@reason-machines/cli-linux-arm64-musl 0.2.371 → 0.2.373

package/bin/vm-hands/{vm-hands-entry-lite-kc07ptqt.js → vm-hands-entry-lite-m8jcht6h.js}

@@ -1,7 +1,7 @@
 // @bun
-import{r as v0}from"./vm-hands-entry-lite-d7y6aah1.js";import{v as n1,x as x6,y as c9}from"./vm-hands-entry-lite-bt6esncn.js";import{A as X2,B as E6,C as $4,D as J4,E as V6,F as m0,J as G6,K as A$}from"./vm-hands-entry-lite-8sddhaka.js";import{V as g2,oa as e0,ra as u1,ta as VJ}from"./vm-hands-entry-lite-k7twc1ch.js";import{Ba as f5,Ca as m5,Da as e4,Ea as $8,Fa as DJ,Ga as WJ,Ha as _9,Ia as d8,Ja as Q8,Ka as L0,La as I1,Ma as C1,Na as I0,Oa as g1,Pa as p8,Qa as B5,Ra as f3,Sa as t8,Wa as r8,cb as AJ,db as RJ,eb as PJ,fb as IJ,gb as D9}from"./vm-hands-entry-lite-8cmyg5e4.js";import{$b as _J,Ab as x8,Bb as J8,Cb as Z8,Db as MJ,Eb as TJ,Gb as u,Hb as e,Ib as s,Jb as c,Kb as H8,Lb as FJ,Mb as N1,Pb as t2,Qb as r2,Rb as R6,Sb as P6,Tb as I6,Ub as S0,Vb as J0,Wb as g,Xb as j9,Yb as j1,Zb as i1,_b as N0,ec as V5,gc as S4,ib as cJ,jc as I2,lb as L8,lc as u8,mb as F8,mc as i3,oc as S8,pb as U8,rb as A8,sc as jJ,tc as l3,ub as R8,zb as E8}from"./vm-hands-entry-lite-ymwv38dd.js";import{xc as X8}from"./vm-hands-entry-lite-b775ysr4.js";import{Ec as g8}from"./vm-hands-entry-lite-mcv6pse6.js";import{Jc as P8,Kc as I8,Rc as C8}from"./vm-hands-entry-lite-dq1fdx0j.js";import{Sc as H$}from"./vm-hands-entry-lite-g9rvf5qk.js";import{id as o4}from"./vm-hands-entry-lite-2c88t2at.js";import{Ad as g5,td as c8,wd as OJ,zd as v5}from"./vm-hands-entry-lite-e9gq8n0f.js";import{Dd as p$,Fd as Q$,Gd as R$,Hd as U1,Jd as B6,Kd as S6,Ld as b6,Nd as H1,Od as w6,Pd as b9,Qd as y6,Rd as s2,Sd as M$,Td as A4,Ud as a2}from"./vm-hands-entry-lite-8emxhcny.js";import{af as r4,if as J6,jf as n$,tf as Z2,ue as L2,ye as HJ,ze as qJ}from"./vm-hands-entry-lite-2fyemnas.js";import{Gf as C6,Hf as m2,Kf as zJ,Nf as w1,Pf as o6,Qf as e6,Vf as n8}from"./vm-hands-entry-lite-5n6agg8d.js";import{hg as V0,ig as $2,jg as xJ,kg as SJ,lg as i$,mg as N3,ng as z2,og as K4,qg as A2,rg as b$,sg as k0,tg as t$,ug as R2,xg as w$}from"./vm-hands-entry-lite-vygp7vq8.js";import{Ag as d1,Bg as v8}from"./vm-hands-entry-lite-y9wkxydj.js";import{Gg as z8}from"./vm-hands-entry-lite-dm52srp5.js";import{$h as W$,Xh as Z$,ai as P0,bi as i9,ci as O6,di as z6,fi as q2,gi as A6,hi as T9,ii as O4,ji as z4,ki as r$}from"./vm-hands-entry-lite-gzyps3ev.js";import{li as v1,mi as z1}from"./vm-hands-entry-lite-5zmn6a7p.js";import{Ji as F6,Ri as l8,Si as L9,Ui as Y8}from"./vm-hands-entry-lite-cxgbb2yr.js";import{Wi as H0,Yi as QJ}from"./vm-hands-entry-lite-9fr904x2.js";import{uj as r}from"./vm-hands-entry-lite-5mz0m0k0.js";import{Tj as K}from"./vm-hands-entry-lite-zmf1terc.js";import{Wj as LJ}from"./vm-hands-entry-lite-ngytzkx1.js";import{$j as h0}from"./vm-hands-entry-lite-y3wncwjd.js";import{fk as aV}from"./vm-hands-entry-lite-7fx4xtf6.js";import{spawn as k6,spawnSync as iV}from"child_process";import{closeSync as h6,mkdirSync as nV,openSync as f6,readdirSync as tV,realpathSync as X$,rmSync as M1}from"fs";import{hostname as rV}from"os";import{dirname as w9,join as F0,resolve as oV}from"path";import{createHash as J7}from"crypto";import{unlinkSync as Z7}from"fs";import{platform as Q7}from"os";import{join as X7}from"path";var s9=K.discriminatedUnion("store",[K.strictObject({version:K.literal(1),store:K.literal("keychain")}),K.strictObject({version:K.literal(1),store:K.literal("file"),api_key:K.string().min(1).max(4096)})]),S$=($)=>X7($,"api-key.json");function F$($){let J=J7("sha256").update(`reason-connect-api-key
-${$}`).digest("hex");return new i$($2(),Q7(),J)}function B3($,J,Z=F$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(S$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof V0))throw Q}c(S$($),{version:1,store:"file",api_key:J})}function d0($,J=F$($)){if(!u(S$($)))return null;let Z=s9.parse(JSON.parse(s(S$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof V0))throw Q;throw Error("worker_api_key_unreadable")}}function a9($,J=F$($)){if(!u(S$($)))return;if(s9.parse(JSON.parse(s(S$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof V0))throw Z}Z7(S$($))}async function K3($,J){let Z;try{Z=await c9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:S0($.proxy)})}catch(Q){if(Q instanceof m0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as z7,renameSync as A7,rmSync as y$}from"fs";import{join as q0}from"path";import{createHash as Y7}from"crypto";import{realpathSync as V7,statSync as G7,unlinkSync as J2}from"fs";import{platform as B7}from"os";import{join as b0}from"path";function d($){return{state:b0(g($),"device.json"),control:b0(g($),"control.json"),lock:b0(g($),"lifecycle.lock"),socket:b0(g($),"control.sock"),daemon:b0(g($),"daemon.json"),releaseCheck:b0(g($),"release-check.json"),updateDeferral:b0(g($),"update-deferral.json"),firstHeartbeat:b0(g($),"first-heartbeat.json")}}var K7=K.object({version:K.literal(1),device_id:K.string().min(1).max(160),offer:K.unknown().optional(),enrollment_ms:K.number().int().nonnegative().max(n$).optional()});function n9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function U3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=K7.safeParse(JSON.parse(s(Z)));if(J2(Z),!Q.success||Q.data.device_id!==J)return null;let X=Z2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=b0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?H3($):new N3(g($))}function Q2($,J){T0($,!0),H7($);let Z=J??H3($),Q=new N3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof V0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function H3($){return new i$($2(),B7(),N7($))}function N7($){let J=q3($);return Y7("sha256").update(`reason-worker
-${J?.directory??g($)}`).digest("hex")}function D1($,J){c(b0(g($),W1),{version:1,directory:q3($)?.directory??g($),devicePublicKey:J})}var W1="keychain-scope.json";function t9($){return u(b0(g($),W1))}var U7=K.strictObject({version:K.literal(1),directory:K.string().min(1),devicePublicKey:K.string().min(1)});function q3($){let J=b0(g($),W1);if(!u(J))return null;let Z=U7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function H7($){let J=b0(g($),W1);if(!u(J))return;if(q3($))try{let Z=H3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof V0))throw Z}J2(J)}function K$($){let J=V7($.workspaceRoot);if(J!==$.workspaceRoot||!G7(J).isDirectory()||!j1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function o($){if(!u(g($)))return null;let J=b$(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&i9($.apiOrigin,J.apiOrigin),Q=Z?[N0($),N0({...$,apiOrigin:J.apiOrigin})]:[N0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var r9=K.strictObject({version:K.literal(1),drained:K.boolean(),revoked:K.boolean()});function $0($){let J=d($).control;return u(J)?r9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function R0($,J){c(d($).control,r9.parse(J))}function w0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=b0(g($),W1);if(u(Z))J2(Z);let Q=d($).state;if(u(Q))J2(Q)}var q7=K.strictObject({read:K.boolean(),write:K.boolean(),execute:K.boolean(),discover_environment:K.boolean(),expose_mcp:K.literal(!1)}),M3=K.strictObject({version:K.literal(1),organization_id:K.string().min(1).max(160),enrollment_ticket:K.string().min(1).max(4096),code_verifier:K.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/),root:K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),permissions:q7,execution_mode:K.enum(["confined","host"]).default("confined")}),folders:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),M7=K.object({device_id:K.string().min(1).max(160),organization_id:K.string().min(1).max(160),auth_scheme:K.literal("p256"),protocol_version:K.literal(2),roots:K.array(K.object({id:K.string().min(1),label:K.string(),path_fingerprint:K.string()})).min(1).max(32),headless:K.object({lifecycle:K.enum(["persistent","ephemeral"]),expires_at:K.iso.datetime({offset:!0})}),first_heartbeat:K.unknown().optional()}),T3=30000;class r0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function T7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(T3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new r0(X?.error==="device_revoked")}return Q.json()}async function L3($,J,Z,Q){v0();let X=M3.parse(JSON.parse(s(J)));return o0($,X,Z,Q)}async function o0($,J,Z,Q=(Y,V)=>T7(Y,V,S0($.proxy)),X=performance.now()){let Y=e9($,J,Z),V=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(V,X)}async function o9($,J,Z,Q,X=performance.now()){let Y=e9($,J,Z),V=await Q(Y.request,J.code_verifier);return V===null?null:Y.receipt(V,X)}function e9($,J,Z){if(v0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=w$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((B,U)=>{let M=w$([B],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(M.path!==B||M.pathFingerprint!==J.folders?.[U]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return M});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],V;try{V=Z.loadPublicKey()}catch{V=Z.createFreshPublicKey()}return{request:{device_public_key:V,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((B)=>({label:B.label,path_fingerprint:B.pathFingerprint,permissions:J.root.permissions}))},receipt(B,U){let M=M7.parse(B);if(M.organization_id!==J.organization_id||M.roots.length!==Y.length||M.roots.some((H,q)=>H.path_fingerprint!==Y[q].pathFingerprint)||M.headless.lifecycle!==$.lifetime||Date.parse(M.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let G=Z2(M.first_heartbeat);try{n9($,M.device_id,{...G?{offer:G}:{},enrollmentMs:Math.min(n$,Math.max(0,Math.round(performance.now()-U)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:M.organization_id,deviceId:M.device_id,devicePublicKey:V,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:N0($),lifetime:$.lifetime,expiresAt:M.headless.expires_at},roots:M.roots.map((H,q)=>({id:H.id,label:H.label,path:Y[q].path,pathFingerprint:H.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as L7,randomUUID as F7}from"crypto";import{unlinkSync as _7}from"fs";import{join as j7}from"path";var Z4=K.strictObject({version:K.literal(1),install_id:K.uuid(),fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/)}),D7=K.object({enrollment_ticket:K.string().min(1).max(4096),expires_at:K.iso.datetime({offset:!0}),device_kind:K.literal("headless"),lifecycle:K.enum(["persistent","ephemeral"]),device_expires_at:K.iso.datetime({offset:!0})});function F3($){return D7.parse($)}var W7=K.object({credentialKind:K.enum(["oauth","api_key"]).optional(),apiOrigin:K.url(),clientId:K.string(),accessToken:K.string().min(1).max(32768),refreshToken:K.string().max(32768),expiresAt:K.iso.datetime({offset:!0}),scopes:K.array(K.string().max(128)).max(128),orgId:K.string().min(1).max(160)});function _$($){return X2(z1("REASON_CLI_CHANNEL",$.channel),H0())}async function j$($,J=_$($)){if(!u(J))return null;let Z=W7.parse(JSON.parse(s(J)));if(!P0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=S0($.proxy),X=Object.assign((V,N)=>Q(V,{...N,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await J4({path:J,fetchImpl:X});if(Y&&!P0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function Q4($,J,Z){if(!P0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=D$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function X4($,J,Z,Q,X){let Y=performance.now();if(!P0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=D$($),N=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(N){let B=await o9($,V.direct(J.orgId),Q,(U,M)=>N({approval:V.request,code_verifier:M,registration:U}).catch((G)=>{throw O7(G)}),Y);if(B)return B}return o0($,V.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(V.request)),Q,X,Y)}function O7($){if(!($ instanceof m0))return $;if($.status===409)return new r0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new r0(!1);return $}var O1=($)=>j7(g($),"enrollment-install.json");function Y4($){if(u(O1($)))_7(O1($))}function D$($,{stored:J=!0}={}){v0();let Z=O1($),Q=J&&u(Z)?Z4.parse(JSON.parse(s(Z))):{version:1,install_id:F7(),fingerprint_key:L7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),V=w$([$.workspaceRoot],X,Y)[0];if(V.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let N=($.folders??[]).map((G)=>{let H=w$([G],X,Y)[0];if(H.path!==G)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:H.pathFingerprint}}),B=$4(),U={install_id:Q.install_id,code_challenge:B.challenge,lifecycle:$.lifetime,roots:[V.pathFingerprint,...N.map((G)=>G.path_fingerprint)].map((G)=>({path_fingerprint:G,permissions:X,execution_mode:$.executionMode}))},M=(G)=>({version:1,organization_id:G,code_verifier:B.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:V.pathFingerprint,permissions:X,execution_mode:$.executionMode},...N.length?{folders:N}:{}});return{request:U,saveInstall(G){e(g(G),!0),c(O1(G),Q)},complete(G,H){let q=F3(H);if(q.lifecycle!==$.lifetime||Date.parse(q.expires_at)<=Date.now()||Date.parse(q.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...M(G),enrollment_ticket:q.enrollment_ticket}},direct:M}}function V4($,J,Z){let Q=O1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=Z4.parse(JSON.parse(s(Q)));return w$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var Y2=8,N4=600000,U4=15000,G4=new Set(["device_revoked","invalid_device_credential"]),V2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,N$=($)=>q0(g($),"workspaces"),H4="account.json",_3=($)=>u(q0($,H4));function y0($){let J;try{J=z7(N$($))}catch{return[]}return J.filter((Z)=>V2.test(Z)).sort().map((Z)=>{let Q=q0(N$($),Z),X=q0(Q,"worker.json"),Y=null;try{let V=J0.safeParse(JSON.parse(s(X)));if(V.success&&V.data.stateDirectory===Q)Y=V.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:_3(Q)}})}function G2($,J){let Z=J.toLowerCase();if(!V2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(N$($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,H4),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function B2($,J){try{let{config:Z,configPath:Q}=G2($,J);e(g(Z),!0),R0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function A1($,J){let Z=J.toLowerCase(),Q=null;try{Q=o($)?.orgId.toLowerCase()??null}catch{}return Q===Z||y0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var j3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function B4($,J){let Z=o($);if(!Z?.worker)throw Error("worker_identity_missing");D1($,Z.devicePublicKey),e(g(J),!0);for(let Y of j3)y$(q0(g(J),Y),{force:!0});for(let Y of j3){let V=q0(g($),Y);if(u(V))A7(V,q0(g(J),Y))}let Q=T0(J),X=b$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");k0({...X,worker:{...X.worker,configDigest:N0(J)}},d(J).state,{proofStore:Q})}function D3($){for(let J of y0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))w0(J.config)}catch{}y$(J.directory,{recursive:!0,force:!0})}y$(O3($),{force:!0})}function K2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(G)=>Number(Date.parse(G.worker?.expiresAt??"")>X+60000),N=y0($).flatMap((G)=>{if(!G.account||!G.config)return[];try{if($0(G.config).revoked)return[];let H=o(G.config);return H&&H.orgId.toLowerCase()===G.organizationId&&(!Q||Y(H))?[{...G,config:G.config,state:H}]:[]}catch{return[]}}).sort((G,H)=>Number(H.organizationId===J)-Number(G.organizationId===J)||Y(H.state)-Y(G.state))[0];if(!N)return null;let B=null;try{B=$0($).revoked?null:o($)}catch{}let U=B?.orgId.toLowerCase()??"";if(Z&&B&&V2.test(U)&&U!==N.organizationId){let G=G2($,U);B4($,G.config),c(G.configPath,G.config)}else if(u(g($))){try{if(u(d($).state))w0($)}catch{}for(let G of j3)y$(q0(g($),G),{force:!0})}D3($);let M=J0.parse({...N.config,stateDirectory:$.stateDirectory});return B4(N.config,M),c(q0($.stateDirectory,"worker.json"),M),y$(N.directory,{recursive:!0,force:!0}),M}var W3={before($){for(let{config:J}of y0($))try{let Z=J?o(J):null;if(J&&Z)D1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of y0(J)){if(Y)continue;try{let V=J0.parse(JSON.parse(s(X)));if(V.stateDirectory!==q0(N$($),Z))continue;let N=J0.parse({...V,stateDirectory:Q}),B=T0(N),U=b$(d(N).state,{proofStore:B,repair:!1});if(U?.worker?.configDigest===N0(V))k0({...U,worker:{...U.worker,configDigest:N0(N)}},d(N).state,{proofStore:B});c(X,N)}catch{}}}},O3=($)=>q0(N$($),"listed.json");function q4($){try{let J=JSON.parse(s(O3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function M4($,J){let Z=y0($),Q=Z.filter((B)=>B.account),X=Z.filter((B)=>!B.account),Y=q4($),V=Y&&!Y.listed?Y.reason:null,N=V||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&N.length===0&&(V||Y&&!Y.listed))return{workspaces:null,off:V};return{off:V,workspaces:[...Q,...N].map(({organizationId:B,config:U,account:M})=>{let G=!1,H=null,q=!1,T=null;try{G=U?$0(U).revoked:!1,H=U&&!G?o(U):null;let L=U?t$(d(U).daemon):null;q=J&&!!H&&L?.state==="connected",T=q?K4(L,H):null}catch{}return{...T?{permission_recovery:T}:{},organization_id:B,device_id:H?.deviceId??null,name:Y?.names?.[B]??null,root:H?.roots[0]?{id:H.roots[0].id,permissions:H.roots[0].permissions}:null,state:G?"removed":q?"connected":"not_running",blocked:!M&&!G&&!q&&(Y?.blocked.includes(B)??!1),...M?{account:!0}:{}}})}}function T4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),V=new Map,N=null,B=!1,U=q4(J)??{listed:!1,reason:null,blocked:[]},M=(_)=>{let{folders:D,...R}=J,E=Z.roots.slice(1).map((P)=>P.path);return J0.parse({...R,...E.length?{folders:E}:{},stateDirectory:q0(N$(J),_)})},G=async(_)=>{let D=V.get(_);if(!D)return;D.controller.abort(),await D.done},H=(_,D=!1)=>{let R=new AbortController,E=()=>R.abort();if(X.addEventListener("abort",E,{once:!0}),X.aborted)R.abort();let P={..._,controller:R,claims:0,done:Promise.resolve(),account:D};P.done=$.serve(_,R.signal,(I)=>{P.claims=I}).then(()=>{return},(I)=>{if(D&&I instanceof L0&&I.status===401&&G4.has(I.code)){try{R0(_.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${_.organizationId} (another account's) no longer accepts this computer (${I.code}); run \`reason connect\` signed in as that account to connect it again
+import{r as v0}from"./vm-hands-entry-lite-jb2sr2r7.js";import{v as n1,x as b6,y as c9}from"./vm-hands-entry-lite-nhtb458c.js";import{A as X2,B as S6,C as $4,D as J4,E as B6,F as m0,J as K6,K as A$}from"./vm-hands-entry-lite-mh0xecf3.js";import{V as g2,oa as e0,ra as u1,ta as BJ}from"./vm-hands-entry-lite-jpq28ncg.js";import{Ba as v5,Ca as g5,Da as e4,Ea as $8,Fa as OJ,Ga as zJ,Ha as _9,Ia as d8,Ja as Q8,Ka as L0,La as I1,Ma as C1,Na as I0,Oa as g1,Pa as p8,Qa as N5,Ra as f3,Sa as t8,Wa as r8,cb as PJ,db as IJ,eb as CJ,fb as EJ,gb as D9}from"./vm-hands-entry-lite-ha8fgq32.js";import{$b as DJ,Ab as x8,Bb as J8,Cb as Z8,Db as LJ,Eb as FJ,Gb as u,Hb as e,Ib as s,Jb as c,Kb as H8,Lb as jJ,Mb as N1,Pb as t2,Qb as r2,Rb as I6,Sb as C6,Tb as E6,Ub as S0,Vb as J0,Wb as g,Xb as j9,Yb as j1,Zb as i1,_b as N0,ec as V5,gc as S4,ib as aJ,jc as I2,lb as L8,lc as u8,mb as F8,mc as i3,oc as S8,pb as U8,rb as A8,sc as WJ,tc as l3,ub as R8,zb as E8}from"./vm-hands-entry-lite-m9awmyqz.js";import{xc as X8}from"./vm-hands-entry-lite-dcynw6t2.js";import{Ec as g8}from"./vm-hands-entry-lite-sb9a1jcn.js";import{Jc as P8,Kc as I8,Rc as C8}from"./vm-hands-entry-lite-anmv8hp7.js";import{Sc as H$}from"./vm-hands-entry-lite-g9rvf5qk.js";import{id as o4}from"./vm-hands-entry-lite-00qsbphw.js";import{Ad as d5,td as c8,wd as AJ,zd as u5}from"./vm-hands-entry-lite-g9sz0618.js";import{Dd as p$,Fd as Q$,Gd as R$,Hd as U1,Jd as N6,Kd as w6,Ld as y6,Nd as H1,Od as k6,Pd as b9,Qd as h6,Rd as s2,Sd as M$,Td as A4,Ud as a2}from"./vm-hands-entry-lite-pt4r24ky.js";import{cf as r4,kf as Q6,lf as n$,ue as L2,vf as Z2,ye as MJ,ze as TJ}from"./vm-hands-entry-lite-zfwg7ehq.js";import{If as x6,Jf as m2,Mf as RJ,Pf as w1,Rf as $7,Sf as J7,Xf as n8}from"./vm-hands-entry-lite-t535zmjz.js";import{jg as V0,kg as $2,lg as bJ,mg as wJ,ng as i$,og as N3,pg as z2,qg as K4,sg as A2,tg as b$,ug as k0,vg as t$,wg as R2,zg as w$}from"./vm-hands-entry-lite-dgxxsdwb.js";import{Cg as d1,Dg as v8}from"./vm-hands-entry-lite-zh8p7ndn.js";import{Ig as z8}from"./vm-hands-entry-lite-za55dtte.js";import{Zh as Z$,bi as W$,ci as P0,di as i9,ei as A6,fi as R6,hi as q2,ii as P6,ji as T9,ki as O4,li as z4,mi as r$}from"./vm-hands-entry-lite-5kgvss4p.js";import{ni as v1,oi as z1}from"./vm-hands-entry-lite-r6pap1kh.js";import{Li as j6,Ti as l8,Ui as L9,Wi as Y8}from"./vm-hands-entry-lite-z4hpfwbj.js";import{Yi as H0,_i as YJ}from"./vm-hands-entry-lite-c01eyep6.js";import{wj as r}from"./vm-hands-entry-lite-fysena9h.js";import{Vj as K}from"./vm-hands-entry-lite-hc3p6r9p.js";import{Yj as _J}from"./vm-hands-entry-lite-bvbfcp1k.js";import{bk as h0}from"./vm-hands-entry-lite-j2q1k9vb.js";import{hk as tV}from"./vm-hands-entry-lite-g036gtem.js";import{spawn as f6,spawnSync as rV}from"child_process";import{closeSync as m6,mkdirSync as oV,openSync as v6,readdirSync as eV,realpathSync as X$,rmSync as M1}from"fs";import{hostname as $G}from"os";import{dirname as w9,join as F0,resolve as JG}from"path";import{createHash as Q7}from"crypto";import{unlinkSync as X7}from"fs";import{platform as Y7}from"os";import{join as V7}from"path";var s9=K.discriminatedUnion("store",[K.strictObject({version:K.literal(1),store:K.literal("keychain")}),K.strictObject({version:K.literal(1),store:K.literal("file"),api_key:K.string().min(1).max(4096)})]),S$=($)=>V7($,"api-key.json");function F$($){let J=Q7("sha256").update(`reason-connect-api-key
+${$}`).digest("hex");return new i$($2(),Y7(),J)}function B3($,J,Z=F$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(S$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof V0))throw Q}c(S$($),{version:1,store:"file",api_key:J})}function d0($,J=F$($)){if(!u(S$($)))return null;let Z=s9.parse(JSON.parse(s(S$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof V0))throw Q;throw Error("worker_api_key_unreadable")}}function a9($,J=F$($)){if(!u(S$($)))return;if(s9.parse(JSON.parse(s(S$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof V0))throw Z}X7(S$($))}async function K3($,J){let Z;try{Z=await c9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:S0($.proxy)})}catch(Q){if(Q instanceof m0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as R7,renameSync as P7,rmSync as y$}from"fs";import{join as q0}from"path";import{createHash as G7}from"crypto";import{realpathSync as B7,statSync as K7,unlinkSync as J2}from"fs";import{platform as N7}from"os";import{join as b0}from"path";function d($){return{state:b0(g($),"device.json"),control:b0(g($),"control.json"),lock:b0(g($),"lifecycle.lock"),socket:b0(g($),"control.sock"),daemon:b0(g($),"daemon.json"),releaseCheck:b0(g($),"release-check.json"),updateDeferral:b0(g($),"update-deferral.json"),firstHeartbeat:b0(g($),"first-heartbeat.json")}}var U7=K.object({version:K.literal(1),device_id:K.string().min(1).max(160),offer:K.unknown().optional(),enrollment_ms:K.number().int().nonnegative().max(n$).optional()});function n9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function U3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=U7.safeParse(JSON.parse(s(Z)));if(J2(Z),!Q.success||Q.data.device_id!==J)return null;let X=Z2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=b0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?H3($):new N3(g($))}function Q2($,J){T0($,!0),M7($);let Z=J??H3($),Q=new N3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof V0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function H3($){return new i$($2(),N7(),H7($))}function H7($){let J=q3($);return G7("sha256").update(`reason-worker
+${J?.directory??g($)}`).digest("hex")}function D1($,J){c(b0(g($),W1),{version:1,directory:q3($)?.directory??g($),devicePublicKey:J})}var W1="keychain-scope.json";function t9($){return u(b0(g($),W1))}var q7=K.strictObject({version:K.literal(1),directory:K.string().min(1),devicePublicKey:K.string().min(1)});function q3($){let J=b0(g($),W1);if(!u(J))return null;let Z=q7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function M7($){let J=b0(g($),W1);if(!u(J))return;if(q3($))try{let Z=H3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof V0))throw Z}J2(J)}function K$($){let J=B7($.workspaceRoot);if(J!==$.workspaceRoot||!K7(J).isDirectory()||!j1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function o($){if(!u(g($)))return null;let J=b$(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&i9($.apiOrigin,J.apiOrigin),Q=Z?[N0($),N0({...$,apiOrigin:J.apiOrigin})]:[N0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var r9=K.strictObject({version:K.literal(1),drained:K.boolean(),revoked:K.boolean()});function $0($){let J=d($).control;return u(J)?r9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function R0($,J){c(d($).control,r9.parse(J))}function w0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=b0(g($),W1);if(u(Z))J2(Z);let Q=d($).state;if(u(Q))J2(Q)}var T7=K.strictObject({read:K.boolean(),write:K.boolean(),execute:K.boolean(),discover_environment:K.boolean(),expose_mcp:K.literal(!1)}),M3=K.strictObject({version:K.literal(1),organization_id:K.string().min(1).max(160),enrollment_ticket:K.string().min(1).max(4096),code_verifier:K.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/),root:K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),permissions:T7,execution_mode:K.enum(["confined","host"]).default("confined")}),folders:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),L7=K.object({device_id:K.string().min(1).max(160),organization_id:K.string().min(1).max(160),auth_scheme:K.literal("p256"),protocol_version:K.literal(2),roots:K.array(K.object({id:K.string().min(1),label:K.string(),path_fingerprint:K.string()})).min(1).max(32),headless:K.object({lifecycle:K.enum(["persistent","ephemeral"]),expires_at:K.iso.datetime({offset:!0})}),first_heartbeat:K.unknown().optional()}),T3=30000;class r0 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function F7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(T3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new r0(X?.error==="device_revoked")}return Q.json()}async function L3($,J,Z,Q){v0();let X=M3.parse(JSON.parse(s(J)));return o0($,X,Z,Q)}async function o0($,J,Z,Q=(Y,V)=>F7(Y,V,S0($.proxy)),X=performance.now()){let Y=e9($,J,Z),V=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(V,X)}async function o9($,J,Z,Q,X=performance.now()){let Y=e9($,J,Z),V=await Q(Y.request,J.code_verifier);return V===null?null:Y.receipt(V,X)}function e9($,J,Z){if(v0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=w$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((B,U)=>{let M=w$([B],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(M.path!==B||M.pathFingerprint!==J.folders?.[U]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return M});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],V;try{V=Z.loadPublicKey()}catch{V=Z.createFreshPublicKey()}return{request:{device_public_key:V,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((B)=>({label:B.label,path_fingerprint:B.pathFingerprint,permissions:J.root.permissions}))},receipt(B,U){let M=L7.parse(B);if(M.organization_id!==J.organization_id||M.roots.length!==Y.length||M.roots.some((H,q)=>H.path_fingerprint!==Y[q].pathFingerprint)||M.headless.lifecycle!==$.lifetime||Date.parse(M.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let G=Z2(M.first_heartbeat);try{n9($,M.device_id,{...G?{offer:G}:{},enrollmentMs:Math.min(n$,Math.max(0,Math.round(performance.now()-U)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:M.organization_id,deviceId:M.device_id,devicePublicKey:V,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:N0($),lifetime:$.lifetime,expiresAt:M.headless.expires_at},roots:M.roots.map((H,q)=>({id:H.id,label:H.label,path:Y[q].path,pathFingerprint:H.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as _7,randomUUID as j7}from"crypto";import{unlinkSync as D7}from"fs";import{join as W7}from"path";var Z4=K.strictObject({version:K.literal(1),install_id:K.uuid(),fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/)}),O7=K.object({enrollment_ticket:K.string().min(1).max(4096),expires_at:K.iso.datetime({offset:!0}),device_kind:K.literal("headless"),lifecycle:K.enum(["persistent","ephemeral"]),device_expires_at:K.iso.datetime({offset:!0})});function F3($){return O7.parse($)}var z7=K.object({credentialKind:K.enum(["oauth","api_key"]).optional(),apiOrigin:K.url(),clientId:K.string(),accessToken:K.string().min(1).max(32768),refreshToken:K.string().max(32768),expiresAt:K.iso.datetime({offset:!0}),scopes:K.array(K.string().max(128)).max(128),orgId:K.string().min(1).max(160)});function _$($){return X2(z1("REASON_CLI_CHANNEL",$.channel),H0())}async function j$($,J=_$($)){if(!u(J))return null;let Z=z7.parse(JSON.parse(s(J)));if(!P0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=S0($.proxy),X=Object.assign((V,N)=>Q(V,{...N,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await J4({path:J,fetchImpl:X});if(Y&&!P0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function Q4($,J,Z){if(!P0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=D$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function X4($,J,Z,Q,X){let Y=performance.now();if(!P0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=D$($),N=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(N){let B=await o9($,V.direct(J.orgId),Q,(U,M)=>N({approval:V.request,code_verifier:M,registration:U}).catch((G)=>{throw A7(G)}),Y);if(B)return B}return o0($,V.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(V.request)),Q,X,Y)}function A7($){if(!($ instanceof m0))return $;if($.status===409)return new r0($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new r0(!1);return $}var O1=($)=>W7(g($),"enrollment-install.json");function Y4($){if(u(O1($)))D7(O1($))}function D$($,{stored:J=!0}={}){v0();let Z=O1($),Q=J&&u(Z)?Z4.parse(JSON.parse(s(Z))):{version:1,install_id:j7(),fingerprint_key:_7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),V=w$([$.workspaceRoot],X,Y)[0];if(V.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let N=($.folders??[]).map((G)=>{let H=w$([G],X,Y)[0];if(H.path!==G)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:H.pathFingerprint}}),B=$4(),U={install_id:Q.install_id,code_challenge:B.challenge,lifecycle:$.lifetime,roots:[V.pathFingerprint,...N.map((G)=>G.path_fingerprint)].map((G)=>({path_fingerprint:G,permissions:X,execution_mode:$.executionMode}))},M=(G)=>({version:1,organization_id:G,code_verifier:B.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:V.pathFingerprint,permissions:X,execution_mode:$.executionMode},...N.length?{folders:N}:{}});return{request:U,saveInstall(G){e(g(G),!0),c(O1(G),Q)},complete(G,H){let q=F3(H);if(q.lifecycle!==$.lifetime||Date.parse(q.expires_at)<=Date.now()||Date.parse(q.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...M(G),enrollment_ticket:q.enrollment_ticket}},direct:M}}function V4($,J,Z){let Q=O1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=Z4.parse(JSON.parse(s(Q)));return w$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var Y2=8,N4=600000,U4=15000,G4=new Set(["device_revoked","invalid_device_credential"]),V2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,N$=($)=>q0(g($),"workspaces"),H4="account.json",_3=($)=>u(q0($,H4));function y0($){let J;try{J=R7(N$($))}catch{return[]}return J.filter((Z)=>V2.test(Z)).sort().map((Z)=>{let Q=q0(N$($),Z),X=q0(Q,"worker.json"),Y=null;try{let V=J0.safeParse(JSON.parse(s(X)));if(V.success&&V.data.stateDirectory===Q)Y=V.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:_3(Q)}})}function G2($,J){let Z=J.toLowerCase();if(!V2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(N$($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,H4),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function B2($,J){try{let{config:Z,configPath:Q}=G2($,J);e(g(Z),!0),R0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function A1($,J){let Z=J.toLowerCase(),Q=null;try{Q=o($)?.orgId.toLowerCase()??null}catch{}return Q===Z||y0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var j3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function B4($,J){let Z=o($);if(!Z?.worker)throw Error("worker_identity_missing");D1($,Z.devicePublicKey),e(g(J),!0);for(let Y of j3)y$(q0(g(J),Y),{force:!0});for(let Y of j3){let V=q0(g($),Y);if(u(V))P7(V,q0(g(J),Y))}let Q=T0(J),X=b$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");k0({...X,worker:{...X.worker,configDigest:N0(J)}},d(J).state,{proofStore:Q})}function D3($){for(let J of y0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))w0(J.config)}catch{}y$(J.directory,{recursive:!0,force:!0})}y$(O3($),{force:!0})}function K2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(G)=>Number(Date.parse(G.worker?.expiresAt??"")>X+60000),N=y0($).flatMap((G)=>{if(!G.account||!G.config)return[];try{if($0(G.config).revoked)return[];let H=o(G.config);return H&&H.orgId.toLowerCase()===G.organizationId&&(!Q||Y(H))?[{...G,config:G.config,state:H}]:[]}catch{return[]}}).sort((G,H)=>Number(H.organizationId===J)-Number(G.organizationId===J)||Y(H.state)-Y(G.state))[0];if(!N)return null;let B=null;try{B=$0($).revoked?null:o($)}catch{}let U=B?.orgId.toLowerCase()??"";if(Z&&B&&V2.test(U)&&U!==N.organizationId){let G=G2($,U);B4($,G.config),c(G.configPath,G.config)}else if(u(g($))){try{if(u(d($).state))w0($)}catch{}for(let G of j3)y$(q0(g($),G),{force:!0})}D3($);let M=J0.parse({...N.config,stateDirectory:$.stateDirectory});return B4(N.config,M),c(q0($.stateDirectory,"worker.json"),M),y$(N.directory,{recursive:!0,force:!0}),M}var W3={before($){for(let{config:J}of y0($))try{let Z=J?o(J):null;if(J&&Z)D1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of y0(J)){if(Y)continue;try{let V=J0.parse(JSON.parse(s(X)));if(V.stateDirectory!==q0(N$($),Z))continue;let N=J0.parse({...V,stateDirectory:Q}),B=T0(N),U=b$(d(N).state,{proofStore:B,repair:!1});if(U?.worker?.configDigest===N0(V))k0({...U,worker:{...U.worker,configDigest:N0(N)}},d(N).state,{proofStore:B});c(X,N)}catch{}}}},O3=($)=>q0(N$($),"listed.json");function q4($){try{let J=JSON.parse(s(O3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function M4($,J){let Z=y0($),Q=Z.filter((B)=>B.account),X=Z.filter((B)=>!B.account),Y=q4($),V=Y&&!Y.listed?Y.reason:null,N=V||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&N.length===0&&(V||Y&&!Y.listed))return{workspaces:null,off:V};return{off:V,workspaces:[...Q,...N].map(({organizationId:B,config:U,account:M})=>{let G=!1,H=null,q=!1,T=null;try{G=U?$0(U).revoked:!1,H=U&&!G?o(U):null;let L=U?t$(d(U).daemon):null;q=J&&!!H&&L?.state==="connected",T=q?K4(L,H):null}catch{}return{...T?{permission_recovery:T}:{},organization_id:B,device_id:H?.deviceId??null,name:Y?.names?.[B]??null,root:H?.roots[0]?{id:H.roots[0].id,permissions:H.roots[0].permissions}:null,state:G?"removed":q?"connected":"not_running",blocked:!M&&!G&&!q&&(Y?.blocked.includes(B)??!1),...M?{account:!0}:{}}})}}function T4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),V=new Map,N=null,B=!1,U=q4(J)??{listed:!1,reason:null,blocked:[]},M=(_)=>{let{folders:D,...R}=J,E=Z.roots.slice(1).map((P)=>P.path);return J0.parse({...R,...E.length?{folders:E}:{},stateDirectory:q0(N$(J),_)})},G=async(_)=>{let D=V.get(_);if(!D)return;D.controller.abort(),await D.done},H=(_,D=!1)=>{let R=new AbortController,E=()=>R.abort();if(X.addEventListener("abort",E,{once:!0}),X.aborted)R.abort();let P={..._,controller:R,claims:0,done:Promise.resolve(),account:D};P.done=$.serve(_,R.signal,(I)=>{P.claims=I}).then(()=>{return},(I)=>{if(D&&I instanceof L0&&I.status===401&&G4.has(I.code)){try{R0(_.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${_.organizationId} (another account's) no longer accepts this computer (${I.code}); run \`reason connect\` signed in as that account to connect it again
 `)}else if(I instanceof L0&&I.status===401&&G4.has(I.code)){try{w0(_.config)}catch{}Y(`Reason worker: workspace ${_.organizationId} no longer accepts this computer
 `)}else if(!R.signal.aborted)Y(`Reason worker: workspace ${_.organizationId} stopped (worker_workspace_failed); it starts again on the next check
 `)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",E),P.claims=0,V.get(_.organizationId)===P)V.delete(_.organizationId);let I=_.config.stateDirectory;if(D&&!_3(I)&&!u(q0(I,"worker.json")))y$(I,{recursive:!0,force:!0})}),V.set(_.organizationId,P)},q=(_,D)=>{if(!D)return null;try{let R=M(_),E=o(D);if(!E||E.orgId!==_||Date.parse(E.worker?.expiresAt??"")<=Date.now()+60000||D.name!==R.name||D.executionMode!==R.executionMode||!P0(D.apiOrigin,R.apiOrigin)||E.roots.map((P)=>P.path).join(`
@@ -10,18 +10,18 @@ ${J?.directory??g($)}`).digest("hex")}function D1($,J){c(b0(g($),W1),{version:1,
 `)}for(let A of C){if(X.aborted)return!0;if(E(A))continue;try{let y=V.get(A);if(f.get(A)){if(y&&y.claims===0)await G(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
 `);continue}let b=q(A,R.get(A)?.config??null);if(b&&y)continue;if(!b){if(y&&y.claims>0)continue;if(await G(A),b=await W(A),b)Y(`Reason worker: connected in workspace ${A}
 `)}if(b&&!X.aborted)H(b)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
-`)}}return!0},F=null,z=async()=>{let _=!1;do B=!1,_=await O().catch(()=>!1);while(B&&!X.aborted);let D=JSON.stringify({version:1,...U});if(F!==D)try{e(N$(J),!0),c(O3(J),JSON.parse(D)),F=D}catch{}return _};return{check(){if(N)B=!0;else N=z().finally(()=>{N=null});return N},claims:()=>[...V.values()].reduce((_,D)=>_+D.claims,0),async settled(){await N,await Promise.all([...V.values()].map((_)=>_.done))}}}import{dirname as R7}from"path";function _4($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!P7($.saved))return J;let Z=$.saved,Q=(V,N)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:V,...N?{code:`worker_api_origin_move_${V}:${N}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?r$():$.native;if(!X)return J;let Y=[];try{let V=X.lock(R7($.configPath));if(!V)return J;if(Y.push(V),u(g(Z))){let M=e0({path:d(Z).lock,runtimeVersion:r});if(!M.acquired)return J;Y.push(()=>M.release())}let N=J0.parse(JSON.parse(s($.configPath)));if(N.stateDirectory!==Z.stateDirectory)return J;let B=j4(N),U={saved:N,configPath:$.configPath};if(!N2(N)&&B.length===0)return Q("unchanged"),U;if(N2(N)){let M=L4(N);c($.configPath,M),U={saved:M,configPath:$.configPath}}for(let M of B)try{c(M.configPath,L4(M.config))}catch(G){Q("failed",`workspace:${F4(G)}`)}return Q("moved"),U}catch(V){return Q("failed",F4(V)),J}finally{for(let V of Y.reverse())V()}}function N2($){return W$($.apiOrigin)!==$.apiOrigin}function j4($){return y0($).filter((J)=>J.config!==null&&N2(J.config))}function P7($){return N2($)||j4($).length>0}function L4($){let J=J0.parse({...$,apiOrigin:W$($.apiOrigin)}),Z=o($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=N0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)k0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function F4($){if($ instanceof V0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as I7,lstatSync as R3,readdirSync as R4,readlinkSync as C7,unlinkSync as E7}from"fs";import{join as D0,sep as x7}from"path";var U2="rehome.json";class H2 extends Error{code;constructor($){super($);this.code=$}}function P4($){let J={saved:$.saved,configPath:$.configPath},Z=D0($.home,".config"),Q=D0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=D0(Q,...X),V=D0(Z,"reason",...X),N=(G,H)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:G,...H?{code:`worker_state_rehome_${G}:${H}`}:{},timestamp:new Date().toISOString()})),B=$.native===void 0?r$():$.native,U=$.saved,M=[];try{if(U&&W4(Q)&&U.stateDirectory===Y){let W={...U,stateDirectory:V};if(!z3(B,V,W,M))return J;return D4(U,W,$.host,N)}if(U&&W4(Q)&&U.stateDirectory===V&&t9(U)&&z3(B,V,U,M))return I4({...U,stateDirectory:Y},U,$.host),J;if(!U||U.lifetime!=="persistent"||U.stateDirectory!==Y||!o$(Q)?.isDirectory())return J;if(h7(Y)===r)return J;let H=(W,O=!0)=>{if(O)c(D0(Y,U2),{version:r});return N("skipped",W),J},q=[Y];for(let W of b7(Q,Y)){if(W.config?.lifetime!=="ephemeral")return H("several_connections");if(!S7(W.directory,W.config,M))return H("once_running",!1);q.push(W.directory)}if(!B)return H("config_rename_unavailable:no_native");if(!z3(B,Y,U,M))return J;let T=o(U);if(!T||$0(U).revoked)return J;if(O4(Z)!==null)return H("conflicting_identity");if(z4(Z)!==null)return H("conflicting_files");if(o$(V)&&(!o$(V).isDirectory()||R4(V).length>0))return H("connection_folder_taken");D1(U,T.devicePublicKey),W3.before(U);let L=d0(Y);if(L&&A3(Y))w7(V,L);let j=q2(Z,B,q);if(j.state!=="renamed"&&j.state!=="linked"){if(L&&A3(Y))C4(V);return H(j.problem??"config_folder_kept")}return D4(U,{...U,stateDirectory:V},$.host,N)}catch(G){try{if(o$(Y)?.isDirectory())c(D0(Y,U2),{version:r})}catch{}return N("failed",f7(G)),k7(U,Y,V,J)}finally{for(let G of M.reverse())G()}}function D4($,J,Z,Q){let X=R3(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)I7(J.stateDirectory,448);let Y=T0(J),V=b$(d(J).state,{proofStore:Y,repair:!1});if(!V?.worker)throw new H2("identity_missing");let N=N0(J);if(V.worker.configDigest===N0($))k0({...V,worker:{...V.worker,configDigest:N}},d(J).state,{proofStore:Y});else if(V.worker.configDigest!==N)throw new H2("worker_config_binding_mismatch");c(D0(J.stateDirectory,"worker.json"),J),W3.after($,J),I4($,J,Z);let B=D0(J.stateDirectory,U2);if(u(B))E7(B);return Q("moved"),{saved:J,configPath:D0(J.stateDirectory,"worker.json")}}function I4($,J,Z){if(A4($,J,Z,"connect"),!A3(J.stateDirectory))return;let Q=y7(F$($.stateDirectory));if(!Q)return;let X=F$(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);C4($.stateDirectory)}function z3($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=e0({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function S7($,J,Z){if(u(g(J))){let X=e0({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=o$(D0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function b7($,J){let Z=[$,...R4($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>D0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let V=D0(X,Y);if(V===J||!o$(D0(V,"worker.json")))continue;let N=E4(V);if(!N||N.stateDirectory===$||N.stateDirectory.startsWith($+x7))Q.push({directory:V,config:N})}return Q}function A3($){try{return JSON.parse(s(D0($,"api-key.json"))).store==="keychain"}catch{return!1}}function w7($,J){let Z=F$($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function C4($){try{F$($).deleteBinding()}catch(J){if(!(J instanceof V0))throw J}}function y7($){try{return $.loadBinding()}catch(J){if(J instanceof V0)return null;throw J}}function k7($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=E4(Z);return X?.stateDirectory===Z?{saved:X,configPath:D0(Z,"worker.json")}:Q}function W4($){try{return R3($).isSymbolicLink()&&C7($)==="reason"}catch{return!1}}function h7($){try{let J=JSON.parse(s(D0($,U2)));return typeof J.version==="string"?J.version:null}catch{return null}}function E4($){try{let J=D0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function o$($){try{return R3($)}catch{return null}}function f7($){if($ instanceof H2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof V0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as m7}from"fs";function M2($){try{let J=JSON.parse(m7(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function x4($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as AV}from"crypto";import{readdirSync as RV,realpathSync as K6,statSync as PV}from"fs";import{hostname as IV}from"os";import{join as c$,resolve as CV}from"path";var T2="cloud",v7=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function R1($){return v7.test($)&&!S4.test($)}var g7={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function e$($){return g7[$]}import{chmodSync as u7,lstatSync as F2,mkdtempSync as d7,realpathSync as k4,rmdirSync as p7,rmSync as l7,unlinkSync as c7}from"fs";import{createConnection as s7,createServer as a7}from"net";import{basename as b4,dirname as w4,join as k$}from"path";var i7=K.enum(["status","drain","resume","stop","reload_roots"]),n7=K.strictObject({version:K.literal(1),instanceId:K.string(),deviceId:K.string(),phase:K.enum(["starting","running","reconnecting","stopping"]),drained:K.boolean(),activeClaims:K.number().int().nonnegative(),activeSessions:K.number().int().nonnegative().optional(),executionEligible:K.boolean(),supportedOperations:K.array(K.enum(L2)).max(L2.length).optional(),capabilityReadiness:K.partialRecord(K.enum(L2),K.boolean()).optional(),lastHeartbeat:K.string().nullable(),expiresAt:K.string()}),t7=K.strictObject({nonce:K.string(),action:i7}),r7=K.object({nonce:K.uuid()}),h4=K.strictObject({version:K.literal(1),nonce:K.uuid(),socketPath:K.string().max(100)});function f4($){return k$(d($).lock,"control.json")}function _2($){return e(d($).lock),r7.parse(JSON.parse(s(k$(d($).lock,"owner.json"))))}function y4($){if(!u($))return!1;let J=F2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function m4($,J){let Z=f4($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!F2(Y).isSocket())return null;return y4(Y)?Y:null}let Q=h4.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=w4(Q.socketPath);if(w4(X)!==k4("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(b4(X))||b4(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),y4(Q.socketPath)?Q.socketPath:null}async function j2($,J,Z){if(_2($).nonce!==J)throw Error("worker_instance_changed");let Q=f4($);if(u(Q))throw Error("worker_control_already_serving");let X=d7(k$(k4("/tmp"),"ara-worker-")),Y=k$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let V=new Set,N=a7((G)=>{V.add(G),G.once("close",()=>V.delete(G)),G.setTimeout(2000,()=>G.destroy());let H="",q=!1;G.on("error",()=>G.destroy()),G.on("data",(T)=>{if(q)return;if(H+=T.toString(),Buffer.byteLength(H)>4096){G.destroy();return}if(!H.includes(`
-`))return;q=!0;try{let L=t7.parse(JSON.parse(H));if(L.nonce!==J){G.destroy();return}G.end(JSON.stringify(Z(L.action))+`
-`)}catch{G.destroy()}})});N.maxConnections=32;let B,U=!1,M=async()=>{if(U)return;U=!0;for(let G of V)G.destroy();if(await new Promise((G)=>N.close(()=>G())),B&&u(Q)){let G=F2(Q);if(G.isFile()&&G.dev===B.dev&&G.ino===B.ino)try{let H=h4.parse(JSON.parse(s(Q)));if(H.nonce===J&&H.socketPath===Y)c7(Q)}catch{}}try{p7(X)}catch{}};try{if(await new Promise((G,H)=>{N.once("error",H),N.listen(Y,()=>{u7(Y,384),G()})}),_2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),B=F2(Q),M}catch(G){throw await M(),G}}function v4($,J){try{let Z=JSON.parse(s(k$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function P1($){return v4($,"runtime_version")}function o7($){return v4($,"nonce")}function g4($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(k$(d($).lock,"owner.json")))return"no_lock";return m4($,_2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var e7=21600000,$Z=K.strictObject({instance:K.string().nullable(),since:K.number().int().nonnegative()});function JZ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=$Z.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;P3($)}catch{}return null}function P3($){try{l7(d($).updateDeferral,{force:!0})}catch{}}async function D2($,J,Z=()=>!1){let Q=o7($),X=JZ($,Q);if(J!==void 0){let U=P1($);if(U===null||U===J&&X===null&&!Z())return{state:"current"}}let Y;try{let U=await K0($,"status");Y=U?U.activeSessions??U.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let V=Date.now(),N=X;if(N===null){N=V;try{c(d($).updateDeferral,{instance:Q,since:N})}catch{}}let B=V-N;return{state:B<e7?"busy":"drained",sessions:Y,waitedMs:B}}async function K0($,J){let Z=d($);if(!u(k$(Z.lock,"owner.json")))return null;let Q=_2($),X=m4($,Q.nonce);if(!X)return null;return new Promise((Y,V)=>{let N=s7(X),B="",U=!1,M=(G,H)=>{if(U)return;if(U=!0,N.destroy(),H)V(H);else Y(G)};N.setTimeout(2000,()=>N.destroy(Error("worker_control_timeout"))),N.on("connect",()=>N.write(JSON.stringify({nonce:Q.nonce,action:J})+`
