npm - @reason-machines/cli-linux-arm64-musl - Versions diffs - 0.2.358 → 0.2.359 - Mend

@reason-machines/cli-linux-arm64-musl 0.2.358 → 0.2.359

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (96) hide show

package/bin/vm-hands/vm-hands-entry-lite-kt4831mq.js ADDED Viewed

@@ -0,0 +1,340 @@
+// @bun
+import{r as v0}from"./vm-hands-entry-lite-5xtkyx25.js";import{v as n1,x as x6,y as c9}from"./vm-hands-entry-lite-463aheya.js";import{A as X2,B as E6,C as $4,D as J4,E as V6,F as m0,J as G6,K as A$}from"./vm-hands-entry-lite-taw01cp4.js";import{V as g2,oa as e0,ra as u1,ta as VJ}from"./vm-hands-entry-lite-c0m2jewa.js";import{Ba as f5,Ca as m5,Da as e4,Ea as $8,Fa as DJ,Ga as WJ,Ha as _9,Ia as d8,Ja as Q8,Ka as L0,La as I1,Ma as C1,Na as I0,Oa as g1,Pa as p8,Qa as B5,Ra as f3,Sa as t8,Wa as r8,cb as AJ,db as RJ,eb as PJ,fb as IJ,gb as D9}from"./vm-hands-entry-lite-c7krpmd8.js";import{$b as _J,Ab as x8,Bb as J8,Cb as Z8,Db as MJ,Eb as TJ,Gb as u,Hb as e,Ib as s,Jb as c,Kb as H8,Lb as FJ,Mb as N1,Pb as t2,Qb as r2,Rb as R6,Sb as P6,Tb as I6,Ub as S0,Vb as J0,Wb as g,Xb as j9,Yb as j1,Zb as i1,_b as N0,ec as V5,gc as S4,ib as cJ,jc as I2,lb as L8,lc as u8,mb as F8,mc as i3,oc as S8,pb as U8,rb as A8,sc as jJ,tc as l3,ub as R8,zb as E8}from"./vm-hands-entry-lite-qbnz4h30.js";import{xc as X8}from"./vm-hands-entry-lite-22we2jrv.js";import{Ec as g8}from"./vm-hands-entry-lite-gxjxx1r2.js";import{Jc as P8,Kc as I8,Rc as C8}from"./vm-hands-entry-lite-j05685sg.js";import{Xc as H$}from"./vm-hands-entry-lite-wry37am5.js";import{nd as o4}from"./vm-hands-entry-lite-r5y08n0q.js";import{Bd as v5,Cd as g5,vd as c8,yd as OJ}from"./vm-hands-entry-lite-n867d88m.js";import{Fd as p$,Hd as Q$,Id as R$,Jd as U1,Ld as B6,Md as S6,Nd as b6,Pd as H1,Qd as w6,Rd as b9,Sd as y6,Td as s2,Ud as M$,Vd as A4,Wd as a2}from"./vm-hands-entry-lite-gzxxsjmr.js";import{Ae as HJ,Be as qJ,cf as r4,kf as J6,lf as n$,vf as Z2,we as L2}from"./vm-hands-entry-lite-szfy3kx7.js";import{If as C6,Jf as m2,Mf as zJ,Pf as w1,Rf as o6,Sf as e6,Xf as n8}from"./vm-hands-entry-lite-07er2w8q.js";import{jg as V0,kg as $2,lg as xJ,mg as SJ,ng as i$,og as N3,pg as z2,qg as K4,sg as A2,tg as b$,ug as k0,vg as t$,wg as R2,zg as w$}from"./vm-hands-entry-lite-s98hjhz3.js";import{Cg as d1,Dg as v8}from"./vm-hands-entry-lite-3ew5ftk0.js";import{Ig as z8}from"./vm-hands-entry-lite-v08mjs3f.js";import{Zh as Z$,bi as W$,ci as P0,di as i9,ei as O6,fi as z6,hi as q2,ii as A6,ji as T9,ki as O4,li as z4,mi as r$}from"./vm-hands-entry-lite-5kgvss4p.js";import{ni as v1,oi as z1}from"./vm-hands-entry-lite-r6pap1kh.js";import{Ei as F6,Mi as l8,Ni as L9,Pi as Y8}from"./vm-hands-entry-lite-x4j4058x.js";import{Ri as H0,Ti as QJ}from"./vm-hands-entry-lite-1j9r1fca.js";import{pj as r}from"./vm-hands-entry-lite-p8662x7z.js";import{Oj as K}from"./vm-hands-entry-lite-kv0qat0x.js";import{Rj as LJ}from"./vm-hands-entry-lite-jn95s3j4.js";import{Wj as h0}from"./vm-hands-entry-lite-ygx9kj92.js";import{ak as aV}from"./vm-hands-entry-lite-h2xemq1f.js";import{spawn as k6,spawnSync as iV}from"child_process";import{closeSync as h6,mkdirSync as nV,openSync as f6,readdirSync as tV,realpathSync as X$,rmSync as M1}from"fs";import{hostname as rV}from"os";import{dirname as w9,join as F0,resolve as oV}from"path";import{createHash as J7}from"crypto";import{unlinkSync as Z7}from"fs";import{platform as Q7}from"os";import{join as X7}from"path";var s9=K.discriminatedUnion("store",[K.strictObject({version:K.literal(1),store:K.literal("keychain")}),K.strictObject({version:K.literal(1),store:K.literal("file"),api_key:K.string().min(1).max(4096)})]),S$=($)=>X7($,"api-key.json");function F$($){let J=J7("sha256").update(`reason-connect-api-key
+${$}`).digest("hex");return new i$($2(),Q7(),J)}function B3($,J,Z=F$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(S$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof V0))throw Q}c(S$($),{version:1,store:"file",api_key:J})}function d0($,J=F$($)){if(!u(S$($)))return null;let Z=s9.parse(JSON.parse(s(S$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof V0))throw Q;throw Error("worker_api_key_unreadable")}}function a9($,J=F$($)){if(!u(S$($)))return;if(s9.parse(JSON.parse(s(S$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof V0))throw Z}Z7(S$($))}async function K3($,J){let Z;try{Z=await c9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:S0($.proxy)})}catch(Q){if(Q instanceof m0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as z7,renameSync as A7,rmSync as y$}from"fs";import{join as q0}from"path";import{createHash as Y7}from"crypto";import{realpathSync as V7,statSync as G7,unlinkSync as J2}from"fs";import{platform as B7}from"os";import{join as b0}from"path";function d($){return{state:b0(g($),"device.json"),control:b0(g($),"control.json"),lock:b0(g($),"lifecycle.lock"),socket:b0(g($),"control.sock"),daemon:b0(g($),"daemon.json"),releaseCheck:b0(g($),"release-check.json"),updateDeferral:b0(g($),"update-deferral.json"),firstHeartbeat:b0(g($),"first-heartbeat.json")}}var K7=K.object({version:K.literal(1),device_id:K.string().min(1).max(160),offer:K.unknown().optional(),enrollment_ms:K.number().int().nonnegative().max(n$).optional()});function n9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function U3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=K7.safeParse(JSON.parse(s(Z)));if(J2(Z),!Q.success||Q.data.device_id!==J)return null;let X=Z2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=b0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?H3($):new N3(g($))}function Q2($,J){T0($,!0),H7($);let Z=J??H3($),Q=new N3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof V0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function H3($){return new i$($2(),B7(),N7($))}function N7($){let J=q3($);return Y7("sha256").update(`reason-worker
+${J?.directory??g($)}`).digest("hex")}function D1($,J){c(b0(g($),W1),{version:1,directory:q3($)?.directory??g($),devicePublicKey:J})}var W1="keychain-scope.json";function t9($){return u(b0(g($),W1))}var U7=K.strictObject({version:K.literal(1),directory:K.string().min(1),devicePublicKey:K.string().min(1)});function q3($){let J=b0(g($),W1);if(!u(J))return null;let Z=U7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function H7($){let J=b0(g($),W1);if(!u(J))return;if(q3($))try{let Z=H3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof V0))throw Z}J2(J)}function K$($){let J=V7($.workspaceRoot);if(J!==$.workspaceRoot||!G7(J).isDirectory()||!j1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function o($){if(!u(g($)))return null;let J=b$(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&i9($.apiOrigin,J.apiOrigin),Q=Z?[N0($),N0({...$,apiOrigin:J.apiOrigin})]:[N0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var r9=K.strictObject({version:K.literal(1),drained:K.boolean(),revoked:K.boolean()});function $0($){let J=d($).control;return u(J)?r9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function R0($,J){c(d($).control,r9.parse(J))}function w0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=b0(g($),W1);if(u(Z))J2(Z);let Q=d($).state;if(u(Q))J2(Q)}var q7=K.strictObject({read:K.boolean(),write:K.boolean(),execute:K.boolean(),discover_environment:K.boolean(),expose_mcp:K.literal(!1)}),M3=K.strictObject({version:K.literal(1),organization_id:K.string().min(1).max(160),enrollment_ticket:K.string().min(1).max(4096),code_verifier:K.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/),root:K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),permissions:q7,execution_mode:K.enum(["confined","host"]).default("confined")}),folders:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),M7=K.object({device_id:K.string().min(1).max(160),organization_id:K.string().min(1).max(160),auth_scheme:K.literal("p256"),protocol_version:K.literal(2),roots:K.array(K.object({id:K.string().min(1),label:K.string(),path_fingerprint:K.string()})).min(1).max(32),headless:K.object({lifecycle:K.enum(["persistent","ephemeral"]),expires_at:K.iso.datetime({offset:!0})}),first_heartbeat:K.unknown().optional()}),T3=30000;class r0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function T7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(T3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new r0(X?.error==="device_revoked")}return Q.json()}async function L3($,J,Z,Q){v0();let X=M3.parse(JSON.parse(s(J)));return o0($,X,Z,Q)}async function o0($,J,Z,Q=(Y,V)=>T7(Y,V,S0($.proxy)),X=performance.now()){let Y=e9($,J,Z),V=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(V,X)}async function o9($,J,Z,Q,X=performance.now()){let Y=e9($,J,Z),V=await Q(Y.request,J.code_verifier);return V===null?null:Y.receipt(V,X)}function e9($,J,Z){if(v0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=w$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((B,U)=>{let M=w$([B],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(M.path!==B||M.pathFingerprint!==J.folders?.[U]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return M});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],V;try{V=Z.loadPublicKey()}catch{V=Z.createFreshPublicKey()}return{request:{device_public_key:V,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((B)=>({label:B.label,path_fingerprint:B.pathFingerprint,permissions:J.root.permissions}))},receipt(B,U){let M=M7.parse(B);if(M.organization_id!==J.organization_id||M.roots.length!==Y.length||M.roots.some((H,q)=>H.path_fingerprint!==Y[q].pathFingerprint)||M.headless.lifecycle!==$.lifetime||Date.parse(M.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let G=Z2(M.first_heartbeat);try{n9($,M.device_id,{...G?{offer:G}:{},enrollmentMs:Math.min(n$,Math.max(0,Math.round(performance.now()-U)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:M.organization_id,deviceId:M.device_id,devicePublicKey:V,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:N0($),lifetime:$.lifetime,expiresAt:M.headless.expires_at},roots:M.roots.map((H,q)=>({id:H.id,label:H.label,path:Y[q].path,pathFingerprint:H.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as L7,randomUUID as F7}from"crypto";import{unlinkSync as _7}from"fs";import{join as j7}from"path";var Z4=K.strictObject({version:K.literal(1),install_id:K.uuid(),fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/)}),D7=K.object({enrollment_ticket:K.string().min(1).max(4096),expires_at:K.iso.datetime({offset:!0}),device_kind:K.literal("headless"),lifecycle:K.enum(["persistent","ephemeral"]),device_expires_at:K.iso.datetime({offset:!0})});function F3($){return D7.parse($)}var W7=K.object({credentialKind:K.enum(["oauth","api_key"]).optional(),apiOrigin:K.url(),clientId:K.string(),accessToken:K.string().min(1).max(32768),refreshToken:K.string().max(32768),expiresAt:K.iso.datetime({offset:!0}),scopes:K.array(K.string().max(128)).max(128),orgId:K.string().min(1).max(160)});function _$($){return X2(z1("REASON_CLI_CHANNEL",$.channel),H0())}async function j$($,J=_$($)){if(!u(J))return null;let Z=W7.parse(JSON.parse(s(J)));if(!P0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=S0($.proxy),X=Object.assign((V,N)=>Q(V,{...N,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await J4({path:J,fetchImpl:X});if(Y&&!P0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function Q4($,J,Z){if(!P0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=D$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function X4($,J,Z,Q,X){let Y=performance.now();if(!P0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=D$($),N=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(N){let B=await o9($,V.direct(J.orgId),Q,(U,M)=>N({approval:V.request,code_verifier:M,registration:U}).catch((G)=>{throw O7(G)}),Y);if(B)return B}return o0($,V.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(V.request)),Q,X,Y)}function O7($){if(!($ instanceof m0))return $;if($.status===409)return new r0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new r0(!1);return $}var O1=($)=>j7(g($),"enrollment-install.json");function Y4($){if(u(O1($)))_7(O1($))}function D$($,{stored:J=!0}={}){v0();let Z=O1($),Q=J&&u(Z)?Z4.parse(JSON.parse(s(Z))):{version:1,install_id:F7(),fingerprint_key:L7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),V=w$([$.workspaceRoot],X,Y)[0];if(V.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let N=($.folders??[]).map((G)=>{let H=w$([G],X,Y)[0];if(H.path!==G)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:H.pathFingerprint}}),B=$4(),U={install_id:Q.install_id,code_challenge:B.challenge,lifecycle:$.lifetime,roots:[V.pathFingerprint,...N.map((G)=>G.path_fingerprint)].map((G)=>({path_fingerprint:G,permissions:X,execution_mode:$.executionMode}))},M=(G)=>({version:1,organization_id:G,code_verifier:B.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:V.pathFingerprint,permissions:X,execution_mode:$.executionMode},...N.length?{folders:N}:{}});return{request:U,saveInstall(G){e(g(G),!0),c(O1(G),Q)},complete(G,H){let q=F3(H);if(q.lifecycle!==$.lifetime||Date.parse(q.expires_at)<=Date.now()||Date.parse(q.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...M(G),enrollment_ticket:q.enrollment_ticket}},direct:M}}function V4($,J,Z){let Q=O1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=Z4.parse(JSON.parse(s(Q)));return w$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var Y2=8,N4=600000,U4=15000,G4=new Set(["device_revoked","invalid_device_credential"]),V2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,N$=($)=>q0(g($),"workspaces"),H4="account.json",_3=($)=>u(q0($,H4));function y0($){let J;try{J=z7(N$($))}catch{return[]}return J.filter((Z)=>V2.test(Z)).sort().map((Z)=>{let Q=q0(N$($),Z),X=q0(Q,"worker.json"),Y=null;try{let V=J0.safeParse(JSON.parse(s(X)));if(V.success&&V.data.stateDirectory===Q)Y=V.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:_3(Q)}})}function G2($,J){let Z=J.toLowerCase();if(!V2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(N$($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,H4),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function B2($,J){try{let{config:Z,configPath:Q}=G2($,J);e(g(Z),!0),R0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function A1($,J){let Z=J.toLowerCase(),Q=null;try{Q=o($)?.orgId.toLowerCase()??null}catch{}return Q===Z||y0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var j3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function B4($,J){let Z=o($);if(!Z?.worker)throw Error("worker_identity_missing");D1($,Z.devicePublicKey),e(g(J),!0);for(let Y of j3)y$(q0(g(J),Y),{force:!0});for(let Y of j3){let V=q0(g($),Y);if(u(V))A7(V,q0(g(J),Y))}let Q=T0(J),X=b$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");k0({...X,worker:{...X.worker,configDigest:N0(J)}},d(J).state,{proofStore:Q})}function D3($){for(let J of y0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))w0(J.config)}catch{}y$(J.directory,{recursive:!0,force:!0})}y$(O3($),{force:!0})}function K2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(G)=>Number(Date.parse(G.worker?.expiresAt??"")>X+60000),N=y0($).flatMap((G)=>{if(!G.account||!G.config)return[];try{if($0(G.config).revoked)return[];let H=o(G.config);return H&&H.orgId.toLowerCase()===G.organizationId&&(!Q||Y(H))?[{...G,config:G.config,state:H}]:[]}catch{return[]}}).sort((G,H)=>Number(H.organizationId===J)-Number(G.organizationId===J)||Y(H.state)-Y(G.state))[0];if(!N)return null;let B=null;try{B=$0($).revoked?null:o($)}catch{}let U=B?.orgId.toLowerCase()??"";if(Z&&B&&V2.test(U)&&U!==N.organizationId){let G=G2($,U);B4($,G.config),c(G.configPath,G.config)}else if(u(g($))){try{if(u(d($).state))w0($)}catch{}for(let G of j3)y$(q0(g($),G),{force:!0})}D3($);let M=J0.parse({...N.config,stateDirectory:$.stateDirectory});return B4(N.config,M),c(q0($.stateDirectory,"worker.json"),M),y$(N.directory,{recursive:!0,force:!0}),M}var W3={before($){for(let{config:J}of y0($))try{let Z=J?o(J):null;if(J&&Z)D1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of y0(J)){if(Y)continue;try{let V=J0.parse(JSON.parse(s(X)));if(V.stateDirectory!==q0(N$($),Z))continue;let N=J0.parse({...V,stateDirectory:Q}),B=T0(N),U=b$(d(N).state,{proofStore:B,repair:!1});if(U?.worker?.configDigest===N0(V))k0({...U,worker:{...U.worker,configDigest:N0(N)}},d(N).state,{proofStore:B});c(X,N)}catch{}}}},O3=($)=>q0(N$($),"listed.json");function q4($){try{let J=JSON.parse(s(O3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function M4($,J){let Z=y0($),Q=Z.filter((B)=>B.account),X=Z.filter((B)=>!B.account),Y=q4($),V=Y&&!Y.listed?Y.reason:null,N=V||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&N.length===0&&(V||Y&&!Y.listed))return{workspaces:null,off:V};return{off:V,workspaces:[...Q,...N].map(({organizationId:B,config:U,account:M})=>{let G=!1,H=null,q=!1,T=null;try{G=U?$0(U).revoked:!1,H=U&&!G?o(U):null;let L=U?t$(d(U).daemon):null;q=J&&!!H&&L?.state==="connected",T=q?K4(L,H):null}catch{}return{...T?{permission_recovery:T}:{},organization_id:B,device_id:H?.deviceId??null,name:Y?.names?.[B]??null,root:H?.roots[0]?{id:H.roots[0].id,permissions:H.roots[0].permissions}:null,state:G?"removed":q?"connected":"not_running",blocked:!M&&!G&&!q&&(Y?.blocked.includes(B)??!1),...M?{account:!0}:{}}})}}function T4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),V=new Map,N=null,B=!1,U=q4(J)??{listed:!1,reason:null,blocked:[]},M=(_)=>{let{folders:D,...R}=J,E=Z.roots.slice(1).map((P)=>P.path);return J0.parse({...R,...E.length?{folders:E}:{},stateDirectory:q0(N$(J),_)})},G=async(_)=>{let D=V.get(_);if(!D)return;D.controller.abort(),await D.done},H=(_,D=!1)=>{let R=new AbortController,E=()=>R.abort();if(X.addEventListener("abort",E,{once:!0}),X.aborted)R.abort();let P={..._,controller:R,claims:0,done:Promise.resolve(),account:D};P.done=$.serve(_,R.signal,(I)=>{P.claims=I}).then(()=>{return},(I)=>{if(D&&I instanceof L0&&I.status===401&&G4.has(I.code)){try{R0(_.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${_.organizationId} (another account's) no longer accepts this computer (${I.code}); run \`reason connect\` signed in as that account to connect it again
+`)}else if(I instanceof L0&&I.status===401&&G4.has(I.code)){try{w0(_.config)}catch{}Y(`Reason worker: workspace ${_.organizationId} no longer accepts this computer
+`)}else if(!R.signal.aborted)Y(`Reason worker: workspace ${_.organizationId} stopped (worker_workspace_failed); it starts again on the next check
+`)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",E),P.claims=0,V.get(_.organizationId)===P)V.delete(_.organizationId);let I=_.config.stateDirectory;if(D&&!_3(I)&&!u(q0(I,"worker.json")))y$(I,{recursive:!0,force:!0})}),V.set(_.organizationId,P)},q=(_,D)=>{if(!D)return null;try{let R=M(_),E=o(D);if(!E||E.orgId!==_||Date.parse(E.worker?.expiresAt??"")<=Date.now()+60000||D.name!==R.name||D.executionMode!==R.executionMode||!P0(D.apiOrigin,R.apiOrigin)||E.roots.map((P)=>P.path).join(`
+`)!==Z.roots.map((P)=>P.path).join(`
+`))return null;return{organizationId:_,config:D,state:E,proofStore:T0(D)}}catch{return null}},T=(_,D)=>{if(!D)return null;try{if($0(D).revoked)return null;let R=o(D);if(!R||R.orgId.toLowerCase()!==_||Date.parse(R.worker?.expiresAt??"")<=Date.now()+60000||D.executionMode!==J.executionMode||!P0(D.apiOrigin,J.apiOrigin))return null;return{organizationId:_,config:D,state:R,proofStore:T0(D)}}catch{return null}},L=(_,D)=>_.deviceId===D.deviceId&&_.devicePublicKey===D.devicePublicKey&&JSON.stringify(_.roots.map((R)=>[R.id,R.path]))===JSON.stringify(D.roots.map((R)=>[R.id,R.path])),j=async(_)=>{for(let[D,R]of _){if(X.aborted)return;let E=V.get(D),P=T(D,R.config);if(E&&P&&L(E.state,P.state))continue;if(E){if(E.claims>0)continue;await G(D)}if(P&&!X.aborted)H(P,!0)}for(let[D,R]of V)if(R.account&&!_.has(D)&&R.claims===0)await G(D)},W=async(_)=>{let D=M(_),R=J0.parse({...D,stateDirectory:J.stateDirectory});if(!u(q0(g(J),"enrollment-install.json")))return null;let E=D$(R),P=await Q.ownerWorkspaceEnrollment(Z,{organization_id:_,install_id:E.request.install_id,code_challenge:E.request.code_challenge},X),I=E.complete(_,P);if(e(g(D),!0),u(d(D).state))w0(D);let f=Q2(D);try{let S=await o0(D,I,f,$.enroll);return k0(S,d(D).state,{proofStore:f}),R0(D,{version:1,drained:!1,revoked:!1}),c(q0(D.stateDirectory,"worker.json"),D),{organizationId:_,config:D,state:S,proofStore:f}}catch(S){if(S instanceof r0&&S.deviceRemoved)return R0(D,{version:1,drained:!0,revoked:!0}),c(q0(D.stateDirectory,"worker.json"),D),null;throw S}},O=async()=>{let _=y0(J),D=new Map(_.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await j(D);let R=new Map(_.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),E=(A)=>D.has(A)||V.get(A)?.account===!0||_3(q0(N$(J),A)),P=(A)=>{let y=R.get(A)?.config;try{return y?$0(y).revoked:!1}catch{return!1}};for(let[A,y]of R){if(V.has(A)||P(A)||U.blocked.includes(A))continue;let b=q(A,y.config);if(b&&!X.aborted)H(b)}let I;try{I=await Q.ownerWorkspaces(Z,X)}catch(A){return U={listed:!1,blocked:U.blocked,...U.names?{names:U.names}:{},reason:A instanceof L0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let f=new Map(I.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>V2.test(A)&&A!==Z.orgId.toLowerCase()&&!E(A))),S=[...f.keys()].filter((A)=>R.has(A)?!P(A):!f.get(A)).slice(0,Y2),k=[...V.values()].filter((A)=>!A.account&&A.claims>0&&!S.includes(A.organizationId)).length,p=S.filter((A)=>!R.has(A)),w=p.slice(p.length-Math.min(Math.max(0,S.length+k-Y2),p.length)),C=S.filter((A)=>!w.includes(A)),x=Object.fromEntries(I.flatMap((A)=>A.name&&C.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));U={listed:!0,reason:null,blocked:C.filter((A)=>f.get(A)),names:x};for(let A of new Set([...R.keys(),...V.keys()])){if(C.includes(A)||E(A))continue;if(f.has(A)&&P(A))continue;if((V.get(A)?.claims??0)>0)continue;await G(A);let y=R.get(A)?.config;try{if(y&&u(d(y).state))w0(y)}catch{}y$(q0(N$(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
+`)}for(let A of C){if(X.aborted)return!0;if(E(A))continue;try{let y=V.get(A);if(f.get(A)){if(y&&y.claims===0)await G(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
+`);continue}let b=q(A,R.get(A)?.config??null);if(b&&y)continue;if(!b){if(y&&y.claims>0)continue;if(await G(A),b=await W(A),b)Y(`Reason worker: connected in workspace ${A}
+`)}if(b&&!X.aborted)H(b)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
