)=>{G.add(B),B.once("close",()=>G.delete(B)),B.setTimeout(2000,()=>B.destroy());let q="",M=!1;B.on("error",()=>B.destroy()),B.on("data",(T)=>{if(M)return;if(q+=T.toString(),Buffer.byteLength(q)>4096){B.destroy();return}if(!q.includes(`
-`))return;M=!0;try{let _=JQ.parse(JSON.parse(q));if(_.nonce!==J){B.destroy();return}B.end(JSON.stringify(Z(_.action))+`
-`)}catch{B.destroy()}})});V.maxConnections=32;let K,N=!1,H=async()=>{if(N)return;N=!0;for(let B of G)B.destroy();if(await new Promise((B)=>V.close(()=>B())),K&&u(Q)){let B=P2(Q);if(B.isFile()&&B.dev===K.dev&&B.ino===K.ino)try{let q=_8.parse(JSON.parse(s(Q)));if(q.nonce===J&&q.socketPath===Y)rZ(Q)}catch{}}try{iZ(X)}catch{}};try{if(await new Promise((B,q)=>{V.once("error",q),V.listen(Y,()=>{sZ(Y,384),B()})}),E2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=P2(Q),H}catch(B){throw await H(),B}}function j8($,J){try{let Z=JSON.parse(s(f$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function f1($){return j8($,"runtime_version")}function QQ($){return j8($,"nonce")}function W8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(f$(d($).lock,"owner.json")))return"no_lock";return L8($,E2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var XQ=21600000,YQ=U.strictObject({instance:U.string().nullable(),since:U.number().int().nonnegative()});function GQ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=YQ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;h3($)}catch{}return null}function h3($){try{nZ(d($).updateDeferral,{force:!0})}catch{}}async function S2($,J,Z=()=>!1){let Q=QQ($),X=GQ($,Q);if(J!==void 0){let N=f1($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await U0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),V=X;if(V===null){V=G;try{c(d($).updateDeferral,{instance:Q,since:V})}catch{}}let K=G-V;return{state:K<XQ?"busy":"drained",sessions:Y,waitedMs:K}}async function U0($,J){let Z=d($);if(!u(f$(Z.lock,"owner.json")))return null;let Q=E2($),X=L8($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let V=tZ(X),K="",N=!1,H=(B,q)=>{if(N)return;if(N=!0,V.destroy(),q)G(q);else Y(B)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
-`)),V.on("data",(B)=>{if(K+=B.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(B)=>{if("code"in B&&["ECONNREFUSED","ENOENT"].includes(String(B.code)))H(null);else H(null,B.message==="worker_control_timeout"?B:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let B=$Q.parse(JSON.parse(K));if(B.instanceId!==Q.nonce)throw Error("worker_instance_changed");H(B)}catch{H(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>H(null,Error("worker_control_unavailable")))})}import{randomUUID as BG}from"crypto";import{homedir as uJ}from"os";import{spawn as KQ}from"child_process";async function D8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),V=(B)=>{if(Q===B)return;Q=B,J.onStatusChange?.(B)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let B=(J.spawn??KQ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=B,B.once("exit",()=>{if(!X&&Z===B)V("failed"),K()}),await new Promise((q,M)=>{B.once("spawn",q),B.once("error",M)}),B.exitCode===null&&B.signalCode===null)V("held")}catch{V("failed"),K()}};G=N(),await G;let H;return{get status(){return Q},release(){return H??=(async()=>{X=!0,clearTimeout(Y),await G;let B=Z;if(!B||B.exitCode!==null||B.signalCode!==null||!B.pid)return Q="failed","released";let q=await new Promise((M)=>{let T,_=setTimeout(()=>{try{B.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);B.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{B.kill("SIGTERM")}catch{}});if(q==="released")Q="failed";return q})()}}}class X1 extends Error{constructor(){super("Reason Device operation lease expired.")}}class b2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new X1;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new X1;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new X1)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as qQ}from"fs";import{constants as m3}from"fs";import{open as BQ}from"fs/promises";import{join as UQ}from"path";var VQ={platform:process.platform,home:B0,async openFile($){let J=await BQ($,m3.O_RDONLY|m3.O_NOFOLLOW|m3.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function O8($=VQ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(UQ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class v3 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function NQ($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new v3;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function z8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await NQ($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof v3||(X instanceof T0?h1(X.status):m1(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function t3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var HQ=1000,MQ=250,TQ=g8(qQ(process.execPath)),A8=null,R8=null;function u8($){if(process.platform!=="darwin")return{};return R8??=O8().then((J)=>{A8={status:J,checkedAt:$().getTime()}}).finally(()=>{R8=null}),{fullDiskAccess:{...A8??{status:"unknown",checkedAt:$().getTime()},executablePath:TQ}}}var I8=8,_Q=2000,FQ=2000,o3=8000,C8=3,LQ=250,P8=1000,E8=30000,jQ=0.2,WQ=30000,DQ=21600000,OQ=300000,zQ=3600000,AQ=0.1,d8=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function RQ($){return Math.min(C8,Math.max(1,$??C8))}function IQ($){return typeof $.reason_code==="string"&&d8.has($.reason_code)?$.reason_code:"cancelled"}function g3($){return $.reason instanceof f0&&($.reason.code==="cancelled"||d8.has($.reason.code))?$.reason.code:"cancelled"}function x8($){return $ instanceof f0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function l8($){return $.capability==="hands.connect"&&(h8($.payload)||f8($.payload))}function u3($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*AQ)))}function CQ($,J=Math.random){let Z=Math.min(E8,P8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*jQ*(Q*2-1);return Math.min(E8,Math.max(P8,Math.round(Z+X)))}function e3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class d3 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function PQ($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function l3($){return $ instanceof Error?$.message:String($)}function p3($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function s0($){return $ instanceof T0&&$.status===409&&$.code==="attempt_fenced"}function c3($){return $.capability==="environment.install"}function EQ($){if($ instanceof k2||$ instanceof X1||$ instanceof g1)return"timeout";if(!($ instanceof Error)||$ instanceof T0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof T0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function v1($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(s0(Z))return;let Q=Z instanceof T0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:EQ(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function Y1($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)v1($,J,Q);throw Q}}class g1 extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function s3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":w8(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:c3(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??e3,K=$.operationCompletionTimeoutMs??o3,N=performance.now()+K,H,B,q=new Promise((_,j)=>{let D=()=>{let F=new g1;Y.abort(F),j(F)},O=(F)=>{clearTimeout(H),H=setTimeout(D,F)};if(B=()=>O(Math.max(0,Math.min(N-performance.now(),_Q))),O(K),$.signal.addEventListener("abort",B,{once:!0}),$.signal.aborted)B()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),q]);break}catch(_){if(G.aborted||$.signal.aborted||P0(_)||s0(_)||!xQ(_)||performance.now()>=N)throw v1($,"completion",_),_;T+=1;let j=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(j<=0)throw v1($,"completion",_),_;try{await V(j,G)}catch{throw v1($,"completion",_),_}}}finally{clearTimeout(H),$.signal.removeEventListener("abort",B),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function xQ($){if(P0($))return!1;if(s0($))return!1;if($ instanceof T0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof g1)return!1;return!0}return!1}class k2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function w2($){if($ instanceof k2)return!0;return $ instanceof T0?h1($.status):m1($)}function a3($,J){if(!($ instanceof T0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function SQ($,J,Z,Q,X){let Y=new AbortController,G,V=()=>{return},K=new Promise((H,B)=>{let q=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),B(M)};if(V=()=>Q.removeEventListener("abort",q),Q.aborted)q();else Q.addEventListener("abort",q,{once:!0})}),N=new Promise((H,B)=>{G=setTimeout(()=>{let q=new k2;Y.abort(q),B(q)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);V()}}async function S8($,J,Z,Q,X,Y){let G=RQ($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??o3,K=$.operationHeartbeatRetryDelayMs??LQ,N=Y.remainingMs(),H=Math.min(N,G*V+K*G*(G-1)/2);for(let B=0;B<G;B+=1)try{Q.throwIfAborted(),Y.assertCurrent();let q=Math.min(V,Y.remainingMs()),M=await SQ($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(q-1000))),clientRetryCount:B},Q,q);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(q){if(Q.aborted||B+1>=G||s0(q)||P0(q)||!w2(q)){if(!Q.aborted)v1($,"operation_heartbeat",q);throw q}let M=N-Y.remainingMs(),T=a3(q,($.now?.()??new Date).getTime()),_=Math.max(K*(B+1),H*(B+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function bQ($,J,Z,Q,X){let Y=l8(J),G=new AbortController,V=new AbortController,K=()=>{G.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,H,B,q=-1,M=0,T=Promise.resolve(),_=[],j=new AbortController,D=!1,O,F=null,z=!1,L,W,R={},E=(S)=>{D=!0,j.abort(S),G.abort(S),V.abort(S)},I=(S)=>{if(O)return O;let y=structuredClone(S),l=M;return O=(async()=>{let k=new AbortController,P=k.signal;P.throwIfAborted();let x,A=()=>{},w=new Promise((b,n)=>{if(A=()=>n(P.reason),P.addEventListener("abort",A,{once:!0}),x=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),P.aborted)A()});try{for(let b=0;b<3;b+=1){P.throwIfAborted();try{let n=await Promise.race([Y1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[y],signal:P,transientRetryOwner:"caller"})),w]);if(P.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(P0(n))X(n);let o=n instanceof T0?h1(n.status):m1(n);if(P.aborted||!o||b===2)throw n;let V0=Math.max(500*2**b,a3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(V0,P),w])}}}finally{clearTimeout(x),P.removeEventListener("abort",A),k.abort()}})(),O},C=(S,y,l)=>{let k=(x)=>Y1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:y,events:S,signal:x,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&s0(A))E(A);if(l&&(P0(A)||s0(A))){if(P0(A))X(A);G.abort(A),V.abort(A),j.abort(A)}throw A});if(!l)return async(x)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(x)).next_event_seq;return}x.throwIfAborted();let A=()=>{},w=new Promise((b,n)=>{A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([k(x),w]);x.throwIfAborted(),M=b.next_event_seq}finally{x.removeEventListener("abort",A)}};let P=z8({send:k,lease:W,sleep:Z,retryAfterMs:(x)=>a3(x,($.now?.()??new Date).getTime())});return async(x)=>{let A=await P(x);if(A.next_event_seq!==y+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,y)=>{let l=S??await S8($,J,{controlAckSeq:q,waitMs:y},V.signal,Z,W),k=null,P=!1;for(let x=0;x<10;x+=1){let A=q+1;for(let w of l.controls){if(w.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(w.kind==="cancel"||w.kind==="operation.cancel")k??=IQ(w.payload),G.abort(new f0(k,"Reason closed the Device operation."));if(w.kind!=="cancel"&&w.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,o=new Promise((V0,W0)=>{b=V0,n=W0});o.catch(()=>{}),R.current={promise:o,resolve:b,reject:n}}try{P||=!await $.onControl?.(J,w)}catch(b){if(b instanceof f0)H??=x8(b);throw R.current?.reject(b),b}}q=w.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==q+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:P}}try{l=await S8($,J,{controlAckSeq:q},V.signal,Z,W),R.current?.resolve()}catch(w){if(R.current?.reject(w),!k||s0(w)||P0(w))throw w;return{cancellationReason:k,unsupported:P}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)W=new b2(J.lease_until,()=>($.now?.()??new Date).getTime(),(y)=>{if(!G.signal.aborted)N=y;G.abort(y),V.abort(y)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||i3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(y){if(!c3(J)||s0(y)||P0(y))throw y;await s3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let y=S.cancellationReason??g3($.signal);G.abort(new f0(y,"Reason closed the Device operation.")),B={status:"cancelled",error_code:y}}else if(S.unsupported)G.abort(),B={status:"failed",error_code:"control_unsupported"};else{let y=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?FQ:15000),P=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??o3)-1000)),x=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!x){if(await Z(k,V.signal),V.signal.aborted)return}let A=await h(void 0,x?P:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new f0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(P0(A))X(A);if(s0(A))N=A,E(A);if(!V.signal.aborted)N=A,G.abort();return}})();try{if(W?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(W?.remainingMs()??0)>0),B=await $.onClaim(J,G.signal,async(k)=>{if(c3(J))return;let P=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",x=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=x||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,j.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,j.signal]):$.signal,w={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:x?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(i3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,V0)=>{_.push({wireEvent:w,settle:(W0)=>W0===void 0?o():V0(W0)})});let b=_;_=[];let n=T.then(async()=>{if((D||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(P)await I(w);return}if(F!==null){if(k.kind!=="hands.stopped"||!z||!L)throw F;let V0=new AbortController,W0=AbortSignal.any([$.signal,j.signal,V0.signal]),H$=setTimeout(()=>V0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);z=!1;try{await L(W0),L=void 0,await C([w],M,!0)(W0),F=null}catch(M$){throw F=M$??Error("Hands stop receipt could not be confirmed."),M$}finally{clearTimeout(H$),V0.abort()}return}if(x&&!W){let V0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));W=new b2(new Date(V0).toISOString(),()=>($.now?.()??new Date).getTime(),(W0)=>{G.abort(W0),V.abort(W0)})}let o=M;if(x)L=C([...b.map((V0)=>V0.wireEvent),w],o,!0),await L(A),L=void 0;else await C([...b.map((V0)=>V0.wireEvent),w],o,!1)(A)});n.then(()=>{for(let o of b)o.settle()},(o)=>{for(let V0 of b)V0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(P0(o))X(o);if(x){if(F===null)z=A.aborted&&!j.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),V.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(k){B=G.signal.aborted?{status:"cancelled",error_code:g3(G.signal)}:{status:"failed",error_code:x8(k)}}finally{Q.authorized=()=>!1,j.abort();for(let k of _.splice(0))k.settle();V.abort(),await y}let l=k8(J.capability)?y8(B.result,J.operation_id):null;if(N){if(P0(N))throw N;B={status:"failed",error_code:H??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&B.status==="succeeded")B={status:"cancelled",error_code:g3(G.signal),...l?{result:l}:{}}}if(W?.close(),P0($.signal.reason))throw $.signal.reason;await s3($,J,B)}finally{W?.close(),j.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function $9($){let J=$.now??(()=>new Date),Z=$.sleep??e3,Q=$.saveStatus??r3,X=$.loadStatus??E1,Y=$.statusPath??n3(),G=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...u8(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),H=0,B,q=!1,M,T,_,j=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),v8();try{let D=async()=>{let O=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||O===T)return;if(M&&T){let L=await M.release();if($.onEvent?.({type:"idle_sleep",status:L,policy:T}),L==="failed")return;M=void 0,T=void 0,K=!1;let W=X(Y);if(W)Q({...W,idleSleepHold:K},Y)}if(!O)return;T=O;let F=!0;M=await($.acquireAwakeHold??D8)(O,{onStatusChange:(L)=>{if(F)return;K=L==="held";let W=X(Y);if(W)Q({...W,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:L,policy:O})}}),F=!1,K=M.status==="held";let z=X(Y);if(z)Q({...z,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:O})};if(await D(),$.readIdleSleepPolicy)_=setInterval(()=>{j=j.then(D).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let O=!1;try{await wQ({...$,saveStatus:(F,z)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},z)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&H>0&&!O){O=!0;let z=H;H=0,B=void 0,$.onEvent?.({type:"reconnected",attempts:z})}$.onEvent?.(F)}});return}catch(F){if(p3(F,$.signal))return;if(P0(F)){q=!0;let L=$.state.worker?"worker_connection_failed":l3(F);throw Q({...N(),state:"error",error:L},Y),$.onEvent?.({type:"error",message:L}),F}H+=1;let z=CQ(H,$.reconnectRandom);B??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:B},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":l3(F),attempt:H,retryInMs:z}),await Z(z,$.signal)}}}catch(D){if(!p3(D,$.signal))throw D}finally{if($.client.close?.(),clearInterval(_),await j,M&&T){let D=await M.release();K=D==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:D,policy:T})}if(!q)Q({...N(),state:"stopped"},Y);else{let D=X(Y);if(D)Q({...D,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function wQ($){let J=$.now??(()=>new Date),Z=$.sleep??e3,Q=$.statusPath??n3(),X=$.saveStatus??r3,Y=$.loadStatus??E1,G=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,H=()=>N.abort($.signal.reason);if($.signal.aborted)H();else $.signal.addEventListener("abort",H,{once:!0});let B=K?.random??Math.random,q=$.maxConcurrentClaims,M=typeof q==="number"&&Number.isSafeInteger(q)&&q>0?Math.min(I8,q):I8,T=0,_=!1,j=null,D=(v)=>{j??=v,N.abort(v)},O=new Map,F=()=>{let v=new Set,X0=0;for(let{claim:x$}of O.values()){let Y$=x$.capability==="hands.connect"?x$.payload[b8]:void 0;if(typeof Y$==="string"){if(v.has(Y$))continue;v.add(Y$)}X0+=1}return X0},z=null,L=()=>[...O.values()].some((v)=>v.authorized()),W=()=>[...O.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(G).getTime()+u3(K.initialDelayMs??WQ,B):Number.POSITIVE_INFINITY,E=null,I=!1,C=$.firstHeartbeat,h=C?.account_root_metadata_supported===!0,S=C?.workspace_root_metadata_supported===!0,y=C?.account_root_path_supported===!0,l=C?.home_contained_roots_supported===!0,k=C?.root_paths_supported===!0,P=C?.startup_supported===!0,x=C!==void 0,A=C?{challenge:C.challenge,expires_at:C.expires_at}:void 0,w,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...u8(J),...V?{lastUsedAt:V}:{},...E?{organizationId:E.organization_id,organizationName:E.organization_name,organizationSlug:E.organization_slug}:{}}),o=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!b)w??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...P&&!b&&w?{startup:w}:{},capabilities:v?m8($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:y,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},V0=()=>{if(I||!$.client.identity)return;I=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;E=v;let X0=Y(Q);if(!X0)return;X({...X0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},W0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,y=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,P=v.startup_supported===!0,x=!1},H$=(v)=>{if(v.startup)b=!0},M$=(v,X0)=>{if(!(X0 instanceof T0&&X0.status===400&&X0.code==="invalid_heartbeat")||!v.startup&&!x)throw X0;if(b=!0,x)h=S=y=!1,l=k=P=x=!1;return null},j1=(v)=>{W0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),V0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},P$=!1,a$=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(P$)a$=!0;let v=o();Y1($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((X0)=>M$(v,X0))).then((X0)=>{if(!X0)return;H$(v),W0(X0),j1(X0)},()=>{return})});let T$=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let Q$=!1,E$=$.maxConsecutiveHeartbeatFailures??3,X$=0;try{while(!$.signal.aborted){if(j)throw j;if(_&&W())break;let v,X0=o(),x$=A;A=void 0,P$=!0,a$=!1;try{let i=await Y1($,"heartbeat",()=>$.client.heartbeat($.state,X0,N.signal,...x$?[x$]:[]).catch((K0)=>M$(X0,K0)));if(P$=!1,!i)continue;v=i,H$(X0),X$=0}catch(i){if(P$=!1,$.signal.aborted)break;if(!w2(i))throw i;if(X$+=1,X$>=E$&&!L())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(W0(v),Object.keys(o().capabilities).length>Object.keys(X0.capabilities).length)continue;if(a$)continue;if(j1(v),j)throw j;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let i=new AbortController,K0=()=>i.abort($.signal.reason);if($.signal.aborted)K0();else $.signal.addEventListener("abort",K0,{once:!0});let z0;try{z0=K.check(i.signal)}catch(A0){z0=Promise.reject(A0)}let G$=z0.then((A0)=>({kind:"completed",result:A0}),(A0)=>({kind:"failed",error:A0})),i$;try{while(!0){let A0=await PQ(G$,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(A0.kind==="failed")throw new d3(A0.error);if(A0.kind==="completed"){i$=A0.result;break}try{let E0=o(),D1=await Y1($,"heartbeat",()=>$.client.heartbeat($.state,E0,N.signal).catch((Y2)=>M$(E0,Y2)));if(!D1)continue;v=D1,H$(E0),j1(v),X$=0}catch(E0){if($.signal.aborted)throw E0;if(!w2(E0))throw E0;if(X$+=1,X$>=E$&&!L())throw E0}}}catch(A0){i.abort(A0);let E0=await G$;if(E0.kind==="completed"&&E0.result==="activated")i$="activated";else throw A0}finally{$.signal.removeEventListener("abort",K0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,i$==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+u3(K.intervalMs??DQ,B)}catch(i){if(!(i instanceof d3))throw i;T+=1;let K0=K.retryBaseMs??OQ,z0=K.retryMaxMs??zQ,G$=Math.min(z0,K0*2**Math.min(T-1,8));R=J().getTime()+u3(G$,B)}if($.signal.aborted)break;if(_&&W())break;if(_){await T$($.heartbeatIntervalMs??15000);continue}let Y$=$.client.sessionCadence?.($.state)??null,S$=Y$?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await T$(S$);continue}if(F()>=M){let i=new AbortController;z=i;try{await Z(S$,AbortSignal.any([$.signal,i.signal]))}catch(K0){if(!i.signal.aborted)throw K0}finally{if(z===i)z=null}continue}let h0,W1=Y$?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),f=performance.now();try{h0=await Y1($,"claim",()=>$.client.claimOperation($.state,{waitMs:W1,signal:N.signal}))}catch(i){if($.signal.aborted||!w2(i)||!L())throw i;await T$(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(j)throw j;if(!h0){if(performance.now()-f<W1-MQ)await T$(HQ);continue}if($.claimable?.()===!1){await s3($,h0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:h0.operation_id,runId:h0.run_id,attemptId:h0.attempt_id,capability:h0.capability});let a,q0={authorized:()=>!1,claim:h0};if(a=bQ({...$,signal:N.signal},h0,Z,q0,D).catch((i)=>{if(P0(i))D(i);else if(!s0(i)&&[...O].some(([K0,z0])=>K0!==a&&z0.authorized())){if(i instanceof g1)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!s0(i)&&j===null)j=i}).finally(()=>{O.delete(a),z?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:O.size})}),O.set(a,q0),$.onEvent?.({type:"claims_changed",activeClaims:O.size}),l8(h0)){if(await a,j)throw j}}}catch(v){if(!p3(v,$.signal)){N.abort(v),Q$=!0;let X0=$.state.worker?"worker_connection_failed":l3(v);throw X({...n(),state:"error",error:X0},Q),$.onEvent?.({type:"error",message:X0}),v}}finally{if(N.abort(),await Promise.allSettled(O.keys()),$.signal.removeEventListener("abort",H),!Q$)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as VX}from"child_process";import{constants as T5,existsSync as NX,mkdtempSync as I5,rmSync as qX}from"fs";import{access as _5,open as HX,readFile as F5,readlink as MX,readdir as L5,unlink as TX,rmdir as _X}from"fs/promises";import{basename as X9,join as G9}from"path";import{randomUUID as h$}from"crypto";import{chmodSync as kQ,closeSync as yQ,fsyncSync as fQ,openSync as hQ,readFileSync as mQ,rmdirSync as p8,unlinkSync as a8,writeFileSync as vQ}from"fs";import{createConnection as gQ,createServer as uQ}from"net";import{dirname as dQ,join as lQ}from"path";var pQ=5000;async function i8($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:h$()},X={runId:h$(),deviceId:h$(),rootId:h$(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=s8(J,X),G={version:1,snapshot_id:h$(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{a8(Y.path)}catch{}}}async function n8($,J,Z=c8){if(J.aborted)return!1;let Q,X,Y=new Set,G=h$(),V=uQ((q)=>{Y.add(q),q.once("close",()=>Y.delete(q)),q.on("error",()=>q.destroy()),q.end(G)});V.maxConnections=1;let K,N,H=new Promise((q)=>{N=()=>q(!1)}),B=setTimeout(N,pQ);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${h$()}`}),X=lQ(Q.journalDirectory,"readiness.json");let q=hQ(X,"wx",384);try{vQ(q,G),fQ(q)}finally{yQ(q)}if(mQ(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{kQ(Q.socketPath,384)}catch{T(!1);return}K=gQ(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(j)=>{if(_+=j,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,H])&&!J.aborted}catch{return!1}finally{clearTimeout(B),J.removeEventListener("abort",N),K?.destroy();for(let q of Y)q.destroy();if(await new Promise((q)=>V.close(()=>q())),Q?.disposeSocket(),X)try{a8(X)}catch{}if(Q){try{p8(Q.journalDirectory)}catch{}try{p8(dQ(Q.journalDirectory))}catch{}}}}import{spawn as cQ}from"child_process";import{randomUUID as m$}from"crypto";import{basename as sQ}from"path";import{fileURLToPath as aQ}from"url";function iQ(){let $=sQ(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",aQ(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function o8($,J,Z=iQ()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=cQ(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>G.once("close",()=>{V=!0,F()}));G.on("error",X);let N,H,B=new Promise((F)=>{N=F}),q=new Promise((F)=>{H=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,j=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
+`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw w4($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}$1(G,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,b3($.path)?.nonce===Y.nonce)x3($.path,{recursive:!0,force:!0});if(J!==null)o$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let H=b3($.path),B=($.now?.()??new Date).getTime(),q=H&&$.staleAfterMs!==void 0?B-Date.parse(H.started_at)<$.staleAfterMs:!1,M=H!==null&&!(J!==null&&c4($.path,E4)!==null)&&Z(H.pid);if(!H||M||q)return{acquired:!1,owner:H,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${t$()}`;try{$1($.path,T),x3(T,{recursive:!0,force:!0}),Q=!0}catch(_){let j=_.code;if(!["ENOENT","EEXIST"].includes(j??""))throw _}}finally{if(!V)x3(G,{recursive:!0,force:!0})}}throw new w1("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function a4($){return d4($)&&l4($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===u4&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&p4($.occurred_at)&&typeof $.event==="string"&&FZ.includes($.event)&&j2($.runtime_version)&&($.from_version===void 0||j2($.from_version))&&($.to_version===void 0||j2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&P4.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=_Z&&$.capabilities.every((J)=>typeof J==="string"&&P4.test(J)))}var RZ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,IZ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,CZ=300000,L2=0n;function PZ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return L2=J>L2?J:L2+1n,`${String(L2).padStart(22,"0")}-${$.event_id}.json`}function i4($){try{return h4($.lifecycleEvents).filter((J)=>RZ.test(J)).sort()}catch{return[]}}function x4($){try{let J=JSON.parse(f4($,"utf8"));return a4(J)?J:null}catch{return null}}function EZ($,J=s4,Z=Date.now()){let Q;try{Q=h4($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(IZ);if(!Y)continue;let G=j0($.lifecycleEvents,X),V=j0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-m4(G).mtimeMs>=CZ}catch{continue}if(!K)continue;try{$1(G,V)}catch(N){let H=N.code;if(H==="EEXIST")b1(G);else if(H!=="ENOENT")throw N}}}function xZ($){let Z=i4($).flatMap((X)=>{try{return[{name:X,size:m4(j0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>HZ||Q>MZ){let X=Z.shift();if(!X)break;try{b1(j0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function k1($,J,Z={}){let Q={schema_version:u4,event_id:Z.eventId?.()??t$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!a4(Q))throw new w1("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return w3($.lifecycleEvents),LZ(j0($.lifecycleEvents,PZ(Q)),`${JSON.stringify(Q)}
+`),xZ($),Q}async function n4($,J,Z){EZ($);let Q=0;for(let X of i4($)){let Y=j0($.lifecycleEvents,X);if(Z){let K=x4(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${t$()}`;try{$1(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=x4(G);if(!V){b1(G);continue}try{await J(V),b1(G),Q+=1}catch{try{$1(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function o4($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!bZ($.saved))return J;let Z=$.saved,Q=(G,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...V?{code:`worker_api_origin_move_${G}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?J1():$.native;if(!X)return J;let Y=[];try{let G=X.lock(SZ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let H=t0({path:d(Z).lock,runtimeVersion:r});if(!H.acquired)return J;Y.push(()=>H.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=e4(V),N={saved:V,configPath:$.configPath};if(!D2(V)&&K.length===0)return Q("unchanged"),N;if(D2(V)){let H=r4(V);c($.configPath,H),N={saved:H,configPath:$.configPath}}for(let H of K)try{c(H.configPath,r4(H.config))}catch(B){Q("failed",`workspace:${t4(B)}`)}return Q("moved"),N}catch(G){return Q("failed",t4(G)),J}finally{for(let G of Y.reverse())G()}}function D2($){return O$($.apiOrigin)!==$.apiOrigin}function e4($){return k0($).filter((J)=>J.config!==null&&D2(J.config))}function bZ($){return D2($)||e4($).length>0}function r4($){let J=J0.parse({...$,apiOrigin:O$($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=N0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)y0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:M0(J)});return J}function t4($){if($ instanceof Y0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as wZ,lstatSync as f3,readdirSync as Y8,readlinkSync as kZ,unlinkSync as yZ}from"fs";import{join as D0,sep as fZ}from"path";var O2="rehome.json";class z2 extends Error{code;constructor($){super($);this.code=$}}function G8($){let J={saved:$.saved,configPath:$.configPath},Z=D0($.home,".config"),Q=D0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=D0(Q,...X),G=D0(Z,"reason",...X),V=(B,q)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:B,...q?{code:`worker_state_rehome_${B}:${q}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?J1():$.native,N=$.saved,H=[];try{if(N&&J8(Q)&&N.stateDirectory===Y){let D={...N,stateDirectory:G};if(!k3(K,G,D,H))return J;return $8(N,D,$.host,V)}if(N&&J8(Q)&&N.stateDirectory===G&&U4(N)&&k3(K,G,N,H))return K8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!Z1(Q)?.isDirectory())return J;if(dZ(Y)===r)return J;let q=(D,O=!0)=>{if(O)c(D0(Y,O2),{version:r});return V("skipped",D),J},M=[Y];for(let D of mZ(Q,Y)){if(D.config?.lifetime!=="ephemeral")return q("several_connections");if(!hZ(D.directory,D.config,H))return q("once_running",!1);M.push(D.directory)}if(!K)return q("config_rename_unavailable:no_native");if(!k3(K,Y,N,H))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(Z8(Z)!==null)return q("conflicting_identity");if(Q8(Z)!==null)return q("conflicting_files");if(Z1(G)&&(!Z1(G).isDirectory()||Y8(G).length>0))return q("connection_folder_taken");R1(N,T.devicePublicKey),P3.before(N);let _=u0(Y);if(_&&y3(Y))vZ(G,_);let j=A2(Z,K,M);if(j.state!=="renamed"&&j.state!=="linked"){if(_&&y3(Y))B8(G);return q(j.problem??"config_folder_kept")}return $8(N,{...N,stateDirectory:G},$.host,V)}catch(B){try{if(Z1(Y)?.isDirectory())c(D0(Y,O2),{version:r})}catch{}return V("failed",lZ(B)),uZ(N,Y,G,J)}finally{for(let B of H.reverse())B()}}function $8($,J,Z,Q){let X=f3(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)wZ(J.stateDirectory,448);let Y=M0(J),G=w$(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new z2("identity_missing");let V=N0(J);if(G.worker.configDigest===N0($))y0({...G,worker:{...G.worker,configDigest:V}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==V)throw new z2("worker_config_binding_mismatch");c(D0(J.stateDirectory,"worker.json"),J),P3.after($,J),K8($,J,Z);let K=D0(J.stateDirectory,O2);if(u(K))yZ(K);return Q("moved"),{saved:J,configPath:D0(J.stateDirectory,"worker.json")}}function K8($,J,Z){if(X8($,J,Z,"connect"),!y3(J.stateDirectory))return;let Q=gZ(F$($.stateDirectory));if(!Q)return;let X=F$(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);B8($.stateDirectory)}function k3($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=t0({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function hZ($,J,Z){if(u(g(J))){let X=t0({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=Z1(D0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function mZ($,J){let Z=[$,...Y8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>D0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=D0(X,Y);if(G===J||!Z1(D0(G,"worker.json")))continue;let V=U8(G);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+fZ))Q.push({directory:G,config:V})}return Q}function y3($){try{return JSON.parse(s(D0($,"api-key.json"))).store==="keychain"}catch{return!1}}function vZ($,J){let Z=F$($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function B8($){try{F$($).deleteBinding()}catch(J){if(!(J instanceof Y0))throw J}}function gZ($){try{return $.loadBinding()}catch(J){if(J instanceof Y0)return null;throw J}}function uZ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=U8(Z);return X?.stateDirectory===Z?{saved:X,configPath:D0(Z,"worker.json")}:Q}function J8($){try{return f3($).isSymbolicLink()&&kZ($)==="reason"}catch{return!1}}function dZ($){try{let J=JSON.parse(s(D0($,O2)));return typeof J.version==="string"?J.version:null}catch{return null}}function U8($){try{let J=D0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function Z1($){try{return f3($)}catch{return null}}function lZ($){if($ instanceof z2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof Y0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as pZ}from"fs";function R2($){try{let J=JSON.parse(pZ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function V8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as IK}from"crypto";import{readdirSync as CK,realpathSync as d6,statSync as PK}from"fs";import{hostname as EK}from"os";import{join as s$,resolve as xK}from"path";var I2="cloud",cZ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function y1($){return cZ.test($)&&!N8.test($)}var sZ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Q1($){return sZ[$]}import{chmodSync as aZ,lstatSync as P2,mkdtempSync as iZ,realpathSync as T8,rmdirSync as nZ,rmSync as rZ,unlinkSync as tZ}from"fs";import{createConnection as oZ,createServer as eZ}from"net";import{basename as q8,dirname as H8,join as f$}from"path";var $Q=U.enum(["status","drain","resume","stop","reload_roots"]),JQ=U.strictObject({version:U.literal(1),instanceId:U.string(),deviceId:U.string(),phase:U.enum(["starting","running","reconnecting","stopping"]),drained:U.boolean(),activeClaims:U.number().int().nonnegative(),activeSessions:U.number().int().nonnegative().optional(),executionEligible:U.boolean(),supportedOperations:U.array(U.enum(C2)).max(C2.length).optional(),capabilityReadiness:U.partialRecord(U.enum(C2),U.boolean()).optional(),lastHeartbeat:U.string().nullable(),expiresAt:U.string()}),ZQ=U.strictObject({nonce:U.string(),action:$Q}),QQ=U.object({nonce:U.uuid()}),_8=U.strictObject({version:U.literal(1),nonce:U.uuid(),socketPath:U.string().max(100)});function F8($){return f$(d($).lock,"control.json")}function E2($){return e(d($).lock),QQ.parse(JSON.parse(s(f$(d($).lock,"owner.json"))))}function M8($){if(!u($))return!1;let J=P2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function L8($,J){let Z=F8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!P2(Y).isSocket())return null;return M8(Y)?Y:null}let Q=_8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=H8(Q.socketPath);if(H8(X)!==T8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(q8(X))||q8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),M8(Q.socketPath)?Q.socketPath:null}async function x2($,J,Z){if(E2($).nonce!==J)throw Error("worker_instance_changed");let Q=F8($);if(u(Q))throw Error("worker_control_already_serving");let X=iZ(f$(T8("/tmp"),"ara-worker-")),Y=f$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,V=eZ((B)=>{G.add(B),B.once("close",()=>G.delete(B)),B.setTimeout(2000,()=>B.destroy());let q="",M=!1;B.on("error",()=>B.destroy()),B.on("data",(T)=>{if(M)return;if(q+=T.toString(),Buffer.byteLength(q)>4096){B.destroy();return}if(!q.includes(`
+`))return;M=!0;try{let _=ZQ.parse(JSON.parse(q));if(_.nonce!==J){B.destroy();return}B.end(JSON.stringify(Z(_.action))+`
+`)}catch{B.destroy()}})});V.maxConnections=32;let K,N=!1,H=async()=>{if(N)return;N=!0;for(let B of G)B.destroy();if(await new Promise((B)=>V.close(()=>B())),K&&u(Q)){let B=P2(Q);if(B.isFile()&&B.dev===K.dev&&B.ino===K.ino)try{let q=_8.parse(JSON.parse(s(Q)));if(q.nonce===J&&q.socketPath===Y)tZ(Q)}catch{}}try{nZ(X)}catch{}};try{if(await new Promise((B,q)=>{V.once("error",q),V.listen(Y,()=>{aZ(Y,384),B()})}),E2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=P2(Q),H}catch(B){throw await H(),B}}function j8($,J){try{let Z=JSON.parse(s(f$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function f1($){return j8($,"runtime_version")}function XQ($){return j8($,"nonce")}function W8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(f$(d($).lock,"owner.json")))return"no_lock";return L8($,E2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var YQ=21600000,GQ=U.strictObject({instance:U.string().nullable(),since:U.number().int().nonnegative()});function KQ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=GQ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;h3($)}catch{}return null}function h3($){try{rZ(d($).updateDeferral,{force:!0})}catch{}}async function S2($,J,Z=()=>!1){let Q=XQ($),X=KQ($,Q);if(J!==void 0){let N=f1($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await U0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),V=X;if(V===null){V=G;try{c(d($).updateDeferral,{instance:Q,since:V})}catch{}}let K=G-V;return{state:K<YQ?"busy":"drained",sessions:Y,waitedMs:K}}async function U0($,J){let Z=d($);if(!u(f$(Z.lock,"owner.json")))return null;let Q=E2($),X=L8($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let V=oZ(X),K="",N=!1,H=(B,q)=>{if(N)return;if(N=!0,V.destroy(),q)G(q);else Y(B)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
