@reason-machines/cli-linux-x64 0.2.407 → 0.2.410

package/bin/vm-hands/vm-hands-entry-lite-32ch1nr1.js

@@ -1,346 +0,0 @@
-// @bun
-import{r as m0}from"./vm-hands-entry-lite-wa261sf8.js";import{v as $2,x as n6,y as t9}from"./vm-hands-entry-lite-h9t84ekh.js";import{A as K2,B as i6,C as V4,D as G4,E as R6,F as v0,J as P6,K as I$}from"./vm-hands-entry-lite-g5c9ec33.js";import{X as a2,qa as Z$,ta as s1,va as RJ}from"./vm-hands-entry-lite-mxdztdmq.js";import{Da as $J,Ea as JJ,Fa as V8,Ga as G8,Ha as mJ,Ia as gJ,Ja as A9,Ka as Z5,La as U8,Ma as L0,Na as S1,Oa as b1,Pa as I0,Qa as c1,Ra as X5,Sa as R5,Ta as l3,Ua as N5,Ya as H5,fb as pJ,gb as lJ,hb as cJ,ib as sJ,jb as P9}from"./vm-hands-entry-lite-tkb2b6x8.js";import{$b as z1,Bb as h8,Gb as g8,Hb as u8,Ib as B8,Jb as K8,Kb as wJ,Lb as yJ,Nb as j8,Ob as hJ,Pb as L1,Sb as Q3,Tb as X3,Ub as p6,Vb as l6,Wb as c6,Xb as b0,Yb as $0,Zb as g,_b as R9,ac as e1,bc as K0,cc as fJ,hc as W5,jc as f4,lb as U6,mc as b2,ob as P8,oc as J5,pb as C8,pc as J9,rc as d8,sb as o8,tb as I8,wb as _8,xc as vJ,yb as k8,yc as t3}from"./vm-hands-entry-lite-va3vbvsk.js";import{Ac as g9,Bc as Q5,Cc as h1,Dc as s6,Gc as N8,zc as m9}from"./vm-hands-entry-lite-yg5h9mhm.js";import{Nc as $5}from"./vm-hands-entry-lite-69ray4x8.js";import{$c as m8,Tc as f8,Uc as v8}from"./vm-hands-entry-lite-jcd21jpm.js";import{ad as L$}from"./vm-hands-entry-lite-swwb5mp2.js";import{bd as u,cd as o,dd as s,ed as c}from"./vm-hands-entry-lite-5rkakg10.js";import{wd as Y8}from"./vm-hands-entry-lite-jw5y1aa5.js";import{Hd as V5,Kd as uJ,Nd as ZJ,Od as QJ}from"./vm-hands-entry-lite-vr4sva78.js";import{Rd as OJ,Sd as s$,Ud as V$,Vd as E$,Wd as T1,Yd as C6,Zd as r6,_d as t6,ae as F1,be as o6,ce as u9,de as e6,ee as e2,fe as G$,ge as x4,he as $3}from"./vm-hands-entry-lite-r6f6qkw6.js";import{If as D6,Jf as e$,Ne as W2,Re as SJ,Se as bJ,Tf as G2,yf as X8}from"./vm-hands-entry-lite-ky0w7t09.js";import{eg as a6,fg as l2,ig as dJ,lg as v1,ng as F7,og as _7,tg as U5}from"./vm-hands-entry-lite-q590arx5.js";import{xg as p8}from"./vm-hands-entry-lite-1sc3wc94.js";import{Ig as V0,Jg as Y2,Kg as nJ,Lg as rJ,Mg as o$,Ng as F3,Og as I2,Pg as L4,Rg as E2,Sg as k$,Tg as h0,Ug as $1,Vg as x2,Yg as h$}from"./vm-hands-entry-lite-yqrmr2c8.js";import{$g as a1,ah as e8}from"./vm-hands-entry-lite-9vf97byd.js";import{gh as y8}from"./vm-hands-entry-lite-mapxp682.js";import{Bi as R$,Ci as C0,Di as $4,Ei as g6,Fi as u6,Hi as _2,Ii as d6,Ji as W9,Ki as I4,Li as E4,Mi as J1,xi as Y$}from"./vm-hands-entry-lite-q4tcfj61.js";import{Ni as l1,Oi as C1}from"./vm-hands-entry-lite-fbpxs065.js";import{kj as k6,sj as Y5,tj as O9,vj as H8}from"./vm-hands-entry-lite-4bgxq9ps.js";import{xj as U0,zj as WJ}from"./vm-hands-entry-lite-hye6r7dy.js";import{Xj as r}from"./vm-hands-entry-lite-f6714myc.js";import{uk as K}from"./vm-hands-entry-lite-vr38bh6k.js";import{xk as kJ}from"./vm-hands-entry-lite-r2xmr627.js";import{Ck as t8,Ek as V1,Ik as DJ,Jk as z8,Kk as A8,Lk as R8}from"./vm-hands-entry-lite-8gjrr6hg.js";import{Rk as f0}from"./vm-hands-entry-lite-40nkzw38.js";import{Xk as WG}from"./vm-hands-entry-lite-72nn2b4n.js";import{spawn as $7,spawnSync as OG}from"child_process";import{closeSync as J7,existsSync as zG,mkdirSync as AG,openSync as Z7,readdirSync as RG,realpathSync as B$,rmSync as j1}from"fs";import{hostname as PG}from"os";import{dirname as d9,join as T0,resolve as CG}from"path";import{createHash as D7}from"crypto";import{unlinkSync as W7}from"fs";import{platform as O7}from"os";import{join as z7}from"path";var o9=K.discriminatedUnion("store",[K.strictObject({version:K.literal(1),store:K.literal("keychain")}),K.strictObject({version:K.literal(1),store:K.literal("file"),api_key:K.string().min(1).max(4096)})]),y$=($)=>z7($,"api-key.json");function W$($){let J=D7("sha256").update(`reason-connect-api-key
-${$}`).digest("hex");return new o$(Y2(),O7(),J)}function L3($,J,Z=W$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(y$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof V0))throw Q}c(y$($),{version:1,store:"file",api_key:J})}function p0($,J=W$($)){if(!u(y$($)))return null;let Z=o9.parse(JSON.parse(s(y$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof V0))throw Q;throw Error("worker_api_key_unreadable")}}function e9($,J=W$($)){if(!u(y$($)))return;if(o9.parse(JSON.parse(s(y$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof V0))throw Z}W7(y$($))}async function T3($,J){let Z;try{Z=await t9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:b0($.proxy)})}catch(Q){if(Q instanceof v0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as d7,renameSync as p7,rmSync as f$}from"fs";import{join as N0}from"path";import{createHash as A7}from"crypto";import{realpathSync as R7,statSync as P7,unlinkSync as V2}from"fs";import{platform as C7}from"os";import{join as w0}from"path";function d($){return{state:w0(g($),"device.json"),control:w0(g($),"control.json"),lock:w0(g($),"lifecycle.lock"),socket:w0(g($),"control.sock"),daemon:w0(g($),"daemon.json"),releaseCheck:w0(g($),"release-check.json"),updateDeferral:w0(g($),"update-deferral.json"),firstHeartbeat:w0(g($),"first-heartbeat.json")}}var I7=K.object({version:K.literal(1),device_id:K.string().min(1).max(160),offer:K.unknown().optional(),enrollment_ms:K.number().int().nonnegative().max(e$).optional()});function J4($,J,Z){o(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function _3($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=I7.safeParse(JSON.parse(s(Z)));if(V2(Z),!Q.success||Q.data.device_id!==J)return null;let X=G2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function M0($,J=!1){o(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=w0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?j3($):new F3(g($))}function B2($,J){M0($,!0),S7($);let Z=J??j3($),Q=new F3(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof V0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function j3($){return new o$(Y2(),C7(),E7($))}function E7($){let J=D3($);return A7("sha256").update(`reason-worker
-${J?.directory??g($)}`).digest("hex")}function A1($,J){c(w0(g($),R1),{version:1,directory:D3($)?.directory??g($),devicePublicKey:J})}var R1="keychain-scope.json";function Z4($){return u(w0(g($),R1))}var x7=K.strictObject({version:K.literal(1),directory:K.string().min(1),devicePublicKey:K.string().min(1)});function D3($){let J=w0(g($),R1);if(!u(J))return null;let Z=x7.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function S7($){let J=w0(g($),R1);if(!u(J))return;if(D3($))try{let Z=j3($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof V0))throw Z}V2(J)}function H$($){let J=R7($.workspaceRoot);if(J!==$.workspaceRoot||!P7(J).isDirectory()||!z1(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=k$(d($).state,{proofStore:M0($),repair:!1}),Z=J!==null&&$4($.apiOrigin,J.apiOrigin),Q=Z?[K0($),K0({...$,apiOrigin:J.apiOrigin})]:[K0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var Q4=K.strictObject({version:K.literal(1),drained:K.boolean(),revoked:K.boolean()});function e($){let J=d($).control;return u(J)?Q4.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function P0($,J){c(d($).control,Q4.parse(J))}function y0($){let J=M0($);J.deleteBinding(),J.deleteKey();let Z=w0(g($),R1);if(u(Z))V2(Z);let Q=d($).state;if(u(Q))V2(Q)}var b7=K.strictObject({read:K.boolean(),write:K.boolean(),execute:K.boolean(),discover_environment:K.boolean(),expose_mcp:K.literal(!1)}),W3=K.strictObject({version:K.literal(1),organization_id:K.string().min(1).max(160),enrollment_ticket:K.string().min(1).max(4096),code_verifier:K.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/),root:K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),permissions:b7,execution_mode:K.enum(["confined","host"]).default("confined")}),folders:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),w7=K.object({device_id:K.string().min(1).max(160),organization_id:K.string().min(1).max(160),auth_scheme:K.literal("p256"),protocol_version:K.literal(2),roots:K.array(K.object({id:K.string().min(1),label:K.string(),path_fingerprint:K.string()})).min(1).max(32),headless:K.object({lifecycle:K.enum(["persistent","ephemeral"]),expires_at:K.iso.datetime({offset:!0})}),first_heartbeat:K.unknown().optional()}),O3=30000;class $$ extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function y7($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(O3)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new $$(X?.error==="device_revoked")}return Q.json()}async function z3($,J,Z,Q){m0();let X=W3.parse(JSON.parse(s(J)));return J$($,X,Z,Q)}async function J$($,J,Z,Q=(Y,V)=>y7(Y,V,b0($.proxy)),X=performance.now()){let Y=Y4($,J,Z),V=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(V,X)}async function X4($,J,Z,Q,X=performance.now()){let Y=Y4($,J,Z),V=await Q(Y.request,J.code_verifier);return V===null?null:Y.receipt(V,X)}function Y4($,J,Z){if(m0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=h$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((G,H)=>{let M=h$([G],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(M.path!==G||M.pathFingerprint!==J.folders?.[H]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return M});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],V;try{V=Z.loadPublicKey()}catch{V=Z.createFreshPublicKey()}return{request:{device_public_key:V,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:J.root.permissions}))},receipt(G,H){let M=w7.parse(G);if(M.organization_id!==J.organization_id||M.roots.length!==Y.length||M.roots.some((B,q)=>B.path_fingerprint!==Y[q].pathFingerprint)||M.headless.lifecycle!==$.lifetime||Date.parse(M.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let U=G2(M.first_heartbeat);try{J4($,M.device_id,{...U?{offer:U}:{},enrollmentMs:Math.min(e$,Math.max(0,Math.round(performance.now()-H)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:M.organization_id,deviceId:M.device_id,devicePublicKey:V,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:K0($),lifetime:$.lifetime,expiresAt:M.headless.expires_at},roots:M.roots.map((B,q)=>({id:B.id,label:B.label,path:Y[q].path,pathFingerprint:B.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as k7,randomUUID as h7}from"crypto";import{unlinkSync as f7}from"fs";import{join as v7}from"path";var B4=K.strictObject({version:K.literal(1),install_id:K.uuid(),fingerprint_key:K.string().regex(/^[a-f0-9]{64}$/)}),m7=K.object({enrollment_ticket:K.string().min(1).max(4096),expires_at:K.iso.datetime({offset:!0}),device_kind:K.literal("headless"),lifecycle:K.enum(["persistent","ephemeral"]),device_expires_at:K.iso.datetime({offset:!0})});function A3($){return m7.parse($)}var g7=K.object({credentialKind:K.enum(["oauth","api_key"]).optional(),apiOrigin:K.url(),clientId:K.string(),accessToken:K.string().min(1).max(32768),refreshToken:K.string().max(32768),expiresAt:K.iso.datetime({offset:!0}),scopes:K.array(K.string().max(128)).max(128),orgId:K.string().min(1).max(160)});function O$($){return K2(C1("REASON_CLI_CHANNEL",$.channel),U0())}async function z$($,J=O$($)){if(!u(J))return null;let Z=g7.parse(JSON.parse(s(J)));if(!C0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=b0($.proxy),X=Object.assign((V,N)=>Q(V,{...N,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await G4({path:J,fetchImpl:X});if(Y&&!C0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function K4($,J,Z){if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function U4($,J,Z,Q,X){let Y=performance.now();if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=A$($),N=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(N){let G=await X4($,V.direct(J.orgId),Q,(H,M)=>N({approval:V.request,code_verifier:M,registration:H}).catch((U)=>{throw u7(U)}),Y);if(G)return G}return J$($,V.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(V.request)),Q,X,Y)}function u7($){if(!($ instanceof v0))return $;if($.status===409)return new $$($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new $$(!1);return $}var P1=($)=>v7(g($),"enrollment-install.json");function N4($){if(u(P1($)))f7(P1($))}function A$($,{stored:J=!0}={}){m0();let Z=P1($),Q=J&&u(Z)?B4.parse(JSON.parse(s(Z))):{version:1,install_id:h7(),fingerprint_key:k7(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),V=h$([$.workspaceRoot],X,Y)[0];if(V.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let N=($.folders??[]).map((U)=>{let B=h$([U],X,Y)[0];if(B.path!==U)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:B.pathFingerprint}}),G=V4(),H={install_id:Q.install_id,code_challenge:G.challenge,lifecycle:$.lifetime,roots:[V.pathFingerprint,...N.map((U)=>U.path_fingerprint)].map((U)=>({path_fingerprint:U,permissions:X,execution_mode:$.executionMode}))},M=(U)=>({version:1,organization_id:U,code_verifier:G.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:V.pathFingerprint,permissions:X,execution_mode:$.executionMode},...N.length?{folders:N}:{}});return{request:H,saveInstall(U){o(g(U),!0),c(P1(U),Q)},complete(U,B){let q=A3(B);if(q.lifecycle!==$.lifetime||Date.parse(q.expires_at)<=Date.now()||Date.parse(q.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...M(U),enrollment_ticket:q.enrollment_ticket}},direct:M}}function H4($,J,Z){let Q=P1($);if(!u(Q))throw Error("worker_folders_unavailable");let X=B4.parse(JSON.parse(s(Q)));return h$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var U2=8,T4=600000,F4=15000,q4=new Set(["device_revoked","invalid_device_credential"]),N2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,q$=($)=>N0(g($),"workspaces"),_4="account.json",R3=($)=>u(N0($,_4));function k0($){let J;try{J=d7(q$($))}catch{return[]}return J.filter((Z)=>N2.test(Z)).sort().map((Z)=>{let Q=N0(q$($),Z),X=N0(Q,"worker.json"),Y=null;try{let V=$0.safeParse(JSON.parse(s(X)));if(V.success&&V.data.stateDirectory===Q)Y=V.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:R3(Q)}})}function H2($,J){let Z=J.toLowerCase();if(!N2.test(Z))throw Error("worker_workspace_id_invalid");let Q=$0.parse({...$,stateDirectory:N0(q$($),Z)});return o(Q.stateDirectory,!0),c(N0(Q.stateDirectory,_4),{version:1}),{config:Q,configPath:N0(Q.stateDirectory,"worker.json")}}function q2($,J){try{let{config:Z,configPath:Q}=H2($,J);o(g(Z),!0),P0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function I1($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||k0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var P3=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function M4($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");A1($,Z.devicePublicKey),o(g(J),!0);for(let Y of P3)f$(N0(g(J),Y),{force:!0});for(let Y of P3){let V=N0(g($),Y);if(u(V))p7(V,N0(g(J),Y))}let Q=M0(J),X=k$(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");h0({...X,worker:{...X.worker,configDigest:K0(J)}},d(J).state,{proofStore:Q})}function C3($){for(let J of k0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))y0(J.config)}catch{}f$(J.directory,{recursive:!0,force:!0})}f$(E3($),{force:!0})}function M2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(U)=>Number(Date.parse(U.worker?.expiresAt??"")>X+60000),N=k0($).flatMap((U)=>{if(!U.account||!U.config)return[];try{if(e(U.config).revoked)return[];let B=t(U.config);return B&&B.orgId.toLowerCase()===U.organizationId&&(!Q||Y(B))?[{...U,config:U.config,state:B}]:[]}catch{return[]}}).sort((U,B)=>Number(B.organizationId===J)-Number(U.organizationId===J)||Y(B.state)-Y(U.state))[0];if(!N)return null;let G=null;try{G=e($).revoked?null:t($)}catch{}let H=G?.orgId.toLowerCase()??"";if(Z&&G&&N2.test(H)&&H!==N.organizationId){let U=H2($,H);M4($,U.config),c(U.configPath,U.config)}else if(u(g($))){try{if(u(d($).state))y0($)}catch{}for(let U of P3)f$(N0(g($),U),{force:!0})}C3($);let M=$0.parse({...N.config,stateDirectory:$.stateDirectory});return M4(N.config,M),c(N0($.stateDirectory,"worker.json"),M),f$(N.directory,{recursive:!0,force:!0}),M}var I3={before($){for(let{config:J}of k0($))try{let Z=J?t(J):null;if(J&&Z)A1(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of k0(J)){if(Y)continue;try{let V=$0.parse(JSON.parse(s(X)));if(V.stateDirectory!==N0(q$($),Z))continue;let N=$0.parse({...V,stateDirectory:Q}),G=M0(N),H=k$(d(N).state,{proofStore:G,repair:!1});if(H?.worker?.configDigest===K0(V))h0({...H,worker:{...H.worker,configDigest:K0(N)}},d(N).state,{proofStore:G});c(X,N)}catch{}}}},E3=($)=>N0(q$($),"listed.json");function j4($){try{let J=JSON.parse(s(E3($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function D4($,J){let Z=k0($),Q=Z.filter((G)=>G.account),X=Z.filter((G)=>!G.account),Y=j4($),V=Y&&!Y.listed?Y.reason:null,N=V||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&N.length===0&&(V||Y&&!Y.listed))return{workspaces:null,off:V};return{off:V,workspaces:[...Q,...N].map(({organizationId:G,config:H,account:M})=>{let U=!1,B=null,q=!1,L=null;try{U=H?e(H).revoked:!1,B=H&&!U?t(H):null;let T=H?$1(d(H).daemon):null;q=J&&!!B&&T?.state==="connected",L=q?L4(T,B):null}catch{}return{...L?{permission_recovery:L}:{},organization_id:G,device_id:B?.deviceId??null,name:Y?.names?.[G]??null,root:B?.roots[0]?{id:B.roots[0].id,permissions:B.roots[0].permissions}:null,state:U?"removed":q?"connected":"not_running",blocked:!M&&!U&&!q&&(Y?.blocked.includes(G)??!1),...M?{account:!0}:{}}})}}function W4($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),V=new Map,N=null,G=!1,H=j4(J)??{listed:!1,reason:null,blocked:[]},M=(j)=>{let{folders:D,...R}=J,I=Z.roots.slice(1).map((P)=>P.path);return $0.parse({...R,...I.length?{folders:I}:{},stateDirectory:N0(q$(J),j)})},U=async(j)=>{let D=V.get(j);if(!D)return;D.controller.abort(),await D.done},B=(j,D=!1)=>{let R=new AbortController,I=()=>R.abort();if(X.addEventListener("abort",I,{once:!0}),X.aborted)R.abort();let P={...j,controller:R,claims:0,done:Promise.resolve(),account:D};P.done=$.serve(j,R.signal,(C)=>{P.claims=C}).then(()=>{return},(C)=>{if(D&&C instanceof L0&&C.status===401&&q4.has(C.code)){try{P0(j.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${j.organizationId} (another account's) no longer accepts this computer (${C.code}); run \`reason connect\` signed in as that account to connect it again
-`)}else if(C instanceof L0&&C.status===401&&q4.has(C.code)){try{y0(j.config)}catch{}Y(`Reason worker: workspace ${j.organizationId} no longer accepts this computer
-`)}else if(!R.signal.aborted)Y(`Reason worker: workspace ${j.organizationId} stopped (worker_workspace_failed); it starts again on the next check
-`)}).finally(()=>{if(R.abort(),X.removeEventListener("abort",I),P.claims=0,V.get(j.organizationId)===P)V.delete(j.organizationId);let C=j.config.stateDirectory;if(D&&!R3(C)&&!u(N0(C,"worker.json")))f$(C,{recursive:!0,force:!0})}),V.set(j.organizationId,P)},q=(j,D)=>{if(!D)return null;try{let R=M(j),I=t(D);if(!I||I.orgId!==j||Date.parse(I.worker?.expiresAt??"")<=Date.now()+60000||D.name!==R.name||D.executionMode!==R.executionMode||!C0(D.apiOrigin,R.apiOrigin)||I.roots.map((P)=>P.path).join(`
-`)!==Z.roots.map((P)=>P.path).join(`
-`))return null;return{organizationId:j,config:D,state:I,proofStore:M0(D)}}catch{return null}},L=(j,D)=>{if(!D)return null;try{if(e(D).revoked)return null;let R=t(D);if(!R||R.orgId.toLowerCase()!==j||Date.parse(R.worker?.expiresAt??"")<=Date.now()+60000||D.executionMode!==J.executionMode||!C0(D.apiOrigin,J.apiOrigin))return null;return{organizationId:j,config:D,state:R,proofStore:M0(D)}}catch{return null}},T=(j,D)=>j.deviceId===D.deviceId&&j.devicePublicKey===D.devicePublicKey&&JSON.stringify(j.roots.map((R)=>[R.id,R.path]))===JSON.stringify(D.roots.map((R)=>[R.id,R.path])),_=async(j)=>{for(let[D,R]of j){if(X.aborted)return;let I=V.get(D),P=L(D,R.config);if(I&&P&&T(I.state,P.state))continue;if(I){if(I.claims>0)continue;await U(D)}if(P&&!X.aborted)B(P,!0)}for(let[D,R]of V)if(R.account&&!j.has(D)&&R.claims===0)await U(D)},W=async(j)=>{let D=M(j),R=$0.parse({...D,stateDirectory:J.stateDirectory});if(!u(N0(g(J),"enrollment-install.json")))return null;let I=A$(R),P=await Q.ownerWorkspaceEnrollment(Z,{organization_id:j,install_id:I.request.install_id,code_challenge:I.request.code_challenge},X),C=I.complete(j,P);if(o(g(D),!0),u(d(D).state))y0(D);let f=B2(D);try{let S=await J$(D,C,f,$.enroll);return h0(S,d(D).state,{proofStore:f}),P0(D,{version:1,drained:!1,revoked:!1}),c(N0(D.stateDirectory,"worker.json"),D),{organizationId:j,config:D,state:S,proofStore:f}}catch(S){if(S instanceof $$&&S.deviceRemoved)return P0(D,{version:1,drained:!0,revoked:!0}),c(N0(D.stateDirectory,"worker.json"),D),null;throw S}},O=async()=>{let j=k0(J),D=new Map(j.filter((A)=>A.account).map((A)=>[A.organizationId,A]));await _(D);let R=new Map(j.filter((A)=>!A.account).map((A)=>[A.organizationId,A])),I=(A)=>D.has(A)||V.get(A)?.account===!0||R3(N0(q$(J),A)),P=(A)=>{let k=R.get(A)?.config;try{return k?e(k).revoked:!1}catch{return!1}};for(let[A,k]of R){if(V.has(A)||P(A)||H.blocked.includes(A))continue;let y=q(A,k.config);if(y&&!X.aborted)B(y)}let C;try{C=await Q.ownerWorkspaces(Z,X)}catch(A){return H={listed:!1,blocked:H.blocked,...H.names?{names:H.names}:{},reason:A instanceof L0&&A.status===403&&A.code==="sign_in_not_eligible"?"sign_in":null},!1}let f=new Map(C.map((A)=>[A.id.toLowerCase(),A.blocked]).filter(([A])=>N2.test(A)&&A!==Z.orgId.toLowerCase()&&!I(A))),S=[...f.keys()].filter((A)=>R.has(A)?!P(A):!f.get(A)).slice(0,U2),h=[...V.values()].filter((A)=>!A.account&&A.claims>0&&!S.includes(A.organizationId)).length,p=S.filter((A)=>!R.has(A)),b=p.slice(p.length-Math.min(Math.max(0,S.length+h-U2),p.length)),x=S.filter((A)=>!b.includes(A)),E=Object.fromEntries(C.flatMap((A)=>A.name&&x.includes(A.id.toLowerCase())?[[A.id.toLowerCase(),A.name]]:[]));H={listed:!0,reason:null,blocked:x.filter((A)=>f.get(A)),names:E};for(let A of new Set([...R.keys(),...V.keys()])){if(x.includes(A)||I(A))continue;if(f.has(A)&&P(A))continue;if((V.get(A)?.claims??0)>0)continue;await U(A);let k=R.get(A)?.config;try{if(k&&u(d(k).state))y0(k)}catch{}f$(N0(q$(J),A),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${A}
-`)}for(let A of x){if(X.aborted)return!0;if(I(A))continue;try{let k=V.get(A);if(f.get(A)){if(k&&k.claims===0)await U(A),Y(`Reason worker: offline in workspace ${A} (outside its allowed networks)
-`);continue}let y=q(A,R.get(A)?.config??null);if(y&&k)continue;if(!y){if(k&&k.claims>0)continue;if(await U(A),y=await W(A),y)Y(`Reason worker: connected in workspace ${A}
-`)}if(y&&!X.aborted)B(y)}catch{Y(`Reason worker: could not connect in workspace ${A} (worker_workspace_failed); it is tried again
