@reason-machines/cli-linux-x64 0.2.504 → 0.2.505

package/bin/vm-hands/vm-hands-entry-lite-rmabryke.js

@@ -1,452 +0,0 @@
-// @bun
-import{Gt,j}from"./vm-hands-entry-lite-rzr2ncf5.js";import{ue,Ce,Z,Ae,de,rr,et,X,O,H,tn}from"./vm-hands-entry-lite-38g65s5x.js";import{Lo,ri}from"./vm-hands-entry-lite-nqdstx24.js";import{xo,P,Je,Se,Ze,ne,Xe,Vn,Ee,Xt,ae,U,N,ce,Hr,zr,Kn}from"./vm-hands-entry-lite-5gevvgec.js";import{Pe,oe,pe,Y,Re,q,Q}from"./vm-hands-entry-lite-5tbntcyq.js";import{It,kr,at,V,D,R,b,En}from"./vm-hands-entry-lite-77j164ps.js";import{Er,xr,vn,oo,He,Sn}from"./vm-hands-entry-lite-tebh7dcm.js";import{K}from"./vm-hands-entry-lite-ncbzy69k.js";import{Mi}from"./vm-hands-entry-lite-xdjrdkh2.js";import{p,ze,Dt,ct,so,_e,we}from"./vm-hands-entry-lite-psywfz8m.js";import{v,h,lo}from"./vm-hands-entry-lite-f69t48dj.js";import{E}from"./vm-hands-entry-lite-txd50spx.js";import{Qt}from"./vm-hands-entry-lite-sss0m3yn.js";import{a,ie,$o}from"./vm-hands-entry-lite-swrymqj9.js";import{L,Ii,Di,Ho,y,t,k,Et,o,d,u,i,c,g,ee,s,n}from"./vm-hands-entry-lite-gvjffc5t.js";import{Li}from"./vm-hands-entry-lite-mk5ayds8.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{qo,se,Wo,C,De,Me,A}from"./vm-hands-entry-lite-87vmbt38.js";var gi=()=>{let e={string:{unit:"characters",verb:"to have"},file:{unit:"bytes",verb:"to have"},array:{unit:"items",verb:"to have"},set:{unit:"items",verb:"to have"},map:{unit:"entries",verb:"to have"}};function l(w){return e[w]??null}let f={regex:"input",email:"email address",url:"URL",emoji:"emoji",uuid:"UUID",uuidv4:"UUIDv4",uuidv6:"UUIDv6",nanoid:"nanoid",guid:"GUID",cuid:"cuid",cuid2:"cuid2",ulid:"ULID",xid:"XID",ksuid:"KSUID",datetime:"ISO datetime",date:"ISO date",time:"ISO time",duration:"ISO duration",ipv4:"IPv4 address",ipv6:"IPv6 address",mac:"MAC address",cidrv4:"IPv4 range",cidrv6:"IPv6 range",base64:"base64-encoded string",base64url:"base64url-encoded string",json_string:"JSON string",e164:"E.164 number",jwt:"JWT",template_literal:"input"},_={nan:"NaN"};return(w)=>{switch(w.code){case"invalid_type":{let S=_[w.expected]??w.expected,I=Ho(w.input),W=_[I]??I;return`Invalid input: expected ${S}, received ${W}`}case"invalid_value":if(w.values.length===1)return`Invalid input: expected ${Di(w.values[0])}`;return`Invalid option: expected one of ${Ii(w.values,"|")}`;case"too_big":{let S=w.inclusive?"<=":"<",I=l(w.origin);if(I)return`Too big: expected ${w.origin??"value"} to have ${S}${w.maximum.toString()} ${I.unit??"elements"}`;return`Too big: expected ${w.origin??"value"} to be ${S}${w.maximum.toString()}`}case"too_small":{let S=w.inclusive?">=":">",I=l(w.origin);if(I)return`Too small: expected ${w.origin} to have ${S}${w.minimum.toString()} ${I.unit}`;return`Too small: expected ${w.origin} to be ${S}${w.minimum.toString()}`}case"invalid_format":{let S=w;if(S.format==="starts_with")return`Invalid string: must start with "${S.prefix}"`;if(S.format==="ends_with")return`Invalid string: must end with "${S.suffix}"`;if(S.format==="includes")return`Invalid string: must include "${S.includes}"`;if(S.format==="regex")return`Invalid string: must match pattern ${S.pattern}`;return`Invalid ${f[S.format]??w.format}`}case"not_multiple_of":return`Invalid number: must be a multiple of ${w.divisor}`;case"unrecognized_keys":return`Unrecognized key${w.keys.length>1?"s":""}: ${Ii(w.keys,", ")}`;case"invalid_key":return`Invalid key in ${w.origin}`;case"invalid_union":if(w.options&&Array.isArray(w.options)&&w.options.length>0)return`Invalid discriminator value. Expected ${w.options.map((I)=>`'${I}'`).join(" | ")}`;return"Invalid input";case"invalid_element":return`Invalid value in ${w.origin}`;default:return"Invalid input"}}};function Rn(){return{localeError:gi()}}L(Rn());class pt extends Error{}function Ao(e){let l;try{l=new URL(e)}catch{throw new pt("The proxy must be a URL like https://proxy.example.com:3128.")}if(l.protocol!=="https:"&&l.protocol!=="http:")throw new pt("The proxy URL must use the https or http scheme.");if(!l.hostname)throw new pt("The proxy URL must name a host.");if(l.port!==""&&Number(l.port)<1)throw new pt("The proxy URL must use a port between 1 and 65535.");if(l.pathname!==""&&l.pathname!=="/"||l.search||l.hash)throw new pt("The proxy URL must not carry a path, query, or fragment.");return l.toString()}import{createHash as bi}from"crypto";import{isAbsolute as To,join as Do,relative as Co,resolve as Vt,sep as No}from"path";var Jt=t().min(1).refine(To,"absolute path required"),xn=c({version:n(1),apiOrigin:Et(),channel:s(["staging","production"]),stateDirectory:Jt,workspaceRoot:Jt,lifetime:s(["persistent","ephemeral"]),executionMode:s(["confined","host"]).default("confined"),name:t().min(1).max(160).default("Reason headless worker"),slots:o().int().min(1).max(4).default(1),shutdownGraceMs:o().int().min(0).max(300000).default(30000),proxy:c({version:n(Gt),url:t().refine((e)=>{try{return Ao(e)===e}catch{return!1}},"invalid proxy URL"),caFile:Jt.optional()}).optional(),userChrome:d().optional(),cloudSessions:n(!0).optional(),localLogins:d().optional(),folders:u(Jt).min(1).max(31).optional()}),wi=/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.trycloudflare\.com$/,B=g("channel",[xn,xn.extend({channel:n("pr"),apiOrigin:t(),prEnvironment:t()}),xn.extend({channel:n("local-qa"),apiOrigin:t()})]).superRefine((e,l)=>{if(e.channel==="local-qa"){if(!wi.test(e.apiOrigin))l.addIssue({code:"custom",message:"local QA worker requires an exact HTTPS trycloudflare.com quick-tunnel origin"})}else if(e.channel==="pr"){let _=e.prEnvironment,w=/^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.up\.railway\.app$/.exec(e.apiOrigin),S=w?.[1]?.match(/(?:^|-)pr-[0-9]+(?=-|$)/g)?.map((I)=>I.replace(/^-/,""));if(!_||/^pr-[1-9][0-9]*$/.exec(_)?.[0]!==_||w?.[0]!==e.apiOrigin||S?.length!==1||S[0]!==_)l.addIssue({code:"custom",message:"PR worker requires explicit prEnvironment and an exact same-PR HTTPS Railway origin"})}else{let _=new URL(e.apiOrigin);if(_.origin!==e.apiOrigin||_.username||_.password||_.protocol!=="https:"&&!(_.protocol==="http:"&&ri(_.origin))||!ri(_.origin)&&!Lo(e.channel,_.origin))l.addIssue({code:"custom",message:"API origin must match channel (or loopback)"})}if(!je(e.workspaceRoot,e.stateDirectory))l.addIssue({code:"custom",message:"state and workspace must be disjoint"});let f=e.folders??[];if(new Set([e.workspaceRoot,...f]).size!==f.length+1||f.some((_)=>!je(_,e.stateDirectory)))l.addIssue({code:"custom",message:"folders must be distinct and disjoint from state"})});function m(e){return Do(e.stateDirectory,`headless-${e.channel==="pr"?e.prEnvironment:e.channel}`)}function je(e,l){if(Fr(l,e))return!1;return!Fr(e,l)||E(Do(No,Co(Vt(e),Vt(l))))}function Fr(e,l){let f=Co(Vt(e),Vt(l));return f===""||f!==".."&&!f.startsWith(`..${No}`)&&!To(f)}function te(e){let{proxy:l,userChrome:f,cloudSessions:_,localLogins:w,folders:S,...I}=e;return bi("sha256").update(JSON.stringify(I)).digest("hex")}var yi=4,vi=[2375,2376,9222,9229];function pr(e){let l=new Set(vi);for(let f of e){let _=new URL(f);l.add(Number(_.port||(["https:","wss:"].includes(_.protocol)?443:80)))}return l}function Gr(){throw new r("preview_unavailable","The live Hands preview binding is unavailable or stale.")}var ki=60000;function Bo(e){let l=new AbortController,f=new Map,_=(x)=>JSON.stringify([x.jobId,x.port]);function w(x){let M=e.authority.owner;if(l.signal.aborted||!e.isCurrent()||e.expiresAtMs<=Date.now()||x.organization_id!==M.organization_id||x.user_id!==M.user_id||x.device_id!==M.device_id)Gr()}function S(x){let M;try{M=e.environment.current()}catch{return null}return M.binding.target_generation===x.generation&&M.binding.target_fence_id===x.fenceId&&M.run_id===e.runId&&M.device_id===e.authority.owner.device_id&&M.root_id===e.authority.rootId?M:null}async function I(x,M,G){let F=await W(x,M,G);if(F!=="moved")return F;let T=await W(x,M,G);return T==="moved"?null:T}async function W(x,M,G){try{w(e.authority.owner);let F=e.identity();if(!F||G.aborted||x.expiresAtMs<=Date.now()||x.expiresAtMs>e.expiresAtMs)return null;let T=M.opened,re=T!==void 0&&F.generation>T.generation,J=S(F);if(re){if(J){if(J.revision<=T.revision||x.expiresAtMs>Date.parse(J.expires_at)||J.binding.target_revision!==T.attachmentRevision||J.binding.root_grant_revision!==T.grantRevision)return null;M.recoveringSinceMs=void 0}else if(Date.now()-(M.recoveringSinceMs??=Date.now())>ki)return null}else if(!J||x.expiresAtMs>Date.parse(J.expires_at)||T&&(F.generation!==T.generation||F.fenceId!==T.fenceId))return null;let z=await e.inspect(x.jobId,G),fe=e.identity(),ve=fe&&S(fe);w(e.authority.owner);let be=J&&{generation:F.generation,fenceId:F.fenceId,snapshotId:J.snapshot_id,revision:J.revision,attachmentRevision:J.binding.target_revision,grantRevision:J.binding.root_grant_revision},Oe=re?T:be;if(G.aborted||!fe)return null;if(fe.generation!==F.generation||fe.fenceId!==F.fenceId||ve?.snapshot_id!==J?.snapshot_id||ve?.revision!==J?.revision)return"moved";let $e=z.ok&&z.job.environmentSnapshotId!==void 0&&z.job.environmentRevision!==void 0?{snapshotId:z.job.environmentSnapshotId,revision:z.job.environmentRevision}:null;if(!z.ok||z.generation!==F.generation||!Oe||!$e)return null;if(($e.snapshotId!==Oe.snapshotId||$e.revision!==Oe.revision)&&(re||!e.environment.carried($e.snapshotId,$e.revision)))return null;if(!T&&F.generation===x.generation&&F.fenceId===x.fenceId)M.opened={...Oe,...$e};return{executorLaunchId:e.executorLaunchId,job:z.job,binding:{organizationId:e.authority.owner.organization_id,userId:e.authority.owner.user_id,deviceId:e.authority.owner.device_id,rootId:e.authority.rootId,runId:e.runId,attachmentRevision:Oe.attachmentRevision,grantRevision:Oe.grantRevision,generation:Oe.generation,fenceId:Oe.fenceId,jobId:z.job.jobId,port:x.port,expiresAtMs:x.expiresAtMs}}}catch{return null}}return{async open(x,M,G){w(M);let{binding:F,deviceRelayUrl:T}=ct(x);if(G.aborted||F.expiresAtMs<=Date.now()||F.expiresAtMs>Date.now()+p.lifetimeMs||new URL(T).origin!==e.authority.relayOrigin)Gr();let re=_(F),J=f.get(re);if(J){if(!ze(J.binding,F)||J.relay!==T)Gr();if(await J.opened,!await Dt(()=>J.port.check())||G.aborted||J.abort.signal.aborted)Gr();return{opened:!0,binding:F}}if(f.size>=yi)Gr();let z=new AbortController,fe={},ve=we({binding:F,deniedPorts:e.authority.deniedPorts,readCurrentJob:()=>I(F,fe,z.signal)}),be=()=>z.abort();if(G.addEventListener("abort",be,{once:!0}),l.signal.addEventListener("abort",be,{once:!0}),G.aborted||l.signal.aborted)be();let Oe=_e({binding:F,deviceRelayUrl:T,port:ve,signal:z.signal}),$e={binding:F,relay:T,abort:z,port:ve,opened:Oe};f.set(re,$e);let qe=()=>{if(G.removeEventListener("abort",be),l.signal.removeEventListener("abort",be),f.get(re)===$e)f.delete(re)};try{if((await Oe).closed.then(qe),G.removeEventListener("abort",be),w(M),z.signal.aborted||!await Dt(()=>ve.check()))Gr();return{opened:!0,binding:F}}catch{z.abort(),qe(),Gr()}},async close(x,M){w(M);let{binding:G}=so(x),F=f.get(_(G));if(!F||!ze(F.binding,G))Gr();return F.abort.abort(),await F.opened.then((T)=>T.closed,()=>{return}),{closed:!0,binding:G}},dispose(){l.abort();for(let x of f.values())x.abort.abort();f.clear()}}}import{WebSocket as Pn}from"ws";var jo=(e)=>("data"in e)?e.data.length:e.bytes,Mo=2*Xe;function ir(e){throw new r(e,"The bound Hands terminal is unavailable or its outcome is unconfirmed.")}var _t=(e)=>!["starting","running"].includes(e.state);function Ji(e,l,f=Date.now()){let _=["relay_url","session_id","expires_at","cols","rows","pty","workspace"];if(Object.keys(e).length!==_.length||Object.keys(e).some((M)=>!_.includes(M))||!ae(l)||!ae(e.session_id)||typeof e.expires_at!=="string"||typeof e.relay_url!=="string"||e.relay_url.length>4096||![e.cols,e.rows].every((M)=>Number.isSafeInteger(M)&&Number(M)>=1&&Number(M)<=Ee))ir("invalid_pty_request");let w=e.pty;if(!w||typeof w!=="object"||Array.isArray(w))ir("invalid_pty_request");let S=w;if(Object.keys(S).length!==2||S.version!==1||!ce(S.jobId))ir("invalid_pty_request");let I;try{I=new URL(e.relay_url)}catch{return ir("invalid_pty_request")}if(!["ws:","wss:"].includes(I.protocol)||I.username||I.password||I.hash||I.protocol==="ws:"&&!["127.0.0.1","[::1]","localhost"].includes(I.hostname))ir("invalid_pty_request");let W=Date.parse(e.expires_at);if(!Number.isSafeInteger(W)||W<=f)ir("invalid_pty_request");return{workspace:H(e.workspace)??ir("invalid_pty_request"),session:{jobId:S.jobId,sessionId:e.session_id,operationId:l,relayUrl:I.href,cols:Number(e.cols),rows:Number(e.rows),leaseExpiresAtMs:Math.min(W,f+43200000)}}}async function Fo(e){let{session:l,binding:f}=e;if(f.assertCurrent(),e.signal.aborted||Date.now()>=l.leaseExpiresAtMs)ir("cancelled");let _=new Pn(l.relayUrl,{followRedirects:!1,perMessageDeflate:!1,maxPayload:ne}),w=new AbortController,S=()=>{},I=()=>{w.abort(),S()};e.signal.addEventListener("abort",I,{once:!0});let W=setTimeout(I,Math.max(1,l.leaseExpiresAtMs-Date.now())),x=[],M=0,G=0,F=0,T=!1,re=!1,J=!1,z,fe,ve,be=(le)=>{ve=new r(le,"Bound terminal input was refused."),I()};_.on("error",()=>be("pty_relay_unavailable")),_.on("close",I),_.on("message",(le,he)=>{if(w.signal.aborted)return;if(!re){be("pty_not_ready");return}let xe=Array.isArray(le)?Buffer.concat(le):le instanceof ArrayBuffer?Buffer.from(le):le;if(xe.length===0)return;let Ke=x.at(-1),Le=he&&Ke!==void 0&&"data"in Ke&&Ke.data.length+xe.length<=ne;if(xe.length>ne||M+xe.length>Vn){be("pty_input_backpressure");return}if(Le)Ke.data=Buffer.concat([Ke.data,xe]);else if(he)x.push({data:Buffer.from(xe)});else try{let Be=JSON.parse(xe.toString("utf8"));if(Be&&Be.t==="close"&&Object.keys(Be).length===1){J=!0,I();return}if(!Be||Be.t!=="resize"||Object.keys(Be).length!==3||![Be.cols,Be.rows].every((ke)=>Number.isSafeInteger(ke)&&ke>=1&&ke<=Ee))throw Error("invalid_control");x.push({cols:Be.cols,rows:Be.rows,bytes:xe.length})}catch{be("invalid_pty_control");return}M+=xe.length,S()});function Oe(le){return Kn(JSON.stringify({...f.scope,version:1,sessionId:l.sessionId,operationId:l.operationId,job:{...le,output:[],pty:le.pty?{...le.pty,output:[]}:void 0}}))}function $e(le){if(!le.ok)ir(le.error);let he=le.job;if(le.generation!==f.scope.generation||he.jobId!==l.jobId||!he.pty||he.leaseExpiresAtMs>l.leaseExpiresAtMs||he.process&&he.process.executorLaunchId!==f.scope.executorLaunchId||he.process&&fe&&(he.process.pid!==fe.pid||he.process.processGroupId!==fe.processGroupId)||he.state!=="starting"&&(he.environmentRevision!==f.environment.revision||he.environmentSnapshotId!==f.environment.snapshotId))ir("pty_binding_changed");if(Oe(he),he.process)fe??={...he.process};return he}async function qe(le){f.assertCurrent();let he=await f.request(le,w.signal);if(f.assertCurrent(),w.signal.aborted)ir("cancelled");let xe=$e(he);if(xe.inputSequence!==G)ir("job_input_sequence");if(!_t(xe)&&xe.leaseExpiresAtMs<=Date.now())ir("pty_binding_changed");return xe}function ye(le){if(f.assertCurrent(),w.signal.aborted||_.readyState!==Pn.OPEN||_.bufferedAmount+Buffer.byteLength(le)>Mo)ir("pty_output_backpressure");_.send(le)}function Fe(le){if(le.firstCursor>F+1)F=le.firstCursor-1;for(let he of le.pty.output){if(he.cursor<=F)continue;if(he.cursor!==F+1)ir("pty_output_gap");let xe=Buffer.from(he.dataBase64,"base64");if(_.bufferedAmount+xe.length>Mo)return!1;ye(xe),F=he.cursor}if(F!==le.nextCursor)ir("pty_output_gap");return!0}async function Ve(le,he){let xe;try{await Promise.race([e.emit(le,he),new Promise((Ke,Le)=>{xe=setTimeout(()=>Le(new r("pty_event_unavailable","Terminal metadata delivery timed out.")),2000)})])}finally{clearTimeout(xe)}}async function Te(){let le=AbortSignal.timeout(Xt),he=f.request({jobId:l.jobId,action:"cancel",input:{}},le),xe,Ke=new Promise((Le,Be)=>{if(xe=()=>Be(new r("pty_cleanup_unconfirmed","Terminal cleanup acknowledgement was not observed within authority.")),le.addEventListener("abort",xe,{once:!0}),le.aborted)xe()});try{let Le=await Promise.race([he,Ke]);if(le.aborted)ir("pty_cleanup_unconfirmed");return $e(Le)}finally{le.removeEventListener("abort",xe)}}try{await new Promise((Le,Be)=>{let ke=setTimeout(()=>{I(),Be(new r("pty_relay_unavailable","Terminal pairing timed out."))},5000),We=()=>{clearTimeout(ke),Be(new r("cancelled","Terminal pairing was cancelled."))};if(w.signal.addEventListener("abort",We,{once:!0}),_.once("open",()=>{clearTimeout(ke),w.signal.removeEventListener("abort",We),Le()}),w.signal.aborted)We()}),f.assertCurrent(),T=!0,z=await qe({jobId:l.jobId,action:"start",input:{mode:"pty",cols:l.cols,rows:l.rows,leaseExpiresAtMs:l.leaseExpiresAtMs}});let le=Date.now()+5000;while(z.state==="starting"){if(Date.now()>=le)ir("pty_not_ready");await new Promise((Le)=>setTimeout(Le,25)),z=await qe({jobId:l.jobId,action:"inspect",input:{after:F}})}if(z.state!