-`)),N.on("data",(G)=>{if(B+=G.toString(),Buffer.byteLength(B)>16384)N.destroy(Error("worker_control_oversize"))}),N.on("error",(G)=>{if("code"in G&&["ECONNREFUSED","ENOENT"].includes(String(G.code)))M(null);else M(null,G.message==="worker_control_timeout"?G:Error("worker_control_unavailable"))}),N.on("end",()=>{try{let G=n7.parse(JSON.parse(B));if(G.instanceId!==Q.nonce)throw Error("worker_instance_changed");M(G)}catch{M(null,Error("worker_control_invalid_response"))}}),N.once("close",()=>M(null,Error("worker_control_unavailable")))})}import{randomUUID as VY}from"crypto";import{homedir as BJ}from"os";import{spawn as ZZ}from"child_process";async function u4($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,V=Promise.resolve(),N=(G)=>{if(Q===G)return;Q=G,J.onStatusChange?.(G)},B=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,V=U()},J.retryMs??5000),Y.unref()},U=async()=>{try{let G=(J.spawn??ZZ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=G,G.once("exit",()=>{if(!X&&Z===G)N("failed"),B()}),await new Promise((H,q)=>{G.once("spawn",H),G.once("error",q)}),G.exitCode===null&&G.signalCode===null)N("held")}catch{N("failed"),B()}};V=U(),await V;let M;return{get status(){return Q},release(){return M??=(async()=>{X=!0,clearTimeout(Y),await V;let G=Z;if(!G||G.exitCode!==null||G.signalCode!==null||!G.pid)return Q="failed","released";let H=await new Promise((q)=>{let T,L=setTimeout(()=>{try{G.kill("SIGKILL")}catch{}T=setTimeout(()=>q("failed"),1000)},1000);G.once("exit",()=>{clearTimeout(L),clearTimeout(T),q("released")});try{G.kill("SIGTERM")}catch{}});if(H==="released")Q="failed";return H})()}}}class $1 extends Error{constructor(){super("Reason Device operation lease expired.")}}class W2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new $1;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new $1;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new $1)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as GZ}from"fs";import{randomUUID as BZ}from"crypto";import{constants as I3}from"fs";import{open as QZ}from"fs/promises";import{join as XZ}from"path";var YZ={platform:process.platform,home:H0,async openFile($){let J=await QZ($,I3.O_RDONLY|I3.O_NOFOLLOW|I3.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function d4($=YZ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(XZ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class C3 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function VZ($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,V=new Promise((N,B)=>{X=()=>{Q.abort(J.reason),B(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let U=new C3;Q.abort(U),B(U)},Z)});try{return await Promise.race([$(Q.signal),V])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function p4($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await VZ($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof C3||(X instanceof L0?I1(X.status):C1(X));if(Y){let V=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+V}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function m3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}function V8($,J,Z){let Q=$?.permissionRecovery;return z2(Q,Z)&&Q.deviceId===J.deviceId&&Q.organizationId===J.orgId?{permissionRecovery:Q}:{}}var KZ=1000,NZ=250,UZ=Y8(GZ(process.execPath)),l4=null,c4=null;function G8($){if(process.platform!=="darwin")return{};return c4??=d4().then((J)=>{l4={status:J,checkedAt:$().getTime()}}).finally(()=>{c4=null}),{fullDiskAccess:{...l4??{status:"unknown",checkedAt:$().getTime()},executablePath:UZ}}}var HZ=8,qZ=64,MZ=2000,TZ=2000,v3=8000,s4=3,LZ=250,a4=1000,i4=30000,FZ=0.2,_Z=30000,jZ=21600000,DZ=300000,WZ=3600000,OZ=0.1,B8=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function zZ($){return Math.min(s4,Math.max(1,$??s4))}function AZ($){return typeof $.reason_code==="string"&&B8.has($.reason_code)?$.reason_code:"cancelled"}function E3($){return $.reason instanceof h0&&($.reason.code==="cancelled"||B8.has($.reason.code))?$.reason.code:"cancelled"}function n4($){return $ instanceof h0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function K8($){return $.capability==="hands.connect"&&(Z8($.payload)||J8($.payload))}function x3($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*OZ)))}function RZ($,J=Math.random){let Z=Math.min(i4,a4*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*FZ*(Q*2-1);return Math.min(i4,Math.max(a4,Math.round(Z+X)))}function g3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class S3 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function PZ($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function b3($){return $ instanceof Error?$.message:String($)}function w3($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function i0($){return $ instanceof L0&&$.status===409&&$.code==="attempt_fenced"}function y3($){return $.capability==="environment.install"}function IZ($){if($ instanceof P2||$ instanceof $1||$ instanceof x1)return"timeout";if(!($ instanceof Error)||$ instanceof L0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof L0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function E1($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(i0(Z))return;let Q=Z instanceof L0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:IZ(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function J1($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)E1($,J,Q);throw Q}}class x1 extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function k3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":o4(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:y3(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,V=Q?AbortSignal.any([Q,Y.signal]):Y.signal,N=$.sleep??g3,B=$.operationCompletionTimeoutMs??v3,U=performance.now()+B,M,G,H=new Promise((L,j)=>{let W=()=>{let F=new x1;Y.abort(F),j(F)},O=(F)=>{clearTimeout(M),M=setTimeout(W,F)};if(G=()=>O(Math.max(0,Math.min(U-performance.now(),MZ))),O(B),$.signal.addEventListener("abort",G,{once:!0}),$.signal.aborted)G()}),q,T=0;try{while(!0)try{q=await Promise.race([$.client.completeOperation($.state,J,X,V),H]);break}catch(L){if(V.aborted||$.signal.aborted||I0(L)||i0(L)||!CZ(L)||performance.now()>=U)throw E1($,"completion",L),L;T+=1;let j=Math.min(500*2**Math.min(T-1,4),Math.max(0,U-performance.now()));if(j<=0)throw E1($,"completion",L),L;try{await N(j,V)}catch{throw E1($,"completion",L),L}}}finally{clearTimeout(M),$.signal.removeEventListener("abort",G),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:q.status})}function CZ($){if(I0($))return!1;if(i0($))return!1;if($ instanceof L0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof x1)return!1;return!0}return!1}class P2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function O2($){if($ instanceof P2)return!0;return $ instanceof L0?I1($.status):C1($)}function h3($,J){if(!($ instanceof L0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function EZ($,J,Z,Q,X){let Y=new AbortController,V,N=()=>{return},B=new Promise((M,G)=>{let H=()=>{let q=Q.reason??new DOMException("Aborted","AbortError");Y.abort(q),G(q)};if(N=()=>Q.removeEventListener("abort",H),Q.aborted)H();else Q.addEventListener("abort",H,{once:!0})}),U=new Promise((M,G)=>{V=setTimeout(()=>{let H=new P2;Y.abort(H),G(H)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),B,U])}finally{if(V!==void 0)clearTimeout(V);N()}}async function t4($,J,Z,Q,X,Y){let V=zZ($.operationHeartbeatMaxAttempts),N=$.operationHeartbeatAttemptTimeoutMs??v3,B=$.operationHeartbeatRetryDelayMs??LZ,U=Y.remainingMs(),M=Math.min(U,V*N+B*V*(V-1)/2);for(let G=0;G<V;G+=1)try{Q.throwIfAborted(),Y.assertCurrent();let H=Math.min(N,Y.remainingMs()),q=await EZ($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(H-1000))),clientRetryCount:G},Q,H);return Q.throwIfAborted(),Y.acknowledge(q.lease_until),q}catch(H){if(Q.aborted||G+1>=V||i0(H)||I0(H)||!O2(H)){if(!Q.aborted)E1($,"operation_heartbeat",H);throw H}let q=U-Y.remainingMs(),T=h3(H,($.now?.()??new Date).getTime()),L=Math.max(B*(G+1),M*(G+1)/V-q,T);await X(Math.min(Y.remainingMs(),L),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function xZ($,J,Z,Q,X){let Y=K8(J),V=new AbortController,N=new AbortController,B=()=>{V.abort($.signal.reason),N.abort($.signal.reason)};if($.signal.aborted)B();else $.signal.addEventListener("abort",B,{once:!0});let U=null,M,G,H=-1,q=0,T=Promise.resolve(),L=[],j=new AbortController,W=!1,O,F=null,z=!1,_,D,R={},E=(S)=>{W=!0,j.abort(S),V.abort(S),N.abort(S)},P=(S)=>{if(O)return O;let k=structuredClone(S),p=q;return O=(async()=>{let w=new AbortController,C=w.signal;C.throwIfAborted();let x,A=()=>{},y=new Promise((b,n)=>{if(A=()=>n(C.reason),C.addEventListener("abort",A,{once:!0}),x=setTimeout(()=>w.abort(Error("Hands stop receipt delivery timed out.")),4000),C.aborted)A()});try{for(let b=0;b<3;b+=1){C.throwIfAborted();try{let n=await Promise.race([J1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:p,events:[k],signal:C,transientRetryOwner:"caller"})),y]);if(C.throwIfAborted(),n.next_event_seq!==p+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");q=n.next_event_seq;return}catch(n){if(I0(n))X(n);let t=n instanceof L0?I1(n.status):C1(n);if(C.aborted||!t||b===2)throw n;let X0=Math.max(500*2**b,h3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(X0,C),y])}}}finally{clearTimeout(x),C.removeEventListener("abort",A),w.abort()}})(),O},I=(S,k,p)=>{let w=(x)=>J1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:k,events:S,signal:x,...p?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&i0(A))E(A);if(p&&(I0(A)||i0(A))){if(I0(A))X(A);V.abort(A),N.abort(A),j.abort(A)}throw A});if(!p)return async(x)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){q=(await w(x)).next_event_seq;return}x.throwIfAborted();let A=()=>{},y=new Promise((b,n)=>{A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([w(x),y]);x.throwIfAborted(),q=b.next_event_seq}finally{x.removeEventListener("abort",A)}};let C=p4({send:w,lease:D,sleep:Z,retryAfterMs:(x)=>h3(x,($.now?.()??new Date).getTime())});return async(x)=>{let A=await C(x);if(A.next_event_seq!==k+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");q=A.next_event_seq}},f=async(S,k)=>{let p=S??await t4($,J,{controlAckSeq:H,waitMs:k},N.signal,Z,D),w=null,C=!1;for(let x=0;x<10;x+=1){let A=H+1;for(let y of p.controls){if(y.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(y.kind==="cancel"||y.kind==="operation.cancel")w??=AZ(y.payload),V.abort(new h0(w,"Reason closed the Device operation."));if(y.kind!=="cancel"&&y.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,t=new Promise((X0,M0)=>{b=X0,n=M0});t.catch(()=>{}),R.current={promise:t,resolve:b,reject:n}}try{C||=!await $.onControl?.(J,y)}catch(b){if(b instanceof h0)M??=n4(b);throw R.current?.reject(b),b}}H=y.seq,A+=1}if(p.controls.length===0){if(p.next_control_seq!==H+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:w,unsupported:C}}try{p=await t4($,J,{controlAckSeq:H},N.signal,Z,D),R.current?.resolve()}catch(y){if(R.current?.reject(y),!w||i0(y)||I0(y))throw y;return{cancellationReason:w,unsupported:C}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)D=new W2(J.lease_until,()=>($.now?.()??new Date).getTime(),(k)=>{if(!V.signal.aborted)U=k;V.abort(k),N.abort(k)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||f3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await f()}catch(k){if(!y3(J)||i0(k)||I0(k))throw k;await k3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let k=S.cancellationReason??E3($.signal);V.abort(new h0(k,"Reason closed the Device operation.")),G={status:"cancelled",error_code:k}}else if(S.unsupported)V.abort(),G={status:"failed",error_code:"control_unsupported"};else{let k=Y?Promise.resolve():(async()=>{let w=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?TZ:15000),C=Math.min(w,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??v3)-1000)),x=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!N.signal.aborted)try{if(!x){if(await Z(w,N.signal),N.signal.aborted)return}let A=await f(void 0,x?C:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)U=Error("Reason requested an unsupported Device operation control.");V.abort(A.cancellationReason?new h0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(I0(A))X(A);if(i0(A))U=A,E(A);if(!N.signal.aborted)U=A,V.abort();return}})();try{if(D?.assertCurrent(),V.signal.throwIfAborted(),Q.authorized=()=>!V.signal.aborted&&(Y||(D?.remainingMs()??0)>0),G=await $.onClaim(J,V.signal,async(w)=>{if(y3(J))return;if(w.kind==="permission.denied"){if(!Q.authorized())return;let t=w.data,X0=($.now??(()=>new Date))().getTime(),M0=$.statusPath??A2(),u0=($.loadStatus??t$)(M0),C0={id:BZ(),kind:"permission_denied",operation:t?.operation,provenance:t?.provenance,occurredAt:new Date(X0).toISOString(),expiresAt:new Date(X0+600000).toISOString(),sessionId:J.run_id,deviceId:$.state.deviceId,organizationId:$.state.orgId};if(u0&&z2(C0,X0)){let c0=u0.permissionRecovery;if(!c0||!z2(c0,X0)||c0.sessionId!==C0.sessionId||c0.operation!==C0.operation||c0.provenance!==C0.provenance)($.saveStatus??R2)({...u0,permissionRecovery:C0},M0)}return}let C=J.capability==="hands.connect"&&w.capability==="hands.connect"&&w.kind==="hands.stopped",x=J.capability==="hands.connect"&&w.kind==="hands.reconnected",A=x||J.capability==="inference.custom.v1"?AbortSignal.any([V.signal,j.signal,...w.deliverySignal?[w.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,j.signal]):$.signal,y={kind:w.kind,payload:{sequence:w.sequence,capability:w.capability,...w.data?{data:x?structuredClone(w.data):w.data}:{}}};if(J.capability==="hands.connect"&&w.capability==="hands.connect"&&(w.kind==="started"||w.kind==="hands.started")||(f3.has(J.capability)||J.capability==="pty.start")&&w.kind==="started")return new Promise((t,X0)=>{L.push({wireEvent:y,settle:(M0)=>M0===void 0?t():X0(M0)})});let b=L;L=[];let n=T.then(async()=>{if((W||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(C)await P(y);return}if(F!==null){if(w.kind!=="hands.stopped"||!z||!_)throw F;let X0=new AbortController,M0=AbortSignal.any([$.signal,j.signal,X0.signal]),u0=setTimeout(()=>X0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);z=!1;try{await _(M0),_=void 0,await I([y],q,!0)(M0),F=null}catch(C0){throw F=C0??Error("Hands stop receipt could not be confirmed."),C0}finally{clearTimeout(u0),X0.abort()}return}if(x&&!D){let X0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));D=new W2(new Date(X0).toISOString(),()=>($.now?.()??new Date).getTime(),(M0)=>{V.abort(M0),N.abort(M0)})}let t=q;if(x)_=I([...b.map((X0)=>X0.wireEvent),y],t,!0),await _(A),_=void 0;else await I([...b.map((X0)=>X0.wireEvent),y],t,!1)(A)});n.then(()=>{for(let t of b)t.settle()},(t)=>{for(let X0 of b)X0.settle(t??Error("Hands event delivery failed."))}),T=n.catch((t)=>{if(I0(t))X(t);if(x){if(F===null)z=A.aborted&&!j.signal.aborted,F=t??Error("Hands generation receipt delivery failed.");if(!A.aborted)V.abort(t),N.abort(t)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(w){G=V.signal.aborted?{status:"cancelled",error_code:E3(V.signal)}:{status:"failed",error_code:n4(w)}}finally{Q.authorized=()=>!1,j.abort();for(let w of L.splice(0))w.settle();N.abort(),await k}let p=e4(J.capability)?$8(G.result,J.operation_id):null;if(U){if(I0(U))throw U;G={status:"failed",error_code:M??"control_or_heartbeat_failed",...p?{result:p}:{}}}else if(V.signal.aborted&&G.status==="succeeded")G={status:"cancelled",error_code:E3(V.signal),...p?{result:p}:{}}}if(D?.close(),I0($.signal.reason))throw $.signal.reason;await k3($,J,G)}finally{D?.close(),j.abort(),N.abort(),$.signal.removeEventListener("abort",B)}}async function u3($){let J=$.now??(()=>new Date),Z=$.sleep??g3,Q=$.saveStatus??R2,X=$.loadStatus??t$,Y=$.statusPath??A2(),V=J().toISOString(),N=X(Y)?.lastUsedAt,B=!1,U=()=>({version:1,pid:process.pid,startedAt:V,...G8(J),...V8(X(Y),$.state,J().getTime()),deviceId:$.state.deviceId,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:B}:{},...N?{lastUsedAt:N}:{}}),M=0,G,H=!1,q,T,L,j=Promise.resolve();Q({...U(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),X8();try{let W=async()=>{let O=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||O===T)return;if(q&&T){let _=await q.release();if($.onEvent?.({type:"idle_sleep",status:_,policy:T}),_==="failed")return;q=void 0,T=void 0,B=!1;let D=X(Y);if(D)Q({...D,idleSleepHold:B},Y)}if(!O)return;T=O;let F=!0;q=await($.acquireAwakeHold??u4)(O,{onStatusChange:(_)=>{if(F)return;B=_==="held";let D=X(Y);if(D)Q({...D,idleSleepHold:B},Y);$.onEvent?.({type:"idle_sleep",status:_,policy:O})}}),F=!1,B=q.status==="held";let z=X(Y);if(z)Q({...z,idleSleepHold:B},Y);$.onEvent?.({type:"idle_sleep",status:q.status,policy:O})};if(await W(),$.readIdleSleepPolicy)L=setInterval(()=>{j=j.then(W).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),L.unref();while(!$.signal.aborted){let O=!1;try{await SZ({...$,saveStatus:(F,z)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;N=F.lastUsedAt??N,Q({...F,startedAt:V,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:B}:{}},z)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&M>0&&!O){O=!0;let z=M;M=0,G=void 0,$.onEvent?.({type:"reconnected",attempts:z})}$.onEvent?.(F)}});return}catch(F){if(w3(F,$.signal))return;if(I0(F)){H=!0;let _=$.state.worker?"worker_connection_failed":b3(F);throw Q({...U(),state:"error",error:_},Y),$.onEvent?.({type:"error",message:_}),F}M+=1;let z=RZ(M,$.reconnectRandom);G??=J().toISOString(),Q({...U(),state:"starting",reconnectingSince:G},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":b3(F),attempt:M,retryInMs:z}),await Z(z,$.signal)}}}catch(W){if(!w3(W,$.signal))throw W}finally{if($.client.close?.(),clearInterval(L),await j,q&&T){let W=await q.release();B=W==="failed"&&q.status==="held",$.onEvent?.({type:"idle_sleep",status:W,policy:T})}if(!H)Q({...U(),state:"stopped"},Y);else{let W=X(Y);if(W)Q({...W,idleSleepHold:B},Y)}$.onEvent?.({type:"stopped"})}}async function SZ($){let J=$.now??(()=>new Date),Z=$.sleep??g3,Q=$.statusPath??A2(),X=$.saveStatus??R2,Y=$.loadStatus??t$,V=J().toISOString(),N=Y(Q)?.lastUsedAt,B=$.runtimeUpdate,U=new AbortController,M=()=>U.abort($.signal.reason);if($.signal.aborted)M();else $.signal.addEventListener("abort",M,{once:!0});let G=B?.random??Math.random,H=$.maxConcurrentClaims,q=typeof H==="number"&&Number.isSafeInteger(H)&&H>0?Math.min(qZ,H):HZ,T=0,L=!1,j=null,W=(v)=>{j??=v,U.abort(v)},O=new Map,F=()=>{let v=new Set,Y0=0;for(let{claim:E$}of O.values()){let G$=E$.capability==="hands.connect"?E$.payload[r4]:void 0;if(typeof G$==="string"){if(v.has(G$))continue;v.add(G$)}Y0+=1}return Y0},z=null,_=()=>[...O.values()].some((v)=>v.authorized()),D=()=>[...O.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=B?new Date(V).getTime()+x3(B.initialDelayMs??_Z,G):Number.POSITIVE_INFINITY,E=null,P=!1,I=$.firstHeartbeat,f=I?.account_root_metadata_supported===!0,S=I?.workspace_root_metadata_supported===!0,k=I?.account_root_path_supported===!0,p=I?.home_contained_roots_supported===!0,w=I?.root_paths_supported===!0,C=I?.startup_supported===!0,x=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,y,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:V,...G8(J),...V8(Y(Q),$.state,J().getTime()),...N?{lastUsedAt:N}:{},deviceId:$.state.deviceId,...E?{organizationId:E.organization_id,organizationName:E.organization_name,organizationSlug:E.organization_slug}:{}}),t=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!b)y??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...C&&!b&&y?{startup:y}:{},capabilities:v?Q8($.capabilities,{accountRootMetadataSupported:f,workspaceRootMetadataSupported:S,accountRootPathSupported:k,homeContainedRootsSupported:p,rootPathsSupported:w}):{supported_operations:[]}}},X0=()=>{if(P||!$.client.identity)return;P=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;E=v;let Y0=Y(Q);if(!Y0)return;X({...Y0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},M0=(v)=>{f=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,k=v.account_root_path_supported===!0,p=v.home_contained_roots_supported===!0,w=v.root_paths_supported===!0,C=v.startup_supported===!0,x=!1},u0=(v)=>{if(v.startup)b=!0},C0=(v,Y0)=>{if(!(Y0 instanceof L0&&Y0.status===400&&Y0.code==="invalid_heartbeat")||!v.startup&&!x)throw Y0;if(b=!0,x)f=S=k=!1,p=w=C=x=!1;return null},c0=(v)=>{M0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),X0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},I$=!1,s$=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(I$)s$=!0;let v=t();J1($,"heartbeat",()=>$.client.heartbeat($.state,v,U.signal).catch((Y0)=>C0(v,Y0))).then((Y0)=>{if(!Y0)return;u0(v),M0(Y0),c0(Y0)},()=>{return})});let T$=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let Y$=!1,C$=$.maxConsecutiveHeartbeatFailures??3,V$=0;try{while(!$.signal.aborted){if(j)throw j;if(L&&D())break;let v,Y0=t(),E$=A;A=void 0,I$=!0,s$=!1;try{let i=await J1($,"heartbeat",()=>$.client.heartbeat($.state,Y0,U.signal,...E$?[E$]:[]).catch((B0)=>C0(Y0,B0)));if(I$=!1,!i)continue;v=i,u0(Y0),V$=0}catch(i){if(I$=!1,$.signal.aborted)break;if(!O2(i))throw i;if(V$+=1,V$>=C$&&!_())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(M0(v),Object.keys(t().capabilities).length>Object.keys(Y0.capabilities).length)continue;if(s$)continue;if(c0(v),j)throw j;if($.signal.aborted)break;if(B&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(B&&J().getTime()>=R)try{let i=new AbortController,B0=()=>i.abort($.signal.reason);if($.signal.aborted)B0();else $.signal.addEventListener("abort",B0,{once:!0});let O0;try{O0=B.check(i.signal)}catch(z0){O0=Promise.reject(z0)}let B$=O0.then((z0)=>({kind:"completed",result:z0}),(z0)=>({kind:"failed",error:z0})),a$;try{while(!0){let z0=await PZ(B$,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(z0.kind==="failed")throw new S3(z0.error);if(z0.kind==="completed"){a$=z0.result;break}try{let E0=t(),L1=await J1($,"heartbeat",()=>$.client.heartbeat($.state,E0,U.signal).catch((r1)=>C0(E0,r1)));if(!L1)continue;v=L1,u0(E0),c0(v),V$=0}catch(E0){if($.signal.aborted)throw E0;if(!O2(E0))throw E0;if(V$+=1,V$>=C$&&!_())throw E0}}}catch(z0){i.abort(z0);let E0=await B$;if(E0.kind==="completed"&&E0.result==="activated")a$="activated";else throw z0}finally{$.signal.removeEventListener("abort",B0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,a$==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),L=!0}R=J().getTime()+x3(B.intervalMs??jZ,G)}catch(i){if(!(i instanceof S3))throw i;T+=1;let B0=B.retryBaseMs??DZ,O0=B.retryMaxMs??WZ,B$=Math.min(O0,B0*2**Math.min(T-1,8));R=J().getTime()+x3(B$,G)}if($.signal.aborted)break;if(L&&D())break;if(L){await T$($.heartbeatIntervalMs??15000);continue}let G$=$.client.sessionCadence?.($.state)??null,x$=G$?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await T$(x$);continue}if(F()>=q){let i=new AbortController;z=i;try{await Z(x$,AbortSignal.any([$.signal,i.signal]))}catch(B0){if(!i.signal.aborted)throw B0}finally{if(z===i)z=null}continue}let f0,T1=G$?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),h=performance.now();try{f0=await J1($,"claim",()=>$.client.claimOperation($.state,{waitMs:T1,signal:U.signal}))}catch(i){if($.signal.aborted||!O2(i)||!_())throw i;await T$(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(j)throw j;if(!f0){if(performance.now()-h<T1-NZ)await T$(KZ);continue}if($.claimable?.()===!1){await k3($,f0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}N=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:f0.operation_id,runId:f0.run_id,attemptId:f0.attempt_id,capability:f0.capability});let a,U0={authorized:()=>!1,claim:f0};if(a=xZ({...$,signal:U.signal},f0,Z,U0,W).catch((i)=>{if(I0(i))W(i);else if(!i0(i)&&[...O].some(([B0,O0])=>B0!==a&&O0.authorized())){if(i instanceof x1)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!i0(i)&&j===null)j=i}).finally(()=>{O.delete(a),z?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:O.size})}),O.set(a,U0),$.onEvent?.({type:"claims_changed",activeClaims:O.size}),K8(f0)){if(await a,j)throw j}}}catch(v){if(!w3(v,$.signal)){U.abort(v),Y$=!0;let Y0=$.state.worker?"worker_connection_failed":b3(v);throw X({...n(),state:"error",error:Y0},Q),$.onEvent?.({type:"error",message:Y0}),v}}finally{if(U.abort(),await Promise.allSettled(O.keys()),$.signal.removeEventListener("abort",M),!Y$)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as BQ}from"child_process";import{constants as k8,existsSync as KQ,mkdtempSync as s8,rmSync as NQ}from"fs";import{access as h8,open as UQ,readFile as f8,readlink as HQ,readdir as m8,unlink as qQ,rmdir as MQ}from"fs/promises";import{basename as c3,join as a3}from"path";import{randomUUID as h$}from"crypto";import{chmodSync as bZ,closeSync as wZ,fsyncSync as yZ,openSync as kZ,readFileSync as hZ,rmdirSync as N8,unlinkSync as q8,writeFileSync as fZ}from"fs";import{createConnection as mZ,createServer as vZ}from"net";import{dirname as gZ,join as uZ}from"path";var dZ=5000;async function M8($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:h$()},X={runId:h$(),deviceId:h$(),rootId:h$(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=H8(J,X),V={version:1,snapshot_id:h$(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(V).installed&&Y.current().snapshot_id===V.snapshot_id&&!Z.aborted}catch{return!1}finally{try{q8(Y.path)}catch{}}}async function T8($,J,Z=U8){if(J.aborted)return!1;let Q,X,Y=new Set,V=h$(),N=vZ((H)=>{Y.add(H),H.once("close",()=>Y.delete(H)),H.on("error",()=>H.destroy()),H.end(V)});N.maxConnections=1;let B,U,M=new Promise((H)=>{U=()=>H(!1)}),G=setTimeout(U,dZ);J.addEventListener("abort",U,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${h$()}`}),X=uZ(Q.journalDirectory,"readiness.json");let H=kZ(X,"wx",384);try{fZ(H,V),yZ(H)}finally{wZ(H)}if(hZ(X,"utf8")!==V||J.aborted)return!1;let q=new Promise((T)=>{N.once("error",()=>T(!1)),N.listen(Q.socketPath,()=>{try{bZ(Q.socketPath,384)}catch{T(!1);return}B=mZ(Q.socketPath);let L="";B.setEncoding("utf8"),B.once("error",()=>T(!1)),B.on("data",(j)=>{if(L+=j,L.length>V.length)B?.destroy(),T(!1)}),B.once("end",()=>T(L===V)),B.once("close",()=>T(!1))})});return await Promise.race([q,M])&&!J.aborted}catch{return!1}finally{clearTimeout(G),J.removeEventListener("abort",U),B?.destroy();for(let H of Y)H.destroy();if(await new Promise((H)=>N.close(()=>H())),Q?.disposeSocket(),X)try{q8(X)}catch{}if(Q){try{N8(Q.journalDirectory)}catch{}try{N8(gZ(Q.journalDirectory))}catch{}}}}import{spawn as pZ}from"child_process";import{randomUUID as f$}from"crypto";import{basename as lZ}from"path";import{fileURLToPath as cZ}from"url";function sZ(){let $=lZ(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",cZ(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function _8($,J,Z=sZ()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),V=pZ(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),N=!1,B=new Promise((F)=>V.once("close",()=>{N=!0,F()}));V.on("error",X);let U,M,G=new Promise((F)=>{U=F}),H=new Promise((F)=>{M=F}),q=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",L=0,j=!1;V.stdout.setEncoding("utf8"),V.stdout.on("data",(F)=>{if(L+=Buffer.byteLength(F),T+=F,L>512){X();return}while(T.includes(`
+`)}}return!0},F=null,z=async()=>{let _=!1;do B=!1,_=await O().catch(()=>!1);while(B&&!X.aborted);let D=JSON.stringify({version:1,...U});if(F!==D)try{e(N$(J),!0),c(O3(J),JSON.parse(D)),F=D}catch{}return _};return{check(){if(N)B=!0;else N=z().finally(()=>{N=null});return N},claims:()=>[...V.values()].reduce((_,D)=>_+D.claims,0),async settled(){await N,await Promise.all([...V.values()].map((_)=>_.done))}}}import{dirname as I7}from"path";function _4($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!C7($.saved))return J;let Z=$.saved,Q=(V,N)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:V,...N?{code:`worker_api_origin_move_${V}:${N}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?r$():$.native;if(!X)return J;let Y=[];try{let V=X.lock(I7($.configPath));if(!V)return J;if(Y.push(V),u(g(Z))){let M=e0({path:d(Z).lock,runtimeVersion:r});if(!M.acquired)return J;Y.push(()=>M.release())}let N=J0.parse(JSON.parse(s($.configPath)));if(N.stateDirectory!==Z.stateDirectory)return J;let B=j4(N),U={saved:N,configPath:$.configPath};if(!N2(N)&&B.length===0)return Q("unchanged"),U;if(N2(N)){let M=L4(N);c($.configPath,M),U={saved:M,configPath:$.configPath}}for(let M of B)try{c(M.configPath,L4(M.config))}catch(G){Q("failed",`workspace:${F4(G)}`)}return Q("moved"),U}catch(V){return Q("failed",F4(V)),J}finally{for(let V of Y.reverse())V()}}function N2($){return W$($.apiOrigin)!==$.apiOrigin}function j4($){return y0($).filter((J)=>J.config!==null&&N2(J.config))}function C7($){return N2($)||j4($).length>0}function L4($){let J=J0.parse({...$,apiOrigin:W$($.apiOrigin)}),Z=o($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=N0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)k0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:T0(J)});return J}function F4($){if($ instanceof V0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as E7,lstatSync as R3,readdirSync as R4,readlinkSync as x7,unlinkSync as S7}from"fs";import{join as D0,sep as b7}from"path";var U2="rehome.json";class H2 extends Error{code;constructor($){super($);this.code=$}}function P4($){let J={saved:$.saved,configPath:$.configPath},Z=D0($.home,".config"),Q=D0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=D0(Q,...X),V=D0(Z,"reason",...X),N=(G,H)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:G,...H?{code:`worker_state_rehome_${G}:${H}`}:{},timestamp:new Date().toISOString()})),B=$.native===void 0?r$():$.native,U=$.saved,M=[];try{if(U&&W4(Q)&&U.stateDirectory===Y){let W={...U,stateDirectory:V};if(!z3(B,V,W,M))return J;return D4(U,W,$.host,N)}if(U&&W4(Q)&&U.stateDirectory===V&&t9(U)&&z3(B,V,U,M))return I4({...U,stateDirectory:Y},U,$.host),J;if(!U||U.lifetime!=="persistent"||U.stateDirectory!==Y||!o$(Q)?.isDirectory())return J;if(m7(Y)===r)return J;let H=(W,O=!0)=>{if(O)c(D0(Y,U2),{version:r});return N("skipped",W),J},q=[Y];for(let W of y7(Q,Y)){if(W.config?.lifetime!=="ephemeral")return H("several_connections");if(!w7(W.directory,W.config,M))return H("once_running",!1);q.push(W.directory)}if(!B)return H("config_rename_unavailable:no_native");if(!z3(B,Y,U,M))return J;let T=o(U);if(!T||$0(U).revoked)return J;if(O4(Z)!==null)return H("conflicting_identity");if(z4(Z)!==null)return H("conflicting_files");if(o$(V)&&(!o$(V).isDirectory()||R4(V).length>0))return H("connection_folder_taken");D1(U,T.devicePublicKey),W3.before(U);let L=d0(Y);if(L&&A3(Y))k7(V,L);let j=q2(Z,B,q);if(j.state!=="renamed"&&j.state!=="linked"){if(L&&A3(Y))C4(V);return H(j.problem??"config_folder_kept")}return D4(U,{...U,stateDirectory:V},$.host,N)}catch(G){try{if(o$(Y)?.isDirectory())c(D0(Y,U2),{version:r})}catch{}return N("failed",v7(G)),f7(U,Y,V,J)}finally{for(let G of M.reverse())G()}}function D4($,J,Z,Q){let X=R3(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)E7(J.stateDirectory,448);let Y=T0(J),V=b$(d(J).state,{proofStore:Y,repair:!1});if(!V?.worker)throw new H2("identity_missing");let N=N0(J);if(V.worker.configDigest===N0($))k0({...V,worker:{...V.worker,configDigest:N}},d(J).state,{proofStore:Y});else if(V.worker.configDigest!==N)throw new H2("worker_config_binding_mismatch");c(D0(J.stateDirectory,"worker.json"),J),W3.after($,J),I4($,J,Z);let B=D0(J.stateDirectory,U2);if(u(B))S7(B);return Q("moved"),{saved:J,configPath:D0(J.stateDirectory,"worker.json")}}function I4($,J,Z){if(A4($,J,Z,"connect"),!A3(J.stateDirectory))return;let Q=h7(F$($.stateDirectory));if(!Q)return;let X=F$(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);C4($.stateDirectory)}function z3($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=e0({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function w7($,J,Z){if(u(g(J))){let X=e0({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=o$(D0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function y7($,J){let Z=[$,...R4($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>D0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let V=D0(X,Y);if(V===J||!o$(D0(V,"worker.json")))continue;let N=E4(V);if(!N||N.stateDirectory===$||N.stateDirectory.startsWith($+b7))Q.push({directory:V,config:N})}return Q}function A3($){try{return JSON.parse(s(D0($,"api-key.json"))).store==="keychain"}catch{return!1}}function k7($,J){let Z=F$($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function C4($){try{F$($).deleteBinding()}catch(J){if(!(J instanceof V0))throw J}}function h7($){try{return $.loadBinding()}catch(J){if(J instanceof V0)return null;throw J}}function f7($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=E4(Z);return X?.stateDirectory===Z?{saved:X,configPath:D0(Z,"worker.json")}:Q}function W4($){try{return R3($).isSymbolicLink()&&x7($)==="reason"}catch{return!1}}function m7($){try{let J=JSON.parse(s(D0($,U2)));return typeof J.version==="string"?J.version:null}catch{return null}}function E4($){try{let J=D0($,"worker.json");return u(J)?J0.parse(JSON.parse(s(J))):null}catch{return null}}function o$($){try{return R3($)}catch{return null}}function v7($){if($ instanceof H2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof V0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as g7}from"fs";function M2($){try{let J=JSON.parse(g7(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function x4($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as IV}from"crypto";import{readdirSync as CV,realpathSync as U6,statSync as EV}from"fs";import{hostname as xV}from"os";import{join as c$,resolve as SV}from"path";var T2="cloud",u7=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function R1($){return u7.test($)&&!S4.test($)}var d7={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function e$($){return d7[$]}import{chmodSync as p7,lstatSync as F2,mkdtempSync as l7,realpathSync as k4,rmdirSync as c7,rmSync as s7,unlinkSync as a7}from"fs";import{createConnection as i7,createServer as n7}from"net";import{basename as b4,dirname as w4,join as k$}from"path";var t7=K.enum(["status","drain","resume","stop","reload_roots"]),r7=K.strictObject({version:K.literal(1),instanceId:K.string(),deviceId:K.string(),phase:K.enum(["starting","running","reconnecting","stopping"]),drained:K.boolean(),activeClaims:K.number().int().nonnegative(),activeSessions:K.number().int().nonnegative().optional(),executionEligible:K.boolean(),supportedOperations:K.array(K.enum(L2)).max(L2.length).optional(),capabilityReadiness:K.partialRecord(K.enum(L2),K.boolean()).optional(),lastHeartbeat:K.string().nullable(),expiresAt:K.string()}),o7=K.strictObject({nonce:K.string(),action:t7}),e7=K.object({nonce:K.uuid()}),h4=K.strictObject({version:K.literal(1),nonce:K.uuid(),socketPath:K.string().max(100)});function f4($){return k$(d($).lock,"control.json")}function _2($){return e(d($).lock),e7.parse(JSON.parse(s(k$(d($).lock,"owner.json"))))}function y4($){if(!u($))return!1;let J=F2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function m4($,J){let Z=f4($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!F2(Y).isSocket())return null;return y4(Y)?Y:null}let Q=h4.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");let X=w4(Q.socketPath);if(w4(X)!==k4("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(b4(X))||b4(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return e(X),y4(Q.socketPath)?Q.socketPath:null}async function j2($,J,Z){if(_2($).nonce!==J)throw Error("worker_instance_changed");let Q=f4($);if(u(Q))throw Error("worker_control_already_serving");let X=l7(k$(k4("/tmp"),"ara-worker-")),Y=k$(X,"control.sock");if(e(X),Buffer.byteLength(Y)>100)throw Error("worker_socket_path_too_long");let V=new Set,N=n7((G)=>{V.add(G),G.once("close",()=>V.delete(G)),G.setTimeout(2000,()=>G.destroy());let H="",q=!1;G.on("error",()=>G.destroy()),G.on("data",(T)=>{if(q)return;if(H+=T.toString(),Buffer.byteLength(H)>4096){G.destroy();return}if(!H.includes(`
+`))return;q=!0;try{let L=o7.parse(JSON.parse(H));if(L.nonce!==J){G.destroy();return}G.end(JSON.stringify(Z(L.action))+`
+`)}catch{G.destroy()}})});N.maxConnections=32;let B,U=!1,M=async()=>{if(U)return;U=!0;for(let G of V)G.destroy();if(await new Promise((G)=>N.close(()=>G())),B&&u(Q)){let G=F2(Q);if(G.isFile()&&G.dev===B.dev&&G.ino===B.ino)try{let H=h4.parse(JSON.parse(s(Q)));if(H.nonce===J&&H.socketPath===Y)a7(Q)}catch{}}try{c7(X)}catch{}};try{if(await new Promise((G,H)=>{N.once("error",H),N.listen(Y,()=>{p7(Y,384),G()})}),_2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:Y}),B=F2(Q),M}catch(G){throw await M(),G}}function v4($,J){try{let Z=JSON.parse(s(k$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function P1($){return v4($,"runtime_version")}function $Z($){return v4($,"nonce")}function g4($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(k$(d($).lock,"owner.json")))return"no_lock";return m4($,_2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var JZ=21600000,ZZ=K.strictObject({instance:K.string().nullable(),since:K.number().int().nonnegative()});function QZ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=ZZ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;P3($)}catch{}return null}function P3($){try{s7(d($).updateDeferral,{force:!0})}catch{}}async function D2($,J,Z=()=>!1){let Q=$Z($),X=QZ($,Q);if(J!==void 0){let U=P1($);if(U===null||U===J&&X===null&&!Z())return{state:"current"}}let Y;try{let U=await K0($,"status");Y=U?U.activeSessions??U.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let V=Date.now(),N=X;if(N===null){N=V;try{c(d($).updateDeferral,{instance:Q,since:N})}catch{}}let B=V-N;return{state:B<JZ?"busy":"drained",sessions:Y,waitedMs:B}}async function K0($,J){let Z=d($);if(!u(k$(Z.lock,"owner.json")))return null;let Q=_2($),X=m4($,Q.nonce);if(!X)return null;return new Promise((Y,V)=>{let N=i7(X),B="",U=!1,M=(G,H)=>{if(U)return;if(U=!0,N.destroy(),H)V(H);else Y(G)};N.setTimeout(2000,()=>N.destroy(Error("worker_control_timeout"))),N.on("connect",()=>N.write(JSON.stringify({nonce:Q.nonce,action:J})+`
+`)),N.on("data",(G)=>{if(B+=G.toString(),Buffer.byteLength(B)>16384)N.destroy(Error("worker_control_oversize"))}),N.on("error",(G)=>{if("code"in G&&["ECONNREFUSED","ENOENT"].includes(String(G.code)))M(null);else M(null,G.message==="worker_control_timeout"?G:Error("worker_control_unavailable"))}),N.on("end",()=>{try{let G=r7.parse(JSON.parse(B));if(G.instanceId!==Q.nonce)throw Error("worker_instance_changed");M(G)}catch{M(null,Error("worker_control_invalid_response"))}}),N.once("close",()=>M(null,Error("worker_control_unavailable")))})}import{randomUUID as KY}from"crypto";import{homedir as NJ}from"os";import{spawn as XZ}from"child_process";async function u4($,J={}){if((J.platform??process.platform)!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Z,Q="failed",X=!1,Y,V=Promise.resolve(),N=(G)=>{if(Q===G)return;Q=G,J.onStatusChange?.(G)},B=()=>{if(X||Y)return;Y=setTimeout(()=>{Y=void 0,V=U()},J.retryMs??5000),Y.unref()},U=async()=>{try{let G=(J.spawn??XZ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Z=G,G.once("exit",()=>{if(!X&&Z===G)N("failed"),B()}),await new Promise((H,q)=>{G.once("spawn",H),G.once("error",q)}),G.exitCode===null&&G.signalCode===null)N("held")}catch{N("failed"),B()}};V=U(),await V;let M;return{get status(){return Q},release(){return M??=(async()=>{X=!0,clearTimeout(Y),await V;let G=Z;if(!G||G.exitCode!==null||G.signalCode!==null||!G.pid)return Q="failed","released";let H=await new Promise((q)=>{let T,L=setTimeout(()=>{try{G.kill("SIGKILL")}catch{}T=setTimeout(()=>q("failed"),1000)},1000);G.once("exit",()=>{clearTimeout(L),clearTimeout(T),q("released")});try{G.kill("SIGTERM")}catch{}});if(H==="released")Q="failed";return H})()}}}class $1 extends Error{constructor(){super("Reason Device operation lease expired.")}}class W2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new $1;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new $1;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new $1)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as KZ}from"fs";import{randomUUID as NZ}from"crypto";import{constants as I3}from"fs";import{open as YZ}from"fs/promises";import{join as VZ}from"path";var GZ={platform:process.platform,home:H0,async openFile($){let J=await YZ($,I3.O_RDONLY|I3.O_NOFOLLOW|I3.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function d4($=GZ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(VZ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class C3 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function BZ($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,V=new Promise((N,B)=>{X=()=>{Q.abort(J.reason),B(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let U=new C3;Q.abort(U),B(U)},Z)});try{return await Promise.race([$(Q.signal),V])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function p4($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await BZ($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof C3||(X instanceof L0?I1(X.status):C1(X));if(Y){let V=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+V}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function m3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}function V8($,J,Z){let Q=$?.permissionRecovery;return z2(Q,Z)&&Q.deviceId===J.deviceId&&Q.organizationId===J.orgId?{permissionRecovery:Q}:{}}var UZ=1000,HZ=250,qZ=Y8(KZ(process.execPath)),l4=null,c4=null;function G8($){if(process.platform!=="darwin")return{};return c4??=d4().then((J)=>{l4={status:J,checkedAt:$().getTime()}}).finally(()=>{c4=null}),{fullDiskAccess:{...l4??{status:"unknown",checkedAt:$().getTime()},executablePath:qZ}}}var MZ=8,TZ=64,LZ=2000,FZ=2000,v3=8000,s4=3,_Z=250,a4=1000,i4=30000,jZ=0.2,DZ=30000,WZ=21600000,OZ=300000,zZ=3600000,AZ=0.1,B8=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function RZ($){return Math.min(s4,Math.max(1,$??s4))}function PZ($){return typeof $.reason_code==="string"&&B8.has($.reason_code)?$.reason_code:"cancelled"}function E3($){return $.reason instanceof h0&&($.reason.code==="cancelled"||B8.has($.reason.code))?$.reason.code:"cancelled"}function n4($){return $ instanceof h0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function K8($){return $.capability==="hands.connect"&&(Z8($.payload)||J8($.payload))}function x3($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*AZ)))}function IZ($,J=Math.random){let Z=Math.min(i4,a4*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*jZ*(Q*2-1);return Math.min(i4,Math.max(a4,Math.round(Z+X)))}function g3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class S3 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function CZ($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function b3($){return $ instanceof Error?$.message:String($)}function w3($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function i0($){return $ instanceof L0&&$.status===409&&$.code==="attempt_fenced"}function y3($){return $.capability==="environment.install"}function EZ($){if($ instanceof P2||$ instanceof $1||$ instanceof x1)return"timeout";if(!($ instanceof Error)||$ instanceof L0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof L0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function E1($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(i0(Z))return;let Q=Z instanceof L0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:EZ(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function J1($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)E1($,J,Q);throw Q}}class x1 extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function k3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":o4(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:y3(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,V=Q?AbortSignal.any([Q,Y.signal]):Y.signal,N=$.sleep??g3,B=$.operationCompletionTimeoutMs??v3,U=performance.now()+B,M,G,H=new Promise((L,j)=>{let W=()=>{let F=new x1;Y.abort(F),j(F)},O=(F)=>{clearTimeout(M),M=setTimeout(W,F)};if(G=()=>O(Math.max(0,Math.min(U-performance.now(),LZ))),O(B),$.signal.addEventListener("abort",G,{once:!0}),$.signal.aborted)G()}),q,T=0;try{while(!0)try{q=await Promise.race([$.client.completeOperation($.state,J,X,V),H]);break}catch(L){if(V.aborted||$.signal.aborted||I0(L)||i0(L)||!xZ(L)||performance.now()>=U)throw E1($,"completion",L),L;T+=1;let j=Math.min(500*2**Math.min(T-1,4),Math.max(0,U-performance.now()));if(j<=0)throw E1($,"completion",L),L;try{await N(j,V)}catch{throw E1($,"completion",L),L}}}finally{clearTimeout(M),$.signal.removeEventListener("abort",G),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:q.status})}function xZ($){if(I0($))return!1;if(i0($))return!1;if($ instanceof L0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof x1)return!1;return!0}return!1}class P2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function O2($){if($ instanceof P2)return!0;return $ instanceof L0?I1($.status):C1($)}function h3($,J){if(!($ instanceof L0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function SZ($,J,Z,Q,X){let Y=new AbortController,V,N=()=>{return},B=new Promise((M,G)=>{let H=()=>{let q=Q.reason??new DOMException("Aborted","AbortError");Y.abort(q),G(q)};if(N=()=>Q.removeEventListener("abort",H),Q.aborted)H();else Q.addEventListener("abort",H,{once:!0})}),U=new Promise((M,G)=>{V=setTimeout(()=>{let H=new P2;Y.abort(H),G(H)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),B,U])}finally{if(V!==void 0)clearTimeout(V);N()}}async function t4($,J,Z,Q,X,Y){let V=RZ($.operationHeartbeatMaxAttempts),N=$.operationHeartbeatAttemptTimeoutMs??v3,B=$.operationHeartbeatRetryDelayMs??_Z,U=Y.remainingMs(),M=Math.min(U,V*N+B*V*(V-1)/2);for(let G=0;G<V;G+=1)try{Q.throwIfAborted(),Y.assertCurrent();let H=Math.min(N,Y.remainingMs()),q=await SZ($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(H-1000))),clientRetryCount:G},Q,H);return Q.throwIfAborted(),Y.acknowledge(q.lease_until),q}catch(H){if(Q.aborted||G+1>=V||i0(H)||I0(H)||!O2(H)){if(!Q.aborted)E1($,"operation_heartbeat",H);throw H}let q=U-Y.remainingMs(),T=h3(H,($.now?.()??new Date).getTime()),L=Math.max(B*(G+1),M*(G+1)/V-q,T);await X(Math.min(Y.remainingMs(),L),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function bZ($,J,Z,Q,X){let Y=K8(J),V=new AbortController,N=new AbortController,B=()=>{V.abort($.signal.reason),N.abort($.signal.reason)};if($.signal.aborted)B();else $.signal.addEventListener("abort",B,{once:!0});let U=null,M,G,H=-1,q=0,T=Promise.resolve(),L=[],j=new AbortController,W=!1,O,F=null,z=!1,_,D,R={},E=(S)=>{W=!0,j.abort(S),V.abort(S),N.abort(S)},P=(S)=>{if(O)return O;let k=structuredClone(S),p=q;return O=(async()=>{let w=new AbortController,C=w.signal;C.throwIfAborted();let x,A=()=>{},y=new Promise((b,n)=>{if(A=()=>n(C.reason),C.addEventListener("abort",A,{once:!0}),x=setTimeout(()=>w.abort(Error("Hands stop receipt delivery timed out.")),4000),C.aborted)A()});try{for(let b=0;b<3;b+=1){C.throwIfAborted();try{let n=await Promise.race([J1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:p,events:[k],signal:C,transientRetryOwner:"caller"})),y]);if(C.throwIfAborted(),n.next_event_seq!==p+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");q=n.next_event_seq;return}catch(n){if(I0(n))X(n);let t=n instanceof L0?I1(n.status):C1(n);if(C.aborted||!t||b===2)throw n;let X0=Math.max(500*2**b,h3(n,($.now?.()??new Date).getTime()));await Promise.race([Z(X0,C),y])}}}finally{clearTimeout(x),C.removeEventListener("abort",A),w.abort()}})(),O},I=(S,k,p)=>{let w=(x)=>J1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:k,events:S,signal:x,...p?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&i0(A))E(A);if(p&&(I0(A)||i0(A))){if(I0(A))X(A);V.abort(A),N.abort(A),j.abort(A)}throw A});if(!p)return async(x)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){q=(await w(x)).next_event_seq;return}x.throwIfAborted();let A=()=>{},y=new Promise((b,n)=>{A=()=>n(x.reason),x.addEventListener("abort",A,{once:!0})});try{let b=await Promise.race([w(x),y]);x.throwIfAborted(),q=b.next_event_seq}finally{x.removeEventListener("abort",A)}};let C=p4({send:w,lease:D,sleep:Z,retryAfterMs:(x)=>h3(x,($.now?.()??new Date).getTime())});return async(x)=>{let A=await C(x);if(A.next_event_seq!==k+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");q=A.next_event_seq}},f=async(S,k)=>{let p=S??await t4($,J,{controlAckSeq:H,waitMs:k},N.signal,Z,D),w=null,C=!1;for(let x=0;x<10;x+=1){let A=H+1;for(let y of p.controls){if(y.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(y.kind==="cancel"||y.kind==="operation.cancel")w??=PZ(y.payload),V.abort(new h0(w,"Reason closed the Device operation."));if(y.kind!=="cancel"&&y.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let b,n,t=new Promise((X0,M0)=>{b=X0,n=M0});t.catch(()=>{}),R.current={promise:t,resolve:b,reject:n}}try{C||=!await $.onControl?.(J,y)}catch(b){if(b instanceof h0)M??=n4(b);throw R.current?.reject(b),b}}H=y.seq,A+=1}if(p.controls.length===0){if(p.next_control_seq!==H+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:w,unsupported:C}}try{p=await t4($,J,{controlAckSeq:H},N.signal,Z,D),R.current?.resolve()}catch(y){if(R.current?.reject(y),!w||i0(y)||I0(y))throw y;return{cancellationReason:w,unsupported:C}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)D=new W2(J.lease_until,()=>($.now?.()??new Date).getTime(),(k)=>{if(!V.signal.aborted)U=k;V.abort(k),N.abort(k)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||f3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await f()}catch(k){if(!y3(J)||i0(k)||I0(k))throw k;await k3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let k=S.cancellationReason??E3($.signal);V.abort(new h0(k,"Reason closed the Device operation.")),G={status:"cancelled",error_code:k}}else if(S.unsupported)V.abort(),G={status:"failed",error_code:"control_unsupported"};else{let k=Y?Promise.resolve():(async()=>{let w=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?FZ:15000),C=Math.min(w,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??v3)-1000)),x=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!N.signal.aborted)try{if(!x){if(await Z(w,N.signal),N.signal.aborted)return}let A=await f(void 0,x?C:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)U=Error("Reason requested an unsupported Device operation control.");V.abort(A.cancellationReason?new h0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(I0(A))X(A);if(i0(A))U=A,E(A);if(!N.signal.aborted)U=A,V.abort();return}})();try{if(D?.assertCurrent(),V.signal.throwIfAborted(),Q.authorized=()=>!V.signal.aborted&&(Y||(D?.remainingMs()??0)>0),G=await $.onClaim(J,V.signal,async(w)=>{if(y3(J))return;if(w.kind==="permission.denied"){if(!Q.authorized())return;let t=w.data,X0=($.now??(()=>new Date))().getTime(),M0=$.statusPath??A2(),u0=($.loadStatus??t$)(M0),C0={id:NZ(),kind:"permission_denied",operation:t?.operation,provenance:t?.provenance,occurredAt:new Date(X0).toISOString(),expiresAt:new Date(X0+600000).toISOString(),sessionId:J.run_id,deviceId:$.state.deviceId,organizationId:$.state.orgId};if(u0&&z2(C0,X0)){let c0=u0.permissionRecovery;if(!c0||!z2(c0,X0)||c0.sessionId!==C0.sessionId||c0.operation!==C0.operation||c0.provenance!==C0.provenance)($.saveStatus??R2)({...u0,permissionRecovery:C0},M0)}return}let C=J.capability==="hands.connect"&&w.capability==="hands.connect"&&w.kind==="hands.stopped",x=J.capability==="hands.connect"&&w.kind==="hands.reconnected",A=x||J.capability==="inference.custom.v1"?AbortSignal.any([V.signal,j.signal,...w.deliverySignal?[w.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,j.signal]):$.signal,y={kind:w.kind,payload:{sequence:w.sequence,capability:w.capability,...w.data?{data:x?structuredClone(w.data):w.data}:{}}};if(J.capability==="hands.connect"&&w.capability==="hands.connect"&&(w.kind==="started"||w.kind==="hands.started")||(f3.has(J.capability)||J.capability==="pty.start")&&w.kind==="started")return new Promise((t,X0)=>{L.push({wireEvent:y,settle:(M0)=>M0===void 0?t():X0(M0)})});let b=L;L=[];let n=T.then(async()=>{if((W||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(C)await P(y);return}if(F!==null){if(w.kind!=="hands.stopped"||!z||!_)throw F;let X0=new AbortController,M0=AbortSignal.any([$.signal,j.signal,X0.signal]),u0=setTimeout(()=>X0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);z=!1;try{await _(M0),_=void 0,await I([y],q,!0)(M0),F=null}catch(C0){throw F=C0??Error("Hands stop receipt could not be confirmed."),C0}finally{clearTimeout(u0),X0.abort()}return}if(x&&!D){let X0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));D=new W2(new Date(X0).toISOString(),()=>($.now?.()??new Date).getTime(),(M0)=>{V.abort(M0),N.abort(M0)})}let t=q;if(x)_=I([...b.map((X0)=>X0.wireEvent),y],t,!0),await _(A),_=void 0;else await I([...b.map((X0)=>X0.wireEvent),y],t,!1)(A)});n.then(()=>{for(let t of b)t.settle()},(t)=>{for(let X0 of b)X0.settle(t??Error("Hands event delivery failed."))}),T=n.catch((t)=>{if(I0(t))X(t);if(x){if(F===null)z=A.aborted&&!j.signal.aborted,F=t??Error("Hands generation receipt delivery failed.");if(!A.aborted)V.abort(t),N.abort(t)}}),await n}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(w){G=V.signal.aborted?{status:"cancelled",error_code:E3(V.signal)}:{status:"failed",error_code:n4(w)}}finally{Q.authorized=()=>!1,j.abort();for(let w of L.splice(0))w.settle();N.abort(),await k}let p=e4(J.capability)?$8(G.result,J.operation_id):null;if(U){if(I0(U))throw U;G={status:"failed",error_code:M??"control_or_heartbeat_failed",...p?{result:p}:{}}}else if(V.signal.aborted&&G.status==="succeeded")G={status:"cancelled",error_code:E3(V.signal),...p?{result:p}:{}}}if(D?.close(),I0($.signal.reason))throw $.signal.reason;await k3($,J,G)}finally{D?.close(),j.abort(),N.abort(),$.signal.removeEventListener("abort",B)}}async function u3($){let J=$.now??(()=>new Date),Z=$.sleep??g3,Q=$.saveStatus??R2,X=$.loadStatus??t$,Y=$.statusPath??A2(),V=J().toISOString(),N=X(Y)?.lastUsedAt,B=!1,U=()=>({version:1,pid:process.pid,startedAt:V,...G8(J),...V8(X(Y),$.state,J().getTime()),deviceId:$.state.deviceId,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:B}:{},...N?{lastUsedAt:N}:{}}),M=0,G,H=!1,q,T,L,j=Promise.resolve();Q({...U(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),X8();try{let W=async()=>{let O=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||O===T)return;if(q&&T){let _=await q.release();if($.onEvent?.({type:"idle_sleep",status:_,policy:T}),_==="failed")return;q=void 0,T=void 0,B=!1;let D=X(Y);if(D)Q({...D,idleSleepHold:B},Y)}if(!O)return;T=O;let F=!0;q=await($.acquireAwakeHold??u4)(O,{onStatusChange:(_)=>{if(F)return;B=_==="held";let D=X(Y);if(D)Q({...D,idleSleepHold:B},Y);$.onEvent?.({type:"idle_sleep",status:_,policy:O})}}),F=!1,B=q.status==="held";let z=X(Y);if(z)Q({...z,idleSleepHold:B},Y);$.onEvent?.({type:"idle_sleep",status:q.status,policy:O})};if(await W(),$.readIdleSleepPolicy)L=setInterval(()=>{j=j.then(W).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),L.unref();while(!$.signal.aborted){let O=!1;try{await wZ({...$,saveStatus:(F,z)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;N=F.lastUsedAt??N,Q({...F,startedAt:V,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:B}:{}},z)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&M>0&&!O){O=!0;let z=M;M=0,G=void 0,$.onEvent?.({type:"reconnected",attempts:z})}$.onEvent?.(F)}});return}catch(F){if(w3(F,$.signal))return;if(I0(F)){H=!0;let _=$.state.worker?"worker_connection_failed":b3(F);throw Q({...U(),state:"error",error:_},Y),$.onEvent?.({type:"error",message:_}),F}M+=1;let z=IZ(M,$.reconnectRandom);G??=J().toISOString(),Q({...U(),state:"starting",reconnectingSince:G},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":b3(F),attempt:M,retryInMs:z}),await Z(z,$.signal)}}}catch(W){if(!w3(W,$.signal))throw W}finally{if($.client.close?.(),clearInterval(L),await j,q&&T){let W=await q.release();B=W==="failed"&&q.status==="held",$.onEvent?.({type:"idle_sleep",status:W,policy:T})}if(!H)Q({...U(),state:"stopped"},Y);else{let W=X(Y);if(W)Q({...W,idleSleepHold:B},Y)}$.onEvent?.({type:"stopped"})}}async function wZ($){let J=$.now??(()=>new Date),Z=$.sleep??g3,Q=$.statusPath??A2(),X=$.saveStatus??R2,Y=$.loadStatus??t$,V=J().toISOString(),N=Y(Q)?.lastUsedAt,B=$.runtimeUpdate,U=new AbortController,M=()=>U.abort($.signal.reason);if($.signal.aborted)M();else $.signal.addEventListener("abort",M,{once:!0});let G=B?.random??Math.random,H=$.maxConcurrentClaims,q=typeof H==="number"&&Number.isSafeInteger(H)&&H>0?Math.min(TZ,H):MZ,T=0,L=!1,j=null,W=(v)=>{j??