-`)}}return!0},F=null,z=async()=>{let j=!1;do G=!1,j=await O().catch(()=>!1);while(G&&!X.aborted);let D=JSON.stringify({version:1,...H});if(F!==D)try{o(q$(J),!0),c(E3(J),JSON.parse(D)),F=D}catch{}return j};return{check(){if(N)G=!0;else N=z().finally(()=>{N=null});return N},claims:()=>[...V.values()].reduce((j,D)=>j+D.claims,0),async settled(){await N,await Promise.all([...V.values()].map((j)=>j.done))}}}import{dirname as l7}from"path";function A4($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!c7($.saved))return J;let Z=$.saved,Q=(V,N)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:V,...N?{code:`worker_api_origin_move_${V}:${N}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?J1():$.native;if(!X)return J;let Y=[];try{let V=X.lock(l7($.configPath));if(!V)return J;if(Y.push(V),u(g(Z))){let M=Z$({path:d(Z).lock,runtimeVersion:r});if(!M.acquired)return J;Y.push(()=>M.release())}let N=$0.parse(JSON.parse(s($.configPath)));if(N.stateDirectory!==Z.stateDirectory)return J;let G=R4(N),H={saved:N,configPath:$.configPath};if(!L2(N)&&G.length===0)return Q("unchanged"),H;if(L2(N)){let M=O4(N);c($.configPath,M),H={saved:M,configPath:$.configPath}}for(let M of G)try{c(M.configPath,O4(M.config))}catch(U){Q("failed",`workspace:${z4(U)}`)}return Q("moved"),H}catch(V){return Q("failed",z4(V)),J}finally{for(let V of Y.reverse())V()}}function L2($){return R$($.apiOrigin)!==$.apiOrigin}function R4($){return k0($).filter((J)=>J.config!==null&&L2(J.config))}function c7($){return L2($)||R4($).length>0}function O4($){let J=$0.parse({...$,apiOrigin:R$($.apiOrigin)}),Z=t($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=K0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)h0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},d(J).state,{proofStore:M0(J)});return J}function z4($){if($ instanceof V0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as s7,lstatSync as b3,readdirSync as S4,readlinkSync as a7,unlinkSync as i7}from"fs";import{join as O0,sep as n7}from"path";var T2="rehome.json";class F2 extends Error{code;constructor($){super($);this.code=$}}function b4($){let J={saved:$.saved,configPath:$.configPath},Z=O0($.home,".config"),Q=O0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=O0(Q,...X),V=O0(Z,"reason",...X),N=(U,B)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:U,...B?{code:`worker_state_rehome_${U}:${B}`}:{},timestamp:new Date().toISOString()})),G=$.native===void 0?J1():$.native,H=$.saved,M=[];try{if(H&&C4(Q)&&H.stateDirectory===Y){let W={...H,stateDirectory:V};if(!x3(G,V,W,M))return J;return P4(H,W,$.host,N)}if(H&&C4(Q)&&H.stateDirectory===V&&Z4(H)&&x3(G,V,H,M))return w4({...H,stateDirectory:Y},H,$.host),J;if(!H||H.lifetime!=="persistent"||H.stateDirectory!==Y||!Z1(Q)?.isDirectory())return J;if(JZ(Y)===r)return J;let B=(W,O=!0)=>{if(O)c(O0(Y,T2),{version:r});return N("skipped",W),J},q=[Y];for(let W of t7(Q,Y)){if(W.config?.lifetime!=="ephemeral")return B("several_connections");if(!r7(W.directory,W.config,M))return B("once_running",!1);q.push(W.directory)}if(!G)return B("config_rename_unavailable:no_native");if(!x3(G,Y,H,M))return J;let L=t(H);if(!L||e(H).revoked)return J;if(I4(Z)!==null)return B("conflicting_identity");if(E4(Z)!==null)return B("conflicting_files");if(Z1(V)&&(!Z1(V).isDirectory()||S4(V).length>0))return B("connection_folder_taken");A1(H,L.devicePublicKey),I3.before(H);let T=p0(Y);if(T&&S3(Y))o7(V,T);let _=_2(Z,G,q);if(_.state!=="renamed"&&_.state!=="linked"){if(T&&S3(Y))y4(V);return B(_.problem??"config_folder_kept")}return P4(H,{...H,stateDirectory:V},$.host,N)}catch(U){try{if(Z1(Y)?.isDirectory())c(O0(Y,T2),{version:r})}catch{}return N("failed",ZZ(U)),$Z(H,Y,V,J)}finally{for(let U of M.reverse())U()}}function P4($,J,Z,Q){let X=b3(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)s7(J.stateDirectory,448);let Y=M0(J),V=k$(d(J).state,{proofStore:Y,repair:!1});if(!V?.worker)throw new F2("identity_missing");let N=K0(J);if(V.worker.configDigest===K0($))h0({...V,worker:{...V.worker,configDigest:N}},d(J).state,{proofStore:Y});else if(V.worker.configDigest!==N)throw new F2("worker_config_binding_mismatch");c(O0(J.stateDirectory,"worker.json"),J),I3.after($,J),w4($,J,Z);let G=O0(J.stateDirectory,T2);if(u(G))i7(G);return Q("moved"),{saved:J,configPath:O0(J.stateDirectory,"worker.json")}}function w4($,J,Z){if(x4($,J,Z,"connect"),!S3(J.stateDirectory))return;let Q=e7(W$($.stateDirectory));if(!Q)return;let X=W$(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);y4($.stateDirectory)}function x3($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!u(g(Z)))return!0;let X=Z$({path:d(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function r7($,J,Z){if(u(g(J))){let X=Z$({path:d(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=Z1(O0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function t7($,J){let Z=[$,...S4($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>O0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let V=O0(X,Y);if(V===J||!Z1(O0(V,"worker.json")))continue;let N=k4(V);if(!N||N.stateDirectory===$||N.stateDirectory.startsWith($+n7))Q.push({directory:V,config:N})}return Q}function S3($){try{return JSON.parse(s(O0($,"api-key.json"))).store==="keychain"}catch{return!1}}function o7($,J){let Z=W$($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function y4($){try{W$($).deleteBinding()}catch(J){if(!(J instanceof V0))throw J}}function e7($){try{return $.loadBinding()}catch(J){if(J instanceof V0)return null;throw J}}function $Z($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=k4(Z);return X?.stateDirectory===Z?{saved:X,configPath:O0(Z,"worker.json")}:Q}function C4($){try{return b3($).isSymbolicLink()&&a7($)==="reason"}catch{return!1}}function JZ($){try{let J=JSON.parse(s(O0($,T2)));return typeof J.version==="string"?J.version:null}catch{return null}}function k4($){try{let J=O0($,"worker.json");return u(J)?$0.parse(JSON.parse(s(J))):null}catch{return null}}function Z1($){try{return b3($)}catch{return null}}function ZZ($){if($ instanceof F2)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof V0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as QZ}from"fs";function j2($){try{let J=JSON.parse(QZ(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function h4($,J){c(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as oV}from"crypto";import{readdirSync as eV,realpathSync as b9,statSync as $G}from"fs";import{hostname as JG}from"os";import{join as i$,resolve as ZG}from"path";var D2="cloud",XZ=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function E1($){return XZ.test($)&&!f4.test($)}var YZ={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Q1($){return YZ[$]}import{randomUUID as VZ}from"crypto";import{chmodSync as GZ,lstatSync as O2,mkdtempSync as BZ,realpathSync as u4,rmdirSync as KZ,rmSync as UZ,unlinkSync as NZ}from"fs";import{createConnection as HZ,createServer as qZ}from"net";import{basename as v4,dirname as m4,join as v$}from"path";var MZ=K.enum(["status","drain","resume","stop","reload_roots"]),LZ=K.strictObject({version:K.literal(1),instanceId:K.string(),deviceId:K.string(),phase:K.enum(["starting","running","reconnecting","stopping"]),drained:K.boolean(),activeClaims:K.number().int().nonnegative(),activeSessions:K.number().int().nonnegative().optional(),executionEligible:K.boolean(),supportedOperations:K.array(K.enum(W2)).max(W2.length).optional(),capabilityReadiness:K.partialRecord(K.enum(W2),K.boolean()).optional(),lastHeartbeat:K.string().nullable(),expiresAt:K.string()}),TZ=K.strictObject({nonce:K.string(),action:MZ}),FZ=K.object({nonce:K.uuid()}),d4=K.strictObject({version:K.literal(1),nonce:K.uuid(),socketPath:K.string().max(100)});function p4($){return v$(d($).lock,"control.json")}function z2($){return o(d($).lock),FZ.parse(JSON.parse(s(v$(d($).lock,"owner.json"))))}function g4($){if(!u($))return!1;let J=O2($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function l4($,J){let Z=p4($);if(!u(Z)){let Y=d($).socket;if(!u(Y)||!O2(Y).isSocket())return null;return g4(Y)?Y:null}let Q=d4.parse(JSON.parse(s(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!_Z.test(Q.socketPath))throw Error("worker_control_endpoint_invalid");return Q.socketPath}let X=m4(Q.socketPath);if(m4(X)!==u4("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(v4(X))||v4(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(X))return null;return o(X),g4(Q.socketPath)?Q.socketPath:null}var _Z=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;async function A2($,J,Z){if(z2($).nonce!==J)throw Error("worker_instance_changed");let Q=p4($);if(u(Q))throw Error("worker_control_already_serving");let X=process.platform==="win32",Y=X?null:BZ(v$(u4("/tmp"),"ara-worker-")),V=Y?v$(Y,"control.sock"):`\\\\.\\pipe\\reason-worker-${VZ()}`;if(Y)o(Y);if(Buffer.byteLength(V)>100)throw Error("worker_socket_path_too_long");let N=new Set,G=qZ((B)=>{N.add(B),B.once("close",()=>N.delete(B)),B.setTimeout(2000,()=>B.destroy());let q="",L=!1;B.on("error",()=>B.destroy()),B.on("data",(T)=>{if(L)return;if(q+=T.toString(),Buffer.byteLength(q)>4096){B.destroy();return}if(!q.includes(`
-`))return;L=!0;try{let _=TZ.parse(JSON.parse(q));if(_.nonce!==J){B.destroy();return}B.end(JSON.stringify(Z(_.action))+`
-`)}catch{B.destroy()}})});G.maxConnections=32;let H,M=!1,U=async()=>{if(M)return;M=!0;for(let B of N)B.destroy();if(await new Promise((B)=>G.close(()=>B())),H&&u(Q)){let B=O2(Q);if(B.isFile()&&B.dev===H.dev&&B.ino===H.ino)try{let q=d4.parse(JSON.parse(s(Q)));if(q.nonce===J&&q.socketPath===V)NZ(Q)}catch{}}try{if(Y)KZ(Y)}catch{}};try{if(await new Promise((B,q)=>{G.once("error",q),G.listen(V,()=>{if(!X)GZ(V,384);B()})}),z2($).nonce!==J)throw Error("worker_instance_changed");return c(Q,{version:1,nonce:J,socketPath:V}),H=O2(Q),U}catch(B){throw await U(),B}}function c4($,J){try{let Z=JSON.parse(s(v$(d($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function x1($){return c4($,"runtime_version")}function jZ($){return c4($,"nonce")}function s4($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(v$(d($).lock,"owner.json")))return"no_lock";return l4($,z2($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var DZ=21600000,WZ=K.strictObject({instance:K.string().nullable(),since:K.number().int().nonnegative()});function OZ($,J){let Z=d($).updateDeferral;try{if(!u(Z))return null;let Q=WZ.safeParse(JSON.parse(s(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;w3($)}catch{}return null}function w3($){try{UZ(d($).updateDeferral,{force:!0})}catch{}}async function R2($,J,Z=()=>!1){let Q=jZ($),X=OZ($,Q);if(J!==void 0){let H=x1($);if(H===null||H===J&&X===null&&!Z())return{state:"current"}}let Y;try{let H=await B0($,"status");Y=H?H.activeSessions??H.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let V=Date.now(),N=X;if(N===null){N=V;try{c(d($).updateDeferral,{instance:Q,since:N})}catch{}}let G=V-N;return{state:G<DZ?"busy":"drained",sessions:Y,waitedMs:G}}async function B0($,J){let Z=d($);if(!u(v$(Z.lock,"owner.json")))return null;let Q=z2($),X=l4($,Q.nonce);if(!X)return null;return new Promise((Y,V)=>{let N=HZ(X),G="",H=!1,M=(U,B)=>{if(H)return;if(H=!0,N.destroy(),B)V(B);else Y(U)};N.setTimeout(2000,()=>N.destroy(Error("worker_control_timeout"))),N.on("connect",()=>N.write(JSON.stringify({nonce:Q.nonce,action:J})+`
-`)),N.on("data",(U)=>{if(G+=U.toString(),Buffer.byteLength(G)>16384)N.destroy(Error("worker_control_oversize"))}),N.on("error",(U)=>{if("code"in U&&["ECONNREFUSED","ENOENT"].includes(String(U.code)))M(null);else M(null,U.message==="worker_control_timeout"?U:Error("worker_control_unavailable"))}),N.on("end",()=>{try{let U=LZ.parse(JSON.parse(G));if(U.instanceId!==Q.nonce)throw Error("worker_instance_changed");M(U)}catch{M(null,Error("worker_control_invalid_response"))}}),N.once("close",()=>M(null,Error("worker_control_unavailable")))})}import{randomUUID as kY}from"crypto";import{homedir as CJ}from"os";import{spawn as zZ}from"child_process";import{createRequire as AZ}from"module";var a4=2147483648,RZ=1;function PZ(){try{let $=AZ(import.meta.url)("bun:ffi"),J=$.dlopen("kernel32.dll",{SetThreadExecutionState:{args:[$.FFIType.u32],returns:$.FFIType.u32}});return(Z)=>J.symbols.SetThreadExecutionState(Z)}catch{return null}}function CZ($,J){if($==="ac_only"||!J)return{status:"unsupported",release:async()=>"unsupported"};let Z=J((a4|RZ)>>>0)===0?"failed":"held";return{get status(){return Z},async release(){if(Z==="held")J(a4);return Z="failed","released"}}}async function i4($,J={}){let Z=J.platform??process.platform;if(Z==="win32")return CZ($,J.setExecutionState??PZ());if(Z!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Q,X="failed",Y=!1,V,N=Promise.resolve(),G=(B)=>{if(X===B)return;X=B,J.onStatusChange?.(B)},H=()=>{if(Y||V)return;V=setTimeout(()=>{V=void 0,N=M()},J.retryMs??5000),V.unref()},M=async()=>{try{let B=(J.spawn??zZ)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Q=B,B.once("exit",()=>{if(!Y&&Q===B)G("failed"),H()}),await new Promise((q,L)=>{B.once("spawn",q),B.once("error",L)}),B.exitCode===null&&B.signalCode===null)G("held")}catch{G("failed"),H()}};N=M(),await N;let U;return{get status(){return X},release(){return U??=(async()=>{Y=!0,clearTimeout(V),await N;let B=Q;if(!B||B.exitCode!==null||B.signalCode!==null||!B.pid)return X="failed","released";let q=await new Promise((L)=>{let T,_=setTimeout(()=>{try{B.kill("SIGKILL")}catch{}T=setTimeout(()=>L("failed"),1000)},1000);B.once("exit",()=>{clearTimeout(_),clearTimeout(T),L("released")});try{B.kill("SIGTERM")}catch{}});if(q==="released")X="failed";return q})()}}}class X1 extends Error{constructor(){super("Reason Device operation lease expired.")}}class P2{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new X1;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new X1;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new X1)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as bZ}from"fs";import{randomUUID as wZ}from"crypto";import{constants as y3}from"fs";import{open as IZ}from"fs/promises";import{join as EZ}from"path";var xZ={platform:process.platform,home:U0,async openFile($){let J=await IZ($,y3.O_RDONLY|y3.O_NOFOLLOW|y3.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function n4($=xZ){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(EZ($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class k3 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function SZ($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,V=new Promise((N,G)=>{X=()=>{Q.abort(J.reason),G(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let H=new k3;Q.abort(H),G(H)},Z)});try{return await Promise.race([$(Q.signal),V])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function r4($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await SZ($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof k3||(X instanceof L0?S1(X.status):b1(X));if(Y){let V=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+V}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function c3($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}function q8($,J,Z){let Q=$?.permissionRecovery;return I2(Q,Z)&&Q.deviceId===J.deviceId&&Q.organizationId===J.orgId?{permissionRecovery:Q}:{}}var yZ=1000,kZ=250,hZ=16,fZ=5000,vZ=H8(bZ(process.execPath)),t4=null,o4=null;function M8($){if(process.platform!=="darwin")return{};return o4??=n4().then((J)=>{t4={status:J,checkedAt:$().getTime()}}).finally(()=>{o4=null}),{fullDiskAccess:{...t4??{status:"unknown",checkedAt:$().getTime()},executablePath:vZ}}}var mZ=8,gZ=64,uZ=2000,dZ=2000,s3=8000,e4=3,pZ=250,$8=1000,J8=30000,lZ=0.2,cZ=30000,sZ=21600000,aZ=300000,iZ=3600000,nZ=0.1,L8=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function rZ($){return Math.min(e4,Math.max(1,$??e4))}function tZ($){return typeof $.reason_code==="string"&&L8.has($.reason_code)?$.reason_code:"cancelled"}function h3($){return $.reason instanceof f0&&($.reason.code==="cancelled"||L8.has($.reason.code))?$.reason.code:"cancelled"}function Z8($){return $ instanceof f0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function T8($){return $.capability==="hands.connect"&&(K8($.payload)||B8($.payload))}function f3($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*nZ)))}function oZ($,J=Math.random){let Z=Math.min(J8,$8*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*lZ*(Q*2-1);return Math.min(J8,Math.max($8,Math.round(Z+X)))}function a3($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class v3 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function eZ($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function m3($){return $ instanceof Error?$.message:String($)}function g3($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function r0($){return $ instanceof L0&&$.status===409&&$.code==="attempt_fenced"}function u3($){return $.capability==="environment.install"}function $Q($){if($ instanceof S2||$ instanceof X1||$ instanceof y1)return"timeout";if(!($ instanceof Error)||$ instanceof L0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof L0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function w1($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(r0(Z))return;let Q=Z instanceof L0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:$Q(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function Y1($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)w1($,J,Q);throw Q}}class y1 extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function d3($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Y8(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:u3(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,V=Q?AbortSignal.any([Q,Y.signal]):Y.signal,N=$.sleep??a3,G=$.operationCompletionTimeoutMs??s3,H=performance.now()+G,M,U,B=new Promise((T,_)=>{let W=()=>{let F=new y1;Y.abort(F),_(F)},O=(F)=>{clearTimeout(M),M=setTimeout(W,F)};if(U=()=>O(Math.max(0,Math.min(H-performance.now(),uZ))),O(G),$.signal.addEventListener("abort",U,{once:!0}),$.signal.aborted)U()}),q,L=0;try{while(!0)try{q=await Promise.race([$.client.completeOperation($.state,J,X,V),B]);break}catch(T){if(V.aborted||$.signal.aborted||I0(T)||r0(T)||!JQ(T)||performance.now()>=H)throw w1($,"completion",T),T;L+=1;let _=Math.min(500*2**Math.min(L-1,4),Math.max(0,H-performance.now()));if(_<=0)throw w1($,"completion",T),T;try{await N(_,V)}catch{throw w1($,"completion",T),T}}}finally{clearTimeout(M),$.signal.removeEventListener("abort",U),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:q.status})}function JQ($){if(I0($))return!1;if(r0($))return!1;if($ instanceof L0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof y1)return!1;return!0}return!1}class S2 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function C2($){if($ instanceof S2)return!0;return $ instanceof L0?S1($.status):b1($)}function p3($,J){if(!($ instanceof L0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function ZQ($,J,Z,Q,X){let Y=new AbortController,V,N=()=>{return},G=new Promise((M,U)=>{let B=()=>{let q=Q.reason??new DOMException("Aborted","AbortError");Y.abort(q),U(q)};if(N=()=>Q.removeEventListener("abort",B),Q.aborted)B();else Q.addEventListener("abort",B,{once:!0})}),H=new Promise((M,U)=>{V=setTimeout(()=>{let B=new S2;Y.abort(B),U(B)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),G,H])}finally{if(V!==void 0)clearTimeout(V);N()}}async function Q8($,J,Z,Q,X,Y){let V=rZ($.operationHeartbeatMaxAttempts),N=$.operationHeartbeatAttemptTimeoutMs??s3,G=$.operationHeartbeatRetryDelayMs??pZ,H=Y.remainingMs(),M=Math.min(H,V*N+G*V*(V-1)/2);for(let U=0;U<V;U+=1)try{Q.throwIfAborted(),Y.assertCurrent();let B=Math.min(N,Y.remainingMs()),q=await ZQ($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(B-1000))),clientRetryCount:U},Q,B);return Q.throwIfAborted(),Y.acknowledge(q.lease_until),q}catch(B){if(Q.aborted||U+1>=V||r0(B)||I0(B)||!C2(B)){if(!Q.aborted)w1($,"operation_heartbeat",B);throw B}let q=H-Y.remainingMs(),L=p3(B,($.now?.()??new Date).getTime()),T=Math.max(G*(U+1),M*(U+1)/V-q,L);await X(Math.min(Y.remainingMs(),T),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function QQ($,J,Z,Q,X){let Y=T8(J),V=new AbortController,N=new AbortController,G=()=>{V.abort($.signal.reason),N.abort($.signal.reason)};if($.signal.aborted)G();else $.signal.addEventListener("abort",G,{once:!0});let H=null,M,U,B=-1,q=0,L=Promise.resolve(),T=[],_=new AbortController,W=!1,O,F=null,z=!1,j,D,R={},I=(S)=>{W=!0,_.abort(S),V.abort(S),N.abort(S)},P=(S)=>{if(O)return O;let h=structuredClone(S),p=q;return O=(async()=>{let b=new AbortController,x=b.signal;x.throwIfAborted();let E,A=()=>{},k=new Promise((y,i)=>{if(A=()=>i(x.reason),x.addEventListener("abort",A,{once:!0}),E=setTimeout(()=>b.abort(Error("Hands stop receipt delivery timed out.")),4000),x.aborted)A()});try{for(let y=0;y<3;y+=1){x.throwIfAborted();try{let i=await Promise.race([Y1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:p,events:[h],signal:x,transientRetryOwner:"caller"})),k]);if(x.throwIfAborted(),i.next_event_seq!==p+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");q=i.next_event_seq;return}catch(i){if(I0(i))X(i);let n=i instanceof L0?S1(i.status):b1(i);if(x.aborted||!n||y===2)throw i;let Y0=Math.max(500*2**y,p3(i,($.now?.()??new Date).getTime()));await Promise.race([Z(Y0,x),k])}}}finally{clearTimeout(E),x.removeEventListener("abort",A),b.abort()}})(),O},C=(S,h,p)=>{let b=(E)=>Y1($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:h,events:S,signal:E,...p?{transientRetryOwner:"caller"}:{}})).catch((A)=>{if(J.capability==="hands.connect"&&r0(A))I(A);if(p&&(I0(A)||r0(A))){if(I0(A))X(A);V.abort(A),N.abort(A),_.abort(A)}throw A});if(!p)return async(E)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){q=(await b(E)).next_event_seq;return}E.throwIfAborted();let A=()=>{},k=new Promise((y,i)=>{A=()=>i(E.reason),E.addEventListener("abort",A,{once:!0})});try{let y=await Promise.race([b(E),k]);E.throwIfAborted(),q=y.next_event_seq}finally{E.removeEventListener("abort",A)}};let x=r4({send:b,lease:D,sleep:Z,retryAfterMs:(E)=>p3(E,($.now?.()??new Date).getTime())});return async(E)=>{let A=await x(E);if(A.next_event_seq!==h+S.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");q=A.next_event_seq}},f=async(S,h)=>{let p=S??await Q8($,J,{controlAckSeq:B,waitMs:h},N.signal,Z,D),b=null,x=!1;for(let E=0;E<10;E+=1){let A=B+1;for(let k of p.controls){if(k.seq!==A)throw Error("Reason returned an out-of-order Device operation control.");if(k.kind==="cancel"||k.kind==="operation.cancel")b??=tZ(k.payload),V.abort(new f0(b,"Reason closed the Device operation."));if(k.kind!=="cancel"&&k.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let y,i,n=new Promise((Y0,H0)=>{y=Y0,i=H0});n.catch(()=>{}),R.current={promise:n,resolve:y,reject:i}}try{x||=!await $.onControl?.(J,k)}catch(y){if(y instanceof f0)M??=Z8(y);throw R.current?.reject(y),y}}B=k.seq,A+=1}if(p.controls.length===0){if(p.next_control_seq!==B+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:b,unsupported:x}}try{p=await Q8($,J,{controlAckSeq:B},N.signal,Z,D),R.current?.resolve()}catch(k){if(R.current?.reject(k),!b||r0(k)||I0(k))throw k;return{cancellationReason:b,unsupported:x}}}throw Error("Reason returned too many Device operation control batches.")};try{let S;try{if(!Y)D=new P2(J.lease_until,()=>($.now?.()??new Date).getTime(),(h)=>{if(!V.signal.aborted)H=h;V.abort(h),N.abort(h)});S=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||l3.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await f()}catch(h){if(!u3(J)||r0(h)||I0(h))throw h;await d3($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(S.cancellationReason||$.signal.aborted){let h=S.cancellationReason??h3($.signal);V.abort(new f0(h,"Reason closed the Device operation.")),U={status:"cancelled",error_code:h}}else if(S.unsupported)V.abort(),U={status:"failed",error_code:"control_unsupported"};else{let h=Y?Promise.resolve():(async()=>{let b=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?dZ:15000),x=Math.min(b,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??s3)-1000)),E=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!N.signal.aborted)try{if(!E){if(await Z(b,N.signal),N.signal.aborted)return}let A=await f(void 0,E?x:void 0);if(A.cancellationReason||A.unsupported){if(A.unsupported)H=Error("Reason requested an unsupported Device operation control.");V.abort(A.cancellationReason?new f0(A.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(A){if(I0(A))X(A);if(r0(A))H=A,I(A);if(!N.signal.aborted)H=A,V.abort();return}})();try{if(D?.assertCurrent(),V.signal.throwIfAborted(),Q.authorized=()=>!V.signal.aborted&&(Y||(D?.remainingMs()??0)>0),U=await $.onClaim(J,V.signal,async(b)=>{if(u3(J))return;if(b.kind==="permission.denied"){if(!Q.authorized())return;let n=b.data,Y0=($.now??(()=>new Date))().getTime(),H0=$.statusPath??E2(),u0=($.loadStatus??$1)(H0),E0={id:wZ(),kind:"permission_denied",operation:n?.operation,provenance:n?.provenance,occurredAt:new Date(Y0).toISOString(),expiresAt:new Date(Y0+600000).toISOString(),sessionId:J.run_id,deviceId:$.state.deviceId,organizationId:$.state.orgId};if(u0&&I2(E0,Y0)){let s0=u0.permissionRecovery;if(!s0||!I2(s0,Y0)||s0.sessionId!==E0.sessionId||s0.operation!==E0.operation||s0.provenance!==E0.provenance)($.saveStatus??x2)({...u0,permissionRecovery:E0},H0)}return}let x=J.capability==="hands.connect"&&b.capability==="hands.connect"&&b.kind==="hands.stopped",E=J.capability==="hands.connect"&&b.kind==="hands.reconnected",A=E||J.capability==="inference.custom.v1"?AbortSignal.any([V.signal,_.signal,...b.deliverySignal?[b.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,_.signal]):$.signal,k={kind:b.kind,payload:{sequence:b.sequence,capability:b.capability,...b.data?{data:E?structuredClone(b.data):b.data}:{}}};if(J.capability==="hands.connect"&&b.capability==="hands.connect"&&(b.kind==="started"||b.kind==="hands.started")||(l3.has(J.capability)||J.capability==="pty.start")&&b.kind==="started")return new Promise((n,Y0)=>{T.push({wireEvent:k,settle:(H0)=>H0===void 0?n():Y0(H0)})});let y=T;T=[];let i=L.then(async()=>{if((W||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(x)await P(k);return}if(F!==null){if(b.kind!=="hands.stopped"||!z||!j)throw F;let Y0=new AbortController,H0=AbortSignal.any([$.signal,_.signal,Y0.signal]),u0=setTimeout(()=>Y0.abort(Error("Hands stop receipt reconciliation timed out.")),4000);z=!1;try{await j(H0),j=void 0,await C([k],q,!0)(H0),F=null}catch(E0){throw F=E0??Error("Hands stop receipt could not be confirmed."),E0}finally{clearTimeout(u0),Y0.abort()}return}if(E&&!D){let Y0=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));D=new P2(new Date(Y0).toISOString(),()=>($.now?.()??new Date).getTime(),(H0)=>{V.abort(H0),N.abort(H0)})}let n=q;if(E)j=C([...y.map((Y0)=>Y0.wireEvent),k],n,!0),await j(A),j=void 0;else await C([...y.map((Y0)=>Y0.wireEvent),k],n,!1)(A)});i.then(()=>{for(let n of y)n.settle()},(n)=>{for(let Y0 of y)Y0.settle(n??Error("Hands event delivery failed."))}),L=i.catch((n)=>{if(I0(n))X(n);if(E){if(F===null)z=A.aborted&&!_.signal.aborted,F=n??Error("Hands generation receipt delivery failed.");if(!A.aborted)V.abort(n),N.abort(n)}}),await i}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await R.current?.promise}catch(b){U=V.signal.aborted?{status:"cancelled",error_code:h3(V.signal)}:{status:"failed",error_code:Z8(b)}}finally{Q.authorized=()=>!1,_.abort();for(let b of T.splice(0))b.settle();N.abort(),await h}let p=V8(J.capability)?G8(U.result,J.operation_id):null;if(H){if(I0(H))throw H;U={status:"failed",error_code:M??"control_or_heartbeat_failed",...p?{result:p}:{}}}else if(V.signal.aborted&&U.status==="succeeded")U={status:"cancelled",error_code:h3(V.signal),...p?{result:p}:{}}}if(D?.close(),I0($.signal.reason))throw $.signal.reason;await d3($,J,U)}finally{D?.close(),_.abort(),N.abort(),$.signal.removeEventListener("abort",G)}}async function i3($){let J=$.now??(()=>new Date),Z=$.sleep??a3,Q=$.saveStatus??x2,X=$.loadStatus??$1,Y=$.statusPath??E2(),V=J().toISOString(),N=X(Y)?.lastUsedAt,G=!1,H=()=>({version:1,pid:process.pid,startedAt:V,...M8(J),...q8(X(Y),$.state,J().getTime()),deviceId:$.state.deviceId,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:G}:{},...N?{lastUsedAt:N}:{}}),M=0,U,B=!1,q,L,T,_=Promise.resolve();Q({...H(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),N8();try{let W=async()=>{let O=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||O===L)return;if(q&&L){let j=await q.release();if($.onEvent?.({type:"idle_sleep",status:j,policy:L}),j==="failed")return;q=void 0,L=void 0,G=!1;let D=X(Y);if(D)Q({...D,idleSleepHold:G},Y)}if(!O)return;L=O;let F=!0;q=await($.acquireAwakeHold??i4)(O,{onStatusChange:(j)=>{if(F)return;G=j==="held";let D=X(Y);if(D)Q({...D,idleSleepHold:G},Y);$.onEvent?.({type:"idle_sleep",status:j,policy:O})}}),F=!1,G=q.status==="held";let z=X(Y);if(z)Q({...z,idleSleepHold:G},Y);$.onEvent?.({type:"idle_sleep",status:q.status,policy:O})};if(await W(),$.readIdleSleepPolicy)T=setInterval(()=>{_=_.then(W).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:L??"battery_and_ac"})})},$.idleSleepPollMs??1000),T.unref();while(!$.signal.aborted){let O=!1;try{await XQ({...