@reason-machines/cli-linux-arm64-musl 0.2.371 → 0.2.372

package/bin/vm-hands/{vm-hands-entry-lite-ymwv38dd.js → vm-hands-entry-lite-70xn5vnc.js}

@@ -1,14 +1,14 @@
 // @bun
-import{Ac as kQ,Bc as fQ,Cc as z4,Dc as K4,Ec as F8}from"./vm-hands-entry-lite-mcv6pse6.js";import{Fc as MQ,Gc as G8,Hc as n9,Ic as _0,Jc as L9,Kc as n0,Rc as K0}from"./vm-hands-entry-lite-dq1fdx0j.js";import{Ve as w9,We as o0,Xe as B8,Ye as m0,af as q0,le as $Q,qe as QQ}from"./vm-hands-entry-lite-2fyemnas.js";import{pg as hQ,vg as a9,wg as m8}from"./vm-hands-entry-lite-vygp7vq8.js";import{Bg as Y4}from"./vm-hands-entry-lite-y9wkxydj.js";import{Dg as OZ,Gg as B9,Pg as ZQ,Qg as XQ,Sg as JQ,Ug as p9,Vg as n$,Wg as i$,Xg as E8,_g as u9,hh as R8,ih as S0,jh as O0,kh as l9,rh as b8,sh as YQ,th as a$}from"./vm-hands-entry-lite-dm52srp5.js";import{ci as cQ,di as h8}from"./vm-hands-entry-lite-gzyps3ev.js";import{Ei as b0}from"./vm-hands-entry-lite-rjwk6sfj.js";import{Wi as M8,Xi as s9,_i as J4}from"./vm-hands-entry-lite-9fr904x2.js";import{$i as L8,aj as i0,bj as N8,cj as a0,dj as H9,ej as Y8,fj as $$,gj as s0,hj as p0,ij as s$,tj as B$}from"./vm-hands-entry-lite-db4z7ekz.js";import{yj as UZ}from"./vm-hands-entry-lite-gbzvzfe6.js";import{Tj as x}from"./vm-hands-entry-lite-zmf1terc.js";import{Zj as G4}from"./vm-hands-entry-lite-ngytzkx1.js";import{$j as C}from"./vm-hands-entry-lite-y3wncwjd.js";import{ak as P1,fk as VZ}from"./vm-hands-entry-lite-7fx4xtf6.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function v9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function P0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function S$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function w$($,Q){let Z=Buffer.from($,"latin1");return Buffer.concat([Buffer.from([Z.length]),Z,Q])}function I0($){if(!v9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(S$)||!P0($.attachmentRevision,0)||!P0($.grantRevision,1)||!P0($.generation,1)||!P0($.port,1024,65535)||!P0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function c0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function q9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function E$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function C9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function b$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function k$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!v9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello")return{type:"hello",binding:I0(Q.binding),...P0(Q.messages,v.chunk,v.upload)?{messages:Q.messages}:{},...P0(Q.window,1,v.window)?{window:Q.window}:{},...Q.bytes===!0?{bytes:!0}:{}};if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:I0(Q.binding),reason:Q.reason};if(!S$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return C9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&P0(Q.status,200,599)&&E$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&E$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return C9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:q9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function _8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((Y)=>Y.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function A8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function T9($){return await A8($)===!0}function c9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function f$($){if(!v9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:I0($.binding),deviceRelayUrl:c9($.deviceRelayUrl,"device")}}function m$($){if(!v9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:I0($.binding)}}import{request as D4}from"http";import{pipeline as _4}from"stream";import{constants as x8,createBrotliCompress as A4,createGzip as x4}from"zlib";import{WebSocket as O9}from"ws";import{randomBytes as q4,timingSafeEqual as T4}from"crypto";import{createServer as O4}from"net";var g$="x-preview-connection";async function y$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=q4(32).toString("base64url"),X=new Set,J=!1,Y=O4((G)=>{if(J||Q.aborted||X.size>=v.streams*2)return G.destroy();X.add(G);let F=new AbortController;G.once("close",()=>{X.delete(G),F.abort()}),G.on("error",()=>G.destroy()),G.setTimeout(2000,()=>G.destroy());let B=Buffer.alloc(0),H=(L)=>{B=Buffer.concat([B,L]);let W=B.indexOf(`\r
+import{Ac as kQ,Bc as fQ,Cc as z4,Dc as K4,Ec as H8}from"./vm-hands-entry-lite-sb9a1jcn.js";import{Fc as MQ,Gc as z8,Hc as i9,Ic as _0,Jc as M9,Kc as i0,Rc as K0}from"./vm-hands-entry-lite-anmv8hp7.js";import{Xe as k9,Ye as r0,Ze as L8,_e as m0,cf as q0,le as $Q,qe as QQ}from"./vm-hands-entry-lite-zfwg7ehq.js";import{rg as hQ,xg as a9,yg as g8}from"./vm-hands-entry-lite-dgxxsdwb.js";import{Dg as Y4}from"./vm-hands-entry-lite-zh8p7ndn.js";import{Fg as OZ,Ig as N9,Rg as ZQ,Sg as XQ,Ug as JQ,Wg as l9,Xg as n$,Yg as i$,Zg as S8,ah as u9,jh as E8,kh as S0,lh as O0,mh as s9,th as k8,uh as YQ,vh as o$}from"./vm-hands-entry-lite-za55dtte.js";import{ei as cQ,fi as v8}from"./vm-hands-entry-lite-5kgvss4p.js";import{Gi as b0}from"./vm-hands-entry-lite-4m40gwkf.js";import{Yi as j8,Zi as n9,aj as J4}from"./vm-hands-entry-lite-c01eyep6.js";import{bj as N8,cj as o0,dj as M8,ej as a0,fj as W9,gj as G8,hj as Q$,ij as n0,jj as l0,kj as s$,vj as L$}from"./vm-hands-entry-lite-9cgm6g8t.js";import{Aj as UZ}from"./vm-hands-entry-lite-mrms7y4e.js";import{Vj as x}from"./vm-hands-entry-lite-hc3p6r9p.js";import{$j as G4}from"./vm-hands-entry-lite-bvbfcp1k.js";import{bk as C}from"./vm-hands-entry-lite-j2q1k9vb.js";import{ck as P1,hk as VZ}from"./vm-hands-entry-lite-g036gtem.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000,window:8};function c9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function P0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function S$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function w$($,Q){let Z=Buffer.from($,"latin1");return Buffer.concat([Buffer.from([Z.length]),Z,Q])}function I0($){if(!c9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(S$)||!P0($.attachmentRevision,0)||!P0($.grantRevision,1)||!P0($.generation,1)||!P0($.port,1024,65535)||!P0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function d0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function O9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function E$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function T9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function b$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function k$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!c9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello")return{type:"hello",binding:I0(Q.binding),...P0(Q.messages,v.chunk,v.upload)?{messages:Q.messages}:{},...P0(Q.window,1,v.window)?{window:Q.window}:{},...Q.bytes===!0?{bytes:!0}:{}};if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:I0(Q.binding),reason:Q.reason};if(!S$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return T9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&P0(Q.status,200,599)&&E$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&E$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return T9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:O9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function A8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((Y)=>Y.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function x8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function D9($){return await x8($)===!0}function d9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function f$($){if(!c9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:I0($.binding),deviceRelayUrl:d9($.deviceRelayUrl,"device")}}function m$($){if(!c9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:I0($.binding)}}import{request as D4}from"http";import{pipeline as _4}from"stream";import{constants as P8,createBrotliCompress as A4,createGzip as x4}from"zlib";import{WebSocket as _9}from"ws";import{randomBytes as q4,timingSafeEqual as T4}from"crypto";import{createServer as O4}from"net";var g$="x-preview-connection";async function y$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=q4(32).toString("base64url"),X=new Set,J=!1,Y=O4((G)=>{if(J||Q.aborted||X.size>=v.streams*2)return G.destroy();X.add(G);let F=new AbortController;G.once("close",()=>{X.delete(G),F.abort()}),G.on("error",()=>G.destroy()),G.setTimeout(2000,()=>G.destroy());let B=Buffer.alloc(0),H=(L)=>{B=Buffer.concat([B,L]);let W=B.indexOf(`\r
 \r
 `);if(W<0){if(B.length>16384)G.destroy();return}if(G.pause(),G.off("data",H),W>16384||B.length>v.upload+16384)return G.destroy();z(B,W).catch(()=>G.destroy())};G.on("data",H);async function z(L,W){let U=L.subarray(0,W).toString("latin1").split(`\r
-`),j=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(U.shift()??"");if(!j)throw Error("preview_request_invalid");q9(j[2]);let O=!1,q=0,A=[];for(let T of U){let S=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!S)throw Error("preview_header_invalid");if(S[1].toLowerCase()===g$){q++;let m=Buffer.from(S[2].trim());O=m.length===Z.length&&T4(m,Buffer.from(Z))}else if(S[1].toLowerCase()!=="host")A.push(T)}if(!O||q!==1||J||F.signal.aborted)throw Error("preview_connection_denied");let R=await $.connect(F.signal);if(J||F.signal.aborted)throw R.destroy(),Error("preview_closed");X.add(R),R.on("error",()=>G.destroy()),R.once("close",()=>{X.delete(R),G.destroy()}),G.once("close",()=>R.destroy()),G.setTimeout(0);let P=[`${j[1]} ${j[2]} HTTP/1.1`,`Host: 127.0.0.1:${R.remotePort}`,...A,"",""].join(`\r
+`),j=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(U.shift()??"");if(!j)throw Error("preview_request_invalid");O9(j[2]);let O=!1,q=0,A=[];for(let T of U){let S=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!S)throw Error("preview_header_invalid");if(S[1].toLowerCase()===g$){q++;let m=Buffer.from(S[2].trim());O=m.length===Z.length&&T4(m,Buffer.from(Z))}else if(S[1].toLowerCase()!=="host")A.push(T)}if(!O||q!==1||J||F.signal.aborted)throw Error("preview_connection_denied");let R=await $.connect(F.signal);if(J||F.signal.aborted)throw R.destroy(),Error("preview_closed");X.add(R),R.on("error",()=>G.destroy()),R.once("close",()=>{X.delete(R),G.destroy()}),G.once("close",()=>R.destroy()),G.setTimeout(0);let P=[`${j[1]} ${j[2]} HTTP/1.1`,`Host: 127.0.0.1:${R.remotePort}`,...A,"",""].join(`\r
 `);R.write(Buffer.concat([Buffer.from(P,"latin1"),L.subarray(W+4)])),R.pipe(G),G.pipe(R),G.resume()}});await new Promise((G,F)=>{Y.once("error",F),Y.listen(0,"127.0.0.1",G)});let K=Y.address();if(!K||typeof K==="string")throw Y.close(),Error("preview_bind_failed");function V(){if(J)return;J=!0,Q.removeEventListener("abort",V);for(let G of X)G.destroy();X.clear(),Y.close()}if(Q.addEventListener("abort",V,{once:!0}),Q.aborted)V();return{port:K.port,headers:{[g$]:Z},close:V}}var P4=60000,I4=1e4,R4=5000,E4=/^(?:text\/(?!event-stream)|application\/(?:(?:x-)?javascript|json|[a-z.+-]*\+json|xml|[a-z.+-]*\+xml|wasm)|image\/svg\+xml)/i;function S4($,Q,Z,X){let J=(G)=>Q.find(([F])=>F.toLowerCase()===G)?.[1],Y=(G)=>X.find(([F])=>F.toLowerCase()===G)?.[1],K=Number(Y("content-length")??Number.NaN);if($!=="GET"||Z!==200||J("range")!==void 0||Y("content-encoding")!==void 0||!E4.test(Y("content-type")??"")||/\bno-transform\b/i.test(Y("cache-control")??"")||K<1024)return null;let V=(G)=>new RegExp(`(?:^|,)\\s*${G}\\s*(?:,|$|;\\s*q=(?:1|0?\\.0*[1-9]))`,"i").test(J("accept-encoding")??"");return V("br")?"br":V("gzip")?"gzip":null}function w4($,Q){let Z=$.filter(([X])=>X.toLowerCase()==="vary").map(([,X])=>X).join(", ");return[...$.filter(([X])=>!["vary","etag","content-md5"].includes(X.toLowerCase())),...$.filter(([X])=>X.toLowerCase()==="etag").map(([X,J])=>[X,J.startsWith("W/")?J:`W/${J}`]),["Content-Encoding",Q],["Vary",Z.split(",").some((X)=>/^\s*(?:accept-encoding|\*)\s*$/i.test(X))?Z:Z?`${Z}, Accept-Encoding`:"Accept-Encoding"]]}async function b4($){process.stderr.write(`${JSON.stringify({event:"worker_preview.open_refused",job_id:$.jobId,port:$.port,reason_code:$.reason})}
-`);let Q=$.binding,Z;try{Z=c9($.deviceRelayUrl,"device")}catch{return}if(!Q)return;await new Promise((X)=>{let J=new O9(Z,{followRedirects:!1,perMessageDeflate:!1,maxPayload:4096}),Y=setTimeout(()=>{J.terminate(),X()},v.authorizationMs*2);J.addEventListener("open",()=>{J.send(JSON.stringify({type:"refused",binding:Q,reason:$.reason})),J.close(1000,`worker_refused_${$.reason}`)}),J.addEventListener("error",()=>{clearTimeout(Y),X()}),J.addEventListener("close",()=>{clearTimeout(Y),X()})})}async function k4($,Q){let Z=Date.now()+I4,X;for(;;){if(!Q())return"closed";let J=X??=$.refusal().finally(()=>{X=void 0}),Y,K=await Promise.race([J.catch(()=>"port_unproved"),new Promise((V)=>{Y=setTimeout(()=>V("port_check_timeout"),v.authorizationMs)})]).finally(()=>clearTimeout(Y));if(K===null)return null;if(!["listener_unproved","port_check_timeout"].includes(K)||Date.now()+500>=Z)return K;await new Promise((V)=>setTimeout(V,500))}}async function h$($){let Q=I0($.binding),Z=()=>!$.signal.aborted&&Date.now()<Q.expiresAtMs,X=Q.expiresAtMs>Date.now()+v.lifetimeMs+R4?"binding_mismatch":await k4($.port,Z);if(X)throw await b4({deviceRelayUrl:$.deviceRelayUrl,binding:Q,jobId:Q.jobId,port:Q.port,reason:X}),Error("preview_not_authorized",{cause:X});let J=c9($.deviceRelayUrl,"device"),Y=await y$($.port,$.signal),K;try{K=new O9(J,{followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload*1.4+300000})}catch(N){throw Y.close(),N}let V=new Map,G=!1,F=!1,B=0,H=!1,z,L,W,U=new Promise((N)=>{W=N}),j,O,q=new Promise((N,M)=>{j=N,O=M}),A=!1,R=(N)=>{let M=Buffer.isBuffer(N)?N:JSON.stringify(N);if(B+=Buffer.byteLength(M),!Z()||F||K.readyState!==O9.OPEN)return P(Z()?"relay_closed":"expired");if(K.bufferedAmount>v.relayBuffered)return P("relay_backlog");if(B>v.total)return P("quota");K.send(M)};function P(N="closed"){if(F)return;F=!0,clearInterval(m),clearTimeout(S),$.signal.removeEventListener("abort",T);for(let M of V.values())M.stop();V.clear(),Y.close(),K.close(1000,`worker_${N}`),O(Error("preview_closed")),W()}let T=()=>P("aborted"),S=setTimeout(()=>P("pair_timeout"),v.requestMs),m=setInterval(async()=>{if(!Z())return P($.signal.aborted?"aborted":"expired");if(H)return;H=!0;try{let N=z??=Promise.resolve().then(()=>$.port.check()).finally(()=>{z=void 0}),M=await A8(()=>N);if(M===!1)return P("port_refused");if(M){L=void 0;return}if(Date.now()-(L??=Date.now())>P4)return P("port_unknown");for(let D of V.values())D.stop()}finally{H=!1}},1000);if($.signal.addEventListener("abort",T,{once:!0}),!Z())P($.signal.aborted?"aborted":"expired");K.addEventListener("open",()=>R({type:"hello",binding:Q,messages:v.upload,window:v.window})),K.addEventListener("close",()=>P("relay_closed")),K.addEventListener("error",()=>P("relay_error")),K.addEventListener("message",(N)=>{try{if(!Z()||F)return P($.signal.aborted?"aborted":"expired");if(typeof N.data!=="string")throw Error("preview_frame_invalid");if(B+=Buffer.byteLength(N.data),B>v.total)return P("quota");let M=k$(N.data);if(!G){if(M.type!=="hello"||!c0(Q,M.binding))return P("binding_mismatch");G=!0,A=M.bytes===!0,clearTimeout(S),j();return}if(M.type==="hello"||M.type==="refused")return P("invalid_frame");if(M.type==="request"){E(M).catch(()=>P("invalid_request"));return}let D=V.get(M.id);if(!D)return;if(M.type==="cancel"||M.type==="end")D.stop();else if(M.type==="credit"&&D.credit)D.credit();else if(M.type==="data"&&D.ws){if(D.ws.readyState!==O9.OPEN||D.ws.bufferedAmount>v.buffered)return D.stop();let w=C9(M.data,v.upload);D.ws.send(M.binary?w:w.toString("utf8"))}else P("invalid_frame")}catch{P("invalid_frame")}});async function E(N){if(V.has(N.id)||V.size>=v.streams)return P("stream_limit");if(!Z())return P($.signal.aborted?"aborted":"expired");let M=new AbortController,D,w,k,f=0,_=(b=!1)=>{if(!V.delete(N.id))return;clearTimeout(D),M.abort(),w?.close(1000,"preview_closed"),k?.(),R({type:b?"end":"cancel",id:N.id})},g={stop:()=>_(),credit:()=>{f++,k?.()}};if(V.set(N.id,g),D=setTimeout(_,v.requestMs),!await T9(()=>$.port.check())||!Z()||M.signal.aborted)return _();let c=q9(N.path);if(N.upgrade){if(N.method!=="GET"||N.body)return _();let b=N.headers.find(([h])=>h.toLowerCase()==="sec-websocket-protocol")?.[1].split(",").map((h)=>h.trim());if(b?.some((h)=>!/^[a-zA-Z0-9._-]{1,100}$/.test(h))||(b?.length??0)>8)return _();w=new O9(`ws://127.0.0.1:${Y.port}${c}`,b,{headers:Y.headers,followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload}),g.ws=w,w.binaryType="arraybuffer",w.addEventListener("open",()=>{clearTimeout(D),R({type:"ws",id:N.id,protocol:w.protocol})}),w.addEventListener("message",(h)=>{let d=typeof h.data!=="string",l=b$(h.data);if(l.length>v.upload)return _();R({type:"data",id:N.id,data:l.toString("base64"),binary:d})}),w.addEventListener("error",()=>_()),w.addEventListener("close",(h)=>_(h.wasClean));return}let u=C9(N.body,v.upload),o=D4({hostname:"127.0.0.1",port:Y.port,path:c,method:N.method,headers:{...Object.fromEntries(_8(N.headers)),...Y.headers,connection:"close"},signal:M.signal,agent:!1,maxHeaderSize:16384},async(b)=>{try{let h=[];for(let M0=0;M0<b.rawHeaders.length;M0+=2)h.push([b.rawHeaders[M0],b.rawHeaders[M0+1]]);let d=b.statusCode??502,l=S4(N.method,N.headers,d,h),G0=l==="br"?A4({flush:x8.BROTLI_OPERATION_FLUSH,params:{[x8.BROTLI_PARAM_QUALITY]:5}}):l==="gzip"?x4({level:6,flush:x8.Z_SYNC_FLUSH}):void 0;if(R({type:"head",id:N.id,status:d,headers:_8(l?w4(h,l):h)}),clearTimeout(D),G0)_4(b,G0,()=>{});for await(let M0 of G0??b){let U0=Buffer.from(M0);for(let W0=0;W0<U0.length;W0+=v.chunk){if(f===0&&!M.signal.aborted)await new Promise((T0)=>{k=T0});if(k=void 0,M.signal.aborted)return;f--;let y0=U0.subarray(W0,W0+v.chunk);R(A?w$(N.id,y0):{type:"data",id:N.id,data:y0.toString("base64"),binary:!0})}}_(!0)}catch{_()}});o.on("error",()=>_()),o.end(u)}return await q,{close:P,closed:U}}import{execFile as f4}from"child_process";import{readFile as m4,readdir as g4,readlink as y4}from"fs/promises";import{connect as h4}from"net";import{setTimeout as v4}from"timers/promises";var c4={directory:g4,text:($)=>m4($,"utf8"),link:y4};class P8 extends Error{code;constructor($="port_unproved"){super("preview_port_ownership_unproved");this.code=$}}var e=($)=>new P8($),d9="preview_listener_unproved",v$="00000000000000000000000001000000";async function d4($,Q,Z=c4){let X=new Map;for(let K of["tcp","tcp6"]){let V=await Z.text(`/proc/net/${K}`);if(V.length>4194304)throw e();for(let G of V.split(`
-`).slice(1)){let F=G.trim().split(/\s+/);if(F.length<10||!["0A","01"].includes(F[3]))continue;let[B,H]=F[1].split(":"),[z,L]=F[2].split(":");if(Number.parseInt(H,16)!==Q)continue;let W=(O)=>O==="0100007F"||O==="0000000000000000FFFF00000100007F"||O===v$,U=F[3]==="0A";if(!(W(B)||U&&/^0+$/.test(B??"")))continue;if(!U&&!W(z))continue;let j=F[9];if(!/^[1-9][0-9]*$/.test(j))continue;X.set(j,{kernelId:j,port:Q,peerPort:U?null:Number.parseInt(L,16),state:U?"listen":"established",host:B===v$?"::1":"127.0.0.1"})}}let J=await Z.directory("/proc");if(J.length>8192)throw e();let Y=[];for(let K of J){if(!/^[1-9][0-9]*$/.test(K))continue;try{let V=await Z.text(`/proc/${K}/stat`),G=V.slice(V.lastIndexOf(")")+2).trim().split(/\s+/);if(Number(G[2])!==$)continue;let F=await Z.directory(`/proc/${K}/fd`);if(F.length>1024)throw e();let B=[];for(let L of F){if(!/^[0-9]+$/.test(L))continue;let W=await Z.link(`/proc/${K}/fd/${L}`).catch(()=>""),U=/^socket:\[([0-9]+)\]$/.exec(W)?.[1],j=U?X.get(U):void 0;if(j)B.push({...j,pid:Number(K),processGroupId:$,descriptor:L})}let H=await Z.text(`/proc/${K}/stat`),z=H.slice(H.lastIndexOf(")")+2).trim().split(/\s+/);if(G[19]===z[19]&&G[2]===z[2])Y.push(...B)}catch(V){if(V instanceof Error&&V.message==="preview_port_ownership_unproved")throw V}}return Y}function p4($,Q,Z){if($.length>2097152)throw e();let X=0,J=0,Y="",K="",V="",G="",F=[],B=()=>{if(X<1||J!==Q||!/^\d+$/.test(Y)||!/^0x[0-9a-f]+$/i.test(K))return;let H=G==="LISTEN"&&["*","127.0.0.1","[::ffff:127.0.0.1]","[::1]"].some((L)=>V===`${L}:${Z}`),z=new RegExp(`^(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):${Z}->(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):([0-9]+)$`).exec(V);if(H||G==="ESTABLISHED"&&z)F.push({pid:X,processGroupId:J,descriptor:Y,kernelId:K,state:H?"listen":"established",port:Z,peerPort:H?null:Number(z[1]),host:V.startsWith("[::1]:")?"::1":"127.0.0.1"})};for(let H of $.split(/[\0\n]/)){let z=H.slice(1);if(H[0]==="p")B(),X=Number(z),J=0,Y=K=V=G="";else if(H[0]==="g")J=Number(z);else if(H[0]==="f")B(),Y=z,K=V=G="";else if(H[0]==="d")K=z;else if(H[0]==="n")V=z;else if(H.startsWith("TST="))G=H.slice(4)}return B(),F}async function u4($,Q){if(process.platform==="linux")return d4($,Q);if(process.platform!=="darwin")throw e();let Z=await new Promise((X,J)=>f4("/usr/sbin/lsof",["-nP","-a","-g",String($),`-iTCP:${Q}`,"-F0pgfdnT"],{timeout:1000,maxBuffer:2097152,encoding:"utf8",env:{PATH:"/usr/bin:/bin",LC_ALL:"C"}},(Y,K)=>Y?J(e()):X(K)));return p4(Z,$,Q)}function c$($,Q={}){let Z=I0($.binding),X=Q.inspectSockets??u4,J=Q.monotonicNow??(()=>performance.now());async function Y(){let z=()=>{if(Date.now()>=Z.expiresAtMs)throw e("binding_expired");if($.deniedPorts.has(Z.port))throw e("port_denied")};z();let L=await $.readCurrentJob(),W=L?.job,U=W?.process;if(z(),!L)throw e("server_stopped");if(!c0(Z,L.binding)||W?.jobId!==Z.jobId)throw e("binding_changed");if(W.state!=="running"||W.finishedAtMs!==null||W.leaseExpiresAtMs<Z.expiresAtMs)throw e("job_not_running");if(!U||U.pid<1||U.pid!==U.processGroupId||U.executorLaunchId!==L.executorLaunchId)throw e("process_unproved");return{pid:U.pid,launch:U.executorLaunchId,started:W.startedAtMs}}let K,V;async function G(){let z=await Y(),L=await X(z.pid,Z.port).catch(()=>{throw Error(d9)}),W=await Y();if(z.pid!==W.pid||z.launch!==W.launch||z.started!==W.started)throw e("job_restarted");return L}async function F(z){for(;;){if(V&&V.startedAt>=z)return V.sockets;if(K&&K.startedAt>=z)return await K.sockets;if(K){await K.sockets.catch(()=>{});continue}let L={startedAt:J(),sockets:G()};K=L;try{let W=await L.sockets;if(!V||V.startedAt<=L.startedAt)V={startedAt:L.startedAt,sockets:W};return W}finally{if(K===L)K=void 0}}}async function B(z=()=>{},L=J()){z();let W=await F(L);if(z(),Date.now()>=Z.expiresAtMs)throw e("binding_expired");if(!W.some((U)=>U.state==="listen"))throw Error(d9);return W}async function H(){try{return await B(()=>{},J()-1000),null}catch(z){if(z instanceof Error&&z.message===d9)return"listener_unproved";return z instanceof P8?z.code:"port_unproved"}}return{refusal:H,async check(){let z=await H();if(z==="listener_unproved")throw Error(d9);return z===null},async connect(z){if(z.aborted)throw e();let L=J()+2000,W=new AbortController,U=new Promise((P)=>W.signal.addEventListener("abort",()=>P(null),{once:!0})),j,O=()=>{W.abort(),j?.destroy()},q=setTimeout(O,2000);z.addEventListener("abort",O,{once:!0});let A=()=>{if(W.signal.aborted||z.aborted||J()>=L||j?.destroyed)throw O(),e()};async function R(P){A();let T=await Promise.race([P().then((S)=>({value:S})),U]);if(A(),!T)throw e();return T.value}try{let P=await R(()=>B(A,J()-1000));A();let T=P.some((N)=>N.state==="listen"&&N.host==="127.0.0.1")?"127.0.0.1":"::1",S=h4({host:T,port:Z.port,signal:z});j=S,S.once("close",O),await R(()=>new Promise((N,M)=>{S.once("connect",N),S.once("error",M)}));let m=S.localPort;if(!m)throw e();let E=J();while(!(await R(()=>B(A,E))).some((N)=>N.state==="established"&&N.peerPort===m))await R(()=>v4(Math.min(20,Math.max(1,L-J())),void 0,{signal:W.signal})),E=J();return A(),S}catch(P){throw O(),P}finally{clearTimeout(q),z.removeEventListener("abort",O),j?.off("close",O),W.abort()}}}}var l4=4,s4=[2375,2376,9222,9229];function d$($){let Q=new Set(s4);for(let Z of $){let X=new URL(Z);Q.add(Number(X.port||(["https:","wss:"].includes(X.protocol)?443:80)))}return Q}function R0(){throw new C("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var n4=60000;function p$($){let Q=new AbortController,Z=new Map,X=(G)=>JSON.stringify([G.jobId,G.port]);function J(G){let F=$.authority.owner;if(Q.signal.aborted||!$.isCurrent()||$.expiresAtMs<=Date.now()||G.organization_id!==F.organization_id||G.user_id!==F.user_id||G.device_id!==F.device_id)R0()}function Y(G){let F;try{F=$.environment.current()}catch{return null}return F.binding.target_generation===G.generation&&F.binding.target_fence_id===G.fenceId&&F.run_id===$.runId&&F.device_id===$.authority.owner.device_id&&F.root_id===$.authority.rootId?F:null}async function K(G,F,B){let H=await V(G,F,B);if(H!=="moved")return H;let z=await V(G,F,B);return z==="moved"?null:z}async function V(G,F,B){try{J($.authority.owner);let H=$.identity();if(!H||B.aborted||G.expiresAtMs<=Date.now()||G.expiresAtMs>$.expiresAtMs)return null;let z=F.opened,L=z!==void 0&&H.generation>z.generation,W=Y(H);if(L){if(W){if(W.revision<=z.revision||G.expiresAtMs>Date.parse(W.expires_at)||W.binding.target_revision!==z.attachmentRevision||W.binding.root_grant_revision!==z.grantRevision)return null;F.recoveringSinceMs=void 0}else if(Date.now()-(F.recoveringSinceMs??=Date.now())>n4)return null}else if(!W||G.expiresAtMs>Date.parse(W.expires_at)||z&&(H.generation!==z.generation||H.fenceId!==z.fenceId))return null;let U=await $.inspect(G.jobId,B),j=$.identity(),O=j&&Y(j);J($.authority.owner);let q=W&&{generation:H.generation,fenceId:H.fenceId,snapshotId:W.snapshot_id,revision:W.revision,attachmentRevision:W.binding.target_revision,grantRevision:W.binding.root_grant_revision},A=L?z:q;if(B.aborted||!j)return null;if(j.generation!==H.generation||j.fenceId!==H.fenceId||O?.snapshot_id!==W?.snapshot_id||O?.revision!==W?.revision)return"moved";let R=U.ok&&U.job.environmentSnapshotId!==void 0&&U.job.environmentRevision!==void 0?{snapshotId:U.job.environmentSnapshotId,revision:U.job.environmentRevision}:null;if(!U.ok||U.generation!==H.generation||!A||!R)return null;if((R.snapshotId!==A.snapshotId||R.revision!==A.revision)&&(L||!$.environment.carried(R.snapshotId,R.revision)))return null;if(!z&&H.generation===G.generation&&H.fenceId===G.fenceId)F.opened={...A,...R};return{executorLaunchId:$.executorLaunchId,job:U.job,binding:{organizationId:$.authority.owner.organization_id,userId:$.authority.owner.user_id,deviceId:$.authority.owner.device_id,rootId:$.authority.rootId,runId:$.runId,attachmentRevision:A.attachmentRevision,grantRevision:A.grantRevision,generation:A.generation,fenceId:A.fenceId,jobId:U.job.jobId,port:G.port,expiresAtMs:G.expiresAtMs}}}catch{return null}}return{async open(G,F,B){J(F);let{binding:H,deviceRelayUrl:z}=f$(G);if(B.aborted||H.expiresAtMs<=Date.now()||H.expiresAtMs>Date.now()+v.lifetimeMs||new URL(z).origin!==$.authority.relayOrigin)R0();let L=X(H),W=Z.get(L);if(W){if(!c0(W.binding,H)||W.relay!==z)R0();if(await W.opened,!await T9(()=>W.port.check())||B.aborted||W.abort.signal.aborted)R0();return{opened:!0,binding:H}}if(Z.size>=l4)R0();let U=new AbortController,j={},O=c$({binding:H,deniedPorts:$.authority.deniedPorts,readCurrentJob:()=>K(H,j,U.signal)}),q=()=>U.abort();if(B.addEventListener("abort",q,{once:!0}),Q.signal.addEventListener("abort",q,{once:!0}),B.aborted||Q.signal.aborted)q();let A=h$({binding:H,deviceRelayUrl:z,port:O,signal:U.signal}),R={binding:H,relay:z,abort:U,port:O,opened:A};Z.set(L,R);let P=()=>{if(B.removeEventListener("abort",q),Q.signal.removeEventListener("abort",q),Z.get(L)===R)Z.delete(L)};try{if((await A).closed.then(P),B.removeEventListener("abort",q),J(F),U.signal.aborted||!await T9(()=>O.check()))R0();return{opened:!0,binding:H}}catch{U.abort(),P(),R0()}},async close(G,F){J(F);let{binding:B}=m$(G),H=Z.get(X(B));if(!H||!c0(H.binding,B))R0();return H.abort.abort(),await H.opened.then((z)=>z.closed,()=>{return}),{closed:!0,binding:B}},dispose(){Q.abort();for(let G of Z.values())G.abort.abort();Z.clear()}}}import{WebSocket as I8}from"ws";var u$=($)=>("data"in $)?$.data.length:$.bytes,l$=2*n$;function i($){throw new C($,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var t0=($)=>!["starting","running"].includes($.state);function D2($,Q,Z=Date.now()){let X=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys($).length!==X.length||Object.keys($).some((F)=>!X.includes(F))||!R8(Q)||!R8($.session_id)||typeof $.expires_at!=="string"||typeof $.relay_url!=="string"||$.relay_url.length>4096||![$.cols,$.rows].every((F)=>Number.isSafeInteger(F)&&Number(F)>=1&&Number(F)<=E8))i("invalid_pty_request");let J=$.pty;if(!J||typeof J!=="object"||Array.isArray(J))i("invalid_pty_request");let Y=J;if(Object.keys(Y).length!==2||Y.version!==1||!l9(Y.jobId))i("invalid_pty_request");let K;try{K=new URL($.relay_url)}catch{return i("invalid_pty_request")}if(!["ws:","wss:"].includes(K.protocol)||K.username||K.password||K.hash||K.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(K.hostname))i("invalid_pty_request");let V=Date.parse($.expires_at);if(!Number.isSafeInteger(V)||V<=Z)i("invalid_pty_request");return{workspace:s$($.workspace)??i("invalid_pty_request"),session:{jobId:Y.jobId,sessionId:$.session_id,operationId:Q,relayUrl:K.href,cols:Number($.cols),rows:Number($.rows),leaseExpiresAtMs:Math.min(V,Z+43200000)}}}async function o$($){let{session:Q,binding:Z}=$;if(Z.assertCurrent(),$.signal.aborted||Date.now()>=Q.leaseExpiresAtMs)i("cancelled");let X=new I8(Q.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:p9}),J=new AbortController,Y=()=>{},K=()=>{J.abort(),Y()};$.signal.addEventListener("abort",K,{once:!0});let V=setTimeout(K,Math.max(1,Q.leaseExpiresAtMs-Date.now())),G=[],F=0,B=0,H=0,z=!1,L=!1,W=!1,U,j,O,q=(N)=>{O=new C(N,"Bound terminal input was refused."),K()};X.on("error",()=>q("pty_relay_unavailable")),X.on("close",K),X.on("message",(N,M)=>{if(J.signal.aborted)return;if(!L){q("pty_not_ready");return}let D=Array.isArray(N)?Buffer.concat(N):N instanceof ArrayBuffer?Buffer.from(N):N;if(D.length===0)return;let w=G.at(-1),k=M&&w!==void 0&&"data"in w&&w.data.length+D.length<=p9;if(D.length>p9||F+D.length>i$){q("pty_input_backpressure");return}if(k)w.data=Buffer.concat([w.data,D]);else if(M)G.push({data:Buffer.from(D)});else try{let f=JSON.parse(D.toString("utf8"));if(f&&f.t==="close"&&Object.keys(f).length===1){W=!0,K();return}if(!f||f.t!=="resize"||Object.keys(f).length!==3||![f.cols,f.rows].every((_)=>Number.isSafeInteger(_)&&_>=1&&_<=E8))throw Error("invalid_control");G.push({cols:f.cols,rows:f.rows,bytes:D.length})}catch{q("invalid_pty_control");return}F+=D.length,Y()});function A(N){return a$(JSON.stringify({...Z.scope,version:1,sessionId:Q.sessionId,operationId:Q.operationId,job:{...N,output:[],pty:N.pty?{...N.pty,output:[]}:void 0}}))}function R(N){if(!N.ok)i(N.error);let M=N.job;if(N.generation!==Z.scope.generation||M.jobId!==Q.jobId||!M.pty||M.leaseExpiresAtMs>Q.leaseExpiresAtMs||M.process&&M.process.executorLaunchId!==Z.scope.executorLaunchId||M.process&&j&&(M.process.pid!==j.pid||M.process.processGroupId!==j.processGroupId)||M.state!=="starting"&&(M.environmentRevision!==Z.environment.revision||M.environmentSnapshotId!==Z.environment.snapshotId))i("pty_binding_changed");if(A(M),M.process)j??={...M.process};return M}async function P(N){Z.assertCurrent();let M=await Z.request(N,J.signal);if(Z.assertCurrent(),J.signal.aborted)i("cancelled");let D=R(M);if(D.inputSequence!==B)i("job_input_sequence");if(!t0(D)&&D.leaseExpiresAtMs<=Date.now())i("pty_binding_changed");return D}function T(N){if(Z.assertCurrent(),J.signal.aborted||X.readyState!==I8.OPEN||X.bufferedAmount+Buffer.byteLength(N)>l$)i("pty_output_backpressure");X.send(N)}function S(N){if(N.firstCursor>H+1)H=N.firstCursor-1;for(let M of N.pty.output){if(M.cursor<=H)continue;if(M.cursor!==H+1)i("pty_output_gap");let D=Buffer.from(M.dataBase64,"base64");if(X.bufferedAmount+D.length>l$)return!1;T(D),H=M.cursor}if(H!==N.nextCursor)i("pty_output_gap");return!0}async function m(N,M){let D;try{await Promise.race([$.emit(N,M),new Promise((w,k)=>{D=setTimeout(()=>k(new C("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(D)}}async function E(){let N=AbortSignal.timeout(u9),M=Z.request({jobId:Q.jobId,action:"cancel",input:{}},N),D,w=new Promise((k,f)=>{if(D=()=>f(new C("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),N.addEventListener("abort",D,{once:!0}),N.aborted)D()});try{let k=await Promise.race([M,w]);if(N.aborted)i("pty_cleanup_unconfirmed");return R(k)}finally{N.removeEventListener("abort",D)}}try{await new Promise((k,f)=>{let _=setTimeout(()=>{K(),f(new C("pty_relay_unavailable","Terminal pairing timed out."))},5000),g=()=>{clearTimeout(_),f(new C("cancelled","Terminal pairing was cancelled."))};if(J.signal.addEventListener("abort",g,{once:!0}),X.once("open",()=>{clearTimeout(_),J.signal.removeEventListener("abort",g),k()}),J.signal.aborted)g()}),Z.assertCurrent(),z=!0,U=await P({jobId:Q.jobId,action:"start",input:{mode:"pty",cols:Q.cols,rows:Q.rows,leaseExpiresAtMs:Q.leaseExpiresAtMs}});let N=Date.now()+5000;while(U.state==="starting"){if(Date.now()>=N)i("pty_not_ready");await new Promise((k)=>setTimeout(k,25)),U=await P({jobId:Q.jobId,action:"inspect",input:{after:H}})}if(U.state!=="running"||U.inputSequence!==0||U.leaseExpiresAtMs<=Date.now())i("pty_not_ready");await m("pty.ready",A(U)),L=!0,T(JSON.stringify({t:"open",cols:U.pty.cols,rows:U.pty.rows,receipt:A(U)}));let M=!1,D=0,w=!1;while(!J.signal.aborted){let k=U.firstCursor>H+1,f=S(U);if(t0(U)){if(f)break}else if(k)M=!0;else if(M&&f&&Date.now()>=D){M=!1,D=Date.now()+1000;let{cols:g,rows:c}=U.pty;for(let u of[{cols:g,rows:c>1?c-1:2},{cols:g,rows:c}]){if(t0(U))break;let o=++B;if(U=await P({jobId:Q.jobId,action:"resize",input:{sequence:o,...u}}),U.inputSequence!==o)i("job_input_sequence")}continue}let _=t0(U)||w?void 0:G.shift();if(_){F-=u$(_);let g=++B;try{U=await P("data"in _?{jobId:Q.jobId,action:"input",input:{sequence:g,dataBase64:_.data.toString("base64")}}:{jobId:Q.jobId,action:"resize",input:{sequence:g,cols:_.cols,rows:_.rows}})}catch(c){if(!(c instanceof C)||c.code!=="job_input_backpressure")throw c;B-=1,G.unshift(_),F+=u$(_),w=!0;continue}if(U.inputSequence!==g)i("job_input_sequence")}else if(await new Promise((g)=>{let c=setTimeout(g,w||!f?10:50);if(Y=()=>{clearTimeout(c),g()},J.signal.aborted||!w&&G.length)Y()}),w=!1,Y=()=>{},!J.signal.aborted&&f)try{U=await P({jobId:Q.jobId,action:"inspect",input:{after:H}})}catch(g){if(!W||!(g instanceof C)||g.code!=="cancelled")throw g}}}catch(N){O??=N}finally{if(L=!1,G.length=0,clearTimeout(V),$.signal.removeEventListener("abort",K),K(),z&&(!U||!t0(U)))try{U=await E()}catch{U=void 0}try{if(!U||!t0(U)||U.pty?.cleanup!=="confirmed")i("pty_cleanup_unconfirmed");let N=A(U);if(X.readyState===I8.OPEN)await new Promise((M)=>{let D=setTimeout(M,500);X.send(JSON.stringify({t:"exit",code:U.exitCode,receipt:N}),()=>{clearTimeout(D),M()})});await m("pty.stopped",N)}catch(N){O??=N}X.terminate()}if(O)throw O;if($.signal.aborted)i("cancelled");if(!U)i("pty_cleanup_unconfirmed");return{receipt:A(U)}}import{createHash as i4,randomUUID as GQ}from"crypto";import{spawnSync as a4}from"child_process";import{closeSync as r$,constants as S8,fstatSync as o4,fsyncSync as r4,lstatSync as D9,mkdirSync as t4,mkdtempSync as zQ,openSync as t$,readFileSync as e4,readdirSync as KQ,realpathSync as $9,rmSync as w8,unlinkSync as $3}from"fs";import{createConnection as Q3}from"net";import{dirname as Z3,join as d0,sep as X3}from"path";import{tmpdir as J3}from"os";var $0=new Map,E0=new Map;function D0($,Q){return i4("sha256").update(JSON.stringify([$,Q])).digest("hex")}function e0($){try{t4($,{mode:448})}catch(Z){if(!(Z instanceof Error&&("code"in Z)&&Z.code==="EEXIST"))throw Z}let Q=D9($);if(!Q.isDirectory()||Q.isSymbolicLink()||Q.uid!==process.getuid?.()||(Q.mode&63)!==0||$9($)!==$)throw new C("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function Y3($){let Q;try{Q=D9($)}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!1;throw Z}return!Q.isDirectory()||Q.isSymbolicLink()||KQ($).length>0}function VQ($){let Q=D0($.root,$.runId),Z=$.previousRuntimeDirectories?.find((K)=>Y3(d0(K,"jobs",Q.slice(0,16))))??$.runtimeDirectory;e0(Z);let X=d0(Z,"jobs");e0(X);let J=d0(X,Q.slice(0,16));if($.maxScopes!==void 0){let K=KQ(X);if(!Number.isSafeInteger($.maxScopes)||$.maxScopes<1||K.length>$.maxScopes||!K.includes(Q.slice(0,16))&&K.length>=$.maxScopes)throw new C("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}e0(J);let Y=zQ(d0($9("/tmp"),"reason-j-"));try{return e0(Y),{journalDirectory:J,scopeId:Q,socketPath:d0(Y,"control.sock"),disposeSocket:()=>w8(Y,{recursive:!0,force:!0})}}catch(K){throw w8(Y,{recursive:!0,force:!0}),K}}var G3=60000,z3=5000;function K3($){let Q=a4("ps",["-o","lstart=","-p",String($)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),Z=Q.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(Q.stdout.trim()):null,X=Z?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(Z[1]):-1;if(!Z||X<0||X%3!==0)return null;let J=new Date(Number(Z[6]),X/3,Number(Z[2]),Number(Z[3]),Number(Z[4]),Number(Z[5])).getTime();return Number.isFinite(J)?J:null}function FQ($,Q={}){let Z=d0($.journalDirectory,"owner.lock"),X;try{X=t$(Z,S8.O_RDONLY|S8.O_NOFOLLOW)}catch{return null}try{let J=o4(X);if(!J.isFile()||J.nlink!==1||J.uid!==process.getuid?.()||(J.mode&63)!==0||J.size>4096)return null;let Y=null;try{Y=JSON.parse(e4(X,"utf8"))}catch{}let K;if(Y===null){if((Q.now??Date.now)()-J.mtimeMs<G3)return null;K={reason:"never_written",executorLaunchId:null}}else{let{version:F,scopeId:B,pid:H,createdAtMs:z,executorLaunchId:L}=Y;if(F!==1||B!==$.scopeId||typeof L!=="string"||typeof H!=="number"||!Number.isSafeInteger(H)||H<1||H===process.pid||typeof z!=="number"||!Number.isSafeInteger(z))return null;if(!(Q.exists??((U)=>{try{return process.kill(U,0),!0}catch(j){return!(j instanceof Error&&("code"in j)&&j.code==="ESRCH")}}))(H))K={reason:"owner_exited",executorLaunchId:L};else{let U=(Q.startedAtMs??K3)(H);if(U===null||U<=z+z3)return null;K={reason:"pid_reused",executorLaunchId:L}}}let V=D9(Z);if(V.dev!==J.dev||V.ino!==J.ino)return null;$3(Z);let G=t$($.journalDirectory,S8.O_RDONLY);try{r4(G)}finally{r$(G)}return K}catch{return null}finally{r$(X)}}function HQ($){let Q={...$,workspace:$.workspace&&Object.freeze({...$.workspace}),previewAuthority:$.previewAuthority&&Object.freeze({...$.previewAuthority,owner:Object.freeze({...$.previewAuthority.owner}),deniedPorts:new Set($.previewAuthority.deniedPorts)})},Z=D0(Q.root,Q.runId);if($0.has(Z)||Q.operationId!==void 0&&E0.has(Q.operationId))throw new C("hands_jobs_busy","The Session already has a live Hands job supervisor.");let X={binding:Q,key:Z,terminals:new Map};if(Q.previewAuthority&&Q.environment)X.previews=p$({authority:Q.previewAuthority,runId:Q.runId,expiresAtMs:Q.expiresAtMs,executorLaunchId:Q.executorLaunchId,environment:Q.environment,isCurrent:()=>$0.get(X.key)===X,identity:()=>{try{return Q9(Q)}catch{return null}},inspect:(J,Y)=>{if($0.get(X.key)!==X)throw new C("preview_unavailable","The Hands supervisor is no longer current.");return UQ(Q,{jobId:J,action:"inspect",input:{after:0}},Y)}});if($0.set(Z,X),Q.operationId!==void 0)E0.set(Q.operationId,X);return()=>{if($0.get(X.key)===X)$0.delete(X.key);if(Q.operationId!==void 0&&E0.get(Q.operationId)===X)E0.delete(Q.operationId);X.previews?.dispose();for(let J of X.terminals.values())J.abort()}}var V3=5000,F3=20;async function y2($){let Q=(J)=>{throw new C("hands_rebind_unavailable",J)};if(!O0($.operationId)||!O0($.runId)||!O0($.fenceId)||!S0($.targetGeneration))Q("Reason sent an invalid Hands rebind.");let Z=E0.get($.operationId);if(!Z||Z.binding.root!==$.root)return Q("No live Hands supervisor owns this operation.");for(let J=Date.now()+V3;;){if($.signal?.aborted)Q("The Hands rebind was cancelled.");if(E0.get($.operationId)!==Z)Q("The Hands supervisor is no longer current.");let Y=null;try{Y=Q9(Z.binding)}catch{}if(Y&&Y.generation===$.targetGeneration&&Y.fenceId===$.fenceId)break;if(Y&&Y.generation>$.targetGeneration||Date.now()>=J)Q("The executor did not adopt this take.");await new Promise((K)=>setTimeout(K,F3))}if(E0.get($.operationId)!==Z||$0.get(Z.key)!==Z)Q("The Hands supervisor is no longer current.");let X=D0($.root,$.runId);if(Z.key===X)return;if($0.has(X))Q("The taking run already has a live Hands job supervisor.");$0.delete(Z.key);for(let J of Z.terminals.values())J.abort();Z.key=X,$0.set(X,Z)}function h2($){let Q="operationId"in $?E0.get($.operationId):$0.get(D0($.root,$.runId)),Z=Q&&Q.binding.root===$.root?Q.binding:void 0;if(!Z?.environment||Z.expiresAtMs<=Date.now())throw new C("environment_unavailable","No live Hands supervisor owns this environment.");return Z.environment.install($.payload)}async function v2($){let Q=$0.get(D0($.root,$.runId));if(!Q?.previews||!$.owner)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.open($.payload,$.owner,$.signal)}async function c2($){let Q=$0.get(D0($.root,$.runId));if(!Q?.previews||!$.owner||$.signal.aborted)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.close($.payload,$.owner)}async function d2($){let Q=D0($.root,$.runId),Z=$0.get(Q),X=Z?.binding,J=X?.runId,Y=X?.previewAuthority,K=X?.environment,V=$.owner&&{...$.owner},G=$.authority&&{...$.authority},F=()=>{throw new C("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!Z||!X||!Y||!K||!V||!G||!X.workspace)return F();let B=Object.freeze({...X.workspace}),H=Q9(X),z=K.current(),L=()=>{if($0.get(Q)!==Z||V.organization_id!==Y.owner.organization_id||V.user_id!==Y.owner.user_id||V.device_id!==Y.owner.device_id||$.deviceId!==Y.owner.device_id||$.rootId!==Y.rootId||p0($.workspace)!==p0(B))F();let U=Q9(X),j=K.current();if(U.generation!==H.generation||U.fenceId!==H.fenceId||j.run_id!==J||j.device_id!==$.deviceId||j.root_id!==$.rootId||j.snapshot_id!==z.snapshot_id||j.revision!==z.revision||j.binding.target_generation!==H.generation||j.binding.target_fence_id!==H.fenceId||G.device_id!==$.deviceId||G.binding!==j.binding.kind||G.target_revision!==j.binding.target_revision||G.root_grant_revision!==j.binding.root_grant_revision||G.target_generation!==H.generation||G.target_fence_id!==H.fenceId)F()};if(L(),new URL($.session.relayUrl).origin!==Y.relayOrigin||Z.terminals.has($.session.jobId)||Z.terminals.size>=4)return F();let W=new AbortController;Z.terminals.set($.session.jobId,W);try{return await o$({session:{...$.session,leaseExpiresAtMs:Math.min($.session.leaseExpiresAtMs,H.expiresAtMs,Date.parse(z.expires_at))},signal:AbortSignal.any([$.signal,W.signal]),emit:$.emit,binding:{assertCurrent:L,environment:{revision:z.revision,snapshotId:z.snapshot_id},scope:{runId:$.runId,deviceId:$.deviceId,rootId:$.rootId,workspace:B,binding:z.binding.kind,targetRevision:z.binding.target_revision,rootGrantRevision:z.binding.root_grant_revision,generation:H.generation,fenceId:H.fenceId,executorLaunchId:H.executorLaunchId},request:(U,j)=>WQ(H,b8(JSON.stringify({...U,type:"job",version:2,generation:H.generation,id:GQ()})),j)}})}finally{if(Z.terminals.get($.session.jobId)===W)Z.terminals.delete($.session.jobId)}}async function p2($){if(l9($.payload.jobId))throw new C("pty_binding_required","PTY jobs require the bound terminal capability.");let Q=$0.get(D0($.root,$.runId))?.binding;if(!Q||Q.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return UQ(Q,$.payload,$.signal)}var H3=1e4,U3=20,W3=XQ/2,B3=ZQ/2,L3=($)=>$.output.reduce((Q,Z)=>Q+Z.text.length,0);async function UQ($,Q,Z){if(Object.keys(Q).some((F)=>!["jobId","action","input","waitForExitMs"].includes(F)))throw new C("invalid_payload","Unexpected job control field.");let{waitForExitMs:X,...J}=Q;if(X!==void 0&&(J.action!=="start"||typeof J.input!=="object"||J.input===null||!("script"in J.input)||typeof X!=="number"||!Number.isSafeInteger(X)||X<1||X>H3))throw new C("invalid_payload","Only a script start may wait for its job, within its bound.");let Y=(F)=>{let B=Q9($);return WQ(B,b8(JSON.stringify({...F,type:"job",version:2,generation:B.generation,id:GQ()})),Z)},K=await Y(J);if(X===void 0)return K;let V=Date.now()+X,G=K;while(G.ok&&["starting","running"].includes(G.job.state)&&G.job.output.length<W3&&L3(G.job)<B3&&!Z.aborted&&Date.now()<V){if(await new Promise((F)=>setTimeout(F,Math.min(U3,V-Date.now()))),Z.aborted)break;try{let F=await Y({jobId:J.jobId,action:"inspect",input:{after:0}});if(!F.ok)break;G=F}catch{break}}return G}function Q9($){if($.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","Hands authority expired.");let Q=$.readIdentity?$.readIdentity():$;if(!Q||!S0(Q.generation)||!O0(Q.fenceId)||Q.generation<$.generation||Q.generation===$.generation&&Q.fenceId!==$.fenceId)throw new C("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return $.generation=Q.generation,$.fenceId=Q.fenceId,{...$}}function WQ($,Q,Z){if(Z.aborted)return Promise.reject(new C("cancelled","Job control was cancelled."));return new Promise((X,J)=>{let Y=Q3($.socketPath),K="",V=!1,G,F=(H,z)=>{if(V)return;if(V=!0,clearTimeout(G),Z.removeEventListener("abort",B),Y.destroy(),H)J(H);else X(z)},B=()=>F(new C("cancelled","Job control waiter cancelled; inspect before retrying mutations."));Z.addEventListener("abort",B,{once:!0}),Y.setEncoding("utf8"),G=setTimeout(()=>F(new C("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,$.expiresAtMs-Date.now()))),Y.on("error",()=>F(new C("hands_job_result_unknown","Hands job control connection failed."))),Y.once("connect",()=>Y.write(JSON.stringify({version:1,scopeId:$.scopeId,fenceId:$.fenceId,executorLaunchId:$.executorLaunchId,request:Q})+`