+`)),V.on("data",(B)=>{if(K+=B.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(B)=>{if("code"in B&&["ECONNREFUSED","ENOENT"].includes(String(B.code)))H(null);else H(null,B.message==="worker_control_timeout"?B:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let B=JQ.parse(JSON.parse(K));if(B.instanceId!==Q.nonce)throw Error("worker_instance_changed");H(B)}catch{H(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>H(null,Error("worker_control_unavailable")))})}import{randomUUID as UG}from"crypto";import{homedir as uJ}from"os";import{spawn as BQ}from"child_process";async function D8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),V=(B)=>{if(Q===B)return;Q=B,J.onStatusChange?.(B)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let B=(J.spawn??BQ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=B,B.once("exit",()=>{if(!X&&Z===B)V("failed"),K()}),await new Promise((q,M)=>{B.once("spawn",q),B.once("error",M)}),B.exitCode===null&&B.signalCode===null)V("held")}catch{V("failed"),K()}};G=N(),await G;let H;return{get status(){return Q},release(){return H??=(async()=>{X=!0,clearTimeout(Y),await G;let B=Z;if(!B||B.exitCode!==null||B.signalCode!==null||!B.pid)return Q="failed","released";let q=await new Promise((M)=>{let T,_=setTimeout(()=>{try{B.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);B.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{B.kill("SIGTERM")}catch{}});if(q==="released")Q="failed";return q})()}}}class X1 extends Error{constructor(){super("Reason Device operation lease expired.")}}class b2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new X1;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new X1;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new X1)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as HQ}from"fs";import{constants as m3}from"fs";import{open as UQ}from"fs/promises";import{join as VQ}from"path";var NQ={platform:process.platform,home:B0,async openFile($){let J=await UQ($,m3.O_RDONLY|m3.O_NOFOLLOW|m3.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function O8($=NQ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(VQ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class v3 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function qQ($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new v3;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function z8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await qQ($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof v3||(X instanceof T0?h1(X.status):m1(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function t3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var MQ=1000,TQ=250,_Q=g8(HQ(process.execPath)),A8=null,R8=null;function u8($){if(process.platform!=="darwin")return{};return R8??=O8().then((J)=>{A8={status:J,checkedAt:$().getTime()}}).finally(()=>{R8=null}),{fullDiskAccess:{...A8??{status:"unknown",checkedAt:$().getTime()},executablePath:_Q}}}var I8=8,FQ=2000,LQ=2000,o3=8000,C8=3,jQ=250,P8=1000,E8=30000,WQ=0.2,DQ=30000,OQ=21600000,zQ=300000,AQ=3600000,RQ=0.1,d8=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function IQ($){return Math.min(C8,Math.max(1,$??C8))}function CQ($){return typeof $.reason_code==="string"&&d8.has($.reason_code)?$.reason_code:"cancelled"}function g3($){return $.reason instanceof f0&&($.reason.code==="cancelled"||d8.has($.reason.code))?$.reason.code:"cancelled"}function x8($){return $ instanceof f0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function l8($){return $.capability==="hands.connect"&&(h8($.payload)||f8($.payload))}function u3($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*RQ)))}function PQ($,J=Math.random){let Z=Math.min(E8,P8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*WQ*(Q*2-1);return Math.min(E8,Math.max(P8,Math.round(Z+X)))}function e3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class d3 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function EQ($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function l3($){return $ instanceof Error?$.message:String($)}function p3($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function s0($){return $ instanceof T0&&$.status===409&&$.code==="attempt_fenced"}function c3($){return $.capability==="environment.install"}function xQ($){if($ instanceof k2||$ instanceof X1||$ instanceof g1)return"timeout";if(!($ instanceof Error)||$ instanceof T0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof T0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function v1($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(s0(Z))return;let Q=Z instanceof T0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:xQ(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function Y1($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)v1($,J,Q);throw Q}}class g1 extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function s3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":w8(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:c3(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??e3,K=$.operationCompletionTimeoutMs??o3,N=performance.now()+K,H,B,q=new Promise((_,j)=>{let D=()=>{let F=new g1;Y.abort(F),j(F)},O=(F)=>{clearTimeout(H),H=setTimeout(D,F)};if(B=()=>O(Math.max(0,Math.min(N-performance.now(),FQ))),O(K),$.signal.addEventListener("abort",B,{once:!0}),$.signal.aborted)B()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),q]);break}catch(_){if(G.aborted||$.signal.aborted||P0(_)||s0(_)||!SQ(_)||performance.now()>=N)throw v1($,"completion",_),_;T+=1;let j=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(j<=0)throw v1($,"completion",_),_;try{await V(j,G)}catch{throw v1($,"completion",_),_}}}finally{clearTimeout(H),$.signal.removeEventListener("abort",B),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function SQ($){if(P0($))return!1;if(s0($))return!1;if($ instanceof T0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof g1)return!1;return!0}return!1}class k2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function w2($){if($ instanceof k2)return!0;return $ instanceof T0?h1($.status):m1($)}function a3($,J){if(!($ instanceof T0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function bQ($,J,Z,Q,X){let Y=new AbortController,G,V=()=>{return},K=new Promise((H,B)=>{let q=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),B(M)};if(V=()=>Q.removeEventListener("abort",q),Q.aborted)q();else Q.addEventListener("abort",q,{once:!0})}),N=new Promise((H,B)=>{G=setTimeout(()=>{let q=new k2;Y.abort(q),B(q)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);V()}}async function S8($,J,Z,Q,X,Y){let G=IQ($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??o3,K=$.operationHeartbeatRetryDelayMs??jQ,N=Y.remainingMs(),H=Math.min(N,G*V+K*G*(G-1)/2);for(let B=0;B<G;B+=1)try{Q.throwIfAborted(),Y.assertCurrent();let q=Math.min(V,Y.remainingMs()),M=await bQ($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(q-1000))),clientRetryCount:B},Q,q);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(q){if(Q.aborted||B+1>=G||s0(q)||P0(q)||!w2(q)){if(!Q.aborted)v1($,"operation_heartbeat",q);throw q}let M=N-Y.remainingMs(),T=a3(q,($.now?.()??new Date).getTime()),_=Math.max(K*(B+1),H*(B+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function wQ($,J,Z,Q,X){let Y=l8(J),G=new AbortController,V=new AbortController,K=()=>{G.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,H,B,q=-1,M=0,T=Promise.resolve(),_=[],j=new AbortController,D=!1,O,F=null,z=!1,L,W,R={},E=(S)=>{D=!0,j.abort(S),G.abort(S),V.abort(S)},I=(S)=>{if(O)return O;let y=structuredClone(S),l=M;return O=(async()=>{let k=new AbortController,P=k.signal;P.throwIfAborted();let x,A=()=>{},w=new Promise((b,n)=>{if(A=()=>n(P.reason),P.addEventListener("abort",A,{once:!0}),x=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),P.aborted)A()});try{for(let b=0;b<3;b+=1){P.throwIfAborted();try{let n=await Promise.race([Y1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[y],signal:P,transientRetryOwner:"caller"})),w]);if(P.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(P0(n))X(n);let o=n instanceof T0?h1(n.status):m1(n);if(P.aborted||!o||b===2)throw n;let V0=Math.max(500*2**b,a3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(V0,P),w])}}}finally{clearTimeout(x),P.removeEventListener("abort",A),k.abort()}})(),O},C=(S,y,l)=>{let k=(x)=>Y1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:y,events:S,signal:x,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&s0(A))E(A);if(l&&(P0(A)||s0(A))){if(P0(A))X(A);G.abort(A),V.abort(A),j.abort(A)}throw A});if(!l)return async(x)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(x)).next_event_seq;return}x.throwIfAborted();let A=()=>{},w=new Promise((b,n)=>{A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([k(x),w]);x.throwIfAborted(),M=b.next_event_seq}finally{x.removeEventListener("abort",A)}};let P=z8({send:k,lease:W,sleep:Z,retryAfterMs:(x)=>a3(x,($.now?.()??new Date).getTime())});return async(x)=>{let A=await P(x);if(A.next_event_seq!==y+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,y)=>{let l=S??await S8($,J,{controlAckSeq:q,waitMs:y},V.signal,Z,W),k=null,P=!1;for(let x=0;x<10;x+=1){let A=q+1;for(let w of l.controls){if(w.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(w.kind==="cancel"||w.kind==="operation.cancel")k??=CQ(w.payload),G.abort(new f0(k,"Reason closed the Device operation."));if(w.kind!=="cancel"&&w.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,o=new Promise((V0,W0)=>{b=V0,n=W0});o.catch(()=>{}),R.current={promise:o,resolve:b,reject:n}}try{P||=!await $.onControl?.(J,w)}catch(b){if(b instanceof f0)H??=x8(b);throw R.current?.reject(b),b}}q=w.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==q+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:P}}try{l=await S8($,J,{controlAckSeq:q},V.signal,Z,W),R.current?.resolve()}catch(w){if(R.current?.reject(w),!k||s0(w)||P0(w))throw w;return{cancellationReason:k,unsupported:P}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)W=new b2(J.lease_until,()=>($.now?.()??new Date).getTime(),(y)=>{if(!G.signal.aborted)N=y;G.abort(y),V.abort(y)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||i3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(y){if(!c3(J)||s0(y)||P0(y))throw y;await s3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let y=S.cancellationReason??g3($.signal);G.abort(new f0(y,"Reason closed the Device operation.")),B={status:"cancelled",error_code:y}}else if(S.unsupported)G.abort(),B={status:"failed",error_code:"control_unsupported"};else{let y=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?LQ:15000),P=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??o3)-1000)),x=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!x){if(await Z(k,V.signal),V.signal.aborted)return}let A=await h(void 0,x?P:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new f0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(P0(A))X(A);if(s0(A))N=A,E(A);if(!V.signal.aborted)N=A,G.abort();return}})();try{if(W?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(W?.remainingMs()??0)>0),B=await $.onClaim(J,G.signal,async(k)=>{if(c3(J))return;let P=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",x=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=x||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,j.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,j.signal]):$.signal,w={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:x?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(i3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,V0)=>{_.push({wireEvent:w,settle:(W0)=>W0===void 0?o():V0(W0)})});let b=_;_=[];let n=T.then(async()=>{if((D||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(P)await I(w);return}if(F!==null){if(k.kind!=="hands.stopped"||!z||!L)throw F;let V0=new AbortController,W0=AbortSignal.any([$.signal,j.signal,V0.signal]),H$=setTimeout(()=>V0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);z=!1;try{await L(W0),L=void 0,await C([w],M,!0)(W0),F=null}catch(M$){throw F=M$??Error("Hands stop receipt could not be confirmed."),M$}finally{clearTimeout(H$),V0.abort()}return}if(x&&!W){let V0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));W=new b2(new Date(V0).toISOString(),()=>($.now?.()??new Date).getTime(),(W0)=>{G.abort(W0),V.abort(W0)})}let o=M;if(x)L=C([...b.map((V0)=>V0.wireEvent),w],o,!0),await L(A),L=void 0;else await C([...b.map((V0)=>V0.wireEvent),w],o,!1)(A)});n.then(()=>{for(let o of b)o.settle()},(o)=>{for(let V0 of b)V0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(P0(o))X(o);if(x){if(F===null)z=A.aborted&&!j.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),V.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(k){B=G.signal.aborted?{status:"cancelled",error_code:g3(G.signal)}:{status:"failed",error_code:x8(k)}}finally{Q.authorized=()=>!1,j.abort();for(let k of _.splice(0))k.settle();V.abort(),await y}let l=k8(J.capability)?y8(B.result,J.operation_id):null;if(N){if(P0(N))throw N;B={status:"failed",error_code:H??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&B.status==="succeeded")B={status:"cancelled",error_code:g3(G.signal),...l?{result:l}:{}}}if(W?.close(),P0($.signal.reason))throw $.signal.reason;await s3($,J,B)}finally{W?.close(),j.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function $9($){let J=$.now??(()=>new Date),Z=$.sleep??e3,Q=$.saveStatus??r3,X=$.loadStatus??E1,Y=$.statusPath??n3(),G=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...u8(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),H=0,B,q=!1,M,T,_,j=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),v8();try{let D=async()=>{let O=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||O===T)return;if(M&&T){let L=await M.release();if($.onEvent?.({type:"idle_sleep",status:L,policy:T}),L==="failed")return;M=void 0,T=void 0,K=!1;let W=X(Y);if(W)Q({...W,idleSleepHold:K},Y)}if(!O)return;T=O;let F=!0;M=await($.acquireAwakeHold??D8)(O,{onStatusChange:(L)=>{if(F)return;K=L==="held";let W=X(Y);if(W)Q({...W,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:L,policy:O})}}),F=!1,K=M.status==="held";let z=X(Y);if(z)Q({...z,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:O})};if(await D(),$.readIdleSleepPolicy)_=setInterval(()=>{j=j.then(D).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let O=!1;try{await kQ({...$,saveStatus:(F,z)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},z)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&H>0&&!O){O=!0;let z=H;H=0,B=void 0,$.onEvent?.({type:"reconnected",attempts:z})}$.onEvent?.(F)}});return}catch(F){if(p3(F,$.signal))return;if(P0(F)){q=!0;let L=$.state.worker?"worker_connection_failed":l3(F);throw Q({...N(),state:"error",error:L},Y),$.onEvent?.({type:"error",message:L}),F}H+=1;let z=PQ(H,$.reconnectRandom);B??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:B},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":l3(F),attempt:H,retryInMs:z}),await Z(z,$.signal)}}}catch(D){if(!p3(D,$.signal))throw D}finally{if($.client.close?.(),clearInterval(_),await j,M&&T){let D=await M.release();K=D==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:D,policy:T})}if(!q)Q({...N(),state:"stopped"},Y);else{let D=X(Y);if(D)Q({...D,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function kQ($){let J=$.now??(()=>new Date),Z=$.sleep??e3,Q=$.statusPath??n3(),X=$.saveStatus??r3,Y=$.loadStatus??E1,G=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,H=()=>N.abort($.signal.reason);if($.signal.aborted)H();else $.signal.addEventListener("abort",H,{once:!0});let B=K?.random??Math.random,q=$.maxConcurrentClaims,M=typeof q==="number"&&Number.isSafeInteger(q)&&q>0?Math.min(I8,q):I8,T=0,_=!1,j=null,D=(v)=>{j??=v,N.abort(v)},O=new Map,F=()=>{let v=new Set,X0=0;for(let{claim:x$}of O.values()){let Y$=x$.capability==="hands.connect"?x$.payload[b8]:void 0;if(typeof Y$==="string"){if(v.has(Y$))continue;v.add(Y$)}X0+=1}return X0},z=null,L=()=>[...O.values()].some((v)=>v.authorized()),W=()=>[...O.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(G).getTime()+u3(K.initialDelayMs??DQ,B):Number.POSITIVE_INFINITY,E=null,I=!1,C=$.firstHeartbeat,h=C?.account_root_metadata_supported===!0,S=C?.workspace_root_metadata_supported===!0,y=C?.account_root_path_supported===!0,l=C?.home_contained_roots_supported===!0,k=C?.root_paths_supported===!0,P=C?.startup_supported===!0,x=C!==void 0,A=C?{challenge:C.challenge,expires_at:C.expires_at}:void 0,w,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...u8(J),...V?{lastUsedAt:V}:{},...E?{organizationId:E.organization_id,organizationName:E.organization_name,organizationSlug:E.organization_slug}:{}}),o=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!b)w??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...P&&!b&&w?{startup:w}:{},capabilities:v?m8($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:y,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},V0=()=>{if(I||!$.client.identity)return;I=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;E=v;let X0=Y(Q);if(!X0)return;X({...X0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},W0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,y=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,P=v.startup_supported===!0,x=!1},H$=(v)=>{if(v.startup)b=!0},M$=(v,X0)=>{if(!(X0 instanceof T0&&X0.status===400&&X0.code==="invalid_heartbeat")||!v.startup&&!x)throw X0;if(b=!0,x)h=S=y=!1,l=k=P=x=!1;return null},j1=(v)=>{W0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),V0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},P$=!1,a$=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(P$)a$=!0;let v=o();Y1($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((X0)=>M$(v,X0))).then((X0)=>{if(!X0)return;H$(v),W0(X0),j1(X0)},()=>{return})});let T$=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let Q$=!1,E$=$.maxConsecutiveHeartbeatFailures??3,X$=0;try{while(!$.signal.aborted){if(j)throw j;if(_&&W())break;let v,X0=o(),x$=A;A=void 0,P$=!0,a$=!1;try{let i=await Y1($,"heartbeat",()=>$.client.heartbeat($.state,X0,N.signal,...x$?[x$]:[]).catch((K0)=>M$(X0,K0)));if(P$=!1,!i)continue;v=i,H$(X0),X$=0}catch(i){if(P$=!1,$.signal.aborted)break;if(!w2(i))throw i;if(X$+=1,X$>=E$&&!L())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(W0(v),Object.keys(o().capabilities).length>Object.keys(X0.capabilities).length)continue;if(a$)continue;if(j1(v),j)throw j;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let i=new AbortController,K0=()=>i.abort($.signal.reason);if($.signal.aborted)K0();else $.signal.addEventListener("abort",K0,{once:!0});let z0;try{z0=K.check(i.signal)}catch(A0){z0=Promise.reject(A0)}let G$=z0.then((A0)=>({kind:"completed",result:A0}),(A0)=>({kind:"failed",error:A0})),i$;try{while(!0){let A0=await EQ(G$,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(A0.kind==="failed")throw new d3(A0.error);if(A0.kind==="completed"){i$=A0.result;break}try{let E0=o(),D1=await Y1($,"heartbeat",()=>$.client.heartbeat($.state,E0,N.signal).catch((Y2)=>M$(E0,Y2)));if(!D1)continue;v=D1,H$(E0),j1(v),X$=0}catch(E0){if($.signal.aborted)throw E0;if(!w2(E0))throw E0;if(X$+=1,X$>=E$&&!L())throw E0}}}catch(A0){i.abort(A0);let E0=await G$;if(E0.kind==="completed"&&E0.result==="activated")i$="activated";else throw A0}finally{$.signal.removeEventListener("abort",K0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,i$==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+u3(K.intervalMs??OQ,B)}catch(i){if(!(i instanceof d3))throw i;T+=1;let K0=K.retryBaseMs??zQ,z0=K.retryMaxMs??AQ,G$=Math.min(z0,K0*2**Math.min(T-1,8));R=J().getTime()+u3(G$,B)}if($.signal.aborted)break;if(_&&W())break;if(_){await T$($.heartbeatIntervalMs??15000);continue}let Y$=$.client.sessionCadence?.($.state)??null,S$=Y$?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await T$(S$);continue}if(F()>=M){let i=new AbortController;z=i;try{await Z(S$,AbortSignal.any([$.signal,i.signal]))}catch(K0){if(!i.signal.aborted)throw K0}finally{if(z===i)z=null}continue}let h0,W1=Y$?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),f=performance.now();try{h0=await Y1($,"claim",()=>$.client.claimOperation($.state,{waitMs:W1,signal:N.signal}))}catch(i){if($.signal.aborted||!w2(i)||!L())throw i;await T$(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(j)throw j;if(!h0){if(performance.now()-f<W1-TQ)await T$(MQ);continue}if($.claimable?.()===!1){await s3($,h0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:h0.operation_id,runId:h0.run_id,attemptId:h0.attempt_id,capability:h0.capability});let a,q0={authorized:()=>!1,claim:h0};if(a=wQ({...$,signal:N.signal},h0,Z,q0,D).catch((i)=>{if(P0(i))D(i);else if(!s0(i)&&[...O].some(([K0,z0])=>K0!==a&&z0.authorized())){if(i instanceof g1)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!s0(i)&&j===null)j=i}).finally(()=>{O.delete(a),z?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:O.size})}),O.set(a,q0),$.onEvent?.({type:"claims_changed",activeClaims:O.size}),l8(h0)){if(await a,j)throw j}}}catch(v){if(!p3(v,$.signal)){N.abort(v),Q$=!0;let X0=$.state.worker?"worker_connection_failed":l3(v);throw X({...n(),state:"error",error:X0},Q),$.onEvent?.({type:"error",message:X0}),v}}finally{if(N.abort(),await Promise.allSettled(O.keys()),$.signal.removeEventListener("abort",H),!Q$)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as NX}from"child_process";import{constants as T5,existsSync as qX,mkdtempSync as I5,rmSync as HX}from"fs";import{access as _5,open as MX,readFile as F5,readlink as TX,readdir as L5,unlink as _X,rmdir as FX}from"fs/promises";import{basename as X9,join as G9}from"path";import{randomUUID as h$}from"crypto";import{chmodSync as yQ,closeSync as fQ,fsyncSync as hQ,openSync as mQ,readFileSync as vQ,rmdirSync as p8,unlinkSync as a8,writeFileSync as gQ}from"fs";import{createConnection as uQ,createServer as dQ}from"net";import{dirname as lQ,join as pQ}from"path";var cQ=5000;async function i8($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:h$()},X={runId:h$(),deviceId:h$(),rootId:h$(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=s8(J,X),G={version:1,snapshot_id:h$(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{a8(Y.path)}catch{}}}async function n8($,J,Z=c8){if(J.aborted)return!1;let Q,X,Y=new Set,G=h$(),V=dQ((q)=>{Y.add(q),q.once("close",()=>Y.delete(q)),q.on("error",()=>q.destroy()),q.end(G)});V.maxConnections=1;let K,N,H=new Promise((q)=>{N=()=>q(!1)}),B=setTimeout(N,cQ);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${h$()}`}),X=pQ(Q.journalDirectory,"readiness.json");let q=mQ(X,"wx",384);try{gQ(q,G),hQ(q)}finally{fQ(q)}if(vQ(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{yQ(Q.socketPath,384)}catch{T(!1);return}K=uQ(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(j)=>{if(_+=j,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,H])&&!J.aborted}catch{return!1}finally{clearTimeout(B),J.removeEventListener("abort",N),K?.destroy();for(let q of Y)q.destroy();if(await new Promise((q)=>V.close(()=>q())),Q?.disposeSocket(),X)try{a8(X)}catch{}if(Q){try{p8(Q.journalDirectory)}catch{}try{p8(lQ(Q.journalDirectory))}catch{}}}}import{spawn as sQ}from"child_process";import{randomUUID as m$}from"crypto";import{basename as aQ}from"path";import{fileURLToPath as iQ}from"url";function nQ(){let $=aQ(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",iQ(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function o8($,J,Z=nQ()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=sQ(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>G.once("close",()=>{V=!0,F()}));G.on("error",X);let N,H,B=new Promise((F)=>{N=F}),q=new Promise((F)=>{H=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,j=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
 `)){let z=T.indexOf(`
-`),L=T.slice(0,z);T=T.slice(z+1);try{if(!j){let W=JSON.parse(L);if(!W||Object.keys(W).length!==2||!Number.isInteger(W.port)||W.port<1024||W.port>65535||typeof W.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(W.token))throw Error("probe_receipt_invalid");j=!0,N({port:W.port,token:W.token})}else if(L==="ready")H(!0);else X()}catch{X()}}}),K.then(X);let D,O=!1;try{let F=await Promise.race([B,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let z=Date.now()+4500,L=m$(),W={organizationId:m$(),userId:m$(),runId:m$(),deviceId:m$(),rootId:m$(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:m$(),port:F.port,expiresAtMs:z},R={binding:W,executorLaunchId:L,job:{jobId:W.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:z,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:L}}},E=t8({binding:W,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});D=await r8({binding:W,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:E,signal:Q.signal}),O=await Promise.race([q,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{O=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),D?.close(),Q.abort(),G.stdin.destroy(),!V)G.kill("SIGKILL");await K}return O&&V}import{execFileSync as f2}from"child_process";import{randomUUID as d0}from"crypto";import{chmodSync as e8,chownSync as q5,closeSync as J9,constants as U$,existsSync as nQ,fstatSync as H5,mkdirSync as $5,mkdtempSync as rQ,openSync as Z9,readFileSync as tQ,readSync as oQ,realpathSync as eQ,rmdirSync as $X,rmSync as JX}from"fs";import{join as v$}from"path";import{fileURLToPath as ZX}from"url";var J5=1e4,QX=!1;function h2(){if(process.platform!=="linux")return!1;return QX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=f2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var XX=Buffer.from([0,255,3,4]);function Z5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function YX($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function u1($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=y2(),{directory:Q,root:X,runtimeDirectory:Y}=BX(Z),G=new AbortController,V=()=>G.abort();$.addEventListener("abort",V,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,J5),H={organization_id:d0(),user_id:d0(),device_id:d0()},B=d0(),q=d0(),M=d0(),T=d0(),_=Date.now()+J5,j={kind:"workspace_source",target_revision:0,root_grant_revision:1},D=d0().replaceAll("-",""),O,F=Buffer.alloc(0),z,L=!1,W=!1,R=!1,E=!1,I,C,h,S=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},y=!1;try{K=GX(Q,Z),I=Bun.serve({hostname:"127.0.0.1",port:0,fetch(P,x){let A=new URL(P.url).pathname,w=A===`/device/hands/${D}`?"hands":A===`/device/pty/${D}`?"pty":null;if(w&&x.upgrade(P,{data:{lane:w}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(P){if(P.data.lane==="pty")O=P},message(P,x){if(P.data.lane!=="pty")return;if(typeof x==="string"){try{if(JSON.parse(x).t==="open")L=!0}catch{V()}return}if(F.length+x.length>8192){V();return}F=Buffer.concat([F,x])}}});let l=`ws://127.0.0.1:${I.port}`;if(C=Q9({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:B,operationId:d0(),attemptId:d0(),claimOwner:H,deviceIdentity:{deviceId:H.device_id,rootId:q,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${D}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:Q5,hands_worker_version:G5,hands_worker_artifact_sha256:B5,hands_worker_entrypoint:K5,target_generation:1,target_fence_id:M,environment_binding:j,[U5]:V5},emitEvent:async(P)=>{if(P==="hands.started")E=!0;if(P==="hands.ready")W=!0;if(P==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:N5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:ZX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!W)V()}),await S(()=>W),X5({root:X,runId:B,payload:{version:1,snapshot_id:T,revision:1,run_id:B,root_id:q,device_id:H.device_id,binding:{...j,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:D},git:null}}),h=Y5({root:X,runId:B,rootId:q,deviceId:H.device_id,owner:H,workspace:{kind:"root"},authority:{device_id:H.device_id,binding:j.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${d0()}`,sessionId:"pty-readiness",operationId:d0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${D}`},emit:async(P,x)=>{if(P==="pty.ready")z=x}}).catch(()=>{V()}),await S(()=>Boolean(z&&O&&L)),O.send(JSON.stringify({t:"resize",cols:100,rows:30})),O.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${D}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${Z5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${Z5("foreground")}; ${K.wait("foreground")}'
-`)),await S(()=>nQ(v$(X,"foreground.pid"))&&F.includes(XX)),!F.includes("30 100")||z.job.environmentSnapshotId!==T||z.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((P)=>KX(v$(X,P)));if(new Set(k).size!==2||k.some((P)=>!Number.isSafeInteger(P)||P<2||P===z.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((P)=>YX(tQ(`/proc/${P}/stat`,"utf8"),P,z.job.process.pid)))return!1}else{let x=f2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((A)=>A.trim().split(/\s+/).map(Number));if(x.length!==2||new Set(x.map(([A])=>A)).size!==2||x.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(O.send(JSON.stringify({t:"close"})),await h,G.signal.aborted)return!1;for(let P of[z.job.process.pid,...k])try{return process.kill(P,0),!1}catch(x){if(!(x instanceof Error&&("code"in x)&&x.code==="ESRCH"))return!1}y=!0}catch{y=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await C,await I?.stop(!0),!E||R)UX({directory:Q,root:X},Z)}return y&&R&&!$.aborted}function GX($,J){let Z={foreground:v$($,"foreground.lifeline"),background:v$($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");f2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))J9(Y)};try{for(let Y of Object.values(Z)){let G=Z9(Y,U$.O_RDONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW);try{if(Q.push(Z9(Y,U$.O_WRONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW)),!H5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{J9(G)}if(J)q5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function M5($=(J)=>u1(J)){let J=new AbortController,Z=JSON.stringify(y2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(y2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function KX($){let J;try{J=Z9($,U$.O_RDONLY|U$.O_NOFOLLOW|U$.O_NONBLOCK)}catch{return Number.NaN}try{let Z=H5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=oQ(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{J9(J)}}function BX($,J=eQ("/tmp")){let Z=rQ(v$(J,"reason-pty-probe-")),Q=v$(Z,"workspace"),X=v$(Z,"private");if($5(Q,{mode:448}),$5(X,{mode:448}),$)e8(Z,493),e8(Q,493),q5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function UX($,J){if(J)try{f2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),$X($.root)}catch{return}JX($.directory,{recursive:!0,force:!0})}var C5=5000,g$="ARA_WORKER_PROBE_READY";function FX($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{VX($,J,{cwd:Z,env:Q,signal:X,timeout:C5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,V)=>Y(!G&&!X.aborted&&V===g$))})}function LX($,J){if(X9($)==="bash")return["--noprofile","--norc","-c",J];if(X9($)==="zsh"||X9($)==="sh")return["-f","-c",J];return null}function jX($,J){let Z=W5({home:J,temporaryDirectory:J}),Q=(Y,G,V)=>FX(Y,G,$.workspaceRoot,Z,V),X=async(Y,G,V,K=(H)=>H===g$,N=!1)=>{let H=await S5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:C5,signal:V});return!V.aborted&&!H.timedOut&&!H.truncated&&H.exitCode===0&&K(H.stdout)};return{workspaceRead:async(Y)=>{return await _5($.workspaceRoot,T5.R_OK),await L5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await _5($.workspaceRoot,T5.W_OK),Y.aborted)return!1;let G=I5(G9($.workspaceRoot,".ara-worker-probe-")),V=G9(G,"receipt");try{let K=await HX(V,"wx",384);try{await K.writeFile(g$),await K.sync()}finally{await K.close()}return await F5(V,"utf8")===g$&&!Y.aborted}finally{await TX(V).catch(()=>{}),await _X(G).catch(()=>{})}},confinedShell:(Y)=>X(x5(),["-c",`printf ${g$}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
-`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,V,K]=await Promise.all([MX("/proc/self/cwd"),L5("/proc/self/fd"),F5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${g$}`],Y),jobs:(Y)=>n8($,Y),environment:(Y)=>i8($,J,Y),preview:(Y)=>o8(J,Y),boundPty:(Y)=>u1(Y),desktopDisplay:()=>E5(),desktopAutomation:async()=>{let Y=B9();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
-`);return R5()},desktopBrowser:async()=>l1()?.features.browser===!0,fullControlShell:(Y)=>{let G=z5(),V=LX(G,`printf ${g$}`);return V?Q(G,V,Y):Promise.resolve(!1)}}}function B9(){return process.platform==="darwin"&&l1()?.features.computer===!0?A5():null}var U9=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function WX($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=K9()){return d1($,J,Z,Q,X).final}function d1($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=K9(),Y,G){let V,K;try{if(K$($),v0(),!J)e(g($),!0),V=I5(G9(g($),"probe-")),J=jX($,V);K=J}catch(O){let F=Promise.reject(O);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(O,F)=>{if(Z.aborted||!F&&!K[O])return!1;let z,L=new Promise((W)=>{z=()=>W(!1)});Z.addEventListener("abort",z,{once:!0});try{return await Promise.race([F??K[O](Z),L])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",z)}},H=$.executionMode==="host",B=H?N("boundPty",Y):Promise.resolve(!1),q=Promise.resolve(G).then(()=>Promise.all(H?[N("preview"),B,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[O,F,z,L,W,R,E,I,C]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...H?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(H&&(!R||!E||!I)&&!G)await q;if(H){if(!R)R=await N("bash");if(!E)E=await N("jobs");if(!I)I=await N("environment")}return{read:O,write:F,shell:z,git:L,processes:W,bash:R,jobs:E,environment:I,full:C}})(),T=(O,F)=>{let{read:z,write:L,shell:W,git:R,processes:E,bash:I,jobs:C,environment:h,full:S}=O,{preview:y,boundPty:l,desktopDisplay:k,desktopAutomation:P,desktopBrowser:x}=F,A=D5(),w=H&&process.platform==="darwin"&&S&&NX("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":z,"fs.write":L,"inference.custom.v1":H&&z,"fs.export":z&&A,"fs.import":L&&A,"exec.run":W&&X,"git.run":W&&R&&X,"process.list":(process.platform==="linux"||W)&&E,"ports.list":(process.platform==="linux"||W)&&E,"exec.full":I&&S&&X,"hands.connect":z&&L&&I&&C,"jobs.control":z&&L&&I&&C,"pty.start":z&&L&&I&&C&&h&&l,"environment.install":z&&L&&I&&C&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&z&&L&&I&&C&&h,"tunnel.open":z&&L&&I&&C&&h&&y,"tunnel.close":z&&L&&I&&C&&h&&y,"preview.serve.v1":z&&I&&C&&y&&S,"display.stream.v1":k,"automation.call.v1":P,"simulator.call.v1":w,"simulator.stream.v1":w,"browser.pr-proof.v1":P&&x&&j5()===null,"workspace.setup.v1":H&&O5()})},_=M.then(async(O)=>T(O,{preview:!1,boundPty:await Promise.race([B,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),j=(async()=>{try{let O=await M,[F,z,L,W,R]=await q;if(H&&!z&&O.read&&O.write&&O.bash&&O.jobs&&O.environment)z=await N("boundPty");return T(O,{preview:F,boundPty:z,desktopDisplay:L,desktopAutomation:W,desktopBrowser:R})}finally{if(V)qX(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let D=(async()=>{let O=await M;if(!(O.read&&O.write&&O.bash&&O.jobs&&O.environment))return!1;return await B||(await j)["pty.start"]===!0})();return D.catch(()=>{}),{initial:_,final:j,pty:D}}var DX=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],OX=[60000,300000,900000];function Y9($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return DX.filter((Z)=>J[Z]!==!0)}function P5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>WX($.config,void 0,Y,$.permissions)),Q=$.readiness,X=Y9($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
-`),(async()=>{for(let Y of $.delaysMs??OX){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=Y9($.config,Q).filter((K)=>G[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