$,saveStatus:(F,z)=>{if(F.state==="starting"||F.state==="error"||F.state==="stopped")return;N=F.lastUsedAt??N,Q({...F,startedAt:V,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:G}:{}},z)},onEvent:(F)=>{if(F.type==="error"&&F.diagnostic){$.onEvent?.(F);return}if(F.type==="started"||F.type==="error"||F.type==="stopped")return;if(F.type==="heartbeat"&&M>0&&!O){O=!0;let z=M;M=0,U=void 0,$.onEvent?.({type:"reconnected",attempts:z})}$.onEvent?.(F)}});return}catch(F){if(g3(F,$.signal))return;if(I0(F)){B=!0;let j=$.state.worker?"worker_connection_failed":m3(F);throw Q({...H(),state:"error",error:j},Y),$.onEvent?.({type:"error",message:j}),F}M+=1;let z=oZ(M,$.reconnectRandom);U??=J().toISOString(),Q({...H(),state:"starting",reconnectingSince:U},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":m3(F),attempt:M,retryInMs:z}),await Z(z,$.signal)}}}catch(W){if(!g3(W,$.signal))throw W}finally{if($.client.close?.(),clearInterval(T),await _,q&&L){let W=await q.release();G=W==="failed"&&q.status==="held",$.onEvent?.({type:"idle_sleep",status:W,policy:L})}if(!B)Q({...H(),state:"stopped"},Y);else{let W=X(Y);if(W)Q({...W,idleSleepHold:G},Y)}$.onEvent?.({type:"stopped"})}}async function XQ($){let J=$.now??(()=>new Date),Z=$.sleep??a3,Q=$.statusPath??E2(),X=$.saveStatus??x2,Y=$.loadStatus??$1,V=J().toISOString(),N=Y(Q)?.lastUsedAt,G=$.runtimeUpdate,H=new AbortController,M=()=>H.abort($.signal.reason);if($.signal.aborted)M();else $.signal.addEventListener("abort",M,{once:!0});let U=G?.random??Math.random,B=$.maxConcurrentClaims,q=typeof B==="number"&&Number.isSafeInteger(B)&&B>0?Math.min(gZ,B):mZ,L=0,T=!1,_=null,W=(m)=>{_??=m,H.abort(m)},O=new Map,F=()=>{let m=new Set,J0=0;for(let{claim:_$}of O.values()){let N$=_$.capability==="hands.connect"?_$.payload[X8]:void 0;if(typeof N$==="string"){if(m.has(N$))continue;m.add(N$)}J0+=1}return J0},z=null,j=()=>[...O.values()].some((m)=>m.authorized()),D=()=>[...O.values()].every((m)=>m.claim.capability==="preview.serve.v1"),R=G?new Date(V).getTime()+f3(G.initialDelayMs??cZ,U):Number.POSITIVE_INFINITY,I=null,P=!1,C=$.firstHeartbeat,f=C?.account_root_metadata_supported===!0,S=C?.workspace_root_metadata_supported===!0,h=C?.account_root_path_supported===!0,p=C?.home_contained_roots_supported===!0,b=C?.root_paths_supported===!0,x=C?.startup_supported===!0,E=C!==void 0,A=C?{challenge:C.challenge,expires_at:C.expires_at}:void 0,k,y=!$.startup,i=()=>({version:1,pid:process.pid,startedAt:V,...M8(J),...q8(Y(Q),$.state,J().getTime()),...N?{lastUsedAt:N}:{},deviceId:$.state.deviceId,...I?{organizationId:I.organization_id,organizationName:I.organization_name,organizationSlug:I.organization_slug}:{}}),n=()=>{let m=($.advertised??$.claimable)?.()!==!1;if(!y)k??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:m,...x&&!y&&k?{startup:k}:{},capabilities:m?U8($.capabilities,{accountRootMetadataSupported:f,workspaceRootMetadataSupported:S,accountRootPathSupported:h,homeContainedRootsSupported:p,rootPathsSupported:b}):{supported_operations:[]}}},Y0=()=>{if(P||!$.client.identity)return;P=!0,$.client.identity($.state,$.signal).then((m)=>{if(m.organization_id!==$.state.orgId)return;I=m;let J0=Y(Q);if(!J0)return;X({...J0,organizationId:m.organization_id,organizationName:m.organization_name,organizationSlug:m.organization_slug},Q)}).catch(()=>{return})},H0=(m)=>{f=m.account_root_metadata_supported===!0,S=m.workspace_root_metadata_supported===!0,h=m.account_root_path_supported===!0,p=m.home_contained_roots_supported===!0,b=m.root_paths_supported===!0,x=m.startup_supported===!0,E=!1},u0=(m)=>{if(m.startup)y=!0},E0=(m,J0)=>{if(!(J0 instanceof L0&&J0.status===400&&J0.code==="invalid_heartbeat")||!m.startup&&!E)throw J0;if(y=!0,E)f=S=h=!1,p=b=x=E=!1;return null},s0=(m)=>{H0(m),X({...i(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),Y0(),$.onEvent?.({type:"heartbeat",serverTime:m.server_time,drain:m.drain,...m.latest_cli_versions?{latestCliVersions:m.latest_cli_versions}:{},...m.hands_prespawn?{handsPrespawn:!0}:{}})},S$=!1,n$=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(S$)n$=!0;let m=n();Y1($,"heartbeat",()=>$.client.heartbeat($.state,m,H.signal).catch((J0)=>E0(m,J0))).then((J0)=>{if(!J0)return;u0(m),H0(J0),s0(J0)},()=>{return})});let F$=(m)=>Z(m,$.signal);X({...i(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let K$=!1,b$=$.maxConsecutiveHeartbeatFailures??3,U$=0,d0=0,D1=0,r$=null;try{while(!$.signal.aborted){if(_)throw _;if(T&&D())break;let m,J0=d0>0&&d0<hZ&&performance.now()-D1<fZ&&r$!==null;if(!J0)d0=0;$:{if(J0&&r$){m=r$;break $}let Q0=n(),a0=A;A=void 0,S$=!0,n$=!1;try{let D0=await Y1($,"heartbeat",()=>$.client.heartbeat($.state,Q0,H.signal,...a0?[a0]:[]).catch((e0)=>E0(Q0,e0)));if(S$=!1,!D0)continue;m=D0,u0(Q0),D1=performance.now(),U$=0}catch(D0){if(S$=!1,$.signal.aborted)break;if(!C2(D0))throw D0;if(U$+=1,U$>=b$&&!j())throw D0;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(H0(m),Object.keys(n().capabilities).length>Object.keys(Q0.capabilities).length)continue;if(n$)continue;if(s0(m),_)throw _;if($.signal.aborted)break;if(G&&["available","required"].includes(m.update_policy??""))R=Math.min(R,J().getTime());if(G&&J().getTime()>=R)try{let D0=new AbortController,e0=()=>D0.abort($.signal.reason);if($.signal.aborted)e0();else $.signal.addEventListener("abort",e0,{once:!0});let j$;try{j$=G.check(D0.signal)}catch(A0){j$=Promise.reject(A0)}let w$=j$.then((A0)=>({kind:"completed",result:A0}),(A0)=>({kind:"failed",error:A0})),t$;try{while(!0){let A0=await eZ(w$,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(A0.kind==="failed")throw new v3(A0.error);if(A0.kind==="completed"){t$=A0.result;break}try{let W0=n(),W1=await Y1($,"heartbeat",()=>$.client.heartbeat($.state,W0,H.signal).catch((Z2)=>E0(W0,Z2)));if(!W1)continue;m=W1,u0(W0),s0(m),U$=0}catch(W0){if($.signal.aborted)throw W0;if(!C2(W0))throw W0;if(U$+=1,U$>=b$&&!j())throw W0}}}catch(A0){D0.abort(A0);let W0=await w$;if(W0.kind==="completed"&&W0.result==="activated")t$="activated";else throw A0}finally{$.signal.removeEventListener("abort",e0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(L=0,t$==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),T=!0}R=J().getTime()+f3(G.intervalMs??sZ,U)}catch(D0){if(!(D0 instanceof v3))throw D0;L+=1;let e0=G.retryBaseMs??aZ,j$=G.retryMaxMs??iZ,w$=Math.min(j$,e0*2**Math.min(L-1,8));R=J().getTime()+f3(w$,U)}}if(r$=m,$.signal.aborted)break;if(T&&D())break;if(T){await F$($.heartbeatIntervalMs??15000);continue}let _$=$.client.sessionCadence?.($.state)??null,N$=_$?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(m.drain||$.claimable?.()===!1){d0=0,await F$(N$);continue}if(F()>=q){d0=0;let Q0=new AbortController;z=Q0;try{await Z(N$,AbortSignal.any([$.signal,Q0.signal]))}catch(a0){if(!Q0.signal.aborted)throw a0}finally{if(z===Q0)z=null}continue}let w,a=J0?0:_$?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),q0=performance.now();try{w=await Y1($,"claim",()=>$.client.claimOperation($.state,{waitMs:a,signal:H.signal}))}catch(Q0){if(d0=0,$.signal.aborted||!C2(Q0)||!j())throw Q0;await F$(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(_)throw _;if(!w){if(J0){d0=0;continue}if(performance.now()-q0<a-kZ)await F$(yZ);continue}if($.claimable?.()===!1){d0=0,await d3($,w,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}N=J().toISOString(),X({...i(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:w.operation_id,runId:w.run_id,attemptId:w.attempt_id,capability:w.capability});let j0,x0={authorized:()=>!1,claim:w};if(j0=QQ({...$,signal:H.signal},w,Z,x0,W).catch((Q0)=>{if(I0(Q0))W(Q0);else if(!r0(Q0)&&[...O].some(([a0,D0])=>a0!==j0&&D0.authorized())){if(Q0 instanceof y1)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!r0(Q0)&&_===null)_=Q0}).finally(()=>{O.delete(j0),z?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:O.size})}),O.set(j0,x0),$.onEvent?.({type:"claims_changed",activeClaims:O.size}),d0+=1,T8(w)){if(d0=0,await j0,_)throw _}}}catch(m){if(!g3(m,$.signal)){H.abort(m),K$=!0;let J0=$.state.worker?"worker_connection_failed":m3(m);throw X({...i(),state:"error",error:J0},Q),$.onEvent?.({type:"error",message:J0}),m}}finally{if(H.abort(),await Promise.allSettled(O.keys()),$.signal.removeEventListener("abort",M),!K$)X({...i(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as kQ}from"child_process";import{constants as a8,existsSync as hQ,mkdtempSync as e3,rmSync as G5}from"fs";import{access as i8,open as fQ,readFile as n8,readlink as vQ,readdir as r8,unlink as mQ,rmdir as gQ}from"fs/promises";import{tmpdir as uQ}from"os";import{basename as $9,join as k2}from"path";import{randomUUID as m$}from"crypto";import{chmodSync as YQ,closeSync as VQ,fsyncSync as GQ,openSync as BQ,readFileSync as KQ,rmdirSync as F8,unlinkSync as D8,writeFileSync as UQ}from"fs";import{createConnection as NQ,createServer as HQ}from"net";import{dirname as qQ,join as MQ}from"path";var LQ=5000;async function W8($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:m$()},X={runId:m$(),deviceId:m$(),rootId:m$(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=j8(J,X),V={version:1,snapshot_id:m$(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(V).installed&&Y.current().snapshot_id===V.snapshot_id&&!Z.aborted}catch{return!1}finally{try{D8(Y.path)}catch{}}}async function O8($,J,Z=_8){if(J.aborted)return!1;let Q,X,Y=new Set,V=m$(),N=HQ((B)=>{Y.add(B),B.once("close",()=>Y.delete(B)),B.on("error",()=>B.destroy()),B.end(V)});N.maxConnections=1;let G,H,M=new Promise((B)=>{H=()=>B(!1)}),U=setTimeout(H,LQ);J.addEventListener("abort",H,{once:!0});try{Q=Z({runtimeDirectory:g($),root:$.workspaceRoot,runId:`readiness-${m$()}`}),X=MQ(Q.journalDirectory,"readiness.json");let B=BQ(X,"wx",384);try{UQ(B,V),GQ(B)}finally{VQ(B)}if(KQ(X,"utf8")!==V||J.aborted)return!1;let q=new Promise((L)=>{N.once("error",()=>L(!1)),N.listen(Q.socketPath,()=>{try{if(process.platform!=="win32")YQ(Q.socketPath,384)}catch{L(!1);return}G=NQ(Q.socketPath);let T="";G.setEncoding("utf8"),G.once("error",()=>L(!1)),G.on("data",(_)=>{if(T+=_,T.length>V.length)G?.destroy(),L(!1)}),G.once("end",()=>L(T===V)),G.once("close",()=>L(!1))})});return await Promise.race([q,M])&&!J.aborted}catch{return!1}finally{clearTimeout(U),J.removeEventListener("abort",H),G?.destroy();for(let B of Y)B.destroy();if(await new Promise((B)=>N.close(()=>B())),Q?.disposeSocket(),X)try{D8(X)}catch{}if(Q){try{F8(Q.journalDirectory)}catch{}try{F8(qQ(Q.journalDirectory))}catch{}}}}import{spawn as TQ}from"child_process";import{randomUUID as g$}from"crypto";import{basename as FQ}from"path";import{fileURLToPath as _Q}from"url";function jQ(){let $=FQ(process.execPath).startsWith("bun");return{command:process.execPath,args:[...$?["--no-env-file",_Q(new URL("./worker-candidate-entry.ts",import.meta.url))]:[],"worker","__preview-probe"]}}async function E8($,J,Z=jQ()){if(J.aborted||!["darwin","linux","win32"].includes(process.platform)||process.platform==="win32"&&!C8())return!1;let Q=new AbortController,X=()=>Q.abort();J.addEventListener("abort",X,{once:!0});let Y=setTimeout(X,5000),V=TQ(Z.command,Z.args,{cwd:$,...A8(),stdio:["pipe","pipe","ignore"],env:z8()});R8(V);let N=!1,G=new Promise((F)=>V.once("close",()=>{N=!0,F()}));V.on("error",X);let H,M,U=new Promise((F)=>{H=F}),B=new Promise((F)=>{M=F}),q=new Promise((F)=>Q.signal.addEventListener("abort",()=>F(null),{once:!0})),L="",T=0,_=!1;V.stdout.setEncoding("utf8"),V.stdout.on("data",(F)=>{if(T+=Buffer.byteLength(F),L+=F,T>512){X();return}while(L.includes(`
-`)){let z=L.indexOf(`
-`),j=L.slice(0,z);L=L.slice(z+1);try{if(!_){let D=JSON.parse(j);if(!D||Object.keys(D).length!==2||!Number.isInteger(D.port)||D.port<1024||D.port>65535||typeof D.token!=="string"||!/^[a-zA-Z0-9_-]{43}$/.test(D.token))throw Error("probe_receipt_invalid");_=!0,H({port:D.port,token:D.token})}else if(j==="ready")M(!0);else X()}catch{X()}}}),G.then(X);let W,O=!1;try{let F=await Promise.race([U,q]);if(!F||!V.pid||Q.signal.aborted||J.aborted)return!1;let z=Date.now()+4500,j=g$(),D={organizationId:g$(),userId:g$(),runId:g$(),deviceId:g$(),rootId:g$(),attachmentRevision:0,grantRevision:1,jobId:"readiness",generation:1,fenceId:g$(),port:F.port,expiresAtMs:z},R={binding:D,executorLaunchId:j,job:{jobId:D.jobId,state:"running",startedAtMs:Date.now(),finishedAtMs:null,leaseExpiresAtMs:z,exitCode:null,inputSequence:0,output:[],firstCursor:1,nextCursor:0,truncated:!1,process:{pid:V.pid,processGroupId:V.pid,executorLaunchId:j}}},I=I8({binding:D,deniedPorts:new Set,readCurrentJob:async()=>!N&&!Q.signal.aborted?R:null});W=await P8({binding:D,deviceRelayUrl:`ws://127.0.0.1:${F.port}/device/readiness/${F.token}`,port:I,signal:Q.signal}),O=await Promise.race([B,q])===!0&&!Q.signal.aborted&&!J.aborted}catch{O=!1}finally{if(clearTimeout(Y),J.removeEventListener("abort",X),W?.close(),Q.abort(),V.stdin.destroy(),!N)V.kill("SIGKILL");await G}return O&&N}import{execFileSync as w2}from"child_process";import{randomUUID as l0}from"crypto";import{chmodSync as x8,chownSync as l8,closeSync as n3,constants as M$,existsSync as DQ,fstatSync as c8,mkdirSync as S8,mkdtempSync as WQ,openSync as r3,readFileSync as OQ,readSync as zQ,realpathSync as AQ,rmdirSync as RQ,rmSync as PQ}from"fs";import{join as u$}from"path";import{fileURLToPath as CQ}from"url";var b8=1e4,IQ=!1;function y2(){if(process.platform!=="linux")return!1;return IQ||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=w2($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var EQ=Buffer.from([0,255,3,4]);function w8($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function xQ($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function k1($,J={}){if(process.platform==="win32")return!$.aborted&&p8();if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=b2(),{directory:Q,root:X,runtimeDirectory:Y}=wQ(Z),V=new AbortController,N=()=>V.abort();$.addEventListener("abort",N,{once:!0});let G;V.signal.addEventListener("abort",()=>G?.close(),{once:!0});let H=setTimeout(N,b8),M={organization_id:l0(),user_id:l0(),device_id:l0()},U=l0(),B=l0(),q=l0(),L=l0(),T=Date.now()+b8,_={kind:"workspace_source",target_revision:0,root_grant_revision:1},W=l0().replaceAll("-",""),O,F=Buffer.alloc(0),z,j=!1,D=!1,R=!1,I=!1,P,C,f,S=async(p)=>{while(!p()){if(V.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((b)=>setTimeout(b,20))}if(V.signal.aborted)throw Error("pty_probe_cancelled")},h=!1;try{G=SQ(Q,Z),P=Bun.serve({hostname:"127.0.0.1",port:0,fetch(x,E){let A=new URL(x.url).pathname,k=A===`/device/hands/${W}`?"hands":A===`/device/pty/${W}`?"pty":null;if(k&&E.upgrade(x,{data:{lane:k}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(x){if(x.data.lane==="pty")O=x},message(x,E){if(x.data.lane!=="pty")return;if(typeof E==="string"){try{if(JSON.parse(E).t==="open")j=!0}catch{N()}return}if(F.length+E.length>8192){N();return}F=Buffer.concat([F,E])}}});let p=`ws://127.0.0.1:${P.port}`;if(C=t3({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:U,operationId:l0(),attemptId:l0(),claimOwner:M,deviceIdentity:{deviceId:M.device_id,rootId:B,apiOrigin:"https://worker-probe.invalid"},signal:V.signal,payload:{relay_url:`${p}/device/hands/${W}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(T).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:y8,hands_worker_version:f8,hands_worker_artifact_sha256:m8,hands_worker_entrypoint:v8,target_generation:1,target_fence_id:q,environment_binding:_,[g8]:u8},emitEvent:async(x)=>{if(x==="hands.started")I=!0;if(x==="hands.ready")D=!0;if(x==="hands.stopped")R=!0}},{browserExecutablePath:null,slot:d8(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:CQ(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!D)N()}),await S(()=>D),k8({root:X,runId:U,payload:{version:1,snapshot_id:L,revision:1,run_id:U,root_id:B,device_id:M.device_id,binding:{..._,target_generation:1,target_fence_id:q},expires_at:new Date(T).toISOString(),variables:{PTY_PROBE_VALUE:W},git:null}}),f=h8({root:X,runId:U,rootId:B,deviceId:M.device_id,owner:M,workspace:{kind:"root"},authority:{device_id:M.device_id,binding:_.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:q},signal:V.signal,session:{jobId:`pty-${l0()}`,sessionId:"pty-readiness",operationId:l0(),cols:80,rows:24,leaseExpiresAtMs:T,relayUrl:`${p}/device/pty/${W}`},emit:async(x,E)=>{if(x==="pty.ready")z=E}}).catch(()=>{N()}),await S(()=>Boolean(z&&O&&j)),O.send(JSON.stringify({t:"resize",cols:100,rows:30})),O.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${W}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${G.wait("background")}) & ${w8("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${w8("foreground")}; ${G.wait("foreground")}'
-`)),await S(()=>DQ(u$(X,"foreground.pid"))&&F.includes(EQ)),!F.includes("30 100")||z.job.environmentSnapshotId!==L||z.job.environmentRevision!==1)return!1;let b=["background.pid","foreground.pid"].map((x)=>bQ(u$(X,x)));if(new Set(b).size!==2||b.some((x)=>!Number.isSafeInteger(x)||x<2||x===z.job.process.pid))return!1;if(process.platform==="linux"){if(!b.every((x)=>xQ(OQ(`/proc/${x}/stat`,"utf8"),x,z.job.process.pid)))return!1}else{let E=w2("/bin/ps",["-o","pid=,pgid=","-p",b.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((A)=>A.trim().split(/\s+/).map(Number));if(E.length!==2||new Set(E.map(([A])=>A)).size!==2||E.some((A)=>A.length!==2||!b.includes(A[0])||A[0]!==A[1]))return!1}if(O.send(JSON.stringify({t:"close"})),await f,V.signal.aborted)return!1;for(let x of[z.job.process.pid,...b])try{return process.kill(x,0),!1}catch(E){if(!(E instanceof Error&&("code"in E)&&E.code==="ESRCH"))return!1}h=!0}catch{h=!1}finally{if(clearTimeout(H),$.removeEventListener("abort",N),N(),G?.close(),await f,await C,await P?.stop(!0),!I||R)yQ({directory:Q,root:X},Z)}return h&&R&&!$.aborted}function SQ($,J){let Z={foreground:u$($,"foreground.lifeline"),background:u$($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");w2("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))n3(Y)};try{for(let Y of Object.values(Z)){let V=r3(Y,M$.O_RDONLY|M$.O_NONBLOCK|M$.O_NOFOLLOW);try{if(Q.push(r3(Y,M$.O_WRONLY|M$.O_NONBLOCK|M$.O_NOFOLLOW)),!c8(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{n3(V)}if(J)l8(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function s8($=(J)=>k1(J)){let J=new AbortController,Z=JSON.stringify(b2()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(b2())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((V)=>{Y=setTimeout(V,X)})]),clearTimeout(Y)}}}function bQ($){let J;try{J=r3($,M$.O_RDONLY|M$.O_NOFOLLOW|M$.O_NONBLOCK)}catch{return Number.NaN}try{let Z=c8(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=zQ(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{n3(J)}}function wQ($,J=AQ("/tmp")){let Z=WQ(u$(J,"reason-pty-probe-")),Q=u$(Z,"workspace"),X=u$(Z,"private");if(S8(Q,{mode:448}),S8(X,{mode:448}),$)x8(Z,493),x8(Q,493),l8(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function yQ($,J){if(J)try{w2("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),RQ($.root)}catch{return}PQ($.directory,{recursive:!0,force:!0})}var B5=5000,d$="ARA_WORKER_PROBE_READY";function dQ($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{kQ($,J,{cwd:Z,env:Q,signal:X,timeout:B5,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8",windowsHide:!0},(V,N)=>Y(!V&&!X.aborted&&N===d$))})}function pQ($,J){let Z=$9($).replace(/\.exe$/i,"");if(Z==="bash")return["--noprofile","--norc","-c",J];if(Z==="zsh"||Z==="sh")return["-f","-c",J];return null}function lQ($,J){let Z=$5({home:J,temporaryDirectory:J}),Q=(Y,V,N)=>dQ(Y,V,$.workspaceRoot,Z,N),X=async(Y,V,N,G=(M)=>M===d$,H=!1)=>{let M=process.platform==="win32"?e3(k2(uQ(),"reason-device-probe-")):$.workspaceRoot;try{let U=await H5(Y,V,{cwd:M,root:M,allowWrite:!1,allowProcessInspection:H,timeoutMs:B5,signal:N,workerProbe:!0}),B=!N.aborted&&!U.timedOut&&!U.truncated&&U.exitCode===0&&G(U.stdout);if(!B&&process.platform==="win32")process.stderr.write(`Reason worker: confined ${$9(Y)} probe failed (exit ${U.exitCode}${U.timedOut?", timed out":""}): ${U.stderr.slice(-300).trim()}
-`);return B}catch(U){if(process.platform==="win32")process.stderr.write(`Reason worker: confined ${$9(Y)} probe failed: ${String(U)}
-`);throw U}finally{if(M!==$.workspaceRoot)G5(M,{recursive:!0,force:!0})}};return{workspaceRead:async(Y)=>{return await i8($.workspaceRoot,a8.R_OK),await r8($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await i8($.workspaceRoot,a8.W_OK),Y.aborted)return!1;let V=e3(k2($.workspaceRoot,".ara-worker-probe-")),N=k2(V,"receipt");try{let G=await fQ(N,"wx",384);try{await G.writeFile(d$),await G.sync()}finally{await G.close()}return await n8(N,"utf8")===d$&&!Y.aborted}finally{await mQ(N).catch(()=>{}),await gQ(V).catch(()=>{})}},confinedShell:(Y)=>{if(process.platform==="win32"&&!h1())return process.stderr.write(`Reason worker: ${Q5}
-`),Promise.resolve(!1);return X(N5(),["-c",`printf ${d$}`],Y)},confinedGit:(Y)=>X("git",["--version"],Y,(V)=>/^git version \S+/.test(V)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(H)=>H.includes(`p${process.pid}
-`)&&/^n\//m.test(H),!0);if(process.platform==="win32")return o8(Y);if(process.platform!=="linux")return!1;let[V,N,G]=await Promise.all([vQ("/proc/self/cwd"),r8("/proc/self/fd"),n8("/proc/net/tcp","utf8")]);return!Y.aborted&&V.length>0&&N.length>0&&G.includes("local_address")},bash:async(Y)=>{let V=process.platform==="win32"?V1():"/bin/bash";if(!V)return process.stderr.write(`Reason worker: ${process.platform==="win32"?t8:"bash is unavailable"}
-`),!1;return Q(V,["--noprofile","--norc","-c",`printf ${d$}`],Y)},jobs:(Y)=>O8($,Y),environment:(Y)=>W8($,J,Y),preview:(Y)=>E8(J,Y),boundPty:(Y)=>k1(Y),desktopDisplay:()=>U5(),desktopAutomation:async()=>{let Y=Z9();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
-`);return V5()},desktopBrowser:async()=>v1()?.features.browser===!0,fullControlShell:(Y)=>{let V=X5(),N=pQ(V,`printf ${d$}`);return N?Q(V,N,Y):Promise.resolve(!1)}}}function Z9(){return process.platform==="darwin"&&v1()?.features.computer===!0?Y5():null}var Q9=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function cQ($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=J9()){return f1($,J,Z,Q,X).final}function f1($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=J9(),Y,V){let N,G;try{if(H$($),m0(),!J)o(g($),!0),N=e3(k2(g($),"probe-")),J=lQ($,N);G=J}catch(O){let F=Promise.reject(O);return F.catch(()=>{}),{initial:F,final:F,pty:F}}let H=async(O,F)=>{if(Z.aborted||!F&&!G[O])return!1;let z,j=new Promise((D)=>{z=()=>D(!1)});Z.addEventListener("abort",z,{once:!0});try{return await Promise.race([F??G[O](Z),j])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",z)}},M=$.executionMode==="host",U=M?H("boundPty",Y):Promise.resolve(!1),B=Promise.resolve(V).then(()=>Promise.all(M?[H("preview"),U,H("desktopDisplay"),H("desktopAutomation"),H("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),q=(async()=>{let[O,F,z,j,D,R,I,P,C]=await Promise.all([Promise.resolve(Q).then((f)=>f.read?H("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((f)=>f.write?H("workspaceWrite"):!1,()=>!1),X?H("confinedShell"):!1,X?H("confinedGit"):!1,H("processInspection"),...M?[H("bash"),H("jobs"),H("environment"),H("fullControlShell")]:[!1,!1,!1,!1]]);if(M&&(!R||!I||!P)&&!V)await B;if(M){if(!R)R=await H("bash");if(!I)I=await H("jobs");if(!P)P=await H("environment")}return{read:O,write:F,shell:z,git:j,processes:D,bash:R,jobs:I,environment:P,full:C}})(),L=(O,F)=>{let{read:z,write:j,shell:D,git:R,processes:I,bash:P,jobs:C,environment:f,full:S}=O,{preview:h,boundPty:p,desktopDisplay:b,desktopAutomation:x,desktopBrowser:E}=F,A=J5(),k=M&&process.platform==="darwin"&&S&&hQ("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":z,"fs.write":j,"inference.custom.v1":M&&z,"fs.export":z&&A,"fs.import":j&&A,"exec.run":D&&X,"git.run":D&&R&&X,"process.list":(process.platform==="linux"||process.platform==="win32"||D)&&I,"ports.list":(process.platform==="linux"||process.platform==="win32"||D)&&I,"exec.full":P&&S&&X,"hands.connect":z&&j&&P&&C,"jobs.control":z&&j&&P&&C,"pty.start":z&&j&&P&&C&&f&&p,"environment.install":z&&j&&P&&C&&f,"github.local.v1":(process.platform==="darwin"||process.platform==="win32"||process.platform==="linux"&&process.geteuid?.()!==0)&&z&&j&&P&&C&&f,"tunnel.open":z&&j&&P&&C&&f&&h,"tunnel.close":z&&j&&P&&C&&f&&h,"preview.serve.v1":z&&P&&C&&h&&S,"display.stream.v1":b,"automation.call.v1":x,"simulator.call.v1":k,"simulator.stream.v1":k,"browser.pr-proof.v1":x&&E&&e8()===null&&process.platform!=="win32","workspace.setup.v1":M&&Z5()})},T=q.then(async(O)=>L(O,{preview:!1,boundPty:await Promise.race([U,new Promise((F)=>setImmediate(()=>F(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),_=(async()=>{try{let O=await q,[F,z,j,D,R]=await B;if(M&&!z&&O.read&&O.write&&O.bash&&O.jobs&&O.environment)z=await H("boundPty");return L(O,{preview:F,boundPty:z,desktopDisplay:j,desktopAutomation:D,desktopBrowser:R})}finally{if(N)G5(N,{recursive:!0,force:!0})}})();T.catch(()=>{});let W=(async()=>{let O=await q;if(!(O.read&&O.write&&O.bash&&O.jobs&&O.environment))return!1;return await U||(await _)["pty.start"]===!0})();return W.catch(()=>{}),{initial:T,final:_,pty:W}}var sQ=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],aQ=[60000,300000,900000];function o3($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return sQ.filter((Z)=>J[Z]!==!0)}function K5($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>cQ($.config,void 0,Y,$.permissions)),Q=$.readiness,X=o3($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
-`),(async()=>{for(let Y of $.delaysMs??aQ){if(await new Promise((G)=>{let H=setTimeout(G,Y);$.signal.addEventListener("abort",()=>{clearTimeout(H),G()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let V;try{V=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let N=o3($.config,Q).filter((G)=>V[G]===!0);if(N.length>0)Q=Object.freeze({...Q,...Object.fromEntries(N.map((G)=>[G,!0]))}),J(`Reason worker: ready after probing again (${N.join(", ")}).