+`)}}return!0},F=null,z=async()=>{let _=!1;do B=!1,_=await O().catch(()=>!1);while(B&&!X.aborted);let D=JSON.stringify({version:1,...U});if(F!==D)try{e(N$(J),!0),c(O3(J),JSON.parse(D)),F=D}catch{}return _};return{check(){if(N)B=!0;else N=z().finally(()=>{N=null});return N},claims:()=>[...V.values()].reduce((_,D)=>_+D.claims,0),async settled(){await N,await Promise.all([...V.values()].map((_)=>_.done))}}}import{dirname as R7}from"path";function _4($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!P7($.saved))return J;let Z=$.saved,Q=(V,N)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:V,...N?{code:`worker_api_origin_move_${V}:${N}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?r$():$.native;if(!X)return J;let Y=[];try{let V=X.lock(R7($.configPath));if(!V)return J;if(Y.push(V),u(g(Z))){let M=e0({path:d(Z).lock,runtimeVersion:r});if(!M.acquired)return J;Y.push(()=>M.release())}let N=J0.parse(JSON.parse(s($.configPath)));if(N.stateDirectory!==Z.stateDirectory)return J;let B=j4(N),U={saved:N,configPath:$.configPath};if(!N2(N)&&B.length===0)return Q("unchanged"),U;if(N2(N)){let M=L4(N);c($.configPath,M),U={saved:M,configPath:$.configPath}}for(let M of B)try{c(M.configPath,L4(M.config))}catch(G){Q("failed",`workspace:${F4(G)}`)}return Q("moved"),U}catch(V){return Q("failed",F4(V)),J}finally{for(let V of Y.reverse())V()}}function N2($){return W$($.apiOrigin)!==$.apiOrigin}function j4($){return y0($).filter((J)=>J.config!==null&&N2(J.config))}function P7($){return N2($)||j4($).length>0}function L4($){let J=J0.parse({...$,apiOrigin:W$($.apiOrigin)}),Z=o($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=N0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)k0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function F4($){if($ instanceof V0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as I7,lstatSync as R3,readdirSync as R4,readlinkSync as C7,unlinkSync as E7}from"fs";import{join as D0,sep as x7}from"path";var U2="rehome.json";class H2 extends Error{code;constructor($){super($);this.code=$}}function P4($){let J={saved:$.saved,configPath:$.configPath},Z=D0($.home,".config"),Q=D0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=D0(Q,...X),V=D0(Z,"reason",...X),N=(G,H)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:G,...H?{code:`worker_state_rehome_${G}:${H}`}:{},timestamp:new Date().toISOString()})),B=$.native===void 0?r$():$.native,U=$.saved,M=[];try{if(U&&W4(Q)&&U.stateDirectory===Y){let W={...U,stateDirectory:V};if(!z3(B,V,W,M))return J;return D4(U,W,$.host,N)}if(U&&W4(Q)&&U.stateDirectory===V&&t9(U)&&z3(B,V,U,M))return I4({...U,stateDirectory:Y},U,$.host),J;if(!U||U.lifetime!=="persistent"||U.stateDirectory!==Y||!o$(Q)?.isDirectory())return J;if(h7(Y)===r)return J;let H=(W,O=!0)=>{if(O)c(D0(Y,U2),{version:r});return N("skipped",W),J},q=[Y];for(let W of b7(Q,Y)){if(W.config?.lifetime!=="ephemeral")return H("several_connections");if(!S7(W.directory,W.config,M))return H("once_running",!1);q.push(W.directory)}if(!B)return H("config_rename_unavailable:no_native");if(!z3(B,Y,U,M))return J;let T=o(U);if(!T||$0(U).revoked)return J;if(O4(Z)!==null)return H("conflicting_identity");if(z4(Z)!==null)return H("conflicting_files");if(o$(V)&&(!o$(V).isDirectory()||R4(V).length>0))return H("connection_folder_taken");D1(U,T.devicePublicKey),W3.before(U);let L=d0(Y);if(L&&A3(Y))w7(V,L);let j=q2(Z,B,q);if(j.state!=="renamed"&&j.state!=="linked"){if(L&&A3(Y))C4(V);return H(j.problem??"config_folder_kept")}return D4(U,{...U,stateDirectory:V},$.host,N)}catch(G){try{if(o$(Y)?.isDirectory())c(D0(Y,U2),{version:r})}catch{}return N("failed",f7(G)),k7(U,Y,V,J)}finally{for(let G of M.reverse())G()}}function D4($,J,Z,Q){let X=R3(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)I7(J.stateDirectory,448);let Y=T0(J),V=b$(d(J).state,{proofStore:Y,repair:!1});if(!V?.worker)throw new H2("identity_missing");let N=N0(J);if(V.worker.configDigest===N0($))k0({...V,worker:{...V.worker,configDigest:N}},d(J).state,{proofStore:Y});else if(V.worker.configDigest!==N)throw new H2("worker_config_binding_mismatch");c(D0(J.stateDirectory,"worker.json"),J),W3.after($,J),I4($,J,Z);let B=D0(J.stateDirectory,U2);if(u(B))E7(B);return Q("moved"),{saved:J,configPath:D0(J.stateDirectory,"worker.json")}}function I4($,J,Z){if(A4($,J,Z,"connect"),!A3(J.stateDirectory))return;let Q=y7(F$($.stateDirectory));if(!Q)return;let X=F$(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);C4($.stateDirectory)}function z3($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=e0({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function S7($,J,Z){if(u(g(J))){let X=e0({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=o$(D0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function b7($,J){let Z=[$,...R4($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>D0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let V=D0(X,Y);if(V===J||!o$(D0(V,"worker.json")))continue;let N=E4(V);if(!N||N.stateDirectory===$||N.stateDirectory.startsWith($+x7))Q.push({directory:V,config:N})}return Q}function A3($){try{return JSON.parse(s(D0($,"api-key.json"))).store==="keychain"}catch{return!1}}function w7($,J){let Z=F$($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function C4($){try{F$($).deleteBinding()}catch(J){if(!(J instanceof V0))throw J}}function y7($){try{return $.loadBinding()}catch(J){if(J instanceof V0)return null;throw J}}function k7($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=E4(Z);return X?.stateDirectory===Z?{saved:X,configPath:D0(Z,"worker.json")}:Q}function W4($){try{return R3($).isSymbolicLink()&&C7($)==="reason"}catch{return!1}}function h7($){try{let J=JSON.parse(s(D0($,U2)));return typeof J.version==="string"?J.version:null}catch{return null}}function E4($){try{let J=D0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function o$($){try{return R3($)}catch{return null}}function f7($){if($ instanceof H2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof V0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as m7}from"fs";function M2($){try{let J=JSON.parse(m7(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function x4($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as AV}from"crypto";import{readdirSync as RV,realpathSync as K6,statSync as PV}from"fs";import{hostname as IV}from"os";import{join as c$,resolve as CV}from"path";var T2="cloud",v7=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function R1($){return v7.test($)&&!S4.test($)}var g7={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function e$($){return g7[$]}import{chmodSync as u7,lstatSync as F2,mkdtempSync as d7,realpathSync as k4,rmdirSync as p7,rmSync as l7,unlinkSync as c7}from"fs";import{createConnection as s7,createServer as a7}from"net";import{basename as b4,dirname as w4,join as k$}from"path";var i7=K.enum(["status","drain","resume","stop","reload_roots"]),n7=K.strictObject({version:K.literal(1),instanceId:K.string(),deviceId:K.string(),phase:K.enum(["starting","running","reconnecting","stopping"]),drained:K.boolean(),activeClaims:K.number().int().nonnegative(),activeSessions:K.number().int().nonnegative().optional(),executionEligible:K.boolean(),supportedOperations:K.array(K.enum(L2)).max(L2.length).optional(),capabilityReadiness:K.partialRecord(K.enum(L2),K.boolean()).optional(),lastHeartbeat:K.string().nullable(),expiresAt:K.string()}),t7=K.strictObject({nonce:K.string(),action:i7}),r7=K.object({nonce:K.uuid()}),h4=K.strictObject({version:K.literal(1),nonce:K.uuid(),socketPath:K.string().max(100)});function f4($){return k$(d($).lock,"control.json")}function _2($){return e(d($).lock),r7.parse(JSON.parse(s(k$(d($).lock,"owner.json"))))}function y4($){if(!u($))return!1;let J=F2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function m4($,J){let Z=f4($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!F2(Y).isSocket())return null;return y4(Y)?Y:null}let Q=h4.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=w4(Q.socketPath);if(w4(X)!==k4("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(b4(X))||b4(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),y4(Q.socketPath)?Q.socketPath:null}async function j2($,J,Z){if(_2($).nonce!==J)throw Error("worker_instance_changed");let Q=f4($);if(u(Q))throw Error("worker_control_already_serving");let X=d7(k$(k4("/tmp"),"ara-worker-")),Y=k$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let V=new Set,N=a7((G)=>{V.add(G),G.once("close",()=>V.delete(G)),G.setTimeout(2000,()=>G.destroy());let H="",q=!1;G.on("error",()=>G.destroy()),G.on("data",(T)=>{if(q)return;if(H+=T.toString(),Buffer.byteLength(H)>4096){G.destroy();return}if(!H.includes(`
+`))return;q=!0;try{let L=t7.parse(JSON.parse(H));if(L.nonce!==J){G.destroy();return}G.end(JSON.stringify(Z(L.action))+`
+`)}catch{G.destroy()}})});N.maxConnections=32;let B,U=!1,M=async()=>{if(U)return;U=!0;for(let G of V)G.destroy();if(await new Promise((G)=>N.close(()=>G())),B&&u(Q)){let G=F2(Q);if(G.isFile()&&G.dev===B.dev&&G.ino===B.ino)try{let H=h4.parse(JSON.parse(s(Q)));if(H.nonce===J&&H.socketPath===Y)c7(Q)}catch{}}try{p7(X)}catch{}};try{if(await new Promise((G,H)=>{N.once("error",H),N.listen(Y,()=>{u7(Y,384),G()})}),_2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),B=F2(Q),M}catch(G){throw await M(),G}}function v4($,J){try{let Z=JSON.parse(s(k$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function P1($){return v4($,"runtime_version")}function o7($){return v4($,"nonce")}function g4($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(k$(d($).lock,"owner.json")))return"no_lock";return m4($,_2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var e7=21600000,$Z=K.strictObject({instance:K.string().nullable(),since:K.number().int().nonnegative()});function JZ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=$Z.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;P3($)}catch{}return null}function P3($){try{l7(d($).updateDeferral,{force:!0})}catch{}}async function D2($,J,Z=()=>!1){let Q=o7($),X=JZ($,Q);if(J!==void 0){let U=P1($);if(U===null||U===J&&X===null&&!Z())return{state:"current"}}let Y;try{let U=await K0($,"status");Y=U?U.activeSessions??U.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let V=Date.now(),N=X;if(N===null){N=V;try{c(d($).updateDeferral,{instance:Q,since:N})}catch{}}let B=V-N;return{state:B<e7?"busy":"drained",sessions:Y,waitedMs:B}}async function K0($,J){let Z=d($);if(!u(k$(Z.lock,"owner.json")))return null;let Q=_2($),X=m4($,Q.nonce);if(!X)return null;return new Promise((Y,V)=>{let N=s7(X),B="",U=!1,M=(G,H)=>{if(U)return;if(U=!0,N.destroy(),H)V(H);else Y(G)};N.setTimeout(2000,()=>N.destroy(Error("worker_control_timeout"))),N.on("connect",()=>N.write(JSON.stringify({nonce:Q.nonce,action:J})+`
+`)),N.on("data",(G)=>{if(B+=G.toString(),Buffer.byteLength(B)>16384)N.destroy(Error("worker_control_oversize"))}),N.on("error",(G)=>{if("code"in G&&["ECONNREFUSED","ENOENT"].includes(String(G.code)))M(null);else M(null,G.message==="worker_control_timeout"?G:Error("worker_control_unavailable"))}),N.on("end",()=>{try{let G=n7.parse(JSON.parse(B));if(G.instanceId!==Q.nonce)throw Error("worker_instance_changed");M(G)}catch{M(null,Error("worker_control_invalid_response"))}}),N.once("close",()=>M(null,Error("worker_control_unavailable")))})}import{randomUUID as VY}from"crypto";import{homedir as BJ}from"os";import{spawn as ZZ}from"child_process";async function u4($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,V=Promise.resolve(),N=(G)=>{if(Q===G)return;Q=G,J.onStatusChange?.(G)},B=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,V=U()},J.retryMs??5000),Y.unref()},U=async()=>{try{let G=(J.spawn??ZZ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=G,G.once("exit",()=>{if(!X&&Z===G)N("failed"),B()}),await new Promise((H,q)=>{G.once("spawn",H),G.once("error",q)}),G.exitCode===null&&G.signalCode===null)N("held")}catch{N("failed"),B()}};V=U(),await V;let M;return{get status(){return Q},release(){return M??=(async()=>{X=!0,clearTimeout(Y),await V;let G=Z;if(!G||G.exitCode!==null||G.signalCode!==null||!G.pid)return Q="failed","released";let H=await new Promise((q)=>{let T,L=setTimeout(()=>{try{G.kill("SIGKILL")}catch{}T=setTimeout(()=>q("failed"),1000)},1000);G.once("exit",()=>{clearTimeout(L),clearTimeout(T),q("released")});try{G.kill("SIGTERM")}catch{}});if(H==="released")Q="failed";return H})()}}}class $1 extends Error{constructor(){super("Reason Device operation lease expired.")}}class W2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new $1;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new $1;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new $1)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as GZ}from"fs";import{randomUUID as BZ}from"crypto";import{constants as I3}from"fs";import{open as QZ}from"fs/promises";import{join as XZ}from"path";var YZ={platform:process.platform,home:H0,async openFile($){let J=await QZ($,I3.O_RDONLY|I3.O_NOFOLLOW|I3.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function d4($=YZ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(XZ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class C3 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function VZ($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,V=new Promise((N,B)=>{X=()=>{Q.abort(J.reason),B(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let U=new C3;Q.abort(U),B(U)},Z)});try{return await Promise.race([$(Q.signal),V])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function p4($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await VZ($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof C3||(X instanceof L0?I1(X.status):C1(X));if(Y){let V=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+V}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function m3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}function V8($,J,Z){let Q=$?.permissionRecovery;return z2(Q,Z)&&Q.deviceId===J.deviceId&&Q.organizationId===J.orgId?{permissionRecovery:Q}:{}}var KZ=1000,NZ=250,UZ=Y8(GZ(process.execPath)),l4=null,c4=null;function G8($){if(process.platform!=="darwin")return{};return c4??=d4().then((J)=>{l4={status:J,checkedAt:$().getTime()}}).finally(()=>{c4=null}),{fullDiskAccess:{...l4??{status:"unknown",checkedAt:$().getTime()},executablePath:UZ}}}var HZ=8,qZ=64,MZ=2000,TZ=2000,v3=8000,s4=3,LZ=250,a4=1000,i4=30000,FZ=0.2,_Z=30000,jZ=21600000,DZ=300000,WZ=3600000,OZ=0.1,B8=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function zZ($){return Math.min(s4,Math.max(1,$??s4))}function AZ($){return typeof $.reason_code==="string"&&B8.has($.reason_code)?$.reason_code:"cancelled"}function E3($){return $.reason instanceof h0&&($.reason.code==="cancelled"||B8.has($.reason.code))?$.reason.code:"cancelled"}function n4($){return $ instanceof h0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function K8($){return $.capability==="hands.connect"&&(Z8($.payload)||J8($.payload))}function x3($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*OZ)))}function RZ($,J=Math.random){let Z=Math.min(i4,a4*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*FZ*(Q*2-1);return Math.min(i4,Math.max(a4,Math.round(Z+X)))}function g3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class S3 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function PZ($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function b3($){return $ instanceof Error?$.message:String($)}function w3($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function i0($){return $ instanceof L0&&$.status===409&&$.code==="attempt_fenced"}function y3($){return $.capability==="environment.install"}function IZ($){if($ instanceof P2||$ instanceof $1||$ instanceof x1)return"timeout";if(!($ instanceof Error)||$ instanceof L0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof L0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function E1($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(i0(Z))return;let Q=Z instanceof L0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:IZ(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function J1($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)E1($,J,Q);throw Q}}class x1 extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function k3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":o4(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:y3(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,V=Q?AbortSignal.any([Q,Y.signal]):Y.signal,N=$.sleep??g3,B=$.operationCompletionTimeoutMs??v3,U=performance.now()+B,M,G,H=new Promise((L,j)=>{let W=()=>{let F=new x1;Y.abort(F),j(F)},O=(F)=>{clearTimeout(M),M=setTimeout(W,F)};if(G=()=>O(Math.max(0,Math.min(U-performance.now(),MZ))),O(B),$.signal.addEventListener("abort",G,{once:!0}),$.signal.aborted)G()}),q,T=0;try{while(!0)try{q=await Promise.race([$.client.completeOperation($.state,J,X,V),H]);break}catch(L){if(V.aborted||$.signal.aborted||I0(L)||i0(L)||!CZ(L)||performance.now()>=U)throw E1($,"completion",L),L;T+=1;let j=Math.min(500*2**Math.min(T-1,4),Math.max(0,U-performance.now()));if(j<=0)throw E1($,"completion",L),L;try{await N(j,V)}catch{throw E1($,"completion",L),L}}}finally{clearTimeout(M),$.signal.removeEventListener("abort",G),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:q.status})}function CZ($){if(I0($))return!1;if(i0($))return!1;if($ instanceof L0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof x1)return!1;return!0}return!1}class P2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function O2($){if($ instanceof P2)return!0;return $ instanceof L0?I1($.status):C1($)}function h3($,J){if(!($ instanceof L0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function EZ($,J,Z,Q,X){let Y=new AbortController,V,N=()=>{return},B=new Promise((M,G)=>{let H=()=>{let q=Q.reason??new DOMException("Aborted","AbortError");Y.abort(q),G(q)};if(N=()=>Q.removeEventListener("abort",H),Q.aborted)H();else Q.addEventListener("abort",H,{once:!0})}),U=new Promise((M,G)=>{V=setTimeout(()=>{let H=new P2;Y.abort(H),G(H)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),B,U])}finally{if(V!==void 0)clearTimeout(V);N()}}async function t4($,J,Z,Q,X,Y){let V=zZ($.operationHeartbeatMaxAttempts),N=$.operationHeartbeatAttemptTimeoutMs??v3,B=$.operationHeartbeatRetryDelayMs??LZ,U=Y.remainingMs(),M=Math.min(U,V*N+B*V*(V-1)/2);for(let G=0;G<V;G+=1)try{Q.throwIfAborted(),Y.assertCurrent();let H=Math.min(N,Y.remainingMs()),q=await EZ($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(H-1000))),clientRetryCount:G},Q,H);return Q.throwIfAborted(),Y.acknowledge(q.lease_until),q}catch(H){if(Q.aborted||G+1>=V||i0(H)||I0(H)||!O2(H)){if(!Q.aborted)E1($,"operation_heartbeat",H);throw H}let q=U-Y.remainingMs(),T=h3(H,($.now?.()??new Date).getTime()),L=Math.max(B*(G+1),M*(G+1)/V-q,T);await X(Math.min(Y.remainingMs(),L),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function xZ($,J,Z,Q,X){let Y=K8(J),V=new AbortController,N=new AbortController,B=()=>{V.abort($.signal.reason),N.abort($.signal.reason)};if($.signal.aborted)B();else $.signal.addEventListener("abort",B,{once:!0});let U=null,M,G,H=-1,q=0,T=Promise.resolve(),L=[],j=new AbortController,W=!1,O,F=null,z=!1,_,D,R={},E=(S)=>{W=!0,j.abort(S),V.abort(S),N.abort(S)},P=(S)=>{if(O)return O;let k=structuredClone(S),p=q;return O=(async()=>{let w=new AbortController,C=w.signal;C.throwIfAborted();let x,A=()=>{},y=new Promise((b,n)=>{if(A=()=>n(C.reason),C.addEventListener("abort",A,{once:!0}),x=setTimeout(()=>w.abort(Error("Hands stop receipt delivery timed out.")),4000),C.aborted)A()});try{for(let b=0;b<3;b+=1){C.throwIfAborted();try{let n=await Promise.race([J1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:p,events:[k],signal:C,transientRetryOwner:"caller"})),y]);if(C.throwIfAborted(),n.next_event_seq!==p+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");q=n.next_event_seq;return}catch(n){if(I0(n))X(n);let t=n instanceof L0?I1(n.status):C1(n);if(C.aborted||!t||b===2)throw n;let X0=Math.max(500*2**b,h3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(X0,C),y])}}}finally{clearTimeout(x),C.removeEventListener("abort",A),w.abort()}})(),O},I=(S,k,p)=>{let w=(x)=>J1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:k,events:S,signal:x,...p?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&i0(A))E(A);if(p&&(I0(A)||i0(A))){if(I0(A))X(A);V.abort(A),N.abort(A),j.abort(A)}throw A});if(!p)return async(x)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){q=(await w(x)).next_event_seq;return}x.throwIfAborted();let A=()=>{},y=new Promise((b,n)=>{A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([w(x),y]);x.throwIfAborted(),q=b.next_event_seq}finally{x.removeEventListener("abort",A)}};let C=p4({send:w,lease:D,sleep:Z,retryAfterMs:(x)=>h3(x,($.now?.()??new Date).getTime())});return async(x)=>{let A=await C(x);if(A.next_event_seq!==k+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");q=A.next_event_seq}},f=async(S,k)=>{let p=S??await t4($,J,{controlAckSeq:H,waitMs:k},N.signal,Z,D),w=null,C=!1;for(let x=0;x<10;x+=1){let A=H+1;for(let y of p.controls){if(y.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(y.kind==="cancel"||y.kind==="operation.cancel")w??=AZ(y.payload),V.abort(new h0(w,"Reason closed the Device operation."));if(y.kind!=="cancel"&&y.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,t=new Promise((X0,M0)=>{b=X0,n=M0});t.catch(()=>{}),R.current={promise:t,resolve:b,reject:n}}try{C||=!await $.onControl?.(J,y)}catch(b){if(b instanceof h0)M??=n4(b);throw R.current?.reject(b),b}}H=y.seq,A+=1}if(p.controls.length===0){if(p.next_control_seq!==H+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:w,unsupported:C}}try{p=await t4($,J,{controlAckSeq:H},N.signal,Z,D),R.current?.resolve()}catch(y){if(R.current?.reject(y),!w||i0(y)||I0(y))throw y;return{cancellationReason:w,unsupported:C}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)D=new W2(J.lease_until,()=>($.now?.()??new Date).getTime(),(k)=>{if(!V.signal.aborted)U=k;V.abort(k),N.abort(k)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||f3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await f()}catch(k){if(!y3(J)||i0(k)||I0(k))throw k;await k3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let k=S.cancellationReason??E3($.signal);V.abort(new h0(k,"Reason closed the Device operation.")),G={status:"cancelled",error_code:k}}else if(S.unsupported)V.abort(),G={status:"failed",error_code:"control_unsupported"};else{let k=Y?Promise.resolve():(async()=>{let w=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?TZ:15000),C=Math.min(w,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??v3)-1000)),x=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!N.signal.aborted)try{if(!x){if(await Z(w,N.signal),N.signal.aborted)return}let A=await f(void 0,x?C:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)U=Error("Reason requested an unsupported Device operation control.");V.abort(A.cancellationReason?new h0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(I0(A))X(A);if(i0(A))U=A,E(A);if(!N.signal.aborted)U=A,V.abort();return}})();try{if(D?.assertCurrent(),V.signal.throwIfAborted(),Q.authorized=()=>!V.signal.aborted&&(Y||(D?.remainingMs()??0)>0),G=await $.onClaim(J,V.signal,async(w)=>{if(y3(J))return;if(w.kind==="permission.denied"){if(!Q.authorized())return;let t=w.data,X0=($.now??(()=>new Date))().getTime(),M0=$.statusPath??A2(),u0=($.loadStatus??t$)(M0),C0={id:BZ(),kind:"permission_denied",operation:t?.operation,provenance:t?.provenance,occurredAt:new Date(X0).toISOString(),expiresAt:new Date(X0+600000).toISOString(),sessionId:J.run_id,deviceId:$.state.deviceId,organizationId:$.state.orgId};if(u0&&z2(C0,X0)){let c0=u0.permissionRecovery;if(!c0||!z2(c0,X0)||c0.sessionId!==C0.sessionId||c0.operation!==C0.operation||c0.provenance!==C0.provenance)($.saveStatus??R2)({...u0,permissionRecovery:C0},M0)}return}let C=J.capability==="hands.connect"&&w.capability==="hands.connect"&&w.kind==="hands.stopped",x=J.capability==="hands.connect"&&w.kind==="hands.reconnected",A=x||J.capability==="inference.custom.v1"?AbortSignal.any([V.signal,j.signal,...w.deliverySignal?[w.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,j.signal]):$.signal,y={kind:w.kind,payload:{sequence:w.sequence,capability:w.capability,...w.data?{data:x?structuredClone(w.data):w.data}:{}}};if(J.capability==="hands.connect"&&w.capability==="hands.connect"&&(w.kind==="started"||w.kind==="hands.started")||(f3.has(J.capability)||J.capability==="pty.start")&&w.kind==="started")return new Promise((t,X0)=>{L.push({wireEvent:y,settle:(M0)=>M0===void 0?t():X0(M0)})});let b=L;L=[];let n=T.then(async()=>{if((W||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(C)await P(y);return}if(F!==null){if(w.kind!=="hands.stopped"||!z||!_)throw F;let X0=new AbortController,M0=AbortSignal.any([$.signal,j.signal,X0.signal]),u0=setTimeout(()=>X0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);z=!1;try{await _(M0),_=void 0,await I([y],q,!0)(M0),F=null}catch(C0){throw F=C0??Error("Hands stop receipt could not be confirmed."),C0}finally{clearTimeout(u0),X0.abort()}return}if(x&&!D){let X0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));D=new W2(new Date(X0).toISOString(),()=>($.now?.()??new Date).getTime(),(M0)=>{V.abort(M0),N.abort(M0)})}let t=q;if(x)_=I([...b.map((X0)=>X0.wireEvent),y],t,!0),await _(A),_=void 0;else await I([...b.map((X0)=>X0.wireEvent),y],t,!1)(A)});n.then(()=>{for(let t of b)t.settle()},(t)=>{for(let X0 of b)X0.settle(t??Error("Hands event delivery failed."))}),T=n.catch((t)=>{if(I0(t))X(t);if(x){if(F===null)z=A.aborted&&!j.signal.aborted,F=t??Error("Hands generation receipt delivery failed.");if(!A.aborted)V.abort(t),N.abort(t)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(w){G=V.signal.aborted?{status:"cancelled",error_code:E3(V.signal)}:{status:"failed",error_code:n4(w)}}finally{Q.authorized=()=>!1,j.abort();for(let w of L.splice(0))w.settle();N.abort(),await k}let p=e4(J.capability)?$8(G.result,J.operation_id):null;if(U){if(I0(U))throw U;G={status:"failed",error_code:M??"control_or_heartbeat_failed",...p?{result:p}:{}}}else if(V.signal.aborted&&G.status==="succeeded")G={status:"cancelled",error_code:E3(V.signal),...p?{result:p}:{}}}if(D?.close(),I0($.signal.reason))throw $.signal.reason;await k3($,J,G)}finally{D?.close(),j.abort(),N.abort(),$.signal.removeEventListener("abort",B)}}async function u3($){let J=$.now??(()=>new Date),Z=$.sleep??g3,Q=$.saveStatus??R2,X=$.loadStatus??t$,Y=$.statusPath??A2(),V=J().toISOString(),N=X(Y)?.lastUsedAt,B=!1,U=()=>({version:1,pid:process.pid,startedAt:V,...G8(J),...V8(X(Y),$.state,J().getTime()),deviceId:$.state.deviceId,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:B}:{},...N?