=v,U.abort(v)},O=new Map,F=()=>{let v=new Set,Y0=0;for(let{claim:E$}of O.values()){let G$=E$.capability==="hands.connect"?E$.payload[r4]:void 0;if(typeof G$==="string"){if(v.has(G$))continue;v.add(G$)}Y0+=1}return Y0},z=null,_=()=>[...O.values()].some((v)=>v.authorized()),D=()=>[...O.values()].every((v)=>v.claim.capability==="preview.serve.v1"),R=B?new Date(V).getTime()+x3(B.initialDelayMs??DZ,G):Number.POSITIVE_INFINITY,E=null,P=!1,I=$.firstHeartbeat,f=I?.account_root_metadata_supported===!0,S=I?.workspace_root_metadata_supported===!0,k=I?.account_root_path_supported===!0,p=I?.home_contained_roots_supported===!0,w=I?.root_paths_supported===!0,C=I?.startup_supported===!0,x=I!==void 0,A=I?{challenge:I.challenge,expires_at:I.expires_at}:void 0,y,b=!$.startup,n=()=>({version:1,pid:process.pid,startedAt:V,...G8(J),...V8(Y(Q),$.state,J().getTime()),...N?{lastUsedAt:N}:{},deviceId:$.state.deviceId,...E?{organizationId:E.organization_id,organizationName:E.organization_name,organizationSlug:E.organization_slug}:{}}),t=()=>{let v=($.advertised??$.claimable)?.()!==!1;if(!b)y??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:v,...C&&!b&&y?{startup:y}:{},capabilities:v?Q8($.capabilities,{accountRootMetadataSupported:f,workspaceRootMetadataSupported:S,accountRootPathSupported:k,homeContainedRootsSupported:p,rootPathsSupported:w}):{supported_operations:[]}}},X0=()=>{if(P||!$.client.identity)return;P=!0,$.client.identity($.state,$.signal).then((v)=>{if(v.organization_id!==$.state.orgId)return;E=v;let Y0=Y(Q);if(!Y0)return;X({...Y0,organizationId:v.organization_id,organizationName:v.organization_name,organizationSlug:v.organization_slug},Q)}).catch(()=>{return})},M0=(v)=>{f=v.account_root_metadata_supported===!0,S=v.workspace_root_metadata_supported===!0,k=v.account_root_path_supported===!0,p=v.home_contained_roots_supported===!0,w=v.root_paths_supported===!0,C=v.startup_supported===!0,x=!1},u0=(v)=>{if(v.startup)b=!0},C0=(v,Y0)=>{if(!(Y0 instanceof L0&&Y0.status===400&&Y0.code==="invalid_heartbeat")||!v.startup&&!x)throw Y0;if(b=!0,x)f=S=k=!1,p=w=C=x=!1;return null},c0=(v)=>{M0(v),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),X0(),$.onEvent?.({type:"heartbeat",serverTime:v.server_time,drain:v.drain,...v.latest_cli_versions?{latestCliVersions:v.latest_cli_versions}:{},...v.hands_prespawn?{handsPrespawn:!0}:{}})},I$=!1,s$=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(I$)s$=!0;let v=t();J1($,"heartbeat",()=>$.client.heartbeat($.state,v,U.signal).catch((Y0)=>C0(v,Y0))).then((Y0)=>{if(!Y0)return;u0(v),M0(Y0),c0(Y0)},()=>{return})});let T$=(v)=>Z(v,$.signal);X({...n(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let Y$=!1,C$=$.maxConsecutiveHeartbeatFailures??3,V$=0;try{while(!$.signal.aborted){if(j)throw j;if(L&&D())break;let v,Y0=t(),E$=A;A=void 0,I$=!0,s$=!1;try{let i=await J1($,"heartbeat",()=>$.client.heartbeat($.state,Y0,U.signal,...E$?[E$]:[]).catch((B0)=>C0(Y0,B0)));if(I$=!1,!i)continue;v=i,u0(Y0),V$=0}catch(i){if(I$=!1,$.signal.aborted)break;if(!O2(i))throw i;if(V$+=1,V$>=C$&&!_())throw i;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(M0(v),Object.keys(t().capabilities).length>Object.keys(Y0.capabilities).length)continue;if(s$)continue;if(c0(v),j)throw j;if($.signal.aborted)break;if(B&&["available","required"].includes(v.update_policy??""))R=Math.min(R,J().getTime());if(B&&J().getTime()>=R)try{let i=new AbortController,B0=()=>i.abort($.signal.reason);if($.signal.aborted)B0();else $.signal.addEventListener("abort",B0,{once:!0});let O0;try{O0=B.check(i.signal)}catch(z0){O0=Promise.reject(z0)}let B$=O0.then((z0)=>({kind:"completed",result:z0}),(z0)=>({kind:"failed",error:z0})),a$;try{while(!0){let z0=await CZ(B$,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(z0.kind==="failed")throw new S3(z0.error);if(z0.kind==="completed"){a$=z0.result;break}try{let E0=t(),L1=await J1($,"heartbeat",()=>$.client.heartbeat($.state,E0,U.signal).catch((r1)=>C0(E0,r1)));if(!L1)continue;v=L1,u0(E0),c0(v),V$=0}catch(E0){if($.signal.aborted)throw E0;if(!O2(E0))throw E0;if(V$+=1,V$>=C$&&!_())throw E0}}}catch(z0){i.abort(z0);let E0=await B$;if(E0.kind==="completed"&&E0.result==="activated")a$="activated";else throw z0}finally{$.signal.removeEventListener("abort",B0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,a$==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),L=!0}R=J().getTime()+x3(B.intervalMs??WZ,G)}catch(i){if(!(i instanceof S3))throw i;T+=1;let B0=B.retryBaseMs??OZ,O0=B.retryMaxMs??zZ,B$=Math.min(O0,B0*2**Math.min(T-1,8));R=J().getTime()+x3(B$,G)}if($.signal.aborted)break;if(L&&D())break;if(L){await T$($.heartbeatIntervalMs??15000);continue}let G$=$.client.sessionCadence?.($.state)??null,x$=G$?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(v.drain||$.claimable?.()===!1){await T$(x$);continue}if(F()>=q){let i=new AbortController;z=i;try{await Z(x$,AbortSignal.any([$.signal,i.signal]))}catch(B0){if(!i.signal.aborted)throw B0}finally{if(z===i)z=null}continue}let f0,T1=G$?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),h=performance.now();try{f0=await J1($,"claim",()=>$.client.claimOperation($.state,{waitMs:T1,signal:U.signal}))}catch(i){if($.signal.aborted||!O2(i)||!_())throw i;await T$(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(j)throw j;if(!f0){if(performance.now()-h<T1-HZ)await T$(UZ);continue}if($.claimable?.()===!1){await k3($,f0,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}N=J().toISOString(),X({...n(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:f0.operation_id,runId:f0.run_id,attemptId:f0.attempt_id,capability:f0.capability});let a,U0={authorized:()=>!1,claim:f0};if(a=bZ({...$,signal:U.signal},f0,Z,U0,W).catch((i)=>{if(I0(i))W(i);else if(!i0(i)&&[...O].some(([B0,O0])=>B0!==a&&O0.authorized())){if(i instanceof x1)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!i0(i)&&j===null)j=i}).finally(()=>{O.delete(a),z?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:O.size})}),O.set(a,U0),$.onEvent?.({type:"claims_changed",activeClaims:O.size}),K8(f0)){if(await a,j)throw j}}}catch(v){if(!w3(v,$.signal)){U.abort(v),Y$=!0;let Y0=$.state.worker?"worker_connection_failed":b3(v);throw X({...n(),state:"error",error:Y0},Q),$.onEvent?.({type:"error",message:Y0}),v}}finally{if(U.abort(),await Promise.allSettled(O.keys()),$.signal.removeEventListener("abort",M),!Y$)X({...n(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as NQ}from"child_process";import{constants as k8,existsSync as UQ,mkdtempSync as s8,rmSync as HQ}from"fs";import{access as h8,open as qQ,readFile as f8,readlink as MQ,readdir as m8,unlink as TQ,rmdir as LQ}from"fs/promises";import{basename as c3,join as a3}from"path";import{randomUUID as h$}from"crypto";import{chmodSync as yZ,closeSync as kZ,fsyncSync as hZ,openSync as fZ,readFileSync as mZ,rmdirSync as N8,unlinkSync as q8,writeFileSync as vZ}from"fs";import{createConnection as gZ,createServer as uZ}from"net";import{dirname as dZ,join as pZ}from"path";var lZ=5000;async function M8($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:h$()},X={runId:h$(),deviceId:h$(),rootId:h$(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=H8(J,X),V={version:1,snapshot_id:h$(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(V).installed&&Y.current().snapshot_id===V.snapshot_id&&!Z.aborted}catch{return!1}finally{try{q8(Y.path)}catch{}}}async function T8($,J,Z=U8){if(J.aborted)return!1;let Q,X,Y=new Set,V=h$(),N=uZ((H)=>{Y.add(H),H.once("close",()=>Y.delete(H)),H.on("error",()=>H.destroy()),H.end(V)});N.maxConnections=1;let B,U,M=new Promise((H)=>{U=()=>H(!1)}),G=setTimeout(U,lZ);J.addEventListener("abort",U,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${h$()}`}),X=pZ(Q.journalDirectory,"readiness.json");let H=fZ(X,"wx",384);try{vZ(H,V),hZ(H)}finally{kZ(H)}if(mZ(X,"utf8")!==V||J.aborted)return!1;let q=new Promise((T)=>{N.once("error",()=>T(!1)),N.listen(Q.socketPath,()=>{try{yZ(Q.socketPath,384)}catch{T(!1);return}B=gZ(Q.socketPath);let L="";B.setEncoding("utf8"),B.once("error",()=>T(!1)),B.on("data",(j)=>{if(L+=j,L.length>V.length)B?.destroy(),T(!1)}),B.once("end",()=>T(L===V)),B.once("close",()=>T(!1))})});return await Promise.race([q,M])&&!J.aborted}catch{return!1}finally{clearTimeout(G),J.removeEventListener("abort",U),B?.destroy();for(let H of Y)H.destroy();if(await new Promise((H)=>N.close(()=>H())),Q?.disposeSocket(),X)try{q8(X)}catch{}if(Q){try{N8(Q.journalDirectory)}catch{}try{N8(dZ(Q.journalDirectory))}catch{}}}}import{spawn as cZ}from"child_process";import{randomUUID as f$}from"crypto";import{basename as sZ}from"path";import{fileURLToPath as aZ}from"url";function iZ(){let $=sZ(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",aZ(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function _8($,J,Z=iZ()){if(J.aborted||!["darwin","linux"].includes(process.platform))return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),V=cZ(Z.command,Z.args,{cwd:$,detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),N=!1,B=new Promise((F)=>V.once("close",()=>{N=!0,F()}));V.on("error",X);let U,M,G=new Promise((F)=>{U=F}),H=new Promise((F)=>{M=F}),q=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),T="",L=0,j=!1;V.stdout.setEncoding("utf8"),V.stdout.on("data",(F)=>{if(L+=Buffer.byteLength(F),T+=F,L>512){X();return}while(T.includes(`
 `)){let z=T.indexOf(`
-`),_=T.slice(0,z);T=T.slice(z+1);try{if(!j){let D=JSON.parse(_);if(!D||Object.keys(D).length!==2||!Number.isInteger(D.port)||D.port<1024||D.port>65535||typeof D.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(D.token))throw Error("probe_receipt_invalid");j=!0,U({port:D.port,token:D.token})}else if(_==="ready")M(!0);else X()}catch{X()}}}),B.then(X);let W,O=!1;try{let F=await Promise.race([G,q]);if(!F||!V.pid||Q.signal.aborted||J.aborted)return!1;let z=Date.now()+4500,_=f$(),D={organizationId:f$(),userId:f$(),runId:f$(),deviceId:f$(),rootId:f$(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:f$(),port:F.port,expiresAtMs:z},R={binding:D,executorLaunchId:_,job:{jobId:D.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:z,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:V.pid,processGroupId:V.pid,executorLaunchId:_}}},E=F8({binding:D,deniedPorts:new Set,readCurrentJob:async()=>!N&&!Q.signal.aborted?R:null});W=await L8({binding:D,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:E,signal:Q.signal}),O=await Promise.race([H,q])===!0&&!Q.signal.aborted&&!J.aborted}catch{O=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),W?.close(),Q.abort(),V.stdin.destroy(),!N)V.kill("SIGKILL");await B}return O&&N}import{execFileSync as C2}from"child_process";import{randomUUID as p0}from"crypto";import{chmodSync as j8,chownSync as b8,closeSync as d3,constants as U$,existsSync as aZ,fstatSync as w8,mkdirSync as D8,mkdtempSync as iZ,openSync as p3,readFileSync as nZ,readSync as tZ,realpathSync as rZ,rmdirSync as oZ,rmSync as eZ}from"fs";import{join as m$}from"path";import{fileURLToPath as $Q}from"url";var W8=1e4,JQ=!1;function E2(){if(process.platform!=="linux")return!1;return JQ||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=C2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var ZQ=Buffer.from([0,255,3,4]);function O8($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function QQ($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function S1($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=I2(),{directory:Q,root:X,runtimeDirectory:Y}=VQ(Z),V=new AbortController,N=()=>V.abort();$.addEventListener("abort",N,{once:!0});let B;V.signal.addEventListener("abort",()=>B?.close(),{once:!0});let U=setTimeout(N,W8),M={organization_id:p0(),user_id:p0(),device_id:p0()},G=p0(),H=p0(),q=p0(),T=p0(),L=Date.now()+W8,j={kind:"workspace_source",target_revision:0,root_grant_revision:1},W=p0().replaceAll("-",""),O,F=Buffer.alloc(0),z,_=!1,D=!1,R=!1,E=!1,P,I,f,S=async(p)=>{while(!p()){if(V.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((w)=>setTimeout(w,20))}if(V.signal.aborted)throw Error("pty_probe_cancelled")},k=!1;try{B=XQ(Q,Z),P=Bun.serve({hostname:"127.0.0.1",port:0,fetch(C,x){let A=new URL(C.url).pathname,y=A===`/device/hands/${W}`?"hands":A===`/device/pty/${W}`?"pty":null;if(y&&x.upgrade(C,{data:{lane:y}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(C){if(C.data.lane==="pty")O=C},message(C,x){if(C.data.lane!=="pty")return;if(typeof x==="string"){try{if(JSON.parse(x).t==="open")_=!0}catch{N()}return}if(F.length+x.length>8192){N();return}F=Buffer.concat([F,x])}}});let p=`ws://127.0.0.1:${P.port}`;if(I=l3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:G,operationId:p0(),attemptId:p0(),claimOwner:M,deviceIdentity:{deviceId:M.device_id,rootId:H,apiOrigin:"https://worker-probe.invalid"},signal:V.signal,payload:{relay_url:`${p}/device/hands/${W}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(L).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:z8,hands_worker_version:P8,hands_worker_artifact_sha256:C8,hands_worker_entrypoint:I8,target_generation:1,target_fence_id:q,environment_binding:j,[E8]:x8},emitEvent:async(C)=>{if(C==="hands.started")E=!0;if(C==="hands.ready")D=!0;if(C==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:S8(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:$Q(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!D)N()}),await S(()=>D),A8({root:X,runId:G,payload:{version:1,snapshot_id:T,revision:1,run_id:G,root_id:H,device_id:M.device_id,binding:{...j,target_generation:1,target_fence_id:q},expires_at:new Date(L).toISOString(),variables:{PTY_PROBE_VALUE:W},git:null}}),f=R8({root:X,runId:G,rootId:H,deviceId:M.device_id,owner:M,workspace:{kind:"root"},authority:{device_id:M.device_id,binding:j.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:q},signal:V.signal,session:{jobId:`pty-${p0()}`,sessionId:"pty-readiness",operationId:p0(),cols:80,rows:24,leaseExpiresAtMs:L,relayUrl:`${p}/device/pty/${W}`},emit:async(C,x)=>{if(C==="pty.ready")z=x}}).catch(()=>{N()}),await S(()=>Boolean(z&&O&&_)),O.send(JSON.stringify({t:"resize",cols:100,rows:30})),O.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${W}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${B.wait("background")}) & ${O8("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${O8("foreground")}; ${B.wait("foreground")}'
-`)),await S(()=>aZ(m$(X,"foreground.pid"))&&F.includes(ZQ)),!F.includes("30 100")||z.job.environmentSnapshotId!==T||z.job.environmentRevision!==1)return!1;let w=["background.pid","foreground.pid"].map((C)=>YQ(m$(X,C)));if(new Set(w).size!==2||w.some((C)=>!Number.isSafeInteger(C)||C<2||C===z.job.process.pid))return!1;if(process.platform==="linux"){if(!w.every((C)=>QQ(nZ(`/proc/${C}/stat`,"utf8"),C,z.job.process.pid)))return!1}else{let x=C2("/bin/ps",["-o","pid=,pgid=","-p",w.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((A)=>A.trim().split(/\s+/).map(Number));if(x.length!==2||new Set(x.map(([A])=>A)).size!==2||x.some((A)=>A.length!==2||!w.includes(A[0])||A[0]!==A[1]))return!1}if(O.send(JSON.stringify({t:"close"})),await f,V.signal.aborted)return!1;for(let C of[z.job.process.pid,...w])try{return process.kill(C,0),!1}catch(x){if(!(x instanceof Error&&("code"in x)&&x.code==="ESRCH"))return!1}k=!0}catch{k=!1}finally{if(clearTimeout(U),$.removeEventListener("abort",N),N(),B?.close(),await f,await I,await P?.stop(!0),!E||R)GQ({directory:Q,root:X},Z)}return k&&R&&!$.aborted}function XQ($,J){let Z={foreground:m$($,"foreground.lifeline"),background:m$($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");C2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))d3(Y)};try{for(let Y of Object.values(Z)){let V=p3(Y,U$.O_RDONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW);try{if(Q.push(p3(Y,U$.O_WRONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW)),!w8(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{d3(V)}if(J)b8(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function y8($=(J)=>S1(J)){let J=new AbortController,Z=JSON.stringify(I2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(I2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((V)=>{Y=setTimeout(V,X)})]),clearTimeout(Y)}}}function YQ($){let J;try{J=p3($,U$.O_RDONLY|U$.O_NOFOLLOW|U$.O_NONBLOCK)}catch{return Number.NaN}try{let Z=w8(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=tZ(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{d3(J)}}function VQ($,J=rZ("/tmp")){let Z=iZ(m$(J,"reason-pty-probe-")),Q=m$(Z,"workspace"),X=m$(Z,"private");if(D8(Q,{mode:448}),D8(X,{mode:448}),$)j8(Z,493),j8(Q,493),b8(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function GQ($,J){if(J)try{C2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),oZ($.root)}catch{return}eZ($.directory,{recursive:!0,force:!0})}var a8=5000,v$="ARA_WORKER_PROBE_READY";function TQ($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{BQ($,J,{cwd:Z,env:Q,signal:X,timeout:a8,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(V,N)=>Y(!V&&!X.aborted&&N===v$))})}function LQ($,J){if(c3($)==="bash")return["--noprofile","--norc","-c",J];if(c3($)==="zsh"||c3($)==="sh")return["-f","-c",J];return null}function FQ($,J){let Z=g8({home:J,temporaryDirectory:J}),Q=(Y,V,N)=>TQ(Y,V,$.workspaceRoot,Z,N),X=async(Y,V,N,B=(M)=>M===v$,U=!1)=>{let M=await r8(Y,V,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:U,timeoutMs:a8,signal:N});return!N.aborted&&!M.timedOut&&!M.truncated&&M.exitCode===0&&B(M.stdout)};return{workspaceRead:async(Y)=>{return await h8($.workspaceRoot,k8.R_OK),await m8($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await h8($.workspaceRoot,k8.W_OK),Y.aborted)return!1;let V=s8(a3($.workspaceRoot,".ara-worker-probe-")),N=a3(V,"receipt");try{let B=await UQ(N,"wx",384);try{await B.writeFile(v$),await B.sync()}finally{await B.close()}return await f8(N,"utf8")===v$&&!Y.aborted}finally{await qQ(N).catch(()=>{}),await MQ(V).catch(()=>{})}},confinedShell:(Y)=>X(t8(),["-c",`printf ${v$}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(V)=>/^git version \S+/.test(V)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(U)=>U.includes(`p${process.pid}
-`)&&/^n\//m.test(U),!0);if(process.platform!=="linux")return!1;let[V,N,B]=await Promise.all([HQ("/proc/self/cwd"),m8("/proc/self/fd"),f8("/proc/net/tcp","utf8")]);return!Y.aborted&&V.length>0&&N.length>0&&B.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${v$}`],Y),jobs:(Y)=>T8($,Y),environment:(Y)=>M8($,J,Y),preview:(Y)=>_8(J,Y),boundPty:(Y)=>S1(Y),desktopDisplay:()=>n8(),desktopAutomation:async()=>{let Y=n3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
-`);return c8()},desktopBrowser:async()=>w1()?.features.browser===!0,fullControlShell:(Y)=>{let V=p8(),N=LQ(V,`printf ${v$}`);return N?Q(V,N,Y):Promise.resolve(!1)}}}function n3(){return process.platform==="darwin"&&w1()?.features.computer===!0?l8():null}var t3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function _Q($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=i3()){return b1($,J,Z,Q,X).final}function b1($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=i3(),Y,V){let N,B;try{if(K$($),v0(),!J)e(g($),!0),N=s8(a3(g($),"probe-")),J=FQ($,N);B=J}catch(O){let F=Promise.reject(O);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let U=async(O,F)=>{if(Z.aborted||!F&&!B[O])return!1;let z,_=new Promise((D)=>{z=()=>D(!1)});Z.addEventListener("abort",z,{once:!0});try{return await Promise.race([F??B[O](Z),_])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",z)}},M=$.executionMode==="host",G=M?U("boundPty",Y):Promise.resolve(!1),H=Promise.resolve(V).then(()=>Promise.all(M?[U("preview"),G,U("desktopDisplay"),U("desktopAutomation"),U("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),q=(async()=>{let[O,F,z,_,D,R,E,P,I]=await Promise.all([Promise.resolve(Q).then((f)=>f.read?U("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((f)=>f.write?U("workspaceWrite"):!1,()=>!1),X?U("confinedShell"):!1,X?U("confinedGit"):!1,U("processInspection"),...M?[U("bash"),U("jobs"),U("environment"),U("fullControlShell")]:[!1,!1,!1,!1]]);if(M&&(!R||!E||!P)&&!V)await H;if(M){if(!R)R=await U("bash");if(!E)E=await U("jobs");if(!P)P=await U("environment")}return{read:O,write:F,shell:z,git:_,processes:D,bash:R,jobs:E,environment:P,full:I}})(),T=(O,F)=>{let{read:z,write:_,shell:D,git:R,processes:E,bash:P,jobs:I,environment:f,full:S}=O,{preview:k,boundPty:p,desktopDisplay:w,desktopAutomation:C,desktopBrowser:x}=F,A=u8(),y=M&&process.platform==="darwin"&&S&&KQ("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":z,"fs.write":_,"inference.custom.v1":M&&z,"fs.export":z&&A,"fs.import":_&&A,"exec.run":D&&X,"git.run":D&&R&&X,"process.list":(process.platform==="linux"||D)&&E,"ports.list":(process.platform==="linux"||D)&&E,"exec.full":P&&S&&X,"hands.connect":z&&_&&P&&I,"jobs.control":z&&_&&P&&I,"pty.start":z&&_&&P&&I&&f&&p,"environment.install":z&&_&&P&&I&&f,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&z&&_&&P&&I&&f,"tunnel.open":z&&_&&P&&I&&f&&k,"tunnel.close":z&&_&&P&&I&&f&&k,"preview.serve.v1":z&&P&&I&&k&&S,"display.stream.v1":w,"automation.call.v1":C,"simulator.call.v1":y,"simulator.stream.v1":y,"browser.pr-proof.v1":C&&x&&v8()===null,"workspace.setup.v1":M&&d8()})},L=q.then(async(O)=>T(O,{preview:!1,boundPty:await Promise.race([G,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),j=(async()=>{try{let O=await q,[F,z,_,D,R]=await H;if(M&&!z&&O.read&&O.write&&O.bash&&O.jobs&&O.environment)z=await U("boundPty");return T(O,{preview:F,boundPty:z,desktopDisplay:_,desktopAutomation:D,desktopBrowser:R})}finally{if(N)NQ(N,{recursive:!0,force:!0})}})();L.catch(()=>{});let W=(async()=>{let O=await q;if(!(O.read&&O.write&&O.bash&&O.jobs&&O.environment))return!1;return await G||(await j)["pty.start"]===!0})();return W.catch(()=>{}),{initial:L,final:j,pty:W}}var jQ=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],DQ=[60000,300000,900000];function s3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return jQ.filter((Z)=>J[Z]!==!0)}function i8($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>_Q($.config,void 0,Y,$.permissions)),Q=$.readiness,X=s3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
-`),(async()=>{for(let Y of $.delaysMs??DQ){if(await new Promise((B)=>{let U=setTimeout(B,Y);$.signal.addEventListener("abort",()=>{clearTimeout(U),B()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let V;try{V=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let N=s3($.config,Q).filter((B)=>V[B]===!0);if(N.length>0)Q=Object.freeze({...Q,...Object.fromEntries(N.map((B)=>[B,!0]))}),J(`Reason worker: ready after probing again (${N.join(", ")}).
-`),$.onReady(Q,N);if(s3($.config,Q).length===0)return}})()}import{execFile as FX}from"child_process";import{createHash as _X,randomUUID as H9}from"crypto";import{lstat as jX,readdir as y5,readFile as u5,realpath as DX,stat as WX}from"fs/promises";import{basename as OX,join as N9}from"path";import{promisify as zX}from"util";import{createConnection as WQ}from"net";import{endianness as $5}from"os";var y1=4,r3=1e4;class O${socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=WQ(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#V(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},V=OQ({jsonrpc:"2.0",id:Q,method:$,params:X}),N=new Promise((B,U)=>{let M=setTimeout(()=>{this.#Z.delete(Q),U(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:B,reject:U,timeout:M})});return Z.write(V),await N}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#V($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=y1){let J=$5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=y1+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(y1,Z);this.#$=this.#$.subarray(Z),this.#G(JSON.parse(Q.toString("utf8")))}}#G($){if(!n0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),n0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class x2{client;cdp;constructor($){this.client="client"in $?$.client:new O$($),this.cdp=new Q5(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=zQ(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new J5(this,$)}getTabs(){return this.client.getTabs()}}class J5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new Z5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class Z5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class Q5{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(n0(Q)&&n0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return n0(Q)&&n0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";o8(Q);let X=Z.timeoutMs??r3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),V=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(n0(V)&&typeof V.errorText==="string"&&V.errorText)throw Error(`Browser failed to navigate tab ${$}: ${V.errorText}`);return await Y.catch(async(N)=>{let B=await this.readDocumentState($);if(e8(B,Q))return;throw N}),V}async waitForLoadState($,J={}){let Z=J.state??"load";o8(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(e8(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??r3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return n0(J)?{href:o3(J.href),readyState:o3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??r3;return new Promise((X,Y)=>{let V=!1,N=null,B,U=()=>{if(V)return!1;return V=!0,clearTimeout(B),N?.(),!0};B=setTimeout(()=>{if(U())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),N=this.client.onNotification((M)=>{try{if(J(M)){if(U())X(M)}}catch(G){if(U())Y(G instanceof Error?G:Error(String(G)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=AQ(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function OQ($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(y1+J.length);if($5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,y1),Z}function n0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function zQ($,J){if(!n0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function o8($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function e8($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function AQ($,J){if($.method!=="onCDPEvent"||!n0($.params))return null;let Z=$.params.source;if(!n0(Z)||Z.tabId!==J)return null;return{method:o3($.params.method)}}function o3($){return typeof $==="string"?$:void 0}import{createHash as RQ}from"crypto";function X5($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${RQ("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as MX}from"async_hooks";import{isDeepStrictEqual as b5}from"util";import{createHash as TX}from"crypto";var PQ=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var IQ=new Set(["png","jpg","jpeg","gif","webp"]),CQ=new Set(["webm","mp4"]);function EQ($){if(!$)return null;try{return new URL($).origin}catch{return null}}function Y5($,J){let Z;try{Z=new URL($)}catch{return null}let Q=EQ(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=PQ.exec(Z.pathname);if(!Y)return null;let V=Y[1]?.toLowerCase(),N=Y[2]?.toLowerCase(),B=Y[3]?.toLowerCase(),U=Y[4]?.toLowerCase();if(!V||!N||!B||!U)return null;let M=IQ.has(U)?"image":CQ.has(U)?"video":null;if(!M)return null;let G=/^(before|after)[\s:_-]+/.exec(B),H=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:H,runId:V,artifactId:N,fileName:`${B}.${U}`,kind:M,phase:G?.[1]==="before"||G?.[1]==="after"?G[1]:null}}var xQ=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,S2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),g$=()=>{throw Error("cloud_browser_media_request_invalid")};function b2($){if(!S2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!xQ.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return g$();let J;try{J=new URL($.configuredMediaOrigin)}catch{return g$()}if(J.protocol!=="https:"||J.username||J.password||J.port||!V5(J.origin,{mode:"public_web"}).allowed)return g$();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!S2(Y)||Object.keys(Y).some((N)=>!["url","sourceUrl","kind"].includes(N))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return g$();let V=Y5(Y.url,J.origin);if(!V||new URL(V.url).origin!==J.origin||V.runId!==Z||V.kind!==Y.kind||V.url!==Y.url||Q.has(Y.url))return g$();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let N;try{N=new URL(Y.sourceUrl)}catch{return g$()}let B=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(N.pathname)?.[1];if(Y.kind!=="image"||N.origin!=="https://camo.githubusercontent.com"||N.username||N.password||N.search||N.hash||!B||B.length%2!==0||Buffer.from(B,"hex").toString("utf8")!==Y.url)return g$()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function G5($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!S2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let V=J.media[Y];if(!S2(X)||X.url!==V.url||X.sourceUrl!==V.sourceUrl||X.kind!==V.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||V.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...V,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...V.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var $9="browser.pr-proof.v1",j0=K.string().uuid(),Z1=K.string().regex(/^[a-f0-9]{64}$/),d$=K.iso.datetime({precision:3}),e3=K.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),K5=K.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),l0=K.object({kind:K.literal("primary_mac"),version:K.literal(1),organizationId:e3,userId:e3,sessionId:e3,runId:j0,deviceId:j0,rootId:j0,rootRevision:K.string().min(1).max(64),binding:K.enum(["workspace_source","mcp_control"]),targetRevision:K.number().int().nonnegative(),generation:j0,profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:K.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),SQ=K.custom().transform(($,J)=>{try{return B5($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),K.NEVER}}),Q1=K.object({version:K.literal(1),owner:l0,contextId:j0,preparedAt:d$,expiresAt:d$,prUrl:K5,headSha:K.string().regex(/^[a-f0-9]{40}$/),skillDigest:Z1,evidenceKind:K.enum(["image","video"]),visualPlan:SQ.optional(),uploadOrigin:K.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),J9=K.object({version:K.literal(1),producer:K.literal("primary_mac"),context:Q1,captureId:j0,operationId:j0,attemptId:j0,tabId:K.number().int().positive(),startedAt:d$,finishedAt:d$,sha256:Z1,media:K.discriminatedUnion("contentType",[K.object({contentType:K.literal("image/png"),sizeBytes:K.number().int().min(24).max(8388608),width:K.number().int().min(1).max(4096),height:K.number().int().min(1).max(4096)}).strict(),K.object({contentType:K.literal("video/webm"),sizeBytes:K.number().int().min(128).max(10485760),durationSeconds:K.number().min(0.05).max(15),frameCount:K.number().int().min(1).max(450),receivedFrameCount:K.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),sN=K.discriminatedUnion("action",[K.object({action:K.literal("screenshot"),context_id:j0,tab_id:K.number().int().positive()}).strict(),K.object({action:K.literal("start_video"),context_id:j0,tab_id:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),K.object({action:K.literal("stop_video"),recording_operation_id:j0}).strict()]),y2=K.object({login:K.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:K.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),w2=K.string().regex(/^[1-9][0-9]{0,19}$/),k1=K.object({version:K.literal(1),owner:l0,expectedActorId:w2.nullable(),repositoryId:w2,repositoryFullName:K.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),bQ=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],Z9=K.discriminatedUnion("status",[k1.extend({status:K.literal("ready"),observedActor:y2,checkedAt:d$}),k1.extend({status:K.literal("not_ready"),reason:K.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:K.enum(bQ).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),u$=K.object({version:K.literal(1),owner:l0,expectedActorId:w2.nullable(),authenticatedActor:y2,attemptId:j0,captureId:j0,prUrl:K5,repositoryId:w2,headSha:K.string().regex(/^[a-f0-9]{40}$/),sha256:Z1,sizeBytes:K.number().int().min(128).max(10485760),contentType:K.literal("video/webm")}).strict(),N5=K.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),X1=K.discriminatedUnion("status",[u$.extend({status:K.literal("not_attempted"),reason:K.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),u$.extend({status:K.literal("uncertain"),reason:K.literal("upload_outcome_unknown")}),u$.extend({status:K.literal("uploaded"),observedActor:y2,nativeUrl:N5,uploadedAt:d$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),h1=u$.extend({nativeUrl:N5,observedActor:y2,bodySha256:Z1}),Q9=K.discriminatedUnion("status",[h1.extend({status:K.literal("incomplete"),reason:K.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),h1.extend({status:K.literal("verified"),sourceSha256:Z1,width:K.number().int().min(1).max(4096),height:K.number().int().min(1).max(4096),durationSeconds:K.number().positive().max(30),advancedSeconds:K.number().min(0.05).max(10),advancedFrames:K.number().int().positive(),playbackRestored:K.literal(!0),verifiedAt:d$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),wQ=K.custom().transform(($,J)=>{try{let Z=b2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),K.NEVER}}),yQ=K.discriminatedUnion("action",[K.object({action:K.literal("auth_check"),input:k1}).strict(),K.object({action:K.literal("prepare"),context:Q1}).strict(),K.object({action:K.literal("capture_png"),owner:l0,contextId:j0,tabId:K.number().int().positive()}).strict(),K.object({action:K.literal("start_video"),owner:l0,contextId:j0,tabId:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),K.object({action:K.literal("inspect_capture"),owner:l0,captureId:j0}).strict(),K.object({action:K.literal("publish_video"),input:u$}).strict(),K.object({action:K.literal("verify_png_media"),owner:l0,media:wQ}).strict().refine(($)=>$.media.runId===$.owner.runId),K.object({action:K.literal("verify_saved_media"),input:h1}).strict(),K.object({action:K.literal("publish_png"),owner:l0,attemptId:j0,captureId:j0,sha256:Z1,sizeBytes:K.number().int().min(24).max(8388608),storagePath:K.string().max(512),uploadUrl:K.string().url().max(8192)}).strict()]);var U5="pr-proof.stop.v1",X9=K.object({requestId:j0,command:yQ}).strict();import{createHash as kQ,randomUUID as hQ}from"crypto";import{isDeepStrictEqual as Y1}from"util";var H5=K.object({operationId:K.string().uuid(),attemptId:K.string().uuid(),contextId:K.string().uuid(),tabId:K.number().int().positive()}).strict(),G0=()=>Error("mac_pr_proof_capture_unavailable"),Y9=($)=>kQ("sha256").update($).digest("hex");function q5($){let J=l0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw G0();if(await $.assertCurrent(),X)throw G0()},V=(H)=>{let q=Z.get(H);if(!q||Date.parse(q.expiresAt)<=Date.now())throw G0();return q},N=(H)=>H.disposal??=(async()=>{H.controller.abort(),H.bytes?.fill(0),H.bytes=void 0,H.receipt=void 0;try{await H.host?.close()}catch{throw X=!0,G0()}})(),B=async()=>{for(let[H,q]of Z){if(Date.parse(q.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,j])=>j.claim.contextId===H);if((await Promise.allSettled(T.map(([,j])=>N(j)))).some((j)=>j.status==="rejected"))throw G0();for(let[j]of T)Q.delete(j);Z.delete(H)}},U=setInterval(()=>{B().catch(()=>{X=!0})},1000);U.unref();let M=(H)=>{if(H.stopRequested=!0,H.started&&H.host&&!H.stop)H.stop=H.host.stop(),H.stop.catch(()=>H.controller.abort())};async function G(H,q){let T=H5.parse(H.claim);if(q==="video"&&(!Number.isInteger(H.seconds)||H.seconds<1||H.seconds>15))throw G0();await Y(),H.signal.throwIfAborted(),await B();let L=V(T.contextId);if(q==="video"&&L.evidenceKind!=="video")throw G0();let j=Q.get(T.operationId);if(j){if(!Y1(j.claim,T)||j.kind!==q||j.seconds!==H.seconds||j.controller.signal.aborted)throw G0();let E=await j.completion;if(await Y(),V(T.contextId),j.controller.signal.aborted)throw G0();return structuredClone(E)}if(Q.size>=16||[...Q.values()].some((E)=>!E.receipt&&!E.controller.signal.aborted&&E.claim.tabId===T.tabId))throw G0();let W,O,F=new Promise((E,P)=>{W=E,O=P});F.catch(()=>{});let z={claim:T,kind:q,seconds:H.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,z);let _=()=>{N(z).catch(()=>{})};H.signal.addEventListener("abort",_,{once:!0});let D=async()=>{await Y(),V(T.contextId),H.signal.throwIfAborted(),z.controller.signal.throwIfAborted()},R;try{await D();let E;if(q==="image"){let P=new Date().toISOString();R=await $.screenshot(structuredClone(L),T.tabId,z.controller.signal);let I=new Date().toISOString();if(await D(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw G0();E=J9.parse({version:1,producer:"primary_mac",context:L,captureId:hQ(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:P,finishedAt:I,sha256:Y9(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(z.host=await $.createVideo(structuredClone(L),T.tabId,H.seconds,z.controller.signal),z.controller.signal.aborted||H.signal.aborted||X)throw await z.host.close(),G0();await z.host.start(),z.started=!0;let P=z.host.completed();if(P.catch(()=>{}),await D(),await H.started?.(),z.stopRequested)M(z);let I=await P;if(z.stop)await z.stop;await D();let f=await z.host.read(I.captureId);R=f.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!Y1(I,f.capture)||!Y1(I.owner,S)||R.length!==I.sizeBytes||Y9(R)!==I.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw G0();await z.host.close(),await D(),E=J9.parse({version:1,producer:"primary_mac",context:L,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await D(),[...Q.values()].reduce((P,I)=>P+(I.bytes?.length??0),R.length)>20971520)throw G0();return z.bytes=Buffer.from(R),z.receipt=E,W(E),structuredClone(E)}catch(E){let P=q==="video"&&!H.signal.aborted&&!z.controller.signal.aborted&&E instanceof Error&&E.message==="mac_recording_worker_failed:no_frames"?new h0("proof_capture_no_frames","The owned tab emitted no recording frames."):G0();throw await N(z).catch(()=>{}),O(P),P}finally{R?.fill(0),H.signal.removeEventListener("abort",_)}}return{async prepare(H){let q=Q1.parse(H);if(!Y1(q.owner,J))throw G0();if(await Y(),await B(),Date.parse(q.preparedAt)>Date.now()||Date.parse(q.expiresAt)<=Date.now())throw G0();let T=Z.get(q.contextId);if(T){if(!Y1(T,q))throw G0();return structuredClone(T)}if(Z.size>=4)throw G0();return Z.set(q.contextId,q),structuredClone(q)},screenshot:(H)=>G(H,"image"),record:(H)=>G(H,"video"),async stop(H){let q=H5.parse(H);await Y(),V(q.contextId);let T=Q.get(q.operationId);if(!T||T.kind!=="video"||!Y1(q,T.claim)||T.controller.signal.aborted)throw G0();M(T)},async publicationCapture(H){await Y(),await B();let q=[...Q.values()].find((T)=>T.receipt?.captureId===H);if(!q?.receipt||!q.bytes||q.controller.signal.aborted)throw G0();if(V(q.claim.contextId),q.bytes.length!==q.receipt.media.sizeBytes||Y9(q.bytes)!==q.receipt.sha256)throw G0();return{capture:structuredClone(q.receipt),bytes:Buffer.from(q.bytes)}},async inspect(H){await Y(),await B();let q=[...Q.values()].find((T)=>T.receipt?.captureId===H);if(!q?.receipt||q.controller.signal.aborted)throw G0();return V(q.claim.contextId),structuredClone(q.receipt)},async close(){X=!0,clearInterval(U);let H=await Promise.allSettled([...Q.values()].map(N));if(Q.clear(),Z.clear(),H.some((q)=>q.status==="rejected"))throw G0()}}}import{createHash as F5,randomUUID as cQ}from"crypto";import{isDeepStrictEqual as f1}from"util";import{realpath as sQ}from"fs/promises";var M5=String.raw`async (media) => {
+`),_=T.slice(0,z);T=T.slice(z+1);try{if(!j){let D=JSON.parse(_);if(!D||Object.keys(D).length!==2||!Number.isInteger(D.port)||D.port<1024||D.port>65535||typeof D.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(D.token))throw Error("probe_receipt_invalid");j=!0,U({port:D.port,token:D.token})}else if(_==="ready")M(!0);else X()}catch{X()}}}),B.then(X);let W,O=!1;try{let F=await Promise.race([G,q]);if(!F||!V.pid||Q.signal.aborted||J.aborted)return!1;let z=Date.now()+4500,_=f$(),D={organizationId:f$(),userId:f$(),runId:f$(),deviceId:f$(),rootId:f$(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:f$(),port:F.port,expiresAtMs:z},R={binding:D,executorLaunchId:_,job:{jobId:D.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:z,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:V.pid,processGroupId:V.pid,executorLaunchId:_}}},E=F8({binding:D,deniedPorts:new Set,readCurrentJob:async()=>!N&&!Q.signal.aborted?R:null});W=await L8({binding:D,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:E,signal:Q.signal}),O=await Promise.race([H,q])===!0&&!Q.signal.aborted&&!J.aborted}catch{O=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),W?.close(),Q.abort(),V.stdin.destroy(),!N)V.kill("SIGKILL");await B}return O&&N}import{execFileSync as C2}from"child_process";import{randomUUID as p0}from"crypto";import{chmodSync as j8,chownSync as b8,closeSync as d3,constants as U$,existsSync as nZ,fstatSync as w8,mkdirSync as D8,mkdtempSync as tZ,openSync as p3,readFileSync as rZ,readSync as oZ,realpathSync as eZ,rmdirSync as $Q,rmSync as JQ}from"fs";import{join as m$}from"path";import{fileURLToPath as ZQ}from"url";var W8=1e4,QQ=!1;function E2(){if(process.platform!=="linux")return!1;return QQ||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=C2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var XQ=Buffer.from([0,255,3,4]);function O8($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function YQ($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function S1($,J={}){if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=I2(),{directory:Q,root:X,runtimeDirectory:Y}=BQ(Z),V=new AbortController,N=()=>V.abort();$.addEventListener("abort",N,{once:!0});let B;V.signal.addEventListener("abort",()=>B?.close(),{once:!0});let U=setTimeout(N,W8),M={organization_id:p0(),user_id:p0(),device_id:p0()},G=p0(),H=p0(),q=p0(),T=p0(),L=Date.now()+W8,j={kind:"workspace_source",target_revision:0,root_grant_revision:1},W=p0().replaceAll("-",""),O,F=Buffer.alloc(0),z,_=!1,D=!1,R=!1,E=!1,P,I,f,S=async(p)=>{while(!p()){if(V.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((w)=>setTimeout(w,20))}if(V.signal.aborted)throw Error("pty_probe_cancelled")},k=!1;try{B=VQ(Q,Z),P=Bun.serve({hostname:"127.0.0.1",port:0,fetch(C,x){let A=new URL(C.url).pathname,y=A===`/device/hands/${W}`?"hands":A===`/device/pty/${W}`?"pty":null;if(y&&x.upgrade(C,{data:{lane:y}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(C){if(C.data.lane==="pty")O=C},message(C,x){if(C.data.lane!=="pty")return;if(typeof x==="string"){try{if(JSON.parse(x).t==="open")_=!0}catch{N()}return}if(F.length+x.length>8192){N();return}F=Buffer.concat([F,x])}}});let p=`ws://127.0.0.1:${P.port}`;if(I=l3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:G,operationId:p0(),attemptId:p0(),claimOwner:M,deviceIdentity:{deviceId:M.device_id,rootId:H,apiOrigin:"https://worker-probe.invalid"},signal:V.signal,payload:{relay_url:`${p}/device/hands/${W}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(L).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:z8,hands_worker_version:P8,hands_worker_artifact_sha256:C8,hands_worker_entrypoint:I8,target_generation:1,target_fence_id:q,environment_binding:j,[E8]:x8},emitEvent:async(C)=>{if(C==="hands.started")E=!0;if(C==="hands.ready")D=!0;if(C==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:S8(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:ZQ(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!D)N()}),await S(()=>D),A8({root:X,runId:G,payload:{version:1,snapshot_id:T,revision:1,run_id:G,root_id:H,device_id:M.device_id,binding:{...j,target_generation:1,target_fence_id:q},expires_at:new Date(L).toISOString(),variables:{PTY_PROBE_VALUE:W},git:null}}),f=R8({root:X,runId:G,rootId:H,deviceId:M.device_id,owner:M,workspace:{kind:"root"},authority:{device_id:M.device_id,binding:j.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:q},signal:V.signal,session:{jobId:`pty-${p0()}`,sessionId:"pty-readiness",operationId:p0(),cols:80,rows:24,leaseExpiresAtMs:L,relayUrl:`${p}/device/pty/${W}`},emit:async(C,x)=>{if(C==="pty.ready")z=x}}).catch(()=>{N()}),await S(()=>Boolean(z&&O&&_)),O.send(JSON.stringify({t:"resize",cols:100,rows:30})),O.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${W}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${B.wait("background")}) & ${O8("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${O8("foreground")}; ${B.wait("foreground")}'
+`)),await S(()=>nZ(m$(X,"foreground.pid"))&&F.includes(XQ)),!F.includes("30 100")||z.job.environmentSnapshotId!==T||z.job.environmentRevision!==1)return!1;let w=["background.pid","foreground.pid"].map((C)=>GQ(m$(X,C)));if(new Set(w).size!==2||w.some((C)=>!Number.isSafeInteger(C)||C<2||C===z.job.process.pid))return!1;if(process.platform==="linux"){if(!w.every((C)=>YQ(rZ(`/proc/${C}/stat`,"utf8"),C,z.job.process.pid)))return!1}else{let x=C2("/bin/ps",["-o","pid=,pgid=","-p",w.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((A)=>A.trim().split(/\s+/).map(Number));if(x.length!==2||new Set(x.map(([A])=>A)).size!==2||x.some((A)=>A.length!==2||!w.includes(A[0])||A[0]!==A[1]))return!1}if(O.send(JSON.stringify({t:"close"})),await f,V.signal.aborted)return!1;for(let C of[z.job.process.pid,...w])try{return process.kill(C,0),!1}catch(x){if(!(x instanceof Error&&("code"in x)&&x.code==="ESRCH"))return!1}k=!0}catch{k=!1}finally{if(clearTimeout(U),$.removeEventListener("abort",N),N(),B?.close(),await f,await I,await P?.stop(!0),!E||R)KQ({directory:Q,root:X},Z)}return k&&R&&!$.aborted}function VQ($,J){let Z={foreground:m$($,"foreground.lifeline"),background:m$($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");C2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))d3(Y)};try{for(let Y of Object.values(Z)){let V=p3(Y,U$.O_RDONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW);try{if(Q.push(p3(Y,U$.O_WRONLY|U$.O_NONBLOCK|U$.O_NOFOLLOW)),!w8(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{d3(V)}if(J)b8(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function y8($=(J)=>S1(J)){let J=new AbortController,Z=JSON.stringify(I2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(I2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((V)=>{Y=setTimeout(V,X)})]),clearTimeout(Y)}}}function GQ($){let J;try{J=p3($,U$.O_RDONLY|U$.O_NOFOLLOW|U$.O_NONBLOCK)}catch{return Number.NaN}try{let Z=w8(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=oZ(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{d3(J)}}function BQ($,J=eZ("/tmp")){let Z=tZ(m$(J,"reason-pty-probe-")),Q=m$(Z,"workspace"),X=m$(Z,"private");if(D8(Q,{mode:448}),D8(X,{mode:448}),$)j8(Z,493),j8(Q,493),b8(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function KQ($,J){if(J)try{C2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),$Q($.root)}catch{return}JQ($.directory,{recursive:!0,force:!0})}var a8=5000,v$="ARA_WORKER_PROBE_READY";function FQ($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{NQ($,J,{cwd:Z,env:Q,signal:X,timeout:a8,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8"},(V,N)=>Y(!V&&!X.aborted&&N===v$))})}function _Q($,J){if(c3($)==="bash")return["--noprofile","--norc","-c",J];if(c3($)==="zsh"||c3($)==="sh")return["-f","-c",J];return null}function jQ($,J){let Z=g8({home:J,temporaryDirectory:J}),Q=(Y,V,N)=>FQ(Y,V,$.workspaceRoot,Z,N),X=async(Y,V,N,B=(M)=>M===v$,U=!1)=>{let M=await r8(Y,V,{cwd:$.workspaceRoot,root:$.workspaceRoot,allowWrite:!1,allowProcessInspection:U,timeoutMs:a8,signal:N});return!N.aborted&&!M.timedOut&&!M.truncated&&M.exitCode===0&&B(M.stdout)};return{workspaceRead:async(Y)=>{return await h8($.workspaceRoot,k8.R_OK),await m8($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await h8($.workspaceRoot,k8.W_OK),Y.aborted)return!1;let V=s8(a3($.workspaceRoot,".ara-worker-probe-")),N=a3(V,"receipt");try{let B=await qQ(N,"wx",384);try{await B.writeFile(v$),await B.sync()}finally{await B.close()}return await f8(N,"utf8")===v$&&!Y.aborted}finally{await TQ(N).catch(()=>{}),await LQ(V).catch(()=>{})}},confinedShell:(Y)=>X(t8(),["-c",`printf ${v$}`],Y),confinedGit:(Y)=>X("git",["--version"],Y,(V)=>/^git version \S+/.test(V)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(U)=>U.includes(`p${process.pid}
+`)&&/^n\//m.test(U),!0);if(process.platform!=="linux")return!1;let[V,N,B]=await Promise.all([MQ("/proc/self/cwd"),m8("/proc/self/fd"),f8("/proc/net/tcp","utf8")]);return!Y.aborted&&V.length>0&&N.length>0&&B.includes("local_address")},bash:(Y)=>Q("/bin/bash",["--noprofile","--norc","-c",`printf ${v$}`],Y),jobs:(Y)=>T8($,Y),environment:(Y)=>M8($,J,Y),preview:(Y)=>_8(J,Y),boundPty:(Y)=>S1(Y),desktopDisplay:()=>n8(),desktopAutomation:async()=>{let Y=n3();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
+`);return c8()},desktopBrowser:async()=>w1()?.features.browser===!0,fullControlShell:(Y)=>{let V=p8(),N=_Q(V,`printf ${v$}`);return N?Q(V,N,Y):Promise.resolve(!1)}}}function n3(){return process.platform==="darwin"&&w1()?.features.computer===!0?l8():null}var t3=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function DQ($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=i3()){return b1($,J,Z,Q,X).final}function b1($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=i3(),Y,V){let N,B;try{if(K$($),v0(),!J)e(g($),!0),N=s8(a3(g($),"probe-")),J=jQ($,N);B=J}catch(O){let F=Promise.reject(O);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let U=async(O,F)=>{if(Z.aborted||!F&&!B[O])return!1;let z,_=new Promise((D)=>{z=()=>D(!1)});Z.addEventListener("abort",z,{once:!0});try{return await Promise.race([F??B[O](Z),_])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",z)}},M=$.executionMode==="host",G=M?U("boundPty",Y):Promise.resolve(!1),H=Promise.resolve(V).then(()=>Promise.all(M?[U("preview"),G,U("desktopDisplay"),U("desktopAutomation"),U("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),q=(async()=>{let[O,F,z,_,D,R,E,P,I]=await Promise.all([Promise.resolve(Q).then((f)=>f.read?U("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((f)=>f.write?U("workspaceWrite"):!1,()=>!1),X?U("confinedShell"):!1,X?U("confinedGit"):!1,U("processInspection"),...M?[U("bash"),U("jobs"),U("environment"),U("fullControlShell")]:[!1,!1,!1,!1]]);if(M&&(!R||!E||!P)&&!V)await H;if(M){if(!R)R=await U("bash");if(!E)E=await U("jobs");if(!P)P=await U("environment")}return{read:O,write:F,shell:z,git:_,processes:D,bash:R,jobs:E,environment:P,full:I}})(),T=(O,F)=>{let{read:z,write:_,shell:D,git:R,processes:E,bash:P,jobs:I,environment:f,full:S}=O,{preview:k,boundPty:p,desktopDisplay:w,desktopAutomation:C,desktopBrowser:x}=F,A=u8(),y=M&&process.platform==="darwin"&&S&&UQ("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":z,"fs.write":_,"inference.custom.v1":M&&z,"fs.export":z&&A,"fs.import":_&&A,"exec.run":D&&X,"git.run":D&&R&&X,"process.list":(process.platform==="linux"||D)&&E,"ports.list":(process.platform==="linux"||D)&&E,"exec.full":P&&S&&X,"hands.connect":z&&_&&P&&I,"jobs.control":z&&_&&P&&I,"pty.start":z&&_&&P&&I&&f&&p,"environment.install":z&&_&&P&&I&&f,"github.local.v1":(process.platform==="darwin"||process.platform==="linux"&&process.geteuid?.()!==0)&&z&&_&&P&&I&&f,"tunnel.open":z&&_&&P&&I&&f&&k,"tunnel.close":z&&_&&P&&I&&f&&k,"preview.serve.v1":z&&P&&I&&k&&S,"display.stream.v1":w,"automation.call.v1":C,"simulator.call.v1":y,"simulator.stream.v1":y,"browser.pr-proof.v1":C&&x&&v8()===null,"workspace.setup.v1":M&&d8()})},L=q.then(async(O)=>T(O,{preview:!1,boundPty:await Promise.race([G,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),j=(async()=>{try{let O=await q,[F,z,_,D,R]=await H;if(M&&!z&&O.read&&O.write&&O.bash&&O.jobs&&O.environment)z=await U("boundPty");return T(O,{preview:F,boundPty:z,desktopDisplay:_,desktopAutomation:D,desktopBrowser:R})}finally{if(N)HQ(N,{recursive:!0,force:!0})}})();L.catch(()=>{});let W=(async()=>{let O=await q;if(!(O.read&&O.write&&O.bash&&O.jobs&&O.environment))return!1;return await G||(await j)["pty.start"]===!0})();return W.catch(()=>{}),{initial:L,final:j,pty:W}}var WQ=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],OQ=[60000,300000,900000];function s3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return WQ.filter((Z)=>J[Z]!==!0)}function i8($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>DQ($.config,void 0,Y,$.permissions)),Q=$.readiness,X=s3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
+`),(async()=>{for(let Y of $.delaysMs??OQ){if(await new Promise((B)=>{let U=setTimeout(B,Y);$.signal.addEventListener("abort",()=>{clearTimeout(U),B()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let V;try{V=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let N=s3($.config,Q).filter((B)=>V[B]===!0);if(N.length>0)Q=Object.freeze({...Q,...Object.fromEntries(N.map((B)=>[B,!0]))}),J(`Reason worker: ready after probing again (${N.join(", ")}).