-`),$.onReady(Q,N);if(o3($.config,Q).length===0)return}})()}import{execFile as cX}from"child_process";import{createHash as sX,randomUUID as j9}from"crypto";import{lstat as aX,readdir as t5,readFile as XJ,realpath as iX,stat as nX}from"fs/promises";import{basename as rX,join as F9}from"path";import{promisify as tX}from"util";import{createConnection as iQ}from"net";import{endianness as L5}from"os";var m1=4,X9=1e4;class P${socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=iQ(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#V(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},V=nQ({jsonrpc:"2.0",id:Q,method:$,params:X}),N=new Promise((G,H)=>{let M=setTimeout(()=>{this.#Z.delete(Q),H(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:G,reject:H,timeout:M})});return Z.write(V),await N}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#V($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=m1){let J=L5()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=m1+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(m1,Z);this.#$=this.#$.subarray(Z),this.#G(JSON.parse(Q.toString("utf8")))}}#G($){if(!t0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),t0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class h2{client;cdp;constructor($){this.client="client"in $?$.client:new P$($),this.cdp=new _5(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=rQ(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new T5(this,$)}getTabs(){return this.client.getTabs()}}class T5{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new F5(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class F5{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class _5{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(t0(Q)&&t0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return t0(Q)&&t0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";q5(Q);let X=Z.timeoutMs??X9;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),V=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(t0(V)&&typeof V.errorText==="string"&&V.errorText)throw Error(`Browser failed to navigate tab ${$}: ${V.errorText}`);return await Y.catch(async(N)=>{let G=await this.readDocumentState($);if(M5(G,Q))return;throw N}),V}async waitForLoadState($,J={}){let Z=J.state??"load";q5(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(M5(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??X9)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return t0(J)?{href:Y9(J.href),readyState:Y9(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??X9;return new Promise((X,Y)=>{let V=!1,N=null,G,H=()=>{if(V)return!1;return V=!0,clearTimeout(G),N?.(),!0};G=setTimeout(()=>{if(H())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),N=this.client.onNotification((M)=>{try{if(J(M)){if(H())X(M)}}catch(U){if(H())Y(U instanceof Error?U:Error(String(U)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=tQ(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function nQ($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(m1+J.length);if(L5()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,m1),Z}function t0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function rQ($,J){if(!t0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function q5($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function M5($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function tQ($,J){if($.method!=="onCDPEvent"||!t0($.params))return null;let Z=$.params.source;if(!t0(Z)||Z.tabId!==J)return null;return{method:Y9($.params.method)}}function Y9($){return typeof $==="string"?$:void 0}import{createHash as oQ}from"crypto";function j5($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${oQ("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as dX}from"async_hooks";import{isDeepStrictEqual as n5}from"util";import{createHash as pX}from"crypto";var eQ=new RegExp("^/media/pr-screenshots/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$","i");var $X=new Set(["png","jpg","jpeg","gif","webp"]),JX=new Set(["webm","mp4"]);function ZX($){if(!$)return null;try{return new URL($).origin}catch{return null}}function D5($,J){let Z;try{Z=new URL($)}catch{return null}let Q=ZX(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash)return null;let Y=eQ.exec(Z.pathname);if(!Y)return null;let V=Y[1]?.toLowerCase(),N=Y[2]?.toLowerCase(),G=Y[3]?.toLowerCase(),H=Y[4]?.toLowerCase();if(!V||!N||!G||!H)return null;let M=$X.has(H)?"image":JX.has(H)?"video":null;if(!M)return null;let U=/^(before|after)[\s:_-]+/.exec(G),B=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:B,runId:V,artifactId:N,fileName:`${G}.${H}`,kind:M,phase:U?.[1]==="before"||U?.[1]==="after"?U[1]:null}}var QX=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,f2=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),p$=()=>{throw Error("cloud_browser_media_request_invalid")};function v2($){if(!f2($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!QX.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return p$();let J;try{J=new URL($.configuredMediaOrigin)}catch{return p$()}if(J.protocol!=="https:"||J.username||J.password||J.port||!W5(J.origin,{mode:"public_web"}).allowed)return p$();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!f2(Y)||Object.keys(Y).some((N)=>!["url","sourceUrl","kind"].includes(N))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return p$();let V=D5(Y.url,J.origin);if(!V||new URL(V.url).origin!==J.origin||V.runId!==Z||V.kind!==Y.kind||V.url!==Y.url||Q.has(Y.url))return p$();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let N;try{N=new URL(Y.sourceUrl)}catch{return p$()}let G=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(N.pathname)?.[1];if(Y.kind!=="image"||N.origin!=="https://camo.githubusercontent.com"||N.username||N.password||N.search||N.hash||!G||G.length%2!==0||Buffer.from(G,"hex").toString("utf8")!==Y.url)return p$()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function O5($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!f2($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let V=J.media[Y];if(!f2(X)||X.url!==V.url||X.sourceUrl!==V.sourceUrl||X.kind!==V.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||V.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...V,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...V.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var G9="browser.pr-proof.v1",_0=K.string().uuid(),G1=K.string().regex(/^[a-f0-9]{64}$/),c$=K.iso.datetime({precision:3}),V9=K.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),P5=K.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),c0=K.object({kind:K.literal("primary_mac"),version:K.literal(1),organizationId:V9,userId:V9,sessionId:V9,runId:_0,deviceId:_0,rootId:_0,rootRevision:K.string().min(1).max(64),binding:K.enum(["workspace_source","mcp_control"]),targetRevision:K.number().int().nonnegative(),generation:_0,profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:K.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),XX=K.custom().transform(($,J)=>{try{return R5($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),K.NEVER}}),B1=K.object({version:K.literal(1),owner:c0,contextId:_0,preparedAt:c$,expiresAt:c$,prUrl:P5,headSha:K.string().regex(/^[a-f0-9]{40}$/),skillDigest:G1,evidenceKind:K.enum(["image","video"]),visualPlan:XX.optional(),uploadOrigin:K.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),B9=K.object({version:K.literal(1),producer:K.literal("primary_mac"),context:B1,captureId:_0,operationId:_0,attemptId:_0,tabId:K.number().int().positive(),startedAt:c$,finishedAt:c$,sha256:G1,media:K.discriminatedUnion("contentType",[K.object({contentType:K.literal("image/png"),sizeBytes:K.number().int().min(24).max(8388608),width:K.number().int().min(1).max(4096),height:K.number().int().min(1).max(4096)}).strict(),K.object({contentType:K.literal("video/webm"),sizeBytes:K.number().int().min(128).max(10485760),durationSeconds:K.number().min(0.05).max(15),frameCount:K.number().int().min(1).max(450),receivedFrameCount:K.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),bN=K.discriminatedUnion("action",[K.object({action:K.literal("screenshot"),context_id:_0,tab_id:K.number().int().positive()}).strict(),K.object({action:K.literal("start_video"),context_id:_0,tab_id:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),K.object({action:K.literal("stop_video"),recording_operation_id:_0}).strict()]),g2=K.object({login:K.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:K.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),m2=K.string().regex(/^[1-9][0-9]{0,19}$/),g1=K.object({version:K.literal(1),owner:c0,expectedActorId:m2.nullable(),repositoryId:m2,repositoryFullName:K.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),YX=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],K9=K.discriminatedUnion("status",[g1.extend({status:K.literal("ready"),observedActor:g2,checkedAt:c$}),g1.extend({status:K.literal("not_ready"),reason:K.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:K.enum(YX).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),l$=K.object({version:K.literal(1),owner:c0,expectedActorId:m2.nullable(),authenticatedActor:g2,attemptId:_0,captureId:_0,prUrl:P5,repositoryId:m2,headSha:K.string().regex(/^[a-f0-9]{40}$/),sha256:G1,sizeBytes:K.number().int().min(128).max(10485760),contentType:K.literal("video/webm")}).strict(),C5=K.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),K1=K.discriminatedUnion("status",[l$.extend({status:K.literal("not_attempted"),reason:K.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),l$.extend({status:K.literal("uncertain"),reason:K.literal("upload_outcome_unknown")}),l$.extend({status:K.literal("uploaded"),observedActor:g2,nativeUrl:C5,uploadedAt:c$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),u1=l$.extend({nativeUrl:C5,observedActor:g2,bodySha256:G1}),U9=K.discriminatedUnion("status",[u1.extend({status:K.literal("incomplete"),reason:K.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),u1.extend({status:K.literal("verified"),sourceSha256:G1,width:K.number().int().min(1).max(4096),height:K.number().int().min(1).max(4096),durationSeconds:K.number().positive().max(30),advancedSeconds:K.number().min(0.05).max(10),advancedFrames:K.number().int().positive(),playbackRestored:K.literal(!0),verifiedAt:c$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),VX=K.custom().transform(($,J)=>{try{let Z=v2($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),K.NEVER}}),GX=K.discriminatedUnion("action",[K.object({action:K.literal("auth_check"),input:g1}).strict(),K.object({action:K.literal("prepare"),context:B1}).strict(),K.object({action:K.literal("capture_png"),owner:c0,contextId:_0,tabId:K.number().int().positive()}).strict(),K.object({action:K.literal("start_video"),owner:c0,contextId:_0,tabId:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),K.object({action:K.literal("inspect_capture"),owner:c0,captureId:_0}).strict(),K.object({action:K.literal("publish_video"),input:l$}).strict(),K.object({action:K.literal("verify_png_media"),owner:c0,media:VX}).strict().refine(($)=>$.media.runId===$.owner.runId),K.object({action:K.literal("verify_saved_media"),input:u1}).strict(),K.object({action:K.literal("publish_png"),owner:c0,attemptId:_0,captureId:_0,sha256:G1,sizeBytes:K.number().int().min(24).max(8388608),storagePath:K.string().max(512),uploadUrl:K.string().url().max(8192)}).strict()]);var I5="pr-proof.stop.v1",N9=K.object({requestId:_0,command:GX}).strict();var BX={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},z5={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},A5={type:"integer",minimum:1,description:"An already-owned tab's id."},wN={...BX,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:z5,tab_id:A5}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:z5,tab_id:A5,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};import{createHash as KX,randomUUID as UX}from"crypto";import{isDeepStrictEqual as U1}from"util";var E5=K.object({operationId:K.string().uuid(),attemptId:K.string().uuid(),contextId:K.string().uuid(),tabId:K.number().int().positive()}).strict(),G0=()=>Error("mac_pr_proof_capture_unavailable"),H9=($)=>KX("sha256").update($).digest("hex");function x5($){let J=c0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw G0();if(await $.assertCurrent(),X)throw G0()},V=(B)=>{let q=Z.get(B);if(!q||Date.parse(q.expiresAt)<=Date.now())throw G0();return q},N=(B)=>B.disposal??=(async()=>{B.controller.abort(),B.bytes?.fill(0),B.bytes=void 0,B.receipt=void 0;try{await B.host?.close()}catch{throw X=!0,G0()}})(),G=async()=>{for(let[B,q]of Z){if(Date.parse(q.expiresAt)>Date.now())continue;let L=[...Q.entries()].filter(([,_])=>_.claim.contextId===B);if((await Promise.allSettled(L.map(([,_])=>N(_)))).some((_)=>_.status==="rejected"))throw G0();for(let[_]of L)Q.delete(_);Z.delete(B)}},H=setInterval(()=>{G().catch(()=>{X=!0})},1000);H.unref();let M=(B)=>{if(B.stopRequested=!0,B.started&&B.host&&!B.stop)B.stop=B.host.stop(),B.stop.catch(()=>B.controller.abort())};async function U(B,q){let L=E5.parse(B.claim);if(q==="video"&&(!Number.isInteger(B.seconds)||B.seconds<1||B.seconds>15))throw G0();await Y(),B.signal.throwIfAborted(),await G();let T=V(L.contextId);if(q==="video"&&T.evidenceKind!=="video")throw G0();let _=Q.get(L.operationId);if(_){if(!U1(_.claim,L)||_.kind!==q||_.seconds!==B.seconds||_.controller.signal.aborted)throw G0();let I=await _.completion;if(await Y(),V(L.contextId),_.controller.signal.aborted)throw G0();return structuredClone(I)}if(Q.size>=16||[...Q.values()].some((I)=>!I.receipt&&!I.controller.signal.aborted&&I.claim.tabId===L.tabId))throw G0();let W,O,F=new Promise((I,P)=>{W=I,O=P});F.catch(()=>{});let z={claim:L,kind:q,seconds:B.seconds,controller:new AbortController,completion:F,stopRequested:!1,started:!1};Q.set(L.operationId,z);let j=()=>{N(z).catch(()=>{})};B.signal.addEventListener("abort",j,{once:!0});let D=async()=>{await Y(),V(L.contextId),B.signal.throwIfAborted(),z.controller.signal.throwIfAborted()},R;try{await D();let I;if(q==="image"){let P=new Date().toISOString();R=await $.screenshot(structuredClone(T),L.tabId,z.controller.signal);let C=new Date().toISOString();if(await D(),R.length<24||R.length>8388608||!R.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||R.readUInt32BE(8)!==13||R.toString("ascii",12,16)!=="IHDR")throw G0();I=B9.parse({version:1,producer:"primary_mac",context:T,captureId:UX(),operationId:L.operationId,attemptId:L.attemptId,tabId:L.tabId,startedAt:P,finishedAt:C,sha256:H9(R),media:{contentType:"image/png",sizeBytes:R.length,width:R.readUInt32BE(16),height:R.readUInt32BE(20)}})}else{if(z.host=await $.createVideo(structuredClone(T),L.tabId,B.seconds,z.controller.signal),z.controller.signal.aborted||B.signal.aborted||X)throw await z.host.close(),G0();await z.host.start(),z.started=!0;let P=z.host.completed();if(P.catch(()=>{}),await D(),await B.started?.(),z.stopRequested)M(z);let C=await P;if(z.stop)await z.stop;await D();let f=await z.host.read(C.captureId);R=f.bytes;let S={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:L.tabId};if(!U1(C,f.capture)||!U1(C.owner,S)||R.length!==C.sizeBytes||H9(R)!==C.sha256||R.length<128||R.readUInt32BE(0)!==440786851)throw G0();await z.host.close(),await D(),I=B9.parse({version:1,producer:"primary_mac",context:T,captureId:C.captureId,operationId:L.operationId,attemptId:L.attemptId,tabId:L.tabId,startedAt:C.startedAt,finishedAt:C.finishedAt,sha256:C.sha256,media:{contentType:"video/webm",sizeBytes:C.sizeBytes,durationSeconds:C.durationSeconds,frameCount:C.frameCount,receivedFrameCount:C.receivedFrameCount}})}if(await D(),[...Q.values()].reduce((P,C)=>P+(C.bytes?.length??0),R.length)>20971520)throw G0();return z.bytes=Buffer.from(R),z.receipt=I,W(I),structuredClone(I)}catch(I){let P=q==="video"&&!B.signal.aborted&&!z.controller.signal.aborted&&I instanceof Error&&I.message==="mac_recording_worker_failed:no_frames"?new f0("proof_capture_no_frames","The owned tab emitted no recording frames."):G0();throw await N(z).catch(()=>{}),O(P),P}finally{R?.fill(0),B.signal.removeEventListener("abort",j)}}return{async prepare(B){let q=B1.parse(B);if(!U1(q.owner,J))throw G0();if(await Y(),await G(),Date.parse(q.preparedAt)>Date.now()||Date.parse(q.expiresAt)<=Date.now())throw G0();let L=Z.get(q.contextId);if(L){if(!U1(L,q))throw G0();return structuredClone(L)}if(Z.size>=4)throw G0();return Z.set(q.contextId,q),structuredClone(q)},screenshot:(B)=>U(B,"image"),record:(B)=>U(B,"video"),async stop(B){let q=E5.parse(B);await Y(),V(q.contextId);let L=Q.get(q.operationId);if(!L||L.kind!=="video"||!U1(q,L.claim)||L.controller.signal.aborted)throw G0();M(L)},async publicationCapture(B){await Y(),await G();let q=[...Q.values()].find((L)=>L.receipt?.captureId===B);if(!q?.receipt||!q.bytes||q.controller.signal.aborted)throw G0();if(V(q.claim.contextId),q.bytes.length!==q.receipt.media.sizeBytes||H9(q.bytes)!==q.receipt.sha256)throw G0();return{capture:structuredClone(q.receipt),bytes:Buffer.from(q.bytes)}},async inspect(B){await Y(),await G();let q=[...Q.values()].find((L)=>L.receipt?.captureId===B);if(!q?.receipt||q.controller.signal.aborted)throw G0();return V(q.claim.contextId),structuredClone(q.receipt)},async close(){X=!0,clearInterval(H);let B=await Promise.allSettled([...Q.values()].map(N));if(Q.clear(),Z.clear(),B.some((q)=>q.status==="rejected"))throw G0()}}}import{createHash as y5,randomUUID as jX}from"crypto";import{isDeepStrictEqual as d1}from"util";import{realpath as DX}from"fs/promises";var S5=String.raw`async (media) => {
-  const deadline = (promise) => {
-    let timer;
-    return Promise.race([promise, new Promise((_, reject) => {
-      timer = setTimeout(() => reject(new Error("media_decode_timeout")), 12000);
-    })]).finally(() => clearTimeout(timer));
-  };
-  const items = await Promise.all(media.map(async (item) => {
-    const element = document.createElement(item.kind === "image" ? "img" : "video");
-    document.body.append(element);
-    try {
-      if (item.kind === "image") {
-        element.src = item.sourceUrl;
-        await deadline(element.decode());
-        if (!element.complete || !element.naturalWidth || !element.naturalHeight) throw new Error("media_image_not_decoded");
-        return { ...item, width: element.naturalWidth, height: element.naturalHeight };
-      }
-      element.muted = true;
-      element.playsInline = true;
-      element.preload = "auto";
-      const loaded = new Promise((resolve, reject) => {
-        element.addEventListener("loadeddata", resolve, { once: true });
-        element.addEventListener("error", () => reject(new Error("media_video_not_decoded")), { once: true });
-      });
-      element.src = item.sourceUrl;
-      await deadline(loaded);
-      if (!element.videoWidth || !element.videoHeight || !Number.isFinite(element.duration) || element.duration <= 0) throw new Error("media_video_not_decoded");
-      const initial = element.currentTime;
-      await deadline(element.play());
-      await deadline(new Promise((resolve, reject) => {
-        let timer;
-        const check = () => {
-          if (element.error) { clearTimeout(timer); reject(new Error("media_video_not_decoded")); return; }
-          if (element.currentTime - initial >= 0.05) { clearTimeout(timer); resolve(); return; }
-          timer = setTimeout(check, 25);
-        };
-        element.addEventListener("pause", () => { clearTimeout(timer); reject(new Error("media_video_not_advancing")); }, { once: true });
-        check();
-      }));
-      return { ...item, width: element.videoWidth, height: element.videoHeight, advancedSeconds: element.currentTime - initial };
-    } finally {
-      if (item.kind === "video") element.pause();
-      element.removeAttribute("src");
-      element.remove();
-    }
-  }));
-  return { verified: true, items };
-}`;var b5=function($){let J=this??globalThis,Z=10485760,Q=(V,N)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let G=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!G&&(J.location.href===V.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==V.prUrl||!G)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(G))return{ok:!1,reason:"identity_mismatch"};let H=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),M=/^[1-9][0-9]{0,19}$/.test(H||"")?H:null,U={login:G,id:M};if(V.expectedActorId!==null&&M!==V.expectedActorId||V.authenticatedActor&&(G!==V.authenticatedActor.login||M!==V.authenticatedActor.id)||V.observedActor&&(G!==V.observedActor.login||M!==V.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==V.repositoryId)return{ok:!1,reason:"identity_mismatch"};let B=J.document.querySelector('link[rel="canonical"]');if(B&&B.href!==V.prUrl)return{ok:!1,reason:"identity_mismatch"};if(N){let q=J.document.querySelector("#new_comment_field"),L=J.document.querySelector("#fc-new_comment_field"),T=q?.closest("file-attachment"),_=q?.closest("form"),W=new J.URL(V.prUrl).pathname+"/comment";if(!q||q.value!==""||!L||L.type!=="file"||L.disabled||!T||T.getAttribute("input")!==L.id||T.getAttribute("data-upload-repository-id")!==V.repositoryId||!_||new J.URL(_.action,J.location.href).origin!=="https://github.com"||new J.URL(_.action,J.location.href).pathname!==W)return{ok:!1,reason:"attachment_unavailable"};let O=T.getAttribute("data-upload-policy-url");if(!O||new J.URL(O,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:U}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let V=$.expected,N=Q(V,!0);if(!N.ok)return{dispatched:!1,reason:N.reason};let G=J.Uint8Array.from(J.atob($.base64||""),(B)=>B.charCodeAt(0));if(G.length!==V.sizeBytes||G.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let H=new J.File([G],V.captureId+".webm",{type:"video/webm"}),M=new J.DataTransfer;M.items.add(H);let U=J.document.querySelector("#fc-new_comment_field");if(!U)return{dispatched:!1,reason:"attachment_unavailable"};return U.files=M.files,U.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:N.actor}}if($.operation==="upload_result"){let V=Q($.expected,!1);if(!V.ok)throw Error("github_video_identity_changed");let N=J.document.querySelector("#new_comment_field")?.value?.trim(),G="["+$.expected.captureId+".webm](",H=N?.startsWith(G)&&N.endsWith(")")?N.slice(G.length,-1):N;if(!H||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(H))return null;return{nativeUrl:H,actor:V.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let V=X.nativeUrl.split("/").pop(),N=(W)=>{try{let O=new J.URL(W,J.location.href);if(O.protocol!=="https:"||O.username||O.password||O.port||O.hash)return!1;if(O.origin==="https://github.com")return O.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(O.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+V+"\\.(webm|mp4)$").test(O.pathname)}catch{return!1}},G=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((W)=>/^issue-[1-9][0-9]*$/.test(W.closest('[id^="issue-"]')?.id||"")&&!W.closest("form")&&!W.closest(".preview-content"));if(G.length!==1)throw Error("saved_body_missing");let H=G[0],M=[...H.querySelectorAll("video")].filter((W)=>[W.currentSrc,W.src,...[...W.querySelectorAll("source")].map((O)=>O.src)].some(N));if(M.length!==1)throw Error("saved_player_missing");let U=M[0],B={muted:U.muted,volume:U.volume,rate:U.playbackRate,preload:U.preload},q=new J.AbortController,L=J.setTimeout(()=>q.abort(),12000),T=(W)=>J.Promise.race([W,new J.Promise((O,F)=>{if(q.signal.aborted)F(Error("playback_timeout"));else q.signal.addEventListener("abort",()=>F(Error("playback_timeout")),{once:!0})})]),_=async(W)=>{while(!W()){if(U.error||q.signal.aborted)throw Error("playback_unverified");await new J.Promise((O)=>J.setTimeout(O,25))}};try{if(U.muted=!0,U.playbackRate=1,U.currentTime=0,U.readyState<2)U.preload="auto",U.load();await _(()=>U.readyState>=2&&U.videoWidth>0&&U.videoHeight>0);let W=U.currentSrc;if(!N(W))throw Error("source_unbound");let O=await T(J.fetch(W,{credentials:"same-origin",redirect:"error",signal:q.signal}));if(O.status!==200||!N(O.url)||O.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(O.headers.get("content-type")||"")||!O.body)throw Error("source_unverifiable");let F=O.headers.get("content-length");if(F!==null&&(!/^[1-9][0-9]*$/.test(F)||Number(F)!==X.sizeBytes))throw Error("source_size_mismatch");let z=O.body.getReader(),j=[],D=0;try{for(;;){let h=await T(z.read());if(h.done)break;if(D+=h.value.length,D>10485760||D>X.sizeBytes)throw Error("source_too_large");j.push(h.value)}}finally{await z.cancel().catch(()=>{}),z.releaseLock()}if(D!==X.sizeBytes)throw Error("source_size_mismatch");let R=new J.Uint8Array(D),I=0;for(let h of j)R.set(h,I),I+=h.length;let P=[...new J.Uint8Array(await T(J.crypto.subtle.digest("SHA-256",R)))].map((h)=>h.toString(16).padStart(2,"0")).join("");if(P!==X.sha256||U.currentSrc!==W||!H.contains(U))throw Error("source_changed");let C=U.currentTime,f=U.getVideoPlaybackQuality().totalVideoFrames;if(await T(U.play()),await _(()=>U.currentTime-C>=0.05&&U.getVideoPlaybackQuality().totalVideoFrames>f),!Q(X,!1).ok||U.currentSrc!==W||!H.contains(U)||U.error)throw Error("player_changed");return{status:"verified",sourceSha256:P,width:U.videoWidth,height:U.videoHeight,durationSeconds:U.duration,advancedSeconds:U.currentTime-C,advancedFrames:U.getVideoPlaybackQuality().totalVideoFrames-f,playbackRestored:!0}}finally{if(J.clearTimeout(L),q.abort(),U.pause(),U.currentTime=0,U.muted=B.muted,U.volume=B.volume,U.playbackRate=B.rate,U.preload=B.preload,!U.paused||U.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as NX}from"child_process";import{lstat as HX,realpath as qX}from"fs/promises";import{join as w5,resolve as MX}from"path";import{promisify as LX}from"util";var TX=LX(NX);async function FX($,J){let Z=await qX($),{stdout:Q}=await TX(w5(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return K.array(K.object({browser:K.string(),directory:K.string(),connected:K.boolean().optional(),source:K.string(),socketPath:K.string().optional(),instanceId:K.string().optional(),extensionId:K.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&MX(Y.source)===w5(Z,"Reason Browser Use","manifest.json"))}async function u2($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await FX($,Z)).filter((V)=>V.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await HX(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as _X}from"crypto";function N1($){return`reason-browser-${_X("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var k5=K.discriminatedUnion("ok",[K.object({ok:K.literal(!0),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict(),K.object({ok:K.literal(!1),reason:K.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),h5=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.string(),extensionInstanceId:K.string(),nativeHostName:K.string()})}),Z0=()=>Error("mac_pr_proof_browser_unavailable");async function q9($){let J=c0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await WX($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${jX()}`,Y=!1,V=async()=>{if(Y)throw Z0();if(await $.assertCurrent(),Y)throw Z0()},N=async(M)=>{if(!d1(J,M.owner))throw Z0();await V()},G=async(M)=>{await N(M);let U=await $.readVideo(M.captureId);try{await V();let B=U.capture;if(!d1(B.context.owner,J)||B.captureId!==M.captureId||B.context.prUrl!==M.prUrl||B.context.headSha!==M.headSha||B.media.contentType!=="video/webm"||B.media.sizeBytes!==M.sizeBytes||B.sha256!==M.sha256||U.bytes.length!==M.sizeBytes||U.bytes.length<128||U.bytes.length>10485760||U.bytes.readUInt32BE(0)!==440786851||y5("sha256").update(U.bytes).digest("hex")!==M.sha256)throw Z0();return U}catch(B){throw U.bytes.fill(0),B}};async function H(M,U,B){await V();let q=await Z.discover(AbortSignal.timeout(5000)),L=new h2({socketPath:q.socketPath,sessionId:X,timeoutMs:5000}),T,_=!1,W,O=new Promise((j,D)=>{W=setTimeout(()=>{_=!0,D(Z0())},60000)});O.catch(()=>{});let F=(j)=>Promise.race([j,O]),z=async()=>{if(_)throw Z0();if(await V(),_)throw Z0()};try{await F(L.connect());let j=h5.parse(await F(L.client.getInfo()));if(j.metadata.extensionId!==q.extensionId||j.metadata.extensionInstanceId!==q.instanceId||!j.metadata.nativeHostName)throw Z0();await z(),B?.("connected");let D=L.newTab();D.then((P)=>{if(_)P.close().catch(()=>{Y=!0})},()=>{}),T=await F(D),await z(),await F(T.goto(M,{waitUntil:"domcontentloaded",timeoutMs:15000})),await z(),B?.("loaded");let I=await F(U(T,async(P)=>{await z();let C=await F(T.evaluate(`(${b5.toString()})(${JSON.stringify(P)})`,{awaitPromise:!0}));return await z(),C},z));return await z(),I}finally{_=!0,clearTimeout(W);try{if(T){let j;try{await Promise.race([T.close(),new Promise((D,R)=>{j=setTimeout(()=>R(Z0()),5000)})])}finally{clearTimeout(j)}}}catch{throw Y=!0,Z0()}finally{L.close()}await V()}}return{async screenshot(M,U,B){let q=B1.parse(M);if(await N(q),!Number.isSafeInteger(U)||U<1||Date.parse(q.expiresAt)<=Date.now())throw Z0();B.throwIfAborted();let L=await Z.discover(B),T=new h2({socketPath:L.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),_;try{await T.connect();let W=h5.parse(await T.client.getInfo());if(W.metadata.extensionId!==L.extensionId||W.metadata.extensionInstanceId!==L.instanceId)throw Z0();if(!K.array(K.object({id:K.number()})).max(256).parse(await T.getTabs()).some((z)=>z.id===U))throw Z0();await V(),B.throwIfAborted();let F=K.object({data:K.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await T.cdp.call(U,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(F.data)||F.data.length%4)throw Z0();if(_=Buffer.from(F.data,"base64"),_.toString("base64")!==F.data||_.length>8388608)throw Z0();if(await V(),B.throwIfAborted(),Date.parse(q.expiresAt)<=Date.now())throw Z0();return _}catch{throw _?.fill(0),Z0()}finally{T.close()}},async verifyImages(M){let U=v2(M);if(U.runId!==J.runId||U.media.some((B)=>B.kind!=="image"))throw Z0();return H("about:blank",async(B,q,L)=>{let T=B.browser.client,_=new Set(U.media.map((P)=>P.sourceUrl)),W=new Map,O=new Set,F=!1,z=0,j=!1,D=new Set,R=(P,C)=>{if(D.size>=32){F=!0;return}let f=T.executeCdp(B.id,P,C);D.add(f),f.catch(()=>{F=!0}).finally(()=>D.delete(f))},I=T.onNotification((P)=>{if(P.method!=="onCDPEvent"||!L$(P.params)||!L$(P.params.source)||P.params.source.tabId!==B.id||!L$(P.params.params))return;let C=P.params.params;if(++z>512){F=!0;return}if(P.params.method==="Fetch.requestPaused"){let h=typeof C.requestId==="string"&&L$(C.request)&&C.request.method==="GET"&&typeof C.request.url==="string"&&_.has(C.request.url)&&C.resourceType==="Image";if(typeof C.requestId!=="string"){F=!0;return}if(!h)F=!0;R(h?"Fetch.continueRequest":"Fetch.failRequest",{requestId:C.requestId,...h?{}:{errorReason:"BlockedByClient"}})}if(P.params.method==="Network.requestWillBeSent"&&C.redirectResponse)F=!0;if(P.params.method==="Network.loadingFailed")F=!0;if(P.params.method==="Network.loadingFinished"&&typeof C.requestId==="string")O.add(C.requestId);if(P.params.method!=="Network.responseReceived")return;if(!L$(C.response)||typeof C.response.url!=="string"||!_.has(C.response.url)||typeof C.requestId!=="string"||!L$(C.response.headers)||C.type!=="Image"){F=!0;return}let f=Object.fromEntries(Object.entries(C.response.headers).map(([h,p])=>[h.toLowerCase(),p])),S=Number(f["content-length"]);if(W.has(C.response.url)||C.response.status!==200||C.response.fromServiceWorker===!0||typeof f["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(f["content-length"])||!Number.isSafeInteger(S)||S>8388608||f["content-range"]||f["content-encoding"]&&f["content-encoding"]!=="identity"){F=!0;return}W.set(C.response.url,{id:C.requestId,length:S})});try{await T.executeCdp(B.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await T.executeCdp(B.id,"Network.setBypassServiceWorker",{bypass:!0}),await T.executeCdp(B.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await T.executeCdp(B.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let P=K.object({frameTree:K.object({frame:K.object({id:K.string().min(1).max(256)})})}).parse(await T.executeCdp(B.id,"Page.getFrameTree",{})),C=[...new Set(U.media.map((h)=>new URL(h.sourceUrl).origin))].join(" ");await T.executeCdp(B.id,"Page.setDocumentContent",{frameId:P.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${C}; style-src 'none'"><body></body>`}),await L(),j=!0;try{await T.executeCdp(B.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new f0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await L();let f;try{f=await B.evaluate(`(${S5})(${JSON.stringify(U.media)})`,{awaitPromise:!0})}catch{throw new f0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await L(),!L$(f)||!Array.isArray(f.items)||f.items.length!==U.media.length)throw Z0();await Promise.all(D);let S=[];for(let h=0;h<U.media.length;h++){await V();let p=W.get(U.media[h].sourceUrl);if(F||!p||!O.has(p.id))throw Z0();let b=K.object({base64Encoded:K.literal(!0),body:K.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await T.executeCdp(B.id,"Network.getResponseBody",{requestId:p.id})),x=Buffer.from(b.body,"base64");try{let E=f.items[h];if(x.length!==p.length||x.toString("base64")!==b.body||!L$(E))throw Z0();S.push({...E,sourceSha256:y5("sha256").update(x).digest("hex")})}finally{x.fill(0)}}if(F)throw Z0();return O5({verified:!0,items:S},U)}finally{if(I(),await Promise.allSettled(D),j)try{await T.executeCdp(B.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new f0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(M){let U=g1.parse(M);await N(U);let B="browser_unavailable";try{return await H(`https://github.com/${U.repositoryFullName}`,async(q,L)=>{let T=k5.parse(await L({operation:"preflight",expected:{...U,prUrl:`https://github.com/${U.repositoryFullName}`}}));return K9.parse(T.ok?{...U,status:"ready",observedActor:T.actor,checkedAt:new Date().toISOString()}:T.reason==="attachment_unavailable"?{...U,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...U,status:"not_ready",reason:T.reason})},(q)=>{B=q==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return K9.parse({...U,status:"not_ready",reason:"unavailable",cause:B})}},async publish(M){let U=l$.parse(M);if(await N(U),U.expectedActorId!==null&&U.authenticatedActor.id!==U.expectedActorId)throw Z0();let B=Q.get(U.attemptId);if(B){if(!d1(B.binding,U))throw Z0();return structuredClone(B.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let q={binding:structuredClone(U),result:K1.parse({...U,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(U.attemptId,q);let L=!1,T="dispatch";try{(await G(U)).bytes.fill(0),q.result=await H(U.prUrl,async(_,W)=>{let O=k5.parse(await W({operation:"identity",expected:U}));if(!O.ok)return K1.parse({...U,status:"not_attempted",reason:O.reason});let F=await G(U),z;try{L=!0,z=K.discriminatedUnion("dispatched",[K.object({dispatched:K.literal(!0),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict(),K.object({dispatched:K.literal(!1),reason:K.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await W({operation:"upload",expected:U,base64:F.bytes.toString("base64")}))}finally{F.bytes.fill(0)}if(!z.dispatched)return L=!1,K1.parse({...U,status:"not_attempted",reason:z.reason});if(!d1(z.actor,O.actor))throw T="actor_changed",Z0();T="result";let j=performance.now();while(performance.now()-j<30000){let D=await W({operation:"upload_result",expected:{...U,observedActor:O.actor}});if(D!==null){let R=K.object({nativeUrl:K.string(),actor:K.object({login:K.string(),id:K.string().nullable()}).strict()}).strict().parse(D);return T="finalize",await V(),K1.parse({...U,status:"uploaded",nativeUrl:R.nativeUrl,observedActor:R.actor,uploadedAt:new Date().toISOString()})}await new Promise((R)=>setTimeout(R,100))}throw T="result_timeout",Z0()})}catch{if(L)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${T})