=="running"||z.inputSequence!==0||z.leaseExpiresAtMs<=Date.now())ir("pty_not_ready");await Ve("pty.ready",Oe(z)),re=!0,ye(JSON.stringify({t:"open",cols:z.pty.cols,rows:z.pty.rows,receipt:Oe(z)}));let he=!1,xe=0,Ke=!1;while(!w.signal.aborted){let Le=z.firstCursor>F+1,Be=Fe(z);if(_t(z)){if(Be)break}else if(Le)he=!0;else if(he&&Be&&Date.now()>=xe){he=!1,xe=Date.now()+1000;let{cols:We,rows:tr}=z.pty;for(let nr of[{cols:We,rows:tr>1?tr-1:2},{cols:We,rows:tr}]){if(_t(z))break;let Pr=++G;if(z=await qe({jobId:l.jobId,action:"resize",input:{sequence:Pr,...nr}}),z.inputSequence!==Pr)ir("job_input_sequence")}continue}let ke=_t(z)||Ke?void 0:x.shift();if(ke){M-=jo(ke);let We=++G;try{z=await qe("data"in ke?{jobId:l.jobId,action:"input",input:{sequence:We,dataBase64:ke.data.toString("base64")}}:{jobId:l.jobId,action:"resize",input:{sequence:We,cols:ke.cols,rows:ke.rows}})}catch(tr){if(!(tr instanceof r)||tr.code!=="job_input_backpressure")throw tr;G-=1,x.unshift(ke),M+=jo(ke),Ke=!0;continue}if(z.inputSequence!==We)ir("job_input_sequence")}else if(await new Promise((We)=>{let tr=setTimeout(We,Ke||!Be?10:50);if(S=()=>{clearTimeout(tr),We()},w.signal.aborted||!Ke&&x.length)S()}),Ke=!1,S=()=>{},!w.signal.aborted&&Be)try{z=await qe({jobId:l.jobId,action:"inspect",input:{after:F}})}catch(We){if(!J||!(We instanceof r)||We.code!=="cancelled")throw We}}}catch(le){ve??=le}finally{if(re=!1,x.length=0,clearTimeout(W),e.signal.removeEventListener("abort",I),I(),T&&(!z||!_t(z)))try{z=await Te()}catch{z=void 0}try{if(!z||!_t(z)||z.pty?.cleanup!=="confirmed")ir("pty_cleanup_unconfirmed");let le=Oe(z);if(_.readyState===Pn.OPEN)await new Promise((he)=>{let xe=setTimeout(he,500);_.send(JSON.stringify({t:"exit",code:z.exitCode,receipt:le}),()=>{clearTimeout(xe),he()})});await Ve("pty.stopped",le)}catch(le){ve??=le}_.terminate()}if(ve)throw ve;if(e.signal.aborted)ir("cancelled");if(!z)ir("pty_cleanup_unconfirmed");return{receipt:Oe(z)}}import{createHash as Si,randomUUID as Tn}from"crypto";import{spawnSync as Go}from"child_process";import{closeSync as Uo,constants as In,fstatSync as Ei,fsyncSync as Ri,lstatSync as Lt,mkdirSync as Oi,mkdtempSync as Jo,openSync as zo,readFileSync as xi,readdirSync as Vo,realpathSync as Nt,rmSync as An,unlinkSync as Pi}from"fs";import{createConnection as Ai}from"net";import{dirname as Ti,join as tt,sep as Ci}from"path";import{tmpdir as Hi}from"os";var Or=new Map,Jr=new Map;function Ur(e,l){return Si("sha256").update(JSON.stringify([e,l])).digest("hex")}function mt(e){try{Oi(e,{mode:448})}catch(f){if(!(f instanceof Error&&("code"in f)&&f.code==="EEXIST"))throw f}let l=Lt(e);if(!l.isDirectory()||l.isSymbolicLink()||!A(l)||Nt(e)!==e)throw new r("hands_jobs_unavailable","Hands job state must be a private canonical directory.")}function Ni(e){let l;try{l=Lt(e)}catch(f){if(f instanceof Error&&"code"in f&&f.code==="ENOENT")return!1;throw f}return!l.isDirectory()||l.isSymbolicLink()||Vo(e).length>0}function hr(e){let l=Ur(e.root,e.runId),f=e.previousRuntimeDirectories?.find((I)=>Ni(tt(I,"jobs",l.slice(0,16))))??e.runtimeDirectory;mt(f);let _=tt(f,"jobs");mt(_);let w=tt(_,l.slice(0,16));if(e.maxScopes!==void 0){let I=Vo(_);if(!Number.isSafeInteger(e.maxScopes)||e.maxScopes<1||I.length>e.maxScopes||!I.includes(l.slice(0,16))&&I.length>=e.maxScopes)throw new r("process_journal_capacity","Managed process receipt capacity is full; preserve uncertain jobs and reconcile their existing receipts before starting more work.")}mt(w);let S=Jo(tt(Wo(),"reason-j-"));try{return mt(S),{journalDirectory:w,scopeId:l,launchDirectory:S,socketPath:process.platform==="win32"?`\\\\.\\pipe\\reason-jobs-${Tn()}`:tt(S,"control.sock"),disposeSocket:()=>An(S,{recursive:!0,force:!0})}}catch(I){throw An(S,{recursive:!0,force:!0}),I}}var Bi=60000,ji=5000;function Wi(e){if(process.platform==="win32")return Fi(e);let l=Go("ps",["-o","lstart=","-p",String(e)],{encoding:"utf8",timeout:2000,env:{...process.env,LC_ALL:"C",LANG:"C"}}),f=l.status===0?/^\w{3} (\w{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/.exec(l.stdout.trim()):null,_=f?"JanFebMarAprMayJunJulAugSepOctNovDec".indexOf(f[1]):-1;if(!f||_<0||_%3!==0)return null;let w=new Date(Number(f[6]),_/3,Number(f[2]),Number(f[3]),Number(f[4]),Number(f[5])).getTime();return Number.isFinite(w)?w:null}function Fi(e){let l=Go(C("powershell"),["-NoProfile","-NonInteractive","-Command",`(Get-Process -Id ${e}).StartTime.ToUniversalTime().ToString('o')`],{encoding:"utf8",timeout:5000,windowsHide:!0,env:De()}),f=l.status===0?Date.parse(l.stdout.trim()):Number.NaN;return Number.isFinite(f)?f:null}function Yo(e,l={}){let f=tt(e.journalDirectory,"owner.lock"),_;try{_=zo(f,In.O_RDONLY|In.O_NOFOLLOW)}catch{return null}try{let w=Ei(_);if(!w.isFile()||w.nlink!==1||!A(w)||w.size>4096)return null;let S=null;try{S=JSON.parse(xi(_,"utf8"))}catch{}let I;if(S===null){if((l.now??Date.now)()-w.mtimeMs<Bi)return null;I={reason:"never_written",executorLaunchId:null}}else{let{version:M,scopeId:G,pid:F,createdAtMs:T,executorLaunchId:re}=S;if(M!==1||G!==e.scopeId||typeof re!=="string"||typeof F!=="number"||!Number.isSafeInteger(F)||F<1||F===process.pid||typeof T!=="number"||!Number.isSafeInteger(T))return null;if(!(l.exists??((z)=>{try{return process.kill(z,0),!0}catch(fe){return!(fe instanceof Error&&("code"in fe)&&fe.code==="ESRCH")}}))(F))I={reason:"owner_exited",executorLaunchId:re};else{let z=(l.startedAtMs??Wi)(F);if(z===null||z<=T+ji)return null;I={reason:"pid_reused",executorLaunchId:re}}}let W=Lt(f);if(W.dev!==w.dev||W.ino!==w.ino)return null;Pi(f);let x=zo(e.journalDirectory,In.O_RDONLY);try{Ri(x)}finally{Uo(x)}return I}catch{return null}finally{Uo(_)}}function Xo(e){let l={...e,workspace:e.workspace&&Object.freeze({...e.workspace}),previewAuthority:e.previewAuthority&&Object.freeze({...e.previewAuthority,owner:Object.freeze({...e.previewAuthority.owner}),deniedPorts:new Set(e.previewAuthority.deniedPorts)})},f=Ur(l.root,l.runId);if(Or.has(f)||l.operationId!==void 0&&Jr.has(l.operationId))throw new r("hands_jobs_busy","The Session already has a live Hands job supervisor.");let _={binding:l,key:f,terminals:new Map};if(l.previewAuthority&&l.environment)_.previews=Bo({authority:l.previewAuthority,runId:l.runId,expiresAtMs:l.expiresAtMs,executorLaunchId:l.executorLaunchId,environment:l.environment,isCurrent:()=>Or.get(_.key)===_,identity:()=>{try{return ht(l)}catch{return null}},inspect:(w,S)=>{if(Or.get(_.key)!==_)throw new r("preview_unavailable","The Hands supervisor is no longer current.");return Zo(l,{jobId:w,action:"inspect",input:{after:0}},S)}});if(Or.set(f,_),l.operationId!==void 0)Jr.set(l.operationId,_);return()=>{if(Or.get(_.key)===_)Or.delete(_.key);if(l.operationId!==void 0&&Jr.get(l.operationId)===_)Jr.delete(l.operationId);_.previews?.dispose();for(let w of _.terminals.values())w.abort()}}var Ui=5000,zi=20;async function Zi(e){let l=(w)=>{throw new r("hands_rebind_unavailable",w)};if(!N(e.operationId)||!N(e.runId)||!N(e.fenceId)||!U(e.targetGeneration))l("Reason sent an invalid Hands rebind.");let f=Jr.get(e.operationId);if(!f||f.binding.root!==e.root)return l("No live Hands supervisor owns this operation.");for(let w=Date.now()+Ui;;){if(e.signal?.aborted)l("The Hands rebind was cancelled.");if(Jr.get(e.operationId)!==f)l("The Hands supervisor is no longer current.");let S=null;try{S=ht(f.binding)}catch{}if(S&&S.generation===e.targetGeneration&&S.fenceId===e.fenceId)break;if(S&&S.generation>e.targetGeneration||Date.now()>=w)l("The executor did not adopt this take.");await new Promise((I)=>setTimeout(I,zi))}if(Jr.get(e.operationId)!==f||Or.get(f.key)!==f)l("The Hands supervisor is no longer current.");let _=Ur(e.root,e.runId);if(f.key===_)return;if(Or.has(_))l("The taking run already has a live Hands job supervisor.");Or.delete(f.key);for(let w of f.terminals.values())w.abort();f.key=_,Or.set(_,f)}function ot(e){let l="operationId"in e?Jr.get(e.operationId):Or.get(Ur(e.root,e.runId)),f=l&&l.binding.root===e.root?l.binding:void 0;if(!f?.environment||f.expiresAtMs<=Date.now())throw new r("environment_unavailable","No live Hands supervisor owns this environment.");return f.environment.install(e.payload)}async function Xi(e){let l=Or.get(Ur(e.root,e.runId));if(!l?.previews||!e.owner)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.open(e.payload,e.owner,e.signal)}async function Yi(e){let l=Or.get(Ur(e.root,e.runId));if(!l?.previews||!e.owner||e.signal.aborted)throw new r("preview_unavailable","No authenticated Hands supervisor owns this preview.");return l.previews.close(e.payload,e.owner)}async function Qi(e){let l=Ur(e.root,e.runId),f=Or.get(l),_=f?.binding,w=_?.runId,S=_?.previewAuthority,I=_?.environment,W=e.owner&&{...e.owner},x=e.authority&&{...e.authority},M=()=>{throw new r("pty_binding_unavailable","No current authenticated Hands scope owns this terminal.")};if(!f||!_||!S||!I||!W||!x||!_.workspace)return M();let G=Object.freeze({..._.workspace}),F=ht(_),T=I.current(),re=()=>{if(Or.get(l)!==f||W.organization_id!==S.owner.organization_id||W.user_id!==S.owner.user_id||W.device_id!==S.owner.device_id||e.deviceId!==S.owner.device_id||e.rootId!==S.rootId||O(e.workspace)!==O(G))M();let z=ht(_),fe=I.current();if(z.generation!==F.generation||z.fenceId!==F.fenceId||fe.run_id!==w||fe.device_id!==e.deviceId||fe.root_id!==e.rootId||fe.snapshot_id!==T.snapshot_id||fe.revision!==T.revision||fe.binding.target_generation!==F.generation||fe.binding.target_fence_id!==F.fenceId||x.device_id!==e.deviceId||x.binding!==fe.binding.kind||x.target_revision!==fe.binding.target_revision||x.root_grant_revision!==fe.binding.root_grant_revision||x.target_generation!==F.generation||x.target_fence_id!==F.fenceId)M()};if(re(),new URL(e.session.relayUrl).origin!==S.relayOrigin||f.terminals.has(e.session.jobId)||f.terminals.size>=4)return M();let J=new AbortController;f.terminals.set(e.session.jobId,J);try{return await Fo({session:{...e.session,leaseExpiresAtMs:Math.min(e.session.leaseExpiresAtMs,F.expiresAtMs,Date.parse(T.expires_at))},signal:AbortSignal.any([e.signal,J.signal]),emit:e.emit,binding:{assertCurrent:re,environment:{revision:T.revision,snapshotId:T.snapshot_id},scope:{runId:e.runId,deviceId:e.deviceId,rootId:e.rootId,workspace:G,binding:T.binding.kind,targetRevision:T.binding.target_revision,rootGrantRevision:T.binding.root_grant_revision,generation:F.generation,fenceId:F.fenceId,executorLaunchId:F.executorLaunchId},request:(z,fe)=>fr(F,Hr(JSON.stringify({...z,type:"job",version:2,generation:F.generation,id:Tn()})),fe)}})}finally{if(f.terminals.get(e.session.jobId)===J)f.terminals.delete(e.session.jobId)}}async function eo(e){if(ce(e.payload.jobId))throw new r("pty_binding_required","PTY jobs require the bound terminal capability.");let l=Or.get(Ur(e.root,e.runId))?.binding;if(!l||l.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","No live Hands supervisor owns this Session and root.");return Zo(l,e.payload,e.signal)}var $i=1e4,Ki=20,Gi=Se/2,Vi=Je/2,qi=(e)=>e.output.reduce((l,f)=>l+f.text.length,0);async function Zo(e,l,f){if(Object.keys(l).some((M)=>!["jobId","action","input","waitForExitMs"].includes(M)))throw new r("invalid_payload","Unexpected job control field.");let{waitForExitMs:_,...w}=l;if(_!==void 0&&(w.action!=="start"||typeof w.input!=="object"||w.input===null||!("script"in w.input)||typeof _!=="number"||!Number.isSafeInteger(_)||_<1||_>$i))throw new r("invalid_payload","Only a script start may wait for its job, within its bound.");let S=(M)=>{let G=ht(e);return fr(G,Hr(JSON.stringify({...M,type:"job",version:2,generation:G.generation,id:Tn()})),f)},I=await S(w);if(_===void 0)return I;let W=Date.now()+_,x=I;while(x.ok&&["starting","running"].includes(x.job.state)&&x.job.output.length<Gi&&qi(x.job)<Vi&&!f.aborted&&Date.now()<W){if(await new Promise((M)=>setTimeout(M,Math.min(Ki,W-Date.now()))),f.aborted)break;try{let M=await S({jobId:w.jobId,action:"inspect",input:{after:0}});if(!M.ok)break;x=M}catch{break}}return x}function ht(e){if(e.expiresAtMs<=Date.now())throw new r("hands_jobs_unavailable","Hands authority expired.");let l=e.readIdentity?e.readIdentity():e;if(!l||!U(l.generation)||!N(l.fenceId)||l.generation<e.generation||l.generation===e.generation&&l.fenceId!==e.fenceId)throw new r("hands_jobs_unavailable","The live Hands fencing identity could not be verified.");return e.generation=l.generation,e.fenceId=l.fenceId,{...e}}function fr(e,l,f){if(f.aborted)return Promise.reject(new r("cancelled","Job control was cancelled."));return new Promise((_,w)=>{let S=Ai(e.socketPath),I="",W=!1,x,M=(F,T)=>{if(W)return;if(W=!0,clearTimeout(x),f.removeEventListener("abort",G),S.destroy(),F)w(F);else _(T)},G=()=>M(new r("cancelled","Job control waiter cancelled; inspect before retrying mutations."));f.addEventListener("abort",G,{once:!0}),S.setEncoding("utf8"),x=setTimeout(()=>M(new r("hands_job_result_unknown","Job control timed out; inspect before retrying mutations.")),Math.min(1e4,Math.max(1,e.expiresAtMs-Date.now()))),S.on("error",()=>M(new r("hands_job_result_unknown","Hands job control connection failed."))),S.once("connect",()=>S.write(JSON.stringify({version:1,scopeId:e.scopeId,fenceId:e.fenceId,executorLaunchId:e.executorLaunchId,request:l})+`
-`)),S.on("data",(F)=>{if(I+=F,Buffer.byteLength(I)>Ze)M(new r("hands_job_result_unknown","Hands job result exceeded its bound."))}),S.once("end",()=>{if(Date.now()>=e.expiresAtMs){M(new r("hands_job_result_unknown","Hands authority expired before the result was acknowledged."));return}try{let F=zr(I.trim());if(F.id!==l.id||F.generation!==e.generation||F.ok&&F.job.jobId!==l.jobId)throw Error("identity");M(void 0,F)}catch{M(new r("hands_job_result_unknown","Hands job response identity or shape was invalid."))}}),S.once("close",()=>{if(!W)M(new r("hands_job_result_unknown","Hands job control closed before an acknowledged result."))})})}function Ko(e){let l=Nt(e.root),f=e.authority,_=Date.parse(e.leaseUntil),w=()=>{if(e.signal.throwIfAborted(),!Number.isFinite(_)||_<=Date.now())throw Error("local_device_gh_lease_expired")};if(w(),f.readOnly&&f.generation===null)return{root:l,readOnly:!0,signal:e.signal,deadlineMs:_,assertCurrent:w};let S=Ur(l,e.runId),I=Or.get(S),W=I?.binding;if(!W?.environment||!W.workspace||W.localGithubConfinement!==!0)throw Error("local_device_gh_confinement_unavailable");let x=W.environment.current(),M=()=>{w();let F=W.environment.current(),T=ht(W);if(Or.get(S)!==I||F.github_auth!=="local_gh"||F.run_id!==W.runId||f.runId!==e.runId||F.device_id!==f.deviceId||F.root_id!==f.rootId||String(F.binding.root_grant_revision)!==f.rootRevision||F.binding.target_generation!==f.generation||F.binding.target_fence_id!==f.fenceId||T.generation!==f.generation||T.fenceId!==f.fenceId||F.snapshot_id!==x.snapshot_id||F.revision!==x.revision)throw Error("local_device_gh_authority_changed")};M();let G=ie(l,W.workspace);return{root:G.boundary,signal:e.signal,deadlineMs:_,privateDirectory:Ti(W.environment.path),repoPath:G.path,readOnly:f.readOnly,forbiddenSecretValues:Object.values(x.variables),secretNames:(F)=>Object.entries(x.variables).filter(([,T])=>T.trim()===F.trim()).map(([T])=>`variable ${T}`),assertCurrent:M}}async function to(e,l){let f=Pe.parse(e.request),_=oe.parse(e.authority);if(_.contributorRefresh&&f.kind==="read"&&_.readOnly)return l(Ko(e));let w=Boolean(_.contributorRefresh);if(w&&(_.merge||f.kind!=="pr_mutation"||f.mutation.action!=="edit"||typeof f.mutation.body!=="string"||f.mutation.title!==void 0||f.mutation.base!==void 0||_.readOnly||_.runId!==e.runId||_.repoFullName!==f.repoFullName))throw Error("local_device_gh_contributor_refresh_authority_invalid");if(f.kind!=="pr_merge"&&!w){if(_.merge)throw Error("local_device_gh_merge_authority_invalid");return l(Ko(e))}if(!w&&(!_.merge||_.readOnly||_.runId!==e.runId||_.repoFullName!==f.repoFullName||_.merge.source==="agent"&&(_.generation===null||_.fenceId===null)))throw Error("local_device_gh_merge_authority_invalid");let S=Nt(e.root),I=Lt(S),W=Date.parse(e.leaseUntil);if(!Number.isFinite(W)||W<=Date.now())throw Error("local_device_gh_lease_expired");let x=Nt(Hi());if(x===S||x.startsWith(S+Ci))throw Error("local_device_gh_private_scope_unavailable");let M=Jo(tt(x,"reason-gh-merge-"));try{mt(M);let G=()=>{if(e.signal.throwIfAborted(),Date.now()>=W)throw Error("local_device_gh_lease_expired");let F=Lt(e.root);if(F.isSymbolicLink()||F.dev!==I.dev||F.ino!==I.ino||Nt(e.root)!