-`)),Y.on("data",(H)=>{if(K+=H,Buffer.byteLength(K)>JQ)F(new C("hands_job_result_unknown","Hands job result exceeded its bound."))}),Y.once("end",()=>{if(Date.now()>=$.expiresAtMs){F(new C("hands_job_result_unknown","Hands authority expired before the result was acknowledged."));return}try{let H=YQ(K.trim());if(H.id!==Q.id||H.generation!==$.generation||H.ok&&H.job.jobId!==Q.jobId)throw Error("identity");F(void 0,H)}catch{F(new C("hands_job_result_unknown","Hands job response identity or shape was invalid."))}}),Y.once("close",()=>{if(!V)F(new C("hands_job_result_unknown","Hands job control closed before an acknowledged result."))})})}function e$($){let Q=$9($.root),Z=$.authority,X=Date.parse($.leaseUntil),J=()=>{if($.signal.throwIfAborted(),!Number.isFinite(X)||X<=Date.now())throw Error("local_device_gh_lease_expired")};if(J(),Z.readOnly&&Z.generation===null)return{root:Q,readOnly:!0,signal:$.signal,deadlineMs:X,assertCurrent:J};let Y=D0(Q,$.runId),K=$0.get(Y),V=K?.binding;if(!V?.environment||!V.workspace||V.localGithubConfinement!==!0)throw Error("local_device_gh_confinement_unavailable");let G=V.environment.current(),F=()=>{J();let H=V.environment.current(),z=Q9(V);if($0.get(Y)!==K||H.github_auth!=="local_gh"||H.run_id!==V.runId||Z.runId!==$.runId||H.device_id!==Z.deviceId||H.root_id!==Z.rootId||String(H.binding.root_grant_revision)!==Z.rootRevision||H.binding.target_generation!==Z.generation||H.binding.target_fence_id!==Z.fenceId||z.generation!==Z.generation||z.fenceId!==Z.fenceId||H.snapshot_id!==G.snapshot_id||H.revision!==G.revision)throw Error("local_device_gh_authority_changed")};F();let B=s9(Q,V.workspace);return{root:B.boundary,signal:$.signal,deadlineMs:X,privateDirectory:Z3(V.environment.path),repoPath:B.path,readOnly:Z.readOnly,forbiddenSecretValues:Object.values(G.variables),secretNames:(H)=>Object.entries(G.variables).filter(([,z])=>z.trim()===H.trim()).map(([z])=>`variable ${z}`),assertCurrent:F}}async function u2($,Q){let Z=$Q.parse($.request),X=QQ.parse($.authority);if(X.contributorRefresh&&Z.kind==="read"&&X.readOnly)return Q(e$($));let J=Boolean(X.contributorRefresh);if(J&&(X.merge||Z.kind!=="pr_mutation"||Z.mutation.action!=="edit"||typeof Z.mutation.body!=="string"||Z.mutation.title!==void 0||Z.mutation.base!==void 0||X.readOnly||X.runId!==$.runId||X.repoFullName!==Z.repoFullName))throw Error("local_device_gh_contributor_refresh_authority_invalid");if(Z.kind!=="pr_merge"&&!J){if(X.merge)throw Error("local_device_gh_merge_authority_invalid");return Q(e$($))}if(!J&&(!X.merge||X.readOnly||X.runId!==$.runId||X.repoFullName!==Z.repoFullName||X.merge.source==="agent"&&(X.generation===null||X.fenceId===null)))throw Error("local_device_gh_merge_authority_invalid");let Y=$9($.root),K=D9(Y),V=Date.parse($.leaseUntil);if(!Number.isFinite(V)||V<=Date.now())throw Error("local_device_gh_lease_expired");let G=$9(J3());if(G===Y||G.startsWith(Y+X3))throw Error("local_device_gh_private_scope_unavailable");let F=zQ(d0(G,"reason-gh-merge-"));try{e0(F);let B=()=>{if($.signal.throwIfAborted(),Date.now()>=V)throw Error("local_device_gh_lease_expired");let H=D9($.root);if(H.isSymbolicLink()||H.dev!==K.dev||H.ino!==K.ino||$9($.root)!==Y)throw Error("local_device_gh_authority_changed");e0(F)};return B(),await Q({root:Y,readOnly:!1,privateDirectory:F,forbiddenSecretValues:[],signal:$.signal,deadlineMs:V,assertCurrent:B})}finally{w8(F,{recursive:!0,force:!0})}}var NQ=43200000;function Z9($){return Number.isSafeInteger($)&&Math.abs($)<=8640000000000000?$:null}function BQ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function LQ($,Q){return Object.keys($).length===Q.length&&Q.every((Z)=>Object.hasOwn($,Z))}function s2($){if(!BQ($)||!LQ($,["version","outcome","clock_source","validation_now_ms","expiry_ms","remaining_ms","maximum_lifetime_ms","cli_artifact"])||$.version!==1||$.maximum_lifetime_ms!==43200000||typeof $.outcome!=="string"||!["accepted","parse","noncanonical","expired","over_cap"].includes($.outcome)||typeof $.clock_source!=="string"||!["date_now","injected"].includes($.clock_source))return null;for(let X of["validation_now_ms","expiry_ms"]){let J=$[X];if(J!==null&&(typeof J!=="number"||Z9(J)===null))return null}if($.remaining_ms!==null&&(typeof $.remaining_ms!=="number"||!Number.isSafeInteger($.remaining_ms)))return null;let Q=typeof $.expiry_ms==="number"&&typeof $.validation_now_ms==="number"?$.expiry_ms-$.validation_now_ms:null;if($.remaining_ms!==(Q!==null&&Number.isSafeInteger(Q)?Q:null))return null;if($.outcome==="parse"&&$.expiry_ms!==null)return null;if($.outcome!=="parse"&&$.expiry_ms===null)return null;if($.outcome==="expired"&&!(typeof Q==="number"&&Q<=0))return null;if($.outcome==="over_cap"&&!(typeof Q==="number"&&Q>43200000))return null;if($.outcome==="accepted"&&!(typeof Q==="number"&&Q>0&&Q<=43200000))return null;let Z=$.cli_artifact;if(!BQ(Z)||!LQ(Z,["kind","status","sha256","observed_at_ms"])||Z.observed_at_ms!==null&&(typeof Z.observed_at_ms!=="number"||Z9(Z.observed_at_ms)===null))return null;if(Z.kind==="entrypoint_file"){if(Z.status!=="observed"||typeof Z.sha256!=="string"||!/^[a-f0-9]{64}$/.test(Z.sha256)||Z.observed_at_ms===null)return null}else if(Z.kind!=="unavailable"||Z.sha256!==null||typeof Z.status!=="string"||!["unsupported_entrypoint","read_failed","file_changed","size_limit","time_limit"].includes(Z.status))return null;return $}var k8=x.strictObject({kind:x.enum(["workspace_source","mcp_control"]),target_revision:x.number().int().nonnegative(),root_grant_revision:x.number().int().positive()}),jQ=new RegExp(n9.tokenPattern),N3=x.strictObject({token_url:x.url().max(2048),request_token:x.string().min(1).max(8192).regex(jQ),aws_credentials_url:x.url().max(2048).nullable()});function CQ($,Q){let Z=(X,J)=>{try{let Y=new URL(X);return Y.origin===new URL(Q).origin&&Y.pathname===J&&!Y.username&&!Y.password&&!Y.search&&!Y.hash}catch{return!1}};if(!jQ.test($.request_token)||!Z($.token_url,n9.tokenPath)||$.aws_credentials_url!==null&&!Z($.aws_credentials_url,n9.awsPath))return null;return{REASON_OIDC_TOKEN_URL:$.token_url,REASON_OIDC_REQUEST_TOKEN:$.request_token,...$.aws_credentials_url!==null?{AWS_CONTAINER_CREDENTIALS_FULL_URI:$.aws_credentials_url,AWS_CONTAINER_AUTHORIZATION_TOKEN:$.request_token}:{}}}function qQ($){return new TextEncoder().encode($).byteLength}function M3($){return qQ(JSON.stringify($)+`
-`)}var TQ=x.strictObject({version:x.literal(1),snapshot_id:x.uuid(),revision:x.number().int().positive(),run_id:x.string().min(1).max(160),device_id:x.uuid(),root_id:x.uuid(),binding:k8.extend({target_generation:x.number().int().positive(),target_fence_id:x.uuid()}),expires_at:x.iso.datetime({offset:!0}),variables:x.record(x.string().max(128).regex(MQ),x.string().refine(($)=>!$.includes("\x00")&&qQ($)<=_0.valueBytes)).refine(($)=>Object.keys($).length<=_0.variables),github_auth:x.literal("local_gh").optional(),git:x.strictObject({base_url:x.url().max(2048),token:x.string().min(1).max(4096).regex(/^[A-Za-z0-9._~-]+$/),expires_at:x.iso.datetime({offset:!0})}).nullable(),cloud_access:N3.optional()}).refine(($)=>$.github_auth!=="local_gh"||$.git===null,"conflicting git authority").refine(($)=>M3($)<=_0.snapshotBytes,"snapshot too large");import{randomUUID as j3}from"crypto";import{closeSync as C3,constants as OQ,fstatSync as q3,lstatSync as DQ,mkdirSync as _Q,openSync as T3,readFileSync as O3,realpathSync as AQ,renameSync as D3,unlinkSync as _3,writeFileSync as A3}from"fs";import{dirname as xQ,resolve as PQ}from"path";var IQ=65536;function i9($){try{return DQ($),!0}catch(Q){if(Q instanceof Error&&"code"in Q&&Q.code==="ENOENT")return!1;throw Q}}function _9($,Q=!1){if(!i9($)){if(!Q)throw Error("worker_state_missing");RQ($),_Q($,{mode:448})}let Z=DQ($);if(!Z.isDirectory()||Z.isSymbolicLink()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0||AQ($)!==PQ($))throw Error("worker_state_directory_not_private_or_canonical")}function RQ($){let Q=xQ($);if(!i9(Q))RQ(Q),_Q(Q,{mode:448});if(AQ(Q)!==PQ(Q))throw Error("worker_parent_not_canonical")}function A9($,Q=IQ){let Z=T3($,OQ.O_RDONLY|OQ.O_NOFOLLOW);try{let X=q3(Z);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>Q)throw Error("worker_file_not_private");return O3(Z,"utf8")}finally{C3(Z)}}function EQ($,Q,Z=IQ){let X=JSON.stringify(Q);if(X===void 0)throw Error("worker_file_invalid");let J=X+`
-`;if(Buffer.byteLength(J,"utf8")>Z)throw Error("worker_file_too_large");if(_9(xQ($)),i9($))A9($,Z);let Y=`${$}.${j3()}`;try{A3(Y,J,{mode:384,flag:"wx"}),D3(Y,$)}finally{if(i9(Y))_3(Y)}}import{spawn as x3}from"child_process";import{basename as P3,isAbsolute as J5}from"path";var I3=0,SQ=120000,wQ=15000,R3=65536;function f8($=process.execPath,Q=process.argv[1]){let Z=P3($),X=(Z.startsWith("bun")||Z.startsWith("node"))&&typeof Q==="string"&&Q.length>0;return{command:$,prefix:X?[Q]:[]}}function Y5($={}){let{command:Q,prefix:Z}=f8($.executablePath,$.sourceEntrypoint),X=$.spawnProcess??x3,J=$.now??Date.now,Y=null,K=0,V=!1,G=(B)=>{try{B.kill("SIGKILL")}catch{}},F=()=>{if(V)return;if(Y&&J()-K<SQ-wQ)return;if(Y){let H=Y;Y=null,G(H)}let B;try{B=X(Q,[...Z,"__device","__hands-worker","--handoff-fd",String(I3)],{cwd:"/",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin"},shell:!1,stdio:["pipe","ignore","pipe"]})}catch{return}Y=B,K=J(),B.on("error",()=>{if(Y===B)Y=null}),B.once("exit",(H,z)=>{if(Y!==B)return;Y=null,$.log?.("hands.worker_prespawn_exited",{exit_code:H,exit_signal:z})}),$.log?.("hands.worker_prespawned",{pid:B.pid??null})};return{arm:F,take(B){let H=Y;if(!H||V)return null;let z=B.args.at(-1),L=B.options.env,W=B.options.cwd,U=[...Z,"__device","__hands-worker","--config"];if(B.command!==Q||B.args.length!==U.length+1||U.some((A,R)=>B.args[R]!==A)||typeof z!=="string"||!L||typeof W!=="string"||B.options.shell||JSON.stringify(B.options.stdio)!==JSON.stringify(["ignore","ignore","pipe"]))return null;Y=null;let j=H.stdin,O={configPath:z,cwd:W,env:Object.fromEntries(Object.entries(L).filter((A)=>typeof A[1]==="string"))},q=JSON.stringify(O);if(H.exitCode!==null||H.signalCode!==null||!j||j.destroyed||J()-K>=SQ-wQ||Buffer.byteLength(q,"utf8")>R3)return G(H),null;return j.on("error",()=>{return}),j.end(q),H.once("exit",()=>{F()}),$.log?.("hands.worker_prespawn_taken",{pid:H.pid??null}),H},adopt(B){B.once("exit",()=>{F()})},close(){if(V=!0,Y)G(Y);Y=null}}}import{accessSync as f3,constants as m3,statSync as g3}from"fs";import{homedir as y3,tmpdir as h3,userInfo as v3}from"os";var E3=new Set(["ALL_PROXY","BUN_BE_BUN","BUN_OPTIONS","CURL_CA_BUNDLE","GIT_SSL_CAINFO","GRPC_DEFAULT_SSL_ROOTS_FILE_PATH","HTTPS_PROXY","HTTP_PROXY","NO_PROXY","NODE_EXTRA_CA_CERTS","NODE_OPTIONS","NODE_TLS_REJECT_UNAUTHORIZED","REQUESTS_CA_BUNDLE","SSLKEYLOGFILE","SSL_CERT_DIR","SSL_CERT_FILE","all_proxy","http_proxy","https_proxy","no_proxy"]);var S3=["BUN_CONFIG_","BUN_INSPECT","DYLD_","NODE_DEBUG"],w3=new Set(["BUN_INSTALL"]);var b3=/^--(?:max-old-space-size|max-semi-space-size|stack-size)=\d{1,9}$/;function k3($){return($??"").split(/\s+/).filter(Boolean).every((Q)=>b3.test(Q.replaceAll("_","-")))}function bQ($){return Object.keys($).filter((Q)=>E3.has(Q)&&!(Q==="NODE_OPTIONS"&&k3($[Q]))||S3.some((Z)=>Q.startsWith(Z))||Q.startsWith("BUN_")&&!w3.has(Q)).sort()}var c3=new Set(["HOME","PATH","PWD","OLDPWD","SHLVL","_","TMPDIR","TMP","TEMP","SHELL","BASH_ENV","ENV","ZDOTDIR","PROMPT_COMMAND","IFS","CDPATH","GLOBIGNORE","SHELLOPTS","BASHOPTS","NODE_PATH"]),d3=/^(?:ARA_|REASON_|PI_|GIT_|GH_|GITHUB_|LD_|DYLD_|BUN_|BASH_FUNC_|SSH_)/,p3=/TOKEN|SECRET|PASSW|PASSPHRASE|CREDENTIAL|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|AUTH/i,u3=/^[A-Za-z_][A-Za-z0-9_]*$/;function mQ($=process.env){let Q=(J)=>{if(!J.startsWith("/")||/[\0\r\n]/.test(J)||J.length>32768)throw Error("invalid_host_execution_environment");return J};if($.PATH!==void 0&&(/[\0\r\n]/.test($.PATH)||$.PATH.length>32768))throw Error("invalid_host_execution_environment");let Z=new Set(bQ($)),X=Object.fromEntries(Object.entries($).filter((J)=>{let[Y,K]=J;return typeof K==="string"&&K.length<=32768&&!K.includes("\x00")&&Y.length<=128&&u3.test(Y)&&!Z.has(Y)&&!c3.has(Y)&&!d3.test(Y)&&!p3.test(Y)}).sort(([J],[Y])=>J.localeCompare(Y)).slice(0,512));return{home:Q($.HOME||y3()),path:fQ($.PATH??"").join(":")||kQ,temporaryDirectory:Q($.TMPDIR||$.TMP||$.TEMP||h3()),variables:X}}function gQ($=process.env,Q=()=>v3().shell){let Z=(J)=>{if(!J||!/^\/[A-Za-z0-9._/-]*\/(?:bash|zsh)$/.test(J))return!1;try{return f3(J,m3.X_OK),g3(J).isFile()}catch{return!1}};if(Z($.SHELL))return $.SHELL;let X;try{X=Q()}catch{X=void 0}return Z(X)?X:"/bin/zsh"}import{readFileSync as vQ,realpathSync as yQ,statSync as l3}from"fs";import{homedir as s3}from"os";import{dirname as n3,isAbsolute as i3,join as x9,sep as a3}from"path";var S5="--proxy",w5="--proxy-ca-file",o3=262144;class J0 extends Error{}function g8($){let Q;try{Q=new URL($)}catch{throw new J0("The proxy must be a URL like https://proxy.example.com:3128.")}if(Q.protocol!=="https:"&&Q.protocol!=="http:")throw new J0("The proxy URL must use the https or http scheme.");if(!Q.hostname)throw new J0("The proxy URL must name a host.");if(Q.port!==""&&Number(Q.port)<1)throw new J0("The proxy URL must use a port between 1 and 65535.");if(Q.pathname!==""&&Q.pathname!=="/"||Q.search||Q.hash)throw new J0("The proxy URL must not carry a path, query, or fragment.");return Q.toString()}function b5($){let Q=new URL($.url),Z=Q.port||(Q.protocol==="https:"?"443":"80");return`${Q.hostname}:${Z}`}function r3($={}){let Q=$.home??s3(),Z=$.statePath??hQ();return[n3(Z),x9(Q,".ssh"),x9(Q,".aws"),x9(Q,".gnupg"),x9(Q,".kube"),x9(Q,"Library","Keychains")]}function t3($,Q){return Q===$||Q.startsWith($+a3)}function e3($,Q={}){if(!i3($))throw new J0("The proxy CA file must be an absolute path.");let Z,X,J;try{Z=yQ($);let V=l3(Z);X=V.size,J=V.isFile()}catch{throw new J0("The proxy CA file does not exist or is not readable.")}if(!J)throw new J0("The proxy CA file must be a regular file.");if(X>o3)throw new J0("The proxy CA file must be 256 KB or smaller.");let Y=r3(Q).flatMap((V)=>{try{let G=yQ(V);return G===V?[V]:[V,G]}catch{return[V]}});for(let V of[$,Z])if(Y.some((G)=>t3(G,V)))throw new J0("The proxy CA file must not live inside a credential directory.");let K;try{K=vQ(Z,"utf8")}catch{throw new J0("The proxy CA file is not readable.")}if(!K.includes("-----BEGIN CERTIFICATE-----"))throw new J0("The proxy CA file must be a PEM certificate bundle.");return Z}function k5($,Q={}){if(!$.proxyUrl)throw new J0("A proxy URL is required.");let Z=g8($.proxyUrl),X=$.caFile===void 0?void 0:e3($.caFile,Q);return{version:a9,url:Z,...X===void 0?{}:{caFile:X}}}function f5($,Q=fetch){if(!$)return Q;let Z,X=!1;return(Y,K)=>{if(!X){if($.caFile)try{Z=vQ($.caFile,"utf8")}catch{throw new J0(`The configured proxy CA file is not readable: ${$.caFile}`)}X=!0}let V={...K,proxy:$.url,...Z===void 0?{}:{tls:{ca:Z}}};return Q(Y,V)}}import{createHash as $1}from"crypto";import{isAbsolute as dQ,join as pQ,relative as uQ,resolve as r9,sep as lQ}from"path";var o9=x.string().min(1).refine(dQ,"absolute path required"),y8=x.strictObject({version:x.literal(1),apiOrigin:x.url(),channel:x.enum(["staging","production"]),stateDirectory:o9,workspaceRoot:o9,lifetime:x.enum(["persistent","ephemeral"]),executionMode:x.enum(["confined","host"]).default("confined"),name:x.string().min(1).max(160).default("Reason headless worker"),slots:x.number().int().min(1).max(4).default(1),shutdownGraceMs:x.number().int().min(0).max(300000).default(30000),proxy:x.strictObject({version:x.literal(a9),url:x.string().refine(($)=>{try{return g8($)===$}catch{return!1}},"invalid proxy URL"),caFile:o9.optional()}).optional(),userChrome:x.boolean().optional(),cloudSessions:x.literal(!0).optional(),localLogins:x.boolean().optional(),folders:x.array(o9).min(1).max(31).optional()}),Q1=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,u5=x.discriminatedUnion("channel",[y8,y8.extend({channel:x.literal("pr"),apiOrigin:x.string(),prEnvironment:x.string()}),y8.extend({channel:x.literal("local-qa"),apiOrigin:x.string()})]).superRefine(($,Q)=>{if($.channel==="local-qa"){if(!Q1.test($.apiOrigin))Q.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else if($.channel==="pr"){let X=$.prEnvironment,J=/^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.up\.railway\.app$/.exec($.apiOrigin),Y=J?.[1]?.match(/(?:^|-)pr-[0-9]+(?=-|$)/g)?.map((K)=>K.replace(/^-/,""));if(!X||/^pr-[1-9][0-9]*$/.exec(X)?.[0]!==X||J?.[0]!==$.apiOrigin||Y?.length!==1||Y[0]!==X)Q.addIssue({code:"custom",message:"PR worker requires explicit prEnvironment and an exact same-PR HTTPS Railway origin"})}else{let X=new URL($.apiOrigin);if(X.origin!==$.apiOrigin||X.username||X.password||X.protocol!=="https:"&&!(X.protocol==="http:"&&h8(X.origin))||!h8(X.origin)&&!cQ($.channel,X.origin))Q.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!P9($.workspaceRoot,$.stateDirectory))Q.addIssue({code:"custom",message:"state and workspace must be disjoint"});let Z=$.folders??[];if(new Set([$.workspaceRoot,...Z]).size!==Z.length+1||Z.some((X)=>!P9(X,$.stateDirectory)))Q.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function Z1($){return pQ($.stateDirectory,`headless-${$.channel==="pr"?$.prEnvironment:$.channel}`)}function l5($,Q={},Z={}){let X=$.executionMode==="host"?"unsandboxed":"sandboxed";return{worker:Object.freeze({executionMode:X,runtimeDirectory:Z1($),handsSlots:$.slots,...Z.ownComputer?{ownComputer:!0}:{},readiness:Object.freeze({...Q}),...Z.persistentTerminals?{persistentTerminals:!0}:{},...Z.probing?.length?{probing:Object.freeze([...Z.probing])}:{},...Z.displayVideo?{displayVideo:!0}:{},...Z.handsBrowser&&Q["hands.connect"]===!0?{handsBrowser:!0}:{},...Z.githubSignedIn===void 0?{}:{githubSignedIn:Z.githubSignedIn},...$.userChrome!==!1&&Z.userChrome?{userChrome:Z.userChrome}:{},...$.cloudSessions&&Q["automation.call.v1"]===!0?{cloudSessions:!0}:{}}),proxy:$.proxy??null}}function P9($,Q){if(w0(Q,$))return!1;return!w0($,Q)||b0(pQ(lQ,uQ(r9($),r9(Q))))}function w0($,Q){let Z=uQ(r9($),r9(Q));return Z===""||Z!==".."&&!Z.startsWith(`..${lQ}`)&&!dQ(Z)}function s5($){let{proxy:Q,userChrome:Z,cloudSessions:X,localLogins:J,folders:Y,...K}=$;return $1("sha256").update(JSON.stringify(K)).digest("hex")}import{readdir as X1}from"fs/promises";var J1=15000;function Y1($){let Q=$ instanceof Error&&"code"in $?$.code:null;return Q==="EPERM"||Q==="EACCES"}function G1($){return new C("folder_access_denied",`macOS blocked Reason from opening ${$}. Allow Reason in System Settings \u203A Privacy & Security \u203A Files and Folders `+"(or Full Disk Access), then try again.")}async function sQ($,{timeoutMs:Q=J1,open:Z=(X)=>X1(X)}={}){let X,J=new Promise((Y)=>{X=setTimeout(()=>Y("pending"),Q)});try{if(await Promise.race([Z($).then(()=>"open"),J])==="pending")throw new C("folder_access_pending",`macOS is asking whether Reason may open ${$}. Answer the prompt on this Mac, then try again.`)}catch(Y){if(Y1(Y))throw G1($);if(Y instanceof C)throw Y}finally{clearTimeout(X)}}import{chmodSync as g1,closeSync as y1,constants as i8,fstatSync as h1,lstatSync as MZ,openSync as v1,readSync as c1,realpathSync as a8,unlinkSync as d1}from"fs";import{lookup as p1}from"dns/promises";import{createRequire as u1}from"module";import{request as l1}from"http";import{request as s1}from"https";import l0 from"net";import{platform as DZ}from"os";import{basename as n1,extname as i1,isAbsolute as jZ,relative as o8,resolve as z9,sep as r8}from"path";var nQ=String.raw`
+`);let Q=$.binding,Z;try{Z=d9($.deviceRelayUrl,"device")}catch{return}if(!Q)return;await new Promise((X)=>{let J=new _9(Z,{followRedirects:!1,perMessageDeflate:!1,maxPayload:4096}),Y=setTimeout(()=>{J.terminate(),X()},v.authorizationMs*2);J.addEventListener("open",()=>{J.send(JSON.stringify({type:"refused",binding:Q,reason:$.reason})),J.close(1000,`worker_refused_${$.reason}`)}),J.addEventListener("error",()=>{clearTimeout(Y),X()}),J.addEventListener("close",()=>{clearTimeout(Y),X()})})}async function k4($,Q){let Z=Date.now()+I4,X;for(;;){if(!Q())return"closed";let J=X??=$.refusal().finally(()=>{X=void 0}),Y,K=await Promise.race([J.catch(()=>"port_unproved"),new Promise((V)=>{Y=setTimeout(()=>V("port_check_timeout"),v.authorizationMs)})]).finally(()=>clearTimeout(Y));if(K===null)return null;if(!["listener_unproved","port_check_timeout"].includes(K)||Date.now()+500>=Z)return K;await new Promise((V)=>setTimeout(V,500))}}async function h$($){let Q=I0($.binding),Z=()=>!$.signal.aborted&&Date.now()<Q.expiresAtMs,X=Q.expiresAtMs>Date.now()+v.lifetimeMs+R4?"binding_mismatch":await k4($.port,Z);if(X)throw await b4({deviceRelayUrl:$.deviceRelayUrl,binding:Q,jobId:Q.jobId,port:Q.port,reason:X}),Error("preview_not_authorized",{cause:X});let J=d9($.deviceRelayUrl,"device"),Y=await y$($.port,$.signal),K;try{K=new _9(J,{followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload*1.4+300000})}catch(N){throw Y.close(),N}let V=new Map,G=!1,F=!1,B=0,H=!1,z,L,W,U=new Promise((N)=>{W=N}),j,O,q=new Promise((N,M)=>{j=N,O=M}),A=!1,R=(N)=>{let M=Buffer.isBuffer(N)?N:JSON.stringify(N);if(B+=Buffer.byteLength(M),!Z()||F||K.readyState!==_9.OPEN)return P(Z()?"relay_closed":"expired");if(K.bufferedAmount>v.relayBuffered)return P("relay_backlog");if(B>v.total)return P("quota");K.send(M)};function P(N="closed"){if(F)return;F=!0,clearInterval(m),clearTimeout(S),$.signal.removeEventListener("abort",T);for(let M of V.values())M.stop();V.clear(),Y.close(),K.close(1000,`worker_${N}`),O(Error("preview_closed")),W()}let T=()=>P("aborted"),S=setTimeout(()=>P("pair_timeout"),v.requestMs),m=setInterval(async()=>{if(!Z())return P($.signal.aborted?"aborted":"expired");if(H)return;H=!0;try{let N=z??=Promise.resolve().then(()=>$.port.check()).finally(()=>{z=void 0}),M=await x8(()=>N);if(M===!1)return P("port_refused");if(M){L=void 0;return}if(Date.now()-(L??=Date.now())>P4)return P("port_unknown");for(let D of V.values())D.stop()}finally{H=!1}},1000);if($.signal.addEventListener("abort",T,{once:!0}),!Z())P($.signal.aborted?"aborted":"expired");K.addEventListener("open",()=>R({type:"hello",binding:Q,messages:v.upload,window:v.window})),K.addEventListener("close",()=>P("relay_closed")),K.addEventListener("error",()=>P("relay_error")),K.addEventListener("message",(N)=>{try{if(!Z()||F)return P($.signal.aborted?"aborted":"expired");if(typeof N.data!=="string")throw Error("preview_frame_invalid");if(B+=Buffer.byteLength(N.data),B>v.total)return P("quota");let M=k$(N.data);if(!G){if(M.type!=="hello"||!d0(Q,M.binding))return P("binding_mismatch");G=!0,A=M.bytes===!0,clearTimeout(S),j();return}if(M.type==="hello"||M.type==="refused")return P("invalid_frame");if(M.type==="request"){E(M).catch(()=>P("invalid_request"));return}let D=V.get(M.id);if(!D)return;if(M.type==="cancel"||M.type==="end")D.stop();else if(M.type==="credit"&&D.credit)D.credit();else if(M.type==="data"&&D.ws){if(D.ws.readyState!==_9.OPEN||D.ws.bufferedAmount>v.buffered)return D.stop();let w=T9(M.data,v.upload);D.ws.send(M.binary?w:w.toString("utf8"))}else P("invalid_frame")}catch{P("invalid_frame")}});async function E(N){if(V.has(N.id)||V.size>=v.streams)return P("stream_limit");if(!Z())return P($.signal.aborted?"aborted":"expired");let M=new AbortController,D,w,k,f=0,_=(b=!1)=>{if(!V.delete(N.id))return;clearTimeout(D),M.abort(),w?.close(1000,"preview_closed"),k?.(),R({type:b?"end":"cancel",id:N.id})},g={stop:()=>_(),credit:()=>{f++,k?.()}};if(V.set(N.id,g),D=setTimeout(_,v.requestMs),!await D9(()=>$.port.check())||!Z()||M.signal.aborted)return _();let c=O9(N.path);if(N.upgrade){if(N.method!=="GET"||N.body)return _();let b=N.headers.find(([h])=>h.toLowerCase()==="sec-websocket-protocol")?.[1].split(",").map((h)=>h.trim());if(b?.some((h)=>!/^[a-zA-Z0-9._-]{1,100}$/.test(h))||(b?.length??0)>8)return _();w=new _9(`ws://127.0.0.1:${Y.port}${c}`,b,{headers:Y.headers,followRedirects:!1,perMessageDeflate:!1,maxPayload:v.upload}),g.ws=w,w.binaryType="arraybuffer",w.addEventListener("open",()=>{clearTimeout(D),R({type:"ws",id:N.id,protocol:w.protocol})}),w.addEventListener("message",(h)=>{let d=typeof h.data!=="string",s=b$(h.data);if(s.length>v.upload)return _();R({type:"data",id:N.id,data:s.toString("base64"),binary:d})}),w.addEventListener("error",()=>_()),w.addEventListener("close",(h)=>_(h.wasClean));return}let u=T9(N.body,v.upload),a=D4({hostname:"127.0.0.1",port:Y.port,path:c,method:N.method,headers:{...Object.fromEntries(A8(N.headers)),...Y.headers,connection:"close"},signal:M.signal,agent:!1,maxHeaderSize:16384},async(b)=>{try{let h=[];for(let M0=0;M0<b.rawHeaders.length;M0+=2)h.push([b.rawHeaders[M0],b.rawHeaders[M0+1]]);let d=b.statusCode??502,s=S4(N.method,N.headers,d,h),G0=s==="br"?A4({flush:P8.BROTLI_OPERATION_FLUSH,params:{[P8.BROTLI_PARAM_QUALITY]:5}}):s==="gzip"?x4({level:6,flush:P8.Z_SYNC_FLUSH}):void 0;if(R({type:"head",id:N.id,status:d,headers:A8(s?w4(h,s):h)}),clearTimeout(D),G0)_4(b,G0,()=>{});for await(let M0 of G0??b){let U0=Buffer.from(M0);for(let W0=0;W0<U0.length;W0+=v.chunk){if(f===0&&!M.signal.aborted)await new Promise((T0)=>{k=T0});if(k=void 0,M.signal.aborted)return;f--;let y0=U0.subarray(W0,W0+v.chunk);R(A?w$(N.id,y0):{type:"data",id:N.id,data:y0.toString("base64"),binary:!0})}}_(!0)}catch{_()}});a.on("error",()=>_()),a.end(u)}return await q,{close:P,closed:U}}import{execFile as f4}from"child_process";import{readFile as m4,readdir as g4,readlink as y4}from"fs/promises";import{connect as h4}from"net";import{setTimeout as v4}from"timers/promises";var c4={directory:g4,text:($)=>m4($,"utf8"),link:y4};class I8 extends Error{code;constructor($="port_unproved"){super("preview_port_ownership_unproved");this.code=$}}var $0=($)=>new I8($),p9="preview_listener_unproved",v$="00000000000000000000000001000000";async function d4($,Q,Z=c4){let X=new Map;for(let K of["tcp","tcp6"]){let V=await Z.text(`/proc/net/${K}`);if(V.length>4194304)throw $0();for(let G of V.split(`
+`).slice(1)){let F=G.trim().split(/\s+/);if(F.length<10||!["0A","01"].includes(F[3]))continue;let[B,H]=F[1].split(":"),[z,L]=F[2].split(":");if(Number.parseInt(H,16)!==Q)continue;let W=(O)=>O==="0100007F"||O==="0000000000000000FFFF00000100007F"||O===v$,U=F[3]==="0A";if(!(W(B)||U&&/^0+$/.test(B??"")))continue;if(!U&&!W(z))continue;let j=F[9];if(!/^[1-9][0-9]*$/.test(j))continue;X.set(j,{kernelId:j,port:Q,peerPort:U?null:Number.parseInt(L,16),state:U?"listen":"established",host:B===v$?"::1":"127.0.0.1"})}}let J=await Z.directory("/proc");if(J.length>8192)throw $0();let Y=[];for(let K of J){if(!/^[1-9][0-9]*$/.test(K))continue;try{let V=await Z.text(`/proc/${K}/stat`),G=V.slice(V.lastIndexOf(")")+2).trim().split(/\s+/);if(Number(G[2])!==$)continue;let F=await Z.directory(`/proc/${K}/fd`);if(F.length>1024)throw $0();let B=[];for(let L of F){if(!/^[0-9]+$/.test(L))continue;let W=await Z.link(`/proc/${K}/fd/${L}`).catch(()=>""),U=/^socket:\[([0-9]+)\]$/.exec(W)?.[1],j=U?X.get(U):void 0;if(j)B.push({...j,pid:Number(K),processGroupId:$,descriptor:L})}let H=await Z.text(`/proc/${K}/stat`),z=H.slice(H.lastIndexOf(")")+2).trim().split(/\s+/);if(G[19]===z[19]&&G[2]===z[2])Y.push(...B)}catch(V){if(V instanceof Error&&V.message==="preview_port_ownership_unproved")throw V}}return Y}function p4($,Q,Z){if($.length>2097152)throw $0();let X=0,J=0,Y="",K="",V="",G="",F=[],B=()=>{if(X<1||J!==Q||!/^\d+$/.test(Y)||!/^0x[0-9a-f]+$/i.test(K))return;let H=G==="LISTEN"&&["*","127.0.0.1","[::ffff:127.0.0.1]","[::1]"].some((L)=>V===`${L}:${Z}`),z=new RegExp(`^(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):${Z}->(?:127\\.0\\.0\\.1|\\[::ffff:127\\.0\\.0\\.1\\]|\\[::1\\]):([0-9]+)$`).exec(V);if(H||G==="ESTABLISHED"&&z)F.push({pid:X,processGroupId:J,descriptor:Y,kernelId:K,state:H?"listen":"established",port:Z,peerPort:H?null:Number(z[1]),host:V.startsWith("[::1]:")?"::1":"127.0.0.1"})};for(let H of $.split(/[\0\n]/)){let z=H.slice(1);if(H[0]==="p")B(),X=Number(z),J=0,Y=K=V=G="";else if(H[0]==="g")J=Number(z);else if(H[0]==="f")B(),Y=z,K=V=G="";else if(H[0]==="d")K=z;else if(H[0]==="n")V=z;else if(H.startsWith("TST="))G=H.slice(4)}return B(),F}async function l4($,Q){if(process.platform==="linux")return d4($,Q);if(process.platform!=="darwin")throw $0();let Z=await new Promise((X,J)=>f4("/usr/sbin/lsof",["-nP","-a","-g",String($),`-iTCP:${Q}`,"-F0pgfdnT"],{timeout:1000,maxBuffer:2097152,encoding:"utf8",env:{PATH:"/usr/bin:/bin",LC_ALL:"C"}},(Y,K)=>Y?J($0()):X(K)));return p4(Z,$,Q)}function c$($,Q={}){let Z=I0($.binding),X=Q.inspectSockets??l4,J=Q.monotonicNow??(()=>performance.now());async function Y(){let z=()=>{if(Date.now()>=Z.expiresAtMs)throw $0("binding_expired");if($.deniedPorts.has(Z.port))throw $0("port_denied")};z();let L=await $.readCurrentJob(),W=L?.job,U=W?.process;if(z(),!L)throw $0("server_stopped");if(!d0(Z,L.binding)||W?.jobId!==Z.jobId)throw $0("binding_changed");if(W.state!=="running"||W.finishedAtMs!==null||W.leaseExpiresAtMs<Z.expiresAtMs)throw $0("job_not_running");if(!U||U.pid<1||U.pid!==U.processGroupId||U.executorLaunchId!==L.executorLaunchId)throw $0("process_unproved");return{pid:U.pid,launch:U.executorLaunchId,started:W.startedAtMs}}let K,V;async function G(){let z=await Y(),L=await X(z.pid,Z.port).catch(()=>{throw Error(p9)}),W=await Y();if(z.pid!==W.pid||z.launch!==W.launch||z.started!==W.started)throw $0("job_restarted");return L}async function F(z){for(;;){if(V&&V.startedAt>=z)return V.sockets;if(K&&K.startedAt>=z)return await K.sockets;if(K){await K.sockets.catch(()=>{});continue}let L={startedAt:J(),sockets:G()};K=L;try{let W=await L.sockets;if(!V||V.startedAt<=L.startedAt)V={startedAt:L.startedAt,sockets:W};return W}finally{if(K===L)K=void 0}}}async function B(z=()=>{},L=J()){z();let W=await F(L);if(z(),Date.now()>=Z.expiresAtMs)throw $0("binding_expired");if(!W.some((U)=>U.state==="listen"))throw Error(p9);return W}async function H(){try{return await B(()=>{},J()-1000),null}catch(z){if(z instanceof Error&&z.message===p9)return"listener_unproved";return z instanceof I8?z.code:"port_unproved"}}return{refusal:H,async check(){let z=await H();if(z==="listener_unproved")throw Error(p9);return z===null},async connect(z){if(z.aborted)throw $0();let L=J()+2000,W=new AbortController,U=new Promise((P)=>W.signal.addEventListener("abort",()=>P(null),{once:!0})),j,O=()=>{W.abort(),j?.destroy()},q=setTimeout(O,2000);z.addEventListener("abort",O,{once:!0});let A=()=>{if(W.signal.aborted||z.aborted||J()>=L||j?.destroyed)throw O(),$0()};async function R(P){A();let T=await Promise.race([P().then((S)=>({value:S})),U]);if(A(),!T)throw $0();return T.value}try{let P=await R(()=>B(A,J()-1000));A();let T=P.some((N)=>N.state==="listen"&&N.host==="127.0.0.1")?"127.0.0.1":"::1",S=h4({host:T,port:Z.port,signal:z});j=S,S.once("close",O),await R(()=>new Promise((N,M)=>{S.once("connect",N),S.once("error",M)}));let m=S.localPort;if(!m)throw $0();let E=J();while(!(await R(()=>B(A,E))).some((N)=>N.state==="established"&&N.peerPort===m))await R(()=>v4(Math.min(20,Math.max(1,L-J())),void 0,{signal:W.signal})),E=J();return A(),S}catch(P){throw O(),P}finally{clearTimeout(q),z.removeEventListener("abort",O),j?.off("close",O),W.abort()}}}}var u4=4,s4=[2375,2376,9222,9229];function d$($){let Q=new Set(s4);for(let Z of $){let X=new URL(Z);Q.add(Number(X.port||(["https:","wss:"].includes(X.protocol)?443:80)))}return Q}function R0(){throw new C("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var n4=60000;function p$($){let Q=new AbortController,Z=new Map,X=(G)=>JSON.stringify([G.jobId,G.port]);function J(G){let F=$.authority.owner;if(Q.signal.aborted||!$.isCurrent()||$.expiresAtMs<=Date.now()||G.organization_id!==F.organization_id||G.user_id!==F.user_id||G.device_id!==F.device_id)R0()}function Y(G){let F;try{F=$.environment.current()}catch{return null}return F.binding.target_generation===G.generation&&F.binding.target_fence_id===G.fenceId&&F.run_id===$.runId&&F.device_id===$.authority.owner.device_id&&F.root_id===$.authority.rootId?F:null}async function K(G,F,B){let H=await V(G,F,B);if(H!=="moved")return H;let z=await V(G,F,B);return z==="moved"?null:z}async function V(G,F,B){try{J($.authority.owner);let H=$.identity();if(!H||B.aborted||G.expiresAtMs<=Date.now()||G.expiresAtMs>$.expiresAtMs)return null;let z=F.opened,L=z!==void 0&&H.generation>z.generation,W=Y(H);if(L){if(W){if(W.revision<=z.revision||G.expiresAtMs>Date.parse(W.expires_at)||W.binding.target_revision!==z.attachmentRevision||W.binding.root_grant_revision!==z.grantRevision)return null;F.recoveringSinceMs=void 0}else if(Date.now()-(F.recoveringSinceMs??=Date.now())>n4)return null}else if(!W||G.expiresAtMs>Date.parse(W.expires_at)||z&&(H.generation!==z.generation||H.fenceId!==z.fenceId))return null;let U=await $.inspect(G.jobId,B),j=$.identity(),O=j&&Y(j);J($.authority.owner);let q=W&&{generation:H.generation,fenceId:H.fenceId,snapshotId:W.snapshot_id,revision:W.revision,attachmentRevision:W.binding.target_revision,grantRevision:W.binding.root_grant_revision},A=L?z:q;if(B.aborted||!j)return null;if(j.generation!==H.generation||j.fenceId!==H.fenceId||O?.snapshot_id!==W?.snapshot_id||O?.revision!==W?.revision)return"moved";let R=U.ok&&U.job.environmentSnapshotId!==void 0&&U.job.environmentRevision!==void 0?{snapshotId:U.job.environmentSnapshotId,revision:U.job.environmentRevision}:null;if(!U.ok||U.generation!==H.generation||!A||!R)return null;if((R.snapshotId!==A.snapshotId||R.revision!==A.revision)&&(L||!$.environment.carried(R.snapshotId,R.revision)))return null;if(!z&&H.generation===G.generation&&H.fenceId===G.fenceId)F.opened={...A,...R};return{executorLaunchId:$.executorLaunchId,job:U.job,binding:{organizationId:$.authority.owner.organization_id,userId:$.authority.owner.user_id,deviceId:$.authority.owner.device_id,rootId:$.authority.rootId,runId:$.runId,attachmentRevision:A.attachmentRevision,grantRevision:A.grantRevision,generation:A.generation,fenceId:A.fenceId,jobId:U.job.jobId,port:G.port,expiresAtMs:G.expiresAtMs}}}catch{return null}}return{async open(G,F,B){J(F);let{binding:H,deviceRelayUrl:z}=f$(G);if(B.aborted||H.expiresAtMs<=Date.now()||H.expiresAtMs>Date.now()+v.lifetimeMs||new URL(z).origin!==$.authority.relayOrigin)R0();let L=X(H),W=Z.get(L);if(W){if(!d0(W.binding,H)||W.relay!==z)R0();if(await W.opened,!await D9(()=>W.port.check())||B.aborted||W.abort.signal.aborted)R0();return{opened:!0,binding:H}}if(Z.size>=u4)R0();let U=new AbortController,j={},O=c$({binding:H,deniedPorts:$.authority.deniedPorts,readCurrentJob:()=>K(H,j,U.signal)}),q=()=>U.abort();if(B.addEventListener("abort",q,{once:!0}),Q.signal.addEventListener("abort",q,{once:!0}),B.aborted||Q.signal.aborted)q();let A=h$({binding:H,deviceRelayUrl:z,port:O,signal:U.signal}),R={binding:H,relay:z,abort:U,port:O,opened:A};Z.set(L,R);let P=()=>{if(B.removeEventListener("abort",q),Q.signal.removeEventListener("abort",q),Z.get(L)===R)Z.delete(L)};try{if((await A).closed.then(P),B.removeEventListener("abort",q),J(F),U.signal.aborted||!await D9(()=>O.check()))R0();return{opened:!0,binding:H}}catch{U.abort(),P(),R0()}},async close(G,F){J(F);let{binding:B}=m$(G),H=Z.get(X(B));if(!H||!d0(H.binding,B))R0();return H.abort.abort(),await H.opened.then((z)=>z.closed,()=>{return}),{closed:!0,binding:B}},dispose(){Q.abort();for(let G of Z.values())G.abort.abort();Z.clear()}}}import{WebSocket as R8}from"ws";var l$=($)=>("data"in $)?$.data.length:$.bytes,u$=2*n$;function i($){throw new C($,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var $9=($)=>!["starting","running"].includes($.state);function D2($,Q,Z=Date.now()){let X=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys($).length!==X.length||Object.keys($).some((F)=>!X.includes(F))||!E8(Q)||!E8($.session_id)||typeof $.expires_at!=="string"||typeof $.relay_url!=="string"||$.relay_url.length>4096||![$.cols,$.rows].every((F)=>Number.isSafeInteger(F)&&Number(F)>=1&&Number(F)<=S8))i("invalid_pty_request");let J=$.pty;if(!J||typeof J!=="object"||Array.isArray(J))i("invalid_pty_request");let Y=J;if(Object.keys(Y).length!==2||Y.version!