{lastUsedAt:N}:{}}),M=0,G,H=!1,q,T,L,j=Promise.resolve();Q({...U(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),X8();try{let W=async()=>{let O=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||O===T)return;if(q&&T){let _=await q.release();if($.onEvent?.({type:"idle_sleep",status:_,policy:T}),_==="failed")return;q=void 0,T=void 0,B=!1;let D=X(Y);if(D)Q({...D,idleSleepHold:B},Y)}if(!O)return;T=O;let F=!0;q=await($.acquireAwakeHold??u4)(O,{onStatusChange:(_)=>{if(F)return;B=_==="held";let D=X(Y);if(D)Q({...D,idleSleepHold:B},Y);$.onEvent?.({type:"idle_sleep",status:_,policy:O})}}),F=!1,B=q.status==="held";let z=X(Y);if(z)Q({...z,idleSleepHold:B},Y);$.onEvent?.({type:"idle_sleep",status:q.status,policy:O})};if(await W(),$.readIdleSleepPolicy)L=setInterval(()=>{j=j.then(W).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),L.unref();while(!$.signal.aborted){let O=!1;try{await SZ({...$,saveStatus:(F,z)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;N=F.lastUsedAt??N,Q({...F,startedAt:V,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:B}:{}},z)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&M>0&&!O){O=!0;let z=M;M=0,G=void 0,$.onEvent?.({type:"reconnected",attempts:z})}$.onEvent?.(F)}});return}catch(F){if(w3(F,$.signal))return;if(I0(F)){H=!0;let _=$.state.worker?"worker_connection_failed":b3(F);throw Q({...U(),state:"error",error:_},Y),$.onEvent?.({type:"error",message:_}),F}M+=1;let z=RZ(M,$.reconnectRandom);G??=J().toISOString(),Q({...U(),state:"starting",reconnectingSince:G},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":b3(F),attempt:M,retryInMs:z}),await Z(z,$.signal)}}}catch(W){if(!w3(W,$.signal))throw W}finally{if($.client.close?.(),clearInterval(L),await j,q&&T){let W=await q.release();B=W==="failed"&&q.status==="held",$.onEvent?.({type:"idle_sleep",status:W,policy:T})}if(!H)Q({...U(),state:"stopped"},Y);else{let W=X(Y);if(W)Q({...W,idleSleepHold:B},Y)}$.onEvent?.({type:"stopped"})}}async function SZ($){let J=$.now??(()=>new Date),Z=$.sleep??g3,Q=$.statusPath??A2(),X=$.saveStatus??R2,Y=$.loadStatus??t$,V=J().toISOString(),N=Y(Q)?.lastUsedAt,B=$.runtimeUpdate,U=new AbortController,M=()=>U.abort($.signal.reason);if($.signal.aborted)M();else $.signal.addEventListener("abort",M,{once:!0});let G=B?.random??Math.random,H=$.maxConcurrentClaims,q=typeof H==="number"&&Number.isSafeInteger(H)&&H>0?Math.min(qZ,H):HZ,T=0,L=!1,j=null,W=(v)=>{j??=v,U.abort(v)},O=new Map,F=()=>{let v=new Set,Y0=0;for(let{claim:E$}of O.values()){let G$=E$.capability==="hands.connect"?E$.payload[r4]:void 0;if(typeof G$==="string"){if(v.has(G$))continue;v.add(G$)}Y0+=1}return Y0},z=null,_=()=>[...O.values()].some((v)=>v.authorized()),D=()=>[...O.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=B?new Date(V).getTime()+x3(B.initialDelayMs??_Z,G):Number.POSITIVE_INFINITY,E=null,P=!1,I=$.firstHeartbeat,f=I?.account_root_metadata_supported===!0,S=I?.workspace_root_metadata_supported===!0,k=I?.account_root_path_supported===!0,p=I?.home_contained_roots_supported===!0,w=I?.root_paths_supported===!0,C=I?.startup_supported===!0,x=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,y,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:V,...G8(J),...V8(Y(Q),$.state,J().getTime()),...N?{lastUsedAt:N}:{},deviceId:$.state.deviceId,...E?{organizationId:E.organization_id,organizationName:E.organization_name,organizationSlug:E.organization_slug}:{}}),t=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!b)y??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...C&&!b&&y?{startup:y}:{},capabilities:v?Q8($.capabilities,{accountRootMetadataSupported:f,workspaceRootMetadataSupported:S,accountRootPathSupported:k,homeContainedRootsSupported:p,rootPathsSupported:w}):{supported_operations:[]}}},X0=()=>{if(P||!$.client.identity)return;P=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;E=v;let Y0=Y(Q);if(!Y0)return;X({...Y0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},M0=(v)=>{f=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,k=v.account_root_path_supported===!0,p=v.home_contained_roots_supported===!0,w=v.root_paths_supported===!0,C=v.startup_supported===!0,x=!1},u0=(v)=>{if(v.startup)b=!0},C0=(v,Y0)=>{if(!(Y0 instanceof L0&&Y0.status===400&&Y0.code==="invalid_heartbeat")||!v.startup&&!x)throw Y0;if(b=!0,x)f=S=k=!1,p=w=C=x=!1;return null},c0=(v)=>{M0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),X0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},I$=!1,s$=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(I$)s$=!0;let v=t();J1($,"heartbeat",()=>$.client.heartbeat($.state,v,U.signal).catch((Y0)=>C0(v,Y0))).then((Y0)=>{if(!Y0)return;u0(v),M0(Y0),c0(Y0)},()=>{return})});let T$=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let Y$=!1,C$=$.maxConsecutiveHeartbeatFailures??3,V$=0;try{while(!$.signal.aborted){if(j)throw j;if(L&&D())break;let v,Y0=t(),E$=A;A=void 0,I$=!0,s$=!1;try{let i=await J1($,"heartbeat",()=>$.client.heartbeat($.state,Y0,U.signal,...E$?[E$]:[]).catch((B0)=>C0(Y0,B0)));if(I$=!1,!i)continue;v=i,u0(Y0),V$=0}catch(i){if(I$=!1,$.signal.aborted)break;if(!O2(i))throw i;if(V$+=1,V$>=C$&&!_())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(M0(v),Object.keys(t().capabilities).length>Object.keys(Y0.capabilities).length)continue;if(s$)continue;if(c0(v),j)throw j;if($.signal.aborted)break;if(B&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(B&&J().getTime()>=R)try{let i=new AbortController,B0=()=>i.abort($.signal.reason);if($.signal.aborted)B0();else $.signal.addEventListener("abort",B0,{once:!0});let O0;try{O0=B.check(i.signal)}catch(z0){O0=Promise.reject(z0)}let B$=O0.then((z0)=>({kind:"completed",result:z0}),(z0)=>({kind:"failed",error:z0})),a$;try{while(!0){let z0=await PZ(B$,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(z0.kind==="failed")throw new S3(z0.error);if(z0.kind==="completed"){a$=z0.result;break}try{let E0=t(),L1=await J1($,"heartbeat",()=>$.client.heartbeat($.state,E0,U.signal).catch((r1)=>C0(E0,r1)));if(!L1)continue;v=L1,u0(E0),c0(v),V$=0}catch(E0){if($.signal.aborted)throw E0;if(!O2(E0))throw E0;if(V$+=1,V$>=C$&&!_())throw E0}}}catch(z0){i.abort(z0);let E0=await B$;if(E0.kind==="completed"&&E0.result==="activated")a$="activated";else throw z0}finally{$.signal.removeEventListener("abort",B0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,a$==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),L=!0}R=J().getTime()+x3(B.intervalMs??jZ,G)}catch(i){if(!(i instanceof S3))throw i;T+=1;let B0=B.retryBaseMs??DZ,O0=B.retryMaxMs??WZ,B$=Math.min(O0,B0*2**Math.min(T-1,8));R=J().getTime()+x3(B$,G)}if($.signal.aborted)break;if(L&&D())break;if(L){await T$($.heartbeatIntervalMs??15000);continue}let G$=$.client.sessionCadence?.($.state)??null,x$=G$?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await T$(x$);continue}if(F()>=q){let i=new AbortController;z=i;try{await Z(x$,AbortSignal.any([$.signal,i.signal]))}catch(B0){if(!i.signal.aborted)throw B0}finally{if(z===i)z=null}continue}let f0,T1=G$?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),h=performance.now();try{f0=await J1($,"claim",()=>$.client.claimOperation($.state,{waitMs:T1,signal:U.signal}))}catch(i){if($.signal.aborted||!O2(i)||!_())throw i;await T$(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(j)throw j;if(!f0){if(performance.now()-h<T1-NZ)await T$(KZ);continue}if($.claimable?.()===!1){await k3($,f0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}N=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:f0.operation_id,runId:f0.run_id,attemptId:f0.attempt_id,capability:f0.capability});let a,U0={authorized:()=>!1,claim:f0};if(a=xZ({...$,signal:U.signal},f0,Z,U0,W).catch((i)=>{if(I0(i))W(i);else if(!i0(i)&&[...O].some(([B0,O0])=>B0!==a&&O0.authorized())){if(i instanceof x1)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!i0(i)&&j===null)j=i}).finally(()=>{O.delete(a),z?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:O.size})}),O.set(a,U0),$.onEvent?.({type:"claims_changed",activeClaims:O.size}),K8(f0)){if(await a,j)throw j}}}catch(v){if(!w3(v,$.signal)){U.abort(v),Y$=!0;let Y0=$.state.worker?"worker_connection_failed":b3(v);throw X({...n(),state:"error",error:Y0},Q),$.onEvent?.({type:"error",message:Y0}),v}}finally{if(U.abort(),await Promise.allSettled(O.keys()),$.signal.removeEventListener("abort",M),!Y$)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as BQ}from"child_process";import{constants as k8,existsSync as KQ,mkdtempSync as s8,rmSync as NQ}from"fs";import{access as h8,open as UQ,readFile as f8,readlink as HQ,readdir as m8,unlink as qQ,rmdir as MQ}from"fs/promises";import{basename as c3,join as a3}from"path";import{randomUUID as h$}from"crypto";import{chmodSync as bZ,closeSync as wZ,fsyncSync as yZ,openSync as kZ,readFileSync as hZ,rmdirSync as N8,unlinkSync as q8,writeFileSync as fZ}from"fs";import{createConnection as mZ,createServer as vZ}from"net";import{dirname as gZ,join as uZ}from"path";var dZ=5000;async function M8($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:h$()},X={runId:h$(),deviceId:h$(),rootId:h$(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=H8(J,X),V={version:1,snapshot_id:h$(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(V).installed&&Y.current().snapshot_id===V.snapshot_id&&!Z.aborted}catch{return!1}finally{try{q8(Y.path)}catch{}}}async function T8($,J,Z=U8){if(J.aborted)return!1;let Q,X,Y=new Set,V=h$(),N=vZ((H)=>{Y.add(H),H.once("close",()=>Y.delete(H)),H.on("error",()=>H.destroy()),H.end(V)});N.maxConnections=1;let B,U,M=new Promise((H)=>{U=()=>H(!1)}),G=setTimeout(U,dZ);J.addEventListener("abort",U,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${h$()}`}),X=uZ(Q.journalDirectory,"readiness.json");let H=kZ(X,"wx",384);try{fZ(H,V),yZ(H)}finally{wZ(H)}if(hZ(X,"utf8")!==V||J.aborted)return!1;let q=new Promise((T)=>{N.once("error",()=>T(!1)),N.listen(Q.socketPath,()=>{try{bZ(Q.socketPath,384)}catch{T(!1);return}B=mZ(Q.socketPath);let L="";B.setEncoding("utf8"),B.once("error",()=>T(!1)),B.on("data",(j)=>{if(L+=j,L.length>V.length)B?.destroy(),T(!1)}),B.once("end",()=>T(L===V)),B.once("close",()=>T(!1))})});return await Promise.race([q,M])&&!J.aborted}catch{return!1}finally{clearTimeout(G),J.removeEventListener("abort",U),B?.destroy();for(let H of Y)H.destroy();if(await new Promise((H)=>N.close(()=>H())),Q?.disposeSocket(),X)try{q8(X)}catch{}if(Q){try{N8(Q.journalDirectory)}catch{}try{N8(gZ(Q.journalDirectory))}catch{}}}}import{spawn as pZ}from"child_process";import{randomUUID as f$}from"crypto";import{basename as lZ}from"path";import{fileURLToPath as cZ}from"url";function sZ(){let $=lZ(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",cZ(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function _8($,J,Z=sZ()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),V=pZ(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),N=!1,B=new Promise((F)=>V.once("close",()=>{N=!0,F()}));V.on("error",X);let U,M,G=new Promise((F)=>{U=F}),H=new Promise((F)=>{M=F}),q=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",L=0,j=!1;V.stdout.setEncoding("utf8"),V.stdout.on("data",(F)=>{if(L+=Buffer.byteLength(F),T+=F,L>512){X();return}while(T.includes(`
+`)){let z=T.indexOf(`
+`),_=T.slice(0,z);T=T.slice(z+1);try{if(!j){let D=JSON.parse(_);if(!D||Object.keys(D).length!==2||!Number.isInteger(D.port)||D.port<1024||D.port>65535||typeof D.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(D.token))throw Error("probe_receipt_invalid");j=!0,U({port:D.port,token:D.token})}else if(_==="ready")M(!0);else X()}catch{X()}}}),B.then(X);let W,O=!1;try{let F=await Promise.race([G,q]);if(!F||!V.pid||Q.signal.aborted||J.aborted)return!1;let z=Date.now()+4500,_=f$(),D={organizationId:f$(),userId:f$(),runId:f$(),deviceId:f$(),rootId:f$(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:f$(),port:F.port,expiresAtMs:z},R={binding:D,executorLaunchId:_,job:{jobId:D.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:z,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:V.pid,processGroupId:V.pid,executorLaunchId:_}}},E=F8({binding:D,deniedPorts:new Set,readCurrentJob:async()=>!N&&!Q.signal.aborted?R:null});W=await L8({binding:D,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:E,signal:Q.signal}),O=await Promise.race([H,q])===!0&&!Q.signal.aborted&&!J.aborted}catch{O=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),W?.close(),Q.abort(),V.stdin.destroy(),!N)V.kill("SIGKILL");await B}return O&&N}import{execFileSync as C2}from"child_process";import{randomUUID as p0}from"crypto";import{chmodSync as j8,chownSync as b8,closeSync as d3,constants as U$,existsSync as aZ,fstatSync as w8,mkdirSync as D8,mkdtempSync as iZ,openSync as p3,readFileSync as nZ,readSync as tZ,realpathSync as rZ,rmdirSync as oZ,rmSync as eZ}from"fs";import{join as m$}from"path";import{fileURLToPath as $Q}from"url";var W8=1e4,JQ=!1;function E2(){if(process.platform!=="linux")return!1;return JQ||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=C2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var ZQ=Buffer.from([0,255,3,4]);function O8($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function QQ($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function S1($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=I2(),{directory:Q,root:X,runtimeDirectory:Y}=VQ(Z),V=new AbortController,N=()=>V.abort();$.addEventListener("abort",N,{once:!0});let B;V.signal.addEventListener("abort",()=>B?.close(),{once:!0});let U=setTimeout(N,W8),M={organization_id:p0(),user_id:p0(),device_id:p0()},G=p0(),H=p0(),q=p0(),T=p0(),L=Date.now()+W8,j={kind:"workspace_source",target_revision:0,root_grant_revision:1},W=p0().replaceAll("-",""),O,F=Buffer.alloc(0),z,_=!1,D=!1,R=!1,E=!1,P,I,f,S=async(p)=>{while(!p()){if(V.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((w)=>setTimeout(w,20))}if(V.signal.aborted)throw Error("pty_probe_cancelled")},k=!1;try{B=XQ(Q,Z),P=Bun.serve({hostname:"127.0.0.1",port:0,fetch(C,x){let A=new URL(C.url).pathname,y=A===`/device/hands/${W}`?"hands":A===`/device/pty/${W}`?"pty":null;if(y&&x.upgrade(C,{data:{lane:y}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(C){if(C.data.lane==="pty")O=C},message(C,x){if(C.data.lane!=="pty")return;if(typeof x==="string"){try{if(JSON.parse(x).t==="open")_=!0}catch{N()}return}if(F.length+x.length>8192){N();return}F=Buffer.concat([F,x])}}});let p=`ws://127.0.0.1:${P.port}`;if(I=l3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:G,operationId:p0(),attemptId:p0(),claimOwner:M,deviceIdentity:{deviceId:M.device_id,rootId:H,apiOrigin:"https://worker-probe.invalid"},signal:V.signal,payload:{relay_url:`${p}/device/hands/${W}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(L).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:z8,hands_worker_version:P8,hands_worker_artifact_sha256:C8,hands_worker_entrypoint:I8,target_generation:1,target_fence_id:q,environment_binding:j,[E8]:x8},emitEvent:async(C)=>{if(C==="hands.started")E=!0;if(C==="hands.ready")D=!0;if(C==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:S8(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:$Q(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!D)N()}),await S(()=>D),A8({root:X,runId:G,payload:{version:1,snapshot_id:T,revision:1,run_id:G,root_id:H,device_id:M.device_id,binding:{...j,target_generation:1,target_fence_id:q},expires_at:new Date(L).toISOString(),variables:{PTY_PROBE_VALUE:W},git:null}}),f=R8({root:X,runId:G,rootId:H,deviceId:M.device_id,owner:M,workspace:{kind:"root"},authority:{device_id:M.device_id,binding:j.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:q},signal:V.signal,session:{jobId:`pty-${p0()}`,sessionId:"pty-readiness",operationId:p0(),cols:80,rows:24,leaseExpiresAtMs:L,relayUrl:`${p}/device/pty/${W}`},emit:async(C,x)=>{if(C==="pty.ready")z=x}}).catch(()=>{N()}),await S(()=>Boolean(z&&O&&_)),O.send(JSON.stringify({t:"resize",cols:100,rows:30})),O.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${W}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${B.wait("background")}) & ${O8("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${O8("foreground")}; ${B.wait("foreground")}'
+`)),await S(()=>aZ(m$(X,"foreground.pid"))&&F.includes(ZQ)),!F.includes("30 100")||z.job.environmentSnapshotId!==T||z.job.environmentRevision!==1)return!1;let w=["background.pid","foreground.pid"].map((C)=>YQ(m$(X,C)));if(new Set(w).size!==2||w.some((C)=>!Number.isSafeInteger(C)||C<2||C===z.job.process.pid))return!1;if(process.platform==="linux"){if(!w.every((C)=>QQ(nZ(`/proc/${C}/stat`,"utf8"),C,z.job.process.pid)))return!1}else{let x=C2("/bin/ps",["-o","pid=,pgid=","-p",w.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((A)=>A.trim().split(/\s+/).map(Number));if(x.length!==2||new Set(x.map(([A])=>A)).size!==2||x.some((A)=>A.length!==2||!w.includes(A[0])||A[0]!==A[1]))return!1}if(O.send(JSON.stringify({t:"close"})),await f,V.signal.aborted)return!1;for(let C of[z.job.process.pid,...w])try{return process.kill(C,0),!1}catch(x){if(!(x instanceof Error&&("code"in x)&&x.code==="ESRCH"))return!1}k=!0}catch{k=!1}finally{if(clearTimeout(U),$.removeEventListener("abort",N),N(),B?.close(),await f,await I,await P?.stop(!0),!E||R)GQ({directory:Q,root:X},Z)}return k&&R&&!$.aborted}function XQ($,J){let Z={foreground:m$($,"foreground.lifeline"),background:m$($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");C2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))d3(Y)};try{for(let Y of Object.values(Z)){let V=p3(Y,U$.O_RDONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW);try{if(Q.push(p3(Y,U$.O_WRONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW)),!w8(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{d3(V)}if(J)b8(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function y8($=(J)=>S1(J)){let J=new AbortController,Z=JSON.stringify(I2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(I2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((V)=>{Y=setTimeout(V,X)})]),clearTimeout(Y)}}}function YQ($){let J;try{J=p3($,U$.O_RDONLY|U$.O_NOFOLLOW|U$.O_NONBLOCK)}catch{return Number.NaN}try{let Z=w8(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=tZ(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{d3(J)}}function VQ($,J=rZ("/tmp")){let Z=iZ(m$(J,"reason-pty-probe-")),Q=m$(Z,"workspace"),X=m$(Z,"private");if(D8(Q,{mode:448}),D8(X,{mode:448}),$)j8(Z,493),j8(Q,493),b8(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function GQ($,J){if(J)try{C2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),oZ($.root)}catch{return}eZ($.directory,{recursive:!0,force:!0})}var a8=5000,v$="ARA_WORKER_PROBE_READY";function TQ($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{BQ($,J,{cwd:Z,env:Q,signal:X,timeout:a8,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(V,N)=>Y(!V&&!X.aborted&&N===v$))})}function LQ($,J){if(c3($)==="bash")return["--noprofile","--norc","-c",J];if(c3($)==="zsh"||c3($)==="sh")return["-f","-c",J];return null}function FQ($,J){let Z=g8({home:J,temporaryDirectory:J}),Q=(Y,V,N)=>TQ(Y,V,$.workspaceRoot,Z,N),X=async(Y,V,N,B=(M)=>M===v$,U=!1)=>{let M=await r8(Y,V,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:U,timeoutMs:a8,signal:N});return!N.aborted&&!M.timedOut&&!M.truncated&&M.exitCode===0&&B(M.stdout)};return{workspaceRead:async(Y)=>{return await h8($.workspaceRoot,k8.R_OK),await m8($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await h8($.workspaceRoot,k8.W_OK),Y.aborted)return!1;let V=s8(a3($.workspaceRoot,".ara-worker-probe-")),N=a3(V,"receipt");try{let B=await UQ(N,"wx",384);try{await B.writeFile(v$),await B.sync()}finally{await B.close()}return await f8(N,"utf8")===v$&&!Y.aborted}finally{await qQ(N).catch(()=>{}),await MQ(V).catch(()=>{})}},confinedShell:(Y)=>X(t8(),["-c",`printf ${v$}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(V)=>/^git version \S+/.test(V)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(U)=>U.includes(`p${process.pid}
+`)&&/^n\//m.test(U),!0);if(process.platform!=="linux")return!1;let[V,N,B]=await Promise.all([HQ("/proc/self/cwd"),m8("/proc/self/fd"),f8("/proc/net/tcp","utf8")]);return!Y.aborted&&V.length>0&&N.length>0&&B.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${v$}`],Y),jobs:(Y)=>T8($,Y),environment:(Y)=>M8($,J,Y),preview:(Y)=>_8(J,Y),boundPty:(Y)=>S1(Y),desktopDisplay:()=>n8(),desktopAutomation:async()=>{let Y=n3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
+`);return c8()},desktopBrowser:async()=>w1()?.features.browser===!0,fullControlShell:(Y)=>{let V=p8(),N=LQ(V,`printf ${v$}`);return N?Q(V,N,Y):Promise.resolve(!1)}}}function n3(){return process.platform==="darwin"&&w1()?.features.computer===!0?l8():null}var t3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function _Q($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=i3()){return b1($,J,Z,Q,X).final}function b1($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=i3(),Y,V){let N,B;try{if(K$($),v0(),!J)e(g($),!0),N=s8(a3(g($),"probe-")),J=FQ($,N);B=J}catch(O){let F=Promise.reject(O);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let U=async(O,F)=>{if(Z.aborted||!F&&!B[O])return!1;let z,_=new Promise((D)=>{z=()=>D(!1)});Z.addEventListener("abort",z,{once:!0});try{return await Promise.race([F??B[O](Z),_])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",z)}},M=$.executionMode==="host",G=M?U("boundPty",Y):Promise.resolve(!1),H=Promise.resolve(V).then(()=>Promise.all(M?[U("preview"),G,U("desktopDisplay"),U("desktopAutomation"),U("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),q=(async()=>{let[O,F,z,_,D,R,E,P,I]=await Promise.all([Promise.resolve(Q).then((f)=>f.read?U("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((f)=>f.write?U("workspaceWrite"):!1,()=>!1),X?U("confinedShell"):!1,X?U("confinedGit"):!1,U("processInspection"),...M?[U("bash"),U("jobs"),U("environment"),U("fullControlShell")]:[!1,!1,!1,!1]]);if(M&&(!R||!E||!P)&&!V)await H;if(M){if(!R)R=await U("bash");if(!E)E=await U("jobs");if(!P)P=await U("environment")}return{read:O,write:F,shell:z,git:_,processes:D,bash:R,jobs:E,environment:P,full:I}})(),T=(O,F)=>{let{read:z,write:_,shell:D,git:R,processes:E,bash:P,jobs:I,environment:f,full:S}=O,{preview:k,boundPty:p,desktopDisplay:w,desktopAutomation:C,desktopBrowser:x}=F,A=u8(),y=M&&process.platform==="darwin"&&S&&KQ("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":z,"fs.write":_,"inference.custom.v1":M&&z,"fs.export":z&&A,"fs.import":_&&A,"exec.run":D&&X,"git.run":D&&R&&X,"process.list":(process.platform==="linux"||D)&&E,"ports.list":(process.platform==="linux"||D)&&E,"exec.full":P&&S&&X,"hands.connect":z&&_&&P&&I,"jobs.control":z&&_&&P&&I,"pty.start":z&&_&&P&&I&&f&&p,"environment.install":z&&_&&P&&I&&f,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&z&&_&&P&&I&&f,"tunnel.open":z&&_&&P&&I&&f&&k,"tunnel.close":z&&_&&P&&I&&f&&k,"preview.serve.v1":z&&P&&I&&k&&S,"display.stream.v1":w,"automation.call.v1":C,"simulator.call.v1":y,"simulator.stream.v1":y,"browser.pr-proof.v1":C&&x&&v8()===null,"workspace.setup.v1":M&&d8()})},L=q.then(async(O)=>T(O,{preview:!1,boundPty:await Promise.race([G,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),j=(async()=>{try{let O=await q,[F,z,_,D,R]=await H;if(M&&!z&&O.read&&O.write&&O.bash&&O.jobs&&O.environment)z=await U("boundPty");return T(O,{preview:F,boundPty:z,desktopDisplay:_,desktopAutomation:D,desktopBrowser:R})}finally{if(N)NQ(N,{recursive:!0,force:!0})}})();L.catch(()=>{});let W=(async()=>{let O=await q;if(!(O.read&&O.write&&O.bash&&O.jobs&&O.environment))return!1;return await G||(await j)["pty.start"]===!0})();return W.catch(()=>{}),{initial:L,final:j,pty:W}}var jQ=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],DQ=[60000,300000,900000];function s3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return jQ.filter((Z)=>J[Z]!==!0)}function i8($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>_Q($.config,void 0,Y,$.permissions)),Q=$.readiness,X=s3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
+`),(async()=>{for(let Y of $.delaysMs??DQ){if(await new Promise((B)=>{let U=setTimeout(B,Y);$.signal.addEventListener("abort",()=>{clearTimeout(U),B()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let V;try{V=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let N=s3($.config,Q).filter((B)=>V[B]===!0);if(N.length>0)Q=Object.freeze({...Q,...Object.fromEntries(N.map((B)=>[B,!0]))}),J(`Reason worker: ready after probing again (${N.join(", ")}).