==S)throw Error("local_device_gh_authority_changed");mt(M)};return G(),await l({root:S,readOnly:!1,privateDirectory:M,forbiddenSecretValues:[],signal:e.signal,deadlineMs:W,assertCurrent:G})}finally{An(M,{recursive:!0,force:!0})}}var rs=43200000;function gt(e){return Number.isSafeInteger(e)&&Math.abs(e)<=8640000000000000?e:null}function Qo(e){return e!==null&&typeof e==="object"&&!Array.isArray(e)}function es(e,l){return Object.keys(e).length===l.length&&l.every((f)=>Object.hasOwn(e,f))}function ro(e){if(!Qo(e)||!es(e,["version","outcome","clock_source","validation_now_ms","expiry_ms","remaining_ms","maximum_lifetime_ms","cli_artifact"])||e.version!==1||e.maximum_lifetime_ms!==43200000||typeof e.outcome!=="string"||!["accepted","parse","noncanonical","expired","over_cap"].includes(e.outcome)||typeof e.clock_source!=="string"||!["date_now","injected"].includes(e.clock_source))return null;for(let _ of["validation_now_ms","expiry_ms"]){let w=e[_];if(w!==null&&(typeof w!=="number"||gt(w)===null))return null}if(e.remaining_ms!==null&&(typeof e.remaining_ms!=="number"||!Number.isSafeInteger(e.remaining_ms)))return null;let l=typeof e.expiry_ms==="number"&&typeof e.validation_now_ms==="number"?e.expiry_ms-e.validation_now_ms:null;if(e.remaining_ms!==(l!==null&&Number.isSafeInteger(l)?l:null))return null;if(e.outcome==="parse"&&e.expiry_ms!==null)return null;if(e.outcome!=="parse"&&e.expiry_ms===null)return null;if(e.outcome==="expired"&&!(typeof l==="number"&&l<=0))return null;if(e.outcome==="over_cap"&&!(typeof l==="number"&&l>43200000))return null;if(e.outcome==="accepted"&&!(typeof l==="number"&&l>0&&l<=43200000))return null;let f=e.cli_artifact;if(!Qo(f)||!es(f,["kind","status","sha256","observed_at_ms"])||f.observed_at_ms!==null&&(typeof f.observed_at_ms!=="number"||gt(f.observed_at_ms)===null))return null;if(f.kind==="entrypoint_file"){if(f.status!=="observed"||typeof f.sha256!=="string"||!/^[a-f0-9]{64}$/.test(f.sha256)||f.observed_at_ms===null)return null}else if(f.kind!=="unavailable"||f.sha256!==null||typeof f.status!=="string"||!["unsupported_entrypoint","read_failed","file_changed","size_limit","time_limit"].includes(f.status))return null;return e}var Dn=c({kind:s(["workspace_source","mcp_control"]),target_revision:o().int().nonnegative(),root_grant_revision:o().int().positive()}),ts=new RegExp(at.tokenPattern),ea=c({token_url:Et().max(2048),request_token:t().min(1).max(8192).regex(ts),aws_credentials_url:Et().max(2048).nullable()});function ns(e,l){let f=(_,w)=>{try{let S=new URL(_);return S.origin===new URL(l).origin&&S.pathname===w&&!S.username&&!S.password&&!S.search&&!S.hash}catch{return!1}};if(!ts.test(e.request_token)||!f(e.token_url,at.tokenPath)||e.aws_credentials_url!==null&&!f(e.aws_credentials_url,at.awsPath))return null;return{REASON_OIDC_TOKEN_URL:e.token_url,REASON_OIDC_REQUEST_TOKEN:e.request_token,...e.aws_credentials_url!==null?{AWS_CONTAINER_CREDENTIALS_FULL_URI:e.aws_credentials_url,AWS_CONTAINER_AUTHORIZATION_TOKEN:e.request_token}:{}}}function os(e){return new TextEncoder().encode(e).byteLength}function ra(e){return os(JSON.stringify(e)+`
-`)}var mr=c({version:n(1),snapshot_id:k(),revision:o().int().positive(),run_id:t().min(1).max(160),device_id:k(),root_id:k(),binding:Dn.extend({target_generation:o().int().positive(),target_fence_id:k()}),expires_at:y.datetime({offset:!0}),variables:ee(t().max(128).regex(It),t().refine((e)=>!e.includes("\x00")&&os(e)<=V.valueBytes)).refine((e)=>Object.keys(e).length<=V.variables),github_auth:n("local_gh").optional(),git:c({base_url:Et().max(2048),token:t().min(1).max(4096).regex(/^[A-Za-z0-9._~-]+$/),expires_at:y.datetime({offset:!0})}).nullable(),cloud_access:ea.optional()}).refine((e)=>e.github_auth!=="local_gh"||e.git===null,"conflicting git authority").refine((e)=>ra(e)<=V.snapshotBytes,"snapshot too large");import{spawn as ta}from"child_process";import{basename as na,isAbsolute as Ou}from"path";var oa=0,ss=120000,is=15000,sa=65536;function Cn(e=process.execPath,l=process.argv[1]){let f=na(e),_=(f.startsWith("bun")||f.startsWith("node"))&&typeof l==="string"&&l.length>0;return{command:e,prefix:_?[l]:[]}}function no(e={}){let{command:l,prefix:f}=Cn(e.executablePath,e.sourceEntrypoint),_=e.spawnProcess??ta,w=e.now??Date.now,S=null,I=0,W=!1,x=(G)=>{try{G.kill("SIGKILL")}catch{}},M=()=>{if(W)return;if(S&&w()-I<ss-is)return;if(S){let F=S;S=null,x(F)}let G;try{G=_(l,[...f,"__device","__hands-worker","--handoff-fd",String(oa)],{cwd:"/",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin"},shell:!1,stdio:["pipe","ignore","pipe"]})}catch{return}S=G,I=w(),G.on("error",()=>{if(S===G)S=null}),G.once("exit",(F,T)=>{if(S!==G)return;S=null,e.log?.("hands.worker_prespawn_exited",{exit_code:F,exit_signal:T})}),e.log?.("hands.worker_prespawned",{pid:G.pid??null})};return{arm:M,take(G){let F=S;if(!F||W)return null;let T=G.args.at(-1),re=G.options.env,J=G.options.cwd,z=[...f,"__device","__hands-worker","--config"];if(G.command!==l||G.args.length!==z.length+1||z.some((Oe,$e)=>G.args[$e]!==Oe)||typeof T!=="string"||!re||typeof J!=="string"||G.options.shell||JSON.stringify(G.options.stdio)!==JSON.stringify(["ignore","ignore","pipe"]))return null;S=null;let fe=F.stdin,ve={configPath:T,cwd:J,env:Object.fromEntries(Object.entries(re).filter((Oe)=>typeof Oe[1]==="string"))},be=JSON.stringify(ve);if(F.exitCode!==null||F.signalCode!==null||!fe||fe.destroyed||w()-I>=ss-is||Buffer.byteLength(be,"utf8")>sa)return x(F),null;return fe.on("error",()=>{return}),fe.end(be),F.once("exit",()=>{M()}),e.log?.("hands.worker_prespawn_taken",{pid:F.pid??null}),F},adopt(G){G.once("exit",()=>{M()})},close(){if(W=!0,S)x(S);S=null}}}import{accessSync as ua,constants as fa,statSync as pa}from"fs";import{homedir as _a,tmpdir as ma,userInfo as ha}from"os";import{delimiter as ga,win32 as ba}from"path";var ia=new Set(["ALL_PROXY","BUN_BE_BUN","BUN_OPTIONS","CURL_CA_BUNDLE","GIT_SSL_CAINFO","GRPC_DEFAULT_SSL_ROOTS_FILE_PATH","HTTPS_PROXY","HTTP_PROXY","NO_PROXY","NODE_EXTRA_CA_CERTS","NODE_OPTIONS","NODE_TLS_REJECT_UNAUTHORIZED","REQUESTS_CA_BUNDLE","SSLKEYLOGFILE","SSL_CERT_DIR","SSL_CERT_FILE","all_proxy","http_proxy","https_proxy","no_proxy"]);var aa=["BUN_CONFIG_","BUN_INSPECT","DYLD_","NODE_DEBUG"],ca=new Set(["BUN_INSTALL"]);var da=/^--(?:max-old-space-size|max-semi-space-size|stack-size)=\d{1,9}$/;function la(e){return(e??"").split(/\s+/).filter(Boolean).every((l)=>da.test(l.replaceAll("_","-")))}function as(e){return Object.keys(e).filter((l)=>ia.has(l)&&!(l==="NODE_OPTIONS"&&la(e[l]))||aa.some((f)=>l.startsWith(f))||l.startsWith("BUN_")&&!ca.has(l)).sort()}var wa=new Set(["HOME","PATH","PWD","OLDPWD","SHLVL","_","TMPDIR","TMP","TEMP","SHELL","BASH_ENV","ENV","ZDOTDIR","PROMPT_COMMAND","IFS","CDPATH","GLOBIGNORE","SHELLOPTS","BASHOPTS","NODE_PATH"]),ya=/^(?:ARA_|REASON_|PI_|GIT_|GH_|GITHUB_|LD_|DYLD_|BUN_|BASH_FUNC_|SSH_)/,va=/TOKEN|SECRET|PASSW|PASSPHRASE|CREDENTIAL|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|AUTH/i,ka=/^[A-Za-z_][A-Za-z0-9_]*$/;function gr(e=process.env){let l=(w)=>{if(!(process.platform==="win32"?ba.isAbsolute(w):w.startsWith("/"))||/[\0\r\n]/.test(w)||w.length>32768)throw Error("invalid_host_execution_environment");return w};if(e.PATH!==void 0&&(/[\0\r\n]/.test(e.PATH)||e.PATH.length>32768))throw Error("invalid_host_execution_environment");let f=new Set(as(e)),_=Object.fromEntries(Object.entries(e).filter((w)=>{let[S,I]=w;return typeof I==="string"&&I.length<=32768&&!I.includes("\x00")&&S.length<=128&&ka.test(S)&&!f.has(S)&&!wa.has(S)&&!ya.test(S)&&!va.test(S)}).sort(([w],[S])=>w.localeCompare(S)).slice(0,512));return{home:l(e.HOME||(process.platform==="win32"?e.USERPROFILE:void 0)||_a()),path:((w)=>process.platform==="win32"?Sn(w):w)(xr(e.PATH??"").join(ga)||Er),temporaryDirectory:l(e.TMPDIR||e.TMP||e.TEMP||ma()),variables:_}}function _r(e=process.env,l=()=>ha().shell){if(process.platform==="win32")return se();let f=(w)=>{if(!w||!/^\/[A-Za-z0-9._/-]*\/(?:bash|zsh)$/.test(w))return!1;try{return ua(w,fa.X_OK),pa(w).isFile()}catch{return!1}};if(f(e.SHELL))return e.SHELL;let _;try{_=l()}catch{_=void 0}return f(_)?_:"/bin/zsh"}import{readdir as Sa}from"fs/promises";var Ea=15000;function gn(e){let l=e instanceof Error&&"code"in e?e.code:null;return l==="EPERM"||l==="EACCES"}function _n(e){return new r("folder_access_denied",`macOS blocked Reason from opening ${e}. Allow Reason in System Settings \u203A Privacy & Security \u203A Files and Folders `+"(or Full Disk Access), then try again.")}async function cs(e,{timeoutMs:l=Ea,open:f=(_)=>Sa(_)}={}){let _,w=new Promise((S)=>{_=setTimeout(()=>S("pending"),l)});try{if(await Promise.race([f(e).then(()=>"open"),w])==="pending")throw new r("folder_access_pending",`macOS is asking whether Reason may open ${e}. Answer the prompt on this Mac, then try again.`)}catch(S){if(gn(S))throw _n(e);if(S instanceof r)throw S}finally{clearTimeout(_)}}import{chmodSync as tc,closeSync as nc,constants as zn,fstatSync as oc,lstatSync as xs,openSync as sc,readSync as ic,realpathSync as $n,unlinkSync as ac}from"fs";import{lookup as cc}from"dns/promises";import{createRequire as dc}from"module";import{request as lc}from"http";import{request as uc}from"https";import it from"net";import{platform as Ds}from"os";import{basename as fc,extname as pc,isAbsolute as Ps,relative as Gn,resolve as yt,sep as Jn}from"path";var ds=String.raw`
-async (roots) => {
-  "use strict";
-  const version = 2;
-  if (globalThis.__araHandsRepl && globalThis.__araHandsRepl.version === version) return;
-  const hostCall = globalThis.__araHandsRpc;
-  if (typeof hostCall !== "function") throw new Error("Reason Hands browser bridge is not installed");
-  try { delete globalThis.__araHandsRpc; } catch (error) {
-    if (!(error instanceof TypeError)) throw error;
-  }
-
-  const handles = new WeakMap();
-  const bytes = new WeakMap();
-  const routes = new WeakMap();
-  const derived = new Set([
-    "browser", "context", "frame", "frameLocator", "getByAltText", "getByLabel",
-    "getByPlaceholder", "getByRole", "getByTestId", "getByText", "getByTitle",
-    "contentFrame", "locator", "nth", "mainFrame", "newContext", "newPage", "opener", "owner", "page", "parentFrame",
-  ]);
-  const locatorMethods = new Set([
-    "all", "allInnerTexts", "allTextContents", "and", "ariaSnapshot", "blur",
-    "boundingBox", "check", "clear", "click", "contentFrame", "count", "dblclick",
-    "dragTo", "evaluate", "evaluateAll", "fill", "filter", "focus", "getAttribute",
-    "hover", "innerHTML", "innerText", "inputValue", "isChecked", "isEditable",
-    "isEnabled", "isHidden", "isVisible", "or", "page", "press", "pressSequentially",
-    "screenshot", "scrollIntoViewIfNeeded", "selectOption", "setInputFiles", "tap",
-    "textContent", "type", "uncheck", "waitFor",
-  ]);
-  const pageMethods = new Set([
-    "addInitScript", "addScriptTag", "addStyleTag", "bringToFront", "close", "content",
-    "emulateMedia", "evaluate", "frameLocator", "frames", "goBack", "goForward", "goto",
-    "isClosed", "pdf", "reload", "route", "screenshot", "captureScreenshot", "selectOption", "setContent",
-    "setDefaultNavigationTimeout", "setDefaultTimeout", "setExtraHTTPHeaders", "setInputFiles",
-    "setViewportSize", "title", "unroute", "url", "viewportSize", "waitForFunction",
-    "waitForLoadState", "waitForNavigation", "waitForTimeout", "waitForURL",
-  ]);
-  const contextMethods = new Set([
-    "startRecording", "stopRecording",
-    "addCookies", "addInitScript", "clearCookies", "clearPermissions", "close", "cookies",
-    "grantPermissions", "pages", "route", "setDefaultNavigationTimeout", "setDefaultTimeout",
-    "setExtraHTTPHeaders", "setGeolocation", "setHTTPCredentials", "setOffline",
-    "setViewportSize", "storageState", "unroute", "viewportSize",
-  ]);
-  const browserMethods = new Set(["close", "contexts", "isConnected", "version"]);
-  const frameMethods = new Set([
-    "addScriptTag", "addStyleTag", "childFrames", "content", "evaluate", "frameLocator",
-    "goto", "isDetached", "name", "parentFrame", "setContent", "title", "url",
-    "waitForFunction", "waitForLoadState", "waitForNavigation", "waitForTimeout", "waitForURL",
-  ]);
-
-  function record(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-    const proto = Object.getPrototypeOf(value);
-    return proto === Object.prototype || proto === null;
-  }
-  function handle(value) {
-    return record(value) && value.$handsRepl === "handle"
-      && typeof value.id === "string" && typeof value.kind === "string";
-  }
-  function clone(value, stack) {
-    if (value === null || typeof value === "boolean" || typeof value === "string") return value;
-    if (typeof value === "number") {
-      if (!Number.isFinite(value)) throw new TypeError("Reason Hands bridge accepts only finite numbers");
-      return value;
-    }
-    if (!value || typeof value !== "object") throw new TypeError("Reason Hands bridge accepts only JSON data");
-    if (stack.has(value)) throw new TypeError("Reason Hands bridge does not accept cyclic data");
-    stack.add(value);
-    try {
-      if (Array.isArray(value)) return value.map((item) => clone(item, stack));
-      if (!record(value)) throw new TypeError("Reason Hands bridge accepts only plain objects");
-      const output = Object.create(null);
-      for (const key of Object.keys(value)) {
-        if (key === "__proto__" || key === "constructor" || key === "prototype") {
-          throw new TypeError("Reason Hands bridge rejects unsafe object keys");
-        }
-        output[key] = clone(value[key], stack);
-      }
-      return output;
-    } finally { stack.delete(value); }
-  }
-  function data(value) { return clone(value, new WeakSet()); }
-  function refOf(value) {
-    const ref = value && typeof value === "object" ? handles.get(value) : undefined;
-    if (!ref) throw new TypeError("Reason Hands operation needs a browser target");
-    return ref;
-  }
-  async function wire(value) {
-    const target = value && typeof value === "object" ? handles.get(value) : undefined;
-    if (target) return (await target).handle;
-    const binary = value && typeof value === "object" ? bytes.get(value) : undefined;
-    if (binary) return binary;
-    const route = value && typeof value === "object" ? routes.get(value) : undefined;
-    if (route) return route;
-    if (value === null || typeof value === "boolean" || typeof value === "string") return value;
-    if (typeof value === "number") {
-      if (!Number.isFinite(value)) throw new TypeError("Reason Hands bridge accepts only finite numbers");
-      return value;
-    }
-    if (Array.isArray(value)) return await Promise.all(value.map(wire));
-    if (!record(value)) throw new TypeError("Reason Hands bridge accepts only JSON data");
-    const output = Object.create(null);
-    for (const key of Object.keys(value)) output[key] = await wire(value[key]);
-    return output;
-  }
-  function decode(value) {
-    if (handle(value)) return makeTarget(value);
-    if (record(value) && value.$handsRepl === "bytes" && typeof value.base64 === "string") {
-      const output = Object.freeze({ $handsRepl: "bytes", base64: value.base64 });
-      bytes.set(output, output);
-      return output;
-    }
-    if (record(value) && value.$handsRepl === "undefined") return undefined;
-    if (Array.isArray(value)) return value.map(decode);
-    if (!record(value)) return value;
-    const output = Object.create(null);
-    for (const key of Object.keys(value)) output[key] = decode(value[key]);
-    return output;
-  }
-  async function rpc(request) { return decode(await hostCall(request)); }
-  async function invoke(ref, method, args) {
-    return await rpc({ type: "call", target: ref.handle, method, args: await Promise.all(args.map(wire)) });
-  }
-  function targetFrom(value) {
-    const ref = value && typeof value === "object" ? handles.get(value) : undefined;
-    if (!ref) throw new Error("Reason Hands bridge received an invalid target");
-    return ref;
-  }
-  function lazy(refPromise) {
-    const object = Object.create(null);
-    const ready = Promise.resolve(refPromise);
-    const proxy = new Proxy(object, {
-      get(_object, key) {
-        if (key === "then") return (resolve, reject) => {
-          // Derived targets carry the bridge's internal { handle, kind } ref,
-          // not the wire handle accepted by makeTarget. Passing the wrapper
-          // used to throw inside this detached fulfillment callback; because
-          // that rejection was not forwarded to the thenable consumer, every
-          // await context.newPage() / await page.context() hung until an
-          // outer tool deadline destroyed the evaluator execution context.
