@reason-machines/cli-linux-arm64-musl 0.2.342 → 0.2.344

package/bin/vm-hands/{vm-hands-entry-lite-hdmwe5bp.js → vm-hands-entry-lite-k1qw05mt.js}

@@ -1,30 +1,30 @@
 // @bun
-import{t as v0}from"./vm-hands-entry-lite-8tf0kw71.js";import{u as Q2,w as B7,x as X4}from"./vm-hands-entry-lite-84t0sxks.js";import{A as K7,B as H4,C as M4,D as m6,E as m0,I as v6,J as R$,z as q2}from"./vm-hands-entry-lite-n76c16jk.js";import{$ as m1,Q as _J,R as FJ,S as w8,T as k8,U as oJ,V as eJ,W as S9,X as D5,Y as h8,Z as T0,_ as h1,aa as P0,ba as n1,ca as O5,da as u5,ea as i3,fa as E5,ja as x5,sa as Z6,ta as Q6,ua as X6,va as Y6,wa as w9}from"./vm-hands-entry-lite-ffa7xfss.js";import{$a as nJ,Ba as n8,Bb as W5,Ca as r8,Cb as K9,Eb as V5,Fa as p8,Ha as Q5,Ib as tJ,Jb as Q9,Ka as X5,Pa as B5,Qa as U5,Ra as y8,Sa as f8,Ta as sJ,Ua as aJ,Wa as u,Xa as e,Ya as s,Za as c,_a as c8,ab as M1,db as Q3,eb as X3,fb as Q7,gb as X7,hb as Y7,ib as S0,jb as J0,kb as g,lb as b9,mb as A1,nb as Z2,ob as N0,pb as rJ,ub as v5,wb as N8,ya as z6,zb as y2}from"./vm-hands-entry-lite-e26ht37z.js";import{Ob as m8}from"./vm-hands-entry-lite-k6e9bt1m.js";import{Vb as j5}from"./vm-hands-entry-lite-h01d2fbm.js";import{bc as Y5,cc as G5,jc as K5}from"./vm-hands-entry-lite-f5m8cde2.js";import{pc as V$}from"./vm-hands-entry-lite-ffgjezmx.js";import{Ec as b8}from"./vm-hands-entry-lite-crh2cy1q.js";import{Kc as p$,Lc as J$,Mc as I$,Nc as T1,Oc as g6,Pc as U7,Qc as V7,Rc as _1,Sc as N7,Tc as c9,Uc as q7,Vc as e2,Wc as q$,Xc as X8,Yc as $3,ad as A5,dd as $6,gd as LJ,hd as jJ}from"./vm-hands-entry-lite-tbrwer33.js";import{Zd as S8,fe as w6,ge as r$,qe as V2,rd as C2,vd as pJ,wd as cJ}from"./vm-hands-entry-lite-ammwy4z8.js";import{Be as U}from"./vm-hands-entry-lite-0r5vmp7p.js";import{Ee as G7,Fe as s2,Ie as J6,Le as l1,Ne as x7,Oe as S7,Te as P5}from"./vm-hands-entry-lite-hbqq9f9a.js";import{Ze as r1,_e as L5}from"./vm-hands-entry-lite-7djq90d1.js";import{bf as n6,ef as z5,ff as E9,hf as v8}from"./vm-hands-entry-lite-ngpcdqxk.js";import{uf as r}from"./vm-hands-entry-lite-2r9pdqzf.js";import{bg as w1,cg as Y0,dg as B2,eg as B6,fg as U6,gg as n$,hg as F3,jg as n3,kg as w$,lg as y0,mg as E1,ng as r3,qg as k$}from"./vm-hands-entry-lite-x6tft70v.js";import{ug as Z5}from"./vm-hands-entry-lite-mybm2kyz.js";import{Ah as K4,Bh as $7,Ch as J7,Eh as A2,Fh as Z7,Gh as P9,Hh as Z8,Ih as Q8,Jh as J1,sh as D$,th as P1,vh as $$,yh as O$,zh as C0}from"./vm-hands-entry-lite-6qfax5p2.js";import{Kh as B0,Mh as fJ}from"./vm-hands-entry-lite-5b29hq7h.js";import{ki as iJ}from"./vm-hands-entry-lite-xr02bw8t.js";import{pi as f0}from"./vm-hands-entry-lite-9k93fyhy.js";import{vi as tK}from"./vm-hands-entry-lite-hz2ww2qe.js";import{spawn as H7,spawnSync as oK}from"child_process";import{closeSync as M7,mkdirSync as eK,openSync as T7,readdirSync as $B,realpathSync as Z$,rmSync as L1}from"fs";import{hostname as JB}from"os";import{dirname as s9,join as _0,resolve as ZB}from"path";import{createHash as w7}from"crypto";import{unlinkSync as k7}from"fs";import{platform as y7}from"os";import{join as f7}from"path";var Y4=U.discriminatedUnion("store",[U.strictObject({version:U.literal(1),store:U.literal("keychain")}),U.strictObject({version:U.literal(1),store:U.literal("file"),api_key:U.string().min(1).max(4096)})]),b$=($)=>f7($,"api-key.json");function F$($){let J=w7("sha256").update(`reason-connect-api-key
-${$}`).digest("hex");return new n$(B2(),y7(),J)}function T3($,J,Z=F$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(b$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof Y0))throw Q}c(b$($),{version:1,store:"file",api_key:J})}function u0($,J=F$($)){if(!u(b$($)))return null;let Z=Y4.parse(JSON.parse(s(b$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof Y0))throw Q;throw Error("worker_api_key_unreadable")}}function G4($,J=F$($)){if(!u(b$($)))return;if(Y4.parse(JSON.parse(s(b$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof Y0))throw Z}k7(b$($))}async function _3($,J){let Z;try{Z=await X4({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:S0($.proxy)})}catch(Q){if(Q instanceof m0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as JZ,renameSync as ZZ,rmSync as y$}from"fs";import{join as H0}from"path";import{createHash as h7}from"crypto";import{realpathSync as m7,statSync as v7,unlinkSync as U2}from"fs";import{platform as g7}from"os";import{join as b0}from"path";function d($){return{state:b0(g($),"device.json"),control:b0(g($),"control.json"),lock:b0(g($),"lifecycle.lock"),socket:b0(g($),"control.sock"),daemon:b0(g($),"daemon.json"),releaseCheck:b0(g($),"release-check.json"),updateDeferral:b0(g($),"update-deferral.json"),firstHeartbeat:b0(g($),"first-heartbeat.json")}}var u7=U.object({version:U.literal(1),device_id:U.string().min(1).max(160),offer:U.unknown().optional(),enrollment_ms:U.number().int().nonnegative().max(r$).optional()});function B4($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function L3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=u7.safeParse(JSON.parse(s(Z)));if(U2(Z),!Q.success||Q.data.device_id!==J)return null;let X=V2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function M0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=b0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?j3($):new F3(g($))}function N2($,J){M0($,!0),p7($);let Z=J??j3($),Q=new F3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof Y0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function j3($){return new n$(B2(),g7(),d7($))}function d7($){let J=W3($);return h7("sha256").update(`reason-worker
-${J?.directory??g($)}`).digest("hex")}function R1($,J){c(b0(g($),I1),{version:1,directory:W3($)?.directory??g($),devicePublicKey:J})}var I1="keychain-scope.json";function U4($){return u(b0(g($),I1))}var l7=U.strictObject({version:U.literal(1),directory:U.string().min(1),devicePublicKey:U.string().min(1)});function W3($){let J=b0(g($),I1);if(!u(J))return null;let Z=l7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function p7($){let J=b0(g($),I1);if(!u(J))return;if(W3($))try{let Z=j3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof Y0))throw Z}U2(J)}function K$($){let J=m7($.workspaceRoot);if(J!==$.workspaceRoot||!v7(J).isDirectory()||!A1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=w$(d($).state,{proofStore:M0($),repair:!1}),Z=J!==null&&K4($.apiOrigin,J.apiOrigin),Q=Z?[N0($),N0({...$,apiOrigin:J.apiOrigin})]:[N0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var V4=U.strictObject({version:U.literal(1),drained:U.boolean(),revoked:U.boolean()});function $0($){let J=d($).control;return u(J)?V4.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function I0($,J){c(d($).control,V4.parse(J))}function w0($){let J=M0($);J.deleteBinding(),J.deleteKey();let Z=b0(g($),I1);if(u(Z))U2(Z);let Q=d($).state;if(u(Q))U2(Q)}var c7=U.strictObject({read:U.boolean(),write:U.boolean(),execute:U.boolean(),discover_environment:U.boolean(),expose_mcp:U.literal(!1)}),D3=U.strictObject({version:U.literal(1),organization_id:U.string().min(1).max(160),enrollment_ticket:U.string().min(1).max(4096),code_verifier:U.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/),root:U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),permissions:c7,execution_mode:U.enum(["confined","host"]).default("confined")}),folders:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),s7=U.object({device_id:U.string().min(1).max(160),organization_id:U.string().min(1).max(160),auth_scheme:U.literal("p256"),protocol_version:U.literal(2),roots:U.array(U.object({id:U.string().min(1),label:U.string(),path_fingerprint:U.string()})).min(1).max(32),headless:U.object({lifecycle:U.enum(["persistent","ephemeral"]),expires_at:U.iso.datetime({offset:!0})}),first_heartbeat:U.unknown().optional()}),O3=30000;class n0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function a7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(O3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new n0(X?.error==="device_revoked")}return Q.json()}async function z3($,J,Z,Q){v0();let X=D3.parse(JSON.parse(s(J)));return r0($,X,Z,Q)}async function r0($,J,Z,Q=(Y,G)=>a7(Y,G,S0($.proxy)),X=performance.now()){let Y=q4($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function N4($,J,Z,Q,X=performance.now()){let Y=q4($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function q4($,J,Z){if(v0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=k$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let H=k$([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(H.path!==K||H.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return H});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let H=s7.parse(K);if(H.organization_id!==J.organization_id||H.roots.length!==Y.length||H.roots.some((q,M)=>q.path_fingerprint!==Y[M].pathFingerprint)||H.headless.lifecycle!==$.lifetime||Date.parse(H.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let B=V2(H.first_heartbeat);try{B4($,H.device_id,{...B?{offer:B}:{},enrollmentMs:Math.min(r$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:H.organization_id,deviceId:H.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:N0($),lifetime:$.lifetime,expiresAt:H.headless.expires_at},roots:H.roots.map((q,M)=>({id:q.id,label:q.label,path:Y[M].path,pathFingerprint:q.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as i7,randomUUID as n7}from"crypto";import{unlinkSync as r7}from"fs";import{join as t7}from"path";var T4=U.strictObject({version:U.literal(1),install_id:U.uuid(),fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/)}),o7=U.object({enrollment_ticket:U.string().min(1).max(4096),expires_at:U.iso.datetime({offset:!0}),device_kind:U.literal("headless"),lifecycle:U.enum(["persistent","ephemeral"]),device_expires_at:U.iso.datetime({offset:!0})});function A3($){return o7.parse($)}var e7=U.object({credentialKind:U.enum(["oauth","api_key"]).optional(),apiOrigin:U.url(),clientId:U.string(),accessToken:U.string().min(1).max(32768),refreshToken:U.string().max(32768),expiresAt:U.iso.datetime({offset:!0}),scopes:U.array(U.string().max(128)).max(128),orgId:U.string().min(1).max(160)});function L$($){return q2(P1("REASON_CLI_CHANNEL",$.channel),B0())}async function j$($,J=L$($)){if(!u(J))return null;let Z=e7.parse(JSON.parse(s(J)));if(!C0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=S0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await M4({path:J,fetchImpl:X});if(Y&&!C0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function _4($,J,Z){if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=W$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function F4($,J,Z,Q,X){let Y=performance.now();if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=W$($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await N4($,G.direct(J.orgId),Q,(N,H)=>V({approval:G.request,code_verifier:H,registration:N}).catch((B)=>{throw $Z(B)}),Y);if(K)return K}return r0($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function $Z($){if(!($ instanceof m0))return $;if($.status===409)return new n0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new n0(!1);return $}var C1=($)=>t7(g($),"enrollment-install.json");function L4($){if(u(C1($)))r7(C1($))}function W$($,{stored:J=!0}={}){v0();let Z=C1($),Q=J&&u(Z)?T4.parse(JSON.parse(s(Z))):{version:1,install_id:n7(),fingerprint_key:i7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=k$([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((B)=>{let q=k$([B],X,Y)[0];if(q.path!==B)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:q.pathFingerprint}}),K=H4(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((B)=>B.path_fingerprint)].map((B)=>({path_fingerprint:B,permissions:X,execution_mode:$.executionMode}))},H=(B)=>({version:1,organization_id:B,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(B){e(g(B),!0),c(C1(B),Q)},complete(B,q){let M=A3(q);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...H(B),enrollment_ticket:M.enrollment_ticket}},direct:H}}function j4($,J,Z){let Q=C1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=T4.parse(JSON.parse(s(Q)));return k$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var H2=8,O4=600000,z4=15000,W4=new Set(["device_revoked","invalid_device_credential"]),M2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,B$=($)=>H0(g($),"workspaces"),A4="account.json",R3=($)=>u(H0($,A4));function k0($){let J;try{J=JZ(B$($))}catch{return[]}return J.filter((Z)=>M2.test(Z)).sort().map((Z)=>{let Q=H0(B$($),Z),X=H0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:R3(Q)}})}function T2($,J){let Z=J.toLowerCase();if(!M2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:H0(B$($),Z)});return e(Q.stateDirectory,!0),c(H0(Q.stateDirectory,A4),{version:1}),{config:Q,configPath:H0(Q.stateDirectory,"worker.json")}}function _2($,J){try{let{config:Z,configPath:Q}=T2($,J);e(g(Z),!0),I0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function x1($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||k0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var I3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function D4($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");R1($,Z.devicePublicKey),e(g(J),!0);for(let Y of I3)y$(H0(g(J),Y),{force:!0});for(let Y of I3){let G=H0(g($),Y);if(u(G))ZZ(G,H0(g(J),Y))}let Q=M0(J),X=w$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");y0({...X,worker:{...X.worker,configDigest:N0(J)}},d(J).state,{proofStore:Q})}function C3($){for(let J of k0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))w0(J.config)}catch{}y$(J.directory,{recursive:!0,force:!0})}y$(E3($),{force:!0})}function F2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(B)=>Number(Date.parse(B.worker?.expiresAt??"")>X+60000),V=k0($).flatMap((B)=>{if(!B.account||!B.config)return[];try{if($0(B.config).revoked)return[];let q=t(B.config);return q&&q.orgId.toLowerCase()===B.organizationId&&(!Q||Y(q))?[{...B,config:B.config,state:q}]:[]}catch{return[]}}).sort((B,q)=>Number(q.organizationId===J)-Number(B.organizationId===J)||Y(q.state)-Y(B.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&M2.test(N)&&N!==V.organizationId){let B=T2($,N);D4($,B.config),c(B.configPath,B.config)}else if(u(g($))){try{if(u(d($).state))w0($)}catch{}for(let B of I3)y$(H0(g($),B),{force:!0})}C3($);let H=J0.parse({...V.config,stateDirectory:$.stateDirectory});return D4(V.config,H),c(H0($.stateDirectory,"worker.json"),H),y$(V.directory,{recursive:!0,force:!0}),H}var P3={before($){for(let{config:J}of k0($))try{let Z=J?t(J):null;if(J&&Z)R1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of k0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==H0(B$($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=M0(V),N=w$(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===N0(G))y0({...N,worker:{...N.worker,configDigest:N0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},E3=($)=>H0(B$($),"listed.json");function R4($){try{let J=JSON.parse(s(E3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function I4($,J){let Z=k0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=R4($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:H})=>{let B=!1,q=null,M=!1;try{B=N?$0(N).revoked:!1,q=N&&!B?t(N):null,M=J&&!!q&&E1(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:q?.deviceId??null,name:Y?.names?.[K]??null,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,state:B?"removed":M?"connected":"not_running",blocked:!H&&!B&&!M&&(Y?.blocked.includes(K)??!1),...H?{account:!0}:{}}})}}function C4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=R4(J)??{listed:!1,reason:null,blocked:[]},H=(L)=>{let{folders:W,...R}=J,E=Z.roots.slice(1).map((I)=>I.path);return J0.parse({...R,...E.length?{folders:E}:{},stateDirectory:H0(B$(J),L)})},B=async(L)=>{let W=G.get(L);if(!W)return;W.controller.abort(),await W.done},q=(L,W=!1)=>{let R=new AbortController,E=()=>R.abort();if(X.addEventListener("abort",E,{once:!0}),X.aborted)R.abort();let I={...L,controller:R,claims:0,done:Promise.resolve(),account:W};I.done=$.serve(L,R.signal,(C)=>{I.claims=C}).then(()=>{return},(C)=>{if(W&&C instanceof T0&&C.status===401&&W4.has(C.code)){try{I0(L.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${L.organizationId} (another account's) no longer accepts this computer (${C.code}); run \`reason connect\` signed in as that account to connect it again
-`)}else if(C instanceof T0&&C.status===401&&W4.has(C.code)){try{w0(L.config)}catch{}Y(`Reason worker: workspace ${L.organizationId} no longer accepts this computer
+import{u as g0}from"./vm-hands-entry-lite-k2e3q5qj.js";import{v as Q2,x as N7,y as Y4}from"./vm-hands-entry-lite-m16qf0yy.js";import{A as q2,B as V7,C as M4,D as T4,E as u6,F as v0,J as d6,K as I$}from"./vm-hands-entry-lite-pnkfgnqz.js";import{$ as h1,R as jJ,S as WJ,T as y8,U as f8,V as J6,W as Z6,X as b9,Y as A5,Z as v8,_ as _0,aa as m1,ba as P0,ca as n1,da as R5,ea as p5,fa as t3,ga as b5,ka as w5,ta as Y6,ua as G6,va as K6,wa as B6,xa as k9}from"./vm-hands-entry-lite-rkmkv423.js";import{$a as i8,Ab as m2,Ca as o8,Cb as z5,Da as e8,Db as B9,Fb as H5,Ga as a8,Ia as G5,Jb as $6,Kb as X9,La as K5,Qa as N5,Ra as q5,Sa as h8,Ta as m8,Ua as nJ,Va as rJ,Xa as u,Ya as e,Za as s,_a as c,ab as oJ,bb as _1,eb as G3,fb as K3,gb as G7,hb as K7,ib as B7,jb as b0,kb as J0,lb as g,mb as w9,nb as R1,ob as Z2,pb as N0,qb as eJ,vb as d5,xb as H8,za as I6}from"./vm-hands-entry-lite-f7g390b5.js";import{Pb as g8}from"./vm-hands-entry-lite-7ba3nhgv.js";import{Wb as O5}from"./vm-hands-entry-lite-wmxksawm.js";import{cc as B5,dc as U5,kc as V5}from"./vm-hands-entry-lite-k2cvr710.js";import{qc as H$}from"./vm-hands-entry-lite-8ynztq9j.js";import{Fc as k8}from"./vm-hands-entry-lite-0wyjnvjz.js";import{Lc as c$,Mc as X$,Nc as C$,Oc as F1,Pc as l6,Qc as q7,Rc as H7,Sc as L1,Tc as M7,Uc as s9,Vc as T7,Wc as Z3,Xc as T$,Yc as G8,Zc as Q3,bd as C5,ed as Q6,hd as DJ,id as OJ}from"./vm-hands-entry-lite-fnefqcw4.js";import{ae as w8,ie as f6,je as t$,te as V2,ud as C2,yd as aJ,zd as iJ}from"./vm-hands-entry-lite-bjc5fdv3.js";import{Ge as U7,He as n2,Ke as X6,Ne as l1,Pe as w7,Qe as k7,Ve as S5}from"./vm-hands-entry-lite-x5az8qvp.js";import{$e as r1,af as D5}from"./vm-hands-entry-lite-pa111vpq.js";import{df as o6,gf as I5,hf as x9,jf as u8}from"./vm-hands-entry-lite-c1p0mz65.js";import{wf as t}from"./vm-hands-entry-lite-f8ss5hkt.js";import{dg as w1,eg as G0,fg as B2,gg as N6,hg as q6,ig as r$,jg as W3,kg as k2,lg as z4,ng as y2,og as k$,pg as f0,qg as o$,rg as f2,ug as y$}from"./vm-hands-entry-lite-kt418g2w.js";import{yg as Y5}from"./vm-hands-entry-lite-knfh7w3j.js";import{Ch as z$,Dh as C0,Eh as B4,Fh as Q7,Gh as X7,Ih as A2,Jh as Y7,Kh as E9,Lh as X8,Mh as Y8,Nh as Q1,wh as O$,xh as E1,zh as Q$}from"./vm-hands-entry-lite-1xjtcxpn.js";import{Oh as U0,Qh as vJ}from"./vm-hands-entry-lite-9dx3at21.js";import{mi as U}from"./vm-hands-entry-lite-2xh7sjs0.js";import{pi as tJ}from"./vm-hands-entry-lite-0jar357h.js";import{ui as h0}from"./vm-hands-entry-lite-gt5pkv4h.js";import{Ai as JB}from"./vm-hands-entry-lite-mhsv58hw.js";import{spawn as _7,spawnSync as ZB}from"child_process";import{closeSync as F7,mkdirSync as QB,openSync as L7,readdirSync as XB,realpathSync as Y$,rmSync as W1}from"fs";import{hostname as YB}from"os";import{dirname as a9,join as F0,resolve as GB}from"path";import{createHash as f7}from"crypto";import{unlinkSync as h7}from"fs";import{platform as m7}from"os";import{join as v7}from"path";var G4=U.discriminatedUnion("store",[U.strictObject({version:U.literal(1),store:U.literal("keychain")}),U.strictObject({version:U.literal(1),store:U.literal("file"),api_key:U.string().min(1).max(4096)})]),w$=($)=>v7($,"api-key.json");function L$($){let J=f7("sha256").update(`reason-connect-api-key
+${$}`).digest("hex");return new r$(B2(),m7(),J)}function L3($,J,Z=L$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(w$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof G0))throw Q}c(w$($),{version:1,store:"file",api_key:J})}function l0($,J=L$($)){if(!u(w$($)))return null;let Z=G4.parse(JSON.parse(s(w$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof G0))throw Q;throw Error("worker_api_key_unreadable")}}function K4($,J=L$($)){if(!u(w$($)))return;if(G4.parse(JSON.parse(s(w$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof G0))throw Z}h7(w$($))}async function j3($,J){let Z;try{Z=await Y4({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:b0($.proxy)})}catch(Q){if(Q instanceof v0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as XZ,renameSync as YZ,rmSync as f$}from"fs";import{join as H0}from"path";import{createHash as g7}from"crypto";import{realpathSync as u7,statSync as d7,unlinkSync as U2}from"fs";import{platform as l7}from"os";import{join as w0}from"path";function d($){return{state:w0(g($),"device.json"),control:w0(g($),"control.json"),lock:w0(g($),"lifecycle.lock"),socket:w0(g($),"control.sock"),daemon:w0(g($),"daemon.json"),releaseCheck:w0(g($),"release-check.json"),updateDeferral:w0(g($),"update-deferral.json"),firstHeartbeat:w0(g($),"first-heartbeat.json")}}var p7=U.object({version:U.literal(1),device_id:U.string().min(1).max(160),offer:U.unknown().optional(),enrollment_ms:U.number().int().nonnegative().max(t$).optional()});function U4($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function D3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=p7.safeParse(JSON.parse(s(Z)));if(U2(Z),!Q.success||Q.data.device_id!==J)return null;let X=V2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=w0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?O3($):new W3(g($))}function N2($,J){T0($,!0),a7($);let Z=J??O3($),Q=new W3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof G0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function O3($){return new r$(B2(),l7(),c7($))}function c7($){let J=z3($);return g7("sha256").update(`reason-worker
+${J?.directory??g($)}`).digest("hex")}function I1($,J){c(w0(g($),C1),{version:1,directory:z3($)?.directory??g($),devicePublicKey:J})}var C1="keychain-scope.json";function V4($){return u(w0(g($),C1))}var s7=U.strictObject({version:U.literal(1),directory:U.string().min(1),devicePublicKey:U.string().min(1)});function z3($){let J=w0(g($),C1);if(!u(J))return null;let Z=s7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function a7($){let J=w0(g($),C1);if(!u(J))return;if(z3($))try{let Z=O3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof G0))throw Z}U2(J)}function V$($){let J=u7($.workspaceRoot);if(J!==$.workspaceRoot||!d7(J).isDirectory()||!R1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function o($){if(!u(g($)))return null;let J=k$(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&B4($.apiOrigin,J.apiOrigin),Q=Z?[N0($),N0({...$,apiOrigin:J.apiOrigin})]:[N0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var N4=U.strictObject({version:U.literal(1),drained:U.boolean(),revoked:U.boolean()});function $0($){let J=d($).control;return u(J)?N4.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function I0($,J){c(d($).control,N4.parse(J))}function k0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=w0(g($),C1);if(u(Z))U2(Z);let Q=d($).state;if(u(Q))U2(Q)}var i7=U.strictObject({read:U.boolean(),write:U.boolean(),execute:U.boolean(),discover_environment:U.boolean(),expose_mcp:U.literal(!1)}),A3=U.strictObject({version:U.literal(1),organization_id:U.string().min(1).max(160),enrollment_ticket:U.string().min(1).max(4096),code_verifier:U.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/),root:U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),permissions:i7,execution_mode:U.enum(["confined","host"]).default("confined")}),folders:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),n7=U.object({device_id:U.string().min(1).max(160),organization_id:U.string().min(1).max(160),auth_scheme:U.literal("p256"),protocol_version:U.literal(2),roots:U.array(U.object({id:U.string().min(1),label:U.string(),path_fingerprint:U.string()})).min(1).max(32),headless:U.object({lifecycle:U.enum(["persistent","ephemeral"]),expires_at:U.iso.datetime({offset:!0})}),first_heartbeat:U.unknown().optional()}),R3=30000;class o0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function r7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(R3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new o0(X?.error==="device_revoked")}return Q.json()}async function I3($,J,Z,Q){g0();let X=A3.parse(JSON.parse(s(J)));return e0($,X,Z,Q)}async function e0($,J,Z,Q=(Y,G)=>r7(Y,G,b0($.proxy)),X=performance.now()){let Y=H4($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function q4($,J,Z,Q,X=performance.now()){let Y=H4($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function H4($,J,Z){if(g0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=y$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let H=y$([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(H.path!==K||H.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return H});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:t,bridge_version:t,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let H=n7.parse(K);if(H.organization_id!==J.organization_id||H.roots.length!==Y.length||H.roots.some((q,M)=>q.path_fingerprint!==Y[M].pathFingerprint)||H.headless.lifecycle!==$.lifetime||Date.parse(H.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let B=V2(H.first_heartbeat);try{U4($,H.device_id,{...B?{offer:B}:{},enrollmentMs:Math.min(t$,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:H.organization_id,deviceId:H.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:N0($),lifetime:$.lifetime,expiresAt:H.headless.expires_at},roots:H.roots.map((q,M)=>({id:q.id,label:q.label,path:Y[M].path,pathFingerprint:q.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as t7,randomUUID as o7}from"crypto";import{unlinkSync as e7}from"fs";import{join as $Z}from"path";var _4=U.strictObject({version:U.literal(1),install_id:U.uuid(),fingerprint_key:U.string().regex(/^[a-f0-9]{64}$/)}),JZ=U.object({enrollment_ticket:U.string().min(1).max(4096),expires_at:U.iso.datetime({offset:!0}),device_kind:U.literal("headless"),lifecycle:U.enum(["persistent","ephemeral"]),device_expires_at:U.iso.datetime({offset:!0})});function C3($){return JZ.parse($)}var ZZ=U.object({credentialKind:U.enum(["oauth","api_key"]).optional(),apiOrigin:U.url(),clientId:U.string(),accessToken:U.string().min(1).max(32768),refreshToken:U.string().max(32768),expiresAt:U.iso.datetime({offset:!0}),scopes:U.array(U.string().max(128)).max(128),orgId:U.string().min(1).max(160)});function j$($){return q2(E1("REASON_CLI_CHANNEL",$.channel),U0())}async function W$($,J=j$($)){if(!u(J))return null;let Z=ZZ.parse(JSON.parse(s(J)));if(!C0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=b0($.proxy),X=Object.assign((G,V)=>Q(G,{...V,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await T4({path:J,fetchImpl:X});if(Y&&!C0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function F4($,J,Z){if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=D$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function L4($,J,Z,Q,X){let Y=performance.now();if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=D$($),V=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(V){let K=await q4($,G.direct(J.orgId),Q,(N,H)=>V({approval:G.request,code_verifier:H,registration:N}).catch((B)=>{throw QZ(B)}),Y);if(K)return K}return e0($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function QZ($){if(!($ instanceof v0))return $;if($.status===409)return new o0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new o0(!1);return $}var P1=($)=>$Z(g($),"enrollment-install.json");function j4($){if(u(P1($)))e7(P1($))}function D$($,{stored:J=!0}={}){g0();let Z=P1($),Q=J&&u(Z)?_4.parse(JSON.parse(s(Z))):{version:1,install_id:o7(),fingerprint_key:t7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=y$([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let V=($.folders??[]).map((B)=>{let q=y$([B],X,Y)[0];if(q.path!==B)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:q.pathFingerprint}}),K=M4(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...V.map((B)=>B.path_fingerprint)].map((B)=>({path_fingerprint:B,permissions:X,execution_mode:$.executionMode}))},H=(B)=>({version:1,organization_id:B,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...V.length?{folders:V}:{}});return{request:N,saveInstall(B){e(g(B),!0),c(P1(B),Q)},complete(B,q){let M=C3(q);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...H(B),enrollment_ticket:M.enrollment_ticket}},direct:H}}function W4($,J,Z){let Q=P1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=_4.parse(JSON.parse(s(Q)));return y$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var H2=8,A4=600000,R4=15000,D4=new Set(["device_revoked","invalid_device_credential"]),M2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,N$=($)=>H0(g($),"workspaces"),I4="account.json",P3=($)=>u(H0($,I4));function y0($){let J;try{J=XZ(N$($))}catch{return[]}return J.filter((Z)=>M2.test(Z)).sort().map((Z)=>{let Q=H0(N$($),Z),X=H0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:P3(Q)}})}function T2($,J){let Z=J.toLowerCase();if(!M2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:H0(N$($),Z)});return e(Q.stateDirectory,!0),c(H0(Q.stateDirectory,I4),{version:1}),{config:Q,configPath:H0(Q.stateDirectory,"worker.json")}}function _2($,J){try{let{config:Z,configPath:Q}=T2($,J);e(g(Z),!0),I0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function x1($,J){let Z=J.toLowerCase(),Q=null;try{Q=o($)?.orgId.toLowerCase()??null}catch{}return Q===Z||y0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var E3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function O4($,J){let Z=o($);if(!Z?.worker)throw Error("worker_identity_missing");I1($,Z.devicePublicKey),e(g(J),!0);for(let Y of E3)f$(H0(g(J),Y),{force:!0});for(let Y of E3){let G=H0(g($),Y);if(u(G))YZ(G,H0(g(J),Y))}let Q=T0(J),X=k$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");f0({...X,worker:{...X.worker,configDigest:N0(J)}},d(J).state,{proofStore:Q})}function x3($){for(let J of y0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))k0(J.config)}catch{}f$(J.directory,{recursive:!0,force:!0})}f$(b3($),{force:!0})}function F2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(B)=>Number(Date.parse(B.worker?.expiresAt??"")>X+60000),V=y0($).flatMap((B)=>{if(!B.account||!B.config)return[];try{if($0(B.config).revoked)return[];let q=o(B.config);return q&&q.orgId.toLowerCase()===B.organizationId&&(!Q||Y(q))?[{...B,config:B.config,state:q}]:[]}catch{return[]}}).sort((B,q)=>Number(q.organizationId===J)-Number(B.organizationId===J)||Y(q.state)-Y(B.state))[0];if(!V)return null;let K=null;try{K=$0($).revoked?null:o($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&M2.test(N)&&N!==V.organizationId){let B=T2($,N);O4($,B.config),c(B.configPath,B.config)}else if(u(g($))){try{if(u(d($).state))k0($)}catch{}for(let B of E3)f$(H0(g($),B),{force:!0})}x3($);let H=J0.parse({...V.config,stateDirectory:$.stateDirectory});return O4(V.config,H),c(H0($.stateDirectory,"worker.json"),H),f$(V.directory,{recursive:!0,force:!0}),H}var S3={before($){for(let{config:J}of y0($))try{let Z=J?o(J):null;if(J&&Z)I1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of y0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==H0(N$($),Z))continue;let V=J0.parse({...G,stateDirectory:Q}),K=T0(V),N=k$(d(V).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===N0(G))f0({...N,worker:{...N.worker,configDigest:N0(V)}},d(V).state,{proofStore:K});c(X,V)}catch{}}}},b3=($)=>H0(N$($),"listed.json");function C4($){try{let J=JSON.parse(s(b3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function P4($,J){let Z=y0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=C4($),G=Y&&!Y.listed?Y.reason:null,V=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&V.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...V].map(({organizationId:K,config:N,account:H})=>{let B=!1,q=null,M=!1,T=null;try{B=N?$0(N).revoked:!1,q=N&&!B?o(N):null;let _=N?o$(d(N).daemon):null;M=J&&!!q&&_?.state==="connected",T=M?z4(_,q):null}catch{}return{...T?{permission_recovery:T}:{},organization_id:K,device_id:q?.deviceId??null,name:Y?.names?.[K]??null,root:q?.roots[0]?{id:q.roots[0].id,permissions:q.roots[0].permissions}:null,state:B?"removed":M?"connected":"not_running",blocked:!H&&!B&&!M&&(Y?.blocked.includes(K)??!1),...H?{account:!0}:{}}})}}function E4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,V=null,K=!1,N=C4(J)??{listed:!1,reason:null,blocked:[]},H=(L)=>{let{folders:W,...R}=J,E=Z.roots.slice(1).map((I)=>I.path);return J0.parse({...R,...E.length?{folders:E}:{},stateDirectory:H0(N$(J),L)})},B=async(L)=>{let W=G.get(L);if(!W)return;W.controller.abort(),await W.done},q=(L,W=!1)=>{let R=new AbortController,E=()=>R.abort();if(X.addEventListener("abort",E,{once:!0}),X.aborted)R.abort();let I={...L,controller:R,claims:0,done:Promise.resolve(),account:W};I.done=$.serve(L,R.signal,(C)=>{I.claims=C}).then(()=>{return},(C)=>{if(W&&C instanceof _0&&C.status===401&&D4.has(C.code)){try{I0(L.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${L.organizationId} (another account's) no longer accepts this computer (${C.code}); run \`reason connect\` signed in as that account to connect it again
+`)}else if(C instanceof _0&&C.status===401&&D4.has(C.code)){try{k0(L.config)}catch{}Y(`Reason worker: workspace ${L.organizationId} no longer accepts this computer
 `)}else if(!R.signal.aborted)Y(`Reason worker: workspace ${L.organizationId} stopped (worker_workspace_failed); it starts again on the next check
-`)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",E),I.claims=0,G.get(L.organizationId)===I)G.delete(L.organizationId);let C=L.config.stateDirectory;if(W&&!R3(C)&&!u(H0(C,"worker.json")))y$(C,{recursive:!0,force:!0})}),G.set(L.organizationId,I)},M=(L,W)=>{if(!W)return null;try{let R=H(L),E=t(W);if(!E||E.orgId!==L||Date.parse(E.worker?.expiresAt??"")<=Date.now()+60000||W.name!==R.name||W.executionMode!==R.executionMode||!C0(W.apiOrigin,R.apiOrigin)||E.roots.map((I)=>I.path).join(`
+`)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",E),I.claims=0,G.get(L.organizationId)===I)G.delete(L.organizationId);let C=L.config.stateDirectory;if(W&&!P3(C)&&!u(H0(C,"worker.json")))f$(C,{recursive:!0,force:!0})}),G.set(L.organizationId,I)},M=(L,W)=>{if(!W)return null;try{let R=H(L),E=o(W);if(!E||E.orgId!==L||Date.parse(E.worker?.expiresAt??"")<=Date.now()+60000||W.name!==R.name||W.executionMode!==R.executionMode||!C0(W.apiOrigin,R.apiOrigin)||E.roots.map((I)=>I.path).join(`
 `)!==Z.roots.map((I)=>I.path).join(`
-`))return null;return{organizationId:L,config:W,state:E,proofStore:M0(W)}}catch{return null}},T=(L,W)=>{if(!W)return null;try{if($0(W).revoked)return null;let R=t(W);if(!R||R.orgId.toLowerCase()!==L||Date.parse(R.worker?.expiresAt??"")<=Date.now()+60000||W.executionMode!==J.executionMode||!C0(W.apiOrigin,J.apiOrigin))return null;return{organizationId:L,config:W,state:R,proofStore:M0(W)}}catch{return null}},_=(L,W)=>L.deviceId===W.deviceId&&L.devicePublicKey===W.devicePublicKey&&JSON.stringify(L.roots.map((R)=>[R.id,R.path]))===JSON.stringify(W.roots.map((R)=>[R.id,R.path])),j=async(L)=>{for(let[W,R]of L){if(X.aborted)return;let E=G.get(W),I=T(W,R.config);if(E&&I&&_(E.state,I.state))continue;if(E){if(E.claims>0)continue;await B(W)}if(I&&!X.aborted)q(I,!0)}for(let[W,R]of G)if(R.account&&!L.has(W)&&R.claims===0)await B(W)},D=async(L)=>{let W=H(L),R=J0.parse({...W,stateDirectory:J.stateDirectory});if(!u(H0(g(J),"enrollment-install.json")))return null;let E=W$(R),I=await Q.ownerWorkspaceEnrollment(Z,{organization_id:L,install_id:E.request.install_id,code_challenge:E.request.code_challenge},X),C=E.complete(L,I);if(e(g(W),!0),u(d(W).state))w0(W);let h=N2(W);try{let S=await r0(W,C,h,$.enroll);return y0(S,d(W).state,{proofStore:h}),I0(W,{version:1,drained:!1,revoked:!1}),c(H0(W.stateDirectory,"worker.json"),W),{organizationId:L,config:W,state:S,proofStore:h}}catch(S){if(S instanceof n0&&S.deviceRemoved)return I0(W,{version:1,drained:!0,revoked:!0}),c(H0(W.stateDirectory,"worker.json"),W),null;throw S}},O=async()=>{let L=k0(J),W=new Map(L.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await j(W);let R=new Map(L.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),E=(A)=>W.has(A)||G.get(A)?.account===!0||R3(H0(B$(J),A)),I=(A)=>{let w=R.get(A)?.config;try{return w?$0(w).revoked:!1}catch{return!1}};for(let[A,w]of R){if(G.has(A)||I(A)||N.blocked.includes(A))continue;let b=M(A,w.config);if(b&&!X.aborted)q(b)}let C;try{C=await Q.ownerWorkspaces(Z,X)}catch(A){return N={listed:!1,blocked:N.blocked,...N.names?{names:N.names}:{},reason:A instanceof T0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let h=new Map(C.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>M2.test(A)&&A!==Z.orgId.toLowerCase()&&!E(A))),S=[...h.keys()].filter((A)=>R.has(A)?!I(A):!h.get(A)).slice(0,H2),y=[...G.values()].filter((A)=>!A.account&&A.claims>0&&!S.includes(A.organizationId)).length,l=S.filter((A)=>!R.has(A)),k=l.slice(l.length-Math.min(Math.max(0,S.length+y-H2),l.length)),P=S.filter((A)=>!k.includes(A)),x=Object.fromEntries(C.flatMap((A)=>A.name&&P.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));N={listed:!0,reason:null,blocked:P.filter((A)=>h.get(A)),names:x};for(let A of new Set([...R.keys(),...G.keys()])){if(P.includes(A)||E(A))continue;if(h.has(A)&&I(A))continue;if((G.get(A)?.claims??0)>0)continue;await B(A);let w=R.get(A)?.config;try{if(w&&u(d(w).state))w0(w)}catch{}y$(H0(B$(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
-`)}for(let A of P){if(X.aborted)return!0;if(E(A))continue;try{let w=G.get(A);if(h.get(A)){if(w&&w.claims===0)await B(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
-`);continue}let b=M(A,R.get(A)?.config??null);if(b&&w)continue;if(!b){if(w&&w.claims>0)continue;if(await B(A),b=await D(A),b)Y(`Reason worker: connected in workspace ${A}
+`))return null;return{organizationId:L,config:W,state:E,proofStore:T0(W)}}catch{return null}},T=(L,W)=>{if(!W)return null;try{if($0(W).revoked)return null;let R=o(W);if(!R||R.orgId.toLowerCase()!==L||Date.parse(R.worker?.expiresAt??"")<=Date.now()+60000||W.executionMode!==J.executionMode||!C0(W.apiOrigin,J.apiOrigin))return null;return{organizationId:L,config:W,state:R,proofStore:T0(W)}}catch{return null}},_=(L,W)=>L.deviceId===W.deviceId&&L.devicePublicKey===W.devicePublicKey&&JSON.stringify(L.roots.map((R)=>[R.id,R.path]))===JSON.stringify(W.roots.map((R)=>[R.id,R.path])),j=async(L)=>{for(let[W,R]of L){if(X.aborted)return;let E=G.get(W),I=T(W,R.config);if(E&&I&&_(E.state,I.state))continue;if(E){if(E.claims>0)continue;await B(W)}if(I&&!X.aborted)q(I,!0)}for(let[W,R]of G)if(R.account&&!L.has(W)&&R.claims===0)await B(W)},D=async(L)=>{let W=H(L),R=J0.parse({...W,stateDirectory:J.stateDirectory});if(!u(H0(g(J),"enrollment-install.json")))return null;let E=D$(R),I=await Q.ownerWorkspaceEnrollment(Z,{organization_id:L,install_id:E.request.install_id,code_challenge:E.request.code_challenge},X),C=E.complete(L,I);if(e(g(W),!0),u(d(W).state))k0(W);let h=N2(W);try{let S=await e0(W,C,h,$.enroll);return f0(S,d(W).state,{proofStore:h}),I0(W,{version:1,drained:!1,revoked:!1}),c(H0(W.stateDirectory,"worker.json"),W),{organizationId:L,config:W,state:S,proofStore:h}}catch(S){if(S instanceof o0&&S.deviceRemoved)return I0(W,{version:1,drained:!0,revoked:!0}),c(H0(W.stateDirectory,"worker.json"),W),null;throw S}},O=async()=>{let L=y0(J),W=new Map(L.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await j(W);let R=new Map(L.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),E=(A)=>W.has(A)||G.get(A)?.account===!0||P3(H0(N$(J),A)),I=(A)=>{let k=R.get(A)?.config;try{return k?$0(k).revoked:!1}catch{return!1}};for(let[A,k]of R){if(G.has(A)||I(A)||N.blocked.includes(A))continue;let b=M(A,k.config);if(b&&!X.aborted)q(b)}let C;try{C=await Q.ownerWorkspaces(Z,X)}catch(A){return N={listed:!1,blocked:N.blocked,...N.names?{names:N.names}:{},reason:A instanceof _0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let h=new Map(C.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>M2.test(A)&&A!==Z.orgId.toLowerCase()&&!E(A))),S=[...h.keys()].filter((A)=>R.has(A)?!I(A):!h.get(A)).slice(0,H2),y=[...G.values()].filter((A)=>!A.account&&A.claims>0&&!S.includes(A.organizationId)).length,l=S.filter((A)=>!R.has(A)),w=l.slice(l.length-Math.min(Math.max(0,S.length+y-H2),l.length)),P=S.filter((A)=>!w.includes(A)),x=Object.fromEntries(C.flatMap((A)=>A.name&&P.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));N={listed:!0,reason:null,blocked:P.filter((A)=>h.get(A)),names:x};for(let A of new Set([...R.keys(),...G.keys()])){if(P.includes(A)||E(A))continue;if(h.has(A)&&I(A))continue;if((G.get(A)?.claims??0)>0)continue;await B(A);let k=R.get(A)?.config;try{if(k&&u(d(k).state))k0(k)}catch{}f$(H0(N$(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
+`)}for(let A of P){if(X.aborted)return!0;if(E(A))continue;try{let k=G.get(A);if(h.get(A)){if(k&&k.claims===0)await B(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
+`);continue}let b=M(A,R.get(A)?.config??null);if(b&&k)continue;if(!b){if(k&&k.claims>0)continue;if(await B(A),b=await D(A),b)Y(`Reason worker: connected in workspace ${A}
 `)}if(b&&!X.aborted)q(b)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
-`)}}return!0},F=null,z=async()=>{let L=!1;do K=!1,L=await O().catch(()=>!1);while(K&&!X.aborted);let W=JSON.stringify({version:1,...N});if(F!==W)try{e(B$(J),!0),c(E3(J),JSON.parse(W)),F=W}catch{}return L};return{check(){if(V)K=!0;else V=z().finally(()=>{V=null});return V},claims:()=>[...G.values()].reduce((L,W)=>L+W.claims,0),async settled(){await V,await Promise.all([...G.values()].map((L)=>L.done))}}}import{dirname as xZ}from"path";import{randomUUID as t$}from"crypto";import{chmodSync as S4,closeSync as o$,constants as e$,existsSync as UZ,fstatSync as b4,lstatSync as w4,mkdirSync as k4,openSync as y4,readFileSync as f4,readdirSync as h4,readlinkSync as $V,realpathSync as JV,renameSync as $1,rmSync as x3,statSync as m4,symlinkSync as ZV,unlinkSync as b1,writeFileSync as S3}from"fs";import{basename as XV,dirname as v4,isAbsolute as VZ,join as j0,relative as YV,resolve as GV,sep as KV}from"path";import{createRequire as NZ}from"module";var g4=1,u4=1,qZ=128,HZ=65536;var MZ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var P4=/^[a-z0-9_.-]{1,80}$/,TZ=64;var _Z=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function d4($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function l4($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function j2($){return typeof $==="string"&&MZ.test($)}function p4($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function w3($){k4($,{recursive:!0,mode:448}),S4($,448)}function FZ($,J){w3(v4($));let Z=`${$}.${process.pid}.${t$()}.tmp`;try{S3(Z,J,{mode:384,flag:"wx"}),S4(Z,384),$1(Z,$)}finally{if(UZ(Z))b1(Z)}}function W2($={}){if(($.platform??process.platform)!=="darwin")throw new w1("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=D$(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?D$(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&VZ(X))?null:j0($.home??B0(),"Library","Application Support"),V=$.root??(G?j0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...G?{legacyRoot:j0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:j0(V,"versions"),current:j0(V,"current"),previous:j0(V,"previous"),brokerLock:j0(V,"broker.lock"),transitionLock:j0(V,"transition.lock"),lifecycleEvents:j0(V,"lifecycle-events")}}function LZ($){return d4($)&&l4($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===g4&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&p4($.started_at)&&j2($.runtime_version)}function c4($,J){try{let Z=w4($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=y4(j0($,J),e$.O_RDONLY|e$.O_NOFOLLOW|e$.O_NONBLOCK);try{let X=b4(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return f4(Q,"utf8")}finally{o$(Q)}}catch{return null}}function b3($){try{let J=JSON.parse(c4($,"owner.json")??"null");return LZ(J)?J:null}catch{return null}}function s4($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var E4="lease",jZ=2,WZ=4,S1;function DZ(){if(S1!==void 0)return S1;if(S1=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=NZ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return S1={flock:(G,V)=>X.symbols.flock(G,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},S1}catch{}return null}function OZ($){let J=DZ();if(!J)return null;let Z=y4(`${$}.lease`,e$.O_RDWR|e$.O_CREAT|e$.O_NOFOLLOW,384);try{let Q=b4(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return o$(Z),"busy";if(J.flock(Z,jZ|WZ)===0)return Z;let X=J.errno();return o$(Z),X===J.wouldBlock?"busy":null}catch(Q){throw o$(Z),Q}}function t0($){w3(v4($.path));let J=OZ($.path);if(J==="busy")return{acquired:!1,owner:b3($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=zZ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)o$(J)}}function zZ($,J){let Z=$.alive??s4,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:g4,pid:$.pid??process.pid,nonce:$.nonce?.()??t$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${t$()}`,V=!1;try{if(k4(G,{mode:448}),S3(j0(G,"owner.json"),`${JSON.stringify(Y)}
-`,{mode:384,flag:"wx"}),J!==null)S3(j0(G,E4),`flock
-`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw w4($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}$1(G,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,b3($.path)?.nonce===Y.nonce)x3($.path,{recursive:!0,force:!0});if(J!==null)o$(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let H=b3($.path),B=($.now?.()??new Date).getTime(),q=H&&$.staleAfterMs!==void 0?B-Date.parse(H.started_at)<$.staleAfterMs:!1,M=H!==null&&!(J!==null&&c4($.path,E4)!==null)&&Z(H.pid);if(!H||M||q)return{acquired:!1,owner:H,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${t$()}`;try{$1($.path,T),x3(T,{recursive:!0,force:!0}),Q=!0}catch(_){let j=_.code;if(!["ENOENT","EEXIST"].includes(j??""))throw _}}finally{if(!V)x3(G,{recursive:!0,force:!0})}}throw new w1("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function a4($){return d4($)&&l4($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===u4&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&p4($.occurred_at)&&typeof $.event==="string"&&_Z.includes($.event)&&j2($.runtime_version)&&($.from_version===void 0||j2($.from_version))&&($.to_version===void 0||j2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&P4.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=TZ&&$.capabilities.every((J)=>typeof J==="string"&&P4.test(J)))}var AZ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,RZ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,IZ=300000,L2=0n;function CZ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return L2=J>L2?J:L2+1n,`${String(L2).padStart(22,"0")}-${$.event_id}.json`}function i4($){try{return h4($.lifecycleEvents).filter((J)=>AZ.test(J)).sort()}catch{return[]}}function x4($){try{let J=JSON.parse(f4($,"utf8"));return a4(J)?J:null}catch{return null}}function PZ($,J=s4,Z=Date.now()){let Q;try{Q=h4($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(RZ);if(!Y)continue;let G=j0($.lifecycleEvents,X),V=j0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-m4(G).mtimeMs>=IZ}catch{continue}if(!K)continue;try{$1(G,V)}catch(N){let H=N.code;if(H==="EEXIST")b1(G);else if(H!=="ENOENT")throw N}}}function EZ($){let Z=i4($).flatMap((X)=>{try{return[{name:X,size:m4(j0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>qZ||Q>HZ){let X=Z.shift();if(!X)break;try{b1(j0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function k1($,J,Z={}){let Q={schema_version:u4,event_id:Z.eventId?.()??t$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!a4(Q))throw new w1("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return w3($.lifecycleEvents),FZ(j0($.lifecycleEvents,CZ(Q)),`${JSON.stringify(Q)}