==1||!s9(Y.jobId))i("invalid_pty_request");let K;try{K=new URL($.relay_url)}catch{return i("invalid_pty_request")}if(!["ws:","wss:"].includes(K.protocol)||K.username||K.password||K.hash||K.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(K.hostname))i("invalid_pty_request");let V=Date.parse($.expires_at);if(!Number.isSafeInteger(V)||V<=Z)i("invalid_pty_request");return{workspace:s$($.workspace)??i("invalid_pty_request"),session:{jobId:Y.jobId,sessionId:$.session_id,operationId:Q,relayUrl:K.href,cols:Number($.cols),rows:Number($.rows),leaseExpiresAtMs:Math.min(V,Z+43200000)}}}async function a$($){let{session:Q,binding:Z}=$;if(Z.assertCurrent(),$.signal.aborted||Date.now()>=Q.leaseExpiresAtMs)i("cancelled");let X=new R8(Q.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:l9}),J=new AbortController,Y=()=>{},K=()=>{J.abort(),Y()};$.signal.addEventListener("abort",K,{once:!0});let V=setTimeout(K,Math.max(1,Q.leaseExpiresAtMs-Date.now())),G=[],F=0,B=0,H=0,z=!1,L=!1,W=!1,U,j,O,q=(N)=>{O=new C(N,"Bound terminal input was refused."),K()};X.on("error",()=>q("pty_relay_unavailable")),X.on("close",K),X.on("message",(N,M)=>{if(J.signal.aborted)return;if(!L){q("pty_not_ready");return}let D=Array.isArray(N)?Buffer.concat(N):N instanceof ArrayBuffer?Buffer.from(N):N;if(D.length===0)return;let w=G.at(-1),k=M&&w!==void 0&&"data"in w&&w.data.length+D.length<=l9;if(D.length>l9||F+D.length>i$){q("pty_input_backpressure");return}if(k)w.data=Buffer.concat([w.data,D]);else if(M)G.push({data:Buffer.from(D)});else try{let f=JSON.parse(D.toString("utf8"));if(f&&f.t==="close"&&Object.keys(f).length===1){W=!0,K();return}if(!f||f.t!=="resize"||Object.keys(f).length!==3||![f.cols,f.rows].every((_)=>Number.isSafeInteger(_)&&_>=1&&_<=S8))throw Error("invalid_control");G.push({cols:f.cols,rows:f.rows,bytes:D.length})}catch{q("invalid_pty_control");return}F+=D.length,Y()});function A(N){return o$(JSON.stringify({...Z.scope,version:1,sessionId:Q.sessionId,operationId:Q.operationId,job:{...N,output:[],pty:N.pty?{...N.pty,output:[]}:void 0}}))}function R(N){if(!N.ok)i(N.error);let M=N.job;if(N.generation!==Z.scope.generation||M.jobId!==Q.jobId||!M.pty||M.leaseExpiresAtMs>Q.leaseExpiresAtMs||M.process&&M.process.executorLaunchId!==Z.scope.executorLaunchId||M.process&&j&&(M.process.pid!==j.pid||M.process.processGroupId!==j.processGroupId)||M.state!=="starting"&&(M.environmentRevision!==Z.environment.revision||M.environmentSnapshotId!==Z.environment.snapshotId))i("pty_binding_changed");if(A(M),M.process)j??={...M.process};return M}async function P(N){Z.assertCurrent();let M=await Z.request(N,J.signal);if(Z.assertCurrent(),J.signal.aborted)i("cancelled");let D=R(M);if(D.inputSequence!==B)i("job_input_sequence");if(!$9(D)&&D.leaseExpiresAtMs<=Date.now())i("pty_binding_changed");return D}function T(N){if(Z.assertCurrent(),J.signal.aborted||X.readyState!==R8.OPEN||X.bufferedAmount+Buffer.byteLength(N)>u$)i("pty_output_backpressure");X.send(N)}function S(N){if(N.firstCursor>H+1)H=N.firstCursor-1;for(let M of N.pty.output){if(M.cursor<=H)continue;if(M.cursor!==H+1)i("pty_output_gap");let D=Buffer.from(M.dataBase64,"base64");if(X.bufferedAmount+D.length>u$)return!1;T(D),H=M.cursor}if(H!==N.nextCursor)i("pty_output_gap");return!0}async function m(N,M){let D;try{await Promise.race([$.emit(N,M),new Promise((w,k)=>{D=setTimeout(()=>k(new C("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(D)}}async function E(){let N=AbortSignal.timeout(u9),M=Z.request({jobId:Q.jobId,action:"cancel",input:{}},N),D,w=new Promise((k,f)=>{if(D=()=>f(new C("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),N.addEventListener("abort",D,{once:!0}),N.aborted)D()});try{let k=await Promise.race([M,w]);if(N.aborted)i("pty_cleanup_unconfirmed");return R(k)}finally{N.removeEventListener("abort",D)}}try{await new Promise((k,f)=>{let _=setTimeout(()=>{K(),f(new C("pty_relay_unavailable","Terminal pairing timed out."))},5000),g=()=>{clearTimeout(_),f(new C("cancelled","Terminal pairing was cancelled."))};if(J.signal.addEventListener("abort",g,{once:!0}),X.once("open",()=>{clearTimeout(_),J.signal.removeEventListener("abort",g),k()}),J.signal.aborted)g()}),Z.assertCurrent(),z=!0,U=await P({jobId:Q.jobId,action:"start",input:{mode:"pty",cols:Q.cols,rows:Q.rows,leaseExpiresAtMs:Q.leaseExpiresAtMs}});let N=Date.now()+5000;while(U.state==="starting"){if(Date.now()>=N)i("pty_not_ready");await new Promise((k)=>setTimeout(k,25)),U=await P({jobId:Q.jobId,action:"inspect",input:{after:H}})}if(U.state!=="running"||U.inputSequence!==0||U.leaseExpiresAtMs<=Date.now())i("pty_not_ready");await m("pty.ready",A(U)),L=!0,T(JSON.stringify({t:"open",cols:U.pty.cols,rows:U.pty.rows,receipt:A(U)}));let M=!1,D=0,w=!1;while(!J.signal.aborted){let k=U.firstCursor>H+1,f=S(U);if($9(U)){if(f)break}else if(k)M=!0;else if(M&&f&&Date.now()>=D){M=!1,D=Date.now()+1000;let{cols:g,rows:c}=U.pty;for(let u of[{cols:g,rows:c>1?c-1:2},{cols:g,rows:c}]){if($9(U))break;let a=++B;if(U=await P({jobId:Q.jobId,action:"resize",input:{sequence:a,...u}}),U.inputSequence!==a)i("job_input_sequence")}continue}let _=$9(U)||w?void 0:G.shift();if(_){F-=l$(_);let g=++B;try{U=await P("data"in _?{jobId:Q.jobId,action:"input",input:{sequence:g,dataBase64:_.data.toString("base64")}}:{jobId:Q.jobId,action:"resize",input:{sequence:g,cols:_.cols,rows:_.rows}})}catch(c){if(!(c instanceof C)||c.code!=="job_input_backpressure")throw c;B-=1,G.unshift(_),F+=l$(_),w=!0;continue}if(U.inputSequence!==g)i("job_input_sequence")}else if(await new Promise((g)=>{let c=setTimeout(g,w||!f?10:50);if(Y=()=>{clearTimeout(c),g()},J.signal.aborted||!w&&G.length)Y()}),w=!1,Y=()=>{},!J.signal.aborted&&f)try{U=await P({jobId:Q.jobId,action:"inspect",input:{after:H}})}catch(g){if(!W||!(g instanceof C)||g.code!=="cancelled")throw g}}}catch(N){O??=N}finally{if(L=!1,G.length=0,clearTimeout(V),$.signal.removeEventListener("abort",K),K(),z&&(!U||!$9(U)))try{U=await E()}catch{U=void 0}try{if(!U||!$9(U)||U.pty?.cleanup!=="confirmed")i("pty_cleanup_unconfirmed");let N=A(U);if(X.readyState===R8.OPEN)await new Promise((M)=>{let D=setTimeout(M,500);X.send(JSON.stringify({t:"exit",code:U.exitCode,receipt:N}),()=>{clearTimeout(D),M()})});await m("pty.stopped",N)}catch(N){O??=N}X.terminate()}if(O)throw O;if($.signal.aborted)i("cancelled");if(!U)i("pty_cleanup_unconfirmed");return{receipt:A(U)}}import{createHash as i4,randomUUID as GQ}from"crypto";import{spawnSync as o4}from"child_process";import{closeSync as r$,constants as w8,fstatSync as a4,fsyncSync as r4,lstatSync as A9,mkdirSync as t4,mkdtempSync as zQ,openSync as t$,readFileSync as e4,readdirSync as KQ,realpathSync as Z9,rmSync as b8,unlinkSync as $3}from"fs";import{createConnection as Q3}from"net";import{dirname as Z3,join as p0,sep as X3}from"path";import{tmpdir as J3}from"os";var Q0=new Map,E0=new Map;function D0($,Q){return i4("sha256").update(JSON.stringify([$,Q])).digest("hex")}function Q9($){try{t4($,{mode:448})}catch(Z){if(!(Z instanceof Error&&("code"in Z)&&Z.code==="EEXIST"))throw Z}let Q=A9($);if(!Q.isDirectory()||Q.isSymbolicLink()||Q.uid!==process.getuid?.()||(Q.mode&63)!==0||Z9($)!==$)throw new C("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function Y3($){let Q;try{Q=A9($)}catch(Z){if(Z instanceof Error&&"code"in Z&&Z.code==="ENOENT")return!1;throw Z}return!Q.isDirectory()||Q.isSymbolicLink()||KQ($).length>0}function VQ($){let Q=D0($.root,$.runId),Z=$.previousRuntimeDirectories?.find((K)=>Y3(p0(K,"jobs",Q.slice(0,16))))??$.runtimeDirectory;Q9(Z);let X=p0(Z,"jobs");Q9(X);let J=p0(X,Q.slice(0,16));if($.maxScopes!==void 0){let K=KQ(X);if(!Number.isSafeInteger($.maxScopes)||$.maxScopes<1||K.length>$.maxScopes||!K.includes(Q.slice(0,16))&&K.length>=$.maxScopes)throw new C("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}Q9(J);let Y=zQ(p0(Z9("/tmp"),"reason-j-"));try{return Q9(Y),{journalDirectory:J,scopeId:Q,socketPath:p0(Y,"control.sock"),disposeSocket:()=>b8(Y,{recursive:!0,force:!0})}}catch(K){throw b8(Y,{recursive:!0,force:!0}),K}}var G3=60000,z3=5000;function K3($){let Q=o4("ps",["-o","lstart=","-p",String($)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),Z=Q.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(Q.stdout.trim()):null,X=Z?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(Z[1]):-1;if(!Z||X<0||X%3!==0)return null;let J=new Date(Number(Z[6]),X/3,Number(Z[2]),Number(Z[3]),Number(Z[4]),Number(Z[5])).getTime();return Number.isFinite(J)?J:null}function FQ($,Q={}){let Z=p0($.journalDirectory,"owner.lock"),X;try{X=t$(Z,w8.O_RDONLY|w8.O_NOFOLLOW)}catch{return null}try{let J=a4(X);if(!J.isFile()||J.nlink!==1||J.uid!==process.getuid?.()||(J.mode&63)!==0||J.size>4096)return null;let Y=null;try{Y=JSON.parse(e4(X,"utf8"))}catch{}let K;if(Y===null){if((Q.now??Date.now)()-J.mtimeMs<G3)return null;K={reason:"never_written",executorLaunchId:null}}else{let{version:F,scopeId:B,pid:H,createdAtMs:z,executorLaunchId:L}=Y;if(F!==1||B!==$.scopeId||typeof L!=="string"||typeof H!=="number"||!Number.isSafeInteger(H)||H<1||H===process.pid||typeof z!=="number"||!Number.isSafeInteger(z))return null;if(!(Q.exists??((U)=>{try{return process.kill(U,0),!0}catch(j){return!(j instanceof Error&&("code"in j)&&j.code==="ESRCH")}}))(H))K={reason:"owner_exited",executorLaunchId:L};else{let U=(Q.startedAtMs??K3)(H);if(U===null||U<=z+z3)return null;K={reason:"pid_reused",executorLaunchId:L}}}let V=A9(Z);if(V.dev!==J.dev||V.ino!==J.ino)return null;$3(Z);let G=t$($.journalDirectory,w8.O_RDONLY);try{r4(G)}finally{r$(G)}return K}catch{return null}finally{r$(X)}}function HQ($){let Q={...$,workspace:$.workspace&&Object.freeze({...$.workspace}),previewAuthority:$.previewAuthority&&Object.freeze({...$.previewAuthority,owner:Object.freeze({...$.previewAuthority.owner}),deniedPorts:new Set($.previewAuthority.deniedPorts)})},Z=D0(Q.root,Q.runId);if(Q0.has(Z)||Q.operationId!==void 0&&E0.has(Q.operationId))throw new C("hands_jobs_busy","The Session already has a live Hands job supervisor.");let X={binding:Q,key:Z,terminals:new Map};if(Q.previewAuthority&&Q.environment)X.previews=p$({authority:Q.previewAuthority,runId:Q.runId,expiresAtMs:Q.expiresAtMs,executorLaunchId:Q.executorLaunchId,environment:Q.environment,isCurrent:()=>Q0.get(X.key)===X,identity:()=>{try{return X9(Q)}catch{return null}},inspect:(J,Y)=>{if(Q0.get(X.key)!==X)throw new C("preview_unavailable","The Hands supervisor is no longer current.");return UQ(Q,{jobId:J,action:"inspect",input:{after:0}},Y)}});if(Q0.set(Z,X),Q.operationId!==void 0)E0.set(Q.operationId,X);return()=>{if(Q0.get(X.key)===X)Q0.delete(X.key);if(Q.operationId!==void 0&&E0.get(Q.operationId)===X)E0.delete(Q.operationId);X.previews?.dispose();for(let J of X.terminals.values())J.abort()}}var V3=5000,F3=20;async function y2($){let Q=(J)=>{throw new C("hands_rebind_unavailable",J)};if(!O0($.operationId)||!O0($.runId)||!O0($.fenceId)||!S0($.targetGeneration))Q("Reason sent an invalid Hands rebind.");let Z=E0.get($.operationId);if(!Z||Z.binding.root!==$.root)return Q("No live Hands supervisor owns this operation.");for(let J=Date.now()+V3;;){if($.signal?.aborted)Q("The Hands rebind was cancelled.");if(E0.get($.operationId)!==Z)Q("The Hands supervisor is no longer current.");let Y=null;try{Y=X9(Z.binding)}catch{}if(Y&&Y.generation===$.targetGeneration&&Y.fenceId===$.fenceId)break;if(Y&&Y.generation>$.targetGeneration||Date.now()>=J)Q("The executor did not adopt this take.");await new Promise((K)=>setTimeout(K,F3))}if(E0.get($.operationId)!==Z||Q0.get(Z.key)!==Z)Q("The Hands supervisor is no longer current.");let X=D0($.root,$.runId);if(Z.key===X)return;if(Q0.has(X))Q("The taking run already has a live Hands job supervisor.");Q0.delete(Z.key);for(let J of Z.terminals.values())J.abort();Z.key=X,Q0.set(X,Z)}function h2($){let Q="operationId"in $?E0.get($.operationId):Q0.get(D0($.root,$.runId)),Z=Q&&Q.binding.root===$.root?Q.binding:void 0;if(!Z?.environment||Z.expiresAtMs<=Date.now())throw new C("environment_unavailable","No live Hands supervisor owns this environment.");return Z.environment.install($.payload)}async function v2($){let Q=Q0.get(D0($.root,$.runId));if(!Q?.previews||!$.owner)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.open($.payload,$.owner,$.signal)}async function c2($){let Q=Q0.get(D0($.root,$.runId));if(!Q?.previews||!$.owner||$.signal.aborted)throw new C("preview_unavailable","No authenticated Hands supervisor owns this preview.");return Q.previews.close($.payload,$.owner)}async function d2($){let Q=D0($.root,$.runId),Z=Q0.get(Q),X=Z?.binding,J=X?.runId,Y=X?.previewAuthority,K=X?.environment,V=$.owner&&{...$.owner},G=$.authority&&{...$.authority},F=()=>{throw new C("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!Z||!X||!Y||!K||!V||!G||!X.workspace)return F();let B=Object.freeze({...X.workspace}),H=X9(X),z=K.current(),L=()=>{if(Q0.get(Q)!==Z||V.organization_id!==Y.owner.organization_id||V.user_id!==Y.owner.user_id||V.device_id!==Y.owner.device_id||$.deviceId!==Y.owner.device_id||$.rootId!==Y.rootId||l0($.workspace)!==l0(B))F();let U=X9(X),j=K.current();if(U.generation!==H.generation||U.fenceId!==H.fenceId||j.run_id!==J||j.device_id!==$.deviceId||j.root_id!==$.rootId||j.snapshot_id!==z.snapshot_id||j.revision!==z.revision||j.binding.target_generation!==H.generation||j.binding.target_fence_id!==H.fenceId||G.device_id!==$.deviceId||G.binding!==j.binding.kind||G.target_revision!==j.binding.target_revision||G.root_grant_revision!==j.binding.root_grant_revision||G.target_generation!==H.generation||G.target_fence_id!==H.fenceId)F()};if(L(),new URL($.session.relayUrl).origin!==Y.relayOrigin||Z.terminals.has($.session.jobId)||Z.terminals.size>=4)return F();let W=new AbortController;Z.terminals.set($.session.jobId,W);try{return await a$({session:{...$.session,leaseExpiresAtMs:Math.min($.session.leaseExpiresAtMs,H.expiresAtMs,Date.parse(z.expires_at))},signal:AbortSignal.any([$.signal,W.signal]),emit:$.emit,binding:{assertCurrent:L,environment:{revision:z.revision,snapshotId:z.snapshot_id},scope:{runId:$.runId,deviceId:$.deviceId,rootId:$.rootId,workspace:B,binding:z.binding.kind,targetRevision:z.binding.target_revision,rootGrantRevision:z.binding.root_grant_revision,generation:H.generation,fenceId:H.fenceId,executorLaunchId:H.executorLaunchId},request:(U,j)=>WQ(H,k8(JSON.stringify({...U,type:"job",version:2,generation:H.generation,id:GQ()})),j)}})}finally{if(Z.terminals.get($.session.jobId)===W)Z.terminals.delete($.session.jobId)}}async function p2($){if(s9($.payload.jobId))throw new C("pty_binding_required","PTY jobs require the bound terminal capability.");let Q=Q0.get(D0($.root,$.runId))?.binding;if(!Q||Q.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return UQ(Q,$.payload,$.signal)}var H3=1e4,U3=20,W3=XQ/2,B3=ZQ/2,L3=($)=>$.output.reduce((Q,Z)=>Q+Z.text.length,0);async function UQ($,Q,Z){if(Object.keys(Q).some((F)=>!["jobId","action","input","waitForExitMs"].includes(F)))throw new C("invalid_payload","Unexpected job control field.");let{waitForExitMs:X,...J}=Q;if(X!==void 0&&(J.action!=="start"||typeof J.input!=="object"||J.input===null||!("script"in J.input)||typeof X!=="number"||!Number.isSafeInteger(X)||X<1||X>H3))throw new C("invalid_payload","Only a script start may wait for its job, within its bound.");let Y=(F)=>{let B=X9($);return WQ(B,k8(JSON.stringify({...F,type:"job",version:2,generation:B.generation,id:GQ()})),Z)},K=await Y(J);if(X===void 0)return K;let V=Date.now()+X,G=K;while(G.ok&&["starting","running"].includes(G.job.state)&&G.job.output.length<W3&&L3(G.job)<B3&&!Z.aborted&&Date.now()<V){if(await new Promise((F)=>setTimeout(F,Math.min(U3,V-Date.now()))),Z.aborted)break;try{let F=await Y({jobId:J.jobId,action:"inspect",input:{after:0}});if(!F.ok)break;G=F}catch{break}}return G}function X9($){if($.expiresAtMs<=Date.now())throw new C("hands_jobs_unavailable","Hands authority expired.");let Q=$.readIdentity?$.readIdentity():$;if(!Q||!S0(Q.generation)||!O0(Q.fenceId)||Q.generation<$.generation||Q.generation===$.generation&&Q.fenceId!==$.fenceId)throw new C("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return $.generation=Q.generation,$.fenceId=Q.fenceId,{...$}}function WQ($,Q,Z){if(Z.aborted)return Promise.reject(new C("cancelled","Job control was cancelled."));return new Promise((X,J)=>{let Y=Q3($.socketPath),K="",V=!1,G,F=(H,z)=>{if(V)return;if(V=!0,clearTimeout(G),Z.removeEventListener("abort",B),Y.destroy(),H)J(H);else X(z)},B=()=>F(new C("cancelled","Job control waiter cancelled; inspect before retrying mutations."));Z.addEventListener("abort",B,{once:!0}),Y.setEncoding("utf8"),G=setTimeout(()=>F(new C("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,$.expiresAtMs-Date.now()))),Y.on("error",()=>F(new C("hands_job_result_unknown","Hands job control connection failed."))),Y.once("connect",()=>Y.write(JSON.stringify({version:1,scopeId:$.scopeId,fenceId:$.fenceId,executorLaunchId:$.executorLaunchId,request:Q})+`
+`)),Y.on("data",(H)=>{if(K+=H,Buffer.byteLength(K)>JQ)F(new C("hands_job_result_unknown","Hands job result exceeded its bound."))}),Y.once("end",()=>{if(Date.now()>=$.expiresAtMs){F(new C("hands_job_result_unknown","Hands authority expired before the result was acknowledged."));return}try{let H=YQ(K.trim());if(H.id!==Q.id||H.generation!==$.generation||H.ok&&H.job.jobId!==Q.jobId)throw Error("identity");F(void 0,H)}catch{F(new C("hands_job_result_unknown","Hands job response identity or shape was invalid."))}}),Y.once("close",()=>{if(!V)F(new C("hands_job_result_unknown","Hands job control closed before an acknowledged result."))})})}function e$($){let Q=Z9($.root),Z=$.authority,X=Date.parse($.leaseUntil),J=()=>{if($.signal.throwIfAborted(),!Number.isFinite(X)||X<=Date.now())throw Error("local_device_gh_lease_expired")};if(J(),Z.readOnly&&Z.generation===null)return{root:Q,readOnly:!0,signal:$.signal,deadlineMs:X,assertCurrent:J};let Y=D0(Q,$.runId),K=Q0.get(Y),V=K?.binding;if(!V?.environment||!V.workspace||V.localGithubConfinement!==!0)throw Error("local_device_gh_confinement_unavailable");let G=V.environment.current(),F=()=>{J();let H=V.environment.current(),z=X9(V);if(Q0.get(Y)!==K||H.github_auth!=="local_gh"||H.run_id!==V.runId||Z.runId!==$.runId||H.device_id!==Z.deviceId||H.root_id!==Z.rootId||String(H.binding.root_grant_revision)!==Z.rootRevision||H.binding.target_generation!==Z.generation||H.binding.target_fence_id!==Z.fenceId||z.generation!==Z.generation||z.fenceId!==Z.fenceId||H.snapshot_id!==G.snapshot_id||H.revision!==G.revision)throw Error("local_device_gh_authority_changed")};F();let B=n9(Q,V.workspace);return{root:B.boundary,signal:$.signal,deadlineMs:X,privateDirectory:Z3(V.environment.path),repoPath:B.path,readOnly:Z.readOnly,forbiddenSecretValues:Object.values(G.variables),secretNames:(H)=>Object.entries(G.variables).filter(([,z])=>z.trim()===H.trim()).map(([z])=>`variable ${z}`),assertCurrent:F}}async function l2($,Q){let Z=$Q.parse($.request),X=QQ.parse($.authority);if(X.contributorRefresh&&Z.kind==="read"&&X.readOnly)return Q(e$($));let J=Boolean(X.contributorRefresh);if(J&&(X.merge||Z.kind!=="pr_mutation"||Z.mutation.action!=="edit"||typeof Z.mutation.body!=="string"||Z.mutation.title!==void 0||Z.mutation.base!==void 0||X.readOnly||X.runId!==$.runId||X.repoFullName!==Z.repoFullName))throw Error("local_device_gh_contributor_refresh_authority_invalid");if(Z.kind!=="pr_merge"&&!J){if(X.merge)throw Error("local_device_gh_merge_authority_invalid");return Q(e$($))}if(!J&&(!X.merge||X.readOnly||X.runId!==$.runId||X.repoFullName!==Z.repoFullName||X.merge.source==="agent"&&(X.generation===null||X.fenceId===null)))throw Error("local_device_gh_merge_authority_invalid");let Y=Z9($.root),K=A9(Y),V=Date.parse($.leaseUntil);if(!Number.isFinite(V)||V<=Date.now())throw Error("local_device_gh_lease_expired");let G=Z9(J3());if(G===Y||G.startsWith(Y+X3))throw Error("local_device_gh_private_scope_unavailable");let F=zQ(p0(G,"reason-gh-merge-"));try{Q9(F);let B=()=>{if($.signal.throwIfAborted(),Date.now()>=V)throw Error("local_device_gh_lease_expired");let H=A9($.root);if(H.isSymbolicLink()||H.dev!==K.dev||H.ino!==K.ino||Z9($.root)!==Y)throw Error("local_device_gh_authority_changed");Q9(F)};return B(),await Q({root:Y,readOnly:!1,privateDirectory:F,forbiddenSecretValues:[],signal:$.signal,deadlineMs:V,assertCurrent:B})}finally{b8(F,{recursive:!0,force:!0})}}var NQ=43200000;function J9($){return Number.isSafeInteger($)&&Math.abs($)<=8640000000000000?$:null}function BQ($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function LQ($,Q){return Object.keys($).length===Q.length&&Q.every((Z)=>Object.hasOwn($,Z))}function s2($){if(!BQ($)||!LQ($,["version","outcome","clock_source","validation_now_ms","expiry_ms","remaining_ms","maximum_lifetime_ms","cli_artifact"])||$.version!==1||$.maximum_lifetime_ms!==43200000||typeof $.outcome!=="string"||!["accepted","parse","noncanonical","expired","over_cap"].includes($.outcome)||typeof $.clock_source!=="string"||!["date_now","injected"].includes($.clock_source))return null;for(let X of["validation_now_ms","expiry_ms"]){let J=$[X];if(J!==null&&(typeof J!=="number"||J9(J)===null))return null}if($.remaining_ms!==null&&(typeof $.remaining_ms!=="number"||!Number.isSafeInteger($.remaining_ms)))return null;let Q=typeof $.expiry_ms==="number"&&typeof $.validation_now_ms==="number"?$.expiry_ms-$.validation_now_ms:null;if($.remaining_ms!==(Q!==null&&Number.isSafeInteger(Q)?Q:null))return null;if($.outcome==="parse"&&$.expiry_ms!==null)return null;if($.outcome!=="parse"&&$.expiry_ms===null)return null;if($.outcome==="expired"&&!(typeof Q==="number"&&Q<=0))return null;if($.outcome==="over_cap"&&!(typeof Q==="number"&&Q>43200000))return null;if($.outcome==="accepted"&&!(typeof Q==="number"&&Q>0&&Q<=43200000))return null;let Z=$.cli_artifact;if(!BQ(Z)||!LQ(Z,["kind","status","sha256","observed_at_ms"])||Z.observed_at_ms!==null&&(typeof Z.observed_at_ms!=="number"||J9(Z.observed_at_ms)===null))return null;if(Z.kind==="entrypoint_file"){if(Z.status!=="observed"||typeof Z.sha256!=="string"||!/^[a-f0-9]{64}$/.test(Z.sha256)||Z.observed_at_ms===null)return null}else if(Z.kind!=="unavailable"||Z.sha256!==null||typeof Z.status!=="string"||!["unsupported_entrypoint","read_failed","file_changed","size_limit","time_limit"].includes(Z.status))return null;return $}var f8=x.strictObject({kind:x.enum(["workspace_source","mcp_control"]),target_revision:x.number().int().nonnegative(),root_grant_revision:x.number().int().positive()}),jQ=new RegExp(i9.tokenPattern),N3=x.strictObject({token_url:x.url().max(2048),request_token:x.string().min(1).max(8192).regex(jQ),aws_credentials_url:x.url().max(2048).nullable()});function CQ($,Q){let Z=(X,J)=>{try{let Y=new URL(X);return Y.origin===new URL(Q).origin&&Y.pathname===J&&!Y.username&&!Y.password&&!Y.search&&!Y.hash}catch{return!1}};if(!jQ.test($.request_token)||!Z($.token_url,i9.tokenPath)||$.aws_credentials_url!==null&&!Z($.aws_credentials_url,i9.awsPath))return null;return{REASON_OIDC_TOKEN_URL:$.token_url,REASON_OIDC_REQUEST_TOKEN:$.request_token,...$.aws_credentials_url!==null?{AWS_CONTAINER_CREDENTIALS_FULL_URI:$.aws_credentials_url,AWS_CONTAINER_AUTHORIZATION_TOKEN:$.request_token}:{}}}function qQ($){return new TextEncoder().encode($).byteLength}function M3($){return qQ(JSON.stringify($)+`
+`)}var TQ=x.strictObject({version:x.literal(1),snapshot_id:x.uuid(),revision:x.number().int().positive(),run_id:x.string().min(1).max(160),device_id:x.uuid(),root_id:x.uuid(),binding:f8.extend({target_generation:x.number().int().positive(),target_fence_id:x.uuid()}),expires_at:x.iso.datetime({offset:!0}),variables:x.record(x.string().max(128).regex(MQ),x.string().refine(($)=>!$.includes("\x00")&&qQ($)<=_0.valueBytes)).refine(($)=>Object.keys($).length<=_0.variables),github_auth:x.literal("local_gh").optional(),git:x.strictObject({base_url:x.url().max(2048),token:x.string().min(1).max(4096).regex(/^[A-Za-z0-9._~-]+$/),expires_at:x.iso.datetime({offset:!0})}).nullable(),cloud_access:N3.optional()}).refine(($)=>$.github_auth!=="local_gh"||$.git===null,"conflicting git authority").refine(($)=>M3($)<=_0.snapshotBytes,"snapshot too large");import{randomUUID as j3}from"crypto";import{closeSync as C3,constants as OQ,fstatSync as q3,lstatSync as DQ,mkdirSync as _Q,openSync as T3,readFileSync as O3,realpathSync as AQ,renameSync as D3,unlinkSync as _3,writeFileSync as A3}from"fs";import{dirname as xQ,resolve as PQ}from"path";var IQ=65536;function o9($){try{return DQ($),!0}catch(Q){if(Q instanceof Error&&"code"in Q&&Q.code==="ENOENT")return!1;throw Q}}function x9($,Q=!1){if(!o9($)){if(!Q)throw Error("worker_state_missing");RQ($),_Q($,{mode:448})}let Z=DQ($);if(!Z.isDirectory()||Z.isSymbolicLink()||Z.uid!==process.getuid?.()||(Z.mode&63)!==0||AQ($)!==PQ($))throw Error("worker_state_directory_not_private_or_canonical")}function RQ($){let Q=xQ($);if(!o9(Q))RQ(Q),_Q(Q,{mode:448});if(AQ(Q)!==PQ(Q))throw Error("worker_parent_not_canonical")}function P9($,Q=IQ){let Z=T3($,OQ.O_RDONLY|OQ.O_NOFOLLOW);try{let X=q3(Z);if(!X.isFile()||X.nlink!==1||X.uid!==process.getuid?.()||(X.mode&63)!==0||X.size>Q)throw Error("worker_file_not_private");return O3(Z,"utf8")}finally{C3(Z)}}function EQ($,Q,Z=IQ){let X=JSON.stringify(Q);if(X===void 0)throw Error("worker_file_invalid");let J=X+`
+`;if(Buffer.byteLength(J,"utf8")>Z)throw Error("worker_file_too_large");if(x9(xQ($)),o9($))P9($,Z);let Y=`${$}.${j3()}`;try{A3(Y,J,{mode:384,flag:"wx"}),D3(Y,$)}finally{if(o9(Y))_3(Y)}}import{spawn as x3}from"child_process";import{basename as P3,isAbsolute as J5}from"path";var I3=0,SQ=120000,wQ=15000,R3=65536;function m8($=process.execPath,Q=process.argv[1]){let Z=P3($),X=(Z.startsWith("bun")||Z.startsWith("node"))&&typeof Q==="string"&&Q.length>0;return{command:$,prefix:X?[Q]:[]}}function Y5($={}){let{command:Q,prefix:Z}=m8($.executablePath,$.sourceEntrypoint),X=$.spawnProcess??x3,J=$.now??Date.now,Y=null,K=0,V=!1,G=(B)=>{try{B.kill("SIGKILL")}catch{}},F=()=>{if(V)return;if(Y&&J()-K<SQ-wQ)return;if(Y){let H=Y;Y=null,G(H)}let B;try{B=X(Q,[...Z,"__device","__hands-worker","--handoff-fd",String(I3)],{cwd:"/",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin"},shell:!1,stdio:["pipe","ignore","pipe"]})}catch{return}Y=B,K=J(),B.on("error",()=>{if(Y===B)Y=null}),B.once("exit",(H,z)=>{if(Y!==B)return;Y=null,$.log?.("hands.worker_prespawn_exited",{exit_code:H,exit_signal:z})}),$.log?.("hands.worker_prespawned",{pid:B.pid??null})};return{arm:F,take(B){let H=Y;if(!H||V)return null;let z=B.args.at(-1),L=B.options.env,W=B.options.cwd,U=[...Z,"__device","__hands-worker","--config"];if(B.command!==Q||B.args.length!==U.length+1||U.some((A,R)=>B.args[R]!==A)||typeof z!=="string"||!L||typeof W!=="string"||B.options.shell||JSON.stringify(B.options.stdio)!==JSON.stringify(["ignore","ignore","pipe"]))return null;Y=null;let j=H.stdin,O={configPath:z,cwd:W,env:Object.fromEntries(Object.entries(L).filter((A)=>typeof A[1]==="string"))},q=JSON.stringify(O);if(H.exitCode!==null||H.signalCode!==null||!j||j.destroyed||J()-K>=SQ-wQ||Buffer.byteLength(q,"utf8")>R3)return G(H),null;return j.on("error",()=>{return}),j.end(q),H.once("exit",()=>{F()}),$.log?.("hands.worker_prespawn_taken",{pid:H.pid??null}),H},adopt(B){B.once("exit",()=>{F()})},close(){if(V=!0,Y)G(Y);Y=null}}}import{accessSync as f3,constants as m3,statSync as g3}from"fs";import{homedir as y3,tmpdir as h3,userInfo as v3}from"os";var E3=new Set(["ALL_PROXY","BUN_BE_BUN","BUN_OPTIONS","CURL_CA_BUNDLE","GIT_SSL_CAINFO","GRPC_DEFAULT_SSL_ROOTS_FILE_PATH","HTTPS_PROXY","HTTP_PROXY","NO_PROXY","NODE_EXTRA_CA_CERTS","NODE_OPTIONS","NODE_TLS_REJECT_UNAUTHORIZED","REQUESTS_CA_BUNDLE","SSLKEYLOGFILE","SSL_CERT_DIR","SSL_CERT_FILE","all_proxy","http_proxy","https_proxy","no_proxy"]);var S3=["BUN_CONFIG_","BUN_INSPECT","DYLD_","NODE_DEBUG"],w3=new Set(["BUN_INSTALL"]);var b3=/^--(?:max-old-space-size|max-semi-space-size|stack-size)=\d{1,9}$/;function k3($){return($??"").split(/\s+/).filter(Boolean).every((Q)=>b3.test(Q.replaceAll("_","-")))}function bQ($){return Object.keys($).filter((Q)=>E3.has(Q)&&!(Q==="NODE_OPTIONS"&&k3($[Q]))||S3.some((Z)=>Q.startsWith(Z))||Q.startsWith("BUN_")&&!w3.has(Q)).sort()}var c3=new Set(["HOME","PATH","PWD","OLDPWD","SHLVL","_","TMPDIR","TMP","TEMP","SHELL","BASH_ENV","ENV","ZDOTDIR","PROMPT_COMMAND","IFS","CDPATH","GLOBIGNORE","SHELLOPTS","BASHOPTS","NODE_PATH"]),d3=/^(?:ARA_|REASON_|PI_|GIT_|GH_|GITHUB_|LD_|DYLD_|BUN_|BASH_FUNC_|SSH_)/,p3=/TOKEN|SECRET|PASSW|PASSPHRASE|CREDENTIAL|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|AUTH/i,l3=/^[A-Za-z_][A-Za-z0-9_]*$/;function mQ($=process.env){let Q=(J)=>{if(!J.startsWith("/")||/[\0\r\n]/.test(J)||J.length>32768)throw Error("invalid_host_execution_environment");return J};if($.PATH!==void 0&&(/[\0\r\n]/.test($.PATH)||$.PATH.length>32768))throw Error("invalid_host_execution_environment");let Z=new Set(bQ($)),X=Object.fromEntries(Object.entries($).filter((J)=>{let[Y,K]=J;return typeof K==="string"&&K.length<=32768&&!K.includes("\x00")&&Y.length<=128&&l3.test(Y)&&!Z.has(Y)&&!c3.has(Y)&&!d3.test(Y)&&!p3.test(Y)}).sort(([J],[Y])=>J.localeCompare(Y)).slice(0,512));return{home:Q($.HOME||y3()),path:fQ($.PATH??"").join(":")||kQ,temporaryDirectory:Q($.TMPDIR||$.TMP||$.TEMP||h3()),variables:X}}function gQ($=process.env,Q=()=>v3().shell){let Z=(J)=>{if(!J||!/^\/[A-Za-z0-9._/-]*\/(?:bash|zsh)$/.test(J))return!1;try{return f3(J,m3.X_OK),g3(J).isFile()}catch{return!1}};if(Z($.SHELL))return $.SHELL;let X;try{X=Q()}catch{X=void 0}return Z(X)?X:"/bin/zsh"}import{readFileSync as vQ,realpathSync as yQ,statSync as u3}from"fs";import{homedir as s3}from"os";import{dirname as n3,isAbsolute as i3,join as I9,sep as o3}from"path";var S5="--proxy",w5="--proxy-ca-file",a3=262144;class J0 extends Error{}function y8($){let Q;try{Q=new URL($)}catch{throw new J0("The proxy must be a URL like https://proxy.example.com:3128.")}if(Q.protocol!=="https:"&&Q.protocol!=="http:")throw new J0("The proxy URL must use the https or http scheme.");if(!Q.hostname)throw new J0("The proxy URL must name a host.");if(Q.port!==""&&Number(Q.port)<1)throw new J0("The proxy URL must use a port between 1 and 65535.");if(Q.pathname!==""&&Q.pathname!=="/"||Q.search||Q.hash)throw new J0("The proxy URL must not carry a path, query, or fragment.");return Q.toString()}function b5($){let Q=new URL($.url),Z=Q.port||(Q.protocol==="https:"?"443":"80");return`${Q.hostname}:${Z}`}function r3($={}){let Q=$.home??s3(),Z=$.statePath??hQ();return[n3(Z),I9(Q,".ssh"),I9(Q,".aws"),I9(Q,".gnupg"),I9(Q,".kube"),I9(Q,"Library","Keychains")]}function t3($,Q){return Q===$||Q.startsWith($+o3)}function e3($,Q={}){if(!i3($))throw new J0("The proxy CA file must be an absolute path.");let Z,X,J;try{Z=yQ($);let V=u3(Z);X=V.size,J=V.isFile()}catch{throw new J0("The proxy CA file does not exist or is not readable.")}if(!J)throw new J0("The proxy CA file must be a regular file.");if(X>a3)throw new J0("The proxy CA file must be 256 KB or smaller.");let Y=r3(Q).flatMap((V)=>{try{let G=yQ(V);return G===V?[V]:[V,G]}catch{return[V]}});for(let V of[$,Z])if(Y.some((G)=>t3(G,V)))throw new J0("The proxy CA file must not live inside a credential directory.");let K;try{K=vQ(Z,"utf8")}catch{throw new J0("The proxy CA file is not readable.")}if(!K.includes("-----BEGIN CERTIFICATE-----"))throw new J0("The proxy CA file must be a PEM certificate bundle.");return Z}function k5($,Q={}){if(!$.proxyUrl)throw new J0("A proxy URL is required.");let Z=y8($.proxyUrl),X=$.caFile===void 0?void 0:e3($.caFile,Q);return{version:a9,url:Z,...X===void 0?{}:{caFile:X}}}function f5($,Q=fetch){if(!$)return Q;let Z,X=!1;return(Y,K)=>{if(!X){if($.caFile)try{Z=vQ($.caFile,"utf8")}catch{throw new J0(`The configured proxy CA file is not readable: ${$.caFile}`)}X=!0}let V={...K,proxy:$.url,...Z===void 0?{}:{tls:{ca:Z}}};return Q(Y,V)}}import{createHash as $1}from"crypto";import{isAbsolute as dQ,join as pQ,relative as lQ,resolve as t9,sep as uQ}from"path";var r9=x.string().min(1).refine(dQ,"absolute path required"),h8=x.strictObject({version:x.literal(1),apiOrigin:x.url(),channel:x.enum(["staging","production"]),stateDirectory:r9,workspaceRoot:r9,lifetime:x.enum(["persistent","ephemeral"]),executionMode:x.enum(["confined","host"]).default("confined"),name:x.string().min(1).max(160).default("Reason headless worker"),slots:x.number().int().min(1).max(4).default(1),shutdownGraceMs:x.number().int().min(0).max(300000).default(30000),proxy:x.strictObject({version:x.literal(a9),url:x.string().refine(($)=>{try{return y8($)===$}catch{return!1}},"invalid proxy URL"),caFile:r9.optional()}).optional(),userChrome:x.boolean().optional(),cloudSessions:x.literal(!0).optional(),localLogins:x.boolean().optional(),folders:x.array(r9).min(1).max(31).optional()}),Q1=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,l5=x.discriminatedUnion("channel",[h8,h8.extend({channel:x.literal("pr"),apiOrigin:x.string(),prEnvironment:x.string()}),h8.extend({channel:x.literal("local-qa"),apiOrigin:x.string()})]).superRefine(($,Q)=>{if($.channel==="local-qa"){if(!Q1.test($.apiOrigin))Q.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else if($.channel==="pr"){let X=$.prEnvironment,J=/^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.up\.railway\.app$/.exec($.apiOrigin),Y=J?.[1]?.match(/(?:^|-)pr-[0-9]+(?=-|$)/g)?.map((K)=>K.replace(/^-/,""));if(!X||/^pr-[1-9][0-9]*$/.exec(X)?.[0]!==X||J?.[0]!==$.apiOrigin||Y?.length!==1||Y[0]!==X)Q.addIssue({code:"custom",message:"PR worker requires explicit prEnvironment and an exact same-PR HTTPS Railway origin"})}else{let X=new URL($.apiOrigin);if(X.origin!==$.apiOrigin||X.username||X.password||X.protocol!=="https:"&&!(X.protocol==="http:"&&v8(X.origin))||!v8(X.origin)&&!cQ($.channel,X.origin))Q.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!R9($.workspaceRoot,$.stateDirectory))Q.addIssue({code:"custom",message:"state and workspace must be disjoint"});let Z=$.folders??[];if(new Set([$.workspaceRoot,...Z]).size!==Z.length+1||Z.some((X)=>!R9(X,$.stateDirectory)))Q.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function Z1($){return pQ($.stateDirectory,`headless-${$.channel==="pr"?$.prEnvironment:$.channel}`)}function u5($,Q={},Z={}){let X=$.executionMode==="host"?"unsandboxed":"sandboxed";return{worker:Object.freeze({executionMode:X,runtimeDirectory:Z1($),handsSlots:$.slots,...Z.ownComputer?{ownComputer:!0}:{},readiness:Object.freeze({...Q}),...Z.persistentTerminals?{persistentTerminals:!0}:{},...Z.probing?.length?{probing:Object.freeze([...Z.probing])}:{},...Z.displayVideo?{displayVideo:!0}:{},...Z.handsBrowser&&Q["hands.connect"]===!0?{handsBrowser:!0}:{},...Z.githubSignedIn===void 0?{}:{githubSignedIn:Z.githubSignedIn},...$.userChrome!==!1&&Z.userChrome?{userChrome:Z.userChrome}:{},...$.cloudSessions&&Q["automation.call.v1"]===!0?{cloudSessions:!0}:{}}),proxy:$.proxy??null}}function R9($,Q){if(w0(Q,$))return!1;return!w0($,Q)||b0(pQ(uQ,lQ(t9($),t9(Q))))}function w0($,Q){let Z=lQ(t9($),t9(Q));return Z===""||Z!==".."&&!Z.startsWith(`..${uQ}`)&&!dQ(Z)}function s5($){let{proxy:Q,userChrome:Z,cloudSessions:X,localLogins:J,folders:Y,...K}=$;return $1("sha256").update(JSON.stringify(K)).digest("hex")}import{readdir as X1}from"fs/promises";var J1=15000;function Y1($){let Q=$ instanceof Error&&"code"in $?$.code:null;return Q==="EPERM"||Q==="EACCES"}function G1($){return new C("folder_access_denied",`macOS blocked Reason from opening ${$}. Allow Reason in System Settings \u203A Privacy & Security \u203A Files and Folders `+"(or Full Disk Access), then try again.")}async function sQ($,{timeoutMs:Q=J1,open:Z=(X)=>X1(X)}={}){let X,J=new Promise((Y)=>{X=setTimeout(()=>Y("pending"),Q)});try{if(await Promise.race([Z($).then(()=>"open"),J])==="pending")throw new C("folder_access_pending",`macOS is asking whether Reason may open ${$}. Answer the prompt on this Mac, then try again.`)}catch(Y){if(Y1(Y))throw G1($);if(Y instanceof C)throw Y}finally{clearTimeout(X)}}import{chmodSync as g1,closeSync as y1,constants as o8,fstatSync as h1,lstatSync as MZ,openSync as v1,readSync as c1,realpathSync as a8,unlinkSync as d1}from"fs";import{lookup as p1}from"dns/promises";import{createRequire as l1}from"module";import{request as u1}from"http";import{request as s1}from"https";import s0 from"net";import{platform as DZ}from"os";import{basename as n1,extname as i1,isAbsolute as jZ,relative as r8,resolve as V9,sep as t8}from"path";var nQ=String.raw`
 async (roots) => {
   "use strict";
   const version = 2;
@@ -303,14 +303,14 @@ async (input) => {
   if (!bridge || typeof bridge.evaluate !== "function") throw new Error("Reason Hands browser bridge is not installed");
   return await bridge.evaluate(typeof input === "string" ? input : input && input.code);
 }