-`),$.onReady(Q,V);if(Y9($.config,Q).length===0)return}})()}import{execFile as jY}from"child_process";import{createHash as WY,randomUUID as R9}from"crypto";import{lstat as DY,readdir as MJ,readFile as DJ,realpath as OY,stat as zY}from"fs/promises";import{basename as AY,join as z9}from"path";import{promisify as RY}from"util";import{createConnection as zX}from"net";import{endianness as k5}from"os";var p1=4,V9=1e4;class z${socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=zX(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=AX({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let H=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:H})});return Z.write(G),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=p1){let J=k5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=p1+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(p1,Z);this.#$=this.#$.subarray(Z),this.#K(JSON.parse(Q.toString("utf8")))}}#K($){if(!a0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),a0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class m2{client;cdp;constructor($){this.client="client"in $?$.client:new z$($),this.cdp=new h5(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=RX(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new y5(this,$)}getTabs(){return this.client.getTabs()}}class y5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new f5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class f5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class h5{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(a0(Q)&&a0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return a0(Q)&&a0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";b5(Q);let X=Z.timeoutMs??V9;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(a0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if(w5(K,Q))return;throw V}),G}async waitForLoadState($,J={}){let Z=J.state??"load";b5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(w5(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??V9)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return a0(J)?{href:N9(J.href),readyState:N9(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??V9;return new Promise((X,Y)=>{let G=!1,V=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((H)=>{try{if(J(H)){if(N())X(H)}}catch(B){if(N())Y(B instanceof Error?B:Error(String(B)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=IX(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function AX($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(p1+J.length);if(k5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,p1),Z}function a0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function RX($,J){if(!a0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function b5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function w5($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function IX($,J){if($.method!=="onCDPEvent"||!a0($.params))return null;let Z=$.params.source;if(!a0(Z)||Z.tabId!==J)return null;return{method:N9($.params.method)}}function N9($){return typeof $==="string"?$:void 0}import{createHash as CX}from"crypto";function m5($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${CX("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as _Y}from"async_hooks";import{isDeepStrictEqual as qJ}from"util";import{createHash as FY}from"crypto";var PX=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var EX=new Set(["png","jpg","jpeg","gif","webp"]),xX=new Set(["webm","mp4"]);function SX($){if(!$)return null;try{return new URL($).origin}catch{return null}}function v5($,J){let Z;try{Z=new URL($)}catch{return null}let Q=SX(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=PX.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!V||!K||!N)return null;let H=EX.has(N)?"image":xX.has(N)?"video":null;if(!H)return null;let B=/^(before|after)[\s:_-]+/.exec(K),q=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:q,runId:G,artifactId:V,fileName:`${K}.${N}`,kind:H,phase:B?.[1]==="before"||B?.[1]==="after"?B[1]:null}}var bX=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,v2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),u$=()=>{throw Error("cloud_browser_media_request_invalid")};function g2($){if(!v2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!bX.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return u$();let J;try{J=new URL($.configuredMediaOrigin)}catch{return u$()}if(J.protocol!=="https:"||J.username||J.password||J.port||!g5(J.origin,{mode:"public_web"}).allowed)return u$();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!v2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return u$();let G=v5(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return u$();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return u$()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return u$()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function u5($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!v2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!v2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var H9="browser.pr-proof.v1",L0=U.string().uuid(),G1=U.string().regex(/^[a-f0-9]{64}$/),l$=U.iso.datetime({precision:3}),q9=U.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),l5=U.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),l0=U.object({kind:U.literal("primary_mac"),version:U.literal(1),organizationId:q9,userId:q9,sessionId:q9,runId:L0,deviceId:L0,rootId:L0,rootRevision:U.string().min(1).max(64),binding:U.enum(["workspace_source","mcp_control"]),targetRevision:U.number().int().nonnegative(),generation:L0,profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:U.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),wX=U.custom().transform(($,J)=>{try{return d5($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),U.NEVER}}),K1=U.object({version:U.literal(1),owner:l0,contextId:L0,preparedAt:l$,expiresAt:l$,prUrl:l5,headSha:U.string().regex(/^[a-f0-9]{40}$/),skillDigest:G1,evidenceKind:U.enum(["image","video"]),visualPlan:wX.optional(),uploadOrigin:U.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),M9=U.object({version:U.literal(1),producer:U.literal("primary_mac"),context:K1,captureId:L0,operationId:L0,attemptId:L0,tabId:U.number().int().positive(),startedAt:l$,finishedAt:l$,sha256:G1,media:U.discriminatedUnion("contentType",[U.object({contentType:U.literal("image/png"),sizeBytes:U.number().int().min(24).max(8388608),width:U.number().int().min(1).max(4096),height:U.number().int().min(1).max(4096)}).strict(),U.object({contentType:U.literal("video/webm"),sizeBytes:U.number().int().min(128).max(10485760),durationSeconds:U.number().min(0.05).max(15),frameCount:U.number().int().min(1).max(450),receivedFrameCount:U.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),uq=U.discriminatedUnion("action",[U.object({action:U.literal("screenshot"),context_id:L0,tab_id:U.number().int().positive()}).strict(),U.object({action:U.literal("start_video"),context_id:L0,tab_id:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),U.object({action:U.literal("stop_video"),recording_operation_id:L0}).strict()]),d2=U.object({login:U.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:U.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),u2=U.string().regex(/^[1-9][0-9]{0,19}$/),c1=U.object({version:U.literal(1),owner:l0,expectedActorId:u2.nullable(),repositoryId:u2,repositoryFullName:U.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),kX=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],T9=U.discriminatedUnion("status",[c1.extend({status:U.literal("ready"),observedActor:d2,checkedAt:l$}),c1.extend({status:U.literal("not_ready"),reason:U.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:U.enum(kX).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),d$=U.object({version:U.literal(1),owner:l0,expectedActorId:u2.nullable(),authenticatedActor:d2,attemptId:L0,captureId:L0,prUrl:l5,repositoryId:u2,headSha:U.string().regex(/^[a-f0-9]{40}$/),sha256:G1,sizeBytes:U.number().int().min(128).max(10485760),contentType:U.literal("video/webm")}).strict(),p5=U.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),B1=U.discriminatedUnion("status",[d$.extend({status:U.literal("not_attempted"),reason:U.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),d$.extend({status:U.literal("uncertain"),reason:U.literal("upload_outcome_unknown")}),d$.extend({status:U.literal("uploaded"),observedActor:d2,nativeUrl:p5,uploadedAt:l$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),s1=d$.extend({nativeUrl:p5,observedActor:d2,bodySha256:G1}),_9=U.discriminatedUnion("status",[s1.extend({status:U.literal("incomplete"),reason:U.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),s1.extend({status:U.literal("verified"),sourceSha256:G1,width:U.number().int().min(1).max(4096),height:U.number().int().min(1).max(4096),durationSeconds:U.number().positive().max(30),advancedSeconds:U.number().min(0.05).max(10),advancedFrames:U.number().int().positive(),playbackRestored:U.literal(!0),verifiedAt:l$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),yX=U.custom().transform(($,J)=>{try{let Z=g2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),U.NEVER}}),fX=U.discriminatedUnion("action",[U.object({action:U.literal("auth_check"),input:c1}).strict(),U.object({action:U.literal("prepare"),context:K1}).strict(),U.object({action:U.literal("capture_png"),owner:l0,contextId:L0,tabId:U.number().int().positive()}).strict(),U.object({action:U.literal("start_video"),owner:l0,contextId:L0,tabId:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),U.object({action:U.literal("inspect_capture"),owner:l0,captureId:L0}).strict(),U.object({action:U.literal("publish_video"),input:d$}).strict(),U.object({action:U.literal("verify_png_media"),owner:l0,media:yX}).strict().refine(($)=>$.media.runId===$.owner.runId),U.object({action:U.literal("verify_saved_media"),input:s1}).strict(),U.object({action:U.literal("publish_png"),owner:l0,attemptId:L0,captureId:L0,sha256:G1,sizeBytes:U.number().int().min(24).max(8388608),storagePath:U.string().max(512),uploadUrl:U.string().url().max(8192)}).strict()]);var c5="pr-proof.stop.v1",F9=U.object({requestId:L0,command:fX}).strict();import{createHash as hX,randomUUID as mX}from"crypto";import{isDeepStrictEqual as U1}from"util";var s5=U.object({operationId:U.string().uuid(),attemptId:U.string().uuid(),contextId:U.string().uuid(),tabId:U.number().int().positive()}).strict(),G0=()=>Error("mac_pr_proof_capture_unavailable"),L9=($)=>hX("sha256").update($).digest("hex");function a5($){let J=l0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw G0();if(await $.assertCurrent(),X)throw G0()},G=(q)=>{let M=Z.get(q);if(!M||Date.parse(M.expiresAt)<=Date.now())throw G0();return M},V=(q)=>q.disposal??=(async()=>{q.controller.abort(),q.bytes?.fill(0),q.bytes=void 0,q.receipt=void 0;try{await q.host?.close()}catch{throw X=!0,G0()}})(),K=async()=>{for(let[q,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,j])=>j.claim.contextId===q);if((await Promise.allSettled(T.map(([,j])=>V(j)))).some((j)=>j.status==="rejected"))throw G0();for(let[j]of T)Q.delete(j);Z.delete(q)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let H=(q)=>{if(q.stopRequested=!0,q.started&&q.host&&!q.stop)q.stop=q.host.stop(),q.stop.catch(()=>q.controller.abort())};async function B(q,M){let T=s5.parse(q.claim);if(M==="video"&&(!Number.isInteger(q.seconds)||q.seconds<1||q.seconds>15))throw G0();await Y(),q.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw G0();let j=Q.get(T.operationId);if(j){if(!U1(j.claim,T)||j.kind!==M||j.seconds!==q.seconds||j.controller.signal.aborted)throw G0();let E=await j.completion;if(await Y(),G(T.contextId),j.controller.signal.aborted)throw G0();return structuredClone(E)}if(Q.size>=16||[...Q.values()].some((E)=>!E.receipt&&!E.controller.signal.aborted&&E.claim.tabId===T.tabId))throw G0();let D,O,F=new Promise((E,I)=>{D=E,O=I});F.catch(()=>{});let z={claim:T,kind:M,seconds:q.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,z);let L=()=>{V(z).catch(()=>{})};q.signal.addEventListener("abort",L,{once:!0});let W=async()=>{await Y(),G(T.contextId),q.signal.throwIfAborted(),z.controller.signal.throwIfAborted()},R;try{await W();let E;if(M==="image"){let I=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,z.controller.signal);let C=new Date().toISOString();if(await W(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw G0();E=M9.parse({version:1,producer:"primary_mac",context:_,captureId:mX(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I,finishedAt:C,sha256:L9(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(z.host=await $.createVideo(structuredClone(_),T.tabId,q.seconds,z.controller.signal),z.controller.signal.aborted||q.signal.aborted||X)throw await z.host.close(),G0();await z.host.start(),z.started=!0;let I=z.host.completed();if(I.catch(()=>{}),await W(),await q.started?.(),z.stopRequested)H(z);let C=await I;if(z.stop)await z.stop;await W();let h=await z.host.read(C.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!U1(C,h.capture)||!U1(C.owner,S)||R.length!==C.sizeBytes||L9(R)!==C.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw G0();await z.host.close(),await W(),E=M9.parse({version:1,producer:"primary_mac",context:_,captureId:C.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C.startedAt,finishedAt:C.finishedAt,sha256:C.sha256,media:{contentType:"video/webm",sizeBytes:C.sizeBytes,durationSeconds:C.durationSeconds,frameCount:C.frameCount,receivedFrameCount:C.receivedFrameCount}})}if(await W(),[...Q.values()].reduce((I,C)=>I+(C.bytes?.length??0),R.length)>20971520)throw G0();return z.bytes=Buffer.from(R),z.receipt=E,D(E),structuredClone(E)}catch(E){let I=M==="video"&&!q.signal.aborted&&!z.controller.signal.aborted&&E instanceof Error&&E.message==="mac_recording_worker_failed:no_frames"?new f0("proof_capture_no_frames","The owned tab emitted no recording frames."):G0();throw await V(z).catch(()=>{}),O(I),I}finally{R?.fill(0),q.signal.removeEventListener("abort",L)}}return{async prepare(q){let M=K1.parse(q);if(!U1(M.owner,J))throw G0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw G0();let T=Z.get(M.contextId);if(T){if(!U1(T,M))throw G0();return structuredClone(T)}if(Z.size>=4)throw G0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(q)=>B(q,"image"),record:(q)=>B(q,"video"),async stop(q){let M=s5.parse(q);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!U1(M,T.claim)||T.controller.signal.aborted)throw G0();H(T)},async publicationCapture(q){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===q);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw G0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||L9(M.bytes)!==M.receipt.sha256)throw G0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(q){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===q);if(!M?.receipt||M.controller.signal.aborted)throw G0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let q=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),q.some((M)=>M.status==="rejected"))throw G0()}}}import{createHash as t5,randomUUID as aX}from"crypto";import{isDeepStrictEqual as a1}from"util";import{realpath as iX}from"fs/promises";var i5=String.raw`async (media) => {
+`),L=T.slice(0,z);T=T.slice(z+1);try{if(!j){let W=JSON.parse(L);if(!W||Object.keys(W).length!==2||!Number.isInteger(W.port)||W.port<1024||W.port>65535||typeof W.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(W.token))throw Error("probe_receipt_invalid");j=!0,N({port:W.port,token:W.token})}else if(L==="ready")H(!0);else X()}catch{X()}}}),K.then(X);let D,O=!1;try{let F=await Promise.race([B,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let z=Date.now()+4500,L=m$(),W={organizationId:m$(),userId:m$(),runId:m$(),deviceId:m$(),rootId:m$(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:m$(),port:F.port,expiresAtMs:z},R={binding:W,executorLaunchId:L,job:{jobId:W.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:z,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:L}}},E=t8({binding:W,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});D=await r8({binding:W,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:E,signal:Q.signal}),O=await Promise.race([q,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{O=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),D?.close(),Q.abort(),G.stdin.destroy(),!V)G.kill("SIGKILL");await K}return O&&V}import{execFileSync as f2}from"child_process";import{randomUUID as d0}from"crypto";import{chmodSync as e8,chownSync as q5,closeSync as J9,constants as U$,existsSync as rQ,fstatSync as H5,mkdirSync as $5,mkdtempSync as tQ,openSync as Z9,readFileSync as oQ,readSync as eQ,realpathSync as $X,rmdirSync as JX,rmSync as ZX}from"fs";import{join as v$}from"path";import{fileURLToPath as QX}from"url";var J5=1e4,XX=!1;function h2(){if(process.platform!=="linux")return!1;return XX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=f2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var YX=Buffer.from([0,255,3,4]);function Z5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function GX($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function u1($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=y2(),{directory:Q,root:X,runtimeDirectory:Y}=UX(Z),G=new AbortController,V=()=>G.abort();$.addEventListener("abort",V,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,J5),H={organization_id:d0(),user_id:d0(),device_id:d0()},B=d0(),q=d0(),M=d0(),T=d0(),_=Date.now()+J5,j={kind:"workspace_source",target_revision:0,root_grant_revision:1},D=d0().replaceAll("-",""),O,F=Buffer.alloc(0),z,L=!1,W=!1,R=!1,E=!1,I,C,h,S=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},y=!1;try{K=KX(Q,Z),I=Bun.serve({hostname:"127.0.0.1",port:0,fetch(P,x){let A=new URL(P.url).pathname,w=A===`/device/hands/${D}`?"hands":A===`/device/pty/${D}`?"pty":null;if(w&&x.upgrade(P,{data:{lane:w}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(P){if(P.data.lane==="pty")O=P},message(P,x){if(P.data.lane!=="pty")return;if(typeof x==="string"){try{if(JSON.parse(x).t==="open")L=!0}catch{V()}return}if(F.length+x.length>8192){V();return}F=Buffer.concat([F,x])}}});let l=`ws://127.0.0.1:${I.port}`;if(C=Q9({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:B,operationId:d0(),attemptId:d0(),claimOwner:H,deviceIdentity:{deviceId:H.device_id,rootId:q,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${D}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:Q5,hands_worker_version:G5,hands_worker_artifact_sha256:B5,hands_worker_entrypoint:K5,target_generation:1,target_fence_id:M,environment_binding:j,[U5]:V5},emitEvent:async(P)=>{if(P==="hands.started")E=!0;if(P==="hands.ready")W=!0;if(P==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:N5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:QX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!W)V()}),await S(()=>W),X5({root:X,runId:B,payload:{version:1,snapshot_id:T,revision:1,run_id:B,root_id:q,device_id:H.device_id,binding:{...j,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:D},git:null}}),h=Y5({root:X,runId:B,rootId:q,deviceId:H.device_id,owner:H,workspace:{kind:"root"},authority:{device_id:H.device_id,binding:j.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${d0()}`,sessionId:"pty-readiness",operationId:d0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${D}`},emit:async(P,x)=>{if(P==="pty.ready")z=x}}).catch(()=>{V()}),await S(()=>Boolean(z&&O&&L)),O.send(JSON.stringify({t:"resize",cols:100,rows:30})),O.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${D}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${Z5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${Z5("foreground")}; ${K.wait("foreground")}'
+`)),await S(()=>rQ(v$(X,"foreground.pid"))&&F.includes(YX)),!F.includes("30 100")||z.job.environmentSnapshotId!==T||z.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((P)=>BX(v$(X,P)));if(new Set(k).size!==2||k.some((P)=>!Number.isSafeInteger(P)||P<2||P===z.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((P)=>GX(oQ(`/proc/${P}/stat`,"utf8"),P,z.job.process.pid)))return!1}else{let x=f2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((A)=>A.trim().split(/\s+/).map(Number));if(x.length!==2||new Set(x.map(([A])=>A)).size!==2||x.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(O.send(JSON.stringify({t:"close"})),await h,G.signal.aborted)return!1;for(let P of[z.job.process.pid,...k])try{return process.kill(P,0),!1}catch(x){if(!(x instanceof Error&&("code"in x)&&x.code==="ESRCH"))return!1}y=!0}catch{y=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await C,await I?.stop(!0),!E||R)VX({directory:Q,root:X},Z)}return y&&R&&!$.aborted}function KX($,J){let Z={foreground:v$($,"foreground.lifeline"),background:v$($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");f2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))J9(Y)};try{for(let Y of Object.values(Z)){let G=Z9(Y,U$.O_RDONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW);try{if(Q.push(Z9(Y,U$.O_WRONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW)),!H5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{J9(G)}if(J)q5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function M5($=(J)=>u1(J)){let J=new AbortController,Z=JSON.stringify(y2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(y2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function BX($){let J;try{J=Z9($,U$.O_RDONLY|U$.O_NOFOLLOW|U$.O_NONBLOCK)}catch{return Number.NaN}try{let Z=H5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=eQ(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{J9(J)}}function UX($,J=$X("/tmp")){let Z=tQ(v$(J,"reason-pty-probe-")),Q=v$(Z,"workspace"),X=v$(Z,"private");if($5(Q,{mode:448}),$5(X,{mode:448}),$)e8(Z,493),e8(Q,493),q5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function VX($,J){if(J)try{f2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),JX($.root)}catch{return}ZX($.directory,{recursive:!0,force:!0})}var C5=5000,g$="ARA_WORKER_PROBE_READY";function LX($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{NX($,J,{cwd:Z,env:Q,signal:X,timeout:C5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,V)=>Y(!G&&!X.aborted&&V===g$))})}function jX($,J){if(X9($)==="bash")return["--noprofile","--norc","-c",J];if(X9($)==="zsh"||X9($)==="sh")return["-f","-c",J];return null}function WX($,J){let Z=W5({home:J,temporaryDirectory:J}),Q=(Y,G,V)=>LX(Y,G,$.workspaceRoot,Z,V),X=async(Y,G,V,K=(H)=>H===g$,N=!1)=>{let H=await S5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:C5,signal:V});return!V.aborted&&!H.timedOut&&!H.truncated&&H.exitCode===0&&K(H.stdout)};return{workspaceRead:async(Y)=>{return await _5($.workspaceRoot,T5.R_OK),await L5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await _5($.workspaceRoot,T5.W_OK),Y.aborted)return!1;let G=I5(G9($.workspaceRoot,".ara-worker-probe-")),V=G9(G,"receipt");try{let K=await MX(V,"wx",384);try{await K.writeFile(g$),await K.sync()}finally{await K.close()}return await F5(V,"utf8")===g$&&!Y.aborted}finally{await _X(V).catch(()=>{}),await FX(G).catch(()=>{})}},confinedShell:(Y)=>X(x5(),["-c",`printf ${g$}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
+`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,V,K]=await Promise.all([TX("/proc/self/cwd"),L5("/proc/self/fd"),F5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${g$}`],Y),jobs:(Y)=>n8($,Y),environment:(Y)=>i8($,J,Y),preview:(Y)=>o8(J,Y),boundPty:(Y)=>u1(Y),desktopDisplay:()=>E5(),desktopAutomation:async()=>{let Y=B9();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
+`);return R5()},desktopBrowser:async()=>l1()?.features.browser===!0,fullControlShell:(Y)=>{let G=z5(),V=jX(G,`printf ${g$}`);return V?Q(G,V,Y):Promise.resolve(!1)}}}function B9(){return process.platform==="darwin"&&l1()?.features.computer===!0?A5():null}var U9=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function DX($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=K9()){return d1($,J,Z,Q,X).final}function d1($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=K9(),Y,G){let V,K;try{if(K$($),v0(),!J)e(g($),!0),V=I5(G9(g($),"probe-")),J=WX($,V);K=J}catch(O){let F=Promise.reject(O);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(O,F)=>{if(Z.aborted||!F&&!K[O])return!1;let z,L=new Promise((W)=>{z=()=>W(!1)});Z.addEventListener("abort",z,{once:!0});try{return await Promise.race([F??K[O](Z),L])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",z)}},H=$.executionMode==="host",B=H?N("boundPty",Y):Promise.resolve(!1),q=Promise.resolve(G).then(()=>Promise.all(H?[N("preview"),B,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[O,F,z,L,W,R,E,I,C]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...H?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(H&&(!R||!E||!I)&&!G)await q;if(H){if(!R)R=await N("bash");if(!E)E=await N("jobs");if(!I)I=await N("environment")}return{read:O,write:F,shell:z,git:L,processes:W,bash:R,jobs:E,environment:I,full:C}})(),T=(O,F)=>{let{read:z,write:L,shell:W,git:R,processes:E,bash:I,jobs:C,environment:h,full:S}=O,{preview:y,boundPty:l,desktopDisplay:k,desktopAutomation:P,desktopBrowser:x}=F,A=D5(),w=H&&process.platform==="darwin"&&S&&qX("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":z,"fs.write":L,"inference.custom.v1":H&&z,"fs.export":z&&A,"fs.import":L&&A,"exec.run":W&&X,"git.run":W&&R&&X,"process.list":(process.platform==="linux"||W)&&E,"ports.list":(process.platform==="linux"||W)&&E,"exec.full":I&&S&&X,"hands.connect":z&&L&&I&&C,"jobs.control":z&&L&&I&&C,"pty.start":z&&L&&I&&C&&h&&l,"environment.install":z&&L&&I&&C&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&z&&L&&I&&C&&h,"tunnel.open":z&&L&&I&&C&&h&&y,"tunnel.close":z&&L&&I&&C&&h&&y,"preview.serve.v1":z&&I&&C&&y&&S,"display.stream.v1":k,"automation.call.v1":P,"simulator.call.v1":w,"simulator.stream.v1":w,"browser.pr-proof.v1":P&&x&&j5()===null,"workspace.setup.v1":H&&O5()})},_=M.then(async(O)=>T(O,{preview:!1,boundPty:await Promise.race([B,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),j=(async()=>{try{let O=await M,[F,z,L,W,R]=await q;if(H&&!z&&O.read&&O.write&&O.bash&&O.jobs&&O.environment)z=await N("boundPty");return T(O,{preview:F,boundPty:z,desktopDisplay:L,desktopAutomation:W,desktopBrowser:R})}finally{if(V)HX(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let D=(async()=>{let O=await M;if(!(O.read&&O.write&&O.bash&&O.jobs&&O.environment))return!1;return await B||(await j)["pty.start"]===!0})();return D.catch(()=>{}),{initial:_,final:j,pty:D}}var OX=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],zX=[60000,300000,900000];function Y9($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return OX.filter((Z)=>J[Z]!==!0)}function P5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>DX($.config,void 0,Y,$.permissions)),Q=$.readiness,X=Y9($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
+`),(async()=>{for(let Y of $.delaysMs??zX){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=Y9($.config,Q).filter((K)=>G[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
+`),$.onReady(Q,V);if(Y9($.config,Q).length===0)return}})()}import{execFile as WY}from"child_process";import{createHash as DY,randomUUID as R9}from"crypto";import{lstat as OY,readdir as MJ,readFile as DJ,realpath as zY,stat as AY}from"fs/promises";import{basename as RY,join as z9}from"path";import{promisify as IY}from"util";import{createConnection as AX}from"net";import{endianness as k5}from"os";var p1=4,V9=1e4;class z${socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=AX(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=RX({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let H=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:H})});return Z.write(G),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=p1){let J=k5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=p1+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(p1,Z);this.#$=this.#$.subarray(Z),this.#K(JSON.parse(Q.toString("utf8")))}}#K($){if(!a0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),a0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class m2{client;cdp;constructor($){this.client="client"in $?$.client:new z$($),this.cdp=new h5(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=IX(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new y5(this,$)}getTabs(){return this.client.getTabs()}}class y5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new f5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class f5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class h5{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(a0(Q)&&a0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return a0(Q)&&a0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";b5(Q);let X=Z.timeoutMs??V9;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(a0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if(w5(K,Q))return;throw V}),G}async waitForLoadState($,J={}){let Z=J.state??"load";b5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(w5(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??V9)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return a0(J)?{href:N9(J.href),readyState:N9(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??V9;return new Promise((X,Y)=>{let G=!1,V=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((H)=>{try{if(J(H)){if(N())X(H)}}catch(B){if(N())Y(B instanceof Error?B:Error(String(B)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=CX(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function RX($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(p1+J.length);if(k5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,p1),Z}function a0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function IX($,J){if(!a0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function b5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function w5($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function CX($,J){if($.method!=="onCDPEvent"||!a0($.params))return null;let Z=$.params.source;if(!a0(Z)||Z.tabId!==J)return null;return{method:N9($.params.method)}}function N9($){return typeof $==="string"?$:void 0}import{createHash as PX}from"crypto";function m5($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${PX("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as FY}from"async_hooks";import{isDeepStrictEqual as qJ}from"util";import{createHash as LY}from"crypto";var EX=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var xX=new Set(["png","jpg","jpeg","gif","webp"]),SX=new Set(["webm","mp4"]);function bX($){if(!$)return null;try{return new URL($).origin}catch{return null}}function v5($,J){let Z;try{Z=new URL($)}catch{return null}let Q=bX(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=EX.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!V||!K||!N)return null;let H=xX.has(N)?"image":SX.has(N)?"video":null;if(!H)return null;let B=/^(before|after)[\s:_-]+/.exec(K),q=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:q,runId:G,artifactId:V,fileName:`${K}.${N}`,kind:H,phase:B?.[1]==="before"||B?.[1]==="after"?B[1]:null}}var wX=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,v2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),u$=()=>{throw Error("cloud_browser_media_request_invalid")};function g2($){if(!v2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!wX.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return u$();let J;try{J=new URL($.configuredMediaOrigin)}catch{return u$()}if(J.protocol!=="https:"||J.username||J.password||J.port||!g5(J.origin,{mode:"public_web"}).allowed)return u$();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!v2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return u$();let G=v5(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return u$();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return u$()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return u$()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function u5($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!v2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!v2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var H9="browser.pr-proof.v1",L0=U.string().uuid(),G1=U.string().regex(/^[a-f0-9]{64}$/),l$=U.iso.datetime({precision:3}),q9=U.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),l5=U.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),l0=U.object({kind:U.literal("primary_mac"),version:U.literal(1),organizationId:q9,userId:q9,sessionId:q9,runId:L0,deviceId:L0,rootId:L0,rootRevision:U.string().min(1).max(64),binding:U.enum(["workspace_source","mcp_control"]),targetRevision:U.number().int().nonnegative(),generation:L0,profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:U.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),kX=U.custom().transform(($,J)=>{try{return d5($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),U.NEVER}}),K1=U.object({version:U.literal(1),owner:l0,contextId:L0,preparedAt:l$,expiresAt:l$,prUrl:l5,headSha:U.string().regex(/^[a-f0-9]{40}$/),skillDigest:G1,evidenceKind:U.enum(["image","video"]),visualPlan:kX.optional(),uploadOrigin:U.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),M9=U.object({version:U.literal(1),producer:U.literal("primary_mac"),context:K1,captureId:L0,operationId:L0,attemptId:L0,tabId:U.number().int().positive(),startedAt:l$,finishedAt:l$,sha256:G1,media:U.discriminatedUnion("contentType",[U.object({contentType:U.literal("image/png"),sizeBytes:U.number().int().min(24).max(8388608),width:U.number().int().min(1).max(4096),height:U.number().int().min(1).max(4096)}).strict(),U.object({contentType:U.literal("video/webm"),sizeBytes:U.number().int().min(128).max(10485760),durationSeconds:U.number().min(0.05).max(15),frameCount:U.number().int().min(1).max(450),receivedFrameCount:U.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),dq=U.discriminatedUnion("action",[U.object({action:U.literal("screenshot"),context_id:L0,tab_id:U.number().int().positive()}).strict(),U.object({action:U.literal("start_video"),context_id:L0,tab_id:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),U.object({action:U.literal("stop_video"),recording_operation_id:L0}).strict()]),d2=U.object({login:U.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:U.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),u2=U.string().regex(/^[1-9][0-9]{0,19}$/),c1=U.object({version:U.literal(1),owner:l0,expectedActorId:u2.nullable(),repositoryId:u2,repositoryFullName:U.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),yX=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],T9=U.discriminatedUnion("status",[c1.extend({status:U.literal("ready"),observedActor:d2,checkedAt:l$}),c1.extend({status:U.literal("not_ready"),reason:U.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:U.enum(yX).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),d$=U.object({version:U.literal(1),owner:l0,expectedActorId:u2.nullable(),authenticatedActor:d2,attemptId:L0,captureId:L0,prUrl:l5,repositoryId:u2,headSha:U.string().regex(/^[a-f0-9]{40}$/),sha256:G1,sizeBytes:U.number().int().min(128).max(10485760),contentType:U.literal("video/webm")}).strict(),p5=U.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),B1=U.discriminatedUnion("status",[d$.extend({status:U.literal("not_attempted"),reason:U.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),d$.extend({status:U.literal("uncertain"),reason:U.literal("upload_outcome_unknown")}),d$.extend({status:U.literal("uploaded"),observedActor:d2,nativeUrl:p5,uploadedAt:l$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),s1=d$.extend({nativeUrl:p5,observedActor:d2,bodySha256:G1}),_9=U.discriminatedUnion("status",[s1.extend({status:U.literal("incomplete"),reason:U.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),s1.extend({status:U.literal("verified"),sourceSha256:G1,width:U.number().int().min(1).max(4096),height:U.number().int().min(1).max(4096),durationSeconds:U.number().positive().max(30),advancedSeconds:U.number().min(0.05).max(10),advancedFrames:U.number().int().positive(),playbackRestored:U.literal(!0),verifiedAt:l$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),fX=U.custom().transform(($,J)=>{try{let Z=g2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),U.NEVER}}),hX=U.discriminatedUnion("action",[U.object({action:U.literal("auth_check"),input:c1}).strict(),U.object({action:U.literal("prepare"),context:K1}).strict(),U.object({action:U.literal("capture_png"),owner:l0,contextId:L0,tabId:U.number().int().positive()}).strict(),U.object({action:U.literal("start_video"),owner:l0,contextId:L0,tabId:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),U.object({action:U.literal("inspect_capture"),owner:l0,captureId:L0}).strict(),U.object({action:U.literal("publish_video"),input:d$}).strict(),U.object({action:U.literal("verify_png_media"),owner:l0,media:fX}).strict().refine(($)=>$.media.runId===$.owner.runId),U.object({action:U.literal("verify_saved_media"),input:s1}).strict(),U.object({action:U.literal("publish_png"),owner:l0,attemptId:L0,captureId:L0,sha256:G1,sizeBytes:U.number().int().min(24).max(8388608),storagePath:U.string().max(512),uploadUrl:U.string().url().max(8192)}).strict()]);var c5="pr-proof.stop.v1",F9=U.object({requestId:L0,command:hX}).strict();import{createHash as mX,randomUUID as vX}from"crypto";import{isDeepStrictEqual as U1}from"util";var s5=U.object({operationId:U.string().uuid(),attemptId:U.string().uuid(),contextId:U.string().uuid(),tabId:U.number().int().positive()}).strict(),G0=()=>Error("mac_pr_proof_capture_unavailable"),L9=($)=>mX("sha256").update($).digest("hex");function a5($){let J=l0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw G0();if(await $.assertCurrent(),X)throw G0()},G=(q)=>{let M=Z.get(q);if(!M||Date.parse(M.expiresAt)<=Date.now())throw G0();return M},V=(q)=>q.disposal??=(async()=>{q.controller.abort(),q.bytes?.fill(0),q.bytes=void 0,q.receipt=void 0;try{await q.host?.close()}catch{throw X=!0,G0()}})(),K=async()=>{for(let[q,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,j])=>j.claim.contextId===q);if((await Promise.allSettled(T.map(([,j])=>V(j)))).some((j)=>j.status==="rejected"))throw G0();for(let[j]of T)Q.delete(j);Z.delete(q)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let H=(q)=>{if(q.stopRequested=!0,q.started&&q.host&&!q.stop)q.stop=q.host.stop(),q.stop.catch(()=>q.controller.abort())};async function B(q,M){let T=s5.parse(q.claim);if(M==="video"&&(!Number.isInteger(q.seconds)||q.seconds<1||q.seconds>15))throw G0();await Y(),q.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw G0();let j=Q.get(T.operationId);if(j){if(!U1(j.claim,T)||j.kind!==M||j.seconds!==q.seconds||j.controller.signal.aborted)throw G0();let E=await j.completion;if(await Y(),G(T.contextId),j.controller.signal.aborted)throw G0();return structuredClone(E)}if(Q.size>=16||[...Q.values()].some((E)=>!E.receipt&&!E.controller.signal.aborted&&E.claim.tabId===T.tabId))throw G0();let D,O,F=new Promise((E,I)=>{D=E,O=I});F.catch(()=>{});let z={claim:T,kind:M,seconds:q.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,z);let L=()=>{V(z).catch(()=>{})};q.signal.addEventListener("abort",L,{once:!0});let W=async()=>{await Y(),G(T.contextId),q.signal.throwIfAborted(),z.controller.signal.throwIfAborted()},R;try{await W();let E;if(M==="image"){let I=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,z.controller.signal);let C=new Date().toISOString();if(await W(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw G0();E=M9.parse({version:1,producer:"primary_mac",context:_,captureId:vX(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I,finishedAt:C,sha256:L9(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(z.host=await $.createVideo(structuredClone(_),T.tabId,q.seconds,z.controller.signal),z.controller.signal.aborted||q.signal.aborted||X)throw await z.host.close(),G0();await z.host.start(),z.started=!0;let I=z.host.completed();if(I.catch(()=>{}),await W(),await q.started?.(),z.stopRequested)H(z);let C=await I;if(z.stop)await z.stop;await W();let h=await z.host.read(C.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!U1(C,h.capture)||!U1(C.owner,S)||R.length!==C.sizeBytes||L9(R)!==C.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw G0();await z.host.close(),await W(),E=M9.parse({version:1,producer:"primary_mac",context:_,captureId:C.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C.startedAt,finishedAt:C.finishedAt,sha256:C.sha256,media:{contentType:"video/webm",sizeBytes:C.sizeBytes,durationSeconds:C.durationSeconds,frameCount:C.frameCount,receivedFrameCount:C.receivedFrameCount}})}if(await W(),[...Q.values()].reduce((I,C)=>I+(C.bytes?.length??0),R.length)>20971520)throw G0();return z.bytes=Buffer.from(R),z.receipt=E,D(E),structuredClone(E)}catch(E){let I=M==="video"&&!q.signal.aborted&&!z.controller.signal.aborted&&E instanceof Error&&E.message==="mac_recording_worker_failed:no_frames"?new f0("proof_capture_no_frames","The owned tab emitted no recording frames."):G0();throw await V(z).catch(()=>{}),O(I),I}finally{R?.fill(0),q.signal.removeEventListener("abort",L)}}return{async prepare(q){let M=K1.parse(q);if(!U1(M.owner,J))throw G0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw G0();let T=Z.get(M.contextId);if(T){if(!U1(T,M))throw G0();return structuredClone(T)}if(Z.size>=4)throw G0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(q)=>B(q,"image"),record:(q)=>B(q,"video"),async stop(q){let M=s5.parse(q);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!U1(M,T.claim)||T.controller.signal.aborted)throw G0();H(T)},async publicationCapture(q){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===q);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw G0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||L9(M.bytes)!==M.receipt.sha256)throw G0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(q){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===q);if(!M?.receipt||M.controller.signal.aborted)throw G0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let q=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),q.some((M)=>M.status==="rejected"))throw G0()}}}import{createHash as t5,randomUUID as iX}from"crypto";import{isDeepStrictEqual as a1}from"util";import{realpath as nX}from"fs/promises";var i5=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -71,24 +71,24 @@ ${J?.directory??g($)}`).digest("hex")}function R1($,J){c(b0(g($),I1),{version:1,