-`),EZ($),Q}async function n4($,J,Z){PZ($);let Q=0;for(let X of i4($)){let Y=j0($.lifecycleEvents,X);if(Z){let K=x4(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${t$()}`;try{$1(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=x4(G);if(!V){b1(G);continue}try{await J(V),b1(G),Q+=1}catch{try{$1(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function o4($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!SZ($.saved))return J;let Z=$.saved,Q=(G,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...V?{code:`worker_api_origin_move_${G}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?J1():$.native;if(!X)return J;let Y=[];try{let G=X.lock(xZ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let H=t0({path:d(Z).lock,runtimeVersion:r});if(!H.acquired)return J;Y.push(()=>H.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=e4(V),N={saved:V,configPath:$.configPath};if(!D2(V)&&K.length===0)return Q("unchanged"),N;if(D2(V)){let H=r4(V);c($.configPath,H),N={saved:H,configPath:$.configPath}}for(let H of K)try{c(H.configPath,r4(H.config))}catch(B){Q("failed",`workspace:${t4(B)}`)}return Q("moved"),N}catch(G){return Q("failed",t4(G)),J}finally{for(let G of Y.reverse())G()}}function D2($){return O$($.apiOrigin)!==$.apiOrigin}function e4($){return k0($).filter((J)=>J.config!==null&&D2(J.config))}function SZ($){return D2($)||e4($).length>0}function r4($){let J=J0.parse({...$,apiOrigin:O$($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=N0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)y0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:M0(J)});return J}function t4($){if($ instanceof Y0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as bZ,lstatSync as f3,readdirSync as Y8,readlinkSync as wZ,unlinkSync as kZ}from"fs";import{join as D0,sep as yZ}from"path";var O2="rehome.json";class z2 extends Error{code;constructor($){super($);this.code=$}}function G8($){let J={saved:$.saved,configPath:$.configPath},Z=D0($.home,".config"),Q=D0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=D0(Q,...X),G=D0(Z,"reason",...X),V=(B,q)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:B,...q?{code:`worker_state_rehome_${B}:${q}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?J1():$.native,N=$.saved,H=[];try{if(N&&J8(Q)&&N.stateDirectory===Y){let D={...N,stateDirectory:G};if(!k3(K,G,D,H))return J;return $8(N,D,$.host,V)}if(N&&J8(Q)&&N.stateDirectory===G&&U4(N)&&k3(K,G,N,H))return K8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!Z1(Q)?.isDirectory())return J;if(uZ(Y)===r)return J;let q=(D,O=!0)=>{if(O)c(D0(Y,O2),{version:r});return V("skipped",D),J},M=[Y];for(let D of hZ(Q,Y)){if(D.config?.lifetime!=="ephemeral")return q("several_connections");if(!fZ(D.directory,D.config,H))return q("once_running",!1);M.push(D.directory)}if(!K)return q("config_rename_unavailable:no_native");if(!k3(K,Y,N,H))return J;let T=t(N);if(!T||$0(N).revoked)return J;if(Z8(Z)!==null)return q("conflicting_identity");if(Q8(Z)!==null)return q("conflicting_files");if(Z1(G)&&(!Z1(G).isDirectory()||Y8(G).length>0))return q("connection_folder_taken");R1(N,T.devicePublicKey),P3.before(N);let _=u0(Y);if(_&&y3(Y))mZ(G,_);let j=A2(Z,K,M);if(j.state!=="renamed"&&j.state!=="linked"){if(_&&y3(Y))B8(G);return q(j.problem??"config_folder_kept")}return $8(N,{...N,stateDirectory:G},$.host,V)}catch(B){try{if(Z1(Y)?.isDirectory())c(D0(Y,O2),{version:r})}catch{}return V("failed",dZ(B)),gZ(N,Y,G,J)}finally{for(let B of H.reverse())B()}}function $8($,J,Z,Q){let X=f3(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)bZ(J.stateDirectory,448);let Y=M0(J),G=w$(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new z2("identity_missing");let V=N0(J);if(G.worker.configDigest===N0($))y0({...G,worker:{...G.worker,configDigest:V}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==V)throw new z2("worker_config_binding_mismatch");c(D0(J.stateDirectory,"worker.json"),J),P3.after($,J),K8($,J,Z);let K=D0(J.stateDirectory,O2);if(u(K))kZ(K);return Q("moved"),{saved:J,configPath:D0(J.stateDirectory,"worker.json")}}function K8($,J,Z){if(X8($,J,Z,"connect"),!y3(J.stateDirectory))return;let Q=vZ(F$($.stateDirectory));if(!Q)return;let X=F$(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);B8($.stateDirectory)}function k3($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=t0({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function fZ($,J,Z){if(u(g(J))){let X=t0({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=Z1(D0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function hZ($,J){let Z=[$,...Y8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>D0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=D0(X,Y);if(G===J||!Z1(D0(G,"worker.json")))continue;let V=U8(G);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+yZ))Q.push({directory:G,config:V})}return Q}function y3($){try{return JSON.parse(s(D0($,"api-key.json"))).store==="keychain"}catch{return!1}}function mZ($,J){let Z=F$($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function B8($){try{F$($).deleteBinding()}catch(J){if(!(J instanceof Y0))throw J}}function vZ($){try{return $.loadBinding()}catch(J){if(J instanceof Y0)return null;throw J}}function gZ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=U8(Z);return X?.stateDirectory===Z?{saved:X,configPath:D0(Z,"worker.json")}:Q}function J8($){try{return f3($).isSymbolicLink()&&wZ($)==="reason"}catch{return!1}}function uZ($){try{let J=JSON.parse(s(D0($,O2)));return typeof J.version==="string"?J.version:null}catch{return null}}function U8($){try{let J=D0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function Z1($){try{return f3($)}catch{return null}}function dZ($){if($ instanceof z2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof Y0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as lZ}from"fs";function R2($){try{let J=JSON.parse(lZ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function V8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as PK}from"crypto";import{readdirSync as EK,realpathSync as u6,statSync as xK}from"fs";import{hostname as SK}from"os";import{join as s$,resolve as bK}from"path";var I2="cloud",pZ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function y1($){return pZ.test($)&&!N8.test($)}var cZ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Q1($){return cZ[$]}import{chmodSync as sZ,lstatSync as P2,mkdtempSync as aZ,realpathSync as T8,rmdirSync as iZ,rmSync as nZ,unlinkSync as rZ}from"fs";import{createConnection as tZ,createServer as oZ}from"net";import{basename as q8,dirname as H8,join as f$}from"path";var eZ=U.enum(["status","drain","resume","stop","reload_roots"]),$Q=U.strictObject({version:U.literal(1),instanceId:U.string(),deviceId:U.string(),phase:U.enum(["starting","running","reconnecting","stopping"]),drained:U.boolean(),activeClaims:U.number().int().nonnegative(),activeSessions:U.number().int().nonnegative().optional(),executionEligible:U.boolean(),supportedOperations:U.array(U.enum(C2)).max(C2.length).optional(),capabilityReadiness:U.partialRecord(U.enum(C2),U.boolean()).optional(),lastHeartbeat:U.string().nullable(),expiresAt:U.string()}),JQ=U.strictObject({nonce:U.string(),action:eZ}),ZQ=U.object({nonce:U.uuid()}),_8=U.strictObject({version:U.literal(1),nonce:U.uuid(),socketPath:U.string().max(100)});function F8($){return f$(d($).lock,"control.json")}function E2($){return e(d($).lock),ZQ.parse(JSON.parse(s(f$(d($).lock,"owner.json"))))}function M8($){if(!u($))return!1;let J=P2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function L8($,J){let Z=F8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!P2(Y).isSocket())return null;return M8(Y)?Y:null}let Q=_8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=H8(Q.socketPath);if(H8(X)!==T8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(q8(X))||q8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),M8(Q.socketPath)?Q.socketPath:null}async function x2($,J,Z){if(E2($).nonce!==J)throw Error("worker_instance_changed");let Q=F8($);if(u(Q))throw Error("worker_control_already_serving");let X=aZ(f$(T8("/tmp"),"ara-worker-")),Y=f$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,V=oZ((B)=>{G.add(B),B.once("close",()=>G.delete(B)),B.setTimeout(2000,()=>B.destroy());let q="",M=!1;B.on("error",()=>B.destroy()),B.on("data",(T)=>{if(M)return;if(q+=T.toString(),Buffer.byteLength(q)>4096){B.destroy();return}if(!q.includes(`
-`))return;M=!0;try{let _=JQ.parse(JSON.parse(q));if(_.nonce!==J){B.destroy();return}B.end(JSON.stringify(Z(_.action))+`
-`)}catch{B.destroy()}})});V.maxConnections=32;let K,N=!1,H=async()=>{if(N)return;N=!0;for(let B of G)B.destroy();if(await new Promise((B)=>V.close(()=>B())),K&&u(Q)){let B=P2(Q);if(B.isFile()&&B.dev===K.dev&&B.ino===K.ino)try{let q=_8.parse(JSON.parse(s(Q)));if(q.nonce===J&&q.socketPath===Y)rZ(Q)}catch{}}try{iZ(X)}catch{}};try{if(await new Promise((B,q)=>{V.once("error",q),V.listen(Y,()=>{sZ(Y,384),B()})}),E2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=P2(Q),H}catch(B){throw await H(),B}}function j8($,J){try{let Z=JSON.parse(s(f$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function f1($){return j8($,"runtime_version")}function QQ($){return j8($,"nonce")}function W8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(f$(d($).lock,"owner.json")))return"no_lock";return L8($,E2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var XQ=21600000,YQ=U.strictObject({instance:U.string().nullable(),since:U.number().int().nonnegative()});function GQ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=YQ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;h3($)}catch{}return null}function h3($){try{nZ(d($).updateDeferral,{force:!0})}catch{}}async function S2($,J,Z=()=>!1){let Q=QQ($),X=GQ($,Q);if(J!==void 0){let N=f1($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await U0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),V=X;if(V===null){V=G;try{c(d($).updateDeferral,{instance:Q,since:V})}catch{}}let K=G-V;return{state:K<XQ?"busy":"drained",sessions:Y,waitedMs:K}}async function U0($,J){let Z=d($);if(!u(f$(Z.lock,"owner.json")))return null;let Q=E2($),X=L8($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let V=tZ(X),K="",N=!1,H=(B,q)=>{if(N)return;if(N=!0,V.destroy(),q)G(q);else Y(B)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
-`)),V.on("data",(B)=>{if(K+=B.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(B)=>{if("code"in B&&["ECONNREFUSED","ENOENT"].includes(String(B.code)))H(null);else H(null,B.message==="worker_control_timeout"?B:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let B=$Q.parse(JSON.parse(K));if(B.instanceId!==Q.nonce)throw Error("worker_instance_changed");H(B)}catch{H(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>H(null,Error("worker_control_unavailable")))})}import{randomUUID as VG}from"crypto";import{homedir as gJ}from"os";import{spawn as KQ}from"child_process";async function D8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),V=(B)=>{if(Q===B)return;Q=B,J.onStatusChange?.(B)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let B=(J.spawn??KQ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=B,B.once("exit",()=>{if(!X&&Z===B)V("failed"),K()}),await new Promise((q,M)=>{B.once("spawn",q),B.once("error",M)}),B.exitCode===null&&B.signalCode===null)V("held")}catch{V("failed"),K()}};G=N(),await G;let H;return{get status(){return Q},release(){return H??=(async()=>{X=!0,clearTimeout(Y),await G;let B=Z;if(!B||B.exitCode!==null||B.signalCode!==null||!B.pid)return Q="failed","released";let q=await new Promise((M)=>{let T,_=setTimeout(()=>{try{B.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);B.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{B.kill("SIGTERM")}catch{}});if(q==="released")Q="failed";return q})()}}}class X1 extends Error{constructor(){super("Reason Device operation lease expired.")}}class b2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new X1;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new X1;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new X1)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as qQ}from"fs";import{constants as m3}from"fs";import{open as BQ}from"fs/promises";import{join as UQ}from"path";var VQ={platform:process.platform,home:B0,async openFile($){let J=await BQ($,m3.O_RDONLY|m3.O_NOFOLLOW|m3.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function O8($=VQ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(UQ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class v3 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function NQ($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new v3;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function z8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await NQ($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof v3||(X instanceof T0?h1(X.status):m1(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function t3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}var HQ=1000,MQ=250,TQ=v8(qQ(process.execPath)),A8=null,R8=null;function g8($){if(process.platform!=="darwin")return{};return R8??=O8().then((J)=>{A8={status:J,checkedAt:$().getTime()}}).finally(()=>{R8=null}),{fullDiskAccess:{...A8??{status:"unknown",checkedAt:$().getTime()},executablePath:TQ}}}var _Q=8,FQ=64,LQ=2000,jQ=2000,o3=8000,I8=3,WQ=250,C8=1000,P8=30000,DQ=0.2,OQ=30000,zQ=21600000,AQ=300000,RQ=3600000,IQ=0.1,u8=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function CQ($){return Math.min(I8,Math.max(1,$??I8))}function PQ($){return typeof $.reason_code==="string"&&u8.has($.reason_code)?$.reason_code:"cancelled"}function g3($){return $.reason instanceof f0&&($.reason.code==="cancelled"||u8.has($.reason.code))?$.reason.code:"cancelled"}function E8($){return $ instanceof f0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function d8($){return $.capability==="hands.connect"&&(f8($.payload)||y8($.payload))}function u3($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*IQ)))}function EQ($,J=Math.random){let Z=Math.min(P8,C8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*DQ*(Q*2-1);return Math.min(P8,Math.max(C8,Math.round(Z+X)))}function e3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class d3 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function xQ($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function l3($){return $ instanceof Error?$.message:String($)}function p3($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function s0($){return $ instanceof T0&&$.status===409&&$.code==="attempt_fenced"}function c3($){return $.capability==="environment.install"}function SQ($){if($ instanceof k2||$ instanceof X1||$ instanceof g1)return"timeout";if(!($ instanceof Error)||$ instanceof T0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof T0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function v1($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(s0(Z))return;let Q=Z instanceof T0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:SQ(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function Y1($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)v1($,J,Q);throw Q}}class g1 extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function s3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":b8(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:c3(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??e3,K=$.operationCompletionTimeoutMs??o3,N=performance.now()+K,H,B,q=new Promise((_,j)=>{let D=()=>{let F=new g1;Y.abort(F),j(F)},O=(F)=>{clearTimeout(H),H=setTimeout(D,F)};if(B=()=>O(Math.max(0,Math.min(N-performance.now(),LQ))),O(K),$.signal.addEventListener("abort",B,{once:!0}),$.signal.aborted)B()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),q]);break}catch(_){if(G.aborted||$.signal.aborted||P0(_)||s0(_)||!bQ(_)||performance.now()>=N)throw v1($,"completion",_),_;T+=1;let j=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(j<=0)throw v1($,"completion",_),_;try{await V(j,G)}catch{throw v1($,"completion",_),_}}}finally{clearTimeout(H),$.signal.removeEventListener("abort",B),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function bQ($){if(P0($))return!1;if(s0($))return!1;if($ instanceof T0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof g1)return!1;return!0}return!1}class k2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function w2($){if($ instanceof k2)return!0;return $ instanceof T0?h1($.status):m1($)}function a3($,J){if(!($ instanceof T0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function wQ($,J,Z,Q,X){let Y=new AbortController,G,V=()=>{return},K=new Promise((H,B)=>{let q=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),B(M)};if(V=()=>Q.removeEventListener("abort",q),Q.aborted)q();else Q.addEventListener("abort",q,{once:!0})}),N=new Promise((H,B)=>{G=setTimeout(()=>{let q=new k2;Y.abort(q),B(q)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);V()}}async function x8($,J,Z,Q,X,Y){let G=CQ($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??o3,K=$.operationHeartbeatRetryDelayMs??WQ,N=Y.remainingMs(),H=Math.min(N,G*V+K*G*(G-1)/2);for(let B=0;B<G;B+=1)try{Q.throwIfAborted(),Y.assertCurrent();let q=Math.min(V,Y.remainingMs()),M=await wQ($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(q-1000))),clientRetryCount:B},Q,q);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(q){if(Q.aborted||B+1>=G||s0(q)||P0(q)||!w2(q)){if(!Q.aborted)v1($,"operation_heartbeat",q);throw q}let M=N-Y.remainingMs(),T=a3(q,($.now?.()??new Date).getTime()),_=Math.max(K*(B+1),H*(B+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function kQ($,J,Z,Q,X){let Y=d8(J),G=new AbortController,V=new AbortController,K=()=>{G.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,H,B,q=-1,M=0,T=Promise.resolve(),_=[],j=new AbortController,D=!1,O,F=null,z=!1,L,W,R={},E=(S)=>{D=!0,j.abort(S),G.abort(S),V.abort(S)},I=(S)=>{if(O)return O;let y=structuredClone(S),l=M;return O=(async()=>{let k=new AbortController,P=k.signal;P.throwIfAborted();let x,A=()=>{},w=new Promise((b,n)=>{if(A=()=>n(P.reason),P.addEventListener("abort",A,{once:!0}),x=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),P.aborted)A()});try{for(let b=0;b<3;b+=1){P.throwIfAborted();try{let n=await Promise.race([Y1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[y],signal:P,transientRetryOwner:"caller"})),w]);if(P.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(P0(n))X(n);let o=n instanceof T0?h1(n.status):m1(n);if(P.aborted||!o||b===2)throw n;let V0=Math.max(500*2**b,a3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(V0,P),w])}}}finally{clearTimeout(x),P.removeEventListener("abort",A),k.abort()}})(),O},C=(S,y,l)=>{let k=(x)=>Y1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:y,events:S,signal:x,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&s0(A))E(A);if(l&&(P0(A)||s0(A))){if(P0(A))X(A);G.abort(A),V.abort(A),j.abort(A)}throw A});if(!l)return async(x)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await k(x)).next_event_seq;return}x.throwIfAborted();let A=()=>{},w=new Promise((b,n)=>{A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([k(x),w]);x.throwIfAborted(),M=b.next_event_seq}finally{x.removeEventListener("abort",A)}};let P=z8({send:k,lease:W,sleep:Z,retryAfterMs:(x)=>a3(x,($.now?.()??new Date).getTime())});return async(x)=>{let A=await P(x);if(A.next_event_seq!==y+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,y)=>{let l=S??await x8($,J,{controlAckSeq:q,waitMs:y},V.signal,Z,W),k=null,P=!1;for(let x=0;x<10;x+=1){let A=q+1;for(let w of l.controls){if(w.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(w.kind==="cancel"||w.kind==="operation.cancel")k??=PQ(w.payload),G.abort(new f0(k,"Reason closed the Device operation."));if(w.kind!=="cancel"&&w.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,o=new Promise((V0,W0)=>{b=V0,n=W0});o.catch(()=>{}),R.current={promise:o,resolve:b,reject:n}}try{P||=!await $.onControl?.(J,w)}catch(b){if(b instanceof f0)H??=E8(b);throw R.current?.reject(b),b}}q=w.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==q+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:P}}try{l=await x8($,J,{controlAckSeq:q},V.signal,Z,W),R.current?.resolve()}catch(w){if(R.current?.reject(w),!k||s0(w)||P0(w))throw w;return{cancellationReason:k,unsupported:P}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)W=new b2(J.lease_until,()=>($.now?.()??new Date).getTime(),(y)=>{if(!G.signal.aborted)N=y;G.abort(y),V.abort(y)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||i3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(y){if(!c3(J)||s0(y)||P0(y))throw y;await s3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let y=S.cancellationReason??g3($.signal);G.abort(new f0(y,"Reason closed the Device operation.")),B={status:"cancelled",error_code:y}}else if(S.unsupported)G.abort(),B={status:"failed",error_code:"control_unsupported"};else{let y=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?jQ:15000),P=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??o3)-1000)),x=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!x){if(await Z(k,V.signal),V.signal.aborted)return}let A=await h(void 0,x?P:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new f0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(P0(A))X(A);if(s0(A))N=A,E(A);if(!V.signal.aborted)N=A,G.abort();return}})();try{if(W?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(W?.remainingMs()??0)>0),B=await $.onClaim(J,G.signal,async(k)=>{if(c3(J))return;let P=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",x=J.capability==="hands.connect"&&k.kind==="hands.reconnected",A=x||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,j.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,j.signal]):$.signal,w={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:x?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(i3.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((o,V0)=>{_.push({wireEvent:w,settle:(W0)=>W0===void 0?o():V0(W0)})});let b=_;_=[];let n=T.then(async()=>{if((D||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(P)await I(w);return}if(F!==null){if(k.kind!=="hands.stopped"||!z||!L)throw F;let V0=new AbortController,W0=AbortSignal.any([$.signal,j.signal,V0.signal]),H$=setTimeout(()=>V0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);z=!1;try{await L(W0),L=void 0,await C([w],M,!0)(W0),F=null}catch(M$){throw F=M$??Error("Hands stop receipt could not be confirmed."),M$}finally{clearTimeout(H$),V0.abort()}return}if(x&&!W){let V0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));W=new b2(new Date(V0).toISOString(),()=>($.now?.()??new Date).getTime(),(W0)=>{G.abort(W0),V.abort(W0)})}let o=M;if(x)L=C([...b.map((V0)=>V0.wireEvent),w],o,!0),await L(A),L=void 0;else await C([...b.map((V0)=>V0.wireEvent),w],o,!1)(A)});n.then(()=>{for(let o of b)o.settle()},(o)=>{for(let V0 of b)V0.settle(o??Error("Hands event delivery failed."))}),T=n.catch((o)=>{if(P0(o))X(o);if(x){if(F===null)z=A.aborted&&!j.signal.aborted,F=o??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(o),V.abort(o)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(k){B=G.signal.aborted?{status:"cancelled",error_code:g3(G.signal)}:{status:"failed",error_code:E8(k)}}finally{Q.authorized=()=>!1,j.abort();for(let k of _.splice(0))k.settle();V.abort(),await y}let l=w8(J.capability)?k8(B.result,J.operation_id):null;if(N){if(P0(N))throw N;B={status:"failed",error_code:H??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&B.status==="succeeded")B={status:"cancelled",error_code:g3(G.signal),...l?{result:l}:{}}}if(W?.close(),P0($.signal.reason))throw $.signal.reason;await s3($,J,B)}finally{W?.close(),j.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function $9($){let J=$.now??(()=>new Date),Z=$.sleep??e3,Q=$.saveStatus??r3,X=$.loadStatus??E1,Y=$.statusPath??n3(),G=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...g8(J),...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),H=0,B,q=!1,M,T,_,j=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),m8();try{let D=async()=>{let O=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||O===T)return;if(M&&T){let L=await M.release();if($.onEvent?.({type:"idle_sleep",status:L,policy:T}),L==="failed")return;M=void 0,T=void 0,K=!1;let W=X(Y);if(W)Q({...W,idleSleepHold:K},Y)}if(!O)return;T=O;let F=!0;M=await($.acquireAwakeHold??D8)(O,{onStatusChange:(L)=>{if(F)return;K=L==="held";let W=X(Y);if(W)Q({...W,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:L,policy:O})}}),F=!1,K=M.status==="held";let z=X(Y);if(z)Q({...z,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:O})};if(await D(),$.readIdleSleepPolicy)_=setInterval(()=>{j=j.then(D).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let O=!1;try{await yQ({...$,saveStatus:(F,z)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},z)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&H>0&&!O){O=!0;let z=H;H=0,B=void 0,$.onEvent?.({type:"reconnected",attempts:z})}$.onEvent?.(F)}});return}catch(F){if(p3(F,$.signal))return;if(P0(F)){q=!0;let L=$.state.worker?"worker_connection_failed":l3(F);throw Q({...N(),state:"error",error:L},Y),$.onEvent?.({type:"error",message:L}),F}H+=1;let z=EQ(H,$.reconnectRandom);B??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:B},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":l3(F),attempt:H,retryInMs:z}),await Z(z,$.signal)}}}catch(D){if(!p3(D,$.signal))throw D}finally{if($.client.close?.(),clearInterval(_),await j,M&&T){let D=await M.release();K=D==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:D,policy:T})}if(!q)Q({...N(),state:"stopped"},Y);else{let D=X(Y);if(D)Q({...D,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function yQ($){let J=$.now??(()=>new Date),Z=$.sleep??e3,Q=$.statusPath??n3(),X=$.saveStatus??r3,Y=$.loadStatus??E1,G=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,H=()=>N.abort($.signal.reason);if($.signal.aborted)H();else $.signal.addEventListener("abort",H,{once:!0});let B=K?.random??Math.random,q=$.maxConcurrentClaims,M=typeof q==="number"&&Number.isSafeInteger(q)&&q>0?Math.min(FQ,q):_Q,T=0,_=!1,j=null,D=(v)=>{j??=v,N.abort(v)},O=new Map,F=()=>{let v=new Set,X0=0;for(let{claim:x$}of O.values()){let Y$=x$.capability==="hands.connect"?x$.payload[S8]:void 0;if(typeof Y$==="string"){if(v.has(Y$))continue;v.add(Y$)}X0+=1}return X0},z=null,L=()=>[...O.values()].some((v)=>v.authorized()),W=()=>[...O.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(G).getTime()+u3(K.initialDelayMs??OQ,B):Number.POSITIVE_INFINITY,E=null,I=!1,C=$.firstHeartbeat,h=C?.account_root_metadata_supported===!0,S=C?.workspace_root_metadata_supported===!0,y=C?.account_root_path_supported===!0,l=C?.home_contained_roots_supported===!0,k=C?.root_paths_supported===!0,P=C?.startup_supported===!0,x=C!==void 0,A=C?{challenge:C.challenge,expires_at:C.expires_at}:void 0,w,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...g8(J),...V?{lastUsedAt:V}:{},...E?{organizationId:E.organization_id,organizationName:E.organization_name,organizationSlug:E.organization_slug}:{}}),o=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!b)w??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...P&&!b&&w?{startup:w}:{},capabilities:v?h8($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:y,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},V0=()=>{if(I||!$.client.identity)return;I=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;E=v;let X0=Y(Q);if(!X0)return;X({...X0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},W0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,y=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,k=v.root_paths_supported===!0,P=v.startup_supported===!0,x=!1},H$=(v)=>{if(v.startup)b=!0},M$=(v,X0)=>{if(!(X0 instanceof T0&&X0.status===400&&X0.code==="invalid_heartbeat")||!v.startup&&!x)throw X0;if(b=!0,x)h=S=y=!1,l=k=P=x=!1;return null},j1=(v)=>{W0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),V0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},P$=!1,a$=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(P$)a$=!0;let v=o();Y1($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((X0)=>M$(v,X0))).then((X0)=>{if(!X0)return;H$(v),W0(X0),j1(X0)},()=>{return})});let T$=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let Q$=!1,E$=$.maxConsecutiveHeartbeatFailures??3,X$=0;try{while(!$.signal.aborted){if(j)throw j;if(_&&W())break;let v,X0=o(),x$=A;A=void 0,P$=!0,a$=!1;try{let i=await Y1($,"heartbeat",()=>$.client.heartbeat($.state,X0,N.signal,...x$?[x$]:[]).catch((K0)=>M$(X0,K0)));if(P$=!1,!i)continue;v=i,H$(X0),X$=0}catch(i){if(P$=!1,$.signal.aborted)break;if(!w2(i))throw i;if(X$+=1,X$>=E$&&!L())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(W0(v),Object.keys(o().capabilities).length>Object.keys(X0.capabilities).length)continue;if(a$)continue;if(j1(v),j)throw j;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let i=new AbortController,K0=()=>i.abort($.signal.reason);if($.signal.aborted)K0();else $.signal.addEventListener("abort",K0,{once:!0});let z0;try{z0=K.check(i.signal)}catch(A0){z0=Promise.reject(A0)}let G$=z0.then((A0)=>({kind:"completed",result:A0}),(A0)=>({kind:"failed",error:A0})),i$;try{while(!0){let A0=await xQ(G$,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(A0.kind==="failed")throw new d3(A0.error);if(A0.kind==="completed"){i$=A0.result;break}try{let E0=o(),D1=await Y1($,"heartbeat",()=>$.client.heartbeat($.state,E0,N.signal).catch((Y2)=>M$(E0,Y2)));if(!D1)continue;v=D1,H$(E0),j1(v),X$=0}catch(E0){if($.signal.aborted)throw E0;if(!w2(E0))throw E0;if(X$+=1,X$>=E$&&!L())throw E0}}}catch(A0){i.abort(A0);let E0=await G$;if(E0.kind==="completed"&&E0.result==="activated")i$="activated";else throw A0}finally{$.signal.removeEventListener("abort",K0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,i$==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+u3(K.intervalMs??zQ,B)}catch(i){if(!(i instanceof d3))throw i;T+=1;let K0=K.retryBaseMs??AQ,z0=K.retryMaxMs??RQ,G$=Math.min(z0,K0*2**Math.min(T-1,8));R=J().getTime()+u3(G$,B)}if($.signal.aborted)break;if(_&&W())break;if(_){await T$($.heartbeatIntervalMs??15000);continue}let Y$=$.client.sessionCadence?.($.state)??null,S$=Y$?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await T$(S$);continue}if(F()>=M){let i=new AbortController;z=i;try{await Z(S$,AbortSignal.any([$.signal,i.signal]))}catch(K0){if(!i.signal.aborted)throw K0}finally{if(z===i)z=null}continue}let h0,W1=Y$?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),f=performance.now();try{h0=await Y1($,"claim",()=>$.client.claimOperation($.state,{waitMs:W1,signal:N.signal}))}catch(i){if($.signal.aborted||!w2(i)||!L())throw i;await T$(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(j)throw j;if(!h0){if(performance.now()-f<W1-MQ)await T$(HQ);continue}if($.claimable?.()===!1){await s3($,h0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:h0.operation_id,runId:h0.run_id,attemptId:h0.attempt_id,capability:h0.capability});let a,q0={authorized:()=>!1,claim:h0};if(a=kQ({...$,signal:N.signal},h0,Z,q0,D).catch((i)=>{if(P0(i))D(i);else if(!s0(i)&&[...O].some(([K0,z0])=>K0!==a&&z0.authorized())){if(i instanceof g1)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!s0(i)&&j===null)j=i}).finally(()=>{O.delete(a),z?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:O.size})}),O.set(a,q0),$.onEvent?.({type:"claims_changed",activeClaims:O.size}),d8(h0)){if(await a,j)throw j}}}catch(v){if(!p3(v,$.signal)){N.abort(v),Q$=!0;let X0=$.state.worker?"worker_connection_failed":l3(v);throw X({...n(),state:"error",error:X0},Q),$.onEvent?.({type:"error",message:X0}),v}}finally{if(N.abort(),await Promise.allSettled(O.keys()),$.signal.removeEventListener("abort",H),!Q$)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as qX}from"child_process";import{constants as M5,existsSync as HX,mkdtempSync as R5,rmSync as MX}from"fs";import{access as T5,open as TX,readFile as _5,readlink as _X,readdir as F5,unlink as FX,rmdir as LX}from"fs/promises";import{basename as X9,join as G9}from"path";import{randomUUID as h$}from"crypto";import{chmodSync as fQ,closeSync as hQ,fsyncSync as mQ,openSync as vQ,readFileSync as gQ,rmdirSync as l8,unlinkSync as s8,writeFileSync as uQ}from"fs";import{createConnection as dQ,createServer as lQ}from"net";import{dirname as pQ,join as cQ}from"path";var sQ=5000;async function a8($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:h$()},X={runId:h$(),deviceId:h$(),rootId:h$(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=c8(J,X),G={version:1,snapshot_id:h$(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{s8(Y.path)}catch{}}}async function i8($,J,Z=p8){if(J.aborted)return!1;let Q,X,Y=new Set,G=h$(),V=lQ((q)=>{Y.add(q),q.once("close",()=>Y.delete(q)),q.on("error",()=>q.destroy()),q.end(G)});V.maxConnections=1;let K,N,H=new Promise((q)=>{N=()=>q(!1)}),B=setTimeout(N,sQ);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${h$()}`}),X=cQ(Q.journalDirectory,"readiness.json");let q=vQ(X,"wx",384);try{uQ(q,G),mQ(q)}finally{hQ(q)}if(gQ(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{fQ(Q.socketPath,384)}catch{T(!1);return}K=dQ(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(j)=>{if(_+=j,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,H])&&!J.aborted}catch{return!1}finally{clearTimeout(B),J.removeEventListener("abort",N),K?.destroy();for(let q of Y)q.destroy();if(await new Promise((q)=>V.close(()=>q())),Q?.disposeSocket(),X)try{s8(X)}catch{}if(Q){try{l8(Q.journalDirectory)}catch{}try{l8(pQ(Q.journalDirectory))}catch{}}}}import{spawn as aQ}from"child_process";import{randomUUID as m$}from"crypto";import{basename as iQ}from"path";import{fileURLToPath as nQ}from"url";function rQ(){let $=iQ(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",nQ(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function t8($,J,Z=rQ()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=aQ(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>G.once("close",()=>{V=!0,F()}));G.on("error",X);let N,H,B=new Promise((F)=>{N=F}),q=new Promise((F)=>{H=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,j=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
+`)}}return!0},F=null,z=async()=>{let L=!1;do K=!1,L=await O().catch(()=>!1);while(K&&!X.aborted);let W=JSON.stringify({version:1,...N});if(F!==W)try{e(N$(J),!0),c(b3(J),JSON.parse(W)),F=W}catch{}return L};return{check(){if(V)K=!0;else V=z().finally(()=>{V=null});return V},claims:()=>[...G.values()].reduce((L,W)=>L+W.claims,0),async settled(){await V,await Promise.all([...G.values()].map((L)=>L.done))}}}import{dirname as wZ}from"path";import{randomUUID as e$}from"crypto";import{chmodSync as w4,closeSync as $1,constants as J1,existsSync as qZ,fstatSync as k4,lstatSync as y4,mkdirSync as f4,openSync as h4,readFileSync as m4,readdirSync as v4,readlinkSync as XV,realpathSync as YV,renameSync as Z1,rmSync as w3,statSync as g4,symlinkSync as GV,unlinkSync as b1,writeFileSync as k3}from"fs";import{basename as BV,dirname as u4,isAbsolute as HZ,join as W0,relative as UV,resolve as VV,sep as NV}from"path";import{createRequire as MZ}from"module";var d4=1,l4=1,TZ=128,_Z=65536;var FZ=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var x4=/^[a-z0-9_.-]{1,80}$/,LZ=64;var jZ=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function p4($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function c4($,J,Z=[]){let Q=new Set([...J,...Z]);return J.every((X)=>(X in $))&&Object.keys($).every((X)=>Q.has(X))}function j2($){return typeof $==="string"&&FZ.test($)}function s4($){return typeof $==="string"&&!Number.isNaN(Date.parse($))&&new Date($).toISOString()===$}function f3($){f4($,{recursive:!0,mode:448}),w4($,448)}function WZ($,J){f3(u4($));let Z=`${$}.${process.pid}.${e$()}.tmp`;try{k3(Z,J,{mode:384,flag:"wx"}),w4(Z,384),Z1(Z,$)}finally{if(qZ(Z))b1(Z)}}function W2($={}){if(($.platform??process.platform)!=="darwin")throw new w1("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let Z=$.environment??process.env,Q=O$(Z,"REASON_CLI_CHANNEL")==="staging",X=Q?O$(Z,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,G=$.root!==void 0||Boolean(X&&HZ(X))?null:W0($.home??U0(),"Library","Application Support"),V=$.root??(G?W0(G,Q?"Reason Staging":"Reason","CLI"):X);return{executableName:"reason",root:V,...G?{legacyRoot:W0(G,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:W0(V,"versions"),current:W0(V,"current"),previous:W0(V,"previous"),brokerLock:W0(V,"broker.lock"),transitionLock:W0(V,"transition.lock"),lifecycleEvents:W0(V,"lifecycle-events")}}function DZ($){return p4($)&&c4($,["schema_version","pid","nonce","started_at","runtime_version"])&&$.schema_version===d4&&typeof $.pid==="number"&&Number.isSafeInteger($.pid)&&$.pid>0&&typeof $.nonce==="string"&&/^[0-9a-f-]{36}$/.test($.nonce)&&s4($.started_at)&&j2($.runtime_version)}function a4($,J){try{let Z=y4($);if(!Z.isDirectory()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0)return null;let Q=h4(W0($,J),J1.O_RDONLY|J1.O_NOFOLLOW|J1.O_NONBLOCK);try{let X=k4(Q);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>4096)return null;return m4(Q,"utf8")}finally{$1(Q)}}catch{return null}}function y3($){try{let J=JSON.parse(a4($,"owner.json")??"null");return DZ(J)?J:null}catch{return null}}function i4($){try{return process.kill($,0),!0}catch(J){return!(J instanceof Error&&("code"in J)&&J.code==="ESRCH")}}var S4="lease",OZ=2,zZ=4,S1;function AZ(){if(S1!==void 0)return S1;if(S1=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let $;try{$=MZ(import.meta.url)("bun:ffi")}catch{return null}let J=process.platform==="darwin"?"__error":"__errno_location",Z=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of Z)try{let X=$.dlopen(Q,{flock:{args:[$.FFIType.i32,$.FFIType.i32],returns:$.FFIType.i32},[J]:{args:[],returns:$.FFIType.ptr}}),Y=X.symbols[J]();if(Y===null)continue;return S1={flock:(G,V)=>X.symbols.flock(G,V),errno:()=>$.read.i32(Y),wouldBlock:process.platform==="darwin"?35:11},S1}catch{}return null}function RZ($){let J=AZ();if(!J)return null;let Z=h4(`${$}.lease`,J1.O_RDWR|J1.O_CREAT|J1.O_NOFOLLOW,384);try{let Q=k4(Z);if(!Q.isFile()||Q.nlink!==1||Q.uid!==process.getuid?.()||(Q.mode&63)!==0)return $1(Z),"busy";if(J.flock(Z,OZ|zZ)===0)return Z;let X=J.errno();return $1(Z),X===J.wouldBlock?"busy":null}catch(Q){throw $1(Z),Q}}function $$($){f3(u4($.path));let J=RZ($.path);if(J==="busy")return{acquired:!1,owner:y3($.path),recoveredStaleOwner:!1};let Z=J!==null;try{let Q=IZ($,J);if(Q.acquired)Z=!1;return Q}finally{if(Z)$1(J)}}function IZ($,J){let Z=$.alive??i4,Q=!1;for(let X=0;X<4;X+=1){let Y={schema_version:d4,pid:$.pid??process.pid,nonce:$.nonce?.()??e$(),started_at:($.now?.()??new Date).toISOString(),runtime_version:$.runtimeVersion},G=`${$.path}.init-${process.pid}-${e$()}`,V=!1;try{if(f4(G,{mode:448}),k3(W0(G,"owner.json"),`${JSON.stringify(Y)}
+`,{mode:384,flag:"wx"}),J!==null)k3(W0(G,S4),`flock
+`,{mode:384,flag:"wx"});$.beforePublish?.();try{throw y4($.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch(N){if(N.code!=="ENOENT")throw N}Z1(G,$.path),V=!0;let K=!1;return{acquired:!0,owner:Y,recoveredStaleOwner:Q,release(){if(K)return;if(K=!0,y3($.path)?.nonce===Y.nonce)w3($.path,{recursive:!0,force:!0});if(J!==null)$1(J)}}}catch(K){let N=K.code;if(!["EEXIST","ENOTEMPTY"].includes(N??""))throw K;let H=y3($.path),B=($.now?.()??new Date).getTime(),q=H&&$.staleAfterMs!==void 0?B-Date.parse(H.started_at)<$.staleAfterMs:!1,M=H!==null&&!(J!==null&&a4($.path,S4)!==null)&&Z(H.pid);if(!H||M||q)return{acquired:!1,owner:H,recoveredStaleOwner:!1};let T=`${$.path}.stale-${process.pid}-${e$()}`;try{Z1($.path,T),w3(T,{recursive:!0,force:!0}),Q=!0}catch(_){let j=_.code;if(!["ENOENT","EEXIST"].includes(j??""))throw _}}finally{if(!V)w3(G,{recursive:!0,force:!0})}}throw new w1("lock_unavailable","Could not acquire the managed Reason runtime lock.")}function n4($){return p4($)&&c4($,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&$.schema_version===l4&&typeof $.event_id==="string"&&/^[0-9a-f-]{36}$/.test($.event_id)&&s4($.occurred_at)&&typeof $.event==="string"&&jZ.includes($.event)&&j2($.runtime_version)&&($.from_version===void 0||j2($.from_version))&&($.to_version===void 0||j2($.to_version))&&($.reason_code===void 0||typeof $.reason_code==="string"&&x4.test($.reason_code))&&($.duration_ms===void 0||typeof $.duration_ms==="number"&&Number.isSafeInteger($.duration_ms)&&$.duration_ms>=0&&$.duration_ms<=86400000)&&($.attempt_count===void 0||typeof $.attempt_count==="number"&&Number.isSafeInteger($.attempt_count)&&$.attempt_count>=1&&$.attempt_count<=1e5)&&($.retry_in_ms===void 0||typeof $.retry_in_ms==="number"&&Number.isSafeInteger($.retry_in_ms)&&$.retry_in_ms>=0&&$.retry_in_ms<=30000)&&($.capabilities===void 0||Array.isArray($.capabilities)&&$.capabilities.length<=LZ&&$.capabilities.every((J)=>typeof J==="string"&&x4.test(J)))}var CZ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,PZ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,EZ=300000,L2=0n;function xZ($){let J=BigInt(new Date($.occurred_at).getTime())*1000000n;return L2=J>L2?J:L2+1n,`${String(L2).padStart(22,"0")}-${$.event_id}.json`}function r4($){try{return v4($.lifecycleEvents).filter((J)=>CZ.test(J)).sort()}catch{return[]}}function b4($){try{let J=JSON.parse(m4($,"utf8"));return n4(J)?J:null}catch{return null}}function SZ($,J=i4,Z=Date.now()){let Q;try{Q=v4($.lifecycleEvents)}catch{return}for(let X of Q){let Y=X.match(PZ);if(!Y)continue;let G=W0($.lifecycleEvents,X),V=W0($.lifecycleEvents,Y[1]),K=!J(Number(Y[2]));if(!K)try{K=Z-g4(G).mtimeMs>=EZ}catch{continue}if(!K)continue;try{Z1(G,V)}catch(N){let H=N.code;if(H==="EEXIST")b1(G);else if(H!=="ENOENT")throw N}}}function bZ($){let Z=r4($).flatMap((X)=>{try{return[{name:X,size:g4(W0($.lifecycleEvents,X)).size}]}catch{return[]}}),Q=Z.reduce((X,Y)=>X+Y.size,0);while(Z.length>TZ||Q>_Z){let X=Z.shift();if(!X)break;try{b1(W0($.lifecycleEvents,X.name)),Q-=X.size}catch(Y){if(Y.code!=="ENOENT")throw Y}}}function k1($,J,Z={}){let Q={schema_version:l4,event_id:Z.eventId?.()??e$(),occurred_at:(Z.now?.()??new Date).toISOString(),...J};if(!n4(Q))throw new w1("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return f3($.lifecycleEvents),WZ(W0($.lifecycleEvents,xZ(Q)),`${JSON.stringify(Q)}
+`),bZ($),Q}async function t4($,J,Z){SZ($);let Q=0;for(let X of r4($)){let Y=W0($.lifecycleEvents,X);if(Z){let K=b4(Y);if(!K||!Z(K))continue}let G=`${Y}.sending-${process.pid}-${e$()}`;try{Z1(Y,G)}catch(K){if(K.code==="ENOENT")continue;throw K}let V=b4(G);if(!V){b1(G);continue}try{await J(V),b1(G),Q+=1}catch{try{Z1(G,Y)}catch(K){if(K.code!=="ENOENT")throw K}break}}return Q}function $8($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!kZ($.saved))return J;let Z=$.saved,Q=(G,V)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:G,...V?{code:`worker_api_origin_move_${G}:${V}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?Q1():$.native;if(!X)return J;let Y=[];try{let G=X.lock(wZ($.configPath));if(!G)return J;if(Y.push(G),u(g(Z))){let H=$$({path:d(Z).lock,runtimeVersion:t});if(!H.acquired)return J;Y.push(()=>H.release())}let V=J0.parse(JSON.parse(s($.configPath)));if(V.stateDirectory!==Z.stateDirectory)return J;let K=J8(V),N={saved:V,configPath:$.configPath};if(!D2(V)&&K.length===0)return Q("unchanged"),N;if(D2(V)){let H=o4(V);c($.configPath,H),N={saved:H,configPath:$.configPath}}for(let H of K)try{c(H.configPath,o4(H.config))}catch(B){Q("failed",`workspace:${e4(B)}`)}return Q("moved"),N}catch(G){return Q("failed",e4(G)),J}finally{for(let G of Y.reverse())G()}}function D2($){return z$($.apiOrigin)!==$.apiOrigin}function J8($){return y0($).filter((J)=>J.config!==null&&D2(J.config))}function kZ($){return D2($)||J8($).length>0}function o4($){let J=J0.parse({...$,apiOrigin:z$($.apiOrigin)}),Z=o($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=N0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)f0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function e4($){if($ instanceof G0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as yZ,lstatSync as v3,readdirSync as K8,readlinkSync as fZ,unlinkSync as hZ}from"fs";import{join as D0,sep as mZ}from"path";var O2="rehome.json";class z2 extends Error{code;constructor($){super($);this.code=$}}function B8($){let J={saved:$.saved,configPath:$.configPath},Z=D0($.home,".config"),Q=D0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=D0(Q,...X),G=D0(Z,"reason",...X),V=(B,q)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:B,...q?{code:`worker_state_rehome_${B}:${q}`}:{},timestamp:new Date().toISOString()})),K=$.native===void 0?Q1():$.native,N=$.saved,H=[];try{if(N&&Q8(Q)&&N.stateDirectory===Y){let D={...N,stateDirectory:G};if(!h3(K,G,D,H))return J;return Z8(N,D,$.host,V)}if(N&&Q8(Q)&&N.stateDirectory===G&&V4(N)&&h3(K,G,N,H))return U8({...N,stateDirectory:Y},N,$.host),J;if(!N||N.lifetime!=="persistent"||N.stateDirectory!==Y||!X1(Q)?.isDirectory())return J;if(pZ(Y)===t)return J;let q=(D,O=!0)=>{if(O)c(D0(Y,O2),{version:t});return V("skipped",D),J},M=[Y];for(let D of gZ(Q,Y)){if(D.config?.lifetime!=="ephemeral")return q("several_connections");if(!vZ(D.directory,D.config,H))return q("once_running",!1);M.push(D.directory)}if(!K)return q("config_rename_unavailable:no_native");if(!h3(K,Y,N,H))return J;let T=o(N);if(!T||$0(N).revoked)return J;if(X8(Z)!==null)return q("conflicting_identity");if(Y8(Z)!==null)return q("conflicting_files");if(X1(G)&&(!X1(G).isDirectory()||K8(G).length>0))return q("connection_folder_taken");I1(N,T.devicePublicKey),S3.before(N);let _=l0(Y);if(_&&m3(Y))uZ(G,_);let j=A2(Z,K,M);if(j.state!=="renamed"&&j.state!=="linked"){if(_&&m3(Y))V8(G);return q(j.problem??"config_folder_kept")}return Z8(N,{...N,stateDirectory:G},$.host,V)}catch(B){try{if(X1(Y)?.isDirectory())c(D0(Y,O2),{version:t})}catch{}return V("failed",cZ(B)),lZ(N,Y,G,J)}finally{for(let B of H.reverse())B()}}function Z8($,J,Z,Q){let X=v3(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)yZ(J.stateDirectory,448);let Y=T0(J),G=k$(d(J).state,{proofStore:Y,repair:!1});if(!G?.worker)throw new z2("identity_missing");let V=N0(J);if(G.worker.configDigest===N0($))f0({...G,worker:{...G.worker,configDigest:V}},d(J).state,{proofStore:Y});else if(G.worker.configDigest!==V)throw new z2("worker_config_binding_mismatch");c(D0(J.stateDirectory,"worker.json"),J),S3.after($,J),U8($,J,Z);let K=D0(J.stateDirectory,O2);if(u(K))hZ(K);return Q("moved"),{saved:J,configPath:D0(J.stateDirectory,"worker.json")}}function U8($,J,Z){if(G8($,J,Z,"connect"),!m3(J.stateDirectory))return;let Q=dZ(L$($.stateDirectory));if(!Q)return;let X=L$(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);V8($.stateDirectory)}function h3($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=$$({path:d(Z).lock,runtimeVersion:t});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function vZ($,J,Z){if(u(g(J))){let X=$$({path:d(J).lock,runtimeVersion:t});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=X1(D0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function gZ($,J){let Z=[$,...K8($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>D0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let G=D0(X,Y);if(G===J||!X1(D0(G,"worker.json")))continue;let V=N8(G);if(!V||V.stateDirectory===$||V.stateDirectory.startsWith($+mZ))Q.push({directory:G,config:V})}return Q}function m3($){try{return JSON.parse(s(D0($,"api-key.json"))).store==="keychain"}catch{return!1}}function uZ($,J){let Z=L$($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function V8($){try{L$($).deleteBinding()}catch(J){if(!(J instanceof G0))throw J}}function dZ($){try{return $.loadBinding()}catch(J){if(J instanceof G0)return null;throw J}}function lZ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=N8(Z);return X?.stateDirectory===Z?{saved:X,configPath:D0(Z,"worker.json")}:Q}function Q8($){try{return v3($).isSymbolicLink()&&fZ($)==="reason"}catch{return!1}}function pZ($){try{let J=JSON.parse(s(D0($,O2)));return typeof J.version==="string"?J.version:null}catch{return null}}function N8($){try{let J=D0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function X1($){try{return v3($)}catch{return null}}function cZ($){if($ instanceof z2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof G0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as sZ}from"fs";function R2($){try{let J=JSON.parse(sZ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function q8($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as bK}from"crypto";import{readdirSync as wK,realpathSync as p6,statSync as kK}from"fs";import{hostname as yK}from"os";import{join as a$,resolve as fK}from"path";var I2="cloud",aZ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function y1($){return aZ.test($)&&!H8.test($)}var iZ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Y1($){return iZ[$]}import{chmodSync as nZ,lstatSync as P2,mkdtempSync as rZ,realpathSync as F8,rmdirSync as tZ,rmSync as oZ,unlinkSync as eZ}from"fs";import{createConnection as $Q,createServer as JQ}from"net";import{basename as M8,dirname as T8,join as h$}from"path";var ZQ=U.enum(["status","drain","resume","stop","reload_roots"]),QQ=U.strictObject({version:U.literal(1),instanceId:U.string(),deviceId:U.string(),phase:U.enum(["starting","running","reconnecting","stopping"]),drained:U.boolean(),activeClaims:U.number().int().nonnegative(),activeSessions:U.number().int().nonnegative().optional(),executionEligible:U.boolean(),supportedOperations:U.array(U.enum(C2)).max(C2.length).optional(),capabilityReadiness:U.partialRecord(U.enum(C2),U.boolean()).optional(),lastHeartbeat:U.string().nullable(),expiresAt:U.string()}),XQ=U.strictObject({nonce:U.string(),action:ZQ}),YQ=U.object({nonce:U.uuid()}),L8=U.strictObject({version:U.literal(1),nonce:U.uuid(),socketPath:U.string().max(100)});function j8($){return h$(d($).lock,"control.json")}function E2($){return e(d($).lock),YQ.parse(JSON.parse(s(h$(d($).lock,"owner.json"))))}function _8($){if(!u($))return!1;let J=P2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function W8($,J){let Z=j8($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!P2(Y).isSocket())return null;return _8(Y)?Y:null}let Q=L8.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=T8(Q.socketPath);if(T8(X)!==F8("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(M8(X))||M8(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),_8(Q.socketPath)?Q.socketPath:null}async function x2($,J,Z){if(E2($).nonce!==J)throw Error("worker_instance_changed");let Q=j8($);if(u(Q))throw Error("worker_control_already_serving");let X=rZ(h$(F8("/tmp"),"ara-worker-")),Y=h$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let G=new Set,V=JQ((B)=>{G.add(B),B.once("close",()=>G.delete(B)),B.setTimeout(2000,()=>B.destroy());let q="",M=!1;B.on("error",()=>B.destroy()),B.on("data",(T)=>{if(M)return;if(q+=T.toString(),Buffer.byteLength(q)>4096){B.destroy();return}if(!q.includes(`