-          ready.then((ref) => {
-            try { resolve(makeTarget(ref.handle)); } catch (error) { reject(error); }
-          }, reject);
-        };
-        if (typeof key !== "string") return undefined;
-        if (key === "first" || key === "last") return lazy(ready.then(async (ref) => targetFrom(await invoke(ref, key, []))));
-        if (derived.has(key)) return (...args) => lazy(ready.then(async (ref) => targetFrom(await invoke(ref, key, args))));
-        if (key === "evaluate" || key === "evaluateAll") return (source, argument) => ready.then((ref) => evaluateInTarget(ref, source, argument));
-        return (...args) => ready.then((ref) => invoke(ref, key, args));
-      },
-    });
-    handles.set(proxy, ready);
-    return proxy;
-  }
-  function makeTarget(handleValue) {
-    if (!handle(handleValue)) throw new Error("Reason Hands bridge received an invalid handle");
-    const ref = { handle: Object.freeze({ $handsRepl: "handle", id: handleValue.id, kind: handleValue.kind }), kind: handleValue.kind };
-    const object = Object.create(null);
-    // Preserve the existing synchronous viewport facade. URL reads use the
-    // dispatcher: a human can navigate the real page without an agent goto,
-    // and a new evaluator must not invent about:blank for that live page.
-    const meta = {
-      viewport: ref.kind === "page" && ref.handle.id === roots.page.id
-        ? { width: 1440, height: 900 }
-        : undefined,
-    };
-    const invokeDerived = (method, args) => lazy(Promise.resolve(invoke(ref, method, args)).then(targetFrom));
-    const get = (_object, key) => {
-      if (key === "first" || key === "last") return invokeDerived(key, []);
-      if (typeof key !== "string") return undefined;
-      if (key === "evaluate" || key === "evaluateAll") return (source, argument) => evaluateInTarget(ref, source, argument);
-      if (ref.kind === "page" && key === "viewportSize" && meta.viewport) {
-        return () => ({ ...meta.viewport });
-      }
-      if (ref.kind === "page" && key === "setViewportSize") {
-        return (next) => invoke(ref, key, [next]).then((value) => {
-          if (record(next) && typeof next.width === "number" && typeof next.height === "number") {
-            meta.viewport = { width: next.width, height: next.height };
-          }
-          return value;
-        });
-      }
-      if ((ref.kind === "page" || ref.kind === "context") && key === "route") {
-        return async (url, handler) => {
-          if (typeof handler !== "function") return await invoke(ref, key, [url, handler]);
-          let fulfillment;
-          const route = Object.freeze({
-            fulfill: async (options) => {
-              if (fulfillment) throw new TypeError("route() can register one fulfillment action");
-              fulfillment = routeFulfill(options);
-            },
-          });
-          await handler(route);
-          if (!fulfillment) {
-            throw new TypeError("route() supports a data-only route.fulfill({ ... }) callback");
-          }
-          return await invoke(ref, key, [url, fulfillment]);
-        };
-      }
-      if (derived.has(key)) return (...args) => invokeDerived(key, args);
-      const methods = ref.kind === "browser" ? browserMethods
-        : ref.kind === "context" ? contextMethods
-          : ref.kind === "page" ? pageMethods
-            : ref.kind === "frame" ? frameMethods
-              : locatorMethods;
-      if (!methods.has(key)) return undefined;
-      return (...args) => invoke(ref, key, args);
-    };
-    const proxy = new Proxy(object, { get });
-    handles.set(proxy, Promise.resolve(ref));
-    return proxy;
-  }
-  async function evaluateInTarget(ref, source, argument) {
-    const text = typeof source === "function" ? Function.prototype.toString.call(source) : source;
-    if (typeof text !== "string" || !text.trim()) throw new TypeError("evaluate() needs a function or expression string");
-    const value = argument === undefined ? undefined : JSON.stringify(await wire(argument));
-    let renderer;
-    if (ref.kind === "locator") {
-      renderer = typeof source === "function"
-        ? "(element) => (" + text + ")(element" + (value === undefined ? "" : ", " + value) + ")"
-        : text;
-    } else {
-      renderer = typeof source === "function"
-        ? "(" + text + ")(" + (value === undefined ? "" : value) + ")"
-        : value === undefined ? text : "(" + text + ")(" + value + ")";
-    }
-    return await invoke(ref, "evaluate", [renderer]);
-  }
-  function routeFulfill(options) {
-    const token = Object.freeze(Object.create(null));
-    routes.set(token, { $handsRepl: "routeFulfill", options: data(options) });
-    return token;
-  }
-  const replConsole = Object.freeze({
-    log: (...values) => { logs.push(values.map(render).join(" ")); },
-    info: (...values) => { logs.push(values.map(render).join(" ")); },
-    warn: (...values) => { logs.push("[warn] " + values.map(render).join(" ")); },
-    error: (...values) => { logs.push("[error] " + values.map(render).join(" ")); },
-  });
-  function render(value) {
-    if (value === undefined) return "undefined";
-    if (typeof value === "string") return value;
-    try { const text = JSON.stringify(value); return text === undefined ? String(value) : text; } catch { return "[unrenderable]"; }
-  }
-  const logs = [];
-  const browser = makeTarget(roots && roots.browser);
-  const context = makeTarget(roots && roots.context);
-  const page = makeTarget(roots && roots.page);
-  const state = Object.create(null);
-  async function a11y(target) {
-    const ref = target === undefined ? await refOf(page) : await refOf(target);
-    return await rpc({ type: "a11y", target: ref.handle });
-  }
-  async function view(source, options) {
-    return await rpc({ type: "view", source: await wire(source), options: options === undefined ? Object.create(null) : await wire(options) });
-  }
-  async function evaluate(code) {
-    if (typeof code !== "string") throw new TypeError("Reason Hands REPL code must be a string");
-    logs.length = 0;
-    let program;
-    let statementList = false;
-    try { program = new Function('"use strict"; return (async () => await (' + code + "\n))();"); }
-    catch {
-      statementList = true;
-      const strictCode = '"use strict";\n' + code;
-      program = new Function(
-        '"use strict"; return (async () => (0, eval)(' + JSON.stringify(strictCode) + '))();',
-      );
-    }
-    let value;
-    try {
-      value = await program();
-    } catch (error) {
-      // Indirect eval preserves a statement-list completion value but cannot
-      // parse top-level await or return. Those programs retain the prior async
-      // block behavior; a syntax failure occurs before any user code executes.
-      if (!statementList || !(error instanceof SyntaxError)) throw error;
-      program = new Function('"use strict"; return (async () => {' + code + "\n})();");
-      value = await program();
-    }
-    const output = render(value);
-    return logs.length === 0 ? output : value === undefined ? logs.join("\n") : logs.join("\n") + "\n" + output;
-  }
-  function install(name, value) { Object.defineProperty(globalThis, name, { value, configurable: false, enumerable: false, writable: false }); }
-  install("browser", browser); install("context", context); install("page", page);
-  install("state", state); install("browserState", state);
-  install("a11y", a11y); install("view", view); install("routeFulfill", routeFulfill); install("console", replConsole);
-  install("__araHandsRepl", Object.freeze({ version, evaluate }));
-}
-`.trim(),ls=String.raw`
-async (input) => {
-  const bridge = globalThis.__araHandsRepl;
-  if (!bridge || typeof bridge.evaluate !== "function") throw new Error("Reason Hands browser bridge is not installed");
-  return await bridge.evaluate(typeof input === "string" ? input : input && input.code);
-}
-`.trim();import{Buffer as bt}from"buffer";import{randomUUID as Ra}from"crypto";class _s extends Error{code;constructor(e){super(e==="hands_repl_private_profile_attribute_denied"?"Private browser attribute read denied.":e);this.code=e;this.name="HandsReplBrowserDispatcherError"}}var ms=new Set(["__defineGetter__","__defineSetter__","__lookupGetter__","__lookupSetter__","__proto__","constructor","prototype"]),us=/^hands_[A-Za-z0-9_-]{8,128}$/,Oa=2048,hs=32,gs=1e4,xa=new Set(["href","src","alt","title","role","aria-label","aria-expanded","aria-checked","aria-selected","aria-disabled","placeholder","type","name","data-testid"]);function Pa(e){let l=e.split("+"),f=(l.pop()??"").replace(/^Key/,"").toLowerCase();if(f==="f12")return!0;if(l.some((_)=>["Control","ControlOrMeta","Meta"].includes(_))&&["l","n","t","j","i","p","s","w","u","o","r","tab","pageup","pagedown"].includes(f))return!0;if(l.some((_)=>["Control","ControlOrMeta","Meta"].includes(_))&&l.includes("Shift")&&f==="c")return!0;return l.includes("Alt")&&["d","arrowleft","arrowright","home"].includes(f)}var Ia=(e)=>{let l=e.closest("a[href],area[href]");return{password:e.tagName==="INPUT"&&e.type==="password",executableLink:Boolean(l&&!/^(https?:|about:blank)/i.test(l.href))}},bs={browser:{close:{returns:"void"},contexts:{returns:"context[]"},isConnected:{returns:"json"},version:{returns:"json"}},context:{addCookies:{returns:"void"},addInitScript:{returns:"void"},browser:{returns:"browser"},clearCookies:{returns:"void"},clearPermissions:{returns:"void"},close:{returns:"void"},cookies:{returns:"json"},grantPermissions:{returns:"void"},newPage:{returns:"page"},pages:{returns:"page[]"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setGeolocation:{returns:"void"},setHTTPCredentials:{returns:"void"},setOffline:{returns:"void"},setViewportSize:{returns:"void"},storageState:{returns:"json"},viewportSize:{returns:"json",special:"contextViewportSize"}},page:{addInitScript:{returns:"void"},addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},bringToFront:{returns:"void"},close:{returns:"void"},content:{returns:"json"},context:{returns:"context"},emulateMedia:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},frame:{returns:"frame"},frameLocator:{returns:"frameLocator"},frames:{returns:"frame[]"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goBack:{returns:"void"},goForward:{returns:"void"},goto:{returns:"void"},isClosed:{returns:"json"},locator:{returns:"locator"},mainFrame:{returns:"frame"},opener:{returns:"page"},pdf:{returns:"bytes"},reload:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setContent:{returns:"void"},setDefaultNavigationTimeout:{returns:"void"},setDefaultTimeout:{returns:"void"},setExtraHTTPHeaders:{returns:"void"},setInputFiles:{returns:"void"},setViewportSize:{returns:"void"},title:{returns:"json"},url:{returns:"json"},viewportSize:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},locator:{all:{returns:"locator[]"},allInnerTexts:{returns:"json"},allTextContents:{returns:"json"},and:{returns:"locator"},ariaSnapshot:{returns:"json"},blur:{returns:"void"},boundingBox:{returns:"json"},check:{returns:"void"},clear:{returns:"void"},click:{returns:"void"},contentFrame:{returns:"frameLocator"},count:{returns:"json"},dblclick:{returns:"void"},dragTo:{returns:"void"},evaluate:{returns:"json",requiresStringSource:!0},evaluateAll:{returns:"json",requiresStringSource:!0},fill:{returns:"void"},filter:{returns:"locator"},first:{returns:"locator",special:"property"},focus:{returns:"void"},getAttribute:{returns:"json"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},hover:{returns:"void"},innerHTML:{returns:"json"},innerText:{returns:"json"},inputValue:{returns:"json"},isChecked:{returns:"json"},isEditable:{returns:"json"},isEnabled:{returns:"json"},isHidden:{returns:"json"},isVisible:{returns:"json"},last:{returns:"locator",special:"property"},locator:{returns:"locator"},nth:{returns:"locator"},or:{returns:"locator"},page:{returns:"page"},press:{returns:"void"},pressSequentially:{returns:"void"},scrollIntoViewIfNeeded:{returns:"void"},screenshot:{returns:"bytes"},selectOption:{returns:"json"},setInputFiles:{returns:"void"},tap:{returns:"void"},textContent:{returns:"json"},type:{returns:"void"},uncheck:{returns:"void"},waitFor:{returns:"void"}},frame:{addScriptTag:{returns:"void"},addStyleTag:{returns:"void"},childFrames:{returns:"frame[]"},content:{returns:"json"},evaluate:{returns:"json",requiresStringSource:!0},frameLocator:{returns:"frameLocator"},getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},goto:{returns:"void"},isDetached:{returns:"json"},locator:{returns:"locator"},name:{returns:"json"},page:{returns:"page"},parentFrame:{returns:"frame"},setContent:{returns:"void"},title:{returns:"json"},url:{returns:"json"},waitForFunction:{returns:"void",requiresStringSource:!0},waitForLoadState:{returns:"void"},waitForNavigation:{returns:"void"},waitForTimeout:{returns:"void"},waitForURL:{returns:"void"}},frameLocator:{getByAltText:{returns:"locator"},getByLabel:{returns:"locator"},getByPlaceholder:{returns:"locator"},getByRole:{returns:"locator"},getByTestId:{returns:"locator"},getByText:{returns:"locator"},getByTitle:{returns:"locator"},locator:{returns:"locator"},owner:{returns:"locator"}}};function Ie(e){throw new _s(e)}function Dr(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let l=Object.getPrototypeOf(e);return l===Object.prototype||l===null}function wt(e,l=0,f={nodes:0}){if(l>hs||++f.nodes>gs)Ie("hands_repl_json_too_complex");if(e===null||typeof e==="boolean"||typeof e==="string")return;if(typeof e==="number"){if(!Number.isFinite(e))Ie("hands_repl_invalid_json");return}if(Array.isArray(e)){for(let _ of e)wt(_,l+1,f);return}if(!Dr(e))Ie("hands_repl_invalid_json");for(let[_,w]of Object.entries(e)){if(ms.has(_))Ie("hands_repl_invalid_json");wt(w,l+1,f)}}function Hn(e){return typeof e==="string"&&Object.hasOwn(bs,e)}function Aa(e){if(!e.endsWith("[]"))return null;let l=e.slice(0,-2);return Hn(l)?l:null}function fs(e){return Dr(e)&&Object.keys(e).length===2&&e.$handsRepl==="bytes"&&typeof e.base64==="string"}function Ta(e){return Dr(e)&&Object.keys(e).length===1&&e.$handsRepl==="undefined"}function ps(e){return Dr(e)&&Object.keys(e).length===2&&e.$handsRepl==="routeFulfill"&&"options"in e}function Vr(e){return!!e&&typeof e==="object"}function qt(){return Object.freeze({$handsRepl:"undefined"})}function Da(e){if(!bt.isBuffer(e)&&!(e instanceof Uint8Array))Ie("hands_repl_expected_bytes");return Object.freeze({$handsRepl:"bytes",base64:bt.from(e).toString("base64")})}function ws(e){if(!Vr(e.browser)||!Vr(e.context)||!Vr(e.page))Ie("hands_repl_invalid_roots");if(typeof e.a11y!=="function"||typeof e.view!=="function")Ie("hands_repl_invalid_callbacks");let l=e.maxHandles??Oa;if(!Number.isInteger(l)||l<3||l>1e5)Ie("hands_repl_invalid_handle_limit");let f=new Map,_=new WeakMap,w=e.createOpaqueId??Ra,S=(T,re)=>{if(!Vr(re))Ie("hands_repl_expected_target");let J=_.get(re)?.get(T);if(J)return J;if(f.size>=l)Ie("hands_repl_handle_limit");let z="";for(let be=0;be<16;be+=1){let Oe=`hands_${w()}`;if(us.test(Oe)&&!f.has(Oe)){z=Oe;break}}if(!z)Ie("hands_repl_invalid_opaque_id");let fe=Object.freeze({$handsRepl:"handle",id:z,kind:T});f.set(z,{kind:T,target:re});let ve=_.get(re);if(!ve)ve=new Map,_.set(re,ve);return ve.set(T,fe),fe},I=Object.freeze({browser:S("browser",e.browser),context:S("context",e.context),page:S("page",e.page)}),W=(T)=>{if(!Dr(T)||Object.keys(T).length!==3||T.$handsRepl!=="handle"||typeof T.id!=="string"||!us.test(T.id)||!Hn(T.kind))Ie("hands_repl_invalid_handle");let re=f.get(T.id);if(!re||re.kind!==T.kind)Ie("hands_repl_unknown_handle");return re},x=(T,re=0,J=new Set)=>{if(re>hs)Ie("hands_repl_json_too_complex");if(T===void 0)return qt();if(T===null||typeof T==="boolean"||typeof T==="string")return T;if(typeof T==="number"){if(!Number.isFinite(T))Ie("hands_repl_non_json_result");return T}if(Array.isArray(T)){if(J.has(T))Ie("hands_repl_cyclic_result");J.add(T);try{return T.map((z)=>x(z,re+1,J))}finally{J.delete(T)}}if(!Dr(T))Ie("hands_repl_non_json_result");if(J.has(T))Ie("hands_repl_cyclic_result");J.add(T);try{let z=Object.create(null);for(let fe of Object.keys(T)){let ve=Object.getOwnPropertyDescriptor(T,fe);if(!ve||!("value"in ve))continue;z[fe]=x(ve.value,re+1,J)}return z}finally{J.delete(T)}},M=(T,re)=>{if(re==="void")return qt();if(re==="json")return x(T);if(re==="bytes")return Da(T);let J=Aa(re);if(J){if(!Array.isArray(T))Ie("hands_repl_expected_target_list");if(J==="context"&&T.some((z)=>z!==e.context))Ie("hands_repl_foreign_context");return T.map((z)=>S(J,z))}if(T===null||T===void 0)return qt();if(!Hn(re))Ie("hands_repl_invalid_return_kind");if(re==="context"&&T!==e.context)Ie("hands_repl_foreign_context");return S(re,T)},G=(T)=>{if(Dr(T)&&T.