-`);q.result=K1.parse({...U,...L?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(q.result)},async verify(M){let U=u1.parse(M);await N(U);try{return(await G(U)).bytes.fill(0),await H(U.prUrl,async(B,q)=>{await B.browser.client.executeCdp(B.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let L=await q({operation:"saved_player",expected:U});if(!L||typeof L!=="object"||Array.isArray(L))throw Z0();let T=U9.parse({...U,...L,..."status"in L&&L.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(U).some(([_,W])=>!d1(W,T[_])))throw Z0();return T}finally{await B.browser.client.executeCdp(B.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return U9.parse({...U,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function WX($,J){let Z=await DX($);return{async discover(Q){let X=await u2(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Z0();return X},tabScope:N1(J.runId)}}import{realpath as uX}from"fs/promises";var HH=K.object({version:K.literal(1),recording_operation_id:K.string().uuid(),proof_ready:K.literal(!1),acknowledged_at:K.iso.datetime()}).strict(),d2=K.object({action:K.literal("start"),request_id:K.string().uuid(),profile:K.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:K.number().int().positive(),seconds:K.number().int().min(1).max(15)}).strict(),f5=K.object({action:K.literal("inspect"),recording_operation_id:K.string().uuid()}).strict(),qH=K.discriminatedUnion("action",[d2,f5]),v5=K.object({recording_operation_id:K.string().uuid()}).strict(),M9={device_id:K.string().uuid(),root_id:K.string().uuid()},OX=K.discriminatedUnion("action",[d2.extend(M9),f5.extend(M9),v5.extend({...M9,action:K.literal("stop")})]),MH=K.toJSONSchema(OX),LH=K.object({version:K.literal(1),recordingId:K.string().uuid(),proofReady:K.literal(!1),capture:K.object({captureId:K.string().uuid(),contentType:K.literal("video/webm"),sha256:K.string().regex(/^[a-f0-9]{64}$/),sizeBytes:K.number().int().min(128).max(10485760),startedAt:K.iso.datetime(),finishedAt:K.iso.datetime(),durationSeconds:K.number().min(0.05).max(15),frameCount:K.number().int().min(1).max(450),receivedFrameCount:K.number().int().min(1).max(2000),owner:K.object({runId:K.string().uuid(),deviceId:K.string().uuid(),rootId:K.string().uuid(),rootRevision:K.string().max(64),profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:K.string().min(1).max(1024),generation:K.string().uuid(),browserScope:K.string().max(128),tabId:K.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var RH=d2.extend({action:K.enum(["start","inspect"]),recording_boot_generation:K.string().uuid(),recording_operation_id:K.string().uuid().optional(),recording_attempt_id:K.string().uuid().optional()}).strict();import{createHash as bX,randomUUID as wX}from"crypto";import{mkdtemp as yX,realpath as kX,rm as s5}from"fs/promises";import{tmpdir as hX}from"os";import{join as fX}from"path";import{spawn as vX}from"child_process";import{isDeepStrictEqual as mX}from"util";import{createHash as zX}from"crypto";import{execFile as AX}from"child_process";import{chmod as RX,lstat as g5,mkdtemp as PX,readFile as u5,realpath as d5,rm as CX,writeFile as m5}from"fs/promises";import{tmpdir as IX}from"os";import{isAbsolute as EX,join as p2}from"path";import{promisify as xX}from"util";var L9=xX(AX),SX=($)=>zX("sha256").update($).digest("hex");async function Q$($){if(!EX($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await d5($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await g5($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||SX(await u5($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function p1($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([Q$(Z.ffmpeg),Q$(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([Q$(Z.ffmpeg),Q$(Z.ffprobe)]);let V=await d5(await PX(p2(J??IX(),"reason-owned-recording-")));await RX(V,448);let N=p2(V,"capture.webm"),G="frames";try{let H=["ffconcat version 1.0"];for(let[_,W]of Q.entries()){let O=`${_}.jpg`;await m5(p2(V,O),W.jpeg,{mode:384,flag:"wx"});let F=Q[_+1]?.timestamp??Q[0].timestamp+X;H.push(`file '${O}'`,`duration ${Math.max(0.001,F-W.timestamp).toFixed(6)}`)}H.push(`file '${Q.length-1}.jpg'`),await m5(p2(V,"frames.ffconcat"),H.join(`
-`)+`
-`,{mode:384,flag:"wx"});let M={cwd:V,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};G="encode",await L9(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",N],M),G="output";let U=await g5(N);if(!U.isFile()||U.isSymbolicLink()||U.nlink!==1||U.size<128||U.size>10485760)throw Error();G="probe";let{stdout:B}=await L9(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",N],M),q=JSON.parse(B),L=q.streams,T=Number(q.format?.duration);if(G="probe_streams",!Array.isArray(L)||L.length!==1||L[0]?.codec_type!=="video"||L[0]?.codec_name!=="vp8")throw Error();if(G="probe_dimensions",!Number.isSafeInteger(L[0].width)||L[0].width<2||L[0].width>1600||!Number.isSafeInteger(L[0].height)||L[0].height<2||L[0].height>1000)throw Error();if(G="probe_duration",!Number.isFinite(T)||Math.abs(T-X)>0.25)throw Error();if(G="probe_frames",!Number.isSafeInteger(Number(L[0].nb_read_frames))||Number(L[0].nb_read_frames)<1)throw Error();if(G="probe_format",q.format?.format_name!=="matroska,webm")throw Error();return G="decode",await L9(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",N,"-f","null","-"],M),G="pin",await Promise.all([Q$(Z.ffmpeg),Q$(Z.ffprobe)]),await u5(N)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${G}_failed`)}finally{await CX(V,{recursive:!0,force:!0})}}}}var l5=K.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var X$=K.string().min(1).max(1024),p5=K.object({path:X$,sha256:K.string().regex(/^[a-f0-9]{64}$/)}).strict(),c5=K.object({owner:K.object({runId:X$,deviceId:X$,rootId:X$,rootRevision:X$,profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:X$,generation:X$,browserScope:X$,tabId:K.number().int().positive()}).strict(),socketPath:X$,extensionId:K.string().regex(/^[a-p]{32}$/),nativeHostName:X$,seconds:K.number().int().min(1).max(15),encoder:K.object({ffmpeg:p5,ffprobe:p5}).strict()}).strict();var gX=15728640,C$=()=>Error("mac_recording_worker_failed");function a5($){let J=c5.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,V=null,N=async()=>{},G=async(B,q=3000)=>{let L;try{return await Promise.race([B,new Promise((T,_)=>{L=setTimeout(()=>_(C$()),q)})])}finally{clearTimeout(L)}},H=()=>V??=G((async()=>{let q=(await Promise.allSettled([N(),$.cleanup()])).find((L)=>L.status==="rejected");if(q?.status==="rejected")throw q.reason})(),5000).catch((B)=>{X=!0;let q=B&&typeof B==="object"&&"code"in B?B.code:null,L=typeof q==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(q)?q:"unknown";throw Error(`mac_recording_cleanup_failed:${L}`)}),M=null,U=async()=>{if(X)throw C$();if(await G($.assertCurrent()),X)throw C$()};return{async start(){if(Y||M)throw Error("mac_recording_already_active");Y=!0;try{await U(),await Q$({path:Z.path,sha256:Z.sha256}),await U(),V=null;let B=await kX(await yX(fX(hX(),"reason-recording-host-")));try{await U()}catch(x){throw await s5(B,{recursive:!0,force:!0}),x}let q=vX(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),L=new Promise((x)=>q.once("close",()=>x())),T=()=>{if(q.pid)try{process.kill(-q.pid,"SIGKILL")}catch(x){if(x.code!=="ESRCH")throw x}},_=null;N=()=>_??=(async()=>{try{T()}catch(x){if(x.code!=="EPERM")throw x}await L;try{for(let x=0;;x++)try{T();break}catch(E){if(E.code!=="EPERM"||x>=20)throw E;await new Promise((A)=>setTimeout(A,25))}}finally{await s5(B,{recursive:!0,force:!0})}})();let W="",O=0,F=!1,z=!1,j=null,D,R,I=new Promise((x,E)=>{D=x,R=E}),P,C,f=new Promise((x,E)=>{P=x,C=E});f.catch(()=>{});let S=(x=C$())=>{if(F)return;F=!0,clearTimeout(h),clearInterval(b),H().then(()=>{R(x),C(x)},(E)=>{R(E),C(E)})},h=setTimeout(()=>S(),(J.seconds+25)*1000),p=!1,b=setInterval(()=>{if(p||F)return;p=!0,U().catch(()=>S()).finally(()=>{p=!1})},250);M={completion:f,stop:()=>{if(!F)q.stdin.write(`{"type":"stop"}
-`)},cancel:()=>S()},q.on("error",()=>S()),q.stdin.on("error",()=>S()),q.stdout.on("data",(x)=>{if(F)return;if(O+=x.length,O>gX){S();return}W+=x.toString("utf8");let E;while((E=W.indexOf(`
-`))!==-1){let A=W.slice(0,E);W=W.slice(E+1);try{let k=JSON.parse(A);if(k.type==="failed"&&Object.keys(k).sort().join(",")==="reason,type"){let n=l5.safeParse(k.reason);S(n.success?Error(`mac_recording_worker_failed:${n.data}`):C$());return}if(k.type==="unsupported"&&!z){S(Error("mac_recording_encoder_unavailable"));return}if(k.type==="started"&&!z&&Object.keys(k).length===1){z=!0,D({recording:!0});continue}if(!z||k.type!=="capture"||j||Object.keys(k).sort().join(",")!=="bytes,capture,type")throw C$();let y=k.capture;if(!y||Object.keys(y).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof y.sha256!=="string"||typeof y.startedAt!=="string"||typeof y.finishedAt!=="string"||!mX(y.owner,J.owner)||y.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(y.sha256)||!Number.isSafeInteger(y.sizeBytes)||y.sizeBytes<128||y.sizeBytes>10485760||!Number.isSafeInteger(y.frameCount)||y.frameCount<1||y.frameCount>450||!Number.isSafeInteger(y.receivedFrameCount)||y.receivedFrameCount<y.frameCount||y.receivedFrameCount>2000||!Number.isFinite(y.durationSeconds)||y.durationSeconds<0.05||y.durationSeconds>J.seconds||!Number.isFinite(Date.parse(y.startedAt))||!Number.isFinite(Date.parse(y.finishedAt))||Math.abs((Date.parse(y.finishedAt)-Date.parse(y.startedAt))/1000-y.durationSeconds)>0.1||typeof k.bytes!=="string"||k.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(k.bytes))throw C$();let i=Buffer.from(k.bytes,"base64");if(i.length!==y.sizeBytes||bX("sha256").update(i).digest("hex")!==y.sha256||!i.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw C$();j={capture:Object.freeze({...y,captureId:wX(),owner:Object.freeze({...J.owner})}),bytes:i}}catch{S();return}}}),q.once("close",(x)=>{if(F)return;if(x!==0||!j||W.trim()){S();return}let E=j;U().then(async()=>{if(await N(),F)return;F=!0,clearTimeout(h),clearInterval(b),Q.set(E.capture.captureId,E);while(Q.size>2)Q.delete(Q.keys().next().value);P(E.capture)}).catch(()=>S())}),q.stdin.write(JSON.stringify({...J,scratchDirectory:B})+`
-`);try{return await I}catch(x){throw M=null,x}}finally{Y=!1}},async completed(){if(await U(),!M)throw Error("mac_recording_not_active");return M.completion},async stop(){await U();let B=M;if(!B)throw Error("mac_recording_not_started");B.stop();try{return await B.completion}finally{if(M===B)M=null}},async read(B){await U();let q=Q.get(B);if(!q)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(q.capture),bytes:Buffer.from(q.bytes)}},async close(){if(X)return;X=!0;let B=M;B?.cancel(),Q.clear();try{await H(),await B?.completion.catch(()=>{})}finally{M=null}}}}var i5=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.string(),extensionInstanceId:K.string(),nativeHostName:K.string()})});async function T9($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await uX($.automationDirectory);J=(Q,X)=>u2(Z,Q,X)}if(await Q$({path:$.worker.path,sha256:$.worker.sha256}),!await p1($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let V=await J(Z,Y),N=new P$({socketPath:V.socketPath,sessionId:X,timeoutMs:2000}),G;try{if(await N.connect(),G=i5.parse(await N.getInfo()),G.metadata.extensionId!==V.extensionId||G.metadata.extensionInstanceId!==V.instanceId)throw Error("mac_recording_profile_changed");if(!K.array(K.object({id:K.number()})).parse(await N.getTabs()).some((M)=>M.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{N.close()}return{extensionInstanceId:V.instanceId,async createHost(H,M,U){let B=new P$({socketPath:V.socketPath,sessionId:H.browser.browserScope,timeoutMs:2000});return a5({worker:$.worker,configuration:{owner:H.browser,seconds:M,encoder:$.encoder,socketPath:V.socketPath,extensionId:V.extensionId,nativeHostName:G.metadata.nativeHostName},async assertCurrent(){U.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await B.connect();let L=i5.parse(await B.getInfo());if(L.metadata.extensionInstanceId!==H.browser.extensionInstanceId||L.metadata.extensionId!==V.extensionId||L.metadata.nativeHostName!==G.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await B.executeCdp(Q,"Page.stopScreencast",{})}finally{B.close()}}})}}}}var z0=()=>Error("mac_pr_proof_unavailable"),lX=K.object({operationId:K.string().uuid()}).strict();function r5($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=K.array(K.object({profile:K.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:K.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!K.string().uuid().safeParse($.generation).success||new Set(Z.map((B)=>B.profile)).size!==Z.length)throw z0();if(!$.qualifiedProfiles){let B=new URL($.uploadOrigin);if(!$.resolveBrowser||B.protocol!=="https:"||B.origin!==$.uploadOrigin||B.username||B.password)throw z0()}let Q=new Map,X=new Map,Y=new Map,V=!1,N=new dX,G=async(B)=>{let q=N.getStore();if(V||!B&&!q)throw z0();if(q?.signal.throwIfAborted(),await $.assertCurrent(B??q.claim),V)throw z0();q?.signal.throwIfAborted()},H=(B,q)=>{let L="owner"in q?q.owner:("context"in q)?q.context.owner:q.input.owner;if(B.capability!==G9||!B.owner||L.generation!==$.generation||!Z.some((T)=>T.profile===L.profile&&T.extension_instance_id===L.extensionInstanceId)||L.organizationId!==B.owner.organization_id||L.userId!==B.owner.user_id||L.deviceId!==B.owner.device_id||L.rootId!==B.root_id||L.runId!==B.run_id)throw z0();return L},M=async(B)=>{await G();let q=JSON.stringify([B.runId,B.profile]),L=Q.get(q);if(!L){if(Q.size>=4)throw z0();L=(async()=>{let _,W=$.browserScope?.(B)??N1(B.runId),O=await $.createBrowser({owner:B,assertCurrent:()=>G(),readVideo:(F)=>_.publicationCapture(F)});if(_=x5({owner:B,browserScope:W,assertCurrent:()=>G(),screenshot:O.screenshot,async createVideo(F,z,j,D){if(!$.resolveBrowser)throw z0();let R=await $.resolveBrowser(B.profile,z,W,D);if(R.extensionInstanceId!==B.extensionInstanceId)throw z0();return R.createHost({organizationId:B.organizationId,userId:B.userId,operationId:F.contextId,attemptId:F.contextId,recordingId:F.contextId,browser:{runId:B.runId,deviceId:B.deviceId,rootId:B.rootId,rootRevision:B.rootRevision,generation:B.generation,profile:B.profile,extensionInstanceId:B.extensionInstanceId,browserScope:W,tabId:z}},j,D)}}),V)throw O.close(),await _.close(),z0();return{owner:structuredClone(B),browser:O,capture:_,expiresAt:Date.now()+300000}})(),Q.set(q,L)}let T=await L;if(!n5(T.owner,B)||T.expiresAt<=Date.now())throw z0();return T},U=setInterval(()=>{for(let[B,q]of Q)q.then(async(L)=>{if(L.expiresAt>Date.now()||[...X.values()].some((T)=>T.runtime===L))return;if(L.browser.close(),await L.capture.close(),Q.get(B)===q)Q.delete(B)}).catch(()=>{V=!0})},1000);return U.unref(),{generation:$.generation,async execute(B,q,L){return N.run({claim:B,signal:q},async()=>{let T=N9.parse(B.payload).command,_=H(B,T);if(await G(B),q.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(T.action==="prepare"?T.context.evidenceKind!=="image"||Boolean(T.context.visualPlan)||!T.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(T.action)))throw Error("proof_png_only");let W=await M(_),O=async()=>{await G(B),q.throwIfAborted()},F;switch(T.action){case"auth_check":F=await W.browser.preflight(T.input);break;case"prepare":if(T.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!T.context.uploadOrigin)throw z0();F=await W.capture.prepare(T.context);break;case"capture_png":F=await W.capture.screenshot({claim:{operationId:B.operation_id,attemptId:B.attempt_id,contextId:T.contextId,tabId:T.tabId},signal:q});break;case"start_video":{let z={runtime:W,contextId:T.contextId,attemptId:B.attempt_id,tabId:T.tabId,signal:q};if(X.has(B.operation_id))throw z0();X.set(B.operation_id,z);try{F=await W.capture.record({claim:{operationId:B.operation_id,attemptId:B.attempt_id,contextId:T.contextId,tabId:T.tabId},signal:q,seconds:T.seconds,started:async()=>{await O(),await L({version:1,operationId:B.operation_id,contextId:T.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(B.operation_id)}break}case"inspect_capture":F=await W.capture.inspect(T.captureId);break;case"publish_video":F=await W.browser.publish(T.input);break;case"verify_saved_media":F=await W.browser.verify(T.input);break;case"verify_png_media":F=await W.browser.verifyImages(T.media);break;case"publish_png":{let z=`${_.runId}:${T.attemptId}`,j=Y.get(z);if(j){if(!n5(j.request,T))throw z0();F=j.result;break}if(Y.size>=16)throw z0();let D=new URL(T.uploadUrl);if(D.protocol!=="https:"||D.username||D.password||D.hash||D.pathname!==`/${T.storagePath}`||!T.storagePath.startsWith(`pr-screenshots/${_.runId}/${T.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(T.storagePath.split("/").at(-1))||T.storagePath.split("/").length!==4)throw z0();let R=await W.capture.publicationCapture(T.captureId);try{if(D.origin!==($.qualifiedProfiles?R.capture.context.uploadOrigin:$.uploadOrigin)||R.capture.media.contentType!=="image/png"||R.capture.sha256!==T.sha256||R.bytes.length!==T.sizeBytes||pX("sha256").update(R.bytes).digest("hex")!==T.sha256)throw z0();await O();let I={request:structuredClone(T),result:{status:"uncertain",sha256:T.sha256,sizeBytes:T.sizeBytes}};Y.set(z,I);try{let P=await fetch(D,{method:"PUT",body:R.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([q,AbortSignal.timeout(20000)])});if(await P.body?.cancel(),await O(),P.ok)I.result={...I.result,status:"uploaded"}}catch{}F=I.result}finally{R.bytes.fill(0)}break}}return await O(),structuredClone(F)})},async control(B,q){if(B.capability!==G9||q.kind!==I5)return!1;let L=lX.safeParse(q.payload),T=X.get(B.operation_id);if(!L.success||L.data.operationId!==B.operation_id||!T||T.attemptId!==B.attempt_id)return!1;let _=N9.parse(B.payload).command;return H(B,_),await G(B),await N.run({claim:B,signal:T.signal},()=>T.runtime.capture.stop({operationId:B.operation_id,attemptId:B.attempt_id,contextId:T.contextId,tabId:T.tabId})),!0},async close(){V=!0,clearInterval(U);let B=await Promise.allSettled([...Q.values()].map(async(q)=>{let L=await q;L.browser.close(),await L.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),B.some((q)=>q.status==="rejected"))throw z0()}}}var oX="__browser-recorder",eX=tX(cX),$Y="/tmp/open-browser-use",JY=33554432,ZY=K.object({version:K.literal("0.1.42"),metadata:K.object({extensionId:K.literal(l2),extensionInstanceId:K.string().min(1).max(1024)})}),o5=()=>Error("worker_pr_proof_browser_unavailable"),D9={components:v1,ensureBrowser:ZJ,socketDirectory:$Y,async identity($){let J=new P$({socketPath:$,sessionId:`reason-proof-qualification-${j9()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function e5($,J=D9){let Z=J.components();if(!Z?.features.browser)throw o5();await J.ensureBrowser(Z),$.throwIfAborted();let Q=F9(QJ(Z),"Default","Local Extension Settings",l2),X=(await t5(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>F9(Q,Y));for(let Y of(await t5(J.socketDirectory)).filter((V)=>V.endsWith(".sock"))){$.throwIfAborted();let V=F9(J.socketDirectory,Y);try{let N=await aX(V);if(!N.isSocket()||N.uid!==process.getuid?.())continue;let G=ZY.parse(await J.identity(V)).metadata.extensionInstanceId;for(let H of X)if((await nX(H)).size<=JY&&(await XJ(H)).includes(G))return{socketPath:V,instanceId:G,extensionId:l2}}catch{}}throw o5()}async function _9($){let J=await iX($);return{path:J,sha256:sX("sha256").update(await XJ(J)).digest("hex")}}async function YJ($={}){let J={...D9,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await _9(Z.ffmpeg),{stdout:X}=await eX(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await _9(Z.ffprobe)};if(!await p1(Y))return{error:"worker_recording_encoder_unqualified"};let V=$.recorder??{path:process.execPath,args:[...rX(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],oX]};return{worker:{...await _9(V.path),args:V.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function VJ($,J={}){let Z={...D9,...J},Q=j9(),X=j9(),Y=$J.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),V=$.recording?JJ.parse({...Y,version:3,video:!0,max_seconds:15}):Y,N=(U)=>j5(U.organizationId,U.sessionId,U.deviceId,1),G=$.recording,H,M=r5({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:N,...G?{resolveBrowser:async(U,B,q,L)=>{H??=T9({...G,assertCurrent:()=>$.assertCurrent(),discover:(_,W)=>e5(W,Z)}),H.catch(()=>{H=void 0});let T=await(await H)(U,B,q,L);return{extensionInstanceId:X,createHost:async(_,W,O)=>QY(await T.createHost({..._,browser:{..._.browser,extensionInstanceId:T.extensionInstanceId}},W,O),X)}}}:{},createBrowser:(U)=>q9({...U,endpoint:(B)=>({discover:(q)=>e5(q,Z),tabScope:N(B)})})});return{capability:V,broker:M}}function QY($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as DY}from"child_process";import{execFile as XY}from"child_process";import{readFile as YY}from"fs/promises";import{join as o0}from"path";var VY="Claude Code-credentials",GY="/usr/bin/security",BY=120000,KY=8192,c2={exec:($,J,Z)=>new Promise((Q)=>{XY($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let V=X?typeof X.code==="number"?X.code:1:0;Q({code:V,stdout:String(Y??"")})})}),readText:async($)=>{try{return await YY($,"utf8")}catch{return null}}};function H1($){return typeof $==="string"&&$.length>0&&$.length<=KY?$:null}function UY($,J){return $.CLAUDE_CONFIG_DIR||o0(J,".claude")}function NY($,J){return $.CODEX_HOME||o0(J,".codex")}function GJ($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=H1(J?.accessToken),Q=H1(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function HY($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function qY($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=H1(J.tokens?.access_token),Q=H1(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:HY(Z)??Date.now()}}catch{return null}}function MY($,J){return o0($.XDG_DATA_HOME||o0(J,".local","share"),"opencode","auth.json")}var LY={anthropic:"anthropic",openai:"openai-codex"};function TY($){return NJ($,LY)}function NJ($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let V=Z[X];if(V?.type!=="oauth")continue;let N=H1(V.access),G=H1(V.refresh),H=typeof V.expires==="number"&&Number.isFinite(V.expires)?V.expires:null;if(N&&G&&H!==null)Q.push({provider:Y,access:N,refresh:G,expires:H})}return Q}catch{return[]}}function FY($){return NJ($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function _Y($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?o0(J,Z.slice(2)):Z||o0(J,".pi","agent")}async function HJ($,J,Z=c2){let Q=[],X=await Z.exec(GY,["find-generic-password","-s",VY,"-w"],BY),Y=Date.now()+300000,V=(G)=>{if(!G)return;let H=Q.findIndex((M)=>M.provider===G.provider);if(H<0)Q.push(G);else if(Q[H].expires<=Y&&G.expires>Y)Q[H]=G};if(V(X.code===0?GJ(X.stdout.trim()):null),!Q.some((G)=>G.provider==="anthropic"&&G.expires>Y))V(GJ(await Z.readText(o0(UY($,J),".credentials.json"))));let N=qY(await Z.readText(o0(NY($,J),"auth.json")));V(N),V(jY(await Z.readText(o0($.GROK_HOME||o0(J,".grok"),"auth.json"))));for(let G of TY(await Z.readText(MY($,J))))V(G);for(let G of FY(await Z.readText(o0(_Y($,J),"auth.json"))))V(G);return Q}function qJ($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var BJ="https://auth.x.ai",KJ="b1a00492-073a-47ea-816f-4c329264a828",UJ=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function jY($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${BJ}::${KJ}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==BJ||Q.oidc_client_id!==KJ||!UJ(Q.key)||!UJ(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var MJ=330000,WY=300000,OY=60000;function zY($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+MJ)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function AY($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*MJ)?OY:WY}var RY=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function LJ($){let J=new Map,Z=$.wait??RY,Q=$.stores??(process.platform==="darwin"?c2:{...c2,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=qJ(await HJ($.environment??process.env,$.home,Q));for(let Y of zY(X,J)){if($.signal.aborted)return;let V=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:V.ok,...V.ok?{}:{error:V.error}})}}catch{}await Z(AY(J),$.signal)}}function TJ($=process.env){return new Promise((J)=>{DY("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as PY,spawn as $M,spawnSync as JM}from"child_process";import{chmodSync as QM,existsSync as CY,mkdirSync as XM,readFileSync as YM,renameSync as VM,rmSync as GM,statSync as BM,writeFileSync as KM}from"fs";import{dirname as NM,isAbsolute as HM,join as s2}from"path";var FJ=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function _J($,J){if(!FJ.test($)||!FJ.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var IY="com.reasonmachines.updater",EY=["so.ara.updater","so.reason.updater"];function xY($){let J=$==="staging"?".staging":"";return{label:`${IY}${J}`,legacyLabels:[...EY].reverse().map((Z)=>`${Z}${J}`)}}function SY($,J){return J==="darwin"?$.launchAgent:J==="win32"?$.scheduledTask:$.systemdService}function bY($,J,Z){return{launchAgent:s2(J,"Library","LaunchAgents",`${$}.plist`),systemdService:s2(Z,"systemd","user",`${$}.service`),systemdTimer:s2(Z,"systemd","user",`${$}.timer`),scheduledTask:s2(OJ(J),`${$}.xml`)}}function wY($,J){return new Promise((Z)=>{PY(DJ($),[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function zJ($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux"&&J!=="win32")return"absent";let Z=$.uid??process.getuid?.();if(J!=="win32"&&(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0))return"absent";let Q=$.home??U0(),{label:X,legacyLabels:Y}=xY($.channel),V=$.configHome??WJ(Q),N=[X,...Y].filter((U)=>{return CY(SY(bY(U,Q,V),J))});if(N.length===0)return"absent";let G=$.command??wY,H=N[0];if(N.length>1){for(let U of N)if((J==="darwin"?await G("/bin/launchctl",["print",`gui/${Z}/${U}`]):J==="win32"?await G("schtasks",["/Query","/TN",U]):await G("systemctl",["--user","is-enabled",`${U}.timer`]))===0){H=U;break}}return(J==="darwin"?await G("/bin/launchctl",["kickstart",`gui/${Z}/${H}`]):J==="win32"?await G("schtasks",["/Run","/TN",H]):await G("systemctl",["--user","start","--no-block",`${H}.service`]))===0?"started":"failed"}var jJ=60000;function AJ($){let J=(X,Y)=>{try{return _J(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let V=setTimeout(X,Y);V.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(V),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),V=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(jJ-1,Math.floor(V*jJ)))}}var yY=30000;async function PJ($){return($.flush??RJ)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(yY);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof L0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var IJ=25000,hY=5000,fY=600000,vY=["display.stream.v1","pty.start"],mY=64;function z9($,J,Z=R9($),Q){return m0(),lJ(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var EJ=5000,gY=600000;function uY($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[s$])return null;try{return a2({platform:J})}catch{return null}}function dY($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function pY($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=Z9();if(Z.length>0)s1($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)s1($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function i1($,J,Z,Q,X={}){if(m0(),$.executionMode==="host")a1();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let V=e($);if(V.revoked)throw Error("worker_revoked");let N=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let G,H=()=>G??=$.executionMode==="host"?dJ():Promise.resolve(!1),M=fJ(),U=X.prestartedReadiness??f1($,X.readinessProbes,N,J.roots[0].permissions),B=X.deferOptionalLanes===!0,q=await(B?U.initial:U.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let L,T=q["github.local.v1"]===!0?(X.probeGithubSignedIn??TJ)().catch(()=>!1):null,_=new AbortController,W=null,O=async(w,a)=>{let j0=($.userChrome??X.ownComputer===!0)&&w["automation.call.v1"]===!0?uJ():null;if(j0&&"code"in j0)process.stderr.write(`Reason worker: your own Chrome unavailable (${j0.code})
-`);let x0=R9($,w,{displayVideo:w["display.stream.v1"]===!0&&await H(),handsBrowser:w["hands.connect"]===!0&&M,userChrome:j0&&"host"in j0?j0.host:null,...L===void 0?{}:{githubSignedIn:L},persistentTerminals:w["pty.start"]===!0&&y2(),probing:a,ownComputer:X.ownComputer===!0});if(!W&&x0.worker.readiness?.["browser.pr-proof.v1"]===!0){let Q0=await YJ();if(W||_.signal.aborted)return x0;process.stderr.write("error"in Q0?`Reason worker: PR video proof unavailable (${Q0.error})
-`:`Reason worker: PR video proof ready (ffmpeg ${Q0.encoder.ffmpeg.path})
-`),W=VJ({assertCurrent:async()=>{if(!b())throw Error("proof_authority_lost")},...!("error"in Q0)?{recording:Q0}:{}})}return x0},F=await O(q,B?Q9.filter((w)=>q[w]!==!0):[]),z=z9($,J,F,W?.capability);X.onStartup?.("inventory_completed");let j=!1,D=0,R=0,I="starting",P=null,C=!1,f=!1,S=null,h,p=()=>!V.drained&&Date.parse(Y)>Date.now()&&z.supported_operations.some((w)=>F.worker.readiness?.[w]===!0),b=()=>!j&&p(),x=null,E=()=>D+(x?.claims()??0),A=null,k=new Set,y=(w)=>{let a=w.capabilities.root_paths;if(Object.assign(w.capabilities,z9(w.config,w.state,F,W?.capability)),a)w.capabilities.root_paths=a},i=(w)=>{F=w,y({config:$,state:J,capabilities:z}),A?.();for(let a of k)y(a),a.heartbeatNow?.()},n=new Set,Y0=new Set,H0=setInterval(()=>{let w=new Set;for(let a of[{state:J,capabilities:z},...k])for(let q0 of vY){if(a.capabilities.operation_constraints?.[q0]?.probing!==!0)continue;let x0=`${a.state.deviceId} ${q0}`;if(w.add(x0),!n.has(x0)||Y0.has(x0))continue;Y0.add(x0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:a.state.deviceId,lane:q0,login_device:a.state===J,timestamp:new Date().toISOString()})}
-`)}n.clear();for(let a of w)n.add(a)},fY);H0.unref();let u0=(w)=>{if(!X.readinessProbes)K5({config:$,readiness:w,signal:_.signal,idle:()=>E()===0,permissions:J.roots[0].permissions,onReady:(a)=>{O(a,[]).then(i)}})},E0=B?U.final.then(async(w)=>{if(_.signal.aborted)return;i(await O(w,[]));let a=Q9.filter((q0)=>w[q0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${a.length?`ready: ${a.join(", ")}`:"none ready"}).