+`),$.onReady(Q,N);if(s3($.config,Q).length===0)return}})()}import{execFile as DX}from"child_process";import{createHash as WX,randomUUID as H9}from"crypto";import{lstat as OX,readdir as h5,readFile as p5,realpath as zX,stat as AX}from"fs/promises";import{basename as RX,join as N9}from"path";import{promisify as PX}from"util";import{createConnection as zQ}from"net";import{endianness as $5}from"os";var y1=4,r3=1e4;class O${socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=zQ(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#V(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},V=AQ({jsonrpc:"2.0",id:Q,method:$,params:X}),N=new Promise((B,U)=>{let M=setTimeout(()=>{this.#Z.delete(Q),U(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:B,reject:U,timeout:M})});return Z.write(V),await N}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#V($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=y1){let J=$5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=y1+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(y1,Z);this.#$=this.#$.subarray(Z),this.#G(JSON.parse(Q.toString("utf8")))}}#G($){if(!n0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),n0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class x2{client;cdp;constructor($){this.client="client"in $?$.client:new O$($),this.cdp=new Q5(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=RQ(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new J5(this,$)}getTabs(){return this.client.getTabs()}}class J5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new Z5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class Z5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class Q5{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(n0(Q)&&n0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return n0(Q)&&n0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";o8(Q);let X=Z.timeoutMs??r3;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),V=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(n0(V)&&typeof V.errorText==="string"&&V.errorText)throw Error(`Browser failed to navigate tab ${$}: ${V.errorText}`);return await Y.catch(async(N)=>{let B=await this.readDocumentState($);if(e8(B,Q))return;throw N}),V}async waitForLoadState($,J={}){let Z=J.state??"load";o8(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(e8(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??r3)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return n0(J)?{href:o3(J.href),readyState:o3(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??r3;return new Promise((X,Y)=>{let V=!1,N=null,B,U=()=>{if(V)return!1;return V=!0,clearTimeout(B),N?.(),!0};B=setTimeout(()=>{if(U())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),N=this.client.onNotification((M)=>{try{if(J(M)){if(U())X(M)}}catch(G){if(U())Y(G instanceof Error?G:Error(String(G)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=PQ(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function AQ($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(y1+J.length);if($5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,y1),Z}function n0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function RQ($,J){if(!n0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function o8($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function e8($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function PQ($,J){if($.method!=="onCDPEvent"||!n0($.params))return null;let Z=$.params.source;if(!n0(Z)||Z.tabId!==J)return null;return{method:o3($.params.method)}}function o3($){return typeof $==="string"?$:void 0}import{createHash as IQ}from"crypto";function X5($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${IQ("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as FX}from"async_hooks";import{isDeepStrictEqual as y5}from"util";import{createHash as _X}from"crypto";var CQ=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var EQ=new Set(["png","jpg","jpeg","gif","webp"]),xQ=new Set(["webm","mp4"]);function SQ($){if(!$)return null;try{return new URL($).origin}catch{return null}}function Y5($,J){let Z;try{Z=new URL($)}catch{return null}let Q=SQ(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=CQ.exec(Z.pathname);if(!Y)return null;let V=Y[1]?.toLowerCase(),N=Y[2]?.toLowerCase(),B=Y[3]?.toLowerCase(),U=Y[4]?.toLowerCase();if(!V||!N||!B||!U)return null;let M=EQ.has(U)?"image":xQ.has(U)?"video":null;if(!M)return null;let G=/^(before|after)[\s:_-]+/.exec(B),H=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:H,runId:V,artifactId:N,fileName:`${B}.${U}`,kind:M,phase:G?.[1]==="before"||G?.[1]==="after"?G[1]:null}}var bQ=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,S2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),g$=()=>{throw Error("cloud_browser_media_request_invalid")};function b2($){if(!S2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!bQ.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return g$();let J;try{J=new URL($.configuredMediaOrigin)}catch{return g$()}if(J.protocol!=="https:"||J.username||J.password||J.port||!V5(J.origin,{mode:"public_web"}).allowed)return g$();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!S2(Y)||Object.keys(Y).some((N)=>!["url","sourceUrl","kind"].includes(N))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return g$();let V=Y5(Y.url,J.origin);if(!V||new URL(V.url).origin!==J.origin||V.runId!==Z||V.kind!==Y.kind||V.url!==Y.url||Q.has(Y.url))return g$();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let N;try{N=new URL(Y.sourceUrl)}catch{return g$()}let B=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(N.pathname)?.[1];if(Y.kind!=="image"||N.origin!=="https://camo.githubusercontent.com"||N.username||N.password||N.search||N.hash||!B||B.length%2!==0||Buffer.from(B,"hex").toString("utf8")!==Y.url)return g$()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function G5($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!S2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let V=J.media[Y];if(!S2(X)||X.url!==V.url||X.sourceUrl!==V.sourceUrl||X.kind!==V.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||V.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...V,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...V.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var $9="browser.pr-proof.v1",j0=K.string().uuid(),Z1=K.string().regex(/^[a-f0-9]{64}$/),d$=K.iso.datetime({precision:3}),e3=K.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),U5=K.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),l0=K.object({kind:K.literal("primary_mac"),version:K.literal(1),organizationId:e3,userId:e3,sessionId:e3,runId:j0,deviceId:j0,rootId:j0,rootRevision:K.string().min(1).max(64),binding:K.enum(["workspace_source","mcp_control"]),targetRevision:K.number().int().nonnegative(),generation:j0,profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:K.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),wQ=K.custom().transform(($,J)=>{try{return N5($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),K.NEVER}}),Q1=K.object({version:K.literal(1),owner:l0,contextId:j0,preparedAt:d$,expiresAt:d$,prUrl:U5,headSha:K.string().regex(/^[a-f0-9]{40}$/),skillDigest:Z1,evidenceKind:K.enum(["image","video"]),visualPlan:wQ.optional(),uploadOrigin:K.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),J9=K.object({version:K.literal(1),producer:K.literal("primary_mac"),context:Q1,captureId:j0,operationId:j0,attemptId:j0,tabId:K.number().int().positive(),startedAt:d$,finishedAt:d$,sha256:Z1,media:K.discriminatedUnion("contentType",[K.object({contentType:K.literal("image/png"),sizeBytes:K.number().int().min(24).max(8388608),width:K.number().int().min(1).max(4096),height:K.number().int().min(1).max(4096)}).strict(),K.object({contentType:K.literal("video/webm"),sizeBytes:K.number().int().min(128).max(10485760),durationSeconds:K.number().min(0.05).max(15),frameCount:K.number().int().min(1).max(450),receivedFrameCount:K.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),nN=K.discriminatedUnion("action",[K.object({action:K.literal("screenshot"),context_id:j0,tab_id:K.number().int().positive()}).strict(),K.object({action:K.literal("start_video"),context_id:j0,tab_id:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),K.object({action:K.literal("stop_video"),recording_operation_id:j0}).strict()]),y2=K.object({login:K.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:K.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),w2=K.string().regex(/^[1-9][0-9]{0,19}$/),k1=K.object({version:K.literal(1),owner:l0,expectedActorId:w2.nullable(),repositoryId:w2,repositoryFullName:K.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),yQ=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],Z9=K.discriminatedUnion("status",[k1.extend({status:K.literal("ready"),observedActor:y2,checkedAt:d$}),k1.extend({status:K.literal("not_ready"),reason:K.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:K.enum(yQ).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),u$=K.object({version:K.literal(1),owner:l0,expectedActorId:w2.nullable(),authenticatedActor:y2,attemptId:j0,captureId:j0,prUrl:U5,repositoryId:w2,headSha:K.string().regex(/^[a-f0-9]{40}$/),sha256:Z1,sizeBytes:K.number().int().min(128).max(10485760),contentType:K.literal("video/webm")}).strict(),H5=K.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),X1=K.discriminatedUnion("status",[u$.extend({status:K.literal("not_attempted"),reason:K.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),u$.extend({status:K.literal("uncertain"),reason:K.literal("upload_outcome_unknown")}),u$.extend({status:K.literal("uploaded"),observedActor:y2,nativeUrl:H5,uploadedAt:d$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),h1=u$.extend({nativeUrl:H5,observedActor:y2,bodySha256:Z1}),Q9=K.discriminatedUnion("status",[h1.extend({status:K.literal("incomplete"),reason:K.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),h1.extend({status:K.literal("verified"),sourceSha256:Z1,width:K.number().int().min(1).max(4096),height:K.number().int().min(1).max(4096),durationSeconds:K.number().positive().max(30),advancedSeconds:K.number().min(0.05).max(10),advancedFrames:K.number().int().positive(),playbackRestored:K.literal(!0),verifiedAt:d$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),kQ=K.custom().transform(($,J)=>{try{let Z=b2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),K.NEVER}}),hQ=K.discriminatedUnion("action",[K.object({action:K.literal("auth_check"),input:k1}).strict(),K.object({action:K.literal("prepare"),context:Q1}).strict(),K.object({action:K.literal("capture_png"),owner:l0,contextId:j0,tabId:K.number().int().positive()}).strict(),K.object({action:K.literal("start_video"),owner:l0,contextId:j0,tabId:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),K.object({action:K.literal("inspect_capture"),owner:l0,captureId:j0}).strict(),K.object({action:K.literal("publish_video"),input:u$}).strict(),K.object({action:K.literal("verify_png_media"),owner:l0,media:kQ}).strict().refine(($)=>$.media.runId===$.owner.runId),K.object({action:K.literal("verify_saved_media"),input:h1}).strict(),K.object({action:K.literal("publish_png"),owner:l0,attemptId:j0,captureId:j0,sha256:Z1,sizeBytes:K.number().int().min(24).max(8388608),storagePath:K.string().max(512),uploadUrl:K.string().url().max(8192)}).strict()]);var q5="pr-proof.stop.v1",X9=K.object({requestId:j0,command:hQ}).strict();var fQ={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},B5={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},K5={type:"integer",minimum:1,description:"An already-owned tab's id."},tN={...fQ,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:B5,tab_id:K5}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:B5,tab_id:K5,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};import{createHash as mQ,randomUUID as vQ}from"crypto";import{isDeepStrictEqual as Y1}from"util";var M5=K.object({operationId:K.string().uuid(),attemptId:K.string().uuid(),contextId:K.string().uuid(),tabId:K.number().int().positive()}).strict(),G0=()=>Error("mac_pr_proof_capture_unavailable"),Y9=($)=>mQ("sha256").update($).digest("hex");function T5($){let J=l0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw G0();if(await $.assertCurrent(),X)throw G0()},V=(H)=>{let q=Z.get(H);if(!q||Date.parse(q.expiresAt)<=Date.now())throw G0();return q},N=(H)=>H.disposal??=(async()=>{H.controller.abort(),H.bytes?.fill(0),H.bytes=void 0,H.receipt=void 0;try{await H.host?.close()}catch{throw X=!0,G0()}})(),B=async()=>{for(let[H,q]of Z){if(Date.parse(q.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,j])=>j.claim.contextId===H);if((await Promise.allSettled(T.map(([,j])=>N(j)))).some((j)=>j.status==="rejected"))throw G0();for(let[j]of T)Q.delete(j);Z.delete(H)}},U=setInterval(()=>{B().catch(()=>{X=!0})},1000);U.unref();let M=(H)=>{if(H.stopRequested=!0,H.started&&H.host&&!H.stop)H.stop=H.host.stop(),H.stop.catch(()=>H.controller.abort())};async function G(H,q){let T=M5.parse(H.claim);if(q==="video"&&(!Number.isInteger(H.seconds)||H.seconds<1||H.seconds>15))throw G0();await Y(),H.signal.throwIfAborted(),await B();let L=V(T.contextId);if(q==="video"&&L.evidenceKind!=="video")throw G0();let j=Q.get(T.operationId);if(j){if(!Y1(j.claim,T)||j.kind!==q||j.seconds!==H.seconds||j.controller.signal.aborted)throw G0();let E=await j.completion;if(await Y(),V(T.contextId),j.controller.signal.aborted)throw G0();return structuredClone(E)}if(Q.size>=16||[...Q.values()].some((E)=>!E.receipt&&!E.controller.signal.aborted&&E.claim.tabId===T.tabId))throw G0();let W,O,F=new Promise((E,P)=>{W=E,O=P});F.catch(()=>{});let z={claim:T,kind:q,seconds:H.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(T.operationId,z);let _=()=>{N(z).catch(()=>{})};H.signal.addEventListener("abort",_,{once:!0});let D=async()=>{await Y(),V(T.contextId),H.signal.throwIfAborted(),z.controller.signal.throwIfAborted()},R;try{await D();let E;if(q==="image"){let P=new Date().toISOString();R=await $.screenshot(structuredClone(L),T.tabId,z.controller.signal);let I=new Date().toISOString();if(await D(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw G0();E=J9.parse({version:1,producer:"primary_mac",context:L,captureId:vQ(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:P,finishedAt:I,sha256:Y9(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(z.host=await $.createVideo(structuredClone(L),T.tabId,H.seconds,z.controller.signal),z.controller.signal.aborted||H.signal.aborted||X)throw await z.host.close(),G0();await z.host.start(),z.started=!0;let P=z.host.completed();if(P.catch(()=>{}),await D(),await H.started?.(),z.stopRequested)M(z);let I=await P;if(z.stop)await z.stop;await D();let f=await z.host.read(I.captureId);R=f.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!Y1(I,f.capture)||!Y1(I.owner,S)||R.length!==I.sizeBytes||Y9(R)!==I.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw G0();await z.host.close(),await D(),E=J9.parse({version:1,producer:"primary_mac",context:L,captureId:I.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:I.startedAt,finishedAt:I.finishedAt,sha256:I.sha256,media:{contentType:"video/webm",sizeBytes:I.sizeBytes,durationSeconds:I.durationSeconds,frameCount:I.frameCount,receivedFrameCount:I.receivedFrameCount}})}if(await D(),[...Q.values()].reduce((P,I)=>P+(I.bytes?.length??0),R.length)>20971520)throw G0();return z.bytes=Buffer.from(R),z.receipt=E,W(E),structuredClone(E)}catch(E){let P=q==="video"&&!H.signal.aborted&&!z.controller.signal.aborted&&E instanceof Error&&E.message==="mac_recording_worker_failed:no_frames"?new h0("proof_capture_no_frames","The owned tab emitted no recording frames."):G0();throw await N(z).catch(()=>{}),O(P),P}finally{R?.fill(0),H.signal.removeEventListener("abort",_)}}return{async prepare(H){let q=Q1.parse(H);if(!Y1(q.owner,J))throw G0();if(await Y(),await B(),Date.parse(q.preparedAt)>Date.now()||Date.parse(q.expiresAt)<=Date.now())throw G0();let T=Z.get(q.contextId);if(T){if(!Y1(T,q))throw G0();return structuredClone(T)}if(Z.size>=4)throw G0();return Z.set(q.contextId,q),structuredClone(q)},screenshot:(H)=>G(H,"image"),record:(H)=>G(H,"video"),async stop(H){let q=M5.parse(H);await Y(),V(q.contextId);let T=Q.get(q.operationId);if(!T||T.kind!=="video"||!Y1(q,T.claim)||T.controller.signal.aborted)throw G0();M(T)},async publicationCapture(H){await Y(),await B();let q=[...Q.values()].find((T)=>T.receipt?.captureId===H);if(!q?.receipt||!q.bytes||q.controller.signal.aborted)throw G0();if(V(q.claim.contextId),q.bytes.length!==q.receipt.media.sizeBytes||Y9(q.bytes)!==q.receipt.sha256)throw G0();return{capture:structuredClone(q.receipt),bytes:Buffer.from(q.bytes)}},async inspect(H){await Y(),await B();let q=[...Q.values()].find((T)=>T.receipt?.captureId===H);if(!q?.receipt||q.controller.signal.aborted)throw G0();return V(q.claim.contextId),structuredClone(q.receipt)},async close(){X=!0,clearInterval(U);let H=await Promise.allSettled([...Q.values()].map(N));if(Q.clear(),Z.clear(),H.some((q)=>q.status==="rejected"))throw G0()}}}import{createHash as j5,randomUUID as iQ}from"crypto";import{isDeepStrictEqual as f1}from"util";import{realpath as nQ}from"fs/promises";var L5=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -68,24 +68,24 @@ ${J?.directory??g($)}`).digest("hex")}function D1($,J){c(b0(g($),W1),{version:1,
     }
   }));
   return { verified: true, items };
-}`;var T5=function($){let J=this??globalThis,Z=10485760,Q=(V,N)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let B=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!B&&(J.location.href===V.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==V.prUrl||!B)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(B))return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),M=/^[1-9][0-9]{0,19}$/.test(U||"")?U:null,G={login:B,id:M};if(V.expectedActorId!==null&&M!==V.expectedActorId||V.authenticatedActor&&(B!==V.authenticatedActor.login||M!==V.authenticatedActor.id)||V.observedActor&&(B!==V.observedActor.login||M!==V.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==V.repositoryId)return{ok:!1,reason:"identity_mismatch"};let H=J.document.querySelector('link[rel="canonical"]');if(H&&H.href!==V.prUrl)return{ok:!1,reason:"identity_mismatch"};if(N){let q=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),L=q?.closest("file-attachment"),j=q?.closest("form"),W=new J.URL(V.prUrl).pathname+"/comment";if(!q||q.value!==""||!T||T.type!=="file"||T.disabled||!L||L.getAttribute("input")!==T.id||L.getAttribute("data-upload-repository-id")!==V.repositoryId||!j||new J.URL(j.action,J.location.href).origin!=="https://github.com"||new J.URL(j.action,J.location.href).pathname!==W)return{ok:!1,reason:"attachment_unavailable"};let O=L.getAttribute("data-upload-policy-url");if(!O||new J.URL(O,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:G}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let V=$.expected,N=Q(V,!0);if(!N.ok)return{dispatched:!1,reason:N.reason};let B=J.Uint8Array.from(J.atob($.base64||""),(H)=>H.charCodeAt(0));if(B.length!==V.sizeBytes||B.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let U=new J.File([B],V.captureId+".webm",{type:"video/webm"}),M=new J.DataTransfer;M.items.add(U);let G=J.document.querySelector("#fc-new_comment_field");if(!G)return{dispatched:!1,reason:"attachment_unavailable"};return G.files=M.files,G.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:N.actor}}if($.operation==="upload_result"){let V=Q($.expected,!1);if(!V.ok)throw Error("github_video_identity_changed");let N=J.document.querySelector("#new_comment_field")?.value?.trim(),B="["+$.expected.captureId+".webm](",U=N?.startsWith(B)&&N.endsWith(")")?N.slice(B.length,-1):N;if(!U||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(U))return null;return{nativeUrl:U,actor:V.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let V=X.nativeUrl.split("/").pop(),N=(W)=>{try{let O=new J.URL(W,J.location.href);if(O.protocol!=="https:"||O.username||O.password||O.port||O.hash)return!1;if(O.origin==="https://github.com")return O.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(O.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+V+"\\.(webm|mp4)$").test(O.pathname)}catch{return!1}},B=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((W)=>/^issue-[1-9][0-9]*$/.test(W.closest('[id^="issue-"]')?.id||"")&&!W.closest("form")&&!W.closest(".preview-content"));if(B.length!==1)throw Error("saved_body_missing");let U=B[0],M=[...U.querySelectorAll("video")].filter((W)=>[W.currentSrc,W.src,...[...W.querySelectorAll("source")].map((O)=>O.src)].some(N));if(M.length!==1)throw Error("saved_player_missing");let G=M[0],H={muted:G.muted,volume:G.volume,rate:G.playbackRate,preload:G.preload},q=new J.AbortController,T=J.setTimeout(()=>q.abort(),12000),L=(W)=>J.Promise.race([W,new J.Promise((O,F)=>{if(q.signal.aborted)F(Error("playback_timeout"));else q.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),j=async(W)=>{while(!W()){if(G.error||q.signal.aborted)throw Error("playback_unverified");await new J.Promise((O)=>J.setTimeout(O,25))}};try{if(G.muted=!0,G.playbackRate=1,G.currentTime=0,G.readyState<2)G.preload="auto",G.load();await j(()=>G.readyState>=2&&G.videoWidth>0&&G.videoHeight>0);let W=G.currentSrc;if(!N(W))throw Error("source_unbound");let O=await L(J.fetch(W,{credentials:"same-origin",redirect:"error",signal:q.signal}));if(O.status!==200||!N(O.url)||O.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(O.headers.get("content-type")||"")||!O.body)throw Error("source_unverifiable");let F=O.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let z=O.body.getReader(),_=[],D=0;try{for(;;){let k=await L(z.read());if(k.done)break;if(D+=k.value.length,D>10485760||D>X.sizeBytes)throw Error("source_too_large");_.push(k.value)}}finally{await z.cancel().catch(()=>{}),z.releaseLock()}if(D!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(D),E=0;for(let k of _)R.set(k,E),E+=k.length;let P=[...new J.Uint8Array(await L(J.crypto.subtle.digest("SHA-256",R)))].map((k)=>k.toString(16).padStart(2,"0")).join("");if(P!==X.sha256||G.currentSrc!==W||!U.contains(G))throw Error("source_changed");let I=G.currentTime,f=G.getVideoPlaybackQuality().totalVideoFrames;if(await L(G.play()),await j(()=>G.currentTime-I>=0.05&&G.getVideoPlaybackQuality().totalVideoFrames>f),!Q(X,!1).ok||G.currentSrc!==W||!U.contains(G)||G.error)throw Error("player_changed");return{status:"verified",sourceSha256:P,width:G.videoWidth,height:G.videoHeight,durationSeconds:G.duration,advancedSeconds:G.currentTime-I,advancedFrames:G.getVideoPlaybackQuality().totalVideoFrames-f,playbackRestored:!0}}finally{if(J.clearTimeout(T),q.abort(),G.pause(),G.currentTime=0,G.muted=H.muted,G.volume=H.volume,G.playbackRate=H.rate,G.preload=H.preload,!G.paused||G.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as fQ}from"child_process";import{lstat as mQ,realpath as vQ}from"fs/promises";import{join as L5,resolve as gQ}from"path";import{promisify as uQ}from"util";var dQ=uQ(fQ);async function pQ($,J){let Z=await vQ($),{stdout:Q}=await dQ(L5(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return K.array(K.object({browser:K.string(),directory:K.string(),connected:K.boolean().optional(),source:K.string(),socketPath:K.string().optional(),instanceId:K.string().optional(),extensionId:K.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&gQ(Y.source)===L5(Z,"Reason Browser Use","manifest.json"))}async function k2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await pQ($,Z)).filter((V)=>V.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await mQ(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as lQ}from"crypto";function V1($){return`reason-browser-${lQ("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var _5=K.discriminatedUnion("ok",[K.object({ok:K.literal(!0),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict(),K.object({ok:K.literal(!1),reason:K.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),j5=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.string(),extensionInstanceId:K.string(),nativeHostName:K.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function V9($){let J=l0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await aQ($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${cQ()}`,Y=!1,V=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},N=async(M)=>{if(!f1(J,M.owner))throw Z0();await V()},B=async(M)=>{await N(M);let G=await $.readVideo(M.captureId);try{await V();let H=G.capture;if(!f1(H.context.owner,J)||H.captureId!==M.captureId||H.context.prUrl!==M.prUrl||H.context.headSha!==M.headSha||H.media.contentType!=="video/webm"||H.media.sizeBytes!==M.sizeBytes||H.sha256!==M.sha256||G.bytes.length!==M.sizeBytes||G.bytes.length<128||G.bytes.length>10485760||G.bytes.readUInt32BE(0)!==440786851||F5("sha256").update(G.bytes).digest("hex")!==M.sha256)throw Z0();return G}catch(H){throw G.bytes.fill(0),H}};async function U(M,G,H){await V();let q=await Z.discover(AbortSignal.timeout(5000)),T=new x2({socketPath:q.socketPath,sessionId:X,timeoutMs:5000}),L,j=!1,W,O=new Promise((_,D)=>{W=setTimeout(()=>{j=!0,D(Z0())},60000)});O.catch(()=>{});let F=(_)=>Promise.race([_,O]),z=async()=>{if(j)throw Z0();if(await V(),j)throw Z0()};try{await F(T.connect());let _=j5.parse(await F(T.client.getInfo()));if(_.metadata.extensionId!==q.extensionId||_.metadata.extensionInstanceId!==q.instanceId||!_.metadata.nativeHostName)throw Z0();await z(),H?.("connected");let D=T.newTab();D.then((P)=>{if(j)P.close().catch(()=>{Y=!0})},()=>{}),L=await F(D),await z(),await F(L.goto(M,{waitUntil:"domcontentloaded",timeoutMs:15000})),await z(),H?.("loaded");let E=await F(G(L,async(P)=>{await z();let I=await F(L.evaluate(`(${T5.toString()})(${JSON.stringify(P)})`,{awaitPromise:!0}));return await z(),I},z));return await z(),E}finally{j=!0,clearTimeout(W);try{if(L){let _;try{await Promise.race([L.close(),new Promise((D,R)=>{_=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(_)}}}catch{throw Y=!0,Z0()}finally{T.close()}await V()}}return{async screenshot(M,G,H){let q=Q1.parse(M);if(await N(q),!Number.isSafeInteger(G)||G<1||Date.parse(q.expiresAt)<=Date.now())throw Z0();H.throwIfAborted();let T=await Z.discover(H),L=new x2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),j;try{await L.connect();let W=j5.parse(await L.client.getInfo());if(W.metadata.extensionId!==T.extensionId||W.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!K.array(K.object({id:K.number()})).max(256).parse(await L.getTabs()).some((z)=>z.id===G))throw Z0();await V(),H.throwIfAborted();let F=K.object({data:K.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await L.cdp.call(G,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(j=Buffer.from(F.data,"base64"),j.toString("base64")!==F.data||j.length>8388608)throw Z0();if(await V(),H.throwIfAborted(),Date.parse(q.expiresAt)<=Date.now())throw Z0();return j}catch{throw j?.fill(0),Z0()}finally{L.close()}},async verifyImages(M){let G=b2(M);if(G.runId!==J.runId||G.media.some((H)=>H.kind!=="image"))throw Z0();return U("about:blank",async(H,q,T)=>{let L=H.browser.client,j=new Set(G.media.map((P)=>P.sourceUrl)),W=new Map,O=new Set,F=!1,z=0,_=!1,D=new Set,R=(P,I)=>{if(D.size>=32){F=!0;return}let f=L.executeCdp(H.id,P,I);D.add(f),f.catch(()=>{F=!0}).finally(()=>D.delete(f))},E=L.onNotification((P)=>{if(P.method!=="onCDPEvent"||!H$(P.params)||!H$(P.params.source)||P.params.source.tabId!==H.id||!H$(P.params.params))return;let I=P.params.params;if(++z>512){F=!0;return}if(P.params.method==="Fetch.requestPaused"){let k=typeof I.requestId==="string"&&H$(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&j.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!k)F=!0;R(k?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...k?{}:{errorReason:"BlockedByClient"}})}if(P.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(P.params.method==="Network.loadingFailed")F=!0;if(P.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")O.add(I.requestId);if(P.params.method!=="Network.responseReceived")return;if(!H$(I.response)||typeof I.response.url!=="string"||!j.has(I.response.url)||typeof I.requestId!=="string"||!H$(I.response.headers)||I.type!=="Image"){F=!0;return}let f=Object.fromEntries(Object.entries(I.response.headers).map(([k,p])=>[k.toLowerCase(),p])),S=Number(f["content-length"]);if(W.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof f["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(f["content-length"])||!Number.isSafeInteger(S)||S>8388608||f["content-range"]||f["content-encoding"]&&f["content-encoding"]!=="identity"){F=!0;return}W.set(I.response.url,{id:I.requestId,length:S})});try{await L.executeCdp(H.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await L.executeCdp(H.id,"Network.setBypassServiceWorker",{bypass:!0}),await L.executeCdp(H.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await L.executeCdp(H.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let P=K.object({frameTree:K.object({frame:K.object({id:K.string().min(1).max(256)})})}).parse(await L.executeCdp(H.id,"Page.getFrameTree",{})),I=[...new Set(G.media.map((k)=>new URL(k.sourceUrl).origin))].join(" ");await L.executeCdp(H.id,"Page.setDocumentContent",{frameId:P.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),_=!0;try{await L.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new h0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let f;try{f=await H.evaluate(`(${M5})(${JSON.stringify(G.media)})`,{awaitPromise:!0})}catch{throw new h0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!H$(f)||!Array.isArray(f.items)||f.items.length!==G.media.length)throw Z0();await Promise.all(D);let S=[];for(let k=0;k<G.media.length;k++){await V();let p=W.get(G.media[k].sourceUrl);if(F||!p||!O.has(p.id))throw Z0();let w=K.object({base64Encoded:K.literal(!0),body:K.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await L.executeCdp(H.id,"Network.getResponseBody",{requestId:p.id})),C=Buffer.from(w.body,"base64");try{let x=f.items[k];if(C.length!==p.length||C.toString("base64")!==w.body||!H$(x))throw Z0();S.push({...x,sourceSha256:F5("sha256").update(C).digest("hex")})}finally{C.fill(0)}}if(F)throw Z0();return G5({verified:!0,items:S},G)}finally{if(E(),await Promise.allSettled(D),_)try{await L.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new h0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(M){let G=k1.parse(M);await N(G);let H="browser_unavailable";try{return await U(`https://github.com/${G.repositoryFullName}`,async(q,T)=>{let L=_5.parse(await T({operation:"preflight",expected:{...G,prUrl:`https://github.com/${G.repositoryFullName}`}}));return Z9.parse(L.ok?{...G,status:"ready",observedActor:L.actor,checkedAt:new Date().toISOString()}:L.reason==="attachment_unavailable"?{...G,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...G,status:"not_ready",reason:L.reason})},(q)=>{H=q==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return Z9.parse({...G,status:"not_ready",reason:"unavailable",cause:H})}},async publish(M){let G=u$.parse(M);if(await N(G),G.expectedActorId!==null&&G.authenticatedActor.id!==G.expectedActorId)throw Z0();let H=Q.get(G.attemptId);if(H){if(!f1(H.binding,G))throw Z0();return structuredClone(H.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let q={binding:structuredClone(G),result:X1.parse({...G,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(G.attemptId,q);let T=!1,L="dispatch";try{(await B(G)).bytes.fill(0),q.result=await U(G.prUrl,async(j,W)=>{let O=_5.parse(await W({operation:"identity",expected:G}));if(!O.ok)return X1.parse({...G,status:"not_attempted",reason:O.reason});let F=await B(G),z;try{T=!0,z=K.discriminatedUnion("dispatched",[K.object({dispatched:K.literal(!0),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict(),K.object({dispatched:K.literal(!1),reason:K.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await W({operation:"upload",expected:G,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!z.dispatched)return T=!1,X1.parse({...G,status:"not_attempted",reason:z.reason});if(!f1(z.actor,O.actor))throw L="actor_changed",Z0();L="result";let _=performance.now();while(performance.now()-_<30000){let D=await W({operation:"upload_result",expected:{...G,observedActor:O.actor}});if(D!==null){let R=K.object({nativeUrl:K.string(),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict().parse(D);return L="finalize",await V(),X1.parse({...G,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw L="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${L})
-`);q.result=X1.parse({...G,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(q.result)},async verify(M){let G=h1.parse(M);await N(G);try{return(await B(G)).bytes.fill(0),await U(G.prUrl,async(H,q)=>{await H.browser.client.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await q({operation:"saved_player",expected:G});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let L=Q9.parse({...G,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(G).some(([j,W])=>!f1(W,L[j])))throw Z0();return L}finally{await H.browser.client.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return Q9.parse({...G,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function aQ($,J){let Z=await sQ($);return{async discover(Q){let X=await k2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:V1(J.runId)}}import{realpath as qX}from"fs/promises";var RU=K.object({version:K.literal(1),recording_operation_id:K.string().uuid(),proof_ready:K.literal(!1),acknowledged_at:K.iso.datetime()}).strict(),h2=K.object({action:K.literal("start"),request_id:K.string().uuid(),profile:K.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),D5=K.object({action:K.literal("inspect"),recording_operation_id:K.string().uuid()}).strict(),PU=K.discriminatedUnion("action",[h2,D5]),W5=K.object({recording_operation_id:K.string().uuid()}).strict(),G9={device_id:K.string().uuid(),root_id:K.string().uuid()},iQ=K.discriminatedUnion("action",[h2.extend(G9),D5.extend(G9),W5.extend({...G9,action:K.literal("stop")})]),IU=K.toJSONSchema(iQ),CU=K.object({version:K.literal(1),recordingId:K.string().uuid(),proofReady:K.literal(!1),capture:K.object({captureId:K.string().uuid(),contentType:K.literal("video/webm"),sha256:K.string().regex(/^[a-f0-9]{64}$/),sizeBytes:K.number().int().min(128).max(10485760),startedAt:K.iso.datetime(),finishedAt:K.iso.datetime(),durationSeconds:K.number().min(0.05).max(15),frameCount:K.number().int().min(1).max(450),receivedFrameCount:K.number().int().min(1).max(2000),owner:K.object({runId:K.string().uuid(),deviceId:K.string().uuid(),rootId:K.string().uuid(),rootRevision:K.string().max(64),profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:K.string().min(1).max(1024),generation:K.string().uuid(),browserScope:K.string().max(128),tabId:K.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var mU=h2.extend({action:K.enum(["start","inspect"]),recording_boot_generation:K.string().uuid(),recording_operation_id:K.string().uuid().optional(),recording_attempt_id:K.string().uuid().optional()}).strict();import{createHash as XX,randomUUID as YX}from"crypto";import{mkdtemp as VX,realpath as GX,rm as E5}from"fs/promises";import{tmpdir as BX}from"os";import{join as KX}from"path";import{spawn as NX}from"child_process";import{isDeepStrictEqual as UX}from"util";import{createHash as nQ}from"crypto";import{execFile as tQ}from"child_process";import{chmod as rQ,lstat as z5,mkdtemp as oQ,readFile as A5,realpath as R5,rm as eQ,writeFile as O5}from"fs/promises";import{tmpdir as $X}from"os";import{isAbsolute as JX,join as f2}from"path";import{promisify as ZX}from"util";var B9=ZX(tQ),QX=($)=>nQ("sha256").update($).digest("hex");async function $$($){if(!JX($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await R5($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await z5($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||QX(await A5($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function m1($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([$$(Z.ffmpeg),$$(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([$$(Z.ffmpeg),$$(Z.ffprobe)]);let V=await R5(await oQ(f2(J??$X(),"reason-owned-recording-")));await rQ(V,448);let N=f2(V,"capture.webm"),B="frames";try{let U=["ffconcat version 1.0"];for(let[j,W]of Q.entries()){let O=`${j}.jpg`;await O5(f2(V,O),W.jpeg,{mode:384,flag:"wx"});let F=Q[j+1]?.timestamp??Q[0].timestamp+X;U.push(`file '${O}'`,`duration ${Math.max(0.001,F-W.timestamp).toFixed(6)}`)}U.push(`file '${Q.length-1}.jpg'`),await O5(f2(V,"frames.ffconcat"),U.join(`
+}`;var F5=function($){let J=this??globalThis,Z=10485760,Q=(V,N)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let B=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!B&&(J.location.href===V.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==V.prUrl||!B)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(B))return{ok:!1,reason:"identity_mismatch"};let U=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),M=/^[1-9][0-9]{0,19}$/.test(U||"")?U:null,G={login:B,id:M};if(V.expectedActorId!==null&&M!==V.expectedActorId||V.authenticatedActor&&(B!==V.authenticatedActor.login||M!==V.authenticatedActor.id)||V.observedActor&&(B!==V.observedActor.login||M!==V.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==V.repositoryId)return{ok:!1,reason:"identity_mismatch"};let H=J.document.querySelector('link[rel="canonical"]');if(H&&H.href!==V.prUrl)return{ok:!1,reason:"identity_mismatch"};if(N){let q=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),L=q?.closest("file-attachment"),j=q?.closest("form"),W=new J.URL(V.prUrl).pathname+"/comment";if(!q||q.value!==""||!T||T.type!=="file"||T.disabled||!L||L.getAttribute("input")!==T.id||L.getAttribute("data-upload-repository-id")!==V.repositoryId||!j||new J.URL(j.action,J.location.href).origin!=="https://github.com"||new J.URL(j.action,J.location.href).pathname!==W)return{ok:!1,reason:"attachment_unavailable"};let O=L.getAttribute("data-upload-policy-url");if(!O||new J.URL(O,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:G}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let V=$.expected,N=Q(V,!0);if(!N.ok)return{dispatched:!1,reason:N.reason};let B=J.Uint8Array.from(J.atob($.base64||""),(H)=>H.charCodeAt(0));if(B.length!==V.sizeBytes||B.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let U=new J.File([B],V.captureId+".webm",{type:"video/webm"}),M=new J.DataTransfer;M.items.add(U);let G=J.document.querySelector("#fc-new_comment_field");if(!G)return{dispatched:!1,reason:"attachment_unavailable"};return G.files=M.files,G.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:N.actor}}if($.operation==="upload_result"){let V=Q($.expected,!1);if(!V.ok)throw Error("github_video_identity_changed");let N=J.document.querySelector("#new_comment_field")?.value?.trim(),B="["+$.expected.captureId+".webm](",U=N?.startsWith(B)&&N.endsWith(")")?N.slice(B.length,-1):N;if(!U||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(U))return null;return{nativeUrl:U,actor:V.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let V=X.nativeUrl.split("/").pop(),N=(W)=>{try{let O=new J.URL(W,J.location.href);if(O.protocol!=="https:"||O.username||O.password||O.port||O.hash)return!1;if(O.origin==="https://github.com")return O.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(O.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+V+"\\.(webm|mp4)$").test(O.pathname)}catch{return!1}},B=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((W)=>/^issue-[1-9][0-9]*$/.test(W.closest('[id^="issue-"]')?.id||"")&&!W.closest("form")&&!W.closest(".preview-content"));if(B.length!==1)throw Error("saved_body_missing");let U=B[0],M=[...U.querySelectorAll("video")].filter((W)=>[W.currentSrc,W.src,...[...W.querySelectorAll("source")].map((O)=>O.src)].some(N));if(M.length!==1)throw Error("saved_player_missing");let G=M[0],H={muted:G.muted,volume:G.volume,rate:G.playbackRate,preload:G.preload},q=new J.AbortController,T=J.setTimeout(()=>q.abort(),12000),L=(W)=>J.Promise.race([W,new J.Promise((O,F)=>{if(q.signal.aborted)F(Error("playback_timeout"));else q.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),j=async(W)=>{while(!W()){if(G.error||q.signal.aborted)throw Error("playback_unverified");await new J.Promise((O)=>J.setTimeout(O,25))}};try{if(G.muted=!0,G.playbackRate=1,G.currentTime=0,G.readyState<2)G.preload="auto",G.load();await j(()=>G.readyState>=2&&G.videoWidth>0&&G.videoHeight>0);let W=G.currentSrc;if(!N(W))throw Error("source_unbound");let O=await L(J.fetch(W,{credentials:"same-origin",redirect:"error",signal:q.signal}));if(O.status!==200||!N(O.url)||O.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(O.headers.get("content-type")||"")||!O.body)throw Error("source_unverifiable");let F=O.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let z=O.body.getReader(),_=[],D=0;try{for(;;){let k=await L(z.read());if(k.done)break;if(D+=k.value.length,D>10485760||D>X.sizeBytes)throw Error("source_too_large");_.push(k.value)}}finally{await z.cancel().catch(()=>{}),z.releaseLock()}if(D!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(D),E=0;for(let k of _)R.set(k,E),E+=k.length;let P=[...new J.Uint8Array(await L(J.crypto.subtle.digest("SHA-256",R)))].map((k)=>k.toString(16).padStart(2,"0")).join("");if(P!==X.sha256||G.currentSrc!==W||!U.contains(G))throw Error("source_changed");let I=G.currentTime,f=G.getVideoPlaybackQuality().totalVideoFrames;if(await L(G.play()),await j(()=>G.currentTime-I>=0.05&&G.getVideoPlaybackQuality().totalVideoFrames>f),!Q(X,!1).ok||G.currentSrc!==W||!U.contains(G)||G.error)throw Error("player_changed");return{status:"verified",sourceSha256:P,width:G.videoWidth,height:G.videoHeight,durationSeconds:G.duration,advancedSeconds:G.currentTime-I,advancedFrames:G.getVideoPlaybackQuality().totalVideoFrames-f,playbackRestored:!0}}finally{if(J.clearTimeout(T),q.abort(),G.pause(),G.currentTime=0,G.muted=H.muted,G.volume=H.volume,G.playbackRate=H.rate,G.preload=H.preload,!G.paused||G.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as gQ}from"child_process";import{lstat as uQ,realpath as dQ}from"fs/promises";import{join as _5,resolve as pQ}from"path";import{promisify as lQ}from"util";var cQ=lQ(gQ);async function sQ($,J){let Z=await dQ($),{stdout:Q}=await cQ(_5(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return K.array(K.object({browser:K.string(),directory:K.string(),connected:K.boolean().optional(),source:K.string(),socketPath:K.string().optional(),instanceId:K.string().optional(),extensionId:K.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&pQ(Y.source)===_5(Z,"Reason Browser Use","manifest.json"))}async function k2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await sQ($,Z)).filter((V)=>V.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await uQ(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as aQ}from"crypto";function V1($){return`reason-browser-${aQ("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var D5=K.discriminatedUnion("ok",[K.object({ok:K.literal(!0),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict(),K.object({ok:K.literal(!1),reason:K.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),W5=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.string(),extensionInstanceId:K.string(),nativeHostName:K.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function V9($){let J=l0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await tQ($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${iQ()}`,Y=!1,V=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},N=async(M)=>{if(!f1(J,M.owner))throw Z0();await V()},B=async(M)=>{await N(M);let G=await $.readVideo(M.captureId);try{await V();let H=G.capture;if(!f1(H.context.owner,J)||H.captureId!==M.captureId||H.context.prUrl!==M.prUrl||H.context.headSha!==M.headSha||H.media.contentType!=="video/webm"||H.media.sizeBytes!==M.sizeBytes||H.sha256!==M.sha256||G.bytes.length!==M.sizeBytes||G.bytes.length<128||G.bytes.length>10485760||G.bytes.readUInt32BE(0)!==440786851||j5("sha256").update(G.bytes).digest("hex")!==M.sha256)throw Z0();return G}catch(H){throw G.bytes.fill(0),H}};async function U(M,G,H){await V();let q=await Z.discover(AbortSignal.timeout(5000)),T=new x2({socketPath:q.socketPath,sessionId:X,timeoutMs:5000}),L,j=!1,W,O=new Promise((_,D)=>{W=setTimeout(()=>{j=!0,D(Z0())},60000)});O.catch(()=>{});let F=(_)=>Promise.race([_,O]),z=async()=>{if(j)throw Z0();if(await V(),j)throw Z0()};try{await F(T.connect());let _=W5.parse(await F(T.client.getInfo()));if(_.metadata.extensionId!==q.extensionId||_.metadata.extensionInstanceId!==q.instanceId||!_.metadata.nativeHostName)throw Z0();await z(),H?.("connected");let D=T.newTab();D.then((P)=>{if(j)P.close().catch(()=>{Y=!0})},()=>{}),L=await F(D),await z(),await F(L.goto(M,{waitUntil:"domcontentloaded",timeoutMs:15000})),await z(),H?.("loaded");let E=await F(G(L,async(P)=>{await z();let I=await F(L.evaluate(`(${F5.toString()})(${JSON.stringify(P)})`,{awaitPromise:!0}));return await z(),I},z));return await z(),E}finally{j=!0,clearTimeout(W);try{if(L){let _;try{await Promise.race([L.close(),new Promise((D,R)=>{_=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(_)}}}catch{throw Y=!0,Z0()}finally{T.close()}await V()}}return{async screenshot(M,G,H){let q=Q1.parse(M);if(await N(q),!Number.isSafeInteger(G)||G<1||Date.parse(q.expiresAt)<=Date.now())throw Z0();H.throwIfAborted();let T=await Z.discover(H),L=new x2({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),j;try{await L.connect();let W=W5.parse(await L.client.getInfo());if(W.metadata.extensionId!==T.extensionId||W.metadata.extensionInstanceId!==T.instanceId)throw Z0();if(!K.array(K.object({id:K.number()})).max(256).parse(await L.getTabs()).some((z)=>z.id===G))throw Z0();await V(),H.throwIfAborted();let F=K.object({data:K.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await L.cdp.call(G,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(j=Buffer.from(F.data,"base64"),j.toString("base64")!==F.data||j.length>8388608)throw Z0();if(await V(),H.throwIfAborted(),Date.parse(q.expiresAt)<=Date.now())throw Z0();return j}catch{throw j?.fill(0),Z0()}finally{L.close()}},async verifyImages(M){let G=b2(M);if(G.runId!==J.runId||G.media.some((H)=>H.kind!=="image"))throw Z0();return U("about:blank",async(H,q,T)=>{let L=H.browser.client,j=new Set(G.media.map((P)=>P.sourceUrl)),W=new Map,O=new Set,F=!1,z=0,_=!1,D=new Set,R=(P,I)=>{if(D.size>=32){F=!0;return}let f=L.executeCdp(H.id,P,I);D.add(f),f.catch(()=>{F=!0}).finally(()=>D.delete(f))},E=L.onNotification((P)=>{if(P.method!=="onCDPEvent"||!H$(P.params)||!H$(P.params.source)||P.params.source.tabId!==H.id||!H$(P.params.params))return;let I=P.params.params;if(++z>512){F=!0;return}if(P.params.method==="Fetch.requestPaused"){let k=typeof I.requestId==="string"&&H$(I.request)&&I.request.method==="GET"&&typeof I.request.url==="string"&&j.has(I.request.url)&&I.resourceType==="Image";if(typeof I.requestId!=="string"){F=!0;return}if(!k)F=!0;R(k?"Fetch.continueRequest":"Fetch.failRequest",{requestId:I.requestId,...k?{}:{errorReason:"BlockedByClient"}})}if(P.params.method==="Network.requestWillBeSent"&&I.redirectResponse)F=!0;if(P.params.method==="Network.loadingFailed")F=!0;if(P.params.method==="Network.loadingFinished"&&typeof I.requestId==="string")O.add(I.requestId);if(P.params.method!=="Network.responseReceived")return;if(!H$(I.response)||typeof I.response.url!=="string"||!j.has(I.response.url)||typeof I.requestId!=="string"||!H$(I.response.headers)||I.type!=="Image"){F=!0;return}let f=Object.fromEntries(Object.entries(I.response.headers).map(([k,p])=>[k.toLowerCase(),p])),S=Number(f["content-length"]);if(W.has(I.response.url)||I.response.status!==200||I.response.fromServiceWorker===!0||typeof f["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(f["content-length"])||!Number.isSafeInteger(S)||S>8388608||f["content-range"]||f["content-encoding"]&&f["content-encoding"]!=="identity"){F=!0;return}W.set(I.response.url,{id:I.requestId,length:S})});try{await L.executeCdp(H.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await L.executeCdp(H.id,"Network.setBypassServiceWorker",{bypass:!0}),await L.executeCdp(H.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await L.executeCdp(H.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let P=K.object({frameTree:K.object({frame:K.object({id:K.string().min(1).max(256)})})}).parse(await L.executeCdp(H.id,"Page.getFrameTree",{})),I=[...new Set(G.media.map((k)=>new URL(k.sourceUrl).origin))].join(" ");await L.executeCdp(H.id,"Page.setDocumentContent",{frameId:P.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${I}; style-src 'none'"><body></body>`}),await T(),_=!0;try{await L.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new h0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let f;try{f=await H.evaluate(`(${L5})(${JSON.stringify(G.media)})`,{awaitPromise:!0})}catch{throw new h0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!H$(f)||!Array.isArray(f.items)||f.items.length!==G.media.length)throw Z0();await Promise.all(D);let S=[];for(let k=0;k<G.media.length;k++){await V();let p=W.get(G.media[k].sourceUrl);if(F||!p||!O.has(p.id))throw Z0();let w=K.object({base64Encoded:K.literal(!0),body:K.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await L.executeCdp(H.id,"Network.getResponseBody",{requestId:p.id})),C=Buffer.from(w.body,"base64");try{let x=f.items[k];if(C.length!==p.length||C.toString("base64")!==w.body||!H$(x))throw Z0();S.push({...x,sourceSha256:j5("sha256").update(C).digest("hex")})}finally{C.fill(0)}}if(F)throw Z0();return G5({verified:!0,items:S},G)}finally{if(E(),await Promise.allSettled(D),_)try{await L.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new h0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(M){let G=k1.parse(M);await N(G);let H="browser_unavailable";try{return await U(`https://github.com/${G.repositoryFullName}`,async(q,T)=>{let L=D5.parse(await T({operation:"preflight",expected:{...G,prUrl:`https://github.com/${G.repositoryFullName}`}}));return Z9.parse(L.ok?{...G,status:"ready",observedActor:L.actor,checkedAt:new Date().toISOString()}:L.reason==="attachment_unavailable"?{...G,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...G,status:"not_ready",reason:L.reason})},(q)=>{H=q==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return Z9.parse({...G,status:"not_ready",reason:"unavailable",cause:H})}},async publish(M){let G=u$.parse(M);if(await N(G),G.expectedActorId!==null&&G.authenticatedActor.id!==G.expectedActorId)throw Z0();let H=Q.get(G.attemptId);if(H){if(!f1(H.binding,G))throw Z0();return structuredClone(H.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let q={binding:structuredClone(G),result:X1.parse({...G,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(G.attemptId,q);let T=!1,L="dispatch";try{(await B(G)).bytes.fill(0),q.result=await U(G.prUrl,async(j,W)=>{let O=D5.parse(await W({operation:"identity",expected:G}));if(!O.ok)return X1.parse({...G,status:"not_attempted",reason:O.reason});let F=await B(G),z;try{T=!0,z=K.discriminatedUnion("dispatched",[K.object({dispatched:K.literal(!0),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict(),K.object({dispatched:K.literal(!1),reason:K.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await W({operation:"upload",expected:G,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!z.dispatched)return T=!1,X1.parse({...G,status:"not_attempted",reason:z.reason});if(!f1(z.actor,O.actor))throw L="actor_changed",Z0();L="result";let _=performance.now();while(performance.now()-_<30000){let D=await W({operation:"upload_result",expected:{...G,observedActor:O.actor}});if(D!==null){let R=K.object({nativeUrl:K.string(),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict().parse(D);return L="finalize",await V(),X1.parse({...G,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw L="result_timeout",Z0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${L})