$handsRepl==="handle")return W(T).target;if(fs(T))return bt.from(T.base64,"base64");if(Ta(T))return;if(ps(T))Ie("hands_repl_route_fulfill_only");if(Array.isArray(T))return T.map(G);if(!Dr(T))return T;let re=Object.create(null);for(let[J,z]of Object.entries(T))re[J]=G(z);return re};return Object.freeze({roots:I,dispatch:async(T)=>{if(!Dr(T)||typeof T.type!=="string")Ie("hands_repl_invalid_request");if(T.type==="a11y"){let ye=T.target===void 0?f.get(I.page.id):W(T.target);if(!ye||ye.kind!=="page"&&ye.kind!=="locator")Ie("hands_repl_invalid_a11y_target");return x(await e.a11y(ye.target))}if(T.type==="view"){if(wt(T.source),T.options!==void 0)wt(T.options);let ye=fs(T.source)?bt.from(T.source.base64,"base64"):T.source;if(e.privateProfile&&!bt.isBuffer(ye))Ie("hands_repl_profile_requires_image_bytes");return x(await e.view(ye,T.options))}if(T.type!=="call")Ie("hands_repl_invalid_request");if(typeof T.method!=="string"||T.method.length===0||T.method.length>128)Ie("hands_repl_invalid_method");if(ms.has(T.method))Ie("hands_repl_forbidden_method");let re=W(T.target),J=T.args??[];if(!Array.isArray(J))Ie("hands_repl_invalid_arguments");if(wt(J),re.kind==="page"&&T.method==="captureScreenshot"){if(J.length!==0)Ie("hands_repl_invalid_arguments");if(!e.screenshotExport)Ie("hands_repl_screenshot_export_unavailable");return x(await e.screenshotExport(re.target))}if(re.kind==="context"&&["startRecording","stopRecording"].includes(T.method)){if(!e.recording||re.target!==e.context)Ie("hands_repl_recording_unavailable");if(J.length>(T.method==="startRecording"?1:0))Ie("hands_repl_invalid_arguments");return x(T.method==="startRecording"?await e.recording.start(J[0]):await e.recording.stop())}if(e.privateProfile){let ye=T.method;if(["evaluate","evaluateAll","waitForFunction","addInitScript","addScriptTag","addStyleTag","setContent","setInputFiles","route","content","cookies","storageState","addCookies","clearCookies","setExtraHTTPHeaders","setHTTPCredentials","grantPermissions","clearPermissions","innerHTML","textContent","allTextContents"].includes(ye)||re.kind==="browser"&&ye==="close"||re.kind==="context"&&ye==="close")Ie("hands_repl_private_profile_method_denied");if(re.kind==="browser"&&ye==="contexts")return M([e.context],"context[]");if((ye==="screenshot"||ye==="pdf")&&Dr(J[0])&&(("path"in J[0])||("style"in J[0])))Ie("hands_repl_private_profile_path_denied");if(ye==="goto"){if(typeof J[0]!=="string")Ie("hands_repl_private_profile_url_denied");try{let Fe=new URL(J[0]);if(!["http:","https:"].includes(Fe.protocol)&&J[0]!=="about:blank")Ie("hands_repl_private_profile_url_denied")}catch{Ie("hands_repl_private_profile_url_denied")}}if(ye==="getAttribute"&&(typeof J[0]!=="string"||!xa.has(J[0].toLowerCase())))Ie("hands_repl_private_profile_attribute_denied");if(re.kind==="locator"&&["innerText","allInnerTexts","getAttribute"].includes(ye)){let Fe=[re.target];if(ye==="allInnerTexts"){let Ve=Reflect.get(re.target,"all");if(typeof Ve!=="function")Ie("hands_repl_private_profile_probe_unavailable");let Te=await Reflect.apply(Ve,re.target,[]);if(!Array.isArray(Te)||Te.length>gs||!Te.every(Vr))Ie("hands_repl_private_profile_probe_unavailable");Fe=Te}for(let Ve of Fe){let Te=Reflect.get(Ve,"isVisible");if(typeof Te!=="function"||!await Reflect.apply(Te,Ve,[]))Ie("hands_repl_private_profile_hidden_value_denied")}}if(ye==="press"&&typeof J[0]==="string"&&Pa(J[0]))Ie("hands_repl_private_profile_browser_shortcut_denied");if(re.kind==="locator"&&["inputValue","click","dblclick","tap","press"].includes(ye)){let Fe=Reflect.get(re.target,"evaluate");if(typeof Fe!=="function")Ie("hands_repl_private_profile_probe_unavailable");let Ve=await Reflect.apply(Fe,re.target,[Ia]);if(!Dr(Ve)||typeof Ve.password!=="boolean"||typeof Ve.executableLink!=="boolean")Ie("hands_repl_private_profile_probe_unavailable");if(ye==="inputValue"&&Ve.password)Ie("hands_repl_private_profile_password_denied");if(ye!=="inputValue"&&Ve.executableLink)Ie("hands_repl_private_profile_url_denied");if(ye==="inputValue"){let Te=Reflect.get(re.target,"isVisible");if(typeof Te!=="function"||!await Reflect.apply(Te,re.target,[]))Ie("hands_repl_private_profile_hidden_value_denied")}}}let z=bs[re.kind][T.method];if(!z)Ie("hands_repl_method_not_allowed");if(z.requiresStringSource&&typeof J[0]!=="string")Ie("hands_repl_string_source_required");if(re.kind==="browser"&&T.method==="contexts")return[I.context];if(["addInitScript","addScriptTag","addStyleTag","screenshot","pdf","storageState"].includes(T.method)&&J.some((ye)=>Dr(ye)&&("path"in ye)))Ie("hands_repl_file_path_not_allowed");if(T.method==="goto"&&typeof J[0]==="string"){let ye;try{ye=new URL(J[0]).protocol}catch{Ie("hands_repl_invalid_url")}if(!["http:","https:","data:","about:","blob:"].includes(ye))Ie("hands_repl_file_path_not_allowed")}if(z.special==="contextViewportSize"){let ye=Reflect.get(re.target,"pages");if(typeof ye!=="function")Ie("hands_repl_method_unavailable");let Fe=await Reflect.apply(ye,re.target,[]),Ve=Array.isArray(Fe)?Fe[0]:void 0,Te=Vr(Ve)?Reflect.get(Ve,"viewportSize"):void 0;if(typeof Te!=="function")return qt();return M(await Reflect.apply(Te,Ve,[]),z.returns)}if(z.special==="property"){let ye=Reflect.get(re.target,T.method);return M(typeof ye==="function"?Reflect.apply(ye,re.target,[]):ye,z.returns)}let fe=Reflect.get(re.target,T.method);if(typeof fe!=="function")Ie("hands_repl_method_unavailable");if(z.special==="route"){let ye=J[1];if(!ps(ye))Ie("hands_repl_invalid_route_handler");wt(ye.options);let Fe=G(ye.options),Ve=async(he)=>{if(!Vr(he))Ie("hands_repl_invalid_route");let xe=Reflect.get(he,"fulfill");if(typeof xe!=="function")Ie("hands_repl_invalid_route");await Reflect.apply(xe,he,[Fe])},Te=[G(J[0]??null),Ve],le=await Reflect.apply(fe,re.target,Te);return M(le,z.returns)}let ve=J.map(G);if(T.method==="setInputFiles"){let ye=re.kind==="locator"?0:1,Fe=async(Te)=>{if(typeof Te!=="string"){if(!Dr(Te)||typeof Te.name!=="string"||typeof Te.mimeType!=="string"||!bt.isBuffer(Te.buffer))Ie("hands_repl_invalid_file_input");return Te}if(!e.readWorkspaceFile)Ie("hands_repl_workspace_required");return e.readWorkspaceFile(Te)},Ve=ve[ye];ve[ye]=Array.isArray(Ve)?await Promise.all(Ve.map(Fe)):await Fe(Ve)}if(T.method==="goto")await e.beforeNavigation?.();let be=e.actionRecorder?.(),Oe=await Reflect.apply(fe,re.target,ve),qe={click:"Click browser element",tap:"Click browser element",dblclick:"Double click browser element",fill:"Type text",type:"Type text",pressSequentially:"Type text",clear:"Clear browser field",press:"Press key",scrollIntoViewIfNeeded:"Scroll browser element into view",dragTo:"Drag on computer",selectOption:"Select browser option",check:"Check browser control",uncheck:"Uncheck browser control",hover:"Hover browser element",focus:"Focus browser element",goto:"Open browser page",reload:"Reload browser page",goBack:"Go back in browser",goForward:"Go forward in browser",screenshot:"Take browser screenshot"}[T.method];if(qe){let ye=Reflect.get(re.target,"page"),Fe=re.kind==="page"?re.target:typeof ye==="function"?Reflect.apply(ye,re.target,[]):void 0;be?.(qe,Vr(Fe)?Fe:void 0)}return M(Oe,z.returns)}})}import{isIP as Ss}from"net";import{Resolver as Ca}from"dns/promises";import{isIP as Zt}from"net";var Ha=[["0.0.0.0",8],["10.0.0.0",8],["100.64.0.0",10],["127.0.0.0",8],["169.254.0.0",16],["172.16.0.0",12],["192.0.0.0",24],["192.0.2.0",24],["192.168.0.0",16],["198.18.0.0",15],["198.51.100.0",24],["203.0.113.0",24],["224.0.0.0",4],["240.0.0.0",4]];function Nn(e){if(Zt(e)!==4)return null;let l=e.split(".");if(l.length!==4)return null;let f=0;for(let _ of l){let w=Number(_);if(!Number.isInteger(w)||w<0||w>255)return null;f=f*256+w}return f>>>0}function Na(e,l,f){let _=Nn(l);if(_===null)return!1;let w=f===0?0:4294967295<<32-f>>>0;return(e&w)>>>0===(_&w)>>>0}function ys(e){let l=Nn(e);if(l===null)return!0;return Ha.some(([f,_])=>Na(l,f,_))}function La(e){if(Zt(e)!==6)return null;let l=e.toLowerCase(),f=l.indexOf("%");if(f>=0)l=l.slice(0,f);let _=[],w=l.lastIndexOf(":"),S=w>=0?l.slice(w+1):"";if(S.includes(".")){let T=Nn(S);if(T===null)return null;_=[T>>>16&65535,T&65535],l=l.slice(0,w+1)+"0:0"}let I=l.split("::");if(I.length>2)return null;let W=(T)=>{if(T==="")return[];let re=[];for(let J of T.split(":")){if(J===""||J.length>4||!/^[0-9a-f]+$/.test(J))return null;re.push(Number.parseInt(J,16))}return re},x=W(I[0]??"");if(x===null)return null;if(I.length===1){let T=x;if(T.length!==8)return null;return _.length>0?T.slice(0,6).concat(_):T}let M=W(I[1]??"");if(M===null)return null;let G=8-x.length-M.length;if(G<0)return null;let F=x.concat(Array(G).fill(0),M);if(F.length!==8)return null;return _.length>0?F.slice(0,6).concat(_):F}function Ba(e,l){return`${e>>8&255}.${e&255}.${l>>8&255}.${l&255}`}function ja(e){let l=La(e);if(l===null)return!0;let[f,_,w]=l;if((f&57344)!==8192)return!0;if(f===8193&&(_&65024)===0)return!0;if(f===8193&&_===3512)return!0;if(f===16383&&(_&61440)===0)return!0;if(f===8194)return ys(Ba(_,w));return!1}function yr(e){return e.replace(/^\[|\]$/g,"")}function Yt(e){let l=yr(e.trim()),f=Zt(l);if(f===4)return ys(l);if(f===6)return ja(l);return!0}function vs(e){if(e instanceof Error&&e.name==="TimeoutError")return"dns_timeout";switch(typeof e==="object"&&e!==null&&"code"in e?e.code:void 0){case"ENOTFOUND":return"dns_not_found";case"ENODATA":return"dns_empty";case"EAI_AGAIN":case"ESERVFAIL":case"ECONNREFUSED":return"dns_temporary";case"ETIMEOUT":case"ETIMEDOUT":return"dns_timeout";default:return"dns_failed"}}var ks=5000;function Ma(e){return async(l,f)=>{if(f?.aborted)throw Error("aborted");let _=new Ca({timeout:ks,tries:1});if(e)_.setServers(e);let w=()=>_.cancel();f?.addEventListener("abort",w,{once:!0});try{let[S,I]=await Promise.allSettled([_.resolve4(l),_.resolve6(l)]),W=[...S.status==="fulfilled"?S.value:[],...I.status==="fulfilled"?I.value:[]];if(W.length>0)return W;let x=[S,I].flatMap((G)=>G.status==="rejected"?[G.reason]:[]);throw x.find((G)=>["dns_temporary","dns_timeout"].includes(vs(G)))??x[0]??Object.assign(Error("DNS returned no addresses"),{code:"ENODATA"})}finally{f?.removeEventListener("abort",w)}}}var Wa=Ma();async function Fa(e,l,f,_){if(_?.aborted)throw Error("aborted");let w=new AbortController,S,I,W=l(e,w.signal);W.catch(()=>{});try{return await Promise.race([W,new Promise((x,M)=>{if(S=setTimeout(()=>M(new DOMException("DNS lookup timed out","TimeoutError")),f),_)I=()=>M(Error("aborted")),_.addEventListener("abort",I,{once:!0})})])}finally{if(S!==void 0)clearTimeout(S);if(_&&I)_.removeEventListener("abort",I);w.abort()}}async function io(e,l=Wa,f){let _=yr(e);if(Zt(_))return Yt(_)?{ok:!1,reason:"non_public_ip"}:{ok:!0,addresses:[_]};let w;try{w=await Fa(_,l,ks,f)}catch(S){return{ok:!1,reason:f?.aborted?f.reason instanceof Error&&f.reason.name==="TimeoutError"?"dns_timeout":"aborted":vs(S)}}if(w.length===0)return{ok:!1,reason:"dns_empty"};if(w.some(Yt))return{ok:!1,reason:"non_public_ip"};return{ok:!0,addresses:w}}var Ua=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;function Ln(e){return e.length<=253&&Ua.test(e.toLowerCase())}function za(e,l){let f=e.trim().toLowerCase();if(!Ln(f))return!1;if(f.startsWith("*.")){let _=f.slice(2);return l===_||l.endsWith(`.${_}`)}return f===l}function $a(e){let l=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(e);if(!l)return null;let f=l.slice(1).map(Number);return f.some((_)=>_>255)?null:f}function Bn(e,l=[]){let f=(_)=>{if(_=_.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,""),!_.includes(":"))return _;try{_=new URL(`http://[${_}]/`).hostname.slice(1,-1)}catch{return _}let w=/^::ffff:([\da-f]+):([\da-f]+)$/.exec(_);if(!w)return _;let S=parseInt(w[1],16),I=parseInt(w[2],16);return`${S>>8}.${S&255}.${I>>8}.${I&255}`};return l.some((_)=>f(_)===f(e))}function nt(e){e=e.toLowerCase().replace(/^\[|\]$/g,"");let l=$a(e);if(l){let[S,I,W]=l;if(S===127)return"loopback";return S===0||S===10||S>=224||S===100&&I>=64&&I<=127||S===169&&I===254||S===172&&I>=16&&I<=31||S===192&&(I===168||I===0&&(W===0||W===2)||I===88&&W===99)||S===198&&(I===18||I===19||I===51&&W===100)||S===203&&I===0&&W===113?"private":"public"}if(!e.includes(":"))return"hostname";try{e=new URL(`http://[${e}]/`).hostname.slice(1,-1)}catch{return"private"}if(e==="::1")return"loopback";let f=/^::ffff:([\da-f]+):([\da-f]+)$/.exec(e);if(f){let S=parseInt(f[1],16),I=parseInt(f[2],16);return nt(`${S>>8}.${S&255}.${I>>8}.${I&255}`)==="public"?"public":"private"}let[_,w=0]=e.split(":").map((S)=>parseInt(S||"0",16));return _<8192||_>16383||_===8194||_===8193&&(w<512||w===3512)||_===16383&&w<4096?"private":"public"}function Ue(e,l){let f;try{f=new URL(e)}catch{return{allowed:!1,url:e,host:null,reason:"invalid_url"}}if(["about:","data:","blob:"].includes(f.protocol))return{allowed:!0,url:e,host:null,reason:"local_document"};if(!["http:","https:","ws:","wss:"].includes(f.protocol))return{allowed:!1,url:e,host:f.hostname||null,reason:"unsupported_protocol"};let _=f.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,"");if(l.mode==="off")return{allowed:!0,url:e,host:_,reason:"policy_off"};let w=(W)=>({allowed:!1,url:e,host:_,reason:W});if(f.username||f.password)return w("invalid_url");if(l.mode==="public_web"){let W=nt(_)!=="public"&&nt(_)!=="hostname"||_==="localhost"||/\.(?:localhost|local|internal|arpa)$/.test(_)||!_.includes(".")&&!Ss(_)||Boolean(Ss(_)&&Yt(_));return{allowed:!W,url:e,host:_,reason:W?"private_network":"public_web"}}let S=Number(f.port||(["https:","wss:"].includes(f.protocol)?443:80));if(l.deniedPorts?.includes(S)||Bn(_,l.deniedHosts))return w("destination_not_allowed");let I=nt(_);if(I==="private"||["local","internal","arpa"].some((W)=>_===W||_.endsWith(`.${W}`)))return w("private_network");if(I==="loopback"||_==="localhost"||_.endsWith(".localhost"))return l.allowedLoopbackPorts?.includes(S)?{allowed:!0,url:e,host:_,reason:"loopback"}:w("destination_not_allowed");if(l.allowedDomains.some((W)=>za(W,_)))return{allowed:!0,url:e,host:_,reason:"allowed_domain"};return{allowed:!1,url:e,host:_,reason:"destination_not_allowed"}}import Es from"child_process";import{accessSync as Ka,constants as Ga,readFileSync as Ja,statSync as Va}from"fs";import{createRequire as qa}from"module";import{dirname as _f,isAbsolute as jn,join as Ya,resolve as mf,win32 as Xa}from"path";var Mn=Object.freeze({schemaVersion:1,driver:"playwright-core",driverVersion:Qt.dependencies["playwright-core"],browser:"chromium"}),Rs=["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome","/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge","/Applications/Brave Browser.app/Contents/MacOS/Brave Browser","/Applications/Chromium.app/Contents/MacOS/Chromium"],Wn=["/usr/bin/chromium","/usr/bin/chromium-browser","/usr/bin/google-chrome","/usr/bin/google-chrome-stable"];function Za(e=process.env){let l=[e.ProgramFiles??"C:\\Program Files",e["ProgramFiles(x86)"]??"C:\\Program Files (x86)"],f=e.LOCALAPPDATA?[e.LOCALAPPDATA]:[],_=(w,...S)=>w.map((I)=>Xa.join(I,...S));return[..._([...l,...f],"Google","Chrome","Application","chrome.exe"),..._(l,"Microsoft","Edge","Application","msedge.exe"),..._([...l,...f],"BraveSoftware","Brave-Browser","Application","brave.exe")]}function Bt(e){try{return Ka(e,Ga.X_OK),jn(e)&&Va(e).isFile()}catch{return!1}}function Fn(e,l=process.platform){let f=l==="darwin"?Rs:l==="linux"?Wn:l==="win32"?Za():null;return f?(e??f).find(Bt)??null:null}function Qa(){if(!process.versions.bun)return;let e=Symbol.for("ara.headless-browser.bun-pipe-owners");if(Object.hasOwn(globalThis,e))return;let l=[];Es.spawn=new Proxy(Es.spawn,{apply(f,_,w){let S=Reflect.apply(f,_,w),I=w[1],W=w[2]?.stdio;if(Array.isArray(I)&&I.includes("--remote-debugging-pipe")&&Array.isArray(W)&&W[3]==="pipe"&&W[4]==="pipe")l.push(S);return S}}),Object.defineProperty(globalThis,e,{value:l})}async function en(e){if(Qa(),e!==void 0){if(!jn(e))throw Error("hands_browser_driver_path_must_be_absolute");let _=Ya(e,"package.json"),w=JSON.parse(Ja(_,"utf8"));if(w.name!==Mn.driver)throw Error("hands_browser_wrong_driver");let S=qa(_)(e),I=S.default?.chromium??S.chromium;if(!I)throw Error("hands_browser_missing_chromium");return{version:w.version,chromium:I}}let[l,f]=await Promise.all([import("./index-ttmxy9nd.js"),import("./package-r7sgmw4t.js").then((m)=>Li(m.default,1))]);return{version:f.default.version,chromium:l.chromium}}var ec=(e,l=Mn.driverVersion)=>({status:"unavailable",reason:e,expectedDriverVersion:l}),rc=(e)=>e.loadDriver?.()??en(e.driverModuleDirectory);async function jt(e={}){return Os(e,Mn.driverVersion)}async function Un(e,l={}){if(e.driverVersion!=="1.61.1"||!jn(e.driverModuleDirectory))throw Error("hands_browser_invalid_managed_compatibility");return Os({...l,driverModuleDirectory:e.driverModuleDirectory,allowSystemBrowser:!0},e.driverVersion)}async function Os(e,l){let f=(x)=>ec(x,l),_=e.platform??process.platform;if(_!=="linux"&&_!=="darwin"&&_!=="win32")return f("unsupported_platform");let w;try{w=await rc(e)}catch{return f("driver_missing")}if(w.version!==l)return f("driver_version_mismatch");let S=(x,M)=>({status:"resolved",executablePath:x,source:M,driverVersion:w.version});if(e.executablePath!==void 0)return Bt(e.executablePath)?S(e.executablePath,"configured"):f("executable_missing");let I=w.chromium.executablePath();if(Bt(I))return S(I,"managed");let W=e.allowSystemBrowser===!0?Fn(e.systemCandidates,_):null;return W?S(W,"system"):f("executable_missing")}var _c=["/usr/local/bin/chromium",...Wn];function yn(e,l=Ds()){return Fn(e??(l==="linux"?_c:void 0),l)}async function mc(){try{return(await en()).chromium}catch{return dc(import.meta.url)("playwright-core").chromium}}var hc=1048576,gc=105000,bc=20000,Is=5000,wc=2000,yc=1000,vc=30000,As=81920,kc={".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".gif":"image/gif"};async function Sc(e,l){let f=new URL(e.url()),_={...await e.allHeaders(),host:f.host};for(let w of Object.keys(_))if(/^(?:proxy-|connection$|upgrade$|transfer-encoding$|content-length$)/i.test(w))delete _[w];return new Promise((w,S)=>{let W=(f.protocol==="https:"?uc:lc)(f,{method:e.method(),headers:_,agent:!1,lookup:(M,G,F)=>{let T=it.isIP(l);if(G.all)F(null,[{address:l,family:T}]);else F(null,l,T)}},(M)=>{let G=[],F=0;M.on("data",(T)=>{if(F+=T.length,F>33554432)W.destroy(Error("hands_browser_response_too_large"));else G.push(T)}),M.on("error",S),M.on("end",()=>{let T={};for(let[re,J]of Object.entries(M.headers))if(J!==void 0&&!["transfer-encoding","connection","content-length"].includes(re))T[re]=Array.isArray(J)?J.join(`