-`),u0(w)},()=>{}):Promise.resolve();if(!B)u0(q);T?.then(async(w)=>{L=w;for(;;){let a=F,q0=await O(a.worker.readiness??{},a.worker.probing??[]);if(_.signal.aborted)return;if(F!==a)continue;i(q0);return}});let s0=B&&F.worker.probing?.includes("pty.start")?U.pty.then(async(w)=>{let a=()=>F.worker.probing?.includes("pty.start")===!0;if(_.signal.aborted||!a())return;let q0=await O({...F.worker.readiness,"pty.start":w},(F.worker.probing??[]).filter((j0)=>j0!=="pty.start"));if(_.signal.aborted||!a())return;i(q0)},()=>{}):Promise.resolve(),S$=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:I,drained:V.drained||j||C,activeClaims:E(),activeSessions:R,lastHeartbeat:P,expiresAt:Y,supportedOperations:[...z.supported_operations],capabilityReadiness:F.worker.readiness,executionEligible:b()&&!C&&I==="running"}),n$=!1,F$=()=>{n$=!0,K$()},K$=()=>{if(j)return;if(j=!0,I="stopping",S?.close(),E()===0)_.abort();else h=setTimeout(()=>_.abort(),$.shutdownGraceMs)},b$=$.channel==="production"||$.channel==="staging"?$.channel:null,U$=d($).releaseCheck,d0=X.publishedRelease??(b$&&$.lifetime==="persistent"?AJ({currentVersion:r,signal:_.signal,actedOn:(()=>{try{let w=JSON.parse(s(U$));return typeof w==="string"?w:null}catch{return null}})(),check:async(w)=>{try{c(U$,w)}catch{}let a=await zJ({channel:b$});process.stderr.write(a==="started"?`Reason worker: CLI ${w} is published; the updater is checking now.
-`:a==="absent"?`Reason worker: CLI ${w} is published; no updater is installed for it here.
-`:`Reason worker: CLI ${w} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),D1=(w)=>{if(w==="stop")F$();if(w==="reload_roots"){let a=t($);if(!a||a.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=a.roots;let q0=pJ(J.roots,CJ());if(q0)z.root_paths=q0;else delete z.root_paths;x?.check()}if(w==="drain"||w==="resume"){if(j||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");V={...V,drained:w==="drain"},P0($,V)}return S$()};X.prestartedControl?.handle(D1);let r$=X.prestartedControl?await X.prestartedControl.closed:await A2($,Q,D1),m,J0=!1,_$=()=>{let w=Date.parse(Y)-Date.now();if(w>0){m=setTimeout(_$,Math.min(w,2147483647));return}j=!0,S?.close(),J0=!0,I="stopping",_.abort(Error("worker_credential_expired"))};_$(),X.signal?.addEventListener("abort",K$,{once:!0});let N$=X.processSignals!==!1;if(N$)process.once("SIGTERM",K$),process.once("SIGINT",F$);if(X.signal?.aborted)K$();try{X.onStartup?.("control_ready");let w=X.client??new c1(R$($.apiOrigin),b0($.proxy,xJ()),Z,{deviceSession:c3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),a=d($).daemon,q0=_3($,J.deviceId),j0=X.startupTiming,x0=j0?()=>({...j0(),...q0?.enrollmentMs!==void 0?{enrollment_ms:q0.enrollmentMs}:{}}):void 0,Q0=(v)=>{let i0=v.client.localSubscription?.bind(v.client);if($.localLogins===!0&&i0)(X.handOverLocalLogins??LJ)({state:v.state,client:{localSubscription:i0},signal:v.signal,home:U0()}).catch(()=>{return});let F0=CJ(),S0=v.client.liveSessionWorktrees?.bind(v.client);if(S0)yJ(()=>wJ({home:F0,deviceId:v.state.deviceId,liveIds:(D$)=>S0(v.state,D$,v.signal)}),v.signal)};Q0({state:J,client:w,signal:_.signal});let a0=uY($,X.platform??process.platform),D0=w.deviceLifecycle?.bind(w),e0=Promise.resolve(),j$=0,w$=()=>{if(!a0||!D0||j||Date.now()<j$)return;j$=Date.now()+gY,e0=e0.then(()=>PJ({paths:a0,device:J,client:{deviceLifecycle:D0},accept:dY,signal:_.signal})).catch(()=>{return})};if(w$(),a0)U.final.then((v)=>pY(a0,v),()=>{});let t$=(v,i0)=>({state:v.state,client:v.client,...v.firstHeartbeat?{firstHeartbeat:v.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:v.capabilities,signal:v.signal,statusPath:v.statusPath,maxConcurrentClaims:X.ownComputer===!0?mY:4*$.slots+mJ,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:IJ,operationCompletionTimeoutMs:IJ,maxConsecutiveHeartbeatFailures:3,claimable:b,advertised:p,onClaim:async(F0,S0,D$)=>{let O1=Date.now();if(!v.capabilities.supported_operations.includes(F0.capability))return{status:"failed",error_code:"unsupported_capability"};let n0=F.worker.probing??[],n9=n0.includes(F0.capability)?E0:F0.capability==="hands.connect"&&$.executionMode==="host"&&n0.includes("pty.start")?s0:null;if(n9){let X2,M3=()=>{};await Promise.race([n9,new Promise((r9)=>{X2=setTimeout(r9,hY),M3=()=>r9(),S0.addEventListener("abort",M3,{once:!0})})]),clearTimeout(X2),S0.removeEventListener("abort",M3)}let Q2=F0.capability==="hands.connect",q3=Q2?S:null,j7={signal:S0,emit:D$,...F,...W?{proveMac:W.broker.execute}:{},...F0.capability==="inference.custom.v1"&&v.client.operationCustomEndpointCredential?{customEndpointCredential:(X2)=>v.client.operationCustomEndpointCredential(v.state,F0,X2)}:{},...Q2?{handsLaunch:{claimedAtMs:O1,...q3?{takePrespawnedWorker:q3.take,adoptSpawnedWorker:q3.adopt}:{}}}:{}};if(Q2)R+=1;try{return await(X.execute??P9)(v.state,F0,j7)}finally{if(Q2)R-=1}},onControl:async(F0,S0)=>await cJ(v.state,F0,S0,v.client)||await sJ(v.state,F0,S0)||await gJ(F0,S0)||await W?.broker.control(F0,S0)||!1,onEvent:i0}),A0=async(v)=>{await v.client.deviceLifecycle?.(v.state,{event_id:kY(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(EJ)).catch(()=>{return})},W0=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,W1=w.ownerWorkspaces?.bind(w),Z2=w.ownerWorkspaceEnrollment?.bind(w);if(W0&&W1&&Z2)x=W4({config:$,state:J,signal:_.signal,client:{ownerWorkspaces:W1,ownerWorkspaceEnrollment:Z2},...W0.enroll?{enroll:W0.enroll}:{},log:(v)=>{process.stderr.write(v)},serve:async(v,i0,F0)=>{let S0=_3(v.config,v.state.deviceId),D$={config:v.config,state:v.state,signal:i0,statusPath:d(v.config).daemon,...S0?.offer?{firstHeartbeat:S0.offer}:{},capabilities:z9(v.config,v.state,F,W?.capability),client:W0.client?.(v)??new c1(R$($.apiOrigin),b0($.proxy,xJ()),v.proofStore,{deviceSession:c3({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};Q0(D$);let O1={...D$,heartbeatNow:null};k.add(O1);try{await i3({registerHeartbeatNow:(n0)=>{O1.heartbeatNow=n0},...t$(D$,(n0)=>{if(n0.type==="completed")A9(n0.operationId,n0.status);if(n0.type==="claims_changed"){if(F0(n0.activeClaims),j&&E()===0)_.abort()}if(n0.type==="stopped")F0(0)})})}finally{k.delete(O1)}if(j&&!J0)await A0(D$)}});let U3=0,N3=0,H3=W0?.intervalMs??T4;if(await i3({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>E()>0?j2(a):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(v)=>{A=v},...x0?{startup:x0}:{},...t$({state:J,client:w,capabilities:z,signal:_.signal,statusPath:a,...q0?.offer?{firstHeartbeat:q0.offer}:{}},(v)=>{if(v.type==="completed")A9(v.operationId,v.status);if(v.type==="claims_changed"){if(D=v.activeClaims,j&&E()===0)_.abort()}if(v.type==="heartbeat"&&!j){if(v.handsPrespawn&&$.lifetime==="ephemeral"&&!S)S=hJ({log:(i0,F0)=>{process.stderr.write(`${JSON.stringify({event:i0,...F0})}
-`)}}),S.arm(),setTimeout(vJ,0);else if(!v.handsPrespawn&&S)S.close(),S=null}if(v.type==="heartbeat"){if(x&&!j&&Date.now()>=U3)U3=Date.now()+H3,x.check().then((i0)=>{N3=i0?0:N3+1,U3=Date.now()+(i0?H3:Math.min(H3,F4*2**Math.min(N3-1,10)))});if(P=v.serverTime,C=v.drain,w$(),!j&&b$)d0?.(v.latestCliVersions?.[b$]);if(!j)I="running";if(!j&&!f&&S$().executionEligible){if(f=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{O9({skipWhenSettled:!0})}catch{}},0)}}if(v.type==="reconnecting"&&!j)I="reconnecting";if(v.type==="stopped")D=0;X.onEvent?.(v)})}),await x?.settled(),j&&!J0&&$.lifetime==="ephemeral")await w.disconnect?.(J,AbortSignal.timeout(EJ)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(j&&!J0)await A0({state:J,client:w});if(n$)await kJ().catch(()=>{return})}catch(w){if(!(w instanceof L0&&w.status===401))throw w;if(P0($,{...V,revoked:!0}),w.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(m),clearInterval(H0),h)clearTimeout(h);if(N$)process.removeListener("SIGTERM",K$),process.removeListener("SIGINT",F$);X.signal?.removeEventListener("abort",K$),_.abort(),S?.close(),await x?.settled().catch(()=>{return}),await W?.broker.close().catch(()=>{return}),await r$()}}function xJ($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(SJ,bJ),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as lY,sign as cY}from"crypto";var aJ=65536,sY=65536;function aY($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new V0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new V0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!nJ(X))throw new V0("invalid_public_key");return X}function iJ(){try{let{privateKey:$,publicKey:J}=lY("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:aY(J)}}catch($){if($ instanceof V0)throw $;throw new V0("proof_key_generation_failed")}}class n1{keyPair=iJ();binding=null;loadPublicKey(){if(!this.keyPair)throw new V0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=iJ(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>sY)throw new V0("proof_sign_failed");let J;try{J=cY("sha256",$,this.keyPair.privateKey)}catch{throw new V0("proof_sign_failed")}if(!rJ(J))throw new V0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>aJ)throw new V0("invalid_binding");if(this.binding)throw new V0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>aJ)throw new V0("invalid_binding");if(!this.binding)throw new V0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as $V,spawn as JV}from"child_process";import{isAbsolute as ZV}from"path";import{promisify as QV}from"util";var r1={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class t1{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let V=this.waiter;this.waiter=void 0,V.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=r1){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
-`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(V)=>V?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as iY}from"crypto";import{unlinkSync as nY}from"fs";import{join as rY}from"path";var o1=1,i2=45000,tY=K.strictObject({type:K.literal("configure"),protocol:K.literal(o1),version:K.string(),config:$0}),oY=K.strictObject({type:K.literal("ticket"),organizationId:K.string().min(1).max(160),receipt:K.unknown()}),eY=K.strictObject({type:K.enum(["ping","stop"])});async function tJ($={}){let J=$.clock??r1,Z=new t1($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),V,N,G,H,M=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:U,version:B}=tY.parse(await Z.receive(30000,Q.signal));if(B!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(H$(U),o(g(U),!0),N=Z$({path:d(U).lock,runtimeVersion:r}),!N.acquired)throw Error("worker_already_running_or_lifecycle_busy");let q=rY(g(U),`ssh-preflight-${iY()}.json`);try{c(q,{version:1}),s(q)}finally{try{nY(q)}catch{}}let L=t(U),T=e(U);if(T.revoked||T.drained)throw Error("worker_ssh_revoked_or_drained");if(L&&Date.parse(L.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(L&&U.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:o1,version:r,platform:process.platform,architecture:process.arch,enrolled:!!L});let _=U.lifetime==="ephemeral"?G=new n1:M0(U,!0);if(!L){let j=A$(U);await Z.send({type:"ticket-request",request:j.request});let D=oY.parse(await Z.receive(70000,Q.signal)),R=j.complete(D.organizationId,D.receipt);if(L=await J$(U,R,_,$.enroll),U.lifetime==="persistent")h0(L,d(U).state,{proofStore:_});P0(U,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");V=(async()=>{try{while(!X.signal.aborted){if(eY.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let W=!1,O,F=!1;H=J.after(Math.max(1,Math.min(i2,$.startupTimeoutMs??i2)),()=>{F=!0,Y()});let z=N.owner.nonce;if(await i1(U,L,_,z,{...$,signal:Q.signal,onEvent(j){if($.onEvent?.(j),j.type==="heartbeat"&&!W&&!O)O=(async()=>{let D=await B0(U,"status");if(!D?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:D.deviceId,expiresAt:D.expiresAt,lifetime:U.lifetime,supervision:"ssh-foreground"}),W=!0,H?.()})().catch(()=>{F=!0,Y()})}}),await O,F||!W)throw Error("worker_ssh_outbound_or_readiness_failed");return M=!0,0}catch(U){let B=U instanceof Error&&/^worker_[a-z_]+$/.test(U.message)?U.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:B})}catch{}return 1}finally{if(H?.(),Y(),X.abort(),await V,G?.deleteBinding(),G?.deleteKey(),N?.acquired)N.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),M)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var I9=($)=>ZV($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),C9=($)=>`'${$.replaceAll("'","'\\''")}'`,XV=K.strictObject({type:K.literal("hello"),protocol:K.literal(o1),version:K.string(),platform:K.enum(["linux","darwin"]),architecture:K.enum(["arm64","x64"]),enrolled:K.boolean()}),YV=K.strictObject({type:K.literal("ticket-request"),request:K.strictObject({install_id:K.uuid(),code_challenge:K.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:K.enum(["persistent","ephemeral"]),roots:K.array(K.strictObject({path_fingerprint:K.string().regex(/^[a-f0-9]{64}$/),execution_mode:K.enum(["confined","host"]),permissions:K.strictObject({read:K.literal(!0),write:K.literal(!0),execute:K.literal(!0),discover_environment:K.literal(!0),expose_mcp:K.literal(!1)})})).length(1)})}),oJ=K.discriminatedUnion("type",[K.strictObject({type:K.literal("running"),deviceId:K.string().min(1).max(160),expiresAt:K.iso.datetime({offset:!0}),lifetime:K.enum(["persistent","ephemeral"]),supervision:K.literal("ssh-foreground")}),K.strictObject({type:K.literal("pong")}),K.strictObject({type:K.literal("stopped")})]),VV=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function n2($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&VV.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function eJ($){if(!I9($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
-a=${C9($.remoteCli)}
-[ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
-p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
-p=$(cd -P "$p" && pwd -P)
-[ "\${p%/}/$f" = "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
-if [ -x /usr/bin/sha256sum ]; then h=$(/usr/bin/sha256sum < "$a");
-elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
-else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
-h=\${h%% *}
-[ "$h" = ${C9($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${C9(J)}`}function $6($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!I9($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,eJ($)]}function GV($){return $6($,!1)}function J6(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:U0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function BV($){let J;try{({stdout:J}=await QV($V)("/usr/bin/ssh",["-G",...$6($,!0)],{env:J6(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
-`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function KV($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function UV($){await BV($);let J=JV("/usr/bin/ssh",GV($),{stdio:["pipe","pipe","pipe"],env:J6()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let V=KV(Z);Z="",X({exitCode:Y??1,errorCode:V})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function NV($){let J=new Map,Z=!1;for(let V=0;V<$.length;V++){let N=$[V];if(N==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(N)||J.has(N))throw Error("worker_unknown_or_duplicate_flag");let G=$[++V];if(!G||G.startsWith("--"))throw Error("worker_missing_flag_value");J.set(N,G)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(V)=>{let N=J.get(V);if(!N)throw Error("worker_required_input_missing");return N},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!I9(X.sshConfig))throw Error("worker_ssh_invalid_target");eJ(X),s(X.sshConfig);let Y=$0.parse(JSON.parse(s(Q("--config"))));if(e1(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function HV($,J,Z,Q,X){let{request:Y}=YV.parse(n2(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let V=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},N=(async()=>{V();let H=Z??O$(J),M=await(Q.enrollmentCredentials??z$)(J,H);if(V(),!M)throw Error("worker_session_login_required");if(!C0(M.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let U=Q.createTicketClient?.(M)??new I$(M,{credentialsPath:H}),B=A3(await U.createHeadlessDeviceEnrollmentTicket(Y));return V(),{type:"ticket",organizationId:M.orgId,receipt:B}})(),G;try{let H=await Promise.race([N,new Promise((M,U)=>{if(G=()=>U(Error("worker_ssh_cancelled")),X.aborted)G();else X.addEventListener("abort",G,{once:!0})})]);V(),await $.send(H)}finally{X.removeEventListener("abort",G)}}async function Z6($,J={}){let{config:Z,target:Q,credentialPath:X}=NV($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??r1,V=await(J.sshTransport??UV)(Q),N=new t1(V.output,V.input,Y),G=new AbortController,H=()=>G.abort(),M,U;if(V.result.then((B)=>{U=B}),process.once("SIGINT",H),process.once("SIGTERM",H),J.signal?.addEventListener("abort",H,{once:!0}),J.signal?.aborted)H();try{if(G.signal.aborted)throw Error("worker_ssh_cancelled");await N.send({type:"configure",protocol:o1,version:r,config:Z});let B=XV.parse(n2(await N.receive(30000,G.signal)));if(B.version!==r)throw Error("worker_ssh_version_mismatch");if(!B.enrolled)await HV(N,Z,X,J,AbortSignal.any([G.signal,N.signal]));M=Y.every(1e4,()=>{N.send({type:"ping"}).catch(H)});let q=!1,L=Y.now()+(B.enrolled?0:O3)+i2+5000;while(!0){let T=q?35000:Math.max(1,L-Y.now()),_=oJ.parse(n2(await N.receive(T,G.signal)));if(_.type==="running"){if(q||_.lifetime!==Z.lifetime||Date.parse(_.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");q=!0,(J.io??process).stdout.write(JSON.stringify(_)+`
-`)}if(_.type==="stopped"){if(!q)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(B){if(G.signal.aborted){M?.();try{await N.send({type:"stop"});let q=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<q)if(oJ.parse(n2(await N.receive(Math.max(1,q-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(B instanceof Error&&B.message==="worker_ssh_connection_closed"){let q=U??await Promise.race([V.result,new Promise((L)=>setTimeout(L,100))]);if(q?.exitCode)throw Error(q.errorCode)}throw B}finally{M?.(),process.removeListener("SIGINT",H),process.removeListener("SIGTERM",H),J.signal?.removeEventListener("abort",H),V.close(),N.dispose()}}import{createConnection as FV}from"net";import{WebSocket as r2}from"ws";var qV=1,M1=65536,Q6=4096,X6=67108864,Y6=4194304,q1=K.uuid(),MV=K.strictObject({kind:K.literal("install_only"),authorityId:q1,organizationId:q1,userId:q1,connectionId:q1,attemptId:q1,purpose:K.literal("install"),generation:K.number().int().positive(),transport:K.literal("reverse_ssh"),expiresAt:K.iso.datetime({offset:!0}),maxDurationMs:K.literal(300000),maxChannels:K.literal(1),allowTcpForwarding:K.literal(!1),allowPty:K.literal(!1)}),LV=K.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!q1.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var TV=K.strictObject({protocol:K.literal(qV),type:K.literal("ssh_install_relay"),authorityToken:K.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:MV,relayUrl:LV,endpoint:K.strictObject({host:K.literal("127.0.0.1"),port:K.literal(22)})});function E9($,J=Date.now()){let Z=TV.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function V6($){let J=JSON.stringify($);if(Buffer.byteLength(J)>M1)throw Error("ssh_install_relay_frame_too_large");return J}function G6($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:E9(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var B6="ssh_install_relay_closed";function _V($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function jV($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function DV($,J=B6){try{$.close(1000,J)}catch{$.terminate()}}async function WV($){let J=$.now??(()=>Date.now()),Z=E9($.receipt,J()),X=($.createWebSocket??((j)=>new r2(j,{followRedirects:!1,perMessageDeflate:!1,maxPayload:M1})))(Z.relayUrl),Y=$.connectLocal??(()=>FV({host:"127.0.0.1",port:22})),V,N=!1,G=!1,H=0,M=0,U,B=(j)=>{if(U)clearTimeout(U);U=setTimeout(()=>T("ssh_install_relay_expired"),Math.max(1,j)),U.unref?.()},q,L=new Promise((j)=>{q=j}),T=(j=B6)=>{if(G)return;if(G=!0,U)clearTimeout(U);if($.signal?.removeEventListener("abort",_),V?.destroy(),X.readyState===r2.OPEN)DV(X,j);else if(X.readyState!==r2.CLOSED)X.terminate();q()},_=()=>T("ssh_install_relay_aborted"),W=()=>T("ssh_install_relay_protocol_error"),O=(j)=>{return H+=1,M+=j,j<=M1&&H<=Q6&&M<=X6},F=(j)=>{if(G||!N||X.readyState!==r2.OPEN||X.bufferedAmount>Y6||!O(j.length)){W();return}X.send(j,{binary:!0},(D)=>{if(D)W()})};X.on("open",()=>{if(G)return;try{let j=V6({type:"ssh_install_relay_receipt",receipt:Z});X.send(j,{binary:!1},(D)=>{if(D)W()})}catch{W()}}),X.on("message",(j,D)=>{if(G)return;let R=_V(j);if(R>M1||!O(R))return W();if(!N){if(D)return W();try{let P=G6(JSON.parse(String(j)));if(P.type!=="ssh_install_relay_ready"||P.authorityId!==Z.authority.authorityId)return W();N=!0,B(Z.authority.maxDurationMs),V=Y(),V.setNoDelay(!0),V.on("data",F),V.on("error",W),V.on("close",()=>T("ssh_install_relay_peer_closed")),V.on("drain",()=>X._socket?.resume()),V.on("connect",()=>{})}catch{W()}return}if(!D)return W();let I=jV(j);if(!I||!V||V.destroyed||!V.write(I))X._socket?.pause()}),X.on("error",W),X.on("close",()=>T("ssh_install_relay_peer_closed"));let z=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(B(z),$.signal?.addEventListener("abort",_,{once:!0}),$.signal?.aborted)_();return{receipt:Z,closed:L,close:()=>T()}}async function K6($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>M1)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await WV({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as OV}from"crypto";var a$="ARA_WORKER_PREVIEW_PROBE";async function N6(){if(typeof Bun>"u")return 1;let $=OV(32).toString("base64url"),J,Z=new Promise((V)=>{J=V}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(V,N){let G=new URL(V.url).pathname;if(V.method!=="GET")return new Response(null,{status:405});if(G==="/readiness")return new Response(a$);if((G==="/readiness-ws"||G===`/device/readiness/${$}`)&&N.upgrade(V,{data:{relay:G.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(V,N){if(typeof N!=="string"||N.length>8192){V.close();return}if(!V.data.relay){if(N===a$)V.send(a$);else V.close();return}try{let G=U6(N),H=(M)=>V.send(JSON.stringify(M));if(G.type==="hello")H(G),H({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(G.type==="head"&&G.id==="http"&&G.status===200)H({type:"credit",id:"http"});else if(G.type==="data"&&G.id==="http"){if(V.data.http+=Buffer.from(G.data,"base64").toString(),V.data.http.length>a$.length)throw Error("probe_overflow");H({type:"credit",id:"http"})}else if(G.type==="end"&&G.id==="http"&&V.data.http===a$)H({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(G.type==="ws"&&G.id==="ws")H({type:"data",id:"ws",data:Buffer.from(a$).toString("base64"),binary:!1});else if(G.type==="data"&&G.id==="ws"&&!G.binary&&Buffer.from(G.data,"base64").toString()===a$&&!V.data.reported)V.data.reported=!0,process.stdout.write(`ready
-`);else throw Error("probe_protocol_failed")}catch{V.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
-`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as RV,createReadStream as PV,fstatSync as CV,readFileSync as IV}from"fs";var H6="/run/sc/instance-generation";var zV=/^[1-9][0-9]{0,15}\n?$/;function AV($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function q6($){if(typeof $!=="string"||!zV.test($))return null;let J=Number($.trim());return AV(J)?J:null}var M6=3,EV=600000,xV=65536,SV=500;function L6($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(M6))throw Error("worker_standby_invalid_invocation");return{handoffFd:M6}}function bV($=(J)=>IV(J,"utf8")){try{return q6($(H6))}catch{return null}}function wV($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=$0.safeParse(Q.config),Y=W3.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var T6={isPipe:($)=>CV($).isFIFO(),stream:($)=>{let J=PV("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function yV($,J=T6){if(!J.isPipe($.fd)){try{RV($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??EV),Q=J.stream($.fd),X=null,Y=()=>{},V=new Promise((G,H)=>{Y=(M)=>{X??=M,H(M)}});V.catch(()=>{});let N=J.every(SV,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let G=(async()=>{let M=[],U=0;for await(let B of Q.chunks){if(X)throw X;if(U===0)$.onArriving?.();if(U+=B.length,U>xV)throw Error("worker_standby_handoff_too_large");M.push(B)}return Buffer.concat(M).toString("utf8")})(),H=await Promise.race([G,V]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return H}finally{N(),Q.close()}}async function F6($,J=T6){let Z=$.readGeneration??(()=>bV()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await yV({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return wV(Y)}var kV=`Usage: reason worker <command> --config PATH [--json]
-
-  enroll                        Obtain/redeem a ticket using the current Reason login
-  start                         Run the existing Device daemon in the foreground
-  status                        Read enrollment and live local control state
-  doctor                        Read local prerequisites; never enroll or repair
-  drain                         Persist withdrawal of new claims; keep current work
-  resume                        Explicitly clear persistent drain
-  stop                          Drain, then cancel at shutdownGraceMs (ephemeral: ends its Device)
-  revoke                        Revoke an offline Device and remove its local key
-  attach                        Start this same worker over verified system SSH
-
-Config: version 1; apiOrigin, channel, stateDirectory, workspaceRoot, lifetime
-(persistent|ephemeral); executionMode defaults confined (host is explicit consent);
-slots (Sessions at once, 1-4) defaults 1 and a Machine worker runs one;
-shutdownGraceMs defaults 30000. Paths must be absolute and canonical.