+`))return;M=!0;try{let _=XQ.parse(JSON.parse(q));if(_.nonce!==J){B.destroy();return}B.end(JSON.stringify(Z(_.action))+`
+`)}catch{B.destroy()}})});V.maxConnections=32;let K,N=!1,H=async()=>{if(N)return;N=!0;for(let B of G)B.destroy();if(await new Promise((B)=>V.close(()=>B())),K&&u(Q)){let B=P2(Q);if(B.isFile()&&B.dev===K.dev&&B.ino===K.ino)try{let q=L8.parse(JSON.parse(s(Q)));if(q.nonce===J&&q.socketPath===Y)eZ(Q)}catch{}}try{tZ(X)}catch{}};try{if(await new Promise((B,q)=>{V.once("error",q),V.listen(Y,()=>{nZ(Y,384),B()})}),E2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),K=P2(Q),H}catch(B){throw await H(),B}}function D8($,J){try{let Z=JSON.parse(s(h$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function f1($){return D8($,"runtime_version")}function GQ($){return D8($,"nonce")}function O8($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(h$(d($).lock,"owner.json")))return"no_lock";return W8($,E2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var KQ=21600000,BQ=U.strictObject({instance:U.string().nullable(),since:U.number().int().nonnegative()});function UQ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=BQ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;g3($)}catch{}return null}function g3($){try{oZ(d($).updateDeferral,{force:!0})}catch{}}async function S2($,J,Z=()=>!1){let Q=GQ($),X=UQ($,Q);if(J!==void 0){let N=f1($);if(N===null||N===J&&X===null&&!Z())return{state:"current"}}let Y;try{let N=await V0($,"status");Y=N?N.activeSessions??N.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let G=Date.now(),V=X;if(V===null){V=G;try{c(d($).updateDeferral,{instance:Q,since:V})}catch{}}let K=G-V;return{state:K<KQ?"busy":"drained",sessions:Y,waitedMs:K}}async function V0($,J){let Z=d($);if(!u(h$(Z.lock,"owner.json")))return null;let Q=E2($),X=W8($,Q.nonce);if(!X)return null;return new Promise((Y,G)=>{let V=$Q(X),K="",N=!1,H=(B,q)=>{if(N)return;if(N=!0,V.destroy(),q)G(q);else Y(B)};V.setTimeout(2000,()=>V.destroy(Error("worker_control_timeout"))),V.on("connect",()=>V.write(JSON.stringify({nonce:Q.nonce,action:J})+`
+`)),V.on("data",(B)=>{if(K+=B.toString(),Buffer.byteLength(K)>16384)V.destroy(Error("worker_control_oversize"))}),V.on("error",(B)=>{if("code"in B&&["ECONNREFUSED","ENOENT"].includes(String(B.code)))H(null);else H(null,B.message==="worker_control_timeout"?B:Error("worker_control_unavailable"))}),V.on("end",()=>{try{let B=QQ.parse(JSON.parse(K));if(B.instanceId!==Q.nonce)throw Error("worker_instance_changed");H(B)}catch{H(null,Error("worker_control_invalid_response"))}}),V.once("close",()=>H(null,Error("worker_control_unavailable")))})}import{randomUUID as MG}from"crypto";import{homedir as lJ}from"os";import{spawn as VQ}from"child_process";async function z8($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,G=Promise.resolve(),V=(B)=>{if(Q===B)return;Q=B,J.onStatusChange?.(B)},K=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,G=N()},J.retryMs??5000),Y.unref()},N=async()=>{try{let B=(J.spawn??VQ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=B,B.once("exit",()=>{if(!X&&Z===B)V("failed"),K()}),await new Promise((q,M)=>{B.once("spawn",q),B.once("error",M)}),B.exitCode===null&&B.signalCode===null)V("held")}catch{V("failed"),K()}};G=N(),await G;let H;return{get status(){return Q},release(){return H??=(async()=>{X=!0,clearTimeout(Y),await G;let B=Z;if(!B||B.exitCode!==null||B.signalCode!==null||!B.pid)return Q="failed","released";let q=await new Promise((M)=>{let T,_=setTimeout(()=>{try{B.kill("SIGKILL")}catch{}T=setTimeout(()=>M("failed"),1000)},1000);B.once("exit",()=>{clearTimeout(_),clearTimeout(T),M("released")});try{B.kill("SIGTERM")}catch{}});if(q==="released")Q="failed";return q})()}}}class G1 extends Error{constructor(){super("Reason Device operation lease expired.")}}class b2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new G1;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new G1;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new G1)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as TQ}from"fs";import{randomUUID as _Q}from"crypto";import{constants as u3}from"fs";import{open as NQ}from"fs/promises";import{join as qQ}from"path";var HQ={platform:process.platform,home:U0,async openFile($){let J=await NQ($,u3.O_RDONLY|u3.O_NOFOLLOW|u3.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function A8($=HQ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(qQ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class d3 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function MQ($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,G=new Promise((V,K)=>{X=()=>{Q.abort(J.reason),K(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let N=new d3;Q.abort(N),K(N)},Z)});try{return await Promise.race([$(Q.signal),G])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function R8($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await MQ($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof d3||(X instanceof _0?h1(X.status):m1(X));if(Y){let G=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+G}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function o3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}function d8($,J,Z){let Q=$?.permissionRecovery;return k2(Q,Z)&&Q.deviceId===J.deviceId&&Q.organizationId===J.orgId?{permissionRecovery:Q}:{}}var FQ=1000,LQ=250,jQ=u8(TQ(process.execPath)),I8=null,C8=null;function l8($){if(process.platform!=="darwin")return{};return C8??=A8().then((J)=>{I8={status:J,checkedAt:$().getTime()}}).finally(()=>{C8=null}),{fullDiskAccess:{...I8??{status:"unknown",checkedAt:$().getTime()},executablePath:jQ}}}var WQ=8,DQ=64,OQ=2000,zQ=2000,e3=8000,P8=3,AQ=250,E8=1000,x8=30000,RQ=0.2,IQ=30000,CQ=21600000,PQ=300000,EQ=3600000,xQ=0.1,p8=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function SQ($){return Math.min(P8,Math.max(1,$??P8))}function bQ($){return typeof $.reason_code==="string"&&p8.has($.reason_code)?$.reason_code:"cancelled"}function l3($){return $.reason instanceof h0&&($.reason.code==="cancelled"||p8.has($.reason.code))?$.reason.code:"cancelled"}function S8($){return $ instanceof h0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function c8($){return $.capability==="hands.connect"&&(m8($.payload)||h8($.payload))}function p3($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*xQ)))}function wQ($,J=Math.random){let Z=Math.min(x8,E8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*RQ*(Q*2-1);return Math.min(x8,Math.max(E8,Math.round(Z+X)))}function $9($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class c3 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function kQ($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function s3($){return $ instanceof Error?$.message:String($)}function a3($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function n0($){return $ instanceof _0&&$.status===409&&$.code==="attempt_fenced"}function i3($){return $.capability==="environment.install"}function yQ($){if($ instanceof h2||$ instanceof G1||$ instanceof g1)return"timeout";if(!($ instanceof Error)||$ instanceof _0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof _0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function v1($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(n0(Z))return;let Q=Z instanceof _0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:yQ(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function K1($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)v1($,J,Q);throw Q}}class g1 extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function n3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":k8(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:i3(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,G=Q?AbortSignal.any([Q,Y.signal]):Y.signal,V=$.sleep??$9,K=$.operationCompletionTimeoutMs??e3,N=performance.now()+K,H,B,q=new Promise((_,j)=>{let D=()=>{let F=new g1;Y.abort(F),j(F)},O=(F)=>{clearTimeout(H),H=setTimeout(D,F)};if(B=()=>O(Math.max(0,Math.min(N-performance.now(),OQ))),O(K),$.signal.addEventListener("abort",B,{once:!0}),$.signal.aborted)B()}),M,T=0;try{while(!0)try{M=await Promise.race([$.client.completeOperation($.state,J,X,G),q]);break}catch(_){if(G.aborted||$.signal.aborted||P0(_)||n0(_)||!fQ(_)||performance.now()>=N)throw v1($,"completion",_),_;T+=1;let j=Math.min(500*2**Math.min(T-1,4),Math.max(0,N-performance.now()));if(j<=0)throw v1($,"completion",_),_;try{await V(j,G)}catch{throw v1($,"completion",_),_}}}finally{clearTimeout(H),$.signal.removeEventListener("abort",B),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:M.status})}function fQ($){if(P0($))return!1;if(n0($))return!1;if($ instanceof _0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof g1)return!1;return!0}return!1}class h2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function w2($){if($ instanceof h2)return!0;return $ instanceof _0?h1($.status):m1($)}function r3($,J){if(!($ instanceof _0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function hQ($,J,Z,Q,X){let Y=new AbortController,G,V=()=>{return},K=new Promise((H,B)=>{let q=()=>{let M=Q.reason??new DOMException("Aborted","AbortError");Y.abort(M),B(M)};if(V=()=>Q.removeEventListener("abort",q),Q.aborted)q();else Q.addEventListener("abort",q,{once:!0})}),N=new Promise((H,B)=>{G=setTimeout(()=>{let q=new h2;Y.abort(q),B(q)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),K,N])}finally{if(G!==void 0)clearTimeout(G);V()}}async function b8($,J,Z,Q,X,Y){let G=SQ($.operationHeartbeatMaxAttempts),V=$.operationHeartbeatAttemptTimeoutMs??e3,K=$.operationHeartbeatRetryDelayMs??AQ,N=Y.remainingMs(),H=Math.min(N,G*V+K*G*(G-1)/2);for(let B=0;B<G;B+=1)try{Q.throwIfAborted(),Y.assertCurrent();let q=Math.min(V,Y.remainingMs()),M=await hQ($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(q-1000))),clientRetryCount:B},Q,q);return Q.throwIfAborted(),Y.acknowledge(M.lease_until),M}catch(q){if(Q.aborted||B+1>=G||n0(q)||P0(q)||!w2(q)){if(!Q.aborted)v1($,"operation_heartbeat",q);throw q}let M=N-Y.remainingMs(),T=r3(q,($.now?.()??new Date).getTime()),_=Math.max(K*(B+1),H*(B+1)/G-M,T);await X(Math.min(Y.remainingMs(),_),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function mQ($,J,Z,Q,X){let Y=c8(J),G=new AbortController,V=new AbortController,K=()=>{G.abort($.signal.reason),V.abort($.signal.reason)};if($.signal.aborted)K();else $.signal.addEventListener("abort",K,{once:!0});let N=null,H,B,q=-1,M=0,T=Promise.resolve(),_=[],j=new AbortController,D=!1,O,F=null,z=!1,L,W,R={},E=(S)=>{D=!0,j.abort(S),G.abort(S),V.abort(S)},I=(S)=>{if(O)return O;let y=structuredClone(S),l=M;return O=(async()=>{let w=new AbortController,P=w.signal;P.throwIfAborted();let x,A=()=>{},k=new Promise((b,n)=>{if(A=()=>n(P.reason),P.addEventListener("abort",A,{once:!0}),x=setTimeout(()=>w.abort(Error("Hands stop receipt delivery timed out.")),4000),P.aborted)A()});try{for(let b=0;b<3;b+=1){P.throwIfAborted();try{let n=await Promise.race([K1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[y],signal:P,transientRetryOwner:"caller"})),k]);if(P.throwIfAborted(),n.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");M=n.next_event_seq;return}catch(n){if(P0(n))X(n);let r=n instanceof _0?h1(n.status):m1(n);if(P.aborted||!r||b===2)throw n;let X0=Math.max(500*2**b,r3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(X0,P),k])}}}finally{clearTimeout(x),P.removeEventListener("abort",A),w.abort()}})(),O},C=(S,y,l)=>{let w=(x)=>K1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:y,events:S,signal:x,...l?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&n0(A))E(A);if(l&&(P0(A)||n0(A))){if(P0(A))X(A);G.abort(A),V.abort(A),j.abort(A)}throw A});if(!l)return async(x)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){M=(await w(x)).next_event_seq;return}x.throwIfAborted();let A=()=>{},k=new Promise((b,n)=>{A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([w(x),k]);x.throwIfAborted(),M=b.next_event_seq}finally{x.removeEventListener("abort",A)}};let P=R8({send:w,lease:W,sleep:Z,retryAfterMs:(x)=>r3(x,($.now?.()??new Date).getTime())});return async(x)=>{let A=await P(x);if(A.next_event_seq!==y+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");M=A.next_event_seq}},h=async(S,y)=>{let l=S??await b8($,J,{controlAckSeq:q,waitMs:y},V.signal,Z,W),w=null,P=!1;for(let x=0;x<10;x+=1){let A=q+1;for(let k of l.controls){if(k.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(k.kind==="cancel"||k.kind==="operation.cancel")w??=bQ(k.payload),G.abort(new h0(w,"Reason closed the Device operation."));if(k.kind!=="cancel"&&k.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,r=new Promise((X0,M0)=>{b=X0,n=M0});r.catch(()=>{}),R.current={promise:r,resolve:b,reject:n}}try{P||=!await $.onControl?.(J,k)}catch(b){if(b instanceof h0)H??=S8(b);throw R.current?.reject(b),b}}q=k.seq,A+=1}if(l.controls.length===0){if(l.next_control_seq!==q+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:w,unsupported:P}}try{l=await b8($,J,{controlAckSeq:q},V.signal,Z,W),R.current?.resolve()}catch(k){if(R.current?.reject(k),!w||n0(k)||P0(k))throw k;return{cancellationReason:w,unsupported:P}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)W=new b2(J.lease_until,()=>($.now?.()??new Date).getTime(),(y)=>{if(!G.signal.aborted)N=y;G.abort(y),V.abort(y)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||t3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await h()}catch(y){if(!i3(J)||n0(y)||P0(y))throw y;await n3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let y=S.cancellationReason??l3($.signal);G.abort(new h0(y,"Reason closed the Device operation.")),B={status:"cancelled",error_code:y}}else if(S.unsupported)G.abort(),B={status:"failed",error_code:"control_unsupported"};else{let y=Y?Promise.resolve():(async()=>{let w=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?zQ:15000),P=Math.min(w,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??e3)-1000)),x=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!V.signal.aborted)try{if(!x){if(await Z(w,V.signal),V.signal.aborted)return}let A=await h(void 0,x?P:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)N=Error("Reason requested an unsupported Device operation control.");G.abort(A.cancellationReason?new h0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(P0(A))X(A);if(n0(A))N=A,E(A);if(!V.signal.aborted)N=A,G.abort();return}})();try{if(W?.assertCurrent(),G.signal.throwIfAborted(),Q.authorized=()=>!G.signal.aborted&&(Y||(W?.remainingMs()??0)>0),B=await $.onClaim(J,G.signal,async(w)=>{if(i3(J))return;if(w.kind==="permission.denied"){if(!Q.authorized())return;let r=w.data,X0=($.now??(()=>new Date))().getTime(),M0=$.statusPath??y2(),d0=($.loadStatus??o$)(M0),E0={id:_Q(),kind:"permission_denied",operation:r?.operation,provenance:r?.provenance,occurredAt:new Date(X0).toISOString(),expiresAt:new Date(X0+600000).toISOString(),sessionId:J.run_id,deviceId:$.state.deviceId,organizationId:$.state.orgId};if(d0&&k2(E0,X0)){let s0=d0.permissionRecovery;if(!s0||!k2(s0,X0)||s0.sessionId!==E0.sessionId||s0.operation!==E0.operation||s0.provenance!==E0.provenance)($.saveStatus??f2)({...d0,permissionRecovery:E0},M0)}return}let P=J.capability==="hands.connect"&&w.capability==="hands.connect"&&w.kind==="hands.stopped",x=J.capability==="hands.connect"&&w.kind==="hands.reconnected",A=x||J.capability==="inference.custom.v1"?AbortSignal.any([G.signal,j.signal,...w.deliverySignal?[w.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,j.signal]):$.signal,k={kind:w.kind,payload:{sequence:w.sequence,capability:w.capability,...w.data?{data:x?structuredClone(w.data):w.data}:{}}};if(J.capability==="hands.connect"&&w.capability==="hands.connect"&&(w.kind==="started"||w.kind==="hands.started")||(t3.has(J.capability)||J.capability==="pty.start")&&w.kind==="started")return new Promise((r,X0)=>{_.push({wireEvent:k,settle:(M0)=>M0===void 0?r():X0(M0)})});let b=_;_=[];let n=T.then(async()=>{if((D||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(P)await I(k);return}if(F!==null){if(w.kind!=="hands.stopped"||!z||!L)throw F;let X0=new AbortController,M0=AbortSignal.any([$.signal,j.signal,X0.signal]),d0=setTimeout(()=>X0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);z=!1;try{await L(M0),L=void 0,await C([k],M,!0)(M0),F=null}catch(E0){throw F=E0??Error("Hands stop receipt could not be confirmed."),E0}finally{clearTimeout(d0),X0.abort()}return}if(x&&!W){let X0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));W=new b2(new Date(X0).toISOString(),()=>($.now?.()??new Date).getTime(),(M0)=>{G.abort(M0),V.abort(M0)})}let r=M;if(x)L=C([...b.map((X0)=>X0.wireEvent),k],r,!0),await L(A),L=void 0;else await C([...b.map((X0)=>X0.wireEvent),k],r,!1)(A)});n.then(()=>{for(let r of b)r.settle()},(r)=>{for(let X0 of b)X0.settle(r??Error("Hands event delivery failed."))}),T=n.catch((r)=>{if(P0(r))X(r);if(x){if(F===null)z=A.aborted&&!j.signal.aborted,F=r??Error("Hands generation receipt delivery failed.");if(!A.aborted)G.abort(r),V.abort(r)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(w){B=G.signal.aborted?{status:"cancelled",error_code:l3(G.signal)}:{status:"failed",error_code:S8(w)}}finally{Q.authorized=()=>!1,j.abort();for(let w of _.splice(0))w.settle();V.abort(),await y}let l=y8(J.capability)?f8(B.result,J.operation_id):null;if(N){if(P0(N))throw N;B={status:"failed",error_code:H??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(G.signal.aborted&&B.status==="succeeded")B={status:"cancelled",error_code:l3(G.signal),...l?{result:l}:{}}}if(W?.close(),P0($.signal.reason))throw $.signal.reason;await n3($,J,B)}finally{W?.close(),j.abort(),V.abort(),$.signal.removeEventListener("abort",K)}}async function J9($){let J=$.now??(()=>new Date),Z=$.sleep??$9,Q=$.saveStatus??f2,X=$.loadStatus??o$,Y=$.statusPath??y2(),G=J().toISOString(),V=X(Y)?.lastUsedAt,K=!1,N=()=>({version:1,pid:process.pid,startedAt:G,...l8(J),...d8(X(Y),$.state,J().getTime()),deviceId:$.state.deviceId,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{},...V?{lastUsedAt:V}:{}}),H=0,B,q=!1,M,T,_,j=Promise.resolve();Q({...N(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),g8();try{let D=async()=>{let O=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||O===T)return;if(M&&T){let L=await M.release();if($.onEvent?.({type:"idle_sleep",status:L,policy:T}),L==="failed")return;M=void 0,T=void 0,K=!1;let W=X(Y);if(W)Q({...W,idleSleepHold:K},Y)}if(!O)return;T=O;let F=!0;M=await($.acquireAwakeHold??z8)(O,{onStatusChange:(L)=>{if(F)return;K=L==="held";let W=X(Y);if(W)Q({...W,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:L,policy:O})}}),F=!1,K=M.status==="held";let z=X(Y);if(z)Q({...z,idleSleepHold:K},Y);$.onEvent?.({type:"idle_sleep",status:M.status,policy:O})};if(await D(),$.readIdleSleepPolicy)_=setInterval(()=>{j=j.then(D).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),_.unref();while(!$.signal.aborted){let O=!1;try{await vQ({...$,saveStatus:(F,z)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;V=F.lastUsedAt??V,Q({...F,startedAt:G,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:K}:{}},z)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&H>0&&!O){O=!0;let z=H;H=0,B=void 0,$.onEvent?.({type:"reconnected",attempts:z})}$.onEvent?.(F)}});return}catch(F){if(a3(F,$.signal))return;if(P0(F)){q=!0;let L=$.state.worker?"worker_connection_failed":s3(F);throw Q({...N(),state:"error",error:L},Y),$.onEvent?.({type:"error",message:L}),F}H+=1;let z=wQ(H,$.reconnectRandom);B??=J().toISOString(),Q({...N(),state:"starting",reconnectingSince:B},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":s3(F),attempt:H,retryInMs:z}),await Z(z,$.signal)}}}catch(D){if(!a3(D,$.signal))throw D}finally{if($.client.close?.(),clearInterval(_),await j,M&&T){let D=await M.release();K=D==="failed"&&M.status==="held",$.onEvent?.({type:"idle_sleep",status:D,policy:T})}if(!q)Q({...N(),state:"stopped"},Y);else{let D=X(Y);if(D)Q({...D,idleSleepHold:K},Y)}$.onEvent?.({type:"stopped"})}}async function vQ($){let J=$.now??(()=>new Date),Z=$.sleep??$9,Q=$.statusPath??y2(),X=$.saveStatus??f2,Y=$.loadStatus??o$,G=J().toISOString(),V=Y(Q)?.lastUsedAt,K=$.runtimeUpdate,N=new AbortController,H=()=>N.abort($.signal.reason);if($.signal.aborted)H();else $.signal.addEventListener("abort",H,{once:!0});let B=K?.random??Math.random,q=$.maxConcurrentClaims,M=typeof q==="number"&&Number.isSafeInteger(q)&&q>0?Math.min(DQ,q):WQ,T=0,_=!1,j=null,D=(v)=>{j??=v,N.abort(v)},O=new Map,F=()=>{let v=new Set,Y0=0;for(let{claim:S$}of O.values()){let B$=S$.capability==="hands.connect"?S$.payload[w8]:void 0;if(typeof B$==="string"){if(v.has(B$))continue;v.add(B$)}Y0+=1}return Y0},z=null,L=()=>[...O.values()].some((v)=>v.authorized()),W=()=>[...O.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=K?new Date(G).getTime()+p3(K.initialDelayMs??IQ,B):Number.POSITIVE_INFINITY,E=null,I=!1,C=$.firstHeartbeat,h=C?.account_root_metadata_supported===!0,S=C?.workspace_root_metadata_supported===!0,y=C?.account_root_path_supported===!0,l=C?.home_contained_roots_supported===!0,w=C?.root_paths_supported===!0,P=C?.startup_supported===!0,x=C!==void 0,A=C?{challenge:C.challenge,expires_at:C.expires_at}:void 0,k,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:G,...l8(J),...d8(Y(Q),$.state,J().getTime()),...V?{lastUsedAt:V}:{},deviceId:$.state.deviceId,...E?{organizationId:E.organization_id,organizationName:E.organization_name,organizationSlug:E.organization_slug}:{}}),r=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!b)k??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...P&&!b&&k?{startup:k}:{},capabilities:v?v8($.capabilities,{accountRootMetadataSupported:h,workspaceRootMetadataSupported:S,accountRootPathSupported:y,homeContainedRootsSupported:l,rootPathsSupported:w}):{supported_operations:[]}}},X0=()=>{if(I||!$.client.identity)return;I=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;E=v;let Y0=Y(Q);if(!Y0)return;X({...Y0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},M0=(v)=>{h=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,y=v.account_root_path_supported===!0,l=v.home_contained_roots_supported===!0,w=v.root_paths_supported===!0,P=v.startup_supported===!0,x=!1},d0=(v)=>{if(v.startup)b=!0},E0=(v,Y0)=>{if(!(Y0 instanceof _0&&Y0.status===400&&Y0.code==="invalid_heartbeat")||!v.startup&&!x)throw Y0;if(b=!0,x)h=S=y=!1,l=w=P=x=!1;return null},s0=(v)=>{M0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),X0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},E$=!1,i$=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(E$)i$=!0;let v=r();K1($,"heartbeat",()=>$.client.heartbeat($.state,v,N.signal).catch((Y0)=>E0(v,Y0))).then((Y0)=>{if(!Y0)return;d0(v),M0(Y0),s0(Y0)},()=>{return})});let _$=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let G$=!1,x$=$.maxConsecutiveHeartbeatFailures??3,K$=0;try{while(!$.signal.aborted){if(j)throw j;if(_&&W())break;let v,Y0=r(),S$=A;A=void 0,E$=!0,i$=!1;try{let i=await K1($,"heartbeat",()=>$.client.heartbeat($.state,Y0,N.signal,...S$?[S$]:[]).catch((B0)=>E0(Y0,B0)));if(E$=!1,!i)continue;v=i,d0(Y0),K$=0}catch(i){if(E$=!1,$.signal.aborted)break;if(!w2(i))throw i;if(K$+=1,K$>=x$&&!L())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(M0(v),Object.keys(r().capabilities).length>Object.keys(Y0.capabilities).length)continue;if(i$)continue;if(s0(v),j)throw j;if($.signal.aborted)break;if(K&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(K&&J().getTime()>=R)try{let i=new AbortController,B0=()=>i.abort($.signal.reason);if($.signal.aborted)B0();else $.signal.addEventListener("abort",B0,{once:!0});let z0;try{z0=K.check(i.signal)}catch(A0){z0=Promise.reject(A0)}let U$=z0.then((A0)=>({kind:"completed",result:A0}),(A0)=>({kind:"failed",error:A0})),n$;try{while(!0){let A0=await kQ(U$,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(A0.kind==="failed")throw new c3(A0.error);if(A0.kind==="completed"){n$=A0.result;break}try{let x0=r(),O1=await K1($,"heartbeat",()=>$.client.heartbeat($.state,x0,N.signal).catch((Y2)=>E0(x0,Y2)));if(!O1)continue;v=O1,d0(x0),s0(v),K$=0}catch(x0){if($.signal.aborted)throw x0;if(!w2(x0))throw x0;if(K$+=1,K$>=x$&&!L())throw x0}}}catch(A0){i.abort(A0);let x0=await U$;if(x0.kind==="completed"&&x0.result==="activated")n$="activated";else throw A0}finally{$.signal.removeEventListener("abort",B0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,n$==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),_=!0}R=J().getTime()+p3(K.intervalMs??CQ,B)}catch(i){if(!(i instanceof c3))throw i;T+=1;let B0=K.retryBaseMs??PQ,z0=K.retryMaxMs??EQ,U$=Math.min(z0,B0*2**Math.min(T-1,8));R=J().getTime()+p3(U$,B)}if($.signal.aborted)break;if(_&&W())break;if(_){await _$($.heartbeatIntervalMs??15000);continue}let B$=$.client.sessionCadence?.($.state)??null,b$=B$?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await _$(b$);continue}if(F()>=M){let i=new AbortController;z=i;try{await Z(b$,AbortSignal.any([$.signal,i.signal]))}catch(B0){if(!i.signal.aborted)throw B0}finally{if(z===i)z=null}continue}let m0,D1=B$?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),f=performance.now();try{m0=await K1($,"claim",()=>$.client.claimOperation($.state,{waitMs:D1,signal:N.signal}))}catch(i){if($.signal.aborted||!w2(i)||!L())throw i;await _$(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(j)throw j;if(!m0){if(performance.now()-f<D1-LQ)await _$(FQ);continue}if($.claimable?.()===!1){await n3($,m0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}V=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:m0.operation_id,runId:m0.run_id,attemptId:m0.attempt_id,capability:m0.capability});let a,q0={authorized:()=>!1,claim:m0};if(a=mQ({...$,signal:N.signal},m0,Z,q0,D).catch((i)=>{if(P0(i))D(i);else if(!n0(i)&&[...O].some(([B0,z0])=>B0!==a&&z0.authorized())){if(i instanceof g1)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!n0(i)&&j===null)j=i}).finally(()=>{O.delete(a),z?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:O.size})}),O.set(a,q0),$.onEvent?.({type:"claims_changed",activeClaims:O.size}),c8(m0)){if(await a,j)throw j}}}catch(v){if(!a3(v,$.signal)){N.abort(v),G$=!0;let Y0=$.state.worker?"worker_connection_failed":s3(v);throw X({...n(),state:"error",error:Y0},Q),$.onEvent?.({type:"error",message:Y0}),v}}finally{if(N.abort(),await Promise.allSettled(O.keys()),$.signal.removeEventListener("abort",H),!G$)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as _X}from"child_process";import{constants as F5,existsSync as FX,mkdtempSync as P5,rmSync as LX}from"fs";import{access as L5,open as jX,readFile as j5,readlink as WX,readdir as W5,unlink as DX,rmdir as OX}from"fs/promises";import{basename as Y9,join as K9}from"path";import{randomUUID as m$}from"crypto";import{chmodSync as gQ,closeSync as uQ,fsyncSync as dQ,openSync as lQ,readFileSync as pQ,rmdirSync as s8,unlinkSync as n8,writeFileSync as cQ}from"fs";import{createConnection as sQ,createServer as aQ}from"net";import{dirname as iQ,join as nQ}from"path";var rQ=5000;async function r8($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:m$()},X={runId:m$(),deviceId:m$(),rootId:m$(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=i8(J,X),G={version:1,snapshot_id:m$(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(G).installed&&Y.current().snapshot_id===G.snapshot_id&&!Z.aborted}catch{return!1}finally{try{n8(Y.path)}catch{}}}async function t8($,J,Z=a8){if(J.aborted)return!1;let Q,X,Y=new Set,G=m$(),V=aQ((q)=>{Y.add(q),q.once("close",()=>Y.delete(q)),q.on("error",()=>q.destroy()),q.end(G)});V.maxConnections=1;let K,N,H=new Promise((q)=>{N=()=>q(!1)}),B=setTimeout(N,rQ);J.addEventListener("abort",N,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${m$()}`}),X=nQ(Q.journalDirectory,"readiness.json");let q=lQ(X,"wx",384);try{cQ(q,G),dQ(q)}finally{uQ(q)}if(pQ(X,"utf8")!==G||J.aborted)return!1;let M=new Promise((T)=>{V.once("error",()=>T(!1)),V.listen(Q.socketPath,()=>{try{gQ(Q.socketPath,384)}catch{T(!1);return}K=sQ(Q.socketPath);let _="";K.setEncoding("utf8"),K.once("error",()=>T(!1)),K.on("data",(j)=>{if(_+=j,_.length>G.length)K?.destroy(),T(!1)}),K.once("end",()=>T(_===G)),K.once("close",()=>T(!1))})});return await Promise.race([M,H])&&!J.aborted}catch{return!1}finally{clearTimeout(B),J.removeEventListener("abort",N),K?.destroy();for(let q of Y)q.destroy();if(await new Promise((q)=>V.close(()=>q())),Q?.disposeSocket(),X)try{n8(X)}catch{}if(Q){try{s8(Q.journalDirectory)}catch{}try{s8(iQ(Q.journalDirectory))}catch{}}}}import{spawn as tQ}from"child_process";import{randomUUID as v$}from"crypto";import{basename as oQ}from"path";import{fileURLToPath as eQ}from"url";function $X(){let $=oQ(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",eQ(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function $5($,J,Z=$X()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),G=tQ(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),V=!1,K=new Promise((F)=>G.once("close",()=>{V=!0,F()}));G.on("error",X);let N,H,B=new Promise((F)=>{N=F}),q=new Promise((F)=>{H=F}),M=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",_=0,j=!1;G.stdout.setEncoding("utf8"),G.stdout.on("data",(F)=>{if(_+=Buffer.byteLength(F),T+=F,_>512){X();return}while(T.includes(`
 `)){let z=T.indexOf(`
-`),L=T.slice(0,z);T=T.slice(z+1);try{if(!j){let W=JSON.parse(L);if(!W||Object.keys(W).length!==2||!Number.isInteger(W.port)||W.port<1024||W.port>65535||typeof W.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(W.token))throw Error("probe_receipt_invalid");j=!0,N({port:W.port,token:W.token})}else if(L==="ready")H(!0);else X()}catch{X()}}}),K.then(X);let D,O=!1;try{let F=await Promise.race([B,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let z=Date.now()+4500,L=m$(),W={organizationId:m$(),userId:m$(),runId:m$(),deviceId:m$(),rootId:m$(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:m$(),port:F.port,expiresAtMs:z},R={binding:W,executorLaunchId:L,job:{jobId:W.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:z,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:L}}},E=r8({binding:W,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});D=await n8({binding:W,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:E,signal:Q.signal}),O=await Promise.race([q,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{O=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),D?.close(),Q.abort(),G.stdin.destroy(),!V)G.kill("SIGKILL");await K}return O&&V}import{execFileSync as f2}from"child_process";import{randomUUID as d0}from"crypto";import{chmodSync as o8,chownSync as N5,closeSync as J9,constants as U$,existsSync as tQ,fstatSync as q5,mkdirSync as e8,mkdtempSync as oQ,openSync as Z9,readFileSync as eQ,readSync as $X,realpathSync as JX,rmdirSync as ZX,rmSync as QX}from"fs";import{join as v$}from"path";import{fileURLToPath as XX}from"url";var $5=1e4,YX=!1;function h2(){if(process.platform!=="linux")return!1;return YX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=f2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var GX=Buffer.from([0,255,3,4]);function J5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function KX($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function u1($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=y2(),{directory:Q,root:X,runtimeDirectory:Y}=VX(Z),G=new AbortController,V=()=>G.abort();$.addEventListener("abort",V,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,$5),H={organization_id:d0(),user_id:d0(),device_id:d0()},B=d0(),q=d0(),M=d0(),T=d0(),_=Date.now()+$5,j={kind:"workspace_source",target_revision:0,root_grant_revision:1},D=d0().replaceAll("-",""),O,F=Buffer.alloc(0),z,L=!1,W=!1,R=!1,E=!1,I,C,h,S=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},y=!1;try{K=BX(Q,Z),I=Bun.serve({hostname:"127.0.0.1",port:0,fetch(P,x){let A=new URL(P.url).pathname,w=A===`/device/hands/${D}`?"hands":A===`/device/pty/${D}`?"pty":null;if(w&&x.upgrade(P,{data:{lane:w}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(P){if(P.data.lane==="pty")O=P},message(P,x){if(P.data.lane!=="pty")return;if(typeof x==="string"){try{if(JSON.parse(x).t==="open")L=!0}catch{V()}return}if(F.length+x.length>8192){V();return}F=Buffer.concat([F,x])}}});let l=`ws://127.0.0.1:${I.port}`;if(C=Q9({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:B,operationId:d0(),attemptId:d0(),claimOwner:H,deviceIdentity:{deviceId:H.device_id,rootId:q,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${D}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:Z5,hands_worker_version:Y5,hands_worker_artifact_sha256:K5,hands_worker_entrypoint:G5,target_generation:1,target_fence_id:M,environment_binding:j,[B5]:U5},emitEvent:async(P)=>{if(P==="hands.started")E=!0;if(P==="hands.ready")W=!0;if(P==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:V5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:XX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!W)V()}),await S(()=>W),Q5({root:X,runId:B,payload:{version:1,snapshot_id:T,revision:1,run_id:B,root_id:q,device_id:H.device_id,binding:{...j,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:D},git:null}}),h=X5({root:X,runId:B,rootId:q,deviceId:H.device_id,owner:H,workspace:{kind:"root"},authority:{device_id:H.device_id,binding:j.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${d0()}`,sessionId:"pty-readiness",operationId:d0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${D}`},emit:async(P,x)=>{if(P==="pty.ready")z=x}}).catch(()=>{V()}),await S(()=>Boolean(z&&O&&L)),O.send(JSON.stringify({t:"resize",cols:100,rows:30})),O.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${D}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${J5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${J5("foreground")}; ${K.wait("foreground")}'
-`)),await S(()=>tQ(v$(X,"foreground.pid"))&&F.includes(GX)),!F.includes("30 100")||z.job.environmentSnapshotId!==T||z.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((P)=>UX(v$(X,P)));if(new Set(k).size!==2||k.some((P)=>!Number.isSafeInteger(P)||P<2||P===z.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((P)=>KX(eQ(`/proc/${P}/stat`,"utf8"),P,z.job.process.pid)))return!1}else{let x=f2("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((A)=>A.trim().split(/\s+/).map(Number));if(x.length!==2||new Set(x.map(([A])=>A)).size!==2||x.some((A)=>A.length!==2||!k.includes(A[0])||A[0]!==A[1]))return!1}if(O.send(JSON.stringify({t:"close"})),await h,G.signal.aborted)return!1;for(let P of[z.job.process.pid,...k])try{return process.kill(P,0),!1}catch(x){if(!(x instanceof Error&&("code"in x)&&x.code==="ESRCH"))return!1}y=!0}catch{y=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await C,await I?.stop(!0),!E||R)NX({directory:Q,root:X},Z)}return y&&R&&!$.aborted}function BX($,J){let Z={foreground:v$($,"foreground.lifeline"),background:v$($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");f2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))J9(Y)};try{for(let Y of Object.values(Z)){let G=Z9(Y,U$.O_RDONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW);try{if(Q.push(Z9(Y,U$.O_WRONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW)),!q5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{J9(G)}if(J)N5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function H5($=(J)=>u1(J)){let J=new AbortController,Z=JSON.stringify(y2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(y2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function UX($){let J;try{J=Z9($,U$.O_RDONLY|U$.O_NOFOLLOW|U$.O_NONBLOCK)}catch{return Number.NaN}try{let Z=q5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=$X(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{J9(J)}}function VX($,J=JX("/tmp")){let Z=oQ(v$(J,"reason-pty-probe-")),Q=v$(Z,"workspace"),X=v$(Z,"private");if(e8(Q,{mode:448}),e8(X,{mode:448}),$)o8(Z,493),o8(Q,493),N5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function NX($,J){if(J)try{f2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),ZX($.root)}catch{return}QX($.directory,{recursive:!0,force:!0})}var I5=5000,g$="ARA_WORKER_PROBE_READY";function jX($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{qX($,J,{cwd:Z,env:Q,signal:X,timeout:I5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,V)=>Y(!G&&!X.aborted&&V===g$))})}function WX($,J){if(X9($)==="bash")return["--noprofile","--norc","-c",J];if(X9($)==="zsh"||X9($)==="sh")return["-f","-c",J];return null}function DX($,J){let Z=j5({home:J,temporaryDirectory:J}),Q=(Y,G,V)=>jX(Y,G,$.workspaceRoot,Z,V),X=async(Y,G,V,K=(H)=>H===g$,N=!1)=>{let H=await x5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:I5,signal:V});return!V.aborted&&!H.timedOut&&!H.truncated&&H.exitCode===0&&K(H.stdout)};return{workspaceRead:async(Y)=>{return await T5($.workspaceRoot,M5.R_OK),await F5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await T5($.workspaceRoot,M5.W_OK),Y.aborted)return!1;let G=R5(G9($.workspaceRoot,".ara-worker-probe-")),V=G9(G,"receipt");try{let K=await TX(V,"wx",384);try{await K.writeFile(g$),await K.sync()}finally{await K.close()}return await _5(V,"utf8")===g$&&!Y.aborted}finally{await FX(V).catch(()=>{}),await LX(G).catch(()=>{})}},confinedShell:(Y)=>X(E5(),["-c",`printf ${g$}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
-`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,V,K]=await Promise.all([_X("/proc/self/cwd"),F5("/proc/self/fd"),_5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${g$}`],Y),jobs:(Y)=>i8($,Y),environment:(Y)=>a8($,J,Y),preview:(Y)=>t8(J,Y),boundPty:(Y)=>u1(Y),desktopDisplay:()=>P5(),desktopAutomation:async()=>{let Y=B9();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
-`);return A5()},desktopBrowser:async()=>l1()?.features.browser===!0,fullControlShell:(Y)=>{let G=O5(),V=WX(G,`printf ${g$}`);return V?Q(G,V,Y):Promise.resolve(!1)}}}function B9(){return process.platform==="darwin"&&l1()?.features.computer===!0?z5():null}var U9=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function OX($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=K9()){return d1($,J,Z,Q,X).final}function d1($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=K9(),Y,G){let V,K;try{if(K$($),v0(),!J)e(g($),!0),V=R5(G9(g($),"probe-")),J=DX($,V);K=J}catch(O){let F=Promise.reject(O);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(O,F)=>{if(Z.aborted||!F&&!K[O])return!1;let z,L=new Promise((W)=>{z=()=>W(!1)});Z.addEventListener("abort",z,{once:!0});try{return await Promise.race([F??K[O](Z),L])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",z)}},H=$.executionMode==="host",B=H?N("boundPty",Y):Promise.resolve(!1),q=Promise.resolve(G).then(()=>Promise.all(H?[N("preview"),B,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[O,F,z,L,W,R,E,I,C]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...H?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(H&&(!R||!E||!I)&&!G)await q;if(H){if(!R)R=await N("bash");if(!E)E=await N("jobs");if(!I)I=await N("environment")}return{read:O,write:F,shell:z,git:L,processes:W,bash:R,jobs:E,environment:I,full:C}})(),T=(O,F)=>{let{read:z,write:L,shell:W,git:R,processes:E,bash:I,jobs:C,environment:h,full:S}=O,{preview:y,boundPty:l,desktopDisplay:k,desktopAutomation:P,desktopBrowser:x}=F,A=W5(),w=H&&process.platform==="darwin"&&S&&HX("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":z,"fs.write":L,"inference.custom.v1":H&&z,"fs.export":z&&A,"fs.import":L&&A,"exec.run":W&&X,"git.run":W&&R&&X,"process.list":(process.platform==="linux"||W)&&E,"ports.list":(process.platform==="linux"||W)&&E,"exec.full":I&&S&&X,"hands.connect":z&&L&&I&&C,"jobs.control":z&&L&&I&&C,"pty.start":z&&L&&I&&C&&h&&l,"environment.install":z&&L&&I&&C&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&z&&L&&I&&C&&h,"tunnel.open":z&&L&&I&&C&&h&&y,"tunnel.close":z&&L&&I&&C&&h&&y,"preview.serve.v1":z&&I&&C&&y&&S,"display.stream.v1":k,"automation.call.v1":P,"simulator.call.v1":w,"simulator.stream.v1":w,"browser.pr-proof.v1":P&&x&&L5()===null,"workspace.setup.v1":H&&D5()})},_=M.then(async(O)=>T(O,{preview:!1,boundPty:await Promise.race([B,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),j=(async()=>{try{let O=await M,[F,z,L,W,R]=await q;if(H&&!z&&O.read&&O.write&&O.bash&&O.jobs&&O.environment)z=await N("boundPty");return T(O,{preview:F,boundPty:z,desktopDisplay:L,desktopAutomation:W,desktopBrowser:R})}finally{if(V)MX(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let D=(async()=>{let O=await M;if(!(O.read&&O.write&&O.bash&&O.jobs&&O.environment))return!1;return await B||(await j)["pty.start"]===!0})();return D.catch(()=>{}),{initial:_,final:j,pty:D}}var zX=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],AX=[60000,300000,900000];function Y9($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return zX.filter((Z)=>J[Z]!==!0)}function C5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>OX($.config,void 0,Y,$.permissions)),Q=$.readiness,X=Y9($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
-`),(async()=>{for(let Y of $.delaysMs??AX){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=Y9($.config,Q).filter((K)=>G[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