-`.trim();import{Buffer as X9}from"buffer";import{randomUUID as z1}from"crypto";class tQ extends Error{code;constructor($){super($==="hands_repl_private_profile_attribute_denied"?"Private browser attribute read denied.":$);this.code=$;this.name="HandsReplBrowserDispatcherError"}}var eQ=new Set(["__defineGetter__","__defineSetter__","__lookupGetter__","__lookupSetter__","__proto__","constructor","prototype"]),aQ=/^hands_[A-Za-z0-9_-]{8,128}$/,K1=2048,$Z=32,QZ=1e4,V1=new Set(["href","src","alt","title","role","aria-label","aria-expanded","aria-checked","aria-selected","aria-disabled","placeholder","type","name","data-testid"]);function F1($){let Q=$.split("+"),Z=(Q.pop()??"").replace(/^Key/,"").toLowerCase();if(Z==="f12")return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&["l","n","t","j","i","p","s","w","u","o","r","tab","pageup","pagedown"].includes(Z))return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&Q.includes("Shift")&&Z==="c")return!0;return Q.includes("Alt")&&["d","arrowleft","arrowright","home"].includes(Z)}var H1=($)=>{let Q=$.closest("a[href],area[href]");return{password:$.tagName==="INPUT"&&$.type==="password",executableLink:Boolean(Q&&!/^(https?:|about:blank)/i.test(Q.href))}},ZZ={browser:{close:{returns:"void"},contexts:{returns:"context[]"},isConnected:{returns:"json"},version:{returns:"json"}},context:{addCookies:{returns:"void"},addInitScript:{returns:"void"},browser:{returns:"browser"},clearCookies:{returns:"void"},clearPermissions:{returns:"void"},close:{returns:"void"},cookies:{returns:"json"},grantPermissions:{returns:"void"},newPage:{returns:"page"},pages:{returns:"page[]"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setGeolocation:{returns:"void"},setHTTPCredentials:{returns:"void"},setOffline:{returns:"void"},setViewportSize:{returns:"void"},storageState:{returns:"json"},viewportSize:{returns:"json",special:"contextViewportSize"}},page:{addInitScript:{returns:"void"},addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},bringToFront:{returns:"void"},close:{returns:"void"},content:{returns:"json"},context:{returns:"context"},emulateMedia:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},frame:{returns:"frame"},frameLocator:{returns:"frameLocator"},frames:{returns:"frame[]"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goBack:{returns:"void"},goForward:{returns:"void"},goto:{returns:"void"},isClosed:{returns:"json"},locator:{returns:"locator"},mainFrame:{returns:"frame"},opener:{returns:"page"},pdf:{returns:"bytes"},reload:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setContent:{returns:"void"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setInputFiles:{returns:"void"},setViewportSize:{returns:"void"},title:{returns:"json"},url:{returns:"json"},viewportSize:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},locator:{all:{returns:"locator[]"},allInnerTexts:{returns:"json"},allTextContents:{returns:"json"},and:{returns:"locator"},ariaSnapshot:{returns:"json"},blur:{returns:"void"},boundingBox:{returns:"json"},check:{returns:"void"},clear:{returns:"void"},click:{returns:"void"},contentFrame:{returns:"frameLocator"},count:{returns:"json"},dblclick:{returns:"void"},dragTo:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},evaluateAll:{returns:"json",requiresStringSource:!0},fill:{returns:"void"},filter:{returns:"locator"},first:{returns:"locator",special:"property"},focus:{returns:"void"},getAttribute:{returns:"json"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},hover:{returns:"void"},innerHTML:{returns:"json"},innerText:{returns:"json"},inputValue:{returns:"json"},isChecked:{returns:"json"},isEditable:{returns:"json"},isEnabled:{returns:"json"},isHidden:{returns:"json"},isVisible:{returns:"json"},last:{returns:"locator",special:"property"},locator:{returns:"locator"},nth:{returns:"locator"},or:{returns:"locator"},page:{returns:"page"},press:{returns:"void"},pressSequentially:{returns:"void"},scrollIntoViewIfNeeded:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setInputFiles:{returns:"void"},tap:{returns:"void"},textContent:{returns:"json"},type:{returns:"void"},uncheck:{returns:"void"},waitFor:{returns:"void"}},frame:{addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},childFrames:{returns:"frame[]"},content:{returns:"json"},evaluate:{returns:"json",requiresStringSource:!0},frameLocator:{returns:"frameLocator"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goto:{returns:"void"},isDetached:{returns:"json"},locator:{returns:"locator"},name:{returns:"json"},page:{returns:"page"},parentFrame:{returns:"frame"},setContent:{returns:"void"},title:{returns:"json"},url:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},frameLocator:{getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},locator:{returns:"locator"},owner:{returns:"locator"}}};function I($){throw new tQ($)}function z0($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Q=Object.getPrototypeOf($);return Q===Object.prototype||Q===null}function J9($,Q=0,Z={nodes:0}){if(Q>$Z||++Z.nodes>QZ)I("hands_repl_json_too_complex");if($===null||typeof $==="boolean"||typeof $==="string")return;if(typeof $==="number"){if(!Number.isFinite($))I("hands_repl_invalid_json");return}if(Array.isArray($)){for(let X of $)J9(X,Q+1,Z);return}if(!z0($))I("hands_repl_invalid_json");for(let[X,J]of Object.entries($)){if(eQ.has(X))I("hands_repl_invalid_json");J9(J,Q+1,Z)}}function v8($){return typeof $==="string"&&Object.hasOwn(ZZ,$)}function U1($){if(!$.endsWith("[]"))return null;let Q=$.slice(0,-2);return v8(Q)?Q:null}function oQ($){return z0($)&&Object.keys($).length===2&&$.$handsRepl==="bytes"&&typeof $.base64==="string"}function W1($){return z0($)&&Object.keys($).length===1&&$.$handsRepl==="undefined"}function rQ($){return z0($)&&Object.keys($).length===2&&$.$handsRepl==="routeFulfill"&&"options"in $}function k0($){return!!$&&typeof $==="object"}function t9(){return Object.freeze({$handsRepl:"undefined"})}function B1($){if(!X9.isBuffer($)&&!($ instanceof Uint8Array))I("hands_repl_expected_bytes");return Object.freeze({$handsRepl:"bytes",base64:X9.from($).toString("base64")})}function XZ($){if(!k0($.browser)||!k0($.context)||!k0($.page))I("hands_repl_invalid_roots");if(typeof $.a11y!=="function"||typeof $.view!=="function")I("hands_repl_invalid_callbacks");let Q=$.maxHandles??K1;if(!Number.isInteger(Q)||Q<3||Q>1e5)I("hands_repl_invalid_handle_limit");let Z=new Map,X=new WeakMap,J=$.createOpaqueId??z1,Y=(z,L)=>{if(!k0(L))I("hands_repl_expected_target");let W=X.get(L)?.get(z);if(W)return W;if(Z.size>=Q)I("hands_repl_handle_limit");let U="";for(let q=0;q<16;q+=1){let A=`hands_${J()}`;if(aQ.test(A)&&!Z.has(A)){U=A;break}}if(!U)I("hands_repl_invalid_opaque_id");let j=Object.freeze({$handsRepl:"handle",id:U,kind:z});Z.set(U,{kind:z,target:L});let O=X.get(L);if(!O)O=new Map,X.set(L,O);return O.set(z,j),j},K=Object.freeze({browser:Y("browser",$.browser),context:Y("context",$.context),page:Y("page",$.page)}),V=(z)=>{if(!z0(z)||Object.keys(z).length!==3||z.$handsRepl!=="handle"||typeof z.id!=="string"||!aQ.test(z.id)||!v8(z.kind))I("hands_repl_invalid_handle");let L=Z.get(z.id);if(!L||L.kind!==z.kind)I("hands_repl_unknown_handle");return L},G=(z,L=0,W=new Set)=>{if(L>$Z)I("hands_repl_json_too_complex");if(z===void 0)return t9();if(z===null||typeof z==="boolean"||typeof z==="string")return z;if(typeof z==="number"){if(!Number.isFinite(z))I("hands_repl_non_json_result");return z}if(Array.isArray(z)){if(W.has(z))I("hands_repl_cyclic_result");W.add(z);try{return z.map((U)=>G(U,L+1,W))}finally{W.delete(z)}}if(!z0(z))I("hands_repl_non_json_result");if(W.has(z))I("hands_repl_cyclic_result");W.add(z);try{let U=Object.create(null);for(let j of Object.keys(z)){let O=Object.getOwnPropertyDescriptor(z,j);if(!O||!("value"in O))continue;U[j]=G(O.value,L+1,W)}return U}finally{W.delete(z)}},F=(z,L)=>{if(L==="void")return t9();if(L==="json")return G(z);if(L==="bytes")return B1(z);let W=U1(L);if(W){if(!Array.isArray(z))I("hands_repl_expected_target_list");if(W==="context"&&z.some((U)=>U!==$.context))I("hands_repl_foreign_context");return z.map((U)=>Y(W,U))}if(z===null||z===void 0)return t9();if(!v8(L))I("hands_repl_invalid_return_kind");if(L==="context"&&z!==$.context)I("hands_repl_foreign_context");return Y(L,z)},B=(z)=>{if(z0(z)&&z.$handsRepl==="handle")return V(z).target;if(oQ(z))return X9.from(z.base64,"base64");if(W1(z))return;if(rQ(z))I("hands_repl_route_fulfill_only");if(Array.isArray(z))return z.map(B);if(!z0(z))return z;let L=Object.create(null);for(let[W,U]of Object.entries(z))L[W]=B(U);return L};return Object.freeze({roots:K,dispatch:async(z)=>{if(!z0(z)||typeof z.type!=="string")I("hands_repl_invalid_request");if(z.type==="a11y"){let T=z.target===void 0?Z.get(K.page.id):V(z.target);if(!T||T.kind!=="page"&&T.kind!=="locator")I("hands_repl_invalid_a11y_target");return G(await $.a11y(T.target))}if(z.type==="view"){if(J9(z.source),z.options!==void 0)J9(z.options);let T=oQ(z.source)?X9.from(z.source.base64,"base64"):z.source;if($.privateProfile&&!X9.isBuffer(T))I("hands_repl_profile_requires_image_bytes");return G(await $.view(T,z.options))}if(z.type!=="call")I("hands_repl_invalid_request");if(typeof z.method!=="string"||z.method.length===0||z.method.length>128)I("hands_repl_invalid_method");if(eQ.has(z.method))I("hands_repl_forbidden_method");let L=V(z.target),W=z.args??[];if(!Array.isArray(W))I("hands_repl_invalid_arguments");if(J9(W),L.kind==="page"&&z.method==="captureScreenshot"){if(W.length!==0)I("hands_repl_invalid_arguments");if(!$.screenshotExport)I("hands_repl_screenshot_export_unavailable");return G(await $.screenshotExport(L.target))}if(L.kind==="context"&&["startRecording","stopRecording"].includes(z.method)){if(!$.recording||L.target!==$.context)I("hands_repl_recording_unavailable");if(W.length>(z.method==="startRecording"?1:0))I("hands_repl_invalid_arguments");return G(z.method==="startRecording"?await $.recording.start(W[0]):await $.recording.stop())}if($.privateProfile){let T=z.method;if(["evaluate","evaluateAll","waitForFunction","addInitScript","addScriptTag","addStyleTag","setContent","setInputFiles","route","content","cookies","storageState","addCookies","clearCookies","setExtraHTTPHeaders","setHTTPCredentials","grantPermissions","clearPermissions","innerHTML","textContent","allTextContents"].includes(T)||L.kind==="browser"&&T==="close"||L.kind==="context"&&T==="close")I("hands_repl_private_profile_method_denied");if(L.kind==="browser"&&T==="contexts")return F([$.context],"context[]");if((T==="screenshot"||T==="pdf")&&z0(W[0])&&(("path"in W[0])||("style"in W[0])))I("hands_repl_private_profile_path_denied");if(T==="goto"){if(typeof W[0]!=="string")I("hands_repl_private_profile_url_denied");try{let S=new URL(W[0]);if(!["http:","https:"].includes(S.protocol)&&W[0]!=="about:blank")I("hands_repl_private_profile_url_denied")}catch{I("hands_repl_private_profile_url_denied")}}if(T==="getAttribute"&&(typeof W[0]!=="string"||!V1.has(W[0].toLowerCase())))I("hands_repl_private_profile_attribute_denied");if(L.kind==="locator"&&["innerText","allInnerTexts","getAttribute"].includes(T)){let S=[L.target];if(T==="allInnerTexts"){let m=Reflect.get(L.target,"all");if(typeof m!=="function")I("hands_repl_private_profile_probe_unavailable");let E=await Reflect.apply(m,L.target,[]);if(!Array.isArray(E)||E.length>QZ||!E.every(k0))I("hands_repl_private_profile_probe_unavailable");S=E}for(let m of S){let E=Reflect.get(m,"isVisible");if(typeof E!=="function"||!await Reflect.apply(E,m,[]))I("hands_repl_private_profile_hidden_value_denied")}}if(T==="press"&&typeof W[0]==="string"&&F1(W[0]))I("hands_repl_private_profile_browser_shortcut_denied");if(L.kind==="locator"&&["inputValue","click","dblclick","tap","press"].includes(T)){let S=Reflect.get(L.target,"evaluate");if(typeof S!=="function")I("hands_repl_private_profile_probe_unavailable");let m=await Reflect.apply(S,L.target,[H1]);if(!z0(m)||typeof m.password!=="boolean"||typeof m.executableLink!=="boolean")I("hands_repl_private_profile_probe_unavailable");if(T==="inputValue"&&m.password)I("hands_repl_private_profile_password_denied");if(T!=="inputValue"&&m.executableLink)I("hands_repl_private_profile_url_denied");if(T==="inputValue"){let E=Reflect.get(L.target,"isVisible");if(typeof E!=="function"||!await Reflect.apply(E,L.target,[]))I("hands_repl_private_profile_hidden_value_denied")}}}let U=ZZ[L.kind][z.method];if(!U)I("hands_repl_method_not_allowed");if(U.requiresStringSource&&typeof W[0]!=="string")I("hands_repl_string_source_required");if(L.kind==="browser"&&z.method==="contexts")return[K.context];if(["addInitScript","addScriptTag","addStyleTag","screenshot","pdf","storageState"].includes(z.method)&&W.some((T)=>z0(T)&&("path"in T)))I("hands_repl_file_path_not_allowed");if(z.method==="goto"&&typeof W[0]==="string"){let T;try{T=new URL(W[0]).protocol}catch{I("hands_repl_invalid_url")}if(!["http:","https:","data:","about:","blob:"].includes(T))I("hands_repl_file_path_not_allowed")}if(U.special==="contextViewportSize"){let T=Reflect.get(L.target,"pages");if(typeof T!=="function")I("hands_repl_method_unavailable");let S=await Reflect.apply(T,L.target,[]),m=Array.isArray(S)?S[0]:void 0,E=k0(m)?Reflect.get(m,"viewportSize"):void 0;if(typeof E!=="function")return t9();return F(await Reflect.apply(E,m,[]),U.returns)}if(U.special==="property"){let T=Reflect.get(L.target,z.method);return F(typeof T==="function"?Reflect.apply(T,L.target,[]):T,U.returns)}let j=Reflect.get(L.target,z.method);if(typeof j!=="function")I("hands_repl_method_unavailable");if(U.special==="route"){let T=W[1];if(!rQ(T))I("hands_repl_invalid_route_handler");J9(T.options);let S=B(T.options),m=async(M)=>{if(!k0(M))I("hands_repl_invalid_route");let D=Reflect.get(M,"fulfill");if(typeof D!=="function")I("hands_repl_invalid_route");await Reflect.apply(D,M,[S])},E=[B(W[0]??null),m],N=await Reflect.apply(j,L.target,E);return F(N,U.returns)}let O=W.map(B);if(z.method==="setInputFiles"){let T=L.kind==="locator"?0:1,S=async(E)=>{if(typeof E!=="string"){if(!z0(E)||typeof E.name!=="string"||typeof E.mimeType!=="string"||!X9.isBuffer(E.buffer))I("hands_repl_invalid_file_input");return E}if(!$.readWorkspaceFile)I("hands_repl_workspace_required");return $.readWorkspaceFile(E)},m=O[T];O[T]=Array.isArray(m)?await Promise.all(m.map(S)):await S(m)}if(z.method==="goto")await $.beforeNavigation?.();let q=$.actionRecorder?.(),A=await Reflect.apply(j,L.target,O),P={click:"Click browser element",tap:"Click browser element",dblclick:"Double click browser element",fill:"Type text",type:"Type text",pressSequentially:"Type text",clear:"Clear browser field",press:"Press key",scrollIntoViewIfNeeded:"Scroll browser element into view",dragTo:"Drag on computer",selectOption:"Select browser option",check:"Check browser control",uncheck:"Uncheck browser control",hover:"Hover browser element",focus:"Focus browser element",goto:"Open browser page",reload:"Reload browser page",goBack:"Go back in browser",goForward:"Go forward in browser",screenshot:"Take browser screenshot"}[z.method];if(P){let T=Reflect.get(L.target,"page"),S=L.kind==="page"?L.target:typeof T==="function"?Reflect.apply(T,L.target,[]):void 0;q?.(P,k0(S)?S:void 0)}return F(A,U.returns)}})}import{isIP as KZ}from"net";import{Resolver as L1}from"dns/promises";import{isIP as $8}from"net";var N1=[["0.0.0.0",8],["10.0.0.0",8],["100.64.0.0",10],["127.0.0.0",8],["169.254.0.0",16],["172.16.0.0",12],["192.0.0.0",24],["192.0.2.0",24],["192.168.0.0",16],["198.18.0.0",15],["198.51.100.0",24],["203.0.113.0",24],["224.0.0.0",4],["240.0.0.0",4]];function c8($){if($8($)!==4)return null;let Q=$.split(".");if(Q.length!==4)return null;let Z=0;for(let X of Q){let J=Number(X);if(!Number.isInteger(J)||J<0||J>255)return null;Z=Z*256+J}return Z>>>0}function M1($,Q,Z){let X=c8(Q);if(X===null)return!1;let J=Z===0?0:4294967295<<32-Z>>>0;return($&J)>>>0===(X&J)>>>0}function JZ($){let Q=c8($);if(Q===null)return!0;return N1.some(([Z,X])=>M1(Q,Z,X))}function j1($){if($8($)!==6)return null;let Q=$.toLowerCase(),Z=Q.indexOf("%");if(Z>=0)Q=Q.slice(0,Z);let X=[],J=Q.lastIndexOf(":"),Y=J>=0?Q.slice(J+1):"";if(Y.includes(".")){let z=c8(Y);if(z===null)return null;X=[z>>>16&65535,z&65535],Q=Q.slice(0,J+1)+"0:0"}let K=Q.split("::");if(K.length>2)return null;let V=(z)=>{if(z==="")return[];let L=[];for(let W of z.split(":")){if(W===""||W.length>4||!/^[0-9a-f]+$/.test(W))return null;L.push(Number.parseInt(W,16))}return L},G=V(K[0]??"");if(G===null)return null;if(K.length===1){let z=G;if(z.length!==8)return null;return X.length>0?z.slice(0,6).concat(X):z}let F=V(K[1]??"");if(F===null)return null;let B=8-G.length-F.length;if(B<0)return null;let H=G.concat(Array(B).fill(0),F);if(H.length!==8)return null;return X.length>0?H.slice(0,6).concat(X):H}function C1($,Q){return`${$>>8&255}.${$&255}.${Q>>8&255}.${Q&255}`}function q1($){let Q=j1($);if(Q===null)return!0;let[Z,X,J]=Q;if((Z&57344)!==8192)return!0;if(Z===8193&&(X&65024)===0)return!0;if(Z===8193&&X===3512)return!0;if(Z===16383&&(X&61440)===0)return!0;if(Z===8194)return JZ(C1(X,J));return!1}function YZ($){return $.replace(/^\[|\]$/g,"")}function e9($){let Q=YZ($.trim()),Z=$8(Q);if(Z===4)return JZ(Q);if(Z===6)return q1(Q);return!0}function GZ($){if($ instanceof Error&&$.name==="TimeoutError")return"dns_timeout";switch(typeof $==="object"&&$!==null&&"code"in $?$.code:void 0){case"ENOTFOUND":return"dns_not_found";case"ENODATA":return"dns_empty";case"EAI_AGAIN":case"ESERVFAIL":case"ECONNREFUSED":return"dns_temporary";case"ETIMEOUT":case"ETIMEDOUT":return"dns_timeout";default:return"dns_failed"}}var zZ=5000;function T1($){return async(Q,Z)=>{if(Z?.aborted)throw Error("aborted");let X=new L1({timeout:zZ,tries:1});if($)X.setServers($);let J=()=>X.cancel();Z?.addEventListener("abort",J,{once:!0});try{let[Y,K]=await Promise.allSettled([X.resolve4(Q),X.resolve6(Q)]),V=[...Y.status==="fulfilled"?Y.value:[],...K.status==="fulfilled"?K.value:[]];if(V.length>0)return V;let G=[Y,K].flatMap((B)=>B.status==="rejected"?[B.reason]:[]);throw G.find((B)=>["dns_temporary","dns_timeout"].includes(GZ(B)))??G[0]??Object.assign(Error("DNS returned no addresses"),{code:"ENODATA"})}finally{Z?.removeEventListener("abort",J)}}}var O1=T1();async function D1($,Q,Z,X){if(X?.aborted)throw Error("aborted");let J=new AbortController,Y,K,V=Q($,J.signal);V.catch(()=>{});try{return await Promise.race([V,new Promise((G,F)=>{if(Y=setTimeout(()=>F(new DOMException("DNS lookup timed out","TimeoutError")),Z),X)K=()=>F(Error("aborted")),X.addEventListener("abort",K,{once:!0})})])}finally{if(Y!==void 0)clearTimeout(Y);if(X&&K)X.removeEventListener("abort",K);J.abort()}}async function XX($,Q=O1,Z){let X=YZ($);if($8(X))return e9(X)?{ok:!1,reason:"non_public_ip"}:{ok:!0,addresses:[X]};let J;try{J=await D1(X,Q,zZ,Z)}catch(Y){return{ok:!1,reason:Z?.aborted?Z.reason instanceof Error&&Z.reason.name==="TimeoutError"?"dns_timeout":"aborted":GZ(Y)}}if(J.length===0)return{ok:!1,reason:"dns_empty"};if(J.some(e9))return{ok:!1,reason:"non_public_ip"};return{ok:!0,addresses:J}}var _1=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;function d8($){return $.length<=253&&_1.test($.toLowerCase())}function A1($,Q){let Z=$.trim().toLowerCase();if(!d8(Z))return!1;if(Z.startsWith("*.")){let X=Z.slice(2);return Q===X||Q.endsWith(`.${X}`)}return Z===Q}function x1($){let Q=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec($);if(!Q)return null;let Z=Q.slice(1).map(Number);return Z.some((X)=>X>255)?null:Z}function p8($,Q=[]){let Z=(X)=>{if(X=X.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,""),!X.includes(":"))return X;try{X=new URL(`http://[${X}]/`).hostname.slice(1,-1)}catch{return X}let J=/^::ffff:([\da-f]+):([\da-f]+)$/.exec(X);if(!J)return X;let Y=parseInt(J[1],16),K=parseInt(J[2],16);return`${Y>>8}.${Y&255}.${K>>8}.${K&255}`};return Q.some((X)=>Z(X)===Z($))}function u0($){$=$.toLowerCase().replace(/^\[|\]$/g,"");let Q=x1($);if(Q){let[Y,K,V]=Q;if(Y===127)return"loopback";return Y===0||Y===10||Y>=224||Y===100&&K>=64&&K<=127||Y===169&&K===254||Y===172&&K>=16&&K<=31||Y===192&&(K===168||K===0&&(V===0||V===2)||K===88&&V===99)||Y===198&&(K===18||K===19||K===51&&V===100)||Y===203&&K===0&&V===113?"private":"public"}if(!$.includes(":"))return"hostname";try{$=new URL(`http://[${$}]/`).hostname.slice(1,-1)}catch{return"private"}if($==="::1")return"loopback";let Z=/^::ffff:([\da-f]+):([\da-f]+)$/.exec($);if(Z){let Y=parseInt(Z[1],16),K=parseInt(Z[2],16);return u0(`${Y>>8}.${Y&255}.${K>>8}.${K&255}`)==="public"?"public":"private"}let[X,J=0]=$.split(":").map((Y)=>parseInt(Y||"0",16));return X<8192||X>16383||X===8194||X===8193&&(J<512||J===3512)||X===16383&&J<4096?"private":"public"}function I9($,Q){let Z;try{Z=new URL($)}catch{return{allowed:!1,url:$,host:null,reason:"invalid_url"}}if(["about:","data:","blob:"].includes(Z.protocol))return{allowed:!0,url:$,host:null,reason:"local_document"};if(!["http:","https:","ws:","wss:"].includes(Z.protocol))return{allowed:!1,url:$,host:Z.hostname||null,reason:"unsupported_protocol"};let X=Z.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,"");if(Q.mode==="off")return{allowed:!0,url:$,host:X,reason:"policy_off"};let J=(V)=>({allowed:!1,url:$,host:X,reason:V});if(Z.username||Z.password)return J("invalid_url");if(Q.mode==="public_web"){let V=u0(X)!=="public"&&u0(X)!=="hostname"||X==="localhost"||/\.(?:localhost|local|internal|arpa)$/.test(X)||!X.includes(".")&&!KZ(X)||Boolean(KZ(X)&&e9(X));return{allowed:!V,url:$,host:X,reason:V?"private_network":"public_web"}}let Y=Number(Z.port||(["https:","wss:"].includes(Z.protocol)?443:80));if(Q.deniedPorts?.includes(Y)||p8(X,Q.deniedHosts))return J("destination_not_allowed");let K=u0(X);if(K==="private"||["local","internal","arpa"].some((V)=>X===V||X.endsWith(`.${V}`)))return J("private_network");if(K==="loopback"||X==="localhost"||X.endsWith(".localhost"))return Q.allowedLoopbackPorts?.includes(Y)?{allowed:!0,url:$,host:X,reason:"loopback"}:J("destination_not_allowed");if(Q.allowedDomains.some((V)=>A1(V,X)))return{allowed:!0,url:$,host:X,reason:"allowed_domain"};return{allowed:!1,url:$,host:X,reason:"destination_not_allowed"}}import FZ from"child_process";import{accessSync as I1,constants as R1,readFileSync as E1,statSync as WZ}from"fs";import{createRequire as BZ}from"module";import{homedir as HZ}from"os";import{dirname as S1,isAbsolute as u8,join as Y9,resolve as w1}from"path";var Q8=Object.freeze({schemaVersion:1,driver:"playwright-core",driverVersion:UZ.dependencies["playwright-core"],browser:"chromium"}),LZ=["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome","/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge","/Applications/Brave Browser.app/Contents/MacOS/Brave Browser","/Applications/Chromium.app/Contents/MacOS/Chromium"],l8=["/usr/bin/chromium","/usr/bin/chromium-browser","/usr/bin/google-chrome","/usr/bin/google-chrome-stable"];function R9($){try{return I1($,R1.X_OK),u8($)&&WZ($).isFile()}catch{return!1}}function s8($,Q=process.platform){let Z=Q==="darwin"?LZ:Q==="linux"?l8:null;return Z?($??Z).find(R9)??null:null}function b1(){if(!process.versions.bun)return;let $=Symbol.for("ara.headless-browser.bun-pipe-owners");if(Object.hasOwn(globalThis,$))return;let Q=[];FZ.spawn=new Proxy(FZ.spawn,{apply(Z,X,J){let Y=Reflect.apply(Z,X,J),K=J[1],V=J[2]?.stdio;if(Array.isArray(K)&&K.includes("--remote-debugging-pipe")&&Array.isArray(V)&&V[3]==="pipe"&&V[4]==="pipe")Q.push(Y);return Y}}),Object.defineProperty(globalThis,$,{value:Q})}async function Z8($){if(b1(),$!==void 0){if(!u8($))throw Error("hands_browser_driver_path_must_be_absolute");let X=Y9($,"package.json"),J=JSON.parse(E1(X,"utf8"));if(J.name!==Q8.driver)throw Error("hands_browser_wrong_driver");let Y=BZ(X)($),K=Y.default?.chromium??Y.chromium;if(!K)throw Error("hands_browser_missing_chromium");return{version:J.version,chromium:K}}let[Q,Z]=await Promise.all([import("./index-kf4q2kw5.js"),import("./package-gxv23nam.js").then((m)=>P1(m.default,1))]);return{version:Z.default.version,chromium:Q.chromium}}var k1=($,Q=Q8.driverVersion)=>({status:"unavailable",reason:$,expectedDriverVersion:Q}),f1=($)=>$.loadDriver?.()??Z8($.driverModuleDirectory),m1={"1.60.0":"1223"};function BX(){let $=process.platform,Q=m1[Q8.driverVersion];if(!Q||$!=="linux"&&$!=="darwin")return!1;let Z=(X)=>process.env[X]??process.env[`npm_config_${X.toLowerCase()}`]??process.env[`npm_package_config_${X.toLowerCase()}`];try{let X=Z("PLAYWRIGHT_BROWSERS_PATH"),J=X==="0"?Y9(S1(BZ(import.meta.url).resolve("playwright-core/package.json")),".local-browsers"):X?w1(Z("INIT_CWD")||process.cwd(),X):Y9($==="darwin"?Y9(HZ(),"Library","Caches"):process.env.XDG_CACHE_HOME||Y9(HZ(),".cache"),"ms-playwright");return WZ(Y9(J,`chromium-${Q}`,"INSTALLATION_COMPLETE")).isFile()}catch{return!1}}async function G9($={}){return NZ($,Q8.driverVersion)}async function n8($,Q={}){if($.driverVersion!=="1.61.1"||!u8($.driverModuleDirectory))throw Error("hands_browser_invalid_managed_compatibility");return NZ({...Q,driverModuleDirectory:$.driverModuleDirectory,allowSystemBrowser:!0},$.driverVersion)}async function NZ($,Q){let Z=(G)=>k1(G,Q),X=$.platform??process.platform;if(X!=="linux"&&X!=="darwin")return Z("unsupported_platform");let J;try{J=await f1($)}catch{return Z("driver_missing")}if(J.version!==Q)return Z("driver_version_mismatch");let Y=(G,F)=>({status:"resolved",executablePath:G,source:F,driverVersion:J.version});if($.executablePath!==void 0)return R9($.executablePath)?Y($.executablePath,"configured"):Z("executable_missing");let K=J.chromium.executablePath();if(R9(K))return Y(K,"managed");let V=$.allowSystemBrowser===!0?s8($.systemCandidates,X):null;return V?Y(V,"system"):Z("executable_missing")}var a1=["/usr/local/bin/chromium",...l8];function o1($,Q=DZ()){return s8($??(Q==="linux"?a1:void 0),Q)}async function r1(){try{return(await Z8()).chromium}catch{return u1(import.meta.url)("playwright-core").chromium}}var t1=1048576,e1=105000,$7=20000,CZ=5000,Q7=2000,Z7=1000,X7=30000,qZ=81920,J7={".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".gif":"image/gif"};async function Y7($,Q){let Z=new URL($.url()),X={...await $.allHeaders(),host:Z.host};for(let J of Object.keys(X))if(/^(?:proxy-|connection$|upgrade$|transfer-encoding$|content-length$)/i.test(J))delete X[J];return new Promise((J,Y)=>{let V=(Z.protocol==="https:"?s1:l1)(Z,{method:$.method(),headers:X,agent:!1,lookup:(F,B,H)=>{let z=l0.isIP(Q);if(B.all)H(null,[{address:Q,family:z}]);else H(null,Q,z)}},(F)=>{let B=[],H=0;F.on("data",(z)=>{if(H+=z.length,H>33554432)V.destroy(Error("hands_browser_response_too_large"));else B.push(z)}),F.on("error",Y),F.on("end",()=>{let z={};for(let[L,W]of Object.entries(F.headers))if(W!==void 0&&!["transfer-encoding","connection","content-length"].includes(L))z[L]=Array.isArray(W)?W.join(`
-`):W;J({status:F.statusCode??502,headers:z,body:Buffer.concat(B)})})}),G=setTimeout(()=>V.destroy(Error("hands_browser_fetch_timeout")),X7);V.once("close",()=>clearTimeout(G)),V.on("error",Y),V.end($.postDataBuffer()??void 0)})}async function G7($,Q,Z=()=>{},X={lookup:(J)=>p1(J,{all:!0}),fetch:Y7}){let J=new WeakSet,Y=new WeakMap,K=(V)=>{let G=Y.get(V);if(G)return G;let F=(async()=>{if(!$.newCDPSession)return;let B=await $.newCDPSession(V),H=new Map;B.on("Network.loadingFinished",({requestId:z})=>H.delete(z)),B.on("Network.loadingFailed",({requestId:z})=>H.delete(z)),B.on("Fetch.requestPaused",async(z)=>{let L=z.networkId??z.requestId,W=z.redirectedRequestId?(H.get(L)??0)+1:0;H.set(L,W);let U=I9(z.request.url,Q),j=Q.mode==="enforce"&&Boolean(z.redirectedRequestId)&&U.host!==null&&!l0.isIP(U.host),O=!U.allowed?U:j?{...U,allowed:!1,reason:"destination_not_allowed"}:W>20?{...U,allowed:!1,reason:"redirect_not_supported"}:null;try{if(O)Z(O),await B.send("Fetch.failRequest",{requestId:z.requestId,errorReason:"BlockedByClient"});else await B.send("Fetch.continueRequest",{requestId:z.requestId})}catch{await B.send("Fetch.failRequest",{requestId:z.requestId,errorReason:"Failed"}).catch(()=>{})}}),await B.send("Network.enable"),await B.send("Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]}),J.add(V)})();return Y.set(V,F),F};return await $.route("**/*",async(V)=>{let G=V.request().url(),F=I9(G,Q);if(F.allowed&&Q.mode==="public_web"){await V.continue();return}let B=V.request();if(F.allowed&&F.host&&l0.isIP(F.host)&&B.isNavigationRequest?.()){let H=B.frame();if(J.has(H.page())&&H===H.page().mainFrame()){await V.continue();return}}if(F.allowed&&(Q.mode==="off"||F.reason==="local_document")){await V.continue();return}if(F.allowed&&F.host)try{let H=F.host,z=u0(H),L,W=await(async()=>{if(z!=="hostname")return[{address:H,family:l0.isIP(H)}];if(F.reason==="loopback")return[{address:"127.0.0.1",family:4}];try{return await Promise.race([X.lookup(H),new Promise((U,j)=>{L=setTimeout(()=>j(Error("hands_browser_dns_timeout")),5000)})])}finally{if(L)clearTimeout(L)}})();if(!W.length||W.some(({address:U})=>{let j=u0(U);return!l0.isIP(U)||Q.mode==="enforce"&&p8(U,Q.deniedHosts)||(F.reason==="loopback"?j!=="loopback":j!=="public")}))F={...F,allowed:!1,reason:"private_network"};else{let U=await X.fetch(V.request(),W[0].address);if(U.status>=300&&U.status<400){let j=U.headers.location??G;try{j=new URL(j,G).href}catch{}let O=I9(j,Q);F=O.allowed?{...O,allowed:!1,reason:"redirect_not_supported"}:O}else{await V.fulfill(U);return}}}catch{await V.abort("failed");return}Z(F),await V.abort("blockedbyclient")}),await $.routeWebSocket("**/*",async(V)=>{let G=I9(V.url(),Q);if(Q.mode==="enforce"&&G.allowed&&(!G.host||!l0.isIP(G.host)))G={...G,allowed:!1,reason:"destination_not_allowed"};if(G.allowed){V.connectToServer();return}Z(G),await V.close({code:1008,reason:"Reason egress policy denied"})}),Q.mode==="off"?void 0:{preparePage:K}}async function _Z($,Q=DZ(),Z){if(Z){let J=await n8(Z,{platform:Q,systemCandidates:$});return J.status==="resolved"?J.executablePath:null}if($!==void 0){let J=o1($,Q);if(J)return J}let X=await G9({platform:Q,systemCandidates:$,allowSystemBrowser:!0});return X.status==="resolved"?X.executablePath:null}function TZ($,Q){if(!$)throw Error("hands_repl_workspace_required");let Z=a8($),X=z9($),J=o8(X,z9(X,Q)),K=J!==".."&&!J.startsWith(`..${r8}`)&&!jZ(J)?z9(Z,J):z9(Z,Q);if(b0(z9(X,Q))||b0(K))throw Error("hands_repl_protected_path");let V=(W)=>{let U=o8(Z,W);return U!==""&&U!==".."&&!U.startsWith(`..${r8}`)&&!jZ(U)},G=a8(K);if(b0(G))throw Error("hands_repl_protected_path");if(!V(K)||!V(G))throw Error("hands_repl_file_outside_workspace");let F=o8(Z,K).split(r8),B=[Z,...F.map((W,U)=>z9(Z,...F.slice(0,U+1)))],H=B.map((W)=>MZ(W));if(H.some((W)=>W.isSymbolicLink()))throw Error("hands_repl_file_symlink");let z=H[H.length-1];if(!z.isFile()||z.nlink!==1||z.size>16777216)throw Error("hands_repl_file_not_regular_or_too_large");let L=v1(K,i8.O_RDONLY|i8.O_NOFOLLOW|i8.O_NONBLOCK);try{let W=h1(L);if(W.dev!==z.dev||W.ino!==z.ino||!W.isFile())throw Error("hands_repl_file_changed");for(let q=0;q<B.length;q++){let A=MZ(B[q]);if(A.dev!==H[q].dev||A.ino!==H[q].ino||A.isSymbolicLink())throw Error("hands_repl_file_changed")}if(!V(a8(K)))throw Error("hands_repl_file_outside_workspace");let U=Buffer.alloc(16777217),j=0;while(j<U.length){let q=c1(L,U,j,U.length-j,null);if(!q)break;j+=q}if(j===U.length)throw Error("hands_repl_file_too_large");let O=U.subarray(0,j);return{name:n1(K),mimeType:J7[i1(K).toLowerCase()]??"application/octet-stream",buffer:O}}finally{y1(L)}}function K9($,Q){$.end(`${JSON.stringify(Q)}
-`)}function X8($){try{d1($)}catch{}}async function AZ($){if($.managedBrowser&&$.driverModuleDirectory!==void 0)throw Error("hands_browser_ambiguous_driver_configuration");let Q=$.launch||$.targetContext?null:$.managedBrowser?await n8($.managedBrowser,{executablePath:$.browserExecutablePath}):await G9({executablePath:$.browserExecutablePath,driverModuleDirectory:$.driverModuleDirectory});if(Q?.status==="unavailable")throw Error(`hands_browser_${Q.reason}`);let Z=Q?.status==="resolved"?Q.executablePath:$.browserExecutablePath;if(!Z||!R9(Z))throw Error("hands_browser_unavailable");let X=$.launch??(async(N)=>($.targetContext?await r1():(await Z8($.managedBrowser?.driverModuleDirectory??$.driverModuleDirectory)).chromium).launch(N)),J=[],Y={},K=null,V=null,G=null,F=null,B=!1,H=null,z=new Map,L=new WeakMap,W=null,U=()=>{if(B)throw Error("hands_repl_stopped");if(F)throw F},j=(N)=>{let M=L.get(N);if(M)return M;let D=Promise.resolve().then(()=>N.close()).then(()=>{z.delete(N)});return L.set(N,D),D},O=async()=>{let N=[...z.entries()].reverse(),M=W??=performance.now()+Z7,D=Promise.allSettled(N.filter(([,_])=>_==="context").map(([_])=>j(_))),w;try{await Promise.race([D,new Promise((_)=>{w=setTimeout(_,Math.max(0,M-performance.now()))})])}finally{if(w)clearTimeout(w)}let k=await Promise.allSettled(N.map(([_])=>j(_))),f=[];for(let[_,g]of k.entries()){if(g.status!=="rejected")continue;let c=g.reason instanceof Error&&["Error","TimeoutError","ProtocolError"].includes(g.reason.name)?g.reason.name:"unknown";f.push(Error(`hands_repl_close_failed: ${N[_][1]}: ${c}`))}if(f.length)throw AggregateError(f,"hands_repl_stop_unconfirmed")},q=(N,M)=>{if(z.set(N,M),B||F)j(N).catch(()=>{return}),U();return N},A=async()=>{let N=await X({executablePath:Z,headless:!0,chromiumSandbox:$.managedBrowser===void 0,args:["--disable-background-networking","--disable-quic","--disable-dev-shm-usage","--disable-gpu","--disable-software-rasterizer","--dns-prefetch-disable","--force-webrtc-ip-handling-policy=disable_non_proxied_udp","--no-pings"]}),M=null;try{q(N,"browser"),M=$.targetContext??q(await N.newContext({viewport:{width:1440,height:900},screen:{width:1440,height:900},serviceWorkers:"block",acceptDownloads:!1}),"context");let D=await G7(M,$.networkPolicy??{mode:"off"},$.onEgressDenied);if(U(),D){let b=M.newPage.bind(M);M.newPage=async()=>{let h=await b();return await D.preparePage(h),h}}let k=M.pages()[0]??await M.newPage();await D?.preparePage(k),U();let f=async(b=k)=>{let h=b;if(typeof h.ariaSnapshot==="function")return h.ariaSnapshot({timeout:1e4});return k.locator("body").innerText({timeout:1e4})},_=async(b,h={})=>{let d=h&&typeof h==="object"&&!Array.isArray(h)?h:{},l,G0="image/png";if(Buffer.isBuffer(b)||b instanceof Uint8Array)l=Buffer.from(b);else if(typeof b==="string"&&(b.startsWith("data:")||/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(b)))l=Buffer.from(b.replace(/^data:[^,]*,/,""),"base64");else if(typeof b==="string"){let T0=TZ($.workspaceRoot,b);l=T0.buffer,G0=T0.mimeType}else throw Error("view() needs a Buffer, a base64 string, or a path to an image file");if(l.length===0)throw Error("view(): the image is empty");let M0=String(d.label??"").replace(/[\r\n>]+/g," ").trim().slice(0,120),U0=Number(d.maxWidth)||1024,W0=Number(d.quality)||72,y0=$.targetContext?await N.newPage():await M.newPage();try{let T0=`data:${G0};base64,${l.toString("base64")}`;for(let r=0;r<5;r+=1){let j0=await y0.evaluate(async(B0)=>{let C0=new Image;C0.src=B0.url,await C0.decode();let h0=Math.min(1,B0.maxWidth/C0.naturalWidth),Y0=document.createElement("canvas");Y0.width=Math.max(1,Math.round(C0.naturalWidth*h0)),Y0.height=Math.max(1,Math.round(C0.naturalHeight*h0));let X0=Y0.getContext("2d");if(!X0)throw Error("view(): canvas unavailable");return X0.fillStyle="#ffffff",X0.fillRect(0,0,Y0.width,Y0.height),X0.drawImage(C0,0,0,Y0.width,Y0.height),{data:Y0.toDataURL("image/jpeg",B0.q/100).split(",")[1]??"",width:Y0.width,height:Y0.height,sourceWidth:C0.naturalWidth,sourceHeight:C0.naturalHeight}},{url:T0,maxWidth:U0,q:W0}),r0=Buffer.from(j0.data,"base64");if(r0.length<=qZ){let B0=M0||"image";return`<<<ARA_VIEW_IMAGE ${j0.data} image/jpeg ${B0}>>>
-Viewing ${B0} (${j0.sourceWidth}x${j0.sourceHeight} source, sent at ${j0.width}x${j0.height}, ${Math.round(r0.length/1024)}KB).`}if(U0>640)U0=Math.round(U0*0.75);else W0=Math.max(30,W0-15)}throw Error(`view(): could not reduce the image under ${Math.round(qZ/1024)}KB`)}finally{await y0.close().catch(()=>{return})}},g=XZ({browser:$.targetContext?.browser()??N,context:M,page:k,a11y:f,view:_,readWorkspaceFile:(b)=>TZ($.workspaceRoot,b),privateProfile:$.privateProfile,beforeNavigation:$.beforeNavigation,recording:$.recording,screenshotExport:$.screenshotExport,actionRecorder:()=>{let b=J,h=Y;return(d,l)=>{if(b.length<OZ)b.push(d);if(l)h.page=l}}}),c=async(b)=>{U();let h=q(await N.newContext({serviceWorkers:"block",acceptDownloads:!1}),"context");try{await h.route("**/*",(l)=>l.abort()),U(),await h.routeWebSocket("**/*",(l)=>l.close({code:1008,reason:"Reason evaluator network denied"})),U(),await h.exposeBinding("__araHandsRpc",async(l,G0)=>$.onBrowserOperation?$.onBrowserOperation(b,()=>g.dispatch(G0)):g.dispatch(G0)),U();let d=await h.newPage();return U(),await d.goto("data:text/html,<title>Reason Hands evaluator</title>"),U(),await d.evaluate(`(${nQ})(${JSON.stringify(g.roots)})`),{context:h,page:d,runId:b}}catch(d){throw await j(h).catch(()=>{return}),d}},u=await c(),o={browser:N,context:M,page:k,evaluator:u,async captureProgressFrame(b){return _(await b.screenshot({type:"jpeg",quality:65,timeout:2000}),{label:"Screen after browser action"})},async resetEvaluator(b){await j(o.evaluator.context),o.evaluator=await c(b)}};return U(),o}catch(D){throw await O().catch(()=>{return}),D}},R=async()=>{if(U(),K)return K;if(!G){V=A();let N;G=Promise.race([V,new Promise((M,D)=>{N=setTimeout(()=>D(Error("hands_browser_unavailable: startup timed out")),$7)})]).then((M)=>{return U(),K=M,M}).catch(async()=>{F=Error("hands_browser_unavailable: startup failed or timed out");let M;try{await Promise.race([O(),new Promise((D,w)=>{M=setTimeout(()=>w(Error("hands_repl_stop_timeout")),CZ)})])}catch{F=Error("hands_browser_unavailable: startup cleanup unconfirmed")}finally{if(M)clearTimeout(M)}throw F}).finally(()=>{if(N)clearTimeout(N)})}return G},P=async(N,M,D=!1)=>{let w=await R(),k=Y;if($.onBrowserOperation&&w.evaluator.runId!==M)await w.resetEvaluator(M);let _=(async()=>{let u=await w.evaluator.page.evaluate(`(${iQ})(${JSON.stringify({code:N})})`);if(typeof u!=="string")throw Error("hands_repl_invalid_evaluator_output");let o=k.page;if(D&&o&&!u.includes("<<<ARA_VIEW_IMAGE")){let b=()=>w.captureProgressFrame(o);try{let h=await($.onBrowserOperation?$.onBrowserOperation(M,b):b());return k.automaticProgressImage=!0,`${u}
+`.trim();import{Buffer as Y9}from"buffer";import{randomUUID as z1}from"crypto";class tQ extends Error{code;constructor($){super($==="hands_repl_private_profile_attribute_denied"?"Private browser attribute read denied.":$);this.code=$;this.name="HandsReplBrowserDispatcherError"}}var eQ=new Set(["__defineGetter__","__defineSetter__","__lookupGetter__","__lookupSetter__","__proto__","constructor","prototype"]),oQ=/^hands_[A-Za-z0-9_-]{8,128}$/,K1=2048,$Z=32,QZ=1e4,V1=new Set(["href","src","alt","title","role","aria-label","aria-expanded","aria-checked","aria-selected","aria-disabled","placeholder","type","name","data-testid"]);function F1($){let Q=$.split("+"),Z=(Q.pop()??"").replace(/^Key/,"").toLowerCase();if(Z==="f12")return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&["l","n","t","j","i","p","s","w","u","o","r","tab","pageup","pagedown"].includes(Z))return!0;if(Q.some((X)=>["Control","ControlOrMeta","Meta"].includes(X))&&Q.includes("Shift")&&Z==="c")return!0;return Q.includes("Alt")&&["d","arrowleft","arrowright","home"].includes(Z)}var H1=($)=>{let Q=$.closest("a[href],area[href]");return{password:$.tagName==="INPUT"&&$.type==="password",executableLink:Boolean(Q&&!/^(https?:|about:blank)/i.test(Q.href))}},ZZ={browser:{close:{returns:"void"},contexts:{returns:"context[]"},isConnected:{returns:"json"},version:{returns:"json"}},context:{addCookies:{returns:"void"},addInitScript:{returns:"void"},browser:{returns:"browser"},clearCookies:{returns:"void"},clearPermissions:{returns:"void"},close:{returns:"void"},cookies:{returns:"json"},grantPermissions:{returns:"void"},newPage:{returns:"page"},pages:{returns:"page[]"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setGeolocation:{returns:"void"},setHTTPCredentials:{returns:"void"},setOffline:{returns:"void"},setViewportSize:{returns:"void"},storageState:{returns:"json"},viewportSize:{returns:"json",special:"contextViewportSize"}},page:{addInitScript:{returns:"void"},addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},bringToFront:{returns:"void"},close:{returns:"void"},content:{returns:"json"},context:{returns:"context"},emulateMedia:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},frame:{returns:"frame"},frameLocator:{returns:"frameLocator"},frames:{returns:"frame[]"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goBack:{returns:"void"},goForward:{returns:"void"},goto:{returns:"void"},isClosed:{returns:"json"},locator:{returns:"locator"},mainFrame:{returns:"frame"},opener:{returns:"page"},pdf:{returns:"bytes"},reload:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setContent:{returns:"void"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setInputFiles:{returns:"void"},setViewportSize:{returns:"void"},title:{returns:"json"},url:{returns:"json"},viewportSize:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},locator:{all:{returns:"locator[]"},allInnerTexts:{returns:"json"},allTextContents:{returns:"json"},and:{returns:"locator"},ariaSnapshot:{returns:"json"},blur:{returns:"void"},boundingBox:{returns:"json"},check:{returns:"void"},clear:{returns:"void"},click:{returns:"void"},contentFrame:{returns:"frameLocator"},count:{returns:"json"},dblclick:{returns:"void"},dragTo:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},evaluateAll:{returns:"json",requiresStringSource:!0},fill:{returns:"void"},filter:{returns:"locator"},first:{returns:"locator",special:"property"},focus:{returns:"void"},getAttribute:{returns:"json"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},hover:{returns:"void"},innerHTML:{returns:"json"},innerText:{returns:"json"},inputValue:{returns:"json"},isChecked:{returns:"json"},isEditable:{returns:"json"},isEnabled:{returns:"json"},isHidden:{returns:"json"},isVisible:{returns:"json"},last:{returns:"locator",special:"property"},locator:{returns:"locator"},nth:{returns:"locator"},or:{returns:"locator"},page:{returns:"page"},press:{returns:"void"},pressSequentially:{returns:"void"},scrollIntoViewIfNeeded:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setInputFiles:{returns:"void"},tap:{returns:"void"},textContent:{returns:"json"},type:{returns:"void"},uncheck:{returns:"void"},waitFor:{returns:"void"}},frame:{addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},childFrames:{returns:"frame[]"},content:{returns:"json"},evaluate:{returns:"json",requiresStringSource:!0},frameLocator:{returns:"frameLocator"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goto:{returns:"void"},isDetached:{returns:"json"},locator:{returns:"locator"},name:{returns:"json"},page:{returns:"page"},parentFrame:{returns:"frame"},setContent:{returns:"void"},title:{returns:"json"},url:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},frameLocator:{getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},locator:{returns:"locator"},owner:{returns:"locator"}}};function I($){throw new tQ($)}function z0($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Q=Object.getPrototypeOf($);return Q===Object.prototype||Q===null}function G9($,Q=0,Z={nodes:0}){if(Q>$Z||++Z.nodes>QZ)I("hands_repl_json_too_complex");if($===null||typeof $==="boolean"||typeof $==="string")return;if(typeof $==="number"){if(!Number.isFinite($))I("hands_repl_invalid_json");return}if(Array.isArray($)){for(let X of $)G9(X,Q+1,Z);return}if(!z0($))I("hands_repl_invalid_json");for(let[X,J]of Object.entries($)){if(eQ.has(X))I("hands_repl_invalid_json");G9(J,Q+1,Z)}}function c8($){return typeof $==="string"&&Object.hasOwn(ZZ,$)}function U1($){if(!$.endsWith("[]"))return null;let Q=$.slice(0,-2);return c8(Q)?Q:null}function aQ($){return z0($)&&Object.keys($).length===2&&$.$handsRepl==="bytes"&&typeof $.base64==="string"}function W1($){return z0($)&&Object.keys($).length===1&&$.$handsRepl==="undefined"}function rQ($){return z0($)&&Object.keys($).length===2&&$.$handsRepl==="routeFulfill"&&"options"in $}function k0($){return!!$&&typeof $==="object"}function e9(){return Object.freeze({$handsRepl:"undefined"})}function B1($){if(!Y9.isBuffer($)&&!($ instanceof Uint8Array))I("hands_repl_expected_bytes");return Object.freeze({$handsRepl:"bytes",base64:Y9.from($).toString("base64")})}function XZ($){if(!k0($.browser)||!k0($.context)||!k0($.page))I("hands_repl_invalid_roots");if(typeof $.a11y!=="function"||typeof $.view!