     }
   }));
   return { verified: true, items };
-}`;var n5=function($){let J=this??globalThis,Z=10485760,Q=(G,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),H=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,B={login:K,id:H};if(G.expectedActorId!==null&&H!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||H!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||H!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let q=J.document.querySelector('link[rel="canonical"]');if(q&&q.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),j=M?.closest("form"),D=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!j||new J.URL(j.action,J.location.href).origin!=="https://github.com"||new J.URL(j.action,J.location.href).pathname!==D)return{ok:!1,reason:"attachment_unavailable"};let O=_.getAttribute("data-upload-policy-url");if(!O||new J.URL(O,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:B}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,V=Q(G,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(q)=>q.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),H=new J.DataTransfer;H.items.add(N);let B=J.document.querySelector("#fc-new_comment_field");if(!B)return{dispatched:!1,reason:"attachment_unavailable"};return B.files=H.files,B.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),V=(D)=>{try{let O=new J.URL(D,J.location.href);if(O.protocol!=="https:"||O.username||O.password||O.port||O.hash)return!1;if(O.origin==="https://github.com")return O.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(O.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(O.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((D)=>/^issue-[1-9][0-9]*$/.test(D.closest('[id^="issue-"]')?.id||"")&&!D.closest("form")&&!D.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],H=[...N.querySelectorAll("video")].filter((D)=>[D.currentSrc,D.src,...[...D.querySelectorAll("source")].map((O)=>O.src)].some(V));if(H.length!==1)throw Error("saved_player_missing");let B=H[0],q={muted:B.muted,volume:B.volume,rate:B.playbackRate,preload:B.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(D)=>J.Promise.race([D,new J.Promise((O,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),j=async(D)=>{while(!D()){if(B.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((O)=>J.setTimeout(O,25))}};try{if(B.muted=!0,B.playbackRate=1,B.currentTime=0,B.readyState<2)B.preload="auto",B.load();await j(()=>B.readyState>=2&&B.videoWidth>0&&B.videoHeight>0);let D=B.currentSrc;if(!V(D))throw Error("source_unbound");let O=await _(J.fetch(D,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(O.status!==200||!V(O.url)||O.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(O.headers.get("content-type")||"")||!O.body)throw Error("source_unverifiable");let F=O.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let z=O.body.getReader(),L=[],W=0;try{for(;;){let y=await _(z.read());if(y.done)break;if(W+=y.value.length,W>10485760||W>X.sizeBytes)throw Error("source_too_large");L.push(y.value)}}finally{await z.cancel().catch(()=>{}),z.releaseLock()}if(W!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(W),E=0;for(let y of L)R.set(y,E),E+=y.length;let I=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((y)=>y.toString(16).padStart(2,"0")).join("");if(I!==X.sha256||B.currentSrc!==D||!N.contains(B))throw Error("source_changed");let C=B.currentTime,h=B.getVideoPlaybackQuality().totalVideoFrames;if(await _(B.play()),await j(()=>B.currentTime-C>=0.05&&B.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||B.currentSrc!==D||!N.contains(B)||B.error)throw Error("player_changed");return{status:"verified",sourceSha256:I,width:B.videoWidth,height:B.videoHeight,durationSeconds:B.duration,advancedSeconds:B.currentTime-C,advancedFrames:B.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),B.pause(),B.currentTime=0,B.muted=q.muted,B.volume=q.volume,B.playbackRate=q.rate,B.preload=q.preload,!B.paused||B.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as vX}from"child_process";import{lstat as gX,realpath as uX}from"fs/promises";import{join as r5,resolve as dX}from"path";import{promisify as lX}from"util";var pX=lX(vX);async function cX($,J){let Z=await uX($),{stdout:Q}=await pX(r5(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return U.array(U.object({browser:U.string(),directory:U.string(),connected:U.boolean().optional(),source:U.string(),socketPath:U.string().optional(),instanceId:U.string().optional(),extensionId:U.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&dX(Y.source)===r5(Z,"Reason Browser Use","manifest.json"))}async function l2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await cX($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await gX(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as sX}from"crypto";function V1($){return`reason-browser-${sX("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var o5=U.discriminatedUnion("ok",[U.object({ok:U.literal(!0),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict(),U.object({ok:U.literal(!1),reason:U.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),e5=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.string(),extensionInstanceId:U.string(),nativeHostName:U.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function j9($){let J=l0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await nX($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${aX()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(H)=>{if(!a1(J,H.owner))throw Z0();await G()},K=async(H)=>{await V(H);let B=await $.readVideo(H.captureId);try{await G();let q=B.capture;if(!a1(q.context.owner,J)||q.captureId!==H.captureId||q.context.prUrl!==H.prUrl||q.context.headSha!==H.headSha||q.media.contentType!=="video/webm"||q.media.sizeBytes!==H.sizeBytes||q.sha256!==H.sha256||B.bytes.length!==H.sizeBytes||B.bytes.length<128||B.bytes.length>10485760||B.bytes.readUInt32BE(0)!==440786851||t5("sha256").update(B.bytes).digest("hex")!==H.sha256)throw Z0();return B}catch(q){throw B.bytes.fill(0),q}};async function N(H,B,q){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new m2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,j=!1,D,O=new Promise((L,W)=>{D=setTimeout(()=>{j=!0,W(Z0())},60000)});O.catch(()=>{});let F=(L)=>Promise.race([L,O]),z=async()=>{if(j)throw Z0();if(await G(),j)throw Z0()};try{await F(T.connect());let L=e5.parse(await F(T.client.getInfo()));if(L.metadata.extensionId!==M.extensionId||L.metadata.extensionInstanceId!==M.instanceId||!L.metadata.nativeHostName)throw Z0();await z(),q?.("connected");let W=T.newTab();W.then((I)=>{if(j)I.close().catch(()=>{Y=!0})},()=>{}),_=await F(W),await z(),await F(_.goto(H,{waitUntil:"domcontentloaded",timeoutMs:15000})),await z(),q?.("loaded");let E=await F(B(_,async(I)=>{await z();let C=await F(_.evaluate(`(${n5.toString()})(${JSON.stringify(I)})`,{awaitPromise:!0}));return await z(),C},z));return await z(),E}finally{j=!0,clearTimeout(D);try{if(_){let L;try{await Promise.race([_.close(),new Promise((W,R)=>{L=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(L)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(H,B,q){let M=K1.parse(H);if(await V(M),!Number.isSafeInteger(B)||B<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();q.throwIfAborted();let T=await Z.discover(q),_=new m2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),j;try{await _.connect();let D=e5.parse(await _.client.getInfo());if(D.metadata.extensionId!==T.extensionId||D.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!U.array(U.object({id:U.number()})).max(256).parse(await _.getTabs()).some((z)=>z.id===B))throw Z0();await G(),q.throwIfAborted();let F=U.object({data:U.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(B,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(j=Buffer.from(F.data,"base64"),j.toString("base64")!==F.data||j.length>8388608)throw Z0();if(await G(),q.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return j}catch{throw j?.fill(0),Z0()}finally{_.close()}},async verifyImages(H){let B=g2(H);if(B.runId!==J.runId||B.media.some((q)=>q.kind!=="image"))throw Z0();return N("about:blank",async(q,M,T)=>{let _=q.browser.client,j=new Set(B.media.map((I)=>I.sourceUrl)),D=new Map,O=new Set,F=!1,z=0,L=!1,W=new Set,R=(I,C)=>{if(W.size>=32){F=!0;return}let h=_.executeCdp(q.id,I,C);W.add(h),h.catch(()=>{F=!0}).finally(()=>W.delete(h))},E=_.onNotification((I)=>{if(I.method!=="onCDPEvent"||!V$(I.params)||!V$(I.params.source)||I.params.source.tabId!==q.id||!V$(I.params.params))return;let C=I.params.params;if(++z>512){F=!0;return}if(I.params.method==="Fetch.requestPaused"){let y=typeof C.requestId==="string"&&V$(C.request)&&C.request.method==="GET"&&typeof C.request.url==="string"&&j.has(C.request.url)&&C.resourceType==="Image";if(typeof C.requestId!=="string"){F=!0;return}if(!y)F=!0;R(y?"Fetch.continueRequest":"Fetch.failRequest",{requestId:C.requestId,...y?{}:{errorReason:"BlockedByClient"}})}if(I.params.method==="Network.requestWillBeSent"&&C.redirectResponse)F=!0;if(I.params.method==="Network.loadingFailed")F=!0;if(I.params.method==="Network.loadingFinished"&&typeof C.requestId==="string")O.add(C.requestId);if(I.params.method!=="Network.responseReceived")return;if(!V$(C.response)||typeof C.response.url!=="string"||!j.has(C.response.url)||typeof C.requestId!=="string"||!V$(C.response.headers)||C.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(C.response.headers).map(([y,l])=>[y.toLowerCase(),l])),S=Number(h["content-length"]);if(D.has(C.response.url)||C.response.status!==200||C.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}D.set(C.response.url,{id:C.requestId,length:S})});try{await _.executeCdp(q.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(q.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(q.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(q.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let I=U.object({frameTree:U.object({frame:U.object({id:U.string().min(1).max(256)})})}).parse(await _.executeCdp(q.id,"Page.getFrameTree",{})),C=[...new Set(B.media.map((y)=>new URL(y.sourceUrl).origin))].join(" ");await _.executeCdp(q.id,"Page.setDocumentContent",{frameId:I.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${C}; style-src 'none'"><body></body>`}),await T(),L=!0;try{await _.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new f0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await q.evaluate(`(${i5})(${JSON.stringify(B.media)})`,{awaitPromise:!0})}catch{throw new f0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!V$(h)||!Array.isArray(h.items)||h.items.length!==B.media.length)throw Z0();await Promise.all(W);let S=[];for(let y=0;y<B.media.length;y++){await G();let l=D.get(B.media[y].sourceUrl);if(F||!l||!O.has(l.id))throw Z0();let k=U.object({base64Encoded:U.literal(!0),body:U.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(q.id,"Network.getResponseBody",{requestId:l.id})),P=Buffer.from(k.body,"base64");try{let x=h.items[y];if(P.length!==l.length||P.toString("base64")!==k.body||!V$(x))throw Z0();S.push({...x,sourceSha256:t5("sha256").update(P).digest("hex")})}finally{P.fill(0)}}if(F)throw Z0();return u5({verified:!0,items:S},B)}finally{if(E(),await Promise.allSettled(W),L)try{await _.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new f0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(H){let B=c1.parse(H);await V(B);let q="browser_unavailable";try{return await N(`https://github.com/${B.repositoryFullName}`,async(M,T)=>{let _=o5.parse(await T({operation:"preflight",expected:{...B,prUrl:`https://github.com/${B.repositoryFullName}`}}));return T9.parse(_.ok?{...B,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...B,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...B,status:"not_ready",reason:_.reason})},(M)=>{q=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return T9.parse({...B,status:"not_ready",reason:"unavailable",cause:q})}},async publish(H){let B=d$.parse(H);if(await V(B),B.expectedActorId!==null&&B.authenticatedActor.id!==B.expectedActorId)throw Z0();let q=Q.get(B.attemptId);if(q){if(!a1(q.binding,B))throw Z0();return structuredClone(q.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(B),result:B1.parse({...B,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(B.attemptId,M);let T=!1,_="dispatch";try{(await K(B)).bytes.fill(0),M.result=await N(B.prUrl,async(j,D)=>{let O=o5.parse(await D({operation:"identity",expected:B}));if(!O.ok)return B1.parse({...B,status:"not_attempted",reason:O.reason});let F=await K(B),z;try{T=!0,z=U.discriminatedUnion("dispatched",[U.object({dispatched:U.literal(!0),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict(),U.object({dispatched:U.literal(!1),reason:U.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await D({operation:"upload",expected:B,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!z.dispatched)return T=!1,B1.parse({...B,status:"not_attempted",reason:z.reason});if(!a1(z.actor,O.actor))throw _="actor_changed",Z0();_="result";let L=performance.now();while(performance.now()-L<30000){let W=await D({operation:"upload_result",expected:{...B,observedActor:O.actor}});if(W!==null){let R=U.object({nativeUrl:U.string(),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict().parse(W);return _="finalize",await G(),B1.parse({...B,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
-`);M.result=B1.parse({...B,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(H){let B=s1.parse(H);await V(B);try{return(await K(B)).bytes.fill(0),await N(B.prUrl,async(q,M)=>{await q.browser.client.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:B});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=_9.parse({...B,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(B).some(([j,D])=>!a1(D,_[j])))throw Z0();return _}finally{await q.browser.client.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return _9.parse({...B,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function nX($,J){let Z=await iX($);return{async discover(Q){let X=await l2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:V1(J.runId)}}import{realpath as TY}from"fs/promises";var WH=U.object({version:U.literal(1),recording_operation_id:U.string().uuid(),proof_ready:U.literal(!1),acknowledged_at:U.iso.datetime()}).strict(),p2=U.object({action:U.literal("start"),request_id:U.string().uuid(),profile:U.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),$J=U.object({action:U.literal("inspect"),recording_operation_id:U.string().uuid()}).strict(),DH=U.discriminatedUnion("action",[p2,$J]),JJ=U.object({recording_operation_id:U.string().uuid()}).strict(),W9={device_id:U.string().uuid(),root_id:U.string().uuid()},rX=U.discriminatedUnion("action",[p2.extend(W9),$J.extend(W9),JJ.extend({...W9,action:U.literal("stop")})]),OH=U.toJSONSchema(rX),zH=U.object({version:U.literal(1),recordingId:U.string().uuid(),proofReady:U.literal(!1),capture:U.object({captureId:U.string().uuid(),contentType:U.literal("video/webm"),sha256:U.string().regex(/^[a-f0-9]{64}$/),sizeBytes:U.number().int().min(128).max(10485760),startedAt:U.iso.datetime(),finishedAt:U.iso.datetime(),durationSeconds:U.number().min(0.05).max(15),frameCount:U.number().int().min(1).max(450),receivedFrameCount:U.number().int().min(1).max(2000),owner:U.object({runId:U.string().uuid(),deviceId:U.string().uuid(),rootId:U.string().uuid(),rootRevision:U.string().max(64),profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:U.string().min(1).max(1024),generation:U.string().uuid(),browserScope:U.string().max(128),tabId:U.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var wH=p2.extend({action:U.enum(["start","inspect"]),recording_boot_generation:U.string().uuid(),recording_operation_id:U.string().uuid().optional(),recording_attempt_id:U.string().uuid().optional()}).strict();import{createHash as GY,randomUUID as KY}from"crypto";import{mkdtemp as BY,realpath as UY,rm as UJ}from"fs/promises";import{tmpdir as VY}from"os";import{join as NY}from"path";import{spawn as qY}from"child_process";import{isDeepStrictEqual as HY}from"util";import{createHash as tX}from"crypto";import{execFile as oX}from"child_process";import{chmod as eX,lstat as QJ,mkdtemp as $Y,readFile as XJ,realpath as YJ,rm as JY,writeFile as ZJ}from"fs/promises";import{tmpdir as ZY}from"os";import{isAbsolute as QY,join as c2}from"path";import{promisify as XY}from"util";var D9=XY(oX),YY=($)=>tX("sha256").update($).digest("hex");async function o0($){if(!QY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await YJ($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await QJ($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||YY(await XJ($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function i1($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([o0(Z.ffmpeg),o0(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([o0(Z.ffmpeg),o0(Z.ffprobe)]);let G=await YJ(await $Y(c2(J??ZY(),"reason-owned-recording-")));await eX(G,448);let V=c2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[j,D]of Q.entries()){let O=`${j}.jpg`;await ZJ(c2(G,O),D.jpeg,{mode:384,flag:"wx"});let F=Q[j+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${O}'`,`duration ${Math.max(0.001,F-D.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await ZJ(c2(G,"frames.ffconcat"),N.join(`
+}`;var n5=function($){let J=this??globalThis,Z=10485760,Q=(G,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),H=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,B={login:K,id:H};if(G.expectedActorId!==null&&H!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||H!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||H!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let q=J.document.querySelector('link[rel="canonical"]');if(q&&q.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),j=M?.closest("form"),D=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!j||new J.URL(j.action,J.location.href).origin!=="https://github.com"||new J.URL(j.action,J.location.href).pathname!==D)return{ok:!1,reason:"attachment_unavailable"};let O=_.getAttribute("data-upload-policy-url");if(!O||new J.URL(O,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:B}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,V=Q(G,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(q)=>q.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),H=new J.DataTransfer;H.items.add(N);let B=J.document.querySelector("#fc-new_comment_field");if(!B)return{dispatched:!1,reason:"attachment_unavailable"};return B.files=H.files,B.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),V=(D)=>{try{let O=new J.URL(D,J.location.href);if(O.protocol!=="https:"||O.username||O.password||O.port||O.hash)return!1;if(O.origin==="https://github.com")return O.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(O.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(O.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((D)=>/^issue-[1-9][0-9]*$/.test(D.closest('[id^="issue-"]')?.id||"")&&!D.closest("form")&&!D.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],H=[...N.querySelectorAll("video")].filter((D)=>[D.currentSrc,D.src,...[...D.querySelectorAll("source")].map((O)=>O.src)].some(V));if(H.length!==1)throw Error("saved_player_missing");let B=H[0],q={muted:B.muted,volume:B.volume,rate:B.playbackRate,preload:B.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(D)=>J.Promise.race([D,new J.Promise((O,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),j=async(D)=>{while(!D()){if(B.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((O)=>J.setTimeout(O,25))}};try{if(B.muted=!0,B.playbackRate=1,B.currentTime=0,B.readyState<2)B.preload="auto",B.load();await j(()=>B.readyState>=2&&B.videoWidth>0&&B.videoHeight>0);let D=B.currentSrc;if(!V(D))throw Error("source_unbound");let O=await _(J.fetch(D,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(O.status!==200||!V(O.url)||O.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(O.headers.get("content-type")||"")||!O.body)throw Error("source_unverifiable");let F=O.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let z=O.body.getReader(),L=[],W=0;try{for(;;){let y=await _(z.read());if(y.done)break;if(W+=y.value.length,W>10485760||W>X.sizeBytes)throw Error("source_too_large");L.push(y.value)}}finally{await z.cancel().catch(()=>{}),z.releaseLock()}if(W!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(W),E=0;for(let y of L)R.set(y,E),E+=y.length;let I=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((y)=>y.toString(16).padStart(2,"0")).join("");if(I!==X.sha256||B.currentSrc!==D||!N.contains(B))throw Error("source_changed");let C=B.currentTime,h=B.getVideoPlaybackQuality().totalVideoFrames;if(await _(B.play()),await j(()=>B.currentTime-C>=0.05&&B.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||B.currentSrc!==D||!N.contains(B)||B.error)throw Error("player_changed");return{status:"verified",sourceSha256:I,width:B.videoWidth,height:B.videoHeight,durationSeconds:B.duration,advancedSeconds:B.currentTime-C,advancedFrames:B.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),B.pause(),B.currentTime=0,B.muted=q.muted,B.volume=q.volume,B.playbackRate=q.rate,B.preload=q.preload,!B.paused||B.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as gX}from"child_process";import{lstat as uX,realpath as dX}from"fs/promises";import{join as r5,resolve as lX}from"path";import{promisify as pX}from"util";var cX=pX(gX);async function sX($,J){let Z=await dX($),{stdout:Q}=await cX(r5(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return U.array(U.object({browser:U.string(),directory:U.string(),connected:U.boolean().optional(),source:U.string(),socketPath:U.string().optional(),instanceId:U.string().optional(),extensionId:U.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&lX(Y.source)===r5(Z,"Reason Browser Use","manifest.json"))}async function l2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await sX($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await uX(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as aX}from"crypto";function V1($){return`reason-browser-${aX("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var o5=U.discriminatedUnion("ok",[U.object({ok:U.literal(!0),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict(),U.object({ok:U.literal(!1),reason:U.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),e5=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.string(),extensionInstanceId:U.string(),nativeHostName:U.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function j9($){let J=l0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await rX($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${iX()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(H)=>{if(!a1(J,H.owner))throw Z0();await G()},K=async(H)=>{await V(H);let B=await $.readVideo(H.captureId);try{await G();let q=B.capture;if(!a1(q.context.owner,J)||q.captureId!==H.captureId||q.context.prUrl!==H.prUrl||q.context.headSha!==H.headSha||q.media.contentType!=="video/webm"||q.media.sizeBytes!==H.sizeBytes||q.sha256!==H.sha256||B.bytes.length!==H.sizeBytes||B.bytes.length<128||B.bytes.length>10485760||B.bytes.readUInt32BE(0)!==440786851||t5("sha256").update(B.bytes).digest("hex")!==H.sha256)throw Z0();return B}catch(q){throw B.bytes.fill(0),q}};async function N(H,B,q){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new m2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,j=!1,D,O=new Promise((L,W)=>{D=setTimeout(()=>{j=!0,W(Z0())},60000)});O.catch(()=>{});let F=(L)=>Promise.race([L,O]),z=async()=>{if(j)throw Z0();if(await G(),j)throw Z0()};try{await F(T.connect());let L=e5.parse(await F(T.client.getInfo()));if(L.metadata.extensionId!==M.extensionId||L.metadata.extensionInstanceId!==M.instanceId||!L.metadata.nativeHostName)throw Z0();await z(),q?.("connected");let W=T.newTab();W.then((I)=>{if(j)I.close().catch(()=>{Y=!0})},()=>{}),_=await F(W),await z(),await F(_.goto(H,{waitUntil:"domcontentloaded",timeoutMs:15000})),await z(),q?.("loaded");let E=await F(B(_,async(I)=>{await z();let C=await F(_.evaluate(`(${n5.toString()})(${JSON.stringify(I)})`,{awaitPromise:!0}));return await z(),C},z));return await z(),E}finally{j=!0,clearTimeout(D);try{if(_){let L;try{await Promise.race([_.close(),new Promise((W,R)=>{L=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(L)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(H,B,q){let M=K1.parse(H);if(await V(M),!Number.isSafeInteger(B)||B<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();q.throwIfAborted();let T=await Z.discover(q),_=new m2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),j;try{await _.connect();let D=e5.parse(await _.client.getInfo());if(D.metadata.extensionId!==T.extensionId||D.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!U.array(U.object({id:U.number()})).max(256).parse(await _.getTabs()).some((z)=>z.id===B))throw Z0();await G(),q.throwIfAborted();let F=U.object({data:U.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(B,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(j=Buffer.from(F.data,"base64"),j.toString("base64")!==F.data||j.length>8388608)throw Z0();if(await G(),q.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return j}catch{throw j?.fill(0),Z0()}finally{_.close()}},async verifyImages(H){let B=g2(H);if(B.runId!==J.runId||B.media.some((q)=>q.kind!=="image"))throw Z0();return N("about:blank",async(q,M,T)=>{let _=q.browser.client,j=new Set(B.media.map((I)=>I.sourceUrl)),D=new Map,O=new Set,F=!1,z=0,L=!1,W=new Set,R=(I,C)=>{if(W.size>=32){F=!0;return}let h=_.executeCdp(q.id,I,C);W.add(h),h.catch(()=>{F=!0}).finally(()=>W.delete(h))},E=_.onNotification((I)=>{if(I.method!=="onCDPEvent"||!V$(I.params)||!V$(I.params.source)||I.params.source.tabId!==q.id||!V$(I.params.params))return;let C=I.params.params;if(++z>512){F=!0;return}if(I.params.method==="Fetch.requestPaused"){let y=typeof C.requestId==="string"&&V$(C.request)&&C.request.method==="GET"&&typeof C.request.url==="string"&&j.has(C.request.url)&&C.resourceType==="Image";if(typeof C.requestId!=="string"){F=!0;return}if(!y)F=!0;R(y?"Fetch.continueRequest":"Fetch.failRequest",{requestId:C.requestId,...y?{}:{errorReason:"BlockedByClient"}})}if(I.params.method==="Network.requestWillBeSent"&&C.redirectResponse)F=!0;if(I.params.method==="Network.loadingFailed")F=!0;if(I.params.method==="Network.loadingFinished"&&typeof C.requestId==="string")O.add(C.requestId);if(I.params.method!=="Network.responseReceived")return;if(!V$(C.response)||typeof C.response.url!=="string"||!j.has(C.response.url)||typeof C.requestId!=="string"||!V$(C.response.headers)||C.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(C.response.headers).map(([y,l])=>[y.toLowerCase(),l])),S=Number(h["content-length"]);if(D.has(C.response.url)||C.response.status!==200||C.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}D.set(C.response.url,{id:C.requestId,length:S})});try{await _.executeCdp(q.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(q.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(q.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(q.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let I=U.object({frameTree:U.object({frame:U.object({id:U.string().min(1).max(256)})})}).parse(await _.executeCdp(q.id,"Page.getFrameTree",{})),C=[...new Set(B.media.map((y)=>new URL(y.sourceUrl).origin))].join(" ");await _.executeCdp(q.id,"Page.setDocumentContent",{frameId:I.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${C}; style-src 'none'"><body></body>`}),await T(),L=!0;try{await _.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new f0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await q.evaluate(`(${i5})(${JSON.stringify(B.media)})`,{awaitPromise:!0})}catch{throw new f0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!V$(h)||!Array.isArray(h.items)||h.items.length!==B.media.length)throw Z0();await Promise.all(W);let S=[];for(let y=0;y<B.media.length;y++){await G();let l=D.get(B.media[y].sourceUrl);if(F||!l||!O.has(l.id))throw Z0();let k=U.object({base64Encoded:U.literal(!0),body:U.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(q.id,"Network.getResponseBody",{requestId:l.id})),P=Buffer.from(k.body,"base64");try{let x=h.items[y];if(P.length!==l.length||P.toString("base64")!==k.body||!V$(x))throw Z0();S.push({...x,sourceSha256:t5("sha256").update(P).digest("hex")})}finally{P.fill(0)}}if(F)throw Z0();return u5({verified:!0,items:S},B)}finally{if(E(),await Promise.allSettled(W),L)try{await _.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new f0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(H){let B=c1.parse(H);await V(B);let q="browser_unavailable";try{return await N(`https://github.com/${B.repositoryFullName}`,async(M,T)=>{let _=o5.parse(await T({operation:"preflight",expected:{...B,prUrl:`https://github.com/${B.repositoryFullName}`}}));return T9.parse(_.ok?{...B,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...B,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...B,status:"not_ready",reason:_.reason})},(M)=>{q=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return T9.parse({...B,status:"not_ready",reason:"unavailable",cause:q})}},async publish(H){let B=d$.parse(H);if(await V(B),B.expectedActorId!==null&&B.authenticatedActor.id!==B.expectedActorId)throw Z0();let q=Q.get(B.attemptId);if(q){if(!a1(q.binding,B))throw Z0();return structuredClone(q.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(B),result:B1.parse({...B,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(B.attemptId,M);let T=!1,_="dispatch";try{(await K(B)).bytes.fill(0),M.result=await N(B.prUrl,async(j,D)=>{let O=o5.parse(await D({operation:"identity",expected:B}));if(!O.ok)return B1.parse({...B,status:"not_attempted",reason:O.reason});let F=await K(B),z;try{T=!0,z=U.discriminatedUnion("dispatched",[U.object({dispatched:U.literal(!0),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict(),U.object({dispatched:U.literal(!1),reason:U.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await D({operation:"upload",expected:B,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!z.dispatched)return T=!1,B1.parse({...B,status:"not_attempted",reason:z.reason});if(!a1(z.actor,O.actor))throw _="actor_changed",Z0();_="result";let L=performance.now();while(performance.now()-L<30000){let W=await D({operation:"upload_result",expected:{...B,observedActor:O.actor}});if(W!==null){let R=U.object({nativeUrl:U.string(),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict().parse(W);return _="finalize",await G(),B1.parse({...B,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
+`);M.result=B1.parse({...B,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(H){let B=s1.parse(H);await V(B);try{return(await K(B)).bytes.fill(0),await N(B.prUrl,async(q,M)=>{await q.browser.client.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:B});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=_9.parse({...B,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(B).some(([j,D])=>!a1(D,_[j])))throw Z0();return _}finally{await q.browser.client.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return _9.parse({...B,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function rX($,J){let Z=await nX($);return{async discover(Q){let X=await l2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:V1(J.runId)}}import{realpath as _Y}from"fs/promises";var DH=U.object({version:U.literal(1),recording_operation_id:U.string().uuid(),proof_ready:U.literal(!1),acknowledged_at:U.iso.datetime()}).strict(),p2=U.object({action:U.literal("start"),request_id:U.string().uuid(),profile:U.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),$J=U.object({action:U.literal("inspect"),recording_operation_id:U.string().uuid()}).strict(),OH=U.discriminatedUnion("action",[p2,$J]),JJ=U.object({recording_operation_id:U.string().uuid()}).strict(),W9={device_id:U.string().uuid(),root_id:U.string().uuid()},tX=U.discriminatedUnion("action",[p2.extend(W9),$J.extend(W9),JJ.extend({...W9,action:U.literal("stop")})]),zH=U.toJSONSchema(tX),AH=U.object({version:U.literal(1),recordingId:U.string().uuid(),proofReady:U.literal(!1),capture:U.object({captureId:U.string().uuid(),contentType:U.literal("video/webm"),sha256:U.string().regex(/^[a-f0-9]{64}$/),sizeBytes:U.number().int().min(128).max(10485760),startedAt:U.iso.datetime(),finishedAt:U.iso.datetime(),durationSeconds:U.number().min(0.05).max(15),frameCount:U.number().int().min(1).max(450),receivedFrameCount:U.number().int().min(1).max(2000),owner:U.object({runId:U.string().uuid(),deviceId:U.string().uuid(),rootId:U.string().uuid(),rootRevision:U.string().max(64),profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:U.string().min(1).max(1024),generation:U.string().uuid(),browserScope:U.string().max(128),tabId:U.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var kH=p2.extend({action:U.enum(["start","inspect"]),recording_boot_generation:U.string().uuid(),recording_operation_id:U.string().uuid().optional(),recording_attempt_id:U.string().uuid().optional()}).strict();import{createHash as KY,randomUUID as BY}from"crypto";import{mkdtemp as UY,realpath as VY,rm as UJ}from"fs/promises";import{tmpdir as NY}from"os";import{join as qY}from"path";import{spawn as HY}from"child_process";import{isDeepStrictEqual as MY}from"util";import{createHash as oX}from"crypto";import{execFile as eX}from"child_process";import{chmod as $Y,lstat as QJ,mkdtemp as JY,readFile as XJ,realpath as YJ,rm as ZY,writeFile as ZJ}from"fs/promises";import{tmpdir as QY}from"os";import{isAbsolute as XY,join as c2}from"path";import{promisify as YY}from"util";var D9=YY(eX),GY=($)=>oX("sha256").update($).digest("hex");async function o0($){if(!XY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await YJ($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await QJ($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||GY(await XJ($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function i1($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([o0(Z.ffmpeg),o0(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([o0(Z.ffmpeg),o0(Z.ffprobe)]);let G=await YJ(await JY(c2(J??QY(),"reason-owned-recording-")));await $Y(G,448);let V=c2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[j,D]of Q.entries()){let O=`${j}.jpg`;await ZJ(c2(G,O),D.jpeg,{mode:384,flag:"wx"});let F=Q[j+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${O}'`,`duration ${Math.max(0.001,F-D.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await ZJ(c2(G,"frames.ffconcat"),N.join(`
 `)+`
-`,{mode:384,flag:"wx"});let H={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await D9(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],H),K="output";let B=await QJ(V);if(!B.isFile()||B.isSymbolicLink()||B.nlink!==1||B.size<128||B.size>10485760)throw Error();K="probe";let{stdout:q}=await D9(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],H),M=JSON.parse(q),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await D9(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],H),K="pin",await Promise.all([o0(Z.ffmpeg),o0(Z.ffprobe)]),await XJ(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await JY(G,{recursive:!0,force:!0})}}}}var KJ=U.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var e0=U.string().min(1).max(1024),GJ=U.object({path:e0,sha256:U.string().regex(/^[a-f0-9]{64}$/)}).strict(),BJ=U.object({owner:U.object({runId:e0,deviceId:e0,rootId:e0,rootRevision:e0,profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:e0,generation:e0,browserScope:e0,tabId:U.number().int().positive()}).strict(),socketPath:e0,extensionId:U.string().regex(/^[a-p]{32}$/),nativeHostName:e0,seconds:U.number().int().min(1).max(15),encoder:U.object({ffmpeg:GJ,ffprobe:GJ}).strict()}).strict();var MY=15728640,A$=()=>Error("mac_recording_worker_failed");function VJ($){let J=BJ.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,V=async()=>{},K=async(q,M=3000)=>{let T;try{return await Promise.race([q,new Promise((_,j)=>{T=setTimeout(()=>j(A$()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((q)=>{X=!0;let M=q&&typeof q==="object"&&"code"in q?q.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),H=null,B=async()=>{if(X)throw A$();if(await K($.assertCurrent()),X)throw A$()};return{async start(){if(Y||H)throw Error("mac_recording_already_active");Y=!0;try{await B(),await o0({path:Z.path,sha256:Z.sha256}),await B(),G=null;let q=await UY(await BY(NY(VY(),"reason-recording-host-")));try{await B()}catch(P){throw await UJ(q,{recursive:!0,force:!0}),P}let M=qY(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((P)=>M.once("close",()=>P())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(P){if(P.code!=="ESRCH")throw P}},j=null;V=()=>j??=(async()=>{try{_()}catch(P){if(P.code!=="EPERM")throw P}await T;try{for(let P=0;;P++)try{_();break}catch(x){if(x.code!=="EPERM"||P>=20)throw x;await new Promise((A)=>setTimeout(A,25))}}finally{await UJ(q,{recursive:!0,force:!0})}})();let D="",O=0,F=!1,z=!1,L=null,W,R,E=new Promise((P,x)=>{W=P,R=x}),I,C,h=new Promise((P,x)=>{I=P,C=x});h.catch(()=>{});let S=(P=A$())=>{if(F)return;F=!0,clearTimeout(y),clearInterval(k),N().then(()=>{R(P),C(P)},(x)=>{R(x),C(x)})},y=setTimeout(()=>S(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,B().catch(()=>S()).finally(()=>{l=!1})},250);H={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
-`)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(P)=>{if(F)return;if(O+=P.length,O>MY){S();return}D+=P.toString("utf8");let x;while((x=D.indexOf(`