-`),$.onReady(Q,V);if(Y9($.config,Q).length===0)return}})()}import{execFile as DY}from"child_process";import{createHash as OY,randomUUID as R9}from"crypto";import{lstat as zY,readdir as HJ,readFile as WJ,realpath as AY,stat as RY}from"fs/promises";import{basename as IY,join as z9}from"path";import{promisify as CY}from"util";import{createConnection as RX}from"net";import{endianness as w5}from"os";var p1=4,V9=1e4;class z${socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=RX(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=IX({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let H=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:H})});return Z.write(G),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=p1){let J=w5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=p1+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(p1,Z);this.#$=this.#$.subarray(Z),this.#K(JSON.parse(Q.toString("utf8")))}}#K($){if(!a0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),a0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class m2{client;cdp;constructor($){this.client="client"in $?$.client:new z$($),this.cdp=new f5(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=CX(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new k5(this,$)}getTabs(){return this.client.getTabs()}}class k5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new y5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class y5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class f5{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(a0(Q)&&a0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return a0(Q)&&a0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";S5(Q);let X=Z.timeoutMs??V9;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(a0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if(b5(K,Q))return;throw V}),G}async waitForLoadState($,J={}){let Z=J.state??"load";S5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(b5(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??V9)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return a0(J)?{href:N9(J.href),readyState:N9(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??V9;return new Promise((X,Y)=>{let G=!1,V=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((H)=>{try{if(J(H)){if(N())X(H)}}catch(B){if(N())Y(B instanceof Error?B:Error(String(B)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=PX(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function IX($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(p1+J.length);if(w5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,p1),Z}function a0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function CX($,J){if(!a0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function S5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function b5($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function PX($,J){if($.method!=="onCDPEvent"||!a0($.params))return null;let Z=$.params.source;if(!a0(Z)||Z.tabId!==J)return null;return{method:N9($.params.method)}}function N9($){return typeof $==="string"?$:void 0}import{createHash as EX}from"crypto";function h5($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${EX("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as LY}from"async_hooks";import{isDeepStrictEqual as NJ}from"util";import{createHash as jY}from"crypto";var xX=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var SX=new Set(["png","jpg","jpeg","gif","webp"]),bX=new Set(["webm","mp4"]);function wX($){if(!$)return null;try{return new URL($).origin}catch{return null}}function m5($,J){let Z;try{Z=new URL($)}catch{return null}let Q=wX(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=xX.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!V||!K||!N)return null;let H=SX.has(N)?"image":bX.has(N)?"video":null;if(!H)return null;let B=/^(before|after)[\s:_-]+/.exec(K),q=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:q,runId:G,artifactId:V,fileName:`${K}.${N}`,kind:H,phase:B?.[1]==="before"||B?.[1]==="after"?B[1]:null}}var kX=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,v2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),u$=()=>{throw Error("cloud_browser_media_request_invalid")};function g2($){if(!v2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!kX.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return u$();let J;try{J=new URL($.configuredMediaOrigin)}catch{return u$()}if(J.protocol!=="https:"||J.username||J.password||J.port||!v5(J.origin,{mode:"public_web"}).allowed)return u$();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!v2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return u$();let G=m5(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return u$();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return u$()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return u$()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function g5($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!v2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!v2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var H9="browser.pr-proof.v1",L0=U.string().uuid(),G1=U.string().regex(/^[a-f0-9]{64}$/),l$=U.iso.datetime({precision:3}),q9=U.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),d5=U.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),l0=U.object({kind:U.literal("primary_mac"),version:U.literal(1),organizationId:q9,userId:q9,sessionId:q9,runId:L0,deviceId:L0,rootId:L0,rootRevision:U.string().min(1).max(64),binding:U.enum(["workspace_source","mcp_control"]),targetRevision:U.number().int().nonnegative(),generation:L0,profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:U.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),yX=U.custom().transform(($,J)=>{try{return u5($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),U.NEVER}}),K1=U.object({version:U.literal(1),owner:l0,contextId:L0,preparedAt:l$,expiresAt:l$,prUrl:d5,headSha:U.string().regex(/^[a-f0-9]{40}$/),skillDigest:G1,evidenceKind:U.enum(["image","video"]),visualPlan:yX.optional(),uploadOrigin:U.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),M9=U.object({version:U.literal(1),producer:U.literal("primary_mac"),context:K1,captureId:L0,operationId:L0,attemptId:L0,tabId:U.number().int().positive(),startedAt:l$,finishedAt:l$,sha256:G1,media:U.discriminatedUnion("contentType",[U.object({contentType:U.literal("image/png"),sizeBytes:U.number().int().min(24).max(8388608),width:U.number().int().min(1).max(4096),height:U.number().int().min(1).max(4096)}).strict(),U.object({contentType:U.literal("video/webm"),sizeBytes:U.number().int().min(128).max(10485760),durationSeconds:U.number().min(0.05).max(15),frameCount:U.number().int().min(1).max(450),receivedFrameCount:U.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),lq=U.discriminatedUnion("action",[U.object({action:U.literal("screenshot"),context_id:L0,tab_id:U.number().int().positive()}).strict(),U.object({action:U.literal("start_video"),context_id:L0,tab_id:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),U.object({action:U.literal("stop_video"),recording_operation_id:L0}).strict()]),d2=U.object({login:U.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:U.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),u2=U.string().regex(/^[1-9][0-9]{0,19}$/),c1=U.object({version:U.literal(1),owner:l0,expectedActorId:u2.nullable(),repositoryId:u2,repositoryFullName:U.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),fX=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],T9=U.discriminatedUnion("status",[c1.extend({status:U.literal("ready"),observedActor:d2,checkedAt:l$}),c1.extend({status:U.literal("not_ready"),reason:U.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:U.enum(fX).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),d$=U.object({version:U.literal(1),owner:l0,expectedActorId:u2.nullable(),authenticatedActor:d2,attemptId:L0,captureId:L0,prUrl:d5,repositoryId:u2,headSha:U.string().regex(/^[a-f0-9]{40}$/),sha256:G1,sizeBytes:U.number().int().min(128).max(10485760),contentType:U.literal("video/webm")}).strict(),l5=U.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),B1=U.discriminatedUnion("status",[d$.extend({status:U.literal("not_attempted"),reason:U.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),d$.extend({status:U.literal("uncertain"),reason:U.literal("upload_outcome_unknown")}),d$.extend({status:U.literal("uploaded"),observedActor:d2,nativeUrl:l5,uploadedAt:l$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),s1=d$.extend({nativeUrl:l5,observedActor:d2,bodySha256:G1}),_9=U.discriminatedUnion("status",[s1.extend({status:U.literal("incomplete"),reason:U.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),s1.extend({status:U.literal("verified"),sourceSha256:G1,width:U.number().int().min(1).max(4096),height:U.number().int().min(1).max(4096),durationSeconds:U.number().positive().max(30),advancedSeconds:U.number().min(0.05).max(10),advancedFrames:U.number().int().positive(),playbackRestored:U.literal(!0),verifiedAt:l$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),hX=U.custom().transform(($,J)=>{try{let Z=g2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),U.NEVER}}),mX=U.discriminatedUnion("action",[U.object({action:U.literal("auth_check"),input:c1}).strict(),U.object({action:U.literal("prepare"),context:K1}).strict(),U.object({action:U.literal("capture_png"),owner:l0,contextId:L0,tabId:U.number().int().positive()}).strict(),U.object({action:U.literal("start_video"),owner:l0,contextId:L0,tabId:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),U.object({action:U.literal("inspect_capture"),owner:l0,captureId:L0}).strict(),U.object({action:U.literal("publish_video"),input:d$}).strict(),U.object({action:U.literal("verify_png_media"),owner:l0,media:hX}).strict().refine(($)=>$.media.runId===$.owner.runId),U.object({action:U.literal("verify_saved_media"),input:s1}).strict(),U.object({action:U.literal("publish_png"),owner:l0,attemptId:L0,captureId:L0,sha256:G1,sizeBytes:U.number().int().min(24).max(8388608),storagePath:U.string().max(512),uploadUrl:U.string().url().max(8192)}).strict()]);var p5="pr-proof.stop.v1",F9=U.object({requestId:L0,command:mX}).strict();import{createHash as vX,randomUUID as gX}from"crypto";import{isDeepStrictEqual as U1}from"util";var c5=U.object({operationId:U.string().uuid(),attemptId:U.string().uuid(),contextId:U.string().uuid(),tabId:U.number().int().positive()}).strict(),G0=()=>Error("mac_pr_proof_capture_unavailable"),L9=($)=>vX("sha256").update($).digest("hex");function s5($){let J=l0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw G0();if(await $.assertCurrent(),X)throw G0()},G=(q)=>{let M=Z.get(q);if(!M||Date.parse(M.expiresAt)<=Date.now())throw G0();return M},V=(q)=>q.disposal??=(async()=>{q.controller.abort(),q.bytes?.fill(0),q.bytes=void 0,q.receipt=void 0;try{await q.host?.close()}catch{throw X=!0,G0()}})(),K=async()=>{for(let[q,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,j])=>j.claim.contextId===q);if((await Promise.allSettled(T.map(([,j])=>V(j)))).some((j)=>j.status==="rejected"))throw G0();for(let[j]of T)Q.delete(j);Z.delete(q)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let H=(q)=>{if(q.stopRequested=!0,q.started&&q.host&&!q.stop)q.stop=q.host.stop(),q.stop.catch(()=>q.controller.abort())};async function B(q,M){let T=c5.parse(q.claim);if(M==="video"&&(!Number.isInteger(q.seconds)||q.seconds<1||q.seconds>15))throw G0();await Y(),q.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw G0();let j=Q.get(T.operationId);if(j){if(!U1(j.claim,T)||j.kind!==M||j.seconds!==q.seconds||j.controller.signal.aborted)throw G0();let E=await j.completion;if(await Y(),G(T.contextId),j.controller.signal.aborted)throw G0();return structuredClone(E)}if(Q.size>=16||[...Q.values()].some((E)=>!E.receipt&&!E.controller.signal.aborted&&E.claim.tabId===T.tabId))throw G0();let D,O,F=new Promise((E,I)=>{D=E,O=I});F.catch(()=>{});let z={claim:T,kind:M,seconds:q.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,z);let L=()=>{V(z).catch(()=>{})};q.signal.addEventListener("abort",L,{once:!0});let W=async()=>{await Y(),G(T.contextId),q.signal.throwIfAborted(),z.controller.signal.throwIfAborted()},R;try{await W();let E;if(M==="image"){let I=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,z.controller.signal);let C=new Date().toISOString();if(await W(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw G0();E=M9.parse({version:1,producer:"primary_mac",context:_,captureId:gX(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I,finishedAt:C,sha256:L9(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(z.host=await $.createVideo(structuredClone(_),T.tabId,q.seconds,z.controller.signal),z.controller.signal.aborted||q.signal.aborted||X)throw await z.host.close(),G0();await z.host.start(),z.started=!0;let I=z.host.completed();if(I.catch(()=>{}),await W(),await q.started?.(),z.stopRequested)H(z);let C=await I;if(z.stop)await z.stop;await W();let h=await z.host.read(C.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!U1(C,h.capture)||!U1(C.owner,S)||R.length!==C.sizeBytes||L9(R)!==C.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw G0();await z.host.close(),await W(),E=M9.parse({version:1,producer:"primary_mac",context:_,captureId:C.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C.startedAt,finishedAt:C.finishedAt,sha256:C.sha256,media:{contentType:"video/webm",sizeBytes:C.sizeBytes,durationSeconds:C.durationSeconds,frameCount:C.frameCount,receivedFrameCount:C.receivedFrameCount}})}if(await W(),[...Q.values()].reduce((I,C)=>I+(C.bytes?.length??0),R.length)>20971520)throw G0();return z.bytes=Buffer.from(R),z.receipt=E,D(E),structuredClone(E)}catch(E){let I=M==="video"&&!q.signal.aborted&&!z.controller.signal.aborted&&E instanceof Error&&E.message==="mac_recording_worker_failed:no_frames"?new f0("proof_capture_no_frames","The owned tab emitted no recording frames."):G0();throw await V(z).catch(()=>{}),O(I),I}finally{R?.fill(0),q.signal.removeEventListener("abort",L)}}return{async prepare(q){let M=K1.parse(q);if(!U1(M.owner,J))throw G0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw G0();let T=Z.get(M.contextId);if(T){if(!U1(T,M))throw G0();return structuredClone(T)}if(Z.size>=4)throw G0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(q)=>B(q,"image"),record:(q)=>B(q,"video"),async stop(q){let M=c5.parse(q);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!U1(M,T.claim)||T.controller.signal.aborted)throw G0();H(T)},async publicationCapture(q){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===q);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw G0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||L9(M.bytes)!==M.receipt.sha256)throw G0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(q){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===q);if(!M?.receipt||M.controller.signal.aborted)throw G0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let q=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),q.some((M)=>M.status==="rejected"))throw G0()}}}import{createHash as r5,randomUUID as nX}from"crypto";import{isDeepStrictEqual as a1}from"util";import{realpath as rX}from"fs/promises";var a5=String.raw`async (media) => {
+`),L=T.slice(0,z);T=T.slice(z+1);try{if(!j){let W=JSON.parse(L);if(!W||Object.keys(W).length!==2||!Number.isInteger(W.port)||W.port<1024||W.port>65535||typeof W.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(W.token))throw Error("probe_receipt_invalid");j=!0,N({port:W.port,token:W.token})}else if(L==="ready")H(!0);else X()}catch{X()}}}),K.then(X);let D,O=!1;try{let F=await Promise.race([B,M]);if(!F||!G.pid||Q.signal.aborted||J.aborted)return!1;let z=Date.now()+4500,L=v$(),W={organizationId:v$(),userId:v$(),runId:v$(),deviceId:v$(),rootId:v$(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:v$(),port:F.port,expiresAtMs:z},R={binding:W,executorLaunchId:L,job:{jobId:W.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:z,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:G.pid,processGroupId:G.pid,executorLaunchId:L}}},E=e8({binding:W,deniedPorts:new Set,readCurrentJob:async()=>!V&&!Q.signal.aborted?R:null});D=await o8({binding:W,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:E,signal:Q.signal}),O=await Promise.race([q,M])===!0&&!Q.signal.aborted&&!J.aborted}catch{O=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),D?.close(),Q.abort(),G.stdin.destroy(),!V)G.kill("SIGKILL");await K}return O&&V}import{execFileSync as v2}from"child_process";import{randomUUID as p0}from"crypto";import{chmodSync as J5,chownSync as M5,closeSync as Z9,constants as q$,existsSync as JX,fstatSync as T5,mkdirSync as Z5,mkdtempSync as ZX,openSync as Q9,readFileSync as QX,readSync as XX,realpathSync as YX,rmdirSync as GX,rmSync as KX}from"fs";import{join as g$}from"path";import{fileURLToPath as BX}from"url";var Q5=1e4,UX=!1;function g2(){if(process.platform!=="linux")return!1;return UX||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=v2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var VX=Buffer.from([0,255,3,4]);function X5($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function NX($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function u1($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=m2(),{directory:Q,root:X,runtimeDirectory:Y}=MX(Z),G=new AbortController,V=()=>G.abort();$.addEventListener("abort",V,{once:!0});let K;G.signal.addEventListener("abort",()=>K?.close(),{once:!0});let N=setTimeout(V,Q5),H={organization_id:p0(),user_id:p0(),device_id:p0()},B=p0(),q=p0(),M=p0(),T=p0(),_=Date.now()+Q5,j={kind:"workspace_source",target_revision:0,root_grant_revision:1},D=p0().replaceAll("-",""),O,F=Buffer.alloc(0),z,L=!1,W=!1,R=!1,E=!1,I,C,h,S=async(l)=>{while(!l()){if(G.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((w)=>setTimeout(w,20))}if(G.signal.aborted)throw Error("pty_probe_cancelled")},y=!1;try{K=qX(Q,Z),I=Bun.serve({hostname:"127.0.0.1",port:0,fetch(P,x){let A=new URL(P.url).pathname,k=A===`/device/hands/${D}`?"hands":A===`/device/pty/${D}`?"pty":null;if(k&&x.upgrade(P,{data:{lane:k}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(P){if(P.data.lane==="pty")O=P},message(P,x){if(P.data.lane!=="pty")return;if(typeof x==="string"){try{if(JSON.parse(x).t==="open")L=!0}catch{V()}return}if(F.length+x.length>8192){V();return}F=Buffer.concat([F,x])}}});let l=`ws://127.0.0.1:${I.port}`;if(C=X9({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:B,operationId:p0(),attemptId:p0(),claimOwner:H,deviceIdentity:{deviceId:H.device_id,rootId:q,apiOrigin:"https://worker-probe.invalid"},signal:G.signal,payload:{relay_url:`${l}/device/hands/${D}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(_).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:Y5,hands_worker_version:B5,hands_worker_artifact_sha256:V5,hands_worker_entrypoint:U5,target_generation:1,target_fence_id:M,environment_binding:j,[N5]:q5},emitEvent:async(P)=>{if(P==="hands.started")E=!0;if(P==="hands.ready")W=!0;if(P==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:H5(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:BX(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!W)V()}),await S(()=>W),G5({root:X,runId:B,payload:{version:1,snapshot_id:T,revision:1,run_id:B,root_id:q,device_id:H.device_id,binding:{...j,target_generation:1,target_fence_id:M},expires_at:new Date(_).toISOString(),variables:{PTY_PROBE_VALUE:D},git:null}}),h=K5({root:X,runId:B,rootId:q,deviceId:H.device_id,owner:H,workspace:{kind:"root"},authority:{device_id:H.device_id,binding:j.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:M},signal:G.signal,session:{jobId:`pty-${p0()}`,sessionId:"pty-readiness",operationId:p0(),cols:80,rows:24,leaseExpiresAtMs:_,relayUrl:`${l}/device/pty/${D}`},emit:async(P,x)=>{if(P==="pty.ready")z=x}}).catch(()=>{V()}),await S(()=>Boolean(z&&O&&L)),O.send(JSON.stringify({t:"resize",cols:100,rows:30})),O.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${D}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${K.wait("background")}) & ${X5("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${X5("foreground")}; ${K.wait("foreground")}'
+`)),await S(()=>JX(g$(X,"foreground.pid"))&&F.includes(VX)),!F.includes("30 100")||z.job.environmentSnapshotId!==T||z.job.environmentRevision!==1)return!1;let w=["background.pid","foreground.pid"].map((P)=>HX(g$(X,P)));if(new Set(w).size!==2||w.some((P)=>!Number.isSafeInteger(P)||P<2||P===z.job.process.pid))return!1;if(process.platform==="linux"){if(!w.every((P)=>NX(QX(`/proc/${P}/stat`,"utf8"),P,z.job.process.pid)))return!1}else{let x=v2("/bin/ps",["-o","pid=,pgid=","-p",w.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((A)=>A.trim().split(/\s+/).map(Number));if(x.length!==2||new Set(x.map(([A])=>A)).size!==2||x.some((A)=>A.length!==2||!w.includes(A[0])||A[0]!==A[1]))return!1}if(O.send(JSON.stringify({t:"close"})),await h,G.signal.aborted)return!1;for(let P of[z.job.process.pid,...w])try{return process.kill(P,0),!1}catch(x){if(!(x instanceof Error&&("code"in x)&&x.code==="ESRCH"))return!1}y=!0}catch{y=!1}finally{if(clearTimeout(N),$.removeEventListener("abort",V),V(),K?.close(),await h,await C,await I?.stop(!0),!E||R)TX({directory:Q,root:X},Z)}return y&&R&&!$.aborted}function qX($,J){let Z={foreground:g$($,"foreground.lifeline"),background:g$($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");v2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))Z9(Y)};try{for(let Y of Object.values(Z)){let G=Q9(Y,q$.O_RDONLY|q$.O_NONBLOCK|q$.O_NOFOLLOW);try{if(Q.push(Q9(Y,q$.O_WRONLY|q$.O_NONBLOCK|q$.O_NOFOLLOW)),!T5(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{Z9(G)}if(J)M5(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function _5($=(J)=>u1(J)){let J=new AbortController,Z=JSON.stringify(m2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(m2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((G)=>{Y=setTimeout(G,X)})]),clearTimeout(Y)}}}function HX($){let J;try{J=Q9($,q$.O_RDONLY|q$.O_NOFOLLOW|q$.O_NONBLOCK)}catch{return Number.NaN}try{let Z=T5(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=XX(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{Z9(J)}}function MX($,J=YX("/tmp")){let Z=ZX(g$(J,"reason-pty-probe-")),Q=g$(Z,"workspace"),X=g$(Z,"private");if(Z5(Q,{mode:448}),Z5(X,{mode:448}),$)J5(Z,493),J5(Q,493),M5(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function TX($,J){if(J)try{v2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),GX($.root)}catch{return}KX($.directory,{recursive:!0,force:!0})}var E5=5000,u$="ARA_WORKER_PROBE_READY";function zX($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{_X($,J,{cwd:Z,env:Q,signal:X,timeout:E5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(G,V)=>Y(!G&&!X.aborted&&V===u$))})}function AX($,J){if(Y9($)==="bash")return["--noprofile","--norc","-c",J];if(Y9($)==="zsh"||Y9($)==="sh")return["-f","-c",J];return null}function RX($,J){let Z=O5({home:J,temporaryDirectory:J}),Q=(Y,G,V)=>zX(Y,G,$.workspaceRoot,Z,V),X=async(Y,G,V,K=(H)=>H===u$,N=!1)=>{let H=await w5(Y,G,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:N,timeoutMs:E5,signal:V});return!V.aborted&&!H.timedOut&&!H.truncated&&H.exitCode===0&&K(H.stdout)};return{workspaceRead:async(Y)=>{return await L5($.workspaceRoot,F5.R_OK),await W5($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await L5($.workspaceRoot,F5.W_OK),Y.aborted)return!1;let G=P5(K9($.workspaceRoot,".ara-worker-probe-")),V=K9(G,"receipt");try{let K=await jX(V,"wx",384);try{await K.writeFile(u$),await K.sync()}finally{await K.close()}return await j5(V,"utf8")===u$&&!Y.aborted}finally{await DX(V).catch(()=>{}),await OX(G).catch(()=>{})}},confinedShell:(Y)=>X(b5(),["-c",`printf ${u$}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(G)=>/^git version \S+/.test(G)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(N)=>N.includes(`p${process.pid}
+`)&&/^n\//m.test(N),!0);if(process.platform!=="linux")return!1;let[G,V,K]=await Promise.all([WX("/proc/self/cwd"),W5("/proc/self/fd"),j5("/proc/net/tcp","utf8")]);return!Y.aborted&&G.length>0&&V.length>0&&K.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${u$}`],Y),jobs:(Y)=>t8($,Y),environment:(Y)=>r8($,J,Y),preview:(Y)=>$5(J,Y),boundPty:(Y)=>u1(Y),desktopDisplay:()=>S5(),desktopAutomation:async()=>{let Y=U9();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
+`);return C5()},desktopBrowser:async()=>l1()?.features.browser===!0,fullControlShell:(Y)=>{let G=R5(),V=AX(G,`printf ${u$}`);return V?Q(G,V,Y):Promise.resolve(!1)}}}function U9(){return process.platform==="darwin"&&l1()?.features.computer===!0?I5():null}var V9=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function IX($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=B9()){return d1($,J,Z,Q,X).final}function d1($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=B9(),Y,G){let V,K;try{if(V$($),g0(),!J)e(g($),!0),V=P5(K9(g($),"probe-")),J=RX($,V);K=J}catch(O){let F=Promise.reject(O);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let N=async(O,F)=>{if(Z.aborted||!F&&!K[O])return!1;let z,L=new Promise((W)=>{z=()=>W(!1)});Z.addEventListener("abort",z,{once:!0});try{return await Promise.race([F??K[O](Z),L])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",z)}},H=$.executionMode==="host",B=H?N("boundPty",Y):Promise.resolve(!1),q=Promise.resolve(G).then(()=>Promise.all(H?[N("preview"),B,N("desktopDisplay"),N("desktopAutomation"),N("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),M=(async()=>{let[O,F,z,L,W,R,E,I,C]=await Promise.all([Promise.resolve(Q).then((h)=>h.read?N("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((h)=>h.write?N("workspaceWrite"):!1,()=>!1),X?N("confinedShell"):!1,X?N("confinedGit"):!1,N("processInspection"),...H?[N("bash"),N("jobs"),N("environment"),N("fullControlShell")]:[!1,!1,!1,!1]]);if(H&&(!R||!E||!I)&&!G)await q;if(H){if(!R)R=await N("bash");if(!E)E=await N("jobs");if(!I)I=await N("environment")}return{read:O,write:F,shell:z,git:L,processes:W,bash:R,jobs:E,environment:I,full:C}})(),T=(O,F)=>{let{read:z,write:L,shell:W,git:R,processes:E,bash:I,jobs:C,environment:h,full:S}=O,{preview:y,boundPty:l,desktopDisplay:w,desktopAutomation:P,desktopBrowser:x}=F,A=z5(),k=H&&process.platform==="darwin"&&S&&FX("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":z,"fs.write":L,"inference.custom.v1":H&&z,"fs.export":z&&A,"fs.import":L&&A,"exec.run":W&&X,"git.run":W&&R&&X,"process.list":(process.platform==="linux"||W)&&E,"ports.list":(process.platform==="linux"||W)&&E,"exec.full":I&&S&&X,"hands.connect":z&&L&&I&&C,"jobs.control":z&&L&&I&&C,"pty.start":z&&L&&I&&C&&h&&l,"environment.install":z&&L&&I&&C&&h,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&z&&L&&I&&C&&h,"tunnel.open":z&&L&&I&&C&&h&&y,"tunnel.close":z&&L&&I&&C&&h&&y,"preview.serve.v1":z&&I&&C&&y&&S,"display.stream.v1":w,"automation.call.v1":P,"simulator.call.v1":k,"simulator.stream.v1":k,"browser.pr-proof.v1":P&&x&&D5()===null,"workspace.setup.v1":H&&A5()})},_=M.then(async(O)=>T(O,{preview:!1,boundPty:await Promise.race([B,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),j=(async()=>{try{let O=await M,[F,z,L,W,R]=await q;if(H&&!z&&O.read&&O.write&&O.bash&&O.jobs&&O.environment)z=await N("boundPty");return T(O,{preview:F,boundPty:z,desktopDisplay:L,desktopAutomation:W,desktopBrowser:R})}finally{if(V)LX(V,{recursive:!0,force:!0})}})();_.catch(()=>{});let D=(async()=>{let O=await M;if(!(O.read&&O.write&&O.bash&&O.jobs&&O.environment))return!1;return await B||(await j)["pty.start"]===!0})();return D.catch(()=>{}),{initial:_,final:j,pty:D}}var CX=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],PX=[60000,300000,900000];function G9($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return CX.filter((Z)=>J[Z]!==!0)}function x5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>IX($.config,void 0,Y,$.permissions)),Q=$.readiness,X=G9($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
+`),(async()=>{for(let Y of $.delaysMs??PX){if(await new Promise((K)=>{let N=setTimeout(K,Y);$.signal.addEventListener("abort",()=>{clearTimeout(N),K()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let G;try{G=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let V=G9($.config,Q).filter((K)=>G[K]===!0);if(V.length>0)Q=Object.freeze({...Q,...Object.fromEntries(V.map((K)=>[K,!0]))}),J(`Reason worker: ready after probing again (${V.join(", ")}).
+`),$.onReady(Q,V);if(G9($.config,Q).length===0)return}})()}import{execFile as RY}from"child_process";import{createHash as IY,randomUUID as I9}from"crypto";import{lstat as CY,readdir as _J,readFile as zJ,realpath as PY,stat as EY}from"fs/promises";import{basename as xY,join as A9}from"path";import{promisify as SY}from"util";import{createConnection as EX}from"net";import{endianness as f5}from"os";var p1=4,N9=1e4;class A${socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=EX(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#G(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},G=xX({jsonrpc:"2.0",id:Q,method:$,params:X}),V=new Promise((K,N)=>{let H=setTimeout(()=>{this.#Z.delete(Q),N(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:K,reject:N,timeout:H})});return Z.write(G),await V}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#G($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=p1){let J=f5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=p1+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(p1,Z);this.#$=this.#$.subarray(Z),this.#K(JSON.parse(Q.toString("utf8")))}}#K($){if(!r0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),r0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class u2{client;cdp;constructor($){this.client="client"in $?$.client:new A$($),this.cdp=new v5(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=SX(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new h5(this,$)}getTabs(){return this.client.getTabs()}}class h5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new m5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class m5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class v5{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(r0(Q)&&r0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return r0(Q)&&r0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";k5(Q);let X=Z.timeoutMs??N9;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),G=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(r0(G)&&typeof G.errorText==="string"&&G.errorText)throw Error(`Browser failed to navigate tab ${$}: ${G.errorText}`);return await Y.catch(async(V)=>{let K=await this.readDocumentState($);if(y5(K,Q))return;throw V}),G}async waitForLoadState($,J={}){let Z=J.state??"load";k5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(y5(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??N9)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return r0(J)?{href:q9(J.href),readyState:q9(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??N9;return new Promise((X,Y)=>{let G=!1,V=null,K,N=()=>{if(G)return!1;return G=!0,clearTimeout(K),V?.(),!0};K=setTimeout(()=>{if(N())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),V=this.client.onNotification((H)=>{try{if(J(H)){if(N())X(H)}}catch(B){if(N())Y(B instanceof Error?B:Error(String(B)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=bX(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function xX($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(p1+J.length);if(f5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,p1),Z}function r0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function SX($,J){if(!r0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function k5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function y5($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function bX($,J){if($.method!=="onCDPEvent"||!r0($.params))return null;let Z=$.params.source;if(!r0(Z)||Z.tabId!==J)return null;return{method:q9($.params.method)}}function q9($){return typeof $==="string"?$:void 0}import{createHash as wX}from"crypto";function g5($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${wX("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as OY}from"async_hooks";import{isDeepStrictEqual as MJ}from"util";import{createHash as zY}from"crypto";var kX=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var yX=new Set(["png","jpg","jpeg","gif","webp"]),fX=new Set(["webm","mp4"]);function hX($){if(!$)return null;try{return new URL($).origin}catch{return null}}function u5($,J){let Z;try{Z=new URL($)}catch{return null}let Q=hX(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=kX.exec(Z.pathname);if(!Y)return null;let G=Y[1]?.toLowerCase(),V=Y[2]?.toLowerCase(),K=Y[3]?.toLowerCase(),N=Y[4]?.toLowerCase();if(!G||!V||!K||!N)return null;let H=yX.has(N)?"image":fX.has(N)?"video":null;if(!H)return null;let B=/^(before|after)[\s:_-]+/.exec(K),q=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:q,runId:G,artifactId:V,fileName:`${K}.${N}`,kind:H,phase:B?.[1]==="before"||B?.[1]==="after"?B[1]:null}}var mX=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,d2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),d$=()=>{throw Error("cloud_browser_media_request_invalid")};function l2($){if(!d2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!mX.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return d$();let J;try{J=new URL($.configuredMediaOrigin)}catch{return d$()}if(J.protocol!=="https:"||J.username||J.password||J.port||!d5(J.origin,{mode:"public_web"}).allowed)return d$();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!d2(Y)||Object.keys(Y).some((V)=>!["url","sourceUrl","kind"].includes(V))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return d$();let G=u5(Y.url,J.origin);if(!G||new URL(G.url).origin!==J.origin||G.runId!==Z||G.kind!==Y.kind||G.url!==Y.url||Q.has(Y.url))return d$();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let V;try{V=new URL(Y.sourceUrl)}catch{return d$()}let K=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(V.pathname)?.[1];if(Y.kind!=="image"||V.origin!=="https://camo.githubusercontent.com"||V.username||V.password||V.search||V.hash||!K||K.length%2!==0||Buffer.from(K,"hex").toString("utf8")!==Y.url)return d$()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function l5($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!d2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let G=J.media[Y];if(!d2(X)||X.url!==G.url||X.sourceUrl!==G.sourceUrl||X.kind!==G.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||G.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...G,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...G.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var M9="browser.pr-proof.v1",j0=U.string().uuid(),B1=U.string().regex(/^[a-f0-9]{64}$/),p$=U.iso.datetime({precision:3}),H9=U.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),c5=U.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),c0=U.object({kind:U.literal("primary_mac"),version:U.literal(1),organizationId:H9,userId:H9,sessionId:H9,runId:j0,deviceId:j0,rootId:j0,rootRevision:U.string().min(1).max(64),binding:U.enum(["workspace_source","mcp_control"]),targetRevision:U.number().int().nonnegative(),generation:j0,profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:U.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),vX=U.custom().transform(($,J)=>{try{return p5($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),U.NEVER}}),U1=U.object({version:U.literal(1),owner:c0,contextId:j0,preparedAt:p$,expiresAt:p$,prUrl:c5,headSha:U.string().regex(/^[a-f0-9]{40}$/),skillDigest:B1,evidenceKind:U.enum(["image","video"]),visualPlan:vX.optional(),uploadOrigin:U.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),T9=U.object({version:U.literal(1),producer:U.literal("primary_mac"),context:U1,captureId:j0,operationId:j0,attemptId:j0,tabId:U.number().int().positive(),startedAt:p$,finishedAt:p$,sha256:B1,media:U.discriminatedUnion("contentType",[U.object({contentType:U.literal("image/png"),sizeBytes:U.number().int().min(24).max(8388608),width:U.number().int().min(1).max(4096),height:U.number().int().min(1).max(4096)}).strict(),U.object({contentType:U.literal("video/webm"),sizeBytes:U.number().int().min(128).max(10485760),durationSeconds:U.number().min(0.05).max(15),frameCount:U.number().int().min(1).max(450),receivedFrameCount:U.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),iq=U.discriminatedUnion("action",[U.object({action:U.literal("screenshot"),context_id:j0,tab_id:U.number().int().positive()}).strict(),U.object({action:U.literal("start_video"),context_id:j0,tab_id:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),U.object({action:U.literal("stop_video"),recording_operation_id:j0}).strict()]),c2=U.object({login:U.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:U.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),p2=U.string().regex(/^[1-9][0-9]{0,19}$/),c1=U.object({version:U.literal(1),owner:c0,expectedActorId:p2.nullable(),repositoryId:p2,repositoryFullName:U.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),gX=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],_9=U.discriminatedUnion("status",[c1.extend({status:U.literal("ready"),observedActor:c2,checkedAt:p$}),c1.extend({status:U.literal("not_ready"),reason:U.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:U.enum(gX).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),l$=U.object({version:U.literal(1),owner:c0,expectedActorId:p2.nullable(),authenticatedActor:c2,attemptId:j0,captureId:j0,prUrl:c5,repositoryId:p2,headSha:U.string().regex(/^[a-f0-9]{40}$/),sha256:B1,sizeBytes:U.number().int().min(128).max(10485760),contentType:U.literal("video/webm")}).strict(),s5=U.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),V1=U.discriminatedUnion("status",[l$.extend({status:U.literal("not_attempted"),reason:U.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),l$.extend({status:U.literal("uncertain"),reason:U.literal("upload_outcome_unknown")}),l$.extend({status:U.literal("uploaded"),observedActor:c2,nativeUrl:s5,uploadedAt:p$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),s1=l$.extend({nativeUrl:s5,observedActor:c2,bodySha256:B1}),F9=U.discriminatedUnion("status",[s1.extend({status:U.literal("incomplete"),reason:U.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),s1.extend({status:U.literal("verified"),sourceSha256:B1,width:U.number().int().min(1).max(4096),height:U.number().int().min(1).max(4096),durationSeconds:U.number().positive().max(30),advancedSeconds:U.number().min(0.05).max(10),advancedFrames:U.number().int().positive(),playbackRestored:U.literal(!0),verifiedAt:p$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),uX=U.custom().transform(($,J)=>{try{let Z=l2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),U.NEVER}}),dX=U.discriminatedUnion("action",[U.object({action:U.literal("auth_check"),input:c1}).strict(),U.object({action:U.literal("prepare"),context:U1}).strict(),U.object({action:U.literal("capture_png"),owner:c0,contextId:j0,tabId:U.number().int().positive()}).strict(),U.object({action:U.literal("start_video"),owner:c0,contextId:j0,tabId:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),U.object({action:U.literal("inspect_capture"),owner:c0,captureId:j0}).strict(),U.object({action:U.literal("publish_video"),input:l$}).strict(),U.object({action:U.literal("verify_png_media"),owner:c0,media:uX}).strict().refine(($)=>$.media.runId===$.owner.runId),U.object({action:U.literal("verify_saved_media"),input:s1}).strict(),U.object({action:U.literal("publish_png"),owner:c0,attemptId:j0,captureId:j0,sha256:B1,sizeBytes:U.number().int().min(24).max(8388608),storagePath:U.string().max(512),uploadUrl:U.string().url().max(8192)}).strict()]);var a5="pr-proof.stop.v1",L9=U.object({requestId:j0,command:dX}).strict();import{createHash as lX,randomUUID as pX}from"crypto";import{isDeepStrictEqual as N1}from"util";var i5=U.object({operationId:U.string().uuid(),attemptId:U.string().uuid(),contextId:U.string().uuid(),tabId:U.number().int().positive()}).strict(),K0=()=>Error("mac_pr_proof_capture_unavailable"),j9=($)=>lX("sha256").update($).digest("hex");function n5($){let J=c0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw K0();if(await $.assertCurrent(),X)throw K0()},G=(q)=>{let M=Z.get(q);if(!M||Date.parse(M.expiresAt)<=Date.now())throw K0();return M},V=(q)=>q.disposal??=(async()=>{q.controller.abort(),q.bytes?.fill(0),q.bytes=void 0,q.receipt=void 0;try{await q.host?.close()}catch{throw X=!0,K0()}})(),K=async()=>{for(let[q,M]of Z){if(Date.parse(M.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,j])=>j.claim.contextId===q);if((await Promise.allSettled(T.map(([,j])=>V(j)))).some((j)=>j.status==="rejected"))throw K0();for(let[j]of T)Q.delete(j);Z.delete(q)}},N=setInterval(()=>{K().catch(()=>{X=!0})},1000);N.unref();let H=(q)=>{if(q.stopRequested=!0,q.started&&q.host&&!q.stop)q.stop=q.host.stop(),q.stop.catch(()=>q.controller.abort())};async function B(q,M){let T=i5.parse(q.claim);if(M==="video"&&(!Number.isInteger(q.seconds)||q.seconds<1||q.seconds>15))throw K0();await Y(),q.signal.throwIfAborted(),await K();let _=G(T.contextId);if(M==="video"&&_.evidenceKind!=="video")throw K0();let j=Q.get(T.operationId);if(j){if(!N1(j.claim,T)||j.kind!==M||j.seconds!==q.seconds||j.controller.signal.aborted)throw K0();let E=await j.completion;if(await Y(),G(T.contextId),j.controller.signal.aborted)throw K0();return structuredClone(E)}if(Q.size>=16||[...Q.values()].some((E)=>!E.receipt&&!E.controller.signal.aborted&&E.claim.tabId===T.tabId))throw K0();let D,O,F=new Promise((E,I)=>{D=E,O=I});F.catch(()=>{});let z={claim:T,kind:M,seconds:q.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,z);let L=()=>{V(z).catch(()=>{})};q.signal.addEventListener("abort",L,{once:!0});let W=async()=>{await Y(),G(T.contextId),q.signal.throwIfAborted(),z.controller.signal.throwIfAborted()},R;try{await W();let E;if(M==="image"){let I=new Date().toISOString();R=await $.screenshot(structuredClone(_),T.tabId,z.controller.signal);let C=new Date().toISOString();if(await W(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw K0();E=T9.parse({version:1,producer:"primary_mac",context:_,captureId:pX(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I,finishedAt:C,sha256:j9(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(z.host=await $.createVideo(structuredClone(_),T.tabId,q.seconds,z.controller.signal),z.controller.signal.aborted||q.signal.aborted||X)throw await z.host.close(),K0();await z.host.start(),z.started=!0;let I=z.host.completed();if(I.catch(()=>{}),await W(),await q.started?.(),z.stopRequested)H(z);let C=await I;if(z.stop)await z.stop;await W();let h=await z.host.read(C.captureId);R=h.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!N1(C,h.capture)||!N1(C.owner,S)||R.length!==C.sizeBytes||j9(R)!==C.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw K0();await z.host.close(),await W(),E=T9.parse({version:1,producer:"primary_mac",context:_,captureId:C.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:C.startedAt,finishedAt:C.finishedAt,sha256:C.sha256,media:{contentType:"video/webm",sizeBytes:C.sizeBytes,durationSeconds:C.durationSeconds,frameCount:C.frameCount,receivedFrameCount:C.receivedFrameCount}})}if(await W(),[...Q.values()].reduce((I,C)=>I+(C.bytes?.length??0),R.length)>20971520)throw K0();return z.bytes=Buffer.from(R),z.receipt=E,D(E),structuredClone(E)}catch(E){let I=M==="video"&&!q.signal.aborted&&!z.controller.signal.aborted&&E instanceof Error&&E.message==="mac_recording_worker_failed:no_frames"?new h0("proof_capture_no_frames","The owned tab emitted no recording frames."):K0();throw await V(z).catch(()=>{}),O(I),I}finally{R?.fill(0),q.signal.removeEventListener("abort",L)}}return{async prepare(q){let M=U1.parse(q);if(!N1(M.owner,J))throw K0();if(await Y(),await K(),Date.parse(M.preparedAt)>Date.now()||Date.parse(M.expiresAt)<=Date.now())throw K0();let T=Z.get(M.contextId);if(T){if(!N1(T,M))throw K0();return structuredClone(T)}if(Z.size>=4)throw K0();return Z.set(M.contextId,M),structuredClone(M)},screenshot:(q)=>B(q,"image"),record:(q)=>B(q,"video"),async stop(q){let M=i5.parse(q);await Y(),G(M.contextId);let T=Q.get(M.operationId);if(!T||T.kind!=="video"||!N1(M,T.claim)||T.controller.signal.aborted)throw K0();H(T)},async publicationCapture(q){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===q);if(!M?.receipt||!M.bytes||M.controller.signal.aborted)throw K0();if(G(M.claim.contextId),M.bytes.length!==M.receipt.media.sizeBytes||j9(M.bytes)!==M.receipt.sha256)throw K0();return{capture:structuredClone(M.receipt),bytes:Buffer.from(M.bytes)}},async inspect(q){await Y(),await K();let M=[...Q.values()].find((T)=>T.receipt?.captureId===q);if(!M?.receipt||M.controller.signal.aborted)throw K0();return G(M.claim.contextId),structuredClone(M.receipt)},async close(){X=!0,clearInterval(N);let q=await Promise.allSettled([...Q.values()].map(V));if(Q.clear(),Z.clear(),q.some((M)=>M.status==="rejected"))throw K0()}}}import{createHash as e5,randomUUID as eX}from"crypto";import{isDeepStrictEqual as a1}from"util";import{realpath as $Y}from"fs/promises";var r5=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -71,25 +71,25 @@ ${J?.directory??g($)}`).digest("hex")}function R1($,J){c(b0(g($),I1),{version:1,
     }
   }));
   return { verified: true, items };
-}`;var i5=function($){let J=this??globalThis,Z=10485760,Q=(G,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),H=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,B={login:K,id:H};if(G.expectedActorId!==null&&H!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||H!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||H!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let q=J.document.querySelector('link[rel="canonical"]');if(q&&q.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),j=M?.closest("form"),D=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!j||new J.URL(j.action,J.location.href).origin!=="https://github.com"||new J.URL(j.action,J.location.href).pathname!==D)return{ok:!1,reason:"attachment_unavailable"};let O=_.getAttribute("data-upload-policy-url");if(!O||new J.URL(O,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:B}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,V=Q(G,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(q)=>q.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),H=new J.DataTransfer;H.items.add(N);let B=J.document.querySelector("#fc-new_comment_field");if(!B)return{dispatched:!1,reason:"attachment_unavailable"};return B.files=H.files,B.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),V=(D)=>{try{let O=new J.URL(D,J.location.href);if(O.protocol!=="https:"||O.username||O.password||O.port||O.hash)return!1;if(O.origin==="https://github.com")return O.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(O.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(O.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((D)=>/^issue-[1-9][0-9]*$/.test(D.closest('[id^="issue-"]')?.id||"")&&!D.closest("form")&&!D.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],H=[...N.querySelectorAll("video")].filter((D)=>[D.currentSrc,D.src,...[...D.querySelectorAll("source")].map((O)=>O.src)].some(V));if(H.length!==1)throw Error("saved_player_missing");let B=H[0],q={muted:B.muted,volume:B.volume,rate:B.playbackRate,preload:B.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(D)=>J.Promise.race([D,new J.Promise((O,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),j=async(D)=>{while(!D()){if(B.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((O)=>J.setTimeout(O,25))}};try{if(B.muted=!0,B.playbackRate=1,B.currentTime=0,B.readyState<2)B.preload="auto",B.load();await j(()=>B.readyState>=2&&B.videoWidth>0&&B.videoHeight>0);let D=B.currentSrc;if(!V(D))throw Error("source_unbound");let O=await _(J.fetch(D,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(O.status!==200||!V(O.url)||O.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(O.headers.get("content-type")||"")||!O.body)throw Error("source_unverifiable");let F=O.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let z=O.body.getReader(),L=[],W=0;try{for(;;){let y=await _(z.read());if(y.done)break;if(W+=y.value.length,W>10485760||W>X.sizeBytes)throw Error("source_too_large");L.push(y.value)}}finally{await z.cancel().catch(()=>{}),z.releaseLock()}if(W!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(W),E=0;for(let y of L)R.set(y,E),E+=y.length;let I=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((y)=>y.toString(16).padStart(2,"0")).join("");if(I!==X.sha256||B.currentSrc!==D||!N.contains(B))throw Error("source_changed");let C=B.currentTime,h=B.getVideoPlaybackQuality().totalVideoFrames;if(await _(B.play()),await j(()=>B.currentTime-C>=0.05&&B.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||B.currentSrc!==D||!N.contains(B)||B.error)throw Error("player_changed");return{status:"verified",sourceSha256:I,width:B.videoWidth,height:B.videoHeight,durationSeconds:B.duration,advancedSeconds:B.currentTime-C,advancedFrames:B.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),B.pause(),B.currentTime=0,B.muted=q.muted,B.volume=q.volume,B.playbackRate=q.rate,B.preload=q.preload,!B.paused||B.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as uX}from"child_process";import{lstat as dX,realpath as lX}from"fs/promises";import{join as n5,resolve as pX}from"path";import{promisify as cX}from"util";var sX=cX(uX);async function aX($,J){let Z=await lX($),{stdout:Q}=await sX(n5(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return U.array(U.object({browser:U.string(),directory:U.string(),connected:U.boolean().optional(),source:U.string(),socketPath:U.string().optional(),instanceId:U.string().optional(),extensionId:U.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&pX(Y.source)===n5(Z,"Reason Browser Use","manifest.json"))}async function l2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await aX($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await dX(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as iX}from"crypto";function V1($){return`reason-browser-${iX("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var t5=U.discriminatedUnion("ok",[U.object({ok:U.literal(!0),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict(),U.object({ok:U.literal(!1),reason:U.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),o5=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.string(),extensionInstanceId:U.string(),nativeHostName:U.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function j9($){let J=l0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await tX($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${nX()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(H)=>{if(!a1(J,H.owner))throw Z0();await G()},K=async(H)=>{await V(H);let B=await $.readVideo(H.captureId);try{await G();let q=B.capture;if(!a1(q.context.owner,J)||q.captureId!==H.captureId||q.context.prUrl!==H.prUrl||q.context.headSha!==H.headSha||q.media.contentType!=="video/webm"||q.media.sizeBytes!==H.sizeBytes||q.sha256!==H.sha256||B.bytes.length!==H.sizeBytes||B.bytes.length<128||B.bytes.length>10485760||B.bytes.readUInt32BE(0)!==440786851||r5("sha256").update(B.bytes).digest("hex")!==H.sha256)throw Z0();return B}catch(q){throw B.bytes.fill(0),q}};async function N(H,B,q){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new m2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,j=!1,D,O=new Promise((L,W)=>{D=setTimeout(()=>{j=!0,W(Z0())},60000)});O.catch(()=>{});let F=(L)=>Promise.race([L,O]),z=async()=>{if(j)throw Z0();if(await G(),j)throw Z0()};try{await F(T.connect());let L=o5.parse(await F(T.client.getInfo()));if(L.metadata.extensionId!==M.extensionId||L.metadata.extensionInstanceId!==M.instanceId||!L.metadata.nativeHostName)throw Z0();await z(),q?.("connected");let W=T.newTab();W.then((I)=>{if(j)I.close().catch(()=>{Y=!0})},()=>{}),_=await F(W),await z(),await F(_.goto(H,{waitUntil:"domcontentloaded",timeoutMs:15000})),await z(),q?.("loaded");let E=await F(B(_,async(I)=>{await z();let C=await F(_.evaluate(`(${i5.toString()})(${JSON.stringify(I)})`,{awaitPromise:!0}));return await z(),C},z));return await z(),E}finally{j=!0,clearTimeout(D);try{if(_){let L;try{await Promise.race([_.close(),new Promise((W,R)=>{L=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(L)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(H,B,q){let M=K1.parse(H);if(await V(M),!Number.isSafeInteger(B)||B<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();q.throwIfAborted();let T=await Z.discover(q),_=new m2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),j;try{await _.connect();let D=o5.parse(await _.client.getInfo());if(D.metadata.extensionId!==T.extensionId||D.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!U.array(U.object({id:U.number()})).max(256).parse(await _.getTabs()).some((z)=>z.id===B))throw Z0();await G(),q.throwIfAborted();let F=U.object({data:U.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(B,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(j=Buffer.from(F.data,"base64"),j.toString("base64")!==F.data||j.length>8388608)throw Z0();if(await G(),q.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return j}catch{throw j?.fill(0),Z0()}finally{_.close()}},async verifyImages(H){let B=g2(H);if(B.runId!==J.runId||B.media.some((q)=>q.kind!=="image"))throw Z0();return N("about:blank",async(q,M,T)=>{let _=q.browser.client,j=new Set(B.media.map((I)=>I.sourceUrl)),D=new Map,O=new Set,F=!1,z=0,L=!1,W=new Set,R=(I,C)=>{if(W.size>=32){F=!0;return}let h=_.executeCdp(q.id,I,C);W.add(h),h.catch(()=>{F=!0}).finally(()=>W.delete(h))},E=_.onNotification((I)=>{if(I.method!=="onCDPEvent"||!V$(I.params)||!V$(I.params.source)||I.params.source.tabId!==q.id||!V$(I.params.params))return;let C=I.params.params;if(++z>512){F=!0;return}if(I.params.method==="Fetch.requestPaused"){let y=typeof C.requestId==="string"&&V$(C.request)&&C.request.method==="GET"&&typeof C.request.url==="string"&&j.has(C.request.url)&&C.resourceType==="Image";if(typeof C.requestId!=="string"){F=!0;return}if(!y)F=!0;R(y?"Fetch.continueRequest":"Fetch.failRequest",{requestId:C.requestId,...y?{}:{errorReason:"BlockedByClient"}})}if(I.params.method==="Network.requestWillBeSent"&&C.redirectResponse)F=!0;if(I.params.method==="Network.loadingFailed")F=!0;if(I.params.method==="Network.loadingFinished"&&typeof C.requestId==="string")O.add(C.requestId);if(I.params.method!=="Network.responseReceived")return;if(!V$(C.response)||typeof C.response.url!=="string"||!j.has(C.response.url)||typeof C.requestId!=="string"||!V$(C.response.headers)||C.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(C.response.headers).map(([y,l])=>[y.toLowerCase(),l])),S=Number(h["content-length"]);if(D.has(C.response.url)||C.response.status!==200||C.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}D.set(C.response.url,{id:C.requestId,length:S})});try{await _.executeCdp(q.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(q.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(q.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(q.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let I=U.object({frameTree:U.object({frame:U.object({id:U.string().min(1).max(256)})})}).parse(await _.executeCdp(q.id,"Page.getFrameTree",{})),C=[...new Set(B.media.map((y)=>new URL(y.sourceUrl).origin))].join(" ");await _.executeCdp(q.id,"Page.setDocumentContent",{frameId:I.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${C}; style-src 'none'"><body></body>`}),await T(),L=!0;try{await _.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new f0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await q.evaluate(`(${a5})(${JSON.stringify(B.media)})`,{awaitPromise:!0})}catch{throw new f0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!V$(h)||!Array.isArray(h.items)||h.items.length!==B.media.length)throw Z0();await Promise.all(W);let S=[];for(let y=0;y<B.media.length;y++){await G();let l=D.get(B.media[y].sourceUrl);if(F||!l||!O.has(l.id))throw Z0();let k=U.object({base64Encoded:U.literal(!0),body:U.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(q.id,"Network.getResponseBody",{requestId:l.id})),P=Buffer.from(k.body,"base64");try{let x=h.items[y];if(P.length!==l.length||P.toString("base64")!==k.body||!V$(x))throw Z0();S.push({...x,sourceSha256:r5("sha256").update(P).digest("hex")})}finally{P.fill(0)}}if(F)throw Z0();return g5({verified:!0,items:S},B)}finally{if(E(),await Promise.allSettled(W),L)try{await _.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new f0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(H){let B=c1.parse(H);await V(B);let q="browser_unavailable";try{return await N(`https://github.com/${B.repositoryFullName}`,async(M,T)=>{let _=t5.parse(await T({operation:"preflight",expected:{...B,prUrl:`https://github.com/${B.repositoryFullName}`}}));return T9.parse(_.ok?{...B,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...B,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...B,status:"not_ready",reason:_.reason})},(M)=>{q=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return T9.parse({...B,status:"not_ready",reason:"unavailable",cause:q})}},async publish(H){let B=d$.parse(H);if(await V(B),B.expectedActorId!==null&&B.authenticatedActor.id!==B.expectedActorId)throw Z0();let q=Q.get(B.attemptId);if(q){if(!a1(q.binding,B))throw Z0();return structuredClone(q.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(B),result:B1.parse({...B,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(B.attemptId,M);let T=!1,_="dispatch";try{(await K(B)).bytes.fill(0),M.result=await N(B.prUrl,async(j,D)=>{let O=t5.parse(await D({operation:"identity",expected:B}));if(!O.ok)return B1.parse({...B,status:"not_attempted",reason:O.reason});let F=await K(B),z;try{T=!0,z=U.discriminatedUnion("dispatched",[U.object({dispatched:U.literal(!0),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict(),U.object({dispatched:U.literal(!1),reason:U.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await D({operation:"upload",expected:B,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!z.dispatched)return T=!1,B1.parse({...B,status:"not_attempted",reason:z.reason});if(!a1(z.actor,O.actor))throw _="actor_changed",Z0();_="result";let L=performance.now();while(performance.now()-L<30000){let W=await D({operation:"upload_result",expected:{...B,observedActor:O.actor}});if(W!==null){let R=U.object({nativeUrl:U.string(),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict().parse(W);return _="finalize",await G(),B1.parse({...B,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