+`);q.result=X1.parse({...G,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(q.result)},async verify(M){let G=h1.parse(M);await N(G);try{return(await B(G)).bytes.fill(0),await U(G.prUrl,async(H,q)=>{await H.browser.client.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await q({operation:"saved_player",expected:G});if(!T||typeof T!=="object"||Array.isArray(T))throw Z0();let L=Q9.parse({...G,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(G).some(([j,W])=>!f1(W,L[j])))throw Z0();return L}finally{await H.browser.client.executeCdp(H.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return Q9.parse({...G,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function tQ($,J){let Z=await nQ($);return{async discover(Q){let X=await k2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:V1(J.runId)}}import{realpath as LX}from"fs/promises";var EU=K.object({version:K.literal(1),recording_operation_id:K.string().uuid(),proof_ready:K.literal(!1),acknowledged_at:K.iso.datetime()}).strict(),h2=K.object({action:K.literal("start"),request_id:K.string().uuid(),profile:K.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),O5=K.object({action:K.literal("inspect"),recording_operation_id:K.string().uuid()}).strict(),xU=K.discriminatedUnion("action",[h2,O5]),z5=K.object({recording_operation_id:K.string().uuid()}).strict(),G9={device_id:K.string().uuid(),root_id:K.string().uuid()},rQ=K.discriminatedUnion("action",[h2.extend(G9),O5.extend(G9),z5.extend({...G9,action:K.literal("stop")})]),SU=K.toJSONSchema(rQ),bU=K.object({version:K.literal(1),recordingId:K.string().uuid(),proofReady:K.literal(!1),capture:K.object({captureId:K.string().uuid(),contentType:K.literal("video/webm"),sha256:K.string().regex(/^[a-f0-9]{64}$/),sizeBytes:K.number().int().min(128).max(10485760),startedAt:K.iso.datetime(),finishedAt:K.iso.datetime(),durationSeconds:K.number().min(0.05).max(15),frameCount:K.number().int().min(1).max(450),receivedFrameCount:K.number().int().min(1).max(2000),owner:K.object({runId:K.string().uuid(),deviceId:K.string().uuid(),rootId:K.string().uuid(),rootRevision:K.string().max(64),profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:K.string().min(1).max(1024),generation:K.string().uuid(),browserScope:K.string().max(128),tabId:K.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var dU=h2.extend({action:K.enum(["start","inspect"]),recording_boot_generation:K.string().uuid(),recording_operation_id:K.string().uuid().optional(),recording_attempt_id:K.string().uuid().optional()}).strict();import{createHash as GX,randomUUID as BX}from"crypto";import{mkdtemp as KX,realpath as NX,rm as S5}from"fs/promises";import{tmpdir as UX}from"os";import{join as HX}from"path";import{spawn as qX}from"child_process";import{isDeepStrictEqual as MX}from"util";import{createHash as oQ}from"crypto";import{execFile as eQ}from"child_process";import{chmod as $X,lstat as R5,mkdtemp as JX,readFile as P5,realpath as I5,rm as ZX,writeFile as A5}from"fs/promises";import{tmpdir as QX}from"os";import{isAbsolute as XX,join as f2}from"path";import{promisify as YX}from"util";var B9=YX(eQ),VX=($)=>oQ("sha256").update($).digest("hex");async function $$($){if(!XX($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await I5($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await R5($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||VX(await P5($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function m1($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([$$(Z.ffmpeg),$$(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([$$(Z.ffmpeg),$$(Z.ffprobe)]);let V=await I5(await JX(f2(J??QX(),"reason-owned-recording-")));await $X(V,448);let N=f2(V,"capture.webm"),B="frames";try{let U=["ffconcat version 1.0"];for(let[j,W]of Q.entries()){let O=`${j}.jpg`;await A5(f2(V,O),W.jpeg,{mode:384,flag:"wx"});let F=Q[j+1]?.timestamp??Q[0].timestamp+X;U.push(`file '${O}'`,`duration ${Math.max(0.001,F-W.timestamp).toFixed(6)}`)}U.push(`file '${Q.length-1}.jpg'`),await A5(f2(V,"frames.ffconcat"),U.join(`
 `)+`
-`,{mode:384,flag:"wx"});let M={cwd:V,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};B="encode",await B9(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",N],M),B="output";let G=await z5(N);if(!G.isFile()||G.isSymbolicLink()||G.nlink!==1||G.size<128||G.size>10485760)throw Error();B="probe";let{stdout:H}=await B9(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",N],M),q=JSON.parse(H),T=q.streams,L=Number(q.format?.duration);if(B="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(B="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(B="probe_duration",!Number.isFinite(L)||Math.abs(L-X)>0.25)throw Error();if(B="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(B="probe_format",q.format?.format_name!=="matroska,webm")throw Error();return B="decode",await B9(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",N,"-f","null","-"],M),B="pin",await Promise.all([$$(Z.ffmpeg),$$(Z.ffprobe)]),await A5(N)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${B}_failed`)}finally{await eQ(V,{recursive:!0,force:!0})}}}}var I5=K.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var J$=K.string().min(1).max(1024),P5=K.object({path:J$,sha256:K.string().regex(/^[a-f0-9]{64}$/)}).strict(),C5=K.object({owner:K.object({runId:J$,deviceId:J$,rootId:J$,rootRevision:J$,profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:J$,generation:J$,browserScope:J$,tabId:K.number().int().positive()}).strict(),socketPath:J$,extensionId:K.string().regex(/^[a-p]{32}$/),nativeHostName:J$,seconds:K.number().int().min(1).max(15),encoder:K.object({ffmpeg:P5,ffprobe:P5}).strict()}).strict();var HX=15728640,z$=()=>Error("mac_recording_worker_failed");function x5($){let J=C5.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,V=null,N=async()=>{},B=async(H,q=3000)=>{let T;try{return await Promise.race([H,new Promise((L,j)=>{T=setTimeout(()=>j(z$()),q)})])}finally{clearTimeout(T)}},U=()=>V??=B((async()=>{let q=(await Promise.allSettled([N(),$.cleanup()])).find((T)=>T.status==="rejected");if(q?.status==="rejected")throw q.reason})(),5000).catch((H)=>{X=!0;let q=H&&typeof H==="object"&&"code"in H?H.code:null,T=typeof q==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(q)?q:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),M=null,G=async()=>{if(X)throw z$();if(await B($.assertCurrent()),X)throw z$()};return{async start(){if(Y||M)throw Error("mac_recording_already_active");Y=!0;try{await G(),await $$({path:Z.path,sha256:Z.sha256}),await G(),V=null;let H=await GX(await VX(KX(BX(),"reason-recording-host-")));try{await G()}catch(C){throw await E5(H,{recursive:!0,force:!0}),C}let q=NX(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((C)=>q.once("close",()=>C())),L=()=>{if(q.pid)try{process.kill(-q.pid,"SIGKILL")}catch(C){if(C.code!=="ESRCH")throw C}},j=null;N=()=>j??=(async()=>{try{L()}catch(C){if(C.code!=="EPERM")throw C}await T;try{for(let C=0;;C++)try{L();break}catch(x){if(x.code!=="EPERM"||C>=20)throw x;await new Promise((A)=>setTimeout(A,25))}}finally{await E5(H,{recursive:!0,force:!0})}})();let W="",O=0,F=!1,z=!1,_=null,D,R,E=new Promise((C,x)=>{D=C,R=x}),P,I,f=new Promise((C,x)=>{P=C,I=x});f.catch(()=>{});let S=(C=z$())=>{if(F)return;F=!0,clearTimeout(k),clearInterval(w),U().then(()=>{R(C),I(C)},(x)=>{R(x),I(x)})},k=setTimeout(()=>S(),(J.seconds+25)*1000),p=!1,w=setInterval(()=>{if(p||F)return;p=!0,G().catch(()=>S()).finally(()=>{p=!1})},250);M={completion:f,stop:()=>{if(!F)q.stdin.write(`{"type":"stop"}
-`)},cancel:()=>S()},q.on("error",()=>S()),q.stdin.on("error",()=>S()),q.stdout.on("data",(C)=>{if(F)return;if(O+=C.length,O>HX){S();return}W+=C.toString("utf8");let x;while((x=W.indexOf(`
-`))!==-1){let A=W.slice(0,x);W=W.slice(x+1);try{let y=JSON.parse(A);if(y.type==="failed"&&Object.keys(y).sort().join(",")==="reason,type"){let t=I5.safeParse(y.reason);S(t.success?Error(`mac_recording_worker_failed:${t.data}`):z$());return}if(y.type==="unsupported"&&!z){S(Error("mac_recording_encoder_unavailable"));return}if(y.type==="started"&&!z&&Object.keys(y).length===1){z=!0,D({recording:!0});continue}if(!z||y.type!=="capture"||_||Object.keys(y).sort().join(",")!=="bytes,capture,type")throw z$();let b=y.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!UX(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof y.bytes!=="string"||y.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(y.bytes))throw z$();let n=Buffer.from(y.bytes,"base64");if(n.length!==b.sizeBytes||XX("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw z$();_={capture:Object.freeze({...b,captureId:YX(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),q.once("close",(C)=>{if(F)return;if(C!==0||!_||W.trim()){S();return}let x=_;G().then(async()=>{if(await N(),F)return;F=!0,clearTimeout(k),clearInterval(w),Q.set(x.capture.captureId,x);while(Q.size>2)Q.delete(Q.keys().next().value);P(x.capture)}).catch(()=>S())}),q.stdin.write(JSON.stringify({...J,scratchDirectory:H})+`
-`);try{return await E}catch(C){throw M=null,C}}finally{Y=!1}},async completed(){if(await G(),!M)throw Error("mac_recording_not_active");return M.completion},async stop(){await G();let H=M;if(!H)throw Error("mac_recording_not_started");H.stop();try{return await H.completion}finally{if(M===H)M=null}},async read(H){await G();let q=Q.get(H);if(!q)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(q.capture),bytes:Buffer.from(q.bytes)}},async close(){if(X)return;X=!0;let H=M;H?.cancel(),Q.clear();try{await U(),await H?.completion.catch(()=>{})}finally{M=null}}}}var S5=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.string(),extensionInstanceId:K.string(),nativeHostName:K.string()})});async function K9($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await qX($.automationDirectory);J=(Q,X)=>k2(Z,Q,X)}if(await $$({path:$.worker.path,sha256:$.worker.sha256}),!await m1($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let V=await J(Z,Y),N=new O$({socketPath:V.socketPath,sessionId:X,timeoutMs:2000}),B;try{if(await N.connect(),B=S5.parse(await N.getInfo()),B.metadata.extensionId!==V.extensionId||B.metadata.extensionInstanceId!==V.instanceId)throw Error("mac_recording_profile_changed");if(!K.array(K.object({id:K.number()})).parse(await N.getTabs()).some((M)=>M.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{N.close()}return{extensionInstanceId:V.instanceId,async createHost(U,M,G){let H=new O$({socketPath:V.socketPath,sessionId:U.browser.browserScope,timeoutMs:2000});return x5({worker:$.worker,configuration:{owner:U.browser,seconds:M,encoder:$.encoder,socketPath:V.socketPath,extensionId:V.extensionId,nativeHostName:B.metadata.nativeHostName},async assertCurrent(){G.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await H.connect();let T=S5.parse(await H.getInfo());if(T.metadata.extensionInstanceId!==U.browser.extensionInstanceId||T.metadata.extensionId!==V.extensionId||T.metadata.nativeHostName!==B.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await H.executeCdp(Q,"Page.stopScreencast",{})}finally{H.close()}}})}}}}var W0=()=>Error("mac_pr_proof_unavailable"),LX=K.object({operationId:K.string().uuid()}).strict();function w5($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=K.array(K.object({profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:K.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!K.string().uuid().safeParse($.generation).success||new Set(Z.map((H)=>H.profile)).size!==Z.length)throw W0();if(!$.qualifiedProfiles){let H=new URL($.uploadOrigin);if(!$.resolveBrowser||H.protocol!=="https:"||H.origin!==$.uploadOrigin||H.username||H.password)throw W0()}let Q=new Map,X=new Map,Y=new Map,V=!1,N=new MX,B=async(H)=>{let q=N.getStore();if(V||!H&&!q)throw W0();if(q?.signal.throwIfAborted(),await $.assertCurrent(H??q.claim),V)throw W0();q?.signal.throwIfAborted()},U=(H,q)=>{let T="owner"in q?q.owner:("context"in q)?q.context.owner:q.input.owner;if(H.capability!==$9||!H.owner||T.generation!==$.generation||!Z.some((L)=>L.profile===T.profile&&L.extension_instance_id===T.extensionInstanceId)||T.organizationId!==H.owner.organization_id||T.userId!==H.owner.user_id||T.deviceId!==H.owner.device_id||T.rootId!==H.root_id||T.runId!==H.run_id)throw W0();return T},M=async(H)=>{await B();let q=JSON.stringify([H.runId,H.profile]),T=Q.get(q);if(!T){if(Q.size>=4)throw W0();T=(async()=>{let j,W=$.browserScope?.(H)??V1(H.runId),O=await $.createBrowser({owner:H,assertCurrent:()=>B(),readVideo:(F)=>j.publicationCapture(F)});if(j=q5({owner:H,browserScope:W,assertCurrent:()=>B(),screenshot:O.screenshot,async createVideo(F,z,_,D){if(!$.resolveBrowser)throw W0();let R=await $.resolveBrowser(H.profile,z,W,D);if(R.extensionInstanceId!==H.extensionInstanceId)throw W0();return R.createHost({organizationId:H.organizationId,userId:H.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:H.runId,deviceId:H.deviceId,rootId:H.rootId,rootRevision:H.rootRevision,generation:H.generation,profile:H.profile,extensionInstanceId:H.extensionInstanceId,browserScope:W,tabId:z}},_,D)}}),V)throw O.close(),await j.close(),W0();return{owner:structuredClone(H),browser:O,capture:j,expiresAt:Date.now()+300000}})(),Q.set(q,T)}let L=await T;if(!b5(L.owner,H)||L.expiresAt<=Date.now())throw W0();return L},G=setInterval(()=>{for(let[H,q]of Q)q.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((L)=>L.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(H)===q)Q.delete(H)}).catch(()=>{V=!0})},1000);return G.unref(),{generation:$.generation,async execute(H,q,T){return N.run({claim:H,signal:q},async()=>{let L=X9.parse(H.payload).command,j=U(H,L);if(await B(H),q.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(L.action==="prepare"?L.context.evidenceKind!=="image"||Boolean(L.context.visualPlan)||!L.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(L.action)))throw Error("proof_png_only");let W=await M(j),O=async()=>{await B(H),q.throwIfAborted()},F;switch(L.action){case"auth_check":F=await W.browser.preflight(L.input);break;case"prepare":if(L.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!L.context.uploadOrigin)throw W0();F=await W.capture.prepare(L.context);break;case"capture_png":F=await W.capture.screenshot({claim:{operationId:H.operation_id,attemptId:H.attempt_id,contextId:L.contextId,tabId:L.tabId},signal:q});break;case"start_video":{let z={runtime:W,contextId:L.contextId,attemptId:H.attempt_id,tabId:L.tabId,signal:q};if(X.has(H.operation_id))throw W0();X.set(H.operation_id,z);try{F=await W.capture.record({claim:{operationId:H.operation_id,attemptId:H.attempt_id,contextId:L.contextId,tabId:L.tabId},signal:q,seconds:L.seconds,started:async()=>{await O(),await T({version:1,operationId:H.operation_id,contextId:L.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(H.operation_id)}break}case"inspect_capture":F=await W.capture.inspect(L.captureId);break;case"publish_video":F=await W.browser.publish(L.input);break;case"verify_saved_media":F=await W.browser.verify(L.input);break;case"verify_png_media":F=await W.browser.verifyImages(L.media);break;case"publish_png":{let z=`${j.runId}:${L.attemptId}`,_=Y.get(z);if(_){if(!b5(_.request,L))throw W0();F=_.result;break}if(Y.size>=16)throw W0();let D=new URL(L.uploadUrl);if(D.protocol!=="https:"||D.username||D.password||D.hash||D.pathname!==`/${L.storagePath}`||!L.storagePath.startsWith(`pr-screenshots/${j.runId}/${L.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(L.storagePath.split("/").at(-1))||L.storagePath.split("/").length!==4)throw W0();let R=await W.capture.publicationCapture(L.captureId);try{if(D.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==L.sha256||R.bytes.length!==L.sizeBytes||TX("sha256").update(R.bytes).digest("hex")!==L.sha256)throw W0();await O();let E={request:structuredClone(L),result:{status:"uncertain",sha256:L.sha256,sizeBytes:L.sizeBytes}};Y.set(z,E);try{let P=await fetch(D,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([q,AbortSignal.timeout(20000)])});if(await P.body?.cancel(),await O(),P.ok)E.result={...E.result,status:"uploaded"}}catch{}F=E.result}finally{R.bytes.fill(0)}break}}return await O(),structuredClone(F)})},async control(H,q){if(H.capability!==$9||q.kind!==U5)return!1;let T=LX.safeParse(q.payload),L=X.get(H.operation_id);if(!T.success||T.data.operationId!==H.operation_id||!L||L.attemptId!==H.attempt_id)return!1;let j=X9.parse(H.payload).command;return U(H,j),await B(H),await N.run({claim:H,signal:L.signal},()=>L.runtime.capture.stop({operationId:H.operation_id,attemptId:H.attempt_id,contextId:L.contextId,tabId:L.tabId})),!0},async close(){V=!0,clearInterval(G);let H=await Promise.allSettled([...Q.values()].map(async(q)=>{let T=await q;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),H.some((q)=>q.status==="rejected"))throw W0()}}}var AX="__browser-recorder",RX=zX(FX),PX="/tmp/open-browser-use",IX=33554432,CX=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.literal(m2),extensionInstanceId:K.string().min(1).max(1024)})}),k5=()=>Error("worker_pr_proof_browser_unavailable"),q9={components:w1,ensureBrowser:v5,socketDirectory:PX,async identity($){let J=new O$({socketPath:$,sessionId:`reason-proof-qualification-${H9()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function h5($,J=q9){let Z=J.components();if(!Z?.features.browser)throw k5();await J.ensureBrowser(Z),$.throwIfAborted();let Q=N9(g5(Z),"Default","Local Extension Settings",m2),X=(await y5(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>N9(Q,Y));for(let Y of(await y5(J.socketDirectory)).filter((V)=>V.endsWith(".sock"))){$.throwIfAborted();let V=N9(J.socketDirectory,Y);try{let N=await jX(V);if(!N.isSocket()||N.uid!==process.getuid?.())continue;let B=CX.parse(await J.identity(V)).metadata.extensionInstanceId;for(let U of X)if((await WX(U)).size<=IX&&(await u5(U)).includes(B))return{socketPath:V,instanceId:B,extensionId:m2}}catch{}}throw k5()}async function U9($){let J=await DX($);return{path:J,sha256:_X("sha256").update(await u5(J)).digest("hex")}}async function d5($={}){let J={...q9,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await U9(Z.ffmpeg),{stdout:X}=await RX(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await U9(Z.ffprobe)};if(!await m1(Y))return{error:"worker_recording_encoder_unqualified"};let V=$.recorder??{path:process.execPath,args:[...OX(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],AX]};return{worker:{...await U9(V.path),args:V.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function p5($,J={}){let Z={...q9,...J},Q=H9(),X=H9(),Y=f5.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),V=$.recording?m5.parse({...Y,version:3,video:!0,max_seconds:15}):Y,N=(G)=>X5(G.organizationId,G.sessionId,G.deviceId,1),B=$.recording,U,M=w5({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:N,...B?{resolveBrowser:async(G,H,q,T)=>{U??=K9({...B,assertCurrent:()=>$.assertCurrent(),discover:(j,W)=>h5(W,Z)}),U.catch(()=>{U=void 0});let L=await(await U)(G,H,q,T);return{extensionInstanceId:X,createHost:async(j,W,O)=>EX(await L.createHost({...j,browser:{...j.browser,extensionInstanceId:L.extensionInstanceId}},W,O),X)}}}:{},createBrowser:(G)=>V9({...G,endpoint:(H)=>({discover:(q)=>h5(q,Z),tabScope:N(H)})})});return{capability:V,broker:M}}function EX($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as sX}from"child_process";import{execFile as xX}from"child_process";import{readFile as SX}from"fs/promises";import{join as t0}from"path";var bX="Claude Code-credentials",wX="/usr/bin/security",yX=120000,kX=8192,v2={exec:($,J,Z)=>new Promise((Q)=>{xX($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let V=X?typeof X.code==="number"?X.code:1:0;Q({code:V,stdout:String(Y??"")})})}),readText:async($)=>{try{return await SX($,"utf8")}catch{return null}}};function G1($){return typeof $==="string"&&$.length>0&&$.length<=kX?$:null}function hX($,J){return $.CLAUDE_CONFIG_DIR||t0(J,".claude")}function fX($,J){return $.CODEX_HOME||t0(J,".codex")}function l5($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=G1(J?.accessToken),Q=G1(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function mX($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function vX($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=G1(J.tokens?.access_token),Q=G1(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:mX(Z)??Date.now()}}catch{return null}}function gX($,J){return t0($.XDG_DATA_HOME||t0(J,".local","share"),"opencode","auth.json")}var uX={anthropic:"anthropic",openai:"openai-codex"};function dX($){return i5($,uX)}function i5($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let V=Z[X];if(V?.type!=="oauth")continue;let N=G1(V.access),B=G1(V.refresh),U=typeof V.expires==="number"&&Number.isFinite(V.expires)?V.expires:null;if(N&&B&&U!==null)Q.push({provider:Y,access:N,refresh:B,expires:U})}return Q}catch{return[]}}function pX($){return i5($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function lX($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?t0(J,Z.slice(2)):Z||t0(J,".pi","agent")}async function n5($,J,Z=v2){let Q=[],X=await Z.exec(wX,["find-generic-password","-s",bX,"-w"],yX),Y=Date.now()+300000,V=(B)=>{if(!B)return;let U=Q.findIndex((M)=>M.provider===B.provider);if(U<0)Q.push(B);else if(Q[U].expires<=Y&&B.expires>Y)Q[U]=B};if(V(X.code===0?l5(X.stdout.trim()):null),!Q.some((B)=>B.provider==="anthropic"&&B.expires>Y))V(l5(await Z.readText(t0(hX($,J),".credentials.json"))));let N=vX(await Z.readText(t0(fX($,J),"auth.json")));V(N),V(cX(await Z.readText(t0($.GROK_HOME||t0(J,".grok"),"auth.json"))));for(let B of dX(await Z.readText(gX($,J))))V(B);for(let B of pX(await Z.readText(t0(lX($,J),"auth.json"))))V(B);return Q}function t5($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var c5="https://auth.x.ai",s5="b1a00492-073a-47ea-816f-4c329264a828",a5=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function cX($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${c5}::${s5}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==c5||Q.oidc_client_id!==s5||!a5(Q.key)||!a5(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var r5=330000,aX=300000,iX=60000;function nX($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+r5)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function tX($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*r5)?iX:aX}var rX=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function o5($){let J=new Map,Z=$.wait??rX,Q=$.stores??(process.platform==="darwin"?v2:{...v2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=t5(await n5($.environment??process.env,$.home,Q));for(let Y of nX(X,J)){if($.signal.aborted)return;let V=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:V.ok,...V.ok?{}:{error:V.error}})}}catch{}await Z(tX(J),$.signal)}}function e5($=process.env){return new Promise((J)=>{sX("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as oX,spawn as Gq,spawnSync as Bq}from"child_process";import{chmodSync as Nq,existsSync as eX,mkdirSync as Uq,readFileSync as Hq,renameSync as qq,rmSync as Mq,statSync as Tq,writeFileSync as Lq}from"fs";import{dirname as _q,isAbsolute as jq,join as M9}from"path";var $J=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function JJ($,J){if(!$J.test($)||!$J.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var $Y="com.reasonmachines.updater",JY=["so.ara.updater","so.reason.updater"];function ZY($){let J=$==="staging"?".staging":"";return{label:`${$Y}${J}`,legacyLabels:[...JY].reverse().map((Z)=>`${Z}${J}`)}}function QY($,J,Z){return{launchAgent:M9(J,"Library","LaunchAgents",`${$}.plist`),systemdService:M9(Z,"systemd","user",`${$}.service`),systemdTimer:M9(Z,"systemd","user",`${$}.timer`)}}function XY($,J){return new Promise((Z)=>{oX($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function XJ($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??H0(),{label:X,legacyLabels:Y}=ZY($.channel),V=$.configHome??QJ(Q),N=[X,...Y].filter((G)=>{let H=QY(G,Q,V);return eX(J==="darwin"?H.launchAgent:H.systemdService)});if(N.length===0)return"absent";let B=$.command??XY,U=N[0];if(N.length>1){for(let G of N)if((J==="darwin"?await B("/bin/launchctl",["print",`gui/${Z}/${G}`]):await B("systemctl",["--user","is-enabled",`${G}.timer`]))===0){U=G;break}}return(J==="darwin"?await B("/bin/launchctl",["kickstart",`gui/${Z}/${U}`]):await B("systemctl",["--user","start","--no-block",`${U}.service`]))===0?"started":"failed"}var ZJ=60000;function YJ($){let J=(X,Y)=>{try{return JJ(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let V=setTimeout(X,Y);V.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(V),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),V=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(ZJ-1,Math.floor(V*ZJ)))}}var YY=30000;async function GJ($){return($.flush??VJ)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(YY);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof L0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var KJ=25000,GY=5000,BY=600000,KY=["display.stream.v1","pty.start"],NY=64;function F9($,J,Z=j9($),Q){return v0(),RJ(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var NJ=5000,UY=600000;function HY($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[p$])return null;try{return g2({platform:J})}catch{return null}}function qY($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function MY($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=n3();if(Z.length>0)u1($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)u1($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function p1($,J,Z,Q,X={}){if(v0(),$.executionMode==="host")d1();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let V=$0($);if(V.revoked)throw Error("worker_revoked");let N=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let B,U=()=>B??=$.executionMode==="host"?zJ():Promise.resolve(!1),M=_J(),G=X.prestartedReadiness??b1($,X.readinessProbes,N,J.roots[0].permissions),H=X.deferOptionalLanes===!0,q=await(H?G.initial:G.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,L=q["github.local.v1"]===!0?(X.probeGithubSignedIn??e5)().catch(()=>!1):null,j=new AbortController,W=null,O=async(h,a)=>{let i=($.userChrome??X.ownComputer===!0)&&h["automation.call.v1"]===!0?OJ():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
-`);let B0=j9($,h,{displayVideo:h["display.stream.v1"]===!0&&await U(),handsBrowser:h["hands.connect"]===!0&&M,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:h["pty.start"]===!0&&E2(),probing:a,ownComputer:X.ownComputer===!0});if(!W&&B0.worker.readiness?.["browser.pr-proof.v1"]===!0){let O0=await d5();if(W||j.signal.aborted)return B0;process.stderr.write("error"in O0?`Reason worker: PR video proof unavailable (${O0.error})
+`,{mode:384,flag:"wx"});let M={cwd:V,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};B="encode",await B9(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",N],M),B="output";let G=await R5(N);if(!G.isFile()||G.isSymbolicLink()||G.nlink!==1||G.size<128||G.size>10485760)throw Error();B="probe";let{stdout:H}=await B9(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",N],M),q=JSON.parse(H),T=q.streams,L=Number(q.format?.duration);if(B="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(B="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(B="probe_duration",!Number.isFinite(L)||Math.abs(L-X)>0.25)throw Error();if(B="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(B="probe_format",q.format?.format_name!=="matroska,webm")throw Error();return B="decode",await B9(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",N,"-f","null","-"],M),B="pin",await Promise.all([$$(Z.ffmpeg),$$(Z.ffprobe)]),await P5(N)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${B}_failed`)}finally{await ZX(V,{recursive:!0,force:!0})}}}}var E5=K.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var J$=K.string().min(1).max(1024),C5=K.object({path:J$,sha256:K.string().regex(/^[a-f0-9]{64}$/)}).strict(),x5=K.object({owner:K.object({runId:J$,deviceId:J$,rootId:J$,rootRevision:J$,profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:J$,generation:J$,browserScope:J$,tabId:K.number().int().positive()}).strict(),socketPath:J$,extensionId:K.string().regex(/^[a-p]{32}$/),nativeHostName:J$,seconds:K.number().int().min(1).max(15),encoder:K.object({ffmpeg:C5,ffprobe:C5}).strict()}).strict();var TX=15728640,z$=()=>Error("mac_recording_worker_failed");function b5($){let J=x5.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,V=null,N=async()=>{},B=async(H,q=3000)=>{let T;try{return await Promise.race([H,new Promise((L,j)=>{T=setTimeout(()=>j(z$()),q)})])}finally{clearTimeout(T)}},U=()=>V??=B((async()=>{let q=(await Promise.allSettled([N(),$.cleanup()])).find((T)=>T.status==="rejected");if(q?.status==="rejected")throw q.reason})(),5000).catch((H)=>{X=!0;let q=H&&typeof H==="object"&&"code"in H?H.code:null,T=typeof q==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(q)?q:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),M=null,G=async()=>{if(X)throw z$();if(await B($.assertCurrent()),X)throw z$()};return{async start(){if(Y||M)throw Error("mac_recording_already_active");Y=!0;try{await G(),await $$({path:Z.path,sha256:Z.sha256}),await G(),V=null;let H=await NX(await KX(HX(UX(),"reason-recording-host-")));try{await G()}catch(C){throw await S5(H,{recursive:!0,force:!0}),C}let q=qX(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((C)=>q.once("close",()=>C())),L=()=>{if(q.pid)try{process.kill(-q.pid,"SIGKILL")}catch(C){if(C.code!=="ESRCH")throw C}},j=null;N=()=>j??=(async()=>{try{L()}catch(C){if(C.code!=="EPERM")throw C}await T;try{for(let C=0;;C++)try{L();break}catch(x){if(x.code!=="EPERM"||C>=20)throw x;await new Promise((A)=>setTimeout(A,25))}}finally{await S5(H,{recursive:!0,force:!0})}})();let W="",O=0,F=!1,z=!1,_=null,D,R,E=new Promise((C,x)=>{D=C,R=x}),P,I,f=new Promise((C,x)=>{P=C,I=x});f.catch(()=>{});let S=(C=z$())=>{if(F)return;F=!0,clearTimeout(k),clearInterval(w),U().then(()=>{R(C),I(C)},(x)=>{R(x),I(x)})},k=setTimeout(()=>S(),(J.seconds+25)*1000),p=!1,w=setInterval(()=>{if(p||F)return;p=!0,G().catch(()=>S()).finally(()=>{p=!1})},250);M={completion:f,stop:()=>{if(!F)q.stdin.write(`{"type":"stop"}
+`)},cancel:()=>S()},q.on("error",()=>S()),q.stdin.on("error",()=>S()),q.stdout.on("data",(C)=>{if(F)return;if(O+=C.length,O>TX){S();return}W+=C.toString("utf8");let x;while((x=W.indexOf(`
+`))!==-1){let A=W.slice(0,x);W=W.slice(x+1);try{let y=JSON.parse(A);if(y.type==="failed"&&Object.keys(y).sort().join(",")==="reason,type"){let t=E5.safeParse(y.reason);S(t.success?Error(`mac_recording_worker_failed:${t.data}`):z$());return}if(y.type==="unsupported"&&!z){S(Error("mac_recording_encoder_unavailable"));return}if(y.type==="started"&&!z&&Object.keys(y).length===1){z=!0,D({recording:!0});continue}if(!z||y.type!=="capture"||_||Object.keys(y).sort().join(",")!=="bytes,capture,type")throw z$();let b=y.capture;if(!b||Object.keys(b).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof b.sha256!=="string"||typeof b.startedAt!=="string"||typeof b.finishedAt!=="string"||!MX(b.owner,J.owner)||b.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(b.sha256)||!Number.isSafeInteger(b.sizeBytes)||b.sizeBytes<128||b.sizeBytes>10485760||!Number.isSafeInteger(b.frameCount)||b.frameCount<1||b.frameCount>450||!Number.isSafeInteger(b.receivedFrameCount)||b.receivedFrameCount<b.frameCount||b.receivedFrameCount>2000||!Number.isFinite(b.durationSeconds)||b.durationSeconds<0.05||b.durationSeconds>J.seconds||!Number.isFinite(Date.parse(b.startedAt))||!Number.isFinite(Date.parse(b.finishedAt))||Math.abs((Date.parse(b.finishedAt)-Date.parse(b.startedAt))/1000-b.durationSeconds)>0.1||typeof y.bytes!=="string"||y.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(y.bytes))throw z$();let n=Buffer.from(y.bytes,"base64");if(n.length!==b.sizeBytes||GX("sha256").update(n).digest("hex")!==b.sha256||!n.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw z$();_={capture:Object.freeze({...b,captureId:BX(),owner:Object.freeze({...J.owner})}),bytes:n}}catch{S();return}}}),q.once("close",(C)=>{if(F)return;if(C!==0||!_||W.trim()){S();return}let x=_;G().then(async()=>{if(await N(),F)return;F=!0,clearTimeout(k),clearInterval(w),Q.set(x.capture.captureId,x);while(Q.size>2)Q.delete(Q.keys().next().value);P(x.capture)}).catch(()=>S())}),q.stdin.write(JSON.stringify({...J,scratchDirectory:H})+`
+`);try{return await E}catch(C){throw M=null,C}}finally{Y=!1}},async completed(){if(await G(),!M)throw Error("mac_recording_not_active");return M.completion},async stop(){await G();let H=M;if(!H)throw Error("mac_recording_not_started");H.stop();try{return await H.completion}finally{if(M===H)M=null}},async read(H){await G();let q=Q.get(H);if(!q)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(q.capture),bytes:Buffer.from(q.bytes)}},async close(){if(X)return;X=!0;let H=M;H?.cancel(),Q.clear();try{await U(),await H?.completion.catch(()=>{})}finally{M=null}}}}var w5=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.string(),extensionInstanceId:K.string(),nativeHostName:K.string()})});async function K9($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await LX($.automationDirectory);J=(Q,X)=>k2(Z,Q,X)}if(await $$({path:$.worker.path,sha256:$.worker.sha256}),!await m1($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let V=await J(Z,Y),N=new O$({socketPath:V.socketPath,sessionId:X,timeoutMs:2000}),B;try{if(await N.connect(),B=w5.parse(await N.getInfo()),B.metadata.extensionId!==V.extensionId||B.metadata.extensionInstanceId!==V.instanceId)throw Error("mac_recording_profile_changed");if(!K.array(K.object({id:K.number()})).parse(await N.getTabs()).some((M)=>M.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{N.close()}return{extensionInstanceId:V.instanceId,async createHost(U,M,G){let H=new O$({socketPath:V.socketPath,sessionId:U.browser.browserScope,timeoutMs:2000});return b5({worker:$.worker,configuration:{owner:U.browser,seconds:M,encoder:$.encoder,socketPath:V.socketPath,extensionId:V.extensionId,nativeHostName:B.metadata.nativeHostName},async assertCurrent(){G.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await H.connect();let T=w5.parse(await H.getInfo());if(T.metadata.extensionInstanceId!==U.browser.extensionInstanceId||T.metadata.extensionId!==V.extensionId||T.metadata.nativeHostName!==B.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await H.executeCdp(Q,"Page.stopScreencast",{})}finally{H.close()}}})}}}}var W0=()=>Error("mac_pr_proof_unavailable"),jX=K.object({operationId:K.string().uuid()}).strict();function k5($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=K.array(K.object({profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:K.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!K.string().uuid().safeParse($.generation).success||new Set(Z.map((H)=>H.profile)).size!==Z.length)throw W0();if(!$.qualifiedProfiles){let H=new URL($.uploadOrigin);if(!$.resolveBrowser||H.protocol!=="https:"||H.origin!==$.uploadOrigin||H.username||H.password)throw W0()}let Q=new Map,X=new Map,Y=new Map,V=!1,N=new FX,B=async(H)=>{let q=N.getStore();if(V||!H&&!q)throw W0();if(q?.signal.throwIfAborted(),await $.assertCurrent(H??q.claim),V)throw W0();q?.signal.throwIfAborted()},U=(H,q)=>{let T="owner"in q?q.owner:("context"in q)?q.context.owner:q.input.owner;if(H.capability!==$9||!H.owner||T.generation!==$.generation||!Z.some((L)=>L.profile===T.profile&&L.extension_instance_id===T.extensionInstanceId)||T.organizationId!==H.owner.organization_id||T.userId!==H.owner.user_id||T.deviceId!==H.owner.device_id||T.rootId!==H.root_id||T.runId!==H.run_id)throw W0();return T},M=async(H)=>{await B();let q=JSON.stringify([H.runId,H.profile]),T=Q.get(q);if(!T){if(Q.size>=4)throw W0();T=(async()=>{let j,W=$.browserScope?.(H)??V1(H.runId),O=await $.createBrowser({owner:H,assertCurrent:()=>B(),readVideo:(F)=>j.publicationCapture(F)});if(j=T5({owner:H,browserScope:W,assertCurrent:()=>B(),screenshot:O.screenshot,async createVideo(F,z,_,D){if(!$.resolveBrowser)throw W0();let R=await $.resolveBrowser(H.profile,z,W,D);if(R.extensionInstanceId!==H.extensionInstanceId)throw W0();return R.createHost({organizationId:H.organizationId,userId:H.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:H.runId,deviceId:H.deviceId,rootId:H.rootId,rootRevision:H.rootRevision,generation:H.generation,profile:H.profile,extensionInstanceId:H.extensionInstanceId,browserScope:W,tabId:z}},_,D)}}),V)throw O.close(),await j.close(),W0();return{owner:structuredClone(H),browser:O,capture:j,expiresAt:Date.now()+300000}})(),Q.set(q,T)}let L=await T;if(!y5(L.owner,H)||L.expiresAt<=Date.now())throw W0();return L},G=setInterval(()=>{for(let[H,q]of Q)q.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((L)=>L.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(H)===q)Q.delete(H)}).catch(()=>{V=!0})},1000);return G.unref(),{generation:$.generation,async execute(H,q,T){return N.run({claim:H,signal:q},async()=>{let L=X9.parse(H.payload).command,j=U(H,L);if(await B(H),q.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(L.action==="prepare"?L.context.evidenceKind!=="image"||Boolean(L.context.visualPlan)||!L.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(L.action)))throw Error("proof_png_only");let W=await M(j),O=async()=>{await B(H),q.throwIfAborted()},F;switch(L.action){case"auth_check":F=await W.browser.preflight(L.input);break;case"prepare":if(L.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!L.context.uploadOrigin)throw W0();F=await W.capture.prepare(L.context);break;case"capture_png":F=await W.capture.screenshot({claim:{operationId:H.operation_id,attemptId:H.attempt_id,contextId:L.contextId,tabId:L.tabId},signal:q});break;case"start_video":{let z={runtime:W,contextId:L.contextId,attemptId:H.attempt_id,tabId:L.tabId,signal:q};if(X.has(H.operation_id))throw W0();X.set(H.operation_id,z);try{F=await W.capture.record({claim:{operationId:H.operation_id,attemptId:H.attempt_id,contextId:L.contextId,tabId:L.tabId},signal:q,seconds:L.seconds,started:async()=>{await O(),await T({version:1,operationId:H.operation_id,contextId:L.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(H.operation_id)}break}case"inspect_capture":F=await W.capture.inspect(L.captureId);break;case"publish_video":F=await W.browser.publish(L.input);break;case"verify_saved_media":F=await W.browser.verify(L.input);break;case"verify_png_media":F=await W.browser.verifyImages(L.media);break;case"publish_png":{let z=`${j.runId}:${L.attemptId}`,_=Y.get(z);if(_){if(!y5(_.request,L))throw W0();F=_.result;break}if(Y.size>=16)throw W0();let D=new URL(L.uploadUrl);if(D.protocol!=="https:"||D.username||D.password||D.hash||D.pathname!==`/${L.storagePath}`||!L.storagePath.startsWith(`pr-screenshots/${j.runId}/${L.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(L.storagePath.split("/").at(-1))||L.storagePath.split("/").length!==4)throw W0();let R=await W.capture.publicationCapture(L.captureId);try{if(D.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==L.sha256||R.bytes.length!==L.sizeBytes||_X("sha256").update(R.bytes).digest("hex")!==L.sha256)throw W0();await O();let E={request:structuredClone(L),result:{status:"uncertain",sha256:L.sha256,sizeBytes:L.sizeBytes}};Y.set(z,E);try{let P=await fetch(D,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([q,AbortSignal.timeout(20000)])});if(await P.body?.cancel(),await O(),P.ok)E.result={...E.result,status:"uploaded"}}catch{}F=E.result}finally{R.bytes.fill(0)}break}}return await O(),structuredClone(F)})},async control(H,q){if(H.capability!==$9||q.kind!==q5)return!1;let T=jX.safeParse(q.payload),L=X.get(H.operation_id);if(!T.success||T.data.operationId!==H.operation_id||!L||L.attemptId!==H.attempt_id)return!1;let j=X9.parse(H.payload).command;return U(H,j),await B(H),await N.run({claim:H,signal:L.signal},()=>L.runtime.capture.stop({operationId:H.operation_id,attemptId:H.attempt_id,contextId:L.contextId,tabId:L.tabId})),!0},async close(){V=!0,clearInterval(G);let H=await Promise.allSettled([...Q.values()].map(async(q)=>{let T=await q;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),H.some((q)=>q.status==="rejected"))throw W0()}}}var IX="__browser-recorder",CX=PX(DX),EX="/tmp/open-browser-use",xX=33554432,SX=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.literal(m2),extensionInstanceId:K.string().min(1).max(1024)})}),f5=()=>Error("worker_pr_proof_browser_unavailable"),q9={components:w1,ensureBrowser:u5,socketDirectory:EX,async identity($){let J=new O$({socketPath:$,sessionId:`reason-proof-qualification-${H9()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function m5($,J=q9){let Z=J.components();if(!Z?.features.browser)throw f5();await J.ensureBrowser(Z),$.throwIfAborted();let Q=N9(d5(Z),"Default","Local Extension Settings",m2),X=(await h5(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>N9(Q,Y));for(let Y of(await h5(J.socketDirectory)).filter((V)=>V.endsWith(".sock"))){$.throwIfAborted();let V=N9(J.socketDirectory,Y);try{let N=await OX(V);if(!N.isSocket()||N.uid!==process.getuid?.())continue;let B=SX.parse(await J.identity(V)).metadata.extensionInstanceId;for(let U of X)if((await AX(U)).size<=xX&&(await p5(U)).includes(B))return{socketPath:V,instanceId:B,extensionId:m2}}catch{}}throw f5()}async function U9($){let J=await zX($);return{path:J,sha256:WX("sha256").update(await p5(J)).digest("hex")}}async function l5($={}){let J={...q9,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await U9(Z.ffmpeg),{stdout:X}=await CX(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await U9(Z.ffprobe)};if(!await m1(Y))return{error:"worker_recording_encoder_unqualified"};let V=$.recorder??{path:process.execPath,args:[...RX(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],IX]};return{worker:{...await U9(V.path),args:V.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function c5($,J={}){let Z={...q9,...J},Q=H9(),X=H9(),Y=v5.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),V=$.recording?g5.parse({...Y,version:3,video:!0,max_seconds:15}):Y,N=(G)=>X5(G.organizationId,G.sessionId,G.deviceId,1),B=$.recording,U,M=k5({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:N,...B?{resolveBrowser:async(G,H,q,T)=>{U??=K9({...B,assertCurrent:()=>$.assertCurrent(),discover:(j,W)=>m5(W,Z)}),U.catch(()=>{U=void 0});let L=await(await U)(G,H,q,T);return{extensionInstanceId:X,createHost:async(j,W,O)=>bX(await L.createHost({...j,browser:{...j.browser,extensionInstanceId:L.extensionInstanceId}},W,O),X)}}}:{},createBrowser:(G)=>V9({...G,endpoint:(H)=>({discover:(q)=>m5(q,Z),tabScope:N(H)})})});return{capability:V,broker:M}}function bX($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as nX}from"child_process";import{execFile as wX}from"child_process";import{readFile as yX}from"fs/promises";import{join as t0}from"path";var kX="Claude Code-credentials",hX="/usr/bin/security",fX=120000,mX=8192,v2={exec:($,J,Z)=>new Promise((Q)=>{wX($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let V=X?typeof X.code==="number"?X.code:1:0;Q({code:V,stdout:String(Y??"")})})}),readText:async($)=>{try{return await yX($,"utf8")}catch{return null}}};function G1($){return typeof $==="string"&&$.length>0&&$.length<=mX?$:null}function vX($,J){return $.CLAUDE_CONFIG_DIR||t0(J,".claude")}function gX($,J){return $.CODEX_HOME||t0(J,".codex")}function s5($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=G1(J?.accessToken),Q=G1(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function uX($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function dX($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=G1(J.tokens?.access_token),Q=G1(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:uX(Z)??Date.now()}}catch{return null}}function pX($,J){return t0($.XDG_DATA_HOME||t0(J,".local","share"),"opencode","auth.json")}var lX={anthropic:"anthropic",openai:"openai-codex"};function cX($){return t5($,lX)}function t5($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let V=Z[X];if(V?.type!=="oauth")continue;let N=G1(V.access),B=G1(V.refresh),U=typeof V.expires==="number"&&Number.isFinite(V.expires)?V.expires:null;if(N&&B&&U!==null)Q.push({provider:Y,access:N,refresh:B,expires:U})}return Q}catch{return[]}}function sX($){return t5($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function aX($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?t0(J,Z.slice(2)):Z||t0(J,".pi","agent")}async function r5($,J,Z=v2){let Q=[],X=await Z.exec(hX,["find-generic-password","-s",kX,"-w"],fX),Y=Date.now()+300000,V=(B)=>{if(!B)return;let U=Q.findIndex((M)=>M.provider===B.provider);if(U<0)Q.push(B);else if(Q[U].expires<=Y&&B.expires>Y)Q[U]=B};if(V(X.code===0?s5(X.stdout.trim()):null),!Q.some((B)=>B.provider==="anthropic"&&B.expires>Y))V(s5(await Z.readText(t0(vX($,J),".credentials.json"))));let N=dX(await Z.readText(t0(gX($,J),"auth.json")));V(N),V(iX(await Z.readText(t0($.GROK_HOME||t0(J,".grok"),"auth.json"))));for(let B of cX(await Z.readText(pX($,J))))V(B);for(let B of sX(await Z.readText(t0(aX($,J),"auth.json"))))V(B);return Q}function o5($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var a5="https://auth.x.ai",i5="b1a00492-073a-47ea-816f-4c329264a828",n5=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function iX($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${a5}::${i5}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==a5||Q.oidc_client_id!==i5||!n5(Q.key)||!n5(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var e5=330000,tX=300000,rX=60000;function oX($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+e5)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function eX($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*e5)?rX:tX}var $Y=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function $J($){let J=new Map,Z=$.wait??$Y,Q=$.stores??(process.platform==="darwin"?v2:{...v2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=o5(await r5($.environment??process.env,$.home,Q));for(let Y of oX(X,J)){if($.signal.aborted)return;let V=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:V.ok,...V.ok?{}:{error:V.error}})}}catch{}await Z(eX(J),$.signal)}}function JJ($=process.env){return new Promise((J)=>{nX("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as JY,spawn as Uq,spawnSync as Hq}from"child_process";import{chmodSync as Mq,existsSync as ZY,mkdirSync as Tq,readFileSync as Lq,renameSync as Fq,rmSync as _q,statSync as jq,writeFileSync as Dq}from"fs";import{dirname as Oq,isAbsolute as zq,join as M9}from"path";var ZJ=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function QJ($,J){if(!ZJ.test($)||!ZJ.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var QY="com.reasonmachines.updater",XY=["so.ara.updater","so.reason.updater"];function YY($){let J=$==="staging"?".staging":"";return{label:`${QY}${J}`,legacyLabels:[...XY].reverse().map((Z)=>`${Z}${J}`)}}function VY($,J,Z){return{launchAgent:M9(J,"Library","LaunchAgents",`${$}.plist`),systemdService:M9(Z,"systemd","user",`${$}.service`),systemdTimer:M9(Z,"systemd","user",`${$}.timer`)}}function GY($,J){return new Promise((Z)=>{JY($,[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function VJ($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux")return"absent";let Z=$.uid??process.getuid?.();if(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0)return"absent";let Q=$.home??H0(),{label:X,legacyLabels:Y}=YY($.channel),V=$.configHome??YJ(Q),N=[X,...Y].filter((G)=>{let H=VY(G,Q,V);return ZY(J==="darwin"?H.launchAgent:H.systemdService)});if(N.length===0)return"absent";let B=$.command??GY,U=N[0];if(N.length>1){for(let G of N)if((J==="darwin"?await B("/bin/launchctl",["print",`gui/${Z}/${G}`]):await B("systemctl",["--user","is-enabled",`${G}.timer`]))===0){U=G;break}}return(J==="darwin"?await B("/bin/launchctl",["kickstart",`gui/${Z}/${U}`]):await B("systemctl",["--user","start","--no-block",`${U}.service`]))===0?"started":"failed"}var XJ=60000;function GJ($){let J=(X,Y)=>{try{return QJ(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let V=setTimeout(X,Y);V.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(V),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),V=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(XJ-1,Math.floor(V*XJ)))}}var BY=30000;async function KJ($){return($.flush??BJ)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(BY);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof L0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var UJ=25000,NY=5000,UY=600000,HY=["display.stream.v1","pty.start"],qY=64;function F9($,J,Z=j9($),Q){return v0(),IJ(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var HJ=5000,MY=600000;function TY($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[p$])return null;try{return g2({platform:J})}catch{return null}}function LY($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function FY($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=n3();if(Z.length>0)u1($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)u1($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function p1($,J,Z,Q,X={}){if(v0(),$.executionMode==="host")d1();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let V=$0($);if(V.revoked)throw Error("worker_revoked");let N=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let B,U=()=>B??=$.executionMode==="host"?RJ():Promise.resolve(!1),M=DJ(),G=X.prestartedReadiness??b1($,X.readinessProbes,N,J.roots[0].permissions),H=X.deferOptionalLanes===!0,q=await(H?G.initial:G.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,L=q["github.local.v1"]===!0?(X.probeGithubSignedIn??JJ)().catch(()=>!1):null,j=new AbortController,W=null,O=async(h,a)=>{let i=($.userChrome??X.ownComputer===!0)&&h["automation.call.v1"]===!0?AJ():null;if(i&&"code"in i)process.stderr.write(`Reason worker: your own Chrome unavailable (${i.code})
+`);let B0=j9($,h,{displayVideo:h["display.stream.v1"]===!0&&await U(),handsBrowser:h["hands.connect"]===!0&&M,userChrome:i&&"host"in i?i.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:h["pty.start"]===!0&&E2(),probing:a,ownComputer:X.ownComputer===!0});if(!W&&B0.worker.readiness?.["browser.pr-proof.v1"]===!0){let O0=await l5();if(W||j.signal.aborted)return B0;process.stderr.write("error"in O0?`Reason worker: PR video proof unavailable (${O0.error})
 `:`Reason worker: PR video proof ready (ffmpeg ${O0.encoder.ffmpeg.path})
-`),W=p5({assertCurrent:async()=>{if(!w())throw Error("proof_authority_lost")},...!("error"in O0)?{recording:O0}:{}})}return B0},F=await O(q,H?t3.filter((h)=>q[h]!==!0):[]),z=F9($,J,F,W?.capability);X.onStartup?.("inventory_completed");let _=!1,D=0,R=0,E="starting",P=null,I=!1,f=!1,S=null,k,p=()=>!V.drained&&Date.parse(Y)>Date.now()&&z.supported_operations.some((h)=>F.worker.readiness?.[h]===!0),w=()=>!_&&p(),C=null,x=()=>D+(C?.claims()??0),A=null,y=new Set,b=(h)=>{let a=h.capabilities.root_paths;if(Object.assign(h.capabilities,F9(h.config,h.state,F,W?.capability)),a)h.capabilities.root_paths=a},n=(h)=>{F=h,b({config:$,state:J,capabilities:z}),A?.();for(let a of y)b(a),a.heartbeatNow?.()},t=new Set,X0=new Set,M0=setInterval(()=>{let h=new Set;for(let a of[{state:J,capabilities:z},...y])for(let U0 of KY){if(a.capabilities.operation_constraints?.[U0]?.probing!==!0)continue;let B0=`${a.state.deviceId} ${U0}`;if(h.add(B0),!t.has(B0)||X0.has(B0))continue;X0.add(B0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:U0,login_device:a.state===J,timestamp:new Date().toISOString()})}
-`)}t.clear();for(let a of h)t.add(a)},BY);M0.unref();let u0=(h)=>{if(!X.readinessProbes)i8({config:$,readiness:h,signal:j.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(a)=>{O(a,[]).then(n)}})},C0=H?G.final.then(async(h)=>{if(j.signal.aborted)return;n(await O(h,[]));let a=t3.filter((U0)=>h[U0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
-`),u0(h)},()=>{}):Promise.resolve();if(!H)u0(q);L?.then(async(h)=>{T=h;for(;;){let a=F,U0=await O(a.worker.readiness??{},a.worker.probing??[]);if(j.signal.aborted)return;if(F!==a)continue;n(U0);return}});let c0=H&&F.worker.probing?.includes("pty.start")?G.pty.then(async(h)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(j.signal.aborted||!a())return;let U0=await O({...F.worker.readiness,"pty.start":h},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(j.signal.aborted||!a())return;n(U0)},()=>{}):Promise.resolve(),I$=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:E,drained:V.drained||_||I,activeClaims:x(),activeSessions:R,lastHeartbeat:P,expiresAt:Y,supportedOperations:[...z.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:w()&&!I&&E==="running"}),s$=!1,T$=()=>{s$=!0,Y$()},Y$=()=>{if(_)return;if(_=!0,E="stopping",S?.close(),x()===0)j.abort();else k=setTimeout(()=>j.abort(),$.shutdownGraceMs)},C$=$.channel==="production"||$.channel==="staging"?$.channel:null,V$=d($).releaseCheck,v=X.publishedRelease??(C$&&$.lifetime==="persistent"?YJ({currentVersion:r,signal:j.signal,actedOn:(()=>{try{let h=JSON.parse(s(V$));return typeof h==="string"?h:null}catch{return null}})(),check:async(h)=>{try{c(V$,h)}catch{}let a=await XJ({channel:C$});process.stderr.write(a==="started"?`Reason worker: CLI ${h} is published; the updater is checking now.