-Config and enrollment files must be owned by the current user with mode 0600.
-Enroll: --enrollment-file PATH redeems a platform-provided ticket instead.
-Enroll: --credential-file PATH selects a protected Reason credentials JSON file
-(including credentialKind: api_key). Credentials never belong in argv or worker state.
-The current login needs devices:write; enrollment never opens a browser or starts work.
-Ephemeral: start keeps its proof key only in this process. It redeems
---enrollment-file PATH, or else obtains a ticket with the current login.
-Its Device ends when the process exits; every start enrolls a new Device.
-Use lifetime persistent to stop and start the same Device.
-Simple setup: \`reason serve NAME\` writes this config and enrolls for you.
-State is isolated under stateDirectory/headless-<channel>, never Desktop identity.
-Persistent keys: a new identity's is a non-extractable login Keychain key on a Mac
-where the CLI can create one there, otherwise an extractable owner-only file.
-proxy {version 1, url, caFile?} carries enrollment, control, Hands and desktop relay
-traffic (not yet previews or kept terminals); proxy environment variables stay refused.
-No service is installed, no update is performed, and no desktop/VNC is enabled.
-SSH: attach --ssh ALIAS --ssh-config PATH --remote-cli /absolute/path/reason
-  --artifact-sha256 HASH --config PATH --foreground [--credential-file PATH]
-The config describes remote paths. An existing, SHA-256-pinned CLI is required.
-SSH config must be protected (0600); it explicitly owns IdentityFile and host trust.
-ProxyJump/ProxyCommand are unsupported; configure a directly reachable alias.
-Pretrust known_hosts. No agent forwarding, automatic installation or detached service.
-SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
-are not forwarded/supported; running is not a browser-readiness receipt.
-Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function hV($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,V=!1;for(let N=0;N<Z.length;N++){let G=Z[N];if(G==="--json"&&!V){V=!0;continue}if(G!=="--config"&&G!=="--enrollment-file"&&G!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let H=Z[++N];if(!H||H.startsWith("--"))throw Error("worker_missing_flag_value");if(G==="--config"&&!Q)Q=H;else if(G==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=H;else if(G==="--credential-file"&&!Y&&J==="enroll")Y=H;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:V}}var fV=1e4,vV=2000,_6=15000,mV=50;async function W6($,J,Z,Q,X,Y){let V=new n1,N=new AbortController,G,H,M=new Promise((I,P)=>{G=I,H=P});if(M.catch(()=>{}),m0(),$.executionMode==="host")a1();Z("enrollment_started");let U=X(V);U.catch(()=>{});let B=null,q=A2($,J,(I)=>{if(!B)throw Error("worker_starting");return B(I)});q.catch(()=>{}),Z("readiness_started");let L=new AbortController,T,_=AbortSignal.any([N.signal,L.signal,...Q.signal?[Q.signal]:[]]),W=Y?.matches($)?Y.result:void 0;if(Y&&!W)await Y.stop();if(W)_.addEventListener("abort",()=>void Y.stop(),{once:!0});let O,F=new Promise((I)=>{O=I}),z=setTimeout(()=>O(),fV);_.addEventListener("abort",()=>O(),{once:!0});let j,D=(I)=>{if(I==="ready")j=setTimeout(()=>O(),vV);Q.onStartup?.(I)},R=f1($,Q.readinessProbes,_,M,void 0,W,F);R.final.catch(()=>{});try{let I;try{I=await U}catch(P){throw N.abort(),H(Error("worker_enrollment_failed")),await R.final.catch(()=>{}),await q.then((C)=>C(),()=>{}),P}Z("enrollment_completed"),T=setTimeout(()=>L.abort(),Math.max(1,Math.min(_6,Date.parse(I.worker?.expiresAt??"")-Date.now()||_6))),G(I.roots[0].permissions),P0($,{version:1,drained:!1,revoked:!1}),await i1($,I,V,J,{...Q,onStartup:D,prestartedReadiness:R,prestartedControl:{closed:q,handle:(P)=>{B=P}},deferOptionalLanes:!0})}finally{clearTimeout(T),clearTimeout(z),clearTimeout(j),N.abort(),V.deleteBinding(),V.deleteKey(),await q.then((I)=>I(),()=>{})}}async function gV($,J,Z,Q){let{handoffFd:X}=L6($);if(L1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,V,N=()=>{let q=Z.readinessProbes?Z.readinessProbes.boundPty:(L)=>k1(L);if(G||!q)return;try{m0(),a1()}catch{return}if(Y=s8(q),!Z.readinessProbes)setImmediate(()=>{if(G)return;try{y2()}catch{}})},G=!1,H=()=>{G=!0,clearTimeout(V),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",H),process.once("SIGINT",H);let M;try{M=await(J.receiveStandbyHandoff??F6)({fd:X,onBooted:()=>{Q("standby_booted"),V=setTimeout(N,mV)},onArriving:()=>clearTimeout(V)})}catch(q){clearTimeout(V);let L=q instanceof Error&&/^worker_standby_[a-z_]+$/.test(q.message)?q.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${L}.
-`),await Y?.stop(),(J.exitProcess??((T)=>process.exit(T)))(1),1}finally{clearTimeout(V),process.off("SIGTERM",H),process.off("SIGINT",H)}if(G)return 0;Q("handoff_received");let{config:U,enrollment:B}=M;try{o(g(U),!0);let q=await O6(U,()=>{});try{if(Q("lock_acquired"),t(U))throw Error("worker_ephemeral_requires_fresh_enrollment");return H$(U),await W6(U,q.owner.nonce,Q,Z,(L)=>J$(U,B,L,J.enroll),Y),0}finally{q.release()}}finally{await Y?.stop()}}async function T$($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,V=(G)=>{Y.set(G,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:G,pid:process.pid,timestamp:new Date().toISOString()})+`
-`),J.onStartup?.(G)},N={...J,onStartup:V,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let G=(q)=>Math.min(e$,Math.max(0,Math.round(q))),H=Y.get("readiness_started"),M=Y.get("readiness_completed"),U=Y.get("handoff_received")??0,B=Object.fromEntries(D6.flatMap((q)=>{let L=Y.get(q);return L===void 0?[]:[[q,G(L-U)]]}));return{service_start_to_heartbeat_ms:G(performance.now()-U),stage_ms:B,...H!==void 0&&M!==void 0?{readiness_ms:G(M-H)}:{}}},onEvent:(G)=>{if(G.type==="error"&&G.diagnostic){Q=!0;let H=G.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:H.stage,category:H.category,httpStatus:H.category==="http"?H.httpStatus:void 0})+`
-`)}J.onEvent?.(G)}};try{if($[0]==="__preview-probe"){if($.length!==1||L1(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await N6()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(L1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await Z6($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await K6();return await tJ(J)}if($[0]==="__update-restart"){let q=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!q)throw Error("worker_unknown_or_duplicate_flag");if(L1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let L=$0.parse(JSON.parse(s($[2]))),T=await R2(L,q?void 0:r);return Z.stdout.write(JSON.stringify(T)+`
-`),T.state==="current"?3:T.state==="busy"?75:0}if($[0]==="standby")return await gV($,J,N,V);let G=hV($);if(!G)return Z.stdout.write(kV),0;if(L1(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux","win32"].includes(process.platform))throw Error("worker_platform_unsupported");let H=$0.parse(JSON.parse(s(G.configPath))),M=(q)=>Z.stdout.write(JSON.stringify(q)+`
-`),U=t(H);if(G.action==="status"||G.action==="doctor"){let q=await B0(H,"status"),L=e(H),T={enrolled:!!U||!!q,deviceId:U?.deviceId??q?.deviceId??null,lifetime:H.lifetime,expired:U||q?Date.parse(U?.worker?.expiresAt??q.expiresAt)<=Date.now():null,drained:L.drained,revoked:L.revoked,live:q};if(G.action==="status")return M(T),0;let _=!0;try{H$(H)}catch{_=!1}return M({...T,workspace:_,platform:process.platform,executionMode:H.executionMode,proofStorage:H.lifetime==="ephemeral"?"process-memory":U&&M0(H)instanceof o$?"login-keychain":"owner-only-file",confinement:H.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:q?.supportedOperations?"live-worker":"unavailable",reportedOperations:q?.supportedOperations??null,capabilityReadiness:q?.capabilityReadiness??null,ready:q?.executionEligible===!0&&!T.expired}),_&&(U||q)&&!T.revoked&&!T.expired?0:1}if(["drain","resume","stop"].includes(G.action)){let q=G.action==="drain"?"drain":G.action==="resume"?"resume":"stop",L=await B0(H,q);if(L){if(M(L),q==="stop"&&H.lifetime==="ephemeral"&&!G.json)Z.stderr.write(dV);return 0}}o(g(H),!0);let B=await O6(H,()=>{if(!G.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(G.action==="start")V("lock_acquired");let q=t(H);if(["drain","resume","stop"].includes(G.action)){if(!q)throw Error("worker_not_enrolled");let L=e(H);if(L.revoked||Date.parse(q.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(G.action!=="stop")P0(H,{...L,drained:G.action==="drain"});return M({running:!1,drained:G.action==="stop"?L.drained:G.action==="drain"}),0}if(G.action==="enroll"){if(H.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let L=G.enrollmentPath,T=!L&&e(H).revoked;if(q&&!T)throw Error("worker_already_enrolled");H$(H);let _=()=>{y0(H),N4(H)};if(T)_();let W=async()=>{let z=B2(H),j=L?await z3(H,L,z,J.enroll):await j6(H,G.credentialPath,J,z);return{proof:z,enrolled:j}},{proof:O,enrolled:F}=await W().catch((z)=>{if(L||!(z instanceof $$)||!z.deviceRemoved)throw z;return _(),W()});return h0(F,d(H).state,{proofStore:O}),P0(H,{version:1,drained:!1,revoked:!1}),M({enrolled:!0,deviceId:F.deviceId,lifetime:H.lifetime}),0}if(G.action==="revoke"){if(!q)throw Error("worker_not_enrolled");let L=M0(H),T=new c1(R$(H.apiOrigin),b0(H.proxy),L);if(P0(H,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(q,T);else await T.disconnect(q,AbortSignal.timeout(30000));return y0(H),M({revoked:!0,localKeyRemoved:!0}),0}if(H$(H),H.lifetime==="ephemeral"){if(q)throw Error("worker_ephemeral_requires_fresh_enrollment");await W6(H,B.owner.nonce,V,N,async(L)=>G.enrollmentPath?z3(H,G.enrollmentPath,L,J.enroll):j6(H,void 0,J,L,"worker_ephemeral_enrollment_required"))}else{if(G.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!q)throw Error("worker_not_enrolled");if(e(H).revoked)X=!0;await i1(H,q,M0(H),B.owner.nonce,N)}return 0}finally{B.release()}}catch(G){let H=G instanceof Error&&(G.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(G.message))?G.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${H}.
-`);let M=$.includes("--json")?void 0:Q1(G instanceof $$&&G.deviceRemoved?"worker_enrollment_device_removed":H);if(M)Z.stderr.write(`${M}
-`);return H==="worker_revoked"&&X?0:1}}var uV=60000;async function O6($,J){let Z=Date.now()+$.shutdownGraceMs+uV,Q=!1;for(;;){let X=Z$({path:d($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await B0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((N)=>setTimeout(N,250))}}var dV='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function j6($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let G=performance.now();return J$($,await Z.enrollmentInput($),Q,Z.enroll,G)}let Y=J??O$($),V=await(Z.enrollmentCredentials??z$)($,Y);if(!V)throw Error(X);let N=Z.createTicketClient?.(V)??new I$(V,{credentialsPath:Y,fetchImpl:b0($.proxy)});return U4($,V,N,Q,Z.enroll)}import{spawn as pV}from"child_process";import{readFileSync as lV,unlinkSync as cV}from"fs";import{join as sV}from"path";var aV=120,iV=15,nV=5000;function t2($={}){let J=$.stateDirectory?sV($.stateDirectory,rV):null;if(J)tV(J);let Z=V1();if(!Z)return null;let Q=process.platform==="win32",X=Math.max(1,Math.floor($.limitSeconds??aV)),Y=$.pid??process.pid,V=Math.min(iV,X),N=J?`printf '%s %s %s\\n' "$(date +%s)" ${X+V} ${z6(r)} > ${z6(J)} 2>/dev/null
-`:"",G=(L)=>`[ $((SECONDS - started)) -ge ${Math.max(1,L-1)} ]`,H=Q?":":`[ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${Y}" ]`,M=Q?`"$SYSTEMROOT/System32/taskkill.exe" /PID ${Y} /F >/dev/null`:`kill -KILL ${Y}`,U=`parent_is_worker() { ${H}; }
-while :; do started=$SECONDS
-IFS= read -r -t ${X} pulse && continue
-${G(X)} && parent_is_worker || exit 0
-started=$SECONDS
-IFS= read -r -t ${V} pulse && continue
-if ${G(V)} && parent_is_worker; then
-  echo "Reason: worker_event_loop_stalled; no progress for ${X+V}s, restarting the worker." >&2
-  ${N}${M}
-fi
-exit 0
-done`,B=pV(Z,["-c",U],{stdio:["pipe","ignore","inherit"],windowsHide:!0,...Q?{env:{...process.env,MSYS_NO_PATHCONV:"1"}}:{}});B.on("error",()=>{}),B.stdin.on("error",()=>{});let q=setInterval(()=>B.stdin.write(`
-`),Math.min(nV,X*1000/4));return q.unref(),B.unref(),{stop(){clearInterval(q),B.stdin.end()}}}var rV="worker-stalled";function z6($){return`'${$.replaceAll("'","'\\''")}'`}function tV($){let J;try{J=lV($,"utf8"),cV($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{s1(a2(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var QG=`Share this computer as a machine
-
-Usage:
-  reason serve                     This computer, signed in (machine name: its hostname)
-  reason serve --token rmt_\u2026       Any server, no login: the token names the machine
-  reason serve NAME [--dir PATH] [--once] [--sandbox] [--yes]
-  reason serve [NAME | --token rmt_\u2026] [--dir PATH] --service
-  reason serve NAME --stop [--json]  (same as: reason stop NAME)
-
-Adds this computer as a worker of a machine and waits for sessions. Start one
-from anywhere with: reason "fix the flaky test" --on NAME
-(To run one session here yourself, run \`reason "PROMPT"\` in the folder; it
-needs no machine and serves only while that command runs.)
-Sessions queue on the machine until one of its workers is free. Run
-\`reason serve\` on more computers, or in more folders, to add workers.
-
-Signed in, the machine is created if it doesn't exist (owners and admins).
-Without a login, use a token from \`reason machines token NAME\`: --token, or
-REASON_TOKEN. The token is used once to join and is never saved. Reconnect
-later with \`reason serve NAME\` or the same command. Press Ctrl-C to stop.
-
-With --service (macOS and Linux), this computer joins in the foreground, then
-keeps the worker running in the background: it starts again at login (Linux:
-at boot, when user lingering is allowed) and restarts if it fails. The service
-runs \`reason serve NAME --dir PATH\` with this worker's saved identity; the
-token is never saved. \`reason stop NAME\` stops and removes it.
-
-Options:
-  --dir PATH   Folder sessions work in (default: the current directory)
-  --once       Keep the worker only while this command runs; nothing is saved
-  --sandbox    Run confined. Sandboxed machines can't host sessions yet.
-  --yes        Accept the first-run confirmation (required without a terminal;
-               a token already carries it)
-  --service    Keep this worker running as a background service (see above)
-  --stop       Stop this computer's running workers for NAME and remove
-               their background services. They stay in Reason and can
-               start again; \`reason disconnect NAME\` removes them.
-
-Sessions run commands in the folder with the permissions of the user who runs
-the worker unless --sandbox is set. Settings live in
-~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
-folder served for NAME is its own worker. Use
-\`reason worker status|revoke --config <that file>\` for advanced control.
-`,XG=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,YG=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,I6="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",A6=["REASON_TOKEN","REASON_MACHINE_TOKEN"],E6="my-computer";function w9($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&E1(J)&&J!==D2?J:E6}class X0 extends Error{}function VG($,J){let Z,Q=new Map,X=new Set;for(let H=0;H<$.length;H+=1){let M=$[H];if(M==="--help"||M==="-h"||M==="help")return null;if(M==="--dir"||M==="--token"||M==="--org"){let U=$[H+1];if(!U||U.startsWith("-"))throw new X0(`Missing value after ${M}.`);if(Q.has(M))throw new X0(`${M} may be specified only once.`);Q.set(M,U),H+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(M)){X.add(M==="-y"?"--yes":M);continue}if(M.startsWith("-"))throw new X0(`Unknown option: ${M}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new X0("Expected one machine NAME.");Z=M}let Y=X.has("--stop");if(Z===void 0&&Y)throw new X0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!E1(Z)&&!XG.test(Z))throw new X0(I6);if(Z.toLowerCase()===D2)throw new X0(`"${D2}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((H)=>H!=="--stop"&&H!=="--json")))throw new X0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new X0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new X0("--service keeps the worker running; it cannot be combined with --once.");let V=Y?void 0:Q.get("--token")??J,N=Q.get("--org");if(V!==void 0){if(!V.startsWith("rmt_"))throw new X0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(N!==void 0&&!YG.test(N))throw new X0("--org must be a workspace id.")}else if(N!==void 0)throw new X0("--org is only used with --token.");let G=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...G===void 0?{}:{dir:G},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...V===void 0?{}:{token:V},...N===void 0?{}:{org:N.toLowerCase()}}}function J3($,J){let Z=ZG($,J??"."),Q;try{Q=process.platform==="win32"?b9.native(Z):b9(Z)}catch{throw new X0(`Folder not found: ${Z}`)}if(!$G(Q).isDirectory())throw new X0(`Not a folder: ${Q}`);return Q}var o2=($)=>i$($,".reason","workers"),x9=($)=>u(d($).state);function GG($,J,Z){let Q=i$(o2($),J);if(R0(i$(Q,"worker.json"))?.workspaceRoot===Z)return Q;return i$(o2($),`${J}@${oV("sha256").update(Z).digest("hex").slice(0,8)}`)}function x6($){let{stateDirectory:J}=$;if(e1($.workspaceRoot,J)||e1(J,$.workspaceRoot))throw new X0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return $0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function R0($){if(!u($))return null;let J=new X0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(s($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=$0.safeParse(Z);if(!Q.success)throw J;return Q.data}function S9($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function BG($,J){$.stdout.write(`${J} [y/N] `);let Z=await R6($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function Z3($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var KG={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function S6($){try{return await $()}catch(J){let Z=J instanceof v0?KG[J.code]:void 0;throw Z?Error(Z):J}}async function UG($,J,Z,Q){let X=x6({...J,name:$.name??E6,stateDirectory:i$(o2(Z),".token-enrollment")}),Y=A$(X,{stored:!1}),V=await S6(()=>P6({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!E1(V.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==V.machine_name.toLowerCase())throw new X0(`This token is for machine "${V.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==V.organization_id.toLowerCase())throw new X0(`This token is for workspace ${V.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let N=!1;return{name:$.name??V.machine_name,input:(G)=>{if(N)throw Error("worker_ticket_receipt_mismatch");return N=!0,Y.saveInstall(G),Y.complete(V.organization_id,V)}}}function NG($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??z$)(X);if(!Y)throw Error("worker_session_login_required");let V=(Z.createApi??((N)=>new I$(N)))(Y);return K4(X,Y,{createHeadlessDeviceEnrollmentTicket:(N)=>S6(async()=>{try{return await V.createMachineEnrollmentTicket($,N)}catch(G){if(!(G instanceof v0)||G.code!=="machine_not_found")throw G}try{await V.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
-`)}catch(G){if(!(G instanceof v0)||G.status!==409)throw G}return V.createMachineEnrollmentTicket($,N)})})}}async function b6($,J,Z,Q){let X=await R2($,Q,()=>C6($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!G$($,J,Z))return null;return w3($),X}function y9($,J){let Z=o2($);if(!u(Z))return[];let Q=J.toLowerCase();return eV(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let V=i$(Z,X,"worker.json"),N=R0(V);return N?[{path:V,config:N}]:[]})}async function HG($,J,Z,Q,X){let Y=y9(J,$.name);if(Y.length===0)throw new X0(`No worker for machine "${$.name}" on this computer.`);let V=Q.controlWorker??B0,N=[];for(let G of Y){let H=await V(G.config,"stop")!==null,M=$3(G.config,X),U=H||M!==null;if(N.push({config:G.path,folder:G.config.workspaceRoot,running:U,service:M?.label??null}),!$.json&&M)Z.stdout.write(`Removed background service ${M.label} (${G.config.workspaceRoot}); it won't start again.
-`);if(!$.json)Z.stdout.write(U?`Stopping machine "${$.name}" in ${G.config.workspaceRoot}; current work finishes first.
-`:`Machine "${$.name}" in ${G.config.workspaceRoot} is not running.
-`)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:N})}
-`);return 0}async function w6($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??T$,X=J.env??process.env,Y=A6.map((V)=>X[V]?.trim()).find(Boolean)||void 0;if(!J.env)for(let V of A6)delete process.env[V];try{let V=VG($,Y);if(!V)return Z.stdout.write(QG),0;let N=b9(J.home??U0()),G=J.serviceHost??V$(N);if(V.stop)return await HG({...V,name:V.name},N,Z,J,G);let H=J.channel??Y$(),M=J3(J.cwd??process.cwd(),V.dir),U=V.service?T1(G,X):void 0,B={channel:H,apiOrigin:$2(X,H),workspaceRoot:M,once:V.once,sandbox:V.sandbox},q=V.token?await UG({...V,token:V.token},B,N,J):void 0,L=q?.name??V.name??w9((J.hostname??JG)()),T=GG(N,L,M),_=i$(T,"worker.json"),W=R0(_);if(q&&W&&x9(W)&&e(W).revoked)y0(W);let O=!q&&W!==null&&x9(W)&&(!l1(X,"REASON_API_URL")?.trim()||C0(B.apiOrigin,W.apiOrigin))?W.apiOrigin:void 0,F=x6({...B,...O?{apiOrigin:O}:{},name:L,stateDirectory:T}),z=W!==null&&x9(W);if(z&&K0(W)!==K0(F)){if(F.lifetime==="ephemeral")throw new X0(`Machine "${L}" is already saved for this folder; --once needs another folder or NAME.`);throw new X0(`Machine "${L}" is already set up with different settings (${W.workspaceRoot}, ${W.executionMode==="host"?"your user permissions":"sandboxed"}).
-Run it with: reason serve ${L} ${S9(W)}
-Or remove it first: reason worker revoke --config ${_}`)}let j=F.lifetime==="persistent"?F1(F,G):null;if(j&&!V.service&&X[s$]!==j.label)return Z.stdout.write(`Machine "${L}" in ${M} already runs as a background service (${j.label}).
-  Logs: ${j.logs}
-  Stop it with: reason stop ${L}
-`),0;if(V.service&&z&&!j&&await(J.controlWorker??B0)(F,"status")!==null)throw new X0(`Machine "${L}" is already running in ${M}. Stop it first (Ctrl-C, or reason stop ${L}), then run this again.`);let D=F.lifetime==="ephemeral"||!z;if(D&&!E1(L))throw new X0(I6);if(F.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
-`);else if(D&&!V.yes&&!q){let P=`Sessions on "${L}" will run commands in ${M} with your user permissions (no sandbox). Continue?`,C=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!C)throw new X0(`${P.replace(/ Continue\?$/,"")}
-Re-run with --yes to confirm.`);if(!await(J.confirm??((f)=>BG(Z,f)))(P))return Z.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!z)o(F.stateDirectory,!0),c(_,F);let R={...J.worker,enrollmentInput:NG(L,q,J,Z)};if(F.lifetime==="persistent"&&!z){Z.stdout.write(`Adding this computer to machine "${L}"\u2026
-`);let C=await Q(["enroll","--config",_],{...R,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(C!==0)return C}if(U){let P;try{P=e2({config:F,launcher:U,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:G})}catch(C){if(!(C instanceof E$))throw C;throw new X0(`${C.message}
-This computer is added to machine "${L}". Run it in this terminal with: reason serve ${L} ${S9(F)}
-Or try the background service again with: reason serve ${L} ${S9(F)} --service`)}return Z.stdout.write([`Reason machine "${L}" runs in the background`,`  Folder:   ${M}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${P.label} (starts at ${P.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${P.logs}`,`Start a session with: reason "\u2026" --on ${L}`,`Stop it with: reason stop ${L}`,...P.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
-`)),0}Z.stdout.write([`Reason machine "${L}"`,`  Folder:   ${M}`,`  Mode:     ${F.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Lifetime: ${F.lifetime==="persistent"?`saved; run \`reason serve ${L}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
-`));let I=j&&X[s$]===j.label&&!J.runWorker?t2({stateDirectory:F.stateDirectory}):null;try{return await Q(["start","--config",_],{...R,io:{stdout:Z.stdout,stderr:Z3(Z.stderr)},onStartup:(P)=>{if(P==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${L}
-`);J.worker?.onStartup?.(P)}})}finally{I?.stop()}}catch(V){if(V instanceof X0||V instanceof E$){let H=V instanceof E$&&V.code?` (${V.code})`:"";return Z.stderr.write(`Reason: ${V.message}${H}
-`),2}let N=V instanceof Error&&/^worker_[a-z_]+$/.test(V.message)?V.message:null,G=N?Q1(N):void 0;return Z.stderr.write(`Reason: ${N?G?`${G} (${N})`:N:"could not prepare this machine."}
-`),1}}var qG=200;var zF=K.strictObject({version:K.literal(1),session_ids:K.array(K.string().min(1).max(200)).max(qG)});function _1($){let J=t($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!e($).revoked}import{spawnSync as y6}from"child_process";import{readFileSync as MG,rmdirSync as LG,rmSync as TG}from"fs";import{join as k9}from"path";var FG=["Reason.app","Ara Sidecar.app","Ara Device.app"],_G="sidecar_retire_failed";function jG($){return k9($,"Library","Application Support","Ara","Sidecar")}function DG($){try{let J=MG(k9($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function h6($,J={}){let Z=jG($),Q=FG.map((N)=>k9(Z,N)).filter(DG);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>y6("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((N)=>process.kill(N,"SIGTERM")),V=J.command??((N,G)=>y6(N,[...G],{stdio:"ignore",timeout:1e4}).status??1);try{for(let N of X().split(`
-`)){let G=N.trim().match(/^(\d+)\s+(.+)$/);if(!G)continue;if(!Q.some((H)=>G[2].startsWith(`${H}/Contents/MacOS/`)))continue;try{Y(Number(G[1]))}catch{}}for(let N of Q)V(k6,["-u",N]),TG(N,{recursive:!0,force:!0});try{LG(Z)}catch{}}catch{return{status:"failed",code:_G}}return{status:"removed",bundles:Q}}var IG=`Connect this computer to Reason
-
-Usage:
-  reason connect                 Your computer, kept connected in the background
-  reason connect --to NAME       Add it to team machine NAME (as reason serve NAME --service)
-  reason connect --token rmt_\u2026   Join a machine with no login (as reason serve --token \u2026 --service)
-  reason connect --once          Only while this command runs; nothing is saved
-  reason connect --api-key KEY   Without reason login: a headless box, with an API key that has
-                                 devices:write (or set REASON_API_KEY, which keeps it out of ps).
-                                 The connection keeps the key to renew itself (macOS: Keychain).
-  reason disconnect [NAME]       Stop and remove it (NAME: this computer's workers for machine NAME);
-                                 it stays disconnected until you run reason connect
-
-Settings, saved; run reason connect again to change them:
-  --folder PATH                  Where Sessions may run (yours: your home folder; a machine: the current folder)
-  --sessions N                   No longer needed: your computer runs every Session you start
-  --name NAME                    This computer's name in Reason (default: its hostname)
-  --api-url URL                  The Reason API to connect to (as REASON_API_URL)
-  --proxy URL                    Reach Reason through this proxy (HTTPS_PROXY is not used)
-  --proxy-ca-file PATH           The proxy's PEM CA bundle
-  --user-chrome on|off           Your Sessions may use your own Chrome and its signed-in profiles
-                                 (macOS, through the Reason extension; on by default)
-  --cloud-sessions on|off        No longer needed: Reason does not read it
-  --minimal                      Keep this computer minimal: files, shell and terminal, no desktop,
-                                 computer use or browser use (reason desktop install adds them)
-  --local-logins on|off          Your Sessions run on the Claude Code, Codex and Grok logins
-                                 on this computer (on by default; off with an API key).
-                                 Reason gets each login's current access token, never
-                                 its refresh token.