+`),$.onReady(Q,N);if(s3($.config,Q).length===0)return}})()}import{execFile as FX}from"child_process";import{createHash as _X,randomUUID as H9}from"crypto";import{lstat as jX,readdir as y5,readFile as u5,realpath as DX,stat as WX}from"fs/promises";import{basename as OX,join as N9}from"path";import{promisify as zX}from"util";import{createConnection as WQ}from"net";import{endianness as $5}from"os";var y1=4,r3=1e4;class O${socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=WQ(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#V(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},V=OQ({jsonrpc:"2.0",id:Q,method:$,params:X}),N=new Promise((B,U)=>{let M=setTimeout(()=>{this.#Z.delete(Q),U(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:B,reject:U,timeout:M})});return Z.write(V),await N}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#V($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=y1){let J=$5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=y1+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(y1,Z);this.#$=this.#$.subarray(Z),this.#G(JSON.parse(Q.toString("utf8")))}}#G($){if(!n0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),n0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class x2{client;cdp;constructor($){this.client="client"in $?$.client:new O$($),this.cdp=new Q5(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=zQ(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new J5(this,$)}getTabs(){return this.client.getTabs()}}class J5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new Z5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class Z5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class Q5{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(n0(Q)&&n0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return n0(Q)&&n0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";o8(Q);let X=Z.timeoutMs??r3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),V=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(n0(V)&&typeof V.errorText==="string"&&V.errorText)throw Error(`Browser failed to navigate tab ${$}: ${V.errorText}`);return await Y.catch(async(N)=>{let B=await this.readDocumentState($);if(e8(B,Q))return;throw N}),V}async waitForLoadState($,J={}){let Z=J.state??"load";o8(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(e8(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??r3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return n0(J)?{href:o3(J.href),readyState:o3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??r3;return new Promise((X,Y)=>{let V=!1,N=null,B,U=()=>{if(V)return!1;return V=!0,clearTimeout(B),N?.(),!0};B=setTimeout(()=>{if(U())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),N=this.client.onNotification((M)=>{try{if(J(M)){if(U())X(M)}}catch(G){if(U())Y(G instanceof Error?G:Error(String(G)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=AQ(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function OQ($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(y1+J.length);if($5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,y1),Z}function n0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function zQ($,J){if(!n0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function o8($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function e8($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function AQ($,J){if($.method!=="onCDPEvent"||!n0($.params))return null;let Z=$.params.source;if(!n0(Z)||Z.tabId!==J)return null;return{method:o3($.params.method)}}function o3($){return typeof $==="string"?$:void 0}import{createHash as RQ}from"crypto";function X5($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${RQ("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as MX}from"async_hooks";import{isDeepStrictEqual as b5}from"util";import{createHash as TX}from"crypto";var PQ=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var IQ=new Set(["png","jpg","jpeg","gif","webp"]),CQ=new Set(["webm","mp4"]);function EQ($){if(!$)return null;try{return new URL($).origin}catch{return null}}function Y5($,J){let Z;try{Z=new URL($)}catch{return null}let Q=EQ(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=PQ.exec(Z.pathname);if(!Y)return null;let V=Y[1]?.toLowerCase(),N=Y[2]?.toLowerCase(),B=Y[3]?.toLowerCase(),U=Y[4]?.toLowerCase();if(!V||!N||!B||!U)return null;let M=IQ.has(U)?"image":CQ.has(U)?"video":null;if(!M)return null;let G=/^(before|after)[\s:_-]+/.exec(B),H=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:H,runId:V,artifactId:N,fileName:`${B}.${U}`,kind:M,phase:G?.[1]==="before"||G?.[1]==="after"?G[1]:null}}var xQ=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,S2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),g$=()=>{throw Error("cloud_browser_media_request_invalid")};function b2($){if(!S2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!xQ.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return g$();let J;try{J=new URL($.configuredMediaOrigin)}catch{return g$()}if(J.protocol!=="https:"||J.username||J.password||J.port||!V5(J.origin,{mode:"public_web"}).allowed)return g$();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!S2(Y)||Object.keys(Y).some((N)=>!["url","sourceUrl","kind"].includes(N))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return g$();let V=Y5(Y.url,J.origin);if(!V||new URL(V.url).origin!==J.origin||V.runId!==Z||V.kind!==Y.kind||V.url!==Y.url||Q.has(Y.url))return g$();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let N;try{N=new URL(Y.sourceUrl)}catch{return g$()}let B=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(N.pathname)?.[1];if(Y.kind!=="image"||N.origin!=="https://camo.githubusercontent.com"||N.username||N.password||N.search||N.hash||!B||B.length%2!==0||Buffer.from(B,"hex").toString("utf8")!==Y.url)return g$()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function G5($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!S2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let V=J.media[Y];if(!S2(X)||X.url!==V.url||X.sourceUrl!==V.sourceUrl||X.kind!==V.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||V.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...V,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...V.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var $9="browser.pr-proof.v1",j0=K.string().uuid(),Z1=K.string().regex(/^[a-f0-9]{64}$/),d$=K.iso.datetime({precision:3}),e3=K.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),K5=K.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),l0=K.object({kind:K.literal("primary_mac"),version:K.literal(1),organizationId:e3,userId:e3,sessionId:e3,runId:j0,deviceId:j0,rootId:j0,rootRevision:K.string().min(1).max(64),binding:K.enum(["workspace_source","mcp_control"]),targetRevision:K.number().int().nonnegative(),generation:j0,profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:K.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),SQ=K.custom().transform(($,J)=>{try{return B5($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),K.NEVER}}),Q1=K.object({version:K.literal(1),owner:l0,contextId:j0,preparedAt:d$,expiresAt:d$,prUrl:K5,headSha:K.string().regex(/^[a-f0-9]{40}$/),skillDigest:Z1,evidenceKind:K.enum(["image","video"]),visualPlan:SQ.optional(),uploadOrigin:K.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),J9=K.object({version:K.literal(1),producer:K.literal("primary_mac"),context:Q1,captureId:j0,operationId:j0,attemptId:j0,tabId:K.number().int().positive(),startedAt:d$,finishedAt:d$,sha256:Z1,media:K.discriminatedUnion("contentType",[K.object({contentType:K.literal("image/png"),sizeBytes:K.number().int().min(24).max(8388608),width:K.number().int().min(1).max(4096),height:K.number().int().min(1).max(4096)}).strict(),K.object({contentType:K.literal("video/webm"),sizeBytes:K.number().int().min(128).max(10485760),durationSeconds:K.number().min(0.05).max(15),frameCount:K.number().int().min(1).max(450),receivedFrameCount:K.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),sN=K.discriminatedUnion("action",[K.object({action:K.literal("screenshot"),context_id:j0,tab_id:K.number().int().positive()}).strict(),K.object({action:K.literal("start_video"),context_id:j0,tab_id:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),K.object({action:K.literal("stop_video"),recording_operation_id:j0}).strict()]),y2=K.object({login:K.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:K.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),w2=K.string().regex(/^[1-9][0-9]{0,19}$/),k1=K.object({version:K.literal(1),owner:l0,expectedActorId:w2.nullable(),repositoryId:w2,repositoryFullName:K.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),bQ=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],Z9=K.discriminatedUnion("status",[k1.extend({status:K.literal("ready"),observedActor:y2,checkedAt:d$}),k1.extend({status:K.literal("not_ready"),reason:K.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:K.enum(bQ).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),u$=K.object({version:K.literal(1),owner:l0,expectedActorId:w2.nullable(),authenticatedActor:y2,attemptId:j0,captureId:j0,prUrl:K5,repositoryId:w2,headSha:K.string().regex(/^[a-f0-9]{40}$/),sha256:Z1,sizeBytes:K.number().int().min(128).max(10485760),contentType:K.literal("video/webm")}).strict(),N5=K.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),X1=K.discriminatedUnion("status",[u$.extend({status:K.literal("not_attempted"),reason:K.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),u$.extend({status:K.literal("uncertain"),reason:K.literal("upload_outcome_unknown")}),u$.extend({status:K.literal("uploaded"),observedActor:y2,nativeUrl:N5,uploadedAt:d$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),h1=u$.extend({nativeUrl:N5,observedActor:y2,bodySha256:Z1}),Q9=K.discriminatedUnion("status",[h1.extend({status:K.literal("incomplete"),reason:K.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),h1.extend({status:K.literal("verified"),sourceSha256:Z1,width:K.number().int().min(1).max(4096),height:K.number().int().min(1).max(4096),durationSeconds:K.number().positive().max(30),advancedSeconds:K.number().min(0.05).max(10),advancedFrames:K.number().int().positive(),playbackRestored:K.literal(!0),verifiedAt:d$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),wQ=K.custom().transform(($,J)=>{try{let Z=b2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),K.NEVER}}),yQ=K.discriminatedUnion("action",[K.object({action:K.literal("auth_check"),input:k1}).strict(),K.object({action:K.literal("prepare"),context:Q1}).strict(),K.object({action:K.literal("capture_png"),owner:l0,contextId:j0,tabId:K.number().int().positive()}).strict(),K.object({action:K.literal("start_video"),owner:l0,contextId:j0,tabId:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),K.object({action:K.literal("inspect_capture"),owner:l0,captureId:j0}).strict(),K.object({action:K.literal("publish_video"),input:u$}).strict(),K.object({action:K.literal("verify_png_media"),owner:l0,media:wQ}).strict().refine(($)=>$.media.runId===$.owner.runId),K.object({action:K.literal("verify_saved_media"),input:h1}).strict(),K.object({action:K.literal("publish_png"),owner:l0,attemptId:j0,captureId:j0,sha256:Z1,sizeBytes:K.number().int().min(24).max(8388608),storagePath:K.string().max(512),uploadUrl:K.string().url().max(8192)}).strict()]);var U5="pr-proof.stop.v1",X9=K.object({requestId:j0,command:yQ}).strict();import{createHash as kQ,randomUUID as hQ}from"crypto";import{isDeepStrictEqual as Y1}from"util";var H5=K.object({operationId:K.string().uuid(),attemptId:K.string().uuid(),contextId:K.string().uuid(),tabId:K.number().int().positive()}).strict(),G0=()=>Error("mac_pr_proof_capture_unavailable"),Y9=($)=>kQ("sha256").update($).digest("hex");function q5($){let J=l0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw G0();if(await $.assertCurrent(),X)throw G0()},V=(H)=>{let q=Z.get(H);if(!q||Date.parse(q.expiresAt)<=Date.now())throw G0();return q},N=(H)=>H.disposal??=(async()=>{H.controller.abort(),H.bytes?.fill(0),H.bytes=void 0,H.receipt=void 0;try{await H.host?.close()}catch{throw X=!0,G0()}})(),B=async()=>{for(let[H,q]of Z){if(Date.parse(q.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,j])=>j.claim.contextId===H);if((await Promise.allSettled(T.map(([,j])=>N(j)))).some((j)=>j.status==="rejected"))throw G0();for(let[j]of T)Q.delete(j);Z.delete(H)}},U=setInterval(()=>{B().catch(()=>{X=!0})},1000);U.unref();let M=(H)=>{if(H.stopRequested=!0,H.started&&H.host&&!H.stop)H.stop=H.host.stop(),H.stop.catch(()=>H.controller.abort())};async function G(H,q){let T=H5.parse(H.claim);if(q==="video"&&(!Number.isInteger(H.seconds)||H.seconds<1||H.seconds>15))throw G0();await Y(),H.signal.throwIfAborted(),await B();let L=V(T.contextId);if(q==="video"&&L.evidenceKind!=="video")throw G0();let j=Q.get(T.operationId);if(j){if(!Y1(j.claim,T)||j.kind!==q||j.seconds!==H.seconds||j.controller.signal.aborted)throw G0();let E=await j.completion;if(await Y(),V(T.contextId),j.controller.signal.aborted)throw G0();return structuredClone(E)}if(Q.size>=16||[...Q.values()].some((E)=>!E.receipt&&!E.controller.signal.aborted&&E.claim.tabId===T.tabId))throw G0();let W,O,F=new Promise((E,P)=>{W=E,O=P});F.catch(()=>{});let z={claim:T,kind:q,seconds:H.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,z);let _=()=>{N(z).catch(()=>{})};H.signal.addEventListener("abort",_,{once:!0});let D=async()=>{await Y(),V(T.contextId),H.signal.throwIfAborted(),z.controller.signal.throwIfAborted()},R;try{await D();let E;if(q==="image"){let P=new Date().toISOString();R=await $.screenshot(structuredClone(L),T.tabId,z.controller.signal);let I=new Date().toISOString();if(await D(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw G0();E=J9.parse({version:1,producer:"primary_mac",context:L,captureId:hQ(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:P,finishedAt:I,sha256:Y9(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(z.host=await $.createVideo(structuredClone(L),T.tabId,H.seconds,z.controller.signal),z.controller.signal.aborted||H.signal.aborted||X)throw await z.host.close(),G0();await z.host.start(),z.started=!0;let P=z.host.completed();if(P.catch(()=>{}),await D(),await H.started?.(),z.stopRequested)M(z);let I=await P;if(z.stop)await z.stop;await D();let f=await z.host.read(I.captureId);R=f.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!Y1(I,f.capture)||!Y1(I.owner,S)||R.length!==I.sizeBytes||Y9(R)!==I.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw G0();await z.host.close(),await D(),E=J9.parse({version:1,producer:"primary_mac",context:L,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await D(),[...Q.values()].reduce((P,I)=>P+(I.bytes?.length??0),R.length)>20971520)throw G0();return z.bytes=Buffer.from(R),z.receipt=E,W(E),structuredClone(E)}catch(E){let P=q==="video"&&!H.signal.aborted&&!z.controller.signal.aborted&&E instanceof Error&&E.message==="mac_recording_worker_failed:no_frames"?new h0("proof_capture_no_frames","The owned tab emitted no recording frames."):G0();throw await N(z).catch(()=>{}),O(P),P}finally{R?.fill(0),H.signal.removeEventListener("abort",_)}}return{async prepare(H){let q=Q1.parse(H);if(!Y1(q.owner,J))throw G0();if(await Y(),await B(),Date.parse(q.preparedAt)>Date.now()||Date.parse(q.expiresAt)<=Date.now())throw G0();let T=Z.get(q.contextId);if(T){if(!Y1(T,q))throw G0();return structuredClone(T)}if(Z.size>=4)throw G0();return Z.set(q.contextId,q),structuredClone(q)},screenshot:(H)=>G(H,"image"),record:(H)=>G(H,"video"),async stop(H){let q=H5.parse(H);await Y(),V(q.contextId);let T=Q.get(q.operationId);if(!T||T.kind!=="video"||!Y1(q,T.claim)||T.controller.signal.aborted)throw G0();M(T)},async publicationCapture(H){await Y(),await B();let q=[...Q.values()].find((T)=>T.receipt?.captureId===H);if(!q?.receipt||!q.bytes||q.controller.signal.aborted)throw G0();if(V(q.claim.contextId),q.bytes.length!==q.receipt.media.sizeBytes||Y9(q.bytes)!==q.receipt.sha256)throw G0();return{capture:structuredClone(q.receipt),bytes:Buffer.from(q.bytes)}},async inspect(H){await Y(),await B();let q=[...Q.values()].find((T)=>T.receipt?.captureId===H);if(!q?.receipt||q.controller.signal.aborted)throw G0();return V(q.claim.contextId),structuredClone(q.receipt)},async close(){X=!0,clearInterval(U);let H=await Promise.allSettled([...Q.values()].map(N));if(Q.clear(),Z.clear(),H.some((q)=>q.status==="rejected"))throw G0()}}}import{createHash as F5,randomUUID as cQ}from"crypto";import{isDeepStrictEqual as f1}from"util";import{realpath as sQ}from"fs/promises";var M5=String.raw`async (media) => {
+  const deadline = (promise) => {
+    let timer;
+    return Promise.race([promise, new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("media_decode_timeout")), 12000);
+    })]).finally(() => clearTimeout(timer));
+  };
+  const items = await Promise.all(media.map(async (item) => {
+    const element = document.createElement(item.kind === "image" ? "img" : "video");
+    document.body.append(element);
+    try {
+      if (item.kind === "image") {
+        element.src = item.sourceUrl;
+        await deadline(element.decode());
+        if (!element.complete || !element.naturalWidth || !element.naturalHeight) throw new Error("media_image_not_decoded");
+        return { ...item, width: element.naturalWidth, height: element.naturalHeight };
+      }
+      element.muted = true;
+      element.playsInline = true;
+      element.preload = "auto";
+      const loaded = new Promise((resolve, reject) => {
+        element.addEventListener("loadeddata", resolve, { once: true });
+        element.addEventListener("error", () => reject(new Error("media_video_not_decoded")), { once: true });
+      });
+      element.src = item.sourceUrl;
+      await deadline(loaded);
+      if (!element.videoWidth || !element.videoHeight || !Number.isFinite(element.duration) || element.duration <= 0) throw new Error("media_video_not_decoded");
+      const initial = element.currentTime;
+      await deadline(element.play());
+      await deadline(new Promise((resolve, reject) => {
+        let timer;
+        const check = () => {
+          if (element.error) { clearTimeout(timer); reject(new Error("media_video_not_decoded")); return; }
+          if (element.currentTime - initial >= 0.05) { clearTimeout(timer); resolve(); return; }
+          timer = setTimeout(check, 25);
+        };
+        element.addEventListener("pause", () => { clearTimeout(timer); reject(new Error("media_video_not_advancing")); }, { once: true });
+        check();
+      }));
+      return { ...item, width: element.videoWidth, height: element.videoHeight, advancedSeconds: element.currentTime - initial };
+    } finally {
+      if (item.kind === "video") element.pause();
+      element.removeAttribute("src");
+      element.remove();
+    }
+  }));
+  return { verified: true, items };
+}`;var T5=function($){let J=this??globalThis,Z=10485760,Q=(V,N)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let B=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!B&&(J.location.href===V.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==V.prUrl||!B)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(B))return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),M=/^[1-9][0-9]{0,19}$/.test(U||"")?U:null,G={login:B,id:M};if(V.expectedActorId!==null&&M!==V.expectedActorId||V.authenticatedActor&&(B!==V.authenticatedActor.login||M!==V.authenticatedActor.id)||V.observedActor&&(B!==V.observedActor.login||M!==V.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==V.repositoryId)return{ok:!1,reason:"identity_mismatch"};let H=J.document.querySelector('link[rel="canonical"]');if(H&&H.href!==V.prUrl)return{ok:!1,reason:"identity_mismatch"};if(N){let q=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),L=q?.closest("file-attachment"),j=q?.closest("form"),W=new J.URL(V.prUrl).pathname+"/comment";if(!q||q.value!==""||!T||T.type!=="file"||T.disabled||!L||L.getAttribute("input")!==T.id||L.getAttribute("data-upload-repository-id")!==V.repositoryId||!j||new J.URL(j.action,J.location.href).origin!=="https://github.com"||new J.URL(j.action,J.location.href).pathname!==W)return{ok:!1,reason:"attachment_unavailable"};let O=L.getAttribute("data-upload-policy-url");if(!O||new J.URL(O,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:G}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let V=$.expected,N=Q(V,!0);if(!N.ok)return{dispatched:!1,reason:N.reason};let B=J.Uint8Array.from(J.atob($.base64||""),(H)=>H.charCodeAt(0));if(B.length!==V.sizeBytes||B.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let U=new J.File([B],V.captureId+".webm",{type:"video/webm"}),M=new J.DataTransfer;M.items.add(U);let G=J.document.querySelector("#fc-new_comment_field");if(!G)return{dispatched:!1,reason:"attachment_unavailable"};return G.files=M.files,G.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:N.actor}}if($.operation==="upload_result"){let V=Q($.expected,!1);if(!V.ok)throw Error("github_video_identity_changed");let N=J.document.querySelector("#new_comment_field")?.value?.trim(),B="["+$.expected.captureId+".webm](",U=N?.startsWith(B)&&N.endsWith(")")?N.slice(B.length,-1):N;if(!U||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(U))return null;return{nativeUrl:U,actor:V.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let V=X.nativeUrl.split("/").pop(),N=(W)=>{try{let O=new J.URL(W,J.location.href);if(O.protocol!=="https:"||O.username||O.password||O.port||O.hash)return!1;if(O.origin==="https://github.com")return O.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(O.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+V+"\\.(webm|mp4)$").test(O.pathname)}catch{return!1}},B=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((W)=>/^issue-[1-9][0-9]*$/.test(W.closest('[id^="issue-"]')?.id||"")&&!W.closest("form")&&!W.closest(".preview-content"));if(B.length!==1)throw Error("saved_body_missing");let U=B[0],M=[...U.querySelectorAll("video")].filter((W)=>[W.currentSrc,W.src,...[...W.querySelectorAll("source")].map((O)=>O.src)].some(N));if(M.length!==1)throw Error("saved_player_missing");let G=M[0],H={muted:G.muted,volume:G.volume,rate:G.playbackRate,preload:G.preload},q=new J.AbortController,T=J.setTimeout(()=>q.abort(),12000),L=(W)=>J.Promise.race([W,new J.Promise((O,F)=>{if(q.signal.aborted)F(Error("playback_timeout"));else q.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),j=async(W)=>{while(!W()){if(G.error||q.signal.aborted)throw Error("playback_unverified");await new J.Promise((O)=>J.setTimeout(O,25))}};try{if(G.muted=!0,G.playbackRate=1,G.currentTime=0,G.readyState<2)G.preload="auto",G.load();await j(()=>G.readyState>=2&&G.videoWidth>0&&G.videoHeight>0);let W=G.currentSrc;if(!N(W))throw Error("source_unbound");let O=await L(J.fetch(W,{credentials:"same-origin",redirect:"error",signal:q.signal}));if(O.status!==200||!N(O.url)||O.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(O.headers.get("content-type")||"")||!O.body)throw Error("source_unverifiable");let F=O.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let z=O.body.getReader(),_=[],D=0;try{for(;;){let k=await L(z.read());if(k.done)break;if(D+=k.value.length,D>10485760||D>X.sizeBytes)throw Error("source_too_large");_.push(k.value)}}finally{await z.cancel().catch(()=>{}),z.releaseLock()}if(D!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(D),E=0;for(let k of _)R.set(k,E),E+=k.length;let P=[...new J.Uint8Array(await L(J.crypto.subtle.digest("SHA-256",R)))].map((k)=>k.toString(16).padStart(2,"0")).join("");if(P!==X.sha256||G.currentSrc!==W||!U.contains(G))throw Error("source_changed");let I=G.currentTime,f=G.getVideoPlaybackQuality().totalVideoFrames;if(await L(G.play()),await j(()=>G.currentTime-I>=0.05&&G.getVideoPlaybackQuality().totalVideoFrames>f),!Q(X,!1).ok||G.currentSrc!==W||!U.contains(G)||G.error)throw Error("player_changed");return{status:"verified",sourceSha256:P,width:G.videoWidth,height:G.videoHeight,durationSeconds:G.duration,advancedSeconds:G.currentTime-I,advancedFrames:G.getVideoPlaybackQuality().totalVideoFrames-f,playbackRestored:!0}}finally{if(J.clearTimeout(T),q.abort(),G.pause(),G.currentTime=0,G.muted=H.muted,G.volume=H.volume,G.playbackRate=H.rate,G.preload=H.preload,!G.paused||G.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as fQ}from"child_process";import{lstat as mQ,realpath as vQ}from"fs/promises";import{join as L5,resolve as gQ}from"path";import{promisify as uQ}from"util";var dQ=uQ(fQ);async function pQ($,J){let Z=await vQ($),{stdout:Q}=await dQ(L5(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return K.array(K.object({browser:K.string(),directory:K.string(),connected:K.boolean().optional(),source:K.string(),socketPath:K.string().optional(),instanceId:K.string().optional(),extensionId:K.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&gQ(Y.source)===L5(Z,"Reason Browser Use","manifest.json"))}async function k2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await pQ($,Z)).filter((V)=>V.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await mQ(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as lQ}from"crypto";function V1($){return`reason-browser-${lQ("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var _5=K.discriminatedUnion("ok",[K.object({ok:K.literal(!0),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict(),K.object({ok:K.literal(!1),reason:K.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),j5=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.string(),extensionInstanceId:K.string(),nativeHostName:K.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function V9($){let J=l0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await aQ($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${cQ()}`,Y=!1,V=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},N=async(M)=>{if(!f1(J,M.owner))throw Z0();await V()},B=async(M)=>{await N(M);let G=await $.readVideo(M.captureId);try{await V();let H=G.capture;if(!f1(H.context.owner,J)||H.captureId!==M.captureId||H.context.prUrl!==M.prUrl||H.context.headSha!==M.headSha||H.media.contentType!=="video/webm"||H.media.sizeBytes!==M.sizeBytes||H.sha256!==M.sha256||G.bytes.length!==M.sizeBytes||G.bytes.length<128||G.bytes.length>10485760||G.bytes.readUInt32BE(0)!==440786851||F5("sha256").update(G.bytes).digest("hex")!==M.sha256)throw Z0();return G}catch(H){throw G.bytes.fill(0),H}};async function U(M,G,H){await V();let q=await Z.discover(AbortSignal.timeout(5000)),T=new x2({socketPath:q.socketPath,sessionId:X,timeoutMs:5000}),L,j=!1,W,O=new Promise((_,D)=>{W=setTimeout(()=>{j=!0,D(Z0())},60000)});O.catch(()=>{});let F=(_)=>Promise.race([_,O]),z=async()=>{if(j)throw Z0();if(await V(),j)throw Z0()};try{await F(T.connect());let _=j5.parse(await F(T.client.getInfo()));if(_.metadata.extensionId!==q.extensionId||_.metadata.extensionInstanceId!==q.instanceId||!_.metadata.nativeHostName)throw Z0();await z(),H?.("connected");let D=T.newTab();D.then((P)=>{if(j)P.close().catch(()=>{Y=!0})},()=>{}),L=await F(D),await z(),await F(L.goto(M,{waitUntil:"domcontentloaded",timeoutMs:15000})),await z(),H?.("loaded");let E=await F(G(L,async(P)=>{await z();let I=await F(L.evaluate(`(${T5.toString()})(${JSON.stringify(P)})`,{awaitPromise:!0}));return await z(),I},z));return await z(),E}finally{j=!0,clearTimeout(W);try{if(L){let _;try{await Promise.race([L.close(),new Promise((D,R)=>{_=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(_)}}}catch{throw Y=!0,Z0()}finally{T.close()}await V()}}return{async screenshot(M,G,H){let q=Q1.parse(M);if(await N(q),!Number.isSafeInteger(G)||G<1||Date.parse(q.expiresAt)<=Date.now())throw Z0();H.throwIfAborted();let T=await Z.discover(H),L=new x2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),j;try{await L.connect();let W=j5.parse(await L.client.getInfo());if(W.metadata.extensionId!==T.extensionId||W.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!K.array(K.object({id:K.number()})).max(256).parse(await L.getTabs()).some((z)=>z.id===G))throw Z0();await V(),H.throwIfAborted();let F=K.object({data:K.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await L.cdp.call(G,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(j=Buffer.from(F.data,"base64"),j.toString("base64")!==F.data||j.length>8388608)throw Z0();if(await V(),H.throwIfAborted(),Date.parse(q.expiresAt)<=Date.now())throw Z0();return j}catch{throw j?.fill(0),Z0()}finally{L.close()}},async verifyImages(M){let G=b2(M);if(G.runId!==J.runId||G.media.some((H)=>H.kind!=="image"))throw Z0();return U("about:blank",async(H,q,T)=>{let L=H.browser.client,j=new Set(G.media.map((P)=>P.sourceUrl)),W=new Map,O=new Set,F=!1,z=0,_=!1,D=new Set,R=(P,I)=>{if(D.size>=32){F=!0;return}let f=L.executeCdp(H.id,P,I);D.add(f),f.catch(()=>{F=!0}).finally(()=>D.delete(f))},E=L.onNotification((P)=>{if(P.method!=="onCDPEvent"||!H$(P.params)||!H$(P.params.source)||P.params.source.tabId!==H.id||!H$(P.params.params))return;let I=P.params.params;if(++z>512){F=!0;return}if(P.params.method==="Fetch.requestPaused"){let k=typeof I.requestId==="string"&&H$(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&j.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!k)F=!0;R(k?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...k?{}:{errorReason:"BlockedByClient"}})}if(P.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(P.params.method==="Network.loadingFailed")F=!0;if(P.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")O.add(I.requestId);if(P.params.method!=="Network.responseReceived")return;if(!H$(I.response)||typeof I.response.url!=="string"||!j.has(I.response.url)||typeof I.requestId!=="string"||!H$(I.response.headers)||I.type!=="Image"){F=!0;return}let f=Object.fromEntries(Object.entries(I.response.headers).map(([k,p])=>[k.toLowerCase(),p])),S=Number(f["content-length"]);if(W.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof f["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(f["content-length"])||!Number.isSafeInteger(S)||S>8388608||f["content-range"]||f["content-encoding"]&&f["content-encoding"]!=="identity"){F=!0;return}W.set(I.response.url,{id:I.requestId,length:S})});try{await L.executeCdp(H.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await L.executeCdp(H.id,"Network.setBypassServiceWorker",{bypass:!0}),await L.executeCdp(H.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await L.executeCdp(H.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let P=K.object({frameTree:K.object({frame:K.object({id:K.string().min(1).max(256)})})}).parse(await L.executeCdp(H.id,"Page.getFrameTree",{})),I=[...new Set(G.media.map((k)=>new URL(k.sourceUrl).origin))].join(" ");await L.executeCdp(H.id,"Page.setDocumentContent",{frameId:P.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),_=!0;try{await L.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new h0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let f;try{f=await H.evaluate(`(${M5})(${JSON.stringify(G.media)})`,{awaitPromise:!0})}catch{throw new h0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!H$(f)||!Array.isArray(f.items)||f.items.length!==G.media.length)throw Z0();await Promise.all(D);let S=[];for(let k=0;k<G.media.length;k++){await V();let p=W.get(G.media[k].sourceUrl);if(F||!p||!O.has(p.id))throw Z0();let w=K.object({base64Encoded:K.literal(!0),body:K.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await L.executeCdp(H.id,"Network.getResponseBody",{requestId:p.id})),C=Buffer.from(w.body,"base64");try{let x=f.items[k];if(C.length!==p.length||C.toString("base64")!==w.body||!H$(x))throw Z0();S.push({...x,sourceSha256:F5("sha256").update(C).digest("hex")})}finally{C.fill(0)}}if(F)throw Z0();return G5({verified:!0,items:S},G)}finally{if(E(),await Promise.allSettled(D),_)try{await L.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new h0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(M){let G=k1.parse(M);await N(G);let H="browser_unavailable";try{return await U(`https://github.com/${G.repositoryFullName}`,async(q,T)=>{let L=_5.parse(await T({operation:"preflight",expected:{...G,prUrl:`https://github.com/${G.repositoryFullName}`}}));return Z9.parse(L.ok?{...G,status:"ready",observedActor:L.actor,checkedAt:new Date().toISOString()}:L.reason==="attachment_unavailable"?{...G,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...G,status:"not_ready",reason:L.reason})},(q)=>{H=q==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return Z9.parse({...G,status:"not_ready",reason:"unavailable",cause:H})}},async publish(M){let G=u$.parse(M);if(await N(G),G.expectedActorId!==null&&G.authenticatedActor.id!==G.expectedActorId)throw Z0();let H=Q.get(G.attemptId);if(H){if(!f1(H.binding,G))throw Z0();return structuredClone(H.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let q={binding:structuredClone(G),result:X1.parse({...G,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(G.attemptId,q);let T=!1,L="dispatch";try{(await B(G)).bytes.fill(0),q.result=await U(G.prUrl,async(j,W)=>{let O=_5.parse(await W({operation:"identity",expected:G}));if(!O.ok)return X1.parse({...G,status:"not_attempted",reason:O.reason});let F=await B(G),z;try{T=!0,z=K.discriminatedUnion("dispatched",[K.object({dispatched:K.literal(!0),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict(),K.object({dispatched:K.literal(!1),reason:K.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await W({operation:"upload",expected:G,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!z.dispatched)return T=!1,X1.parse({...G,status:"not_attempted",reason:z.reason});if(!f1(z.actor,O.actor))throw L="actor_changed",Z0();L="result";let _=performance.now();while(performance.now()-_<30000){let D=await W({operation:"upload_result",expected:{...G,observedActor:O.actor}});if(D!==null){let R=K.object({nativeUrl:K.string(),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict().parse(D);return L="finalize",await V(),X1.parse({...G,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw L="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${L})