-`):J;w({status:M.statusCode??502,headers:T,body:Buffer.concat(G)})})}),x=setTimeout(()=>W.destroy(Error("hands_browser_fetch_timeout")),vc);W.once("close",()=>clearTimeout(x)),W.on("error",S),W.end(e.postDataBuffer()??void 0)})}async function Ec(e,l,f=()=>{},_={lookup:(w)=>cc(w,{all:!0}),fetch:Sc}){let w=new WeakSet,S=new WeakMap,I=(W)=>{let x=S.get(W);if(x)return x;let M=(async()=>{if(!e.newCDPSession)return;let G=await e.newCDPSession(W),F=new Map;G.on("Network.loadingFinished",({requestId:T})=>F.delete(T)),G.on("Network.loadingFailed",({requestId:T})=>F.delete(T)),G.on("Fetch.requestPaused",async(T)=>{let re=T.networkId??T.requestId,J=T.redirectedRequestId?(F.get(re)??0)+1:0;F.set(re,J);let z=Ue(T.request.url,l),fe=l.mode==="enforce"&&Boolean(T.redirectedRequestId)&&z.host!==null&&!it.isIP(z.host),ve=!z.allowed?z:fe?{...z,allowed:!1,reason:"destination_not_allowed"}:J>20?{...z,allowed:!1,reason:"redirect_not_supported"}:null;try{if(ve)f(ve),await G.send("Fetch.failRequest",{requestId:T.requestId,errorReason:"BlockedByClient"});else await G.send("Fetch.continueRequest",{requestId:T.requestId})}catch{await G.send("Fetch.failRequest",{requestId:T.requestId,errorReason:"Failed"}).catch(()=>{})}}),await G.send("Network.enable"),await G.send("Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]}),w.add(W)})();return S.set(W,M),M};return await e.route("**/*",async(W)=>{let x=W.request().url(),M=Ue(x,l);if(M.allowed&&l.mode==="public_web"){await W.continue();return}let G=W.request();if(M.allowed&&M.host&&it.isIP(M.host)&&G.isNavigationRequest?.()){let F=G.frame();if(w.has(F.page())&&F===F.page().mainFrame()){await W.continue();return}}if(M.allowed&&(l.mode==="off"||M.reason==="local_document")){await W.continue();return}if(M.allowed&&M.host)try{let F=M.host,T=nt(F),re,J=await(async()=>{if(T!=="hostname")return[{address:F,family:it.isIP(F)}];if(M.reason==="loopback")return[{address:"127.0.0.1",family:4}];try{return await Promise.race([_.lookup(F),new Promise((z,fe)=>{re=setTimeout(()=>fe(Error("hands_browser_dns_timeout")),5000)})])}finally{if(re)clearTimeout(re)}})();if(!J.length||J.some(({address:z})=>{let fe=nt(z);return!it.isIP(z)||l.mode==="enforce"&&Bn(z,l.deniedHosts)||(M.reason==="loopback"?fe!=="loopback":fe!=="public")}))M={...M,allowed:!1,reason:"private_network"};else{let z=await _.fetch(W.request(),J[0].address);if(z.status>=300&&z.status<400){let fe=z.headers.location??x;try{fe=new URL(fe,x).href}catch{}let ve=Ue(fe,l);M=ve.allowed?{...ve,allowed:!1,reason:"redirect_not_supported"}:ve}else{await W.fulfill(z);return}}}catch{await W.abort("failed");return}f(M),await W.abort("blockedbyclient")}),await e.routeWebSocket("**/*",async(W)=>{let x=Ue(W.url(),l);if(l.mode==="enforce"&&x.allowed&&(!x.host||!it.isIP(x.host)))x={...x,allowed:!1,reason:"destination_not_allowed"};if(x.allowed){W.connectToServer();return}f(x),await W.close({code:1008,reason:"Reason egress policy denied"})}),l.mode==="off"?void 0:{preparePage:I}}async function Cs(e,l=Ds(),f){if(f){let w=await Un(f,{platform:l,systemCandidates:e});return w.status==="resolved"?w.executablePath:null}if(e!==void 0){let w=yn(e,l);if(w)return w}let _=await jt({platform:l,systemCandidates:e,allowSystemBrowser:!0});return _.status==="resolved"?_.executablePath:null}function Ts(e,l){if(!e)throw Error("hands_repl_workspace_required");let f=$n(e),_=yt(e),w=Gn(_,yt(_,l)),I=w!==".."&&!w.startsWith(`..${Jn}`)&&!Ps(w)?yt(f,w):yt(f,l);if(E(yt(_,l))||E(I))throw Error("hands_repl_protected_path");let W=(J)=>{let z=Gn(f,J);return z!==""&&z!==".."&&!z.startsWith(`..${Jn}`)&&!Ps(z)},x=$n(I);if(E(x))throw Error("hands_repl_protected_path");if(!W(I)||!W(x))throw Error("hands_repl_file_outside_workspace");let M=Gn(f,I).split(Jn),G=[f,...M.map((J,z)=>yt(f,...M.slice(0,z+1)))],F=G.map((J)=>xs(J));if(F.some((J)=>J.isSymbolicLink()))throw Error("hands_repl_file_symlink");let T=F[F.length-1];if(!T.isFile()||T.nlink!==1||T.size>16777216)throw Error("hands_repl_file_not_regular_or_too_large");let re=sc(I,zn.O_RDONLY|zn.O_NOFOLLOW|zn.O_NONBLOCK);try{let J=oc(re);if(J.dev!==T.dev||J.ino!==T.ino||!J.isFile())throw Error("hands_repl_file_changed");for(let be=0;be<G.length;be++){let Oe=xs(G[be]);if(Oe.dev!==F[be].dev||Oe.ino!==F[be].ino||Oe.isSymbolicLink())throw Error("hands_repl_file_changed")}if(!W($n(I)))throw Error("hands_repl_file_outside_workspace");let z=Buffer.alloc(16777217),fe=0;while(fe<z.length){let be=ic(re,z,fe,z.length-fe,null);if(!be)break;fe+=be}if(fe===z.length)throw Error("hands_repl_file_too_large");let ve=z.subarray(0,fe);return{name:fc(I),mimeType:kc[pc(I).toLowerCase()]??"application/octet-stream",buffer:ve}}finally{nc(re)}}function vt(e,l){e.end(`${JSON.stringify(l)}
-`)}function rn(e){try{ac(e)}catch{}}async function Hs(e){if(e.managedBrowser&&e.driverModuleDirectory!==void 0)throw Error("hands_browser_ambiguous_driver_configuration");let l=e.launch||e.targetContext?null:e.managedBrowser?await Un(e.managedBrowser,{executablePath:e.browserExecutablePath}):await jt({executablePath:e.browserExecutablePath,driverModuleDirectory:e.driverModuleDirectory});if(l?.status==="unavailable")throw Error(`hands_browser_${l.reason}`);let f=l?.status==="resolved"?l.executablePath:e.browserExecutablePath;if(!f||!Bt(f))throw Error("hands_browser_unavailable");let _=e.launch??(async(le)=>(e.targetContext?await mc():(await en(e.managedBrowser?.driverModuleDirectory??e.driverModuleDirectory)).chromium).launch(le)),w=[],S={},I=null,W=null,x=null,M=null,G=!1,F=null,T=new Map,re=new WeakMap,J=null,z=()=>{if(G)throw Error("hands_repl_stopped");if(M)throw M},fe=(le)=>{let he=re.get(le);if(he)return he;let xe=Promise.resolve().then(()=>le.close()).then(()=>{T.delete(le)});return re.set(le,xe),xe},ve=async()=>{let le=[...T.entries()].reverse(),he=J??=performance.now()+yc,xe=Promise.allSettled(le.filter(([,ke])=>ke==="context").map(([ke])=>fe(ke))),Ke;try{await Promise.race([xe,new Promise((ke)=>{Ke=setTimeout(ke,Math.max(0,he-performance.now()))})])}finally{if(Ke)clearTimeout(Ke)}let Le=await Promise.allSettled(le.map(([ke])=>fe(ke))),Be=[];for(let[ke,We]of Le.entries()){if(We.status!=="rejected")continue;let tr=We.reason instanceof Error&&["Error","TimeoutError","ProtocolError"].includes(We.reason.name)?We.reason.name:"unknown";Be.push(Error(`hands_repl_close_failed: ${le[ke][1]}: ${tr}`))}if(Be.length)throw AggregateError(Be,"hands_repl_stop_unconfirmed")},be=(le,he)=>{if(T.set(le,he),G||M)fe(le).catch(()=>{return}),z();return le},Oe=async()=>{let le=await _({executablePath:f,headless:!0,chromiumSandbox:e.managedBrowser===void 0,args:["--disable-background-networking","--disable-quic","--disable-dev-shm-usage","--disable-gpu","--disable-software-rasterizer","--dns-prefetch-disable","--force-webrtc-ip-handling-policy=disable_non_proxied_udp","--no-pings"]}),he=null;try{be(le,"browser"),he=e.targetContext??be(await le.newContext({viewport:{width:1440,height:900},screen:{width:1440,height:900},serviceWorkers:"block",acceptDownloads:!1}),"context");let xe=await Ec(he,e.networkPolicy??{mode:"off"},e.onEgressDenied);if(z(),xe){let Ge=he.newPage.bind(he);he.newPage=async()=>{let or=await Ge();return await xe.preparePage(or),or}}let Le=he.pages()[0]??await he.newPage();await xe?.preparePage(Le),z();let Be=async(Ge=Le)=>{let or=Ge;if(typeof or.ariaSnapshot==="function")return or.ariaSnapshot({timeout:1e4});return Le.locator("body").innerText({timeout:1e4})},ke=async(Ge,or={})=>{let sr=or&&typeof or==="object"&&!Array.isArray(or)?or:{},dr,Wr="image/png";if(Buffer.isBuffer(Ge)||Ge instanceof Uint8Array)dr=Buffer.from(Ge);else if(typeof Ge==="string"&&(Ge.startsWith("data:")||/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(Ge)))dr=Buffer.from(Ge.replace(/^data:[^,]*,/,""),"base64");else if(typeof Ge==="string"){let Xr=Ts(e.workspaceRoot,Ge);dr=Xr.buffer,Wr=Xr.mimeType}else throw Error("view() needs a Buffer, a base64 string, or a path to an image file");if(dr.length===0)throw Error("view(): the image is empty");let ln=String(sr.label??"").replace(/[\r\n>]+/g," ").trim().slice(0,120),Kr=Number(sr.maxWidth)||1024,lt=Number(sr.quality)||72,Ft=e.targetContext?await le.newPage():await he.newPage();try{let Xr=`data:${Wr};base64,${dr.toString("base64")}`;for(let lr=0;lr<5;lr+=1){let jr=await Ft.evaluate(async(Lr)=>{let Mr=new Image;Mr.src=Lr.url,await Mr.decode();let Zr=Math.min(1,Lr.maxWidth/Mr.naturalWidth),Tr=document.createElement("canvas");Tr.width=Math.max(1,Math.round(Mr.naturalWidth*Zr)),Tr.height=Math.max(1,Math.round(Mr.naturalHeight*Zr));let Ir=Tr.getContext("2d");if(!Ir)throw Error("view(): canvas unavailable");return Ir.fillStyle="#ffffff",Ir.fillRect(0,0,Tr.width,Tr.height),Ir.drawImage(Mr,0,0,Tr.width,Tr.height),{data:Tr.toDataURL("image/jpeg",Lr.q/100).split(",")[1]??"",width:Tr.width,height:Tr.height,sourceWidth:Mr.naturalWidth,sourceHeight:Mr.naturalHeight}},{url:Xr,maxWidth:Kr,q:lt}),ut=Buffer.from(jr.data,"base64");if(ut.length<=As){let Lr=ln||"image";return`<<<ARA_VIEW_IMAGE ${jr.data} image/jpeg ${Lr}>>>
-Viewing ${Lr} (${jr.sourceWidth}x${jr.sourceHeight} source, sent at ${jr.width}x${jr.height}, ${Math.round(ut.length/1024)}KB).`}if(Kr>640)Kr=Math.round(Kr*0.75);else lt=Math.max(30,lt-15)}throw Error(`view(): could not reduce the image under ${Math.round(As/1024)}KB`)}finally{await Ft.close().catch(()=>{return})}},We=ws({browser:e.targetContext?.browser()??le,context:he,page:Le,a11y:Be,view:ke,readWorkspaceFile:(Ge)=>Ts(e.workspaceRoot,Ge),privateProfile:e.privateProfile,beforeNavigation:e.beforeNavigation,recording:e.recording,screenshotExport:e.screenshotExport,actionRecorder:()=>{let Ge=w,or=S;return(sr,dr)=>{if(Ge.length<xo)Ge.push(sr);if(dr)or.page=dr}}}),tr=async(Ge)=>{z();let or=be(await le.newContext({serviceWorkers:"block",acceptDownloads:!1}),"context");try{await or.route("**/*",(dr)=>dr.abort()),z(),await or.routeWebSocket("**/*",(dr)=>dr.close({code:1008,reason:"Reason evaluator network denied"})),z(),await or.exposeBinding("__araHandsRpc",async(dr,Wr)=>e.onBrowserOperation?e.onBrowserOperation(Ge,()=>We.dispatch(Wr)):We.dispatch(Wr)),z();let sr=await or.newPage();return z(),await sr.goto("data:text/html,<title>Reason Hands evaluator</title>"),z(),await sr.evaluate(`(${ds})(${JSON.stringify(We.roots)})`),{context:or,page:sr,runId:Ge}}catch(sr){throw await fe(or).catch(()=>{return}),sr}},nr=await tr(),Pr={browser:le,context:he,page:Le,evaluator:nr,async captureProgressFrame(Ge){return ke(await Ge.screenshot({type:"jpeg",quality:65,timeout:2000}),{label:"Screen after browser action"})},async resetEvaluator(Ge){await fe(Pr.evaluator.context),Pr.evaluator=await tr(Ge)}};return z(),Pr}catch(xe){throw await ve().catch(()=>{return}),xe}},$e=async()=>{if(z(),I)return I;if(!x){W=Oe();let le;x=Promise.race([W,new Promise((he,xe)=>{le=setTimeout(()=>xe(Error("hands_browser_unavailable: startup timed out")),bc)})]).then((he)=>(z(),I=he,he)).catch(async()=>{M=Error("hands_browser_unavailable: startup failed or timed out");let he;try{await Promise.race([ve(),new Promise((xe,Ke)=>{he=setTimeout(()=>Ke(Error("hands_repl_stop_timeout")),Is)})])}catch{M=Error("hands_browser_unavailable: startup cleanup unconfirmed")}finally{if(he)clearTimeout(he)}throw M}).finally(()=>{if(le)clearTimeout(le)})}return x},qe=async(le,he,xe=!1)=>{let Ke=await $e(),Le=S;if(e.onBrowserOperation&&Ke.evaluator.runId!==he)await Ke.resetEvaluator(he);let ke=(async()=>{let nr=await Ke.evaluator.page.evaluate(`(${ls})(${JSON.stringify({code:le})})`);if(typeof nr!=="string")throw Error("hands_repl_invalid_evaluator_output");let Pr=Le.page;if(xe&&Pr&&!nr.includes("<<<ARA_VIEW_IMAGE")){let Ge=()=>Ke.captureProgressFrame(Pr);try{let or=await(e.onBrowserOperation?e.onBrowserOperation(he,Ge):Ge());return Le.automaticProgressImage=!0,`${nr}
-${or}`}catch{return`${nr}
-Screen capture unavailable.`}}return nr})(),We,tr=new Promise((nr,Pr)=>{We=setTimeout(()=>Pr(Error("REPL evaluation timed out after 105 seconds")),gc)});try{return await Promise.race([ke,tr])}catch(nr){if(nr instanceof Error&&nr.message.includes("timed out"))ke.catch(()=>{return}),await Ke.resetEvaluator(he).catch(()=>{return});throw nr}finally{if(We)clearTimeout(We)}},ye=Promise.resolve(),Fe=new Set,Ve=new Set;rn(e.socketPath);let Te=it.createServer((le)=>{Fe.add(le),le.once("close",()=>{Fe.delete(le),Ve.delete(le)}),le.setEncoding("utf8");let he="",xe=!1;le.on("data",(Ke)=>{if(xe)return;if(he+=Ke,he.length>hc){xe=!0,vt(le,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let Le=he.indexOf(`
-`);if(Le===-1)return;xe=!0;let Be=he.slice(0,Le);if(e.onControl)try{let ke=JSON.parse(Be);if(typeof ke.action==="string"&&ke.action!=="evaluate")Ve.add(le)}catch{}ye=ye.then(async()=>{if(le.destroyed)return;w=[],S={};try{let ke=JSON.parse(Be);if(ke.action==="probe"){let Ge=await $e();await qe("undefined",Ge.evaluator.runId),vt(le,{ok:!0,output:"ARA_HANDS_REPL_READY"});return}if(typeof ke.action==="string"&&ke.action!=="evaluate"&&e.onControl){vt(le,{ok:!0,output:await e.onControl(ke.action,ke)});return}if(ke.action!=="evaluate"||typeof ke.code!=="string")throw Error("Invalid REPL request");let We=ke.code,tr=typeof ke.runId==="string"?ke.runId:void 0,nr=()=>qe(We,tr,ke.includeProgressCapture===!0),Pr=await(e.onEvaluate?e.onEvaluate(ke,nr):nr());vt(le,{ok:!0,output:Pr,browserActions:w,...S.automaticProgressImage?{automaticProgressImage:!0}:{}})}catch(ke){vt(le,{ok:!1,error:ke instanceof Error?ke.message:String(ke),stack:ke instanceof Error?ke.stack:void 0,browserActions:w})}}).catch((ke)=>{vt(le,{ok:!1,error:ke instanceof Error?ke.message:String(ke)})})})});try{await new Promise((le,he)=>{Te.once("error",he),Te.listen(e.socketPath,()=>{Te.off("error",he);try{if(process.platform!=="win32")tc(e.socketPath,384);le()}catch(xe){Te.close(()=>he(xe))}})})}catch(le){throw rn(e.socketPath),le}return{socketPath:e.socketPath,browserExecutablePath:f,stop(){if(F)return F;G=!0;let le=Ve.size?setTimeout(()=>{for(let Le of Ve)Le.destroy()},wc):void 0,he=new Promise((Le)=>Te.close(()=>{if(le)clearTimeout(le);Le()}));for(let Le of Fe)if(!Ve.has(Le))Le.destroy();ye.catch(()=>{return});let xe=async()=>{await he,rn(e.socketPath);let Le=[ve()];if(W)Le.push(W.then(()=>{return},()=>{return}));let Be=await Promise.allSettled(Le),ke=await Promise.allSettled([ve()]),We=[...Be,...ke].filter((tr)=>tr.status==="rejected");if(We.length)throw AggregateError(We.map((tr)=>tr.reason),"hands_repl_stop_unconfirmed")},Ke;return F=Promise.race([xe(),new Promise((Le,Be)=>{Ke=setTimeout(()=>Be(Error("hands_repl_stop_timeout")),Is)})]).finally(()=>{if(Ke)clearTimeout(Ke);rn(e.socketPath)}),F}}}var Rc=["private_runtime","runtime_root","temporary_directory","granted_root","workspace_layout","jobs","browser_socket","relay_url","environment_owner","job_environment","config_write"],Oc=["ENOENT","EACCES","EPERM","EINVAL","ENOTDIR","EISDIR","ELOOP","EROFS","ENOSPC","EMFILE","ENFILE","EEXIST"];function Ns(e,l){if(!e||!Rc.includes(e))return null;let f=typeof l==="object"&&l!==null&&"code"in l?l.code:null;return{workspace_stage:e,workspace_errno:typeof f==="string"&&Oc.includes(f)?f:"unknown"}}import{lstatSync as xc,readFileSync as Pc}from"fs";var Ic="/run/sc/egress-guard",Ac=10002,qn=10003;function Ls(e=process.platform,l=Ic){if(e!=="linux")return!1;try{let f=xc(l);if(!f.isFile()||f.uid!==0||(f.mode&18)!==0)return!1;return Pc(l,"utf8")===`v1 ${Ac} ${qn}