-
-  --keep-awake on|off            macOS: keep this Mac awake while it runs Sessions (default on).
-                                 Applies at once, without reconnecting.
-  --add-folder PATH              Let Sessions run in another folder too, on the same computer in
-  --remove-folder PATH           Reason; or stop that. Applies at once; running Sessions in other
-                                 folders keep running. \`reason status --json\` lists the folders.
-
-Your computer is Personal: it needs no machine and no admin role, and only you
-start Sessions on it until you make it Team in Settings \u203A Computers. They run commands
-with your user permissions (there is no sandbox mode). It starts again at login (Linux:
-at boot, when lingering is allowed), restarts if it fails, and \`reason update\`
-restarts it on the new version. \`reason status\` shows it.
-
-It is connected in the workspace you signed in to. It is also connected, by
-itself, in up to 8 other workspaces you belong to, as each one's own computer,
-when this computer was signed in with the setup command Reason shows you (it
-ends in --pair CODE, a one-time code from your signed-in Reason) or by the
-Reason app, and was connected after that. Signed in with \`reason login\`
-alone, or connected with --api-key or --once, it stays in the one workspace:
-run the setup command from Reason here, then \`reason disconnect\` and
-\`reason connect\` if it was connected before. One sign-in covers one computer;
-a second computer needs its own. \`reason status\` says when this applies.
-
-One computer serves several Reason accounts. Signed in as another account than
-the one it is connected for, reason connect connects it for that account too,
-as that account's own computer in the workspace it signed in to; the other
-accounts stay connected. That account's \`reason logout\` removes only its own.
-`,EG=`Disconnect this computer from Reason
-
-Usage:
-  reason disconnect              Stop your computer's connection and remove it from Reason, in every
-                                 workspace and for every Reason account it is connected for. It stays
-                                 disconnected (reason "\u2026" won't connect it) until you run reason connect
-  reason disconnect NAME         Stop this computer's workers for machine NAME and remove them from Reason
-
-  --account                      Only the signed-in account's computer leaves Reason (all of it when it is
-                                 the only account here); it stays disconnected for that account until
-                                 its reason connect (the Reason app's Disconnect)
-  --temporary                    The Reason app's sign-out: only the signed-in account's computer leaves
-                                 Reason (all of it when it is the only account here), and it is not kept
-                                 disconnected: the next reason "\u2026" connects it again
-  --yes, -y                      Accepted for scripts; disconnect never asks
-`;class l extends Error{code;constructor($,J="worker_connect_refused"){super($);this.code=J}}var xG=4,Y3={write:()=>!0};function g0($,J,Z=!1){let Q=X7($,J,Z);return Q.length===1?Q[0]:T0(d6(T0($,".config")),...Q7(J,Z))}var Q7=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function X7($,J,Z=!1){let Q=$;try{Q=B$($)}catch{}return["ara","reason"].map((X)=>T0(Q,".config",X,...Q7(J,Z))).filter(SG)}function SG($){try{if(B$($)!==$)return!1;return R0(T0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var Y7="disconnected.json";function H_($,J){return u(T0(g0($,J),Y7))}function V3($,J,Z){let Q=T0(g0($,J),Y7);if(!Z){j1(Q,{force:!0});return}o(d9(Q),!0),c(Q,{version:1,disconnected_at:new Date().toISOString()})}function bG($){let J=new Map,Z=new Set;for(let U=0;U<$.length;U+=1){let B=$[U];if(B==="--help"||B==="-h"||B==="help")return null;if(["--to","--token","--folder","--sessions",Q3,X3,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(B)){let q=$[U+1];if(!q||q.startsWith("-"))throw new l(`Missing value after ${B}.`);if(J.has(B))throw new l(`${B} may be specified only once.`);J.set(B,q),U+=1;continue}if(["--once","--yes","-y","--minimal"].includes(B)){Z.add(B==="-y"?"--yes":B);continue}if(B.startsWith("-"))throw new l(`Unknown option: ${B}. Run \`reason connect --help\`.`);throw new l(`Unexpected argument: ${B}. To add this computer to a team machine, use --to ${B}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new l("--sessions takes a number from 1 to 4.");if(J.has(X3)&&!J.has(Q3))throw new l("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new l("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((U)=>U!=="--yes")))throw new l("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((U)=>J.has(U));if(Y.length>0&&(J.size>1||[...Z].some((U)=>U!=="--yes")))throw new l(`Run reason connect ${Y[0]} PATH on its own.`);let V=J.get("--user-chrome");if(V!==void 0&&V!=="on"&&V!=="off")throw new l("--user-chrome takes on or off.");let N=J.get("--cloud-sessions");if(N!==void 0&&N!=="on"&&N!=="off")throw new l("--cloud-sessions takes on or off.");let G=J.get("--local-logins");if(G!==void 0&&G!=="on"&&G!=="off")throw new l("--local-logins takes on or off.");let H=J.get("--name")?.trim();if(H!==void 0&&(H.length===0||H.length>160))throw new l("--name takes a name of 1 to 160 characters.");let M=(U,B)=>B===void 0?{}:{[U]:B};return{...M("to",J.get("--to")),...M("token",J.get("--token")),...M("folder",J.get("--folder")),...M("sessions",Q===void 0?void 0:Number(Q)),...M("keepAwake",X===void 0?void 0:X==="on"),...M("userChrome",V===void 0?void 0:V==="on"),...M("cloudSessions",N===void 0?void 0:N==="on"),...M("localLogins",G===void 0?void 0:G==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...M("proxy",J.get(Q3)),...M("proxyCaFile",J.get(X3)),...M("apiKey",J.get("--api-key")),...M("name",H),...M("apiUrl",J.get("--api-url")),...M("addFolder",J.get("--add-folder")),...M("removeFolder",J.get("--remove-folder"))}}var x$=($)=>u(d($).state),V7=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function G7($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function B7($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=J3($.options.cwd??process.cwd(),J.folder)}catch(N){throw new l(N instanceof Error?N.message:String(N))}if(!z1(Q,$.stateDirectory))throw new l(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?$2({REASON_API_URL:J.apiUrl},$.channel):Z&&!l1($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:$2($.environment,$.channel)}catch(N){throw new l(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${N instanceof Error?N.message:String(N)}`)}if(Z&&X!==Z.apiOrigin&&C0(X,Z.apiOrigin))X=Z.apiOrigin;if(!u6(X)&&!g6($.channel,X))throw new l(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=c6({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(N){if(!(N instanceof p6))throw N;throw new l(N.message)}let V=(Z?.folders??[]).filter((N)=>N!==Q);return $0.parse({...V.length?{folders:V}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??w9(($.options.hostname??PG)()),slots:J.sessions??Z?.slots??xG,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function K7($,J){if($.localLogins!==void 0||J)return $;return $0.parse({...$,localLogins:!0})}async function p9($,J,Z,Q,X){if(e($).revoked){if(x$($))try{y0($)}catch{}C3($);let N=[];try{N=RG(g($))}catch{}for(let G of N)if(G!=="workspaces")j1(T0(g($),G),{recursive:!0,force:!0})}else if(x$($))y0($);o($.stateDirectory,!0),c(J,$);let Y=wG(Z.stderr),V=await(Q.runWorker??T$)(["enroll","--config",J],{...l9(Q.worker,X),io:{stdout:Y3,stderr:Y}});if(V!==0)Z.stderr.write(`Reason: this computer was not connected. (${Y.code()??"worker_command_failed"})
-`);return V}function wG($){let J=null;return{write:(Z)=>{for(let Q of Z.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))J=Q[1];return $.write(Z)},code:()=>J}}function J2($,J,Z){let Q=i6(K2(C1("REASON_CLI_CHANNEL",J),$));return Q&&C0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function yG($,J,Z,Q){let{config:X,configPath:Y}=H2($,J),V=(H)=>{try{return H!==null&&_1(H)&&t(H)?.orgId.toLowerCase()===J}catch{return!1}},N=null;try{N=R0(Y)}catch{}if(V(N))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let G=await p9(X,Y,Z,Q,void 0);if(G===0&&V(X))return 0;if(G===0&&x$(X))await G3(X,Y,Z,Q);if(j1(X.stateDirectory,{recursive:!0,force:!0}),G!==0)return G;throw new l("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function l9($,J){return J?{...$,enrollmentCredentials:(Z)=>T3(Z,J)}:{...$}}async function c9($,J,Z,Q,X,Y="connect"){if(await s9($,Q,X,Y),Y==="connect"&&!await L7($,Z,Q))return!1;if(!await G3($,J,Z,Q))return!1;return e9($.stateDirectory),j1($.stateDirectory,{recursive:!0,force:!0}),!0}async function G3($,J,Z,Q){if(!x$($)||e($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??T$)(["revoke","--config",J],{...Q.worker,io:{stdout:Y3,stderr:Y?Z.stderr:Y3}})===0)return!0;if(Y)return!1;await new Promise((N)=>setTimeout(N,1000))}}async function s9($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??B0,V=async()=>Y($,"status").catch(()=>null),N=await Y($,"stop").catch(()=>null)!==null,G=!X&&$3($,Z,Q);if(N||G){let H=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<H&&await V()!==null)await new Promise((M)=>setTimeout(M,250))}}function a9($,J){return J==="darwin"&&$.userChrome!==!1}function h9($,J,Z){let Q=[...a9($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${G7($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
-`)}function f9($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),"  Sessions:  every Session you start",`  Mode:      ${G7(J)}`,...J.proxy?[`  Proxy:     ${l6(J.proxy)}`]:[],...a9(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
-`)}async function f6($,J,Z){let{io:Q,options:X}=Z;if(X7(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:d9(J),timestamp:new Date().toISOString()})}
-`);let Y=_2(T0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
-`);W9(Z.home,Z.host.platform);let V=b4({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(q)=>Q.stderr.write(`${q}
-`),host:Z.host}),N=A4({...V,log:(q)=>Q.stderr.write(`${q}
-`)}),{configPath:G}=N,H=N.saved;if(!H)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let M=(q,L)=>{let T=K3(Z.home,Z.channel),_;try{let O=null;try{O=L.keep?null:t(H)?.orgId.toLowerCase()??null}catch{}if(_=M2(H,{prefer:J2(Z.home,Z.channel,H),...L}),_&&O)q2(_,O)}finally{T()}if(!_)return!1;H=_;let W="";try{W=` (workspace ${t(_)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${q}; this computer goes on running Sessions for its other Reason account${W}.
-`),!0};if(e(H).revoked&&!M("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(H.executionMode==="confined"||!_1(H)){let q=p0(H.stateDirectory)??void 0,L=q?null:J2(Z.home,Z.channel,H);if(!q&&!(L&&I1(H,L)))M("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let U=H.executionMode==="confined";if(U||!_1(H)){let q=p0(H.stateDirectory)??void 0;if(Q.stderr.write(U?V7:`Reason: this computer's connection expired; renewing it with ${q?"its API key":"your login"}\u2026
-`),await p9($0.parse({...H,executionMode:"host"}),G,Q,X,q)!==0)return Q.stderr.write(q?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let B=new AbortController;if(!X.runWorker)import("./ask-relay-jatz6zdz.js").then(({runBackgroundAskRelay:q})=>q(B.signal,(L)=>Q.stderr.write(`${L}
-`))).catch(()=>{});try{for(;;){let q=p0(H.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},L=X.runWorker?null:t2({stateDirectory:H.stateDirectory}),T=!1,_;try{_=await(X.runWorker??T$)(["start","--config",G],{deferOptionalLanes:!0,...X.worker,...q,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{T=!0}})}finally{L?.stop()}if(!T)return _;if(!M("this computer's connection was removed from Reason",{keep:!1}))break}return V3(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{B.abort()}}async function kG($,J,Z){let{io:Q,options:X,home:Y,channel:V,environment:N}=Z;if(J&&await(X.controlWorker??B0)(J,"status").catch(()=>null))throw new l("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=g0(Y,V,!0),H=B7({parsed:$,saved:J,stateDirectory:G,lifetime:"ephemeral",home:Y,channel:V,options:X,environment:N}),M=K7(H,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),U=T0(G,"worker.json");return o(G,!0),c(U,M),Q.stdout.write(f9(`Reason: connecting "${M.name}" while this command runs`,M,Z.host.platform,["Connecting\u2026"])),(X.runWorker??T$)(["start","--config",U],{...l9(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:Z3(Q.stderr)},onStartup:(B)=>{if(B==="ready")Q.stdout.write(`Connected. Start Sessions on "${M.name}" from Reason. Press Ctrl-C to stop.
-`);X.worker?.onStartup?.(B)}})}function hG($,J,Z,Q){if(Z.platform!=="darwin")throw new l("--keep-awake is for macOS.");if(!J)throw new l("This computer is not connected to Reason. Run reason connect first.");o(g(J),!0),h4(d(J).daemon,$);let X=j2(d(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var fG=K.object({root:K.object({id:K.string().min(1).max(160),label:K.string().max(160),path_fingerprint:K.string()})});async function U7($,J,Z,Q){let X=await(l9(Q.worker,Z).enrollmentCredentials??z$)($,O$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new I$(X,{credentialsPath:O$($),fetchImpl:b0($.proxy)}),V=(N)=>N instanceof v0&&N.status===404&&!["device_not_found","root_not_found"].includes(N.code);return{add:async(N)=>{let G=H4($,N,{...J.roots[0].permissions,expose_mcp:!1}),H=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((U)=>{if(V(U))throw Error("worker_folders_unavailable");if(U instanceof v0&&U.code==="root_limit_reached")throw new l("This computer already has the most folders Reason allows (32).");throw U}),M=fG.parse(H).root;if(M.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:M.id,label:M.label}},remove:async(N)=>{await Y.removeDeviceRoot(J.deviceId,N).catch((G)=>{if(V(G))throw Error("worker_folders_unavailable");if(!(G instanceof v0&&G.code==="root_not_found"))throw G})}}}function N7($,J,Z){h0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:K0($)}},d($).state,{proofStore:M0($)})}async function H7($,J,Z,Q){let{io:X,options:Y,host:V}=Q,N=J&&!Q.apiKey&&p0(J.stateDirectory)===null?J2(Q.home,Q.channel,J):null,G=J&&N&&x$(J)&&!I1(J,N)?k0(J).find((P)=>P.account&&P.organizationId===N)??null:void 0;if(G===null)throw new l("This computer is not connected for your account. Run reason connect first.");let H=G?G.config:J,M=G?G.configPath:Z,U=H&&x$(H)&&!e(H).revoked?t(H):null;if(!J||!H||!U||H.lifetime!=="persistent")throw new l("This computer is not connected to Reason. Run reason connect first.");let B=$.addFolder!==void 0,q=B?$.addFolder:$.removeFolder,L=Y.cwd??process.cwd(),T;try{T=J3(L,q)}catch(P){if(B)throw new l(P instanceof Error?P.message:String(P));T=CG(L,q)}if(T===H.workspaceRoot)throw new l(`${T} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let _=H.folders??[],W=U.roots.slice(1).find((P)=>P.path===T);if(!B&&!W&&!_.includes(T))throw new l(`${T} is not one of this computer's folders.`);if(B&&!z1(T,H.stateDirectory))throw new l(`${T} holds Reason's own settings.`);if(B&&!W&&_.length>=31)throw new l("This computer already has the most folders Reason allows (32).");let O=Q.apiKey??p0(H.stateDirectory)??void 0,F=await U7(H,U,O,Y),z=U.roots.filter((P)=>P.path!==T);if(B)z=[...z,await F.add(T)];else if(W)await F.remove(W.id);N7(H,U,z);let j=B?[..._.filter((P)=>P!==T),T]:_.filter((P)=>P!==T),{folders:D,...R}=H;if(c(M,$0.parse({...R,...j.length?{folders:j}:{}})),!await(Y.controlWorker??B0)(J,"reload_roots").then(()=>!0,()=>!1))G$(J,V,"connect");return X.stdout.write(B?`Added ${T}. Sessions on "${H.name}" may run in it.
-`:`Removed ${T}. Sessions on "${H.name}" no longer run in it.
-`),0}async function q_($,J,Z){let Q=v9(Z),X=K3(Q.home,Q.channel);try{let Y=T0(g0(Q.home,Q.channel),"worker.json");return await H7({once:!1,yes:J,addFolder:$},R0(Y),Y,Q)===0}finally{X()}}function v9($,J){let Z=B$($.home??U0()),Q=$.env??process.env;return{io:$.io??B3(),options:$,home:Z,channel:$.channel??Y$(),environment:Q,apiKey:J??n6(Q),host:$.serviceHost??V$(Z)}}async function vG($,J,Z,Q){let X=t($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let V=await U7($,X,Z,Q),N=Y.find((G)=>G.path===J.workspaceRoot)??await V.add(J.workspaceRoot);await V.remove(Y[0].id),Y=[N,...Y.slice(1).filter((G)=>G.id!==N.id)]}N7(J,X,Y)}var q7=Symbol("serve here");async function mG($,J,Z,Q){let{io:X,options:Y,home:V,channel:N,environment:G,host:H}=Q;if(H.platform==="darwin"){let E=h6(V);if(E.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${E.code}).
-`)}let M=J&&!Q.apiKey&&p0(J.stateDirectory)===null?J2(V,N,J):null,U=J&&M&&e(J).revoked&&k0(J).some((E)=>E.account&&E.organizationId===M)?M2(J,{prefer:M,keep:!1})??J:J,B=B7({parsed:$,saved:U,stateDirectory:g0(V,N),lifetime:"persistent",home:V,channel:N,options:Y,environment:G});if(V3(V,N,!1),U?.executionMode==="confined")X.stdout.write(V7);let q=U?p0(U.stateDirectory):null,L=K7(B,Q.apiKey??q??void 0),T=T1(H,G),_=U!==null&&x$(U),W=_&&K0(U)===K0(L),O=W&&_1(L),F=U?.userChrome!==!1===(L.userChrome!==!1)&&U?.cloudSessions===L.cloudSessions&&U?.localLogins===L.localLogins,z=Q.apiKey??q??void 0,j=M!==null&&_&&!e(U).revoked&&!I1(U,M);if(j){if(!W||!F||JSON.stringify(U.proxy)!==JSON.stringify(L.proxy))throw new l("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let E=await yG(U,M,X,Y);if(E!==0)return E}let D=j?[`  Account:   yours too, in workspace ${M}, beside this computer's other Reason account`]:[],R=async()=>{if($.apiKey===void 0||$.apiKey===q)return;await T3(L,$.apiKey),L3(L.stateDirectory,$.apiKey)},I=G.PATH||"/usr/local/bin:/usr/bin:/bin",P=O&&JSON.stringify(U?.proxy)===JSON.stringify(L.proxy)&&F?F1(L,H,"connect"):null,C=P?.label===r6(L.channel),f=C?await(Y.controlWorker??B0)(L,"status").catch(()=>null):null,S=f!==null,h=C&&!S&&u9(P,H)&&e6({config:L,launcher:T,path:I,host:H,kind:"connect"});if((S||h)&&[null,r].includes(x1(L))){await R();let E=o6(L,H,"connect");if(E==="retired"){let A=h?null:await(Y.controlWorker??B0)(L,"status").catch(()=>null);if(!h&&(!A||A.phase==="stopping"))G$(L,H,"connect")}else if(E==="current_not_running")G$(L,H,"connect");else if(H.platform==="win32"&&f&&(f.capabilityReadiness?.["exec.run"]===!1||f.supportedOperations?.includes("exec.run")===!1)&&lG())G$(L,H,"connect");return await(Y.controlWorker??B0)(L,"reload_roots").catch(()=>null),X.stdout.write(G.REASON_INSTALLER==="1"?h9(L,H.platform,D):f9("This computer is connected to Reason",L,H.platform,[...D,...h?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let p=!O&&!j;if(_&&!W)if(U.apiOrigin!==L.apiOrigin||U.name!==L.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
-`),!await c9(U,Z,X,Y,H))throw new l("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(U.executionMode==="host"&&_1(U))X.stdout.write(`Applying the new settings to this computer\u2026
-`),await vG(U,L,z,Y),p=!1;else await s9(U,Y,H);if(p){if(G.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
-`);let E=await p9(L,Z,X,Y,z);if(E!==0)return E;if(z)L3(L.stateDirectory,z)}else c(Z,L),await R();let b;try{b=e2({config:L,launcher:T,path:I,host:H,kind:"connect"})}catch(E){if(!(E instanceof E$))throw E;if(E.code!=="worker_service_manager_missing")throw new l(`${E.message}
-This computer is set up; run reason connect again to start it.`,E.code??"worker_service_start_failed");if(Y.serveHere&&G.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),q7;if(Y.serveHere&&G.REASON_INSTALLER==="1"&&await gG(L,T,G,Y))return X.stdout.write(h9(L,H.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${T} connect under a process manager)`])),0;throw new E$(`${E.message}
-This computer is set up. Keep it connected by running ${T} connect in a terminal or under this box's process manager.`,E.code)}let x=[...D,...b.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...b.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${b.identityProblem}).`]:[]];return X.stdout.write(G.REASON_INSTALLER==="1"?h9(L,H.platform,x):f9("This computer is connected to Reason",L,H.platform,[`  Service:   ${b.label} (starts at ${b.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${b.logs}`,`Start Sessions on "${L.name}" from Reason. Remove it with: reason disconnect`,...x])),0}async function gG($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??M7)(J,Y,T0($.stateDirectory,"connect.log"));for(let V=0;V<60;V+=1)if(await new Promise((N)=>setTimeout(N,500)),await(Q.controlWorker??B0)($,"status").catch(()=>null))return!0;return!1}function M7($,J,Z){let Q=Z7(Z,"a",384);try{let X=$7($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{J7(Q)}}async function L7($,J,Z,Q=!1){let X=!0;for(let Y of k0($)){if(Q&&Y.account)continue;if(Y.config&&x$(Y.config)&&!e(Y.config).revoked){if(await(Z.runWorker??T$)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:Y3,stderr:J.stderr}})!==0){X=!1;continue}}j1(Y.directory,{recursive:!0,force:!0})}return X}function B3(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function i9($,J){if($ instanceof l||$ instanceof E$)return J.stderr.write(`Reason: ${$.message} (${$.code??"worker_service_failed"})
-`),2;let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:dG($);return J.stderr.write(`Reason: ${Q1(Z)??"could not connect this computer."} (${Z})
-`),1}var uG=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]);function dG($){if($ instanceof v0)return $.status>=500?"worker_api_unavailable":"worker_api_refused";let J=$?.code;if(typeof J==="string"&&uG.has(J))return`worker_file_${J.toLowerCase()}`;return"worker_connect_unexpected"}function v6($,J){if($.minimal){F7({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||_7({home:J.home})!=="install")return;let Z;try{Z=T1(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=T0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??m6)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
-`);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let Q=(J.options.installDesktop??m6)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function pG($){if($.host.platform!=="win32"||!$.io.stdinIsTty)return;m9();let J=g9();if(!zG(J)||h1(J))return;$.io.stdout.write(`Setting up the Windows sandbox for confined commands; approve the Windows prompt\u2026
-`);let Z=s6(J);if(Z!=="installed")$.io.stderr.write(`Reason: the Windows sandbox was not set up (${Z==="cancelled"?"prompt declined":"install failed"}); connecting without confined commands. Run reason connect again to retry. (windows_sandbox_unavailable)
-`)}function lG(){if(V1()===null)return!1;return m9(),h1(g9())}function m6($,J,Z){if(!Z){let X=()=>OG($,["desktop","install"],{env:J,stdio:"inherit"}).status??1,Y=X();return Y===3221225477?X():Y}AG(d9(Z.log),{recursive:!0,mode:448});let Q=Z7(Z.log,"w",384);try{let X=$7($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{J7(Q)}return 0}async function M_($,J={}){let Z=J.io??B3();try{let Q=bG($);if(!Q)return Z.stdout.write(IG),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new l("A machine's workers run one Session at a time; --sessions does not apply to them.");if(Q.proxy!==void 0)throw new l("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new l("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new l("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new l("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[H,M]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(M!==void 0)throw new l(`${H} is for your own computer; reason serve sets up a machine's workers.`);return v6(Q,v9(J)),await(J.runServe??w6)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=v9(J,Q.apiKey),{channel:Y,environment:V}=X;if(!J.env)for(let H of["REASON_API_KEY","ARA_API_KEY"])delete process.env[H];if(Q.userChrome&&X.host.platform!=="darwin")throw new l("--user-chrome is for a Mac.");let N=t6(V[s$],Y),G=N||Q.once?()=>{return}:K3(X.home,Y);try{let H=T0(g0(X.home,Y),"worker.json"),M=R0(H);if(N)return await f6(M,H,X);if(Q.keepAwake!==void 0)return hG(Q.keepAwake,M,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await H7(Q,M,H,X);if(v6(Q,X),pG(X),Q.once)return await kG(Q,M,X);let U=await mG(Q,M,H,X);if(U!==q7)return U;return G(),G=()=>{return},await f6(R0(H),H,X)}finally{G()}}catch(Q){return i9(Q,Z)}}async function L_($,J={}){let Z=J.io??B3();try{if($.some((V)=>["--help","-h","help"].includes(V)))return Z.stdout.write(EG),0;let Q=$.filter((V)=>!["--yes","-y","--temporary","--account"].includes(V)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new l("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await aG(Q[0],Z,J);return await T7(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return i9(Q,Z)}}async function T_($={}){let J=$.io??B3();try{return await T7(J,$,"logout")}catch(Z){return i9(Z,J)}}async function T7($,J,Z){let Q=B$(J.home??U0()),X=J.channel??Y$(),Y=K3(Q,X);try{return await cG($,J,Z,Q,X)}finally{Y()}}function K3($,J){let Z=g0($,J),Q=u(Z)?J1():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new l("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function cG($,J,Z,Q,X){let Y=T0(g0(Q,X),"worker.json"),V=R0(Y);if(!V){if(Z==="disconnect")V3(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(Z!=="disconnect"){let G=await sG(V,Y,$,J,Z,Q,X);if(G!==null)return G}let N=!1;try{N=await c9(V,Y,$,J,J.serviceHost??V$(Q))}finally{if(Z!=="temporary")V3(Q,X,!0)}if(!N)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
-`),1;return $.stdout.write(`Disconnected "${V.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function sG($,J,Z,Q,X,Y,V){let N=k0($).filter((_)=>_.account);if(N.length===0)return null;let G=J2(Y,V,$),H=Q.controlWorker??B0,M=N.find((_)=>_.organizationId===G);if(M){if(M.config&&!await G3(M.config,M.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
-`),1;if(X!=="account"||!M.config)j1(M.directory,{recursive:!0,force:!0});return await H($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${G} for your account. It stays connected for its other Reason accounts.
-`),0}if(!G&&X==="account")throw new l("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!G||!I1($,G)){if(X==="account"&&G)q2($,G);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let U=Q.serviceHost??V$(Y),B=null;try{B=t($)?.orgId.toLowerCase()??null}catch{}if(await s9($,Q,U,"connect",!0),!await L7($,Z,Q,!0)||!await G3($,J,Z,Q))return G$($,U,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
-`),1;let q=M2($,{prefer:null,keep:!1});if(!q)return null;if(X==="account"&&B)q2(q,B);let L=G$(q,U,"connect")!==null,T="";try{T=` in workspace ${t(q)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${T}${L?"":"; run reason connect to start it again"}.
-`),0}async function aG($,J,Z){let Q=B$(Z.home??U0()),X=Z.serviceHost??V$(Q),Y=y9(Q,$);if(Y.length===0)throw new l(`No worker for machine "${$}" on this computer.`);let V=!1;for(let N of Y)if(await c9(N.config,N.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${N.config.workspaceRoot}.
-`);else V=!0,J.stderr.write(`Reason: machine "${$}" in ${N.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
-`);return V?1:0}async function F_($={}){let J=B$($.home??U0()),Z=R0(T0(g0(J,$.channel??Y$()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??B0)(Z,"status").catch((q)=>{return Q=q instanceof Error?q:Error(String(q)),null}),Y=X?x1(Z):null,V=$.serviceHost??V$(J),N=F1(Z,V,"connect"),G=e(Z).revoked,H=!G&&!X,M=(()=>{try{return t(Z)}catch{return null}})(),{workspaces:U,off:B}=G||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:D4(Z,X?.phase==="running");return{workspaces:U,workspaces_off:B,workspaces_max:U2+(U?.filter((q)=>q.account).length??0),name:Z.name,device_id:M?.deviceId??null,organization_id:M?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:null,user_chrome:a9(Z,V.platform),cloud_sessions:Z.cloudSessions===!0,root:M?.roots[0]?{id:M.roots[0].id,permissions:M.roots[0].permissions}:null,roots:M?.roots.map((q)=>({id:q.id,folder:q.path,permissions:q.permissions}))??[],state:G?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:H?s4(Z,Q):null,worker_alive:H&&N?u9(N,V):null,sessions_running:X?.activeSessions??null,version:Y,service:N?{label:N.label,logs:N.logs}:null}}async function __($,J,Z=B0){let Q={version:1,status:"unavailable"},X=R0(T0(g0(B$($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?a6({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function j_($={}){try{let J=B$($.home??U0());return R0(T0(g0(J,$.channel??Y$()),"worker.json"))?.userChrome!==!1}catch{return!1}}function D_($={}){let J=B$($.home??U0()),Z=R0(T0(g0(J,$.channel??Y$()),"worker.json"));if(!Z)return null;return G$(Z,$.serviceHost??V$(J),"connect")?.label??null}async function W_($={}){let J=B$($.home??U0()),Z=R0(T0(g0(J,$.channel??Y$()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??V$(J),X=await b6(Z,Q,"connect",$.current);if(X!==null||F1(Z,Q,"connect"))return X;return iG(Z,Q,$)}async function iG($,J,Z){let Q=Z.controlWorker??B0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&x1($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let V;try{V=T1(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let N=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<N&&await Q($,"status").catch(()=>null)!==null)await new Promise((U)=>setTimeout(U,250));let{REASON_INSTALLER:G,REASON_DESKTOP_BACKGROUND:H,...M}=Z.env??process.env;return(Z.startConnection??M7)(V,M,T0($.stateDirectory,"connect.log")),{state:"restarted"}}
-export{d as a,t as b,j2 as c,R0 as d,IG as e,EG as f,g0 as g,H_ as h,q_ as i,M_ as j,L_ as k,T_ as l,F_ as m,__ as n,j_ as o,D_ as p,W_ as q};