-`))!==-1){let A=D.slice(0,x);D=D.slice(x+1);try{let w=JSON.parse(A);if(w.type==="failed"&&Object.keys(w).sort().join(",")==="reason,type"){let o=KJ.safeParse(w.reason);S(o.success?Error(`mac_recording_worker_failed:${o.data}`):A$());return}if(w.type==="unsupported"&&!z){S(Error("mac_recording_encoder_unavailable"));return}if(w.type==="started"&&!z&&Object.keys(w).length===1){z=!0,W({recording:!0});continue}if(!z||w.type!=="capture"||L||Object.keys(w).sort().join(",")!=="bytes,capture,type")throw A$();let b=w.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!HY(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof w.bytes!=="string"||w.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(w.bytes))throw A$();let n=Buffer.from(w.bytes,"base64");if(n.length!==b.sizeBytes||GY("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw A$();L={capture:Object.freeze({...b,captureId:KY(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(P)=>{if(F)return;if(P!==0||!L||D.trim()){S();return}let x=L;B().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(y),clearInterval(k),Q.set(x.capture.captureId,x);while(Q.size>2)Q.delete(Q.keys().next().value);I(x.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:q})+`
-`);try{return await E}catch(P){throw H=null,P}}finally{Y=!1}},async completed(){if(await B(),!H)throw Error("mac_recording_not_active");return H.completion},async stop(){await B();let q=H;if(!q)throw Error("mac_recording_not_started");q.stop();try{return await q.completion}finally{if(H===q)H=null}},async read(q){await B();let M=Q.get(q);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let q=H;q?.cancel(),Q.clear();try{await N(),await q?.completion.catch(()=>{})}finally{H=null}}}}var NJ=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.string(),extensionInstanceId:U.string(),nativeHostName:U.string()})});async function O9($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await TY($.automationDirectory);J=(Q,X)=>l2(Z,Q,X)}if(await o0({path:$.worker.path,sha256:$.worker.sha256}),!await i1($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),V=new z$({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=NJ.parse(await V.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!U.array(U.object({id:U.number()})).parse(await V.getTabs()).some((H)=>H.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:G.instanceId,async createHost(N,H,B){let q=new z$({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return VJ({worker:$.worker,configuration:{owner:N.browser,seconds:H,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){B.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await q.connect();let T=NJ.parse(await q.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await q.executeCdp(Q,"Page.stopScreencast",{})}finally{q.close()}}})}}}}var O0=()=>Error("mac_pr_proof_unavailable"),LY=U.object({operationId:U.string().uuid()}).strict();function HJ($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=U.array(U.object({profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:U.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!U.string().uuid().safeParse($.generation).success||new Set(Z.map((q)=>q.profile)).size!==Z.length)throw O0();if(!$.qualifiedProfiles){let q=new URL($.uploadOrigin);if(!$.resolveBrowser||q.protocol!=="https:"||q.origin!==$.uploadOrigin||q.username||q.password)throw O0()}let Q=new Map,X=new Map,Y=new Map,G=!1,V=new _Y,K=async(q)=>{let M=V.getStore();if(G||!q&&!M)throw O0();if(M?.signal.throwIfAborted(),await $.assertCurrent(q??M.claim),G)throw O0();M?.signal.throwIfAborted()},N=(q,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(q.capability!==H9||!q.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==q.owner.organization_id||T.userId!==q.owner.user_id||T.deviceId!==q.owner.device_id||T.rootId!==q.root_id||T.runId!==q.run_id)throw O0();return T},H=async(q)=>{await K();let M=JSON.stringify([q.runId,q.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw O0();T=(async()=>{let j,D=$.browserScope?.(q)??V1(q.runId),O=await $.createBrowser({owner:q,assertCurrent:()=>K(),readVideo:(F)=>j.publicationCapture(F)});if(j=a5({owner:q,browserScope:D,assertCurrent:()=>K(),screenshot:O.screenshot,async createVideo(F,z,L,W){if(!$.resolveBrowser)throw O0();let R=await $.resolveBrowser(q.profile,z,D,W);if(R.extensionInstanceId!==q.extensionInstanceId)throw O0();return R.createHost({organizationId:q.organizationId,userId:q.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:q.runId,deviceId:q.deviceId,rootId:q.rootId,rootRevision:q.rootRevision,generation:q.generation,profile:q.profile,extensionInstanceId:q.extensionInstanceId,browserScope:D,tabId:z}},L,W)}}),G)throw O.close(),await j.close(),O0();return{owner:structuredClone(q),browser:O,capture:j,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!qJ(_.owner,q)||_.expiresAt<=Date.now())throw O0();return _},B=setInterval(()=>{for(let[q,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(q)===M)Q.delete(q)}).catch(()=>{G=!0})},1000);return B.unref(),{generation:$.generation,async execute(q,M,T){return V.run({claim:q,signal:M},async()=>{let _=F9.parse(q.payload).command,j=N(q,_);if(await K(q),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let D=await H(j),O=async()=>{await K(q),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await D.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw O0();F=await D.capture.prepare(_.context);break;case"capture_png":F=await D.capture.screenshot({claim:{operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let z={runtime:D,contextId:_.contextId,attemptId:q.attempt_id,tabId:_.tabId,signal:M};if(X.has(q.operation_id))throw O0();X.set(q.operation_id,z);try{F=await D.capture.record({claim:{operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await O(),await T({version:1,operationId:q.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(q.operation_id)}break}case"inspect_capture":F=await D.capture.inspect(_.captureId);break;case"publish_video":F=await D.browser.publish(_.input);break;case"verify_saved_media":F=await D.browser.verify(_.input);break;case"verify_png_media":F=await D.browser.verifyImages(_.media);break;case"publish_png":{let z=`${j.runId}:${_.attemptId}`,L=Y.get(z);if(L){if(!qJ(L.request,_))throw O0();F=L.result;break}if(Y.size>=16)throw O0();let W=new URL(_.uploadUrl);if(W.protocol!=="https:"||W.username||W.password||W.hash||W.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${j.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw O0();let R=await D.capture.publicationCapture(_.captureId);try{if(W.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||FY("sha256").update(R.bytes).digest("hex")!==_.sha256)throw O0();await O();let E={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(z,E);try{let I=await fetch(W,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await I.body?.cancel(),await O(),I.ok)E.result={...E.result,status:"uploaded"}}catch{}F=E.result}finally{R.bytes.fill(0)}break}}return await O(),structuredClone(F)})},async control(q,M){if(q.capability!==H9||M.kind!==c5)return!1;let T=LY.safeParse(M.payload),_=X.get(q.operation_id);if(!T.success||T.data.operationId!==q.operation_id||!_||_.attemptId!==q.attempt_id)return!1;let j=F9.parse(q.payload).command;return N(q,j),await K(q),await V.run({claim:q,signal:_.signal},()=>_.runtime.capture.stop({operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(B);let q=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),q.some((M)=>M.status==="rejected"))throw O0()}}}var IY="__browser-recorder",CY=RY(jY),PY="/tmp/open-browser-use",EY=33554432,xY=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.literal(s2),extensionInstanceId:U.string().min(1).max(1024)})}),TJ=()=>Error("worker_pr_proof_browser_unavailable"),I9={components:l1,ensureBrowser:jJ,socketDirectory:PY,async identity($){let J=new z$({socketPath:$,sessionId:`reason-proof-qualification-${R9()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function _J($,J=I9){let Z=J.components();if(!Z?.features.browser)throw TJ();await J.ensureBrowser(Z),$.throwIfAborted();let Q=z9(WJ(Z),"Default","Local Extension Settings",s2),X=(await MJ(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>z9(Q,Y));for(let Y of(await MJ(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=z9(J.socketDirectory,Y);try{let V=await DY(G);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=xY.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await zY(N)).size<=EY&&(await DJ(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:s2}}catch{}}throw TJ()}async function A9($){let J=await OY($);return{path:J,sha256:WY("sha256").update(await DJ(J)).digest("hex")}}async function OJ($={}){let J={...I9,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await A9(Z.ffmpeg),{stdout:X}=await CY(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await A9(Z.ffprobe)};if(!await i1(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...AY(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],IY]};return{worker:{...await A9(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function zJ($,J={}){let Z={...I9,...J},Q=R9(),X=R9(),Y=FJ.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?LJ.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(B)=>m5(B.organizationId,B.sessionId,B.deviceId,1),K=$.recording,N,H=HJ({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(B,q,M,T)=>{N??=O9({...K,assertCurrent:()=>$.assertCurrent(),discover:(j,D)=>_J(D,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(B,q,M,T);return{extensionInstanceId:X,createHost:async(j,D,O)=>SY(await _.createHost({...j,browser:{...j.browser,extensionInstanceId:_.extensionInstanceId}},D,O),X)}}}:{},createBrowser:(B)=>j9({...B,endpoint:(q)=>({discover:(M)=>_J(M,Z),tabScope:V(q)})})});return{capability:G,broker:H}}function SY($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as iY}from"child_process";import{execFile as bY}from"child_process";import{readFile as wY}from"fs/promises";import{join as i0}from"path";var kY="Claude Code-credentials",yY="/usr/bin/security",fY=120000,hY=8192,a2={exec:($,J,Z)=>new Promise((Q)=>{bY($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await wY($,"utf8")}catch{return null}}};function N1($){return typeof $==="string"&&$.length>0&&$.length<=hY?$:null}function mY($,J){return $.CLAUDE_CONFIG_DIR||i0(J,".claude")}function vY($,J){return $.CODEX_HOME||i0(J,".codex")}function AJ($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=N1(J?.accessToken),Q=N1(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function gY($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function uY($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=N1(J.tokens?.access_token),Q=N1(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:gY(Z)??Date.now()}}catch{return null}}function dY($,J){return i0($.XDG_DATA_HOME||i0(J,".local","share"),"opencode","auth.json")}var lY={anthropic:"anthropic",openai:"openai-codex"};function pY($){return PJ($,lY)}function PJ($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let V=N1(G.access),K=N1(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function cY($){return PJ($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function sY($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?i0(J,Z.slice(2)):Z||i0(J,".pi","agent")}async function EJ($,J,Z=a2){let Q=[],X=await Z.exec(yY,["find-generic-password","-s",kY,"-w"],fY),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((H)=>H.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?AJ(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(AJ(await Z.readText(i0(mY($,J),".credentials.json"))));let V=uY(await Z.readText(i0(vY($,J),"auth.json")));G(V),G(aY(await Z.readText(i0($.GROK_HOME||i0(J,".grok"),"auth.json"))));for(let K of pY(await Z.readText(dY($,J))))G(K);for(let K of cY(await Z.readText(i0(sY($,J),"auth.json"))))G(K);return Q}function xJ($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var RJ="https://auth.x.ai",IJ="b1a00492-073a-47ea-816f-4c329264a828",CJ=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function aY($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${RJ}::${IJ}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==RJ||Q.oidc_client_id!==IJ||!CJ(Q.key)||!CJ(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var SJ=330000,nY=300000,rY=60000;function tY($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+SJ)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function oY($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*SJ)?rY:nY}var eY=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function bJ($){let J=new Map,Z=$.wait??eY,Q=$.stores??(process.platform==="darwin"?a2:{...a2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=xJ(await EJ($.environment??process.env,$.home,Q));for(let Y of tY(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(oY(J),$.signal)}}function wJ($=process.env){return new Promise((J)=>{iY("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as $G,spawn as JT,spawnSync as ZT}from"child_process";import{chmodSync as XT,existsSync as JG,mkdirSync as YT,readFileSync as GT,renameSync as KT,rmSync as BT,statSync as UT,writeFileSync as VT}from"fs";import{dirname as qT,isAbsolute as HT,join as C9}from"path";var kJ=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function yJ($,J){if(!kJ.test($)||!kJ.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var ZG="com.reasonmachines.updater",QG=["so.ara.updater","so.reason.updater"];function XG($){let J=$==="staging"?".staging":"";return{label:`${ZG}${J}`,legacyLabels:[...QG].reverse().map((Z)=>`${Z}${J}`)}}function YG($,J,Z){return{launchAgent:C9(J,"Library","LaunchAgents",`${$}.plist`),systemdService:C9(Z,"systemd","user",`${$}.service`),systemdTimer:C9(Z,"systemd","user",`${$}.timer`)}}function GG($,J){return new Promise((Z)=>{$G($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function mJ($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??B0(),{label:X,legacyLabels:Y}=XG($.channel),G=$.configHome??hJ(Q),V=[X,...Y].filter((B)=>{let q=YG(B,Q,G);return JG(J==="darwin"?q.launchAgent:q.systemdService)});if(V.length===0)return"absent";let K=$.command??GG,N=V[0];if(V.length>1){for(let B of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${B}`]):await K("systemctl",["--user","is-enabled",`${B}.timer`]))===0){N=B;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var fJ=60000;function vJ($){let J=(X,Y)=>{try{return yJ(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(fJ-1,Math.floor(G*fJ)))}}var KG=30000;async function gJ($){return($.flush??n4)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(KG);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof T0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var dJ=25000,UG=5000,VG=600000,NG=["display.stream.v1","pty.start"];function x9($,J,Z=b9($),Q){return v0(),X6(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var lJ=5000,qG=600000;function HG($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[p$])return null;try{return W2({platform:J})}catch{return null}}function MG($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function TG($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=B9();if(Z.length>0)k1($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)k1($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function t1($,J,Z,Q,X={}){if(v0(),$.executionMode==="host")r1();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?Z6():Promise.resolve(!1),H=tJ(),B=X.prestartedReadiness??d1($,X.readinessProbes,V,J.roots[0].permissions),q=X.deferOptionalLanes===!0,M=await(q?B.initial:B.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??wJ)().catch(()=>!1):null,j=new AbortController,D=null,O=async(f,a)=>{let i=($.userChrome??X.ownComputer===!0)&&f["automation.call.v1"]===!0?J6():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
+`,{mode:384,flag:"wx"});let H={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await D9(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],H),K="output";let B=await QJ(V);if(!B.isFile()||B.isSymbolicLink()||B.nlink!==1||B.size<128||B.size>10485760)throw Error();K="probe";let{stdout:q}=await D9(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],H),M=JSON.parse(q),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await D9(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],H),K="pin",await Promise.all([o0(Z.ffmpeg),o0(Z.ffprobe)]),await XJ(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await ZY(G,{recursive:!0,force:!0})}}}}var KJ=U.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var e0=U.string().min(1).max(1024),GJ=U.object({path:e0,sha256:U.string().regex(/^[a-f0-9]{64}$/)}).strict(),BJ=U.object({owner:U.object({runId:e0,deviceId:e0,rootId:e0,rootRevision:e0,profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:e0,generation:e0,browserScope:e0,tabId:U.number().int().positive()}).strict(),socketPath:e0,extensionId:U.string().regex(/^[a-p]{32}$/),nativeHostName:e0,seconds:U.number().int().min(1).max(15),encoder:U.object({ffmpeg:GJ,ffprobe:GJ}).strict()}).strict();var TY=15728640,A$=()=>Error("mac_recording_worker_failed");function VJ($){let J=BJ.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,V=async()=>{},K=async(q,M=3000)=>{let T;try{return await Promise.race([q,new Promise((_,j)=>{T=setTimeout(()=>j(A$()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((q)=>{X=!0;let M=q&&typeof q==="object"&&"code"in q?q.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),H=null,B=async()=>{if(X)throw A$();if(await K($.assertCurrent()),X)throw A$()};return{async start(){if(Y||H)throw Error("mac_recording_already_active");Y=!0;try{await B(),await o0({path:Z.path,sha256:Z.sha256}),await B(),G=null;let q=await VY(await UY(qY(NY(),"reason-recording-host-")));try{await B()}catch(P){throw await UJ(q,{recursive:!0,force:!0}),P}let M=HY(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((P)=>M.once("close",()=>P())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(P){if(P.code!=="ESRCH")throw P}},j=null;V=()=>j??=(async()=>{try{_()}catch(P){if(P.code!=="EPERM")throw P}await T;try{for(let P=0;;P++)try{_();break}catch(x){if(x.code!=="EPERM"||P>=20)throw x;await new Promise((A)=>setTimeout(A,25))}}finally{await UJ(q,{recursive:!0,force:!0})}})();let D="",O=0,F=!1,z=!1,L=null,W,R,E=new Promise((P,x)=>{W=P,R=x}),I,C,h=new Promise((P,x)=>{I=P,C=x});h.catch(()=>{});let S=(P=A$())=>{if(F)return;F=!0,clearTimeout(y),clearInterval(k),N().then(()=>{R(P),C(P)},(x)=>{R(x),C(x)})},y=setTimeout(()=>S(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,B().catch(()=>S()).finally(()=>{l=!1})},250);H={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
+`)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(P)=>{if(F)return;if(O+=P.length,O>TY){S();return}D+=P.toString("utf8");let x;while((x=D.indexOf(`
+`))!==-1){let A=D.slice(0,x);D=D.slice(x+1);try{let w=JSON.parse(A);if(w.type==="failed"&&Object.keys(w).sort().join(",")==="reason,type"){let o=KJ.safeParse(w.reason);S(o.success?Error(`mac_recording_worker_failed:${o.data}`):A$());return}if(w.type==="unsupported"&&!z){S(Error("mac_recording_encoder_unavailable"));return}if(w.type==="started"&&!z&&Object.keys(w).length===1){z=!0,W({recording:!0});continue}if(!z||w.type!=="capture"||L||Object.keys(w).sort().join(",")!=="bytes,capture,type")throw A$();let b=w.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!MY(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof w.bytes!=="string"||w.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(w.bytes))throw A$();let n=Buffer.from(w.bytes,"base64");if(n.length!==b.sizeBytes||KY("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw A$();L={capture:Object.freeze({...b,captureId:BY(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(P)=>{if(F)return;if(P!==0||!L||D.trim()){S();return}let x=L;B().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(y),clearInterval(k),Q.set(x.capture.captureId,x);while(Q.size>2)Q.delete(Q.keys().next().value);I(x.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:q})+`
+`);try{return await E}catch(P){throw H=null,P}}finally{Y=!1}},async completed(){if(await B(),!H)throw Error("mac_recording_not_active");return H.completion},async stop(){await B();let q=H;if(!q)throw Error("mac_recording_not_started");q.stop();try{return await q.completion}finally{if(H===q)H=null}},async read(q){await B();let M=Q.get(q);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let q=H;q?.cancel(),Q.clear();try{await N(),await q?.completion.catch(()=>{})}finally{H=null}}}}var NJ=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.string(),extensionInstanceId:U.string(),nativeHostName:U.string()})});async function O9($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await _Y($.automationDirectory);J=(Q,X)=>l2(Z,Q,X)}if(await o0({path:$.worker.path,sha256:$.worker.sha256}),!await i1($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),V=new z$({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=NJ.parse(await V.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!U.array(U.object({id:U.number()})).parse(await V.getTabs()).some((H)=>H.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:G.instanceId,async createHost(N,H,B){let q=new z$({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return VJ({worker:$.worker,configuration:{owner:N.browser,seconds:H,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){B.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await q.connect();let T=NJ.parse(await q.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await q.executeCdp(Q,"Page.stopScreencast",{})}finally{q.close()}}})}}}}var O0=()=>Error("mac_pr_proof_unavailable"),jY=U.object({operationId:U.string().uuid()}).strict();function HJ($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=U.array(U.object({profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:U.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!U.string().uuid().safeParse($.generation).success||new Set(Z.map((q)=>q.profile)).size!==Z.length)throw O0();if(!$.qualifiedProfiles){let q=new URL($.uploadOrigin);if(!$.resolveBrowser||q.protocol!=="https:"||q.origin!==$.uploadOrigin||q.username||q.password)throw O0()}let Q=new Map,X=new Map,Y=new Map,G=!1,V=new FY,K=async(q)=>{let M=V.getStore();if(G||!q&&!M)throw O0();if(M?.signal.throwIfAborted(),await $.assertCurrent(q??M.claim),G)throw O0();M?.signal.throwIfAborted()},N=(q,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(q.capability!==H9||!q.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==q.owner.organization_id||T.userId!==q.owner.user_id||T.deviceId!==q.owner.device_id||T.rootId!==q.root_id||T.runId!==q.run_id)throw O0();return T},H=async(q)=>{await K();let M=JSON.stringify([q.runId,q.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw O0();T=(async()=>{let j,D=$.browserScope?.(q)??V1(q.runId),O=await $.createBrowser({owner:q,assertCurrent:()=>K(),readVideo:(F)=>j.publicationCapture(F)});if(j=a5({owner:q,browserScope:D,assertCurrent:()=>K(),screenshot:O.screenshot,async createVideo(F,z,L,W){if(!$.resolveBrowser)throw O0();let R=await $.resolveBrowser(q.profile,z,D,W);if(R.extensionInstanceId!==q.extensionInstanceId)throw O0();return R.createHost({organizationId:q.organizationId,userId:q.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:q.runId,deviceId:q.deviceId,rootId:q.rootId,rootRevision:q.rootRevision,generation:q.generation,profile:q.profile,extensionInstanceId:q.extensionInstanceId,browserScope:D,tabId:z}},L,W)}}),G)throw O.close(),await j.close(),O0();return{owner:structuredClone(q),browser:O,capture:j,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!qJ(_.owner,q)||_.expiresAt<=Date.now())throw O0();return _},B=setInterval(()=>{for(let[q,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(q)===M)Q.delete(q)}).catch(()=>{G=!0})},1000);return B.unref(),{generation:$.generation,async execute(q,M,T){return V.run({claim:q,signal:M},async()=>{let _=F9.parse(q.payload).command,j=N(q,_);if(await K(q),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let D=await H(j),O=async()=>{await K(q),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await D.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw O0();F=await D.capture.prepare(_.context);break;case"capture_png":F=await D.capture.screenshot({claim:{operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let z={runtime:D,contextId:_.contextId,attemptId:q.attempt_id,tabId:_.tabId,signal:M};if(X.has(q.operation_id))throw O0();X.set(q.operation_id,z);try{F=await D.capture.record({claim:{operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await O(),await T({version:1,operationId:q.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(q.operation_id)}break}case"inspect_capture":F=await D.capture.inspect(_.captureId);break;case"publish_video":F=await D.browser.publish(_.input);break;case"verify_saved_media":F=await D.browser.verify(_.input);break;case"verify_png_media":F=await D.browser.verifyImages(_.media);break;case"publish_png":{let z=`${j.runId}:${_.attemptId}`,L=Y.get(z);if(L){if(!qJ(L.request,_))throw O0();F=L.result;break}if(Y.size>=16)throw O0();let W=new URL(_.uploadUrl);if(W.protocol!=="https:"||W.username||W.password||W.hash||W.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${j.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw O0();let R=await D.capture.publicationCapture(_.captureId);try{if(W.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||LY("sha256").update(R.bytes).digest("hex")!==_.sha256)throw O0();await O();let E={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(z,E);try{let I=await fetch(W,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await I.body?.cancel(),await O(),I.ok)E.result={...E.result,status:"uploaded"}}catch{}F=E.result}finally{R.bytes.fill(0)}break}}return await O(),structuredClone(F)})},async control(q,M){if(q.capability!==H9||M.kind!==c5)return!1;let T=jY.safeParse(M.payload),_=X.get(q.operation_id);if(!T.success||T.data.operationId!==q.operation_id||!_||_.attemptId!==q.attempt_id)return!1;let j=F9.parse(q.payload).command;return N(q,j),await K(q),await V.run({claim:q,signal:_.signal},()=>_.runtime.capture.stop({operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(B);let q=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),q.some((M)=>M.status==="rejected"))throw O0()}}}var CY="__browser-recorder",PY=IY(WY),EY="/tmp/open-browser-use",xY=33554432,SY=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.literal(s2),extensionInstanceId:U.string().min(1).max(1024)})}),TJ=()=>Error("worker_pr_proof_browser_unavailable"),I9={components:l1,ensureBrowser:jJ,socketDirectory:EY,async identity($){let J=new z$({socketPath:$,sessionId:`reason-proof-qualification-${R9()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function _J($,J=I9){let Z=J.components();if(!Z?.features.browser)throw TJ();await J.ensureBrowser(Z),$.throwIfAborted();let Q=z9(WJ(Z),"Default","Local Extension Settings",s2),X=(await MJ(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>z9(Q,Y));for(let Y of(await MJ(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=z9(J.socketDirectory,Y);try{let V=await OY(G);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=SY.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await AY(N)).size<=xY&&(await DJ(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:s2}}catch{}}throw TJ()}async function A9($){let J=await zY($);return{path:J,sha256:DY("sha256").update(await DJ(J)).digest("hex")}}async function OJ($={}){let J={...I9,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await A9(Z.ffmpeg),{stdout:X}=await PY(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await A9(Z.ffprobe)};if(!await i1(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...RY(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],CY]};return{worker:{...await A9(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function zJ($,J={}){let Z={...I9,...J},Q=R9(),X=R9(),Y=FJ.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?LJ.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(B)=>m5(B.organizationId,B.sessionId,B.deviceId,1),K=$.recording,N,H=HJ({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(B,q,M,T)=>{N??=O9({...K,assertCurrent:()=>$.assertCurrent(),discover:(j,D)=>_J(D,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(B,q,M,T);return{extensionInstanceId:X,createHost:async(j,D,O)=>bY(await _.createHost({...j,browser:{...j.browser,extensionInstanceId:_.extensionInstanceId}},D,O),X)}}}:{},createBrowser:(B)=>j9({...B,endpoint:(q)=>({discover:(M)=>_J(M,Z),tabScope:V(q)})})});return{capability:G,broker:H}}function bY($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as nY}from"child_process";import{execFile as wY}from"child_process";import{readFile as kY}from"fs/promises";import{join as i0}from"path";var yY="Claude Code-credentials",fY="/usr/bin/security",hY=120000,mY=8192,a2={exec:($,J,Z)=>new Promise((Q)=>{wY($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await kY($,"utf8")}catch{return null}}};function N1($){return typeof $==="string"&&$.length>0&&$.length<=mY?$:null}function vY($,J){return $.CLAUDE_CONFIG_DIR||i0(J,".claude")}function gY($,J){return $.CODEX_HOME||i0(J,".codex")}function AJ($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=N1(J?.accessToken),Q=N1(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function uY($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function dY($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=N1(J.tokens?.access_token),Q=N1(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:uY(Z)??Date.now()}}catch{return null}}function lY($,J){return i0($.XDG_DATA_HOME||i0(J,".local","share"),"opencode","auth.json")}var pY={anthropic:"anthropic",openai:"openai-codex"};function cY($){return PJ($,pY)}function PJ($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let V=N1(G.access),K=N1(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function sY($){return PJ($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function aY($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?i0(J,Z.slice(2)):Z||i0(J,".pi","agent")}async function EJ($,J,Z=a2){let Q=[],X=await Z.exec(fY,["find-generic-password","-s",yY,"-w"],hY),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((H)=>H.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?AJ(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(AJ(await Z.readText(i0(vY($,J),".credentials.json"))));let V=dY(await Z.readText(i0(gY($,J),"auth.json")));G(V),G(iY(await Z.readText(i0($.GROK_HOME||i0(J,".grok"),"auth.json"))));for(let K of cY(await Z.readText(lY($,J))))G(K);for(let K of sY(await Z.readText(i0(aY($,J),"auth.json"))))G(K);return Q}function xJ($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var RJ="https://auth.x.ai",IJ="b1a00492-073a-47ea-816f-4c329264a828",CJ=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function iY($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${RJ}::${IJ}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==RJ||Q.oidc_client_id!==IJ||!CJ(Q.key)||!CJ(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var SJ=330000,rY=300000,tY=60000;function oY($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+SJ)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function eY($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*SJ)?tY:rY}var $G=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function bJ($){let J=new Map,Z=$.wait??$G,Q=$.stores??(process.platform==="darwin"?a2:{...a2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=xJ(await EJ($.environment??process.env,$.home,Q));for(let Y of oY(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(eY(J),$.signal)}}function wJ($=process.env){return new Promise((J)=>{nY("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as JG,spawn as ZT,spawnSync as QT}from"child_process";import{chmodSync as YT,existsSync as ZG,mkdirSync as GT,readFileSync as KT,renameSync as BT,rmSync as UT,statSync as VT,writeFileSync as NT}from"fs";import{dirname as HT,isAbsolute as MT,join as C9}from"path";var kJ=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function yJ($,J){if(!kJ.test($)||!kJ.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var QG="com.reasonmachines.updater",XG=["so.ara.updater","so.reason.updater"];function YG($){let J=$==="staging"?".staging":"";return{label:`${QG}${J}`,legacyLabels:[...XG].reverse().map((Z)=>`${Z}${J}`)}}function GG($,J,Z){return{launchAgent:C9(J,"Library","LaunchAgents",`${$}.plist`),systemdService:C9(Z,"systemd","user",`${$}.service`),systemdTimer:C9(Z,"systemd","user",`${$}.timer`)}}function KG($,J){return new Promise((Z)=>{JG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function mJ($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??B0(),{label:X,legacyLabels:Y}=YG($.channel),G=$.configHome??hJ(Q),V=[X,...Y].filter((B)=>{let q=GG(B,Q,G);return ZG(J==="darwin"?q.launchAgent:q.systemdService)});if(V.length===0)return"absent";let K=$.command??KG,N=V[0];if(V.length>1){for(let B of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${B}`]):await K("systemctl",["--user","is-enabled",`${B}.timer`]))===0){N=B;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var fJ=60000;function vJ($){let J=(X,Y)=>{try{return yJ(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(fJ-1,Math.floor(G*fJ)))}}var BG=30000;async function gJ($){return($.flush??n4)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(BG);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof T0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var dJ=25000,VG=5000,NG=600000,qG=["display.stream.v1","pty.start"];function x9($,J,Z=b9($),Q){return v0(),X6(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var lJ=5000,HG=600000;function MG($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[p$])return null;try{return W2({platform:J})}catch{return null}}function TG($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function _G($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=B9();if(Z.length>0)k1($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)k1($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function t1($,J,Z,Q,X={}){if(v0(),$.executionMode==="host")r1();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?Z6():Promise.resolve(!1),H=tJ(),B=X.prestartedReadiness??d1($,X.readinessProbes,V,J.roots[0].permissions),q=X.deferOptionalLanes===!0,M=await(q?B.initial:B.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??wJ)().catch(()=>!1):null,j=new AbortController,D=null,O=async(f,a)=>{let i=($.userChrome??X.ownComputer===!0)&&f["automation.call.v1"]===!0?J6():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
 `);let K0=b9($,f,{displayVideo:f["display.stream.v1"]===!0&&await N(),handsBrowser:f["hands.connect"]===!0&&H,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:f["pty.start"]===!0&&h2(),probing:a});if(!D&&K0.worker.readiness?.["browser.pr-proof.v1"]===!0){let z0=await OJ();if(D||j.signal.aborted)return K0;process.stderr.write("error"in z0?`Reason worker: PR video proof unavailable (${z0.error})
 `:`Reason worker: PR video proof ready (ffmpeg ${z0.encoder.ffmpeg.path})
-`),D=zJ({assertCurrent:async()=>{if(!k())throw Error("proof_authority_lost")},...!("error"in z0)?{recording:z0}:{}})}return K0},F=await O(M,q?U9.filter((f)=>M[f]!==!0):[]),z=x9($,J,F,D?.capability);X.onStartup?.("inventory_completed");let L=!1,W=0,R=0,E="starting",I=null,C=!1,h=!1,S=null,y,l=()=>!G.drained&&Date.parse(Y)>Date.now()&&z.supported_operations.some((f)=>F.worker.readiness?.[f]===!0),k=()=>!L&&l(),P=null,x=()=>W+(P?.claims()??0),A=null,w=new Set,b=(f)=>{let a=f.capabilities.root_paths;if(Object.assign(f.capabilities,x9(f.config,f.state,F,D?.capability)),a)f.capabilities.root_paths=a},n=(f)=>{F=f,b({config:$,state:J,capabilities:z}),A?.();for(let a of w)b(a),a.heartbeatNow?.()},o=new Set,V0=new Set,W0=setInterval(()=>{let f=new Set;for(let a of[{state:J,capabilities:z},...w])for(let q0 of NG){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let K0=`${a.state.deviceId} ${q0}`;if(f.add(K0),!o.has(K0)||V0.has(K0))continue;V0.add(K0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
-`)}o.clear();for(let a of f)o.add(a)},VG);W0.unref();let H$=(f)=>{if(!X.readinessProbes)P5({config:$,readiness:f,signal:j.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(a)=>{O(a,[]).then(n)}})},M$=q?B.final.then(async(f)=>{if(j.signal.aborted)return;n(await O(f,[]));let a=U9.filter((q0)=>f[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
+`),D=zJ({assertCurrent:async()=>{if(!k())throw Error("proof_authority_lost")},...!("error"in z0)?{recording:z0}:{}})}return K0},F=await O(M,q?U9.filter((f)=>M[f]!==!0):[]),z=x9($,J,F,D?.capability);X.onStartup?.("inventory_completed");let L=!1,W=0,R=0,E="starting",I=null,C=!1,h=!1,S=null,y,l=()=>!G.drained&&Date.parse(Y)>Date.now()&&z.supported_operations.some((f)=>F.worker.readiness?.[f]===!0),k=()=>!L&&l(),P=null,x=()=>W+(P?.claims()??0),A=null,w=new Set,b=(f)=>{let a=f.capabilities.root_paths;if(Object.assign(f.capabilities,x9(f.config,f.state,F,D?.capability)),a)f.capabilities.root_paths=a},n=(f)=>{F=f,b({config:$,state:J,capabilities:z}),A?.();for(let a of w)b(a),a.heartbeatNow?.()},o=new Set,V0=new Set,W0=setInterval(()=>{let f=new Set;for(let a of[{state:J,capabilities:z},...w])for(let q0 of qG){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let K0=`${a.state.deviceId} ${q0}`;if(f.add(K0),!o.has(K0)||V0.has(K0))continue;V0.add(K0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
+`)}o.clear();for(let a of f)o.add(a)},NG);W0.unref();let H$=(f)=>{if(!X.readinessProbes)P5({config:$,readiness:f,signal:j.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(a)=>{O(a,[]).then(n)}})},M$=q?B.final.then(async(f)=>{if(j.signal.aborted)return;n(await O(f,[]));let a=U9.filter((q0)=>f[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
 `),H$(f)},()=>{}):Promise.resolve();if(!q)H$(M);_?.then(async(f)=>{T=f;for(;;){let a=F,q0=await O(a.worker.readiness??{},a.worker.probing??[]);if(j.signal.aborted)return;if(F!==a)continue;n(q0);return}});let j1=q&&F.worker.probing?.includes("pty.start")?B.pty.then(async(f)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(j.signal.aborted||!a())return;let q0=await O({...F.worker.readiness,"pty.start":f},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(j.signal.aborted||!a())return;n(q0)},()=>{}):Promise.resolve(),P$=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:E,drained:G.drained||L||C,activeClaims:x(),activeSessions:R,lastHeartbeat:I,expiresAt:Y,supportedOperations:[...z.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:k()&&!C&&E==="running"}),a$=!1,T$=()=>{a$=!0,Q$()},Q$=()=>{if(L)return;if(L=!0,E="stopping",S?.close(),x()===0)j.abort();else y=setTimeout(()=>j.abort(),$.shutdownGraceMs)},E$=$.channel==="production"||$.channel==="staging"?$.channel:null,X$=d($).releaseCheck,v=X.publishedRelease??(E$&&$.lifetime==="persistent"?vJ({currentVersion:r,signal:j.signal,actedOn:(()=>{try{let f=JSON.parse(s(X$));return typeof f==="string"?f:null}catch{return null}})(),check:async(f)=>{try{c(X$,f)}catch{}let a=await mJ({channel:E$});process.stderr.write(a==="started"?`Reason worker: CLI ${f} is published; the updater is checking now.