-`}catch{return!1}}var Tc=/^(\/.+)-sidechat-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;function Bs(e){let l=Tc.exec(e.replace(/\/+$/,""));return l?`${l[1]}/repo`:null}import{randomUUID as vd}from"crypto";import{spawn as kd,spawnSync as Sd}from"child_process";import{accessSync as Ed,chmodSync as Wt,closeSync as Rd,constants as At,fchmodSync as Od,fstatSync as xd,openSync as Pd,copyFileSync as Id,existsSync as _o,lstatSync as cr,statSync as dt,mkdtempSync as Ad,mkdirSync as Tt,realpathSync as er,renameSync as cn,rmSync as Td,writeFileSync as dn}from"fs";import{homedir as Dd,tmpdir as di}from"os";import{basename as Cd,dirname as Ar,join as ar,resolve as li,sep as Hd}from"path";var Dc={"navigation.ara-egress.invalid":"canary_navigation","fetch.ara-egress.invalid":"canary_fetch","subresource.ara-egress.invalid":"canary_subresource","codeload.github.com":"canary_redirect","websocket.ara-egress.invalid":"canary_websocket"};function js(e){return e===null?"other":Dc[e]??"other"}function Nr(e,l){if(e===void 0||l===void 0)return null;let f=Math.round(l-e);return Number.isSafeInteger(f)&&f>=0&&f<=600000?f:null}var Ye="workspace_mode",qr="granted_root",Br="project_root",kt="terminal_root",St="terminal_benchmark_tool_profile",Cc=["bash","bash-node-repl","bash-node-repl-files"],Ms="hands_node_repl_persistent_execution_unsupported";function Ws(e){return e==="bash"?null:"hands_node_repl_persistent_execution_unsupported"}function Fs(e){return Cc.includes(e)}var $f=i({device_id:t().uuid(),root_id:t().uuid()}),Yn=/^reason\/[0-9a-f]{8}$/,Hc=c({source_path:t().refine(X).optional(),branch:t().regex(Yn)}),Kf=i({checkout_mode:s(["worktree","direct"]).optional(),project_workspace_source:i({kind:n("local_device"),device_id:t().uuid(),root_id:t().uuid(),path:t().refine(X).optional(),worktree:Hc.optional()})});import{execFile as Nc}from"child_process";var Lc=20000,Bc=1e4,Us=/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/,jc=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","gc.auto=0","-c","maintenance.auto=false"];async function zs(e,l=Mc){let f=(fe,ve=Bc)=>l([...jc,"-C",e,...fe],ve),_=async(fe)=>{let ve=await f(fe);return ve.status===0?ve.stdout.trim():null},w=await _(["rev-parse","--verify","--quiet","HEAD^{commit}"]);if(!w||!Us.test(w))return null;let S=w.slice(0,12),I=(fe)=>({commit:w,from:"head",note:`reason: started from ${fe}`}),W=await _(["symbolic-ref","--quiet","HEAD"]);if(!W?.startsWith("refs/heads/"))return I(`the checkout's detached HEAD ${S}`);let x=W.slice(11),M=await f(["--no-optional-locks","status","--porcelain=v1","--untracked-files=no"]);if(M.status!==0||M.stdout.trim())return I(`${x} at ${S}: the checkout has uncommitted changes, which stay there`);let G=await _(["config","--get",`branch.${x}.remote`]),F=await _(["config","--get",`branch.${x}.merge`]);if(!G||!F?.startsWith("refs/")||G.startsWith("-"))return I(`${x} at ${S}: it has no upstream to catch up with`);let T=G==="."||(await f(["fetch","--quiet","--no-tags","--no-write-fetch-head","--no-recurse-submodules",G,F],Lc)).status===0,re=await _(["rev-parse","--abbrev-ref","--symbolic-full-name","@{upstream}"]),J=re?await _(["rev-parse","--verify","--quiet","@{upstream}^{commit}"]):null;if(!re||!J||!Us.test(J))return I(`${x} at ${S}: ${T?"it has no upstream to catch up with":`fetching ${G} failed`}`);if(!T)return I(`${x} at ${S}: fetching ${re} failed, so it may be behind`);if(J===w)return I(`${x} at ${S}, the same commit as ${re} after fetching it`);if((await f(["merge-base","--is-ancestor",w,J])).status!==0)return I(`${x} at ${S}: it has commits that ${re} does not`);let z=await _(["rev-list","--count",`${w}..${J}`]);return{commit:J,from:"upstream",note:`reason: started from ${re} at ${J.slice(0,12)}, fetched just now: ${x} had no commits of its own and was ${z??"some"} commits behind it`}}function Mc(e,l){return new Promise((f)=>{Nc("git",e,{encoding:"utf8",timeout:l,maxBuffer:1048576,env:{...process.env,GIT_TERMINAL_PROMPT:"0"}},(_,w)=>{let S=_?typeof _.code==="number"?_.code:null:0;f({status:S,stdout:String(w??"")})})})}import{lstatSync as Wc,readdirSync as Yf,readFileSync as Xf,realpathSync as $s,rmdirSync as Zf,unlinkSync as Qf,writeFileSync as Fc}from"fs";import{join as Xn,resolve as rp}from"path";var Uc=".reason-device";function Ks(e,l,f){let _=l.split("/"),w=de.split("/");if(_.length!==w.length+2||w.some((S,I)=>_[I]!==S)||!rr.test(_[w.length]))return;try{let S=zc(e,_[w.length]);Fc(Xn(S,Uc),f,{flag:"wx",mode:384})}catch{}}function zc(e,l){let f=()=>new r("session_worktree_outside_workspace","Reason removes only Session folders in ~/.reason/workspace/sessions.");if(!rr.test(l))throw f();let _=Xn($s(e),de),w=Xn(_,l);if(!Wc(w).isDirectory()||$s(w)!==w)throw f();return w}import{createHash as $c}from"crypto";import{join as Kc}from"path";function Gc(e){return kr(e)}function $r(){throw new r("environment_unavailable","The private Session environment is unavailable or stale.")}function nn(e){return $c("sha256").update(JSON.stringify({...e,variables:Object.fromEntries(Object.entries(e.variables).sort(([l],[f])=>l.localeCompare(f)))})).digest("hex")}function Gs(e,l){v(e);let f=Kc(e,"environment.json"),_,w=new Set,S=(W,x)=>`${x}:${W}`,I=(W)=>{let x=mr.safeParse(W);if(!x.success)return $r();let M=x.data,G=l.identity(),F=Date.parse(M.expires_at);if(!G||M.run_id!==l.runId||M.device_id!==l.deviceId||M.root_id!==l.rootId||M.binding.kind!==l.binding.kind||M.binding.target_revision!==l.binding.target_revision||M.binding.root_grant_revision!==l.binding.root_grant_revision||M.binding.target_generation!==G.generation||M.binding.target_fence_id!==G.fenceId||F<=Date.now()||F>l.expiresAtMs||l.expiresAtMs<=Date.now()||Object.keys(M.variables).some((T)=>!Gc(T)))return $r();if(M.git){let T=new URL(l.apiOrigin),re=new URL(M.git.base_url),J=Date.parse(M.git.expires_at);if(re.origin!==T.origin)throw new r("environment_git_origin_mismatch","The delivered Git broker is not on this worker's API origin.");if(!["/git","/git/"].includes(re.pathname)||re.username||re.password||re.search||re.hash||J<=Date.now()||J>F)return $r()}if(M.cloud_access&&!ns(M.cloud_access,l.apiOrigin))throw new r("environment_cloud_access_origin_mismatch","The delivered cloud access is not on this worker's API origin.");return M};return{path:f,install(W){let x=I(W),M=nn(x);if(_&&(x.revision<_.revision||x.revision===_.revision&&(M!==_.hash||x.snapshot_id!==_.snapshotId)))return $r();if(!_||x.revision>_.revision){if(lo(f,x,V.snapshotBytes),nn(I(JSON.parse(h(f,V.snapshotBytes))))!==M)return $r();let G=_;if(_={revision:x.revision,hash:M,snapshotId:x.snapshot_id,generation:x.binding.target_generation},G&&G.generation<_.generation)w.add(S(G.snapshotId,G.revision))}else if(nn(I(JSON.parse(h(f,V.snapshotBytes))))!==_.hash)return $r();return{installed:!0,snapshot_id:x.snapshot_id,installed_revision:x.revision}},current(){if(!_)return $r();try{let W=I(JSON.parse(h(f,V.snapshotBytes)));if(nn(W)!==_.hash)return $r();return W}catch{return $r()}},carried:(W,x)=>w.has(S(W,x))}}var xt=Object.freeze([Object.freeze({version:"0.2.61",artifact_sha256:"02ffcd514bf7cc0a9e73d4ce31ecea32709429cd0adf79e7062c1b70ff9ab8b8",legacy_linux_x64_sha256:"cdc0828abde3157e39afc6a64e033deee52ff7cfb09b55a42e60394df24980b9"}),Object.freeze({version:"0.2.62",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d",legacy_linux_x64_sha256:"cce594365d518b680abfb2378d234c8ef4e3daf257df83adef650a4523fb2d92"}),Object.freeze({version:"0.2.63",artifact_sha256:"20a77fff617e18315c60777d46a2de2c433e42eba4e1c5e0b5535d967847303d"}),Object.freeze({version:"0.2.64",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.65",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.66",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.67",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.68",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.69",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.70",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.71",artifact_sha256:"830afe8cffb1f4ebb2663b5f86e5d2a7c9965fa03706178b251eea5d415917d2"}),Object.freeze({version:"0.2.72",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.73",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.74",artifact_sha256:"6071ba92082b8378f5484e8dce446d3f0c3bde61d5b5ca48efa6f72389d3ab64"}),Object.freeze({version:"0.2.75",artifact_sha256:"a6e0648894f1f4876affd77c0ff42642c1f9cbe9bb752de19d7a97a5fb3b820e"}),Object.freeze({version:"0.2.76",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.77",artifact_sha256:"857446b7e0b25fe1cc21e58860c7d984ee9a1c28efb4a4c49bc573a2d70bb3c0"}),Object.freeze({version:"0.2.78",artifact_sha256:"0a7a7ece14850a28b8f972d66e4eef570eb2bb75d58f8a82f4e9afe91424e27f",pi_tools_v1:!0}),Object.freeze({version:"0.2.79",artifact_sha256:"96f52656b454fc5b9ffe520f5c5d55720b5173eb084cd326d2710e434623897b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.80",artifact_sha256:"6ee0ed70889e2771bd9b239ee039b549361b56ce870e08956ec7cce7fa199cd7",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.81",artifact_sha256:"c8909b36f4ee9316c0c3e298cb9adb5fc821a6ec5ca365cab60043eb942c258a",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.82",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.83",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.84",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.85",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.86",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.87",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.88",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.89",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.90",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.91",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.92",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.93",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.94",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.95",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.96",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.97",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.98",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.99",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.100",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.101",artifact_sha256:"38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.102",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.103",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.104",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.105",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.106",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.107",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.108",artifact_sha256:"53da53b31916c077bd63814db6cef8646785352d628b06a9ded927a94b08ecdd",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.109",artifact_sha256:"7a82b33611b9f47478fb181d0da6f49a04f7e4bc401a7752530fecffb2dc5864",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.110",artifact_sha256:"00b7dcc9078a7d7ea4814414fbf92dcf9ba3b0fd51186aac1b967e9ae306a377",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.111",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.112",artifact_sha256:"7688e992667a48defe6fefb3b8624012b918e8776498faf9e5b20b69c13d7520",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.113",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.114",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.115",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.116",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.117",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.118",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.119",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.120",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.121",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.122",artifact_sha256:"cc134e4d22b3f4032099d9f3c18a95815177598e0e6658840702e0dafaf5c7ad",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.123",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.124",artifact_sha256:"ae68959cc57c3d3e360ba16883479d0706a0c2e742fe61a66b78e12fbbf5463e",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.125",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.126",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.127",artifact_sha256:"503ec2935bd73740bca494782cea6e6740667ce416d1a526c8cdf152ab3d0090",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.128",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.129",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.130",artifact_sha256:"852f8b11cee963d2f077f010b5c836fab0ee84e0026c4762bc4c7ef28e4deb2b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.131",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.132",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.133",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.134",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.135",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.136",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.137",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.138",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.139",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.140",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.141",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.142",artifact_sha256:"39e5173130068852fd81ffbe0f75cf52d7afcfcd92d640fedda85e1993960527",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.143",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.144",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.145",artifact_sha256:"ddd5382224321a671a5e338ccc8f9aae09ad876b534e6a8bfec07dc04c5b57d3",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0}),Object.freeze({version:"0.2.146",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.147",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.148",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.149",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.150",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.151",artifact_sha256:"8b2959fed27dff6769a0124ecbbddceaa671dc2dd502f5f77d54dbe69c99e4b5",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.152",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.153",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.154",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.155",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.156",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.157",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.158",artifact_sha256:"065b5bfc86ec87cf2907d83864ffef9912a8cb18b2b36db435c74cfd3891b8f8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0}),Object.freeze({version:"0.2.159",artifact_sha256:"cc806ca6df14c39d45a944d1e1db9827dae35b3e66e0265ededb3eea3d883dcb",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.160",artifact_sha256:"0b8f6c4598a19acbeff93929efc237dbc4e356ccb26abf6957e297bfc1b551e8",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.161",artifact_sha256:"d570f5035bfc5916c31f4954ce5bcc00013eec83edb020edbbfbd3260b9c17d0",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.162",artifact_sha256:"6e52c44af7a3ea3633a4dc28aa63696143cd80044bca7f67a57c4c156985566f",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.163",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.164",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.165",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.166",artifact_sha256:"8c14891abb51ab566864387137ea4af511db7ef9c565afb63e4f2b49c91260b6",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.167",artifact_sha256:"62658de309f9b9c8fd70041c83898d8625d85fed303ac6e60c3a17afc85477e2",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.168",artifact_sha256:"24d7efe74218b862a90f48cf71dc59dce1d0dba29b167168aca06649bbfab364",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.169",artifact_sha256:"83879d03741c3f37c1502535d128685421cd7a498bc22543516a23ef2b21e496",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.170",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.171",artifact_sha256:"386b975277972e253599e5168b654e35c50b5eed9cbe711d7359e2efedd78f31",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.172",artifact_sha256:"7a01a820961bd03b31007e46ba4f09df0a621ea5bfc9ee84548d6acdfd750169",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.173",artifact_sha256:"82c9ece017e109cf8b4b54734ac7a81b1ecb2ff35a426998369b6c3e690fd1ae",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.174",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.175",artifact_sha256:"07fa1db4f84afe909ad4de4bcdbda9bc785cf2598b51769b1f5620bb86b3743b",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0}),Object.freeze({version:"0.2.176",artifact_sha256:"ba3e211489877d0622aeca87be98e235d245f39d2b57f275cd924168d05f98ce",pi_tools_v1:!0,background_bash_v1:!0,machine_sdk_v1:!0,pi_tools_confinement_v1:!0,home_folder_v1:!0})]),Jc="16befed856b4414dee65733e82549e1db74fe0ff3841d2571cfd8605d3ee970b",Vc=Object.freeze(["ea63410f321f70848139a63ddcaa9f3f0a48daa3641898cc1db9f0e15ddfbb13","6cd101ddb09f87ed6996aa92a93911b1759b5ae33e9579c3dff8225ecfcbe1b6",Jc]),Js=Object.freeze(["0f57db3036c275f78064796a72827d0f47fe702475e5feebb31e1569bcb5a0cf","38e82c8fefcc4ef98468eb3b4f0df450e4e196a8bd1063bb4de14ffef951a0c2"]),wp=Object.freeze(["pi_tools_v1","background_bash_v1","machine_sdk_v1","pi_tools_confinement_v1","home_folder_v1","workspace_before_v1"]),yp=new Set([b,...xt.map((e)=>e.artifact_sha256),...Vc,...Js]);var vp=new Set([b,...xt.filter((e)=>e.pi_tools_v1).map((e)=>e.artifact_sha256),...Js]);var kp=new Set([b,...xt.filter((e)=>e.pi_tools_confinement_v1).map((e)=>e.artifact_sha256)]);var Sp=new Set([b,...xt.filter((e)=>e.home_folder_v1).map((e)=>e.artifact_sha256)]);var Ep=new Set([b,...xt.filter((e)=>e.background_bash_v1).map((e)=>e.artifact_sha256)]);var Rp=new Set([b,...xt.filter((e)=>e.machine_sdk_v1).map((e)=>e.artifact_sha256)]);var qc=[R,"reason-hands-worker.cjs"];function Vs(e){return typeof e==="string"&&qc.includes(e)}var Yc;function qs(){return Yc??