+`),W=c5({assertCurrent:async()=>{if(!w())throw Error("proof_authority_lost")},...!("error"in O0)?{recording:O0}:{}})}return B0},F=await O(q,H?t3.filter((h)=>q[h]!==!0):[]),z=F9($,J,F,W?.capability);X.onStartup?.("inventory_completed");let _=!1,D=0,R=0,E="starting",P=null,I=!1,f=!1,S=null,k,p=()=>!V.drained&&Date.parse(Y)>Date.now()&&z.supported_operations.some((h)=>F.worker.readiness?.[h]===!0),w=()=>!_&&p(),C=null,x=()=>D+(C?.claims()??0),A=null,y=new Set,b=(h)=>{let a=h.capabilities.root_paths;if(Object.assign(h.capabilities,F9(h.config,h.state,F,W?.capability)),a)h.capabilities.root_paths=a},n=(h)=>{F=h,b({config:$,state:J,capabilities:z}),A?.();for(let a of y)b(a),a.heartbeatNow?.()},t=new Set,X0=new Set,M0=setInterval(()=>{let h=new Set;for(let a of[{state:J,capabilities:z},...y])for(let U0 of HY){if(a.capabilities.operation_constraints?.[U0]?.probing!==!0)continue;let B0=`${a.state.deviceId} ${U0}`;if(h.add(B0),!t.has(B0)||X0.has(B0))continue;X0.add(B0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:U0,login_device:a.state===J,timestamp:new Date().toISOString()})}
+`)}t.clear();for(let a of h)t.add(a)},UY);M0.unref();let u0=(h)=>{if(!X.readinessProbes)i8({config:$,readiness:h,signal:j.signal,idle:()=>x()===0,permissions:J.roots[0].permissions,onReady:(a)=>{O(a,[]).then(n)}})},C0=H?G.final.then(async(h)=>{if(j.signal.aborted)return;n(await O(h,[]));let a=t3.filter((U0)=>h[U0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
+`),u0(h)},()=>{}):Promise.resolve();if(!H)u0(q);L?.then(async(h)=>{T=h;for(;;){let a=F,U0=await O(a.worker.readiness??{},a.worker.probing??[]);if(j.signal.aborted)return;if(F!==a)continue;n(U0);return}});let c0=H&&F.worker.probing?.includes("pty.start")?G.pty.then(async(h)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(j.signal.aborted||!a())return;let U0=await O({...F.worker.readiness,"pty.start":h},(F.worker.probing??[]).filter((i)=>i!=="pty.start"));if(j.signal.aborted||!a())return;n(U0)},()=>{}):Promise.resolve(),I$=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:E,drained:V.drained||_||I,activeClaims:x(),activeSessions:R,lastHeartbeat:P,expiresAt:Y,supportedOperations:[...z.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:w()&&!I&&E==="running"}),s$=!1,T$=()=>{s$=!0,Y$()},Y$=()=>{if(_)return;if(_=!0,E="stopping",S?.close(),x()===0)j.abort();else k=setTimeout(()=>j.abort(),$.shutdownGraceMs)},C$=$.channel==="production"||$.channel==="staging"?$.channel:null,V$=d($).releaseCheck,v=X.publishedRelease??(C$&&$.lifetime==="persistent"?GJ({currentVersion:r,signal:j.signal,actedOn:(()=>{try{let h=JSON.parse(s(V$));return typeof h==="string"?h:null}catch{return null}})(),check:async(h)=>{try{c(V$,h)}catch{}let a=await VJ({channel:C$});process.stderr.write(a==="started"?`Reason worker: CLI ${h} is published; the updater is checking now.
 `:a==="absent"?`Reason worker: CLI ${h} is published; no updater is installed for it here.
 `:`Reason worker: CLI ${h} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),Y0=(h)=>{if(h==="stop")T$();if(h==="reload_roots"){let a=o($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let U0=AJ(J.roots,BJ());if(U0)z.root_paths=U0;else delete z.root_paths;C?.check()}if(h==="drain"||h==="resume"){if(_||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");V={...V,drained:h==="drain"},R0($,V)}return I$()};X.prestartedControl?.handle(Y0);let E$=X.prestartedControl?await X.prestartedControl.closed:await j2($,Q,Y0),G$,x$=!1,f0=()=>{let h=Date.parse(Y)-Date.now();if(h>0){G$=setTimeout(f0,Math.min(h,2147483647));return}_=!0,S?.close(),x$=!0,E="stopping",j.abort(Error("worker_credential_expired"))};f0(),X.signal?.addEventListener("abort",Y$,{once:!0});let T1=X.processSignals!==!1;if(T1)process.once("SIGTERM",Y$),process.once("SIGINT",T$);if(X.signal?.aborted)Y$();try{X.onStartup?.("control_ready");let h=X.client??new g1(W$($.apiOrigin),S0($.proxy,UJ()),Z,{deviceSession:m3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,U0=U3($,J.deviceId),i=X.startupTiming,B0=i?()=>({...i(),...U0?.enrollmentMs!==void 0?{enrollment_ms:U0.enrollmentMs}:{}}):void 0,O0=(m)=>{let s0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&s0)(X.handOverLocalLogins??o5)({state:m.state,client:{localSubscription:s0},signal:m.signal,home:H0()}).catch(()=>{return});let _0=BJ(),x0=m.client.liveSessionWorktrees?.bind(m.client);if(x0)TJ(()=>MJ({home:_0,deviceId:m.state.deviceId,liveIds:(L$)=>x0(m.state,L$,m.signal)}),m.signal)};O0({state:J,client:h,signal:j.signal});let B$=HY($,X.platform??process.platform),a$=h.deviceLifecycle?.bind(h),z0=Promise.resolve(),E0=0,L1=()=>{if(!B$||!a$||_||Date.now()<E0)return;E0=Date.now()+UY,z0=z0.then(()=>GJ({paths:B$,device:J,client:{deviceLifecycle:a$},accept:qY,signal:j.signal})).catch(()=>{return})};if(L1(),B$)G.final.then((m)=>MY(B$,m),()=>{});let r1=(m,s0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:X.ownComputer===!0?NY:4*$.slots+DJ,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:KJ,operationCompletionTimeoutMs:KJ,maxConsecutiveHeartbeatFailures:3,claimable:w,advertised:p,onClaim:async(_0,x0,L$)=>{let _1=Date.now();if(!m.capabilities.supported_operations.includes(_0.capability))return{status:"failed",error_code:"unsupported_capability"};let a0=F.worker.probing??[],p9=a0.includes(_0.capability)?C0:_0.capability==="hands.connect"&&$.executionMode==="host"&&a0.includes("pty.start")?c0:null;if(p9){let e1,G3=()=>{};await Promise.race([p9,new Promise((l9)=>{e1=setTimeout(l9,GY),G3=()=>l9(),x0.addEventListener("abort",G3,{once:!0})})]),clearTimeout(e1),x0.removeEventListener("abort",G3)}let o1=_0.capability==="hands.connect",V3=o1?S:null,$7={signal:x0,emit:L$,...F,...W?{proveMac:W.broker.execute}:{},..._0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(e1)=>m.client.operationCustomEndpointCredential(m.state,_0,e1)}:{},...o1?{handsLaunch:{claimedAtMs:_1,...V3?{takePrespawnedWorker:V3.take,adoptSpawnedWorker:V3.adopt}:{}}}:{}};if(o1)R+=1;try{return await(X.execute??D9)(m.state,_0,$7)}finally{if(o1)R-=1}},onControl:async(_0,x0)=>await PJ(m.state,_0,x0,m.client)||await IJ(m.state,_0,x0)||await WJ(_0,x0)||await W?.broker.control(_0,x0)||!1,onEvent:s0}),g9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:VY(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(NJ)).catch(()=>{return})},F1=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,u9=h.ownerWorkspaces?.bind(h),d9=h.ownerWorkspaceEnrollment?.bind(h);if(F1&&u9&&d9)C=T4({config:$,state:J,signal:j.signal,client:{ownerWorkspaces:u9,ownerWorkspaceEnrollment:d9},...F1.enroll?{enroll:F1.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,s0,_0)=>{let x0=U3(m.config,m.state.deviceId),L$={config:m.config,state:m.state,signal:s0,statusPath:d(m.config).daemon,...x0?.offer?{firstHeartbeat:x0.offer}:{},capabilities:F9(m.config,m.state,F,W?.capability),client:F1.client?.(m)??new g1(W$($.apiOrigin),S0($.proxy,UJ()),m.proofStore,{deviceSession:m3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};O0(L$);let _1={...L$,heartbeatNow:null};y.add(_1);try{await u3({registerHeartbeatNow:(a0)=>{_1.heartbeatNow=a0},...r1(L$,(a0)=>{if(a0.type==="completed")_9(a0.operationId,a0.status);if(a0.type==="claims_changed"){if(_0(a0.activeClaims),_&&x()===0)j.abort()}if(a0.type==="stopped")_0(0)})})}finally{y.delete(_1)}if(_&&!x$)await g9(L$)}});let Q3=0,X3=0,Y3=F1?.intervalMs??N4;if(await u3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?M2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...B0?{startup:B0}:{},...r1({state:J,client:h,capabilities:z,signal:j.signal,statusPath:a,...U0?.offer?{firstHeartbeat:U0.offer}:{}},(m)=>{if(m.type==="completed")_9(m.operationId,m.status);if(m.type==="claims_changed"){if(D=m.activeClaims,_&&x()===0)j.abort()}if(m.type==="heartbeat"&&!_){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=FJ({log:(s0,_0)=>{process.stderr.write(`${JSON.stringify({event:s0,..._0})}
-`)}}),S.arm(),setTimeout(jJ,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(C&&!_&&Date.now()>=Q3)Q3=Date.now()+Y3,C.check().then((s0)=>{X3=s0?0:X3+1,Q3=Date.now()+(s0?Y3:Math.min(Y3,U4*2**Math.min(X3-1,10)))});if(P=m.serverTime,I=m.drain,L1(),!_&&C$)v?.(m.latestCliVersions?.[C$]);if(!_)E="running";if(!_&&!f&&I$().executionEligible){if(f=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{L9({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!_)E="reconnecting";if(m.type==="stopped")D=0;X.onEvent?.(m)})}),await C?.settled(),_&&!x$&&$.lifetime==="ephemeral")await h.disconnect?.(J,AbortSignal.timeout(NJ)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(_&&!x$)await g9({state:J,client:h});if(s$)await LJ().catch(()=>{return})}catch(h){if(!(h instanceof L0&&h.status===401))throw h;if(R0($,{...V,revoked:!0}),h.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(G$),clearInterval(M0),k)clearTimeout(k);if(T1)process.removeListener("SIGTERM",Y$),process.removeListener("SIGINT",T$);X.signal?.removeEventListener("abort",Y$),j.abort(),S?.close(),await C?.settled().catch(()=>{return}),await W?.broker.close().catch(()=>{return}),await E$()}}function UJ($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(HJ,qJ),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as TY,sign as LY}from"crypto";var CJ=65536,FY=65536;function _Y($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new V0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new V0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!xJ(X))throw new V0("invalid_public_key");return X}function EJ(){try{let{privateKey:$,publicKey:J}=TY("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:_Y(J)}}catch($){if($ instanceof V0)throw $;throw new V0("proof_key_generation_failed")}}class l1{keyPair=EJ();binding=null;loadPublicKey(){if(!this.keyPair)throw new V0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=EJ(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>FY)throw new V0("proof_sign_failed");let J;try{J=LY("sha256",$,this.keyPair.privateKey)}catch{throw new V0("proof_sign_failed")}if(!SJ(J))throw new V0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>CJ)throw new V0("invalid_binding");if(this.binding)throw new V0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>CJ)throw new V0("invalid_binding");if(!this.binding)throw new V0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as RY,spawn as PY}from"child_process";import{isAbsolute as IY}from"path";import{promisify as CY}from"util";var c1={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class s1{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let V=this.waiter;this.waiter=void 0,V.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=c1){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
-`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(V)=>V?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as jY}from"crypto";import{unlinkSync as DY}from"fs";import{join as WY}from"path";var a1=1,u2=45000,OY=K.strictObject({type:K.literal("configure"),protocol:K.literal(a1),version:K.string(),config:J0}),zY=K.strictObject({type:K.literal("ticket"),organizationId:K.string().min(1).max(160),receipt:K.unknown()}),AY=K.strictObject({type:K.enum(["ping","stop"])});async function bJ($={}){let J=$.clock??c1,Z=new s1($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),V,N,B,U,M=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:G,version:H}=OY.parse(await Z.receive(30000,Q.signal));if(H!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(K$(G),e(g(G),!0),N=e0({path:d(G).lock,runtimeVersion:r}),!N.acquired)throw Error("worker_already_running_or_lifecycle_busy");let q=WY(g(G),`ssh-preflight-${jY()}.json`);try{c(q,{version:1}),s(q)}finally{try{DY(q)}catch{}}let T=o(G),L=$0(G);if(L.revoked||L.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&G.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:a1,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let j=G.lifetime==="ephemeral"?B=new l1:T0(G,!0);if(!T){let _=D$(G);await Z.send({type:"ticket-request",request:_.request});let D=zY.parse(await Z.receive(70000,Q.signal)),R=_.complete(D.organizationId,D.receipt);if(T=await o0(G,R,j,$.enroll),G.lifetime==="persistent")k0(T,d(G).state,{proofStore:j});R0(G,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");V=(async()=>{try{while(!X.signal.aborted){if(AY.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let W=!1,O,F=!1;U=J.after(Math.max(1,Math.min(u2,$.startupTimeoutMs??u2)),()=>{F=!0,Y()});let z=N.owner.nonce;if(await p1(G,T,j,z,{...$,signal:Q.signal,onEvent(_){if($.onEvent?.(_),_.type==="heartbeat"&&!W&&!O)O=(async()=>{let D=await K0(G,"status");if(!D?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:D.deviceId,expiresAt:D.expiresAt,lifetime:G.lifetime,supervision:"ssh-foreground"}),W=!0,U?.()})().catch(()=>{F=!0,Y()})}}),await O,F||!W)throw Error("worker_ssh_outbound_or_readiness_failed");return M=!0,0}catch(G){let H=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:H})}catch{}return 1}finally{if(U?.(),Y(),X.abort(),await V,B?.deleteBinding(),B?.deleteKey(),N?.acquired)N.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),M)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var O9=($)=>IY($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),W9=($)=>`'${$.replaceAll("'","'\\''")}'`,EY=K.strictObject({type:K.literal("hello"),protocol:K.literal(a1),version:K.string(),platform:K.enum(["linux","darwin"]),architecture:K.enum(["arm64","x64"]),enrolled:K.boolean()}),xY=K.strictObject({type:K.literal("ticket-request"),request:K.strictObject({install_id:K.uuid(),code_challenge:K.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:K.enum(["persistent","ephemeral"]),roots:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),execution_mode:K.enum(["confined","host"]),permissions:K.strictObject({read:K.literal(!0),write:K.literal(!0),execute:K.literal(!0),discover_environment:K.literal(!0),expose_mcp:K.literal(!1)})})).length(1)})}),wJ=K.discriminatedUnion("type",[K.strictObject({type:K.literal("running"),deviceId:K.string().min(1).max(160),expiresAt:K.iso.datetime({offset:!0}),lifetime:K.enum(["persistent","ephemeral"]),supervision:K.literal("ssh-foreground")}),K.strictObject({type:K.literal("pong")}),K.strictObject({type:K.literal("stopped")})]),SY=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function d2($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&SY.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function yJ($){if(!O9($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
+`)}}):void 0),Y0=(h)=>{if(h==="stop")T$();if(h==="reload_roots"){let a=o($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let U0=PJ(J.roots,NJ());if(U0)z.root_paths=U0;else delete z.root_paths;C?.check()}if(h==="drain"||h==="resume"){if(_||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");V={...V,drained:h==="drain"},R0($,V)}return I$()};X.prestartedControl?.handle(Y0);let E$=X.prestartedControl?await X.prestartedControl.closed:await j2($,Q,Y0),G$,x$=!1,f0=()=>{let h=Date.parse(Y)-Date.now();if(h>0){G$=setTimeout(f0,Math.min(h,2147483647));return}_=!0,S?.close(),x$=!0,E="stopping",j.abort(Error("worker_credential_expired"))};f0(),X.signal?.addEventListener("abort",Y$,{once:!0});let T1=X.processSignals!==!1;if(T1)process.once("SIGTERM",Y$),process.once("SIGINT",T$);if(X.signal?.aborted)Y$();try{X.onStartup?.("control_ready");let h=X.client??new g1(W$($.apiOrigin),S0($.proxy,qJ()),Z,{deviceSession:m3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,U0=U3($,J.deviceId),i=X.startupTiming,B0=i?()=>({...i(),...U0?.enrollmentMs!==void 0?{enrollment_ms:U0.enrollmentMs}:{}}):void 0,O0=(m)=>{let s0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&s0)(X.handOverLocalLogins??$J)({state:m.state,client:{localSubscription:s0},signal:m.signal,home:H0()}).catch(()=>{return});let _0=NJ(),x0=m.client.liveSessionWorktrees?.bind(m.client);if(x0)FJ(()=>LJ({home:_0,deviceId:m.state.deviceId,liveIds:(L$)=>x0(m.state,L$,m.signal)}),m.signal)};O0({state:J,client:h,signal:j.signal});let B$=TY($,X.platform??process.platform),a$=h.deviceLifecycle?.bind(h),z0=Promise.resolve(),E0=0,L1=()=>{if(!B$||!a$||_||Date.now()<E0)return;E0=Date.now()+MY,z0=z0.then(()=>KJ({paths:B$,device:J,client:{deviceLifecycle:a$},accept:LY,signal:j.signal})).catch(()=>{return})};if(L1(),B$)G.final.then((m)=>FY(B$,m),()=>{});let r1=(m,s0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:X.ownComputer===!0?qY:4*$.slots+OJ,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:UJ,operationCompletionTimeoutMs:UJ,maxConsecutiveHeartbeatFailures:3,claimable:w,advertised:p,onClaim:async(_0,x0,L$)=>{let _1=Date.now();if(!m.capabilities.supported_operations.includes(_0.capability))return{status:"failed",error_code:"unsupported_capability"};let a0=F.worker.probing??[],p9=a0.includes(_0.capability)?C0:_0.capability==="hands.connect"&&$.executionMode==="host"&&a0.includes("pty.start")?c0:null;if(p9){let e1,G3=()=>{};await Promise.race([p9,new Promise((l9)=>{e1=setTimeout(l9,NY),G3=()=>l9(),x0.addEventListener("abort",G3,{once:!0})})]),clearTimeout(e1),x0.removeEventListener("abort",G3)}let o1=_0.capability==="hands.connect",V3=o1?S:null,Z7={signal:x0,emit:L$,...F,...W?{proveMac:W.broker.execute}:{},..._0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(e1)=>m.client.operationCustomEndpointCredential(m.state,_0,e1)}:{},...o1?{handsLaunch:{claimedAtMs:_1,...V3?{takePrespawnedWorker:V3.take,adoptSpawnedWorker:V3.adopt}:{}}}:{}};if(o1)R+=1;try{return await(X.execute??D9)(m.state,_0,Z7)}finally{if(o1)R-=1}},onControl:async(_0,x0)=>await CJ(m.state,_0,x0,m.client)||await EJ(m.state,_0,x0)||await zJ(_0,x0)||await W?.broker.control(_0,x0)||!1,onEvent:s0}),g9=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:KY(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(HJ)).catch(()=>{return})},F1=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,u9=h.ownerWorkspaces?.bind(h),d9=h.ownerWorkspaceEnrollment?.bind(h);if(F1&&u9&&d9)C=T4({config:$,state:J,signal:j.signal,client:{ownerWorkspaces:u9,ownerWorkspaceEnrollment:d9},...F1.enroll?{enroll:F1.enroll}:{},log:(m)=>{process.stderr.write(m)},serve:async(m,s0,_0)=>{let x0=U3(m.config,m.state.deviceId),L$={config:m.config,state:m.state,signal:s0,statusPath:d(m.config).daemon,...x0?.offer?{firstHeartbeat:x0.offer}:{},capabilities:F9(m.config,m.state,F,W?.capability),client:F1.client?.(m)??new g1(W$($.apiOrigin),S0($.proxy,qJ()),m.proofStore,{deviceSession:m3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};O0(L$);let _1={...L$,heartbeatNow:null};y.add(_1);try{await u3({registerHeartbeatNow:(a0)=>{_1.heartbeatNow=a0},...r1(L$,(a0)=>{if(a0.type==="completed")_9(a0.operationId,a0.status);if(a0.type==="claims_changed"){if(_0(a0.activeClaims),_&&x()===0)j.abort()}if(a0.type==="stopped")_0(0)})})}finally{y.delete(_1)}if(_&&!x$)await g9(L$)}});let Q3=0,X3=0,Y3=F1?.intervalMs??N4;if(await u3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>x()>0?M2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{A=m},...B0?{startup:B0}:{},...r1({state:J,client:h,capabilities:z,signal:j.signal,statusPath:a,...U0?.offer?{firstHeartbeat:U0.offer}:{}},(m)=>{if(m.type==="completed")_9(m.operationId,m.status);if(m.type==="claims_changed"){if(D=m.activeClaims,_&&x()===0)j.abort()}if(m.type==="heartbeat"&&!_){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=jJ({log:(s0,_0)=>{process.stderr.write(`${JSON.stringify({event:s0,..._0})}
+`)}}),S.arm(),setTimeout(WJ,0);else if(!m.handsPrespawn&&S)S.close(),S=null}if(m.type==="heartbeat"){if(C&&!_&&Date.now()>=Q3)Q3=Date.now()+Y3,C.check().then((s0)=>{X3=s0?0:X3+1,Q3=Date.now()+(s0?Y3:Math.min(Y3,U4*2**Math.min(X3-1,10)))});if(P=m.serverTime,I=m.drain,L1(),!_&&C$)v?.(m.latestCliVersions?.[C$]);if(!_)E="running";if(!_&&!f&&I$().executionEligible){if(f=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{L9({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!_)E="reconnecting";if(m.type==="stopped")D=0;X.onEvent?.(m)})}),await C?.settled(),_&&!x$&&$.lifetime==="ephemeral")await h.disconnect?.(J,AbortSignal.timeout(HJ)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
+`)});else if(_&&!x$)await g9({state:J,client:h});if(s$)await _J().catch(()=>{return})}catch(h){if(!(h instanceof L0&&h.status===401))throw h;if(R0($,{...V,revoked:!0}),h.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(G$),clearInterval(M0),k)clearTimeout(k);if(T1)process.removeListener("SIGTERM",Y$),process.removeListener("SIGINT",T$);X.signal?.removeEventListener("abort",Y$),j.abort(),S?.close(),await C?.settled().catch(()=>{return}),await W?.broker.close().catch(()=>{return}),await E$()}}function qJ($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(MJ,TJ),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as _Y,sign as jY}from"crypto";var xJ=65536,DY=65536;function WY($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new V0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new V0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!bJ(X))throw new V0("invalid_public_key");return X}function SJ(){try{let{privateKey:$,publicKey:J}=_Y("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:WY(J)}}catch($){if($ instanceof V0)throw $;throw new V0("proof_key_generation_failed")}}class l1{keyPair=SJ();binding=null;loadPublicKey(){if(!this.keyPair)throw new V0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=SJ(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>DY)throw new V0("proof_sign_failed");let J;try{J=jY("sha256",$,this.keyPair.privateKey)}catch{throw new V0("proof_sign_failed")}if(!wJ(J))throw new V0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>xJ)throw new V0("invalid_binding");if(this.binding)throw new V0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>xJ)throw new V0("invalid_binding");if(!this.binding)throw new V0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as CY,spawn as EY}from"child_process";import{isAbsolute as xY}from"path";import{promisify as SY}from"util";var c1={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class s1{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let V=this.waiter;this.waiter=void 0,V.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=c1){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
+`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(V)=>V?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as OY}from"crypto";import{unlinkSync as zY}from"fs";import{join as AY}from"path";var a1=1,u2=45000,RY=K.strictObject({type:K.literal("configure"),protocol:K.literal(a1),version:K.string(),config:J0}),PY=K.strictObject({type:K.literal("ticket"),organizationId:K.string().min(1).max(160),receipt:K.unknown()}),IY=K.strictObject({type:K.enum(["ping","stop"])});async function yJ($={}){let J=$.clock??c1,Z=new s1($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),V,N,B,U,M=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:G,version:H}=RY.parse(await Z.receive(30000,Q.signal));if(H!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(K$(G),e(g(G),!0),N=e0({path:d(G).lock,runtimeVersion:r}),!N.acquired)throw Error("worker_already_running_or_lifecycle_busy");let q=AY(g(G),`ssh-preflight-${OY()}.json`);try{c(q,{version:1}),s(q)}finally{try{zY(q)}catch{}}let T=o(G),L=$0(G);if(L.revoked||L.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&G.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:a1,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let j=G.lifetime==="ephemeral"?B=new l1:T0(G,!0);if(!T){let _=D$(G);await Z.send({type:"ticket-request",request:_.request});let D=PY.parse(await Z.receive(70000,Q.signal)),R=_.complete(D.organizationId,D.receipt);if(T=await o0(G,R,j,$.enroll),G.lifetime==="persistent")k0(T,d(G).state,{proofStore:j});R0(G,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");V=(async()=>{try{while(!X.signal.aborted){if(IY.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let W=!1,O,F=!1;U=J.after(Math.max(1,Math.min(u2,$.startupTimeoutMs??u2)),()=>{F=!0,Y()});let z=N.owner.nonce;if(await p1(G,T,j,z,{...$,signal:Q.signal,onEvent(_){if($.onEvent?.(_),_.type==="heartbeat"&&!W&&!O)O=(async()=>{let D=await K0(G,"status");if(!D?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:D.deviceId,expiresAt:D.expiresAt,lifetime:G.lifetime,supervision:"ssh-foreground"}),W=!0,U?.()})().catch(()=>{F=!0,Y()})}}),await O,F||!W)throw Error("worker_ssh_outbound_or_readiness_failed");return M=!0,0}catch(G){let H=G instanceof Error&&/^worker_[a-z_]+$/.test(G.message)?G.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:H})}catch{}return 1}finally{if(U?.(),Y(),X.abort(),await V,B?.deleteBinding(),B?.deleteKey(),N?.acquired)N.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),M)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var O9=($)=>xY($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),W9=($)=>`'${$.replaceAll("'","'\\''")}'`,bY=K.strictObject({type:K.literal("hello"),protocol:K.literal(a1),version:K.string(),platform:K.enum(["linux","darwin"]),architecture:K.enum(["arm64","x64"]),enrolled:K.boolean()}),wY=K.strictObject({type:K.literal("ticket-request"),request:K.strictObject({install_id:K.uuid(),code_challenge:K.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:K.enum(["persistent","ephemeral"]),roots:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),execution_mode:K.enum(["confined","host"]),permissions:K.strictObject({read:K.literal(!0),write:K.literal(!0),execute:K.literal(!0),discover_environment:K.literal(!0),expose_mcp:K.literal(!1)})})).length(1)})}),kJ=K.discriminatedUnion("type",[K.strictObject({type:K.literal("running"),deviceId:K.string().min(1).max(160),expiresAt:K.iso.datetime({offset:!0}),lifetime:K.enum(["persistent","ephemeral"]),supervision:K.literal("ssh-foreground")}),K.strictObject({type:K.literal("pong")}),K.strictObject({type:K.literal("stopped")})]),yY=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function d2($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&yY.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function hJ($){if(!O9($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
 a=${W9($.remoteCli)}
 [ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
 p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
@@ -96,11 +96,11 @@ elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
 else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
 h=\${h%% *}
 [ "$h" = ${W9($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${W9(J)}`}function kJ($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!O9($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,yJ($)]}function bY($){return kJ($,!1)}function hJ(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:H0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function wY($){let J;try{({stdout:J}=await CY(RY)("/usr/bin/ssh",["-G",...kJ($,!0)],{env:hJ(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
-`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function yY($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function kY($){await wY($);let J=PY("/usr/bin/ssh",bY($),{stdio:["pipe","pipe","pipe"],env:hJ()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let V=yY(Z);Z="",X({exitCode:Y??1,errorCode:V})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function hY($){let J=new Map,Z=!1;for(let V=0;V<$.length;V++){let N=$[V];if(N==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(N)||J.has(N))throw Error("worker_unknown_or_duplicate_flag");let B=$[++V];if(!B||B.startsWith("--"))throw Error("worker_missing_flag_value");J.set(N,B)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(V)=>{let N=J.get(V);if(!N)throw Error("worker_required_input_missing");return N},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!O9(X.sshConfig))throw Error("worker_ssh_invalid_target");yJ(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(i1(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function fY($,J,Z,Q,X){let{request:Y}=xY.parse(d2(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let V=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},N=(async()=>{V();let U=Z??_$(J),M=await(Q.enrollmentCredentials??j$)(J,U);if(V(),!M)throw Error("worker_session_login_required");if(!P0(M.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=Q.createTicketClient?.(M)??new A$(M,{credentialsPath:U}),H=F3(await G.createHeadlessDeviceEnrollmentTicket(Y));return V(),{type:"ticket",organizationId:M.orgId,receipt:H}})(),B;try{let U=await Promise.race([N,new Promise((M,G)=>{if(B=()=>G(Error("worker_ssh_cancelled")),X.aborted)B();else X.addEventListener("abort",B,{once:!0})})]);V(),await $.send(U)}finally{X.removeEventListener("abort",B)}}async function fJ($,J={}){let{config:Z,target:Q,credentialPath:X}=hY($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??c1,V=await(J.sshTransport??kY)(Q),N=new s1(V.output,V.input,Y),B=new AbortController,U=()=>B.abort(),M,G;if(V.result.then((H)=>{G=H}),process.once("SIGINT",U),process.once("SIGTERM",U),J.signal?.addEventListener("abort",U,{once:!0}),J.signal?.aborted)U();try{if(B.signal.aborted)throw Error("worker_ssh_cancelled");await N.send({type:"configure",protocol:a1,version:r,config:Z});let H=EY.parse(d2(await N.receive(30000,B.signal)));if(H.version!==r)throw Error("worker_ssh_version_mismatch");if(!H.enrolled)await fY(N,Z,X,J,AbortSignal.any([B.signal,N.signal]));M=Y.every(1e4,()=>{N.send({type:"ping"}).catch(U)});let q=!1,T=Y.now()+(H.enrolled?0:T3)+u2+5000;while(!0){let L=q?35000:Math.max(1,T-Y.now()),j=wJ.parse(d2(await N.receive(L,B.signal)));if(j.type==="running"){if(q||j.lifetime!==Z.lifetime||Date.parse(j.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");q=!0,(J.io??process).stdout.write(JSON.stringify(j)+`
-`)}if(j.type==="stopped"){if(!q)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(H){if(B.signal.aborted){M?.();try{await N.send({type:"stop"});let q=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<q)if(wJ.parse(d2(await N.receive(Math.max(1,q-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(H instanceof Error&&H.message==="worker_ssh_connection_closed"){let q=G??await Promise.race([V.result,new Promise((T)=>setTimeout(T,100))]);if(q?.exitCode)throw Error(q.errorCode)}throw H}finally{M?.(),process.removeListener("SIGINT",U),process.removeListener("SIGTERM",U),J.signal?.removeEventListener("abort",U),V.close(),N.dispose()}}import{createConnection as dY}from"net";import{WebSocket as p2}from"ws";var mY=1,K1=65536,mJ=4096,vJ=67108864,gJ=4194304,B1=K.uuid(),vY=K.strictObject({kind:K.literal("install_only"),authorityId:B1,organizationId:B1,userId:B1,connectionId:B1,attemptId:B1,purpose:K.literal("install"),generation:K.number().int().positive(),transport:K.literal("reverse_ssh"),expiresAt:K.iso.datetime({offset:!0}),maxDurationMs:K.literal(300000),maxChannels:K.literal(1),allowTcpForwarding:K.literal(!1),allowPty:K.literal(!1)}),gY=K.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!B1.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var uY=K.strictObject({protocol:K.literal(mY),type:K.literal("ssh_install_relay"),authorityToken:K.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:vY,relayUrl:gY,endpoint:K.strictObject({host:K.literal("127.0.0.1"),port:K.literal(22)})});function z9($,J=Date.now()){let Z=uY.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function uJ($){let J=JSON.stringify($);if(Buffer.byteLength(J)>K1)throw Error("ssh_install_relay_frame_too_large");return J}function dJ($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:z9(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var pJ="ssh_install_relay_closed";function pY($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function lY($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function cY($,J=pJ){try{$.close(1000,J)}catch{$.terminate()}}async function sY($){let J=$.now??(()=>Date.now()),Z=z9($.receipt,J()),X=($.createWebSocket??((_)=>new p2(_,{followRedirects:!1,perMessageDeflate:!1,maxPayload:K1})))(Z.relayUrl),Y=$.connectLocal??(()=>dY({host:"127.0.0.1",port:22})),V,N=!1,B=!1,U=0,M=0,G,H=(_)=>{if(G)clearTimeout(G);G=setTimeout(()=>L("ssh_install_relay_expired"),Math.max(1,_)),G.unref?.()},q,T=new Promise((_)=>{q=_}),L=(_=pJ)=>{if(B)return;if(B=!0,G)clearTimeout(G);if($.signal?.removeEventListener("abort",j),V?.destroy(),X.readyState===p2.OPEN)cY(X,_);else if(X.readyState!==p2.CLOSED)X.terminate();q()},j=()=>L("ssh_install_relay_aborted"),W=()=>L("ssh_install_relay_protocol_error"),O=(_)=>{return U+=1,M+=_,_<=K1&&U<=mJ&&M<=vJ},F=(_)=>{if(B||!N||X.readyState!==p2.OPEN||X.bufferedAmount>gJ||!O(_.length)){W();return}X.send(_,{binary:!0},(D)=>{if(D)W()})};X.on("open",()=>{if(B)return;try{let _=uJ({type:"ssh_install_relay_receipt",receipt:Z});X.send(_,{binary:!1},(D)=>{if(D)W()})}catch{W()}}),X.on("message",(_,D)=>{if(B)return;let R=pY(_);if(R>K1||!O(R))return W();if(!N){if(D)return W();try{let P=dJ(JSON.parse(String(_)));if(P.type!=="ssh_install_relay_ready"||P.authorityId!==Z.authority.authorityId)return W();N=!0,H(Z.authority.maxDurationMs),V=Y(),V.setNoDelay(!0),V.on("data",F),V.on("error",W),V.on("close",()=>L("ssh_install_relay_peer_closed")),V.on("drain",()=>X._socket?.resume()),V.on("connect",()=>{})}catch{W()}return}if(!D)return W();let E=lY(_);if(!E||!V||V.destroyed||!V.write(E))X._socket?.pause()}),X.on("error",W),X.on("close",()=>L("ssh_install_relay_peer_closed"));let z=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(H(z),$.signal?.addEventListener("abort",j,{once:!0}),$.signal?.aborted)j();return{receipt:Z,closed:T,close:()=>L()}}async function lJ($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>K1)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await sY({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as aY}from"crypto";var l$="ARA_WORKER_PREVIEW_PROBE";async function sJ(){if(typeof Bun>"u")return 1;let $=aY(32).toString("base64url"),J,Z=new Promise((V)=>{J=V}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(V,N){let B=new URL(V.url).pathname;if(V.method!=="GET")return new Response(null,{status:405});if(B==="/readiness")return new Response(l$);if((B==="/readiness-ws"||B===`/device/readiness/${$}`)&&N.upgrade(V,{data:{relay:B.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(V,N){if(typeof N!=="string"||N.length>8192){V.close();return}if(!V.data.relay){if(N===l$)V.send(l$);else V.close();return}try{let B=cJ(N),U=(M)=>V.send(JSON.stringify(M));if(B.type==="hello")U(B),U({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(B.type==="head"&&B.id==="http"&&B.status===200)U({type:"credit",id:"http"});else if(B.type==="data"&&B.id==="http"){if(V.data.http+=Buffer.from(B.data,"base64").toString(),V.data.http.length>l$.length)throw Error("probe_overflow");U({type:"credit",id:"http"})}else if(B.type==="end"&&B.id==="http"&&V.data.http===l$)U({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(B.type==="ws"&&B.id==="ws")U({type:"data",id:"ws",data:Buffer.from(l$).toString("base64"),binary:!1});else if(B.type==="data"&&B.id==="ws"&&!B.binary&&Buffer.from(B.data,"base64").toString()===l$&&!V.data.reported)V.data.reported=!0,process.stdout.write(`ready
+exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${W9(J)}`}function fJ($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!O9($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,hJ($)]}function kY($){return fJ($,!1)}function mJ(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:H0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function hY($){let J;try{({stdout:J}=await SY(CY)("/usr/bin/ssh",["-G",...fJ($,!0)],{env:mJ(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
+`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function fY($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function mY($){await hY($);let J=EY("/usr/bin/ssh",kY($),{stdio:["pipe","pipe","pipe"],env:mJ()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let V=fY(Z);Z="",X({exitCode:Y??1,errorCode:V})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function vY($){let J=new Map,Z=!1;for(let V=0;V<$.length;V++){let N=$[V];if(N==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(N)||J.has(N))throw Error("worker_unknown_or_duplicate_flag");let B=$[++V];if(!B||B.startsWith("--"))throw Error("worker_missing_flag_value");J.set(N,B)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(V)=>{let N=J.get(V);if(!N)throw Error("worker_required_input_missing");return N},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!O9(X.sshConfig))throw Error("worker_ssh_invalid_target");hJ(X),s(X.sshConfig);let Y=J0.parse(JSON.parse(s(Q("--config"))));if(i1(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function gY($,J,Z,Q,X){let{request:Y}=wY.parse(d2(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let V=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},N=(async()=>{V();let U=Z??_$(J),M=await(Q.enrollmentCredentials??j$)(J,U);if(V(),!M)throw Error("worker_session_login_required");if(!P0(M.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=Q.createTicketClient?.(M)??new A$(M,{credentialsPath:U}),H=F3(await G.createHeadlessDeviceEnrollmentTicket(Y));return V(),{type:"ticket",organizationId:M.orgId,receipt:H}})(),B;try{let U=await Promise.race([N,new Promise((M,G)=>{if(B=()=>G(Error("worker_ssh_cancelled")),X.aborted)B();else X.addEventListener("abort",B,{once:!0})})]);V(),await $.send(U)}finally{X.removeEventListener("abort",B)}}async function vJ($,J={}){let{config:Z,target:Q,credentialPath:X}=vY($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??c1,V=await(J.sshTransport??mY)(Q),N=new s1(V.output,V.input,Y),B=new AbortController,U=()=>B.abort(),M,G;if(V.result.then((H)=>{G=H}),process.once("SIGINT",U),process.once("SIGTERM",U),J.signal?.addEventListener("abort",U,{once:!0}),J.signal?.aborted)U();try{if(B.signal.aborted)throw Error("worker_ssh_cancelled");await N.send({type:"configure",protocol:a1,version:r,config:Z});let H=bY.parse(d2(await N.receive(30000,B.signal)));if(H.version!==r)throw Error("worker_ssh_version_mismatch");if(!H.enrolled)await gY(N,Z,X,J,AbortSignal.any([B.signal,N.signal]));M=Y.every(1e4,()=>{N.send({type:"ping"}).catch(U)});let q=!1,T=Y.now()+(H.enrolled?0:T3)+u2+5000;while(!0){let L=q?35000:Math.max(1,T-Y.now()),j=kJ.parse(d2(await N.receive(L,B.signal)));if(j.type==="running"){if(q||j.lifetime!==Z.lifetime||Date.parse(j.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");q=!0,(J.io??process).stdout.write(JSON.stringify(j)+`
+`)}if(j.type==="stopped"){if(!q)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(H){if(B.signal.aborted){M?.();try{await N.send({type:"stop"});let q=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<q)if(kJ.parse(d2(await N.receive(Math.max(1,q-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(H instanceof Error&&H.message==="worker_ssh_connection_closed"){let q=G??await Promise.race([V.result,new Promise((T)=>setTimeout(T,100))]);if(q?.exitCode)throw Error(q.errorCode)}throw H}finally{M?.(),process.removeListener("SIGINT",U),process.removeListener("SIGTERM",U),J.signal?.removeEventListener("abort",U),V.close(),N.dispose()}}import{createConnection as cY}from"net";import{WebSocket as p2}from"ws";var uY=1,K1=65536,gJ=4096,uJ=67108864,dJ=4194304,B1=K.uuid(),dY=K.strictObject({kind:K.literal("install_only"),authorityId:B1,organizationId:B1,userId:B1,connectionId:B1,attemptId:B1,purpose:K.literal("install"),generation:K.number().int().positive(),transport:K.literal("reverse_ssh"),expiresAt:K.iso.datetime({offset:!0}),maxDurationMs:K.literal(300000),maxChannels:K.literal(1),allowTcpForwarding:K.literal(!1),allowPty:K.literal(!1)}),pY=K.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!B1.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var lY=K.strictObject({protocol:K.literal(uY),type:K.literal("ssh_install_relay"),authorityToken:K.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:dY,relayUrl:pY,endpoint:K.strictObject({host:K.literal("127.0.0.1"),port:K.literal(22)})});function z9($,J=Date.now()){let Z=lY.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function pJ($){let J=JSON.stringify($);if(Buffer.byteLength(J)>K1)throw Error("ssh_install_relay_frame_too_large");return J}function lJ($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:z9(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var cJ="ssh_install_relay_closed";function sY($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function aY($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function iY($,J=cJ){try{$.close(1000,J)}catch{$.terminate()}}async function nY($){let J=$.now??(()=>Date.now()),Z=z9($.receipt,J()),X=($.createWebSocket??((_)=>new p2(_,{followRedirects:!1,perMessageDeflate:!1,maxPayload:K1})))(Z.relayUrl),Y=$.connectLocal??(()=>cY({host:"127.0.0.1",port:22})),V,N=!1,B=!1,U=0,M=0,G,H=(_)=>{if(G)clearTimeout(G);G=setTimeout(()=>L("ssh_install_relay_expired"),Math.max(1,_)),G.unref?.()},q,T=new Promise((_)=>{q=_}),L=(_=cJ)=>{if(B)return;if(B=!0,G)clearTimeout(G);if($.signal?.removeEventListener("abort",j),V?.destroy(),X.readyState===p2.OPEN)iY(X,_);else if(X.readyState!==p2.CLOSED)X.terminate();q()},j=()=>L("ssh_install_relay_aborted"),W=()=>L("ssh_install_relay_protocol_error"),O=(_)=>{return U+=1,M+=_,_<=K1&&U<=gJ&&M<=uJ},F=(_)=>{if(B||!N||X.readyState!==p2.OPEN||X.bufferedAmount>dJ||!O(_.length)){W();return}X.send(_,{binary:!0},(D)=>{if(D)W()})};X.on("open",()=>{if(B)return;try{let _=pJ({type:"ssh_install_relay_receipt",receipt:Z});X.send(_,{binary:!1},(D)=>{if(D)W()})}catch{W()}}),X.on("message",(_,D)=>{if(B)return;let R=sY(_);if(R>K1||!O(R))return W();if(!N){if(D)return W();try{let P=lJ(JSON.parse(String(_)));if(P.type!=="ssh_install_relay_ready"||P.authorityId!==Z.authority.authorityId)return W();N=!0,H(Z.authority.maxDurationMs),V=Y(),V.setNoDelay(!0),V.on("data",F),V.on("error",W),V.on("close",()=>L("ssh_install_relay_peer_closed")),V.on("drain",()=>X._socket?.resume()),V.on("connect",()=>{})}catch{W()}return}if(!D)return W();let E=aY(_);if(!E||!V||V.destroyed||!V.write(E))X._socket?.pause()}),X.on("error",W),X.on("close",()=>L("ssh_install_relay_peer_closed"));let z=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(H(z),$.signal?.addEventListener("abort",j,{once:!0}),$.signal?.aborted)j();return{receipt:Z,closed:T,close:()=>L()}}async function sJ($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>K1)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await nY({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as tY}from"crypto";var l$="ARA_WORKER_PREVIEW_PROBE";async function iJ(){if(typeof Bun>"u")return 1;let $=tY(32).toString("base64url"),J,Z=new Promise((V)=>{J=V}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(V,N){let B=new URL(V.url).pathname;if(V.method!=="GET")return new Response(null,{status:405});if(B==="/readiness")return new Response(l$);if((B==="/readiness-ws"||B===`/device/readiness/${$}`)&&N.upgrade(V,{data:{relay:B.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(V,N){if(typeof N!=="string"||N.length>8192){V.close();return}if(!V.data.relay){if(N===l$)V.send(l$);else V.close();return}try{let B=aJ(N),U=(M)=>V.send(JSON.stringify(M));if(B.type==="hello")U(B),U({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(B.type==="head"&&B.id==="http"&&B.status===200)U({type:"credit",id:"http"});else if(B.type==="data"&&B.id==="http"){if(V.data.http+=Buffer.from(B.data,"base64").toString(),V.data.http.length>l$.length)throw Error("probe_overflow");U({type:"credit",id:"http"})}else if(B.type==="end"&&B.id==="http"&&V.data.http===l$)U({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(B.type==="ws"&&B.id==="ws")U({type:"data",id:"ws",data:Buffer.from(l$).toString("base64"),binary:!1});else if(B.type==="data"&&B.id==="ws"&&!B.binary&&Buffer.from(B.data,"base64").toString()===l$&&!V.data.reported)V.data.reported=!0,process.stdout.write(`ready
 `);else throw Error("probe_protocol_failed")}catch{V.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
-`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as tY,createReadStream as rY,fstatSync as oY,readFileSync as eY}from"fs";var aJ="/run/sc/instance-generation";var iY=/^[1-9][0-9]{0,15}\n?$/;function nY($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function iJ($){if(typeof $!=="string"||!iY.test($))return null;let J=Number($.trim());return nY(J)?J:null}var nJ=3,$V=600000,JV=65536,ZV=500;function tJ($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(nJ))throw Error("worker_standby_invalid_invocation");return{handoffFd:nJ}}function QV($=(J)=>eY(J,"utf8")){try{return iJ($(aJ))}catch{return null}}function XV($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=M3.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var rJ={isPipe:($)=>oY($).isFIFO(),stream:($)=>{let J=rY("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function YV($,J=rJ){if(!J.isPipe($.fd)){try{tY($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??$V),Q=J.stream($.fd),X=null,Y=()=>{},V=new Promise((B,U)=>{Y=(M)=>{X??=M,U(M)}});V.catch(()=>{});let N=J.every(ZV,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let B=(async()=>{let M=[],G=0;for await(let H of Q.chunks){if(X)throw X;if(G===0)$.onArriving?.();if(G+=H.length,G>JV)throw Error("worker_standby_handoff_too_large");M.push(H)}return Buffer.concat(M).toString("utf8")})(),U=await Promise.race([B,V]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return U}finally{N(),Q.close()}}async function oJ($,J=rJ){let Z=$.readGeneration??(()=>QV()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await YV({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return XV(Y)}var VV=`Usage: reason worker <command> --config PATH [--json]
+`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as eY,createReadStream as $V,fstatSync as JV,readFileSync as ZV}from"fs";var nJ="/run/sc/instance-generation";var rY=/^[1-9][0-9]{0,15}\n?$/;function oY($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function tJ($){if(typeof $!=="string"||!rY.test($))return null;let J=Number($.trim());return oY(J)?J:null}var rJ=3,QV=600000,XV=65536,YV=500;function oJ($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(rJ))throw Error("worker_standby_invalid_invocation");return{handoffFd:rJ}}function VV($=(J)=>ZV(J,"utf8")){try{return tJ($(nJ))}catch{return null}}function GV($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=M3.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var eJ={isPipe:($)=>JV($).isFIFO(),stream:($)=>{let J=$V("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function BV($,J=eJ){if(!J.isPipe($.fd)){try{eY($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??QV),Q=J.stream($.fd),X=null,Y=()=>{},V=new Promise((B,U)=>{Y=(M)=>{X??=M,U(M)}});V.catch(()=>{});let N=J.every(YV,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let B=(async()=>{let M=[],G=0;for await(let H of Q.chunks){if(X)throw X;if(G===0)$.onArriving?.();if(G+=H.length,G>XV)throw Error("worker_standby_handoff_too_large");M.push(H)}return Buffer.concat(M).toString("utf8")})(),U=await Promise.race([B,V]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return U}finally{N(),Q.close()}}async function $6($,J=eJ){let Z=$.readGeneration??(()=>VV()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await BV({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return GV(Y)}var KV=`Usage: reason worker <command> --config PATH [--json]
 
   enroll                        Obtain/redeem a ticket using the current Reason login
   start                         Run the existing Device daemon in the foreground
@@ -141,15 +141,15 @@ Pretrust known_hosts. No agent forwarding, automatic installation or detached se
 SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
 are not forwarded/supported; running is not a browser-readiness receipt.
 Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function GV($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,V=!1;for(let N=0;N<Z.length;N++){let B=Z[N];if(B==="--json"&&!V){V=!0;continue}if(B!=="--config"&&B!=="--enrollment-file"&&B!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let U=Z[++N];if(!U||U.startsWith("--"))throw Error("worker_missing_flag_value");if(B==="--config"&&!Q)Q=U;else if(B==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=U;else if(B==="--credential-file"&&!Y&&J==="enroll")Y=U;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:V}}var BV=1e4,KV=2000,eJ=15000,NV=50;async function Z6($,J,Z,Q,X,Y){let V=new l1,N=new AbortController,B,U,M=new Promise((E,P)=>{B=E,U=P});if(M.catch(()=>{}),v0(),$.executionMode==="host")d1();Z("enrollment_started");let G=X(V);G.catch(()=>{});let H=null,q=j2($,J,(E)=>{if(!H)throw Error("worker_starting");return H(E)});q.catch(()=>{}),Z("readiness_started");let T=new AbortController,L,j=AbortSignal.any([N.signal,T.signal,...Q.signal?[Q.signal]:[]]),W=Y?.matches($)?Y.result:void 0;if(Y&&!W)await Y.stop();if(W)j.addEventListener("abort",()=>void Y.stop(),{once:!0});let O,F=new Promise((E)=>{O=E}),z=setTimeout(()=>O(),BV);j.addEventListener("abort",()=>O(),{once:!0});let _,D=(E)=>{if(E==="ready")_=setTimeout(()=>O(),KV);Q.onStartup?.(E)},R=b1($,Q.readinessProbes,j,M,void 0,W,F);R.final.catch(()=>{});try{let E;try{E=await G}catch(P){throw N.abort(),U(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await q.then((I)=>I(),()=>{}),P}Z("enrollment_completed"),L=setTimeout(()=>T.abort(),Math.max(1,Math.min(eJ,Date.parse(E.worker?.expiresAt??"")-Date.now()||eJ))),B(E.roots[0].permissions),R0($,{version:1,drained:!1,revoked:!1}),await p1($,E,V,J,{...Q,onStartup:D,prestartedReadiness:R,prestartedControl:{closed:q,handle:(P)=>{H=P}},deferOptionalLanes:!0})}finally{clearTimeout(L),clearTimeout(z),clearTimeout(_),N.abort(),V.deleteBinding(),V.deleteKey(),await q.then((E)=>E(),()=>{})}}async function UV($,J,Z,Q){let{handoffFd:X}=tJ($);if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,V,N=()=>{let q=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>S1(T);if(B||!q)return;try{v0(),d1()}catch{return}if(Y=y8(q),!Z.readinessProbes)setImmediate(()=>{if(B)return;try{E2()}catch{}})},B=!1,U=()=>{B=!0,clearTimeout(V),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",U),process.once("SIGINT",U);let M;try{M=await(J.receiveStandbyHandoff??oJ)({fd:X,onBooted:()=>{Q("standby_booted"),V=setTimeout(N,NV)},onArriving:()=>clearTimeout(V)})}catch(q){clearTimeout(V);let T=q instanceof Error&&/^worker_standby_[a-z_]+$/.test(q.message)?q.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
-`),await Y?.stop(),(J.exitProcess??((L)=>process.exit(L)))(1),1}finally{clearTimeout(V),process.off("SIGTERM",U),process.off("SIGINT",U)}if(B)return 0;Q("handoff_received");let{config:G,enrollment:H}=M;try{e(g(G),!0);let q=await Q6(G,()=>{});try{if(Q("lock_acquired"),o(G))throw Error("worker_ephemeral_requires_fresh_enrollment");return K$(G),await Z6(G,q.owner.nonce,Q,Z,(T)=>o0(G,H,T,J.enroll),Y),0}finally{q.release()}}finally{await Y?.stop()}}async function q$($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,V=(B)=>{Y.set(B,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:B,pid:process.pid,timestamp:new Date().toISOString()})+`
-`),J.onStartup?.(B)},N={...J,onStartup:V,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let B=(q)=>Math.min(n$,Math.max(0,Math.round(q))),U=Y.get("readiness_started"),M=Y.get("readiness_completed"),G=Y.get("handoff_received")??0,H=Object.fromEntries(J6.flatMap((q)=>{let T=Y.get(q);return T===void 0?[]:[[q,B(T-G)]]}));return{service_start_to_heartbeat_ms:B(performance.now()-G),stage_ms:H,...U!==void 0&&M!==void 0?{readiness_ms:B(M-U)}:{}}},onEvent:(B)=>{if(B.type==="error"&&B.diagnostic){Q=!0;let U=B.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:U.stage,category:U.category,httpStatus:U.category==="http"?U.httpStatus:void 0})+`
-`)}J.onEvent?.(B)}};try{if($[0]==="__preview-probe"){if($.length!==1||N1(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await sJ()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await fJ($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await lJ();return await bJ(J)}if($[0]==="__update-restart"){let q=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!q)throw Error("worker_unknown_or_duplicate_flag");if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),L=await D2(T,q?void 0:r);return Z.stdout.write(JSON.stringify(L)+`
-`),L.state==="current"?3:L.state==="busy"?75:0}if($[0]==="standby")return await UV($,J,N,V);let B=GV($);if(!B)return Z.stdout.write(VV),0;if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let U=J0.parse(JSON.parse(s(B.configPath))),M=(q)=>Z.stdout.write(JSON.stringify(q)+`
-`),G=o(U);if(B.action==="status"||B.action==="doctor"){let q=await K0(U,"status"),T=$0(U),L={enrolled:!!G||!!q,deviceId:G?.deviceId??q?.deviceId??null,lifetime:U.lifetime,expired:G||q?Date.parse(G?.worker?.expiresAt??q.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:q};if(B.action==="status")return M(L),0;let j=!0;try{K$(U)}catch{j=!1}return M({...L,workspace:j,platform:process.platform,executionMode:U.executionMode,proofStorage:U.lifetime==="ephemeral"?"process-memory":G&&T0(U)instanceof i$?"login-keychain":"owner-only-file",confinement:U.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:q?.supportedOperations?"live-worker":"unavailable",reportedOperations:q?.supportedOperations??null,capabilityReadiness:q?.capabilityReadiness??null,ready:q?.executionEligible===!0&&!L.expired}),j&&(G||q)&&!L.revoked&&!L.expired?0:1}if(["drain","resume","stop"].includes(B.action)){let q=B.action==="drain"?"drain":B.action==="resume"?"resume":"stop",T=await K0(U,q);if(T){if(M(T),q==="stop"&&U.lifetime==="ephemeral"&&!B.json)Z.stderr.write(qV);return 0}}e(g(U),!0);let H=await Q6(U,()=>{if(!B.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(B.action==="start")V("lock_acquired");let q=o(U);if(["drain","resume","stop"].includes(B.action)){if(!q)throw Error("worker_not_enrolled");let T=$0(U);if(T.revoked||Date.parse(q.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(B.action!=="stop")R0(U,{...T,drained:B.action==="drain"});return M({running:!1,drained:B.action==="stop"?T.drained:B.action==="drain"}),0}if(B.action==="enroll"){if(U.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=B.enrollmentPath,L=!T&&$0(U).revoked;if(q&&!L)throw Error("worker_already_enrolled");K$(U);let j=()=>{w0(U),Y4(U)};if(L)j();let W=async()=>{let z=Q2(U),_=T?await L3(U,T,z,J.enroll):await $6(U,B.credentialPath,J,z);return{proof:z,enrolled:_}},{proof:O,enrolled:F}=await W().catch((z)=>{if(T||!(z instanceof r0)||!z.deviceRemoved)throw z;return j(),W()});return k0(F,d(U).state,{proofStore:O}),R0(U,{version:1,drained:!1,revoked:!1}),M({enrolled:!0,deviceId:F.deviceId,lifetime:U.lifetime}),0}if(B.action==="revoke"){if(!q)throw Error("worker_not_enrolled");let T=T0(U),L=new g1(W$(U.apiOrigin),S0(U.proxy),T);if(R0(U,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(q,L);else await L.disconnect(q,AbortSignal.timeout(30000));return w0(U),M({revoked:!0,localKeyRemoved:!0}),0}if(K$(U),U.lifetime==="ephemeral"){if(q)throw Error("worker_ephemeral_requires_fresh_enrollment");await Z6(U,H.owner.nonce,V,N,async(T)=>B.enrollmentPath?L3(U,B.enrollmentPath,T,J.enroll):$6(U,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(B.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!q)throw Error("worker_not_enrolled");if($0(U).revoked)X=!0;await p1(U,q,T0(U),H.owner.nonce,N)}return 0}finally{H.release()}}catch(B){let U=B instanceof Error&&(B.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(B.message))?B.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${U}.
+`;function NV($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,V=!1;for(let N=0;N<Z.length;N++){let B=Z[N];if(B==="--json"&&!V){V=!0;continue}if(B!=="--config"&&B!=="--enrollment-file"&&B!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let U=Z[++N];if(!U||U.startsWith("--"))throw Error("worker_missing_flag_value");if(B==="--config"&&!Q)Q=U;else if(B==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=U;else if(B==="--credential-file"&&!Y&&J==="enroll")Y=U;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:V}}var UV=1e4,HV=2000,J6=15000,qV=50;async function X6($,J,Z,Q,X,Y){let V=new l1,N=new AbortController,B,U,M=new Promise((E,P)=>{B=E,U=P});if(M.catch(()=>{}),v0(),$.executionMode==="host")d1();Z("enrollment_started");let G=X(V);G.catch(()=>{});let H=null,q=j2($,J,(E)=>{if(!H)throw Error("worker_starting");return H(E)});q.catch(()=>{}),Z("readiness_started");let T=new AbortController,L,j=AbortSignal.any([N.signal,T.signal,...Q.signal?[Q.signal]:[]]),W=Y?.matches($)?Y.result:void 0;if(Y&&!W)await Y.stop();if(W)j.addEventListener("abort",()=>void Y.stop(),{once:!0});let O,F=new Promise((E)=>{O=E}),z=setTimeout(()=>O(),UV);j.addEventListener("abort",()=>O(),{once:!0});let _,D=(E)=>{if(E==="ready")_=setTimeout(()=>O(),HV);Q.onStartup?.(E)},R=b1($,Q.readinessProbes,j,M,void 0,W,F);R.final.catch(()=>{});try{let E;try{E=await G}catch(P){throw N.abort(),U(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await q.then((I)=>I(),()=>{}),P}Z("enrollment_completed"),L=setTimeout(()=>T.abort(),Math.max(1,Math.min(J6,Date.parse(E.worker?.expiresAt??"")-Date.now()||J6))),B(E.roots[0].permissions),R0($,{version:1,drained:!1,revoked:!1}),await p1($,E,V,J,{...Q,onStartup:D,prestartedReadiness:R,prestartedControl:{closed:q,handle:(P)=>{H=P}},deferOptionalLanes:!0})}finally{clearTimeout(L),clearTimeout(z),clearTimeout(_),N.abort(),V.deleteBinding(),V.deleteKey(),await q.then((E)=>E(),()=>{})}}async function MV($,J,Z,Q){let{handoffFd:X}=oJ($);if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,V,N=()=>{let q=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>S1(T);if(B||!q)return;try{v0(),d1()}catch{return}if(Y=y8(q),!Z.readinessProbes)setImmediate(()=>{if(B)return;try{E2()}catch{}})},B=!1,U=()=>{B=!0,clearTimeout(V),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",U),process.once("SIGINT",U);let M;try{M=await(J.receiveStandbyHandoff??$6)({fd:X,onBooted:()=>{Q("standby_booted"),V=setTimeout(N,qV)},onArriving:()=>clearTimeout(V)})}catch(q){clearTimeout(V);let T=q instanceof Error&&/^worker_standby_[a-z_]+$/.test(q.message)?q.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
+`),await Y?.stop(),(J.exitProcess??((L)=>process.exit(L)))(1),1}finally{clearTimeout(V),process.off("SIGTERM",U),process.off("SIGINT",U)}if(B)return 0;Q("handoff_received");let{config:G,enrollment:H}=M;try{e(g(G),!0);let q=await Y6(G,()=>{});try{if(Q("lock_acquired"),o(G))throw Error("worker_ephemeral_requires_fresh_enrollment");return K$(G),await X6(G,q.owner.nonce,Q,Z,(T)=>o0(G,H,T,J.enroll),Y),0}finally{q.release()}}finally{await Y?.stop()}}async function q$($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,V=(B)=>{Y.set(B,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:B,pid:process.pid,timestamp:new Date().toISOString()})+`
+`),J.onStartup?.(B)},N={...J,onStartup:V,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let B=(q)=>Math.min(n$,Math.max(0,Math.round(q))),U=Y.get("readiness_started"),M=Y.get("readiness_completed"),G=Y.get("handoff_received")??0,H=Object.fromEntries(Q6.flatMap((q)=>{let T=Y.get(q);return T===void 0?[]:[[q,B(T-G)]]}));return{service_start_to_heartbeat_ms:B(performance.now()-G),stage_ms:H,...U!==void 0&&M!==void 0?{readiness_ms:B(M-U)}:{}}},onEvent:(B)=>{if(B.type==="error"&&B.diagnostic){Q=!0;let U=B.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:U.stage,category:U.category,httpStatus:U.category==="http"?U.httpStatus:void 0})+`
+`)}J.onEvent?.(B)}};try{if($[0]==="__preview-probe"){if($.length!==1||N1(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await iJ()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await vJ($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await sJ();return await yJ(J)}if($[0]==="__update-restart"){let q=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!q)throw Error("worker_unknown_or_duplicate_flag");if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(s($[2]))),L=await D2(T,q?void 0:r);return Z.stdout.write(JSON.stringify(L)+`
+`),L.state==="current"?3:L.state==="busy"?75:0}if($[0]==="standby")return await MV($,J,N,V);let B=NV($);if(!B)return Z.stdout.write(KV),0;if(N1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux"].includes(process.platform))throw Error("worker_platform_unsupported");let U=J0.parse(JSON.parse(s(B.configPath))),M=(q)=>Z.stdout.write(JSON.stringify(q)+`
+`),G=o(U);if(B.action==="status"||B.action==="doctor"){let q=await K0(U,"status"),T=$0(U),L={enrolled:!!G||!!q,deviceId:G?.deviceId??q?.deviceId??null,lifetime:U.lifetime,expired:G||q?Date.parse(G?.worker?.expiresAt??q.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:q};if(B.action==="status")return M(L),0;let j=!0;try{K$(U)}catch{j=!1}return M({...L,workspace:j,platform:process.platform,executionMode:U.executionMode,proofStorage:U.lifetime==="ephemeral"?"process-memory":G&&T0(U)instanceof i$?"login-keychain":"owner-only-file",confinement:U.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:q?.supportedOperations?"live-worker":"unavailable",reportedOperations:q?.supportedOperations??null,capabilityReadiness:q?.capabilityReadiness??null,ready:q?.executionEligible===!0&&!L.expired}),j&&(G||q)&&!L.revoked&&!L.expired?0:1}if(["drain","resume","stop"].includes(B.action)){let q=B.action==="drain"?"drain":B.action==="resume"?"resume":"stop",T=await K0(U,q);if(T){if(M(T),q==="stop"&&U.lifetime==="ephemeral"&&!B.json)Z.stderr.write(LV);return 0}}e(g(U),!0);let H=await Y6(U,()=>{if(!B.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
+`)});try{if(B.action==="start")V("lock_acquired");let q=o(U);if(["drain","resume","stop"].includes(B.action)){if(!q)throw Error("worker_not_enrolled");let T=$0(U);if(T.revoked||Date.parse(q.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(B.action!=="stop")R0(U,{...T,drained:B.action==="drain"});return M({running:!1,drained:B.action==="stop"?T.drained:B.action==="drain"}),0}if(B.action==="enroll"){if(U.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=B.enrollmentPath,L=!T&&$0(U).revoked;if(q&&!L)throw Error("worker_already_enrolled");K$(U);let j=()=>{w0(U),Y4(U)};if(L)j();let W=async()=>{let z=Q2(U),_=T?await L3(U,T,z,J.enroll):await Z6(U,B.credentialPath,J,z);return{proof:z,enrolled:_}},{proof:O,enrolled:F}=await W().catch((z)=>{if(T||!(z instanceof r0)||!z.deviceRemoved)throw z;return j(),W()});return k0(F,d(U).state,{proofStore:O}),R0(U,{version:1,drained:!1,revoked:!1}),M({enrolled:!0,deviceId:F.deviceId,lifetime:U.lifetime}),0}if(B.action==="revoke"){if(!q)throw Error("worker_not_enrolled");let T=T0(U),L=new g1(W$(U.apiOrigin),S0(U.proxy),T);if(R0(U,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(q,L);else await L.disconnect(q,AbortSignal.timeout(30000));return w0(U),M({revoked:!0,localKeyRemoved:!0}),0}if(K$(U),U.lifetime==="ephemeral"){if(q)throw Error("worker_ephemeral_requires_fresh_enrollment");await X6(U,H.owner.nonce,V,N,async(T)=>B.enrollmentPath?L3(U,B.enrollmentPath,T,J.enroll):Z6(U,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(B.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!q)throw Error("worker_not_enrolled");if($0(U).revoked)X=!0;await p1(U,q,T0(U),H.owner.nonce,N)}return 0}finally{H.release()}}catch(B){let U=B instanceof Error&&(B.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(B.message))?B.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${U}.
 `);let M=$.includes("--json")?void 0:e$(B instanceof r0&&B.deviceRemoved?"worker_enrollment_device_removed":U);if(M)Z.stderr.write(`${M}
-`);return U==="worker_revoked"&&X?0:1}}var HV=60000;async function Q6($,J){let Z=Date.now()+$.shutdownGraceMs+HV,Q=!1;for(;;){let X=e0({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await K0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((N)=>setTimeout(N,250))}}var qV='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function $6($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let B=performance.now();return o0($,await Z.enrollmentInput($),Q,Z.enroll,B)}let Y=J??_$($),V=await(Z.enrollmentCredentials??j$)($,Y);if(!V)throw Error(X);let N=Z.createTicketClient?.(V)??new A$(V,{credentialsPath:Y,fetchImpl:S0($.proxy)});return X4($,V,N,Q,Z.enroll)}import{spawn as MV}from"child_process";import{existsSync as TV,readFileSync as LV,unlinkSync as FV}from"fs";import{join as _V}from"path";var jV=120,DV=15,WV=5000;function l2($={}){let J=$.stateDirectory?_V($.stateDirectory,OV):null;if(J)zV(J);let Z=["/bin/bash","/usr/bin/bash"].find((G)=>TV(G));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??jV)),X=$.pid??process.pid,Y=Math.min(DV,Q),V=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${X6(r)} > ${X6(J)} 2>/dev/null
+`);return U==="worker_revoked"&&X?0:1}}var TV=60000;async function Y6($,J){let Z=Date.now()+$.shutdownGraceMs+TV,Q=!1;for(;;){let X=e0({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await K0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((N)=>setTimeout(N,250))}}var LV='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function Z6($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let B=performance.now();return o0($,await Z.enrollmentInput($),Q,Z.enroll,B)}let Y=J??_$($),V=await(Z.enrollmentCredentials??j$)($,Y);if(!V)throw Error(X);let N=Z.createTicketClient?.(V)??new A$(V,{credentialsPath:Y,fetchImpl:S0($.proxy)});return X4($,V,N,Q,Z.enroll)}import{spawn as FV}from"child_process";import{existsSync as _V,readFileSync as jV,unlinkSync as DV}from"fs";import{join as WV}from"path";var OV=120,zV=15,AV=5000;function l2($={}){let J=$.stateDirectory?WV($.stateDirectory,RV):null;if(J)PV(J);let Z=["/bin/bash","/usr/bin/bash"].find((G)=>_V(G));if(!Z)return null;let Q=Math.max(1,Math.floor($.limitSeconds??OV)),X=$.pid??process.pid,Y=Math.min(zV,Q),V=J?`printf '%s %s %s\\n' "$(date +%s)" ${Q+Y} ${V6(r)} > ${V6(J)} 2>/dev/null
 `:"",N=(G)=>`[ $((SECONDS - started)) -ge ${Math.max(1,G-1)} ]`,B=`parent_is_worker() { [ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${X}" ]; }
 while :; do started=$SECONDS
 IFS= read -r -t ${Q} pulse && continue
@@ -161,8 +161,8 @@ if ${N(Y)} && parent_is_worker; then
   ${V}kill -KILL ${X}
 fi
 exit 0
-done`,U=MV(Z,["-c",B],{stdio:["pipe","ignore","inherit"]});U.on("error",()=>{}),U.stdin.on("error",()=>{});let M=setInterval(()=>U.stdin.write(`
-`),Math.min(WV,Q*1000/4));return M.unref(),U.unref(),{stop(){clearInterval(M),U.stdin.end()}}}var OV="worker-stalled";function X6($){return`'${$.replaceAll("'","'\\''")}'`}function zV($){let J;try{J=LV($,"utf8"),FV($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{u1(g2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var EV=`Share this computer as a machine
+done`,U=FV(Z,["-c",B],{stdio:["pipe","ignore","inherit"]});U.on("error",()=>{}),U.stdin.on("error",()=>{});let M=setInterval(()=>U.stdin.write(`
+`),Math.min(AV,Q*1000/4));return M.unref(),U.unref(),{stop(){clearInterval(M),U.stdin.end()}}}var RV="worker-stalled";function V6($){return`'${$.replaceAll("'","'\\''")}'`}function PV($){let J;try{J=jV($,"utf8"),DV($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{u1(g2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var bV=`Share this computer as a machine
 
 Usage:
   reason serve                     This computer, signed in (machine name: its hostname)
@@ -205,20 +205,20 @@ the worker unless --sandbox is set. Settings live in
 ~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
 folder served for NAME is its own worker. Use
 \`reason worker status|revoke --config <that file>\` for advanced control.
-`,xV=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,SV=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,N6="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",Y6=["REASON_TOKEN","REASON_MACHINE_TOKEN"],U6="my-computer";function P9($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&R1(J)&&J!==T2?J:U6}class Q0 extends Error{}function bV($,J){let Z,Q=new Map,X=new Set;for(let U=0;U<$.length;U+=1){let M=$[U];if(M==="--help"||M==="-h"||M==="help")return null;if(M==="--dir"||M==="--token"||M==="--org"){let G=$[U+1];if(!G||G.startsWith("-"))throw new Q0(`Missing value after ${M}.`);if(Q.has(M))throw new Q0(`${M} may be specified only once.`);Q.set(M,G),U+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(M)){X.add(M==="-y"?"--yes":M);continue}if(M.startsWith("-"))throw new Q0(`Unknown option: ${M}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=M}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!R1(Z)&&!xV.test(Z))throw new Q0(N6);if(Z.toLowerCase()===T2)throw new Q0(`"${T2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((U)=>U!=="--stop"&&U!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let V=Y?void 0:Q.get("--token")??J,N=Q.get("--org");if(V!==void 0){if(!V.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(N!==void 0&&!SV.test(N))throw new Q0("--org must be a workspace id.")}else if(N!==void 0)throw new Q0("--org is only used with --token.");let B=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...B===void 0?{}:{dir:B},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...V===void 0?{}:{token:V},...N===void 0?{}:{org:N.toLowerCase()}}}function i2($,J){let Z=CV($,J??"."),Q;try{Q=K6(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!PV(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var c2=($)=>c$($,".reason","workers"),A9=($)=>u(d($).state);function wV($,J,Z){let Q=c$(c2($),J);if(A0(c$(Q,"worker.json"))?.workspaceRoot===Z)return Q;return c$(c2($),`${J}@${AV("sha256").update(Z).digest("hex").slice(0,8)}`)}function H6($){let{stateDirectory:J}=$;if(i1($.workspaceRoot,J)||i1(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function A0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function R9($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function yV($,J){$.stdout.write(`${J} [y/N] `);let Z=await V6($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function n2($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var kV={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function q6($){try{return await $()}catch(J){let Z=J instanceof m0?kV[J.code]:void 0;throw Z?Error(Z):J}}async function hV($,J,Z,Q){let X=H6({...J,name:$.name??U6,stateDirectory:c$(c2(Z),".token-enrollment")}),Y=D$(X,{stored:!1}),V=await q6(()=>G6({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!R1(V.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==V.machine_name.toLowerCase())throw new Q0(`This token is for machine "${V.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==V.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${V.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let N=!1;return{name:$.name??V.machine_name,input:(B)=>{if(N)throw Error("worker_ticket_receipt_mismatch");return N=!0,Y.saveInstall(B),Y.complete(V.organization_id,V)}}}function fV($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??j$)(X);if(!Y)throw Error("worker_session_login_required");let V=(Z.createApi??((N)=>new A$(N)))(Y);return Q4(X,Y,{createHeadlessDeviceEnrollmentTicket:(N)=>q6(async()=>{try{return await V.createMachineEnrollmentTicket($,N)}catch(B){if(!(B instanceof m0)||B.code!=="machine_not_found")throw B}try{await V.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
-`)}catch(B){if(!(B instanceof m0)||B.status!==409)throw B}return V.createMachineEnrollmentTicket($,N)})})}}async function M6($,J,Z,Q){let X=await D2($,Q,()=>B6($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!M$($,J,Z))return null;return P3($),X}function I9($,J){let Z=c2($);if(!u(Z))return[];let Q=J.toLowerCase();return RV(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let V=c$(Z,X,"worker.json"),N=A0(V);return N?[{path:V,config:N}]:[]})}async function mV($,J,Z,Q,X){let Y=I9(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let V=Q.controlWorker??K0,N=[];for(let B of Y){let U=await V(B.config,"stop")!==null,M=a2(B.config,X),G=U||M!==null;if(N.push({config:B.path,folder:B.config.workspaceRoot,running:G,service:M?.label??null}),!$.json&&M)Z.stdout.write(`Removed background service ${M.label} (${B.config.workspaceRoot}); it won't start again.
+`,wV=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,yV=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,H6="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",G6=["REASON_TOKEN","REASON_MACHINE_TOKEN"],q6="my-computer";function P9($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&R1(J)&&J!==T2?J:q6}class Q0 extends Error{}function kV($,J){let Z,Q=new Map,X=new Set;for(let U=0;U<$.length;U+=1){let M=$[U];if(M==="--help"||M==="-h"||M==="help")return null;if(M==="--dir"||M==="--token"||M==="--org"){let G=$[U+1];if(!G||G.startsWith("-"))throw new Q0(`Missing value after ${M}.`);if(Q.has(M))throw new Q0(`${M} may be specified only once.`);Q.set(M,G),U+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(M)){X.add(M==="-y"?"--yes":M);continue}if(M.startsWith("-"))throw new Q0(`Unknown option: ${M}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Q0("Expected one machine NAME.");Z=M}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Q0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!R1(Z)&&!wV.test(Z))throw new Q0(H6);if(Z.toLowerCase()===T2)throw new Q0(`"${T2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((U)=>U!=="--stop"&&U!=="--json")))throw new Q0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Q0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Q0("--service keeps the worker running; it cannot be combined with --once.");let V=Y?void 0:Q.get("--token")??J,N=Q.get("--org");if(V!==void 0){if(!V.startsWith("rmt_"))throw new Q0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(N!==void 0&&!yV.test(N))throw new Q0("--org must be a workspace id.")}else if(N!==void 0)throw new Q0("--org is only used with --token.");let B=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...B===void 0?{}:{dir:B},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...V===void 0?{}:{token:V},...N===void 0?{}:{org:N.toLowerCase()}}}function i2($,J){let Z=SV($,J??"."),Q;try{Q=U6(Z)}catch{throw new Q0(`Folder not found: ${Z}`)}if(!EV(Q).isDirectory())throw new Q0(`Not a folder: ${Q}`);return Q}var c2=($)=>c$($,".reason","workers"),A9=($)=>u(d($).state);function hV($,J,Z){let Q=c$(c2($),J);if(A0(c$(Q,"worker.json"))?.workspaceRoot===Z)return Q;return c$(c2($),`${J}@${IV("sha256").update(Z).digest("hex").slice(0,8)}`)}function M6($){let{stateDirectory:J}=$;if(i1($.workspaceRoot,J)||i1(J,$.workspaceRoot))throw new Q0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function A0($){if(!u($))return null;let J=new Q0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function R9($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function fV($,J){$.stdout.write(`${J} [y/N] `);let Z=await B6($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function n2($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var mV={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function T6($){try{return await $()}catch(J){let Z=J instanceof m0?mV[J.code]:void 0;throw Z?Error(Z):J}}async function vV($,J,Z,Q){let X=M6({...J,name:$.name??q6,stateDirectory:c$(c2(Z),".token-enrollment")}),Y=D$(X,{stored:!1}),V=await T6(()=>K6({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!R1(V.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==V.machine_name.toLowerCase())throw new Q0(`This token is for machine "${V.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==V.organization_id.toLowerCase())throw new Q0(`This token is for workspace ${V.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let N=!1;return{name:$.name??V.machine_name,input:(B)=>{if(N)throw Error("worker_ticket_receipt_mismatch");return N=!0,Y.saveInstall(B),Y.complete(V.organization_id,V)}}}function gV($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??j$)(X);if(!Y)throw Error("worker_session_login_required");let V=(Z.createApi??((N)=>new A$(N)))(Y);return Q4(X,Y,{createHeadlessDeviceEnrollmentTicket:(N)=>T6(async()=>{try{return await V.createMachineEnrollmentTicket($,N)}catch(B){if(!(B instanceof m0)||B.code!=="machine_not_found")throw B}try{await V.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
+`)}catch(B){if(!(B instanceof m0)||B.status!==409)throw B}return V.createMachineEnrollmentTicket($,N)})})}}async function L6($,J,Z,Q){let X=await D2($,Q,()=>N6($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!M$($,J,Z))return null;return P3($),X}function I9($,J){let Z=c2($);if(!u(Z))return[];let Q=J.toLowerCase();return CV(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let V=c$(Z,X,"worker.json"),N=A0(V);return N?[{path:V,config:N}]:[]})}async function uV($,J,Z,Q,X){let Y=I9(J,$.name);if(Y.length===0)throw new Q0(`No worker for machine "${$.name}" on this computer.`);let V=Q.controlWorker??K0,N=[];for(let B of Y){let U=await V(B.config,"stop")!==null,M=a2(B.config,X),G=U||M!==null;if(N.push({config:B.path,folder:B.config.workspaceRoot,running:G,service:M?.label??null}),!$.json&&M)Z.stdout.write(`Removed background service ${M.label} (${B.config.workspaceRoot}); it won't start again.
 `);if(!$.json)Z.stdout.write(G?`Stopping machine "${$.name}" in ${B.config.workspaceRoot}; current work finishes first.
 `:`Machine "${$.name}" in ${B.config.workspaceRoot} is not running.
 `)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:N})}
-`);return 0}async function T6($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??q$,X=J.env??process.env,Y=Y6.map((V)=>X[V]?.trim()).find(Boolean)||void 0;if(!J.env)for(let V of Y6)delete process.env[V];try{let V=bV($,Y);if(!V)return Z.stdout.write(EV),0;let N=K6(J.home??H0()),B=J.serviceHost??Q$(N);if(V.stop)return await mV({...V,name:V.name},N,Z,J,B);let U=J.channel??Z$(),M=i2(J.cwd??process.cwd(),V.dir),G=V.service?U1(B,X):void 0,H={channel:U,apiOrigin:n1(X,U),workspaceRoot:M,once:V.once,sandbox:V.sandbox},q=V.token?await hV({...V,token:V.token},H,N,J):void 0,T=q?.name??V.name??P9((J.hostname??IV)()),L=wV(N,T,M),j=c$(L,"worker.json"),W=A0(j);if(q&&W&&A9(W)&&$0(W).revoked)w0(W);let O=!q&&W!==null&&A9(W)&&(!v1(X,"REASON_API_URL")?.trim()||P0(H.apiOrigin,W.apiOrigin))?W.apiOrigin:void 0,F=H6({...H,...O?{apiOrigin:O}:{},name:T,stateDirectory:L}),z=W!==null&&A9(W);if(z&&N0(W)!==N0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${W.workspaceRoot}, ${W.executionMode==="host"?"your user permissions":"sandboxed"}).
+`);return 0}async function F6($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??q$,X=J.env??process.env,Y=G6.map((V)=>X[V]?.trim()).find(Boolean)||void 0;if(!J.env)for(let V of G6)delete process.env[V];try{let V=kV($,Y);if(!V)return Z.stdout.write(bV),0;let N=U6(J.home??H0()),B=J.serviceHost??Q$(N);if(V.stop)return await uV({...V,name:V.name},N,Z,J,B);let U=J.channel??Z$(),M=i2(J.cwd??process.cwd(),V.dir),G=V.service?U1(B,X):void 0,H={channel:U,apiOrigin:n1(X,U),workspaceRoot:M,once:V.once,sandbox:V.sandbox},q=V.token?await vV({...V,token:V.token},H,N,J):void 0,T=q?.name??V.name??P9((J.hostname??xV)()),L=hV(N,T,M),j=c$(L,"worker.json"),W=A0(j);if(q&&W&&A9(W)&&$0(W).revoked)w0(W);let O=!q&&W!==null&&A9(W)&&(!v1(X,"REASON_API_URL")?.trim()||P0(H.apiOrigin,W.apiOrigin))?W.apiOrigin:void 0,F=M6({...H,...O?{apiOrigin:O}:{},name:T,stateDirectory:L}),z=W!==null&&A9(W);if(z&&N0(W)!==N0(F)){if(F.lifetime==="ephemeral")throw new Q0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Q0(`Machine "${T}" is already set up with different settings (${W.workspaceRoot}, ${W.executionMode==="host"?"your user permissions":"sandboxed"}).
 Run it with: reason serve ${T} ${R9(W)}
 Or remove it first: reason worker revoke --config ${j}`)}let _=F.lifetime==="persistent"?H1(F,B):null;if(_&&!V.service&&X[p$]!==_.label)return Z.stdout.write(`Machine "${T}" in ${M} already runs as a background service (${_.label}).
   Logs: ${_.logs}
   Stop it with: reason stop ${T}
-`),0;if(V.service&&z&&!_&&await(J.controlWorker??K0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${M}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let D=F.lifetime==="ephemeral"||!z;if(D&&!R1(T))throw new Q0(N6);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
+`),0;if(V.service&&z&&!_&&await(J.controlWorker??K0)(F,"status")!==null)throw new Q0(`Machine "${T}" is already running in ${M}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let D=F.lifetime==="ephemeral"||!z;if(D&&!R1(T))throw new Q0(H6);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
 `);else if(D&&!V.yes&&!q){let P=`Sessions on "${T}" will run commands in ${M} with your user permissions (no sandbox). Continue?`,I=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!I)throw new Q0(`${P.replace(/ Continue\?$/,"")}
-Re-run with --yes to confirm.`);if(!await(J.confirm??((f)=>yV(Z,f)))(P))return Z.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!z)e(F.stateDirectory,!0),c(j,F);let R={...J.worker,enrollmentInput:fV(T,q,J,Z)};if(F.lifetime==="persistent"&&!z){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
+Re-run with --yes to confirm.`);if(!await(J.confirm??((f)=>fV(Z,f)))(P))return Z.stderr.write(`Cancelled. Nothing was added.
+`),1}if(!z)e(F.stateDirectory,!0),c(j,F);let R={...J.worker,enrollmentInput:gV(T,q,J,Z)};if(F.lifetime==="persistent"&&!z){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
 `);let I=await Q(["enroll","--config",j],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(I!==0)return I}if(G){let P;try{P=s2({config:F,launcher:G,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:B})}catch(I){if(!(I instanceof R$))throw I;throw new Q0(`${I.message}
 This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${R9(F)}
 Or try the background service again with: reason serve ${T} ${R9(F)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${M}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${P.label} (starts at ${P.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${P.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...P.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
@@ -226,8 +226,8 @@ Or try the background service again with: reason serve ${T} ${R9(F)} --service`)
 `));let E=_&&X[p$]===_.label&&!J.runWorker?l2({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",j],{...R,io:{stdout:Z.stdout,stderr:n2(Z.stderr)},onStartup:(P)=>{if(P==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
 `);J.worker?.onStartup?.(P)}})}finally{E?.stop()}}catch(V){if(V instanceof Q0||V instanceof R$){let U=V instanceof R$&&V.code?` (${V.code})`:"";return Z.stderr.write(`Reason: ${V.message}${U}
 `),2}let N=V instanceof Error&&/^worker_[a-z_]+$/.test(V.message)?V.message:null,B=N?e$(N):void 0;return Z.stderr.write(`Reason: ${N?B?`${B} (${N})`:N:"could not prepare this machine."}
-`),1}}var vV=200;var IL=K.strictObject({version:K.literal(1),session_ids:K.array(K.string().min(1).max(200)).max(vV)});function q1($){let J=o($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as L6}from"child_process";import{readFileSync as gV,rmdirSync as uV,rmSync as dV}from"fs";import{join as C9}from"path";var pV=["Reason.app","Ara Sidecar.app","Ara Device.app"],lV="sidecar_retire_failed";function cV($){return C9($,"Library","Application Support","Ara","Sidecar")}function sV($){try{let J=gV(C9($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function _6($,J={}){let Z=cV($),Q=pV.map((N)=>C9(Z,N)).filter(sV);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>L6("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((N)=>process.kill(N,"SIGTERM")),V=J.command??((N,B)=>L6(N,[...B],{stdio:"ignore",timeout:1e4}).status??1);try{for(let N of X().split(`
-`)){let B=N.trim().match(/^(\d+)\s+(.+)$/);if(!B)continue;if(!Q.some((U)=>B[2].startsWith(`${U}/Contents/MacOS/`)))continue;try{Y(Number(B[1]))}catch{}}for(let N of Q)V(F6,["-u",N]),dV(N,{recursive:!0,force:!0});try{uV(Z)}catch{}}catch{return{status:"failed",code:lV}}return{status:"removed",bundles:Q}}var eV=`Connect this computer to Reason
+`),1}}var dV=200;var SL=K.strictObject({version:K.literal(1),session_ids:K.array(K.string().min(1).max(200)).max(dV)});function q1($){let J=o($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as _6}from"child_process";import{readFileSync as pV,rmdirSync as lV,rmSync as cV}from"fs";import{join as C9}from"path";var sV=["Reason.app","Ara Sidecar.app","Ara Device.app"],aV="sidecar_retire_failed";function iV($){return C9($,"Library","Application Support","Ara","Sidecar")}function nV($){try{let J=pV(C9($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function D6($,J={}){let Z=iV($),Q=sV.map((N)=>C9(Z,N)).filter(nV);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>_6("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((N)=>process.kill(N,"SIGTERM")),V=J.command??((N,B)=>_6(N,[...B],{stdio:"ignore",timeout:1e4}).status??1);try{for(let N of X().split(`
+`)){let B=N.trim().match(/^(\d+)\s+(.+)$/);if(!B)continue;if(!Q.some((U)=>B[2].startsWith(`${U}/Contents/MacOS/`)))continue;try{Y(Number(B[1]))}catch{}}for(let N of Q)V(j6,["-u",N]),cV(N,{recursive:!0,force:!0});try{lV(Z)}catch{}}catch{return{status:"failed",code:aV}}return{status:"removed",bundles:Q}}var ZG=`Connect this computer to Reason
 
 Usage:
   reason connect                 Your computer, kept connected in the background
@@ -283,7 +283,7 @@ One computer serves several Reason accounts. Signed in as another account than
 the one it is connected for, reason connect connects it for that account too,
 as that account's own computer in the workspace it signed in to; the other
 accounts stay connected. That account's \`reason logout\` removes only its own.