-`);M.result=B1.parse({...B,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(H){let B=s1.parse(H);await V(B);try{return(await K(B)).bytes.fill(0),await N(B.prUrl,async(q,M)=>{await q.browser.client.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:B});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=_9.parse({...B,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(B).some(([j,D])=>!a1(D,_[j])))throw Z0();return _}finally{await q.browser.client.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return _9.parse({...B,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function tX($,J){let Z=await rX($);return{async discover(Q){let X=await l2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:V1(J.runId)}}import{realpath as FY}from"fs/promises";var OH=U.object({version:U.literal(1),recording_operation_id:U.string().uuid(),proof_ready:U.literal(!1),acknowledged_at:U.iso.datetime()}).strict(),p2=U.object({action:U.literal("start"),request_id:U.string().uuid(),profile:U.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),e5=U.object({action:U.literal("inspect"),recording_operation_id:U.string().uuid()}).strict(),zH=U.discriminatedUnion("action",[p2,e5]),$J=U.object({recording_operation_id:U.string().uuid()}).strict(),W9={device_id:U.string().uuid(),root_id:U.string().uuid()},oX=U.discriminatedUnion("action",[p2.extend(W9),e5.extend(W9),$J.extend({...W9,action:U.literal("stop")})]),AH=U.toJSONSchema(oX),RH=U.object({version:U.literal(1),recordingId:U.string().uuid(),proofReady:U.literal(!1),capture:U.object({captureId:U.string().uuid(),contentType:U.literal("video/webm"),sha256:U.string().regex(/^[a-f0-9]{64}$/),sizeBytes:U.number().int().min(128).max(10485760),startedAt:U.iso.datetime(),finishedAt:U.iso.datetime(),durationSeconds:U.number().min(0.05).max(15),frameCount:U.number().int().min(1).max(450),receivedFrameCount:U.number().int().min(1).max(2000),owner:U.object({runId:U.string().uuid(),deviceId:U.string().uuid(),rootId:U.string().uuid(),rootRevision:U.string().max(64),profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:U.string().min(1).max(1024),generation:U.string().uuid(),browserScope:U.string().max(128),tabId:U.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var yH=p2.extend({action:U.enum(["start","inspect"]),recording_boot_generation:U.string().uuid(),recording_operation_id:U.string().uuid().optional(),recording_attempt_id:U.string().uuid().optional()}).strict();import{createHash as BY,randomUUID as UY}from"crypto";import{mkdtemp as VY,realpath as NY,rm as BJ}from"fs/promises";import{tmpdir as qY}from"os";import{join as HY}from"path";import{spawn as MY}from"child_process";import{isDeepStrictEqual as TY}from"util";import{createHash as eX}from"crypto";import{execFile as $Y}from"child_process";import{chmod as JY,lstat as ZJ,mkdtemp as ZY,readFile as QJ,realpath as XJ,rm as QY,writeFile as JJ}from"fs/promises";import{tmpdir as XY}from"os";import{isAbsolute as YY,join as c2}from"path";import{promisify as GY}from"util";var D9=GY($Y),KY=($)=>eX("sha256").update($).digest("hex");async function o0($){if(!YY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await XJ($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await ZJ($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||KY(await QJ($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function i1($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([o0(Z.ffmpeg),o0(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([o0(Z.ffmpeg),o0(Z.ffprobe)]);let G=await XJ(await ZY(c2(J??XY(),"reason-owned-recording-")));await JY(G,448);let V=c2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[j,D]of Q.entries()){let O=`${j}.jpg`;await JJ(c2(G,O),D.jpeg,{mode:384,flag:"wx"});let F=Q[j+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${O}'`,`duration ${Math.max(0.001,F-D.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await JJ(c2(G,"frames.ffconcat"),N.join(`
+}`;var t5=function($){let J=this??globalThis,Z=10485760,Q=(G,V)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!K&&(J.location.href===G.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==G.prUrl||!K)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(K))return{ok:!1,reason:"identity_mismatch"};let N=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),H=/^[1-9][0-9]{0,19}$/.test(N||"")?N:null,B={login:K,id:H};if(G.expectedActorId!==null&&H!==G.expectedActorId||G.authenticatedActor&&(K!==G.authenticatedActor.login||H!==G.authenticatedActor.id)||G.observedActor&&(K!==G.observedActor.login||H!==G.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==G.repositoryId)return{ok:!1,reason:"identity_mismatch"};let q=J.document.querySelector('link[rel="canonical"]');if(q&&q.href!==G.prUrl)return{ok:!1,reason:"identity_mismatch"};if(V){let M=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),_=M?.closest("file-attachment"),j=M?.closest("form"),D=new J.URL(G.prUrl).pathname+"/comment";if(!M||M.value!==""||!T||T.type!=="file"||T.disabled||!_||_.getAttribute("input")!==T.id||_.getAttribute("data-upload-repository-id")!==G.repositoryId||!j||new J.URL(j.action,J.location.href).origin!=="https://github.com"||new J.URL(j.action,J.location.href).pathname!==D)return{ok:!1,reason:"attachment_unavailable"};let O=_.getAttribute("data-upload-policy-url");if(!O||new J.URL(O,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:B}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let G=$.expected,V=Q(G,!0);if(!V.ok)return{dispatched:!1,reason:V.reason};let K=J.Uint8Array.from(J.atob($.base64||""),(q)=>q.charCodeAt(0));if(K.length!==G.sizeBytes||K.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let N=new J.File([K],G.captureId+".webm",{type:"video/webm"}),H=new J.DataTransfer;H.items.add(N);let B=J.document.querySelector("#fc-new_comment_field");if(!B)return{dispatched:!1,reason:"attachment_unavailable"};return B.files=H.files,B.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:V.actor}}if($.operation==="upload_result"){let G=Q($.expected,!1);if(!G.ok)throw Error("github_video_identity_changed");let V=J.document.querySelector("#new_comment_field")?.value?.trim(),K="["+$.expected.captureId+".webm](",N=V?.startsWith(K)&&V.endsWith(")")?V.slice(K.length,-1):V;if(!N||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(N))return null;return{nativeUrl:N,actor:G.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let G=X.nativeUrl.split("/").pop(),V=(D)=>{try{let O=new J.URL(D,J.location.href);if(O.protocol!=="https:"||O.username||O.password||O.port||O.hash)return!1;if(O.origin==="https://github.com")return O.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(O.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+G+"\\.(webm|mp4)$").test(O.pathname)}catch{return!1}},K=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((D)=>/^issue-[1-9][0-9]*$/.test(D.closest('[id^="issue-"]')?.id||"")&&!D.closest("form")&&!D.closest(".preview-content"));if(K.length!==1)throw Error("saved_body_missing");let N=K[0],H=[...N.querySelectorAll("video")].filter((D)=>[D.currentSrc,D.src,...[...D.querySelectorAll("source")].map((O)=>O.src)].some(V));if(H.length!==1)throw Error("saved_player_missing");let B=H[0],q={muted:B.muted,volume:B.volume,rate:B.playbackRate,preload:B.preload},M=new J.AbortController,T=J.setTimeout(()=>M.abort(),12000),_=(D)=>J.Promise.race([D,new J.Promise((O,F)=>{if(M.signal.aborted)F(Error("playback_timeout"));else M.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),j=async(D)=>{while(!D()){if(B.error||M.signal.aborted)throw Error("playback_unverified");await new J.Promise((O)=>J.setTimeout(O,25))}};try{if(B.muted=!0,B.playbackRate=1,B.currentTime=0,B.readyState<2)B.preload="auto",B.load();await j(()=>B.readyState>=2&&B.videoWidth>0&&B.videoHeight>0);let D=B.currentSrc;if(!V(D))throw Error("source_unbound");let O=await _(J.fetch(D,{credentials:"same-origin",redirect:"error",signal:M.signal}));if(O.status!==200||!V(O.url)||O.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(O.headers.get("content-type")||"")||!O.body)throw Error("source_unverifiable");let F=O.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let z=O.body.getReader(),L=[],W=0;try{for(;;){let y=await _(z.read());if(y.done)break;if(W+=y.value.length,W>10485760||W>X.sizeBytes)throw Error("source_too_large");L.push(y.value)}}finally{await z.cancel().catch(()=>{}),z.releaseLock()}if(W!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(W),E=0;for(let y of L)R.set(y,E),E+=y.length;let I=[...new J.Uint8Array(await _(J.crypto.subtle.digest("SHA-256",R)))].map((y)=>y.toString(16).padStart(2,"0")).join("");if(I!==X.sha256||B.currentSrc!==D||!N.contains(B))throw Error("source_changed");let C=B.currentTime,h=B.getVideoPlaybackQuality().totalVideoFrames;if(await _(B.play()),await j(()=>B.currentTime-C>=0.05&&B.getVideoPlaybackQuality().totalVideoFrames>h),!Q(X,!1).ok||B.currentSrc!==D||!N.contains(B)||B.error)throw Error("player_changed");return{status:"verified",sourceSha256:I,width:B.videoWidth,height:B.videoHeight,durationSeconds:B.duration,advancedSeconds:B.currentTime-C,advancedFrames:B.getVideoPlaybackQuality().totalVideoFrames-h,playbackRestored:!0}}finally{if(J.clearTimeout(T),M.abort(),B.pause(),B.currentTime=0,B.muted=q.muted,B.volume=q.volume,B.playbackRate=q.rate,B.preload=q.preload,!B.paused||B.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as cX}from"child_process";import{lstat as sX,realpath as aX}from"fs/promises";import{join as o5,resolve as iX}from"path";import{promisify as nX}from"util";var rX=nX(cX);async function tX($,J){let Z=await aX($),{stdout:Q}=await rX(o5(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return U.array(U.object({browser:U.string(),directory:U.string(),connected:U.boolean().optional(),source:U.string(),socketPath:U.string().optional(),instanceId:U.string().optional(),extensionId:U.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&iX(Y.source)===o5(Z,"Reason Browser Use","manifest.json"))}async function s2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await tX($,Z)).filter((G)=>G.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await sX(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as oX}from"crypto";function q1($){return`reason-browser-${oX("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var $J=U.discriminatedUnion("ok",[U.object({ok:U.literal(!0),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict(),U.object({ok:U.literal(!1),reason:U.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),JJ=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.string(),extensionInstanceId:U.string(),nativeHostName:U.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function W9($){let J=c0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await JY($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${eX()}`,Y=!1,G=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},V=async(H)=>{if(!a1(J,H.owner))throw Z0();await G()},K=async(H)=>{await V(H);let B=await $.readVideo(H.captureId);try{await G();let q=B.capture;if(!a1(q.context.owner,J)||q.captureId!==H.captureId||q.context.prUrl!==H.prUrl||q.context.headSha!==H.headSha||q.media.contentType!=="video/webm"||q.media.sizeBytes!==H.sizeBytes||q.sha256!==H.sha256||B.bytes.length!==H.sizeBytes||B.bytes.length<128||B.bytes.length>10485760||B.bytes.readUInt32BE(0)!==440786851||e5("sha256").update(B.bytes).digest("hex")!==H.sha256)throw Z0();return B}catch(q){throw B.bytes.fill(0),q}};async function N(H,B,q){await G();let M=await Z.discover(AbortSignal.timeout(5000)),T=new u2({socketPath:M.socketPath,sessionId:X,timeoutMs:5000}),_,j=!1,D,O=new Promise((L,W)=>{D=setTimeout(()=>{j=!0,W(Z0())},60000)});O.catch(()=>{});let F=(L)=>Promise.race([L,O]),z=async()=>{if(j)throw Z0();if(await G(),j)throw Z0()};try{await F(T.connect());let L=JJ.parse(await F(T.client.getInfo()));if(L.metadata.extensionId!==M.extensionId||L.metadata.extensionInstanceId!==M.instanceId||!L.metadata.nativeHostName)throw Z0();await z(),q?.("connected");let W=T.newTab();W.then((I)=>{if(j)I.close().catch(()=>{Y=!0})},()=>{}),_=await F(W),await z(),await F(_.goto(H,{waitUntil:"domcontentloaded",timeoutMs:15000})),await z(),q?.("loaded");let E=await F(B(_,async(I)=>{await z();let C=await F(_.evaluate(`(${t5.toString()})(${JSON.stringify(I)})`,{awaitPromise:!0}));return await z(),C},z));return await z(),E}finally{j=!0,clearTimeout(D);try{if(_){let L;try{await Promise.race([_.close(),new Promise((W,R)=>{L=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(L)}}}catch{throw Y=!0,Z0()}finally{T.close()}await G()}}return{async screenshot(H,B,q){let M=U1.parse(H);if(await V(M),!Number.isSafeInteger(B)||B<1||Date.parse(M.expiresAt)<=Date.now())throw Z0();q.throwIfAborted();let T=await Z.discover(q),_=new u2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),j;try{await _.connect();let D=JJ.parse(await _.client.getInfo());if(D.metadata.extensionId!==T.extensionId||D.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!U.array(U.object({id:U.number()})).max(256).parse(await _.getTabs()).some((z)=>z.id===B))throw Z0();await G(),q.throwIfAborted();let F=U.object({data:U.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.cdp.call(B,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(j=Buffer.from(F.data,"base64"),j.toString("base64")!==F.data||j.length>8388608)throw Z0();if(await G(),q.throwIfAborted(),Date.parse(M.expiresAt)<=Date.now())throw Z0();return j}catch{throw j?.fill(0),Z0()}finally{_.close()}},async verifyImages(H){let B=l2(H);if(B.runId!==J.runId||B.media.some((q)=>q.kind!=="image"))throw Z0();return N("about:blank",async(q,M,T)=>{let _=q.browser.client,j=new Set(B.media.map((I)=>I.sourceUrl)),D=new Map,O=new Set,F=!1,z=0,L=!1,W=new Set,R=(I,C)=>{if(W.size>=32){F=!0;return}let h=_.executeCdp(q.id,I,C);W.add(h),h.catch(()=>{F=!0}).finally(()=>W.delete(h))},E=_.onNotification((I)=>{if(I.method!=="onCDPEvent"||!H$(I.params)||!H$(I.params.source)||I.params.source.tabId!==q.id||!H$(I.params.params))return;let C=I.params.params;if(++z>512){F=!0;return}if(I.params.method==="Fetch.requestPaused"){let y=typeof C.requestId==="string"&&H$(C.request)&&C.request.method==="GET"&&typeof C.request.url==="string"&&j.has(C.request.url)&&C.resourceType==="Image";if(typeof C.requestId!=="string"){F=!0;return}if(!y)F=!0;R(y?"Fetch.continueRequest":"Fetch.failRequest",{requestId:C.requestId,...y?{}:{errorReason:"BlockedByClient"}})}if(I.params.method==="Network.requestWillBeSent"&&C.redirectResponse)F=!0;if(I.params.method==="Network.loadingFailed")F=!0;if(I.params.method==="Network.loadingFinished"&&typeof C.requestId==="string")O.add(C.requestId);if(I.params.method!=="Network.responseReceived")return;if(!H$(C.response)||typeof C.response.url!=="string"||!j.has(C.response.url)||typeof C.requestId!=="string"||!H$(C.response.headers)||C.type!=="Image"){F=!0;return}let h=Object.fromEntries(Object.entries(C.response.headers).map(([y,l])=>[y.toLowerCase(),l])),S=Number(h["content-length"]);if(D.has(C.response.url)||C.response.status!==200||C.response.fromServiceWorker===!0||typeof h["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(h["content-length"])||!Number.isSafeInteger(S)||S>8388608||h["content-range"]||h["content-encoding"]&&h["content-encoding"]!=="identity"){F=!0;return}D.set(C.response.url,{id:C.requestId,length:S})});try{await _.executeCdp(q.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await _.executeCdp(q.id,"Network.setBypassServiceWorker",{bypass:!0}),await _.executeCdp(q.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await _.executeCdp(q.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let I=U.object({frameTree:U.object({frame:U.object({id:U.string().min(1).max(256)})})}).parse(await _.executeCdp(q.id,"Page.getFrameTree",{})),C=[...new Set(B.media.map((y)=>new URL(y.sourceUrl).origin))].join(" ");await _.executeCdp(q.id,"Page.setDocumentContent",{frameId:I.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${C}; style-src 'none'"><body></body>`}),await T(),L=!0;try{await _.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new h0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let h;try{h=await q.evaluate(`(${r5})(${JSON.stringify(B.media)})`,{awaitPromise:!0})}catch{throw new h0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!H$(h)||!Array.isArray(h.items)||h.items.length!==B.media.length)throw Z0();await Promise.all(W);let S=[];for(let y=0;y<B.media.length;y++){await G();let l=D.get(B.media[y].sourceUrl);if(F||!l||!O.has(l.id))throw Z0();let w=U.object({base64Encoded:U.literal(!0),body:U.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await _.executeCdp(q.id,"Network.getResponseBody",{requestId:l.id})),P=Buffer.from(w.body,"base64");try{let x=h.items[y];if(P.length!==l.length||P.toString("base64")!==w.body||!H$(x))throw Z0();S.push({...x,sourceSha256:e5("sha256").update(P).digest("hex")})}finally{P.fill(0)}}if(F)throw Z0();return l5({verified:!0,items:S},B)}finally{if(E(),await Promise.allSettled(W),L)try{await _.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new h0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(H){let B=c1.parse(H);await V(B);let q="browser_unavailable";try{return await N(`https://github.com/${B.repositoryFullName}`,async(M,T)=>{let _=$J.parse(await T({operation:"preflight",expected:{...B,prUrl:`https://github.com/${B.repositoryFullName}`}}));return _9.parse(_.ok?{...B,status:"ready",observedActor:_.actor,checkedAt:new Date().toISOString()}:_.reason==="attachment_unavailable"?{...B,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...B,status:"not_ready",reason:_.reason})},(M)=>{q=M==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return _9.parse({...B,status:"not_ready",reason:"unavailable",cause:q})}},async publish(H){let B=l$.parse(H);if(await V(B),B.expectedActorId!==null&&B.authenticatedActor.id!==B.expectedActorId)throw Z0();let q=Q.get(B.attemptId);if(q){if(!a1(q.binding,B))throw Z0();return structuredClone(q.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let M={binding:structuredClone(B),result:V1.parse({...B,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(B.attemptId,M);let T=!1,_="dispatch";try{(await K(B)).bytes.fill(0),M.result=await N(B.prUrl,async(j,D)=>{let O=$J.parse(await D({operation:"identity",expected:B}));if(!O.ok)return V1.parse({...B,status:"not_attempted",reason:O.reason});let F=await K(B),z;try{T=!0,z=U.discriminatedUnion("dispatched",[U.object({dispatched:U.literal(!0),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict(),U.object({dispatched:U.literal(!1),reason:U.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await D({operation:"upload",expected:B,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!z.dispatched)return T=!1,V1.parse({...B,status:"not_attempted",reason:z.reason});if(!a1(z.actor,O.actor))throw _="actor_changed",Z0();_="result";let L=performance.now();while(performance.now()-L<30000){let W=await D({operation:"upload_result",expected:{...B,observedActor:O.actor}});if(W!==null){let R=U.object({nativeUrl:U.string(),actor:U.object({login:U.string(),id:U.string().nullable()}).strict()}).strict().parse(W);return _="finalize",await G(),V1.parse({...B,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw _="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${_})
+`);M.result=V1.parse({...B,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(M.result)},async verify(H){let B=s1.parse(H);await V(B);try{return(await K(B)).bytes.fill(0),await N(B.prUrl,async(q,M)=>{await q.browser.client.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await M({operation:"saved_player",expected:B});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let _=F9.parse({...B,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(B).some(([j,D])=>!a1(D,_[j])))throw Z0();return _}finally{await q.browser.client.executeCdp(q.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return F9.parse({...B,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function JY($,J){let Z=await $Y($);return{async discover(Q){let X=await s2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:q1(J.runId)}}import{realpath as DY}from"fs/promises";var CH=U.object({version:U.literal(1),recording_operation_id:U.string().uuid(),proof_ready:U.literal(!1),acknowledged_at:U.iso.datetime()}).strict(),a2=U.object({action:U.literal("start"),request_id:U.string().uuid(),profile:U.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:U.number().int().positive(),seconds:U.number().int().min(1).max(15)}).strict(),ZJ=U.object({action:U.literal("inspect"),recording_operation_id:U.string().uuid()}).strict(),PH=U.discriminatedUnion("action",[a2,ZJ]),QJ=U.object({recording_operation_id:U.string().uuid()}).strict(),D9={device_id:U.string().uuid(),root_id:U.string().uuid()},ZY=U.discriminatedUnion("action",[a2.extend(D9),ZJ.extend(D9),QJ.extend({...D9,action:U.literal("stop")})]),EH=U.toJSONSchema(ZY),xH=U.object({version:U.literal(1),recordingId:U.string().uuid(),proofReady:U.literal(!1),capture:U.object({captureId:U.string().uuid(),contentType:U.literal("video/webm"),sha256:U.string().regex(/^[a-f0-9]{64}$/),sizeBytes:U.number().int().min(128).max(10485760),startedAt:U.iso.datetime(),finishedAt:U.iso.datetime(),durationSeconds:U.number().min(0.05).max(15),frameCount:U.number().int().min(1).max(450),receivedFrameCount:U.number().int().min(1).max(2000),owner:U.object({runId:U.string().uuid(),deviceId:U.string().uuid(),rootId:U.string().uuid(),rootRevision:U.string().max(64),profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:U.string().min(1).max(1024),generation:U.string().uuid(),browserScope:U.string().max(128),tabId:U.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var gH=a2.extend({action:U.enum(["start","inspect"]),recording_boot_generation:U.string().uuid(),recording_operation_id:U.string().uuid().optional(),recording_attempt_id:U.string().uuid().optional()}).strict();import{createHash as qY,randomUUID as HY}from"crypto";import{mkdtemp as MY,realpath as TY,rm as NJ}from"fs/promises";import{tmpdir as _Y}from"os";import{join as FY}from"path";import{spawn as LY}from"child_process";import{isDeepStrictEqual as jY}from"util";import{createHash as QY}from"crypto";import{execFile as XY}from"child_process";import{chmod as YY,lstat as YJ,mkdtemp as GY,readFile as GJ,realpath as KJ,rm as KY,writeFile as XJ}from"fs/promises";import{tmpdir as BY}from"os";import{isAbsolute as UY,join as i2}from"path";import{promisify as VY}from"util";var O9=VY(XY),NY=($)=>QY("sha256").update($).digest("hex");async function J$($){if(!UY($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await KJ($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await YJ($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||NY(await GJ($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function i1($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([J$(Z.ffmpeg),J$(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([J$(Z.ffmpeg),J$(Z.ffprobe)]);let G=await KJ(await GY(i2(J??BY(),"reason-owned-recording-")));await YY(G,448);let V=i2(G,"capture.webm"),K="frames";try{let N=["ffconcat version 1.0"];for(let[j,D]of Q.entries()){let O=`${j}.jpg`;await XJ(i2(G,O),D.jpeg,{mode:384,flag:"wx"});let F=Q[j+1]?.timestamp??Q[0].timestamp+X;N.push(`file '${O}'`,`duration ${Math.max(0.001,F-D.timestamp).toFixed(6)}`)}N.push(`file '${Q.length-1}.jpg'`),await XJ(i2(G,"frames.ffconcat"),N.join(`
 `)+`
-`,{mode:384,flag:"wx"});let H={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await D9(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],H),K="output";let B=await ZJ(V);if(!B.isFile()||B.isSymbolicLink()||B.nlink!==1||B.size<128||B.size>10485760)throw Error();K="probe";let{stdout:q}=await D9(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],H),M=JSON.parse(q),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await D9(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],H),K="pin",await Promise.all([o0(Z.ffmpeg),o0(Z.ffprobe)]),await QJ(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await QY(G,{recursive:!0,force:!0})}}}}var GJ=U.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var e0=U.string().min(1).max(1024),YJ=U.object({path:e0,sha256:U.string().regex(/^[a-f0-9]{64}$/)}).strict(),KJ=U.object({owner:U.object({runId:e0,deviceId:e0,rootId:e0,rootRevision:e0,profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:e0,generation:e0,browserScope:e0,tabId:U.number().int().positive()}).strict(),socketPath:e0,extensionId:U.string().regex(/^[a-p]{32}$/),nativeHostName:e0,seconds:U.number().int().min(1).max(15),encoder:U.object({ffmpeg:YJ,ffprobe:YJ}).strict()}).strict();var _Y=15728640,A$=()=>Error("mac_recording_worker_failed");function UJ($){let J=KJ.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,V=async()=>{},K=async(q,M=3000)=>{let T;try{return await Promise.race([q,new Promise((_,j)=>{T=setTimeout(()=>j(A$()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((q)=>{X=!0;let M=q&&typeof q==="object"&&"code"in q?q.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),H=null,B=async()=>{if(X)throw A$();if(await K($.assertCurrent()),X)throw A$()};return{async start(){if(Y||H)throw Error("mac_recording_already_active");Y=!0;try{await B(),await o0({path:Z.path,sha256:Z.sha256}),await B(),G=null;let q=await NY(await VY(HY(qY(),"reason-recording-host-")));try{await B()}catch(P){throw await BJ(q,{recursive:!0,force:!0}),P}let M=MY(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((P)=>M.once("close",()=>P())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(P){if(P.code!=="ESRCH")throw P}},j=null;V=()=>j??=(async()=>{try{_()}catch(P){if(P.code!=="EPERM")throw P}await T;try{for(let P=0;;P++)try{_();break}catch(x){if(x.code!=="EPERM"||P>=20)throw x;await new Promise((A)=>setTimeout(A,25))}}finally{await BJ(q,{recursive:!0,force:!0})}})();let D="",O=0,F=!1,z=!1,L=null,W,R,E=new Promise((P,x)=>{W=P,R=x}),I,C,h=new Promise((P,x)=>{I=P,C=x});h.catch(()=>{});let S=(P=A$())=>{if(F)return;F=!0,clearTimeout(y),clearInterval(k),N().then(()=>{R(P),C(P)},(x)=>{R(x),C(x)})},y=setTimeout(()=>S(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||F)return;l=!0,B().catch(()=>S()).finally(()=>{l=!1})},250);H={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
-`)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(P)=>{if(F)return;if(O+=P.length,O>_Y){S();return}D+=P.toString("utf8");let x;while((x=D.indexOf(`
-`))!==-1){let A=D.slice(0,x);D=D.slice(x+1);try{let w=JSON.parse(A);if(w.type==="failed"&&Object.keys(w).sort().join(",")==="reason,type"){let o=GJ.safeParse(w.reason);S(o.success?Error(`mac_recording_worker_failed:${o.data}`):A$());return}if(w.type==="unsupported"&&!z){S(Error("mac_recording_encoder_unavailable"));return}if(w.type==="started"&&!z&&Object.keys(w).length===1){z=!0,W({recording:!0});continue}if(!z||w.type!=="capture"||L||Object.keys(w).sort().join(",")!=="bytes,capture,type")throw A$();let b=w.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!TY(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof w.bytes!=="string"||w.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(w.bytes))throw A$();let n=Buffer.from(w.bytes,"base64");if(n.length!==b.sizeBytes||BY("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw A$();L={capture:Object.freeze({...b,captureId:UY(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(P)=>{if(F)return;if(P!==0||!L||D.trim()){S();return}let x=L;B().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(y),clearInterval(k),Q.set(x.capture.captureId,x);while(Q.size>2)Q.delete(Q.keys().next().value);I(x.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:q})+`
-`);try{return await E}catch(P){throw H=null,P}}finally{Y=!1}},async completed(){if(await B(),!H)throw Error("mac_recording_not_active");return H.completion},async stop(){await B();let q=H;if(!q)throw Error("mac_recording_not_started");q.stop();try{return await q.completion}finally{if(H===q)H=null}},async read(q){await B();let M=Q.get(q);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let q=H;q?.cancel(),Q.clear();try{await N(),await q?.completion.catch(()=>{})}finally{H=null}}}}var VJ=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.string(),extensionInstanceId:U.string(),nativeHostName:U.string()})});async function O9($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await FY($.automationDirectory);J=(Q,X)=>l2(Z,Q,X)}if(await o0({path:$.worker.path,sha256:$.worker.sha256}),!await i1($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),V=new z$({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=VJ.parse(await V.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!U.array(U.object({id:U.number()})).parse(await V.getTabs()).some((H)=>H.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:G.instanceId,async createHost(N,H,B){let q=new z$({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return UJ({worker:$.worker,configuration:{owner:N.browser,seconds:H,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){B.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await q.connect();let T=VJ.parse(await q.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await q.executeCdp(Q,"Page.stopScreencast",{})}finally{q.close()}}})}}}}var O0=()=>Error("mac_pr_proof_unavailable"),WY=U.object({operationId:U.string().uuid()}).strict();function qJ($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=U.array(U.object({profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:U.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!U.string().uuid().safeParse($.generation).success||new Set(Z.map((q)=>q.profile)).size!==Z.length)throw O0();if(!$.qualifiedProfiles){let q=new URL($.uploadOrigin);if(!$.resolveBrowser||q.protocol!=="https:"||q.origin!==$.uploadOrigin||q.username||q.password)throw O0()}let Q=new Map,X=new Map,Y=new Map,G=!1,V=new LY,K=async(q)=>{let M=V.getStore();if(G||!q&&!M)throw O0();if(M?.signal.throwIfAborted(),await $.assertCurrent(q??M.claim),G)throw O0();M?.signal.throwIfAborted()},N=(q,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(q.capability!==H9||!q.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==q.owner.organization_id||T.userId!==q.owner.user_id||T.deviceId!==q.owner.device_id||T.rootId!==q.root_id||T.runId!==q.run_id)throw O0();return T},H=async(q)=>{await K();let M=JSON.stringify([q.runId,q.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw O0();T=(async()=>{let j,D=$.browserScope?.(q)??V1(q.runId),O=await $.createBrowser({owner:q,assertCurrent:()=>K(),readVideo:(F)=>j.publicationCapture(F)});if(j=s5({owner:q,browserScope:D,assertCurrent:()=>K(),screenshot:O.screenshot,async createVideo(F,z,L,W){if(!$.resolveBrowser)throw O0();let R=await $.resolveBrowser(q.profile,z,D,W);if(R.extensionInstanceId!==q.extensionInstanceId)throw O0();return R.createHost({organizationId:q.organizationId,userId:q.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:q.runId,deviceId:q.deviceId,rootId:q.rootId,rootRevision:q.rootRevision,generation:q.generation,profile:q.profile,extensionInstanceId:q.extensionInstanceId,browserScope:D,tabId:z}},L,W)}}),G)throw O.close(),await j.close(),O0();return{owner:structuredClone(q),browser:O,capture:j,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!NJ(_.owner,q)||_.expiresAt<=Date.now())throw O0();return _},B=setInterval(()=>{for(let[q,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(q)===M)Q.delete(q)}).catch(()=>{G=!0})},1000);return B.unref(),{generation:$.generation,async execute(q,M,T){return V.run({claim:q,signal:M},async()=>{let _=F9.parse(q.payload).command,j=N(q,_);if(await K(q),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let D=await H(j),O=async()=>{await K(q),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await D.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw O0();F=await D.capture.prepare(_.context);break;case"capture_png":F=await D.capture.screenshot({claim:{operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let z={runtime:D,contextId:_.contextId,attemptId:q.attempt_id,tabId:_.tabId,signal:M};if(X.has(q.operation_id))throw O0();X.set(q.operation_id,z);try{F=await D.capture.record({claim:{operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await O(),await T({version:1,operationId:q.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(q.operation_id)}break}case"inspect_capture":F=await D.capture.inspect(_.captureId);break;case"publish_video":F=await D.browser.publish(_.input);break;case"verify_saved_media":F=await D.browser.verify(_.input);break;case"verify_png_media":F=await D.browser.verifyImages(_.media);break;case"publish_png":{let z=`${j.runId}:${_.attemptId}`,L=Y.get(z);if(L){if(!NJ(L.request,_))throw O0();F=L.result;break}if(Y.size>=16)throw O0();let W=new URL(_.uploadUrl);if(W.protocol!=="https:"||W.username||W.password||W.hash||W.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${j.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw O0();let R=await D.capture.publicationCapture(_.captureId);try{if(W.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||jY("sha256").update(R.bytes).digest("hex")!==_.sha256)throw O0();await O();let E={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(z,E);try{let I=await fetch(W,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await I.body?.cancel(),await O(),I.ok)E.result={...E.result,status:"uploaded"}}catch{}F=E.result}finally{R.bytes.fill(0)}break}}return await O(),structuredClone(F)})},async control(q,M){if(q.capability!==H9||M.kind!==p5)return!1;let T=WY.safeParse(M.payload),_=X.get(q.operation_id);if(!T.success||T.data.operationId!==q.operation_id||!_||_.attemptId!==q.attempt_id)return!1;let j=F9.parse(q.payload).command;return N(q,j),await K(q),await V.run({claim:q,signal:_.signal},()=>_.runtime.capture.stop({operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(B);let q=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),q.some((M)=>M.status==="rejected"))throw O0()}}}var PY="__browser-recorder",EY=CY(DY),xY="/tmp/open-browser-use",SY=33554432,bY=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.literal(s2),extensionInstanceId:U.string().min(1).max(1024)})}),MJ=()=>Error("worker_pr_proof_browser_unavailable"),I9={components:l1,ensureBrowser:LJ,socketDirectory:xY,async identity($){let J=new z$({socketPath:$,sessionId:`reason-proof-qualification-${R9()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function TJ($,J=I9){let Z=J.components();if(!Z?.features.browser)throw MJ();await J.ensureBrowser(Z),$.throwIfAborted();let Q=z9(jJ(Z),"Default","Local Extension Settings",s2),X=(await HJ(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>z9(Q,Y));for(let Y of(await HJ(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=z9(J.socketDirectory,Y);try{let V=await zY(G);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=bY.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await RY(N)).size<=SY&&(await WJ(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:s2}}catch{}}throw MJ()}async function A9($){let J=await AY($);return{path:J,sha256:OY("sha256").update(await WJ(J)).digest("hex")}}async function DJ($={}){let J={...I9,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await A9(Z.ffmpeg),{stdout:X}=await EY(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await A9(Z.ffprobe)};if(!await i1(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...IY(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],PY]};return{worker:{...await A9(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function OJ($,J={}){let Z={...I9,...J},Q=R9(),X=R9(),Y=_J.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?FJ.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(B)=>h5(B.organizationId,B.sessionId,B.deviceId,1),K=$.recording,N,H=qJ({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(B,q,M,T)=>{N??=O9({...K,assertCurrent:()=>$.assertCurrent(),discover:(j,D)=>TJ(D,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(B,q,M,T);return{extensionInstanceId:X,createHost:async(j,D,O)=>wY(await _.createHost({...j,browser:{...j.browser,extensionInstanceId:_.extensionInstanceId}},D,O),X)}}}:{},createBrowser:(B)=>j9({...B,endpoint:(q)=>({discover:(M)=>TJ(M,Z),tabScope:V(q)})})});return{capability:G,broker:H}}function wY($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as rY}from"child_process";import{execFile as kY}from"child_process";import{readFile as yY}from"fs/promises";import{join as i0}from"path";var fY="Claude Code-credentials",hY="/usr/bin/security",mY=120000,vY=8192,a2={exec:($,J,Z)=>new Promise((Q)=>{kY($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await yY($,"utf8")}catch{return null}}};function N1($){return typeof $==="string"&&$.length>0&&$.length<=vY?$:null}function gY($,J){return $.CLAUDE_CONFIG_DIR||i0(J,".claude")}function uY($,J){return $.CODEX_HOME||i0(J,".codex")}function zJ($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=N1(J?.accessToken),Q=N1(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function dY($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function lY($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=N1(J.tokens?.access_token),Q=N1(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:dY(Z)??Date.now()}}catch{return null}}function pY($,J){return i0($.XDG_DATA_HOME||i0(J,".local","share"),"opencode","auth.json")}var cY={anthropic:"anthropic",openai:"openai-codex"};function sY($){return CJ($,cY)}function CJ($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let V=N1(G.access),K=N1(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function aY($){return CJ($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function iY($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?i0(J,Z.slice(2)):Z||i0(J,".pi","agent")}async function PJ($,J,Z=a2){let Q=[],X=await Z.exec(hY,["find-generic-password","-s",fY,"-w"],mY),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((H)=>H.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?zJ(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(zJ(await Z.readText(i0(gY($,J),".credentials.json"))));let V=lY(await Z.readText(i0(uY($,J),"auth.json")));G(V),G(nY(await Z.readText(i0($.GROK_HOME||i0(J,".grok"),"auth.json"))));for(let K of sY(await Z.readText(pY($,J))))G(K);for(let K of aY(await Z.readText(i0(iY($,J),"auth.json"))))G(K);return Q}function EJ($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var AJ="https://auth.x.ai",RJ="b1a00492-073a-47ea-816f-4c329264a828",IJ=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function nY($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${AJ}::${RJ}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==AJ||Q.oidc_client_id!==RJ||!IJ(Q.key)||!IJ(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var xJ=330000,tY=300000,oY=60000;function eY($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+xJ)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function $G($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*xJ)?oY:tY}var JG=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function SJ($){let J=new Map,Z=$.wait??JG,Q=$.stores??(process.platform==="darwin"?a2:{...a2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=EJ(await PJ($.environment??process.env,$.home,Q));for(let Y of eY(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z($G(J),$.signal)}}function bJ($=process.env){return new Promise((J)=>{rY("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as ZG,spawn as QT,spawnSync as XT}from"child_process";import{chmodSync as GT,existsSync as QG,mkdirSync as KT,readFileSync as BT,renameSync as UT,rmSync as VT,statSync as NT,writeFileSync as qT}from"fs";import{dirname as MT,isAbsolute as TT,join as C9}from"path";var wJ=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function kJ($,J){if(!wJ.test($)||!wJ.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var XG="com.reasonmachines.updater",YG=["so.ara.updater","so.reason.updater"];function GG($){let J=$==="staging"?".staging":"";return{label:`${XG}${J}`,legacyLabels:[...YG].reverse().map((Z)=>`${Z}${J}`)}}function KG($,J,Z){return{launchAgent:C9(J,"Library","LaunchAgents",`${$}.plist`),systemdService:C9(Z,"systemd","user",`${$}.service`),systemdTimer:C9(Z,"systemd","user",`${$}.timer`)}}function BG($,J){return new Promise((Z)=>{ZG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function hJ($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??B0(),{label:X,legacyLabels:Y}=GG($.channel),G=$.configHome??fJ(Q),V=[X,...Y].filter((B)=>{let q=KG(B,Q,G);return QG(J==="darwin"?q.launchAgent:q.systemdService)});if(V.length===0)return"absent";let K=$.command??BG,N=V[0];if(V.length>1){for(let B of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${B}`]):await K("systemctl",["--user","is-enabled",`${B}.timer`]))===0){N=B;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var yJ=60000;function mJ($){let J=(X,Y)=>{try{return kJ(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(yJ-1,Math.floor(G*yJ)))}}var UG=30000;async function vJ($){return($.flush??n4)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(UG);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof T0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var uJ=25000,NG=5000,qG=600000,HG=["display.stream.v1","pty.start"],MG=64;function x9($,J,Z=b9($),Q){return v0(),Q6(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var dJ=5000,TG=600000;function _G($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[p$])return null;try{return W2({platform:J})}catch{return null}}function FG($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function LG($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=B9();if(Z.length>0)k1($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)k1($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function t1($,J,Z,Q,X={}){if(v0(),$.executionMode==="host")r1();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?J6():Promise.resolve(!1),H=rJ(),B=X.prestartedReadiness??d1($,X.readinessProbes,V,J.roots[0].permissions),q=X.deferOptionalLanes===!0,M=await(q?B.initial:B.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??bJ)().catch(()=>!1):null,j=new AbortController,D=null,O=async(f,a)=>{let i=($.userChrome??X.ownComputer===!0)&&f["automation.call.v1"]===!0?$6():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
-`);let K0=b9($,f,{displayVideo:f["display.stream.v1"]===!0&&await N(),handsBrowser:f["hands.connect"]===!0&&H,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:f["pty.start"]===!0&&h2(),probing:a,ownComputer:X.ownComputer===!0});if(!D&&K0.worker.readiness?.["browser.pr-proof.v1"]===!0){let z0=await DJ();if(D||j.signal.aborted)return K0;process.stderr.write("error"in z0?`Reason worker: PR video proof unavailable (${z0.error})
+`,{mode:384,flag:"wx"});let H={cwd:G,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};K="encode",await O9(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",V],H),K="output";let B=await YJ(V);if(!B.isFile()||B.isSymbolicLink()||B.nlink!==1||B.size<128||B.size>10485760)throw Error();K="probe";let{stdout:q}=await O9(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",V],H),M=JSON.parse(q),T=M.streams,_=Number(M.format?.duration);if(K="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(K="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(K="probe_duration",!Number.isFinite(_)||Math.abs(_-X)>0.25)throw Error();if(K="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(K="probe_format",M.format?.format_name!=="matroska,webm")throw Error();return K="decode",await O9(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",V,"-f","null","-"],H),K="pin",await Promise.all([J$(Z.ffmpeg),J$(Z.ffprobe)]),await GJ(V)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${K}_failed`)}finally{await KY(G,{recursive:!0,force:!0})}}}}var UJ=U.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var Z$=U.string().min(1).max(1024),BJ=U.object({path:Z$,sha256:U.string().regex(/^[a-f0-9]{64}$/)}).strict(),VJ=U.object({owner:U.object({runId:Z$,deviceId:Z$,rootId:Z$,rootRevision:Z$,profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:Z$,generation:Z$,browserScope:Z$,tabId:U.number().int().positive()}).strict(),socketPath:Z$,extensionId:U.string().regex(/^[a-p]{32}$/),nativeHostName:Z$,seconds:U.number().int().min(1).max(15),encoder:U.object({ffmpeg:BJ,ffprobe:BJ}).strict()}).strict();var WY=15728640,R$=()=>Error("mac_recording_worker_failed");function qJ($){let J=VJ.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,G=null,V=async()=>{},K=async(q,M=3000)=>{let T;try{return await Promise.race([q,new Promise((_,j)=>{T=setTimeout(()=>j(R$()),M)})])}finally{clearTimeout(T)}},N=()=>G??=K((async()=>{let M=(await Promise.allSettled([V(),$.cleanup()])).find((T)=>T.status==="rejected");if(M?.status==="rejected")throw M.reason})(),5000).catch((q)=>{X=!0;let M=q&&typeof q==="object"&&"code"in q?q.code:null,T=typeof M==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(M)?M:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),H=null,B=async()=>{if(X)throw R$();if(await K($.assertCurrent()),X)throw R$()};return{async start(){if(Y||H)throw Error("mac_recording_already_active");Y=!0;try{await B(),await J$({path:Z.path,sha256:Z.sha256}),await B(),G=null;let q=await TY(await MY(FY(_Y(),"reason-recording-host-")));try{await B()}catch(P){throw await NJ(q,{recursive:!0,force:!0}),P}let M=LY(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((P)=>M.once("close",()=>P())),_=()=>{if(M.pid)try{process.kill(-M.pid,"SIGKILL")}catch(P){if(P.code!=="ESRCH")throw P}},j=null;V=()=>j??=(async()=>{try{_()}catch(P){if(P.code!=="EPERM")throw P}await T;try{for(let P=0;;P++)try{_();break}catch(x){if(x.code!=="EPERM"||P>=20)throw x;await new Promise((A)=>setTimeout(A,25))}}finally{await NJ(q,{recursive:!0,force:!0})}})();let D="",O=0,F=!1,z=!1,L=null,W,R,E=new Promise((P,x)=>{W=P,R=x}),I,C,h=new Promise((P,x)=>{I=P,C=x});h.catch(()=>{});let S=(P=R$())=>{if(F)return;F=!0,clearTimeout(y),clearInterval(w),N().then(()=>{R(P),C(P)},(x)=>{R(x),C(x)})},y=setTimeout(()=>S(),(J.seconds+25)*1000),l=!1,w=setInterval(()=>{if(l||F)return;l=!0,B().catch(()=>S()).finally(()=>{l=!1})},250);H={completion:h,stop:()=>{if(!F)M.stdin.write(`{"type":"stop"}