+`);q.result=X1.parse({...G,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(q.result)},async verify(M){let G=h1.parse(M);await N(G);try{return(await B(G)).bytes.fill(0),await U(G.prUrl,async(H,q)=>{await H.browser.client.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await q({operation:"saved_player",expected:G});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let L=Q9.parse({...G,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(G).some(([j,W])=>!f1(W,L[j])))throw Z0();return L}finally{await H.browser.client.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return Q9.parse({...G,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function aQ($,J){let Z=await sQ($);return{async discover(Q){let X=await k2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:V1(J.runId)}}import{realpath as qX}from"fs/promises";var RU=K.object({version:K.literal(1),recording_operation_id:K.string().uuid(),proof_ready:K.literal(!1),acknowledged_at:K.iso.datetime()}).strict(),h2=K.object({action:K.literal("start"),request_id:K.string().uuid(),profile:K.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),D5=K.object({action:K.literal("inspect"),recording_operation_id:K.string().uuid()}).strict(),PU=K.discriminatedUnion("action",[h2,D5]),W5=K.object({recording_operation_id:K.string().uuid()}).strict(),G9={device_id:K.string().uuid(),root_id:K.string().uuid()},iQ=K.discriminatedUnion("action",[h2.extend(G9),D5.extend(G9),W5.extend({...G9,action:K.literal("stop")})]),IU=K.toJSONSchema(iQ),CU=K.object({version:K.literal(1),recordingId:K.string().uuid(),proofReady:K.literal(!1),capture:K.object({captureId:K.string().uuid(),contentType:K.literal("video/webm"),sha256:K.string().regex(/^[a-f0-9]{64}$/),sizeBytes:K.number().int().min(128).max(10485760),startedAt:K.iso.datetime(),finishedAt:K.iso.datetime(),durationSeconds:K.number().min(0.05).max(15),frameCount:K.number().int().min(1).max(450),receivedFrameCount:K.number().int().min(1).max(2000),owner:K.object({runId:K.string().uuid(),deviceId:K.string().uuid(),rootId:K.string().uuid(),rootRevision:K.string().max(64),profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:K.string().min(1).max(1024),generation:K.string().uuid(),browserScope:K.string().max(128),tabId:K.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var mU=h2.extend({action:K.enum(["start","inspect"]),recording_boot_generation:K.string().uuid(),recording_operation_id:K.string().uuid().optional(),recording_attempt_id:K.string().uuid().optional()}).strict();import{createHash as XX,randomUUID as YX}from"crypto";import{mkdtemp as VX,realpath as GX,rm as E5}from"fs/promises";import{tmpdir as BX}from"os";import{join as KX}from"path";import{spawn as NX}from"child_process";import{isDeepStrictEqual as UX}from"util";import{createHash as nQ}from"crypto";import{execFile as tQ}from"child_process";import{chmod as rQ,lstat as z5,mkdtemp as oQ,readFile as A5,realpath as R5,rm as eQ,writeFile as O5}from"fs/promises";import{tmpdir as $X}from"os";import{isAbsolute as JX,join as f2}from"path";import{promisify as ZX}from"util";var B9=ZX(tQ),QX=($)=>nQ("sha256").update($).digest("hex");async function $$($){if(!JX($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await R5($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await z5($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||QX(await A5($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function m1($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([$$(Z.ffmpeg),$$(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([$$(Z.ffmpeg),$$(Z.ffprobe)]);let V=await R5(await oQ(f2(J??$X(),"reason-owned-recording-")));await rQ(V,448);let N=f2(V,"capture.webm"),B="frames";try{let U=["ffconcat version 1.0"];for(let[j,W]of Q.entries()){let O=`${j}.jpg`;await O5(f2(V,O),W.jpeg,{mode:384,flag:"wx"});let F=Q[j+1]?.timestamp??Q[0].timestamp+X;U.push(`file '${O}'`,`duration ${Math.max(0.001,F-W.timestamp).toFixed(6)}`)}U.push(`file '${Q.length-1}.jpg'`),await O5(f2(V,"frames.ffconcat"),U.join(`
+`)+`
+`,{mode:384,flag:"wx"});let M={cwd:V,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};B="encode",await B9(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",N],M),B="output";let G=await z5(N);if(!G.isFile()||G.isSymbolicLink()||G.nlink!==1||G.size<128||G.size>10485760)throw Error();B="probe";let{stdout:H}=await B9(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",N],M),q=JSON.parse(H),T=q.streams,L=Number(q.format?.duration);if(B="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(B="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(B="probe_duration",!Number.isFinite(L)||Math.abs(L-X)>0.25)throw Error();if(B="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(B="probe_format",q.format?.format_name!=="matroska,webm")throw Error();return B="decode",await B9(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",N,"-f","null","-"],M),B="pin",await Promise.all([$$(Z.ffmpeg),$$(Z.ffprobe)]),await A5(N)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${B}_failed`)}finally{await eQ(V,{recursive:!0,force:!0})}}}}var I5=K.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var J$=K.string().min(1).max(1024),P5=K.object({path:J$,sha256:K.string().regex(/^[a-f0-9]{64}$/)}).strict(),C5=K.object({owner:K.object({runId:J$,deviceId:J$,rootId:J$,rootRevision:J$,profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:J$,generation:J$,browserScope:J$,tabId:K.number().int().positive()}).strict(),socketPath:J$,extensionId:K.string().regex(/^[a-p]{32}$/),nativeHostName:J$,seconds:K.number().int().min(1).max(15),encoder:K.object({ffmpeg:P5,ffprobe:P5}).strict()}).strict();var HX=15728640,z$=()=>Error("mac_recording_worker_failed");function x5($){let J=C5.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,V=null,N=async()=>{},B=async(H,q=3000)=>{let T;try{return await Promise.race([H,new Promise((L,j)=>{T=setTimeout(()=>j(z$()),q)})])}finally{clearTimeout(T)}},U=()=>V??=B((async()=>{let q=(await Promise.allSettled([N(),$.cleanup()])).find((T)=>T.status==="rejected");if(q?.status==="rejected")throw q.reason})(),5000).catch((H)=>{X=!0;let q=H&&typeof H==="object"&&"code"in H?H.code:null,T=typeof q==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(q)?q:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),M=null,G=async()=>{if(X)throw z$();if(await B($.assertCurrent()),X)throw z$()};return{async start(){if(Y||M)throw Error("mac_recording_already_active");Y=!0;try{await G(),await $$({path:Z.path,sha256:Z.sha256}),await G(),V=null;let H=await GX(await VX(KX(BX(),"reason-recording-host-")));try{await G()}catch(C){throw await E5(H,{recursive:!0,force:!0}),C}let q=NX(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((C)=>q.once("close",()=>C())),L=()=>{if(q.pid)try{process.kill(-q.pid,"SIGKILL")}catch(C){if(C.code!=="ESRCH")throw C}},j=null;N=()=>j??=(async()=>{try{L()}catch(C){if(C.code!=="EPERM")throw C}await T;try{for(let C=0;;C++)try{L();break}catch(x){if(x.code!=="EPERM"||C>=20)throw x;await new Promise((A)=>setTimeout(A,25))}}finally{await E5(H,{recursive:!0,force:!0})}})();let W="",O=0,F=!1,z=!1,_=null,D,R,E=new Promise((C,x)=>{D=C,R=x}),P,I,f=new Promise((C,x)=>{P=C,I=x});f.catch(()=>{});let S=(C=z$())=>{if(F)return;F=!0,clearTimeout(k),clearInterval(w),U().then(()=>{R(C),I(C)},(x)=>{R(x),I(x)})},k=setTimeout(()=>S(),(J.seconds+25)*1000),p=!1,w=setInterval(()=>{if(p||F)return;p=!0,G().catch(()=>S()).finally(()=>{p=!1})},250);M={completion:f,stop:()=>{if(!F)q.stdin.write(`{"type":"stop"}
+`)},cancel:()=>S()},q.on("error",()=>S()),q.stdin.on("error",()=>S()),q.stdout.on("data",(C)=>{if(F)return;if(O+=C.length,O>HX){S();return}W+=C.toString("utf8");let x;while((x=W.indexOf(`
+`))!==-1){let A=W.slice(0,x);W=W.slice(x+1);try{let y=JSON.parse(A);if(y.type==="failed"&&Object.keys(y).sort().join(",")==="reason,type"){let t=I5.safeParse(y.reason);S(t.success?Error(`mac_recording_worker_failed:${t.data}`):z$());return}if(y.type==="unsupported"&&!z){S(Error("mac_recording_encoder_unavailable"));return}if(y.type==="started"&&!z&&Object.keys(y).length===1){z=!0,D({recording:!0});continue}if(!z||y.type!=="capture"||_||Object.keys(y).sort().join(",")!=="bytes,capture,type")throw z$();let b=y.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!UX(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof y.bytes!=="string"||y.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(y.bytes))throw z$();let n=Buffer.from(y.bytes,"base64");if(n.length!==b.sizeBytes||XX("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw z$();_={capture:Object.freeze({...b,captureId:YX(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),q.once("close",(C)=>{if(F)return;if(C!==0||!_||W.trim()){S();return}let x=_;G().then(async()=>{if(await N(),F)return;F=!0,clearTimeout(k),clearInterval(w),Q.set(x.capture.captureId,x);while(Q.size>2)Q.delete(Q.keys().next().value);P(x.capture)}).catch(()=>S())}),q.stdin.write(JSON.stringify({...J,scratchDirectory:H})+`
+`);try{return await E}catch(C){throw M=null,C}}finally{Y=!1}},async completed(){if(await G(),!M)throw Error("mac_recording_not_active");return M.completion},async stop(){await G();let H=M;if(!H)throw Error("mac_recording_not_started");H.stop();try{return await H.completion}finally{if(M===H)M=null}},async read(H){await G();let q=Q.get(H);if(!q)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(q.capture),bytes:Buffer.from(q.bytes)}},async close(){if(X)return;X=!0;let H=M;H?.cancel(),Q.clear();try{await U(),await H?.completion.catch(()=>{})}finally{M=null}}}}var S5=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.string(),extensionInstanceId:K.string(),nativeHostName:K.string()})});async function K9($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await qX($.automationDirectory);J=(Q,X)=>k2(Z,Q,X)}if(await $$({path:$.worker.path,sha256:$.worker.sha256}),!await m1($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let V=await J(Z,Y),N=new O$({socketPath:V.socketPath,sessionId:X,timeoutMs:2000}),B;try{if(await N.connect(),B=S5.parse(await N.getInfo()),B.metadata.extensionId!==V.extensionId||B.metadata.extensionInstanceId!==V.instanceId)throw Error("mac_recording_profile_changed");if(!K.array(K.object({id:K.number()})).parse(await N.getTabs()).some((M)=>M.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{N.close()}return{extensionInstanceId:V.instanceId,async createHost(U,M,G){let H=new O$({socketPath:V.socketPath,sessionId:U.browser.browserScope,timeoutMs:2000});return x5({worker:$.worker,configuration:{owner:U.browser,seconds:M,encoder:$.encoder,socketPath:V.socketPath,extensionId:V.extensionId,nativeHostName:B.metadata.nativeHostName},async assertCurrent(){G.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await H.connect();let T=S5.parse(await H.getInfo());if(T.metadata.extensionInstanceId!==U.browser.extensionInstanceId||T.metadata.extensionId!==V.extensionId||T.metadata.nativeHostName!==B.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await H.executeCdp(Q,"Page.stopScreencast",{})}finally{H.close()}}})}}}}var W0=()=>Error("mac_pr_proof_unavailable"),LX=K.object({operationId:K.string().uuid()}).strict();function w5($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=K.array(K.object({profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:K.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!K.string().uuid().safeParse($.generation).success||new Set(Z.map((H)=>H.profile)).size!==Z.length)throw W0();if(!$.qualifiedProfiles){let H=new URL($.uploadOrigin);if(!$.resolveBrowser||H.protocol!=="https:"||H.origin!==$.uploadOrigin||H.username||H.password)throw W0()}let Q=new Map,X=new Map,Y=new Map,V=!1,N=new MX,B=async(H)=>{let q=N.getStore();if(V||!H&&!q)throw W0();if(q?.signal.throwIfAborted(),await $.assertCurrent(H??q.claim),V)throw W0();q?.signal.throwIfAborted()},U=(H,q)=>{let T="owner"in q?q.owner:("context"in q)?q.context.owner:q.input.owner;if(H.capability!==$9||!H.owner||T.generation!==$.generation||!Z.some((L)=>L.profile===T.profile&&L.extension_instance_id===T.extensionInstanceId)||T.organizationId!==H.owner.organization_id||T.userId!==H.owner.user_id||T.deviceId!==H.owner.device_id||T.rootId!==H.root_id||T.runId!==H.run_id)throw W0();return T},M=async(H)=>{await B();let q=JSON.stringify([H.runId,H.profile]),T=Q.get(q);if(!T){if(Q.size>=4)throw W0();T=(async()=>{let j,W=$.browserScope?.(H)??V1(H.runId),O=await $.createBrowser({owner:H,assertCurrent:()=>B(),readVideo:(F)=>j.publicationCapture(F)});if(j=q5({owner:H,browserScope:W,assertCurrent:()=>B(),screenshot:O.screenshot,async createVideo(F,z,_,D){if(!$.resolveBrowser)throw W0();let R=await $.resolveBrowser(H.profile,z,W,D);if(R.extensionInstanceId!==H.extensionInstanceId)throw W0();return R.createHost({organizationId:H.organizationId,userId:H.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:H.runId,deviceId:H.deviceId,rootId:H.rootId,rootRevision:H.rootRevision,generation:H.generation,profile:H.profile,extensionInstanceId:H.extensionInstanceId,browserScope:W,tabId:z}},_,D)}}),V)throw O.close(),await j.close(),W0();return{owner:structuredClone(H),browser:O,capture:j,expiresAt:Date.now()+300000}})(),Q.set(q,T)}let L=await T;if(!b5(L.owner,H)||L.expiresAt<=Date.now())throw W0();return L},G=setInterval(()=>{for(let[H,q]of Q)q.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((L)=>L.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(H)===q)Q.delete(H)}).catch(()=>{V=!0})},1000);return G.unref(),{generation:$.generation,async execute(H,q,T){return N.run({claim:H,signal:q},async()=>{let L=X9.parse(H.payload).command,j=U(H,L);if(await B(H),q.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(L.action==="prepare"?L.context.evidenceKind!=="image"||Boolean(L.context.visualPlan)||!L.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(L.action)))throw Error("proof_png_only");let W=await M(j),O=async()=>{await B(H),q.throwIfAborted()},F;switch(L.action){case"auth_check":F=await W.browser.preflight(L.input);break;case"prepare":if(L.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!L.context.uploadOrigin)throw W0();F=await W.capture.prepare(L.context);break;case"capture_png":F=await W.capture.screenshot({claim:{operationId:H.operation_id,attemptId:H.attempt_id,contextId:L.contextId,tabId:L.tabId},signal:q});break;case"start_video":{let z={runtime:W,contextId:L.contextId,attemptId:H.attempt_id,tabId:L.tabId,signal:q};if(X.has(H.operation_id))throw W0();X.set(H.operation_id,z);try{F=await W.capture.record({claim:{operationId:H.operation_id,attemptId:H.attempt_id,contextId:L.contextId,tabId:L.tabId},signal:q,seconds:L.seconds,started:async()=>{await O(),await T({version:1,operationId:H.operation_id,contextId:L.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(H.operation_id)}break}case"inspect_capture":F=await W.capture.inspect(L.captureId);break;case"publish_video":F=await W.browser.publish(L.input);break;case"verify_saved_media":F=await W.browser.verify(L.input);break;case"verify_png_media":F=await W.browser.verifyImages(L.media);break;case"publish_png":{let z=`${j.runId}:${L.attemptId}`,_=Y.get(z);if(_){if(!b5(_.request,L))throw W0();F=_.result;break}if(Y.size>=16)throw W0();let D=new URL(L.uploadUrl);if(D.protocol!=="https:"||D.username||D.password||D.hash||D.pathname!==`/${L.storagePath}`||!L.storagePath.startsWith(`pr-screenshots/${j.runId}/${L.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(L.storagePath.split("/").at(-1))||L.storagePath.split("/").length!==4)throw W0();let R=await W.capture.publicationCapture(L.captureId);try{if(D.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==L.sha256||R.bytes.length!==L.sizeBytes||TX("sha256").update(R.bytes).digest("hex")!==L.sha256)throw W0();await O();let E={request:structuredClone(L),result:{status:"uncertain",sha256:L.sha256,sizeBytes:L.sizeBytes}};Y.set(z,E);try{let P=await fetch(D,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([q,AbortSignal.timeout(20000)])});if(await P.body?.cancel(),await O(),P.ok)E.result={...E.result,status:"uploaded"}}catch{}F=E.result}finally{R.bytes.fill(0)}break}}return await O(),structuredClone(F)})},async control(H,q){if(H.capability!==$9||q.kind!==U5)return!1;let T=LX.safeParse(q.payload),L=X.get(H.operation_id);if(!T.success||T.data.operationId!==H.operation_id||!L||L.attemptId!==H.attempt_id)return!1;let j=X9.parse(H.payload).command;return U(H,j),await B(H),await N.run({claim:H,signal:L.signal},()=>L.runtime.capture.stop({operationId:H.operation_id,attemptId:H.attempt_id,contextId:L.contextId,tabId:L.tabId})),!0},async close(){V=!0,clearInterval(G);let H=await Promise.allSettled([...Q.values()].map(async(q)=>{let T=await q;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),H.some((q)=>q.status==="rejected"))throw W0()}}}var AX="__browser-recorder",RX=zX(FX),PX="/tmp/open-browser-use",IX=33554432,CX=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.literal(m2),extensionInstanceId:K.string().min(1).max(1024)})}),k5=()=>Error("worker_pr_proof_browser_unavailable"),q9={components:w1,ensureBrowser:v5,socketDirectory:PX,async identity($){let J=new O$({socketPath:$,sessionId:`reason-proof-qualification-${H9()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function h5($,J=q9){let Z=J.components();if(!Z?.features.browser)throw k5();await J.ensureBrowser(Z),$.throwIfAborted();let Q=N9(g5(Z),"Default","Local Extension Settings",m2),X=(await y5(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>N9(Q,Y));for(let Y of(await y5(J.socketDirectory)).filter((V)=>V.endsWith(".sock"))){$.throwIfAborted();let V=N9(J.socketDirectory,Y);try{let N=await jX(V);if(!N.isSocket()||N.uid!==process.getuid?.())continue;let B=CX.parse(await J.identity(V)).metadata.extensionInstanceId;for(let U of X)if((await WX(U)).size<=IX&&(await u5(U)).includes(B))return{socketPath:V,instanceId:B,extensionId:m2}}catch{}}throw k5()}async function U9($){let J=await DX($);return{path:J,sha256:_X("sha256").update(await u5(J)).digest("hex")}}async function d5($={}){let J={...q9,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await U9(Z.ffmpeg),{stdout:X}=await RX(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await U9(Z.ffprobe)};if(!await m1(Y))return{error:"worker_recording_encoder_unqualified"};let V=$.recorder??{path:process.execPath,args:[...OX(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],AX]};return{worker:{...await U9(V.path),args:V.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function p5($,J={}){let Z={...q9,...J},Q=H9(),X=H9(),Y=f5.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),V=$.recording?m5.parse({...Y,version:3,video:!0,max_seconds:15}):Y,N=(G)=>X5(G.organizationId,G.sessionId,G.deviceId,1),B=$.recording,U,M=w5({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:N,...B?{resolveBrowser:async(G,H,q,T)=>{U??=K9({...B,assertCurrent:()=>$.assertCurrent(),discover:(j,W)=>h5(W,Z)}),U.catch(()=>{U=void 0});let L=await(await U)(G,H,q,T);return{extensionInstanceId:X,createHost:async(j,W,O)=>EX(await L.createHost({...j,browser:{...j.browser,extensionInstanceId:L.extensionInstanceId}},W,O),X)}}}:{},createBrowser:(G)=>V9({...G,endpoint:(H)=>({discover:(q)=>h5(q,Z),tabScope:N(H)})})});return{capability:V,broker:M}}function EX($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as sX}from"child_process";import{execFile as xX}from"child_process";import{readFile as SX}from"fs/promises";import{join as t0}from"path";var bX="Claude Code-credentials",wX="/usr/bin/security",yX=120000,kX=8192,v2={exec:($,J,Z)=>new Promise((Q)=>{xX($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let V=X?typeof X.code==="number"?X.code:1:0;Q({code:V,stdout:String(Y??"")})})}),readText:async($)=>{try{return await SX($,"utf8")}catch{return null}}};function G1($){return typeof $==="string"&&$.length>0&&$.length<=kX?$:null}function hX($,J){return $.CLAUDE_CONFIG_DIR||t0(J,".claude")}function fX($,J){return $.CODEX_HOME||t0(J,".codex")}function l5($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=G1(J?.accessToken),Q=G1(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function mX($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function vX($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=G1(J.tokens?.access_token),Q=G1(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:mX(Z)??Date.now()}}catch{return null}}function gX($,J){return t0($.XDG_DATA_HOME||t0(J,".local","share"),"opencode","auth.json")}var uX={anthropic:"anthropic",openai:"openai-codex"};function dX($){return i5($,uX)}function i5($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let V=Z[X];if(V?.type!=="oauth")continue;let N=G1(V.access),B=G1(V.refresh),U=typeof V.expires==="number"&&Number.isFinite(V.expires)?V.expires:null;if(N&&B&&U!==null)Q.push({provider:Y,access:N,refresh:B,expires:U})}return Q}catch{return[]}}function pX($){return i5($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function lX($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?t0(J,Z.slice(2)):Z||t0(J,".pi","agent")}async function n5($,J,Z=v2){let Q=[],X=await Z.exec(wX,["find-generic-password","-s",bX,"-w"],yX),Y=Date.now()+300000,V=(B)=>{if(!B)return;let U=Q.findIndex((M)=>M.provider===B.provider);if(U<0)Q.push(B);else if(Q[U].expires<=Y&&B.expires>Y)Q[U]=B};if(V(X.code===0?l5(X.stdout.trim()):null),!Q.some((B)=>B.provider==="anthropic"&&B.expires>Y))V(l5(await Z.readText(t0(hX($,J),".credentials.json"))));let N=vX(await Z.readText(t0(fX($,J),"auth.json")));V(N),V(cX(await Z.readText(t0($.GROK_HOME||t0(J,".grok"),"auth.json"))));for(let B of dX(await Z.readText(gX($,J))))V(B);for(let B of pX(await Z.readText(t0(lX($,J),"auth.json"))))V(B);return Q}function t5($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var c5="https://auth.x.ai",s5="b1a00492-073a-47ea-816f-4c329264a828",a5=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function cX($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${c5}::${s5}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==c5||Q.oidc_client_id!==s5||!a5(Q.key)||!a5(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var r5=330000,aX=300000,iX=60000;function nX($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+r5)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function tX($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*r5)?iX:aX}var rX=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function o5($){let J=new Map,Z=$.wait??rX,Q=$.stores??(process.platform==="darwin"?v2:{...v2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=t5(await n5($.environment??process.env,$.home,Q));for(let Y of nX(X,J)){if($.signal.aborted)return;let V=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:V.ok,...V.ok?{}:{error:V.error}})}}catch{}await Z(tX(J),$.signal)}}function e5($=process.env){return new Promise((J)=>{sX("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as oX,spawn as Gq,spawnSync as Bq}from"child_process";import{chmodSync as Nq,existsSync as eX,mkdirSync as Uq,readFileSync as Hq,renameSync as qq,rmSync as Mq,statSync as Tq,writeFileSync as Lq}from"fs";import{dirname as _q,isAbsolute as jq,join as M9}from"path";var $J=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function JJ($,J){if(!$J.test($)||!$J.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var $Y="com.reasonmachines.updater",JY=["so.ara.updater","so.reason.updater"];function ZY($){let J=$==="staging"?".staging":"";return{label:`${$Y}${J}`,legacyLabels:[...JY].reverse().map((Z)=>`${Z}${J}`)}}function QY($,J,Z){return{launchAgent:M9(J,"Library","LaunchAgents",`${$}.plist`),systemdService:M9(Z,"systemd","user",`${$}.service`),systemdTimer:M9(Z,"systemd","user",`${$}.timer`)}}function XY($,J){return new Promise((Z)=>{oX($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function XJ($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??H0(),{label:X,legacyLabels:Y}=ZY($.channel),V=$.configHome??QJ(Q),N=[X,...Y].filter((G)=>{let H=QY(G,Q,V);return eX(J==="darwin"?H.launchAgent:H.systemdService)});if(N.length===0)return"absent";let B=$.command??XY,U=N[0];if(N.length>1){for(let G of N)if((J==="darwin"?await B("/bin/launchctl",["print",`gui/${Z}/${G}`]):await B("systemctl",["--user","is-enabled",`${G}.timer`]))===0){U=G;break}}return(J==="darwin"?await B("/bin/launchctl",["kickstart",`gui/${Z}/${U}`]):await B("systemctl",["--user","start","--no-block",`${U}.service`]))===0?"started":"failed"}var ZJ=60000;function YJ($){let J=(X,Y)=>{try{return JJ(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let V=setTimeout(X,Y);V.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(V),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),V=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(ZJ-1,Math.floor(V*ZJ)))}}var YY=30000;async function GJ($){return($.flush??VJ)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(YY);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof L0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var KJ=25000,GY=5000,BY=600000,KY=["display.stream.v1","pty.start"],NY=64;function F9($,J,Z=j9($),Q){return v0(),RJ(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var NJ=5000,UY=600000;function HY($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[p$])return null;try{return g2({platform:J})}catch{return null}}function qY($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function MY($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=n3();if(Z.length>0)u1($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)u1($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function p1($,J,Z,Q,X={}){if(v0(),$.executionMode==="host")d1();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let V=$0($);if(V.revoked)throw Error("worker_revoked");let N=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let B,U=()=>B??=$.executionMode==="host"?zJ():Promise.resolve(!1),M=_J(),G=X.prestartedReadiness??b1($,X.readinessProbes,N,J.roots[0].permissions),H=X.deferOptionalLanes===!0,q=await(H?G.initial:G.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,L=q["github.local.v1"]===!0?(X.probeGithubSignedIn??e5)().catch(()=>!1):null,j=new AbortController,W=null,O=async(h,a)=>{let i=($.userChrome??X.ownComputer===!0)&&h["automation.call.v1"]===!0?OJ():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
+`);let B0=j9($,h,{displayVideo:h["display.stream.v1"]===!0&&await U(),handsBrowser:h["hands.connect"]===!0&&M,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:h["pty.start"]===!0&&E2(),probing:a,ownComputer:X.ownComputer===!0});if(!W&&B0.worker.readiness?.["browser.pr-proof.v1"]===!0){let O0=await d5();if(W||j.signal.aborted)return B0;process.stderr.write("error"in O0?`Reason worker: PR video proof unavailable (${O0.error})
+`:`Reason worker: PR video proof ready (ffmpeg ${O0.encoder.ffmpeg.path})
+`),W=p5({assertCurrent:async()=>{if(!w())throw Error("proof_authority_lost")},...!("error"in O0)?{recording:O0}:{}})}return B0},F=await O(q,H?t3.filter((h)=>q[h]!==!0):[]),z=F9($,J,F,W?.capability);X.onStartup?.("inventory_completed");let _=!1,D=0,R=0,E="starting",P=null,I=!1,f=!1,S=null,k,p=()=>!V.drained&&Date.parse(Y)>Date.now()&&z.supported_operations.some((h)=>F.worker.readiness?.[h]===!0),w=()=>!_&&p(),C=null,x=()=>D+(C?.claims()??0),A=null,y=new Set,b=(h)=>{let a=h.capabilities.root_paths;if(Object.assign(h.capabilities,F9(h.config,h.state,F,W?.capability)),a)h.capabilities.root_paths=a},n=(h)=>{F=h,b({config:$,state:J,capabilities:z}),A?.();for(let a of y)b(a),a.heartbeatNow?.()},t=new Set,X0=new Set,M0=setInterval(()=>{let h=new Set;for(let a of[{state:J,capabilities:z},...y])for(let U0 of KY){if(a.capabilities.operation_constraints?.[U0]?.probing!==!0)continue;let B0=`${a.state.deviceId} ${U0}`;if(h.add(B0),!t.has(B0)||X0.has(B0))continue;X0.add(B0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:U0,login_device:a.state===J,timestamp:new Date().toISOString()})}
+`)}t.clear();for(let a of h)t.add(a)},BY);M0.unref();let u0=(h)=>{if(!X.readinessProbes)i8({config:$,readiness:h,signal:j.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(a)=>{O(a,[]).then(n)}})},C0=H?G.final.then(async(h)=>{if(j.signal.aborted)return;n(await O(h,[]));let a=t3.filter((U0)=>h[U0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
+`),u0(h)},()=>{}):Promise.resolve();if(!H)u0(q);L?.then(async(h)=>{T=h;for(;;){let a=F,U0=await O(a.worker.readiness??{},a.worker.probing??[]);if(j.signal.aborted)return;if(F!==a)continue;n(U0);return}});let c0=H&&F.worker.probing?.includes("pty.start")?G.pty.then(async(h)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(j.signal.aborted||!a())return;let U0=await O({...F.worker.readiness,"pty.start":h},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(j.signal.aborted||!a())return;n(U0)},()=>{}):Promise.resolve(),I$=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:E,drained:V.drained||_||I,activeClaims:x(),activeSessions:R,lastHeartbeat:P,expiresAt:Y,supportedOperations:[...z.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:w()&&!I&&E==="running"}),s$=!1,T$=()=>{s$=!0,Y$()},Y$=()=>{if(_)return;if(_=!0,E="stopping",S?.close(),x()===0)j.abort();else k=setTimeout(()=>j.abort(),$.shutdownGraceMs)},C$=$.channel==="production"||$.channel==="staging"?$.channel:null,V$=d($).releaseCheck,v=X.publishedRelease??(C$&&$.lifetime==="persistent"?YJ({currentVersion:r,signal:j.signal,actedOn:(()=>{try{let h=JSON.parse(s(V$));return typeof h==="string"?h:null}catch{return null}})(),check:async(h)=>{try{c(V$,h)}catch{}let a=await XJ({channel:C$});process.stderr.write(a==="started"?`Reason worker: CLI ${h} is published; the updater is checking now.