=="function")I("hands_repl_invalid_callbacks");let Q=$.maxHandles??K1;if(!Number.isInteger(Q)||Q<3||Q>1e5)I("hands_repl_invalid_handle_limit");let Z=new Map,X=new WeakMap,J=$.createOpaqueId??z1,Y=(z,L)=>{if(!k0(L))I("hands_repl_expected_target");let W=X.get(L)?.get(z);if(W)return W;if(Z.size>=Q)I("hands_repl_handle_limit");let U="";for(let q=0;q<16;q+=1){let A=`hands_${J()}`;if(oQ.test(A)&&!Z.has(A)){U=A;break}}if(!U)I("hands_repl_invalid_opaque_id");let j=Object.freeze({$handsRepl:"handle",id:U,kind:z});Z.set(U,{kind:z,target:L});let O=X.get(L);if(!O)O=new Map,X.set(L,O);return O.set(z,j),j},K=Object.freeze({browser:Y("browser",$.browser),context:Y("context",$.context),page:Y("page",$.page)}),V=(z)=>{if(!z0(z)||Object.keys(z).length!==3||z.$handsRepl!=="handle"||typeof z.id!=="string"||!oQ.test(z.id)||!c8(z.kind))I("hands_repl_invalid_handle");let L=Z.get(z.id);if(!L||L.kind!==z.kind)I("hands_repl_unknown_handle");return L},G=(z,L=0,W=new Set)=>{if(L>$Z)I("hands_repl_json_too_complex");if(z===void 0)return e9();if(z===null||typeof z==="boolean"||typeof z==="string")return z;if(typeof z==="number"){if(!Number.isFinite(z))I("hands_repl_non_json_result");return z}if(Array.isArray(z)){if(W.has(z))I("hands_repl_cyclic_result");W.add(z);try{return z.map((U)=>G(U,L+1,W))}finally{W.delete(z)}}if(!z0(z))I("hands_repl_non_json_result");if(W.has(z))I("hands_repl_cyclic_result");W.add(z);try{let U=Object.create(null);for(let j of Object.keys(z)){let O=Object.getOwnPropertyDescriptor(z,j);if(!O||!("value"in O))continue;U[j]=G(O.value,L+1,W)}return U}finally{W.delete(z)}},F=(z,L)=>{if(L==="void")return e9();if(L==="json")return G(z);if(L==="bytes")return B1(z);let W=U1(L);if(W){if(!Array.isArray(z))I("hands_repl_expected_target_list");if(W==="context"&&z.some((U)=>U!==$.context))I("hands_repl_foreign_context");return z.map((U)=>Y(W,U))}if(z===null||z===void 0)return e9();if(!c8(L))I("hands_repl_invalid_return_kind");if(L==="context"&&z!==$.context)I("hands_repl_foreign_context");return Y(L,z)},B=(z)=>{if(z0(z)&&z.$handsRepl==="handle")return V(z).target;if(aQ(z))return Y9.from(z.base64,"base64");if(W1(z))return;if(rQ(z))I("hands_repl_route_fulfill_only");if(Array.isArray(z))return z.map(B);if(!z0(z))return z;let L=Object.create(null);for(let[W,U]of Object.entries(z))L[W]=B(U);return L};return Object.freeze({roots:K,dispatch:async(z)=>{if(!z0(z)||typeof z.type!=="string")I("hands_repl_invalid_request");if(z.type==="a11y"){let T=z.target===void 0?Z.get(K.page.id):V(z.target);if(!T||T.kind!=="page"&&T.kind!=="locator")I("hands_repl_invalid_a11y_target");return G(await $.a11y(T.target))}if(z.type==="view"){if(G9(z.source),z.options!==void 0)G9(z.options);let T=aQ(z.source)?Y9.from(z.source.base64,"base64"):z.source;if($.privateProfile&&!Y9.isBuffer(T))I("hands_repl_profile_requires_image_bytes");return G(await $.view(T,z.options))}if(z.type!=="call")I("hands_repl_invalid_request");if(typeof z.method!=="string"||z.method.length===0||z.method.length>128)I("hands_repl_invalid_method");if(eQ.has(z.method))I("hands_repl_forbidden_method");let L=V(z.target),W=z.args??[];if(!Array.isArray(W))I("hands_repl_invalid_arguments");if(G9(W),L.kind==="page"&&z.method==="captureScreenshot"){if(W.length!==0)I("hands_repl_invalid_arguments");if(!$.screenshotExport)I("hands_repl_screenshot_export_unavailable");return G(await $.screenshotExport(L.target))}if(L.kind==="context"&&["startRecording","stopRecording"].includes(z.method)){if(!$.recording||L.target!==$.context)I("hands_repl_recording_unavailable");if(W.length>(z.method==="startRecording"?1:0))I("hands_repl_invalid_arguments");return G(z.method==="startRecording"?await $.recording.start(W[0]):await $.recording.stop())}if($.privateProfile){let T=z.method;if(["evaluate","evaluateAll","waitForFunction","addInitScript","addScriptTag","addStyleTag","setContent","setInputFiles","route","content","cookies","storageState","addCookies","clearCookies","setExtraHTTPHeaders","setHTTPCredentials","grantPermissions","clearPermissions","innerHTML","textContent","allTextContents"].includes(T)||L.kind==="browser"&&T==="close"||L.kind==="context"&&T==="close")I("hands_repl_private_profile_method_denied");if(L.kind==="browser"&&T==="contexts")return F([$.context],"context[]");if((T==="screenshot"||T==="pdf")&&z0(W[0])&&(("path"in W[0])||("style"in W[0])))I("hands_repl_private_profile_path_denied");if(T==="goto"){if(typeof W[0]!=="string")I("hands_repl_private_profile_url_denied");try{let S=new URL(W[0]);if(!["http:","https:"].includes(S.protocol)&&W[0]!=="about:blank")I("hands_repl_private_profile_url_denied")}catch{I("hands_repl_private_profile_url_denied")}}if(T==="getAttribute"&&(typeof W[0]!=="string"||!V1.has(W[0].toLowerCase())))I("hands_repl_private_profile_attribute_denied");if(L.kind==="locator"&&["innerText","allInnerTexts","getAttribute"].includes(T)){let S=[L.target];if(T==="allInnerTexts"){let m=Reflect.get(L.target,"all");if(typeof m!=="function")I("hands_repl_private_profile_probe_unavailable");let E=await Reflect.apply(m,L.target,[]);if(!Array.isArray(E)||E.length>QZ||!E.every(k0))I("hands_repl_private_profile_probe_unavailable");S=E}for(let m of S){let E=Reflect.get(m,"isVisible");if(typeof E!=="function"||!await Reflect.apply(E,m,[]))I("hands_repl_private_profile_hidden_value_denied")}}if(T==="press"&&typeof W[0]==="string"&&F1(W[0]))I("hands_repl_private_profile_browser_shortcut_denied");if(L.kind==="locator"&&["inputValue","click","dblclick","tap","press"].includes(T)){let S=Reflect.get(L.target,"evaluate");if(typeof S!=="function")I("hands_repl_private_profile_probe_unavailable");let m=await Reflect.apply(S,L.target,[H1]);if(!z0(m)||typeof m.password!=="boolean"||typeof m.executableLink!=="boolean")I("hands_repl_private_profile_probe_unavailable");if(T==="inputValue"&&m.password)I("hands_repl_private_profile_password_denied");if(T!=="inputValue"&&m.executableLink)I("hands_repl_private_profile_url_denied");if(T==="inputValue"){let E=Reflect.get(L.target,"isVisible");if(typeof E!=="function"||!await Reflect.apply(E,L.target,[]))I("hands_repl_private_profile_hidden_value_denied")}}}let U=ZZ[L.kind][z.method];if(!U)I("hands_repl_method_not_allowed");if(U.requiresStringSource&&typeof W[0]!=="string")I("hands_repl_string_source_required");if(L.kind==="browser"&&z.method==="contexts")return[K.context];if(["addInitScript","addScriptTag","addStyleTag","screenshot","pdf","storageState"].includes(z.method)&&W.some((T)=>z0(T)&&("path"in T)))I("hands_repl_file_path_not_allowed");if(z.method==="goto"&&typeof W[0]==="string"){let T;try{T=new URL(W[0]).protocol}catch{I("hands_repl_invalid_url")}if(!["http:","https:","data:","about:","blob:"].includes(T))I("hands_repl_file_path_not_allowed")}if(U.special==="contextViewportSize"){let T=Reflect.get(L.target,"pages");if(typeof T!=="function")I("hands_repl_method_unavailable");let S=await Reflect.apply(T,L.target,[]),m=Array.isArray(S)?S[0]:void 0,E=k0(m)?Reflect.get(m,"viewportSize"):void 0;if(typeof E!=="function")return e9();return F(await Reflect.apply(E,m,[]),U.returns)}if(U.special==="property"){let T=Reflect.get(L.target,z.method);return F(typeof T==="function"?Reflect.apply(T,L.target,[]):T,U.returns)}let j=Reflect.get(L.target,z.method);if(typeof j!=="function")I("hands_repl_method_unavailable");if(U.special==="route"){let T=W[1];if(!rQ(T))I("hands_repl_invalid_route_handler");G9(T.options);let S=B(T.options),m=async(M)=>{if(!k0(M))I("hands_repl_invalid_route");let D=Reflect.get(M,"fulfill");if(typeof D!=="function")I("hands_repl_invalid_route");await Reflect.apply(D,M,[S])},E=[B(W[0]??null),m],N=await Reflect.apply(j,L.target,E);return F(N,U.returns)}let O=W.map(B);if(z.method==="setInputFiles"){let T=L.kind==="locator"?0:1,S=async(E)=>{if(typeof E!=="string"){if(!z0(E)||typeof E.name!=="string"||typeof E.mimeType!=="string"||!Y9.isBuffer(E.buffer))I("hands_repl_invalid_file_input");return E}if(!$.readWorkspaceFile)I("hands_repl_workspace_required");return $.readWorkspaceFile(E)},m=O[T];O[T]=Array.isArray(m)?await Promise.all(m.map(S)):await S(m)}if(z.method==="goto")await $.beforeNavigation?.();let q=$.actionRecorder?.(),A=await Reflect.apply(j,L.target,O),P={click:"Click browser element",tap:"Click browser element",dblclick:"Double click browser element",fill:"Type text",type:"Type text",pressSequentially:"Type text",clear:"Clear browser field",press:"Press key",scrollIntoViewIfNeeded:"Scroll browser element into view",dragTo:"Drag on computer",selectOption:"Select browser option",check:"Check browser control",uncheck:"Uncheck browser control",hover:"Hover browser element",focus:"Focus browser element",goto:"Open browser page",reload:"Reload browser page",goBack:"Go back in browser",goForward:"Go forward in browser",screenshot:"Take browser screenshot"}[z.method];if(P){let T=Reflect.get(L.target,"page"),S=L.kind==="page"?L.target:typeof T==="function"?Reflect.apply(T,L.target,[]):void 0;q?.(P,k0(S)?S:void 0)}return F(A,U.returns)}})}import{isIP as KZ}from"net";import{Resolver as L1}from"dns/promises";import{isIP as Q8}from"net";var N1=[["0.0.0.0",8],["10.0.0.0",8],["100.64.0.0",10],["127.0.0.0",8],["169.254.0.0",16],["172.16.0.0",12],["192.0.0.0",24],["192.0.2.0",24],["192.168.0.0",16],["198.18.0.0",15],["198.51.100.0",24],["203.0.113.0",24],["224.0.0.0",4],["240.0.0.0",4]];function d8($){if(Q8($)!==4)return null;let Q=$.split(".");if(Q.length!==4)return null;let Z=0;for(let X of Q){let J=Number(X);if(!Number.isInteger(J)||J<0||J>255)return null;Z=Z*256+J}return Z>>>0}function M1($,Q,Z){let X=d8(Q);if(X===null)return!1;let J=Z===0?0:4294967295<<32-Z>>>0;return($&J)>>>0===(X&J)>>>0}function JZ($){let Q=d8($);if(Q===null)return!0;return N1.some(([Z,X])=>M1(Q,Z,X))}function j1($){if(Q8($)!==6)return null;let Q=$.toLowerCase(),Z=Q.indexOf("%");if(Z>=0)Q=Q.slice(0,Z);let X=[],J=Q.lastIndexOf(":"),Y=J>=0?Q.slice(J+1):"";if(Y.includes(".")){let z=d8(Y);if(z===null)return null;X=[z>>>16&65535,z&65535],Q=Q.slice(0,J+1)+"0:0"}let K=Q.split("::");if(K.length>2)return null;let V=(z)=>{if(z==="")return[];let L=[];for(let W of z.split(":")){if(W===""||W.length>4||!/^[0-9a-f]+$/.test(W))return null;L.push(Number.parseInt(W,16))}return L},G=V(K[0]??"");if(G===null)return null;if(K.length===1){let z=G;if(z.length!==8)return null;return X.length>0?z.slice(0,6).concat(X):z}let F=V(K[1]??"");if(F===null)return null;let B=8-G.length-F.length;if(B<0)return null;let H=G.concat(Array(B).fill(0),F);if(H.length!==8)return null;return X.length>0?H.slice(0,6).concat(X):H}function C1($,Q){return`${$>>8&255}.${$&255}.${Q>>8&255}.${Q&255}`}function q1($){let Q=j1($);if(Q===null)return!0;let[Z,X,J]=Q;if((Z&57344)!==8192)return!0;if(Z===8193&&(X&65024)===0)return!0;if(Z===8193&&X===3512)return!0;if(Z===16383&&(X&61440)===0)return!0;if(Z===8194)return JZ(C1(X,J));return!1}function YZ($){return $.replace(/^\[|\]$/g,"")}function $8($){let Q=YZ($.trim()),Z=Q8(Q);if(Z===4)return JZ(Q);if(Z===6)return q1(Q);return!0}function GZ($){if($ instanceof Error&&$.name==="TimeoutError")return"dns_timeout";switch(typeof $==="object"&&$!==null&&"code"in $?$.code:void 0){case"ENOTFOUND":return"dns_not_found";case"ENODATA":return"dns_empty";case"EAI_AGAIN":case"ESERVFAIL":case"ECONNREFUSED":return"dns_temporary";case"ETIMEOUT":case"ETIMEDOUT":return"dns_timeout";default:return"dns_failed"}}var zZ=5000;function T1($){return async(Q,Z)=>{if(Z?.aborted)throw Error("aborted");let X=new L1({timeout:zZ,tries:1});if($)X.setServers($);let J=()=>X.cancel();Z?.addEventListener("abort",J,{once:!0});try{let[Y,K]=await Promise.allSettled([X.resolve4(Q),X.resolve6(Q)]),V=[...Y.status==="fulfilled"?Y.value:[],...K.status==="fulfilled"?K.value:[]];if(V.length>0)return V;let G=[Y,K].flatMap((B)=>B.status==="rejected"?[B.reason]:[]);throw G.find((B)=>["dns_temporary","dns_timeout"].includes(GZ(B)))??G[0]??Object.assign(Error("DNS returned no addresses"),{code:"ENODATA"})}finally{Z?.removeEventListener("abort",J)}}}var O1=T1();async function D1($,Q,Z,X){if(X?.aborted)throw Error("aborted");let J=new AbortController,Y,K,V=Q($,J.signal);V.catch(()=>{});try{return await Promise.race([V,new Promise((G,F)=>{if(Y=setTimeout(()=>F(new DOMException("DNS lookup timed out","TimeoutError")),Z),X)K=()=>F(Error("aborted")),X.addEventListener("abort",K,{once:!0})})])}finally{if(Y!==void 0)clearTimeout(Y);if(X&&K)X.removeEventListener("abort",K);J.abort()}}async function XX($,Q=O1,Z){let X=YZ($);if(Q8(X))return $8(X)?{ok:!1,reason:"non_public_ip"}:{ok:!0,addresses:[X]};let J;try{J=await D1(X,Q,zZ,Z)}catch(Y){return{ok:!1,reason:Z?.aborted?Z.reason instanceof Error&&Z.reason.name==="TimeoutError"?"dns_timeout":"aborted":GZ(Y)}}if(J.length===0)return{ok:!1,reason:"dns_empty"};if(J.some($8))return{ok:!1,reason:"non_public_ip"};return{ok:!0,addresses:J}}var _1=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;function p8($){return $.length<=253&&_1.test($.toLowerCase())}function A1($,Q){let Z=$.trim().toLowerCase();if(!p8(Z))return!1;if(Z.startsWith("*.")){let X=Z.slice(2);return Q===X||Q.endsWith(`.${X}`)}return Z===Q}function x1($){let Q=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec($);if(!Q)return null;let Z=Q.slice(1).map(Number);return Z.some((X)=>X>255)?null:Z}function l8($,Q=[]){let Z=(X)=>{if(X=X.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,""),!X.includes(":"))return X;try{X=new URL(`http://[${X}]/`).hostname.slice(1,-1)}catch{return X}let J=/^::ffff:([\da-f]+):([\da-f]+)$/.exec(X);if(!J)return X;let Y=parseInt(J[1],16),K=parseInt(J[2],16);return`${Y>>8}.${Y&255}.${K>>8}.${K&255}`};return Q.some((X)=>Z(X)===Z($))}function u0($){$=$.toLowerCase().replace(/^\[|\]$/g,"");let Q=x1($);if(Q){let[Y,K,V]=Q;if(Y===127)return"loopback";return Y===0||Y===10||Y>=224||Y===100&&K>=64&&K<=127||Y===169&&K===254||Y===172&&K>=16&&K<=31||Y===192&&(K===168||K===0&&(V===0||V===2)||K===88&&V===99)||Y===198&&(K===18||K===19||K===51&&V===100)||Y===203&&K===0&&V===113?"private":"public"}if(!$.includes(":"))return"hostname";try{$=new URL(`http://[${$}]/`).hostname.slice(1,-1)}catch{return"private"}if($==="::1")return"loopback";let Z=/^::ffff:([\da-f]+):([\da-f]+)$/.exec($);if(Z){let Y=parseInt(Z[1],16),K=parseInt(Z[2],16);return u0(`${Y>>8}.${Y&255}.${K>>8}.${K&255}`)==="public"?"public":"private"}let[X,J=0]=$.split(":").map((Y)=>parseInt(Y||"0",16));return X<8192||X>16383||X===8194||X===8193&&(J<512||J===3512)||X===16383&&J<4096?"private":"public"}function E9($,Q){let Z;try{Z=new URL($)}catch{return{allowed:!1,url:$,host:null,reason:"invalid_url"}}if(["about:","data:","blob:"].includes(Z.protocol))return{allowed:!0,url:$,host:null,reason:"local_document"};if(!["http:","https:","ws:","wss:"].includes(Z.protocol))return{allowed:!1,url:$,host:Z.hostname||null,reason:"unsupported_protocol"};let X=Z.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,"");if(Q.mode==="off")return{allowed:!0,url:$,host:X,reason:"policy_off"};let J=(V)=>({allowed:!1,url:$,host:X,reason:V});if(Z.username||Z.password)return J("invalid_url");if(Q.mode==="public_web"){let V=u0(X)!=="public"&&u0(X)!=="hostname"||X==="localhost"||/\.(?:localhost|local|internal|arpa)$/.test(X)||!X.includes(".")&&!KZ(X)||Boolean(KZ(X)&&$8(X));return{allowed:!V,url:$,host:X,reason:V?"private_network":"public_web"}}let Y=Number(Z.port||(["https:","wss:"].includes(Z.protocol)?443:80));if(Q.deniedPorts?.includes(Y)||l8(X,Q.deniedHosts))return J("destination_not_allowed");let K=u0(X);if(K==="private"||["local","internal","arpa"].some((V)=>X===V||X.endsWith(`.${V}`)))return J("private_network");if(K==="loopback"||X==="localhost"||X.endsWith(".localhost"))return Q.allowedLoopbackPorts?.includes(Y)?{allowed:!0,url:$,host:X,reason:"loopback"}:J("destination_not_allowed");if(Q.allowedDomains.some((V)=>A1(V,X)))return{allowed:!0,url:$,host:X,reason:"allowed_domain"};return{allowed:!1,url:$,host:X,reason:"destination_not_allowed"}}import FZ from"child_process";import{accessSync as I1,constants as R1,readFileSync as E1,statSync as WZ}from"fs";import{createRequire as BZ}from"module";import{homedir as HZ}from"os";import{dirname as S1,isAbsolute as u8,join as z9,resolve as w1}from"path";var Z8=Object.freeze({schemaVersion:1,driver:"playwright-core",driverVersion:UZ.dependencies["playwright-core"],browser:"chromium"}),LZ=["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome","/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge","/Applications/Brave Browser.app/Contents/MacOS/Brave Browser","/Applications/Chromium.app/Contents/MacOS/Chromium"],s8=["/usr/bin/chromium","/usr/bin/chromium-browser","/usr/bin/google-chrome","/usr/bin/google-chrome-stable"];function S9($){try{return I1($,R1.X_OK),u8($)&&WZ($).isFile()}catch{return!1}}function n8($,Q=process.platform){let Z=Q==="darwin"?LZ:Q==="linux"?s8:null;return Z?($??Z).find(S9)??null:null}function b1(){if(!process.versions.bun)return;let $=Symbol.for("ara.headless-browser.bun-pipe-owners");if(Object.hasOwn(globalThis,$))return;let Q=[];FZ.spawn=new Proxy(FZ.spawn,{apply(Z,X,J){let Y=Reflect.apply(Z,X,J),K=J[1],V=J[2]?.stdio;if(Array.isArray(K)&&K.includes("--remote-debugging-pipe")&&Array.isArray(V)&&V[3]==="pipe"&&V[4]==="pipe")Q.push(Y);return Y}}),Object.defineProperty(globalThis,$,{value:Q})}async function X8($){if(b1(),$!==void 0){if(!u8($))throw Error("hands_browser_driver_path_must_be_absolute");let X=z9($,"package.json"),J=JSON.parse(E1(X,"utf8"));if(J.name!==Z8.driver)throw Error("hands_browser_wrong_driver");let Y=BZ(X)($),K=Y.default?.chromium??Y.chromium;if(!K)throw Error("hands_browser_missing_chromium");return{version:J.version,chromium:K}}let[Q,Z]=await Promise.all([import("./index-bbk6a9sk.js"),import("./package-3cd7cfyv.js").then((m)=>P1(m.default,1))]);return{version:Z.default.version,chromium:Q.chromium}}var k1=($,Q=Z8.driverVersion)=>({status:"unavailable",reason:$,expectedDriverVersion:Q}),f1=($)=>$.loadDriver?.()??X8($.driverModuleDirectory),m1={"1.60.0":"1223"};function BX(){let $=process.platform,Q=m1[Z8.driverVersion];if(!Q||$!=="linux"&&$!=="darwin")return!1;let Z=(X)=>process.env[X]??process.env[`npm_config_${X.toLowerCase()}`]??process.env[`npm_package_config_${X.toLowerCase()}`];try{let X=Z("PLAYWRIGHT_BROWSERS_PATH"),J=X==="0"?z9(S1(BZ(import.meta.url).resolve("playwright-core/package.json")),".local-browsers"):X?w1(Z("INIT_CWD")||process.cwd(),X):z9($==="darwin"?z9(HZ(),"Library","Caches"):process.env.XDG_CACHE_HOME||z9(HZ(),".cache"),"ms-playwright");return WZ(z9(J,`chromium-${Q}`,"INSTALLATION_COMPLETE")).isFile()}catch{return!1}}async function K9($={}){return NZ($,Z8.driverVersion)}async function i8($,Q={}){if($.driverVersion!=="1.61.1"||!u8($.driverModuleDirectory))throw Error("hands_browser_invalid_managed_compatibility");return NZ({...Q,driverModuleDirectory:$.driverModuleDirectory,allowSystemBrowser:!0},$.driverVersion)}async function NZ($,Q){let Z=(G)=>k1(G,Q),X=$.platform??process.platform;if(X!=="linux"&&X!=="darwin")return Z("unsupported_platform");let J;try{J=await f1($)}catch{return Z("driver_missing")}if(J.version!==Q)return Z("driver_version_mismatch");let Y=(G,F)=>({status:"resolved",executablePath:G,source:F,driverVersion:J.version});if($.executablePath!==void 0)return S9($.executablePath)?Y($.executablePath,"configured"):Z("executable_missing");let K=J.chromium.executablePath();if(S9(K))return Y(K,"managed");let V=$.allowSystemBrowser===!0?n8($.systemCandidates,X):null;return V?Y(V,"system"):Z("executable_missing")}var o1=["/usr/local/bin/chromium",...s8];function a1($,Q=DZ()){return n8($??(Q==="linux"?o1:void 0),Q)}async function r1(){try{return(await X8()).chromium}catch{return l1(import.meta.url)("playwright-core").chromium}}var t1=1048576,e1=105000,$7=20000,CZ=5000,Q7=2000,Z7=1000,X7=30000,qZ=81920,J7={".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".gif":"image/gif"};async function Y7($,Q){let Z=new URL($.url()),X={...await $.allHeaders(),host:Z.host};for(let J of Object.keys(X))if(/^(?:proxy-|connection$|upgrade$|transfer-encoding$|content-length$)/i.test(J))delete X[J];return new Promise((J,Y)=>{let V=(Z.protocol==="https:"?s1:u1)(Z,{method:$.method(),headers:X,agent:!1,lookup:(F,B,H)=>{let z=s0.isIP(Q);if(B.all)H(null,[{address:Q,family:z}]);else H(null,Q,z)}},(F)=>{let B=[],H=0;F.on("data",(z)=>{if(H+=z.length,H>33554432)V.destroy(Error("hands_browser_response_too_large"));else B.push(z)}),F.on("error",Y),F.on("end",()=>{let z={};for(let[L,W]of Object.entries(F.headers))if(W!==void 0&&!["transfer-encoding","connection","content-length"].includes(L))z[L]=Array.isArray(W)?W.join(`
+`):W;J({status:F.statusCode??502,headers:z,body:Buffer.concat(B)})})}),G=setTimeout(()=>V.destroy(Error("hands_browser_fetch_timeout")),X7);V.once("close",()=>clearTimeout(G)),V.on("error",Y),V.end($.postDataBuffer()??void 0)})}async function G7($,Q,Z=()=>{},X={lookup:(J)=>p1(J,{all:!0}),fetch:Y7}){let J=new WeakSet,Y=new WeakMap,K=(V)=>{let G=Y.get(V);if(G)return G;let F=(async()=>{if(!$.newCDPSession)return;let B=await $.newCDPSession(V),H=new Map;B.on("Network.loadingFinished",({requestId:z})=>H.delete(z)),B.on("Network.loadingFailed",({requestId:z})=>H.delete(z)),B.on("Fetch.requestPaused",async(z)=>{let L=z.networkId??z.requestId,W=z.redirectedRequestId?(H.get(L)??0)+1:0;H.set(L,W);let U=E9(z.request.url,Q),j=Q.mode==="enforce"&&Boolean(z.redirectedRequestId)&&U.host!==null&&!s0.isIP(U.host),O=!U.allowed?U:j?{...U,allowed:!1,reason:"destination_not_allowed"}:W>20?{...U,allowed:!1,reason:"redirect_not_supported"}:null;try{if(O)Z(O),await B.send("Fetch.failRequest",{requestId:z.requestId,errorReason:"BlockedByClient"});else await B.send("Fetch.continueRequest",{requestId:z.requestId})}catch{await B.send("Fetch.failRequest",{requestId:z.requestId,errorReason:"Failed"}).catch(()=>{})}}),await B.send("Network.enable"),await B.send("Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]}),J.add(V)})();return Y.set(V,F),F};return await $.route("**/*",async(V)=>{let G=V.request().url(),F=E9(G,Q);if(F.allowed&&Q.mode==="public_web"){await V.continue();return}let B=V.request();if(F.allowed&&F.host&&s0.isIP(F.host)&&B.isNavigationRequest?.()){let H=B.frame();if(J.has(H.page())&&H===H.page().mainFrame()){await V.continue();return}}if(F.allowed&&(Q.mode==="off"||F.reason==="local_document")){await V.continue();return}if(F.allowed&&F.host)try{let H=F.host,z=u0(H),L,W=await(async()=>{if(z!=="hostname")return[{address:H,family:s0.isIP(H)}];if(F.reason==="loopback")return[{address:"127.0.0.1",family:4}];try{return await Promise.race([X.lookup(H),new Promise((U,j)=>{L=setTimeout(()=>j(Error("hands_browser_dns_timeout")),5000)})])}finally{if(L)clearTimeout(L)}})();if(!W.length||W.some(({address:U})=>{let j=u0(U);return!s0.isIP(U)||Q.mode==="enforce"&&l8(U,Q.deniedHosts)||(F.reason==="loopback"?j!=="loopback":j!=="public")}))F={...F,allowed:!1,reason:"private_network"};else{let U=await X.fetch(V.request(),W[0].address);if(U.status>=300&&U.status<400){let j=U.headers.location??G;try{j=new URL(j,G).href}catch{}let O=E9(j,Q);F=O.allowed?{...O,allowed:!1,reason:"redirect_not_supported"}:O}else{await V.fulfill(U);return}}}catch{await V.abort("failed");return}Z(F),await V.abort("blockedbyclient")}),await $.routeWebSocket("**/*",async(V)=>{let G=E9(V.url(),Q);if(Q.mode==="enforce"&&G.allowed&&(!G.host||!s0.isIP(G.host)))G={...G,allowed:!1,reason:"destination_not_allowed"};if(G.allowed){V.connectToServer();return}Z(G),await V.close({code:1008,reason:"Reason egress policy denied"})}),Q.mode==="off"?void 0:{preparePage:K}}async function _Z($,Q=DZ(),Z){if(Z){let J=await i8(Z,{platform:Q,systemCandidates:$});return J.status==="resolved"?J.executablePath:null}if($!==void 0){let J=a1($,Q);if(J)return J}let X=await K9({platform:Q,systemCandidates:$,allowSystemBrowser:!0});return X.status==="resolved"?X.executablePath:null}function TZ($,Q){if(!$)throw Error("hands_repl_workspace_required");let Z=a8($),X=V9($),J=r8(X,V9(X,Q)),K=J!==".."&&!J.startsWith(`..${t8}`)&&!jZ(J)?V9(Z,J):V9(Z,Q);if(b0(V9(X,Q))||b0(K))throw Error("hands_repl_protected_path");let V=(W)=>{let U=r8(Z,W);return U!==""&&U!==".."&&!U.startsWith(`..${t8}`)&&!jZ(U)},G=a8(K);if(b0(G))throw Error("hands_repl_protected_path");if(!V(K)||!V(G))throw Error("hands_repl_file_outside_workspace");let F=r8(Z,K).split(t8),B=[Z,...F.map((W,U)=>V9(Z,...F.slice(0,U+1)))],H=B.map((W)=>MZ(W));if(H.some((W)=>W.isSymbolicLink()))throw Error("hands_repl_file_symlink");let z=H[H.length-1];if(!z.isFile()||z.nlink!==1||z.size>16777216)throw Error("hands_repl_file_not_regular_or_too_large");let L=v1(K,o8.O_RDONLY|o8.O_NOFOLLOW|o8.O_NONBLOCK);try{let W=h1(L);if(W.dev!==z.dev||W.ino!==z.ino||!W.isFile())throw Error("hands_repl_file_changed");for(let q=0;q<B.length;q++){let A=MZ(B[q]);if(A.dev!==H[q].dev||A.ino!==H[q].ino||A.isSymbolicLink())throw Error("hands_repl_file_changed")}if(!V(a8(K)))throw Error("hands_repl_file_outside_workspace");let U=Buffer.alloc(16777217),j=0;while(j<U.length){let q=c1(L,U,j,U.length-j,null);if(!q)break;j+=q}if(j===U.length)throw Error("hands_repl_file_too_large");let O=U.subarray(0,j);return{name:n1(K),mimeType:J7[i1(K).toLowerCase()]??"application/octet-stream",buffer:O}}finally{y1(L)}}function F9($,Q){$.end(`${JSON.stringify(Q)}
+`)}function J8($){try{d1($)}catch{}}async function AZ($){if($.managedBrowser&&$.driverModuleDirectory!==void 0)throw Error("hands_browser_ambiguous_driver_configuration");let Q=$.launch||$.targetContext?null:$.managedBrowser?await i8($.managedBrowser,{executablePath:$.browserExecutablePath}):await K9({executablePath:$.browserExecutablePath,driverModuleDirectory:$.driverModuleDirectory});if(Q?.status==="unavailable")throw Error(`hands_browser_${Q.reason}`);let Z=Q?.status==="resolved"?Q.executablePath:$.browserExecutablePath;if(!Z||!S9(Z))throw Error("hands_browser_unavailable");let X=$.launch??(async(N)=>($.targetContext?await r1():(await X8($.managedBrowser?.driverModuleDirectory??$.driverModuleDirectory)).chromium).launch(N)),J=[],Y={},K=null,V=null,G=null,F=null,B=!1,H=null,z=new Map,L=new WeakMap,W=null,U=()=>{if(B)throw Error("hands_repl_stopped");if(F)throw F},j=(N)=>{let M=L.get(N);if(M)return M;let D=Promise.resolve().then(()=>N.close()).then(()=>{z.delete(N)});return L.set(N,D),D},O=async()=>{let N=[...z.entries()].reverse(),M=W??=performance.now()+Z7,D=Promise.allSettled(N.filter(([,_])=>_==="context").map(([_])=>j(_))),w;try{await Promise.race([D,new Promise((_)=>{w=setTimeout(_,Math.max(0,M-performance.now()))})])}finally{if(w)clearTimeout(w)}let k=await Promise.allSettled(N.map(([_])=>j(_))),f=[];for(let[_,g]of k.entries()){if(g.status!=="rejected")continue;let c=g.reason instanceof Error&&["Error","TimeoutError","ProtocolError"].includes(g.reason.name)?g.reason.name:"unknown";f.push(Error(`hands_repl_close_failed: ${N[_][1]}: ${c}`))}if(f.length)throw AggregateError(f,"hands_repl_stop_unconfirmed")},q=(N,M)=>{if(z.set(N,M),B||F)j(N).catch(()=>{return}),U();return N},A=async()=>{let N=await X({executablePath:Z,headless:!0,chromiumSandbox:$.managedBrowser===void 0,args:["--disable-background-networking","--disable-quic","--disable-dev-shm-usage","--disable-gpu","--disable-software-rasterizer","--dns-prefetch-disable","--force-webrtc-ip-handling-policy=disable_non_proxied_udp","--no-pings"]}),M=null;try{q(N,"browser"),M=$.targetContext??q(await N.newContext({viewport:{width:1440,height:900},screen:{width:1440,height:900},serviceWorkers:"block",acceptDownloads:!1}),"context");let D=await G7(M,$.networkPolicy??{mode:"off"},$.onEgressDenied);if(U(),D){let b=M.newPage.bind(M);M.newPage=async()=>{let h=await b();return await D.preparePage(h),h}}let k=M.pages()[0]??await M.newPage();await D?.preparePage(k),U();let f=async(b=k)=>{let h=b;if(typeof h.ariaSnapshot==="function")return h.ariaSnapshot({timeout:1e4});return k.locator("body").innerText({timeout:1e4})},_=async(b,h={})=>{let d=h&&typeof h==="object"&&!Array.isArray(h)?h:{},s,G0="image/png";if(Buffer.isBuffer(b)||b instanceof Uint8Array)s=Buffer.from(b);else if(typeof b==="string"&&(b.startsWith("data:")||/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(b)))s=Buffer.from(b.replace(/^data:[^,]*,/,""),"base64");else if(typeof b==="string"){let T0=TZ($.workspaceRoot,b);s=T0.buffer,G0=T0.mimeType}else throw Error("view() needs a Buffer, a base64 string, or a path to an image file");if(s.length===0)throw Error("view(): the image is empty");let M0=String(d.label??"").replace(/[\r\n>]+/g," ").trim().slice(0,120),U0=Number(d.maxWidth)||1024,W0=Number(d.quality)||72,y0=$.targetContext?await N.newPage():await M.newPage();try{let T0=`data:${G0};base64,${s.toString("base64")}`;for(let r=0;r<5;r+=1){let j0=await y0.evaluate(async(B0)=>{let C0=new Image;C0.src=B0.url,await C0.decode();let h0=Math.min(1,B0.maxWidth/C0.naturalWidth),Y0=document.createElement("canvas");Y0.width=Math.max(1,Math.round(C0.naturalWidth*h0)),Y0.height=Math.max(1,Math.round(C0.naturalHeight*h0));let X0=Y0.getContext("2d");if(!X0)throw Error("view(): canvas unavailable");return X0.fillStyle="#ffffff",X0.fillRect(0,0,Y0.width,Y0.height),X0.drawImage(C0,0,0,Y0.width,Y0.height),{data:Y0.toDataURL("image/jpeg",B0.q/100).split(",")[1]??"",width:Y0.width,height:Y0.height,sourceWidth:C0.naturalWidth,sourceHeight:C0.naturalHeight}},{url:T0,maxWidth:U0,q:W0}),t0=Buffer.from(j0.data,"base64");if(t0.length<=qZ){let B0=M0||"image";return`<<<ARA_VIEW_IMAGE ${j0.data} image/jpeg ${B0}>>>
+Viewing ${B0} (${j0.sourceWidth}x${j0.sourceHeight} source, sent at ${j0.width}x${j0.height}, ${Math.round(t0.length/1024)}KB).`}if(U0>640)U0=Math.round(U0*0.75);else W0=Math.max(30,W0-15)}throw Error(`view(): could not reduce the image under ${Math.round(qZ/1024)}KB`)}finally{await y0.close().catch(()=>{return})}},g=XZ({browser:$.targetContext?.browser()??N,context:M,page:k,a11y:f,view:_,readWorkspaceFile:(b)=>TZ($.workspaceRoot,b),privateProfile:$.privateProfile,beforeNavigation:$.beforeNavigation,recording:$.recording,screenshotExport:$.screenshotExport,actionRecorder:()=>{let b=J,h=Y;return(d,s)=>{if(b.length<OZ)b.push(d);if(s)h.page=s}}}),c=async(b)=>{U();let h=q(await N.newContext({serviceWorkers:"block",acceptDownloads:!1}),"context");try{await h.route("**/*",(s)=>s.abort()),U(),await h.routeWebSocket("**/*",(s)=>s.close({code:1008,reason:"Reason evaluator network denied"})),U(),await h.exposeBinding("__araHandsRpc",async(s,G0)=>$.onBrowserOperation?$.onBrowserOperation(b,()=>g.dispatch(G0)):g.dispatch(G0)),U();let d=await h.newPage();return U(),await d.goto("data:text/html,<title>Reason Hands evaluator</title>"),U(),await d.evaluate(`(${nQ})(${JSON.stringify(g.roots)})`),{context:h,page:d,runId:b}}catch(d){throw await j(h).catch(()=>{return}),d}},u=await c(),a={browser:N,context:M,page:k,evaluator:u,async captureProgressFrame(b){return _(await b.screenshot({type:"jpeg",quality:65,timeout:2000}),{label:"Screen after browser action"})},async resetEvaluator(b){await j(a.evaluator.context),a.evaluator=await c(b)}};return U(),a}catch(D){throw await O().catch(()=>{return}),D}},R=async()=>{if(U(),K)return K;if(!G){V=A();let N;G=Promise.race([V,new Promise((M,D)=>{N=setTimeout(()=>D(Error("hands_browser_unavailable: startup timed out")),$7)})]).then((M)=>{return U(),K=M,M}).catch(async()=>{F=Error("hands_browser_unavailable: startup failed or timed out");let M;try{await Promise.race([O(),new Promise((D,w)=>{M=setTimeout(()=>w(Error("hands_repl_stop_timeout")),CZ)})])}catch{F=Error("hands_browser_unavailable: startup cleanup unconfirmed")}finally{if(M)clearTimeout(M)}throw F}).finally(()=>{if(N)clearTimeout(N)})}return G},P=async(N,M,D=!1)=>{let w=await R(),k=Y;if($.onBrowserOperation&&w.evaluator.runId!==M)await w.resetEvaluator(M);let _=(async()=>{let u=await w.evaluator.page.evaluate(`(${iQ})(${JSON.stringify({code:N})})`);if(typeof u!=="string")throw Error("hands_repl_invalid_evaluator_output");let a=k.page;if(D&&a&&!u.includes("<<<ARA_VIEW_IMAGE")){let b=()=>w.captureProgressFrame(a);try{let h=await($.onBrowserOperation?$.onBrowserOperation(M,b):b());return k.automaticProgressImage=!0,`${u}
 ${h}`}catch{return`${u}
-Screen capture unavailable.`}}return u})(),g,c=new Promise((u,o)=>{g=setTimeout(()=>o(Error("REPL evaluation timed out after 105 seconds")),e1)});try{return await Promise.race([_,c])}catch(u){if(u instanceof Error&&u.message.includes("timed out"))_.catch(()=>{return}),await w.resetEvaluator(M).catch(()=>{return});throw u}finally{if(g)clearTimeout(g)}},T=Promise.resolve(),S=new Set,m=new Set;X8($.socketPath);let E=l0.createServer((N)=>{S.add(N),N.once("close",()=>{S.delete(N),m.delete(N)}),N.setEncoding("utf8");let M="",D=!1;N.on("data",(w)=>{if(D)return;if(M+=w,M.length>t1){D=!0,K9(N,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let k=M.indexOf(`
-`);if(k===-1)return;D=!0;let f=M.slice(0,k);if($.onControl)try{let _=JSON.parse(f);if(typeof _.action==="string"&&_.action!=="evaluate")m.add(N)}catch{}T=T.then(async()=>{if(N.destroyed)return;J=[],Y={};try{let _=JSON.parse(f);if(_.action==="probe"){let b=await R();await P("undefined",b.evaluator.runId),K9(N,{ok:!0,output:"ARA_HANDS_REPL_READY"});return}if(typeof _.action==="string"&&_.action!=="evaluate"&&$.onControl){K9(N,{ok:!0,output:await $.onControl(_.action,_)});return}if(_.action!=="evaluate"||typeof _.code!=="string")throw Error("Invalid REPL request");let g=_.code,c=typeof _.runId==="string"?_.runId:void 0,u=()=>P(g,c,_.includeProgressCapture===!0),o=await($.onEvaluate?$.onEvaluate(_,u):u());K9(N,{ok:!0,output:o,browserActions:J,...Y.automaticProgressImage?{automaticProgressImage:!0}:{}})}catch(_){K9(N,{ok:!1,error:_ instanceof Error?_.message:String(_),stack:_ instanceof Error?_.stack:void 0,browserActions:J})}}).catch((_)=>{K9(N,{ok:!1,error:_ instanceof Error?_.message:String(_)})})})});try{await new Promise((N,M)=>{E.once("error",M),E.listen($.socketPath,()=>{E.off("error",M);try{g1($.socketPath,384),N()}catch(D){E.close(()=>M(D))}})})}catch(N){throw X8($.socketPath),N}return{socketPath:$.socketPath,browserExecutablePath:Z,stop(){if(H)return H;B=!0;let N=m.size?setTimeout(()=>{for(let k of m)k.destroy()},Q7):void 0,M=new Promise((k)=>E.close(()=>{if(N)clearTimeout(N);k()}));for(let k of S)if(!m.has(k))k.destroy();T.catch(()=>{return});let D=async()=>{await M,X8($.socketPath);let k=[O()];if(V)k.push(V.then(()=>{return},()=>{return}));let f=await Promise.allSettled(k),_=await Promise.allSettled([O()]),g=[...f,..._].filter((c)=>c.status==="rejected");if(g.length)throw AggregateError(g.map((c)=>c.reason),"hands_repl_stop_unconfirmed")},w;return H=Promise.race([D(),new Promise((k,f)=>{w=setTimeout(()=>f(Error("hands_repl_stop_timeout")),CZ)})]).finally(()=>{if(w)clearTimeout(w);X8($.socketPath)}),H}}}var z7=["private_runtime","runtime_root","temporary_directory","granted_root","workspace_layout","jobs","browser_socket","relay_url","environment_owner","job_environment","config_write"],K7=["ENOENT","EACCES","EPERM","EINVAL","ENOTDIR","EISDIR","ELOOP","EROFS","ENOSPC","EMFILE","ENFILE","EEXIST"];function xZ($,Q){if(!$||!z7.includes($))return null;let Z=typeof Q==="object"&&Q!==null&&"code"in Q?Q.code:null;return{workspace_stage:$,workspace_errno:typeof Z==="string"&&K7.includes(Z)?Z:"unknown"}}import{lstatSync as V7,readFileSync as F7}from"fs";var H7="/run/sc/egress-guard",U7=10002,t8=10003;function PZ($=process.platform,Q=H7){if($!=="linux")return!1;try{let Z=V7(Q);if(!Z.isFile()||Z.uid!==0||(Z.mode&18)!==0)return!1;return F7(Q,"utf8")===`v1 ${U7} ${t8}