+`)},cancel:()=>S()},M.on("error",()=>S()),M.stdin.on("error",()=>S()),M.stdout.on("data",(P)=>{if(F)return;if(O+=P.length,O>WY){S();return}D+=P.toString("utf8");let x;while((x=D.indexOf(`
+`))!==-1){let A=D.slice(0,x);D=D.slice(x+1);try{let k=JSON.parse(A);if(k.type==="failed"&&Object.keys(k).sort().join(",")==="reason,type"){let r=UJ.safeParse(k.reason);S(r.success?Error(`mac_recording_worker_failed:${r.data}`):R$());return}if(k.type==="unsupported"&&!z){S(Error("mac_recording_encoder_unavailable"));return}if(k.type==="started"&&!z&&Object.keys(k).length===1){z=!0,W({recording:!0});continue}if(!z||k.type!=="capture"||L||Object.keys(k).sort().join(",")!=="bytes,capture,type")throw R$();let b=k.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!jY(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof k.bytes!=="string"||k.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(k.bytes))throw R$();let n=Buffer.from(k.bytes,"base64");if(n.length!==b.sizeBytes||qY("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw R$();L={capture:Object.freeze({...b,captureId:HY(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),M.once("close",(P)=>{if(F)return;if(P!==0||!L||D.trim()){S();return}let x=L;B().then(async()=>{if(await V(),F)return;F=!0,clearTimeout(y),clearInterval(w),Q.set(x.capture.captureId,x);while(Q.size>2)Q.delete(Q.keys().next().value);I(x.capture)}).catch(()=>S())}),M.stdin.write(JSON.stringify({...J,scratchDirectory:q})+`
+`);try{return await E}catch(P){throw H=null,P}}finally{Y=!1}},async completed(){if(await B(),!H)throw Error("mac_recording_not_active");return H.completion},async stop(){await B();let q=H;if(!q)throw Error("mac_recording_not_started");q.stop();try{return await q.completion}finally{if(H===q)H=null}},async read(q){await B();let M=Q.get(q);if(!M)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(M.capture),bytes:Buffer.from(M.bytes)}},async close(){if(X)return;X=!0;let q=H;q?.cancel(),Q.clear();try{await N(),await q?.completion.catch(()=>{})}finally{H=null}}}}var HJ=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.string(),extensionInstanceId:U.string(),nativeHostName:U.string()})});async function z9($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await DY($.automationDirectory);J=(Q,X)=>s2(Z,Q,X)}if(await J$({path:$.worker.path,sha256:$.worker.sha256}),!await i1($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let G=await J(Z,Y),V=new A$({socketPath:G.socketPath,sessionId:X,timeoutMs:2000}),K;try{if(await V.connect(),K=HJ.parse(await V.getInfo()),K.metadata.extensionId!==G.extensionId||K.metadata.extensionInstanceId!==G.instanceId)throw Error("mac_recording_profile_changed");if(!U.array(U.object({id:U.number()})).parse(await V.getTabs()).some((H)=>H.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{V.close()}return{extensionInstanceId:G.instanceId,async createHost(N,H,B){let q=new A$({socketPath:G.socketPath,sessionId:N.browser.browserScope,timeoutMs:2000});return qJ({worker:$.worker,configuration:{owner:N.browser,seconds:H,encoder:$.encoder,socketPath:G.socketPath,extensionId:G.extensionId,nativeHostName:K.metadata.nativeHostName},async assertCurrent(){B.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await q.connect();let T=HJ.parse(await q.getInfo());if(T.metadata.extensionInstanceId!==N.browser.extensionInstanceId||T.metadata.extensionId!==G.extensionId||T.metadata.nativeHostName!==K.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await q.executeCdp(Q,"Page.stopScreencast",{})}finally{q.close()}}})}}}}var O0=()=>Error("mac_pr_proof_unavailable"),AY=U.object({operationId:U.string().uuid()}).strict();function TJ($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=U.array(U.object({profile:U.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:U.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!U.string().uuid().safeParse($.generation).success||new Set(Z.map((q)=>q.profile)).size!==Z.length)throw O0();if(!$.qualifiedProfiles){let q=new URL($.uploadOrigin);if(!$.resolveBrowser||q.protocol!=="https:"||q.origin!==$.uploadOrigin||q.username||q.password)throw O0()}let Q=new Map,X=new Map,Y=new Map,G=!1,V=new OY,K=async(q)=>{let M=V.getStore();if(G||!q&&!M)throw O0();if(M?.signal.throwIfAborted(),await $.assertCurrent(q??M.claim),G)throw O0();M?.signal.throwIfAborted()},N=(q,M)=>{let T="owner"in M?M.owner:("context"in M)?M.context.owner:M.input.owner;if(q.capability!==M9||!q.owner||T.generation!==$.generation||!Z.some((_)=>_.profile===T.profile&&_.extension_instance_id===T.extensionInstanceId)||T.organizationId!==q.owner.organization_id||T.userId!==q.owner.user_id||T.deviceId!==q.owner.device_id||T.rootId!==q.root_id||T.runId!==q.run_id)throw O0();return T},H=async(q)=>{await K();let M=JSON.stringify([q.runId,q.profile]),T=Q.get(M);if(!T){if(Q.size>=4)throw O0();T=(async()=>{let j,D=$.browserScope?.(q)??q1(q.runId),O=await $.createBrowser({owner:q,assertCurrent:()=>K(),readVideo:(F)=>j.publicationCapture(F)});if(j=n5({owner:q,browserScope:D,assertCurrent:()=>K(),screenshot:O.screenshot,async createVideo(F,z,L,W){if(!$.resolveBrowser)throw O0();let R=await $.resolveBrowser(q.profile,z,D,W);if(R.extensionInstanceId!==q.extensionInstanceId)throw O0();return R.createHost({organizationId:q.organizationId,userId:q.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:q.runId,deviceId:q.deviceId,rootId:q.rootId,rootRevision:q.rootRevision,generation:q.generation,profile:q.profile,extensionInstanceId:q.extensionInstanceId,browserScope:D,tabId:z}},L,W)}}),G)throw O.close(),await j.close(),O0();return{owner:structuredClone(q),browser:O,capture:j,expiresAt:Date.now()+300000}})(),Q.set(M,T)}let _=await T;if(!MJ(_.owner,q)||_.expiresAt<=Date.now())throw O0();return _},B=setInterval(()=>{for(let[q,M]of Q)M.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((_)=>_.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(q)===M)Q.delete(q)}).catch(()=>{G=!0})},1000);return B.unref(),{generation:$.generation,async execute(q,M,T){return V.run({claim:q,signal:M},async()=>{let _=L9.parse(q.payload).command,j=N(q,_);if(await K(q),M.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(_.action==="prepare"?_.context.evidenceKind!=="image"||Boolean(_.context.visualPlan)||!_.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(_.action)))throw Error("proof_png_only");let D=await H(j),O=async()=>{await K(q),M.throwIfAborted()},F;switch(_.action){case"auth_check":F=await D.browser.preflight(_.input);break;case"prepare":if(_.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!_.context.uploadOrigin)throw O0();F=await D.capture.prepare(_.context);break;case"capture_png":F=await D.capture.screenshot({claim:{operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M});break;case"start_video":{let z={runtime:D,contextId:_.contextId,attemptId:q.attempt_id,tabId:_.tabId,signal:M};if(X.has(q.operation_id))throw O0();X.set(q.operation_id,z);try{F=await D.capture.record({claim:{operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId},signal:M,seconds:_.seconds,started:async()=>{await O(),await T({version:1,operationId:q.operation_id,contextId:_.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(q.operation_id)}break}case"inspect_capture":F=await D.capture.inspect(_.captureId);break;case"publish_video":F=await D.browser.publish(_.input);break;case"verify_saved_media":F=await D.browser.verify(_.input);break;case"verify_png_media":F=await D.browser.verifyImages(_.media);break;case"publish_png":{let z=`${j.runId}:${_.attemptId}`,L=Y.get(z);if(L){if(!MJ(L.request,_))throw O0();F=L.result;break}if(Y.size>=16)throw O0();let W=new URL(_.uploadUrl);if(W.protocol!=="https:"||W.username||W.password||W.hash||W.pathname!==`/${_.storagePath}`||!_.storagePath.startsWith(`pr-screenshots/${j.runId}/${_.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(_.storagePath.split("/").at(-1))||_.storagePath.split("/").length!==4)throw O0();let R=await D.capture.publicationCapture(_.captureId);try{if(W.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==_.sha256||R.bytes.length!==_.sizeBytes||zY("sha256").update(R.bytes).digest("hex")!==_.sha256)throw O0();await O();let E={request:structuredClone(_),result:{status:"uncertain",sha256:_.sha256,sizeBytes:_.sizeBytes}};Y.set(z,E);try{let I=await fetch(W,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([M,AbortSignal.timeout(20000)])});if(await I.body?.cancel(),await O(),I.ok)E.result={...E.result,status:"uploaded"}}catch{}F=E.result}finally{R.bytes.fill(0)}break}}return await O(),structuredClone(F)})},async control(q,M){if(q.capability!==M9||M.kind!==a5)return!1;let T=AY.safeParse(M.payload),_=X.get(q.operation_id);if(!T.success||T.data.operationId!==q.operation_id||!_||_.attemptId!==q.attempt_id)return!1;let j=L9.parse(q.payload).command;return N(q,j),await K(q),await V.run({claim:q,signal:_.signal},()=>_.runtime.capture.stop({operationId:q.operation_id,attemptId:q.attempt_id,contextId:_.contextId,tabId:_.tabId})),!0},async close(){G=!0,clearInterval(B);let q=await Promise.allSettled([...Q.values()].map(async(M)=>{let T=await M;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),q.some((M)=>M.status==="rejected"))throw O0()}}}var bY="__browser-recorder",wY=SY(RY),kY="/tmp/open-browser-use",yY=33554432,fY=U.object({version:U.literal("0.1.42"),metadata:U.object({extensionId:U.literal(n2),extensionInstanceId:U.string().min(1).max(1024)})}),FJ=()=>Error("worker_pr_proof_browser_unavailable"),C9={components:l1,ensureBrowser:DJ,socketDirectory:kY,async identity($){let J=new A$({socketPath:$,sessionId:`reason-proof-qualification-${I9()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function LJ($,J=C9){let Z=J.components();if(!Z?.features.browser)throw FJ();await J.ensureBrowser(Z),$.throwIfAborted();let Q=A9(OJ(Z),"Default","Local Extension Settings",n2),X=(await _J(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>A9(Q,Y));for(let Y of(await _J(J.socketDirectory)).filter((G)=>G.endsWith(".sock"))){$.throwIfAborted();let G=A9(J.socketDirectory,Y);try{let V=await CY(G);if(!V.isSocket()||V.uid!==process.getuid?.())continue;let K=fY.parse(await J.identity(G)).metadata.extensionInstanceId;for(let N of X)if((await EY(N)).size<=yY&&(await zJ(N)).includes(K))return{socketPath:G,instanceId:K,extensionId:n2}}catch{}}throw FJ()}async function R9($){let J=await PY($);return{path:J,sha256:IY("sha256").update(await zJ(J)).digest("hex")}}async function AJ($={}){let J={...C9,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await R9(Z.ffmpeg),{stdout:X}=await wY(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await R9(Z.ffprobe)};if(!await i1(Y))return{error:"worker_recording_encoder_unqualified"};let G=$.recorder??{path:process.execPath,args:[...xY(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],bY]};return{worker:{...await R9(G.path),args:G.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function RJ($,J={}){let Z={...C9,...J},Q=I9(),X=I9(),Y=jJ.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),G=$.recording?WJ.parse({...Y,version:3,video:!0,max_seconds:15}):Y,V=(B)=>g5(B.organizationId,B.sessionId,B.deviceId,1),K=$.recording,N,H=TJ({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:V,...K?{resolveBrowser:async(B,q,M,T)=>{N??=z9({...K,assertCurrent:()=>$.assertCurrent(),discover:(j,D)=>LJ(D,Z)}),N.catch(()=>{N=void 0});let _=await(await N)(B,q,M,T);return{extensionInstanceId:X,createHost:async(j,D,O)=>hY(await _.createHost({...j,browser:{...j.browser,extensionInstanceId:_.extensionInstanceId}},D,O),X)}}}:{},createBrowser:(B)=>W9({...B,endpoint:(q)=>({discover:(M)=>LJ(M,Z),tabScope:V(q)})})});return{capability:G,broker:H}}function hY($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as $G}from"child_process";import{execFile as mY}from"child_process";import{readFile as vY}from"fs/promises";import{join as t0}from"path";var gY="Claude Code-credentials",uY="/usr/bin/security",dY=120000,lY=8192,r2={exec:($,J,Z)=>new Promise((Q)=>{mY($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let G=X?typeof X.code==="number"?X.code:1:0;Q({code:G,stdout:String(Y??"")})})}),readText:async($)=>{try{return await vY($,"utf8")}catch{return null}}};function H1($){return typeof $==="string"&&$.length>0&&$.length<=lY?$:null}function pY($,J){return $.CLAUDE_CONFIG_DIR||t0(J,".claude")}function cY($,J){return $.CODEX_HOME||t0(J,".codex")}function IJ($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=H1(J?.accessToken),Q=H1(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function sY($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function aY($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=H1(J.tokens?.access_token),Q=H1(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:sY(Z)??Date.now()}}catch{return null}}function iY($,J){return t0($.XDG_DATA_HOME||t0(J,".local","share"),"opencode","auth.json")}var nY={anthropic:"anthropic",openai:"openai-codex"};function rY($){return xJ($,nY)}function xJ($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let G=Z[X];if(G?.type!=="oauth")continue;let V=H1(G.access),K=H1(G.refresh),N=typeof G.expires==="number"&&Number.isFinite(G.expires)?G.expires:null;if(V&&K&&N!==null)Q.push({provider:Y,access:V,refresh:K,expires:N})}return Q}catch{return[]}}function tY($){return xJ($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function oY($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?t0(J,Z.slice(2)):Z||t0(J,".pi","agent")}async function SJ($,J,Z=r2){let Q=[],X=await Z.exec(uY,["find-generic-password","-s",gY,"-w"],dY),Y=Date.now()+300000,G=(K)=>{if(!K)return;let N=Q.findIndex((H)=>H.provider===K.provider);if(N<0)Q.push(K);else if(Q[N].expires<=Y&&K.expires>Y)Q[N]=K};if(G(X.code===0?IJ(X.stdout.trim()):null),!Q.some((K)=>K.provider==="anthropic"&&K.expires>Y))G(IJ(await Z.readText(t0(pY($,J),".credentials.json"))));let V=aY(await Z.readText(t0(cY($,J),"auth.json")));G(V),G(eY(await Z.readText(t0($.GROK_HOME||t0(J,".grok"),"auth.json"))));for(let K of rY(await Z.readText(iY($,J))))G(K);for(let K of tY(await Z.readText(t0(oY($,J),"auth.json"))))G(K);return Q}function bJ($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var CJ="https://auth.x.ai",PJ="b1a00492-073a-47ea-816f-4c329264a828",EJ=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function eY($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${CJ}::${PJ}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==CJ||Q.oidc_client_id!==PJ||!EJ(Q.key)||!EJ(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var wJ=330000,JG=300000,ZG=60000;function QG($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+wJ)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function XG($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*wJ)?ZG:JG}var YG=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function kJ($){let J=new Map,Z=$.wait??YG,Q=$.stores??(process.platform==="darwin"?r2:{...r2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=bJ(await SJ($.environment??process.env,$.home,Q));for(let Y of QG(X,J)){if($.signal.aborted)return;let G=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:G.ok,...G.ok?{}:{error:G.error}})}}catch{}await Z(XG(J),$.signal)}}function yJ($=process.env){return new Promise((J)=>{$G("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as GG,spawn as BT,spawnSync as UT}from"child_process";import{chmodSync as NT,existsSync as KG,mkdirSync as qT,readFileSync as HT,renameSync as MT,rmSync as TT,statSync as _T,writeFileSync as FT}from"fs";import{dirname as jT,isAbsolute as WT,join as P9}from"path";var fJ=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function hJ($,J){if(!fJ.test($)||!fJ.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var BG="com.reasonmachines.updater",UG=["so.ara.updater","so.reason.updater"];function VG($){let J=$==="staging"?".staging":"";return{label:`${BG}${J}`,legacyLabels:[...UG].reverse().map((Z)=>`${Z}${J}`)}}function NG($,J,Z){return{launchAgent:P9(J,"Library","LaunchAgents",`${$}.plist`),systemdService:P9(Z,"systemd","user",`${$}.service`),systemdTimer:P9(Z,"systemd","user",`${$}.timer`)}}function qG($,J){return new Promise((Z)=>{GG($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function gJ($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??U0(),{label:X,legacyLabels:Y}=VG($.channel),G=$.configHome??vJ(Q),V=[X,...Y].filter((B)=>{let q=NG(B,Q,G);return KG(J==="darwin"?q.launchAgent:q.systemdService)});if(V.length===0)return"absent";let K=$.command??qG,N=V[0];if(V.length>1){for(let B of V)if((J==="darwin"?await K("/bin/launchctl",["print",`gui/${Z}/${B}`]):await K("systemctl",["--user","is-enabled",`${B}.timer`]))===0){N=B;break}}return(J==="darwin"?await K("/bin/launchctl",["kickstart",`gui/${Z}/${N}`]):await K("systemctl",["--user","start","--no-block",`${N}.service`]))===0?"started":"failed"}var mJ=60000;function uJ($){let J=(X,Y)=>{try{return hJ(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let G=setTimeout(X,Y);G.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(G),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),G=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(mJ-1,Math.floor(G*mJ)))}}var HG=30000;async function dJ($){return($.flush??t4)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(HG);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof _0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var pJ=25000,TG=5000,_G=600000,FG=["display.stream.v1","pty.start"],LG=64;function S9($,J,Z=w9($),Q){return g0(),G6(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var cJ=5000,jG=600000;function WG($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[c$])return null;try{return W2({platform:J})}catch{return null}}function DG($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function OG($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=U9();if(Z.length>0)k1($,{event:"worker.capabilities_withheld",runtime_version:t,capabilities:Z});if(Q)k1($,{event:"identity.computer_use_unavailable",runtime_version:t,reason_code:Q})}catch{}}async function t1($,J,Z,Q,X={}){if(g0(),$.executionMode==="host")r1();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let G=$0($);if(G.revoked)throw Error("worker_revoked");let V=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let K,N=()=>K??=$.executionMode==="host"?X6():Promise.resolve(!1),H=eJ(),B=X.prestartedReadiness??d1($,X.readinessProbes,V,J.roots[0].permissions),q=X.deferOptionalLanes===!0,M=await(q?B.initial:B.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,_=M["github.local.v1"]===!0?(X.probeGithubSignedIn??yJ)().catch(()=>!1):null,j=new AbortController,D=null,O=async(f,a)=>{let i=($.userChrome??X.ownComputer===!0)&&f["automation.call.v1"]===!0?Q6():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
+`);let B0=w9($,f,{displayVideo:f["display.stream.v1"]===!0&&await N(),handsBrowser:f["hands.connect"]===!0&&H,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:f["pty.start"]===!0&&g2(),probing:a,ownComputer:X.ownComputer===!0});if(!D&&B0.worker.readiness?.["browser.pr-proof.v1"]===!0){let z0=await AJ();if(D||j.signal.aborted)return B0;process.stderr.write("error"in z0?`Reason worker: PR video proof unavailable (${z0.error})
 `:`Reason worker: PR video proof ready (ffmpeg ${z0.encoder.ffmpeg.path})
-`),D=OJ({assertCurrent:async()=>{if(!k())throw Error("proof_authority_lost")},...!("error"in z0)?{recording:z0}:{}})}return K0},F=await O(M,q?U9.filter((f)=>M[f]!==!0):[]),z=x9($,J,F,D?.capability);X.onStartup?.("inventory_completed");let L=!1,W=0,R=0,E="starting",I=null,C=!1,h=!1,S=null,y,l=()=>!G.drained&&Date.parse(Y)>Date.now()&&z.supported_operations.some((f)=>F.worker.readiness?.[f]===!0),k=()=>!L&&l(),P=null,x=()=>W+(P?.claims()??0),A=null,w=new Set,b=(f)=>{let a=f.capabilities.root_paths;if(Object.assign(f.capabilities,x9(f.config,f.state,F,D?.capability)),a)f.capabilities.root_paths=a},n=(f)=>{F=f,b({config:$,state:J,capabilities:z}),A?.();for(let a of w)b(a),a.heartbeatNow?.()},o=new Set,V0=new Set,W0=setInterval(()=>{let f=new Set;for(let a of[{state:J,capabilities:z},...w])for(let q0 of HG){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let K0=`${a.state.deviceId} ${q0}`;if(f.add(K0),!o.has(K0)||V0.has(K0))continue;V0.add(K0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
-`)}o.clear();for(let a of f)o.add(a)},qG);W0.unref();let H$=(f)=>{if(!X.readinessProbes)C5({config:$,readiness:f,signal:j.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(a)=>{O(a,[]).then(n)}})},M$=q?B.final.then(async(f)=>{if(j.signal.aborted)return;n(await O(f,[]));let a=U9.filter((q0)=>f[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
-`),H$(f)},()=>{}):Promise.resolve();if(!q)H$(M);_?.then(async(f)=>{T=f;for(;;){let a=F,q0=await O(a.worker.readiness??{},a.worker.probing??[]);if(j.signal.aborted)return;if(F!==a)continue;n(q0);return}});let j1=q&&F.worker.probing?.includes("pty.start")?B.pty.then(async(f)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(j.signal.aborted||!a())return;let q0=await O({...F.worker.readiness,"pty.start":f},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(j.signal.aborted||!a())return;n(q0)},()=>{}):Promise.resolve(),P$=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:E,drained:G.drained||L||C,activeClaims:x(),activeSessions:R,lastHeartbeat:I,expiresAt:Y,supportedOperations:[...z.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:k()&&!C&&E==="running"}),a$=!1,T$=()=>{a$=!0,Q$()},Q$=()=>{if(L)return;if(L=!0,E="stopping",S?.close(),x()===0)j.abort();else y=setTimeout(()=>j.abort(),$.shutdownGraceMs)},E$=$.channel==="production"||$.channel==="staging"?$.channel:null,X$=d($).releaseCheck,v=X.publishedRelease??(E$&&$.lifetime==="persistent"?mJ({currentVersion:r,signal:j.signal,actedOn:(()=>{try{let f=JSON.parse(s(X$));return typeof f==="string"?f:null}catch{return null}})(),check:async(f)=>{try{c(X$,f)}catch{}let a=await hJ({channel:E$});process.stderr.write(a==="started"?`Reason worker: CLI ${f} is published; the updater is checking now.
+`),D=RJ({assertCurrent:async()=>{if(!w())throw Error("proof_authority_lost")},...!("error"in z0)?{recording:z0}:{}})}return B0},F=await O(M,q?V9.filter((f)=>M[f]!==!0):[]),z=S9($,J,F,D?.capability);X.onStartup?.("inventory_completed");let L=!1,W=0,R=0,E="starting",I=null,C=!1,h=!1,S=null,y,l=()=>!G.drained&&Date.parse(Y)>Date.now()&&z.supported_operations.some((f)=>F.worker.readiness?.[f]===!0),w=()=>!L&&l(),P=null,x=()=>W+(P?.claims()??0),A=null,k=new Set,b=(f)=>{let a=f.capabilities.root_paths;if(Object.assign(f.capabilities,S9(f.config,f.state,F,D?.capability)),a)f.capabilities.root_paths=a},n=(f)=>{F=f,b({config:$,state:J,capabilities:z}),A?.();for(let a of k)b(a),a.heartbeatNow?.()},r=new Set,X0=new Set,M0=setInterval(()=>{let f=new Set;for(let a of[{state:J,capabilities:z},...k])for(let q0 of FG){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let B0=`${a.state.deviceId} ${q0}`;if(f.add(B0),!r.has(B0)||X0.has(B0))continue;X0.add(B0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
+`)}r.clear();for(let a of f)r.add(a)},_G);M0.unref();let d0=(f)=>{if(!X.readinessProbes)x5({config:$,readiness:f,signal:j.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(a)=>{O(a,[]).then(n)}})},E0=q?B.final.then(async(f)=>{if(j.signal.aborted)return;n(await O(f,[]));let a=V9.filter((q0)=>f[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
+`),d0(f)},()=>{}):Promise.resolve();if(!q)d0(M);_?.then(async(f)=>{T=f;for(;;){let a=F,q0=await O(a.worker.readiness??{},a.worker.probing??[]);if(j.signal.aborted)return;if(F!==a)continue;n(q0);return}});let s0=q&&F.worker.probing?.includes("pty.start")?B.pty.then(async(f)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(j.signal.aborted||!a())return;let q0=await O({...F.worker.readiness,"pty.start":f},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(j.signal.aborted||!a())return;n(q0)},()=>{}):Promise.resolve(),E$=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:E,drained:G.drained||L||C,activeClaims:x(),activeSessions:R,lastHeartbeat:I,expiresAt:Y,supportedOperations:[...z.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:w()&&!C&&E==="running"}),i$=!1,_$=()=>{i$=!0,G$()},G$=()=>{if(L)return;if(L=!0,E="stopping",S?.close(),x()===0)j.abort();else y=setTimeout(()=>j.abort(),$.shutdownGraceMs)},x$=$.channel==="production"||$.channel==="staging"?$.channel:null,K$=d($).releaseCheck,v=X.publishedRelease??(x$&&$.lifetime==="persistent"?uJ({currentVersion:t,signal:j.signal,actedOn:(()=>{try{let f=JSON.parse(s(K$));return typeof f==="string"?f:null}catch{return null}})(),check:async(f)=>{try{c(K$,f)}catch{}let a=await gJ({channel:x$});process.stderr.write(a==="started"?`Reason worker: CLI ${f} is published; the updater is checking now.
 `:a==="absent"?`Reason worker: CLI ${f} is published; no updater is installed for it here.
 `:`Reason worker: CLI ${f} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),X0=(f)=>{if(f==="stop")T$();if(f==="reload_roots"){let a=t($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=Z6(J.roots,gJ());if(q0)z.root_paths=q0;else delete z.root_paths;P?.check()}if(f==="drain"||f==="resume"){if(L||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:f==="drain"},I0($,G)}return P$()};X.prestartedControl?.handle(X0);let x$=X.prestartedControl?await X.prestartedControl.closed:await x2($,Q,X0),Y$,S$=!1,h0=()=>{let f=Date.parse(Y)-Date.now();if(f>0){Y$=setTimeout(h0,Math.min(f,2147483647));return}L=!0,S?.close(),S$=!0,E="stopping",j.abort(Error("worker_credential_expired"))};h0(),X.signal?.addEventListener("abort",Q$,{once:!0});let W1=X.processSignals!==!1;if(W1)process.once("SIGTERM",Q$),process.once("SIGINT",T$);if(X.signal?.aborted)Q$();try{X.onStartup?.("control_ready");let f=X.client??new n1(O$($.apiOrigin),S0($.proxy,lJ()),Z,{deviceSession:t3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=L3($,J.deviceId),i=X.startupTiming,K0=i?()=>({...i(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,z0=(m)=>{let p0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&p0)(X.handOverLocalLogins??SJ)({state:m.state,client:{localSubscription:p0},signal:m.signal,home:B0()}).catch(()=>{return});let F0=gJ(),x0=m.client.liveSessionWorktrees?.bind(m.client);if(x0)aJ(()=>sJ({home:F0,deviceId:m.state.deviceId,liveIds:(_$)=>x0(m.state,_$,m.signal)}),m.signal)};z0({state:J,client:f,signal:j.signal});let G$=_G($,X.platform??process.platform),i$=f.deviceLifecycle?.bind(f),A0=Promise.resolve(),E0=0,D1=()=>{if(!G$||!i$||L||Date.now()<E0)return;E0=Date.now()+TG,A0=A0.then(()=>vJ({paths:G$,device:J,client:{deviceLifecycle:i$},accept:FG,signal:j.signal})).catch(()=>{return})};if(D1(),G$)B.final.then((m)=>LG(G$,m),()=>{});let Y2=(m,p0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:X.ownComputer===!0?MG:4*$.slots+oJ,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:uJ,operationCompletionTimeoutMs:uJ,maxConsecutiveHeartbeatFailures:3,claimable:k,advertised:l,onClaim:async(F0,x0,_$)=>{let z1=Date.now();if(!m.capabilities.supported_operations.includes(F0.capability))return{status:"failed",error_code:"unsupported_capability"};let c0=F.worker.probing??[],Z4=c0.includes(F0.capability)?M$:F0.capability==="hands.connect"&&$.executionMode==="host"&&c0.includes("pty.start")?j1:null;if(Z4){let K2,M3=()=>{};await Promise.race([Z4,new Promise((Q4)=>{K2=setTimeout(Q4,NG),M3=()=>Q4(),x0.addEventListener("abort",M3,{once:!0})})]),clearTimeout(K2),x0.removeEventListener("abort",M3)}let G2=F0.capability==="hands.connect",H3=G2?S:null,b7={signal:x0,emit:_$,...F,...D?{proveMac:D.broker.execute}:{},...F0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(K2)=>m.client.operationCustomEndpointCredential(m.state,F0,K2)}:{},...G2?{handsLaunch:{claimedAtMs:z1,...H3?{takePrespawnedWorker:H3.take,adoptSpawnedWorker:H3.adopt}:{}}}:{}};if(G2)R+=1;try{return await(X.execute??w9)(m.state,F0,b7)}finally{if(G2)R-=1}},onControl:async(F0,x0)=>await X6(m.state,F0,x0,m.client)||await Y6(m.state,F0,x0)||await eJ(F0,x0)||await D?.broker.control(F0,x0)||!1,onEvent:p0}),e9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:VG(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(dJ)).catch(()=>{return})},O1=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,$4=f.ownerWorkspaces?.bind(f),J4=f.ownerWorkspaceEnrollment?.bind(f);if(O1&&$4&&J4)P=C4({config:$,state:J,signal:j.signal,client:{ownerWorkspaces:$4,ownerWorkspaceEnrollment:J4},...O1.enroll?{enroll:O1.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,p0,F0)=>{let x0=L3(m.config,m.state.deviceId),_$={config:m.config,state:m.state,signal:p0,statusPath:d(m.config).daemon,...x0?.offer?{firstHeartbeat:x0.offer}:{},capabilities:x9(m.config,m.state,F,D?.capability),client:O1.client?.(m)??new n1(O$($.apiOrigin),S0($.proxy,lJ()),m.proofStore,{deviceSession:t3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};z0(_$);let z1={..._$,heartbeatNow:null};w.add(z1);try{await $9({registerHeartbeatNow:(c0)=>{z1.heartbeatNow=c0},...Y2(_$,(c0)=>{if(c0.type==="completed")S9(c0.operationId,c0.status);if(c0.type==="claims_changed"){if(F0(c0.activeClaims),L&&x()===0)j.abort()}if(c0.type==="stopped")F0(0)})})}finally{w.delete(z1)}if(L&&!S$)await e9(_$)}});let V3=0,N3=0,q3=O1?.intervalMs??O4;if(await $9({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?R2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...K0?{startup:K0}:{},...Y2({state:J,client:f,capabilities:z,signal:j.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(m)=>{if(m.type==="completed")S9(m.operationId,m.status);if(m.type==="claims_changed"){if(W=m.activeClaims,L&&x()===0)j.abort()}if(m.type==="heartbeat"&&!L){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=nJ({log:(p0,F0)=>{process.stderr.write(`${JSON.stringify({event:p0,...F0})}
-`)}}),S.arm(),setTimeout(tJ,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(P&&!L&&Date.now()>=V3)V3=Date.now()+q3,P.check().then((p0)=>{N3=p0?0:N3+1,V3=Date.now()+(p0?q3:Math.min(q3,z4*2**Math.min(N3-1,10)))});if(I=m.serverTime,C=m.drain,D1(),!L&&E$)v?.(m.latestCliVersions?.[E$]);if(!L)E="running";if(!L&&!h&&P$().executionEligible){if(h=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{E9({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!L)E="reconnecting";if(m.type==="stopped")W=0;X.onEvent?.(m)})}),await P?.settled(),L&&!S$&&$.lifetime==="ephemeral")await f.disconnect?.(J,AbortSignal.timeout(dJ)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(L&&!S$)await e9({state:J,client:f});if(a$)await iJ().catch(()=>{return})}catch(f){if(!(f instanceof T0&&f.status===401))throw f;if(I0($,{...G,revoked:!0}),f.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(Y$),clearInterval(W0),y)clearTimeout(y);if(W1)process.removeListener("SIGTERM",Q$),process.removeListener("SIGINT",T$);X.signal?.removeEventListener("abort",Q$),j.abort(),S?.close(),await P?.settled().catch(()=>{return}),await D?.broker.close().catch(()=>{return}),await x$()}}function lJ($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(pJ,cJ),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as jG,sign as WG}from"crypto";var G6=65536,DG=65536;function OG($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new Y0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new Y0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!B6(X))throw new Y0("invalid_public_key");return X}function K6(){try{let{privateKey:$,publicKey:J}=jG("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:OG(J)}}catch($){if($ instanceof Y0)throw $;throw new Y0("proof_key_generation_failed")}}class o1{keyPair=K6();binding=null;loadPublicKey(){if(!this.keyPair)throw new Y0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=K6(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>DG)throw new Y0("proof_sign_failed");let J;try{J=WG("sha256",$,this.keyPair.privateKey)}catch{throw new Y0("proof_sign_failed")}if(!U6(J))throw new Y0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>G6)throw new Y0("invalid_binding");if(this.binding)throw new Y0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>G6)throw new Y0("invalid_binding");if(!this.binding)throw new Y0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as EG,spawn as xG}from"child_process";import{isAbsolute as SG}from"path";import{promisify as bG}from"util";var e1={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class $2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=e1){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
-`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as zG}from"crypto";import{unlinkSync as AG}from"fs";import{join as RG}from"path";var J2=1,i2=45000,IG=U.strictObject({type:U.literal("configure"),protocol:U.literal(J2),version:U.string(),config:J0}),CG=U.strictObject({type:U.literal("ticket"),organizationId:U.string().min(1).max(160),receipt:U.unknown()}),PG=U.strictObject({type:U.enum(["ping","stop"])});async function V6($={}){let J=$.clock??e1,Z=new $2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,V,K,N,H=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:B,version:q}=IG.parse(await Z.receive(30000,Q.signal));if(q!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(K$(B),e(g(B),!0),V=t0({path:d(B).lock,runtimeVersion:r}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=RG(g(B),`ssh-preflight-${zG()}.json`);try{c(M,{version:1}),s(M)}finally{try{AG(M)}catch{}}let T=t(B),_=$0(B);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&B.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:J2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let j=B.lifetime==="ephemeral"?K=new o1:M0(B,!0);if(!T){let L=W$(B);await Z.send({type:"ticket-request",request:L.request});let W=CG.parse(await Z.receive(70000,Q.signal)),R=L.complete(W.organizationId,W.receipt);if(T=await r0(B,R,j,$.enroll),B.lifetime==="persistent")y0(T,d(B).state,{proofStore:j});I0(B,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(PG.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let D=!1,O,F=!1;N=J.after(Math.max(1,Math.min(i2,$.startupTimeoutMs??i2)),()=>{F=!0,Y()});let z=V.owner.nonce;if(await t1(B,T,j,z,{...$,signal:Q.signal,onEvent(L){if($.onEvent?.(L),L.type==="heartbeat"&&!D&&!O)O=(async()=>{let W=await U0(B,"status");if(!W?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:W.deviceId,expiresAt:W.expiresAt,lifetime:B.lifetime,supervision:"ssh-foreground"}),D=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await O,F||!D)throw Error("worker_ssh_outbound_or_readiness_failed");return H=!0,0}catch(B){let q=B instanceof Error&&/^worker_[a-z_]+$/.test(B.message)?B.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:q})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),H)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var y9=($)=>SG($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),k9=($)=>`'${$.replaceAll("'","'\\''")}'`,wG=U.strictObject({type:U.literal("hello"),protocol:U.literal(J2),version:U.string(),platform:U.enum(["linux","darwin"]),architecture:U.enum(["arm64","x64"]),enrolled:U.boolean()}),kG=U.strictObject({type:U.literal("ticket-request"),request:U.strictObject({install_id:U.uuid(),code_challenge:U.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:U.enum(["persistent","ephemeral"]),roots:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),execution_mode:U.enum(["confined","host"]),permissions:U.strictObject({read:U.literal(!0),write:U.literal(!0),execute:U.literal(!0),discover_environment:U.literal(!0),expose_mcp:U.literal(!1)})})).length(1)})}),N6=U.discriminatedUnion("type",[U.strictObject({type:U.literal("running"),deviceId:U.string().min(1).max(160),expiresAt:U.iso.datetime({offset:!0}),lifetime:U.enum(["persistent","ephemeral"]),supervision:U.literal("ssh-foreground")}),U.strictObject({type:U.literal("pong")}),U.strictObject({type:U.literal("stopped")})]),yG=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function n2($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&yG.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function q6($){if(!y9($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
-a=${k9($.remoteCli)}
+`)}}):void 0),Y0=(f)=>{if(f==="stop")_$();if(f==="reload_roots"){let a=o($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=Y6(J.roots,lJ());if(q0)z.root_paths=q0;else delete z.root_paths;P?.check()}if(f==="drain"||f==="resume"){if(L||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");G={...G,drained:f==="drain"},I0($,G)}return E$()};X.prestartedControl?.handle(Y0);let S$=X.prestartedControl?await X.prestartedControl.closed:await x2($,Q,Y0),B$,b$=!1,m0=()=>{let f=Date.parse(Y)-Date.now();if(f>0){B$=setTimeout(m0,Math.min(f,2147483647));return}L=!0,S?.close(),b$=!0,E="stopping",j.abort(Error("worker_credential_expired"))};m0(),X.signal?.addEventListener("abort",G$,{once:!0});let D1=X.processSignals!==!1;if(D1)process.once("SIGTERM",G$),process.once("SIGINT",_$);if(X.signal?.aborted)G$();try{X.onStartup?.("control_ready");let f=X.client??new n1(z$($.apiOrigin),b0($.proxy,sJ()),Z,{deviceSession:o3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=D3($,J.deviceId),i=X.startupTiming,B0=i?()=>({...i(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,z0=(m)=>{let a0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&a0)(X.handOverLocalLogins??kJ)({state:m.state,client:{localSubscription:a0},signal:m.signal,home:U0()}).catch(()=>{return});let L0=lJ(),S0=m.client.liveSessionWorktrees?.bind(m.client);if(S0)rJ(()=>nJ({home:L0,deviceId:m.state.deviceId,liveIds:(F$)=>S0(m.state,F$,m.signal)}),m.signal)};z0({state:J,client:f,signal:j.signal});let U$=WG($,X.platform??process.platform),n$=f.deviceLifecycle?.bind(f),A0=Promise.resolve(),x0=0,O1=()=>{if(!U$||!n$||L||Date.now()<x0)return;x0=Date.now()+jG,A0=A0.then(()=>dJ({paths:U$,device:J,client:{deviceLifecycle:n$},accept:DG,signal:j.signal})).catch(()=>{return})};if(O1(),U$)B.final.then((m)=>OG(U$,m),()=>{});let Y2=(m,a0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:t,bridgeVersion:t,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:X.ownComputer===!0?LG:4*$.slots+J6,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:pJ,operationCompletionTimeoutMs:pJ,maxConsecutiveHeartbeatFailures:3,claimable:w,advertised:l,onClaim:async(L0,S0,F$)=>{let A1=Date.now();if(!m.capabilities.supported_operations.includes(L0.capability))return{status:"failed",error_code:"unsupported_capability"};let i0=F.worker.probing??[],Q4=i0.includes(L0.capability)?E0:L0.capability==="hands.connect"&&$.executionMode==="host"&&i0.includes("pty.start")?s0:null;if(Q4){let K2,F3=()=>{};await Promise.race([Q4,new Promise((X4)=>{K2=setTimeout(X4,TG),F3=()=>X4(),S0.addEventListener("abort",F3,{once:!0})})]),clearTimeout(K2),S0.removeEventListener("abort",F3)}let G2=L0.capability==="hands.connect",_3=G2?S:null,y7={signal:S0,emit:F$,...F,...D?{proveMac:D.broker.execute}:{},...L0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(K2)=>m.client.operationCustomEndpointCredential(m.state,L0,K2)}:{},...G2?{handsLaunch:{claimedAtMs:A1,..._3?{takePrespawnedWorker:_3.take,adoptSpawnedWorker:_3.adopt}:{}}}:{}};if(G2)R+=1;try{return await(X.execute??k9)(m.state,L0,y7)}finally{if(G2)R-=1}},onControl:async(L0,S0)=>await K6(m.state,L0,S0,m.client)||await B6(m.state,L0,S0)||await Z6(L0,S0)||await D?.broker.control(L0,S0)||!1,onEvent:a0}),$4=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:MG(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:t,reason_code:"worker_stopped"},AbortSignal.timeout(cJ)).catch(()=>{return})},z1=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,J4=f.ownerWorkspaces?.bind(f),Z4=f.ownerWorkspaceEnrollment?.bind(f);if(z1&&J4&&Z4)P=E4({config:$,state:J,signal:j.signal,client:{ownerWorkspaces:J4,ownerWorkspaceEnrollment:Z4},...z1.enroll?{enroll:z1.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,a0,L0)=>{let S0=D3(m.config,m.state.deviceId),F$={config:m.config,state:m.state,signal:a0,statusPath:d(m.config).daemon,...S0?.offer?{firstHeartbeat:S0.offer}:{},capabilities:S9(m.config,m.state,F,D?.capability),client:z1.client?.(m)??new n1(z$($.apiOrigin),b0($.proxy,sJ()),m.proofStore,{deviceSession:o3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};z0(F$);let A1={...F$,heartbeatNow:null};k.add(A1);try{await J9({registerHeartbeatNow:(i0)=>{A1.heartbeatNow=i0},...Y2(F$,(i0)=>{if(i0.type==="completed")b9(i0.operationId,i0.status);if(i0.type==="claims_changed"){if(L0(i0.activeClaims),L&&x()===0)j.abort()}if(i0.type==="stopped")L0(0)})})}finally{k.delete(A1)}if(L&&!b$)await $4(F$)}});let H3=0,M3=0,T3=z1?.intervalMs??A4;if(await J9({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?R2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...B0?{startup:B0}:{},...Y2({state:J,client:f,capabilities:z,signal:j.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(m)=>{if(m.type==="completed")b9(m.operationId,m.status);if(m.type==="claims_changed"){if(W=m.activeClaims,L&&x()===0)j.abort()}if(m.type==="heartbeat"&&!L){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=oJ({log:(a0,L0)=>{process.stderr.write(`${JSON.stringify({event:a0,...L0})}
+`)}}),S.arm(),setTimeout($6,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(P&&!L&&Date.now()>=H3)H3=Date.now()+T3,P.check().then((a0)=>{M3=a0?0:M3+1,H3=Date.now()+(a0?T3:Math.min(T3,R4*2**Math.min(M3-1,10)))});if(I=m.serverTime,C=m.drain,O1(),!L&&x$)v?.(m.latestCliVersions?.[x$]);if(!L)E="running";if(!L&&!h&&E$().executionEligible){if(h=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{x9({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!L)E="reconnecting";if(m.type==="stopped")W=0;X.onEvent?.(m)})}),await P?.settled(),L&&!b$&&$.lifetime==="ephemeral")await f.disconnect?.(J,AbortSignal.timeout(cJ)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
+`)});else if(L&&!b$)await $4({state:J,client:f});if(i$)await tJ().catch(()=>{return})}catch(f){if(!(f instanceof _0&&f.status===401))throw f;if(I0($,{...G,revoked:!0}),f.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(B$),clearInterval(M0),y)clearTimeout(y);if(D1)process.removeListener("SIGTERM",G$),process.removeListener("SIGINT",_$);X.signal?.removeEventListener("abort",G$),j.abort(),S?.close(),await P?.settled().catch(()=>{return}),await D?.broker.close().catch(()=>{return}),await S$()}}function sJ($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(aJ,iJ),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as zG,sign as AG}from"crypto";var U6=65536,RG=65536;function IG($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new G0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new G0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!N6(X))throw new G0("invalid_public_key");return X}function V6(){try{let{privateKey:$,publicKey:J}=zG("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:IG(J)}}catch($){if($ instanceof G0)throw $;throw new G0("proof_key_generation_failed")}}class o1{keyPair=V6();binding=null;loadPublicKey(){if(!this.keyPair)throw new G0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=V6(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>RG)throw new G0("proof_sign_failed");let J;try{J=AG("sha256",$,this.keyPair.privateKey)}catch{throw new G0("proof_sign_failed")}if(!q6(J))throw new G0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>U6)throw new G0("invalid_binding");if(this.binding)throw new G0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>U6)throw new G0("invalid_binding");if(!this.binding)throw new G0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as wG,spawn as kG}from"child_process";import{isAbsolute as yG}from"path";import{promisify as fG}from"util";var e1={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class $2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let G=this.waiter;this.waiter=void 0,G.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=e1){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
+`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(G)=>G?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as CG}from"crypto";import{unlinkSync as PG}from"fs";import{join as EG}from"path";var J2=1,t2=45000,xG=U.strictObject({type:U.literal("configure"),protocol:U.literal(J2),version:U.string(),config:J0}),SG=U.strictObject({type:U.literal("ticket"),organizationId:U.string().min(1).max(160),receipt:U.unknown()}),bG=U.strictObject({type:U.enum(["ping","stop"])});async function H6($={}){let J=$.clock??e1,Z=new $2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),G,V,K,N,H=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:B,version:q}=xG.parse(await Z.receive(30000,Q.signal));if(q!==t)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(V$(B),e(g(B),!0),V=$$({path:d(B).lock,runtimeVersion:t}),!V.acquired)throw Error("worker_already_running_or_lifecycle_busy");let M=EG(g(B),`ssh-preflight-${CG()}.json`);try{c(M,{version:1}),s(M)}finally{try{PG(M)}catch{}}let T=o(B),_=$0(B);if(_.revoked||_.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&B.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:J2,version:t,platform:process.platform,architecture:process.arch,enrolled:!!T});let j=B.lifetime==="ephemeral"?K=new o1:T0(B,!0);if(!T){let L=D$(B);await Z.send({type:"ticket-request",request:L.request});let W=SG.parse(await Z.receive(70000,Q.signal)),R=L.complete(W.organizationId,W.receipt);if(T=await e0(B,R,j,$.enroll),B.lifetime==="persistent")f0(T,d(B).state,{proofStore:j});I0(B,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");G=(async()=>{try{while(!X.signal.aborted){if(bG.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let D=!1,O,F=!1;N=J.after(Math.max(1,Math.min(t2,$.startupTimeoutMs??t2)),()=>{F=!0,Y()});let z=V.owner.nonce;if(await t1(B,T,j,z,{...$,signal:Q.signal,onEvent(L){if($.onEvent?.(L),L.type==="heartbeat"&&!D&&!O)O=(async()=>{let W=await V0(B,"status");if(!W?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:W.deviceId,expiresAt:W.expiresAt,lifetime:B.lifetime,supervision:"ssh-foreground"}),D=!0,N?.()})().catch(()=>{F=!0,Y()})}}),await O,F||!D)throw Error("worker_ssh_outbound_or_readiness_failed");return H=!0,0}catch(B){let q=B instanceof Error&&/^worker_[a-z_]+$/.test(B.message)?B.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:q})}catch{}return 1}finally{if(N?.(),Y(),X.abort(),await G,K?.deleteBinding(),K?.deleteKey(),V?.acquired)V.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),H)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var f9=($)=>yG($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),y9=($)=>`'${$.replaceAll("'","'\\''")}'`,hG=U.strictObject({type:U.literal("hello"),protocol:U.literal(J2),version:U.string(),platform:U.enum(["linux","darwin"]),architecture:U.enum(["arm64","x64"]),enrolled:U.boolean()}),mG=U.strictObject({type:U.literal("ticket-request"),request:U.strictObject({install_id:U.uuid(),code_challenge:U.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:U.enum(["persistent","ephemeral"]),roots:U.array(U.strictObject({path_fingerprint:U.string().regex(/^[a-f0-9]{64}$/),execution_mode:U.enum(["confined","host"]),permissions:U.strictObject({read:U.literal(!0),write:U.literal(!0),execute:U.literal(!0),discover_environment:U.literal(!0),expose_mcp:U.literal(!1)})})).length(1)})}),M6=U.discriminatedUnion("type",[U.strictObject({type:U.literal("running"),deviceId:U.string().min(1).max(160),expiresAt:U.iso.datetime({offset:!0}),lifetime:U.enum(["persistent","ephemeral"]),supervision:U.literal("ssh-foreground")}),U.strictObject({type:U.literal("pong")}),U.strictObject({type:U.literal("stopped")})]),vG=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function o2($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&vG.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function T6($){if(!f9($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
+a=${y9($.remoteCli)}
 [ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
 p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
 p=$(cd -P "$p" && pwd -P)
@@ -98,12 +98,12 @@ if [ -x /usr/bin/sha256sum ]; then h=$(/usr/bin/sha256sum < "$a");
 elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
 else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
 h=\${h%% *}
-[ "$h" = ${k9($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${k9(J)}`}function H6($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!y9($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,q6($)]}function fG($){return H6($,!1)}function M6(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:B0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function hG($){let J;try{({stdout:J}=await bG(EG)("/usr/bin/ssh",["-G",...H6($,!0)],{env:M6(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