+`:a==="absent"?`Reason worker: CLI ${h} is published; no updater is installed for it here.
+`:`Reason worker: CLI ${h} is published; the updater did not start, so its next scheduled check takes it.
+`)}}):void 0),Y0=(h)=>{if(h==="stop")T$();if(h==="reload_roots"){let a=o($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let U0=AJ(J.roots,BJ());if(U0)z.root_paths=U0;else delete z.root_paths;C?.check()}if(h==="drain"||h==="resume"){if(_||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");V={...V,drained:h==="drain"},R0($,V)}return I$()};X.prestartedControl?.handle(Y0);let E$=X.prestartedControl?await X.prestartedControl.closed:await j2($,Q,Y0),G$,x$=!1,f0=()=>{let h=Date.parse(Y)-Date.now();if(h>0){G$=setTimeout(f0,Math.min(h,2147483647));return}_=!0,S?.close(),x$=!0,E="stopping",j.abort(Error("worker_credential_expired"))};f0(),X.signal?.addEventListener("abort",Y$,{once:!0});let T1=X.processSignals!==!1;if(T1)process.once("SIGTERM",Y$),process.once("SIGINT",T$);if(X.signal?.aborted)Y$();try{X.onStartup?.("control_ready");let h=X.client??new g1(W$($.apiOrigin),S0($.proxy,UJ()),Z,{deviceSession:m3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,U0=U3($,J.deviceId),i=X.startupTiming,B0=i?()=>({...i(),...U0?.enrollmentMs!==void 0?{enrollment_ms:U0.enrollmentMs}:{}}):void 0,O0=(m)=>{let s0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&s0)(X.handOverLocalLogins??o5)({state:m.state,client:{localSubscription:s0},signal:m.signal,home:H0()}).catch(()=>{return});let _0=BJ(),x0=m.client.liveSessionWorktrees?.bind(m.client);if(x0)TJ(()=>MJ({home:_0,deviceId:m.state.deviceId,liveIds:(L$)=>x0(m.state,L$,m.signal)}),m.signal)};O0({state:J,client:h,signal:j.signal});let B$=HY($,X.platform??process.platform),a$=h.deviceLifecycle?.bind(h),z0=Promise.resolve(),E0=0,L1=()=>{if(!B$||!a$||_||Date.now()<E0)return;E0=Date.now()+UY,z0=z0.then(()=>GJ({paths:B$,device:J,client:{deviceLifecycle:a$},accept:qY,signal:j.signal})).catch(()=>{return})};if(L1(),B$)G.final.then((m)=>MY(B$,m),()=>{});let r1=(m,s0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:X.ownComputer===!0?NY:4*$.slots+DJ,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:KJ,operationCompletionTimeoutMs:KJ,maxConsecutiveHeartbeatFailures:3,claimable:w,advertised:p,onClaim:async(_0,x0,L$)=>{let _1=Date.now();if(!m.capabilities.supported_operations.includes(_0.capability))return{status:"failed",error_code:"unsupported_capability"};let a0=F.worker.probing??[],p9=a0.includes(_0.capability)?C0:_0.capability==="hands.connect"&&$.executionMode==="host"&&a0.includes("pty.start")?c0:null;if(p9){let e1,G3=()=>{};await Promise.race([p9,new Promise((l9)=>{e1=setTimeout(l9,GY),G3=()=>l9(),x0.addEventListener("abort",G3,{once:!0})})]),clearTimeout(e1),x0.removeEventListener("abort",G3)}let o1=_0.capability==="hands.connect",V3=o1?S:null,$7={signal:x0,emit:L$,...F,...W?{proveMac:W.broker.execute}:{},..._0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(e1)=>m.client.operationCustomEndpointCredential(m.state,_0,e1)}:{},...o1?{handsLaunch:{claimedAtMs:_1,...V3?{takePrespawnedWorker:V3.take,adoptSpawnedWorker:V3.adopt}:{}}}:{}};if(o1)R+=1;try{return await(X.execute??D9)(m.state,_0,$7)}finally{if(o1)R-=1}},onControl:async(_0,x0)=>await PJ(m.state,_0,x0,m.client)||await IJ(m.state,_0,x0)||await WJ(_0,x0)||await W?.broker.control(_0,x0)||!1,onEvent:s0}),g9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:VY(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(NJ)).catch(()=>{return})},F1=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,u9=h.ownerWorkspaces?.bind(h),d9=h.ownerWorkspaceEnrollment?.bind(h);if(F1&&u9&&d9)C=T4({config:$,state:J,signal:j.signal,client:{ownerWorkspaces:u9,ownerWorkspaceEnrollment:d9},...F1.enroll?{enroll:F1.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,s0,_0)=>{let x0=U3(m.config,m.state.deviceId),L$={config:m.config,state:m.state,signal:s0,statusPath:d(m.config).daemon,...x0?.offer?{firstHeartbeat:x0.offer}:{},capabilities:F9(m.config,m.state,F,W?.capability),client:F1.client?.(m)??new g1(W$($.apiOrigin),S0($.proxy,UJ()),m.proofStore,{deviceSession:m3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};O0(L$);let _1={...L$,heartbeatNow:null};y.add(_1);try{await u3({registerHeartbeatNow:(a0)=>{_1.heartbeatNow=a0},...r1(L$,(a0)=>{if(a0.type==="completed")_9(a0.operationId,a0.status);if(a0.type==="claims_changed"){if(_0(a0.activeClaims),_&&x()===0)j.abort()}if(a0.type==="stopped")_0(0)})})}finally{y.delete(_1)}if(_&&!x$)await g9(L$)}});let Q3=0,X3=0,Y3=F1?.intervalMs??N4;if(await u3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?M2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...B0?{startup:B0}:{},...r1({state:J,client:h,capabilities:z,signal:j.signal,statusPath:a,...U0?.offer?{firstHeartbeat:U0.offer}:{}},(m)=>{if(m.type==="completed")_9(m.operationId,m.status);if(m.type==="claims_changed"){if(D=m.activeClaims,_&&x()===0)j.abort()}if(m.type==="heartbeat"&&!_){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=FJ({log:(s0,_0)=>{process.stderr.write(`${JSON.stringify({event:s0,..._0})}
+`)}}),S.arm(),setTimeout(jJ,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(C&&!_&&Date.now()>=Q3)Q3=Date.now()+Y3,C.check().then((s0)=>{X3=s0?0:X3+1,Q3=Date.now()+(s0?Y3:Math.min(Y3,U4*2**Math.min(X3-1,10)))});if(P=m.serverTime,I=m.drain,L1(),!_&&C$)v?.(m.latestCliVersions?.[C$]);if(!_)E="running";if(!_&&!f&&I$().executionEligible){if(f=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{L9({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!_)E="reconnecting";if(m.type==="stopped")D=0;X.onEvent?.(m)})}),await C?.settled(),_&&!x$&&$.lifetime==="ephemeral")await h.disconnect?.(J,AbortSignal.timeout(NJ)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
+`)});else if(_&&!x$)await g9({state:J,client:h});if(s$)await LJ().catch(()=>{return})}catch(h){if(!(h instanceof L0&&h.status===401))throw h;if(R0($,{...V,revoked:!0}),h.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(G$),clearInterval(M0),k)clearTimeout(k);if(T1)process.removeListener("SIGTERM",Y$),process.removeListener("SIGINT",T$);X.signal?.removeEventListener("abort",Y$),j.abort(),S?.close(),await C?.settled().catch(()=>{return}),await W?.broker.close().catch(()=>{return}),await E$()}}function UJ($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(HJ,qJ),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as TY,sign as LY}from"crypto";var CJ=65536,FY=65536;function _Y($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new V0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new V0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!xJ(X))throw new V0("invalid_public_key");return X}function EJ(){try{let{privateKey:$,publicKey:J}=TY("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:_Y(J)}}catch($){if($ instanceof V0)throw $;throw new V0("proof_key_generation_failed")}}class l1{keyPair=EJ();binding=null;loadPublicKey(){if(!this.keyPair)throw new V0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=EJ(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>FY)throw new V0("proof_sign_failed");let J;try{J=LY("sha256",$,this.keyPair.privateKey)}catch{throw new V0("proof_sign_failed")}if(!SJ(J))throw new V0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>CJ)throw new V0("invalid_binding");if(this.binding)throw new V0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>CJ)throw new V0("invalid_binding");if(!this.binding)throw new V0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as RY,spawn as PY}from"child_process";import{isAbsolute as IY}from"path";import{promisify as CY}from"util";var c1={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class s1{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let V=this.waiter;this.waiter=void 0,V.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=c1){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
+`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(V)=>V?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as jY}from"crypto";import{unlinkSync as DY}from"fs";import{join as WY}from"path";var a1=1,u2=45000,OY=K.strictObject({type:K.literal("configure"),protocol:K.literal(a1),version:K.string(),config:J0}),zY=K.strictObject({type:K.literal("ticket"),organizationId:K.string().min(1).max(160),receipt:K.unknown()}),AY=K.strictObject({type:K.enum(["ping","stop"])});async function bJ($={}){let J=$.clock??c1,Z=new s1($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),V,N,B,U,M=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:G,version:H}=OY.parse(await Z.receive(30000,Q.signal));if(H!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(K$(G),e(g(G),!0),N=e0({path:d(G).lock,runtimeVersion:r}),!N.acquired)throw Error("worker_already_running_or_lifecycle_busy");let q=WY(g(G),`ssh-preflight-${jY()}.json`);try{c(q,{version:1}),s(q)}finally{try{DY(q)}catch{}}let T=o(G),L=$0(G);if(L.revoked||L.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&G.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:a1,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let j=G.lifetime==="ephemeral"?B=new l1:T0(G,!0);if(!T){let _=D$(G);await Z.send({type:"ticket-request",request:_.request});let D=zY.parse(await Z.receive(70000,Q.signal)),R=_.complete(D.organizationId,D.receipt);if(T=await o0(G,R,j,$.enroll),G.lifetime==="persistent")k0(T,d(G).state,{proofStore:j});R0(G,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");V=(async()=>{try{while(!X.signal.aborted){if(AY.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let W=!1,O,F=!1;U=J.after(Math.max(1,Math.min(u2,$.startupTimeoutMs??u2)),()=>{F=!0,Y()});let z=N.owner.nonce;if(await p1(G,T,j,z,{...$,signal:Q.signal,onEvent(_){if($.onEvent?.(_),_.type==="heartbeat"&&!W&&!O)O=(async()=>{let D=await K0(G,"status");if(!D?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:D.deviceId,expiresAt:D.expiresAt,lifetime:G.lifetime,supervision:"ssh-foreground"}),W=!0,U?.()})().catch(()=>{F=!0,Y()})}}),await O,F||!W)throw Error("worker_ssh_outbound_or_readiness_failed");return M=!0,0}catch(G){let H=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:H})}catch{}return 1}finally{if(U?.(),Y(),X.abort(),await V,B?.deleteBinding(),B?.deleteKey(),N?.acquired)N.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),M)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var O9=($)=>IY($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),W9=($)=>`'${$.replaceAll("'","'\\''")}'`,EY=K.strictObject({type:K.literal("hello"),protocol:K.literal(a1),version:K.string(),platform:K.enum(["linux","darwin"]),architecture:K.enum(["arm64","x64"]),enrolled:K.boolean()}),xY=K.strictObject({type:K.literal("ticket-request"),request:K.strictObject({install_id:K.uuid(),code_challenge:K.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:K.enum(["persistent","ephemeral"]),roots:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),execution_mode:K.enum(["confined","host"]),permissions:K.strictObject({read:K.literal(!0),write:K.literal(!0),execute:K.literal(!0),discover_environment:K.literal(!0),expose_mcp:K.literal(!1)})})).length(1)})}),wJ=K.discriminatedUnion("type",[K.strictObject({type:K.literal("running"),deviceId:K.string().min(1).max(160),expiresAt:K.iso.datetime({offset:!0}),lifetime:K.enum(["persistent","ephemeral"]),supervision:K.literal("ssh-foreground")}),K.strictObject({type:K.literal("pong")}),K.strictObject({type:K.literal("stopped")})]),SY=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function d2($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&SY.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function yJ($){if(!O9($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
+a=${W9($.remoteCli)}
+[ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
+p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
+p=$(cd -P "$p" && pwd -P)
+[ "\${p%/}/$f" = "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
+if [ -x /usr/bin/sha256sum ]; then h=$(/usr/bin/sha256sum < "$a");
+elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
+else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
+h=\${h%% *}
+[ "$h" = ${W9($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
+exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${W9(J)}`}function kJ($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!O9($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,yJ($)]}function bY($){return kJ($,!1)}function hJ(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:H0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function wY($){let J;try{({stdout:J}=await CY(RY)("/usr/bin/ssh",["-G",...kJ($,!0)],{env:hJ(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
+`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function yY($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function kY($){await wY($);let J=PY("/usr/bin/ssh",bY($),{stdio:["pipe","pipe","pipe"],env:hJ()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let V=yY(Z);Z="",X({exitCode:Y??1,errorCode:V})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function hY($){let J=new Map,Z=!1;for(let V=0;V<$.length;V++){let N=$[V];if(N==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(N)||J.has(N))throw Error("worker_unknown_or_duplicate_flag");let B=$[++V];if(!B||B.startsWith("--"))throw Error("worker_missing_flag_value");J.set(N,B)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(V)=>{let N=J.get(V);if(!N)throw Error("worker_required_input_missing");return N},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!O9(X.sshConfig))throw Error("worker_ssh_invalid_target");yJ(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(i1(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function fY($,J,Z,Q,X){let{request:Y}=xY.parse(d2(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let V=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},N=(async()=>{V();let U=Z??_$(J),M=await(Q.enrollmentCredentials??j$)(J,U);if(V(),!M)throw Error("worker_session_login_required");if(!P0(M.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=Q.createTicketClient?.(M)??new A$(M,{credentialsPath:U}),H=F3(await G.createHeadlessDeviceEnrollmentTicket(Y));return V(),{type:"ticket",organizationId:M.orgId,receipt:H}})(),B;try{let U=await Promise.race([N,new Promise((M,G)=>{if(B=()=>G(Error("worker_ssh_cancelled")),X.aborted)B();else X.addEventListener("abort",B,{once:!0})})]);V(),await $.send(U)}finally{X.removeEventListener("abort",B)}}async function fJ($,J={}){let{config:Z,target:Q,credentialPath:X}=hY($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??c1,V=await(J.sshTransport??kY)(Q),N=new s1(V.output,V.input,Y),B=new AbortController,U=()=>B.abort(),M,G;if(V.result.then((H)=>{G=H}),process.once("SIGINT",U),process.once("SIGTERM",U),J.signal?.addEventListener("abort",U,{once:!0}),J.signal?.aborted)U();try{if(B.signal.aborted)throw Error("worker_ssh_cancelled");await N.send({type:"configure",protocol:a1,version:r,config:Z});let H=EY.parse(d2(await N.receive(30000,B.signal)));if(H.version!==r)throw Error("worker_ssh_version_mismatch");if(!H.enrolled)await fY(N,Z,X,J,AbortSignal.any([B.signal,N.signal]));M=Y.every(1e4,()=>{N.send({type:"ping"}).catch(U)});let q=!1,T=Y.now()+(H.enrolled?0:T3)+u2+5000;while(!0){let L=q?35000:Math.max(1,T-Y.now()),j=wJ.parse(d2(await N.receive(L,B.signal)));if(j.type==="running"){if(q||j.lifetime!==Z.lifetime||Date.parse(j.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");q=!0,(J.io??process).stdout.write(JSON.stringify(j)+`
+`)}if(j.type==="stopped"){if(!q)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(H){if(B.signal.aborted){M?.();try{await N.send({type:"stop"});let q=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<q)if(wJ.parse(d2(await N.receive(Math.max(1,q-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(H instanceof Error&&H.message==="worker_ssh_connection_closed"){let q=G??await Promise.race([V.result,new Promise((T)=>setTimeout(T,100))]);if(q?.exitCode)throw Error(q.errorCode)}throw H}finally{M?.(),process.removeListener("SIGINT",U),process.removeListener("SIGTERM",U),J.signal?.removeEventListener("abort",U),V.close(),N.dispose()}}import{createConnection as dY}from"net";import{WebSocket as p2}from"ws";var mY=1,K1=65536,mJ=4096,vJ=67108864,gJ=4194304,B1=K.uuid(),vY=K.strictObject({kind:K.literal("install_only"),authorityId:B1,organizationId:B1,userId:B1,connectionId:B1,attemptId:B1,purpose:K.literal("install"),generation:K.number().int().positive(),transport:K.literal("reverse_ssh"),expiresAt:K.iso.datetime({offset:!0}),maxDurationMs:K.literal(300000),maxChannels:K.literal(1),allowTcpForwarding:K.literal(!1),allowPty:K.literal(!1)}),gY=K.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!B1.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var uY=K.strictObject({protocol:K.literal(mY),type:K.literal("ssh_install_relay"),authorityToken:K.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:vY,relayUrl:gY,endpoint:K.strictObject({host:K.literal("127.0.0.1"),port:K.literal(22)})});function z9($,J=Date.now()){let Z=uY.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function uJ($){let J=JSON.stringify($);if(Buffer.byteLength(J)>K1)throw Error("ssh_install_relay_frame_too_large");return J}function dJ($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:z9(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var pJ="ssh_install_relay_closed";function pY($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function lY($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function cY($,J=pJ){try{$.close(1000,J)}catch{$.terminate()}}async function sY($){let J=$.now??(()=>Date.now()),Z=z9($.receipt,J()),X=($.createWebSocket??((_)=>new p2(_,{followRedirects:!1,perMessageDeflate:!1,maxPayload:K1})))(Z.relayUrl),Y=$.connectLocal??(()=>dY({host:"127.0.0.1",port:22})),V,N=!1,B=!1,U=0,M=0,G,H=(_)=>{if(G)clearTimeout(G);G=setTimeout(()=>L("ssh_install_relay_expired"),Math.max(1,_)),G.unref?.()},q,T=new Promise((_)=>{q=_}),L=(_=pJ)=>{if(B)return;if(B=!0,G)clearTimeout(G);if($.signal?.removeEventListener("abort",j),V?.destroy(),X.readyState===p2.OPEN)cY(X,_);else if(X.readyState!==p2.CLOSED)X.terminate();q()},j=()=>L("ssh_install_relay_aborted"),W=()=>L("ssh_install_relay_protocol_error"),O=(_)=>{return U+=1,M+=_,_<=K1&&U<=mJ&&M<=vJ},F=(_)=>{if(B||!N||X.readyState!==p2.OPEN||X.bufferedAmount>gJ||!O(_.length)){W();return}X.send(_,{binary:!0},(D)=>{if(D)W()})};X.on("open",()=>{if(B)return;try{let _=uJ({type:"ssh_install_relay_receipt",receipt:Z});X.send(_,{binary:!1},(D)=>{if(D)W()})}catch{W()}}),X.on("message",(_,D)=>{if(B)return;let R=pY(_);if(R>K1||!O(R))return W();if(!N){if(D)return W();try{let P=dJ(JSON.parse(String(_)));if(P.type!=="ssh_install_relay_ready"||P.authorityId!==Z.authority.authorityId)return W();N=!0,H(Z.authority.maxDurationMs),V=Y(),V.setNoDelay(!0),V.on("data",F),V.on("error",W),V.on("close",()=>L("ssh_install_relay_peer_closed")),V.on("drain",()=>X._socket?.resume()),V.on("connect",()=>{})}catch{W()}return}if(!D)return W();let E=lY(_);if(!E||!V||V.destroyed||!V.write(E))X._socket?.pause()}),X.on("error",W),X.on("close",()=>L("ssh_install_relay_peer_closed"));let z=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(H(z),$.signal?.addEventListener("abort",j,{once:!0}),$.signal?.aborted)j();return{receipt:Z,closed:T,close:()=>L()}}async function lJ($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>K1)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await sY({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as aY}from"crypto";var l$="ARA_WORKER_PREVIEW_PROBE";async function sJ(){if(typeof Bun>"u")return 1;let $=aY(32).toString("base64url"),J,Z=new Promise((V)=>{J=V}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(V,N){let B=new URL(V.url).pathname;if(V.method!=="GET")return new Response(null,{status:405});if(B==="/readiness")return new Response(l$);if((B==="/readiness-ws"||B===`/device/readiness/${$}`)&&N.upgrade(V,{data:{relay:B.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(V,N){if(typeof N!=="string"||N.length>8192){V.close();return}if(!V.data.relay){if(N===l$)V.send(l$);else V.close();return}try{let B=cJ(N),U=(M)=>V.send(JSON.stringify(M));if(B.type==="hello")U(B),U({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(B.type==="head"&&B.id==="http"&&B.status===200)U({type:"credit",id:"http"});else if(B.type==="data"&&B.id==="http"){if(V.data.http+=Buffer.from(B.data,"base64").toString(),V.data.http.length>l$.length)throw Error("probe_overflow");U({type:"credit",id:"http"})}else if(B.type==="end"&&B.id==="http"&&V.data.http===l$)U({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(B.type==="ws"&&B.id==="ws")U({type:"data",id:"ws",data:Buffer.from(l$).toString("base64"),binary:!1});else if(B.type==="data"&&B.id==="ws"&&!B.binary&&Buffer.from(B.data,"base64").toString()===l$&&!V.data.reported)V.data.reported=!0,process.stdout.write(`ready
+`);else throw Error("probe_protocol_failed")}catch{V.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
+`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as tY,createReadStream as rY,fstatSync as oY,readFileSync as eY}from"fs";var aJ="/run/sc/instance-generation";var iY=/^[1-9][0-9]{0,15}\n?$/;function nY($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function iJ($){if(typeof $!=="string"||!iY.test($))return null;let J=Number($.trim());return nY(J)?J:null}var nJ=3,$V=600000,JV=65536,ZV=500;function tJ($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(nJ))throw Error("worker_standby_invalid_invocation");return{handoffFd:nJ}}function QV($=(J)=>eY(J,"utf8")){try{return iJ($(aJ))}catch{return null}}function XV($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=M3.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var rJ={isPipe:($)=>oY($).isFIFO(),stream:($)=>{let J=rY("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function YV($,J=rJ){if(!J.isPipe($.fd)){try{tY($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??$V),Q=J.stream($.fd),X=null,Y=()=>{},V=new Promise((B,U)=>{Y=(M)=>{X??=M,U(M)}});V.catch(()=>{});let N=J.every(ZV,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let B=(async()=>{let M=[],G=0;for await(let H of Q.chunks){if(X)throw X;if(G===0)$.onArriving?.();if(G+=H.length,G>JV)throw Error("worker_standby_handoff_too_large");M.push(H)}return Buffer.concat(M).toString("utf8")})(),U=await Promise.race([B,V]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return U}finally{N(),Q.close()}}async function oJ($,J=rJ){let Z=$.readGeneration??(()=>QV()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await YV({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return XV(Y)}var VV=`Usage: reason worker <command> --config PATH [--json]
+  enroll                        Obtain/redeem a ticket using the current Reason login
+  start                         Run the existing Device daemon in the foreground
+  status                        Read enrollment and live local control state
+  doctor                        Read local prerequisites; never enroll or repair
+  drain                         Persist withdrawal of new claims; keep current work
+  resume                        Explicitly clear persistent drain
+  stop                          Drain, then cancel at shutdownGraceMs (ephemeral: ends its Device)
+  revoke                        Revoke an offline Device and remove its local key
+  attach                        Start this same worker over verified system SSH
+Config: version 1; apiOrigin, channel, stateDirectory, workspaceRoot, lifetime
+(persistent|ephemeral); executionMode defaults confined (host is explicit consent);
+slots (Sessions at once, 1-4) defaults 1 and a Machine worker runs one;
+shutdownGraceMs defaults 30000. Paths must be absolute and canonical.