-`,$G=`Disconnect this computer from Reason
+`,QG=`Disconnect this computer from Reason
 
 Usage:
   reason disconnect              Stop your computer's connection and remove it from Reason, in every
@@ -298,43 +298,43 @@ Usage:
                                  Reason (all of it when it is the only account here), and it is not kept
                                  disconnected: the next reason "\u2026" connects it again
   --yes, -y                      Accepted for scripts; disconnect never asks
-`;class l extends Error{code;constructor($,J="worker_connect_refused"){super($);this.code=J}}var JG=4,o2={write:()=>!0};function g0($,J,Z=!1){let Q=v6($,J,Z);return Q.length===1?Q[0]:F0(A6(F0($,".config")),...m6(J,Z))}var m6=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function v6($,J,Z=!1){let Q=$;try{Q=X$($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...m6(J,Z))).filter(ZG)}function ZG($){try{if(X$($)!==$)return!1;return A0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var g6="disconnected.json";function TF($,J){return u(F0(g0($,J),g6))}function e2($,J,Z){let Q=F0(g0($,J),g6);if(!Z){M1(Q,{force:!0});return}e(w9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function QG($){let J=new Map,Z=new Set;for(let G=0;G<$.length;G+=1){let H=$[G];if(H==="--help"||H==="-h"||H==="help")return null;if(["--to","--token","--folder","--sessions",t2,r2,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(H)){let q=$[G+1];if(!q||q.startsWith("-"))throw new l(`Missing value after ${H}.`);if(J.has(H))throw new l(`${H} may be specified only once.`);J.set(H,q),G+=1;continue}if(["--once","--yes","-y","--minimal"].includes(H)){Z.add(H==="-y"?"--yes":H);continue}if(H.startsWith("-"))throw new l(`Unknown option: ${H}. Run \`reason connect --help\`.`);throw new l(`Unexpected argument: ${H}. To add this computer to a team machine, use --to ${H}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new l("--sessions takes a number from 1 to 4.");if(J.has(r2)&&!J.has(t2))throw new l("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new l("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((G)=>G!=="--yes")))throw new l("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((G)=>J.has(G));if(Y.length>0&&(J.size>1||[...Z].some((G)=>G!=="--yes")))throw new l(`Run reason connect ${Y[0]} PATH on its own.`);let V=J.get("--user-chrome");if(V!==void 0&&V!=="on"&&V!=="off")throw new l("--user-chrome takes on or off.");let N=J.get("--cloud-sessions");if(N!==void 0&&N!=="on"&&N!=="off")throw new l("--cloud-sessions takes on or off.");let B=J.get("--local-logins");if(B!==void 0&&B!=="on"&&B!=="off")throw new l("--local-logins takes on or off.");let U=J.get("--name")?.trim();if(U!==void 0&&(U.length===0||U.length>160))throw new l("--name takes a name of 1 to 160 characters.");let M=(G,H)=>H===void 0?{}:{[G]:H};return{...M("to",J.get("--to")),...M("token",J.get("--token")),...M("folder",J.get("--folder")),...M("sessions",Q===void 0?void 0:Number(Q)),...M("keepAwake",X===void 0?void 0:X==="on"),...M("userChrome",V===void 0?void 0:V==="on"),...M("cloudSessions",N===void 0?void 0:N==="on"),...M("localLogins",B===void 0?void 0:B==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...M("proxy",J.get(t2)),...M("proxyCaFile",J.get(r2)),...M("apiKey",J.get("--api-key")),...M("name",U),...M("apiUrl",J.get("--api-url")),...M("addFolder",J.get("--add-folder")),...M("removeFolder",J.get("--remove-folder"))}}var P$=($)=>u(d($).state),u6=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function d6($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function p6($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=i2($.options.cwd??process.cwd(),J.folder)}catch(N){throw new l(N instanceof Error?N.message:String(N))}if(!j1(Q,$.stateDirectory))throw new l(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?n1({REASON_API_URL:J.apiUrl},$.channel):Z&&!v1($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:n1($.environment,$.channel)}catch(N){throw new l(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${N instanceof Error?N.message:String(N)}`)}if(Z&&X!==Z.apiOrigin&&P0(X,Z.apiOrigin))X=Z.apiOrigin;if(!z6(X)&&!O6($.channel,X))throw new l(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=I6({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(N){if(!(N instanceof R6))throw N;throw new l(N.message)}let V=(Z?.folders??[]).filter((N)=>N!==Q);return J0.parse({...V.length?{folders:V}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??P9(($.options.hostname??rV)()),slots:J.sessions??Z?.slots??JG,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function l6($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function y9($,J,Z,Q,X){if($0($).revoked){if(P$($))try{w0($)}catch{}D3($);let N=[];try{N=tV(g($))}catch{}for(let B of N)if(B!=="workspaces")M1(F0(g($),B),{recursive:!0,force:!0})}else if(P$($))w0($);e($.stateDirectory,!0),c(J,$);let Y=XG(Z.stderr),V=await(Q.runWorker??q$)(["enroll","--config",J],{...k9(Q.worker,X),io:{stdout:o2,stderr:Y}});if(V!==0)Z.stderr.write(`Reason: this computer was not connected. (${Y.code()??"worker_command_failed"})
-`);return V}function XG($){let J=null;return{write:(Z)=>{for(let Q of Z.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))J=Q[1];return $.write(Z)},code:()=>J}}function t1($,J,Z){let Q=E6(X2(z1("REASON_CLI_CHANNEL",J),$));return Q&&P0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function YG($,J,Z,Q){let{config:X,configPath:Y}=G2($,J),V=(U)=>{try{return U!==null&&q1(U)&&o(U)?.orgId.toLowerCase()===J}catch{return!1}},N=null;try{N=A0(Y)}catch{}if(V(N))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let B=await y9(X,Y,Z,Q,void 0);if(B===0&&V(X))return 0;if(B===0&&P$(X))await $3(X,Y,Z,Q);if(M1(X.stateDirectory,{recursive:!0,force:!0}),B!==0)return B;throw new l("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function k9($,J){return J?{...$,enrollmentCredentials:(Z)=>K3(Z,J)}:{...$}}async function h9($,J,Z,Q,X,Y="connect"){if(await f9($,Q,X,Y),Y==="connect"&&!await t6($,Z,Q))return!1;if(!await $3($,J,Z,Q))return!1;return a9($.stateDirectory),M1($.stateDirectory,{recursive:!0,force:!0}),!0}async function $3($,J,Z,Q){if(!P$($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??q$)(["revoke","--config",J],{...Q.worker,io:{stdout:o2,stderr:Y?Z.stderr:o2}})===0)return!0;if(Y)return!1;await new Promise((N)=>setTimeout(N,1000))}}async function f9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??K0,V=async()=>Y($,"status").catch(()=>null),N=await Y($,"stop").catch(()=>null)!==null,B=!X&&a2($,Z,Q);if(N||B){let U=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<U&&await V()!==null)await new Promise((M)=>setTimeout(M,250))}}function m9($,J){return J==="darwin"&&$.userChrome!==!1}function E9($,J,Z){let Q=[...m9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${d6($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
-`)}function x9($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),"  Sessions:  every Session you start",`  Mode:      ${d6(J)}`,...J.proxy?[`  Proxy:     ${P6(J.proxy)}`]:[],...m9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
-`)}async function j6($,J,Z){let{io:Q,options:X}=Z;if(v6(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:w9(J),timestamp:new Date().toISOString()})}
+`;class l extends Error{code;constructor($,J="worker_connect_refused"){super($);this.code=J}}var XG=4,o2={write:()=>!0};function g0($,J,Z=!1){let Q=u6($,J,Z);return Q.length===1?Q[0]:F0(P6(F0($,".config")),...g6(J,Z))}var g6=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function u6($,J,Z=!1){let Q=$;try{Q=X$($)}catch{}return["ara","reason"].map((X)=>F0(Q,".config",X,...g6(J,Z))).filter(YG)}function YG($){try{if(X$($)!==$)return!1;return A0(F0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var d6="disconnected.json";function jF($,J){return u(F0(g0($,J),d6))}function e2($,J,Z){let Q=F0(g0($,J),d6);if(!Z){M1(Q,{force:!0});return}e(w9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function VG($){let J=new Map,Z=new Set;for(let G=0;G<$.length;G+=1){let H=$[G];if(H==="--help"||H==="-h"||H==="help")return null;if(["--to","--token","--folder","--sessions",t2,r2,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(H)){let q=$[G+1];if(!q||q.startsWith("-"))throw new l(`Missing value after ${H}.`);if(J.has(H))throw new l(`${H} may be specified only once.`);J.set(H,q),G+=1;continue}if(["--once","--yes","-y","--minimal"].includes(H)){Z.add(H==="-y"?"--yes":H);continue}if(H.startsWith("-"))throw new l(`Unknown option: ${H}. Run \`reason connect --help\`.`);throw new l(`Unexpected argument: ${H}. To add this computer to a team machine, use --to ${H}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new l("--sessions takes a number from 1 to 4.");if(J.has(r2)&&!J.has(t2))throw new l("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new l("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((G)=>G!=="--yes")))throw new l("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((G)=>J.has(G));if(Y.length>0&&(J.size>1||[...Z].some((G)=>G!=="--yes")))throw new l(`Run reason connect ${Y[0]} PATH on its own.`);let V=J.get("--user-chrome");if(V!==void 0&&V!=="on"&&V!=="off")throw new l("--user-chrome takes on or off.");let N=J.get("--cloud-sessions");if(N!==void 0&&N!=="on"&&N!=="off")throw new l("--cloud-sessions takes on or off.");let B=J.get("--local-logins");if(B!==void 0&&B!=="on"&&B!=="off")throw new l("--local-logins takes on or off.");let U=J.get("--name")?.trim();if(U!==void 0&&(U.length===0||U.length>160))throw new l("--name takes a name of 1 to 160 characters.");let M=(G,H)=>H===void 0?{}:{[G]:H};return{...M("to",J.get("--to")),...M("token",J.get("--token")),...M("folder",J.get("--folder")),...M("sessions",Q===void 0?void 0:Number(Q)),...M("keepAwake",X===void 0?void 0:X==="on"),...M("userChrome",V===void 0?void 0:V==="on"),...M("cloudSessions",N===void 0?void 0:N==="on"),...M("localLogins",B===void 0?void 0:B==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...M("proxy",J.get(t2)),...M("proxyCaFile",J.get(r2)),...M("apiKey",J.get("--api-key")),...M("name",U),...M("apiUrl",J.get("--api-url")),...M("addFolder",J.get("--add-folder")),...M("removeFolder",J.get("--remove-folder"))}}var P$=($)=>u(d($).state),p6=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function l6($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function c6($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=i2($.options.cwd??process.cwd(),J.folder)}catch(N){throw new l(N instanceof Error?N.message:String(N))}if(!j1(Q,$.stateDirectory))throw new l(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?n1({REASON_API_URL:J.apiUrl},$.channel):Z&&!v1($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:n1($.environment,$.channel)}catch(N){throw new l(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${N instanceof Error?N.message:String(N)}`)}if(Z&&X!==Z.apiOrigin&&P0(X,Z.apiOrigin))X=Z.apiOrigin;if(!R6(X)&&!A6($.channel,X))throw new l(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=E6({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(N){if(!(N instanceof I6))throw N;throw new l(N.message)}let V=(Z?.folders??[]).filter((N)=>N!==Q);return J0.parse({...V.length?{folders:V}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??P9(($.options.hostname??$G)()),slots:J.sessions??Z?.slots??XG,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function s6($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function y9($,J,Z,Q,X){if($0($).revoked){if(P$($))try{w0($)}catch{}D3($);let N=[];try{N=eV(g($))}catch{}for(let B of N)if(B!=="workspaces")M1(F0(g($),B),{recursive:!0,force:!0})}else if(P$($))w0($);e($.stateDirectory,!0),c(J,$);let Y=GG(Z.stderr),V=await(Q.runWorker??q$)(["enroll","--config",J],{...k9(Q.worker,X),io:{stdout:o2,stderr:Y}});if(V!==0)Z.stderr.write(`Reason: this computer was not connected. (${Y.code()??"worker_command_failed"})
+`);return V}function GG($){let J=null;return{write:(Z)=>{for(let Q of Z.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))J=Q[1];return $.write(Z)},code:()=>J}}function t1($,J,Z){let Q=S6(X2(z1("REASON_CLI_CHANNEL",J),$));return Q&&P0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function BG($,J,Z,Q){let{config:X,configPath:Y}=G2($,J),V=(U)=>{try{return U!==null&&q1(U)&&o(U)?.orgId.toLowerCase()===J}catch{return!1}},N=null;try{N=A0(Y)}catch{}if(V(N))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let B=await y9(X,Y,Z,Q,void 0);if(B===0&&V(X))return 0;if(B===0&&P$(X))await $3(X,Y,Z,Q);if(M1(X.stateDirectory,{recursive:!0,force:!0}),B!==0)return B;throw new l("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function k9($,J){return J?{...$,enrollmentCredentials:(Z)=>K3(Z,J)}:{...$}}async function h9($,J,Z,Q,X,Y="connect"){if(await f9($,Q,X,Y),Y==="connect"&&!await o6($,Z,Q))return!1;if(!await $3($,J,Z,Q))return!1;return a9($.stateDirectory),M1($.stateDirectory,{recursive:!0,force:!0}),!0}async function $3($,J,Z,Q){if(!P$($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??q$)(["revoke","--config",J],{...Q.worker,io:{stdout:o2,stderr:Y?Z.stderr:o2}})===0)return!0;if(Y)return!1;await new Promise((N)=>setTimeout(N,1000))}}async function f9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??K0,V=async()=>Y($,"status").catch(()=>null),N=await Y($,"stop").catch(()=>null)!==null,B=!X&&a2($,Z,Q);if(N||B){let U=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<U&&await V()!==null)await new Promise((M)=>setTimeout(M,250))}}function m9($,J){return J==="darwin"&&$.userChrome!==!1}function E9($,J,Z){let Q=[...m9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${l6($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
+`)}function x9($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),"  Sessions:  every Session you start",`  Mode:      ${l6(J)}`,...J.proxy?[`  Proxy:     ${C6(J.proxy)}`]:[],...m9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
+`)}async function W6($,J,Z){let{io:Q,options:X}=Z;if(u6(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:w9(J),timestamp:new Date().toISOString()})}
 `);let Y=q2(F0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
 `);T9(Z.home,Z.host.platform);let V=P4({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(q)=>Q.stderr.write(`${q}
 `),host:Z.host}),N=_4({...V,log:(q)=>Q.stderr.write(`${q}
 `)}),{configPath:B}=N,U=N.saved;if(!U)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let M=(q,T)=>{let L=Z3(Z.home,Z.channel),j;try{let O=null;try{O=T.keep?null:o(U)?.orgId.toLowerCase()??null}catch{}if(j=K2(U,{prefer:t1(Z.home,Z.channel,U),...T}),j&&O)B2(j,O)}finally{L()}if(!j)return!1;U=j;let W="";try{W=` (workspace ${o(j)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${q}; this computer goes on running Sessions for its other Reason account${W}.
-`),!0};if($0(U).revoked&&!M("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(U.executionMode==="confined"||!q1(U)){let q=d0(U.stateDirectory)??void 0,T=q?null:t1(Z.home,Z.channel,U);if(!q&&!(T&&A1(U,T)))M("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let G=U.executionMode==="confined";if(G||!q1(U)){let q=d0(U.stateDirectory)??void 0;if(Q.stderr.write(G?u6:`Reason: this computer's connection expired; renewing it with ${q?"its API key":"your login"}\u2026
-`),await y9(J0.parse({...U,executionMode:"host"}),B,Q,X,q)!==0)return Q.stderr.write(q?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let H=new AbortController;if(!X.runWorker)import("./ask-relay-dq0v3bmt.js").then(({runBackgroundAskRelay:q})=>q(H.signal,(T)=>Q.stderr.write(`${T}
-`))).catch(()=>{});try{for(;;){let q=d0(U.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:l2({stateDirectory:U.stateDirectory}),L=!1,j;try{j=await(X.runWorker??q$)(["start","--config",B],{deferOptionalLanes:!0,...X.worker,...q,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{L=!0}})}finally{T?.stop()}if(!L)return j;if(!M("this computer's connection was removed from Reason",{keep:!1}))break}return e2(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{H.abort()}}async function VG($,J,Z){let{io:Q,options:X,home:Y,channel:V,environment:N}=Z;if(J&&await(X.controlWorker??K0)(J,"status").catch(()=>null))throw new l("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let B=g0(Y,V,!0),U=p6({parsed:$,saved:J,stateDirectory:B,lifetime:"ephemeral",home:Y,channel:V,options:X,environment:N}),M=l6(U,Z.apiKey??(J?d0(J.stateDirectory)??void 0:void 0)),G=F0(B,"worker.json");return e(B,!0),c(G,M),Q.stdout.write(x9(`Reason: connecting "${M.name}" while this command runs`,M,Z.host.platform,["Connecting\u2026"])),(X.runWorker??q$)(["start","--config",G],{...k9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:n2(Q.stderr)},onStartup:(H)=>{if(H==="ready")Q.stdout.write(`Connected. Start Sessions on "${M.name}" from Reason. Press Ctrl-C to stop.
-`);X.worker?.onStartup?.(H)}})}function GG($,J,Z,Q){if(Z.platform!=="darwin")throw new l("--keep-awake is for macOS.");if(!J)throw new l("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),x4(d(J).daemon,$);let X=M2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var BG=K.object({root:K.object({id:K.string().min(1).max(160),label:K.string().max(160),path_fingerprint:K.string()})});async function c6($,J,Z,Q){let X=await(k9(Q.worker,Z).enrollmentCredentials??j$)($,_$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new A$(X,{credentialsPath:_$($),fetchImpl:S0($.proxy)}),V=(N)=>N instanceof m0&&N.status===404&&!["device_not_found","root_not_found"].includes(N.code);return{add:async(N)=>{let B=V4($,N,{...J.roots[0].permissions,expose_mcp:!1}),U=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:B.pathFingerprint,label:B.label,permissions:{...B.permissions,expose_mcp:!1}}).catch((G)=>{if(V(G))throw Error("worker_folders_unavailable");if(G instanceof m0&&G.code==="root_limit_reached")throw new l("This computer already has the most folders Reason allows (32).");throw G}),M=BG.parse(U).root;if(M.path_fingerprint!==B.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...B,id:M.id,label:M.label}},remove:async(N)=>{await Y.removeDeviceRoot(J.deviceId,N).catch((B)=>{if(V(B))throw Error("worker_folders_unavailable");if(!(B instanceof m0&&B.code==="root_not_found"))throw B})}}}function s6($,J,Z){k0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:N0($)}},d($).state,{proofStore:T0($)})}async function a6($,J,Z,Q){let{io:X,options:Y,host:V}=Q,N=J&&!Q.apiKey&&d0(J.stateDirectory)===null?t1(Q.home,Q.channel,J):null,B=J&&N&&P$(J)&&!A1(J,N)?y0(J).find((P)=>P.account&&P.organizationId===N)??null:void 0;if(B===null)throw new l("This computer is not connected for your account. Run reason connect first.");let U=B?B.config:J,M=B?B.configPath:Z,G=U&&P$(U)&&!$0(U).revoked?o(U):null;if(!J||!U||!G||U.lifetime!=="persistent")throw new l("This computer is not connected to Reason. Run reason connect first.");let H=$.addFolder!==void 0,q=H?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),L;try{L=i2(T,q)}catch(P){if(H)throw new l(P instanceof Error?P.message:String(P));L=oV(T,q)}if(L===U.workspaceRoot)throw new l(`${L} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let j=U.folders??[],W=G.roots.slice(1).find((P)=>P.path===L);if(!H&&!W&&!j.includes(L))throw new l(`${L} is not one of this computer's folders.`);if(H&&!j1(L,U.stateDirectory))throw new l(`${L} holds Reason's own settings.`);if(H&&!W&&j.length>=31)throw new l("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??d0(U.stateDirectory)??void 0,F=await c6(U,G,O,Y),z=G.roots.filter((P)=>P.path!==L);if(H)z=[...z,await F.add(L)];else if(W)await F.remove(W.id);s6(U,G,z);let _=H?[...j.filter((P)=>P!==L),L]:j.filter((P)=>P!==L),{folders:D,...R}=U;if(c(M,J0.parse({...R,..._.length?{folders:_}:{}})),!await(Y.controlWorker??K0)(J,"reload_roots").then(()=>!0,()=>!1))M$(J,V,"connect");return X.stdout.write(H?`Added ${L}. Sessions on "${U.name}" may run in it.
+`),!0};if($0(U).revoked&&!M("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(U.executionMode==="confined"||!q1(U)){let q=d0(U.stateDirectory)??void 0,T=q?null:t1(Z.home,Z.channel,U);if(!q&&!(T&&A1(U,T)))M("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let G=U.executionMode==="confined";if(G||!q1(U)){let q=d0(U.stateDirectory)??void 0;if(Q.stderr.write(G?p6:`Reason: this computer's connection expired; renewing it with ${q?"its API key":"your login"}\u2026
+`),await y9(J0.parse({...U,executionMode:"host"}),B,Q,X,q)!==0)return Q.stderr.write(q?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let H=new AbortController;if(!X.runWorker)import("./ask-relay-8z5hmrxz.js").then(({runBackgroundAskRelay:q})=>q(H.signal,(T)=>Q.stderr.write(`${T}
+`))).catch(()=>{});try{for(;;){let q=d0(U.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:l2({stateDirectory:U.stateDirectory}),L=!1,j;try{j=await(X.runWorker??q$)(["start","--config",B],{deferOptionalLanes:!0,...X.worker,...q,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{L=!0}})}finally{T?.stop()}if(!L)return j;if(!M("this computer's connection was removed from Reason",{keep:!1}))break}return e2(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{H.abort()}}async function KG($,J,Z){let{io:Q,options:X,home:Y,channel:V,environment:N}=Z;if(J&&await(X.controlWorker??K0)(J,"status").catch(()=>null))throw new l("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let B=g0(Y,V,!0),U=c6({parsed:$,saved:J,stateDirectory:B,lifetime:"ephemeral",home:Y,channel:V,options:X,environment:N}),M=s6(U,Z.apiKey??(J?d0(J.stateDirectory)??void 0:void 0)),G=F0(B,"worker.json");return e(B,!0),c(G,M),Q.stdout.write(x9(`Reason: connecting "${M.name}" while this command runs`,M,Z.host.platform,["Connecting\u2026"])),(X.runWorker??q$)(["start","--config",G],{...k9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:n2(Q.stderr)},onStartup:(H)=>{if(H==="ready")Q.stdout.write(`Connected. Start Sessions on "${M.name}" from Reason. Press Ctrl-C to stop.
+`);X.worker?.onStartup?.(H)}})}function NG($,J,Z,Q){if(Z.platform!=="darwin")throw new l("--keep-awake is for macOS.");if(!J)throw new l("This computer is not connected to Reason. Run reason connect first.");e(g(J),!0),x4(d(J).daemon,$);let X=M2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
+`),0}var UG=K.object({root:K.object({id:K.string().min(1).max(160),label:K.string().max(160),path_fingerprint:K.string()})});async function a6($,J,Z,Q){let X=await(k9(Q.worker,Z).enrollmentCredentials??j$)($,_$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new A$(X,{credentialsPath:_$($),fetchImpl:S0($.proxy)}),V=(N)=>N instanceof m0&&N.status===404&&!["device_not_found","root_not_found"].includes(N.code);return{add:async(N)=>{let B=V4($,N,{...J.roots[0].permissions,expose_mcp:!1}),U=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:B.pathFingerprint,label:B.label,permissions:{...B.permissions,expose_mcp:!1}}).catch((G)=>{if(V(G))throw Error("worker_folders_unavailable");if(G instanceof m0&&G.code==="root_limit_reached")throw new l("This computer already has the most folders Reason allows (32).");throw G}),M=UG.parse(U).root;if(M.path_fingerprint!==B.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...B,id:M.id,label:M.label}},remove:async(N)=>{await Y.removeDeviceRoot(J.deviceId,N).catch((B)=>{if(V(B))throw Error("worker_folders_unavailable");if(!(B instanceof m0&&B.code==="root_not_found"))throw B})}}}function i6($,J,Z){k0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:N0($)}},d($).state,{proofStore:T0($)})}async function n6($,J,Z,Q){let{io:X,options:Y,host:V}=Q,N=J&&!Q.apiKey&&d0(J.stateDirectory)===null?t1(Q.home,Q.channel,J):null,B=J&&N&&P$(J)&&!A1(J,N)?y0(J).find((P)=>P.account&&P.organizationId===N)??null:void 0;if(B===null)throw new l("This computer is not connected for your account. Run reason connect first.");let U=B?B.config:J,M=B?B.configPath:Z,G=U&&P$(U)&&!$0(U).revoked?o(U):null;if(!J||!U||!G||U.lifetime!=="persistent")throw new l("This computer is not connected to Reason. Run reason connect first.");let H=$.addFolder!==void 0,q=H?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),L;try{L=i2(T,q)}catch(P){if(H)throw new l(P instanceof Error?P.message:String(P));L=JG(T,q)}if(L===U.workspaceRoot)throw new l(`${L} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let j=U.folders??[],W=G.roots.slice(1).find((P)=>P.path===L);if(!H&&!W&&!j.includes(L))throw new l(`${L} is not one of this computer's folders.`);if(H&&!j1(L,U.stateDirectory))throw new l(`${L} holds Reason's own settings.`);if(H&&!W&&j.length>=31)throw new l("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??d0(U.stateDirectory)??void 0,F=await a6(U,G,O,Y),z=G.roots.filter((P)=>P.path!==L);if(H)z=[...z,await F.add(L)];else if(W)await F.remove(W.id);i6(U,G,z);let _=H?[...j.filter((P)=>P!==L),L]:j.filter((P)=>P!==L),{folders:D,...R}=U;if(c(M,J0.parse({...R,..._.length?{folders:_}:{}})),!await(Y.controlWorker??K0)(J,"reload_roots").then(()=>!0,()=>!1))M$(J,V,"connect");return X.stdout.write(H?`Added ${L}. Sessions on "${U.name}" may run in it.
 `:`Removed ${L}. Sessions on "${U.name}" no longer run in it.
-`),0}async function LF($,J,Z){let Q=S9(Z),X=Z3(Q.home,Q.channel);try{let Y=F0(g0(Q.home,Q.channel),"worker.json");return await a6({once:!1,yes:J,addFolder:$},A0(Y),Y,Q)===0}finally{X()}}function S9($,J){let Z=X$($.home??H0()),Q=$.env??process.env;return{io:$.io??J3(),options:$,home:Z,channel:$.channel??Z$(),environment:Q,apiKey:J??x6(Q),host:$.serviceHost??Q$(Z)}}async function KG($,J,Z,Q){let X=o($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let V=await c6($,X,Z,Q),N=Y.find((B)=>B.path===J.workspaceRoot)??await V.add(J.workspaceRoot);await V.remove(Y[0].id),Y=[N,...Y.slice(1).filter((B)=>B.id!==N.id)]}s6(J,X,Y)}var i6=Symbol("serve here");async function NG($,J,Z,Q){let{io:X,options:Y,home:V,channel:N,environment:B,host:U}=Q;if(U.platform==="darwin"){let C=_6(V);if(C.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${C.code}).
-`)}let M=J&&!Q.apiKey&&d0(J.stateDirectory)===null?t1(V,N,J):null,G=J&&M&&$0(J).revoked&&y0(J).some((C)=>C.account&&C.organizationId===M)?K2(J,{prefer:M,keep:!1})??J:J,H=p6({parsed:$,saved:G,stateDirectory:g0(V,N),lifetime:"persistent",home:V,channel:N,options:Y,environment:B});if(e2(V,N,!1),G?.executionMode==="confined")X.stdout.write(u6);let q=G?d0(G.stateDirectory):null,T=l6(H,Q.apiKey??q??void 0),L=U1(U,B),j=G!==null&&P$(G),W=j&&N0(G)===N0(T),O=W&&q1(T),F=G?.userChrome!==!1===(T.userChrome!==!1)&&G?.cloudSessions===T.cloudSessions&&G?.localLogins===T.localLogins,z=Q.apiKey??q??void 0,_=M!==null&&j&&!$0(G).revoked&&!A1(G,M);if(_){if(!W||!F||JSON.stringify(G.proxy)!==JSON.stringify(T.proxy))throw new l("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let C=await YG(G,M,X,Y);if(C!==0)return C}let D=_?[`  Account:   yours too, in workspace ${M}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===q)return;await K3(T,$.apiKey),B3(T.stateDirectory,$.apiKey)},E=B.PATH||"/usr/local/bin:/usr/bin:/bin",P=O&&JSON.stringify(G?.proxy)===JSON.stringify(T.proxy)&&F?H1(T,U,"connect"):null,I=P?.label===S6(T.channel),f=I&&await(Y.controlWorker??K0)(T,"status").catch(()=>null)!==null,S=I&&!f&&b9(P,U)&&y6({config:T,launcher:L,path:E,host:U,kind:"connect"});if((f||S)&&[null,r].includes(P1(T))){await R();let C=w6(T,U,"connect");if(C==="retired"){let x=S?null:await(Y.controlWorker??K0)(T,"status").catch(()=>null);if(!S&&(!x||x.phase==="stopping"))M$(T,U,"connect")}else if(C==="current_not_running")M$(T,U,"connect");return await(Y.controlWorker??K0)(T,"reload_roots").catch(()=>null),X.stdout.write(B.REASON_INSTALLER==="1"?E9(T,U.platform,D):x9("This computer is connected to Reason",T,U.platform,[...D,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let k=!O&&!_;if(j&&!W)if(G.apiOrigin!==T.apiOrigin||G.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),0}async function DF($,J,Z){let Q=S9(Z),X=Z3(Q.home,Q.channel);try{let Y=F0(g0(Q.home,Q.channel),"worker.json");return await n6({once:!1,yes:J,addFolder:$},A0(Y),Y,Q)===0}finally{X()}}function S9($,J){let Z=X$($.home??H0()),Q=$.env??process.env;return{io:$.io??J3(),options:$,home:Z,channel:$.channel??Z$(),environment:Q,apiKey:J??b6(Q),host:$.serviceHost??Q$(Z)}}async function HG($,J,Z,Q){let X=o($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let V=await a6($,X,Z,Q),N=Y.find((B)=>B.path===J.workspaceRoot)??await V.add(J.workspaceRoot);await V.remove(Y[0].id),Y=[N,...Y.slice(1).filter((B)=>B.id!==N.id)]}i6(J,X,Y)}var t6=Symbol("serve here");async function qG($,J,Z,Q){let{io:X,options:Y,home:V,channel:N,environment:B,host:U}=Q;if(U.platform==="darwin"){let C=D6(V);if(C.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${C.code}).
+`)}let M=J&&!Q.apiKey&&d0(J.stateDirectory)===null?t1(V,N,J):null,G=J&&M&&$0(J).revoked&&y0(J).some((C)=>C.account&&C.organizationId===M)?K2(J,{prefer:M,keep:!1})??J:J,H=c6({parsed:$,saved:G,stateDirectory:g0(V,N),lifetime:"persistent",home:V,channel:N,options:Y,environment:B});if(e2(V,N,!1),G?.executionMode==="confined")X.stdout.write(p6);let q=G?d0(G.stateDirectory):null,T=s6(H,Q.apiKey??q??void 0),L=U1(U,B),j=G!==null&&P$(G),W=j&&N0(G)===N0(T),O=W&&q1(T),F=G?.userChrome!==!1===(T.userChrome!==!1)&&G?.cloudSessions===T.cloudSessions&&G?.localLogins===T.localLogins,z=Q.apiKey??q??void 0,_=M!==null&&j&&!$0(G).revoked&&!A1(G,M);if(_){if(!W||!F||JSON.stringify(G.proxy)!==JSON.stringify(T.proxy))throw new l("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let C=await BG(G,M,X,Y);if(C!==0)return C}let D=_?[`  Account:   yours too, in workspace ${M}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===q)return;await K3(T,$.apiKey),B3(T.stateDirectory,$.apiKey)},E=B.PATH||"/usr/local/bin:/usr/bin:/bin",P=O&&JSON.stringify(G?.proxy)===JSON.stringify(T.proxy)&&F?H1(T,U,"connect"):null,I=P?.label===w6(T.channel),f=I&&await(Y.controlWorker??K0)(T,"status").catch(()=>null)!==null,S=I&&!f&&b9(P,U)&&h6({config:T,launcher:L,path:E,host:U,kind:"connect"});if((f||S)&&[null,r].includes(P1(T))){await R();let C=k6(T,U,"connect");if(C==="retired"){let x=S?null:await(Y.controlWorker??K0)(T,"status").catch(()=>null);if(!S&&(!x||x.phase==="stopping"))M$(T,U,"connect")}else if(C==="current_not_running")M$(T,U,"connect");return await(Y.controlWorker??K0)(T,"reload_roots").catch(()=>null),X.stdout.write(B.REASON_INSTALLER==="1"?E9(T,U.platform,D):x9("This computer is connected to Reason",T,U.platform,[...D,...S?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let k=!O&&!_;if(j&&!W)if(G.apiOrigin!==T.apiOrigin||G.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
 `),!await h9(G,Z,X,Y,U))throw new l("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(G.executionMode==="host"&&q1(G))X.stdout.write(`Applying the new settings to this computer\u2026
-`),await KG(G,T,z,Y),k=!1;else await f9(G,Y,U);if(k){if(B.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
+`),await HG(G,T,z,Y),k=!1;else await f9(G,Y,U);if(k){if(B.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
 `);let C=await y9(T,Z,X,Y,z);if(C!==0)return C;if(z)B3(T.stateDirectory,z)}else c(Z,T),await R();let p;try{p=s2({config:T,launcher:L,path:E,host:U,kind:"connect"})}catch(C){if(!(C instanceof R$))throw C;if(C.code!=="worker_service_manager_missing")throw new l(`${C.message}
 This computer is set up; run reason connect again to start it.`,C.code??"worker_service_start_failed");if(Y.serveHere&&B.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),i6;if(Y.serveHere&&B.REASON_INSTALLER==="1"&&await UG(T,L,B,Y))return X.stdout.write(E9(T,U.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${L} connect under a process manager)`])),0;throw new R$(`${C.message}
-This computer is set up. Keep it connected by running ${L} connect in a terminal or under this box's process manager.`,C.code)}let w=[...D,...p.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...p.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${p.identityProblem}).`]:[]];return X.stdout.write(B.REASON_INSTALLER==="1"?E9(T,U.platform,w):x9("This computer is connected to Reason",T,U.platform,[`  Service:   ${p.label} (starts at ${p.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${p.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...w])),0}async function UG($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??n6)(J,Y,F0($.stateDirectory,"connect.log"));for(let V=0;V<60;V+=1)if(await new Promise((N)=>setTimeout(N,500)),await(Q.controlWorker??K0)($,"status").catch(()=>null))return!0;return!1}function n6($,J,Z){let Q=f6(Z,"a",384);try{let X=k6($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{h6(Q)}}async function t6($,J,Z,Q=!1){let X=!0;for(let Y of y0($)){if(Q&&Y.account)continue;if(Y.config&&P$(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??q$)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:o2,stderr:J.stderr}})!==0){X=!1;continue}}M1(Y.directory,{recursive:!0,force:!0})}return X}function J3(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function v9($,J){if($ instanceof l||$ instanceof R$)return J.stderr.write(`Reason: ${$.message} (${$.code??"worker_service_failed"})
-`),2;let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:qG($);return J.stderr.write(`Reason: ${e$(Z)??"could not connect this computer."} (${Z})
-`),1}var HG=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]);function qG($){if($ instanceof m0)return $.status>=500?"worker_api_unavailable":"worker_api_refused";let J=$?.code;if(typeof J==="string"&&HG.has(J))return`worker_file_${J.toLowerCase()}`;return"worker_connect_unexpected"}function D6($,J){if($.minimal){o6({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||e6({home:J.home})!=="install")return;let Z;try{Z=U1(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??W6)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
+`),t6;if(Y.serveHere&&B.REASON_INSTALLER==="1"&&await MG(T,L,B,Y))return X.stdout.write(E9(T,U.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${L} connect under a process manager)`])),0;throw new R$(`${C.message}
+This computer is set up. Keep it connected by running ${L} connect in a terminal or under this box's process manager.`,C.code)}let w=[...D,...p.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...p.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${p.identityProblem}).`]:[]];return X.stdout.write(B.REASON_INSTALLER==="1"?E9(T,U.platform,w):x9("This computer is connected to Reason",T,U.platform,[`  Service:   ${p.label} (starts at ${p.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${p.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...w])),0}async function MG($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??r6)(J,Y,F0($.stateDirectory,"connect.log"));for(let V=0;V<60;V+=1)if(await new Promise((N)=>setTimeout(N,500)),await(Q.controlWorker??K0)($,"status").catch(()=>null))return!0;return!1}function r6($,J,Z){let Q=v6(Z,"a",384);try{let X=f6($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{m6(Q)}}async function o6($,J,Z,Q=!1){let X=!0;for(let Y of y0($)){if(Q&&Y.account)continue;if(Y.config&&P$(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??q$)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:o2,stderr:J.stderr}})!==0){X=!1;continue}}M1(Y.directory,{recursive:!0,force:!0})}return X}function J3(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function v9($,J){if($ instanceof l||$ instanceof R$)return J.stderr.write(`Reason: ${$.message} (${$.code??"worker_service_failed"})
+`),2;let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:LG($);return J.stderr.write(`Reason: ${e$(Z)??"could not connect this computer."} (${Z})
+`),1}var TG=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]);function LG($){if($ instanceof m0)return $.status>=500?"worker_api_unavailable":"worker_api_refused";let J=$?.code;if(typeof J==="string"&&TG.has(J))return`worker_file_${J.toLowerCase()}`;return"worker_connect_unexpected"}function O6($,J){if($.minimal){$7({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||J7({home:J.home})!=="install")return;let Z;try{Z=U1(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=F0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??z6)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
 `);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let Q=(J.options.installDesktop??W6)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function W6($,J,Z){if(!Z)return iV($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;nV(w9(Z.log),{recursive:!0,mode:448});let Q=f6(Z.log,"w",384);try{let X=k6($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{h6(Q)}return 0}async function FF($,J={}){let Z=J.io??J3();try{let Q=QG($);if(!Q)return Z.stdout.write(eV),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new l("A machine's workers run one Session at a time; --sessions does not apply to them.");if(Q.proxy!==void 0)throw new l("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new l("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new l("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new l("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[U,M]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(M!==void 0)throw new l(`${U} is for your own computer; reason serve sets up a machine's workers.`);return D6(Q,S9(J)),await(J.runServe??T6)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=S9(J,Q.apiKey),{channel:Y,environment:V}=X;if(!J.env)for(let U of["REASON_API_KEY","ARA_API_KEY"])delete process.env[U];if(Q.userChrome&&X.host.platform!=="darwin")throw new l("--user-chrome is for a Mac.");let N=b6(V[p$],Y),B=N||Q.once?()=>{return}:Z3(X.home,Y);try{let U=F0(g0(X.home,Y),"worker.json"),M=A0(U);if(N)return await j6(M,U,X);if(Q.keepAwake!==void 0)return GG(Q.keepAwake,M,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await a6(Q,M,U,X);if(D6(Q,X),Q.once)return await VG(Q,M,X);let G=await NG(Q,M,U,X);if(G!==i6)return G;return B(),B=()=>{return},await j6(A0(U),U,X)}finally{B()}}catch(Q){return v9(Q,Z)}}async function _F($,J={}){let Z=J.io??J3();try{if($.some((V)=>["--help","-h","help"].includes(V)))return Z.stdout.write($G),0;let Q=$.filter((V)=>!["--yes","-y","--temporary","--account"].includes(V)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new l("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await LG(Q[0],Z,J);return await r6(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return v9(Q,Z)}}async function jF($={}){let J=$.io??J3();try{return await r6(J,$,"logout")}catch(Z){return v9(Z,J)}}async function r6($,J,Z){let Q=X$(J.home??H0()),X=J.channel??Z$(),Y=Z3(Q,X);try{return await MG($,J,Z,Q,X)}finally{Y()}}function Z3($,J){let Z=g0($,J),Q=u(Z)?r$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new l("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function MG($,J,Z,Q,X){let Y=F0(g0(Q,X),"worker.json"),V=A0(Y);if(!V){if(Z==="disconnect")e2(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(Z!=="disconnect"){let B=await TG(V,Y,$,J,Z,Q,X);if(B!==null)return B}let N=!1;try{N=await h9(V,Y,$,J,J.serviceHost??Q$(Q))}finally{if(Z!=="temporary")e2(Q,X,!0)}if(!N)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`);let Q=(J.options.installDesktop??z6)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
+`)}function z6($,J,Z){if(!Z)return rV($,["desktop","install"],{env:J,stdio:"inherit"}).status??1;oV(w9(Z.log),{recursive:!0,mode:448});let Q=v6(Z.log,"w",384);try{let X=f6($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{m6(Q)}return 0}async function WF($,J={}){let Z=J.io??J3();try{let Q=VG($);if(!Q)return Z.stdout.write(ZG),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new l("A machine's workers run one Session at a time; --sessions does not apply to them.");if(Q.proxy!==void 0)throw new l("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new l("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new l("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new l("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[U,M]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(M!==void 0)throw new l(`${U} is for your own computer; reason serve sets up a machine's workers.`);return O6(Q,S9(J)),await(J.runServe??F6)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=S9(J,Q.apiKey),{channel:Y,environment:V}=X;if(!J.env)for(let U of["REASON_API_KEY","ARA_API_KEY"])delete process.env[U];if(Q.userChrome&&X.host.platform!=="darwin")throw new l("--user-chrome is for a Mac.");let N=y6(V[p$],Y),B=N||Q.once?()=>{return}:Z3(X.home,Y);try{let U=F0(g0(X.home,Y),"worker.json"),M=A0(U);if(N)return await W6(M,U,X);if(Q.keepAwake!==void 0)return NG(Q.keepAwake,M,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await n6(Q,M,U,X);if(O6(Q,X),Q.once)return await KG(Q,M,X);let G=await qG(Q,M,U,X);if(G!==t6)return G;return B(),B=()=>{return},await W6(A0(U),U,X)}finally{B()}}catch(Q){return v9(Q,Z)}}async function OF($,J={}){let Z=J.io??J3();try{if($.some((V)=>["--help","-h","help"].includes(V)))return Z.stdout.write(QG),0;let Q=$.filter((V)=>!["--yes","-y","--temporary","--account"].includes(V)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new l("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await jG(Q[0],Z,J);return await e6(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return v9(Q,Z)}}async function zF($={}){let J=$.io??J3();try{return await e6(J,$,"logout")}catch(Z){return v9(Z,J)}}async function e6($,J,Z){let Q=X$(J.home??H0()),X=J.channel??Z$(),Y=Z3(Q,X);try{return await FG($,J,Z,Q,X)}finally{Y()}}function Z3($,J){let Z=g0($,J),Q=u(Z)?r$():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new l("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function FG($,J,Z,Q,X){let Y=F0(g0(Q,X),"worker.json"),V=A0(Y);if(!V){if(Z==="disconnect")e2(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(Z!=="disconnect"){let B=await _G(V,Y,$,J,Z,Q,X);if(B!==null)return B}let N=!1;try{N=await h9(V,Y,$,J,J.serviceHost??Q$(Q))}finally{if(Z!=="temporary")e2(Q,X,!0)}if(!N)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
 `),1;return $.stdout.write(`Disconnected "${V.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function TG($,J,Z,Q,X,Y,V){let N=y0($).filter((j)=>j.account);if(N.length===0)return null;let B=t1(Y,V,$),U=Q.controlWorker??K0,M=N.find((j)=>j.organizationId===B);if(M){if(M.config&&!await $3(M.config,M.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),0}async function _G($,J,Z,Q,X,Y,V){let N=y0($).filter((j)=>j.account);if(N.length===0)return null;let B=t1(Y,V,$),U=Q.controlWorker??K0,M=N.find((j)=>j.organizationId===B);if(M){if(M.config&&!await $3(M.config,M.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
 `),1;if(X!=="account"||!M.config)M1(M.directory,{recursive:!0,force:!0});return await U($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${B} for your account. It stays connected for its other Reason accounts.
 `),0}if(!B&&X==="account")throw new l("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!B||!A1($,B)){if(X==="account"&&B)B2($,B);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let G=Q.serviceHost??Q$(Y),H=null;try{H=o($)?.orgId.toLowerCase()??null}catch{}if(await f9($,Q,G,"connect",!0),!await t6($,Z,Q,!0)||!await $3($,J,Z,Q))return M$($,G,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`);return 0}let G=Q.serviceHost??Q$(Y),H=null;try{H=o($)?.orgId.toLowerCase()??null}catch{}if(await f9($,Q,G,"connect",!0),!await o6($,Z,Q,!0)||!await $3($,J,Z,Q))return M$($,G,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
 `),1;let q=K2($,{prefer:null,keep:!1});if(!q)return null;if(X==="account"&&H)B2(q,H);let T=M$(q,G,"connect")!==null,L="";try{L=` in workspace ${o(q)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${L}${T?"":"; run reason connect to start it again"}.
-`),0}async function LG($,J,Z){let Q=X$(Z.home??H0()),X=Z.serviceHost??Q$(Q),Y=I9(Q,$);if(Y.length===0)throw new l(`No worker for machine "${$}" on this computer.`);let V=!1;for(let N of Y)if(await h9(N.config,N.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${N.config.workspaceRoot}.
+`),0}async function jG($,J,Z){let Q=X$(Z.home??H0()),X=Z.serviceHost??Q$(Q),Y=I9(Q,$);if(Y.length===0)throw new l(`No worker for machine "${$}" on this computer.`);let V=!1;for(let N of Y)if(await h9(N.config,N.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${N.config.workspaceRoot}.
 `);else V=!0,J.stderr.write(`Reason: machine "${$}" in ${N.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
-`);return V?1:0}async function DF($={}){let J=X$($.home??H0()),Z=A0(F0(g0(J,$.channel??Z$()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??K0)(Z,"status").catch((q)=>{return Q=q instanceof Error?q:Error(String(q)),null}),Y=X?P1(Z):null,V=$.serviceHost??Q$(J),N=H1(Z,V,"connect"),B=$0(Z).revoked,U=!B&&!X,M=(()=>{try{return o(Z)}catch{return null}})(),{workspaces:G,off:H}=B||d0(Z.stateDirectory)!==null?{workspaces:null,off:null}:M4(Z,X?.phase==="running");return{workspaces:G,workspaces_off:H,workspaces_max:Y2+(G?.filter((q)=>q.account).length??0),name:Z.name,device_id:M?.deviceId??null,organization_id:M?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:null,user_chrome:m9(Z,V.platform),cloud_sessions:Z.cloudSessions===!0,root:M?.roots[0]?{id:M.roots[0].id,permissions:M.roots[0].permissions}:null,roots:M?.roots.map((q)=>({id:q.id,folder:q.path,permissions:q.permissions}))??[],state:B?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:U?g4(Z,Q):null,worker_alive:U&&N?b9(N,V):null,sessions_running:X?.activeSessions??null,version:Y,service:N?{label:N.label,logs:N.logs}:null}}async function WF($,J,Z=K0){let Q={version:1,status:"unavailable"},X=A0(F0(g0(X$($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?C6({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function OF($={}){try{let J=X$($.home??H0());return A0(F0(g0(J,$.channel??Z$()),"worker.json"))?.userChrome!==!1}catch{return!1}}function zF($={}){let J=X$($.home??H0()),Z=A0(F0(g0(J,$.channel??Z$()),"worker.json"));if(!Z)return null;return M$(Z,$.serviceHost??Q$(J),"connect")?.label??null}async function AF($={}){let J=X$($.home??H0()),Z=A0(F0(g0(J,$.channel??Z$()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??Q$(J),X=await M6(Z,Q,"connect",$.current);if(X!==null||H1(Z,Q,"connect"))return X;return FG(Z,Q,$)}async function FG($,J,Z){let Q=Z.controlWorker??K0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&P1($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let V;try{V=U1(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await Q($,"status").catch(()=>null)!==null)await new Promise((G)=>setTimeout(G,250));let{REASON_INSTALLER:B,REASON_DESKTOP_BACKGROUND:U,...M}=Z.env??process.env;return(Z.startConnection??n6)(V,M,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
-export{d as a,o as b,M2 as c,A0 as d,eV as e,$G as f,g0 as g,TF as h,LF as i,FF as j,_F as k,jF as l,DF as m,WF as n,OF as o,zF as p,AF as q};
+`);return V?1:0}async function AF($={}){let J=X$($.home??H0()),Z=A0(F0(g0(J,$.channel??Z$()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??K0)(Z,"status").catch((q)=>{return Q=q instanceof Error?q:Error(String(q)),null}),Y=X?P1(Z):null,V=$.serviceHost??Q$(J),N=H1(Z,V,"connect"),B=$0(Z).revoked,U=!B&&!X,M=(()=>{try{return o(Z)}catch{return null}})(),{workspaces:G,off:H}=B||d0(Z.stateDirectory)!==null?{workspaces:null,off:null}:M4(Z,X?.phase==="running");return{workspaces:G,workspaces_off:H,workspaces_max:Y2+(G?.filter((q)=>q.account).length??0),name:Z.name,device_id:M?.deviceId??null,organization_id:M?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:null,user_chrome:m9(Z,V.platform),cloud_sessions:Z.cloudSessions===!0,root:M?.roots[0]?{id:M.roots[0].id,permissions:M.roots[0].permissions}:null,roots:M?.roots.map((q)=>({id:q.id,folder:q.path,permissions:q.permissions}))??[],state:B?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:U?g4(Z,Q):null,worker_alive:U&&N?b9(N,V):null,sessions_running:X?.activeSessions??null,version:Y,service:N?{label:N.label,logs:N.logs}:null}}async function RF($,J,Z=K0){let Q={version:1,status:"unavailable"},X=A0(F0(g0(X$($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?x6({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function PF($={}){try{let J=X$($.home??H0());return A0(F0(g0(J,$.channel??Z$()),"worker.json"))?.userChrome!==!1}catch{return!1}}function IF($={}){let J=X$($.home??H0()),Z=A0(F0(g0(J,$.channel??Z$()),"worker.json"));if(!Z)return null;return M$(Z,$.serviceHost??Q$(J),"connect")?.label??null}async function CF($={}){let J=X$($.home??H0()),Z=A0(F0(g0(J,$.channel??Z$()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??Q$(J),X=await L6(Z,Q,"connect",$.current);if(X!==null||H1(Z,Q,"connect"))return X;return DG(Z,Q,$)}async function DG($,J,Z){let Q=Z.controlWorker??K0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&P1($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let V;try{V=U1(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await Q($,"status").catch(()=>null)!==null)await new Promise((G)=>setTimeout(G,250));let{REASON_INSTALLER:B,REASON_DESKTOP_BACKGROUND:U,...M}=Z.env??process.env;return(Z.startConnection??r6)(V,M,F0($.stateDirectory,"connect.log")),{state:"restarted"}}
+export{d as a,o as b,M2 as c,A0 as d,ZG as e,QG as f,g0 as g,jF as h,DF as i,WF as j,OF as k,zF as l,AF as m,RF as n,PF as o,IF as p,CF as q};