-`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function mG($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function vG($){await hG($);let J=xG("/usr/bin/ssh",fG($),{stdio:["pipe","pipe","pipe"],env:M6()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=mG(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function gG($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let V=$[G];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let V=J.get(G);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!y9(X.sshConfig))throw Error("worker_ssh_invalid_target");q6(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(Z2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function uG($,J,Z,Q,X){let{request:Y}=kG.parse(n2(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{G();let N=Z??L$(J),H=await(Q.enrollmentCredentials??j$)(J,N);if(G(),!H)throw Error("worker_session_login_required");if(!C0(H.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!H.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let B=Q.createTicketClient?.(H)??new R$(H,{credentialsPath:N}),q=A3(await B.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:H.orgId,receipt:q}})(),K;try{let N=await Promise.race([V,new Promise((H,B)=>{if(K=()=>B(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function T6($,J={}){let{config:Z,target:Q,credentialPath:X}=gG($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??e1,G=await(J.sshTransport??vG)(Q),V=new $2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),H,B;if(G.result.then((q)=>{B=q}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:J2,version:r,config:Z});let q=wG.parse(n2(await V.receive(30000,K.signal)));if(q.version!==r)throw Error("worker_ssh_version_mismatch");if(!q.enrolled)await uG(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));H=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(q.enrolled?0:O3)+i2+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),j=N6.parse(n2(await V.receive(_,K.signal)));if(j.type==="running"){if(M||j.lifetime!==Z.lifetime||Date.parse(j.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(j)+`
-`)}if(j.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(q){if(K.signal.aborted){H?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(N6.parse(n2(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(q instanceof Error&&q.message==="worker_ssh_connection_closed"){let M=B??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw q}finally{H?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),V.dispose()}}import{createConnection as sG}from"net";import{WebSocket as r2}from"ws";var dG=1,H1=65536,_6=4096,F6=67108864,L6=4194304,q1=U.uuid(),lG=U.strictObject({kind:U.literal("install_only"),authorityId:q1,organizationId:q1,userId:q1,connectionId:q1,attemptId:q1,purpose:U.literal("install"),generation:U.number().int().positive(),transport:U.literal("reverse_ssh"),expiresAt:U.iso.datetime({offset:!0}),maxDurationMs:U.literal(300000),maxChannels:U.literal(1),allowTcpForwarding:U.literal(!1),allowPty:U.literal(!1)}),pG=U.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!q1.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var cG=U.strictObject({protocol:U.literal(dG),type:U.literal("ssh_install_relay"),authorityToken:U.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:lG,relayUrl:pG,endpoint:U.strictObject({host:U.literal("127.0.0.1"),port:U.literal(22)})});function f9($,J=Date.now()){let Z=cG.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function j6($){let J=JSON.stringify($);if(Buffer.byteLength(J)>H1)throw Error("ssh_install_relay_frame_too_large");return J}function W6($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:f9(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var D6="ssh_install_relay_closed";function aG($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function iG($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function nG($,J=D6){try{$.close(1000,J)}catch{$.terminate()}}async function rG($){let J=$.now??(()=>Date.now()),Z=f9($.receipt,J()),X=($.createWebSocket??((L)=>new r2(L,{followRedirects:!1,perMessageDeflate:!1,maxPayload:H1})))(Z.relayUrl),Y=$.connectLocal??(()=>sG({host:"127.0.0.1",port:22})),G,V=!1,K=!1,N=0,H=0,B,q=(L)=>{if(B)clearTimeout(B);B=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,L)),B.unref?.()},M,T=new Promise((L)=>{M=L}),_=(L=D6)=>{if(K)return;if(K=!0,B)clearTimeout(B);if($.signal?.removeEventListener("abort",j),G?.destroy(),X.readyState===r2.OPEN)nG(X,L);else if(X.readyState!==r2.CLOSED)X.terminate();M()},j=()=>_("ssh_install_relay_aborted"),D=()=>_("ssh_install_relay_protocol_error"),O=(L)=>{return N+=1,H+=L,L<=H1&&N<=_6&&H<=F6},F=(L)=>{if(K||!V||X.readyState!==r2.OPEN||X.bufferedAmount>L6||!O(L.length)){D();return}X.send(L,{binary:!0},(W)=>{if(W)D()})};X.on("open",()=>{if(K)return;try{let L=j6({type:"ssh_install_relay_receipt",receipt:Z});X.send(L,{binary:!1},(W)=>{if(W)D()})}catch{D()}}),X.on("message",(L,W)=>{if(K)return;let R=aG(L);if(R>H1||!O(R))return D();if(!V){if(W)return D();try{let I=W6(JSON.parse(String(L)));if(I.type!=="ssh_install_relay_ready"||I.authorityId!==Z.authority.authorityId)return D();V=!0,q(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",D),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{D()}return}if(!W)return D();let E=iG(L);if(!E||!G||G.destroyed||!G.write(E))X._socket?.pause()}),X.on("error",D),X.on("close",()=>_("ssh_install_relay_peer_closed"));let z=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(q(z),$.signal?.addEventListener("abort",j,{once:!0}),$.signal?.aborted)j();return{receipt:Z,closed:T,close:()=>_()}}async function O6($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>H1)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await rG({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as tG}from"crypto";var c$="ARA_WORKER_PREVIEW_PROBE";async function A6(){if(typeof Bun>"u")return 1;let $=tG(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,V){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(c$);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,V){if(typeof V!=="string"||V.length>8192){G.close();return}if(!G.data.relay){if(V===c$)G.send(c$);else G.close();return}try{let K=z6(V),N=(H)=>G.send(JSON.stringify(H));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>c$.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===c$)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(c$).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===c$&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
+[ "$h" = ${y9($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
+exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${y9(J)}`}function _6($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!f9($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,T6($)]}function gG($){return _6($,!1)}function F6(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:U0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function uG($){let J;try{({stdout:J}=await fG(wG)("/usr/bin/ssh",["-G",..._6($,!0)],{env:F6(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
+`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function dG($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function lG($){await uG($);let J=kG("/usr/bin/ssh",gG($),{stdio:["pipe","pipe","pipe"],env:F6()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let G=dG(Z);Z="",X({exitCode:Y??1,errorCode:G})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function pG($){let J=new Map,Z=!1;for(let G=0;G<$.length;G++){let V=$[G];if(V==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(V)||J.has(V))throw Error("worker_unknown_or_duplicate_flag");let K=$[++G];if(!K||K.startsWith("--"))throw Error("worker_missing_flag_value");J.set(V,K)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(G)=>{let V=J.get(G);if(!V)throw Error("worker_required_input_missing");return V},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!f9(X.sshConfig))throw Error("worker_ssh_invalid_target");T6(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(Z2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function cG($,J,Z,Q,X){let{request:Y}=mG.parse(o2(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let G=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},V=(async()=>{G();let N=Z??j$(J),H=await(Q.enrollmentCredentials??W$)(J,N);if(G(),!H)throw Error("worker_session_login_required");if(!C0(H.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!H.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let B=Q.createTicketClient?.(H)??new I$(H,{credentialsPath:N}),q=C3(await B.createHeadlessDeviceEnrollmentTicket(Y));return G(),{type:"ticket",organizationId:H.orgId,receipt:q}})(),K;try{let N=await Promise.race([V,new Promise((H,B)=>{if(K=()=>B(Error("worker_ssh_cancelled")),X.aborted)K();else X.addEventListener("abort",K,{once:!0})})]);G(),await $.send(N)}finally{X.removeEventListener("abort",K)}}async function L6($,J={}){let{config:Z,target:Q,credentialPath:X}=pG($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??e1,G=await(J.sshTransport??lG)(Q),V=new $2(G.output,G.input,Y),K=new AbortController,N=()=>K.abort(),H,B;if(G.result.then((q)=>{B=q}),process.once("SIGINT",N),process.once("SIGTERM",N),J.signal?.addEventListener("abort",N,{once:!0}),J.signal?.aborted)N();try{if(K.signal.aborted)throw Error("worker_ssh_cancelled");await V.send({type:"configure",protocol:J2,version:t,config:Z});let q=hG.parse(o2(await V.receive(30000,K.signal)));if(q.version!==t)throw Error("worker_ssh_version_mismatch");if(!q.enrolled)await cG(V,Z,X,J,AbortSignal.any([K.signal,V.signal]));H=Y.every(1e4,()=>{V.send({type:"ping"}).catch(N)});let M=!1,T=Y.now()+(q.enrolled?0:R3)+t2+5000;while(!0){let _=M?35000:Math.max(1,T-Y.now()),j=M6.parse(o2(await V.receive(_,K.signal)));if(j.type==="running"){if(M||j.lifetime!==Z.lifetime||Date.parse(j.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");M=!0,(J.io??process).stdout.write(JSON.stringify(j)+`
+`)}if(j.type==="stopped"){if(!M)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(q){if(K.signal.aborted){H?.();try{await V.send({type:"stop"});let M=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<M)if(M6.parse(o2(await V.receive(Math.max(1,M-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(q instanceof Error&&q.message==="worker_ssh_connection_closed"){let M=B??await Promise.race([G.result,new Promise((T)=>setTimeout(T,100))]);if(M?.exitCode)throw Error(M.errorCode)}throw q}finally{H?.(),process.removeListener("SIGINT",N),process.removeListener("SIGTERM",N),J.signal?.removeEventListener("abort",N),G.close(),V.dispose()}}import{createConnection as rG}from"net";import{WebSocket as e2}from"ws";var sG=1,T1=65536,j6=4096,W6=67108864,D6=4194304,M1=U.uuid(),aG=U.strictObject({kind:U.literal("install_only"),authorityId:M1,organizationId:M1,userId:M1,connectionId:M1,attemptId:M1,purpose:U.literal("install"),generation:U.number().int().positive(),transport:U.literal("reverse_ssh"),expiresAt:U.iso.datetime({offset:!0}),maxDurationMs:U.literal(300000),maxChannels:U.literal(1),allowTcpForwarding:U.literal(!1),allowPty:U.literal(!1)}),iG=U.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!M1.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var nG=U.strictObject({protocol:U.literal(sG),type:U.literal("ssh_install_relay"),authorityToken:U.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:aG,relayUrl:iG,endpoint:U.strictObject({host:U.literal("127.0.0.1"),port:U.literal(22)})});function h9($,J=Date.now()){let Z=nG.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function O6($){let J=JSON.stringify($);if(Buffer.byteLength(J)>T1)throw Error("ssh_install_relay_frame_too_large");return J}function z6($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:h9(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var A6="ssh_install_relay_closed";function tG($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function oG($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function eG($,J=A6){try{$.close(1000,J)}catch{$.terminate()}}async function $K($){let J=$.now??(()=>Date.now()),Z=h9($.receipt,J()),X=($.createWebSocket??((L)=>new e2(L,{followRedirects:!1,perMessageDeflate:!1,maxPayload:T1})))(Z.relayUrl),Y=$.connectLocal??(()=>rG({host:"127.0.0.1",port:22})),G,V=!1,K=!1,N=0,H=0,B,q=(L)=>{if(B)clearTimeout(B);B=setTimeout(()=>_("ssh_install_relay_expired"),Math.max(1,L)),B.unref?.()},M,T=new Promise((L)=>{M=L}),_=(L=A6)=>{if(K)return;if(K=!0,B)clearTimeout(B);if($.signal?.removeEventListener("abort",j),G?.destroy(),X.readyState===e2.OPEN)eG(X,L);else if(X.readyState!==e2.CLOSED)X.terminate();M()},j=()=>_("ssh_install_relay_aborted"),D=()=>_("ssh_install_relay_protocol_error"),O=(L)=>{return N+=1,H+=L,L<=T1&&N<=j6&&H<=W6},F=(L)=>{if(K||!V||X.readyState!==e2.OPEN||X.bufferedAmount>D6||!O(L.length)){D();return}X.send(L,{binary:!0},(W)=>{if(W)D()})};X.on("open",()=>{if(K)return;try{let L=O6({type:"ssh_install_relay_receipt",receipt:Z});X.send(L,{binary:!1},(W)=>{if(W)D()})}catch{D()}}),X.on("message",(L,W)=>{if(K)return;let R=tG(L);if(R>T1||!O(R))return D();if(!V){if(W)return D();try{let I=z6(JSON.parse(String(L)));if(I.type!=="ssh_install_relay_ready"||I.authorityId!==Z.authority.authorityId)return D();V=!0,q(Z.authority.maxDurationMs),G=Y(),G.setNoDelay(!0),G.on("data",F),G.on("error",D),G.on("close",()=>_("ssh_install_relay_peer_closed")),G.on("drain",()=>X._socket?.resume()),G.on("connect",()=>{})}catch{D()}return}if(!W)return D();let E=oG(L);if(!E||!G||G.destroyed||!G.write(E))X._socket?.pause()}),X.on("error",D),X.on("close",()=>_("ssh_install_relay_peer_closed"));let z=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(q(z),$.signal?.addEventListener("abort",j,{once:!0}),$.signal?.aborted)j();return{receipt:Z,closed:T,close:()=>_()}}async function R6($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>T1)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await $K({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as JK}from"crypto";var s$="ARA_WORKER_PREVIEW_PROBE";async function C6(){if(typeof Bun>"u")return 1;let $=JK(32).toString("base64url"),J,Z=new Promise((G)=>{J=G}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(G,V){let K=new URL(G.url).pathname;if(G.method!=="GET")return new Response(null,{status:405});if(K==="/readiness")return new Response(s$);if((K==="/readiness-ws"||K===`/device/readiness/${$}`)&&V.upgrade(G,{data:{relay:K.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(G,V){if(typeof V!=="string"||V.length>8192){G.close();return}if(!G.data.relay){if(V===s$)G.send(s$);else G.close();return}try{let K=I6(V),N=(H)=>G.send(JSON.stringify(H));if(K.type==="hello")N(K),N({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(K.type==="head"&&K.id==="http"&&K.status===200)N({type:"credit",id:"http"});else if(K.type==="data"&&K.id==="http"){if(G.data.http+=Buffer.from(K.data,"base64").toString(),G.data.http.length>s$.length)throw Error("probe_overflow");N({type:"credit",id:"http"})}else if(K.type==="end"&&K.id==="http"&&G.data.http===s$)N({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(K.type==="ws"&&K.id==="ws")N({type:"data",id:"ws",data:Buffer.from(s$).toString("base64"),binary:!1});else if(K.type==="data"&&K.id==="ws"&&!K.binary&&Buffer.from(K.data,"base64").toString()===s$&&!G.data.reported)G.data.reported=!0,process.stdout.write(`ready
 `);else throw Error("probe_protocol_failed")}catch{G.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
-`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as $K,createReadStream as JK,fstatSync as ZK,readFileSync as QK}from"fs";var R6="/run/sc/instance-generation";var oG=/^[1-9][0-9]{0,15}\n?$/;function eG($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function I6($){if(typeof $!=="string"||!oG.test($))return null;let J=Number($.trim());return eG(J)?J:null}var C6=3,XK=600000,YK=65536,GK=500;function P6($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(C6))throw Error("worker_standby_invalid_invocation");return{handoffFd:C6}}function KK($=(J)=>QK(J,"utf8")){try{return I6($(R6))}catch{return null}}function BK($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=D3.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var E6={isPipe:($)=>ZK($).isFIFO(),stream:($)=>{let J=JK("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function UK($,J=E6){if(!J.isPipe($.fd)){try{$K($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??XK),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(H)=>{X??=H,N(H)}});G.catch(()=>{});let V=J.every(GK,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let H=[],B=0;for await(let q of Q.chunks){if(X)throw X;if(B===0)$.onArriving?.();if(B+=q.length,B>YK)throw Error("worker_standby_handoff_too_large");H.push(q)}return Buffer.concat(H).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function x6($,J=E6){let Z=$.readGeneration??(()=>KK()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await UK({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return BK(Y)}var VK=`Usage: reason worker <command> --config PATH [--json]
+`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as XK,createReadStream as YK,fstatSync as GK,readFileSync as KK}from"fs";var P6="/run/sc/instance-generation";var ZK=/^[1-9][0-9]{0,15}\n?$/;function QK($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function E6($){if(typeof $!=="string"||!ZK.test($))return null;let J=Number($.trim());return QK(J)?J:null}var x6=3,BK=600000,UK=65536,VK=500;function S6($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(x6))throw Error("worker_standby_invalid_invocation");return{handoffFd:x6}}function NK($=(J)=>KK(J,"utf8")){try{return E6($(P6))}catch{return null}}function qK($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=A3.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var b6={isPipe:($)=>GK($).isFIFO(),stream:($)=>{let J=YK("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function HK($,J=b6){if(!J.isPipe($.fd)){try{XK($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??BK),Q=J.stream($.fd),X=null,Y=()=>{},G=new Promise((K,N)=>{Y=(H)=>{X??=H,N(H)}});G.catch(()=>{});let V=J.every(VK,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let K=(async()=>{let H=[],B=0;for await(let q of Q.chunks){if(X)throw X;if(B===0)$.onArriving?.();if(B+=q.length,B>UK)throw Error("worker_standby_handoff_too_large");H.push(q)}return Buffer.concat(H).toString("utf8")})(),N=await Promise.race([K,G]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return N}finally{V(),Q.close()}}async function w6($,J=b6){let Z=$.readGeneration??(()=>NK()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await HK({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return qK(Y)}var MK=`Usage: reason worker <command> --config PATH [--json]
 
   enroll                        Obtain/redeem a ticket using the current Reason login
   start                         Run the existing Device daemon in the foreground
@@ -144,15 +144,15 @@ Pretrust known_hosts. No agent forwarding, automatic installation or detached se
 SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
 are not forwarded/supported; running is not a browser-readiness receipt.
 Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function NK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var qK=1e4,HK=2000,S6=15000,MK=50;async function k6($,J,Z,Q,X,Y){let G=new o1,V=new AbortController,K,N,H=new Promise((E,I)=>{K=E,N=I});if(H.catch(()=>{}),v0(),$.executionMode==="host")r1();Z("enrollment_started");let B=X(G);B.catch(()=>{});let q=null,M=x2($,J,(E)=>{if(!q)throw Error("worker_starting");return q(E)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,j=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),D=Y?.matches($)?Y.result:void 0;if(Y&&!D)await Y.stop();if(D)j.addEventListener("abort",()=>void Y.stop(),{once:!0});let O,F=new Promise((E)=>{O=E}),z=setTimeout(()=>O(),qK);j.addEventListener("abort",()=>O(),{once:!0});let L,W=(E)=>{if(E==="ready")L=setTimeout(()=>O(),HK);Q.onStartup?.(E)},R=d1($,Q.readinessProbes,j,H,void 0,D,F);R.final.catch(()=>{});try{let E;try{E=await B}catch(I){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((C)=>C(),()=>{}),I}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(S6,Date.parse(E.worker?.expiresAt??"")-Date.now()||S6))),K(E.roots[0].permissions),I0($,{version:1,drained:!1,revoked:!1}),await t1($,E,G,J,{...Q,onStartup:W,prestartedReadiness:R,prestartedControl:{closed:M,handle:(I)=>{q=I}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(z),clearTimeout(L),V.abort(),G.deleteBinding(),G.deleteKey(),await M.then((E)=>E(),()=>{})}}async function TK($,J,Z,Q){let{handoffFd:X}=P6($);if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>u1(T);if(K||!M)return;try{v0(),r1()}catch{return}if(Y=H5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{h2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let H;try{H=await(J.receiveStandbyHandoff??x6)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(V,MK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
-`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:B,enrollment:q}=H;try{e(g(B),!0);let M=await y6(B,()=>{});try{if(Q("lock_acquired"),t(B))throw Error("worker_ephemeral_requires_fresh_enrollment");return K$(B),await k6(B,M.owner.nonce,Q,Z,(T)=>r0(B,q,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function N$($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
-`),J.onStartup?.(K)},V={...J,onStartup:G,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(M)=>Math.min(r$,Math.max(0,Math.round(M))),N=Y.get("readiness_started"),H=Y.get("readiness_completed"),B=Y.get("handoff_received")??0,q=Object.fromEntries(w6.flatMap((M)=>{let T=Y.get(M);return T===void 0?[]:[[M,K(T-B)]]}));return{service_start_to_heartbeat_ms:K(performance.now()-B),stage_ms:q,...N!==void 0&&H!==void 0?{readiness_ms:K(H-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
-`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||M1(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await A6()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await T6($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await O6();return await V6(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await S2(T,M?void 0:r);return Z.stdout.write(JSON.stringify(_)+`
-`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await TK($,J,V,G);let K=NK($);if(!K)return Z.stdout.write(VK),0;if(M1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),H=(M)=>Z.stdout.write(JSON.stringify(M)+`
-`),B=t(N);if(K.action==="status"||K.action==="doctor"){let M=await U0(N,"status"),T=$0(N),_={enrolled:!!B||!!M,deviceId:B?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:B||M?Date.parse(B?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return H(_),0;let j=!0;try{K$(N)}catch{j=!1}return H({..._,workspace:j,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":B&&M0(N)instanceof n$?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),j&&(B||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await U0(N,M);if(T){if(H(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(FK);return 0}}e(g(N),!0);let q=await y6(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(K.action==="start")G("lock_acquired");let M=t(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")I0(N,{...T,drained:K.action==="drain"});return H({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");K$(N);let j=()=>{w0(N),L4(N)};if(_)j();let D=async()=>{let z=N2(N),L=T?await z3(N,T,z,J.enroll):await b6(N,K.credentialPath,J,z);return{proof:z,enrolled:L}},{proof:O,enrolled:F}=await D().catch((z)=>{if(T||!(z instanceof n0)||!z.deviceRemoved)throw z;return j(),D()});return y0(F,d(N).state,{proofStore:O}),I0(N,{version:1,drained:!1,revoked:!1}),H({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=M0(N),_=new n1(O$(N.apiOrigin),S0(N.proxy),T);if(I0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return w0(N),H({revoked:!0,localKeyRemoved:!0}),0}if(K$(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await k6(N,q.owner.nonce,G,V,async(T)=>K.enrollmentPath?z3(N,K.enrollmentPath,T,J.enroll):b6(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await t1(N,M,M0(N),q.owner.nonce,V)}return 0}finally{q.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
-`);let H=$.includes("--json")?void 0:Q1(K instanceof n0&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(H)Z.stderr.write(`${H}
-`);return N==="worker_revoked"&&X?0:1}}var _K=60000;async function y6($,J){let Z=Date.now()+$.shutdownGraceMs+_K,Q=!1;for(;;){let X=t0({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await U0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var FK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function b6($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return r0($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??L$($),G=await(Z.enrollmentCredentials??j$)($,Y);if(!G)throw Error(X);let V=Z.createTicketClient?.(G)??new R$(G,{credentialsPath:Y,fetchImpl:S0($.proxy)});return F4($,G,V,Q,Z.enroll)}import{spawn as LK}from"child_process";import{existsSync as jK,readFileSync as WK,unlinkSync as DK}from"fs";import{join as OK}from"path";var zK=120,AK=15,RK=5000;function t2($={}){let J=$.stateDirectory?OK($.stateDirectory,IK):null;if(J)CK(J);let Z=["/bin/bash","/usr/bin/bash"].find((B)=>jK(B));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??zK)),X=$.pid??process.pid,Y=Math.min(AK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${f6(r)} > ${f6(J)} 2>/dev/null
+`;function TK($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,G=!1;for(let V=0;V<Z.length;V++){let K=Z[V];if(K==="--json"&&!G){G=!0;continue}if(K!=="--config"&&K!=="--enrollment-file"&&K!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let N=Z[++V];if(!N||N.startsWith("--"))throw Error("worker_missing_flag_value");if(K==="--config"&&!Q)Q=N;else if(K==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=N;else if(K==="--credential-file"&&!Y&&J==="enroll")Y=N;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:G}}var _K=1e4,FK=2000,k6=15000,LK=50;async function h6($,J,Z,Q,X,Y){let G=new o1,V=new AbortController,K,N,H=new Promise((E,I)=>{K=E,N=I});if(H.catch(()=>{}),g0(),$.executionMode==="host")r1();Z("enrollment_started");let B=X(G);B.catch(()=>{});let q=null,M=x2($,J,(E)=>{if(!q)throw Error("worker_starting");return q(E)});M.catch(()=>{}),Z("readiness_started");let T=new AbortController,_,j=AbortSignal.any([V.signal,T.signal,...Q.signal?[Q.signal]:[]]),D=Y?.matches($)?Y.result:void 0;if(Y&&!D)await Y.stop();if(D)j.addEventListener("abort",()=>void Y.stop(),{once:!0});let O,F=new Promise((E)=>{O=E}),z=setTimeout(()=>O(),_K);j.addEventListener("abort",()=>O(),{once:!0});let L,W=(E)=>{if(E==="ready")L=setTimeout(()=>O(),FK);Q.onStartup?.(E)},R=d1($,Q.readinessProbes,j,H,void 0,D,F);R.final.catch(()=>{});try{let E;try{E=await B}catch(I){throw V.abort(),N(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await M.then((C)=>C(),()=>{}),I}Z("enrollment_completed"),_=setTimeout(()=>T.abort(),Math.max(1,Math.min(k6,Date.parse(E.worker?.expiresAt??"")-Date.now()||k6))),K(E.roots[0].permissions),I0($,{version:1,drained:!1,revoked:!1}),await t1($,E,G,J,{...Q,onStartup:W,prestartedReadiness:R,prestartedControl:{closed:M,handle:(I)=>{q=I}},deferOptionalLanes:!0})}finally{clearTimeout(_),clearTimeout(z),clearTimeout(L),V.abort(),G.deleteBinding(),G.deleteKey(),await M.then((E)=>E(),()=>{})}}async function jK($,J,Z,Q){let{handoffFd:X}=S6($);if(_1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,G,V=()=>{let M=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>u1(T);if(K||!M)return;try{g0(),r1()}catch{return}if(Y=_5(M),!Z.readinessProbes)setImmediate(()=>{if(K)return;try{g2()}catch{}})},K=!1,N=()=>{K=!0,clearTimeout(G),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",N),process.once("SIGINT",N);let H;try{H=await(J.receiveStandbyHandoff??w6)({fd:X,onBooted:()=>{Q("standby_booted"),G=setTimeout(V,LK)},onArriving:()=>clearTimeout(G)})}catch(M){clearTimeout(G);let T=M instanceof Error&&/^worker_standby_[a-z_]+$/.test(M.message)?M.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
+`),await Y?.stop(),(J.exitProcess??((_)=>process.exit(_)))(1),1}finally{clearTimeout(G),process.off("SIGTERM",N),process.off("SIGINT",N)}if(K)return 0;Q("handoff_received");let{config:B,enrollment:q}=H;try{e(g(B),!0);let M=await m6(B,()=>{});try{if(Q("lock_acquired"),o(B))throw Error("worker_ephemeral_requires_fresh_enrollment");return V$(B),await h6(B,M.owner.nonce,Q,Z,(T)=>e0(B,q,T,J.enroll),Y),0}finally{M.release()}}finally{await Y?.stop()}}async function M$($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,G=(K)=>{Y.set(K,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:K,pid:process.pid,timestamp:new Date().toISOString()})+`
+`),J.onStartup?.(K)},V={...J,onStartup:G,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let K=(M)=>Math.min(t$,Math.max(0,Math.round(M))),N=Y.get("readiness_started"),H=Y.get("readiness_completed"),B=Y.get("handoff_received")??0,q=Object.fromEntries(f6.flatMap((M)=>{let T=Y.get(M);return T===void 0?[]:[[M,K(T-B)]]}));return{service_start_to_heartbeat_ms:K(performance.now()-B),stage_ms:q,...N!==void 0&&H!==void 0?{readiness_ms:K(H-N)}:{}}},onEvent:(K)=>{if(K.type==="error"&&K.diagnostic){Q=!0;let N=K.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:N.stage,category:N.category,httpStatus:N.category==="http"?N.httpStatus:void 0})+`
+`)}J.onEvent?.(K)}};try{if($[0]==="__preview-probe"){if($.length!==1||_1(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await C6()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(_1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await L6($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await R6();return await H6(J)}if($[0]==="__update-restart"){let M=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!M)throw Error("worker_unknown_or_duplicate_flag");if(_1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),_=await S2(T,M?void 0:t);return Z.stdout.write(JSON.stringify(_)+`
+`),_.state==="current"?3:_.state==="busy"?75:0}if($[0]==="standby")return await jK($,J,V,G);let K=TK($);if(!K)return Z.stdout.write(MK),0;if(_1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let N=J0.parse(JSON.parse(s(K.configPath))),H=(M)=>Z.stdout.write(JSON.stringify(M)+`
+`),B=o(N);if(K.action==="status"||K.action==="doctor"){let M=await V0(N,"status"),T=$0(N),_={enrolled:!!B||!!M,deviceId:B?.deviceId??M?.deviceId??null,lifetime:N.lifetime,expired:B||M?Date.parse(B?.worker?.expiresAt??M.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:M};if(K.action==="status")return H(_),0;let j=!0;try{V$(N)}catch{j=!1}return H({..._,workspace:j,platform:process.platform,executionMode:N.executionMode,proofStorage:N.lifetime==="ephemeral"?"process-memory":B&&T0(N)instanceof r$?"login-keychain":"owner-only-file",confinement:N.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:M?.supportedOperations?"live-worker":"unavailable",reportedOperations:M?.supportedOperations??null,capabilityReadiness:M?.capabilityReadiness??null,ready:M?.executionEligible===!0&&!_.expired}),j&&(B||M)&&!_.revoked&&!_.expired?0:1}if(["drain","resume","stop"].includes(K.action)){let M=K.action==="drain"?"drain":K.action==="resume"?"resume":"stop",T=await V0(N,M);if(T){if(H(T),M==="stop"&&N.lifetime==="ephemeral"&&!K.json)Z.stderr.write(DK);return 0}}e(g(N),!0);let q=await m6(N,()=>{if(!K.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
+`)});try{if(K.action==="start")G("lock_acquired");let M=o(N);if(["drain","resume","stop"].includes(K.action)){if(!M)throw Error("worker_not_enrolled");let T=$0(N);if(T.revoked||Date.parse(M.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(K.action!=="stop")I0(N,{...T,drained:K.action==="drain"});return H({running:!1,drained:K.action==="stop"?T.drained:K.action==="drain"}),0}if(K.action==="enroll"){if(N.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=K.enrollmentPath,_=!T&&$0(N).revoked;if(M&&!_)throw Error("worker_already_enrolled");V$(N);let j=()=>{k0(N),j4(N)};if(_)j();let D=async()=>{let z=N2(N),L=T?await I3(N,T,z,J.enroll):await y6(N,K.credentialPath,J,z);return{proof:z,enrolled:L}},{proof:O,enrolled:F}=await D().catch((z)=>{if(T||!(z instanceof o0)||!z.deviceRemoved)throw z;return j(),D()});return f0(F,d(N).state,{proofStore:O}),I0(N,{version:1,drained:!1,revoked:!1}),H({enrolled:!0,deviceId:F.deviceId,lifetime:N.lifetime}),0}if(K.action==="revoke"){if(!M)throw Error("worker_not_enrolled");let T=T0(N),_=new n1(z$(N.apiOrigin),b0(N.proxy),T);if(I0(N,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(M,_);else await _.disconnect(M,AbortSignal.timeout(30000));return k0(N),H({revoked:!0,localKeyRemoved:!0}),0}if(V$(N),N.lifetime==="ephemeral"){if(M)throw Error("worker_ephemeral_requires_fresh_enrollment");await h6(N,q.owner.nonce,G,V,async(T)=>K.enrollmentPath?I3(N,K.enrollmentPath,T,J.enroll):y6(N,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(K.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!M)throw Error("worker_not_enrolled");if($0(N).revoked)X=!0;await t1(N,M,T0(N),q.owner.nonce,V)}return 0}finally{q.release()}}catch(K){let N=K instanceof Error&&(K.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(K.message))?K.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${N}.
+`);let H=$.includes("--json")?void 0:Y1(K instanceof o0&&K.deviceRemoved?"worker_enrollment_device_removed":N);if(H)Z.stderr.write(`${H}
+`);return N==="worker_revoked"&&X?0:1}}var WK=60000;async function m6($,J){let Z=Date.now()+$.shutdownGraceMs+WK,Q=!1;for(;;){let X=$$({path:d($).lock,runtimeVersion:t});if(X.acquired)return X;let Y=await V0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((V)=>setTimeout(V,250))}}var DK='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function y6($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let K=performance.now();return e0($,await Z.enrollmentInput($),Q,Z.enroll,K)}let Y=J??j$($),G=await(Z.enrollmentCredentials??W$)($,Y);if(!G)throw Error(X);let V=Z.createTicketClient?.(G)??new I$(G,{credentialsPath:Y,fetchImpl:b0($.proxy)});return L4($,G,V,Q,Z.enroll)}import{spawn as OK}from"child_process";import{existsSync as zK,readFileSync as AK,unlinkSync as RK}from"fs";import{join as IK}from"path";var CK=120,PK=15,EK=5000;function $3($={}){let J=$.stateDirectory?IK($.stateDirectory,xK):null;if(J)SK(J);let Z=["/bin/bash","/usr/bin/bash"].find((B)=>zK(B));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??CK)),X=$.pid??process.pid,Y=Math.min(PK,Q),G=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${v6(t)} > ${v6(J)} 2>/dev/null
 `:"",V=(B)=>`[ $((SECONDS - started)) -ge ${Math.max(1,B-1)} ]`,K=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
 while :; do started=$SECONDS
 IFS= read -r -t ${Q} pulse && continue
@@ -164,8 +164,8 @@ if ${V(Y)} && parent_is_worker; then
   ${G}kill -KILL ${X}
 fi
 exit 0
-done`,N=LK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let H=setInterval(()=>N.stdin.write(`
-`),Math.min(RK,Q*1000/4));return H.unref(),N.unref(),{stop(){clearInterval(H),N.stdin.end()}}}var IK="worker-stalled";function f6($){return`'${$.replaceAll("'","'\\''")}'`}function CK($){let J;try{J=WK($,"utf8"),DK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{k1(W2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var wK=`Share this computer as a machine
+done`,N=OK(Z,["-c",K],{stdio:["pipe","ignore","inherit"]});N.on("error",()=>{}),N.stdin.on("error",()=>{});let H=setInterval(()=>N.stdin.write(`
+`),Math.min(EK,Q*1000/4));return H.unref(),N.unref(),{stop(){clearInterval(H),N.stdin.end()}}}var xK="worker-stalled";function v6($){return`'${$.replaceAll("'","'\\''")}'`}function SK($){let J;try{J=AK($,"utf8"),RK($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{k1(W2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var hK=`Share this computer as a machine
 
 Usage:
   reason serve                     This computer, signed in (machine name: its hostname)
@@ -208,29 +208,29 @@ the worker unless --sandbox is set. Settings live in
 ~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
 folder served for NAME is its own worker. Use
 \`reason worker status|revoke --config <that file>\` for advanced control.
-`,kK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,yK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,d6="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",h6=["REASON_TOKEN","REASON_MACHINE_TOKEN"],l6="my-computer";function v9($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&y1(J)&&J!==I2?J:l6}class Q0 extends Error{}function fK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let H=$[N];if(H==="--help"||H==="-h"||H==="help")return null;if(H==="--dir"||H==="--token"||H==="--org"){let B=$[N+1];if(!B||B.startsWith("-"))throw new Q0(`Missing value after ${H}.`);if(Q.has(H))throw new Q0(`${H} may be specified only once.`);Q.set(H,B),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(H)){X.add(H==="-y"?"--yes":H);continue}if(H.startsWith("-"))throw new Q0(`Unknown option: ${H}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=H}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!y1(Z)&&!kK.test(Z))throw new Q0(d6);if(Z.toLowerCase()===I2)throw new Q0(`"${I2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!yK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...V===void 0?{}:{org:V.toLowerCase()}}}function J3($,J){let Z=bK($,J??"."),Q;try{Q=u6(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!xK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var o2=($)=>s$($,".reason","workers"),h9=($)=>u(d($).state);function hK($,J,Z){let Q=s$(o2($),J);if(R0(s$(Q,"worker.json"))?.workspaceRoot===Z)return Q;return s$(o2($),`${J}@${PK("sha256").update(Z).digest("hex").slice(0,8)}`)}function p6($){let{stateDirectory:J}=$;if(Z2($.workspaceRoot,J)||Z2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function R0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function m9($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function mK($,J){$.stdout.write(`${J} [y/N] `);let Z=await m6($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function Z3($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var vK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function c6($){try{return await $()}catch(J){let Z=J instanceof m0?vK[J.code]:void 0;throw Z?Error(Z):J}}async function gK($,J,Z,Q){let X=p6({...J,name:$.name??l6,stateDirectory:s$(o2(Z),".token-enrollment")}),Y=W$(X,{stored:!1}),G=await c6(()=>v6({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!y1(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??G.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function uK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??j$)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((V)=>new R$(V)))(Y);return _4(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>c6(async()=>{try{return await G.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof m0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
-`)}catch(K){if(!(K instanceof m0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,V)})})}}async function s6($,J,Z,Q){let X=await S2($,Q,()=>g6($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!q$($,J,Z))return null;return h3($),X}function g9($,J){let Z=o2($);if(!u(Z))return[];let Q=J.toLowerCase();return EK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=s$(Z,X,"worker.json"),V=R0(G);return V?[{path:G,config:V}]:[]})}async function dK($,J,Z,Q,X){let Y=g9(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??U0,V=[];for(let K of Y){let N=await G(K.config,"stop")!==null,H=$3(K.config,X),B=N||H!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:B,service:H?.label??null}),!$.json&&H)Z.stdout.write(`Removed background service ${H.label} (${K.config.workspaceRoot}); it won't start again.
+`,mK=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,vK=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,c6="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",g6=["REASON_TOKEN","REASON_MACHINE_TOKEN"],s6="my-computer";function g9($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&y1(J)&&J!==I2?J:s6}class Q0 extends Error{}function gK($,J){let Z,Q=new Map,X=new Set;for(let N=0;N<$.length;N+=1){let H=$[N];if(H==="--help"||H==="-h"||H==="help")return null;if(H==="--dir"||H==="--token"||H==="--org"){let B=$[N+1];if(!B||B.startsWith("-"))throw new Q0(`Missing value after ${H}.`);if(Q.has(H))throw new Q0(`${H} may be specified only once.`);Q.set(H,B),N+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(H)){X.add(H==="-y"?"--yes":H);continue}if(H.startsWith("-"))throw new Q0(`Unknown option: ${H}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=H}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!y1(Z)&&!mK.test(Z))throw new Q0(c6);if(Z.toLowerCase()===I2)throw new Q0(`"${I2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((N)=>N!=="--stop"&&N!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let G=Y?void 0:Q.get("--token")??J,V=Q.get("--org");if(G!==void 0){if(!G.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(V!==void 0&&!vK.test(V))throw new Q0("--org must be a workspace id.")}else if(V!==void 0)throw new Q0("--org is only used with --token.");let K=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...K===void 0?{}:{dir:K},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...G===void 0?{}:{token:G},...V===void 0?{}:{org:V.toLowerCase()}}}function X3($,J){let Z=fK($,J??"."),Q;try{Q=p6(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!kK(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var J3=($)=>a$($,".reason","workers"),m9=($)=>u(d($).state);function uK($,J,Z){let Q=a$(J3($),J);if(R0(a$(Q,"worker.json"))?.workspaceRoot===Z)return Q;return a$(J3($),`${J}@${bK("sha256").update(Z).digest("hex").slice(0,8)}`)}function a6($){let{stateDirectory:J}=$;if(Z2($.workspaceRoot,J)||Z2(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function R0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function v9($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function dK($,J){$.stdout.write(`${J} [y/N] `);let Z=await u6($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function Y3($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var lK={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function i6($){try{return await $()}catch(J){let Z=J instanceof v0?lK[J.code]:void 0;throw Z?Error(Z):J}}async function pK($,J,Z,Q){let X=a6({...J,name:$.name??s6,stateDirectory:a$(J3(Z),".token-enrollment")}),Y=D$(X,{stored:!1}),G=await i6(()=>d6({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!y1(G.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==G.machine_name.toLowerCase())throw new Q0(`This token is for machine "${G.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==G.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${G.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let V=!1;return{name:$.name??G.machine_name,input:(K)=>{if(V)throw Error("worker_ticket_receipt_mismatch");return V=!0,Y.saveInstall(K),Y.complete(G.organization_id,G)}}}function cK($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??W$)(X);if(!Y)throw Error("worker_session_login_required");let G=(Z.createApi??((V)=>new I$(V)))(Y);return F4(X,Y,{createHeadlessDeviceEnrollmentTicket:(V)=>i6(async()=>{try{return await G.createMachineEnrollmentTicket($,V)}catch(K){if(!(K instanceof v0)||K.code!=="machine_not_found")throw K}try{await G.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
+`)}catch(K){if(!(K instanceof v0)||K.status!==409)throw K}return G.createMachineEnrollmentTicket($,V)})})}}async function n6($,J,Z,Q){let X=await S2($,Q,()=>l6($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!T$($,J,Z))return null;return g3($),X}function u9($,J){let Z=J3($);if(!u(Z))return[];let Q=J.toLowerCase();return wK(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let G=a$(Z,X,"worker.json"),V=R0(G);return V?[{path:G,config:V}]:[]})}async function sK($,J,Z,Q,X){let Y=u9(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let G=Q.controlWorker??V0,V=[];for(let K of Y){let N=await G(K.config,"stop")!==null,H=Q3(K.config,X),B=N||H!==null;if(V.push({config:K.path,folder:K.config.workspaceRoot,running:B,service:H?.label??null}),!$.json&&H)Z.stdout.write(`Removed background service ${H.label} (${K.config.workspaceRoot}); it won't start again.
 `);if(!$.json)Z.stdout.write(B?`Stopping machine "${$.name}" in ${K.config.workspaceRoot}; current work finishes first.
 `:`Machine "${$.name}" in ${K.config.workspaceRoot} is not running.
 `)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:V})}
-`);return 0}async function a6($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??N$,X=J.env??process.env,Y=h6.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of h6)delete process.env[G];try{let G=fK($,Y);if(!G)return Z.stdout.write(wK),0;let V=u6(J.home??B0()),K=J.serviceHost??J$(V);if(G.stop)return await dK({...G,name:G.name},V,Z,J,K);let N=J.channel??$$(),H=J3(J.cwd??process.cwd(),G.dir),B=G.service?T1(K,X):void 0,q={channel:N,apiOrigin:Q2(X,N),workspaceRoot:H,once:G.once,sandbox:G.sandbox},M=G.token?await gK({...G,token:G.token},q,V,J):void 0,T=M?.name??G.name??v9((J.hostname??SK)()),_=hK(V,T,H),j=s$(_,"worker.json"),D=R0(j);if(M&&D&&h9(D)&&$0(D).revoked)w0(D);let O=!M&&D!==null&&h9(D)&&(!D$(X,"REASON_API_URL")?.trim()||C0(q.apiOrigin,D.apiOrigin))?D.apiOrigin:void 0,F=p6({...q,...O?{apiOrigin:O}:{},name:T,stateDirectory:_}),z=D!==null&&h9(D);if(z&&N0(D)!==N0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${D.workspaceRoot}, ${D.executionMode==="host"?"your user permissions":"sandboxed"}).
-Run it with: reason serve ${T} ${m9(D)}
-Or remove it first: reason worker revoke --config ${j}`)}let L=F.lifetime==="persistent"?_1(F,K):null;if(L&&!G.service&&X[p$]!==L.label)return Z.stdout.write(`Machine "${T}" in ${H} already runs as a background service (${L.label}).
+`);return 0}async function r6($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??M$,X=J.env??process.env,Y=g6.map((G)=>X[G]?.trim()).find(Boolean)||void 0;if(!J.env)for(let G of g6)delete process.env[G];try{let G=gK($,Y);if(!G)return Z.stdout.write(hK),0;let V=p6(J.home??U0()),K=J.serviceHost??X$(V);if(G.stop)return await sK({...G,name:G.name},V,Z,J,K);let N=J.channel??Q$(),H=X3(J.cwd??process.cwd(),G.dir),B=G.service?F1(K,X):void 0,q={channel:N,apiOrigin:Q2(X,N),workspaceRoot:H,once:G.once,sandbox:G.sandbox},M=G.token?await pK({...G,token:G.token},q,V,J):void 0,T=M?.name??G.name??g9((J.hostname??yK)()),_=uK(V,T,H),j=a$(_,"worker.json"),D=R0(j);if(M&&D&&m9(D)&&$0(D).revoked)k0(D);let O=!M&&D!==null&&m9(D)&&(!O$(X,"REASON_API_URL")?.trim()||C0(q.apiOrigin,D.apiOrigin))?D.apiOrigin:void 0,F=a6({...q,...O?{apiOrigin:O}:{},name:T,stateDirectory:_}),z=D!==null&&m9(D);if(z&&N0(D)!==N0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${D.workspaceRoot}, ${D.executionMode==="host"?"your user permissions":"sandboxed"}).
+Run it with: reason serve ${T} ${v9(D)}
+Or remove it first: reason worker revoke --config ${j}`)}let L=F.lifetime==="persistent"?L1(F,K):null;if(L&&!G.service&&X[c$]!==L.label)return Z.stdout.write(`Machine "${T}" in ${H} already runs as a background service (${L.label}).
   Logs: ${L.logs}
   Stop it with: reason stop ${T}
-`),0;if(G.service&&z&&!L&&await(J.controlWorker??U0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${H}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let W=F.lifetime==="ephemeral"||!z;if(W&&!y1(T))throw new Q0(d6);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
+`),0;if(G.service&&z&&!L&&await(J.controlWorker??V0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${H}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let W=F.lifetime==="ephemeral"||!z;if(W&&!y1(T))throw new Q0(c6);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
 `);else if(W&&!G.yes&&!M){let I=`Sessions on "${T}" will run commands in ${H} with your user permissions (no sandbox). Continue?`,C=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!C)throw new Q0(`${I.replace(/ Continue\?$/,"")}
-Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>mK(Z,h)))(I))return Z.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!z)e(F.stateDirectory,!0),c(j,F);let R={...J.worker,enrollmentInput:uK(T,M,J,Z)};if(F.lifetime==="persistent"&&!z){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
-`);let C=await Q(["enroll","--config",j],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(C!==0)return C}if(B){let I;try{I=e2({config:F,launcher:B,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(C){if(!(C instanceof I$))throw C;throw new Q0(`${C.message}
-This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${m9(F)}
-Or try the background service again with: reason serve ${T} ${m9(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${H}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${I.label} (starts at ${I.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${I.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...I.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
+Re-run with --yes to confirm.`);if(!await(J.confirm??((h)=>dK(Z,h)))(I))return Z.stderr.write(`Cancelled. Nothing was added.