+Config and enrollment files must be owned by the current user with mode 0600.
+Enroll: --enrollment-file PATH redeems a platform-provided ticket instead.
+Enroll: --credential-file PATH selects a protected Reason credentials JSON file
+(including credentialKind: api_key). Credentials never belong in argv or worker state.
+The current login needs devices:write; enrollment never opens a browser or starts work.
+Ephemeral: start keeps its proof key only in this process. It redeems
+--enrollment-file PATH, or else obtains a ticket with the current login.
+Its Device ends when the process exits; every start enrolls a new Device.
+Use lifetime persistent to stop and start the same Device.
+Simple setup: \`reason serve NAME\` writes this config and enrolls for you.
+State is isolated under stateDirectory/headless-<channel>, never Desktop identity.
+Persistent keys: a new identity's is a non-extractable login Keychain key on a Mac
+where the CLI can create one there, otherwise an extractable owner-only file.
+proxy {version 1, url, caFile?} carries enrollment, control, Hands and desktop relay
+traffic (not yet previews or kept terminals); proxy environment variables stay refused.
+No service is installed, no update is performed, and no desktop/VNC is enabled.
+SSH: attach --ssh ALIAS --ssh-config PATH --remote-cli /absolute/path/reason
+  --artifact-sha256 HASH --config PATH --foreground [--credential-file PATH]
+The config describes remote paths. An existing, SHA-256-pinned CLI is required.
+SSH config must be protected (0600); it explicitly owns IdentityFile and host trust.
+ProxyJump/ProxyCommand are unsupported; configure a directly reachable alias.
+Pretrust known_hosts. No agent forwarding, automatic installation or detached service.
+SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
+are not forwarded/supported; running is not a browser-readiness receipt.
+Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
+`;function GV($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,V=!1;for(let N=0;N<Z.length;N++){let B=Z[N];if(B==="--json"&&!V){V=!0;continue}if(B!=="--config"&&B!=="--enrollment-file"&&B!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let U=Z[++N];if(!U||U.startsWith("--"))throw Error("worker_missing_flag_value");if(B==="--config"&&!Q)Q=U;else if(B==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=U;else if(B==="--credential-file"&&!Y&&J==="enroll")Y=U;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:V}}var BV=1e4,KV=2000,eJ=15000,NV=50;async function Z6($,J,Z,Q,X,Y){let V=new l1,N=new AbortController,B,U,M=new Promise((E,P)=>{B=E,U=P});if(M.catch(()=>{}),v0(),$.executionMode==="host")d1();Z("enrollment_started");let G=X(V);G.catch(()=>{});let H=null,q=j2($,J,(E)=>{if(!H)throw Error("worker_starting");return H(E)});q.catch(()=>{}),Z("readiness_started");let T=new AbortController,L,j=AbortSignal.any([N.signal,T.signal,...Q.signal?[Q.signal]:[]]),W=Y?.matches($)?Y.result:void 0;if(Y&&!W)await Y.stop();if(W)j.addEventListener("abort",()=>void Y.stop(),{once:!0});let O,F=new Promise((E)=>{O=E}),z=setTimeout(()=>O(),BV);j.addEventListener("abort",()=>O(),{once:!0});let _,D=(E)=>{if(E==="ready")_=setTimeout(()=>O(),KV);Q.onStartup?.(E)},R=b1($,Q.readinessProbes,j,M,void 0,W,F);R.final.catch(()=>{});try{let E;try{E=await G}catch(P){throw N.abort(),U(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await q.then((I)=>I(),()=>{}),P}Z("enrollment_completed"),L=setTimeout(()=>T.abort(),Math.max(1,Math.min(eJ,Date.parse(E.worker?.expiresAt??"")-Date.now()||eJ))),B(E.roots[0].permissions),R0($,{version:1,drained:!1,revoked:!1}),await p1($,E,V,J,{...Q,onStartup:D,prestartedReadiness:R,prestartedControl:{closed:q,handle:(P)=>{H=P}},deferOptionalLanes:!0})}finally{clearTimeout(L),clearTimeout(z),clearTimeout(_),N.abort(),V.deleteBinding(),V.deleteKey(),await q.then((E)=>E(),()=>{})}}async function UV($,J,Z,Q){let{handoffFd:X}=tJ($);if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,V,N=()=>{let q=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>S1(T);if(B||!q)return;try{v0(),d1()}catch{return}if(Y=y8(q),!Z.readinessProbes)setImmediate(()=>{if(B)return;try{E2()}catch{}})},B=!1,U=()=>{B=!0,clearTimeout(V),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",U),process.once("SIGINT",U);let M;try{M=await(J.receiveStandbyHandoff??oJ)({fd:X,onBooted:()=>{Q("standby_booted"),V=setTimeout(N,NV)},onArriving:()=>clearTimeout(V)})}catch(q){clearTimeout(V);let T=q instanceof Error&&/^worker_standby_[a-z_]+$/.test(q.message)?q.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
+`),await Y?.stop(),(J.exitProcess??((L)=>process.exit(L)))(1),1}finally{clearTimeout(V),process.off("SIGTERM",U),process.off("SIGINT",U)}if(B)return 0;Q("handoff_received");let{config:G,enrollment:H}=M;try{e(g(G),!0);let q=await Q6(G,()=>{});try{if(Q("lock_acquired"),o(G))throw Error("worker_ephemeral_requires_fresh_enrollment");return K$(G),await Z6(G,q.owner.nonce,Q,Z,(T)=>o0(G,H,T,J.enroll),Y),0}finally{q.release()}}finally{await Y?.stop()}}async function q$($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,V=(B)=>{Y.set(B,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:B,pid:process.pid,timestamp:new Date().toISOString()})+`
+`),J.onStartup?.(B)},N={...J,onStartup:V,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let B=(q)=>Math.min(n$,Math.max(0,Math.round(q))),U=Y.get("readiness_started"),M=Y.get("readiness_completed"),G=Y.get("handoff_received")??0,H=Object.fromEntries(J6.flatMap((q)=>{let T=Y.get(q);return T===void 0?[]:[[q,B(T-G)]]}));return{service_start_to_heartbeat_ms:B(performance.now()-G),stage_ms:H,...U!==void 0&&M!==void 0?{readiness_ms:B(M-U)}:{}}},onEvent:(B)=>{if(B.type==="error"&&B.diagnostic){Q=!0;let U=B.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:U.stage,category:U.category,httpStatus:U.category==="http"?U.httpStatus:void 0})+`
+`)}J.onEvent?.(B)}};try{if($[0]==="__preview-probe"){if($.length!==1||N1(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await sJ()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await fJ($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await lJ();return await bJ(J)}if($[0]==="__update-restart"){let q=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!q)throw Error("worker_unknown_or_duplicate_flag");if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),L=await D2(T,q?void 0:r);return Z.stdout.write(JSON.stringify(L)+`
+`),L.state==="current"?3:L.state==="busy"?75:0}if($[0]==="standby")return await UV($,J,N,V);let B=GV($);if(!B)return Z.stdout.write(VV),0;if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let U=J0.parse(JSON.parse(s(B.configPath))),M=(q)=>Z.stdout.write(JSON.stringify(q)+`
+`),G=o(U);if(B.action==="status"||B.action==="doctor"){let q=await K0(U,"status"),T=$0(U),L={enrolled:!!G||!!q,deviceId:G?.deviceId??q?.deviceId??null,lifetime:U.lifetime,expired:G||q?Date.parse(G?.worker?.expiresAt??q.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:q};if(B.action==="status")return M(L),0;let j=!0;try{K$(U)}catch{j=!1}return M({...L,workspace:j,platform:process.platform,executionMode:U.executionMode,proofStorage:U.lifetime==="ephemeral"?"process-memory":G&&T0(U)instanceof i$?"login-keychain":"owner-only-file",confinement:U.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:q?.supportedOperations?"live-worker":"unavailable",reportedOperations:q?.supportedOperations??null,capabilityReadiness:q?.capabilityReadiness??null,ready:q?.executionEligible===!0&&!L.expired}),j&&(G||q)&&!L.revoked&&!L.expired?0:1}if(["drain","resume","stop"].includes(B.action)){let q=B.action==="drain"?"drain":B.action==="resume"?"resume":"stop",T=await K0(U,q);if(T){if(M(T),q==="stop"&&U.lifetime==="ephemeral"&&!B.json)Z.stderr.write(qV);return 0}}e(g(U),!0);let H=await Q6(U,()=>{if(!B.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
+`)});try{if(B.action==="start")V("lock_acquired");let q=o(U);if(["drain","resume","stop"].includes(B.action)){if(!q)throw Error("worker_not_enrolled");let T=$0(U);if(T.revoked||Date.parse(q.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(B.action!=="stop")R0(U,{...T,drained:B.action==="drain"});return M({running:!1,drained:B.action==="stop"?T.drained:B.action==="drain"}),0}if(B.action==="enroll"){if(U.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=B.enrollmentPath,L=!T&&$0(U).revoked;if(q&&!L)throw Error("worker_already_enrolled");K$(U);let j=()=>{w0(U),Y4(U)};if(L)j();let W=async()=>{let z=Q2(U),_=T?await L3(U,T,z,J.enroll):await $6(U,B.credentialPath,J,z);return{proof:z,enrolled:_}},{proof:O,enrolled:F}=await W().catch((z)=>{if(T||!(z instanceof r0)||!z.deviceRemoved)throw z;return j(),W()});return k0(F,d(U).state,{proofStore:O}),R0(U,{version:1,drained:!1,revoked:!1}),M({enrolled:!0,deviceId:F.deviceId,lifetime:U.lifetime}),0}if(B.action==="revoke"){if(!q)throw Error("worker_not_enrolled");let T=T0(U),L=new g1(W$(U.apiOrigin),S0(U.proxy),T);if(R0(U,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(q,L);else await L.disconnect(q,AbortSignal.timeout(30000));return w0(U),M({revoked:!0,localKeyRemoved:!0}),0}if(K$(U),U.lifetime==="ephemeral"){if(q)throw Error("worker_ephemeral_requires_fresh_enrollment");await Z6(U,H.owner.nonce,V,N,async(T)=>B.enrollmentPath?L3(U,B.enrollmentPath,T,J.enroll):$6(U,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(B.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!q)throw Error("worker_not_enrolled");if($0(U).revoked)X=!0;await p1(U,q,T0(U),H.owner.nonce,N)}return 0}finally{H.release()}}catch(B){let U=B instanceof Error&&(B.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(B.message))?B.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${U}.
+`);let M=$.includes("--json")?void 0:e$(B instanceof r0&&B.deviceRemoved?"worker_enrollment_device_removed":U);if(M)Z.stderr.write(`${M}
+`);return U==="worker_revoked"&&X?0:1}}var HV=60000;async function Q6($,J){let Z=Date.now()+$.shutdownGraceMs+HV,Q=!1;for(;;){let X=e0({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await K0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((N)=>setTimeout(N,250))}}var qV='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function $6($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let B=performance.now();return o0($,await Z.enrollmentInput($),Q,Z.enroll,B)}let Y=J??_$($),V=await(Z.enrollmentCredentials??j$)($,Y);if(!V)throw Error(X);let N=Z.createTicketClient?.(V)??new A$(V,{credentialsPath:Y,fetchImpl:S0($.proxy)});return X4($,V,N,Q,Z.enroll)}import{spawn as MV}from"child_process";import{existsSync as TV,readFileSync as LV,unlinkSync as FV}from"fs";import{join as _V}from"path";var jV=120,DV=15,WV=5000;function l2($={}){let J=$.stateDirectory?_V($.stateDirectory,OV):null;if(J)zV(J);let Z=["/bin/bash","/usr/bin/bash"].find((G)=>TV(G));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??jV)),X=$.pid??process.pid,Y=Math.min(DV,Q),V=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${X6(r)} > ${X6(J)} 2>/dev/null
+`:"",N=(G)=>`[ $((SECONDS - started)) -ge ${Math.max(1,G-1)} ]`,B=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
+while :; do started=$SECONDS
+IFS= read -r -t ${Q} pulse && continue
+${N(Q)} && parent_is_worker || exit 0
+started=$SECONDS
+IFS= read -r -t ${Y} pulse && continue
+if ${N(Y)} && parent_is_worker; then
+  echo "Reason: worker_event_loop_stalled; no progress for ${Q+Y}s, restarting the worker." >&2
+  ${V}kill -KILL ${X}
+fi
+exit 0
+done`,U=MV(Z,["-c",B],{stdio:["pipe","ignore","inherit"]});U.on("error",()=>{}),U.stdin.on("error",()=>{});let M=setInterval(()=>U.stdin.write(`
+`),Math.min(WV,Q*1000/4));return M.unref(),U.unref(),{stop(){clearInterval(M),U.stdin.end()}}}var OV="worker-stalled";function X6($){return`'${$.replaceAll("'","'\\''")}'`}function zV($){let J;try{J=LV($,"utf8"),FV($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{u1(g2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var EV=`Share this computer as a machine
+Usage:
+  reason serve                     This computer, signed in (machine name: its hostname)
+  reason serve --token rmt_\u2026       Any server, no login: the token names the machine
+  reason serve NAME [--dir PATH] [--once] [--sandbox] [--yes]
+  reason serve [NAME | --token rmt_\u2026] [--dir PATH] --service
+  reason serve NAME --stop [--json]  (same as: reason stop NAME)
+Adds this computer as a worker of a machine and waits for sessions. Start one
+from anywhere with: reason "fix the flaky test" --on NAME
+(To run one session here yourself, run \`reason "PROMPT"\` in the folder; it
+needs no machine and serves only while that command runs.)
+Sessions queue on the machine until one of its workers is free. Run
+\`reason serve\` on more computers, or in more folders, to add workers.
+Signed in, the machine is created if it doesn't exist (owners and admins).
+Without a login, use a token from \`reason machines token NAME\`: --token, or
+REASON_TOKEN. The token is used once to join and is never saved. Reconnect
+later with \`reason serve NAME\` or the same command. Press Ctrl-C to stop.
+With --service (macOS and Linux), this computer joins in the foreground, then
+keeps the worker running in the background: it starts again at login (Linux:
+at boot, when user lingering is allowed) and restarts if it fails. The service
+runs \`reason serve NAME --dir PATH\` with this worker's saved identity; the
+token is never saved. \`reason stop NAME\` stops and removes it.
+Options:
+  --dir PATH   Folder sessions work in (default: the current directory)
+  --once       Keep the worker only while this command runs; nothing is saved
+  --sandbox    Run confined. Sandboxed machines can't host sessions yet.
+  --yes        Accept the first-run confirmation (required without a terminal;
+               a token already carries it)
+  --service    Keep this worker running as a background service (see above)
+  --stop       Stop this computer's running workers for NAME and remove
+               their background services. They stay in Reason and can
+               start again; \`reason disconnect NAME\` removes them.
+Sessions run commands in the folder with the permissions of the user who runs
+the worker unless --sandbox is set. Settings live in
+~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
+folder served for NAME is its own worker. Use
+\`reason worker status|revoke --config <that file>\` for advanced control.
+`,xV=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,SV=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,N6="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",Y6=["REASON_TOKEN","REASON_MACHINE_TOKEN"],U6="my-computer";function P9($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&R1(J)&&J!==T2?J:U6}class Q0 extends Error{}function bV($,J){let Z,Q=new Map,X=new Set;for(let U=0;U<$.length;U+=1){let M=$[U];if(M==="--help"||M==="-h"||M==="help")return null;if(M==="--dir"||M==="--token"||M==="--org"){let G=$[U+1];if(!G||G.startsWith("-"))throw new Q0(`Missing value after ${M}.`);if(Q.has(M))throw new Q0(`${M} may be specified only once.`);Q.set(M,G),U+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(M)){X.add(M==="-y"?"--yes":M);continue}if(M.startsWith("-"))throw new Q0(`Unknown option: ${M}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=M}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!R1(Z)&&!xV.test(Z))throw new Q0(N6);if(Z.toLowerCase()===T2)throw new Q0(`"${T2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((U)=>U!=="--stop"&&U!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let V=Y?void 0:Q.get("--token")??J,N=Q.get("--org");if(V!==void 0){if(!V.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(N!==void 0&&!SV.test(N))throw new Q0("--org must be a workspace id.")}else if(N!==void 0)throw new Q0("--org is only used with --token.");let B=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...B===void 0?{}:{dir:B},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...V===void 0?{}:{token:V},...N===void 0?{}:{org:N.toLowerCase()}}}function i2($,J){let Z=CV($,J??"."),Q;try{Q=K6(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!PV(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var c2=($)=>c$($,".reason","workers"),A9=($)=>u(d($).state);function wV($,J,Z){let Q=c$(c2($),J);if(A0(c$(Q,"worker.json"))?.workspaceRoot===Z)return Q;return c$(c2($),`${J}@${AV("sha256").update(Z).digest("hex").slice(0,8)}`)}function H6($){let{stateDirectory:J}=$;if(i1($.workspaceRoot,J)||i1(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function A0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function R9($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function yV($,J){$.stdout.write(`${J} [y/N] `);let Z=await V6($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function n2($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var kV={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function q6($){try{return await $()}catch(J){let Z=J instanceof m0?kV[J.code]:void 0;throw Z?Error(Z):J}}async function hV($,J,Z,Q){let X=H6({...J,name:$.name??U6,stateDirectory:c$(c2(Z),".token-enrollment")}),Y=D$(X,{stored:!1}),V=await q6(()=>G6({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!R1(V.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==V.machine_name.toLowerCase())throw new Q0(`This token is for machine "${V.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==V.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${V.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let N=!1;return{name:$.name??V.machine_name,input:(B)=>{if(N)throw Error("worker_ticket_receipt_mismatch");return N=!0,Y.saveInstall(B),Y.complete(V.organization_id,V)}}}function fV($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??j$)(X);if(!Y)throw Error("worker_session_login_required");let V=(Z.createApi??((N)=>new A$(N)))(Y);return Q4(X,Y,{createHeadlessDeviceEnrollmentTicket:(N)=>q6(async()=>{try{return await V.createMachineEnrollmentTicket($,N)}catch(B){if(!(B instanceof m0)||B.code!=="machine_not_found")throw B}try{await V.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
+`)}catch(B){if(!(B instanceof m0)||B.status!==409)throw B}return V.createMachineEnrollmentTicket($,N)})})}}async function M6($,J,Z,Q){let X=await D2($,Q,()=>B6($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!M$($,J,Z))return null;return P3($),X}function I9($,J){let Z=c2($);if(!u(Z))return[];let Q=J.toLowerCase();return RV(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let V=c$(Z,X,"worker.json"),N=A0(V);return N?[{path:V,config:N}]:[]})}async function mV($,J,Z,Q,X){let Y=I9(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let V=Q.controlWorker??K0,N=[];for(let B of Y){let U=await V(B.config,"stop")!==null,M=a2(B.config,X),G=U||M!==null;if(N.push({config:B.path,folder:B.config.workspaceRoot,running:G,service:M?.label??null}),!$.json&&M)Z.stdout.write(`Removed background service ${M.label} (${B.config.workspaceRoot}); it won't start again.
+`);if(!$.json)Z.stdout.write(G?`Stopping machine "${$.name}" in ${B.config.workspaceRoot}; current work finishes first.
+`:`Machine "${$.name}" in ${B.config.workspaceRoot} is not running.
+`)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:N})}
+`);return 0}async function T6($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??q$,X=J.env??process.env,Y=Y6.map((V)=>X[V]?.trim()).find(Boolean)||void 0;if(!J.env)for(let V of Y6)delete process.env[V];try{let V=bV($,Y);if(!V)return Z.stdout.write(EV),0;let N=K6(J.home??H0()),B=J.serviceHost??Q$(N);if(V.stop)return await mV({...V,name:V.name},N,Z,J,B);let U=J.channel??Z$(),M=i2(J.cwd??process.cwd(),V.dir),G=V.service?U1(B,X):void 0,H={channel:U,apiOrigin:n1(X,U),workspaceRoot:M,once:V.once,sandbox:V.sandbox},q=V.token?await hV({...V,token:V.token},H,N,J):void 0,T=q?.name??V.name??P9((J.hostname??IV)()),L=wV(N,T,M),j=c$(L,"worker.json"),W=A0(j);if(q&&W&&A9(W)&&$0(W).revoked)w0(W);let O=!q&&W!==null&&A9(W)&&(!v1(X,"REASON_API_URL")?.trim()||P0(H.apiOrigin,W.apiOrigin))?W.apiOrigin:void 0,F=H6({...H,...O?{apiOrigin:O}:{},name:T,stateDirectory:L}),z=W!==null&&A9(W);if(z&&N0(W)!==N0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${W.workspaceRoot}, ${W.executionMode==="host"?"your user permissions":"sandboxed"}).
+Run it with: reason serve ${T} ${R9(W)}
+Or remove it first: reason worker revoke --config ${j}`)}let _=F.lifetime==="persistent"?H1(F,B):null;if(_&&!V.service&&X[p$]!==_.label)return Z.stdout.write(`Machine "${T}" in ${M} already runs as a background service (${_.label}).
+  Logs: ${_.logs}
+  Stop it with: reason stop ${T}
+`),0;if(V.service&&z&&!_&&await(J.controlWorker??K0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${M}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let D=F.lifetime==="ephemeral"||!z;if(D&&!R1(T))throw new Q0(N6);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
+`);else if(D&&!V.yes&&!q){let P=`Sessions on "${T}" will run commands in ${M} with your user permissions (no sandbox). Continue?`,I=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!I)throw new Q0(`${P.replace(/ Continue\?$/,"")}
+Re-run with --yes to confirm.`);if(!await(J.confirm??((f)=>yV(Z,f)))(P))return Z.stderr.write(`Cancelled. Nothing was added.
+`),1}if(!z)e(F.stateDirectory,!0),c(j,F);let R={...J.worker,enrollmentInput:fV(T,q,J,Z)};if(F.lifetime==="persistent"&&!z){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
+`);let I=await Q(["enroll","--config",j],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(I!==0)return I}if(G){let P;try{P=s2({config:F,launcher:G,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:B})}catch(I){if(!(I instanceof R$))throw I;throw new Q0(`${I.message}
+This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${R9(F)}
+Or try the background service again with: reason serve ${T} ${R9(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${M}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${P.label} (starts at ${P.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${P.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...P.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
+`)),0}Z.stdout.write([`Reason machine "${T}"`,`  Folder:   ${M}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Lifetime: ${F.lifetime==="persistent"?`saved; run \`reason serve ${T}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
+`));let E=_&&X[p$]===_.label&&!J.runWorker?l2({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",j],{...R,io:{stdout:Z.stdout,stderr:n2(Z.stderr)},onStartup:(P)=>{if(P==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
+`);J.worker?.onStartup?.(P)}})}finally{E?.stop()}}catch(V){if(V instanceof Q0||V instanceof R$){let U=V instanceof R$&&V.code?` (${V.code})`:"";return Z.stderr.write(`Reason: ${V.message}${U}
+`),2}let N=V instanceof Error&&/^worker_[a-z_]+$/.test(V.message)?V.message:null,B=N?e$(N):void 0;return Z.stderr.write(`Reason: ${N?B?`${B} (${N})`:N:"could not prepare this machine."}
+`),1}}var vV=200;var IL=K.strictObject({version:K.literal(1),session_ids:K.array(K.string().min(1).max(200)).max(vV)});function q1($){let J=o($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as L6}from"child_process";import{readFileSync as gV,rmdirSync as uV,rmSync as dV}from"fs";import{join as C9}from"path";var pV=["Reason.app","Ara Sidecar.app","Ara Device.app"],lV="sidecar_retire_failed";function cV($){return C9($,"Library","Application Support","Ara","Sidecar")}function sV($){try{let J=gV(C9($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function _6($,J={}){let Z=cV($),Q=pV.map((N)=>C9(Z,N)).filter(sV);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>L6("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((N)=>process.kill(N,"SIGTERM")),V=J.command??((N,B)=>L6(N,[...B],{stdio:"ignore",timeout:1e4}).status??1);try{for(let N of X().split(`
+`)){let B=N.trim().match(/^(\d+)\s+(.+)$/);if(!B)continue;if(!Q.some((U)=>B[2].startsWith(`${U}/Contents/MacOS/`)))continue;try{Y(Number(B[1]))}catch{}}for(let N of Q)V(F6,["-u",N]),dV(N,{recursive:!0,force:!0});try{uV(Z)}catch{}}catch{return{status:"failed",code:lV}}return{status:"removed",bundles:Q}}var eV=`Connect this computer to Reason
+Usage:
+  reason connect                 Your computer, kept connected in the background
+  reason connect --to NAME       Add it to team machine NAME (as reason serve NAME --service)
+  reason connect --token rmt_\u2026   Join a machine with no login (as reason serve --token \u2026 --service)
+  reason connect --once          Only while this command runs; nothing is saved
+  reason connect --api-key KEY   Without reason login: a headless box, with an API key that has
+                                 devices:write (or set REASON_API_KEY, which keeps it out of ps).
+                                 The connection keeps the key to renew itself (macOS: Keychain).
+  reason disconnect [NAME]       Stop and remove it (NAME: this computer's workers for machine NAME);
+                                 it stays disconnected until you run reason connect
+Settings, saved; run reason connect again to change them:
+  --folder PATH                  Where Sessions may run (yours: your home folder; a machine: the current folder)
+  --sessions N                   No longer needed: your computer runs every Session you start
+  --name NAME                    This computer's name in Reason (default: its hostname)
+  --api-url URL                  The Reason API to connect to (as REASON_API_URL)
+  --proxy URL                    Reach Reason through this proxy (HTTPS_PROXY is not used)
+  --proxy-ca-file PATH           The proxy's PEM CA bundle
+  --user-chrome on|off           Your Sessions may use your own Chrome and its signed-in profiles
+                                 (macOS, through the Reason extension; on by default)
+  --cloud-sessions on|off        No longer needed: Reason does not read it
+  --minimal                      Keep this computer minimal: files, shell and terminal, no desktop,
+                                 computer use or browser use (reason desktop install adds them)
+  --local-logins on|off          Your Sessions run on the Claude Code, Codex and Grok logins
+                                 on this computer (on by default; off with an API key).
+                                 Reason gets each login's current access token, never
+                                 its refresh token.
+  --keep-awake on|off            macOS: keep this Mac awake while it runs Sessions (default on).
+                                 Applies at once, without reconnecting.
+  --add-folder PATH              Let Sessions run in another folder too, on the same computer in
+  --remove-folder PATH           Reason; or stop that. Applies at once; running Sessions in other
+                                 folders keep running. \`reason status --json\` lists the folders.
+Your computer is Personal: it needs no machine and no admin role, and only you
+start Sessions on it until you make it Team in Settings \u203A Computers. They run commands
+with your user permissions (there is no sandbox mode). It starts again at login (Linux:
+at boot, when lingering is allowed), restarts if it fails, and \`reason update\`
+restarts it on the new version. \`reason status\` shows it.
+It is connected in the workspace you signed in to. It is also connected, by
+itself, in up to 8 other workspaces you belong to, as each one's own computer,
+when this computer was signed in with the setup command Reason shows you (it
+ends in --pair CODE, a one-time code from your signed-in Reason) or by the
+Reason app, and was connected after that. Signed in with \`reason login\`
+alone, or connected with --api-key or --once, it stays in the one workspace:
+run the setup command from Reason here, then \`reason disconnect\` and
+\`reason connect\` if it was connected before. One sign-in covers one computer;
+a second computer needs its own. \`reason status\` says when this applies.