-`}catch{return!1}}var W7=/^(\/.+)-sidechat-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;function IZ($){let Q=W7.exec($.replace(/\/+$/,""));return Q?`${Q[1]}/repo`:null}import{randomUUID as V6}from"crypto";import{spawn as F6,spawnSync as H6}from"child_process";import{chmodSync as b9,closeSync as U6,constants as H$,fchmodSync as W6,fstatSync as B6,openSync as L6,copyFileSync as N6,existsSync as W$,lstatSync as t,statSync as k9,mkdtempSync as M6,mkdirSync as N9,realpathSync as n,renameSync as U8,rmSync as j6,writeFileSync as W8}from"fs";import{homedir as C6,tmpdir as V4}from"os";import{basename as q6,dirname as V0,join as a,resolve as F4}from"path";var B7={"navigation.ara-egress.invalid":"canary_navigation","fetch.ara-egress.invalid":"canary_fetch","subresource.ara-egress.invalid":"canary_subresource","codeload.github.com":"canary_redirect","websocket.ara-egress.invalid":"canary_websocket"};function RZ($){return $===null?"other":B7[$]??"other"}function H0($,Q){if($===void 0||Q===void 0)return null;let Z=Math.round(Q-$);return Number.isSafeInteger(Z)&&Z>=0&&Z<=600000?Z:null}var p="workspace_mode",f0="granted_root",L0="project_root",V9="terminal_root",F9="terminal_benchmark_tool_profile",L7=["bash","bash-node-repl","bash-node-repl-files"],EZ="hands_node_repl_persistent_execution_unsupported";function SZ($){return $==="bash"?null:"hands_node_repl_persistent_execution_unsupported"}function e8($){return L7.includes($)}function yX($){return wZ($)&&$.workspace_mode==="terminal_root"&&e8($.terminal_benchmark_tool_profile)}var N0="tool_scoped_standby";function hX($){return wZ($)&&$[N0]===!0}function wZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}var uX=x.object({device_id:x.string().uuid(),root_id:x.string().uuid()}),Q$=/^reason\/[0-9a-f]{8}$/,N7=x.strictObject({source_path:x.string().refine(s0).optional(),branch:x.string().regex(Q$)}),lX=x.object({checkout_mode:x.enum(["worktree","direct"]).optional(),project_workspace_source:x.object({kind:x.literal("local_device"),device_id:x.string().uuid(),root_id:x.string().uuid(),path:x.string().refine(s0).optional(),worktree:N7.optional()})});import{execFile as M7}from"child_process";var j7=20000,C7=1e4,bZ=/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/,q7=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","gc.auto=0","-c","maintenance.auto=false"];async function kZ($,Q=T7){let Z=(j,O=C7)=>Q([...q7,"-C",$,...j],O),X=async(j)=>{let O=await Z(j);return O.status===0?O.stdout.trim():null},J=await X(["rev-parse","--verify","--quiet","HEAD^{commit}"]);if(!J||!bZ.test(J))return null;let Y=J.slice(0,12),K=(j)=>({commit:J,from:"head",note:`reason: started from ${j}`}),V=await X(["symbolic-ref","--quiet","HEAD"]);if(!V?.startsWith("refs/heads/"))return K(`the checkout's detached HEAD ${Y}`);let G=V.slice(11),F=await Z(["--no-optional-locks","status","--porcelain=v1","--untracked-files=no"]);if(F.status!==0||F.stdout.trim())return K(`${G} at ${Y}: the checkout has uncommitted changes, which stay there`);let B=await X(["config","--get",`branch.${G}.remote`]),H=await X(["config","--get",`branch.${G}.merge`]);if(!B||!H?.startsWith("refs/")||B.startsWith("-"))return K(`${G} at ${Y}: it has no upstream to catch up with`);let z=B==="."||(await Z(["fetch","--quiet","--no-tags","--no-write-fetch-head","--no-recurse-submodules",B,H],j7)).status===0,L=await X(["rev-parse","--abbrev-ref","--symbolic-full-name","@{upstream}"]),W=L?await X(["rev-parse","--verify","--quiet","@{upstream}^{commit}"]):null;if(!L||!W||!bZ.test(W))return K(`${G} at ${Y}: ${z?"it has no upstream to catch up with":`fetching ${B} failed`}`);if(!z)return K(`${G} at ${Y}: fetching ${L} failed, so it may be behind`);if(W===J)return K(`${G} at ${Y}, the same commit as ${L} after fetching it`);if((await Z(["merge-base","--is-ancestor",J,W])).status!==0)return K(`${G} at ${Y}: it has commits that ${L} does not`);let U=await X(["rev-list","--count",`${J}..${W}`]);return{commit:W,from:"upstream",note:`reason: started from ${L} at ${W.slice(0,12)}, fetched just now: ${G} had no commits of its own and was ${U??"some"} commits behind it`}}function T7($,Q){return new Promise((Z)=>{M7("git",$,{encoding:"utf8",timeout:Q,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(X,J)=>{let Y=X?typeof X.code==="number"?X.code:null:0;Z({status:Y,stdout:String(J??"")})})})}import{execFile as O7}from"child_process";import{lstatSync as J$,readdirSync as Z$,readFileSync as gZ,realpathSync as J8,rmdirSync as fZ,unlinkSync as D7,writeFileSync as _7}from"fs";import{readFile as A7}from"fs/promises";import{join as A0,resolve as mZ}from"path";var E9=".reason-device",x7=86400000,P7=500,I7=60000;function yZ($,Q,Z){let X=Q.split("/"),J=H9.split("/");if(X.length!==J.length+2||J.some((Y,K)=>X[K]!==Y)||!Y8.test(X[J.length]))return;try{let Y=hZ($,X[J.length]);_7(A0(Y,E9),Z,{flag:"wx",mode:384})}catch{}}function hZ($,Q){let Z=()=>new C("session_worktree_outside_workspace","Reason removes only Session folders in ~/.reason/workspace/sessions.");if(!Y8.test(Q))throw Z();let X=A0(J8($),H9),J=A0(X,Q);if(!J$(J).isDirectory()||J8(J)!==J)throw Z();return J}async function R7($,Q,Z=S7){let X;try{X=hZ($,Q)}catch(J){if(X$(J))return!0;throw J}for(let J of Z$(X,{withFileTypes:!0})){if(J.name===E9||!J.isDirectory())continue;let Y=A0(X,J.name),K=await E7(Y);if(K){let V=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false",`--git-dir=${K}`,"worktree"];if((await Z([...V,"remove","--force",Y])).status===0)await Z([...V,"prune"])}else try{fZ(Y)}catch{}}if(Z$(X).some((J)=>J!==E9))return!1;try{D7(A0(X,E9))}catch(J){if(!X$(J))throw J}return fZ(X),!0}async function E7($){try{let Q=A0($,".git");if(!J$(Q).isFile())return null;let Z=/^gitdir: (.+)$/m.exec(gZ(Q,"utf8"));if(!Z)return null;let X=mZ($,Z[1].trim());return mZ(X,(await A7(A0(X,"commondir"),"utf8")).trim())}catch{return null}}async function QJ($){let Q;try{if(Q=A0(J8($.home),H9),!J$(Q).isDirectory())return{status:"skipped",reason:"workspace_untrusted"};if(J8(Q)!==Q)return{status:"skipped",reason:"workspace_untrusted"}}catch(Y){if(X$(Y))return{status:"skipped",reason:"no_workspace"};throw Y}let Z=Z$(Q,{withFileTypes:!0}).filter((Y)=>Y.isDirectory()&&Y8.test(Y.name)).map((Y)=>Y.name).filter((Y)=>{try{return gZ(A0(Q,Y,E9),"utf8")===$.deviceId}catch{return!1}}).sort().slice(0,P7);if(!Z.length)return{status:"done",removed:[],kept:[],failed:[]};let X=await $.liveIds(Z);if(X===null)return{status:"skipped",reason:"server_unsupported"};let J={status:"done",removed:[],kept:Z.filter((Y)=>X.includes(Y)),failed:[]};for(let Y of Z.filter((K)=>!X.includes(K)))(await R7($.home,Y,$.runGit).catch(()=>!1)?J.removed:J.failed).push(Y);return J}function ZJ($,Q,Z=x7){if(Q.aborted)return;let X=!1,J=()=>{if(X||Q.aborted)return;X=!0,$().catch(()=>{return}).finally(()=>{X=!1})},Y=setInterval(J,Z);Y.unref?.(),Q.addEventListener("abort",()=>clearInterval(Y),{once:!0}),J()}function X$($){return typeof $==="object"&&$!==null&&$.code==="ENOENT"}function S7($){return new Promise((Q)=>{O7("git",$,{encoding:"utf8",timeout:I7,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(Z,X,J)=>{let Y=Z&&typeof Z.code==="number"?Z.code:null;Q({status:Z?Y??1:0,stderr:J??""})})})}import{createHash as w7}from"crypto";import{join as b7}from"path";function k7($){return G8($)}function x0(){throw new C("environment_unavailable","The private Session environment is unavailable or stale.")}function z8($){return w7("sha256").update(JSON.stringify({...$,variables:Object.fromEntries(Object.entries($.variables).sort(([Q],[Z])=>Q.localeCompare(Z)))})).digest("hex")}function vZ($,Q){_9($);let Z=b7($,"environment.json"),X,J=new Set,Y=(V,G)=>`${G}:${V}`,K=(V)=>{let G=TQ.safeParse(V);if(!G.success)return x0();let F=G.data,B=Q.identity(),H=Date.parse(F.expires_at);if(!B||F.run_id!==Q.runId||F.device_id!==Q.deviceId||F.root_id!==Q.rootId||F.binding.kind!==Q.binding.kind||F.binding.target_revision!==Q.binding.target_revision||F.binding.root_grant_revision!==Q.binding.root_grant_revision||F.binding.target_generation!==B.generation||F.binding.target_fence_id!==B.fenceId||H<=Date.now()||H>Q.expiresAtMs||Q.expiresAtMs<=Date.now()||Object.keys(F.variables).some((z)=>!k7(z)))return x0();if(F.git){let z=new URL(Q.apiOrigin),L=new URL(F.git.base_url),W=Date.parse(F.git.expires_at);if(L.origin!==z.origin)throw new C("environment_git_origin_mismatch","The delivered Git broker is not on this worker's API origin.");if(!["/git","/git/"].includes(L.pathname)||L.username||L.password||L.search||L.hash||W<=Date.now()||W>H)return x0()}if(F.cloud_access&&!CQ(F.cloud_access,Q.apiOrigin))throw new C("environment_cloud_access_origin_mismatch","The delivered cloud access is not on this worker's API origin.");return F};return{path:Z,install(V){let G=K(V),F=z8(G);if(X&&(G.revision<X.revision||G.revision===X.revision&&(F!==X.hash||G.snapshot_id!==X.snapshotId)))return x0();if(!X||G.revision>X.revision){if(EQ(Z,G,_0.snapshotBytes),z8(K(JSON.parse(A9(Z,_0.snapshotBytes))))!==F)return x0();let B=X;if(X={revision:G.revision,hash:F,snapshotId:G.snapshot_id,generation:G.binding.target_generation},B&&B.generation<X.generation)J.add(Y(B.snapshotId,B.revision))}else if(z8(K(JSON.parse(A9(Z,_0.snapshotBytes))))!==X.hash)return x0();return{installed:!0,snapshot_id:G.snapshot_id,installed_revision:G.revision}},current(){if(!X)return x0();try{let V=K(JSON.parse(A9(Z,_0.snapshotBytes)));if(z8(V)!==X.hash)return x0();return V}catch{return x0()}},carried:(V,G)=>J.has(Y(V,G))}}var U9=Object.freeze([Object.freeze({version:"0.2.61",artifact_sha256:"02ffcd514bf7cc0a9e73d4ce31ecea32709429cd0adf79e7062c1b70ff9ab8b8",legacy_linux_x64_sha256:"cdc0828abde3157e39afc6a64e033deee52ff7cfb09b55a42e60394df24980b9"}),Object.freeze({version:"0.2.62",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d",legacy_linux_x64_sha256:"cce594365d518b680abfb2378d234c8ef4e3daf257df83adef650a4523fb2d92"}),Object.freeze({version:"0.2.63",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d"}),Object.freeze({version:"0.2.64",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.65",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.66",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.67",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.68",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.69",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.70",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.71",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.72",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.73",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.74",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.75",artifact_sha256:"a6e0648894f1f4876affd77c0ff42642c1f9cbe9bb752de19d7a97a5fb3b820e"}),Object.freeze({version:"0.2.76",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.77",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.78",artifact_sha256:"0a7a7ece14850a28b8f972d66e4eef570eb2bb75d58f8a82f4e9afe91424e27f",pi_tools_v1:!0}),Object.freeze({version:"0.2.79",artifact_sha256:"96f52656b454fc5b9ffe520f5c5d55720b5173eb084cd326d2710e434623897b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.80",artifact_sha256:"6ee0ed70889e2771bd9b239ee039b549361b56ce870e08956ec7cce7fa199cd7",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.81",artifact_sha256:"c8909b36f4ee9316c0c3e298cb9adb5fc821a6ec5ca365cab60043eb942c258a",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.82",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.83",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.84",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.85",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.86",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.87",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.88",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.89",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.90",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.91",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.92",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.93",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.94",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.95",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.96",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.97",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.98",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.99",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.100",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.101",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.102",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.103",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.104",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.105",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.106",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.107",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.108",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.109",artifact_sha256:"7a82b33611b9f47478fb181d0da6f49a04f7e4bc401a7752530fecffb2dc5864",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.110",artifact_sha256:"00b7dcc9078a7d7ea4814414fbf92dcf9ba3b0fd51186aac1b967e9ae306a377",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.111",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.112",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.113",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.114",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.115",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.116",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.117",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.118",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.119",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.120",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.121",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.122",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.123",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.124",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.125",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.126",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.127",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.128",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.129",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.130",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.131",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.132",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.133",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.134",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.135",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.136",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.137",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.138",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.139",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.140",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.141",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.142",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.143",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.144",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.145",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.146",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.147",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.148",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.149",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.150",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.151",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.152",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.153",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.154",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.155",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.156",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.157",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.158",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.159",artifact_sha256:"cc806ca6df14c39d45a944d1e1db9827dae35b3e66e0265ededb3eea3d883dcb",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.160",artifact_sha256:"0b8f6c4598a19acbeff93929efc237dbc4e356ccb26abf6957e297bfc1b551e8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.161",artifact_sha256:"d570f5035bfc5916c31f4954ce5bcc00013eec83edb020edbbfbd3260b9c17d0",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.162",artifact_sha256:"6e52c44af7a3ea3633a4dc28aa63696143cd80044bca7f67a57c4c156985566f",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.163",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.164",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.165",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.166",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.167",artifact_sha256:"62658de309f9b9c8fd70041c83898d8625d85fed303ac6e60c3a17afc85477e2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.168",artifact_sha256:"24d7efe74218b862a90f48cf71dc59dce1d0dba29b167168aca06649bbfab364",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.169",artifact_sha256:"83879d03741c3f37c1502535d128685421cd7a498bc22543516a23ef2b21e496",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.170",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.171",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.172",artifact_sha256:"7a01a820961bd03b31007e46ba4f09df0a621ea5bfc9ee84548d6acdfd750169",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.173",artifact_sha256:"82c9ece017e109cf8b4b54734ac7a81b1ecb2ff35a426998369b6c3e690fd1ae",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.174",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.175",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.176",artifact_sha256:"ba3e211489877d0622aeca87be98e235d245f39d2b57f275cd924168d05f98ce",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0})]),f7="16befed856b4414dee65733e82549e1db74fe0ff3841d2571cfd8605d3ee970b",m7=Object.freeze(["ea63410f321f70848139a63ddcaa9f3f0a48daa3641898cc1db9f0e15ddfbb13","6cd101ddb09f87ed6996aa92a93911b1759b5ae33e9579c3dff8225ecfcbe1b6",f7]),cZ=Object.freeze(["0f57db3036c275f78064796a72827d0f47fe702475e5feebb31e1569bcb5a0cf","38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2"]),jJ=Object.freeze(["pi_tools_v1","background_bash_v1","machine_sdk_v1","pi_tools_confinement_v1","home_folder_v1","workspace_before_v1"]),CJ=new Set([K0,...U9.map(($)=>$.artifact_sha256),...m7,...cZ]);var qJ=new Set([K0,...U9.filter(($)=>$.pi_tools_v1).map(($)=>$.artifact_sha256),...cZ]);var TJ=new Set([K0,...U9.filter(($)=>$.pi_tools_confinement_v1).map(($)=>$.artifact_sha256)]);var OJ=new Set([K0,...U9.filter(($)=>$.home_folder_v1).map(($)=>$.artifact_sha256)]);var DJ=new Set([K0,...U9.filter(($)=>$.background_bash_v1).map(($)=>$.artifact_sha256)]);var _J=new Set([K0,...U9.filter(($)=>$.machine_sdk_v1).map(($)=>$.artifact_sha256)]);var g7=[n0,"reason-hands-worker.cjs"];function dZ($){return typeof $==="string"&&g7.includes($)}var y7;function pZ(){return y7??{kind:"unavailable",status:"unsupported_entrypoint",sha256:null,observed_at_ms:null}}import{closeSync as h7,constants as Y$,fstatSync as uZ,lstatSync as v7,openSync as c7,readSync as d7,realpathSync as p7,watch as u7}from"fs";import{dirname as lZ}from"path";function K8($,Q){let Z;try{let X=lZ($),J=v7(X);if(!J.isDirectory()||J.isSymbolicLink()||J.uid!==process.getuid?.()||(J.mode&18)!==0||p7(X)!==X)return null;Z=c7($,Y$.O_RDONLY|Y$.O_NOFOLLOW|Y$.O_NONBLOCK);let Y=uZ(Z);if(!Y.isFile()||Y.nlink!==1||Y.uid!==process.getuid?.()||(Y.mode&63)!==0||Y.size<1||Y.size>8192)return null;let K=Buffer.alloc(8193),V=d7(Z,K,0,K.length,0),G=uZ(Z);if(V!==Y.size||G.size!==Y.size||G.nlink!==1||G.mtimeMs!==Y.mtimeMs||G.ctimeMs!==Y.ctimeMs)return null;let F=JSON.parse(K.subarray(0,V).toString("utf8"));if(!F||F.pid!==Q.pid||!Number.isSafeInteger(F.pid)||F.pid<1||F.launchId!==Q.launchId||F.workerVersion!==Q.workerVersion||F.protocolVersion!==Q.protocolVersion||F.workerArtifactSha256!==Q.workerArtifactSha256||F.workerEntrypoint!==Q.workerEntrypoint||F.workspaceAliasReady!==!0||!S0(F.targetGeneration)||!S0(F.generation)||!O0(F.fenceId))return null;return{...Q,generation:F.generation,targetGeneration:F.targetGeneration,fenceId:F.fenceId,workspaceAliasReady:!0}}catch{return null}finally{if(Z!==void 0)h7(Z)}}var l7=($,Q,Z)=>{let X=u7($,{persistent:!1},Q);return X.on("error",Z),X};function sZ($){let Q=new AbortController,Z=$.initial,X=Z.targetGeneration,J=!1,Y=!1,K,V,G=()=>{if(Y)return;Y=!0,K?.close(),K=void 0,clearInterval(V),$.signal.removeEventListener("abort",G),Q.abort()},F=()=>{if(Y)return;if(!$.isAlive()){G();return}let B=K8($.path,$.initial);if(!B||B.generation<Z.generation||B.targetGeneration<Z.targetGeneration||B.targetGeneration===Z.targetGeneration&&B.fenceId!==Z.fenceId)return;if(Z=B,J||B.targetGeneration<=X)return;X=B.targetGeneration,J=!0,Promise.resolve().then(()=>{return Q.signal.throwIfAborted(),$.publish(B,Q.signal)}).catch(()=>{if(!Y)G(),$.failed?.()}).finally(()=>{J=!1,F()})};if($.signal.aborted)return G(),{stop:G};$.signal.addEventListener("abort",G,{once:!0});try{K=($.watch??l7)(lZ($.path),F,()=>{K?.close(),K=void 0})}catch{}return V=setInterval(F,1000),V.unref?.(),F(),{stop:G}}import{spawn as s7}from"child_process";import{chmodSync as n7,mkdtempSync as i7,realpathSync as a7,rmSync as o7,unlinkSync as r7,writeFileSync as t7}from"fs";import e7 from"net";import{platform as $6,tmpdir as Q6}from"os";import{join as nZ}from"path";var iZ=1048576,K$=105000,Z6=2000,X6=String.raw`
+Screen capture unavailable.`}}return u})(),g,c=new Promise((u,a)=>{g=setTimeout(()=>a(Error("REPL evaluation timed out after 105 seconds")),e1)});try{return await Promise.race([_,c])}catch(u){if(u instanceof Error&&u.message.includes("timed out"))_.catch(()=>{return}),await w.resetEvaluator(M).catch(()=>{return});throw u}finally{if(g)clearTimeout(g)}},T=Promise.resolve(),S=new Set,m=new Set;J8($.socketPath);let E=s0.createServer((N)=>{S.add(N),N.once("close",()=>{S.delete(N),m.delete(N)}),N.setEncoding("utf8");let M="",D=!1;N.on("data",(w)=>{if(D)return;if(M+=w,M.length>t1){D=!0,F9(N,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let k=M.indexOf(`
+`);if(k===-1)return;D=!0;let f=M.slice(0,k);if($.onControl)try{let _=JSON.parse(f);if(typeof _.action==="string"&&_.action!=="evaluate")m.add(N)}catch{}T=T.then(async()=>{if(N.destroyed)return;J=[],Y={};try{let _=JSON.parse(f);if(_.action==="probe"){let b=await R();await P("undefined",b.evaluator.runId),F9(N,{ok:!0,output:"ARA_HANDS_REPL_READY"});return}if(typeof _.action==="string"&&_.action!=="evaluate"&&$.onControl){F9(N,{ok:!0,output:await $.onControl(_.action,_)});return}if(_.action!=="evaluate"||typeof _.code!=="string")throw Error("Invalid REPL request");let g=_.code,c=typeof _.runId==="string"?_.runId:void 0,u=()=>P(g,c,_.includeProgressCapture===!0),a=await($.onEvaluate?$.onEvaluate(_,u):u());F9(N,{ok:!0,output:a,browserActions:J,...Y.automaticProgressImage?{automaticProgressImage:!0}:{}})}catch(_){F9(N,{ok:!1,error:_ instanceof Error?_.message:String(_),stack:_ instanceof Error?_.stack:void 0,browserActions:J})}}).catch((_)=>{F9(N,{ok:!1,error:_ instanceof Error?_.message:String(_)})})})});try{await new Promise((N,M)=>{E.once("error",M),E.listen($.socketPath,()=>{E.off("error",M);try{g1($.socketPath,384),N()}catch(D){E.close(()=>M(D))}})})}catch(N){throw J8($.socketPath),N}return{socketPath:$.socketPath,browserExecutablePath:Z,stop(){if(H)return H;B=!0;let N=m.size?setTimeout(()=>{for(let k of m)k.destroy()},Q7):void 0,M=new Promise((k)=>E.close(()=>{if(N)clearTimeout(N);k()}));for(let k of S)if(!m.has(k))k.destroy();T.catch(()=>{return});let D=async()=>{await M,J8($.socketPath);let k=[O()];if(V)k.push(V.then(()=>{return},()=>{return}));let f=await Promise.allSettled(k),_=await Promise.allSettled([O()]),g=[...f,..._].filter((c)=>c.status==="rejected");if(g.length)throw AggregateError(g.map((c)=>c.reason),"hands_repl_stop_unconfirmed")},w;return H=Promise.race([D(),new Promise((k,f)=>{w=setTimeout(()=>f(Error("hands_repl_stop_timeout")),CZ)})]).finally(()=>{if(w)clearTimeout(w);J8($.socketPath)}),H}}}var z7=["private_runtime","runtime_root","temporary_directory","granted_root","workspace_layout","jobs","browser_socket","relay_url","environment_owner","job_environment","config_write"],K7=["ENOENT","EACCES","EPERM","EINVAL","ENOTDIR","EISDIR","ELOOP","EROFS","ENOSPC","EMFILE","ENFILE","EEXIST"];function xZ($,Q){if(!$||!z7.includes($))return null;let Z=typeof Q==="object"&&Q!==null&&"code"in Q?Q.code:null;return{workspace_stage:$,workspace_errno:typeof Z==="string"&&K7.includes(Z)?Z:"unknown"}}import{lstatSync as V7,readFileSync as F7}from"fs";var H7="/run/sc/egress-guard",U7=10002,e8=10003;function PZ($=process.platform,Q=H7){if($!=="linux")return!1;try{let Z=V7(Q);if(!Z.isFile()||Z.uid!==0||(Z.mode&18)!==0)return!1;return F7(Q,"utf8")===`v1 ${U7} ${e8}
+`}catch{return!1}}var W7=/^(\/.+)-sidechat-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;function IZ($){let Q=W7.exec($.replace(/\/+$/,""));return Q?`${Q[1]}/repo`:null}import{randomUUID as V6}from"crypto";import{spawn as F6,spawnSync as H6}from"child_process";import{chmodSync as f9,closeSync as U6,constants as U$,fchmodSync as W6,fstatSync as B6,openSync as L6,copyFileSync as N6,existsSync as B$,lstatSync as t,statSync as m9,mkdtempSync as M6,mkdirSync as j9,realpathSync as n,renameSync as W8,rmSync as j6,writeFileSync as B8}from"fs";import{homedir as C6,tmpdir as V4}from"os";import{basename as q6,dirname as V0,join as o,resolve as F4}from"path";var B7={"navigation.ara-egress.invalid":"canary_navigation","fetch.ara-egress.invalid":"canary_fetch","subresource.ara-egress.invalid":"canary_subresource","codeload.github.com":"canary_redirect","websocket.ara-egress.invalid":"canary_websocket"};function RZ($){return $===null?"other":B7[$]??"other"}function H0($,Q){if($===void 0||Q===void 0)return null;let Z=Math.round(Q-$);return Number.isSafeInteger(Z)&&Z>=0&&Z<=600000?Z:null}var p="workspace_mode",f0="granted_root",L0="project_root",H9="terminal_root",U9="terminal_benchmark_tool_profile",L7=["bash","bash-node-repl","bash-node-repl-files"],EZ="hands_node_repl_persistent_execution_unsupported";function SZ($){return $==="bash"?null:"hands_node_repl_persistent_execution_unsupported"}function $$($){return L7.includes($)}function yX($){return wZ($)&&$.workspace_mode==="terminal_root"&&$$($.terminal_benchmark_tool_profile)}var N0="tool_scoped_standby";function hX($){return wZ($)&&$[N0]===!0}function wZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}var lX=x.object({device_id:x.string().uuid(),root_id:x.string().uuid()}),Z$=/^reason\/[0-9a-f]{8}$/,N7=x.strictObject({source_path:x.string().refine(n0).optional(),branch:x.string().regex(Z$)}),uX=x.object({checkout_mode:x.enum(["worktree","direct"]).optional(),project_workspace_source:x.object({kind:x.literal("local_device"),device_id:x.string().uuid(),root_id:x.string().uuid(),path:x.string().refine(n0).optional(),worktree:N7.optional()})});import{execFile as M7}from"child_process";var j7=20000,C7=1e4,bZ=/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/,q7=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","gc.auto=0","-c","maintenance.auto=false"];async function kZ($,Q=T7){let Z=(j,O=C7)=>Q([...q7,"-C",$,...j],O),X=async(j)=>{let O=await Z(j);return O.status===0?O.stdout.trim():null},J=await X(["rev-parse","--verify","--quiet","HEAD^{commit}"]);if(!J||!bZ.test(J))return null;let Y=J.slice(0,12),K=(j)=>({commit:J,from:"head",note:`reason: started from ${j}`}),V=await X(["symbolic-ref","--quiet","HEAD"]);if(!V?.startsWith("refs/heads/"))return K(`the checkout's detached HEAD ${Y}`);let G=V.slice(11),F=await Z(["--no-optional-locks","status","--porcelain=v1","--untracked-files=no"]);if(F.status!==0||F.stdout.trim())return K(`${G} at ${Y}: the checkout has uncommitted changes, which stay there`);let B=await X(["config","--get",`branch.${G}.remote`]),H=await X(["config","--get",`branch.${G}.merge`]);if(!B||!H?.startsWith("refs/")||B.startsWith("-"))return K(`${G} at ${Y}: it has no upstream to catch up with`);let z=B==="."||(await Z(["fetch","--quiet","--no-tags","--no-write-fetch-head","--no-recurse-submodules",B,H],j7)).status===0,L=await X(["rev-parse","--abbrev-ref","--symbolic-full-name","@{upstream}"]),W=L?await X(["rev-parse","--verify","--quiet","@{upstream}^{commit}"]):null;if(!L||!W||!bZ.test(W))return K(`${G} at ${Y}: ${z?"it has no upstream to catch up with":`fetching ${B} failed`}`);if(!z)return K(`${G} at ${Y}: fetching ${L} failed, so it may be behind`);if(W===J)return K(`${G} at ${Y}, the same commit as ${L} after fetching it`);if((await Z(["merge-base","--is-ancestor",J,W])).status!==0)return K(`${G} at ${Y}: it has commits that ${L} does not`);let U=await X(["rev-list","--count",`${J}..${W}`]);return{commit:W,from:"upstream",note:`reason: started from ${L} at ${W.slice(0,12)}, fetched just now: ${G} had no commits of its own and was ${U??"some"} commits behind it`}}function T7($,Q){return new Promise((Z)=>{M7("git",$,{encoding:"utf8",timeout:Q,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(X,J)=>{let Y=X?typeof X.code==="number"?X.code:null:0;Z({status:Y,stdout:String(J??"")})})})}import{execFile as O7}from"child_process";import{lstatSync as Y$,readdirSync as X$,readFileSync as gZ,realpathSync as Y8,rmdirSync as fZ,unlinkSync as D7,writeFileSync as _7}from"fs";import{readFile as A7}from"fs/promises";import{join as A0,resolve as mZ}from"path";var w9=".reason-device",x7=86400000,P7=500,I7=60000;function yZ($,Q,Z){let X=Q.split("/"),J=W9.split("/");if(X.length!==J.length+2||J.some((Y,K)=>X[K]!==Y)||!G8.test(X[J.length]))return;try{let Y=hZ($,X[J.length]);_7(A0(Y,w9),Z,{flag:"wx",mode:384})}catch{}}function hZ($,Q){let Z=()=>new C("session_worktree_outside_workspace","Reason removes only Session folders in ~/.reason/workspace/sessions.");if(!G8.test(Q))throw Z();let X=A0(Y8($),W9),J=A0(X,Q);if(!Y$(J).isDirectory()||Y8(J)!==J)throw Z();return J}async function R7($,Q,Z=S7){let X;try{X=hZ($,Q)}catch(J){if(J$(J))return!0;throw J}for(let J of X$(X,{withFileTypes:!0})){if(J.name===w9||!J.isDirectory())continue;let Y=A0(X,J.name),K=await E7(Y);if(K){let V=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false",`--git-dir=${K}`,"worktree"];if((await Z([...V,"remove","--force",Y])).status===0)await Z([...V,"prune"])}else try{fZ(Y)}catch{}}if(X$(X).some((J)=>J!==w9))return!1;try{D7(A0(X,w9))}catch(J){if(!J$(J))throw J}return fZ(X),!0}async function E7($){try{let Q=A0($,".git");if(!Y$(Q).isFile())return null;let Z=/^gitdir: (.+)$/m.exec(gZ(Q,"utf8"));if(!Z)return null;let X=mZ($,Z[1].trim());return mZ(X,(await A7(A0(X,"commondir"),"utf8")).trim())}catch{return null}}async function QJ($){let Q;try{if(Q=A0(Y8($.home),W9),!Y$(Q).isDirectory())return{status:"skipped",reason:"workspace_untrusted"};if(Y8(Q)!==Q)return{status:"skipped",reason:"workspace_untrusted"}}catch(Y){if(J$(Y))return{status:"skipped",reason:"no_workspace"};throw Y}let Z=X$(Q,{withFileTypes:!0}).filter((Y)=>Y.isDirectory()&&G8.test(Y.name)).map((Y)=>Y.name).filter((Y)=>{try{return gZ(A0(Q,Y,w9),"utf8")===$.deviceId}catch{return!1}}).sort().slice(0,P7);if(!Z.length)return{status:"done",removed:[],kept:[],failed:[]};let X=await $.liveIds(Z);if(X===null)return{status:"skipped",reason:"server_unsupported"};let J={status:"done",removed:[],kept:Z.filter((Y)=>X.includes(Y)),failed:[]};for(let Y of Z.filter((K)=>!X.includes(K)))(await R7($.home,Y,$.runGit).catch(()=>!1)?J.removed:J.failed).push(Y);return J}function ZJ($,Q,Z=x7){if(Q.aborted)return;let X=!1,J=()=>{if(X||Q.aborted)return;X=!0,$().catch(()=>{return}).finally(()=>{X=!1})},Y=setInterval(J,Z);Y.unref?.(),Q.addEventListener("abort",()=>clearInterval(Y),{once:!0}),J()}function J$($){return typeof $==="object"&&$!==null&&$.code==="ENOENT"}function S7($){return new Promise((Q)=>{O7("git",$,{encoding:"utf8",timeout:I7,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(Z,X,J)=>{let Y=Z&&typeof Z.code==="number"?Z.code:null;Q({status:Z?Y??1:0,stderr:J??""})})})}import{createHash as w7}from"crypto";import{join as b7}from"path";function k7($){return z8($)}function x0(){throw new C("environment_unavailable","The private Session environment is unavailable or stale.")}function K8($){return w7("sha256").update(JSON.stringify({...$,variables:Object.fromEntries(Object.entries($.variables).sort(([Q],[Z])=>Q.localeCompare(Z)))})).digest("hex")}function vZ($,Q){x9($);let Z=b7($,"environment.json"),X,J=new Set,Y=(V,G)=>`${G}:${V}`,K=(V)=>{let G=TQ.safeParse(V);if(!G.success)return x0();let F=G.data,B=Q.identity(),H=Date.parse(F.expires_at);if(!B||F.run_id!==Q.runId||F.device_id!==Q.deviceId||F.root_id!==Q.rootId||F.binding.kind!==Q.binding.kind||F.binding.target_revision!==Q.binding.target_revision||F.binding.root_grant_revision!==Q.binding.root_grant_revision||F.binding.target_generation!==B.generation||F.binding.target_fence_id!==B.fenceId||H<=Date.now()||H>Q.expiresAtMs||Q.expiresAtMs<=Date.now()||Object.keys(F.variables).some((z)=>!k7(z)))return x0();if(F.git){let z=new URL(Q.apiOrigin),L=new URL(F.git.base_url),W=Date.parse(F.git.expires_at);if(L.origin!==z.origin)throw new C("environment_git_origin_mismatch","The delivered Git broker is not on this worker's API origin.");if(!["/git","/git/"].includes(L.pathname)||L.username||L.password||L.search||L.hash||W<=Date.now()||W>H)return x0()}if(F.cloud_access&&!CQ(F.cloud_access,Q.apiOrigin))throw new C("environment_cloud_access_origin_mismatch","The delivered cloud access is not on this worker's API origin.");return F};return{path:Z,install(V){let G=K(V),F=K8(G);if(X&&(G.revision<X.revision||G.revision===X.revision&&(F!==X.hash||G.snapshot_id!==X.snapshotId)))return x0();if(!X||G.revision>X.revision){if(EQ(Z,G,_0.snapshotBytes),K8(K(JSON.parse(P9(Z,_0.snapshotBytes))))!==F)return x0();let B=X;if(X={revision:G.revision,hash:F,snapshotId:G.snapshot_id,generation:G.binding.target_generation},B&&B.generation<X.generation)J.add(Y(B.snapshotId,B.revision))}else if(K8(K(JSON.parse(P9(Z,_0.snapshotBytes))))!==X.hash)return x0();return{installed:!0,snapshot_id:G.snapshot_id,installed_revision:G.revision}},current(){if(!X)return x0();try{let V=K(JSON.parse(P9(Z,_0.snapshotBytes)));if(K8(V)!==X.hash)return x0();return V}catch{return x0()}},carried:(V,G)=>J.has(Y(V,G))}}var B9=Object.freeze([Object.freeze({version:"0.2.61",artifact_sha256:"02ffcd514bf7cc0a9e73d4ce31ecea32709429cd0adf79e7062c1b70ff9ab8b8",legacy_linux_x64_sha256:"cdc0828abde3157e39afc6a64e033deee52ff7cfb09b55a42e60394df24980b9"}),Object.freeze({version:"0.2.62",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d",legacy_linux_x64_sha256:"cce594365d518b680abfb2378d234c8ef4e3daf257df83adef650a4523fb2d92"}),Object.freeze({version:"0.2.63",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d"}),Object.freeze({version:"0.2.64",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.65",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.66",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.67",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.68",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.69",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.70",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.71",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.72",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.73",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.74",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.75",artifact_sha256:"a6e0648894f1f4876affd77c0ff42642c1f9cbe9bb752de19d7a97a5fb3b820e"}),Object.freeze({version:"0.2.76",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.77",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.78",artifact_sha256:"0a7a7ece14850a28b8f972d66e4eef570eb2bb75d58f8a82f4e9afe91424e27f",pi_tools_v1:!0}),Object.freeze({version:"0.2.79",artifact_sha256:"96f52656b454fc5b9ffe520f5c5d55720b5173eb084cd326d2710e434623897b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.80",artifact_sha256:"6ee0ed70889e2771bd9b239ee039b549361b56ce870e08956ec7cce7fa199cd7",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.81",artifact_sha256:"c8909b36f4ee9316c0c3e298cb9adb5fc821a6ec5ca365cab60043eb942c258a",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.82",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.83",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.84",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.85",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.86",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.87",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.88",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.89",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.90",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.91",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.92",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.93",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.94",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.95",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.96",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.97",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.98",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.99",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.100",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.101",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.102",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.103",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.104",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.105",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.106",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.107",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.108",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.109",artifact_sha256:"7a82b33611b9f47478fb181d0da6f49a04f7e4bc401a7752530fecffb2dc5864",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.110",artifact_sha256:"00b7dcc9078a7d7ea4814414fbf92dcf9ba3b0fd51186aac1b967e9ae306a377",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.111",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.112",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.113",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.114",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.115",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.116",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.117",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.118",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.119",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.120",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.121",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.122",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.123",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.124",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.125",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.126",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.127",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.128",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.129",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.130",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.131",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.132",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.133",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.134",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.135",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.136",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.137",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.138",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.139",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.140",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.141",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.142",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.143",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.144",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.145",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.146",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.147",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.148",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.149",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.150",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.151",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.152",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.153",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.154",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.155",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.156",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.157",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.158",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.159",artifact_sha256:"cc806ca6df14c39d45a944d1e1db9827dae35b3e66e0265ededb3eea3d883dcb",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.160",artifact_sha256:"0b8f6c4598a19acbeff93929efc237dbc4e356ccb26abf6957e297bfc1b551e8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.161",artifact_sha256:"d570f5035bfc5916c31f4954ce5bcc00013eec83edb020edbbfbd3260b9c17d0",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.162",artifact_sha256:"6e52c44af7a3ea3633a4dc28aa63696143cd80044bca7f67a57c4c156985566f",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.163",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.164",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.165",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.166",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.167",artifact_sha256:"62658de309f9b9c8fd70041c83898d8625d85fed303ac6e60c3a17afc85477e2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.168",artifact_sha256:"24d7efe74218b862a90f48cf71dc59dce1d0dba29b167168aca06649bbfab364",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.169",artifact_sha256:"83879d03741c3f37c1502535d128685421cd7a498bc22543516a23ef2b21e496",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.170",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.171",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.172",artifact_sha256:"7a01a820961bd03b31007e46ba4f09df0a621ea5bfc9ee84548d6acdfd750169",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.173",artifact_sha256:"82c9ece017e109cf8b4b54734ac7a81b1ecb2ff35a426998369b6c3e690fd1ae",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.174",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.175",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.176",artifact_sha256:"ba3e211489877d0622aeca87be98e235d245f39d2b57f275cd924168d05f98ce",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0})]),f7="16befed856b4414dee65733e82549e1db74fe0ff3841d2571cfd8605d3ee970b",m7=Object.freeze(["ea63410f321f70848139a63ddcaa9f3f0a48daa3641898cc1db9f0e15ddfbb13","6cd101ddb09f87ed6996aa92a93911b1759b5ae33e9579c3dff8225ecfcbe1b6",f7]),cZ=Object.freeze(["0f57db3036c275f78064796a72827d0f47fe702475e5feebb31e1569bcb5a0cf","38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2"]),jJ=Object.freeze(["pi_tools_v1","background_bash_v1","machine_sdk_v1","pi_tools_confinement_v1","home_folder_v1","workspace_before_v1"]),CJ=new Set([K0,...B9.map(($)=>$.artifact_sha256),...m7,...cZ]);var qJ=new Set([K0,...B9.filter(($)=>$.pi_tools_v1).map(($)=>$.artifact_sha256),...cZ]);var TJ=new Set([K0,...B9.filter(($)=>$.pi_tools_confinement_v1).map(($)=>$.artifact_sha256)]);var OJ=new Set([K0,...B9.filter(($)=>$.home_folder_v1).map(($)=>$.artifact_sha256)]);var DJ=new Set([K0,...B9.filter(($)=>$.background_bash_v1).map(($)=>$.artifact_sha256)]);var _J=new Set([K0,...B9.filter(($)=>$.machine_sdk_v1).map(($)=>$.artifact_sha256)]);var g7=[i0,"reason-hands-worker.cjs"];function dZ($){return typeof $==="string"&&g7.includes($)}var y7;function pZ(){return y7??{kind:"unavailable",status:"unsupported_entrypoint",sha256:null,observed_at_ms:null}}import{closeSync as h7,constants as G$,fstatSync as lZ,lstatSync as v7,openSync as c7,readSync as d7,realpathSync as p7,watch as l7}from"fs";import{dirname as uZ}from"path";function V8($,Q){let Z;try{let X=uZ($),J=v7(X);if(!J.isDirectory()||J.isSymbolicLink()||J.uid!==process.getuid?.()||(J.mode&18)!==0||p7(X)!==X)return null;Z=c7($,G$.O_RDONLY|G$.O_NOFOLLOW|G$.O_NONBLOCK);let Y=lZ(Z);if(!Y.isFile()||Y.nlink!==1||Y.uid!==process.getuid?.()||(Y.mode&63)!==0||Y.size<1||Y.size>8192)return null;let K=Buffer.alloc(8193),V=d7(Z,K,0,K.length,0),G=lZ(Z);if(V!==Y.size||G.size!==Y.size||G.nlink!==1||G.mtimeMs!==Y.mtimeMs||G.ctimeMs!==Y.ctimeMs)return null;let F=JSON.parse(K.subarray(0,V).toString("utf8"));if(!F||F.pid!==Q.pid||!Number.isSafeInteger(F.pid)||F.pid<1||F.launchId!==Q.launchId||F.workerVersion!==Q.workerVersion||F.protocolVersion!==Q.protocolVersion||F.workerArtifactSha256!==Q.workerArtifactSha256||F.workerEntrypoint!==Q.workerEntrypoint||F.workspaceAliasReady!==!0||!S0(F.targetGeneration)||!S0(F.generation)||!O0(F.fenceId))return null;return{...Q,generation:F.generation,targetGeneration:F.targetGeneration,fenceId:F.fenceId,workspaceAliasReady:!0}}catch{return null}finally{if(Z!==void 0)h7(Z)}}var u7=($,Q,Z)=>{let X=l7($,{persistent:!1},Q);return X.on("error",Z),X};function sZ($){let Q=new AbortController,Z=$.initial,X=Z.targetGeneration,J=!1,Y=!1,K,V,G=()=>{if(Y)return;Y=!0,K?.close(),K=void 0,clearInterval(V),$.signal.removeEventListener("abort",G),Q.abort()},F=()=>{if(Y)return;if(!$.isAlive()){G();return}let B=V8($.path,$.initial);if(!B||B.generation<Z.generation||B.targetGeneration<Z.targetGeneration||B.targetGeneration===Z.targetGeneration&&B.fenceId!==Z.fenceId)return;if(Z=B,J||B.targetGeneration<=X)return;X=B.targetGeneration,J=!0,Promise.resolve().then(()=>{return Q.signal.throwIfAborted(),$.publish(B,Q.signal)}).catch(()=>{if(!Y)G(),$.failed?.()}).finally(()=>{J=!1,F()})};if($.signal.aborted)return G(),{stop:G};$.signal.addEventListener("abort",G,{once:!0});try{K=($.watch??u7)(uZ($.path),F,()=>{K?.close(),K=void 0})}catch{}return V=setInterval(F,1000),V.unref?.(),F(),{stop:G}}import{spawn as s7}from"child_process";import{chmodSync as n7,mkdtempSync as i7,realpathSync as o7,rmSync as a7,unlinkSync as r7,writeFileSync as t7}from"fs";import e7 from"net";import{platform as $6,tmpdir as Q6}from"os";import{join as nZ}from"path";var iZ=1048576,V$=105000,Z6=2000,X6=String.raw`