+`),1}if(!z)e(F.stateDirectory,!0),c(j,F);let R={...J.worker,enrollmentInput:cK(T,M,J,Z)};if(F.lifetime==="persistent"&&!z){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
+`);let C=await Q(["enroll","--config",j],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(C!==0)return C}if(B){let I;try{I=Z3({config:F,launcher:B,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:K})}catch(C){if(!(C instanceof C$))throw C;throw new Q0(`${C.message}
+This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${v9(F)}
+Or try the background service again with: reason serve ${T} ${v9(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${H}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${I.label} (starts at ${I.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${I.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...I.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
 `)),0}Z.stdout.write([`Reason machine "${T}"`,`  Folder:   ${H}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Lifetime: ${F.lifetime==="persistent"?`saved; run \`reason serve ${T}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
-`));let E=L&&X[p$]===L.label&&!J.runWorker?t2({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",j],{...R,io:{stdout:Z.stdout,stderr:Z3(Z.stderr)},onStartup:(I)=>{if(I==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
-`);J.worker?.onStartup?.(I)}})}finally{E?.stop()}}catch(G){if(G instanceof Q0||G instanceof I$){let N=G instanceof I$&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
-`),2}let V=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:null,K=V?Q1(V):void 0;return Z.stderr.write(`Reason: ${V?K?`${K} (${V})`:V:"could not prepare this machine."}
-`),1}}var lK=200;var zL=U.strictObject({version:U.literal(1),session_ids:U.array(U.string().min(1).max(200)).max(lK)});function F1($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as i6}from"child_process";import{readFileSync as pK,rmdirSync as cK,rmSync as sK}from"fs";import{join as u9}from"path";var aK=["Reason.app","Ara Sidecar.app","Ara Device.app"],iK="sidecar_retire_failed";function nK($){return u9($,"Library","Application Support","Ara","Sidecar")}function rK($){try{let J=pK(u9($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function r6($,J={}){let Z=nK($),Q=aK.map((V)=>u9(Z,V)).filter(rK);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>i6("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),G=J.command??((V,K)=>i6(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
-`)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)G(n6,["-u",V]),sK(V,{recursive:!0,force:!0});try{cK(Z)}catch{}}catch{return{status:"failed",code:iK}}return{status:"removed",bundles:Q}}var QB=`Connect this computer to Reason
+`));let E=L&&X[c$]===L.label&&!J.runWorker?$3({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",j],{...R,io:{stdout:Z.stdout,stderr:Y3(Z.stderr)},onStartup:(I)=>{if(I==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
+`);J.worker?.onStartup?.(I)}})}finally{E?.stop()}}catch(G){if(G instanceof Q0||G instanceof C$){let N=G instanceof C$&&G.code?` (${G.code})`:"";return Z.stderr.write(`Reason: ${G.message}${N}
+`),2}let V=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:null,K=V?Y1(V):void 0;return Z.stderr.write(`Reason: ${V?K?`${K} (${V})`:V:"could not prepare this machine."}
+`),1}}var aK=200;var PL=U.strictObject({version:U.literal(1),session_ids:U.array(U.string().min(1).max(200)).max(aK)});function j1($){let J=o($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as t6}from"child_process";import{readFileSync as iK,rmdirSync as nK,rmSync as rK}from"fs";import{join as d9}from"path";var tK=["Reason.app","Ara Sidecar.app","Ara Device.app"],oK="sidecar_retire_failed";function eK($){return d9($,"Library","Application Support","Ara","Sidecar")}function $B($){try{let J=iK(d9($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function e6($,J={}){let Z=eK($),Q=tK.map((V)=>d9(Z,V)).filter($B);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>t6("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((V)=>process.kill(V,"SIGTERM")),G=J.command??((V,K)=>t6(V,[...K],{stdio:"ignore",timeout:1e4}).status??1);try{for(let V of X().split(`
+`)){let K=V.trim().match(/^(\d+)\s+(.+)$/);if(!K)continue;if(!Q.some((N)=>K[2].startsWith(`${N}/Contents/MacOS/`)))continue;try{Y(Number(K[1]))}catch{}}for(let V of Q)G(o6,["-u",V]),rK(V,{recursive:!0,force:!0});try{nK(Z)}catch{}}catch{return{status:"failed",code:oK}}return{status:"removed",bundles:Q}}var KB=`Connect this computer to Reason
 
 Usage:
   reason connect                 Your computer, kept connected in the background
@@ -286,7 +286,7 @@ One computer serves several Reason accounts. Signed in as another account than
 the one it is connected for, reason connect connects it for that account too,
 as that account's own computer in the workspace it signed in to; the other
 accounts stay connected. That account's \`reason logout\` removes only its own.
-`,XB=`Disconnect this computer from Reason
+`,BB=`Disconnect this computer from Reason
 
 Usage:
   reason disconnect              Stop your computer's connection and remove it from Reason, in every
@@ -301,43 +301,43 @@ Usage:
                                  Reason (all of it when it is the only account here), and it is not kept
                                  disconnected: the next reason "\u2026" connects it again
   --yes, -y                      Accepted for scripts; disconnect never asks
-`;class p extends Error{code;constructor($,J="worker_connect_refused"){super($);this.code=J}}var YB=4,Y3={write:()=>!0};function g0($,J,Z=!1){let Q=F7($,J,Z);return Q.length===1?Q[0]:_0(Z7(_0($,".config")),..._7(J,Z))}var _7=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function F7($,J,Z=!1){let Q=$;try{Q=Z$($)}catch{}return["ara","reason"].map((X)=>_0(Q,".config",X,..._7(J,Z))).filter(GB)}function GB($){try{if(Z$($)!==$)return!1;return R0(_0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var L7="disconnected.json";function Nj($,J){return u(_0(g0($,J),L7))}function G3($,J,Z){let Q=_0(g0($,J),L7);if(!Z){L1(Q,{force:!0});return}e(s9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function KB($){let J=new Map,Z=new Set;for(let B=0;B<$.length;B+=1){let q=$[B];if(q==="--help"||q==="-h"||q==="help")return null;if(["--to","--token","--folder","--sessions",Q3,X3,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(q)){let M=$[B+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${q}.`);if(J.has(q))throw new p(`${q} may be specified only once.`);J.set(q,M),B+=1;continue}if(["--once","--yes","-y","--minimal"].includes(q)){Z.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new p(`Unknown option: ${q}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${q}. To add this computer to a team machine, use --to ${q}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(X3)&&!J.has(Q3))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((B)=>B!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((B)=>J.has(B));if(Y.length>0&&(J.size>1||[...Z].some((B)=>B!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let H=(B,q)=>q===void 0?{}:{[B]:q};return{...H("to",J.get("--to")),...H("token",J.get("--token")),...H("folder",J.get("--folder")),...H("sessions",Q===void 0?void 0:Number(Q)),...H("keepAwake",X===void 0?void 0:X==="on"),...H("userChrome",G===void 0?void 0:G==="on"),...H("cloudSessions",V===void 0?void 0:V==="on"),...H("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...H("proxy",J.get(Q3)),...H("proxyCaFile",J.get(X3)),...H("apiKey",J.get("--api-key")),...H("name",N),...H("apiUrl",J.get("--api-url")),...H("addFolder",J.get("--add-folder")),...H("removeFolder",J.get("--remove-folder"))}}var C$=($)=>u(d($).state),j7=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function W7($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function D7($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=J3($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!A1(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?Q2({REASON_API_URL:J.apiUrl},$.channel):Z&&!D$($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:Q2($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&C0(X,Z.apiOrigin))X=Z.apiOrigin;if(!J7(X)&&!$7($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=Y7({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof Q7))throw V;throw new p(V.message)}let G=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??v9(($.options.hostname??JB)()),slots:J.sessions??Z?.slots??YB,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function O7($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function a9($,J,Z,Q,X){if($0($).revoked){if(C$($))try{w0($)}catch{}C3($);let V=[];try{V=$B(g($))}catch{}for(let K of V)if(K!=="workspaces")L1(_0(g($),K),{recursive:!0,force:!0})}else if(C$($))w0($);e($.stateDirectory,!0),c(J,$);let Y=BB(Z.stderr),G=await(Q.runWorker??N$)(["enroll","--config",J],{...i9(Q.worker,X),io:{stdout:Y3,stderr:Y}});if(G!==0)Z.stderr.write(`Reason: this computer was not connected. (${Y.code()??"worker_command_failed"})
-`);return G}function BB($){let J=null;return{write:(Z)=>{for(let Q of Z.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))J=Q[1];return $.write(Z)},code:()=>J}}function X2($,J,Z){let Q=K7(q2(P1("REASON_CLI_CHANNEL",J),$));return Q&&C0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function UB($,J,Z,Q){let{config:X,configPath:Y}=T2($,J),G=(N)=>{try{return N!==null&&F1(N)&&t(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=R0(Y)}catch{}if(G(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let K=await a9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&C$(X))await K3(X,Y,Z,Q);if(L1(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function i9($,J){return J?{...$,enrollmentCredentials:(Z)=>_3(Z,J)}:{...$}}async function n9($,J,Z,Q,X,Y="connect"){if(await r9($,Q,X,Y),Y==="connect"&&!await P7($,Z,Q))return!1;if(!await K3($,J,Z,Q))return!1;return G4($.stateDirectory),L1($.stateDirectory,{recursive:!0,force:!0}),!0}async function K3($,J,Z,Q){if(!C$($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??N$)(["revoke","--config",J],{...Q.worker,io:{stdout:Y3,stderr:Y?Z.stderr:Y3}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function r9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??U0,G=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&$3($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((H)=>setTimeout(H,250))}}function t9($,J){return J==="darwin"&&$.userChrome!==!1}function d9($,J,Z){let Q=[...t9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${W7($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
-`)}function l9($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),"  Sessions:  every Session you start",`  Mode:      ${W7(J)}`,...J.proxy?[`  Proxy:     ${X7(J.proxy)}`]:[],...t9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
-`)}async function t6($,J,Z){let{io:Q,options:X}=Z;if(F7(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:s9(J),timestamp:new Date().toISOString()})}
-`);let Y=A2(_0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
-`);P9(Z.home,Z.host.platform);let G=G8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(M)=>Q.stderr.write(`${M}
-`),host:Z.host}),V=o4({...G,log:(M)=>Q.stderr.write(`${M}
-`)}),{configPath:K}=V,N=V.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let H=(M,T)=>{let _=U3(Z.home,Z.channel),j;try{let O=null;try{O=T.keep?null:t(N)?.orgId.toLowerCase()??null}catch{}if(j=F2(N,{prefer:X2(Z.home,Z.channel,N),...T}),j&&O)_2(j,O)}finally{_()}if(!j)return!1;N=j;let D="";try{D=` (workspace ${t(j)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${M}; this computer goes on running Sessions for its other Reason account${D}.
-`),!0};if($0(N).revoked&&!H("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!F1(N)){let M=u0(N.stateDirectory)??void 0,T=M?null:X2(Z.home,Z.channel,N);if(!M&&!(T&&x1(N,T)))H("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let B=N.executionMode==="confined";if(B||!F1(N)){let M=u0(N.stateDirectory)??void 0;if(Q.stderr.write(B?j7:`Reason: this computer's connection expired; renewing it with ${M?"its API key":"your login"}\u2026
-`),await a9(J0.parse({...N,executionMode:"host"}),K,Q,X,M)!==0)return Q.stderr.write(M?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let q=new AbortController;if(!X.runWorker)import("./ask-relay-z5ykm780.js").then(({runBackgroundAskRelay:M})=>M(q.signal,(T)=>Q.stderr.write(`${T}
-`))).catch(()=>{});try{for(;;){let M=u0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:t2({stateDirectory:N.stateDirectory}),_=!1,j;try{j=await(X.runWorker??N$)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...M,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{_=!0}})}finally{T?.stop()}if(!_)return j;if(!H("this computer's connection was removed from Reason",{keep:!1}))break}return G3(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{q.abort()}}async function VB($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??U0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=g0(Y,G,!0),N=D7({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),H=O7(N,Z.apiKey??(J?u0(J.stateDirectory)??void 0:void 0)),B=_0(K,"worker.json");return e(K,!0),c(B,H),Q.stdout.write(l9(`Reason: connecting "${H.name}" while this command runs`,H,Z.host.platform,["Connecting\u2026"])),(X.runWorker??N$)(["start","--config",B],{...i9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:Z3(Q.stderr)},onStartup:(q)=>{if(q==="ready")Q.stdout.write(`Connected. Start Sessions on "${H.name}" from Reason. Press Ctrl-C to stop.
-`);X.worker?.onStartup?.(q)}})}function NB($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),V8(d(J).daemon,$);let X=R2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var qB=U.object({root:U.object({id:U.string().min(1).max(160),label:U.string().max(160),path_fingerprint:U.string()})});async function z7($,J,Z,Q){let X=await(i9(Q.worker,Z).enrollmentCredentials??j$)($,L$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new R$(X,{credentialsPath:L$($),fetchImpl:S0($.proxy)}),G=(V)=>V instanceof m0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=j4($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((B)=>{if(G(B))throw Error("worker_folders_unavailable");if(B instanceof m0&&B.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw B}),H=qB.parse(N).root;if(H.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:H.id,label:H.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof m0&&K.code==="root_not_found"))throw K})}}}function A7($,J,Z){y0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:N0($)}},d($).state,{proofStore:M0($)})}async function R7($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&u0(J.stateDirectory)===null?X2(Q.home,Q.channel,J):null,K=J&&V&&C$(J)&&!x1(J,V)?k0(J).find((I)=>I.account&&I.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,H=K?K.configPath:Z,B=N&&C$(N)&&!$0(N).revoked?t(N):null;if(!J||!N||!B||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let q=$.addFolder!==void 0,M=q?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=J3(T,M)}catch(I){if(q)throw new p(I instanceof Error?I.message:String(I));_=ZB(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let j=N.folders??[],D=B.roots.slice(1).find((I)=>I.path===_);if(!q&&!D&&!j.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(q&&!A1(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(q&&!D&&j.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??u0(N.stateDirectory)??void 0,F=await z7(N,B,O,Y),z=B.roots.filter((I)=>I.path!==_);if(q)z=[...z,await F.add(_)];else if(D)await F.remove(D.id);A7(N,B,z);let L=q?[...j.filter((I)=>I!==_),_]:j.filter((I)=>I!==_),{folders:W,...R}=N;if(c(H,J0.parse({...R,...L.length?{folders:L}:{}})),!await(Y.controlWorker??U0)(J,"reload_roots").then(()=>!0,()=>!1))q$(J,G,"connect");return X.stdout.write(q?`Added ${_}. Sessions on "${N.name}" may run in it.
+`;class p extends Error{code;constructor($,J="worker_connect_refused"){super($);this.code=J}}var UB=4,B3={write:()=>!0};function u0($,J,Z=!1){let Q=W7($,J,Z);return Q.length===1?Q[0]:F0(Y7(F0($,".config")),...j7(J,Z))}var j7=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function W7($,J,Z=!1){let Q=$;try{Q=Y$($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...j7(J,Z))).filter(VB)}function VB($){try{if(Y$($)!==$)return!1;return R0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var D7="disconnected.json";function _j($,J){return u(F0(u0($,J),D7))}function U3($,J,Z){let Q=F0(u0($,J),D7);if(!Z){W1(Q,{force:!0});return}e(a9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function NB($){let J=new Map,Z=new Set;for(let B=0;B<$.length;B+=1){let q=$[B];if(q==="--help"||q==="-h"||q==="help")return null;if(["--to","--token","--folder","--sessions",G3,K3,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(q)){let M=$[B+1];if(!M||M.startsWith("-"))throw new p(`Missing value after ${q}.`);if(J.has(q))throw new p(`${q} may be specified only once.`);J.set(q,M),B+=1;continue}if(["--once","--yes","-y","--minimal"].includes(q)){Z.add(q==="-y"?"--yes":q);continue}if(q.startsWith("-"))throw new p(`Unknown option: ${q}. Run \`reason connect --help\`.`);throw new p(`Unexpected argument: ${q}. To add this computer to a team machine, use --to ${q}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new p("--sessions takes a number from 1 to 4.");if(J.has(K3)&&!J.has(G3))throw new p("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new p("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((B)=>B!=="--yes")))throw new p("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((B)=>J.has(B));if(Y.length>0&&(J.size>1||[...Z].some((B)=>B!=="--yes")))throw new p(`Run reason connect ${Y[0]} PATH on its own.`);let G=J.get("--user-chrome");if(G!==void 0&&G!=="on"&&G!=="off")throw new p("--user-chrome takes on or off.");let V=J.get("--cloud-sessions");if(V!==void 0&&V!=="on"&&V!=="off")throw new p("--cloud-sessions takes on or off.");let K=J.get("--local-logins");if(K!==void 0&&K!=="on"&&K!=="off")throw new p("--local-logins takes on or off.");let N=J.get("--name")?.trim();if(N!==void 0&&(N.length===0||N.length>160))throw new p("--name takes a name of 1 to 160 characters.");let H=(B,q)=>q===void 0?{}:{[B]:q};return{...H("to",J.get("--to")),...H("token",J.get("--token")),...H("folder",J.get("--folder")),...H("sessions",Q===void 0?void 0:Number(Q)),...H("keepAwake",X===void 0?void 0:X==="on"),...H("userChrome",G===void 0?void 0:G==="on"),...H("cloudSessions",V===void 0?void 0:V==="on"),...H("localLogins",K===void 0?void 0:K==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...H("proxy",J.get(G3)),...H("proxyCaFile",J.get(K3)),...H("apiKey",J.get("--api-key")),...H("name",N),...H("apiUrl",J.get("--api-url")),...H("addFolder",J.get("--add-folder")),...H("removeFolder",J.get("--remove-folder"))}}var P$=($)=>u(d($).state),O7=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function z7($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function A7($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=X3($.options.cwd??process.cwd(),J.folder)}catch(V){throw new p(V instanceof Error?V.message:String(V))}if(!R1(Q,$.stateDirectory))throw new p(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?Q2({REASON_API_URL:J.apiUrl},$.channel):Z&&!O$($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:Q2($.environment,$.channel)}catch(V){throw new p(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${V instanceof Error?V.message:String(V)}`)}if(Z&&X!==Z.apiOrigin&&C0(X,Z.apiOrigin))X=Z.apiOrigin;if(!X7(X)&&!Q7($.channel,X))throw new p(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=B7({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(V){if(!(V instanceof G7))throw V;throw new p(V.message)}let G=(Z?.folders??[]).filter((V)=>V!==Q);return J0.parse({...G.length?{folders:G}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??g9(($.options.hostname??YB)()),slots:J.sessions??Z?.slots??UB,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function R7($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function i9($,J,Z,Q,X){if($0($).revoked){if(P$($))try{k0($)}catch{}x3($);let V=[];try{V=XB(g($))}catch{}for(let K of V)if(K!=="workspaces")W1(F0(g($),K),{recursive:!0,force:!0})}else if(P$($))k0($);e($.stateDirectory,!0),c(J,$);let Y=qB(Z.stderr),G=await(Q.runWorker??M$)(["enroll","--config",J],{...n9(Q.worker,X),io:{stdout:B3,stderr:Y}});if(G!==0)Z.stderr.write(`Reason: this computer was not connected. (${Y.code()??"worker_command_failed"})
+`);return G}function qB($){let J=null;return{write:(Z)=>{for(let Q of Z.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))J=Q[1];return $.write(Z)},code:()=>J}}function X2($,J,Z){let Q=V7(q2(E1("REASON_CLI_CHANNEL",J),$));return Q&&C0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function HB($,J,Z,Q){let{config:X,configPath:Y}=T2($,J),G=(N)=>{try{return N!==null&&j1(N)&&o(N)?.orgId.toLowerCase()===J}catch{return!1}},V=null;try{V=R0(Y)}catch{}if(G(V))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let K=await i9(X,Y,Z,Q,void 0);if(K===0&&G(X))return 0;if(K===0&&P$(X))await V3(X,Y,Z,Q);if(W1(X.stateDirectory,{recursive:!0,force:!0}),K!==0)return K;throw new p("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function n9($,J){return J?{...$,enrollmentCredentials:(Z)=>j3(Z,J)}:{...$}}async function r9($,J,Z,Q,X,Y="connect"){if(await t9($,Q,X,Y),Y==="connect"&&!await S7($,Z,Q))return!1;if(!await V3($,J,Z,Q))return!1;return K4($.stateDirectory),W1($.stateDirectory,{recursive:!0,force:!0}),!0}async function V3($,J,Z,Q){if(!P$($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??M$)(["revoke","--config",J],{...Q.worker,io:{stdout:B3,stderr:Y?Z.stderr:B3}})===0)return!0;if(Y)return!1;await new Promise((V)=>setTimeout(V,1000))}}async function t9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??V0,G=async()=>Y($,"status").catch(()=>null),V=await Y($,"stop").catch(()=>null)!==null,K=!X&&Q3($,Z,Q);if(V||K){let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await G()!==null)await new Promise((H)=>setTimeout(H,250))}}function o9($,J){return J==="darwin"&&$.userChrome!==!1}function l9($,J,Z){let Q=[...o9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${z7($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
+`)}function p9($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),"  Sessions:  every Session you start",`  Mode:      ${z7(J)}`,...J.proxy?[`  Proxy:     ${K7(J.proxy)}`]:[],...o9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
+`)}async function $7($,J,Z){let{io:Q,options:X}=Z;if(W7(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:a9(J),timestamp:new Date().toISOString()})}
+`);let Y=A2(F0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
+`);E9(Z.home,Z.host.platform);let G=B8({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(M)=>Q.stderr.write(`${M}
+`),host:Z.host}),V=$8({...G,log:(M)=>Q.stderr.write(`${M}
+`)}),{configPath:K}=V,N=V.saved;if(!N)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let H=(M,T)=>{let _=q3(Z.home,Z.channel),j;try{let O=null;try{O=T.keep?null:o(N)?.orgId.toLowerCase()??null}catch{}if(j=F2(N,{prefer:X2(Z.home,Z.channel,N),...T}),j&&O)_2(j,O)}finally{_()}if(!j)return!1;N=j;let D="";try{D=` (workspace ${o(j)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${M}; this computer goes on running Sessions for its other Reason account${D}.
+`),!0};if($0(N).revoked&&!H("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(N.executionMode==="confined"||!j1(N)){let M=l0(N.stateDirectory)??void 0,T=M?null:X2(Z.home,Z.channel,N);if(!M&&!(T&&x1(N,T)))H("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let B=N.executionMode==="confined";if(B||!j1(N)){let M=l0(N.stateDirectory)??void 0;if(Q.stderr.write(B?O7:`Reason: this computer's connection expired; renewing it with ${M?"its API key":"your login"}\u2026
+`),await i9(J0.parse({...N,executionMode:"host"}),K,Q,X,M)!==0)return Q.stderr.write(M?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let q=new AbortController;if(!X.runWorker)import("./ask-relay-mxa9m9t7.js").then(({runBackgroundAskRelay:M})=>M(q.signal,(T)=>Q.stderr.write(`${T}
+`))).catch(()=>{});try{for(;;){let M=l0(N.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:$3({stateDirectory:N.stateDirectory}),_=!1,j;try{j=await(X.runWorker??M$)(["start","--config",K],{deferOptionalLanes:!0,...X.worker,...M,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{_=!0}})}finally{T?.stop()}if(!_)return j;if(!H("this computer's connection was removed from Reason",{keep:!1}))break}return U3(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{q.abort()}}async function MB($,J,Z){let{io:Q,options:X,home:Y,channel:G,environment:V}=Z;if(J&&await(X.controlWorker??V0)(J,"status").catch(()=>null))throw new p("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let K=u0(Y,G,!0),N=A7({parsed:$,saved:J,stateDirectory:K,lifetime:"ephemeral",home:Y,channel:G,options:X,environment:V}),H=R7(N,Z.apiKey??(J?l0(J.stateDirectory)??void 0:void 0)),B=F0(K,"worker.json");return e(K,!0),c(B,H),Q.stdout.write(p9(`Reason: connecting "${H.name}" while this command runs`,H,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M$)(["start","--config",B],{...n9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:Y3(Q.stderr)},onStartup:(q)=>{if(q==="ready")Q.stdout.write(`Connected. Start Sessions on "${H.name}" from Reason. Press Ctrl-C to stop.
+`);X.worker?.onStartup?.(q)}})}function TB($,J,Z,Q){if(Z.platform!=="darwin")throw new p("--keep-awake is for macOS.");if(!J)throw new p("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),q8(d(J).daemon,$);let X=R2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
+`),0}var _B=U.object({root:U.object({id:U.string().min(1).max(160),label:U.string().max(160),path_fingerprint:U.string()})});async function I7($,J,Z,Q){let X=await(n9(Q.worker,Z).enrollmentCredentials??W$)($,j$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new I$(X,{credentialsPath:j$($),fetchImpl:b0($.proxy)}),G=(V)=>V instanceof v0&&V.status===404&&!["device_not_found","root_not_found"].includes(V.code);return{add:async(V)=>{let K=W4($,V,{...J.roots[0].permissions,expose_mcp:!1}),N=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:K.pathFingerprint,label:K.label,permissions:{...K.permissions,expose_mcp:!1}}).catch((B)=>{if(G(B))throw Error("worker_folders_unavailable");if(B instanceof v0&&B.code==="root_limit_reached")throw new p("This computer already has the most folders Reason allows (32).");throw B}),H=_B.parse(N).root;if(H.path_fingerprint!==K.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...K,id:H.id,label:H.label}},remove:async(V)=>{await Y.removeDeviceRoot(J.deviceId,V).catch((K)=>{if(G(K))throw Error("worker_folders_unavailable");if(!(K instanceof v0&&K.code==="root_not_found"))throw K})}}}function C7($,J,Z){f0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:N0($)}},d($).state,{proofStore:T0($)})}async function P7($,J,Z,Q){let{io:X,options:Y,host:G}=Q,V=J&&!Q.apiKey&&l0(J.stateDirectory)===null?X2(Q.home,Q.channel,J):null,K=J&&V&&P$(J)&&!x1(J,V)?y0(J).find((I)=>I.account&&I.organizationId===V)??null:void 0;if(K===null)throw new p("This computer is not connected for your account. Run reason connect first.");let N=K?K.config:J,H=K?K.configPath:Z,B=N&&P$(N)&&!$0(N).revoked?o(N):null;if(!J||!N||!B||N.lifetime!=="persistent")throw new p("This computer is not connected to Reason. Run reason connect first.");let q=$.addFolder!==void 0,M=q?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),_;try{_=X3(T,M)}catch(I){if(q)throw new p(I instanceof Error?I.message:String(I));_=GB(T,M)}if(_===N.workspaceRoot)throw new p(`${_} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let j=N.folders??[],D=B.roots.slice(1).find((I)=>I.path===_);if(!q&&!D&&!j.includes(_))throw new p(`${_} is not one of this computer's folders.`);if(q&&!R1(_,N.stateDirectory))throw new p(`${_} holds Reason's own settings.`);if(q&&!D&&j.length>=31)throw new p("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??l0(N.stateDirectory)??void 0,F=await I7(N,B,O,Y),z=B.roots.filter((I)=>I.path!==_);if(q)z=[...z,await F.add(_)];else if(D)await F.remove(D.id);C7(N,B,z);let L=q?[...j.filter((I)=>I!==_),_]:j.filter((I)=>I!==_),{folders:W,...R}=N;if(c(H,J0.parse({...R,...L.length?{folders:L}:{}})),!await(Y.controlWorker??V0)(J,"reload_roots").then(()=>!0,()=>!1))T$(J,G,"connect");return X.stdout.write(q?`Added ${_}. Sessions on "${N.name}" may run in it.
 `:`Removed ${_}. Sessions on "${N.name}" no longer run in it.
-`),0}async function qj($,J,Z){let Q=p9(Z),X=U3(Q.home,Q.channel);try{let Y=_0(g0(Q.home,Q.channel),"worker.json");return await R7({once:!1,yes:J,addFolder:$},R0(Y),Y,Q)===0}finally{X()}}function p9($,J){let Z=Z$($.home??B0()),Q=$.env??process.env;return{io:$.io??B3(),options:$,home:Z,channel:$.channel??$$(),environment:Q,apiKey:J??B7(Q),host:$.serviceHost??J$(Z)}}async function HB($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await z7($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}A7(J,X,Y)}var I7=Symbol("serve here");async function MB($,J,Z,Q){let{io:X,options:Y,home:G,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let P=r6(G);if(P.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${P.code}).
-`)}let H=J&&!Q.apiKey&&u0(J.stateDirectory)===null?X2(G,V,J):null,B=J&&H&&$0(J).revoked&&k0(J).some((P)=>P.account&&P.organizationId===H)?F2(J,{prefer:H,keep:!1})??J:J,q=D7({parsed:$,saved:B,stateDirectory:g0(G,V),lifetime:"persistent",home:G,channel:V,options:Y,environment:K});if(G3(G,V,!1),B?.executionMode==="confined")X.stdout.write(j7);let M=B?u0(B.stateDirectory):null,T=O7(q,Q.apiKey??M??void 0),_=T1(N,K),j=B!==null&&C$(B),D=j&&N0(B)===N0(T),O=D&&F1(T),F=B?.userChrome!==!1===(T.userChrome!==!1)&&B?.cloudSessions===T.cloudSessions&&B?.localLogins===T.localLogins,z=Q.apiKey??M??void 0,L=H!==null&&j&&!$0(B).revoked&&!x1(B,H);if(L){if(!D||!F||JSON.stringify(B.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let P=await UB(B,H,X,Y);if(P!==0)return P}let W=L?[`  Account:   yours too, in workspace ${H}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await _3(T,$.apiKey),T3(T.stateDirectory,$.apiKey)},E=K.PATH||"/usr/local/bin:/usr/bin:/bin",I=O&&JSON.stringify(B?.proxy)===JSON.stringify(T.proxy)&&F?_1(T,N,"connect"):null,C=I?.label===U7(T.channel),h=C&&await(Y.controlWorker??U0)(T,"status").catch(()=>null)!==null,S=C&&!h&&c9(I,N)&&q7({config:T,launcher:_,path:E,host:N,kind:"connect"});if((h||S)&&[null,r].includes(f1(T))){await R();let P=N7(T,N,"connect");if(P==="retired"){let x=S?null:await(Y.controlWorker??U0)(T,"status").catch(()=>null);if(!S&&(!x||x.phase==="stopping"))q$(T,N,"connect")}else if(P==="current_not_running")q$(T,N,"connect");return await(Y.controlWorker??U0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?d9(T,N.platform,W):l9("This computer is connected to Reason",T,N.platform,[...W,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let y=!O&&!L;if(j&&!D)if(B.apiOrigin!==T.apiOrigin||B.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
-`),!await n9(B,Z,X,Y,N))throw new p("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(B.executionMode==="host"&&F1(B))X.stdout.write(`Applying the new settings to this computer\u2026
-`),await HB(B,T,z,Y),y=!1;else await r9(B,Y,N);if(y){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
-`);let P=await a9(T,Z,X,Y,z);if(P!==0)return P;if(z)T3(T.stateDirectory,z)}else c(Z,T),await R();let l;try{l=e2({config:T,launcher:_,path:E,host:N,kind:"connect"})}catch(P){if(!(P instanceof I$))throw P;if(P.code!=="worker_service_manager_missing")throw new p(`${P.message}
+`),0}async function Fj($,J,Z){let Q=c9(Z),X=q3(Q.home,Q.channel);try{let Y=F0(u0(Q.home,Q.channel),"worker.json");return await P7({once:!1,yes:J,addFolder:$},R0(Y),Y,Q)===0}finally{X()}}function c9($,J){let Z=Y$($.home??U0()),Q=$.env??process.env;return{io:$.io??N3(),options:$,home:Z,channel:$.channel??Q$(),environment:Q,apiKey:J??N7(Q),host:$.serviceHost??X$(Z)}}async function FB($,J,Z,Q){let X=o($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let G=await I7($,X,Z,Q),V=Y.find((K)=>K.path===J.workspaceRoot)??await G.add(J.workspaceRoot);await G.remove(Y[0].id),Y=[V,...Y.slice(1).filter((K)=>K.id!==V.id)]}C7(J,X,Y)}var E7=Symbol("serve here");async function LB($,J,Z,Q){let{io:X,options:Y,home:G,channel:V,environment:K,host:N}=Q;if(N.platform==="darwin"){let P=e6(G);if(P.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${P.code}).
+`)}let H=J&&!Q.apiKey&&l0(J.stateDirectory)===null?X2(G,V,J):null,B=J&&H&&$0(J).revoked&&y0(J).some((P)=>P.account&&P.organizationId===H)?F2(J,{prefer:H,keep:!1})??J:J,q=A7({parsed:$,saved:B,stateDirectory:u0(G,V),lifetime:"persistent",home:G,channel:V,options:Y,environment:K});if(U3(G,V,!1),B?.executionMode==="confined")X.stdout.write(O7);let M=B?l0(B.stateDirectory):null,T=R7(q,Q.apiKey??M??void 0),_=F1(N,K),j=B!==null&&P$(B),D=j&&N0(B)===N0(T),O=D&&j1(T),F=B?.userChrome!==!1===(T.userChrome!==!1)&&B?.cloudSessions===T.cloudSessions&&B?.localLogins===T.localLogins,z=Q.apiKey??M??void 0,L=H!==null&&j&&!$0(B).revoked&&!x1(B,H);if(L){if(!D||!F||JSON.stringify(B.proxy)!==JSON.stringify(T.proxy))throw new p("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let P=await HB(B,H,X,Y);if(P!==0)return P}let W=L?[`  Account:   yours too, in workspace ${H}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===M)return;await j3(T,$.apiKey),L3(T.stateDirectory,$.apiKey)},E=K.PATH||"/usr/local/bin:/usr/bin:/bin",I=O&&JSON.stringify(B?.proxy)===JSON.stringify(T.proxy)&&F?L1(T,N,"connect"):null,C=I?.label===q7(T.channel),h=C&&await(Y.controlWorker??V0)(T,"status").catch(()=>null)!==null,S=C&&!h&&s9(I,N)&&T7({config:T,launcher:_,path:E,host:N,kind:"connect"});if((h||S)&&[null,t].includes(f1(T))){await R();let P=M7(T,N,"connect");if(P==="retired"){let x=S?null:await(Y.controlWorker??V0)(T,"status").catch(()=>null);if(!S&&(!x||x.phase==="stopping"))T$(T,N,"connect")}else if(P==="current_not_running")T$(T,N,"connect");return await(Y.controlWorker??V0)(T,"reload_roots").catch(()=>null),X.stdout.write(K.REASON_INSTALLER==="1"?l9(T,N.platform,W):p9("This computer is connected to Reason",T,N.platform,[...W,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let y=!O&&!L;if(j&&!D)if(B.apiOrigin!==T.apiOrigin||B.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),!await r9(B,Z,X,Y,N))throw new p("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(B.executionMode==="host"&&j1(B))X.stdout.write(`Applying the new settings to this computer\u2026
+`),await FB(B,T,z,Y),y=!1;else await t9(B,Y,N);if(y){if(K.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
+`);let P=await i9(T,Z,X,Y,z);if(P!==0)return P;if(z)L3(T.stateDirectory,z)}else c(Z,T),await R();let l;try{l=Z3({config:T,launcher:_,path:E,host:N,kind:"connect"})}catch(P){if(!(P instanceof C$))throw P;if(P.code!=="worker_service_manager_missing")throw new p(`${P.message}
 This computer is set up; run reason connect again to start it.`,P.code??"worker_service_start_failed");if(Y.serveHere&&K.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),I7;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await TB(T,_,K,Y))return X.stdout.write(d9(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new I$(`${P.message}
-This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,P.code)}let k=[...W,...l.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...l.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${l.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?d9(T,N.platform,k):l9("This computer is connected to Reason",T,N.platform,[`  Service:   ${l.label} (starts at ${l.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${l.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...k])),0}async function TB($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??C7)(J,Y,_0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??U0)($,"status").catch(()=>null))return!0;return!1}function C7($,J,Z){let Q=T7(Z,"a",384);try{let X=H7($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{M7(Q)}}async function P7($,J,Z,Q=!1){let X=!0;for(let Y of k0($)){if(Q&&Y.account)continue;if(Y.config&&C$(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??N$)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:Y3,stderr:J.stderr}})!==0){X=!1;continue}}L1(Y.directory,{recursive:!0,force:!0})}return X}function B3(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function o9($,J){if($ instanceof p||$ instanceof I$)return J.stderr.write(`Reason: ${$.message} (${$.code??"worker_service_failed"})
-`),2;let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:FB($);return J.stderr.write(`Reason: ${Q1(Z)??"could not connect this computer."} (${Z})
-`),1}var _B=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]);function FB($){if($ instanceof m0)return $.status>=500?"worker_api_unavailable":"worker_api_refused";let J=$?.code;if(typeof J==="string"&&_B.has(J))return`worker_file_${J.toLowerCase()}`;return"worker_connect_unexpected"}function o6($,J){if($.minimal){x7({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||S7({home:J.home})!=="install")return;let Z;try{Z=T1(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=_0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??e6)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
+`),E7;if(Y.serveHere&&K.REASON_INSTALLER==="1"&&await jB(T,_,K,Y))return X.stdout.write(l9(T,N.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${_} connect under a process manager)`])),0;throw new C$(`${P.message}
+This computer is set up. Keep it connected by running ${_} connect in a terminal or under this box's process manager.`,P.code)}let w=[...W,...l.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...l.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${l.identityProblem}).`]:[]];return X.stdout.write(K.REASON_INSTALLER==="1"?l9(T,N.platform,w):p9("This computer is connected to Reason",T,N.platform,[`  Service:   ${l.label} (starts at ${l.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${l.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...w])),0}async function jB($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??x7)(J,Y,F0($.stateDirectory,"connect.log"));for(let G=0;G<60;G+=1)if(await new Promise((V)=>setTimeout(V,500)),await(Q.controlWorker??V0)($,"status").catch(()=>null))return!0;return!1}function x7($,J,Z){let Q=L7(Z,"a",384);try{let X=_7($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{F7(Q)}}async function S7($,J,Z,Q=!1){let X=!0;for(let Y of y0($)){if(Q&&Y.account)continue;if(Y.config&&P$(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??M$)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:B3,stderr:J.stderr}})!==0){X=!1;continue}}W1(Y.directory,{recursive:!0,force:!0})}return X}function N3(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function e9($,J){if($ instanceof p||$ instanceof C$)return J.stderr.write(`Reason: ${$.message} (${$.code??"worker_service_failed"})
+`),2;let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:DB($);return J.stderr.write(`Reason: ${Y1(Z)??"could not connect this computer."} (${Z})
+`),1}var WB=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]);function DB($){if($ instanceof v0)return $.status>=500?"worker_api_unavailable":"worker_api_refused";let J=$?.code;if(typeof J==="string"&&WB.has(J))return`worker_file_${J.toLowerCase()}`;return"worker_connect_unexpected"}function J7($,J){if($.minimal){w7({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||k7({home:J.home})!=="install")return;let Z;try{Z=F1(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??Z7)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
 `);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let Q=(J.options.installDesktop??e6)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function e6($,J,Z){if(!Z)return oK($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;eK(s9(Z.log),{recursive:!0,mode:448});let Q=T7(Z.log,"w",384);try{let X=H7($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{M7(Q)}return 0}async function Hj($,J={}){let Z=J.io??B3();try{let Q=KB($);if(!Q)return Z.stdout.write(QB),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions does not apply to them.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,H]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(H!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return o6(Q,p9(J)),await(J.runServe??a6)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=p9(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=V7(G[p$],Y),K=V||Q.once?()=>{return}:U3(X.home,Y);try{let N=_0(g0(X.home,Y),"worker.json"),H=R0(N);if(V)return await t6(H,N,X);if(Q.keepAwake!==void 0)return NB(Q.keepAwake,H,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await R7(Q,H,N,X);if(o6(Q,X),Q.once)return await VB(Q,H,X);let B=await MB(Q,H,N,X);if(B!==I7)return B;return K(),K=()=>{return},await t6(R0(N),N,X)}finally{K()}}catch(Q){return o9(Q,Z)}}async function Mj($,J={}){let Z=J.io??B3();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(XB),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await WB(Q[0],Z,J);return await E7(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return o9(Q,Z)}}async function Tj($={}){let J=$.io??B3();try{return await E7(J,$,"logout")}catch(Z){return o9(Z,J)}}async function E7($,J,Z){let Q=Z$(J.home??B0()),X=J.channel??$$(),Y=U3(Q,X);try{return await LB($,J,Z,Q,X)}finally{Y()}}function U3($,J){let Z=g0($,J),Q=u(Z)?J1():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function LB($,J,Z,Q,X){let Y=_0(g0(Q,X),"worker.json"),G=R0(Y);if(!G){if(Z==="disconnect")G3(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(Z!=="disconnect"){let K=await jB(G,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await n9(G,Y,$,J,J.serviceHost??J$(Q))}finally{if(Z!=="temporary")G3(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`);let Q=(J.options.installDesktop??Z7)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
+`)}function Z7($,J,Z){if(!Z)return ZB($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;QB(a9(Z.log),{recursive:!0,mode:448});let Q=L7(Z.log,"w",384);try{let X=_7($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{F7(Q)}return 0}async function Lj($,J={}){let Z=J.io??N3();try{let Q=NB($);if(!Q)return Z.stdout.write(KB),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new p("A machine's workers run one Session at a time; --sessions does not apply to them.");if(Q.proxy!==void 0)throw new p("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new p("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new p("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new p("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[N,H]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(H!==void 0)throw new p(`${N} is for your own computer; reason serve sets up a machine's workers.`);return J7(Q,c9(J)),await(J.runServe??r6)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=c9(J,Q.apiKey),{channel:Y,environment:G}=X;if(!J.env)for(let N of["REASON_API_KEY","ARA_API_KEY"])delete process.env[N];if(Q.userChrome&&X.host.platform!=="darwin")throw new p("--user-chrome is for a Mac.");let V=H7(G[c$],Y),K=V||Q.once?()=>{return}:q3(X.home,Y);try{let N=F0(u0(X.home,Y),"worker.json"),H=R0(N);if(V)return await $7(H,N,X);if(Q.keepAwake!==void 0)return TB(Q.keepAwake,H,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await P7(Q,H,N,X);if(J7(Q,X),Q.once)return await MB(Q,H,X);let B=await LB(Q,H,N,X);if(B!==E7)return B;return K(),K=()=>{return},await $7(R0(N),N,X)}finally{K()}}catch(Q){return e9(Q,Z)}}async function jj($,J={}){let Z=J.io??N3();try{if($.some((G)=>["--help","-h","help"].includes(G)))return Z.stdout.write(BB),0;let Q=$.filter((G)=>!["--yes","-y","--temporary","--account"].includes(G)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new p("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await AB(Q[0],Z,J);return await b7(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return e9(Q,Z)}}async function Wj($={}){let J=$.io??N3();try{return await b7(J,$,"logout")}catch(Z){return e9(Z,J)}}async function b7($,J,Z){let Q=Y$(J.home??U0()),X=J.channel??Q$(),Y=q3(Q,X);try{return await OB($,J,Z,Q,X)}finally{Y()}}function q3($,J){let Z=u0($,J),Q=u(Z)?Q1():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new p("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function OB($,J,Z,Q,X){let Y=F0(u0(Q,X),"worker.json"),G=R0(Y);if(!G){if(Z==="disconnect")U3(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(Z!=="disconnect"){let K=await zB(G,Y,$,J,Z,Q,X);if(K!==null)return K}let V=!1;try{V=await r9(G,Y,$,J,J.serviceHost??X$(Q))}finally{if(Z!=="temporary")U3(Q,X,!0)}if(!V)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
 `),1;return $.stdout.write(`Disconnected "${G.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function jB($,J,Z,Q,X,Y,G){let V=k0($).filter((j)=>j.account);if(V.length===0)return null;let K=X2(Y,G,$),N=Q.controlWorker??U0,H=V.find((j)=>j.organizationId===K);if(H){if(H.config&&!await K3(H.config,H.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
-`),1;if(X!=="account"||!H.config)L1(H.directory,{recursive:!0,force:!0});return await N($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${K} for your account. It stays connected for its other Reason accounts.
+`),0}async function zB($,J,Z,Q,X,Y,G){let V=y0($).filter((j)=>j.account);if(V.length===0)return null;let K=X2(Y,G,$),N=Q.controlWorker??V0,H=V.find((j)=>j.organizationId===K);if(H){if(H.config&&!await V3(H.config,H.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),1;if(X!=="account"||!H.config)W1(H.directory,{recursive:!0,force:!0});return await N($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${K} for your account. It stays connected for its other Reason accounts.
 `),0}if(!K&&X==="account")throw new p("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!K||!x1($,K)){if(X==="account"&&K)_2($,K);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let B=Q.serviceHost??J$(Y),q=null;try{q=t($)?.orgId.toLowerCase()??null}catch{}if(await r9($,Q,B,"connect",!0),!await P7($,Z,Q,!0)||!await K3($,J,Z,Q))return q$($,B,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
-`),1;let M=F2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&q)_2(M,q);let T=q$(M,B,"connect")!==null,_="";try{_=` in workspace ${t(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
-`),0}async function WB($,J,Z){let Q=Z$(Z.home??B0()),X=Z.serviceHost??J$(Q),Y=g9(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let V of Y)if(await n9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
+`);return 0}let B=Q.serviceHost??X$(Y),q=null;try{q=o($)?.orgId.toLowerCase()??null}catch{}if(await t9($,Q,B,"connect",!0),!await S7($,Z,Q,!0)||!await V3($,J,Z,Q))return T$($,B,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`),1;let M=F2($,{prefer:null,keep:!1});if(!M)return null;if(X==="account"&&q)_2(M,q);let T=T$(M,B,"connect")!==null,_="";try{_=` in workspace ${o(M)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${_}${T?"":"; run reason connect to start it again"}.
+`),0}async function AB($,J,Z){let Q=Y$(Z.home??U0()),X=Z.serviceHost??X$(Q),Y=u9(Q,$);if(Y.length===0)throw new p(`No worker for machine "${$}" on this computer.`);let G=!1;for(let V of Y)if(await r9(V.config,V.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${V.config.workspaceRoot}.
 `);else G=!0,J.stderr.write(`Reason: machine "${$}" in ${V.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
-`);return G?1:0}async function _j($={}){let J=Z$($.home??B0()),Z=R0(_0(g0(J,$.channel??$$()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??U0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?f1(Z):null,G=$.serviceHost??J$(J),V=_1(Z,G,"connect"),K=$0(Z).revoked,N=!K&&!X,H=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:B,off:q}=K||u0(Z.stateDirectory)!==null?{workspaces:null,off:null}:I4(Z,X?.phase==="running");return{workspaces:B,workspaces_off:q,workspaces_max:H2+(B?.filter((M)=>M.account).length??0),name:Z.name,device_id:H?.deviceId??null,organization_id:H?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:null,user_chrome:t9(Z,G.platform),cloud_sessions:Z.cloudSessions===!0,root:H?.roots[0]?{id:H.roots[0].id,permissions:H.roots[0].permissions}:null,roots:H?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?W8(Z,Q):null,worker_alive:N&&V?c9(V,G):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function Fj($,J,Z=U0){let Q={version:1,status:"unavailable"},X=R0(_0(g0(Z$($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?G7({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function Lj($={}){try{let J=Z$($.home??B0());return R0(_0(g0(J,$.channel??$$()),"worker.json"))?.userChrome!==!1}catch{return!1}}function jj($={}){let J=Z$($.home??B0()),Z=R0(_0(g0(J,$.channel??$$()),"worker.json"));if(!Z)return null;return q$(Z,$.serviceHost??J$(J),"connect")?.label??null}async function Wj($={}){let J=Z$($.home??B0()),Z=R0(_0(g0(J,$.channel??$$()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??J$(J),X=await s6(Z,Q,"connect",$.current);if(X!==null||_1(Z,Q,"connect"))return X;return DB(Z,Q,$)}async function DB($,J,Z){let Q=Z.controlWorker??U0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&f1($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=T1(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((B)=>setTimeout(B,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...H}=Z.env??process.env;return(Z.startConnection??C7)(G,H,_0($.stateDirectory,"connect.log")),{state:"restarted"}}
-export{d,R2 as e,R0 as f,QB as g,XB as h,g0 as i,Nj as j,qj as k,Hj as l,Mj as m,Tj as n,_j as o,Fj as p,Lj as q,jj as r,Wj as s};
+`);return G?1:0}async function Dj($={}){let J=Y$($.home??U0()),Z=R0(F0(u0(J,$.channel??Q$()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??V0)(Z,"status").catch((M)=>{return Q=M instanceof Error?M:Error(String(M)),null}),Y=X?f1(Z):null,G=$.serviceHost??X$(J),V=L1(Z,G,"connect"),K=$0(Z).revoked,N=!K&&!X,H=(()=>{try{return o(Z)}catch{return null}})(),{workspaces:B,off:q}=K||l0(Z.stateDirectory)!==null?{workspaces:null,off:null}:P4(Z,X?.phase==="running");return{workspaces:B,workspaces_off:q,workspaces_max:H2+(B?.filter((M)=>M.account).length??0),name:Z.name,device_id:H?.deviceId??null,organization_id:H?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:null,user_chrome:o9(Z,G.platform),cloud_sessions:Z.cloudSessions===!0,root:H?.roots[0]?{id:H.roots[0].id,permissions:H.roots[0].permissions}:null,roots:H?.roots.map((M)=>({id:M.id,folder:M.path,permissions:M.permissions}))??[],state:K?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:N?O8(Z,Q):null,worker_alive:N&&V?s9(V,G):null,sessions_running:X?.activeSessions??null,version:Y,service:V?{label:V.label,logs:V.logs}:null}}async function Oj($,J,Z=V0){let Q={version:1,status:"unavailable"},X=R0(F0(u0(Y$($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?U7({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function zj($={}){try{let J=Y$($.home??U0());return R0(F0(u0(J,$.channel??Q$()),"worker.json"))?.userChrome!==!1}catch{return!1}}function Aj($={}){let J=Y$($.home??U0()),Z=R0(F0(u0(J,$.channel??Q$()),"worker.json"));if(!Z)return null;return T$(Z,$.serviceHost??X$(J),"connect")?.label??null}async function Rj($={}){let J=Y$($.home??U0()),Z=R0(F0(u0(J,$.channel??Q$()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??X$(J),X=await n6(Z,Q,"connect",$.current);if(X!==null||L1(Z,Q,"connect"))return X;return RB(Z,Q,$)}async function RB($,J,Z){let Q=Z.controlWorker??V0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&f1($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let G;try{G=F1(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let V=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<V&&await Q($,"status").catch(()=>null)!==null)await new Promise((B)=>setTimeout(B,250));let{REASON_INSTALLER:K,REASON_DESKTOP_BACKGROUND:N,...H}=Z.env??process.env;return(Z.startConnection??x7)(G,H,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
+export{d,o as e,R2 as f,R0 as g,KB as h,BB as i,u0 as j,_j as k,Fj as l,Lj as m,jj as n,Wj as o,Dj as p,Oj as q,zj as r,Aj as s,Rj as t};