 `:a==="absent"?`Reason worker: CLI ${f} is published; no updater is installed for it here.
 `:`Reason worker: CLI ${f} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),X0=(f)=>{if(f==="stop")T$();if(f==="reload_roots"){let a=t($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=Q6(J.roots,uJ());if(q0)z.root_paths=q0;else delete z.root_paths;P?.check()}if(f==="drain"||f==="resume"){if(L||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:f==="drain"},I0($,G)}return P$()};X.prestartedControl?.handle(X0);let x$=X.prestartedControl?await X.prestartedControl.closed:await x2($,Q,X0),Y$,S$=!1,h0=()=>{let f=Date.parse(Y)-Date.now();if(f>0){Y$=setTimeout(h0,Math.min(f,2147483647));return}L=!0,S?.close(),S$=!0,E="stopping",j.abort(Error("worker_credential_expired"))};h0(),X.signal?.addEventListener("abort",Q$,{once:!0});let W1=X.processSignals!==!1;if(W1)process.once("SIGTERM",Q$),process.once("SIGINT",T$);if(X.signal?.aborted)Q$();try{X.onStartup?.("control_ready");let f=X.client??new n1(O$($.apiOrigin),S0($.proxy,pJ()),Z,{deviceSession:t3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=L3($,J.deviceId),i=X.startupTiming,K0=i?()=>({...i(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,z0=(m)=>{let p0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&p0)(X.handOverLocalLogins??bJ)({state:m.state,client:{localSubscription:p0},signal:m.signal,home:B0()}).catch(()=>{return});let F0=uJ(),x0=m.client.liveSessionWorktrees?.bind(m.client);if(x0)iJ(()=>aJ({home:F0,deviceId:m.state.deviceId,liveIds:(_$)=>x0(m.state,_$,m.signal)}),m.signal)};z0({state:J,client:f,signal:j.signal});let G$=HG($,X.platform??process.platform),i$=f.deviceLifecycle?.bind(f),A0=Promise.resolve(),E0=0,D1=()=>{if(!G$||!i$||L||Date.now()<E0)return;E0=Date.now()+qG,A0=A0.then(()=>gJ({paths:G$,device:J,client:{deviceLifecycle:i$},accept:MG,signal:j.signal})).catch(()=>{return})};if(D1(),G$)B.final.then((m)=>TG(G$,m),()=>{});let Y2=(m,p0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+eJ,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:dJ,operationCompletionTimeoutMs:dJ,maxConsecutiveHeartbeatFailures:3,claimable:k,advertised:l,onClaim:async(F0,x0,_$)=>{let z1=Date.now();if(!m.capabilities.supported_operations.includes(F0.capability))return{status:"failed",error_code:"unsupported_capability"};let c0=F.worker.probing??[],Z4=c0.includes(F0.capability)?M$:F0.capability==="hands.connect"&&$.executionMode==="host"&&c0.includes("pty.start")?j1:null;if(Z4){let K2,M3=()=>{};await Promise.race([Z4,new Promise((Q4)=>{K2=setTimeout(Q4,UG),M3=()=>Q4(),x0.addEventListener("abort",M3,{once:!0})})]),clearTimeout(K2),x0.removeEventListener("abort",M3)}let G2=F0.capability==="hands.connect",H3=G2?S:null,b7={signal:x0,emit:_$,...F,...D?{proveMac:D.broker.execute}:{},...F0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(K2)=>m.client.operationCustomEndpointCredential(m.state,F0,K2)}:{},...G2?{handsLaunch:{claimedAtMs:z1,...H3?{takePrespawnedWorker:H3.take,adoptSpawnedWorker:H3.adopt}:{}}}:{}};if(G2)R+=1;try{return await(X.execute??w9)(m.state,F0,b7)}finally{if(G2)R-=1}},onControl:async(F0,x0)=>await Y6(m.state,F0,x0,m.client)||await G6(m.state,F0,x0)||await $6(F0,x0)||await D?.broker.control(F0,x0)||!1,onEvent:p0}),e9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:BG(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(lJ)).catch(()=>{return})},O1=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,$4=f.ownerWorkspaces?.bind(f),J4=f.ownerWorkspaceEnrollment?.bind(f);if(O1&&$4&&J4)P=C4({config:$,state:J,signal:j.signal,client:{ownerWorkspaces:$4,ownerWorkspaceEnrollment:J4},...O1.enroll?{enroll:O1.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,p0,F0)=>{let x0=L3(m.config,m.state.deviceId),_$={config:m.config,state:m.state,signal:p0,statusPath:d(m.config).daemon,...x0?.offer?{firstHeartbeat:x0.offer}:{},capabilities:x9(m.config,m.state,F,D?.capability),client:O1.client?.(m)??new n1(O$($.apiOrigin),S0($.proxy,pJ()),m.proofStore,{deviceSession:t3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};z0(_$);let z1={..._$,heartbeatNow:null};w.add(z1);try{await $9({registerHeartbeatNow:(c0)=>{z1.heartbeatNow=c0},...Y2(_$,(c0)=>{if(c0.type==="completed")S9(c0.operationId,c0.status);if(c0.type==="claims_changed"){if(F0(c0.activeClaims),L&&x()===0)j.abort()}if(c0.type==="stopped")F0(0)})})}finally{w.delete(z1)}if(L&&!S$)await e9(_$)}});let V3=0,N3=0,q3=O1?.intervalMs??O4;if(await $9({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?R2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...K0?{startup:K0}:{},...Y2({state:J,client:f,capabilities:z,signal:j.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(m)=>{if(m.type==="completed")S9(m.operationId,m.status);if(m.type==="claims_changed"){if(W=m.activeClaims,L&&x()===0)j.abort()}if(m.type==="heartbeat"&&!L){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=rJ({log:(p0,F0)=>{process.stderr.write(`${JSON.stringify({event:p0,...F0})}
+`)}}):void 0),X0=(f)=>{if(f==="stop")T$();if(f==="reload_roots"){let a=t($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=Q6(J.roots,uJ());if(q0)z.root_paths=q0;else delete z.root_paths;P?.check()}if(f==="drain"||f==="resume"){if(L||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:f==="drain"},I0($,G)}return P$()};X.prestartedControl?.handle(X0);let x$=X.prestartedControl?await X.prestartedControl.closed:await x2($,Q,X0),Y$,S$=!1,h0=()=>{let f=Date.parse(Y)-Date.now();if(f>0){Y$=setTimeout(h0,Math.min(f,2147483647));return}L=!0,S?.close(),S$=!0,E="stopping",j.abort(Error("worker_credential_expired"))};h0(),X.signal?.addEventListener("abort",Q$,{once:!0});let W1=X.processSignals!==!1;if(W1)process.once("SIGTERM",Q$),process.once("SIGINT",T$);if(X.signal?.aborted)Q$();try{X.onStartup?.("control_ready");let f=X.client??new n1(O$($.apiOrigin),S0($.proxy,pJ()),Z,{deviceSession:t3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=L3($,J.deviceId),i=X.startupTiming,K0=i?()=>({...i(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,z0=(m)=>{let p0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&p0)(X.handOverLocalLogins??bJ)({state:m.state,client:{localSubscription:p0},signal:m.signal,home:B0()}).catch(()=>{return});let F0=uJ(),x0=m.client.liveSessionWorktrees?.bind(m.client);if(x0)iJ(()=>aJ({home:F0,deviceId:m.state.deviceId,liveIds:(_$)=>x0(m.state,_$,m.signal)}),m.signal)};z0({state:J,client:f,signal:j.signal});let G$=MG($,X.platform??process.platform),i$=f.deviceLifecycle?.bind(f),A0=Promise.resolve(),E0=0,D1=()=>{if(!G$||!i$||L||Date.now()<E0)return;E0=Date.now()+HG,A0=A0.then(()=>gJ({paths:G$,device:J,client:{deviceLifecycle:i$},accept:TG,signal:j.signal})).catch(()=>{return})};if(D1(),G$)B.final.then((m)=>_G(G$,m),()=>{});let Y2=(m,p0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:4*$.slots+eJ,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:dJ,operationCompletionTimeoutMs:dJ,maxConsecutiveHeartbeatFailures:3,claimable:k,advertised:l,onClaim:async(F0,x0,_$)=>{let z1=Date.now();if(!m.capabilities.supported_operations.includes(F0.capability))return{status:"failed",error_code:"unsupported_capability"};let c0=F.worker.probing??[],Z4=c0.includes(F0.capability)?M$:F0.capability==="hands.connect"&&$.executionMode==="host"&&c0.includes("pty.start")?j1:null;if(Z4){let K2,M3=()=>{};await Promise.race([Z4,new Promise((Q4)=>{K2=setTimeout(Q4,VG),M3=()=>Q4(),x0.addEventListener("abort",M3,{once:!0})})]),clearTimeout(K2),x0.removeEventListener("abort",M3)}let G2=F0.capability==="hands.connect",H3=G2?S:null,w7={signal:x0,emit:_$,...F,...D?{proveMac:D.broker.execute}:{},...F0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(K2)=>m.client.operationCustomEndpointCredential(m.state,F0,K2)}:{},...G2?{handsLaunch:{claimedAtMs:z1,...H3?{takePrespawnedWorker:H3.take,adoptSpawnedWorker:H3.adopt}:{}}}:{}};if(G2)R+=1;try{return await(X.execute??w9)(m.state,F0,w7)}finally{if(G2)R-=1}},onControl:async(F0,x0)=>await Y6(m.state,F0,x0,m.client)||await G6(m.state,F0,x0)||await $6(F0,x0)||await D?.broker.control(F0,x0)||!1,onEvent:p0}),e9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:UG(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(lJ)).catch(()=>{return})},O1=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,$4=f.ownerWorkspaces?.bind(f),J4=f.ownerWorkspaceEnrollment?.bind(f);if(O1&&$4&&J4)P=C4({config:$,state:J,signal:j.signal,client:{ownerWorkspaces:$4,ownerWorkspaceEnrollment:J4},...O1.enroll?{enroll:O1.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,p0,F0)=>{let x0=L3(m.config,m.state.deviceId),_$={config:m.config,state:m.state,signal:p0,statusPath:d(m.config).daemon,...x0?.offer?{firstHeartbeat:x0.offer}:{},capabilities:x9(m.config,m.state,F,D?.capability),client:O1.client?.(m)??new n1(O$($.apiOrigin),S0($.proxy,pJ()),m.proofStore,{deviceSession:t3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};z0(_$);let z1={..._$,heartbeatNow:null};w.add(z1);try{await $9({registerHeartbeatNow:(c0)=>{z1.heartbeatNow=c0},...Y2(_$,(c0)=>{if(c0.type==="completed")S9(c0.operationId,c0.status);if(c0.type==="claims_changed"){if(F0(c0.activeClaims),L&&x()===0)j.abort()}if(c0.type==="stopped")F0(0)})})}finally{w.delete(z1)}if(L&&!S$)await e9(_$)}});let V3=0,N3=0,q3=O1?.intervalMs??O4;if(await $9({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?R2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...K0?{startup:K0}:{},...Y2({state:J,client:f,capabilities:z,signal:j.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(m)=>{if(m.type==="completed")S9(m.operationId,m.status);if(m.type==="claims_changed"){if(W=m.activeClaims,L&&x()===0)j.abort()}if(m.type==="heartbeat"&&!L){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=rJ({log:(p0,F0)=>{process.stderr.write(`${JSON.stringify({event:p0,...F0})}
 `)}}),S.arm(),setTimeout(oJ,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(P&&!L&&Date.now()>=V3)V3=Date.now()+q3,P.check().then((p0)=>{N3=p0?0:N3+1,V3=Date.now()+(p0?q3:Math.min(q3,z4*2**Math.min(N3-1,10)))});if(I=m.serverTime,C=m.drain,D1(),!L&&E$)v?.(m.latestCliVersions?.[E$]);if(!L)E="running";if(!L&&!h&&P$().executionEligible){if(h=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{E9({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!L)E="reconnecting";if(m.type==="stopped")W=0;X.onEvent?.(m)})}),await P?.settled(),L&&!S$&&$.lifetime==="ephemeral")await f.disconnect?.(J,AbortSignal.timeout(lJ)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(L&&!S$)await e9({state:J,client:f});if(a$)await nJ().catch(()=>{return})}catch(f){if(!(f instanceof T0&&f.status===401))throw f;if(I0($,{...G,revoked:!0}),f.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(Y$),clearInterval(W0),y)clearTimeout(y);if(W1)process.removeListener("SIGTERM",Q$),process.removeListener("SIGINT",T$);X.signal?.removeEventListener("abort",Q$),j.abort(),S?.close(),await P?.settled().catch(()=>{return}),await D?.broker.close().catch(()=>{return}),await x$()}}function pJ($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(cJ,sJ),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as _G,sign as FG}from"crypto";var K6=65536,LG=65536;function jG($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new Y0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new Y0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!U6(X))throw new Y0("invalid_public_key");return X}function B6(){try{let{privateKey:$,publicKey:J}=_G("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:jG(J)}}catch($){if($ instanceof Y0)throw $;throw new Y0("proof_key_generation_failed")}}class o1{keyPair=B6();binding=null;loadPublicKey(){if(!this.keyPair)throw new Y0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=B6(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>LG)throw new Y0("proof_sign_failed");let J;try{J=FG("sha256",$,this.keyPair.privateKey)}catch{throw new Y0("proof_sign_failed")}if(!V6(J))throw new Y0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>K6)throw new Y0("invalid_binding");if(this.binding)throw new Y0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>K6)throw new Y0("invalid_binding");if(!this.binding)throw new Y0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as IG,spawn as CG}from"child_process";import{isAbsolute as PG}from"path";import{promisify as EG}from"util";var e1={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class $2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=e1){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
-`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as WG}from"crypto";import{unlinkSync as DG}from"fs";import{join as OG}from"path";var J2=1,i2=45000,zG=U.strictObject({type:U.literal("configure"),protocol:U.literal(J2),version:U.string(),config:J0}),AG=U.strictObject({type:U.literal("ticket"),organizationId:U.string().min(1).max(160),receipt:U.unknown()}),RG=U.strictObject({type:U.enum(["ping","stop"])});async function N6($={}){let J=$.clock??e1,Z=new $2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,V,K,N,H=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:B,version:q}=zG.parse(await Z.receive(30000,Q.signal));if(q!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(K$(B),e(g(B),!0),V=t0({path:d(B).lock,runtimeVersion:r}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=OG(g(B),`ssh-preflight-${WG()}.json`);try{c(M,{version:1}),s(M)}finally{try{DG(M)}catch{}}let T=t(B),_=$0(B);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&B.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:J2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let j=B.lifetime==="ephemeral"?K=new o1:M0(B,!0);if(!T){let L=W$(B);await Z.send({type:"ticket-request",request:L.request});let W=AG.parse(await Z.receive(70000,Q.signal)),R=L.complete(W.organizationId,W.receipt);if(T=await r0(B,R,j,$.enroll),B.lifetime==="persistent")y0(T,d(B).state,{proofStore:j});I0(B,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(RG.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let D=!1,O,F=!1;N=J.after(Math.max(1,Math.min(i2,$.startupTimeoutMs??i2)),()=>{F=!0,Y()});let z=V.owner.nonce;if(await t1(B,T,j,z,{...$,signal:Q.signal,onEvent(L){if($.onEvent?.(L),L.type==="heartbeat"&&!D&&!O)O=(async()=>{let W=await U0(B,"status");if(!W?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:W.deviceId,expiresAt:W.expiresAt,lifetime:B.lifetime,supervision:"ssh-foreground"}),D=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await O,F||!D)throw Error("worker_ssh_outbound_or_readiness_failed");return H=!0,0}catch(B){let q=B instanceof Error&&/^worker_[a-z_]+$/.test(B.message)?B.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:q})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),H)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var y9=($)=>PG($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),k9=($)=>`'${$.replaceAll("'","'\\''")}'`,xG=U.strictObject({type:U.literal("hello"),protocol:U.literal(J2),version:U.string(),platform:U.enum(["linux","darwin"]),architecture:U.enum(["arm64","x64"]),enrolled:U.boolean()}),SG=U.strictObject({type:U.literal("ticket-request"),request:U.strictObject({install_id:U.uuid(),code_challenge:U.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:U.enum(["persistent","ephemeral"]),roots:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),execution_mode:U.enum(["confined","host"]),permissions:U.strictObject({read:U.literal(!0),write:U.literal(!0),execute:U.literal(!0),discover_environment:U.literal(!0),expose_mcp:U.literal(!1)})})).length(1)})}),q6=U.discriminatedUnion("type",[U.strictObject({type:U.literal("running"),deviceId:U.string().min(1).max(160),expiresAt:U.iso.datetime({offset:!0}),lifetime:U.enum(["persistent","ephemeral"]),supervision:U.literal("ssh-foreground")}),U.strictObject({type:U.literal("pong")}),U.strictObject({type:U.literal("stopped")})]),bG=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function n2($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&bG.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function H6($){if(!y9($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
+`)});else if(L&&!S$)await e9({state:J,client:f});if(a$)await nJ().catch(()=>{return})}catch(f){if(!(f instanceof T0&&f.status===401))throw f;if(I0($,{...G,revoked:!0}),f.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(Y$),clearInterval(W0),y)clearTimeout(y);if(W1)process.removeListener("SIGTERM",Q$),process.removeListener("SIGINT",T$);X.signal?.removeEventListener("abort",Q$),j.abort(),S?.close(),await P?.settled().catch(()=>{return}),await D?.broker.close().catch(()=>{return}),await x$()}}function pJ($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(cJ,sJ),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as FG,sign as LG}from"crypto";var K6=65536,jG=65536;function WG($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new Y0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new Y0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!U6(X))throw new Y0("invalid_public_key");return X}function B6(){try{let{privateKey:$,publicKey:J}=FG("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:WG(J)}}catch($){if($ instanceof Y0)throw $;throw new Y0("proof_key_generation_failed")}}class o1{keyPair=B6();binding=null;loadPublicKey(){if(!this.keyPair)throw new Y0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=B6(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>jG)throw new Y0("proof_sign_failed");let J;try{J=LG("sha256",$,this.keyPair.privateKey)}catch{throw new Y0("proof_sign_failed")}if(!V6(J))throw new Y0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>K6)throw new Y0("invalid_binding");if(this.binding)throw new Y0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>K6)throw new Y0("invalid_binding");if(!this.binding)throw new Y0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as CG,spawn as PG}from"child_process";import{isAbsolute as EG}from"path";import{promisify as xG}from"util";var e1={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class $2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=e1){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
+`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as DG}from"crypto";import{unlinkSync as OG}from"fs";import{join as zG}from"path";var J2=1,i2=45000,AG=U.strictObject({type:U.literal("configure"),protocol:U.literal(J2),version:U.string(),config:J0}),RG=U.strictObject({type:U.literal("ticket"),organizationId:U.string().min(1).max(160),receipt:U.unknown()}),IG=U.strictObject({type:U.enum(["ping","stop"])});async function N6($={}){let J=$.clock??e1,Z=new $2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,V,K,N,H=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:B,version:q}=AG.parse(await Z.receive(30000,Q.signal));if(q!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(K$(B),e(g(B),!0),V=t0({path:d(B).lock,runtimeVersion:r}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=zG(g(B),`ssh-preflight-${DG()}.json`);try{c(M,{version:1}),s(M)}finally{try{OG(M)}catch{}}let T=t(B),_=$0(B);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&B.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:J2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let j=B.lifetime==="ephemeral"?K=new o1:M0(B,!0);if(!T){let L=W$(B);await Z.send({type:"ticket-request",request:L.request});let W=RG.parse(await Z.receive(70000,Q.signal)),R=L.complete(W.organizationId,W.receipt);if(T=await r0(B,R,j,$.enroll),B.lifetime==="persistent")y0(T,d(B).state,{proofStore:j});I0(B,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(IG.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let D=!1,O,F=!1;N=J.after(Math.max(1,Math.min(i2,$.startupTimeoutMs??i2)),()=>{F=!0,Y()});let z=V.owner.nonce;if(await t1(B,T,j,z,{...$,signal:Q.signal,onEvent(L){if($.onEvent?.(L),L.type==="heartbeat"&&!D&&!O)O=(async()=>{let W=await U0(B,"status");if(!W?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:W.deviceId,expiresAt:W.expiresAt,lifetime:B.lifetime,supervision:"ssh-foreground"}),D=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await O,F||!D)throw Error("worker_ssh_outbound_or_readiness_failed");return H=!0,0}catch(B){let q=B instanceof Error&&/^worker_[a-z_]+$/.test(B.message)?B.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:q})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),H)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var y9=($)=>EG($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),k9=($)=>`'${$.replaceAll("'","'\\''")}'`,SG=U.strictObject({type:U.literal("hello"),protocol:U.literal(J2),version:U.string(),platform:U.enum(["linux","darwin"]),architecture:U.enum(["arm64","x64"]),enrolled:U.boolean()}),bG=U.strictObject({type:U.literal("ticket-request"),request:U.strictObject({install_id:U.uuid(),code_challenge:U.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:U.enum(["persistent","ephemeral"]),roots:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),execution_mode:U.enum(["confined","host"]),permissions:U.strictObject({read:U.literal(!0),write:U.literal(!0),execute:U.literal(!0),discover_environment:U.literal(!0),expose_mcp:U.literal(!1)})})).length(1)})}),q6=U.discriminatedUnion("type",[U.strictObject({type:U.literal("running"),deviceId:U.string().min(1).max(160),expiresAt:U.iso.datetime({offset:!0}),lifetime:U.enum(["persistent","ephemeral"]),supervision:U.literal("ssh-foreground")}),U.strictObject({type:U.literal("pong")}),U.strictObject({type:U.literal("stopped")})]),wG=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function n2($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&wG.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function H6($){if(!y9($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
 a=${k9($.remoteCli)}
 [ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
 p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
@@ -99,11 +99,11 @@ elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
 else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
 h=\${h%% *}
 [ "$h" = ${k9($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${k9(J)}`}function M6($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!y9($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,H6($)]}function wG($){return M6($,!1)}function T6(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:B0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function kG($){let J;try{({stdout:J}=await EG(IG)("/usr/bin/ssh",["-G",...M6($,!0)],{env:T6(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
-`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function yG($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function fG($){await kG($);let J=CG("/usr/bin/ssh",wG($),{stdio:["pipe","pipe","pipe"],env:T6()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=yG(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function hG($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let V=$[G];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let V=J.get(G);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!y9(X.sshConfig))throw Error("worker_ssh_invalid_target");H6(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(Z2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function mG($,J,Z,Q,X){let{request:Y}=SG.parse(n2(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{G();let N=Z??L$(J),H=await(Q.enrollmentCredentials??j$)(J,N);if(G(),!H)throw Error("worker_session_login_required");if(!C0(H.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!H.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let B=Q.createTicketClient?.(H)??new R$(H,{credentialsPath:N}),q=A3(await B.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:H.orgId,receipt:q}})(),K;try{let N=await Promise.race([V,new Promise((H,B)=>{if(K=()=>B(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function _6($,J={}){let{config:Z,target:Q,credentialPath:X}=hG($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??e1,G=await(J.sshTransport??fG)(Q),V=new $2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),H,B;if(G.result.then((q)=>{B=q}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:J2,version:r,config:Z});let q=xG.parse(n2(await V.receive(30000,K.signal)));if(q.version!==r)throw Error("worker_ssh_version_mismatch");if(!q.enrolled)await mG(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));H=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(q.enrolled?0:O3)+i2+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),j=q6.parse(n2(await V.receive(_,K.signal)));if(j.type==="running"){if(M||j.lifetime!==Z.lifetime||Date.parse(j.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(j)+`
-`)}if(j.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(q){if(K.signal.aborted){H?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(q6.parse(n2(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(q instanceof Error&&q.message==="worker_ssh_connection_closed"){let M=B??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw q}finally{H?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),V.dispose()}}import{createConnection as lG}from"net";import{WebSocket as r2}from"ws";var vG=1,H1=65536,F6=4096,L6=67108864,j6=4194304,q1=U.uuid(),gG=U.strictObject({kind:U.literal("install_only"),authorityId:q1,organizationId:q1,userId:q1,connectionId:q1,attemptId:q1,purpose:U.literal("install"),generation:U.number().int().positive(),transport:U.literal("reverse_ssh"),expiresAt:U.iso.datetime({offset:!0}),maxDurationMs:U.literal(300000),maxChannels:U.literal(1),allowTcpForwarding:U.literal(!1),allowPty:U.literal(!1)}),uG=U.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!q1.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var dG=U.strictObject({protocol:U.literal(vG),type:U.literal("ssh_install_relay"),authorityToken:U.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:gG,relayUrl:uG,endpoint:U.strictObject({host:U.literal("127.0.0.1"),port:U.literal(22)})});function f9($,J=Date.now()){let Z=dG.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function W6($){let J=JSON.stringify($);if(Buffer.byteLength(J)>H1)throw Error("ssh_install_relay_frame_too_large");return J}function D6($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:f9(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var O6="ssh_install_relay_closed";function pG($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function cG($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function sG($,J=O6){try{$.close(1000,J)}catch{$.terminate()}}async function aG($){let J=$.now??(()=>Date.now()),Z=f9($.receipt,J()),X=($.createWebSocket??((L)=>new r2(L,{followRedirects:!1,perMessageDeflate:!1,maxPayload:H1})))(Z.relayUrl),Y=$.connectLocal??(()=>lG({host:"127.0.0.1",port:22})),G,V=!1,K=!1,N=0,H=0,B,q=(L)=>{if(B)clearTimeout(B);B=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,L)),B.unref?.()},M,T=new Promise((L)=>{M=L}),_=(L=O6)=>{if(K)return;if(K=!0,B)clearTimeout(B);if($.signal?.removeEventListener("abort",j),G?.destroy(),X.readyState===r2.OPEN)sG(X,L);else if(X.readyState!==r2.CLOSED)X.terminate();M()},j=()=>_("ssh_install_relay_aborted"),D=()=>_("ssh_install_relay_protocol_error"),O=(L)=>{return N+=1,H+=L,L<=H1&&N<=F6&&H<=L6},F=(L)=>{if(K||!V||X.readyState!==r2.OPEN||X.bufferedAmount>j6||!O(L.length)){D();return}X.send(L,{binary:!0},(W)=>{if(W)D()})};X.on("open",()=>{if(K)return;try{let L=W6({type:"ssh_install_relay_receipt",receipt:Z});X.send(L,{binary:!1},(W)=>{if(W)D()})}catch{D()}}),X.on("message",(L,W)=>{if(K)return;let R=pG(L);if(R>H1||!O(R))return D();if(!V){if(W)return D();try{let I=D6(JSON.parse(String(L)));if(I.type!=="ssh_install_relay_ready"||I.authorityId!==Z.authority.authorityId)return D();V=!0,q(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",D),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{D()}return}if(!W)return D();let E=cG(L);if(!E||!G||G.destroyed||!G.write(E))X._socket?.pause()}),X.on("error",D),X.on("close",()=>_("ssh_install_relay_peer_closed"));let z=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(q(z),$.signal?.addEventListener("abort",j,{once:!0}),$.signal?.aborted)j();return{receipt:Z,closed:T,close:()=>_()}}async function z6($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>H1)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await aG({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as iG}from"crypto";var c$="ARA_WORKER_PREVIEW_PROBE";async function R6(){if(typeof Bun>"u")return 1;let $=iG(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,V){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(c$);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,V){if(typeof V!=="string"||V.length>8192){G.close();return}if(!G.data.relay){if(V===c$)G.send(c$);else G.close();return}try{let K=A6(V),N=(H)=>G.send(JSON.stringify(H));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>c$.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===c$)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(c$).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===c$&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
+exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${k9(J)}`}function M6($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!y9($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,H6($)]}function kG($){return M6($,!1)}function T6(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:B0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function yG($){let J;try{({stdout:J}=await xG(CG)("/usr/bin/ssh",["-G",...M6($,!0)],{env:T6(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
+`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function fG($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function hG($){await yG($);let J=PG("/usr/bin/ssh",kG($),{stdio:["pipe","pipe","pipe"],env:T6()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=fG(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function mG($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let V=$[G];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let V=J.get(G);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!y9(X.sshConfig))throw Error("worker_ssh_invalid_target");H6(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(Z2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function vG($,J,Z,Q,X){let{request:Y}=bG.parse(n2(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{G();let N=Z??L$(J),H=await(Q.enrollmentCredentials??j$)(J,N);if(G(),!H)throw Error("worker_session_login_required");if(!C0(H.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!H.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let B=Q.createTicketClient?.(H)??new R$(H,{credentialsPath:N}),q=A3(await B.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:H.orgId,receipt:q}})(),K;try{let N=await Promise.race([V,new Promise((H,B)=>{if(K=()=>B(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function _6($,J={}){let{config:Z,target:Q,credentialPath:X}=mG($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??e1,G=await(J.sshTransport??hG)(Q),V=new $2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),H,B;if(G.result.then((q)=>{B=q}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:J2,version:r,config:Z});let q=SG.parse(n2(await V.receive(30000,K.signal)));if(q.version!==r)throw Error("worker_ssh_version_mismatch");if(!q.enrolled)await vG(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));H=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(q.enrolled?0:O3)+i2+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),j=q6.parse(n2(await V.receive(_,K.signal)));if(j.type==="running"){if(M||j.lifetime!==Z.lifetime||Date.parse(j.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(j)+`
+`)}if(j.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(q){if(K.signal.aborted){H?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(q6.parse(n2(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(q instanceof Error&&q.message==="worker_ssh_connection_closed"){let M=B??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw q}finally{H?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),V.dispose()}}import{createConnection as pG}from"net";import{WebSocket as r2}from"ws";var gG=1,H1=65536,F6=4096,L6=67108864,j6=4194304,q1=U.uuid(),uG=U.strictObject({kind:U.literal("install_only"),authorityId:q1,organizationId:q1,userId:q1,connectionId:q1,attemptId:q1,purpose:U.literal("install"),generation:U.number().int().positive(),transport:U.literal("reverse_ssh"),expiresAt:U.iso.datetime({offset:!0}),maxDurationMs:U.literal(300000),maxChannels:U.literal(1),allowTcpForwarding:U.literal(!1),allowPty:U.literal(!1)}),dG=U.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!q1.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var lG=U.strictObject({protocol:U.literal(gG),type:U.literal("ssh_install_relay"),authorityToken:U.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:uG,relayUrl:dG,endpoint:U.strictObject({host:U.literal("127.0.0.1"),port:U.literal(22)})});function f9($,J=Date.now()){let Z=lG.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function W6($){let J=JSON.stringify($);if(Buffer.byteLength(J)>H1)throw Error("ssh_install_relay_frame_too_large");return J}function D6($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:f9(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var O6="ssh_install_relay_closed";function cG($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function sG($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function aG($,J=O6){try{$.close(1000,J)}catch{$.terminate()}}async function iG($){let J=$.now??(()=>Date.now()),Z=f9($.receipt,J()),X=($.createWebSocket??((L)=>new r2(L,{followRedirects:!1,perMessageDeflate:!1,maxPayload:H1})))(Z.relayUrl),Y=$.connectLocal??(()=>pG({host:"127.0.0.1",port:22})),G,V=!1,K=!1,N=0,H=0,B,q=(L)=>{if(B)clearTimeout(B);B=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,L)),B.unref?.()},M,T=new Promise((L)=>{M=L}),_=(L=O6)=>{if(K)return;if(K=!0,B)clearTimeout(B);if($.signal?.removeEventListener("abort",j),G?.destroy(),X.readyState===r2.OPEN)aG(X,L);else if(X.readyState!==r2.CLOSED)X.terminate();M()},j=()=>_("ssh_install_relay_aborted"),D=()=>_("ssh_install_relay_protocol_error"),O=(L)=>{return N+=1,H+=L,L<=H1&&N<=F6&&H<=L6},F=(L)=>{if(K||!V||X.readyState!==r2.OPEN||X.bufferedAmount>j6||!O(L.length)){D();return}X.send(L,{binary:!0},(W)=>{if(W)D()})};X.on("open",()=>{if(K)return;try{let L=W6({type:"ssh_install_relay_receipt",receipt:Z});X.send(L,{binary:!1},(W)=>{if(W)D()})}catch{D()}}),X.on("message",(L,W)=>{if(K)return;let R=cG(L);if(R>H1||!O(R))return D();if(!V){if(W)return D();try{let I=D6(JSON.parse(String(L)));if(I.type!=="ssh_install_relay_ready"||I.authorityId!==Z.authority.authorityId)return D();V=!0,q(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",D),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{D()}return}if(!W)return D();let E=sG(L);if(!E||!G||G.destroyed||!G.write(E))X._socket?.pause()}),X.on("error",D),X.on("close",()=>_("ssh_install_relay_peer_closed"));let z=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(q(z),$.signal?.addEventListener("abort",j,{once:!0}),$.signal?.aborted)j();return{receipt:Z,closed:T,close:()=>_()}}async function z6($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>H1)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await iG({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as nG}from"crypto";var c$="ARA_WORKER_PREVIEW_PROBE";async function R6(){if(typeof Bun>"u")return 1;let $=nG(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,V){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(c$);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,V){if(typeof V!=="string"||V.length>8192){G.close();return}if(!G.data.relay){if(V===c$)G.send(c$);else G.close();return}try{let K=A6(V),N=(H)=>G.send(JSON.stringify(H));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>c$.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===c$)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(c$).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===c$&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
 `);else throw Error("probe_protocol_failed")}catch{G.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
-`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as tG,createReadStream as oG,fstatSync as eG,readFileSync as $K}from"fs";var I6="/run/sc/instance-generation";var nG=/^[1-9][0-9]{0,15}\n?$/;function rG($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function C6($){if(typeof $!=="string"||!nG.test($))return null;let J=Number($.trim());return rG(J)?J:null}var P6=3,JK=600000,ZK=65536,QK=500;function E6($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(P6))throw Error("worker_standby_invalid_invocation");return{handoffFd:P6}}function XK($=(J)=>$K(J,"utf8")){try{return C6($(I6))}catch{return null}}function YK($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=D3.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var x6={isPipe:($)=>eG($).isFIFO(),stream:($)=>{let J=oG("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function GK($,J=x6){if(!J.isPipe($.fd)){try{tG($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??JK),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(H)=>{X??=H,N(H)}});G.catch(()=>{});let V=J.every(QK,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let H=[],B=0;for await(let q of Q.chunks){if(X)throw X;if(B===0)$.onArriving?.();if(B+=q.length,B>ZK)throw Error("worker_standby_handoff_too_large");H.push(q)}return Buffer.concat(H).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function S6($,J=x6){let Z=$.readGeneration??(()=>XK()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await GK({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return YK(Y)}var KK=`Usage: reason worker <command> --config PATH [--json]
+`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as oG,createReadStream as eG,fstatSync as $K,readFileSync as JK}from"fs";var I6="/run/sc/instance-generation";var rG=/^[1-9][0-9]{0,15}\n?$/;function tG($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function C6($){if(typeof $!=="string"||!rG.test($))return null;let J=Number($.trim());return tG(J)?J:null}var P6=3,ZK=600000,QK=65536,XK=500;function E6($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(P6))throw Error("worker_standby_invalid_invocation");return{handoffFd:P6}}function YK($=(J)=>JK(J,"utf8")){try{return C6($(I6))}catch{return null}}function GK($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=D3.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var x6={isPipe:($)=>$K($).isFIFO(),stream:($)=>{let J=eG("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function KK($,J=x6){if(!J.isPipe($.fd)){try{oG($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??ZK),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(H)=>{X??=H,N(H)}});G.catch(()=>{});let V=J.every(XK,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let H=[],B=0;for await(let q of Q.chunks){if(X)throw X;if(B===0)$.onArriving?.();if(B+=q.length,B>QK)throw Error("worker_standby_handoff_too_large");H.push(q)}return Buffer.concat(H).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function S6($,J=x6){let Z=$.readGeneration??(()=>YK()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await KK({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return GK(Y)}var BK=`Usage: reason worker <command> --config PATH [--json]
   enroll                        Obtain/redeem a ticket using the current Reason login
   start                         Run the existing Device daemon in the foreground
@@ -144,15 +144,15 @@ Pretrust known_hosts. No agent forwarding, automatic installation or detached se
 SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
 are not forwarded/supported; running is not a browser-readiness receipt.
 Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function BK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var UK=1e4,VK=2000,b6=15000,NK=50;async function k6($,J,Z,Q,X,Y){let G=new o1,V=new AbortController,K,N,H=new Promise((E,I)=>{K=E,N=I});if(H.catch(()=>{}),v0(),$.executionMode==="host")r1();Z("enrollment_started");let B=X(G);B.catch(()=>{});let q=null,M=x2($,J,(E)=>{if(!q)throw Error("worker_starting");return q(E)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,j=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),D=Y?.matches($)?Y.result:void 0;if(Y&&!D)await Y.stop();if(D)j.addEventListener("abort",()=>void Y.stop(),{once:!0});let O,F=new Promise((E)=>{O=E}),z=setTimeout(()=>O(),UK);j.addEventListener("abort",()=>O(),{once:!0});let L,W=(E)=>{if(E==="ready")L=setTimeout(()=>O(),VK);Q.onStartup?.(E)},R=d1($,Q.readinessProbes,j,H,void 0,D,F);R.final.catch(()=>{});try{let E;try{E=await B}catch(I){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((C)=>C(),()=>{}),I}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(b6,Date.parse(E.worker?.expiresAt??"")-Date.now()||b6))),K(E.roots[0].permissions),I0($,{version:1,drained:!1,revoked:!1}),await t1($,E,G,J,{...Q,onStartup:W,prestartedReadiness:R,prestartedControl:{closed:M,handle:(I)=>{q=I}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(z),clearTimeout(L),V.abort(),G.deleteBinding(),G.deleteKey(),await M.then((E)=>E(),()=>{})}}async function qK($,J,Z,Q){let{handoffFd:X}=E6($);if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>u1(T);if(K||!M)return;try{v0(),r1()}catch{return}if(Y=M5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{h2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let H;try{H=await(J.receiveStandbyHandoff??S6)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(V,NK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
-`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:B,enrollment:q}=H;try{e(g(B),!0);let M=await y6(B,()=>{});try{if(Q("lock_acquired"),t(B))throw Error("worker_ephemeral_requires_fresh_enrollment");return K$(B),await k6(B,M.owner.nonce,Q,Z,(T)=>r0(B,q,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function N$($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
-`),J.onStartup?.(K)},V={...J,onStartup:G,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(B)=>Math.min(r$,Math.max(0,Math.round(B))),N=Y.get("readiness_started"),H=Y.get("readiness_completed");return{service_start_to_heartbeat_ms:K(performance.now()-(Y.get("handoff_received")??0)),...N!==void 0&&H!==void 0?{readiness_ms:K(H-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
+`;function UK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var VK=1e4,NK=2000,b6=15000,qK=50;async function y6($,J,Z,Q,X,Y){let G=new o1,V=new AbortController,K,N,H=new Promise((E,I)=>{K=E,N=I});if(H.catch(()=>{}),v0(),$.executionMode==="host")r1();Z("enrollment_started");let B=X(G);B.catch(()=>{});let q=null,M=x2($,J,(E)=>{if(!q)throw Error("worker_starting");return q(E)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,j=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),D=Y?.matches($)?Y.result:void 0;if(Y&&!D)await Y.stop();if(D)j.addEventListener("abort",()=>void Y.stop(),{once:!0});let O,F=new Promise((E)=>{O=E}),z=setTimeout(()=>O(),VK);j.addEventListener("abort",()=>O(),{once:!0});let L,W=(E)=>{if(E==="ready")L=setTimeout(()=>O(),NK);Q.onStartup?.(E)},R=d1($,Q.readinessProbes,j,H,void 0,D,F);R.final.catch(()=>{});try{let E;try{E=await B}catch(I){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((C)=>C(),()=>{}),I}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(b6,Date.parse(E.worker?.expiresAt??"")-Date.now()||b6))),K(E.roots[0].permissions),I0($,{version:1,drained:!1,revoked:!1}),await t1($,E,G,J,{...Q,onStartup:W,prestartedReadiness:R,prestartedControl:{closed:M,handle:(I)=>{q=I}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(z),clearTimeout(L),V.abort(),G.deleteBinding(),G.deleteKey(),await M.then((E)=>E(),()=>{})}}async function HK($,J,Z,Q){let{handoffFd:X}=E6($);if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>u1(T);if(K||!M)return;try{v0(),r1()}catch{return}if(Y=M5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{h2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let H;try{H=await(J.receiveStandbyHandoff??S6)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(V,qK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
+`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:B,enrollment:q}=H;try{e(g(B),!0);let M=await f6(B,()=>{});try{if(Q("lock_acquired"),t(B))throw Error("worker_ephemeral_requires_fresh_enrollment");return K$(B),await y6(B,M.owner.nonce,Q,Z,(T)=>r0(B,q,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function N$($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
+`),J.onStartup?.(K)},V={...J,onStartup:G,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(M)=>Math.min(r$,Math.max(0,Math.round(M))),N=Y.get("readiness_started"),H=Y.get("readiness_completed"),B=Y.get("handoff_received")??0,q=Object.fromEntries(k6.flatMap((M)=>{let T=Y.get(M);return T===void 0?[]:[[M,K(T-B)]]}));return{service_start_to_heartbeat_ms:K(performance.now()-B),stage_ms:q,...N!==void 0&&H!==void 0?{readiness_ms:K(H-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
 `)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||M1(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await R6()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await _6($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await z6();return await N6(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await S2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
-`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await qK($,J,V,G);let K=BK($);if(!K)return Z.stdout.write(KK),0;if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),H=(M)=>Z.stdout.write(JSON.stringify(M)+`
-`),B=t(N);if(K.action==="status"||K.action==="doctor"){let M=await U0(N,"status"),T=$0(N),_={enrolled:!!B||!!M,deviceId:B?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:B||M?Date.parse(B?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return H(_),0;let j=!0;try{K$(N)}catch{j=!1}return H({..._,workspace:j,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":B&&M0(N)instanceof n$?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),j&&(B||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await U0(N,M);if(T){if(H(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(MK);return 0}}e(g(N),!0);let q=await y6(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")I0(N,{...T,drained:K.action==="drain"});return H({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");K$(N);let j=()=>{w0(N),L4(N)};if(_)j();let D=async()=>{let z=N2(N),L=T?await z3(N,T,z,J.enroll):await w6(N,K.credentialPath,J,z);return{proof:z,enrolled:L}},{proof:O,enrolled:F}=await D().catch((z)=>{if(T||!(z instanceof n0)||!z.deviceRemoved)throw z;return j(),D()});return y0(F,d(N).state,{proofStore:O}),I0(N,{version:1,drained:!1,revoked:!1}),H({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=M0(N),_=new n1(O$(N.apiOrigin),S0(N.proxy),T);if(I0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return w0(N),H({revoked:!0,localKeyRemoved:!0}),0}if(K$(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await k6(N,q.owner.nonce,G,V,async(T)=>K.enrollmentPath?z3(N,K.enrollmentPath,T,J.enroll):w6(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await t1(N,M,M0(N),q.owner.nonce,V)}return 0}finally{q.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
+`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await HK($,J,V,G);let K=UK($);if(!K)return Z.stdout.write(BK),0;if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),H=(M)=>Z.stdout.write(JSON.stringify(M)+`
+`),B=t(N);if(K.action==="status"||K.action==="doctor"){let M=await U0(N,"status"),T=$0(N),_={enrolled:!!B||!!M,deviceId:B?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:B||M?Date.parse(B?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return H(_),0;let j=!0;try{K$(N)}catch{j=!1}return H({..._,workspace:j,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":B&&M0(N)instanceof n$?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),j&&(B||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await U0(N,M);if(T){if(H(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(TK);return 0}}e(g(N),!0);let q=await f6(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
+`)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")I0(N,{...T,drained:K.action==="drain"});return H({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");K$(N);let j=()=>{w0(N),L4(N)};if(_)j();let D=async()=>{let z=N2(N),L=T?await z3(N,T,z,J.enroll):await w6(N,K.credentialPath,J,z);return{proof:z,enrolled:L}},{proof:O,enrolled:F}=await D().catch((z)=>{if(T||!(z instanceof n0)||!z.deviceRemoved)throw z;return j(),D()});return y0(F,d(N).state,{proofStore:O}),I0(N,{version:1,drained:!1,revoked:!1}),H({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=M0(N),_=new n1(O$(N.apiOrigin),S0(N.proxy),T);if(I0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return w0(N),H({revoked:!0,localKeyRemoved:!0}),0}if(K$(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await y6(N,q.owner.nonce,G,V,async(T)=>K.enrollmentPath?z3(N,K.enrollmentPath,T,J.enroll):w6(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await t1(N,M,M0(N),q.owner.nonce,V)}return 0}finally{q.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
 `);let H=$.includes("--json")?void 0:Q1(K instanceof n0&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(H)Z.stderr.write(`${H}
-`);return N==="worker_revoked"&&X?0:1}}var HK=60000;async function y6($,J){let Z=Date.now()+$.shutdownGraceMs+HK,Q=!1;for(;;){let X=t0({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await U0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var MK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function w6($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return r0($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??L$($),G=await(Z.enrollmentCredentials??j$)($,Y);if(!G)throw Error(X);let V=Z.createTicketClient?.(G)??new R$(G,{credentialsPath:Y,fetchImpl:S0($.proxy)});return F4($,G,V,Q,Z.enroll)}import{spawn as TK}from"child_process";import{existsSync as _K,readFileSync as FK,unlinkSync as LK}from"fs";import{join as jK}from"path";var WK=120,DK=15,OK=5000;function t2($={}){let J=$.stateDirectory?jK($.stateDirectory,zK):null;if(J)AK(J);let Z=["/bin/bash","/usr/bin/bash"].find((B)=>_K(B));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??WK)),X=$.pid??process.pid,Y=Math.min(DK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${f6(r)} > ${f6(J)} 2>/dev/null
+`);return N==="worker_revoked"&&X?0:1}}var MK=60000;async function f6($,J){let Z=Date.now()+$.shutdownGraceMs+MK,Q=!1;for(;;){let X=t0({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await U0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var TK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function w6($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return r0($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??L$($),G=await(Z.enrollmentCredentials??j$)($,Y);if(!G)throw Error(X);let V=Z.createTicketClient?.(G)??new R$(G,{credentialsPath:Y,fetchImpl:S0($.proxy)});return F4($,G,V,Q,Z.enroll)}import{spawn as _K}from"child_process";import{existsSync as FK,readFileSync as LK,unlinkSync as jK}from"fs";import{join as WK}from"path";var DK=120,OK=15,zK=5000;function t2($={}){let J=$.stateDirectory?WK($.stateDirectory,AK):null;if(J)RK(J);let Z=["/bin/bash","/usr/bin/bash"].find((B)=>FK(B));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??DK)),X=$.pid??process.pid,Y=Math.min(OK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${h6(r)} > ${h6(J)} 2>/dev/null
 `:"",V=(B)=>`[ $((SECONDS - started)) -ge ${Math.max(1,B-1)} ]`,K=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
 while :; do started=$SECONDS
 IFS= read -r -t ${Q} pulse && continue
@@ -164,8 +164,8 @@ if ${V(Y)} && parent_is_worker; then
   ${G}kill -KILL ${X}
 fi
 exit 0
-done`,N=TK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let H=setInterval(()=>N.stdin.write(`
-`),Math.min(OK,Q*1000/4));return H.unref(),N.unref(),{stop(){clearInterval(H),N.stdin.end()}}}var zK="worker-stalled";function f6($){return`'${$.replaceAll("'","'\\''")}'`}function AK($){let J;try{J=FK($,"utf8"),LK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{k1(W2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var xK=`Share this computer as a machine
+done`,N=_K(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let H=setInterval(()=>N.stdin.write(`
+`),Math.min(zK,Q*1000/4));return H.unref(),N.unref(),{stop(){clearInterval(H),N.stdin.end()}}}var AK="worker-stalled";function h6($){return`'${$.replaceAll("'","'\\''")}'`}function RK($){let J;try{J=LK($,"utf8"),jK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{k1(W2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var SK=`Share this computer as a machine
 Usage:
   reason serve                     This computer, signed in (machine name: its hostname)
@@ -208,20 +208,20 @@ the worker unless --sandbox is set. Settings live in
 ~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
 folder served for NAME is its own worker. Use
 \`reason worker status|revoke --config <that file>\` for advanced control.
-`,SK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,bK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,d6="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",h6=["REASON_TOKEN","REASON_MACHINE_TOKEN"],l6="my-computer";function v9($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&y1(J)&&J!==I2?J:l6}class Q0 extends Error{}function wK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let H=$[N];if(H==="--help"||H==="-h"||H==="help")return null;if(H==="--dir"||H==="--token"||H==="--org"){let B=$[N+1];if(!B||B.startsWith("-"))throw new Q0(`Missing value after ${H}.`);if(Q.has(H))throw new Q0(`${H} may be specified only once.`);Q.set(H,B),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(H)){X.add(H==="-y"?"--yes":H);continue}if(H.startsWith("-"))throw new Q0(`Unknown option: ${H}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=H}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!y1(Z)&&!SK.test(Z))throw new Q0(d6);if(Z.toLowerCase()===I2)throw new Q0(`"${I2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!bK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...V===void 0?{}:{org:V.toLowerCase()}}}function J3($,J){let Z=EK($,J??"."),Q;try{Q=u6(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!CK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var o2=($)=>s$($,".reason","workers"),h9=($)=>u(d($).state);function kK($,J,Z){let Q=s$(o2($),J);if(R0(s$(Q,"worker.json"))?.workspaceRoot===Z)return Q;return s$(o2($),`${J}@${RK("sha256").update(Z).digest("hex").slice(0,8)}`)}function p6($){let{stateDirectory:J}=$;if(Z2($.workspaceRoot,J)||Z2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function R0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function m9($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function yK($,J){$.stdout.write(`${J} [y/N] `);let Z=await m6($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function Z3($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var fK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function c6($){try{return await $()}catch(J){let Z=J instanceof m0?fK[J.code]:void 0;throw Z?Error(Z):J}}async function hK($,J,Z,Q){let X=p6({...J,name:$.name??l6,stateDirectory:s$(o2(Z),".token-enrollment")}),Y=W$(X,{stored:!1}),G=await c6(()=>v6({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!y1(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??G.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function mK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??j$)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((V)=>new R$(V)))(Y);return _4(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>c6(async()=>{try{return await G.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof m0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
-`)}catch(K){if(!(K instanceof m0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,V)})})}}async function s6($,J,Z,Q){let X=await S2($,Q,()=>g6($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!q$($,J,Z))return null;return h3($),X}function g9($,J){let Z=o2($);if(!u(Z))return[];let Q=J.toLowerCase();return IK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=s$(Z,X,"worker.json"),V=R0(G);return V?[{path:G,config:V}]:[]})}async function vK($,J,Z,Q,X){let Y=g9(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??U0,V=[];for(let K of Y){let N=await G(K.config,"stop")!==null,H=$3(K.config,X),B=N||H!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:B,service:H?.label??null}),!$.json&&H)Z.stdout.write(`Removed background service ${H.label} (${K.config.workspaceRoot}); it won't start again.
+`,bK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,wK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,l6="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",m6=["REASON_TOKEN","REASON_MACHINE_TOKEN"],p6="my-computer";function v9($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&y1(J)&&J!==I2?J:p6}class Q0 extends Error{}function kK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let H=$[N];if(H==="--help"||H==="-h"||H==="help")return null;if(H==="--dir"||H==="--token"||H==="--org"){let B=$[N+1];if(!B||B.startsWith("-"))throw new Q0(`Missing value after ${H}.`);if(Q.has(H))throw new Q0(`${H} may be specified only once.`);Q.set(H,B),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(H)){X.add(H==="-y"?"--yes":H);continue}if(H.startsWith("-"))throw new Q0(`Unknown option: ${H}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=H}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!y1(Z)&&!bK.test(Z))throw new Q0(l6);if(Z.toLowerCase()===I2)throw new Q0(`"${I2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!wK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...V===void 0?{}:{org:V.toLowerCase()}}}function J3($,J){let Z=xK($,J??"."),Q;try{Q=d6(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!PK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var o2=($)=>s$($,".reason","workers"),h9=($)=>u(d($).state);function yK($,J,Z){let Q=s$(o2($),J);if(R0(s$(Q,"worker.json"))?.workspaceRoot===Z)return Q;return s$(o2($),`${J}@${IK("sha256").update(Z).digest("hex").slice(0,8)}`)}function c6($){let{stateDirectory:J}=$;if(Z2($.workspaceRoot,J)||Z2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function R0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function m9($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function fK($,J){$.stdout.write(`${J} [y/N] `);let Z=await v6($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function Z3($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var hK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function s6($){try{return await $()}catch(J){let Z=J instanceof m0?hK[J.code]:void 0;throw Z?Error(Z):J}}async function mK($,J,Z,Q){let X=c6({...J,name:$.name??p6,stateDirectory:s$(o2(Z),".token-enrollment")}),Y=W$(X,{stored:!1}),G=await s6(()=>g6({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!y1(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??G.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function vK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??j$)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((V)=>new R$(V)))(Y);return _4(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>s6(async()=>{try{return await G.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof m0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
+`)}catch(K){if(!(K instanceof m0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,V)})})}}async function a6($,J,Z,Q){let X=await S2($,Q,()=>u6($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!q$($,J,Z))return null;return h3($),X}function g9($,J){let Z=o2($);if(!u(Z))return[];let Q=J.toLowerCase();return CK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=s$(Z,X,"worker.json"),V=R0(G);return V?[{path:G,config:V}]:[]})}async function gK($,J,Z,Q,X){let Y=g9(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??U0,V=[];for(let K of Y){let N=await G(K.config,"stop")!==null,H=$3(K.config,X),B=N||H!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:B,service:H?.label??null}),!$.json&&H)Z.stdout.write(`Removed background service ${H.label} (${K.config.workspaceRoot}); it won't start again.
 `);if(!$.json)Z.stdout.write(B?`Stopping machine "${$.name}" in ${K.config.workspaceRoot}; current work finishes first.
 `:`Machine "${$.name}" in ${K.config.workspaceRoot} is not running.
 `)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:V})}
-`);return 0}async function a6($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??N$,X=J.env??process.env,Y=h6.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of h6)delete process.env[G];try{let G=wK($,Y);if(!G)return Z.stdout.write(xK),0;let V=u6(J.home??B0()),K=J.serviceHost??J$(V);if(G.stop)return await vK({...G,name:G.name},V,Z,J,K);let N=J.channel??$$(),H=J3(J.cwd??process.cwd(),G.dir),B=G.service?T1(K,X):void 0,q={channel:N,apiOrigin:Q2(X,N),workspaceRoot:H,once:G.once,sandbox:G.sandbox},M=G.token?await hK({...G,token:G.token},q,V,J):void 0,T=M?.name??G.name??v9((J.hostname??PK)()),_=kK(V,T,H),j=s$(_,"worker.json"),D=R0(j);if(M&&D&&h9(D)&&$0(D).revoked)w0(D);let O=!M&&D!==null&&h9(D)&&(!D$(X,"REASON_API_URL")?.trim()||C0(q.apiOrigin,D.apiOrigin))?D.apiOrigin:void 0,F=p6({...q,...O?{apiOrigin:O}:{},name:T,stateDirectory:_}),z=D!==null&&h9(D);if(z&&N0(D)!==N0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${D.workspaceRoot}, ${D.executionMode==="host"?"your user permissions":"sandboxed"}).
+`);return 0}async function i6($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??N$,X=J.env??process.env,Y=m6.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of m6)delete process.env[G];try{let G=kK($,Y);if(!G)return Z.stdout.write(SK),0;let V=d6(J.home??B0()),K=J.serviceHost??J$(V);if(G.stop)return await gK({...G,name:G.name},V,Z,J,K);let N=J.channel??$$(),H=J3(J.cwd??process.cwd(),G.dir),B=G.service?T1(K,X):void 0,q={channel:N,apiOrigin:Q2(X,N),workspaceRoot:H,once:G.once,sandbox:G.sandbox},M=G.token?await mK({...G,token:G.token},q,V,J):void 0,T=M?.name??G.name??v9((J.hostname??EK)()),_=yK(V,T,H),j=s$(_,"worker.json"),D=R0(j);if(M&&D&&h9(D)&&$0(D).revoked)w0(D);let O=!M&&D!==null&&h9(D)&&(!D$(X,"REASON_API_URL")?.trim()||C0(q.apiOrigin,D.apiOrigin))?D.apiOrigin:void 0,F=c6({...q,...O?{apiOrigin:O}:{},name:T,stateDirectory:_}),z=D!==null&&h9(D);if(z&&N0(D)!==N0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${D.workspaceRoot}, ${D.executionMode==="host"?"your user permissions":"sandboxed"}).
 Run it with: reason serve ${T} ${m9(D)}
 Or remove it first: reason worker revoke --config ${j}`)}let L=F.lifetime==="persistent"?_1(F,K):null;if(L&&!G.service&&X[p$]!==L.label)return Z.stdout.write(`Machine "${T}" in ${H} already runs as a background service (${L.label}).
   Logs: ${L.logs}
   Stop it with: reason stop ${T}
-`),0;if(G.service&&z&&!L&&await(J.controlWorker??U0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${H}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let W=F.lifetime==="ephemeral"||!z;if(W&&!y1(T))throw new Q0(d6);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
+`),0;if(G.service&&z&&!L&&await(J.controlWorker??U0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${H}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let W=F.lifetime==="ephemeral"||!z;if(W&&!y1(T))throw new Q0(l6);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
 `);else if(W&&!G.yes&&!M){let I=`Sessions on "${T}" will run commands in ${H} with your user permissions (no sandbox). Continue?`,C=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!C)throw new Q0(`${I.replace(/ Continue\?$/,"")}
-Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>yK(Z,h)))(I))return Z.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!z)e(F.stateDirectory,!0),c(j,F);let R={...J.worker,enrollmentInput:mK(T,M,J,Z)};if(F.lifetime==="persistent"&&!z){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
+Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>fK(Z,h)))(I))return Z.stderr.write(`Cancelled. Nothing was added.
+`),1}if(!z)e(F.stateDirectory,!0),c(j,F);let R={...J.worker,enrollmentInput:vK(T,M,J,Z)};if(F.lifetime==="persistent"&&!z){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
 `);let C=await Q(["enroll","--config",j],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(C!==0)return C}if(B){let I;try{I=e2({config:F,launcher:B,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(C){if(!(C instanceof I$))throw C;throw new Q0(`${C.message}
 This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${m9(F)}
 Or try the background service again with: reason serve ${T} ${m9(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${H}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${I.label} (starts at ${I.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${I.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...I.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
@@ -229,8 +229,8 @@ Or try the background service again with: reason serve ${T} ${m9(F)} --service`)
 `));let E=L&&X[p$]===L.label&&!J.runWorker?t2({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",j],{...R,io:{stdout:Z.stdout,stderr:Z3(Z.stderr)},onStartup:(I)=>{if(I==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
 `);J.worker?.onStartup?.(I)}})}finally{E?.stop()}}catch(G){if(G instanceof Q0||G instanceof I$){let N=G instanceof I$&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
 `),2}let V=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:null,K=V?Q1(V):void 0;return Z.stderr.write(`Reason: ${V?K?`${K} (${V})`:V:"could not prepare this machine."}
-`),1}}var gK=200;var DL=U.strictObject({version:U.literal(1),session_ids:U.array(U.string().min(1).max(200)).max(gK)});function F1($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as i6}from"child_process";import{readFileSync as uK,rmdirSync as dK,rmSync as lK}from"fs";import{join as u9}from"path";var pK=["Reason.app","Ara Sidecar.app","Ara Device.app"],cK="sidecar_retire_failed";function sK($){return u9($,"Library","Application Support","Ara","Sidecar")}function aK($){try{let J=uK(u9($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function r6($,J={}){let Z=sK($),Q=pK.map((V)=>u9(Z,V)).filter(aK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>i6("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),G=J.command??((V,K)=>i6(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
-`)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)G(n6,["-u",V]),lK(V,{recursive:!0,force:!0});try{dK(Z)}catch{}}catch{return{status:"failed",code:cK}}return{status:"removed",bundles:Q}}var $B=`Connect this computer to Reason
+`),1}}var uK=200;var OL=U.strictObject({version:U.literal(1),session_ids:U.array(U.string().min(1).max(200)).max(uK)});function F1($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as n6}from"child_process";import{readFileSync as dK,rmdirSync as lK,rmSync as pK}from"fs";import{join as u9}from"path";var cK=["Reason.app","Ara Sidecar.app","Ara Device.app"],sK="sidecar_retire_failed";function aK($){return u9($,"Library","Application Support","Ara","Sidecar")}function iK($){try{let J=dK(u9($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function t6($,J={}){let Z=aK($),Q=cK.map((V)=>u9(Z,V)).filter(iK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>n6("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),G=J.command??((V,K)=>n6(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
+`)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)G(r6,["-u",V]),pK(V,{recursive:!0,force:!0});try{lK(Z)}catch{}}catch{return{status:"failed",code:sK}}return{status:"removed",bundles:Q}}var JB=`Connect this computer to Reason
 Usage:
   reason connect                 Your computer, kept connected in the background
@@ -286,7 +286,7 @@ One computer serves several Reason accounts. Signed in as another account than
 the one it is connected for, reason connect connects it for that account too,
 as that account's own computer in the workspace it signed in to; the other
 accounts stay connected. That account's \`reason logout\` removes only its own.