 const { writeSync } = require("node:fs");
 const { createRequire } = require("node:module");
 const { join } = require("node:path");
@@ -318,7 +318,7 @@ const { createInterface } = require("node:readline");
 const { formatWithOptions, inspect } = require("node:util");
 const vm = require("node:vm");
 
-const timeoutMs = ${K$};
+const timeoutMs = ${V$};
 const maxLogChars = 524288;
 let activeOutput = [];
 let activeOutputChars = 0;
@@ -449,11 +449,11 @@ lines.on("line", (line) => {
     }
   }).catch((error) => respond({ ok: false, error: String(error) }));
 });
-`;function J6($=process.execPath,Q=process.versions.bun){return Q?"node":$}function G$($){try{r7($)}catch{}}function V8($,Q){$.end(`${JSON.stringify(Q)}
-`)}function z$($){return JSON.stringify($)}function Y6($){let Q=i7(nZ(Q6(),"reason-node-repl-")),Z=nZ(Q,"node-repl.sb"),J=["(version 1)","(deny default)",'(import "system.sb")',"(allow process*)","(deny network*)",`(allow file-read* ${["/System","/usr","/bin","/opt/homebrew","/usr/local"].map((K)=>`(subpath ${z$(K)})`).join(" ")})`,`(allow file-read* file-write* (subpath ${z$($.workRoot)}) (subpath ${z$(Q)}))`].join(`
-`);t7(Z,J,{mode:384});let Y=!1;return{command:"/usr/bin/sandbox-exec",args:["-f",Z,$.nodeExecutable,...$.nodeArgs],cwd:$.workRoot,env:{...$.environment,TMPDIR:Q},async cleanup(){if(Y)return;Y=!0,o7(Q,{recursive:!0,force:!0})}}}async function G6($){let Q=a7($.workRoot),Z=$.nodeExecutable??J6(),X=["--max-old-space-size=512","--permission",`--allow-fs-read=${Q}`,`--allow-fs-write=${Q}`,"-e",X6],J=F8({home:Q,temporaryDirectory:Q}),Y=$.platformName??$6();if(Y==="linux")return{command:Z,args:X,cwd:Q,env:J,async cleanup(){}};if(Y==="darwin")return Y6({nodeExecutable:Z,nodeArgs:X,workRoot:Q,environment:J});throw Error("hands_node_repl_platform_unsupported")}async function S9($){let Q;try{await Promise.race([$,new Promise((Z,X)=>{Q=setTimeout(()=>X(Error("hands_node_repl_child_cleanup_timeout")),Z6)})])}finally{clearTimeout(Q)}}async function aZ($){if($.executionMode!=="single-evaluation")throw Error(EZ);let Q=await G6($),Z;try{Z=s7(Q.command,Q.args,{cwd:Q.cwd,env:Q.env,stdio:["pipe","pipe","pipe"]})}catch(q){throw await Q.cleanup(),q}let X=new Promise((q)=>Z.once("close",()=>q())),J;Z.once("error",(q)=>{J=q});let Y=!1,K=!1,V="";Z.stderr.setEncoding("utf8"),Z.stderr.on("data",(q)=>{V=`${V}${q}`.slice(-16384)});let G=Z.stdout,F,B=(q,A,R)=>{if(R)q.failure??=R;if(q.finishing)return;q.finishing=!0,K=!0,Z.kill("SIGKILL"),S9(X).then(()=>{if(q.failure)q.reject(q.failure);else q.resolve(A??{})},(P)=>q.reject(P))},H=()=>{if(K=!0,F)B(F,void 0,Error("hands_node_repl_state_lost"));else Z.kill("SIGKILL")},z="";G?.setEncoding("utf8"),G?.on("data",(q)=>{if(F?.finishing||K)return;if(z+=q,z.length>iZ){H();return}while(!0){let A=z.indexOf(`
-`);if(A===-1)return;let R=z.slice(0,A);z=z.slice(A+1);let P=F;if(!P){H();return}try{let T=JSON.parse(R);if(P.action==="probe")P.resolve(T);else{B(P,T);return}}catch{B(P,void 0,Error("invalid_hands_node_repl_child_response"));return}}});let L=(q)=>{let A=V.trim(),R=q??Error(A?`hands_node_repl_child_exited:${A}`:"hands_node_repl_child_exited");if(K=!0,F&&!F.finishing)B(F,void 0,R)};Z.once("error",L),Z.once("close",()=>L()),Z.stdin.on("error",L);let W=(q)=>new Promise((A,R)=>{if(Y||K||Z.exitCode!==null||Z.signalCode!==null){R(Error(K?"hands_node_repl_state_lost":"hands_node_repl_stopped"));return}let P=setTimeout(H,q.action==="probe"?1e4:Math.max(1,Math.min($.evaluationTimeoutMs??K$-1000,K$-1000))),T={action:q.action,finishing:!1,resolve(S){if(F===T)F=void 0;clearTimeout(P),A(S)},reject(S){if(F===T)F=void 0;clearTimeout(P),R(S)}};F=T,Z.stdin.write(`${JSON.stringify(q)}
-`,(S)=>{if(!S)return;B(T,void 0,S)})});try{if(!G){if(Z.pid===void 0)await S9(X);throw J??Error("hands_node_repl_control_pipe_missing")}let q=await W({action:"probe"});if(q.ok!==!0||q.output!=="ARA_HANDS_REPL_READY")throw Error("hands_node_repl_probe_failed")}catch(q){Y=!0,Z.kill("SIGKILL");try{await S9(X)}finally{await Q.cleanup()}throw q}let U=Promise.resolve(),j=new Set;G$($.socketPath);let O=e7.createServer((q)=>{j.add(q),q.once("close",()=>j.delete(q)),q.setEncoding("utf8");let A="",R=!1,P=!1;q.once("close",()=>{if(P)H()}),q.on("error",()=>q.destroy()),q.on("data",(T)=>{if(R)return;if(A+=T,A.length>iZ){R=!0,V8(q,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let S=A.indexOf(`
-`);if(S===-1)return;R=!0;let m=A.slice(0,S);U=U.then(async()=>{if(q.destroyed)return;try{let E=JSON.parse(m);if(E.action!=="evaluate"||typeof E.code!=="string")throw Error("Invalid REPL request");P=!0;let N=await W({action:"evaluate",code:E.code});if(P=!1,N.ok!==!0||typeof N.output!=="string")throw Error(typeof N.error==="string"?N.error:"hands_node_repl_failed");V8(q,{ok:!0,output:N.output})}catch(E){P=!1,V8(q,{ok:!1,error:E instanceof Error?E.message:String(E),stack:E instanceof Error?E.stack:void 0})}}).catch((E)=>{V8(q,{ok:!1,error:E instanceof Error?E.message:String(E)})})})});try{await new Promise((q,A)=>{O.once("error",A),O.listen($.socketPath,()=>{O.off("error",A);try{n7($.socketPath,384),q()}catch(R){O.close(()=>A(R))}})})}catch(q){Y=!0,Z.kill("SIGKILL");try{await S9(X)}finally{await Q.cleanup(),G$($.socketPath)}throw q}return{socketPath:$.socketPath,async stop(){if(Y)return;Y=!0;let q=new Promise((A)=>O.close(()=>A()));for(let A of j)A.destroy();await q,U.catch(()=>{return}),H();try{await S9(X)}finally{await Q.cleanup(),G$($.socketPath)}}}}var V$=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var oZ="/workspace",rZ="/var/lib/reason/sessions",z6="/var/lib/reason/session-controls";function tZ($){let Q=`${rZ}/`;if(!$.startsWith(Q))return null;let Z=$.slice(Q.length);if(!V$.test(Z)||Z!==Z.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${z6}/${Z}/job.env`}function K6($){if(!V$.test($))throw Error("personal_computer_invalid_identity");return $.toLowerCase()}function H8($){let Q=K6($);return{runtimeRoot:`${rZ}/${Q}`,workspaceRoot:`${oZ}/sessions/${Q}`,sharedRoot:oZ}}var eZ="/root/.ara/cloud-browser/repl.sock";function F$($){return $==="compute"}function $4($,Q,Z="linux"){if($)H8($);if(Z!=="linux")throw Error("cloud_browser_os_invalid");if(Q!==void 0&&(!$||!/^[1-9][0-9]{0,18}$/.test(Q)))throw Error("cloud_browser_generation_invalid");let X=$?`/var/lib/reason/browsers/${$.toLowerCase()}`:"/root/.ara/cloud-browser",J=$?`${X}/${Q?`g${Q}`:"current"}`:X,Y=$?`/root/.b/${$.toLowerCase().replaceAll("-","")}`:X;return{temporarySessionDirectory:Y,temporaryDirectory:$?`${Y}/${Q??"current"}`:`${J}/tmp`,directory:J,sessionDirectory:X,config:`${J}/config.json`,status:`${J}/status.json`,socket:`${J}/repl.sock`,bundle:`${J}/driver.mjs`,processName:$?`ara-browser-${$.toLowerCase()}${Q?`-${Q}`:""}`:"ara-cloud-browser"}}var U$="browser_egress",Q4=NQ,T6=45000,O6=u9+1500,g0=/^[A-Za-z0-9._:-]{1,160}$/,D6="/run/ara-hands";function _6($,Q,Z=V4()){if($==="darwin")return{temporaryRoot:Z,prepareRoot:!1,sessionMode:448};return{temporaryRoot:Q??D6,prepareRoot:!0,sessionMode:457}}function Z4($,Q=process.platform,Z=process.geteuid?.()){return $===!0&&Q==="linux"&&Z===0}function L$($=Y4(),Q=process.platform,Z=process.geteuid?.()){return $&&Q==="linux"&&Z===0?{uid:$.uid,gid:$.gid,home:$.home,username:$.username}:null}function A6($=L$(),Q=PZ){return $&&Q()?t8:null}function yY($=L$(),Q=process.platform,Z=process.geteuid?.()){return Q!=="linux"||Z!==0||$!==null}function hY($=process.platform,Q=process.geteuid?.()){return $!=="linux"||Q!==0}function x6($,Q){if(!Q&&($??"linux")==="linux")return eZ;return $4(Q,void 0,$??"linux").socket}function P6($){return $[N0]===!0?"sandbox_loopback":"ara_device_wss"}function W9($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function H4($){let Q=$.toLowerCase().replace(/^\[|\]$/g,"");return Q==="localhost"||Q.endsWith(".localhost")||Q==="::1"||Q==="0:0:0:0:0:0:0:1"||Q==="0.0.0.0"||Q.startsWith("127.")}class U4 extends C{expiryDiagnostic;constructor($){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=$}}function I6($){return W9($)&&Object.keys($).every((Q)=>Q==="source_path"||Q==="branch")&&($.source_path===void 0||s0($.source_path))&&typeof $.branch==="string"&&Q$.test($.branch)}function R6($,Q,Z){let X=Q===void 0?Date.now():Q,J=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],Y=new Set([...J,"workspace_id","legacy_workspace_id",i0,a0,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",p,N0,U$,F9,q0,o0,m0]),K=W9($)?$:null,V=K?.[U$],G=K?.[F9],F=K?.[o0],B=V===void 0||(K?.[p]===f0||F===w9&&K?.[p]===void 0)&&W9(V)&&Object.keys(V).every((q)=>q==="mode"||q==="allowed_domains")&&V.mode==="enforce"&&Array.isArray(V.allowed_domains)&&V.allowed_domains.length<=256&&V.allowed_domains.every((q)=>typeof q==="string"&&d8(q));if(!W9($)||J.some((q)=>!(q in $))||Object.keys($).some((q)=>!Y.has(q))||!B||F!==void 0&&F!==w9||K?.[m0]!==void 0&&K[m0]!==B8||K?.personal_workspace!==void 0&&(K.personal_workspace!==!0||K[p]!==f0)||K?.cloud_browser!==void 0&&(K.cloud_browser!==!0||K[p]!==f0)||K?.sandbox_provider!==void 0&&!F$(K.sandbox_provider)||K?.sandbox_os!==void 0&&K.sandbox_os!=="linux"||G!==void 0&&(K?.[p]!==V9||!e8(G))||p in $&&$[p]!==f0&&$[p]!==V9&&$[p]!==L0||N0 in $&&$[N0]!==!0||$.workspace_path!==void 0&&(!s0($.workspace_path)||$[p]!==L0)||$.workspace_worktree!==void 0&&($.workspace_path===void 0||!I6($.workspace_worktree))||typeof $.relay_url!=="string"||typeof $.session_id!=="string"||!g0.test($.session_id)||$.workspace_id!==void 0&&(typeof $.workspace_id!=="string"||!g0.test($.workspace_id))||$.legacy_workspace_id!==void 0&&(typeof $.legacy_workspace_id!=="string"||!g0.test($.legacy_workspace_id))||$[i0]!==void 0&&($[i0]!==L8||(p in $))||$[a0]!==void 0&&($[a0]!==N8||(p in $))||$[q0]!==void 0&&(typeof $[q0]!=="string"||!g0.test($[q0]))||typeof $.environment_id!=="string"||!g0.test($.environment_id)||typeof $.expires_at!=="string"||$.policy_mode!=="full_access"||$.policy_version!==1||$.hands_protocol_version!==B9||$.hands_worker_version!==L9||$.hands_worker_artifact_sha256!==K0||!dZ($.hands_worker_entrypoint)||!S0($.target_generation)||!O0($.target_fence_id))throw new C("invalid_hands_payload","Reason Hands connection payload is invalid.");let H;try{H=new URL($.relay_url)}catch{throw new C("invalid_hands_relay","Reason Hands relay URL is invalid.")}let z=$[N0]===!0,L=H4(H.hostname);if((z?H.protocol!=="ws:"||!L:L?H.protocol!=="ws:":H.protocol!=="wss:")||H.username||H.password||H.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(H.pathname))throw new C("invalid_hands_relay","Reason Hands relay URL is not allowed.");let W=Date.parse($.expires_at),U=Number.isNaN(W)?"parse":new Date(W).toISOString()!==$.expires_at?"noncanonical":W<=X?"expired":W-X>Q4?"over_cap":"accepted",j={version:1,outcome:U,clock_source:Q===void 0?"date_now":"injected",validation_now_ms:Z9(X),expiry_ms:Z9(W),remaining_ms:Number.isSafeInteger(W-X)?W-X:null,maximum_lifetime_ms:Q4,cli_artifact:pZ()};if(U!=="accepted")throw new U4(j);try{Z?.(j)}catch{}let O=$.environment_binding===void 0?void 0:k8.safeParse($.environment_binding);if(O&&!O.success)throw new C("invalid_hands_request","Reason Hands environment binding is invalid.");return{...$.cloud_browser===!0?{cloud_browser:!0}:{},...F$($.sandbox_provider)?{sandbox_provider:$.sandbox_provider}:{},...$.sandbox_os==="linux"?{sandbox_os:$.sandbox_os}:{},...$.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:H.toString(),...O?.success?{environment_binding:O.data}:{},session_id:$.session_id,...$.workspace_id===void 0?{}:{workspace_id:$.workspace_id},...$.legacy_workspace_id===void 0?{}:{legacy_workspace_id:$.legacy_workspace_id},...$[i0]===L8?{[i0]:L8}:{},...$[a0]===N8?{[a0]:N8}:{},...typeof $[q0]==="string"?{[q0]:$[q0]}:{},...$[o0]===w9?{[o0]:w9}:{},...$[m0]===B8?{[m0]:B8}:{},...typeof $.workspace_path==="string"?{workspace_path:$.workspace_path}:{},...W9($.workspace_worktree)?{workspace_worktree:{...typeof $.workspace_worktree.source_path==="string"?{source_path:$.workspace_worktree.source_path}:{},branch:String($.workspace_worktree.branch)}}:{},environment_id:$.environment_id,expires_at:$.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:B9,hands_worker_version:L9,hands_worker_artifact_sha256:K0,hands_worker_entrypoint:n0,target_generation:$.target_generation,target_fence_id:$.target_fence_id,...p in $?{[p]:$[p]}:{},...z?{[N0]:!0}:{},...G===void 0?{}:{[F9]:G},...V===void 0?{}:{[U$]:{mode:"enforce",allowed_domains:[...new Set(V.allowed_domains)].sort()}}}}function E6(){let $=new Map;return{acquire(Q,Z){if($.has(Q))return null;let X=[...$.values()],J=(K)=>Z.group!==void 0&&K.group===Z.group;if(Z.exclusive?!X.every(J):X.some((K)=>K.exclusive))return null;if(Z.limit!==void 0&&!X.some(J)&&new Set(X.map((K,V)=>K.group??V)).size>=Z.limit)return null;$.set(Q,Z);let Y=!1;return()=>{if(Y)return;Y=!0,$.delete(Q)}},activeOwners:()=>[...$.keys()]}}var S6=E6();function w6($,Q){N9($,{recursive:!0,mode:448});let Z=n($),X=()=>new C("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let K of Q.split("/")){let V=a(Z,K);try{let F=t(V);if(F.isSymbolicLink()||!F.isDirectory())throw X()}catch(F){if(!(F&&typeof F==="object"&&("code"in F)&&F.code==="ENOENT"))throw F;try{N9(V,{mode:448})}catch(B){if(!(B&&typeof B==="object"&&("code"in B)&&B.code==="EEXIST"))throw B}}let G=t(V);if(G.isSymbolicLink()||!G.isDirectory()||n(V)!==V)throw X();Z=V}let J=t(Z),Y=L6(Z,H$.O_RDONLY|H$.O_DIRECTORY|H$.O_NOFOLLOW);try{let K=B6(Y);if(!K.isDirectory()||K.dev!==J.dev||K.ino!==J.ino||n(Z)!==Z)throw X();W6(Y,448)}finally{U6(Y)}return Z}function b6($,Q=J4(),Z,X,J){if(!g0.test($)||Z!==void 0&&!g0.test(Z))throw new C("invalid_hands_workspace","Reason Hands run identity is invalid.");let Y=V0(p0({kind:"managed",workspaceId:$,...X?{base:X}:{},...J?{layout:J}:{}})),K=w6(Q,V0(Y)),V=a(K,q6(Y)),G=!1;try{let z=t(V);if(G=!0,z.isSymbolicLink())throw new C("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!z.isDirectory())throw new C("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(z){if(z instanceof C||!(z&&typeof z==="object"&&("code"in z)&&z.code==="ENOENT"))throw z}if(J&&!G)try{let z=a(n(Q),V0(p0({kind:"managed",workspaceId:$,...X?{base:X}:{}}))),L=t(z);if(!L.isSymbolicLink()&&L.isDirectory()&&n(z)===z)U8(z,V),G=!0}catch{}if(Z&&Z!==$){let z=a(K,Z);try{let L=t(z);if(L.isSymbolicLink()||!L.isDirectory())throw new C("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let W=n(z);if(V0(W)!==K)throw new C("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let U=null;if(G){U=a(K,`.${$}.previous`);try{throw t(U),new C("invalid_hands_workspace","Reason Hands previous workspace backup already exists.")}catch(j){if(j instanceof C||!(j&&typeof j==="object"&&("code"in j)&&j.code==="ENOENT"))throw j}U8(V,U)}try{U8(W,V)}catch(j){if(U)U8(U,V);throw j}G=!0}catch(L){if(L instanceof C||!(L&&typeof L==="object"&&("code"in L)&&L.code==="ENOENT"))throw L}}N9(V,{recursive:!0,mode:448}),b9(V,448);let F=n(V);if(V0(F)!==K)throw new C("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let B=a(F,"repo");try{let z=t(B);if(z.isSymbolicLink()||!z.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(z){if(z instanceof C||!(z&&typeof z==="object"&&("code"in z)&&z.code==="ENOENT"))throw z}N9(B,{recursive:!0,mode:448}),b9(B,448);let H=n(B);if(V0(H)!==F)throw new C("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:F,repoPath:H}}function W4($){let Q=null;try{Q=t($)}catch{}if(!Q||Q.isSymbolicLink()||!Q.isDirectory()||Q.uid!==0||Q.gid!==0||(Q.mode&4095)!==493)throw new C("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function k6($,Q){let Z="/";for(let X of["",...$.split("/"),...Q.split("/")].filter((J,Y)=>Y===0||J)){if(X)Z=a(Z,X);let J;try{J=t(Z)}catch{return null}if(J.uid!==0)return J.uid;if((J.mode&2)!==0&&(J.mode&512)===0&&!J.isSymbolicLink())return-1;if(J.isSymbolicLink()||!J.isDirectory())return null}return null}function f6($,Q,Z,X=process.geteuid?.(),J){if(!g0.test(Q))return null;let Y,K;try{Y=n($),K=V0(p0({kind:"managed",workspaceId:Q,...Z?{base:Z}:{},...J?{layout:J}:{}}))}catch{return null}let V=a(Y,K),G=B$(V)!==null,F=(W)=>new C("cloud_workspace_root_invalid",W),B;if(X===0){let W=k6(Y,K);if(W===null)return null;if(!G)throw new C("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");B=W}else{if(!G)return null;let W,U;try{W=t(V0(V)),U=t(V)}catch{return null}if(W.isSymbolicLink()||!W.isDirectory()||W.uid===0||U.uid!==0)return null;B=W.uid}let H=Y;for(let W of K.split("/")){let U=a(H,W),j=!1;try{let O=t(U);j=!O.isSymbolicLink()&&O.isDirectory()&&n(U)===U}catch{}if(!j)throw F("This cloud Session's workspace root is missing or is not a real directory.");H=U}W4(V);let z;try{z=B4(V)}catch(W){if(W instanceof C)throw W;throw F("This cloud Session's workspace root changed while Reason Hands checked it.")}let L=null;try{L=k9(z.repoPath).uid}catch{}if(L!==B)throw new C("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return z}function B4($,Q=!1){let Z=n($),X=a(Z,"repo"),J;try{J=t(X)}catch{throw new C("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(Q){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(Z))throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");if(H8(Z.slice(Z.lastIndexOf("/")+1)).runtimeRoot!==Z)throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");let V=n("/workspace"),G=n(X);if(V!=="/workspace"||!k9(G).isDirectory()||!G.startsWith("/workspace/"))throw new C("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:Z,repoPath:G}}let Y=IZ(Z);if(Y&&J.isSymbolicLink()){let V=n(X);if(V!==n(Y)||!k9(V).isDirectory())throw new C("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:Z,repoPath:V}}if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let K=n(X);if(V0(K)!==Z)throw new C("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:Z,repoPath:K}}function N$($,Q,Z){if(Q!==void 0&&!s0(Q))throw new C("invalid_hands_workspace",`Reason Hands ${Z} is invalid.`);let X=F4($,Q??".");if(!w0($,X))throw new C("invalid_hands_workspace",`Reason Hands ${Z} escapes its granted root.`);return X}function L4($,Q,Z){if($$(Q)){let X=n(Z);return{anchor:X,target:F4(X,Q),boundary:a(X,H9)}}return{anchor:$,target:N$($,Q,"folder"),boundary:$}}function m6($,Q){if(!w0($,Q))throw new C("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let Z=$;for(let X of Q.slice($.length).split("/").filter(Boolean)){Z=a(Z,X);let J=null;try{J=t(Z)}catch(Y){if(Y.code!=="ENOENT")throw Y}if(!J)N9(Z,{mode:448});else if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function N4($,Q){let Z=n(N$($,Q.source_path,"repository"));if(!w0($,Z)||!k9(Z).isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return Z}async function g6($,Q,Z,X=M8()){try{let J=n($);if(W$(L4(J,Q,X).target))return;return await kZ(N4(J,Z))??void 0}catch{return}}function y6($,Q,Z,X,J=h6,Y=M8()){let K=n($),{target:V,boundary:G,anchor:F}=L4(K,Q,Y);if(Z&&!W$(V)){let z=N4(K,Z);m6(F,V0(V));let L=["-c","core.hooksPath=/dev/null","-C",z];if(X)J([...L,"update-ref","--create-reflog","-m",X.note,`refs/heads/${Z.branch}`,X.commit,""]);let W=X?J([...L,"worktree","add",V,Z.branch]):J([...L,"worktree","add","-b",Z.branch,V]);if(!X&&W.status!==0&&/already exists/.test(W.stderr)&&!W$(V))W=J([...L,"worktree","add",V,Z.branch]);if(W.status!==0)throw new C(/not a git repository/i.test(W.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let B;try{B=t(V)}catch{throw new C("workspace_folder_missing","This Session's folder no longer exists.")}let H=n(V);if(B.isSymbolicLink()&&!w0(G,H))throw new C("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!k9(H).isDirectory()||!w0(G,H))throw new C("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(b0(H))throw new C("protected_path","Credential and secret folders are unavailable to Sessions.");return H}function h6($){let Q=H6("git",$,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:Q.status,stderr:Q.stderr??""}}function M4($){return tZ($)??B$($)?.jobEnv??a($,"job.env")}function v6($,Q){let Z=M4($),X=t(Z);if(X.isSymbolicLink()||!X.isFile())throw new C("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");N6(Z,Q),b9(Q,384)}function c6($){if($.workspaceMode===L0&&$.workspacePath!==void 0){let K=$.home??M8(),V=y6($.grantedRoot,$.workspacePath,$.workspaceWorktree,$.workspaceWorktreeStart,void 0,K);if($.workspaceWorktree&&$.deviceId)yZ(K,$.workspacePath,$.deviceId);return{workRoot:V,repoPath:V,workspace:{kind:"root",path:$.workspacePath},jobEnvPath:a($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if($.workspaceMode===f0)return{...B4($.grantedRoot,$.personalWorkspace),workspace:{kind:"root"},jobEnvPath:a($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if($.workspaceMode===V9||$.workspaceMode===L0){let K=t($.grantedRoot);if(K.isSymbolicLink()||!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands root must be a real directory.");let V=n($.grantedRoot);return{workRoot:V,repoPath:V,workspace:{kind:"root"},jobEnvPath:a($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let Q=$.workspaceId??$.runId,Z={kind:"managed",workspaceId:Q,...$.workspaceBase?{base:$.workspaceBase}:{},...$.workspaceLayout?{layout:$.workspaceLayout}:{}},X=s9($.grantedRoot,Z,$.home).anchor,J=f6(X,Q,$.workspaceBase,void 0,$.workspaceLayout);if(J)return{...J,workspace:Z,jobEnvPath:a($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let Y=b6(Q,X,$.legacyWorkspaceId,$.workspaceBase,$.workspaceLayout);return{...Y,workspace:Z,jobEnvPath:a($.temporaryDirectory,"job.env"),workspacePoolPath:V0(Y.workRoot),managedWorkspace:!0}}function d6($){let{command:Q,prefix:Z}=f8($.executablePath,$.sourceEntrypoint),X=F8({home:C6(),temporaryDirectory:$.temporaryDirectory,path:$.path});if(X.REASON_DEVICE_ROOT=X.ARA_DEVICE_ROOT=$.grantedRoot,X.REASON_HANDS_WORKSPACE=X.ARA_HANDS_WORKSPACE=$.workRoot,X.REASON_HANDS_REPO=X.ARA_HANDS_REPO=$.root,$.workspacePoolPath)X.REASON_HANDS_WORKSPACE_POOL=X.ARA_HANDS_WORKSPACE_POOL=$.workspacePoolPath;return{command:Q,args:[...Z,"__device","__hands-worker","--config",$.configPath],options:{cwd:$.root,env:X,shell:!1,stdio:["ignore","ignore","pipe"]}}}function p6($,Q){let Z="",X=!1,J=Date.now(),Y=0,K=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped","request_cancelled","permission_denied"].map((H)=>`hands.worker.${H}`)),V=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed","cancelled","settled","unsupported","unconfirmed",...["sandbox_policy","os_permission_unknown"].flatMap((H)=>["bash","read","write","edit"].map((z)=>`${H}:${z}`))]),G=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],F=["peerGeneration","socketState","closeCode"],B=new Set(["event","reason","launchId",...G,...F]);return(H)=>{for(let z of H.toString().split(/(?<=\n)/)){let L=z.endsWith(`
-`);if(!X&&Z.length+z.length<=2048)Z+=z;else X=!0;if(!L)continue;let W=Z;if(Z="",X){X=!1;continue}try{let U=JSON.parse(W);if(!U||typeof U!=="object"||Array.isArray(U)||Object.keys(U).some((j)=>!B.has(j))||!K.has(U.event)||!V.has(U.reason)||U.event==="hands.worker.permission_denied"!==(typeof U.reason==="string"&&U.reason.includes(":"))||U.launchId!==$||G.some((j)=>!Number.isSafeInteger(U[j])||U[j]<0)||F.some((j)=>U[j]!==null&&(!Number.isSafeInteger(U[j])||U[j]<0)))continue;if(Date.now()-J>=60000)J=Date.now(),Y=0;if(Y>=122)continue;Y+=1,Q(U)}catch{}}}}async function u6($){let Q=$.now()+$.timeoutMs;while($.now()<Q){if($.signal.aborted)throw new C("cancelled","Reason Hands start was cancelled.");if($.spawnFailed?.()||$.child.exitCode!==null||$.child.signalCode!==null)throw new C("hands_worker_exited","Reason Hands exited before ready.");let Z=K8($.path,{pid:$.child.pid??-1,launchId:$.launchId,workerVersion:L9,protocolVersion:B9,workerArtifactSha256:K0,workerEntrypoint:n0});if(Z?.targetGeneration===$.targetGeneration&&Z.fenceId===$.fenceId)return Z;await new Promise((X)=>setTimeout(X,10))}throw new C("hands_ready_timeout","Reason Hands did not become ready.")}async function l6($,Q){let Z=()=>$.exitCode===0&&$.signalCode===null;if($.exitCode!==null||$.signalCode!==null)return Z()?"stopped":"already_exited";let X=new Promise((K)=>$.once("exit",()=>K()));try{if(!$.kill("SIGTERM"))return Z()?"stopped":"unobserved"}catch{return Z()?"stopped":"unobserved"}if(await X4(X,Q))return Z()?"stopped":"unobserved";try{$.kill("SIGKILL")}catch{}return await X4(X,Q)?"forced":"unobserved"}async function X4($,Q){let Z;try{return await Promise.race([$.then(()=>!0),new Promise((X)=>{Z=setTimeout(()=>X(!1),Q)})])}finally{clearTimeout(Z)}}function s6($){return new Promise((Q)=>{let Z=!1,X=(V)=>{if(Z)return;Z=!0,clearTimeout(K),$.signal.removeEventListener("abort",J),$.child.off("exit",Y),Q(V)},J=()=>X("cancelled"),Y=()=>X("exited"),K=setTimeout(()=>X("expired"),Math.max(0,$.expiresAt-$.now()));if($.signal.addEventListener("abort",J,{once:!0}),$.child.once("exit",Y),$.signal.aborted)J();else if($.child.exitCode!==null||$.child.signalCode!==null)Y()})}var j4=K4();function n6($,Q){if(!($ instanceof Error)||$ instanceof C)return!1;let Z=["hands_browser_driver_missing","hands_browser_driver_version_mismatch","hands_browser_executable_missing","hands_browser_unsupported_platform","hands_browser_unavailable"].includes($.message),X=["ENOENT","EACCES","EPERM"].includes($.code??"");if(!Z&&!X)return!1;try{return t(Q),!1}catch(J){return W9(J)&&J.code==="ENOENT"}}function i6($){return $.sandbox_provider==="compute"&&!$.cloud_browser&&!$[N0]&&$[p]===f0}function a6($,Q,Z){return $===void 0?{}:{dispatch_stages:{version:1,claim_to_entered_ms:H0($,Q),...Z===void 0?{}:{worker_prespawned:Z}}}}function vY(){j4().catch(()=>{return}),G9().catch(()=>{return})}async function cY($,Q={}){let Z=Q.logDiagnostic??((N)=>console.warn(N)),X=new Map,J=(N)=>{let M=Date.now();X.set(N,M);try{Z(JSON.stringify({event:"sandbox.hands_startup",stage:N,timestampMs:M}))}catch{}};J("entered");let Y=$.claimEnvironment;$.claimEnvironment=void 0;let K=Q.now??Date.now,V,G=R6($.payload,Q.now?.(),(N)=>{V=N});if($.managedPty&&($.managedPty.version!==1||!$.headless||!$.runtimeDirectory||![void 0,!0].includes($.managedPty.startupVerified)||!$.deviceIdentity||!$.claimOwner||$.claimOwner.device_id!==$.deviceIdentity.deviceId||!G.environment_binding||!["darwin","linux"].includes(process.platform)))throw new C("pty_unsupported","Bound PTY requires qualified headless Hands with private jobs and environment.");let F=async(N)=>{let M;try{await Promise.race([N,new Promise((D,w)=>{M=setTimeout(()=>w(new C("hands_event_delivery_unavailable","Hands event delivery did not settle within its deadline.")),Math.max(1,Math.min(Q.eventDeliveryTimeoutMs??5000,5000)))})])}finally{clearTimeout(M)}},B=async(N,M)=>F($.emitEvent(N,M));if($.headless&&(G.cloud_browser===!0||$.managedBrowser!==void 0||G[N0]!==void 0||G[F9]!==void 0||G[p]!==void 0&&G[p]!==L0))throw new C("invalid_hands_request","Managed sandbox extensions are unavailable to a headless worker.");let H=L$(),z=G[m0]===void 0?null:A6(H);if(G[m0]!==void 0&&(z===null||!$.headless||!Z4($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_model_jobs_egress_unavailable","This worker cannot hold its jobs to the guest egress guard; the Hands did not start.");if(G[o0]!==void 0&&!($.headless&&Z4($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_confinement_unavailable","Confined Hands need a root Linux worker in host mode.");if(G.cloud_browser&&process.platform!=="linux")throw new C("cloud_browser_target_invalid","Cloud browser is available only on a cloud machine.");let L=`${$.operationId}:${$.attemptId}`,W=G[p]===V9,U=$.headless||process.platform==="darwin"&&$.managedBrowser===void 0&&!G.cloud_browser&&!G.browser_egress&&!G[N0]&&(G[p]===void 0||G[p]===L0)||i6(G),j=W?G[F9]??"bash":null,O=j?SZ(j):null;if(O)throw new C(O,"Persistent Node REPL execution is unavailable; this benchmark profile cannot start.");let q=G[p],A=$.headless===!0&&$.ownComputer!==!0?$.handsSlots??1:void 0,R=(Q.slot??S6).acquire(L,{exclusive:A===1||q!==void 0&&q!==L0,...A!==void 0&&A>1?{limit:A}:{},...$.headless===!0&&G[q0]!==void 0?{group:G[q0]}:{}});if(!R)throw new C("hands_slot_busy",A!==void 0&&A>1?`This Reason worker runs at most ${A} sessions at a time.`:"This Reason Device runs one session at a time.");let P=$.headless===!0?G4($.runId):null,T=null,S=null,m,E;try{J("browser_resolution");let N=$.headless&&Q.browserExecutablePath===void 0?await G9():null,M=W||G.cloud_browser?null:Q.browserExecutablePath===void 0?$.headless?N?.status==="resolved"?N.executablePath:null:await _Z(void 0,process.platform,$.managedBrowser):Q.browserExecutablePath;if(!W&&!G.cloud_browser&&!U&&!M)throw new C("hands_browser_unavailable","Reason Hands requires Chrome, Edge, Brave, Chromium, or a Playwright Chromium install.");J("path_resolution");let D;try{D=await(Q.resolvePathEnvironment??j4)()}catch{D={path:z4(),source:"fallback"}}if(J("workspace_setup"),process.platform==="darwin"){let s=G[p]===L0&&G.workspace_path!==void 0?N$($.root,G.workspace_worktree?G.workspace_worktree.source_path:G.workspace_path,"folder"):null;for(let Z0 of new Set([$.root,...s?[s]:[]]))await sQ(Z0)}let k=G[p]===f0||G[p]===V9?_6(process.platform,Q.sandboxRuntimeRoot):null,f=$.headless&&$.runtimeDirectory?$.runtimeDirectory:k?k.temporaryRoot:V4();if(T="private_runtime",$.headless&&$.runtimeDirectory){_9(f);let s=n($.root);if(!P9(s,f))throw new C("invalid_hands_workspace","Private worker state must not overlap the granted workspace.")}if($.headless&&$.runtimeDirectory&&(!$.deviceIdentity||!G.environment_binding))throw new C("environment_unavailable","Headless Hands requires a server-bound private environment.");if(T="runtime_root",k?.prepareRoot)N9(f,{recursive:!0,mode:457}),b9(f,457);T="temporary_directory";let _=n(M6(a(f,"reason-hands-session-")));S=_,b9(_,k?.sessionMode??448);let g=a(_,"hands-config.json"),c=a(_,"hands-ready.json"),u=V6(),o=G.target_fence_id;T="granted_root";let b=n($.root);T="workspace_layout";let h=G[p]===L0&&G.workspace_path!==void 0&&G.workspace_worktree?await g6(b,G.workspace_path,G.workspace_worktree):void 0,{workRoot:d,repoPath:l,jobEnvPath:G0,workspacePoolPath:M0,managedWorkspace:U0,workspace:W0,cloudSessionRoot:y0}=c6({grantedRoot:b,personalWorkspace:G.personal_workspace===!0,runId:$.runId,workspaceId:G.workspace_id,legacyWorkspaceId:G.legacy_workspace_id,workspaceBase:G[i0],workspaceLayout:G[a0],temporaryDirectory:_,workspaceMode:G[p],applicationSupportPath:Q.applicationSupportPath,...G.workspace_path===void 0?{}:{workspacePath:G.workspace_path},...G.workspace_worktree?{workspaceWorktree:G.workspace_worktree}:{},...h?{workspaceWorktreeStart:h}:{},...$.deviceIdentity?{deviceId:$.deviceIdentity.deviceId}:{}}),T0=P6(G);T="jobs";let r=$.headless&&$.runtimeDirectory?VQ({runtimeDirectory:$.runtimeDirectory,root:b,runId:$.runId}):void 0;m=r?.disposeSocket;let j0=r?FQ(r):null;if(j0)try{Z(JSON.stringify({event:"hands.journal_owner_retired",run_id:$.runId,reason:j0.reason,prior_executor_launch_id:j0.executorLaunchId}))}catch{}if(r&&[d,l].some((s)=>!P9(s,r.journalDirectory)))throw new C("invalid_hands_workspace","A Session can't work in the folder that holds this worker's settings; start it in a project or repository inside it.");let r0=G.personal_workspace?d.slice(d.lastIndexOf("/")+1):void 0;if(r0&&r0!==G.workspace_id)throw new C("invalid_hands_workspace","Personal session identity does not match its Device grant.");T="browser_socket";let B0=G.cloud_browser?x6(G.sandbox_os,r0):a(r?V0(r.socketPath):_,"repl.sock");T="relay_url";let C0=H4(new URL(G.relay_url).hostname),h0=T0==="ara_device_wss"&&!C0?(Q.loadProxy??m8)()?.url:void 0,Y0;T="environment_owner";let X0=$.headless&&$.deviceIdentity&&G.environment_binding?vZ(_,{runId:$.runId,...$.deviceIdentity,binding:G.environment_binding,expiresAtMs:Date.parse(G.expires_at),identity:()=>Y0?.()??null}):void 0;T="job_environment";let M9=!X0&&W0.kind==="managed"&&U0?a(d,"job.env"):null;if(M9)try{W8(M9,"",{mode:384,flag:"wx"})}catch(s){if(!(s instanceof Error&&("code"in s)&&s.code==="EEXIST"))throw s}let j8={url:G.relay_url,transport:T0,...h0===void 0?{}:{proxyUrl:h0},...$.localGithubConfinement?{localGithubConfinement:!0}:{},...G[o0]&&X0?{gitCredentialEnvironment:!0}:{},workerVersion:L9,protocolVersion:B9,workerArtifactSha256:K0,workerEntrypoint:n0,targetGeneration:G.target_generation,fenceId:o,workRoot:d,workspaceAliasPath:d,jobEnvPath:G0,...X0?{environmentSnapshotPath:X0.path,...$.hostExecution?{executionEnvironment:mQ()}:{},environmentExpectedBinding:{runId:$.runId,...$.deviceIdentity,binding:G.environment_binding}}:M9?{jobEnvSourcePath:M9,workspacePoolPath:V0(d)}:U0?{}:{jobEnvSourcePath:M4(d)},repoPath:l,replSocketPath:B0,...G.cloud_browser?{browserRunId:$.runId}:{},readyPath:c,launchId:u,expiresAtMs:Date.parse(G.expires_at),bashTimeoutMs:300000,replTimeoutMs:120000,...r?{managedJobs:{journalDirectory:r.journalDirectory,scopeId:r.scopeId},jobControlSocketPath:r.socketPath}:{},...r&&H?{jobsUser:{...H,...z!==null?{modelGid:z}:{}}}:{},...$.managedPty&&r&&X0?{managedPty:{version:1,...$.managedPty.startupVerified===!0?{persistent:!0}:{},...process.platform==="darwin"?{shell:gQ()}:{}}}:{},...U&&!M?{allowedTools:["bash","read","write","edit"]}:W?{allowedTools:j==="bash"?["bash"]:["bash","repl"]}:{}};if(X0||U0&&!M9)W8(G0,"",{mode:384});else v6(d,G0);T="config_write",W8(g,JSON.stringify(j8),{mode:384}),T=null;let v0={session_id:G.session_id,environment_id:G.environment_id,hands_protocol_version:B9,hands_worker_version:L9,hands_worker_artifact_sha256:K0,hands_worker_entrypoint:n0,target_generation:G.target_generation,target_fence_id:G.target_fence_id,executor_launch_id:u},f9=null,M$=!1,j$=!1,C$,Q0=null,q$,T$,m9="failed",O$=null,C8=Promise.resolve(),D$=null,q8=async(s,Z0)=>{try{await B(s,Z0)}catch{}};try{J("event_started");let s,Z0=(async()=>{await $.emitEvent("hands.started",{...v0,policy_mode:"full_access",policy_version:1,path_source:D.source}),s=Date.now()})();Z0.catch(()=>{return}),J("worker_setup");let g9=G.browser_egress?{mode:"enforce",allowedDomains:G.browser_egress.allowed_domains}:{mode:"off"};if(j&&j!=="bash")f9=await(Q.startNodeRepl??aZ)({socketPath:B0,workRoot:d});else if(!W&&!G.cloud_browser&&M)f9=await(Q.startRepl??AZ)({socketPath:B0,browserExecutablePath:M,workspaceRoot:l,...$.managedBrowser?{managedBrowser:$.managedBrowser}:{},...$.desktopRecording?{recording:$.desktopRecording}:{},networkPolicy:g9,onEgressDenied:(y)=>{let F0=RZ(y.host);Z(JSON.stringify({event:"sandbox.repl_egress_denied",destination_id:F0,reason:y.reason,run_id:$.runId})),C8=C8.then(()=>B("hands.browser_egress_denied",{destination_id:F0,reason:y.reason})).catch((h9)=>{D$??=h9})}}).catch((y)=>{if(!U||$.signal.aborted||K()>=Date.parse(G.expires_at)||!n6(y,B0))throw y;return Object.assign(j8,{allowedTools:["bash","read","write","edit"]}),W8(g,JSON.stringify(j8),{mode:384}),j$=!0,null});let _$=d6({configPath:g,root:l,grantedRoot:b,workRoot:d,workspacePoolPath:M0,temporaryDirectory:_,path:D.path,executablePath:Q.executablePath,sourceEntrypoint:Q.sourceEntrypoint}),T8=Date.now(),O8,A$,D8=Q.takePrespawnedWorker?.(_$)??null;if(C$=Q.takePrespawnedWorker?D8!==null:void 0,Q0=D8??(Q.spawnWorker??((y)=>F6(y.command,y.args,y.options)))(_$),!D8)Q.adoptSpawnedWorker?.(Q0);Q0.stderr?.on("data",p6(u,(y)=>{if(y.event==="hands.worker.connecting")O8??=y.timestampMs;else if(y.event==="hands.worker.open")A$??=y.timestampMs;if(Z(JSON.stringify({...y,run_id:$.runId})),y.event==="hands.worker.permission_denied"&&typeof y.reason==="string"){let[F0,h9]=y.reason.split(":");if(["sandbox_policy","os_permission_unknown"].includes(F0??"")&&["bash","read","write","edit"].includes(h9??""))B("permission.denied",{provenance:F0,operation:h9}).catch(()=>{return})}}));let x$=!1;Q0.on("error",()=>{x$=!0}),Q0.once("exit",(y,F0)=>{try{Z(JSON.stringify({event:"hands.worker.exited",run_id:$.runId,launchId:u,exit_code:y,exit_signal:F0}))}catch{}}),E=Q0,J("worker_ready_wait");let j9=await u6({path:c,launchId:u,fenceId:o,targetGeneration:G.target_generation,child:Q0,spawnFailed:()=>x$,signal:$.signal,timeoutMs:Q.readyTimeoutMs??T6,now:K}),C4=Date.now();if(Y0=()=>{if(!Q0||Q0.exitCode!==null||Q0.signalCode!==null)return null;let y=K8(c,j9);return y?{generation:y.targetGeneration,fenceId:y.fenceId}:null},r){let y={root:b,runId:$.runId,operationId:$.operationId,scopeId:r.scopeId,socketPath:r.socketPath,generation:j9.targetGeneration,fenceId:j9.fenceId,executorLaunchId:u,expiresAtMs:Date.parse(G.expires_at),readIdentity:Y0,workspace:W0,localGithubConfinement:$.localGithubConfinement===!0};if(X0)y.environment=X0;if($.claimOwner&&$.deviceIdentity&&$.claimOwner.device_id===$.deviceIdentity.deviceId){let F0=[$.deviceIdentity.apiOrigin,G.relay_url];if(h0)F0.push(h0);y.previewAuthority={owner:Object.freeze({...$.claimOwner}),rootId:$.deviceIdentity.rootId,relayOrigin:new URL(G.relay_url).origin,deniedPorts:d$(F0)}}T$=HQ(y)}if(await new Promise((y)=>{setImmediate(y)}),y0)W4(d);let y9;if(Y&&X0){try{let y=X0.install(Y);y9={snapshot_id:y.snapshot_id,installed_revision:y.installed_revision}}catch{}try{Z(JSON.stringify({event:"hands.environment_at_claim",run_id:$.runId,installed:y9!==void 0}))}catch{}}Y=void 0,J("event_ready");let P$=F(Z0);P$.catch(()=>{return});let I$=Date.now();M$=!0,await B("hands.ready",{...v0,expiry_diagnostic:V,startup_stages:{version:1,browser_resolution_ms:H0(X.get("browser_resolution"),X.get("path_resolution")),path_resolution_ms:H0(X.get("path_resolution"),X.get("workspace_setup")),workspace_setup_ms:H0(X.get("workspace_setup"),X.get("event_started")),repl_setup_ms:H0(X.get("worker_setup"),T8),worker_boot_ms:H0(T8,O8),worker_dial_ms:H0(O8,A$),worker_ready_ms:H0(T8,C4),started_event_ms:H0(X.get("event_started"),s),started_join_wait_ms:H0(X.get("event_ready"),I$),total_ms:H0(X.get("entered"),I$)},...a6($.claimedAtMs,X.get("entered"),C$),...$.managedPty?.startupVerified===!0?{managed_pty:{version:1,execution_mode:"host",descendant_cleanup_verified:!0}}:{},policy_mode:"full_access",policy_version:1,path_source:D.source,connection_generation:j9.generation,...y9?{environment_installed:y9}:{},...U&&!f9?{browser_state:"unavailable",browser_reason_code:j$?"setup_failed":"not_resolved"}:{viewport_width:1440,viewport_height:900}}),await P$,J("ready"),q$=sZ({path:c,initial:j9,signal:$.signal,isAlive:()=>Q0!==null&&Q0.exitCode===null&&Q0.signalCode===null&&K()<Date.parse(G.expires_at),publish:(y,F0)=>$.emitEvent("hands.reconnected",{...v0,target_generation:y.targetGeneration,target_fence_id:y.fenceId,connection_generation:y.generation},F0),failed:()=>Z(JSON.stringify({event:"hands.worker.generation_proof_failed",run_id:$.runId,executor_launch_id:u}))});let R$=await s6({child:Q0,signal:$.signal,expiresAt:Date.parse(G.expires_at),now:K});if(R$==="cancelled"){let y=$.signal.reason instanceof C?$.signal.reason.code:"cancelled";throw m9=y,new C(y,"Reason Hands was cancelled.")}if(R$==="exited")throw new C("hands_worker_exited","Reason Hands exited unexpectedly.");return m9="expired",{...v0,policy_mode:"full_access",policy_version:1,ended:"expired"}}catch(s){O$=s;let Z0=s instanceof C?s.code:"hands_failed",g9=Z0==="cancelled"||["run_finished","run_cancelled","driver_handoff","driver_stopped"].includes(Z0);if(m9=g9?Z0:"failed",!g9)await q8("hands.failed",{...v0,reason_code:Z0});throw s}finally{q$?.stop(),T$?.();let s=Q0?await l6(Q0,Q.stopTimeoutMs??O6):null,Z0=!1;await $.desktopRecording?.close();try{await f9?.stop()}catch{Z0=!0}if(await C8,(s==="stopped"||s==="already_exited"&&!M$)&&!Z0)await q8("hands.stopped",{...v0,reason_code:m9});else if(s!==null||Z0){if(await q8("hands.failed",{...v0,reason_code:s==="forced"?"hands_stop_forced":"hands_stop_unconfirmed"}),O$===null||Z0)throw new C("hands_stop_unconfirmed","Reason Hands resource cleanup could not be proven.")}if(D$!==null)throw new C("hands_egress_audit_failed","Reason Hands could not persist a browser egress denial receipt.")}}catch(N){let M=xZ(T,N);if(M)try{Z(JSON.stringify({event:"sandbox.hands_workspace_failed",...M}))}catch{}throw N}finally{try{if(!E||E.exitCode!==null||E.signalCode!==null)m?.();if(S!==null&&(!E||E.exitCode!==null||E.signalCode!==null))j6(S,{recursive:!0,force:!0})}finally{P?.(),R()}}}