+One computer serves several Reason accounts. Signed in as another account than
+the one it is connected for, reason connect connects it for that account too,
+as that account's own computer in the workspace it signed in to; the other
+accounts stay connected. That account's \`reason logout\` removes only its own.
+`,$G=`Disconnect this computer from Reason
+Usage:
+  reason disconnect              Stop your computer's connection and remove it from Reason, in every
+                                 workspace and for every Reason account it is connected for. It stays
+                                 disconnected (reason "\u2026" won't connect it) until you run reason connect
+  reason disconnect NAME         Stop this computer's workers for machine NAME and remove them from Reason
+  --account                      Only the signed-in account's computer leaves Reason (all of it when it is
+                                 the only account here); it stays disconnected for that account until
+                                 its reason connect (the Reason app's Disconnect)
+  --temporary                    The Reason app's sign-out: only the signed-in account's computer leaves
+                                 Reason (all of it when it is the only account here), and it is not kept
+                                 disconnected: the next reason "\u2026" connects it again
+  --yes, -y                      Accepted for scripts; disconnect never asks
+`;class l extends Error{code;constructor($,J="worker_connect_refused"){super($);this.code=J}}var JG=4,o2={write:()=>!0};function g0($,J,Z=!1){let Q=v6($,J,Z);return Q.length===1?Q[0]:F0(A6(F0($,".config")),...m6(J,Z))}var m6=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function v6($,J,Z=!1){let Q=$;try{Q=X$($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...m6(J,Z))).filter(ZG)}function ZG($){try{if(X$($)!==$)return!1;return A0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var g6="disconnected.json";function TF($,J){return u(F0(g0($,J),g6))}function e2($,J,Z){let Q=F0(g0($,J),g6);if(!Z){M1(Q,{force:!0});return}e(w9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function QG($){let J=new Map,Z=new Set;for(let G=0;G<$.length;G+=1){let H=$[G];if(H==="--help"||H==="-h"||H==="help")return null;if(["--to","--token","--folder","--sessions",t2,r2,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(H)){let q=$[G+1];if(!q||q.startsWith("-"))throw new l(`Missing value after ${H}.`);if(J.has(H))throw new l(`${H} may be specified only once.`);J.set(H,q),G+=1;continue}if(["--once","--yes","-y","--minimal"].includes(H)){Z.add(H==="-y"?"--yes":H);continue}if(H.startsWith("-"))throw new l(`Unknown option: ${H}. Run \`reason connect --help\`.`);throw new l(`Unexpected argument: ${H}. To add this computer to a team machine, use --to ${H}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new l("--sessions takes a number from 1 to 4.");if(J.has(r2)&&!J.has(t2))throw new l("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new l("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((G)=>G!=="--yes")))throw new l("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((G)=>J.has(G));if(Y.length>0&&(J.size>1||[...Z].some((G)=>G!=="--yes")))throw new l(`Run reason connect ${Y[0]} PATH on its own.`);let V=J.get("--user-chrome");if(V!==void 0&&V!=="on"&&V!=="off")throw new l("--user-chrome takes on or off.");let N=J.get("--cloud-sessions");if(N!==void 0&&N!=="on"&&N!=="off")throw new l("--cloud-sessions takes on or off.");let B=J.get("--local-logins");if(B!==void 0&&B!=="on"&&B!=="off")throw new l("--local-logins takes on or off.");let U=J.get("--name")?.trim();if(U!==void 0&&(U.length===0||U.length>160))throw new l("--name takes a name of 1 to 160 characters.");let M=(G,H)=>H===void 0?{}:{[G]:H};return{...M("to",J.get("--to")),...M("token",J.get("--token")),...M("folder",J.get("--folder")),...M("sessions",Q===void 0?void 0:Number(Q)),...M("keepAwake",X===void 0?void 0:X==="on"),...M("userChrome",V===void 0?void 0:V==="on"),...M("cloudSessions",N===void 0?void 0:N==="on"),...M("localLogins",B===void 0?void 0:B==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...M("proxy",J.get(t2)),...M("proxyCaFile",J.get(r2)),...M("apiKey",J.get("--api-key")),...M("name",U),...M("apiUrl",J.get("--api-url")),...M("addFolder",J.get("--add-folder")),...M("removeFolder",J.get("--remove-folder"))}}var P$=($)=>u(d($).state),u6=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function d6($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function p6($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=i2($.options.cwd??process.cwd(),J.folder)}catch(N){throw new l(N instanceof Error?N.message:String(N))}if(!j1(Q,$.stateDirectory))throw new l(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?n1({REASON_API_URL:J.apiUrl},$.channel):Z&&!v1($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:n1($.environment,$.channel)}catch(N){throw new l(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${N instanceof Error?N.message:String(N)}`)}if(Z&&X!==Z.apiOrigin&&P0(X,Z.apiOrigin))X=Z.apiOrigin;if(!z6(X)&&!O6($.channel,X))throw new l(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=I6({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(N){if(!(N instanceof R6))throw N;throw new l(N.message)}let V=(Z?.folders??[]).filter((N)=>N!==Q);return J0.parse({...V.length?{folders:V}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??P9(($.options.hostname??rV)()),slots:J.sessions??Z?.slots??JG,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function l6($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function y9($,J,Z,Q,X){if($0($).revoked){if(P$($))try{w0($)}catch{}D3($);let N=[];try{N=tV(g($))}catch{}for(let B of N)if(B!=="workspaces")M1(F0(g($),B),{recursive:!0,force:!0})}else if(P$($))w0($);e($.stateDirectory,!0),c(J,$);let Y=XG(Z.stderr),V=await(Q.runWorker??q$)(["enroll","--config",J],{...k9(Q.worker,X),io:{stdout:o2,stderr:Y}});if(V!==0)Z.stderr.write(`Reason: this computer was not connected. (${Y.code()??"worker_command_failed"})
+`);return V}function XG($){let J=null;return{write:(Z)=>{for(let Q of Z.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))J=Q[1];return $.write(Z)},code:()=>J}}function t1($,J,Z){let Q=E6(X2(z1("REASON_CLI_CHANNEL",J),$));return Q&&P0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function YG($,J,Z,Q){let{config:X,configPath:Y}=G2($,J),V=(U)=>{try{return U!==null&&q1(U)&&o(U)?.orgId.toLowerCase()===J}catch{return!1}},N=null;try{N=A0(Y)}catch{}if(V(N))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let B=await y9(X,Y,Z,Q,void 0);if(B===0&&V(X))return 0;if(B===0&&P$(X))await $3(X,Y,Z,Q);if(M1(X.stateDirectory,{recursive:!0,force:!0}),B!==0)return B;throw new l("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function k9($,J){return J?{...$,enrollmentCredentials:(Z)=>K3(Z,J)}:{...$}}async function h9($,J,Z,Q,X,Y="connect"){if(await f9($,Q,X,Y),Y==="connect"&&!await t6($,Z,Q))return!1;if(!await $3($,J,Z,Q))return!1;return a9($.stateDirectory),M1($.stateDirectory,{recursive:!0,force:!0}),!0}async function $3($,J,Z,Q){if(!P$($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??q$)(["revoke","--config",J],{...Q.worker,io:{stdout:o2,stderr:Y?Z.stderr:o2}})===0)return!0;if(Y)return!1;await new Promise((N)=>setTimeout(N,1000))}}async function f9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??K0,V=async()=>Y($,"status").catch(()=>null),N=await Y($,"stop").catch(()=>null)!==null,B=!X&&a2($,Z,Q);if(N||B){let U=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<U&&await V()!==null)await new Promise((M)=>setTimeout(M,250))}}function m9($,J){return J==="darwin"&&$.userChrome!==!1}function E9($,J,Z){let Q=[...m9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${d6($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
+`)}function x9($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),"  Sessions:  every Session you start",`  Mode:      ${d6(J)}`,...J.proxy?[`  Proxy:     ${P6(J.proxy)}`]:[],...m9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
+`)}async function j6($,J,Z){let{io:Q,options:X}=Z;if(v6(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:w9(J),timestamp:new Date().toISOString()})}
+`);let Y=q2(F0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
+`);T9(Z.home,Z.host.platform);let V=P4({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(q)=>Q.stderr.write(`${q}
+`),host:Z.host}),N=_4({...V,log:(q)=>Q.stderr.write(`${q}
+`)}),{configPath:B}=N,U=N.saved;if(!U)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let M=(q,T)=>{let L=Z3(Z.home,Z.channel),j;try{let O=null;try{O=T.keep?null:o(U)?.orgId.toLowerCase()??null}catch{}if(j=K2(U,{prefer:t1(Z.home,Z.channel,U),...T}),j&&O)B2(j,O)}finally{L()}if(!j)return!1;U=j;let W="";try{W=` (workspace ${o(j)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${q}; this computer goes on running Sessions for its other Reason account${W}.
+`),!0};if($0(U).revoked&&!M("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(U.executionMode==="confined"||!q1(U)){let q=d0(U.stateDirectory)??void 0,T=q?null:t1(Z.home,Z.channel,U);if(!q&&!(T&&A1(U,T)))M("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let G=U.executionMode==="confined";if(G||!q1(U)){let q=d0(U.stateDirectory)??void 0;if(Q.stderr.write(G?u6:`Reason: this computer's connection expired; renewing it with ${q?"its API key":"your login"}\u2026
+`),await y9(J0.parse({...U,executionMode:"host"}),B,Q,X,q)!==0)return Q.stderr.write(q?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let H=new AbortController;if(!X.runWorker)import("./ask-relay-fkb3bj30.js").then(({runBackgroundAskRelay:q})=>q(H.signal,(T)=>Q.stderr.write(`${T}
+`))).catch(()=>{});try{for(;;){let q=d0(U.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:l2({stateDirectory:U.stateDirectory}),L=!1,j;try{j=await(X.runWorker??q$)(["start","--config",B],{deferOptionalLanes:!0,...X.worker,...q,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{L=!0}})}finally{T?.stop()}if(!L)return j;if(!M("this computer's connection was removed from Reason",{keep:!1}))break}return e2(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{H.abort()}}async function VG($,J,Z){let{io:Q,options:X,home:Y,channel:V,environment:N}=Z;if(J&&await(X.controlWorker??K0)(J,"status").catch(()=>null))throw new l("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let B=g0(Y,V,!0),U=p6({parsed:$,saved:J,stateDirectory:B,lifetime:"ephemeral",home:Y,channel:V,options:X,environment:N}),M=l6(U,Z.apiKey??(J?d0(J.stateDirectory)??void 0:void 0)),G=F0(B,"worker.json");return e(B,!0),c(G,M),Q.stdout.write(x9(`Reason: connecting "${M.name}" while this command runs`,M,Z.host.platform,["Connecting\u2026"])),(X.runWorker??q$)(["start","--config",G],{...k9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:n2(Q.stderr)},onStartup:(H)=>{if(H==="ready")Q.stdout.write(`Connected. Start Sessions on "${M.name}" from Reason. Press Ctrl-C to stop.
+`);X.worker?.onStartup?.(H)}})}function GG($,J,Z,Q){if(Z.platform!=="darwin")throw new l("--keep-awake is for macOS.");if(!J)throw new l("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),x4(d(J).daemon,$);let X=M2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
+`),0}var BG=K.object({root:K.object({id:K.string().min(1).max(160),label:K.string().max(160),path_fingerprint:K.string()})});async function c6($,J,Z,Q){let X=await(k9(Q.worker,Z).enrollmentCredentials??j$)($,_$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new A$(X,{credentialsPath:_$($),fetchImpl:S0($.proxy)}),V=(N)=>N instanceof m0&&N.status===404&&!["device_not_found","root_not_found"].includes(N.code);return{add:async(N)=>{let B=V4($,N,{...J.roots[0].permissions,expose_mcp:!1}),U=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:B.pathFingerprint,label:B.label,permissions:{...B.permissions,expose_mcp:!1}}).catch((G)=>{if(V(G))throw Error("worker_folders_unavailable");if(G instanceof m0&&G.code==="root_limit_reached")throw new l("This computer already has the most folders Reason allows (32).");throw G}),M=BG.parse(U).root;if(M.path_fingerprint!==B.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...B,id:M.id,label:M.label}},remove:async(N)=>{await Y.removeDeviceRoot(J.deviceId,N).catch((B)=>{if(V(B))throw Error("worker_folders_unavailable");if(!(B instanceof m0&&B.code==="root_not_found"))throw B})}}}function s6($,J,Z){k0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:N0($)}},d($).state,{proofStore:T0($)})}async function a6($,J,Z,Q){let{io:X,options:Y,host:V}=Q,N=J&&!Q.apiKey&&d0(J.stateDirectory)===null?t1(Q.home,Q.channel,J):null,B=J&&N&&P$(J)&&!A1(J,N)?y0(J).find((P)=>P.account&&P.organizationId===N)??null:void 0;if(B===null)throw new l("This computer is not connected for your account. Run reason connect first.");let U=B?B.config:J,M=B?B.configPath:Z,G=U&&P$(U)&&!$0(U).revoked?o(U):null;if(!J||!U||!G||U.lifetime!=="persistent")throw new l("This computer is not connected to Reason. Run reason connect first.");let H=$.addFolder!==void 0,q=H?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),L;try{L=i2(T,q)}catch(P){if(H)throw new l(P instanceof Error?P.message:String(P));L=oV(T,q)}if(L===U.workspaceRoot)throw new l(`${L} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let j=U.folders??[],W=G.roots.slice(1).find((P)=>P.path===L);if(!H&&!W&&!j.includes(L))throw new l(`${L} is not one of this computer's folders.`);if(H&&!j1(L,U.stateDirectory))throw new l(`${L} holds Reason's own settings.`);if(H&&!W&&j.length>=31)throw new l("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??d0(U.stateDirectory)??void 0,F=await c6(U,G,O,Y),z=G.roots.filter((P)=>P.path!==L);if(H)z=[...z,await F.add(L)];else if(W)await F.remove(W.id);s6(U,G,z);let _=H?[...j.filter((P)=>P!==L),L]:j.filter((P)=>P!==L),{folders:D,...R}=U;if(c(M,J0.parse({...R,..._.length?{folders:_}:{}})),!await(Y.controlWorker??K0)(J,"reload_roots").then(()=>!0,()=>!1))M$(J,V,"connect");return X.stdout.write(H?`Added ${L}. Sessions on "${U.name}" may run in it.
+`:`Removed ${L}. Sessions on "${U.name}" no longer run in it.
+`),0}async function LF($,J,Z){let Q=S9(Z),X=Z3(Q.home,Q.channel);try{let Y=F0(g0(Q.home,Q.channel),"worker.json");return await a6({once:!1,yes:J,addFolder:$},A0(Y),Y,Q)===0}finally{X()}}function S9($,J){let Z=X$($.home??H0()),Q=$.env??process.env;return{io:$.io??J3(),options:$,home:Z,channel:$.channel??Z$(),environment:Q,apiKey:J??x6(Q),host:$.serviceHost??Q$(Z)}}async function KG($,J,Z,Q){let X=o($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let V=await c6($,X,Z,Q),N=Y.find((B)=>B.path===J.workspaceRoot)??await V.add(J.workspaceRoot);await V.remove(Y[0].id),Y=[N,...Y.slice(1).filter((B)=>B.id!==N.id)]}s6(J,X,Y)}var i6=Symbol("serve here");async function NG($,J,Z,Q){let{io:X,options:Y,home:V,channel:N,environment:B,host:U}=Q;if(U.platform==="darwin"){let C=_6(V);if(C.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${C.code}).
+`)}let M=J&&!Q.apiKey&&d0(J.stateDirectory)===null?t1(V,N,J):null,G=J&&M&&$0(J).revoked&&y0(J).some((C)=>C.account&&C.organizationId===M)?K2(J,{prefer:M,keep:!1})??J:J,H=p6({parsed:$,saved:G,stateDirectory:g0(V,N),lifetime:"persistent",home:V,channel:N,options:Y,environment:B});if(e2(V,N,!1),G?.executionMode==="confined")X.stdout.write(u6);let q=G?d0(G.stateDirectory):null,T=l6(H,Q.apiKey??q??void 0),L=U1(U,B),j=G!==null&&P$(G),W=j&&N0(G)===N0(T),O=W&&q1(T),F=G?.userChrome!==!1===(T.userChrome!==!1)&&G?.cloudSessions===T.cloudSessions&&G?.localLogins===T.localLogins,z=Q.apiKey??q??void 0,_=M!==null&&j&&!$0(G).revoked&&!A1(G,M);if(_){if(!W||!F||JSON.stringify(G.proxy)!==JSON.stringify(T.proxy))throw new l("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let C=await YG(G,M,X,Y);if(C!==0)return C}let D=_?[`  Account:   yours too, in workspace ${M}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===q)return;await K3(T,$.apiKey),B3(T.stateDirectory,$.apiKey)},E=B.PATH||"/usr/local/bin:/usr/bin:/bin",P=O&&JSON.stringify(G?.proxy)===JSON.stringify(T.proxy)&&F?H1(T,U,"connect"):null,I=P?.label===S6(T.channel),f=I&&await(Y.controlWorker??K0)(T,"status").catch(()=>null)!==null,S=I&&!f&&b9(P,U)&&y6({config:T,launcher:L,path:E,host:U,kind:"connect"});if((f||S)&&[null,r].includes(P1(T))){await R();let C=w6(T,U,"connect");if(C==="retired"){let x=S?null:await(Y.controlWorker??K0)(T,"status").catch(()=>null);if(!S&&(!x||x.phase==="stopping"))M$(T,U,"connect")}else if(C==="current_not_running")M$(T,U,"connect");return await(Y.controlWorker??K0)(T,"reload_roots").catch(()=>null),X.stdout.write(B.REASON_INSTALLER==="1"?E9(T,U.platform,D):x9("This computer is connected to Reason",T,U.platform,[...D,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let k=!O&&!_;if(j&&!W)if(G.apiOrigin!==T.apiOrigin||G.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),!await h9(G,Z,X,Y,U))throw new l("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(G.executionMode==="host"&&q1(G))X.stdout.write(`Applying the new settings to this computer\u2026
+`),await KG(G,T,z,Y),k=!1;else await f9(G,Y,U);if(k){if(B.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
+`);let C=await y9(T,Z,X,Y,z);if(C!==0)return C;if(z)B3(T.stateDirectory,z)}else c(Z,T),await R();let p;try{p=s2({config:T,launcher:L,path:E,host:U,kind:"connect"})}catch(C){if(!(C instanceof R$))throw C;if(C.code!=="worker_service_manager_missing")throw new l(`${C.message}
+This computer is set up; run reason connect again to start it.`,C.code??"worker_service_start_failed");if(Y.serveHere&&B.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
+`),i6;if(Y.serveHere&&B.REASON_INSTALLER==="1"&&await UG(T,L,B,Y))return X.stdout.write(E9(T,U.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${L} connect under a process manager)`])),0;throw new R$(`${C.message}
+This computer is set up. Keep it connected by running ${L} connect in a terminal or under this box's process manager.`,C.code)}let w=[...D,...p.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...p.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${p.identityProblem}).`]:[]];return X.stdout.write(B.REASON_INSTALLER==="1"?E9(T,U.platform,w):x9("This computer is connected to Reason",T,U.platform,[`  Service:   ${p.label} (starts at ${p.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${p.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...w])),0}async function UG($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??n6)(J,Y,F0($.stateDirectory,"connect.log"));for(let V=0;V<60;V+=1)if(await new Promise((N)=>setTimeout(N,500)),await(Q.controlWorker??K0)($,"status").catch(()=>null))return!0;return!1}function n6($,J,Z){let Q=f6(Z,"a",384);try{let X=k6($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{h6(Q)}}async function t6($,J,Z,Q=!1){let X=!0;for(let Y of y0($)){if(Q&&Y.account)continue;if(Y.config&&P$(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??q$)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:o2,stderr:J.stderr}})!==0){X=!1;continue}}M1(Y.directory,{recursive:!0,force:!0})}return X}function J3(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function v9($,J){if($ instanceof l||$ instanceof R$)return J.stderr.write(`Reason: ${$.message} (${$.code??"worker_service_failed"})
+`),2;let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:qG($);return J.stderr.write(`Reason: ${e$(Z)??"could not connect this computer."} (${Z})
+`),1}var HG=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]);function qG($){if($ instanceof m0)return $.status>=500?"worker_api_unavailable":"worker_api_refused";let J=$?.code;if(typeof J==="string"&&HG.has(J))return`worker_file_${J.toLowerCase()}`;return"worker_connect_unexpected"}function D6($,J){if($.minimal){o6({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||e6({home:J.home})!=="install")return;let Z;try{Z=U1(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??W6)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
+`);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
+`);let Q=(J.options.installDesktop??W6)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
+`)}function W6($,J,Z){if(!Z)return iV($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;nV(w9(Z.log),{recursive:!0,mode:448});let Q=f6(Z.log,"w",384);try{let X=k6($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{h6(Q)}return 0}async function FF($,J={}){let Z=J.io??J3();try{let Q=QG($);if(!Q)return Z.stdout.write(eV),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new l("A machine's workers run one Session at a time; --sessions does not apply to them.");if(Q.proxy!==void 0)throw new l("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new l("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new l("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new l("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[U,M]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(M!==void 0)throw new l(`${U} is for your own computer; reason serve sets up a machine's workers.`);return D6(Q,S9(J)),await(J.runServe??T6)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=S9(J,Q.apiKey),{channel:Y,environment:V}=X;if(!J.env)for(let U of["REASON_API_KEY","ARA_API_KEY"])delete process.env[U];if(Q.userChrome&&X.host.platform!=="darwin")throw new l("--user-chrome is for a Mac.");let N=b6(V[p$],Y),B=N||Q.once?()=>{return}:Z3(X.home,Y);try{let U=F0(g0(X.home,Y),"worker.json"),M=A0(U);if(N)return await j6(M,U,X);if(Q.keepAwake!==void 0)return GG(Q.keepAwake,M,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await a6(Q,M,U,X);if(D6(Q,X),Q.once)return await VG(Q,M,X);let G=await NG(Q,M,U,X);if(G!==i6)return G;return B(),B=()=>{return},await j6(A0(U),U,X)}finally{B()}}catch(Q){return v9(Q,Z)}}async function _F($,J={}){let Z=J.io??J3();try{if($.some((V)=>["--help","-h","help"].includes(V)))return Z.stdout.write($G),0;let Q=$.filter((V)=>!["--yes","-y","--temporary","--account"].includes(V)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new l("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await LG(Q[0],Z,J);return await r6(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return v9(Q,Z)}}async function jF($={}){let J=$.io??J3();try{return await r6(J,$,"logout")}catch(Z){return v9(Z,J)}}async function r6($,J,Z){let Q=X$(J.home??H0()),X=J.channel??Z$(),Y=Z3(Q,X);try{return await MG($,J,Z,Q,X)}finally{Y()}}function Z3($,J){let Z=g0($,J),Q=u(Z)?r$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new l("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function MG($,J,Z,Q,X){let Y=F0(g0(Q,X),"worker.json"),V=A0(Y);if(!V){if(Z==="disconnect")e2(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(Z!=="disconnect"){let B=await TG(V,Y,$,J,Z,Q,X);if(B!==null)return B}let N=!1;try{N=await h9(V,Y,$,J,J.serviceHost??Q$(Q))}finally{if(Z!=="temporary")e2(Q,X,!0)}if(!N)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`),1;return $.stdout.write(`Disconnected "${V.name}". It no longer runs Sessions; run reason connect to connect it again.
+`),0}async function TG($,J,Z,Q,X,Y,V){let N=y0($).filter((j)=>j.account);if(N.length===0)return null;let B=t1(Y,V,$),U=Q.controlWorker??K0,M=N.find((j)=>j.organizationId===B);if(M){if(M.config&&!await $3(M.config,M.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),1;if(X!=="account"||!M.config)M1(M.directory,{recursive:!0,force:!0});return await U($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${B} for your account. It stays connected for its other Reason accounts.
+`),0}if(!B&&X==="account")throw new l("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!B||!A1($,B)){if(X==="account"&&B)B2($,B);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
+`);return 0}let G=Q.serviceHost??Q$(Y),H=null;try{H=o($)?.orgId.toLowerCase()??null}catch{}if(await f9($,Q,G,"connect",!0),!await t6($,Z,Q,!0)||!await $3($,J,Z,Q))return M$($,G,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`),1;let q=K2($,{prefer:null,keep:!1});if(!q)return null;if(X==="account"&&H)B2(q,H);let T=M$(q,G,"connect")!==null,L="";try{L=` in workspace ${o(q)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${L}${T?"":"; run reason connect to start it again"}.
+`),0}async function LG($,J,Z){let Q=X$(Z.home??H0()),X=Z.serviceHost??Q$(Q),Y=I9(Q,$);if(Y.length===0)throw new l(`No worker for machine "${$}" on this computer.`);let V=!1;for(let N of Y)if(await h9(N.config,N.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${N.config.workspaceRoot}.
+`);else V=!0,J.stderr.write(`Reason: machine "${$}" in ${N.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
+`);return V?1:0}async function DF($={}){let J=X$($.home??H0()),Z=A0(F0(g0(J,$.channel??Z$()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??K0)(Z,"status").catch((q)=>{return Q=q instanceof Error?q:Error(String(q)),null}),Y=X?P1(Z):null,V=$.serviceHost??Q$(J),N=H1(Z,V,"connect"),B=$0(Z).revoked,U=!B&&!X,M=(()=>{try{return o(Z)}catch{return null}})(),{workspaces:G,off:H}=B||d0(Z.stateDirectory)!==null?{workspaces:null,off:null}:M4(Z,X?.phase==="running");return{workspaces:G,workspaces_off:H,workspaces_max:Y2+(G?.filter((q)=>q.account).length??0),name:Z.name,device_id:M?.deviceId??null,organization_id:M?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:null,user_chrome:m9(Z,V.platform),cloud_sessions:Z.cloudSessions===!0,root:M?.roots[0]?{id:M.roots[0].id,permissions:M.roots[0].permissions}:null,roots:M?.roots.map((q)=>({id:q.id,folder:q.path,permissions:q.permissions}))??[],state:B?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:U?g4(Z,Q):null,worker_alive:U&&N?b9(N,V):null,sessions_running:X?.activeSessions??null,version:Y,service:N?{label:N.label,logs:N.logs}:null}}async function WF($,J,Z=K0){let Q={version:1,status:"unavailable"},X=A0(F0(g0(X$($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?C6({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function OF($={}){try{let J=X$($.home??H0());return A0(F0(g0(J,$.channel??Z$()),"worker.json"))?.userChrome!==!1}catch{return!1}}function zF($={}){let J=X$($.home??H0()),Z=A0(F0(g0(J,$.channel??Z$()),"worker.json"));if(!Z)return null;return M$(Z,$.serviceHost??Q$(J),"connect")?.label??null}async function AF($={}){let J=X$($.home??H0()),Z=A0(F0(g0(J,$.channel??Z$()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??Q$(J),X=await M6(Z,Q,"connect",$.current);if(X!==null||H1(Z,Q,"connect"))return X;return FG(Z,Q,$)}async function FG($,J,Z){let Q=Z.controlWorker??K0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&P1($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let V;try{V=U1(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await Q($,"status").catch(()=>null)!==null)await new Promise((G)=>setTimeout(G,250));let{REASON_INSTALLER:B,REASON_DESKTOP_BACKGROUND:U,...M}=Z.env??process.env;return(Z.startConnection??n6)(V,M,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
+export{d as a,o as b,M2 as c,A0 as d,eV as e,$G as f,g0 as g,TF as h,LF as i,FF as j,_F as k,jF as l,DF as m,WF as n,OF as o,zF as p,AF as q};