-`,JB=`Disconnect this computer from Reason
+`,ZB=`Disconnect this computer from Reason
 Usage:
   reason disconnect              Stop your computer's connection and remove it from Reason, in every
@@ -301,43 +301,43 @@ Usage:
                                  Reason (all of it when it is the only account here), and it is not kept
                                  disconnected: the next reason "\u2026" connects it again
   --yes, -y                      Accepted for scripts; disconnect never asks
-`;class p extends Error{code;constructor($,J="worker_connect_refused"){super($);this.code=J}}var ZB=4,Y3={write:()=>!0};function g0($,J,Z=!1){let Q=F7($,J,Z);return Q.length===1?Q[0]:_0(Z7(_0($,".config")),..._7(J,Z))}var _7=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function F7($,J,Z=!1){let Q=$;try{Q=Z$($)}catch{}return["ara","reason"].map((X)=>_0(Q,".config",X,..._7(J,Z))).filter(QB)}function QB($){try{if(Z$($)!==$)return!1;return R0(_0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var L7="disconnected.json";function Uj($,J){return u(_0(g0($,J),L7))}function G3($,J,Z){let Q=_0(g0($,J),L7);if(!Z){L1(Q,{force:!0});return}e(s9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function XB($){let J=new Map,Z=new Set;for(let B=0;B<$.length;B+=1){let q=$[B];if(q==="--help"||q==="-h"||q==="help")return null;if(["--to","--token","--folder","--sessions",Q3,X3,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(q)){let M=$[B+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${q}.`);if(J.has(q))throw new p(`${q} may be specified only once.`);J.set(q,M),B+=1;continue}if(["--once","--yes","-y","--minimal"].includes(q)){Z.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new p(`Unknown option: ${q}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${q}. To add this computer to a team machine, use --to ${q}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(X3)&&!J.has(Q3))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((B)=>B!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((B)=>J.has(B));if(Y.length>0&&(J.size>1||[...Z].some((B)=>B!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let H=(B,q)=>q===void 0?{}:{[B]:q};return{...H("to",J.get("--to")),...H("token",J.get("--token")),...H("folder",J.get("--folder")),...H("sessions",Q===void 0?void 0:Number(Q)),...H("keepAwake",X===void 0?void 0:X==="on"),...H("userChrome",G===void 0?void 0:G==="on"),...H("cloudSessions",V===void 0?void 0:V==="on"),...H("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...H("proxy",J.get(Q3)),...H("proxyCaFile",J.get(X3)),...H("apiKey",J.get("--api-key")),...H("name",N),...H("apiUrl",J.get("--api-url")),...H("addFolder",J.get("--add-folder")),...H("removeFolder",J.get("--remove-folder"))}}var C$=($)=>u(d($).state),j7=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function W7($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function YB($){return $===1?"one at a time":`up to ${$} at once`}function D7($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=J3($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!A1(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?Q2({REASON_API_URL:J.apiUrl},$.channel):Z&&!D$($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:Q2($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&C0(X,Z.apiOrigin))X=Z.apiOrigin;if(!J7(X)&&!$7($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=Y7({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof Q7))throw V;throw new p(V.message)}let G=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??v9(($.options.hostname??oK)()),slots:J.sessions??Z?.slots??ZB,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function O7($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function a9($,J,Z,Q,X){if($0($).revoked){if(C$($))try{w0($)}catch{}C3($);let V=[];try{V=tK(g($))}catch{}for(let K of V)if(K!=="workspaces")L1(_0(g($),K),{recursive:!0,force:!0})}else if(C$($))w0($);e($.stateDirectory,!0),c(J,$);let Y=GB(Z.stderr),G=await(Q.runWorker??N$)(["enroll","--config",J],{...i9(Q.worker,X),io:{stdout:Y3,stderr:Y}});if(G!==0)Z.stderr.write(`Reason: this computer was not connected. (${Y.code()??"worker_command_failed"})
-`);return G}function GB($){let J=null;return{write:(Z)=>{for(let Q of Z.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))J=Q[1];return $.write(Z)},code:()=>J}}function X2($,J,Z){let Q=K7(q2(P1("REASON_CLI_CHANNEL",J),$));return Q&&C0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function KB($,J,Z,Q){let{config:X,configPath:Y}=T2($,J),G=(N)=>{try{return N!==null&&F1(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=R0(Y)}catch{}if(G(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let K=await a9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&C$(X))await K3(X,Y,Z,Q);if(L1(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function i9($,J){return J?{...$,enrollmentCredentials:(Z)=>_3(Z,J)}:{...$}}async function n9($,J,Z,Q,X,Y="connect"){if(await r9($,Q,X,Y),Y==="connect"&&!await P7($,Z,Q))return!1;if(!await K3($,J,Z,Q))return!1;return G4($.stateDirectory),L1($.stateDirectory,{recursive:!0,force:!0}),!0}async function K3($,J,Z,Q){if(!C$($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??N$)(["revoke","--config",J],{...Q.worker,io:{stdout:Y3,stderr:Y?Z.stderr:Y3}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function r9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??U0,G=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&$3($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((H)=>setTimeout(H,250))}}function t9($,J){return J==="darwin"&&$.userChrome!==!1}function d9($,J,Z){let Q=[...t9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${W7($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
-`)}function l9($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${YB(J.slots)}`,`  Mode:      ${W7(J)}`,...J.proxy?[`  Proxy:     ${X7(J.proxy)}`]:[],...t9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
-`)}async function t6($,J,Z){let{io:Q,options:X}=Z;if(F7(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:s9(J),timestamp:new Date().toISOString()})}
+`;class p extends Error{code;constructor($,J="worker_connect_refused"){super($);this.code=J}}var QB=4,Y3={write:()=>!0};function g0($,J,Z=!1){let Q=L7($,J,Z);return Q.length===1?Q[0]:_0(Q7(_0($,".config")),...F7(J,Z))}var F7=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function L7($,J,Z=!1){let Q=$;try{Q=Z$($)}catch{}return["ara","reason"].map((X)=>_0(Q,".config",X,...F7(J,Z))).filter(XB)}function XB($){try{if(Z$($)!==$)return!1;return R0(_0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var j7="disconnected.json";function Vj($,J){return u(_0(g0($,J),j7))}function G3($,J,Z){let Q=_0(g0($,J),j7);if(!Z){L1(Q,{force:!0});return}e(s9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function YB($){let J=new Map,Z=new Set;for(let B=0;B<$.length;B+=1){let q=$[B];if(q==="--help"||q==="-h"||q==="help")return null;if(["--to","--token","--folder","--sessions",Q3,X3,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(q)){let M=$[B+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${q}.`);if(J.has(q))throw new p(`${q} may be specified only once.`);J.set(q,M),B+=1;continue}if(["--once","--yes","-y","--minimal"].includes(q)){Z.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new p(`Unknown option: ${q}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${q}. To add this computer to a team machine, use --to ${q}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(X3)&&!J.has(Q3))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((B)=>B!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((B)=>J.has(B));if(Y.length>0&&(J.size>1||[...Z].some((B)=>B!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let H=(B,q)=>q===void 0?{}:{[B]:q};return{...H("to",J.get("--to")),...H("token",J.get("--token")),...H("folder",J.get("--folder")),...H("sessions",Q===void 0?void 0:Number(Q)),...H("keepAwake",X===void 0?void 0:X==="on"),...H("userChrome",G===void 0?void 0:G==="on"),...H("cloudSessions",V===void 0?void 0:V==="on"),...H("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...H("proxy",J.get(Q3)),...H("proxyCaFile",J.get(X3)),...H("apiKey",J.get("--api-key")),...H("name",N),...H("apiUrl",J.get("--api-url")),...H("addFolder",J.get("--add-folder")),...H("removeFolder",J.get("--remove-folder"))}}var C$=($)=>u(d($).state),W7=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function D7($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function GB($){return $===1?"one at a time":`up to ${$} at once`}function O7($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=J3($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!A1(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?Q2({REASON_API_URL:J.apiUrl},$.channel):Z&&!D$($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:Q2($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&C0(X,Z.apiOrigin))X=Z.apiOrigin;if(!Z7(X)&&!J7($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=G7({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof X7))throw V;throw new p(V.message)}let G=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??v9(($.options.hostname??eK)()),slots:J.sessions??Z?.slots??QB,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function z7($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function a9($,J,Z,Q,X){if($0($).revoked){if(C$($))try{w0($)}catch{}C3($);let V=[];try{V=oK(g($))}catch{}for(let K of V)if(K!=="workspaces")L1(_0(g($),K),{recursive:!0,force:!0})}else if(C$($))w0($);e($.stateDirectory,!0),c(J,$);let Y=KB(Z.stderr),G=await(Q.runWorker??N$)(["enroll","--config",J],{...i9(Q.worker,X),io:{stdout:Y3,stderr:Y}});if(G!==0)Z.stderr.write(`Reason: this computer was not connected. (${Y.code()??"worker_command_failed"})
+`);return G}function KB($){let J=null;return{write:(Z)=>{for(let Q of Z.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))J=Q[1];return $.write(Z)},code:()=>J}}function X2($,J,Z){let Q=B7(q2(P1("REASON_CLI_CHANNEL",J),$));return Q&&C0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function BB($,J,Z,Q){let{config:X,configPath:Y}=T2($,J),G=(N)=>{try{return N!==null&&F1(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=R0(Y)}catch{}if(G(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let K=await a9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&C$(X))await K3(X,Y,Z,Q);if(L1(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function i9($,J){return J?{...$,enrollmentCredentials:(Z)=>_3(Z,J)}:{...$}}async function n9($,J,Z,Q,X,Y="connect"){if(await r9($,Q,X,Y),Y==="connect"&&!await E7($,Z,Q))return!1;if(!await K3($,J,Z,Q))return!1;return G4($.stateDirectory),L1($.stateDirectory,{recursive:!0,force:!0}),!0}async function K3($,J,Z,Q){if(!C$($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??N$)(["revoke","--config",J],{...Q.worker,io:{stdout:Y3,stderr:Y?Z.stderr:Y3}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function r9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??U0,G=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&$3($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((H)=>setTimeout(H,250))}}function t9($,J){return J==="darwin"&&$.userChrome!==!1}function d9($,J,Z){let Q=[...t9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${D7($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
+`)}function l9($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),`  Sessions:  ${GB(J.slots)}`,`  Mode:      ${D7(J)}`,...J.proxy?[`  Proxy:     ${Y7(J.proxy)}`]:[],...t9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
+`)}async function o6($,J,Z){let{io:Q,options:X}=Z;if(L7(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:s9(J),timestamp:new Date().toISOString()})}
 `);let Y=A2(_0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
 `);P9(Z.home,Z.host.platform);let G=G8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(M)=>Q.stderr.write(`${M}
 `),host:Z.host}),V=o4({...G,log:(M)=>Q.stderr.write(`${M}
 `)}),{configPath:K}=V,N=V.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let H=(M,T)=>{let _=U3(Z.home,Z.channel),j;try{let O=null;try{O=T.keep?null:t(N)?.orgId.toLowerCase()??null}catch{}if(j=F2(N,{prefer:X2(Z.home,Z.channel,N),...T}),j&&O)_2(j,O)}finally{_()}if(!j)return!1;N=j;let D="";try{D=` (workspace ${t(j)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${M}; this computer goes on running Sessions for its other Reason account${D}.
-`),!0};if($0(N).revoked&&!H("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!F1(N)){let M=u0(N.stateDirectory)??void 0,T=M?null:X2(Z.home,Z.channel,N);if(!M&&!(T&&x1(N,T)))H("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let B=N.executionMode==="confined";if(B||!F1(N)){let M=u0(N.stateDirectory)??void 0;if(Q.stderr.write(B?j7:`Reason: this computer's connection expired; renewing it with ${M?"its API key":"your login"}\u2026
-`),await a9(J0.parse({...N,executionMode:"host"}),K,Q,X,M)!==0)return Q.stderr.write(M?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let q=new AbortController;if(!X.runWorker)import("./ask-relay-9p6w86km.js").then(({runBackgroundAskRelay:M})=>M(q.signal,(T)=>Q.stderr.write(`${T}
-`))).catch(()=>{});try{for(;;){let M=u0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:t2({stateDirectory:N.stateDirectory}),_=!1,j;try{j=await(X.runWorker??N$)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...M,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{_=!0}})}finally{T?.stop()}if(!_)return j;if(!H("this computer's connection was removed from Reason",{keep:!1}))break}return G3(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{q.abort()}}async function BB($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??U0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=g0(Y,G,!0),N=D7({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),H=O7(N,Z.apiKey??(J?u0(J.stateDirectory)??void 0:void 0)),B=_0(K,"worker.json");return e(K,!0),c(B,H),Q.stdout.write(l9(`Reason: connecting "${H.name}" while this command runs`,H,Z.host.platform,["Connecting\u2026"])),(X.runWorker??N$)(["start","--config",B],{...i9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:Z3(Q.stderr)},onStartup:(q)=>{if(q==="ready")Q.stdout.write(`Connected. Start Sessions on "${H.name}" from Reason. Press Ctrl-C to stop.
-`);X.worker?.onStartup?.(q)}})}function UB($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),V8(d(J).daemon,$);let X=R2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var VB=U.object({root:U.object({id:U.string().min(1).max(160),label:U.string().max(160),path_fingerprint:U.string()})});async function z7($,J,Z,Q){let X=await(i9(Q.worker,Z).enrollmentCredentials??j$)($,L$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new R$(X,{credentialsPath:L$($),fetchImpl:S0($.proxy)}),G=(V)=>V instanceof m0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=j4($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((B)=>{if(G(B))throw Error("worker_folders_unavailable");if(B instanceof m0&&B.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw B}),H=VB.parse(N).root;if(H.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:H.id,label:H.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof m0&&K.code==="root_not_found"))throw K})}}}function A7($,J,Z){y0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:N0($)}},d($).state,{proofStore:M0($)})}async function R7($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&u0(J.stateDirectory)===null?X2(Q.home,Q.channel,J):null,K=J&&V&&C$(J)&&!x1(J,V)?k0(J).find((I)=>I.account&&I.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,H=K?K.configPath:Z,B=N&&C$(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!B||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let q=$.addFolder!==void 0,M=q?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=J3(T,M)}catch(I){if(q)throw new p(I instanceof Error?I.message:String(I));_=eK(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let j=N.folders??[],D=B.roots.slice(1).find((I)=>I.path===_);if(!q&&!D&&!j.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(q&&!A1(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(q&&!D&&j.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??u0(N.stateDirectory)??void 0,F=await z7(N,B,O,Y),z=B.roots.filter((I)=>I.path!==_);if(q)z=[...z,await F.add(_)];else if(D)await F.remove(D.id);A7(N,B,z);let L=q?[...j.filter((I)=>I!==_),_]:j.filter((I)=>I!==_),{folders:W,...R}=N;if(c(H,J0.parse({...R,...L.length?{folders:L}:{}})),!await(Y.controlWorker??U0)(J,"reload_roots").then(()=>!0,()=>!1))q$(J,G,"connect");return X.stdout.write(q?`Added ${_}. Sessions on "${N.name}" may run in it.
+`),!0};if($0(N).revoked&&!H("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!F1(N)){let M=u0(N.stateDirectory)??void 0,T=M?null:X2(Z.home,Z.channel,N);if(!M&&!(T&&x1(N,T)))H("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let B=N.executionMode==="confined";if(B||!F1(N)){let M=u0(N.stateDirectory)??void 0;if(Q.stderr.write(B?W7:`Reason: this computer's connection expired; renewing it with ${M?"its API key":"your login"}\u2026
+`),await a9(J0.parse({...N,executionMode:"host"}),K,Q,X,M)!==0)return Q.stderr.write(M?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let q=new AbortController;if(!X.runWorker)import("./ask-relay-1vtqq978.js").then(({runBackgroundAskRelay:M})=>M(q.signal,(T)=>Q.stderr.write(`${T}
+`))).catch(()=>{});try{for(;;){let M=u0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:t2({stateDirectory:N.stateDirectory}),_=!1,j;try{j=await(X.runWorker??N$)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...M,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{_=!0}})}finally{T?.stop()}if(!_)return j;if(!H("this computer's connection was removed from Reason",{keep:!1}))break}return G3(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{q.abort()}}async function UB($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??U0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=g0(Y,G,!0),N=O7({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),H=z7(N,Z.apiKey??(J?u0(J.stateDirectory)??void 0:void 0)),B=_0(K,"worker.json");return e(K,!0),c(B,H),Q.stdout.write(l9(`Reason: connecting "${H.name}" while this command runs`,H,Z.host.platform,["Connecting\u2026"])),(X.runWorker??N$)(["start","--config",B],{...i9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:Z3(Q.stderr)},onStartup:(q)=>{if(q==="ready")Q.stdout.write(`Connected. Start Sessions on "${H.name}" from Reason. Press Ctrl-C to stop.
+`);X.worker?.onStartup?.(q)}})}function VB($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),V8(d(J).daemon,$);let X=R2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
+`),0}var NB=U.object({root:U.object({id:U.string().min(1).max(160),label:U.string().max(160),path_fingerprint:U.string()})});async function A7($,J,Z,Q){let X=await(i9(Q.worker,Z).enrollmentCredentials??j$)($,L$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new R$(X,{credentialsPath:L$($),fetchImpl:S0($.proxy)}),G=(V)=>V instanceof m0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=j4($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((B)=>{if(G(B))throw Error("worker_folders_unavailable");if(B instanceof m0&&B.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw B}),H=NB.parse(N).root;if(H.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:H.id,label:H.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof m0&&K.code==="root_not_found"))throw K})}}}function R7($,J,Z){y0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:N0($)}},d($).state,{proofStore:M0($)})}async function I7($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&u0(J.stateDirectory)===null?X2(Q.home,Q.channel,J):null,K=J&&V&&C$(J)&&!x1(J,V)?k0(J).find((I)=>I.account&&I.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,H=K?K.configPath:Z,B=N&&C$(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!B||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let q=$.addFolder!==void 0,M=q?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=J3(T,M)}catch(I){if(q)throw new p(I instanceof Error?I.message:String(I));_=$B(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let j=N.folders??[],D=B.roots.slice(1).find((I)=>I.path===_);if(!q&&!D&&!j.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(q&&!A1(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(q&&!D&&j.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??u0(N.stateDirectory)??void 0,F=await A7(N,B,O,Y),z=B.roots.filter((I)=>I.path!==_);if(q)z=[...z,await F.add(_)];else if(D)await F.remove(D.id);R7(N,B,z);let L=q?[...j.filter((I)=>I!==_),_]:j.filter((I)=>I!==_),{folders:W,...R}=N;if(c(H,J0.parse({...R,...L.length?{folders:L}:{}})),!await(Y.controlWorker??U0)(J,"reload_roots").then(()=>!0,()=>!1))q$(J,G,"connect");return X.stdout.write(q?`Added ${_}. Sessions on "${N.name}" may run in it.
 `:`Removed ${_}. Sessions on "${N.name}" no longer run in it.
-`),0}async function Vj($,J,Z){let Q=p9(Z),X=U3(Q.home,Q.channel);try{let Y=_0(g0(Q.home,Q.channel),"worker.json");return await R7({once:!1,yes:J,addFolder:$},R0(Y),Y,Q)===0}finally{X()}}function p9($,J){let Z=Z$($.home??B0()),Q=$.env??process.env;return{io:$.io??B3(),options:$,home:Z,channel:$.channel??$$(),environment:Q,apiKey:J??B7(Q),host:$.serviceHost??J$(Z)}}async function NB($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await z7($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}A7(J,X,Y)}var I7=Symbol("serve here");async function qB($,J,Z,Q){let{io:X,options:Y,home:G,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let P=r6(G);if(P.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${P.code}).
-`)}let H=J&&!Q.apiKey&&u0(J.stateDirectory)===null?X2(G,V,J):null,B=J&&H&&$0(J).revoked&&k0(J).some((P)=>P.account&&P.organizationId===H)?F2(J,{prefer:H,keep:!1})??J:J,q=D7({parsed:$,saved:B,stateDirectory:g0(G,V),lifetime:"persistent",home:G,channel:V,options:Y,environment:K});if(G3(G,V,!1),B?.executionMode==="confined")X.stdout.write(j7);let M=B?u0(B.stateDirectory):null,T=O7(q,Q.apiKey??M??void 0),_=T1(N,K),j=B!==null&&C$(B),D=j&&N0(B)===N0(T),O=D&&F1(T),F=B?.userChrome!==!1===(T.userChrome!==!1)&&B?.cloudSessions===T.cloudSessions&&B?.localLogins===T.localLogins,z=Q.apiKey??M??void 0,L=H!==null&&j&&!$0(B).revoked&&!x1(B,H);if(L){if(!D||!F||JSON.stringify(B.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let P=await KB(B,H,X,Y);if(P!==0)return P}let W=L?[`  Account:   yours too, in workspace ${H}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await _3(T,$.apiKey),T3(T.stateDirectory,$.apiKey)},E=K.PATH||"/usr/local/bin:/usr/bin:/bin",I=O&&JSON.stringify(B?.proxy)===JSON.stringify(T.proxy)&&F?_1(T,N,"connect"):null,C=I?.label===U7(T.channel),h=C&&await(Y.controlWorker??U0)(T,"status").catch(()=>null)!==null,S=C&&!h&&c9(I,N)&&q7({config:T,launcher:_,path:E,host:N,kind:"connect"});if((h||S)&&[null,r].includes(f1(T))){await R();let P=N7(T,N,"connect");if(P==="retired"){let x=S?null:await(Y.controlWorker??U0)(T,"status").catch(()=>null);if(!S&&(!x||x.phase==="stopping"))q$(T,N,"connect")}else if(P==="current_not_running")q$(T,N,"connect");return await(Y.controlWorker??U0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?d9(T,N.platform,W):l9("This computer is connected to Reason",T,N.platform,[...W,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let y=!O&&!L;if(j&&!D)if(B.apiOrigin!==T.apiOrigin||B.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),0}async function Nj($,J,Z){let Q=p9(Z),X=U3(Q.home,Q.channel);try{let Y=_0(g0(Q.home,Q.channel),"worker.json");return await I7({once:!1,yes:J,addFolder:$},R0(Y),Y,Q)===0}finally{X()}}function p9($,J){let Z=Z$($.home??B0()),Q=$.env??process.env;return{io:$.io??B3(),options:$,home:Z,channel:$.channel??$$(),environment:Q,apiKey:J??U7(Q),host:$.serviceHost??J$(Z)}}async function qB($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await A7($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}R7(J,X,Y)}var C7=Symbol("serve here");async function HB($,J,Z,Q){let{io:X,options:Y,home:G,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let P=t6(G);if(P.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${P.code}).
+`)}let H=J&&!Q.apiKey&&u0(J.stateDirectory)===null?X2(G,V,J):null,B=J&&H&&$0(J).revoked&&k0(J).some((P)=>P.account&&P.organizationId===H)?F2(J,{prefer:H,keep:!1})??J:J,q=O7({parsed:$,saved:B,stateDirectory:g0(G,V),lifetime:"persistent",home:G,channel:V,options:Y,environment:K});if(G3(G,V,!1),B?.executionMode==="confined")X.stdout.write(W7);let M=B?u0(B.stateDirectory):null,T=z7(q,Q.apiKey??M??void 0),_=T1(N,K),j=B!==null&&C$(B),D=j&&N0(B)===N0(T),O=D&&F1(T),F=B?.userChrome!==!1===(T.userChrome!==!1)&&B?.cloudSessions===T.cloudSessions&&B?.localLogins===T.localLogins,z=Q.apiKey??M??void 0,L=H!==null&&j&&!$0(B).revoked&&!x1(B,H);if(L){if(!D||!F||JSON.stringify(B.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let P=await BB(B,H,X,Y);if(P!==0)return P}let W=L?[`  Account:   yours too, in workspace ${H}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await _3(T,$.apiKey),T3(T.stateDirectory,$.apiKey)},E=K.PATH||"/usr/local/bin:/usr/bin:/bin",I=O&&JSON.stringify(B?.proxy)===JSON.stringify(T.proxy)&&F?_1(T,N,"connect"):null,C=I?.label===V7(T.channel),h=C&&await(Y.controlWorker??U0)(T,"status").catch(()=>null)!==null,S=C&&!h&&c9(I,N)&&H7({config:T,launcher:_,path:E,host:N,kind:"connect"});if((h||S)&&[null,r].includes(f1(T))){await R();let P=q7(T,N,"connect");if(P==="retired"){let x=S?null:await(Y.controlWorker??U0)(T,"status").catch(()=>null);if(!S&&(!x||x.phase==="stopping"))q$(T,N,"connect")}else if(P==="current_not_running")q$(T,N,"connect");return await(Y.controlWorker??U0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?d9(T,N.platform,W):l9("This computer is connected to Reason",T,N.platform,[...W,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder or --sessions; remove it with reason disconnect."])),0}let y=!O&&!L;if(j&&!D)if(B.apiOrigin!==T.apiOrigin||B.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
 `),!await n9(B,Z,X,Y,N))throw new p("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(B.executionMode==="host"&&F1(B))X.stdout.write(`Applying the new settings to this computer\u2026
-`),await NB(B,T,z,Y),y=!1;else await r9(B,Y,N);if(y){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
+`),await qB(B,T,z,Y),y=!1;else await r9(B,Y,N);if(y){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
 `);let P=await a9(T,Z,X,Y,z);if(P!==0)return P;if(z)T3(T.stateDirectory,z)}else c(Z,T),await R();let l;try{l=e2({config:T,launcher:_,path:E,host:N,kind:"connect"})}catch(P){if(!(P instanceof I$))throw P;if(P.code!=="worker_service_manager_missing")throw new p(`${P.message}
 This computer is set up; run reason connect again to start it.`,P.code??"worker_service_start_failed");if(Y.serveHere&&K.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),I7;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await HB(T,_,K,Y))return X.stdout.write(d9(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new I$(`${P.message}
-This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,P.code)}let k=[...W,...l.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...l.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${l.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?d9(T,N.platform,k):l9("This computer is connected to Reason",T,N.platform,[`  Service:   ${l.label} (starts at ${l.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${l.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...k])),0}async function HB($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??C7)(J,Y,_0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??U0)($,"status").catch(()=>null))return!0;return!1}function C7($,J,Z){let Q=T7(Z,"a",384);try{let X=H7($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{M7(Q)}}async function P7($,J,Z,Q=!1){let X=!0;for(let Y of k0($)){if(Q&&Y.account)continue;if(Y.config&&C$(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??N$)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:Y3,stderr:J.stderr}})!==0){X=!1;continue}}L1(Y.directory,{recursive:!0,force:!0})}return X}function B3(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function o9($,J){if($ instanceof p||$ instanceof I$)return J.stderr.write(`Reason: ${$.message} (${$.code??"worker_service_failed"})
-`),2;let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:TB($);return J.stderr.write(`Reason: ${Q1(Z)??"could not connect this computer."} (${Z})
-`),1}var MB=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]);function TB($){if($ instanceof m0)return $.status>=500?"worker_api_unavailable":"worker_api_refused";let J=$?.code;if(typeof J==="string"&&MB.has(J))return`worker_file_${J.toLowerCase()}`;return"worker_connect_unexpected"}function o6($,J){if($.minimal){x7({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||S7({home:J.home})!=="install")return;let Z;try{Z=T1(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=_0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??e6)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
+`),C7;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await MB(T,_,K,Y))return X.stdout.write(d9(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new I$(`${P.message}
+This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,P.code)}let k=[...W,...l.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...l.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${l.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?d9(T,N.platform,k):l9("This computer is connected to Reason",T,N.platform,[`  Service:   ${l.label} (starts at ${l.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${l.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...k])),0}async function MB($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??P7)(J,Y,_0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??U0)($,"status").catch(()=>null))return!0;return!1}function P7($,J,Z){let Q=_7(Z,"a",384);try{let X=M7($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{T7(Q)}}async function E7($,J,Z,Q=!1){let X=!0;for(let Y of k0($)){if(Q&&Y.account)continue;if(Y.config&&C$(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??N$)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:Y3,stderr:J.stderr}})!==0){X=!1;continue}}L1(Y.directory,{recursive:!0,force:!0})}return X}function B3(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function o9($,J){if($ instanceof p||$ instanceof I$)return J.stderr.write(`Reason: ${$.message} (${$.code??"worker_service_failed"})
+`),2;let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:_B($);return J.stderr.write(`Reason: ${Q1(Z)??"could not connect this computer."} (${Z})
+`),1}var TB=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]);function _B($){if($ instanceof m0)return $.status>=500?"worker_api_unavailable":"worker_api_refused";let J=$?.code;if(typeof J==="string"&&TB.has(J))return`worker_file_${J.toLowerCase()}`;return"worker_connect_unexpected"}function e6($,J){if($.minimal){S7({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||b7({home:J.home})!=="install")return;let Z;try{Z=T1(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=_0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??$7)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
 `);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let Q=(J.options.installDesktop??e6)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function e6($,J,Z){if(!Z)return nK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;rK(s9(Z.log),{recursive:!0,mode:448});let Q=T7(Z.log,"w",384);try{let X=H7($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{M7(Q)}return 0}async function Nj($,J={}){let Z=J.io??B3();try{let Q=XB($);if(!Q)return Z.stdout.write($B),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,H]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(H!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return o6(Q,p9(J)),await(J.runServe??a6)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=p9(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=V7(G[p$],Y),K=V||Q.once?()=>{return}:U3(X.home,Y);try{let N=_0(g0(X.home,Y),"worker.json"),H=R0(N);if(V)return await t6(H,N,X);if(Q.keepAwake!==void 0)return UB(Q.keepAwake,H,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await R7(Q,H,N,X);if(o6(Q,X),Q.once)return await BB(Q,H,X);let B=await qB(Q,H,N,X);if(B!==I7)return B;return K(),K=()=>{return},await t6(R0(N),N,X)}finally{K()}}catch(Q){return o9(Q,Z)}}async function qj($,J={}){let Z=J.io??B3();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(JB),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await LB(Q[0],Z,J);return await E7(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return o9(Q,Z)}}async function Hj($={}){let J=$.io??B3();try{return await E7(J,$,"logout")}catch(Z){return o9(Z,J)}}async function E7($,J,Z){let Q=Z$(J.home??B0()),X=J.channel??$$(),Y=U3(Q,X);try{return await _B($,J,Z,Q,X)}finally{Y()}}function U3($,J){let Z=g0($,J),Q=u(Z)?J1():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function _B($,J,Z,Q,X){let Y=_0(g0(Q,X),"worker.json"),G=R0(Y);if(!G){if(Z==="disconnect")G3(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(Z!=="disconnect"){let K=await FB(G,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await n9(G,Y,$,J,J.serviceHost??J$(Q))}finally{if(Z!=="temporary")G3(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`);let Q=(J.options.installDesktop??$7)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
+`)}function $7($,J,Z){if(!Z)return rK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;tK(s9(Z.log),{recursive:!0,mode:448});let Q=_7(Z.log,"w",384);try{let X=M7($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{T7(Q)}return 0}async function qj($,J={}){let Z=J.io??B3();try{let Q=YB($);if(!Q)return Z.stdout.write(JB),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions is for your own computer.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,H]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(H!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return e6(Q,p9(J)),await(J.runServe??i6)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=p9(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=N7(G[p$],Y),K=V||Q.once?()=>{return}:U3(X.home,Y);try{let N=_0(g0(X.home,Y),"worker.json"),H=R0(N);if(V)return await o6(H,N,X);if(Q.keepAwake!==void 0)return VB(Q.keepAwake,H,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await I7(Q,H,N,X);if(e6(Q,X),Q.once)return await UB(Q,H,X);let B=await HB(Q,H,N,X);if(B!==C7)return B;return K(),K=()=>{return},await o6(R0(N),N,X)}finally{K()}}catch(Q){return o9(Q,Z)}}async function Hj($,J={}){let Z=J.io??B3();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(ZB),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await jB(Q[0],Z,J);return await x7(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return o9(Q,Z)}}async function Mj($={}){let J=$.io??B3();try{return await x7(J,$,"logout")}catch(Z){return o9(Z,J)}}async function x7($,J,Z){let Q=Z$(J.home??B0()),X=J.channel??$$(),Y=U3(Q,X);try{return await FB($,J,Z,Q,X)}finally{Y()}}function U3($,J){let Z=g0($,J),Q=u(Z)?J1():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function FB($,J,Z,Q,X){let Y=_0(g0(Q,X),"worker.json"),G=R0(Y);if(!G){if(Z==="disconnect")G3(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(Z!=="disconnect"){let K=await LB(G,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await n9(G,Y,$,J,J.serviceHost??J$(Q))}finally{if(Z!=="temporary")G3(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
 `),1;return $.stdout.write(`Disconnected "${G.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function FB($,J,Z,Q,X,Y,G){let V=k0($).filter((j)=>j.account);if(V.length===0)return null;let K=X2(Y,G,$),N=Q.controlWorker??U0,H=V.find((j)=>j.organizationId===K);if(H){if(H.config&&!await K3(H.config,H.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),0}async function LB($,J,Z,Q,X,Y,G){let V=k0($).filter((j)=>j.account);if(V.length===0)return null;let K=X2(Y,G,$),N=Q.controlWorker??U0,H=V.find((j)=>j.organizationId===K);if(H){if(H.config&&!await K3(H.config,H.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
 `),1;if(X!=="account"||!H.config)L1(H.directory,{recursive:!0,force:!0});return await N($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${K} for your account. It stays connected for its other Reason accounts.
 `),0}if(!K&&X==="account")throw new p("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!K||!x1($,K)){if(X==="account"&&K)_2($,K);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let B=Q.serviceHost??J$(Y),q=null;try{q=t($)?.orgId.toLowerCase()??null}catch{}if(await r9($,Q,B,"connect",!0),!await P7($,Z,Q,!0)||!await K3($,J,Z,Q))return q$($,B,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`);return 0}let B=Q.serviceHost??J$(Y),q=null;try{q=t($)?.orgId.toLowerCase()??null}catch{}if(await r9($,Q,B,"connect",!0),!await E7($,Z,Q,!0)||!await K3($,J,Z,Q))return q$($,B,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
 `),1;let M=F2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&q)_2(M,q);let T=q$(M,B,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
-`),0}async function LB($,J,Z){let Q=Z$(Z.home??B0()),X=Z.serviceHost??J$(Q),Y=g9(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let V of Y)if(await n9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
+`),0}async function jB($,J,Z){let Q=Z$(Z.home??B0()),X=Z.serviceHost??J$(Q),Y=g9(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let V of Y)if(await n9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
 `);else G=!0,J.stderr.write(`Reason: machine "${$}" in ${V.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
-`);return G?1:0}async function Mj($={}){let J=Z$($.home??B0()),Z=R0(_0(g0(J,$.channel??$$()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??U0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?f1(Z):null,G=$.serviceHost??J$(J),V=_1(Z,G,"connect"),K=$0(Z).revoked,N=!K&&!X,H=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:B,off:q}=K||u0(Z.stateDirectory)!==null?{workspaces:null,off:null}:I4(Z,X?.phase==="running");return{workspaces:B,workspaces_off:q,workspaces_max:H2+(B?.filter((M)=>M.account).length??0),name:Z.name,device_id:H?.deviceId??null,organization_id:H?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:t9(Z,G.platform),cloud_sessions:Z.cloudSessions===!0,root:H?.roots[0]?{id:H.roots[0].id,permissions:H.roots[0].permissions}:null,roots:H?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?W8(Z,Q):null,worker_alive:N&&V?c9(V,G):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function Tj($,J,Z=U0){let Q={version:1,status:"unavailable"},X=R0(_0(g0(Z$($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?G7({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function _j($={}){try{let J=Z$($.home??B0());return R0(_0(g0(J,$.channel??$$()),"worker.json"))?.userChrome!==!1}catch{return!1}}function Fj($={}){let J=Z$($.home??B0()),Z=R0(_0(g0(J,$.channel??$$()),"worker.json"));if(!Z)return null;return q$(Z,$.serviceHost??J$(J),"connect")?.label??null}async function Lj($={}){let J=Z$($.home??B0()),Z=R0(_0(g0(J,$.channel??$$()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??J$(J),X=await s6(Z,Q,"connect",$.current);if(X!==null||_1(Z,Q,"connect"))return X;return jB(Z,Q,$)}async function jB($,J,Z){let Q=Z.controlWorker??U0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&f1($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=T1(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((B)=>setTimeout(B,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...H}=Z.env??process.env;return(Z.startConnection??C7)(G,H,_0($.stateDirectory,"connect.log")),{state:"restarted"}}
-export{d,R2 as e,R0 as f,$B as g,JB as h,g0 as i,Uj as j,Vj as k,Nj as l,qj as m,Hj as n,Mj as o,Tj as p,_j as q,Fj as r,Lj as s};
+`);return G?1:0}async function Tj($={}){let J=Z$($.home??B0()),Z=R0(_0(g0(J,$.channel??$$()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??U0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?f1(Z):null,G=$.serviceHost??J$(J),V=_1(Z,G,"connect"),K=$0(Z).revoked,N=!K&&!X,H=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:B,off:q}=K||u0(Z.stateDirectory)!==null?{workspaces:null,off:null}:I4(Z,X?.phase==="running");return{workspaces:B,workspaces_off:q,workspaces_max:H2+(B?.filter((M)=>M.account).length??0),name:Z.name,device_id:H?.deviceId??null,organization_id:H?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:Z.slots,user_chrome:t9(Z,G.platform),cloud_sessions:Z.cloudSessions===!0,root:H?.roots[0]?{id:H.roots[0].id,permissions:H.roots[0].permissions}:null,roots:H?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?W8(Z,Q):null,worker_alive:N&&V?c9(V,G):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function _j($,J,Z=U0){let Q={version:1,status:"unavailable"},X=R0(_0(g0(Z$($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?K7({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function Fj($={}){try{let J=Z$($.home??B0());return R0(_0(g0(J,$.channel??$$()),"worker.json"))?.userChrome!==!1}catch{return!1}}function Lj($={}){let J=Z$($.home??B0()),Z=R0(_0(g0(J,$.channel??$$()),"worker.json"));if(!Z)return null;return q$(Z,$.serviceHost??J$(J),"connect")?.label??null}async function jj($={}){let J=Z$($.home??B0()),Z=R0(_0(g0(J,$.channel??$$()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??J$(J),X=await a6(Z,Q,"connect",$.current);if(X!==null||_1(Z,Q,"connect"))return X;return WB(Z,Q,$)}async function WB($,J,Z){let Q=Z.controlWorker??U0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&f1($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=T1(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((B)=>setTimeout(B,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...H}=Z.env??process.env;return(Z.startConnection??P7)(G,H,_0($.stateDirectory,"connect.log")),{state:"restarted"}}
+export{d,R2 as e,R0 as f,JB as g,ZB as h,g0 as i,Vj as j,Nj as k,qj as l,Hj as m,Mj as n,Tj as o,_j as p,Fj as q,Lj as r,jj as s};