-export{v as hb,k$ as ib,f$ as jb,b4 as kb,h$ as lb,c$ as mb,d$ as nb,D2 as ob,VQ as pb,y2 as qb,h2 as rb,v2 as sb,c2 as tb,d2 as ub,p2 as vb,WQ as wb,u2 as xb,s2 as yb,p as zb,L0 as Ab,yX as Bb,hX as Cb,QJ as Db,ZJ as Eb,TQ as Fb,i9 as Gb,_9 as Hb,A9 as Ib,EQ as Jb,vZ as Kb,Y5 as Lb,bQ as Mb,mQ as Nb,gQ as Ob,S5 as Pb,w5 as Qb,J0 as Rb,b5 as Sb,k5 as Tb,f5 as Ub,u5 as Vb,Z1 as Wb,l5 as Xb,P9 as Yb,w0 as Zb,s5 as _b,BX as $b,Y1 as ac,G1 as bc,YZ as cc,XX as dc,I9 as ec,o1 as fc,V$ as gc,tZ as hc,Z4 as ic,L$ as jc,A6 as kc,yY as lc,hY as mc,U4 as nc,E6 as oc,W4 as pc,B4 as qc,d6 as rc,vY as sc,cY as tc};
+`;function J6($=process.execPath,Q=process.versions.bun){return Q?"node":$}function z$($){try{r7($)}catch{}}function F8($,Q){$.end(`${JSON.stringify(Q)}
+`)}function K$($){return JSON.stringify($)}function Y6($){let Q=i7(nZ(Q6(),"reason-node-repl-")),Z=nZ(Q,"node-repl.sb"),J=["(version 1)","(deny default)",'(import "system.sb")',"(allow process*)","(deny network*)",`(allow file-read* ${["/System","/usr","/bin","/opt/homebrew","/usr/local"].map((K)=>`(subpath ${K$(K)})`).join(" ")})`,`(allow file-read* file-write* (subpath ${K$($.workRoot)}) (subpath ${K$(Q)}))`].join(`
+`);t7(Z,J,{mode:384});let Y=!1;return{command:"/usr/bin/sandbox-exec",args:["-f",Z,$.nodeExecutable,...$.nodeArgs],cwd:$.workRoot,env:{...$.environment,TMPDIR:Q},async cleanup(){if(Y)return;Y=!0,a7(Q,{recursive:!0,force:!0})}}}async function G6($){let Q=o7($.workRoot),Z=$.nodeExecutable??J6(),X=["--max-old-space-size=512","--permission",`--allow-fs-read=${Q}`,`--allow-fs-write=${Q}`,"-e",X6],J=H8({home:Q,temporaryDirectory:Q}),Y=$.platformName??$6();if(Y==="linux")return{command:Z,args:X,cwd:Q,env:J,async cleanup(){}};if(Y==="darwin")return Y6({nodeExecutable:Z,nodeArgs:X,workRoot:Q,environment:J});throw Error("hands_node_repl_platform_unsupported")}async function b9($){let Q;try{await Promise.race([$,new Promise((Z,X)=>{Q=setTimeout(()=>X(Error("hands_node_repl_child_cleanup_timeout")),Z6)})])}finally{clearTimeout(Q)}}async function oZ($){if($.executionMode!=="single-evaluation")throw Error(EZ);let Q=await G6($),Z;try{Z=s7(Q.command,Q.args,{cwd:Q.cwd,env:Q.env,stdio:["pipe","pipe","pipe"]})}catch(q){throw await Q.cleanup(),q}let X=new Promise((q)=>Z.once("close",()=>q())),J;Z.once("error",(q)=>{J=q});let Y=!1,K=!1,V="";Z.stderr.setEncoding("utf8"),Z.stderr.on("data",(q)=>{V=`${V}${q}`.slice(-16384)});let G=Z.stdout,F,B=(q,A,R)=>{if(R)q.failure??=R;if(q.finishing)return;q.finishing=!0,K=!0,Z.kill("SIGKILL"),b9(X).then(()=>{if(q.failure)q.reject(q.failure);else q.resolve(A??{})},(P)=>q.reject(P))},H=()=>{if(K=!0,F)B(F,void 0,Error("hands_node_repl_state_lost"));else Z.kill("SIGKILL")},z="";G?.setEncoding("utf8"),G?.on("data",(q)=>{if(F?.finishing||K)return;if(z+=q,z.length>iZ){H();return}while(!0){let A=z.indexOf(`
+`);if(A===-1)return;let R=z.slice(0,A);z=z.slice(A+1);let P=F;if(!P){H();return}try{let T=JSON.parse(R);if(P.action==="probe")P.resolve(T);else{B(P,T);return}}catch{B(P,void 0,Error("invalid_hands_node_repl_child_response"));return}}});let L=(q)=>{let A=V.trim(),R=q??Error(A?`hands_node_repl_child_exited:${A}`:"hands_node_repl_child_exited");if(K=!0,F&&!F.finishing)B(F,void 0,R)};Z.once("error",L),Z.once("close",()=>L()),Z.stdin.on("error",L);let W=(q)=>new Promise((A,R)=>{if(Y||K||Z.exitCode!==null||Z.signalCode!==null){R(Error(K?"hands_node_repl_state_lost":"hands_node_repl_stopped"));return}let P=setTimeout(H,q.action==="probe"?1e4:Math.max(1,Math.min($.evaluationTimeoutMs??V$-1000,V$-1000))),T={action:q.action,finishing:!1,resolve(S){if(F===T)F=void 0;clearTimeout(P),A(S)},reject(S){if(F===T)F=void 0;clearTimeout(P),R(S)}};F=T,Z.stdin.write(`${JSON.stringify(q)}
+`,(S)=>{if(!S)return;B(T,void 0,S)})});try{if(!G){if(Z.pid===void 0)await b9(X);throw J??Error("hands_node_repl_control_pipe_missing")}let q=await W({action:"probe"});if(q.ok!==!0||q.output!=="ARA_HANDS_REPL_READY")throw Error("hands_node_repl_probe_failed")}catch(q){Y=!0,Z.kill("SIGKILL");try{await b9(X)}finally{await Q.cleanup()}throw q}let U=Promise.resolve(),j=new Set;z$($.socketPath);let O=e7.createServer((q)=>{j.add(q),q.once("close",()=>j.delete(q)),q.setEncoding("utf8");let A="",R=!1,P=!1;q.once("close",()=>{if(P)H()}),q.on("error",()=>q.destroy()),q.on("data",(T)=>{if(R)return;if(A+=T,A.length>iZ){R=!0,F8(q,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let S=A.indexOf(`
+`);if(S===-1)return;R=!0;let m=A.slice(0,S);U=U.then(async()=>{if(q.destroyed)return;try{let E=JSON.parse(m);if(E.action!=="evaluate"||typeof E.code!=="string")throw Error("Invalid REPL request");P=!0;let N=await W({action:"evaluate",code:E.code});if(P=!1,N.ok!==!0||typeof N.output!=="string")throw Error(typeof N.error==="string"?N.error:"hands_node_repl_failed");F8(q,{ok:!0,output:N.output})}catch(E){P=!1,F8(q,{ok:!1,error:E instanceof Error?E.message:String(E),stack:E instanceof Error?E.stack:void 0})}}).catch((E)=>{F8(q,{ok:!1,error:E instanceof Error?E.message:String(E)})})})});try{await new Promise((q,A)=>{O.once("error",A),O.listen($.socketPath,()=>{O.off("error",A);try{n7($.socketPath,384),q()}catch(R){O.close(()=>A(R))}})})}catch(q){Y=!0,Z.kill("SIGKILL");try{await b9(X)}finally{await Q.cleanup(),z$($.socketPath)}throw q}return{socketPath:$.socketPath,async stop(){if(Y)return;Y=!0;let q=new Promise((A)=>O.close(()=>A()));for(let A of j)A.destroy();await q,U.catch(()=>{return}),H();try{await b9(X)}finally{await Q.cleanup(),z$($.socketPath)}}}}var F$=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var aZ="/workspace",rZ="/var/lib/reason/sessions",z6="/var/lib/reason/session-controls";function tZ($){let Q=`${rZ}/`;if(!$.startsWith(Q))return null;let Z=$.slice(Q.length);if(!F$.test(Z)||Z!==Z.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${z6}/${Z}/job.env`}function K6($){if(!F$.test($))throw Error("personal_computer_invalid_identity");return $.toLowerCase()}function U8($){let Q=K6($);return{runtimeRoot:`${rZ}/${Q}`,workspaceRoot:`${aZ}/sessions/${Q}`,sharedRoot:aZ}}var eZ="/root/.ara/cloud-browser/repl.sock";function H$($){return $==="compute"}function $4($,Q,Z="linux"){if($)U8($);if(Z!=="linux")throw Error("cloud_browser_os_invalid");if(Q!==void 0&&(!$||!/^[1-9][0-9]{0,18}$/.test(Q)))throw Error("cloud_browser_generation_invalid");let X=$?`/var/lib/reason/browsers/${$.toLowerCase()}`:"/root/.ara/cloud-browser",J=$?`${X}/${Q?`g${Q}`:"current"}`:X,Y=$?`/root/.b/${$.toLowerCase().replaceAll("-","")}`:X;return{temporarySessionDirectory:Y,temporaryDirectory:$?`${Y}/${Q??"current"}`:`${J}/tmp`,directory:J,sessionDirectory:X,config:`${J}/config.json`,status:`${J}/status.json`,socket:`${J}/repl.sock`,bundle:`${J}/driver.mjs`,processName:$?`ara-browser-${$.toLowerCase()}${Q?`-${Q}`:""}`:"ara-cloud-browser"}}var W$="browser_egress",Q4=NQ,T6=45000,O6=u9+1500,g0=/^[A-Za-z0-9._:-]{1,160}$/,D6="/run/ara-hands";function _6($,Q,Z=V4()){if($==="darwin")return{temporaryRoot:Z,prepareRoot:!1,sessionMode:448};return{temporaryRoot:Q??D6,prepareRoot:!0,sessionMode:457}}function Z4($,Q=process.platform,Z=process.geteuid?.()){return $===!0&&Q==="linux"&&Z===0}function N$($=Y4(),Q=process.platform,Z=process.geteuid?.()){return $&&Q==="linux"&&Z===0?{uid:$.uid,gid:$.gid,home:$.home,username:$.username}:null}function A6($=N$(),Q=PZ){return $&&Q()?e8:null}function yY($=N$(),Q=process.platform,Z=process.geteuid?.()){return Q!=="linux"||Z!==0||$!==null}function hY($=process.platform,Q=process.geteuid?.()){return $!=="linux"||Q!==0}function x6($,Q){if(!Q&&($??"linux")==="linux")return eZ;return $4(Q,void 0,$??"linux").socket}function P6($){return $[N0]===!0?"sandbox_loopback":"ara_device_wss"}function L9($){return Boolean($)&&typeof $==="object"&&!Array.isArray($)}function H4($){let Q=$.toLowerCase().replace(/^\[|\]$/g,"");return Q==="localhost"||Q.endsWith(".localhost")||Q==="::1"||Q==="0:0:0:0:0:0:0:1"||Q==="0.0.0.0"||Q.startsWith("127.")}class U4 extends C{expiryDiagnostic;constructor($){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=$}}function I6($){return L9($)&&Object.keys($).every((Q)=>Q==="source_path"||Q==="branch")&&($.source_path===void 0||n0($.source_path))&&typeof $.branch==="string"&&Z$.test($.branch)}function R6($,Q,Z){let X=Q===void 0?Date.now():Q,J=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],Y=new Set([...J,"workspace_id","legacy_workspace_id",o0,a0,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",p,N0,W$,U9,q0,r0,m0]),K=L9($)?$:null,V=K?.[W$],G=K?.[U9],F=K?.[r0],B=V===void 0||(K?.[p]===f0||F===k9&&K?.[p]===void 0)&&L9(V)&&Object.keys(V).every((q)=>q==="mode"||q==="allowed_domains")&&V.mode==="enforce"&&Array.isArray(V.allowed_domains)&&V.allowed_domains.length<=256&&V.allowed_domains.every((q)=>typeof q==="string"&&p8(q));if(!L9($)||J.some((q)=>!(q in $))||Object.keys($).some((q)=>!Y.has(q))||!B||F!==void 0&&F!==k9||K?.[m0]!==void 0&&K[m0]!==L8||K?.personal_workspace!==void 0&&(K.personal_workspace!==!0||K[p]!==f0)||K?.cloud_browser!==void 0&&(K.cloud_browser!==!0||K[p]!==f0)||K?.sandbox_provider!==void 0&&!H$(K.sandbox_provider)||K?.sandbox_os!==void 0&&K.sandbox_os!=="linux"||G!==void 0&&(K?.[p]!==H9||!$$(G))||p in $&&$[p]!==f0&&$[p]!==H9&&$[p]!==L0||N0 in $&&$[N0]!==!0||$.workspace_path!==void 0&&(!n0($.workspace_path)||$[p]!==L0)||$.workspace_worktree!==void 0&&($.workspace_path===void 0||!I6($.workspace_worktree))||typeof $.relay_url!=="string"||typeof $.session_id!=="string"||!g0.test($.session_id)||$.workspace_id!==void 0&&(typeof $.workspace_id!=="string"||!g0.test($.workspace_id))||$.legacy_workspace_id!==void 0&&(typeof $.legacy_workspace_id!=="string"||!g0.test($.legacy_workspace_id))||$[o0]!==void 0&&($[o0]!==N8||(p in $))||$[a0]!==void 0&&($[a0]!==M8||(p in $))||$[q0]!==void 0&&(typeof $[q0]!=="string"||!g0.test($[q0]))||typeof $.environment_id!=="string"||!g0.test($.environment_id)||typeof $.expires_at!=="string"||$.policy_mode!=="full_access"||$.policy_version!==1||$.hands_protocol_version!==N9||$.hands_worker_version!==M9||$.hands_worker_artifact_sha256!==K0||!dZ($.hands_worker_entrypoint)||!S0($.target_generation)||!O0($.target_fence_id))throw new C("invalid_hands_payload","Reason Hands connection payload is invalid.");let H;try{H=new URL($.relay_url)}catch{throw new C("invalid_hands_relay","Reason Hands relay URL is invalid.")}let z=$[N0]===!0,L=H4(H.hostname);if((z?H.protocol!=="ws:"||!L:L?H.protocol!=="ws:":H.protocol!=="wss:")||H.username||H.password||H.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(H.pathname))throw new C("invalid_hands_relay","Reason Hands relay URL is not allowed.");let W=Date.parse($.expires_at),U=Number.isNaN(W)?"parse":new Date(W).toISOString()!==$.expires_at?"noncanonical":W<=X?"expired":W-X>Q4?"over_cap":"accepted",j={version:1,outcome:U,clock_source:Q===void 0?"date_now":"injected",validation_now_ms:J9(X),expiry_ms:J9(W),remaining_ms:Number.isSafeInteger(W-X)?W-X:null,maximum_lifetime_ms:Q4,cli_artifact:pZ()};if(U!=="accepted")throw new U4(j);try{Z?.(j)}catch{}let O=$.environment_binding===void 0?void 0:f8.safeParse($.environment_binding);if(O&&!O.success)throw new C("invalid_hands_request","Reason Hands environment binding is invalid.");return{...$.cloud_browser===!0?{cloud_browser:!0}:{},...H$($.sandbox_provider)?{sandbox_provider:$.sandbox_provider}:{},...$.sandbox_os==="linux"?{sandbox_os:$.sandbox_os}:{},...$.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:H.toString(),...O?.success?{environment_binding:O.data}:{},session_id:$.session_id,...$.workspace_id===void 0?{}:{workspace_id:$.workspace_id},...$.legacy_workspace_id===void 0?{}:{legacy_workspace_id:$.legacy_workspace_id},...$[o0]===N8?{[o0]:N8}:{},...$[a0]===M8?{[a0]:M8}:{},...typeof $[q0]==="string"?{[q0]:$[q0]}:{},...$[r0]===k9?{[r0]:k9}:{},...$[m0]===L8?{[m0]:L8}:{},...typeof $.workspace_path==="string"?{workspace_path:$.workspace_path}:{},...L9($.workspace_worktree)?{workspace_worktree:{...typeof $.workspace_worktree.source_path==="string"?{source_path:$.workspace_worktree.source_path}:{},branch:String($.workspace_worktree.branch)}}:{},environment_id:$.environment_id,expires_at:$.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:N9,hands_worker_version:M9,hands_worker_artifact_sha256:K0,hands_worker_entrypoint:i0,target_generation:$.target_generation,target_fence_id:$.target_fence_id,...p in $?{[p]:$[p]}:{},...z?{[N0]:!0}:{},...G===void 0?{}:{[U9]:G},...V===void 0?{}:{[W$]:{mode:"enforce",allowed_domains:[...new Set(V.allowed_domains)].sort()}}}}function E6(){let $=new Map;return{acquire(Q,Z){if($.has(Q))return null;let X=[...$.values()],J=(K)=>Z.group!==void 0&&K.group===Z.group;if(Z.exclusive?!X.every(J):X.some((K)=>K.exclusive))return null;if(Z.limit!==void 0&&!X.some(J)&&new Set(X.map((K,V)=>K.group??V)).size>=Z.limit)return null;$.set(Q,Z);let Y=!1;return()=>{if(Y)return;Y=!0,$.delete(Q)}},activeOwners:()=>[...$.keys()]}}var S6=E6();function w6($,Q){j9($,{recursive:!0,mode:448});let Z=n($),X=()=>new C("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let K of Q.split("/")){let V=o(Z,K);try{let F=t(V);if(F.isSymbolicLink()||!F.isDirectory())throw X()}catch(F){if(!(F&&typeof F==="object"&&("code"in F)&&F.code==="ENOENT"))throw F;try{j9(V,{mode:448})}catch(B){if(!(B&&typeof B==="object"&&("code"in B)&&B.code==="EEXIST"))throw B}}let G=t(V);if(G.isSymbolicLink()||!G.isDirectory()||n(V)!==V)throw X();Z=V}let J=t(Z),Y=L6(Z,U$.O_RDONLY|U$.O_DIRECTORY|U$.O_NOFOLLOW);try{let K=B6(Y);if(!K.isDirectory()||K.dev!==J.dev||K.ino!==J.ino||n(Z)!==Z)throw X();W6(Y,448)}finally{U6(Y)}return Z}function b6($,Q=J4(),Z,X,J){if(!g0.test($)||Z!==void 0&&!g0.test(Z))throw new C("invalid_hands_workspace","Reason Hands run identity is invalid.");let Y=V0(l0({kind:"managed",workspaceId:$,...X?{base:X}:{},...J?{layout:J}:{}})),K=w6(Q,V0(Y)),V=o(K,q6(Y)),G=!1;try{let z=t(V);if(G=!0,z.isSymbolicLink())throw new C("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!z.isDirectory())throw new C("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(z){if(z instanceof C||!(z&&typeof z==="object"&&("code"in z)&&z.code==="ENOENT"))throw z}if(J&&!G)try{let z=o(n(Q),V0(l0({kind:"managed",workspaceId:$,...X?{base:X}:{}}))),L=t(z);if(!L.isSymbolicLink()&&L.isDirectory()&&n(z)===z)W8(z,V),G=!0}catch{}if(Z&&Z!==$){let z=o(K,Z);try{let L=t(z);if(L.isSymbolicLink()||!L.isDirectory())throw new C("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let W=n(z);if(V0(W)!==K)throw new C("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let U=null;if(G){U=o(K,`.${$}.previous`);try{throw t(U),new C("invalid_hands_workspace","Reason Hands previous workspace backup already exists.")}catch(j){if(j instanceof C||!(j&&typeof j==="object"&&("code"in j)&&j.code==="ENOENT"))throw j}W8(V,U)}try{W8(W,V)}catch(j){if(U)W8(U,V);throw j}G=!0}catch(L){if(L instanceof C||!(L&&typeof L==="object"&&("code"in L)&&L.code==="ENOENT"))throw L}}j9(V,{recursive:!0,mode:448}),f9(V,448);let F=n(V);if(V0(F)!==K)throw new C("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let B=o(F,"repo");try{let z=t(B);if(z.isSymbolicLink()||!z.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(z){if(z instanceof C||!(z&&typeof z==="object"&&("code"in z)&&z.code==="ENOENT"))throw z}j9(B,{recursive:!0,mode:448}),f9(B,448);let H=n(B);if(V0(H)!==F)throw new C("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:F,repoPath:H}}function W4($){let Q=null;try{Q=t($)}catch{}if(!Q||Q.isSymbolicLink()||!Q.isDirectory()||Q.uid!==0||Q.gid!==0||(Q.mode&4095)!==493)throw new C("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function k6($,Q){let Z="/";for(let X of["",...$.split("/"),...Q.split("/")].filter((J,Y)=>Y===0||J)){if(X)Z=o(Z,X);let J;try{J=t(Z)}catch{return null}if(J.uid!==0)return J.uid;if((J.mode&2)!==0&&(J.mode&512)===0&&!J.isSymbolicLink())return-1;if(J.isSymbolicLink()||!J.isDirectory())return null}return null}function f6($,Q,Z,X=process.geteuid?.(),J){if(!g0.test(Q))return null;let Y,K;try{Y=n($),K=V0(l0({kind:"managed",workspaceId:Q,...Z?{base:Z}:{},...J?{layout:J}:{}}))}catch{return null}let V=o(Y,K),G=L$(V)!==null,F=(W)=>new C("cloud_workspace_root_invalid",W),B;if(X===0){let W=k6(Y,K);if(W===null)return null;if(!G)throw new C("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");B=W}else{if(!G)return null;let W,U;try{W=t(V0(V)),U=t(V)}catch{return null}if(W.isSymbolicLink()||!W.isDirectory()||W.uid===0||U.uid!==0)return null;B=W.uid}let H=Y;for(let W of K.split("/")){let U=o(H,W),j=!1;try{let O=t(U);j=!O.isSymbolicLink()&&O.isDirectory()&&n(U)===U}catch{}if(!j)throw F("This cloud Session's workspace root is missing or is not a real directory.");H=U}W4(V);let z;try{z=B4(V)}catch(W){if(W instanceof C)throw W;throw F("This cloud Session's workspace root changed while Reason Hands checked it.")}let L=null;try{L=m9(z.repoPath).uid}catch{}if(L!==B)throw new C("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return z}function B4($,Q=!1){let Z=n($),X=o(Z,"repo"),J;try{J=t(X)}catch{throw new C("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(Q){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(Z))throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");if(U8(Z.slice(Z.lastIndexOf("/")+1)).runtimeRoot!==Z)throw new C("invalid_hands_workspace","Personal runtime identity is invalid.");let V=n("/workspace"),G=n(X);if(V!=="/workspace"||!m9(G).isDirectory()||!G.startsWith("/workspace/"))throw new C("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:Z,repoPath:G}}let Y=IZ(Z);if(Y&&J.isSymbolicLink()){let V=n(X);if(V!==n(Y)||!m9(V).isDirectory())throw new C("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:Z,repoPath:V}}if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let K=n(X);if(V0(K)!==Z)throw new C("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:Z,repoPath:K}}function M$($,Q,Z){if(Q!==void 0&&!n0(Q))throw new C("invalid_hands_workspace",`Reason Hands ${Z} is invalid.`);let X=F4($,Q??".");if(!w0($,X))throw new C("invalid_hands_workspace",`Reason Hands ${Z} escapes its granted root.`);return X}function L4($,Q,Z){if(Q$(Q)){let X=n(Z);return{anchor:X,target:F4(X,Q),boundary:o(X,W9)}}return{anchor:$,target:M$($,Q,"folder"),boundary:$}}function m6($,Q){if(!w0($,Q))throw new C("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let Z=$;for(let X of Q.slice($.length).split("/").filter(Boolean)){Z=o(Z,X);let J=null;try{J=t(Z)}catch(Y){if(Y.code!=="ENOENT")throw Y}if(!J)j9(Z,{mode:448});else if(J.isSymbolicLink()||!J.isDirectory())throw new C("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function N4($,Q){let Z=n(M$($,Q.source_path,"repository"));if(!w0($,Z)||!m9(Z).isDirectory())throw new C("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return Z}async function g6($,Q,Z,X=j8()){try{let J=n($);if(B$(L4(J,Q,X).target))return;return await kZ(N4(J,Z))??void 0}catch{return}}function y6($,Q,Z,X,J=h6,Y=j8()){let K=n($),{target:V,boundary:G,anchor:F}=L4(K,Q,Y);if(Z&&!B$(V)){let z=N4(K,Z);m6(F,V0(V));let L=["-c","core.hooksPath=/dev/null","-C",z];if(X)J([...L,"update-ref","--create-reflog","-m",X.note,`refs/heads/${Z.branch}`,X.commit,""]);let W=X?J([...L,"worktree","add",V,Z.branch]):J([...L,"worktree","add","-b",Z.branch,V]);if(!X&&W.status!==0&&/already exists/.test(W.stderr)&&!B$(V))W=J([...L,"worktree","add",V,Z.branch]);if(W.status!==0)throw new C(/not a git repository/i.test(W.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let B;try{B=t(V)}catch{throw new C("workspace_folder_missing","This Session's folder no longer exists.")}let H=n(V);if(B.isSymbolicLink()&&!w0(G,H))throw new C("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!m9(H).isDirectory()||!w0(G,H))throw new C("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(b0(H))throw new C("protected_path","Credential and secret folders are unavailable to Sessions.");return H}function h6($){let Q=H6("git",$,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:Q.status,stderr:Q.stderr??""}}function M4($){return tZ($)??L$($)?.jobEnv??o($,"job.env")}function v6($,Q){let Z=M4($),X=t(Z);if(X.isSymbolicLink()||!X.isFile())throw new C("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");N6(Z,Q),f9(Q,384)}function c6($){if($.workspaceMode===L0&&$.workspacePath!==void 0){let K=$.home??j8(),V=y6($.grantedRoot,$.workspacePath,$.workspaceWorktree,$.workspaceWorktreeStart,void 0,K);if($.workspaceWorktree&&$.deviceId)yZ(K,$.workspacePath,$.deviceId);return{workRoot:V,repoPath:V,workspace:{kind:"root",path:$.workspacePath},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if($.workspaceMode===f0)return{...B4($.grantedRoot,$.personalWorkspace),workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if($.workspaceMode===H9||$.workspaceMode===L0){let K=t($.grantedRoot);if(K.isSymbolicLink()||!K.isDirectory())throw new C("invalid_hands_workspace","Reason Hands root must be a real directory.");let V=n($.grantedRoot);return{workRoot:V,repoPath:V,workspace:{kind:"root"},jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let Q=$.workspaceId??$.runId,Z={kind:"managed",workspaceId:Q,...$.workspaceBase?{base:$.workspaceBase}:{},...$.workspaceLayout?{layout:$.workspaceLayout}:{}},X=n9($.grantedRoot,Z,$.home).anchor,J=f6(X,Q,$.workspaceBase,void 0,$.workspaceLayout);if(J)return{...J,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let Y=b6(Q,X,$.legacyWorkspaceId,$.workspaceBase,$.workspaceLayout);return{...Y,workspace:Z,jobEnvPath:o($.temporaryDirectory,"job.env"),workspacePoolPath:V0(Y.workRoot),managedWorkspace:!0}}function d6($){let{command:Q,prefix:Z}=m8($.executablePath,$.sourceEntrypoint),X=H8({home:C6(),temporaryDirectory:$.temporaryDirectory,path:$.path});if(X.REASON_DEVICE_ROOT=X.ARA_DEVICE_ROOT=$.grantedRoot,X.REASON_HANDS_WORKSPACE=X.ARA_HANDS_WORKSPACE=$.workRoot,X.REASON_HANDS_REPO=X.ARA_HANDS_REPO=$.root,$.workspacePoolPath)X.REASON_HANDS_WORKSPACE_POOL=X.ARA_HANDS_WORKSPACE_POOL=$.workspacePoolPath;return{command:Q,args:[...Z,"__device","__hands-worker","--config",$.configPath],options:{cwd:$.root,env:X,shell:!1,stdio:["ignore","ignore","pipe"]}}}function p6($,Q){let Z="",X=!1,J=Date.now(),Y=0,K=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped","request_cancelled","permission_denied"].map((H)=>`hands.worker.${H}`)),V=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed","cancelled","settled","unsupported","unconfirmed",...["sandbox_policy","os_permission_unknown"].flatMap((H)=>["bash","read","write","edit"].map((z)=>`${H}:${z}`))]),G=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],F=["peerGeneration","socketState","closeCode"],B=new Set(["event","reason","launchId",...G,...F]);return(H)=>{for(let z of H.toString().split(/(?<=\n)/)){let L=z.endsWith(`
+`);if(!X&&Z.length+z.length<=2048)Z+=z;else X=!0;if(!L)continue;let W=Z;if(Z="",X){X=!1;continue}try{let U=JSON.parse(W);if(!U||typeof U!=="object"||Array.isArray(U)||Object.keys(U).some((j)=>!B.has(j))||!K.has(U.event)||!V.has(U.reason)||U.event==="hands.worker.permission_denied"!==(typeof U.reason==="string"&&U.reason.includes(":"))||U.launchId!==$||G.some((j)=>!Number.isSafeInteger(U[j])||U[j]<0)||F.some((j)=>U[j]!==null&&(!Number.isSafeInteger(U[j])||U[j]<0)))continue;if(Date.now()-J>=60000)J=Date.now(),Y=0;if(Y>=122)continue;Y+=1,Q(U)}catch{}}}}async function l6($){let Q=$.now()+$.timeoutMs;while($.now()<Q){if($.signal.aborted)throw new C("cancelled","Reason Hands start was cancelled.");if($.spawnFailed?.()||$.child.exitCode!==null||$.child.signalCode!==null)throw new C("hands_worker_exited","Reason Hands exited before ready.");let Z=V8($.path,{pid:$.child.pid??-1,launchId:$.launchId,workerVersion:M9,protocolVersion:N9,workerArtifactSha256:K0,workerEntrypoint:i0});if(Z?.targetGeneration===$.targetGeneration&&Z.fenceId===$.fenceId)return Z;await new Promise((X)=>setTimeout(X,10))}throw new C("hands_ready_timeout","Reason Hands did not become ready.")}async function u6($,Q){let Z=()=>$.exitCode===0&&$.signalCode===null;if($.exitCode!==null||$.signalCode!==null)return Z()?"stopped":"already_exited";let X=new Promise((K)=>$.once("exit",()=>K()));try{if(!$.kill("SIGTERM"))return Z()?"stopped":"unobserved"}catch{return Z()?"stopped":"unobserved"}if(await X4(X,Q))return Z()?"stopped":"unobserved";try{$.kill("SIGKILL")}catch{}return await X4(X,Q)?"forced":"unobserved"}async function X4($,Q){let Z;try{return await Promise.race([$.then(()=>!0),new Promise((X)=>{Z=setTimeout(()=>X(!1),Q)})])}finally{clearTimeout(Z)}}function s6($){return new Promise((Q)=>{let Z=!1,X=(V)=>{if(Z)return;Z=!0,clearTimeout(K),$.signal.removeEventListener("abort",J),$.child.off("exit",Y),Q(V)},J=()=>X("cancelled"),Y=()=>X("exited"),K=setTimeout(()=>X("expired"),Math.max(0,$.expiresAt-$.now()));if($.signal.addEventListener("abort",J,{once:!0}),$.child.once("exit",Y),$.signal.aborted)J();else if($.child.exitCode!==null||$.child.signalCode!==null)Y()})}var j4=K4();function n6($,Q){if(!($ instanceof Error)||$ instanceof C)return!1;let Z=["hands_browser_driver_missing","hands_browser_driver_version_mismatch","hands_browser_executable_missing","hands_browser_unsupported_platform","hands_browser_unavailable"].includes($.message),X=["ENOENT","EACCES","EPERM"].includes($.code??"");if(!Z&&!X)return!1;try{return t(Q),!1}catch(J){return L9(J)&&J.code==="ENOENT"}}function i6($){return $.sandbox_provider==="compute"&&!$.cloud_browser&&!$[N0]&&$[p]===f0}function o6($,Q,Z){return $===void 0?{}:{dispatch_stages:{version:1,claim_to_entered_ms:H0($,Q),...Z===void 0?{}:{worker_prespawned:Z}}}}function vY(){j4().catch(()=>{return}),K9().catch(()=>{return})}async function cY($,Q={}){let Z=Q.logDiagnostic??((N)=>console.warn(N)),X=new Map,J=(N)=>{let M=Date.now();X.set(N,M);try{Z(JSON.stringify({event:"sandbox.hands_startup",stage:N,timestampMs:M}))}catch{}};J("entered");let Y=$.claimEnvironment;$.claimEnvironment=void 0;let K=Q.now??Date.now,V,G=R6($.payload,Q.now?.(),(N)=>{V=N});if($.managedPty&&($.managedPty.version!==1||!$.headless||!$.runtimeDirectory||![void 0,!0].includes($.managedPty.startupVerified)||!$.deviceIdentity||!$.claimOwner||$.claimOwner.device_id!==$.deviceIdentity.deviceId||!G.environment_binding||!["darwin","linux"].includes(process.platform)))throw new C("pty_unsupported","Bound PTY requires qualified headless Hands with private jobs and environment.");let F=async(N)=>{let M;try{await Promise.race([N,new Promise((D,w)=>{M=setTimeout(()=>w(new C("hands_event_delivery_unavailable","Hands event delivery did not settle within its deadline.")),Math.max(1,Math.min(Q.eventDeliveryTimeoutMs??5000,5000)))})])}finally{clearTimeout(M)}},B=async(N,M)=>F($.emitEvent(N,M));if($.headless&&(G.cloud_browser===!0||$.managedBrowser!==void 0||G[N0]!==void 0||G[U9]!==void 0||G[p]!==void 0&&G[p]!==L0))throw new C("invalid_hands_request","Managed sandbox extensions are unavailable to a headless worker.");let H=N$(),z=G[m0]===void 0?null:A6(H);if(G[m0]!==void 0&&(z===null||!$.headless||!Z4($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_model_jobs_egress_unavailable","This worker cannot hold its jobs to the guest egress guard; the Hands did not start.");if(G[r0]!==void 0&&!($.headless&&Z4($.hostExecution,Q.hostIdentity?.platform,Q.hostIdentity?.euid)))throw new C("hands_confinement_unavailable","Confined Hands need a root Linux worker in host mode.");if(G.cloud_browser&&process.platform!=="linux")throw new C("cloud_browser_target_invalid","Cloud browser is available only on a cloud machine.");let L=`${$.operationId}:${$.attemptId}`,W=G[p]===H9,U=$.headless||process.platform==="darwin"&&$.managedBrowser===void 0&&!G.cloud_browser&&!G.browser_egress&&!G[N0]&&(G[p]===void 0||G[p]===L0)||i6(G),j=W?G[U9]??"bash":null,O=j?SZ(j):null;if(O)throw new C(O,"Persistent Node REPL execution is unavailable; this benchmark profile cannot start.");let q=G[p],A=$.headless===!0&&$.ownComputer!==!0?$.handsSlots??1:void 0,R=(Q.slot??S6).acquire(L,{exclusive:A===1||q!==void 0&&q!==L0,...A!==void 0&&A>1?{limit:A}:{},...$.headless===!0&&G[q0]!==void 0?{group:G[q0]}:{}});if(!R)throw new C("hands_slot_busy",A!==void 0&&A>1?`This Reason worker runs at most ${A} sessions at a time.`:"This Reason Device runs one session at a time.");let P=$.headless===!0?G4($.runId):null,T=null,S=null,m,E;try{J("browser_resolution");let N=$.headless&&Q.browserExecutablePath===void 0?await K9():null,M=W||G.cloud_browser?null:Q.browserExecutablePath===void 0?$.headless?N?.status==="resolved"?N.executablePath:null:await _Z(void 0,process.platform,$.managedBrowser):Q.browserExecutablePath;if(!W&&!G.cloud_browser&&!U&&!M)throw new C("hands_browser_unavailable","Reason Hands requires Chrome, Edge, Brave, Chromium, or a Playwright Chromium install.");J("path_resolution");let D;try{D=await(Q.resolvePathEnvironment??j4)()}catch{D={path:z4(),source:"fallback"}}if(J("workspace_setup"),process.platform==="darwin"){let l=G[p]===L0&&G.workspace_path!==void 0?M$($.root,G.workspace_worktree?G.workspace_worktree.source_path:G.workspace_path,"folder"):null;for(let e of new Set([$.root,...l?[l]:[]]))await sQ(e)}let k=G[p]===f0||G[p]===H9?_6(process.platform,Q.sandboxRuntimeRoot):null,f=$.headless&&$.runtimeDirectory?$.runtimeDirectory:k?k.temporaryRoot:V4();if(T="private_runtime",$.headless&&$.runtimeDirectory){x9(f);let l=n($.root);if(!R9(l,f))throw new C("invalid_hands_workspace","Private worker state must not overlap the granted workspace.")}if($.headless&&$.runtimeDirectory&&(!$.deviceIdentity||!G.environment_binding))throw new C("environment_unavailable","Headless Hands requires a server-bound private environment.");if(T="runtime_root",k?.prepareRoot)j9(f,{recursive:!0,mode:457}),f9(f,457);T="temporary_directory";let _=n(M6(o(f,"reason-hands-session-")));S=_,f9(_,k?.sessionMode??448);let g=o(_,"hands-config.json"),c=o(_,"hands-ready.json"),u=V6(),a=G.target_fence_id;if($.workspaceGrant){T="workspace_grant",J("workspace_grant_wait");let l=$.workspaceGrant;await new Promise((e,c0)=>{let e0=()=>c0(new C("cancelled","Reason Hands was cancelled."));if($.signal.aborted){e0();return}$.signal.addEventListener("abort",e0,{once:!0}),l.then(e,c0).finally(()=>$.signal.removeEventListener("abort",e0))})}T="granted_root";let b=n($.root);T="workspace_layout";let h=G[p]===L0&&G.workspace_path!==void 0&&G.workspace_worktree?await g6(b,G.workspace_path,G.workspace_worktree):void 0,{workRoot:d,repoPath:s,jobEnvPath:G0,workspacePoolPath:M0,managedWorkspace:U0,workspace:W0,cloudSessionRoot:y0}=c6({grantedRoot:b,personalWorkspace:G.personal_workspace===!0,runId:$.runId,workspaceId:G.workspace_id,legacyWorkspaceId:G.legacy_workspace_id,workspaceBase:G[o0],workspaceLayout:G[a0],temporaryDirectory:_,workspaceMode:G[p],applicationSupportPath:Q.applicationSupportPath,...G.workspace_path===void 0?{}:{workspacePath:G.workspace_path},...G.workspace_worktree?{workspaceWorktree:G.workspace_worktree}:{},...h?{workspaceWorktreeStart:h}:{},...$.deviceIdentity?{deviceId:$.deviceIdentity.deviceId}:{}}),T0=P6(G);T="jobs";let r=$.headless&&$.runtimeDirectory?VQ({runtimeDirectory:$.runtimeDirectory,root:b,runId:$.runId}):void 0;m=r?.disposeSocket;let j0=r?FQ(r):null;if(j0)try{Z(JSON.stringify({event:"hands.journal_owner_retired",run_id:$.runId,reason:j0.reason,prior_executor_launch_id:j0.executorLaunchId}))}catch{}if(r&&[d,s].some((l)=>!R9(l,r.journalDirectory)))throw new C("invalid_hands_workspace","A Session can't work in the folder that holds this worker's settings; start it in a project or repository inside it.");let t0=G.personal_workspace?d.slice(d.lastIndexOf("/")+1):void 0;if(t0&&t0!==G.workspace_id)throw new C("invalid_hands_workspace","Personal session identity does not match its Device grant.");T="browser_socket";let B0=G.cloud_browser?x6(G.sandbox_os,t0):o(r?V0(r.socketPath):_,"repl.sock");T="relay_url";let C0=H4(new URL(G.relay_url).hostname),h0=T0==="ara_device_wss"&&!C0?(Q.loadProxy??g8)()?.url:void 0,Y0;T="environment_owner";let X0=$.headless&&$.deviceIdentity&&G.environment_binding?vZ(_,{runId:$.runId,...$.deviceIdentity,binding:G.environment_binding,expiresAtMs:Date.parse(G.expires_at),identity:()=>Y0?.()??null}):void 0;T="job_environment";let C9=!X0&&W0.kind==="managed"&&U0?o(d,"job.env"):null;if(C9)try{B8(C9,"",{mode:384,flag:"wx"})}catch(l){if(!(l instanceof Error&&("code"in l)&&l.code==="EEXIST"))throw l}let C8={url:G.relay_url,transport:T0,...h0===void 0?{}:{proxyUrl:h0},...$.localGithubConfinement?{localGithubConfinement:!0}:{},...G[r0]&&X0?{gitCredentialEnvironment:!0}:{},workerVersion:M9,protocolVersion:N9,workerArtifactSha256:K0,workerEntrypoint:i0,targetGeneration:G.target_generation,fenceId:a,workRoot:d,workspaceAliasPath:d,jobEnvPath:G0,...X0?{environmentSnapshotPath:X0.path,...$.hostExecution?{executionEnvironment:mQ()}:{},environmentExpectedBinding:{runId:$.runId,...$.deviceIdentity,binding:G.environment_binding}}:C9?{jobEnvSourcePath:C9,workspacePoolPath:V0(d)}:U0?{}:{jobEnvSourcePath:M4(d)},repoPath:s,replSocketPath:B0,...G.cloud_browser?{browserRunId:$.runId}:{},readyPath:c,launchId:u,expiresAtMs:Date.parse(G.expires_at),bashTimeoutMs:300000,replTimeoutMs:120000,...r?{managedJobs:{journalDirectory:r.journalDirectory,scopeId:r.scopeId},jobControlSocketPath:r.socketPath}:{},...r&&H?{jobsUser:{...H,...z!==null?{modelGid:z}:{}}}:{},...$.managedPty&&r&&X0?{managedPty:{version:1,...$.managedPty.startupVerified===!0?{persistent:!0}:{},...process.platform==="darwin"?{shell:gQ()}:{}}}:{},...U&&!M?{allowedTools:["bash","read","write","edit"]}:W?{allowedTools:j==="bash"?["bash"]:["bash","repl"]}:{}};if(X0||U0&&!C9)B8(G0,"",{mode:384});else v6(d,G0);T="config_write",B8(g,JSON.stringify(C8),{mode:384}),T=null;let v0={session_id:G.session_id,environment_id:G.environment_id,hands_protocol_version:N9,hands_worker_version:M9,hands_worker_artifact_sha256:K0,hands_worker_entrypoint:i0,target_generation:G.target_generation,target_fence_id:G.target_fence_id,executor_launch_id:u},g9=null,j$=!1,C$=!1,q$,Z0=null,T$,O$,y9="failed",D$=null,q8=Promise.resolve(),_$=null,T8=async(l,e)=>{try{await B(l,e)}catch{}};try{J("event_started");let l,e=(async()=>{await $.emitEvent("hands.started",{...v0,policy_mode:"full_access",policy_version:1,path_source:D.source}),l=Date.now()})();e.catch(()=>{return}),J("worker_setup");let c0=G.browser_egress?{mode:"enforce",allowedDomains:G.browser_egress.allowed_domains}:{mode:"off"};if(j&&j!=="bash")g9=await(Q.startNodeRepl??oZ)({socketPath:B0,workRoot:d});else if(!W&&!G.cloud_browser&&M)g9=await(Q.startRepl??AZ)({socketPath:B0,browserExecutablePath:M,workspaceRoot:s,...$.managedBrowser?{managedBrowser:$.managedBrowser}:{},...$.desktopRecording?{recording:$.desktopRecording}:{},networkPolicy:c0,onEgressDenied:(y)=>{let F0=RZ(y.host);Z(JSON.stringify({event:"sandbox.repl_egress_denied",destination_id:F0,reason:y.reason,run_id:$.runId})),q8=q8.then(()=>B("hands.browser_egress_denied",{destination_id:F0,reason:y.reason})).catch((v9)=>{_$??=v9})}}).catch((y)=>{if(!U||$.signal.aborted||K()>=Date.parse(G.expires_at)||!n6(y,B0))throw y;return Object.assign(C8,{allowedTools:["bash","read","write","edit"]}),B8(g,JSON.stringify(C8),{mode:384}),C$=!0,null});let e0=d6({configPath:g,root:s,grantedRoot:b,workRoot:d,workspacePoolPath:M0,temporaryDirectory:_,path:D.path,executablePath:Q.executablePath,sourceEntrypoint:Q.sourceEntrypoint}),O8=Date.now(),D8,A$,_8=Q.takePrespawnedWorker?.(e0)??null;if(q$=Q.takePrespawnedWorker?_8!==null:void 0,Z0=_8??(Q.spawnWorker??((y)=>F6(y.command,y.args,y.options)))(e0),!_8)Q.adoptSpawnedWorker?.(Z0);Z0.stderr?.on("data",p6(u,(y)=>{if(y.event==="hands.worker.connecting")D8??=y.timestampMs;else if(y.event==="hands.worker.open")A$??=y.timestampMs;if(Z(JSON.stringify({...y,run_id:$.runId})),y.event==="hands.worker.permission_denied"&&typeof y.reason==="string"){let[F0,v9]=y.reason.split(":");if(["sandbox_policy","os_permission_unknown"].includes(F0??"")&&["bash","read","write","edit"].includes(v9??""))B("permission.denied",{provenance:F0,operation:v9}).catch(()=>{return})}}));let x$=!1;Z0.on("error",()=>{x$=!0}),Z0.once("exit",(y,F0)=>{try{Z(JSON.stringify({event:"hands.worker.exited",run_id:$.runId,launchId:u,exit_code:y,exit_signal:F0}))}catch{}}),E=Z0,J("worker_ready_wait");let q9=await l6({path:c,launchId:u,fenceId:a,targetGeneration:G.target_generation,child:Z0,spawnFailed:()=>x$,signal:$.signal,timeoutMs:Q.readyTimeoutMs??T6,now:K}),C4=Date.now();if(Y0=()=>{if(!Z0||Z0.exitCode!==null||Z0.signalCode!==null)return null;let y=V8(c,q9);return y?{generation:y.targetGeneration,fenceId:y.fenceId}:null},r){let y={root:b,runId:$.runId,operationId:$.operationId,scopeId:r.scopeId,socketPath:r.socketPath,generation:q9.targetGeneration,fenceId:q9.fenceId,executorLaunchId:u,expiresAtMs:Date.parse(G.expires_at),readIdentity:Y0,workspace:W0,localGithubConfinement:$.localGithubConfinement===!0};if(X0)y.environment=X0;if($.claimOwner&&$.deviceIdentity&&$.claimOwner.device_id===$.deviceIdentity.deviceId){let F0=[$.deviceIdentity.apiOrigin,G.relay_url];if(h0)F0.push(h0);y.previewAuthority={owner:Object.freeze({...$.claimOwner}),rootId:$.deviceIdentity.rootId,relayOrigin:new URL(G.relay_url).origin,deniedPorts:d$(F0)}}O$=HQ(y)}if(await new Promise((y)=>{setImmediate(y)}),y0)W4(d);let h9;if(Y&&X0){try{let y=X0.install(Y);h9={snapshot_id:y.snapshot_id,installed_revision:y.installed_revision}}catch{}try{Z(JSON.stringify({event:"hands.environment_at_claim",run_id:$.runId,installed:h9!==void 0}))}catch{}}Y=void 0,J("event_ready");let P$=F(e);P$.catch(()=>{return});let I$=Date.now();j$=!0,await B("hands.ready",{...v0,expiry_diagnostic:V,startup_stages:{version:1,browser_resolution_ms:H0(X.get("browser_resolution"),X.get("path_resolution")),path_resolution_ms:H0(X.get("path_resolution"),X.get("workspace_setup")),workspace_setup_ms:H0(X.get("workspace_setup"),X.get("event_started")),repl_setup_ms:H0(X.get("worker_setup"),O8),worker_boot_ms:H0(O8,D8),worker_dial_ms:H0(D8,A$),worker_ready_ms:H0(O8,C4),started_event_ms:H0(X.get("event_started"),l),started_join_wait_ms:H0(X.get("event_ready"),I$),total_ms:H0(X.get("entered"),I$)},...o6($.claimedAtMs,X.get("entered"),q$),...$.managedPty?.startupVerified===!0?{managed_pty:{version:1,execution_mode:"host",descendant_cleanup_verified:!0}}:{},policy_mode:"full_access",policy_version:1,path_source:D.source,connection_generation:q9.generation,...h9?{environment_installed:h9}:{},...U&&!g9?{browser_state:"unavailable",browser_reason_code:C$?"setup_failed":"not_resolved"}:{viewport_width:1440,viewport_height:900}}),await P$,J("ready"),T$=sZ({path:c,initial:q9,signal:$.signal,isAlive:()=>Z0!==null&&Z0.exitCode===null&&Z0.signalCode===null&&K()<Date.parse(G.expires_at),publish:(y,F0)=>$.emitEvent("hands.reconnected",{...v0,target_generation:y.targetGeneration,target_fence_id:y.fenceId,connection_generation:y.generation},F0),failed:()=>Z(JSON.stringify({event:"hands.worker.generation_proof_failed",run_id:$.runId,executor_launch_id:u}))});let R$=await s6({child:Z0,signal:$.signal,expiresAt:Date.parse(G.expires_at),now:K});if(R$==="cancelled"){let y=$.signal.reason instanceof C?$.signal.reason.code:"cancelled";throw y9=y,new C(y,"Reason Hands was cancelled.")}if(R$==="exited")throw new C("hands_worker_exited","Reason Hands exited unexpectedly.");return y9="expired",{...v0,policy_mode:"full_access",policy_version:1,ended:"expired"}}catch(l){D$=l;let e=l instanceof C?l.code:"hands_failed",c0=e==="cancelled"||["run_finished","run_cancelled","driver_handoff","driver_stopped"].includes(e);if(y9=c0?e:"failed",!c0)await T8("hands.failed",{...v0,reason_code:e});throw l}finally{T$?.stop(),O$?.();let l=Z0?await u6(Z0,Q.stopTimeoutMs??O6):null,e=!1;await $.desktopRecording?.close();try{await g9?.stop()}catch{e=!0}if(await q8,(l==="stopped"||l==="already_exited"&&!j$)&&!e)await T8("hands.stopped",{...v0,reason_code:y9});else if(l!==null||e){if(await T8("hands.failed",{...v0,reason_code:l==="forced"?"hands_stop_forced":"hands_stop_unconfirmed"}),D$===null||e)throw new C("hands_stop_unconfirmed","Reason Hands resource cleanup could not be proven.")}if(_$!==null)throw new C("hands_egress_audit_failed","Reason Hands could not persist a browser egress denial receipt.")}}catch(N){let M=xZ(T,N);if(M)try{Z(JSON.stringify({event:"sandbox.hands_workspace_failed",...M}))}catch{}throw N}finally{try{if(!E||E.exitCode!==null||E.signalCode!==null)m?.();if(S!==null&&(!E||E.exitCode!==null||E.signalCode!==null))j6(S,{recursive:!0,force:!0})}finally{P?.(),R()}}}
+export{v as hb,k$ as ib,f$ as jb,b4 as kb,h$ as lb,c$ as mb,d$ as nb,D2 as ob,VQ as pb,y2 as qb,h2 as rb,v2 as sb,c2 as tb,d2 as ub,p2 as vb,WQ as wb,l2 as xb,s2 as yb,p as zb,L0 as Ab,yX as Bb,hX as Cb,QJ as Db,ZJ as Eb,TQ as Fb,o9 as Gb,x9 as Hb,P9 as Ib,EQ as Jb,vZ as Kb,Y5 as Lb,bQ as Mb,mQ as Nb,gQ as Ob,S5 as Pb,w5 as Qb,J0 as Rb,b5 as Sb,k5 as Tb,f5 as Ub,l5 as Vb,Z1 as Wb,u5 as Xb,R9 as Yb,w0 as Zb,s5 as _b,BX as $b,Y1 as ac,G1 as bc,YZ as cc,XX as dc,E9 as ec,a1 as fc,F$ as gc,tZ as hc,Z4 as ic,N$ as jc,A6 as kc,yY as lc,hY as mc,U4 as nc,E6 as oc,W4 as pc,B4 as qc,d6 as rc,vY as sc,cY as tc};