{kind:"unavailable",status:"unsupported_entrypoint",sha256:null,observed_at_ms:null}}import{closeSync as Xc,constants as Zn,fstatSync as Ys,lstatSync as Zc,openSync as Qc,readSync as ed,realpathSync as rd,watch as td}from"fs";import{dirname as Xs}from"path";function on(e,l){let f;try{let _=Xs(e),w=Zc(_);if(!w.isDirectory()||w.isSymbolicLink()||!A(w,18)||rd(_)!==_)return null;f=Qc(e,Zn.O_RDONLY|Zn.O_NOFOLLOW|Zn.O_NONBLOCK);let S=Ys(f);if(!S.isFile()||S.nlink!==1||!A(S)||S.size<1||S.size>8192)return null;let I=Buffer.alloc(8193),W=ed(f,I,0,I.length,0),x=Ys(f);if(W!==S.size||x.size!==S.size||x.nlink!==1||x.mtimeMs!==S.mtimeMs||x.ctimeMs!==S.ctimeMs)return null;let M=JSON.parse(I.subarray(0,W).toString("utf8"));if(!M||M.pid!==l.pid||!Number.isSafeInteger(M.pid)||M.pid<1||M.launchId!==l.launchId||M.workerVersion!==l.workerVersion||M.protocolVersion!==l.protocolVersion||M.workerArtifactSha256!==l.workerArtifactSha256||M.workerEntrypoint!==l.workerEntrypoint||M.workspaceAliasReady!==!0||!U(M.targetGeneration)||!U(M.generation)||!N(M.fenceId))return null;return{...l,generation:M.generation,targetGeneration:M.targetGeneration,fenceId:M.fenceId,workspaceAliasReady:!0}}catch{return null}finally{if(f!==void 0)Xc(f)}}var nd=(e,l,f)=>{let _=td(e,{persistent:!1},l);return _.on("error",f),_};function Zs(e){let l=new AbortController,f=e.initial,_=f.targetGeneration,w=!1,S=!1,I,W,x=()=>{if(S)return;S=!0,I?.close(),I=void 0,clearInterval(W),e.signal.removeEventListener("abort",x),l.abort()},M=()=>{if(S)return;if(!e.isAlive()){x();return}let G=on(e.path,e.initial);if(!G||G.generation<f.generation||G.targetGeneration<f.targetGeneration||G.targetGeneration===f.targetGeneration&&G.fenceId!==f.fenceId)return;if(f=G,w||G.targetGeneration<=_)return;_=G.targetGeneration,w=!0,Promise.resolve().then(()=>(l.signal.throwIfAborted(),e.publish(G,l.signal))).catch(()=>{if(!S)x(),e.failed?.()}).finally(()=>{w=!1,M()})};if(e.signal.aborted)return x(),{stop:x};e.signal.addEventListener("abort",x,{once:!0});try{I=(e.watch??nd)(Xs(e.path),M,()=>{I?.close(),I=void 0})}catch{}return W=setInterval(M,1000),W.unref?.(),M(),{stop:x}}import{spawn as od}from"child_process";import{chmodSync as sd,mkdtempSync as id,realpathSync as ad,rmSync as cd,unlinkSync as dd,writeFileSync as ld}from"fs";import ud from"net";import{platform as fd,tmpdir as pd}from"os";import{join as Qs}from"path";var ei=1048576,co=105000,_d=2000,md=String.raw`
-const { writeSync } = require("node:fs");
-const { createRequire } = require("node:module");
-const { join } = require("node:path");
-const { createInterface } = require("node:readline");
-const { formatWithOptions, inspect } = require("node:util");
-const vm = require("node:vm");
-
-const timeoutMs = ${co};
-const maxLogChars = 524288;
-let activeOutput = [];
-let activeOutputChars = 0;
-function appendOutput(value) {
-  if (activeOutputChars >= maxLogChars) return;
-  const kept = String(value).slice(0, maxLogChars - activeOutputChars);
-  activeOutput.push(kept);
-  activeOutputChars += kept.length;
-}
-const replConsole = Object.fromEntries(
-  ["log", "info", "warn", "error", "debug"].map((method) => [
-    method,
-    (...args) => {
-      const formatted = formatWithOptions({ colors: false }, ...args);
-      appendOutput(formatted + "\n");
-    },
-  ]),
-);
-const originalProcessKill = process.kill.bind(process);
-function selfOnlyProcessKill(pid, signal) {
-  if (pid !== process.pid) {
-    const error = new Error("kill EPERM");
-    error.code = "EPERM";
-    error.errno = -1;
-    error.syscall = "kill";
-    throw error;
-  }
-  return originalProcessKill(pid, signal);
-}
-Object.defineProperty(process, "kill", {
-  value: selfOnlyProcessKill,
-  configurable: false,
-  enumerable: true,
-  writable: false,
-});
-Object.defineProperty(process, "_kill", {
-  value: selfOnlyProcessKill,
-  configurable: false,
-  enumerable: false,
-  writable: false,
-});
-const localRequire = createRequire(join(process.cwd(), "__ara_hands_node_repl__.js"));
-const context = vm.createContext({
-  AbortController,
-  AbortSignal,
-  Buffer,
-  URL,
-  URLSearchParams,
-  clearImmediate,
-  clearInterval,
-  clearTimeout,
-  console: replConsole,
-  fetch,
-  process,
-  queueMicrotask,
-  require: localRequire,
-  setImmediate,
-  setInterval,
-  setTimeout,
-  structuredClone,
-});
-
-async function evaluate(code) {
-  activeOutput = [];
-  activeOutputChars = 0;
-  const originalStdoutWrite = process.stdout.write;
-  process.stdout.write = function(chunk, encoding, callback) {
-    const normalizedEncoding = typeof encoding === "string" ? encoding : undefined;
-    appendOutput(Buffer.isBuffer(chunk) ? chunk.toString(normalizedEncoding) : chunk);
-    const completed = typeof encoding === "function" ? encoding : callback;
-    if (typeof completed === "function") queueMicrotask(completed);
-    return true;
-  };
-  const script = new vm.Script(code, { filename: "reason-hands-node-repl.js" });
-  let timer;
-  try {
-    const value = script.runInContext(context, { timeout: timeoutMs });
-    const resolved = await Promise.race([
-      Promise.resolve(value),
-      new Promise((_, reject) => {
-        timer = setTimeout(
-          () => reject(new Error("REPL evaluation timed out after 105 seconds")),
-          timeoutMs,
-        );
-      }),
-    ]);
-    const inspected = inspect(resolved, {
-      depth: 8,
-      colors: false,
-      maxArrayLength: 200,
-      maxStringLength: 16_000,
-      breakLength: 120,
-    });
-    const emitted = activeOutput.join("");
-    return emitted.length === 0
-      ? inspected
-      : emitted + (emitted.endsWith("\n") ? "" : "\n") + inspected;
-  } finally {
-    if (timer) clearTimeout(timer);
-    process.stdout.write = originalStdoutWrite;
-  }
-}
-
-// Ordinary stdout is just an untrusted result stream, not a control authority.
-// The parent must terminate and reap this process before accepting any result.
-function respond(payload) { writeSync(1, JSON.stringify(payload) + "\n"); }
-
-let queue = Promise.resolve();
-const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
-lines.on("line", (line) => {
-  queue = queue.then(async () => {
-    try {
-      const request = JSON.parse(line);
-      if (request.action === "probe") {
-        respond({ ok: true, output: "ARA_HANDS_REPL_READY" });
-        return;
-      }
-      if (request.action !== "evaluate" || typeof request.code !== "string") {
-        throw new Error("Invalid REPL request");
-      }
-      respond({ ok: true, output: await evaluate(request.code) });
-    } catch (error) {
-      respond({
-        ok: false,
-        error: error instanceof Error ? error.message : String(error),
-        stack: error instanceof Error ? error.stack : undefined,
-      });
-    }
-  }).catch((error) => respond({ ok: false, error: String(error) }));
-});
-`;function hd(e=process.execPath,l=process.versions.bun){return l?"node":e}function Qn(e){try{dd(e)}catch{}}function sn(e,l){e.end(`${JSON.stringify(l)}
-`)}function ao(e){return JSON.stringify(e)}function gd(e){let l=id(Qs(pd(),"reason-node-repl-")),f=Qs(l,"node-repl.sb"),w=["(version 1)","(deny default)",'(import "system.sb")',"(allow process*)","(deny network*)",`(allow file-read* ${["/System","/usr","/bin","/opt/homebrew","/usr/local"].map((I)=>`(subpath ${ao(I)})`).join(" ")})`,`(allow file-read* file-write* (subpath ${ao(e.workRoot)}) (subpath ${ao(l)}))`].join(`
-`);ld(f,w,{mode:384});let S=!1;return{command:"/usr/bin/sandbox-exec",args:["-f",f,e.nodeExecutable,...e.nodeArgs],cwd:e.workRoot,env:{...e.environment,TMPDIR:l},async cleanup(){if(S)return;S=!0,cd(l,{recursive:!0,force:!0})}}}async function bd(e){let l=ad(e.workRoot),f=e.nodeExecutable??hd(),_=["--max-old-space-size=512","--permission",`--allow-fs-read=${l}`,`--allow-fs-write=${l}`,"-e",md],w=He({home:l,temporaryDirectory:l}),S=e.platformName??fd();if(S==="linux")return{command:f,args:_,cwd:l,env:w,async cleanup(){}};if(S==="darwin")return gd({nodeExecutable:f,nodeArgs:_,workRoot:l,environment:w});throw Error("hands_node_repl_platform_unsupported")}async function Mt(e){let l;try{await Promise.race([e,new Promise((f,_)=>{l=setTimeout(()=>_(Error("hands_node_repl_child_cleanup_timeout")),_d)})])}finally{clearTimeout(l)}}async function ti(e){if(e.executionMode!=="single-evaluation")throw Error(Ms);let l=await bd(e),f;try{f=od(l.command,l.args,{cwd:l.cwd,env:l.env,stdio:["pipe","pipe","pipe"]})}catch(be){throw await l.cleanup(),be}let _=new Promise((be)=>f.once("close",()=>be())),w;f.once("error",(be)=>{w=be});let S=!1,I=!1,W="";f.stderr.setEncoding("utf8"),f.stderr.on("data",(be)=>{W=`${W}${be}`.slice(-16384)});let x=f.stdout,M,G=(be,Oe,$e)=>{if($e)be.failure??=$e;if(be.finishing)return;be.finishing=!0,I=!0,f.kill("SIGKILL"),Mt(_).then(()=>{if(be.failure)be.reject(be.failure);else be.resolve(Oe??{})},(qe)=>be.reject(qe))},F=()=>{if(I=!0,M)G(M,void 0,Error("hands_node_repl_state_lost"));else f.kill("SIGKILL")},T="";x?.setEncoding("utf8"),x?.on("data",(be)=>{if(M?.finishing||I)return;if(T+=be,T.length>ei){F();return}while(!0){let Oe=T.indexOf(`
-`);if(Oe===-1)return;let $e=T.slice(0,Oe);T=T.slice(Oe+1);let qe=M;if(!qe){F();return}try{let ye=JSON.parse($e);if(qe.action==="probe")qe.resolve(ye);else{G(qe,ye);return}}catch{G(qe,void 0,Error("invalid_hands_node_repl_child_response"));return}}});let re=(be)=>{let Oe=W.trim(),$e=be??Error(Oe?`hands_node_repl_child_exited:${Oe}`:"hands_node_repl_child_exited");if(I=!0,M&&!M.finishing)G(M,void 0,$e)};f.once("error",re),f.once("close",()=>re()),f.stdin.on("error",re);let J=(be)=>new Promise((Oe,$e)=>{if(S||I||f.exitCode!==null||f.signalCode!==null){$e(Error(I?"hands_node_repl_state_lost":"hands_node_repl_stopped"));return}let qe=setTimeout(F,be.action==="probe"?1e4:Math.max(1,Math.min(e.evaluationTimeoutMs??co-1000,co-1000))),ye={action:be.action,finishing:!1,resolve(Fe){if(M===ye)M=void 0;clearTimeout(qe),Oe(Fe)},reject(Fe){if(M===ye)M=void 0;clearTimeout(qe),$e(Fe)}};M=ye,f.stdin.write(`${JSON.stringify(be)}
-`,(Fe)=>{if(!Fe)return;G(ye,void 0,Fe)})});try{if(!x){if(f.pid===void 0)await Mt(_);throw w??Error("hands_node_repl_control_pipe_missing")}let be=await J({action:"probe"});if(be.ok!==!0||be.output!=="ARA_HANDS_REPL_READY")throw Error("hands_node_repl_probe_failed")}catch(be){S=!0,f.kill("SIGKILL");try{await Mt(_)}finally{await l.cleanup()}throw be}let z=Promise.resolve(),fe=new Set;Qn(e.socketPath);let ve=ud.createServer((be)=>{fe.add(be),be.once("close",()=>fe.delete(be)),be.setEncoding("utf8");let Oe="",$e=!1,qe=!1;be.once("close",()=>{if(qe)F()}),be.on("error",()=>be.destroy()),be.on("data",(ye)=>{if($e)return;if(Oe+=ye,Oe.length>ei){$e=!0,sn(be,{ok:!1,error:"REPL request exceeds 1 MiB"});return}let Fe=Oe.indexOf(`
-`);if(Fe===-1)return;$e=!0;let Ve=Oe.slice(0,Fe);z=z.then(async()=>{if(be.destroyed)return;try{let Te=JSON.parse(Ve);if(Te.action!=="evaluate"||typeof Te.code!=="string")throw Error("Invalid REPL request");qe=!0;let le=await J({action:"evaluate",code:Te.code});if(qe=!1,le.ok!==!0||typeof le.output!=="string")throw Error(typeof le.error==="string"?le.error:"hands_node_repl_failed");sn(be,{ok:!0,output:le.output})}catch(Te){qe=!1,sn(be,{ok:!1,error:Te instanceof Error?Te.message:String(Te),stack:Te instanceof Error?Te.stack:void 0})}}).catch((Te)=>{sn(be,{ok:!1,error:Te instanceof Error?Te.message:String(Te)})})})});try{await new Promise((be,Oe)=>{ve.once("error",Oe),ve.listen(e.socketPath,()=>{ve.off("error",Oe);try{sd(e.socketPath,384),be()}catch($e){ve.close(()=>Oe($e))}})})}catch(be){S=!0,f.kill("SIGKILL");try{await Mt(_)}finally{await l.cleanup(),Qn(e.socketPath)}throw be}return{socketPath:e.socketPath,async stop(){if(S)return;S=!0;let be=new Promise((Oe)=>ve.close(()=>Oe()));for(let Oe of fe)Oe.destroy();await be,z.catch(()=>{return}),F();try{await Mt(_)}finally{await l.cleanup(),Qn(e.socketPath)}}}}var uo=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var ni="/workspace",oi="/var/lib/reason/sessions",wd="/var/lib/reason/session-controls";function wr(e){let l=`${oi}/`;if(!e.startsWith(l))return null;let f=e.slice(l.length);if(!uo.test(f)||f!==f.toLowerCase())throw Error("personal_computer_invalid_runtime_root");return`${wd}/${f}/job.env`}function yd(e){if(!uo.test(e))throw Error("personal_computer_invalid_identity");return e.toLowerCase()}function an(e){let l=yd(e);return{runtimeRoot:`${oi}/${l}`,workspaceRoot:`${ni}/sessions/${l}`,sharedRoot:ni}}var si="/root/.ara/cloud-browser/repl.sock";function fo(e){return e==="compute"}function ii(e,l,f="linux"){if(e)an(e);if(f!=="linux")throw Error("cloud_browser_os_invalid");if(l!==void 0&&(!e||!/^[1-9][0-9]{0,18}$/.test(l)))throw Error("cloud_browser_generation_invalid");let _=e?`/var/lib/reason/browsers/${e.toLowerCase()}`:"/root/.ara/cloud-browser",w=e?`${_}/${l?`g${l}`:"current"}`:_,S=e?`/root/.b/${e.toLowerCase().replaceAll("-","")}`:_;return{temporarySessionDirectory:S,temporaryDirectory:e?`${S}/${l??"current"}`:`${w}/tmp`,directory:w,sessionDirectory:_,config:`${w}/config.json`,status:`${w}/status.json`,socket:`${w}/repl.sock`,bundle:`${w}/driver.mjs`,processName:e?`ara-browser-${e.toLowerCase()}${l?`-${l}`:""}`:"ara-cloud-browser"}}var po="browser_egress",ai=rs,Nd=45000,Ld=Xt+1500,Yr=/^[A-Za-z0-9._:-]{1,160}$/,Bd="/run/ara-hands";function jd(e,l,f=di()){if(e==="darwin")return{temporaryRoot:f,prepareRoot:!1,sessionMode:448};return{temporaryRoot:l??Bd,prepareRoot:!0,sessionMode:457}}function me(e,l=process.platform,f=process.geteuid?.()){return e===!0&&l==="linux"&&f===0}function ge(e=K(),l=process.platform,f=process.geteuid?.()){return e&&l==="linux"&&f===0?{uid:e.uid,gid:e.gid,home:e.home,username:e.username}:null}function Rt(e=ge(),l=Ls){return e&&l()?qn:null}function Md(e,l){if(!l&&(e??"linux")==="linux")return si;return ii(l,void 0,e??"linux").socket}function Pt(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function ui(e){let l=e.toLowerCase().replace(/^\[|\]$/g,"");return l==="localhost"||l.endsWith(".localhost")||l==="::1"||l==="0:0:0:0:0:0:0:1"||l==="0.0.0.0"||l.startsWith("127.")}class br extends r{expiryDiagnostic;constructor(e){super("invalid_hands_expiry","Reason Hands connection expiry is invalid.");this.expiryDiagnostic=e}}function Wd(e){return Pt(e)&&Object.keys(e).every((l)=>l==="source_path"||l==="branch")&&(e.source_path===void 0||X(e.source_path))&&typeof e.branch==="string"&&Yn.test(e.branch)}function Fd(e,l,f){let _=l===void 0?Date.now():l,w=["relay_url","session_id","environment_id","expires_at","policy_mode","policy_version","hands_protocol_version","hands_worker_version","hands_worker_artifact_sha256","hands_worker_entrypoint","target_generation","target_fence_id"],S=new Set([...w,"workspace_id","legacy_workspace_id",Ce,Ae,"environment_binding","cloud_browser","sandbox_provider","sandbox_os","personal_workspace","workspace_path","workspace_worktree",Ye,po,St,Q,Y,q]),I=Pt(e)?e:null,W=I?.[po],x=I?.[St],M=I?.[Y],G=W===void 0||(I?.[Ye]===qr||M===pe&&I?.[Ye]===void 0)&&Pt(W)&&Object.keys(W).every((ve)=>ve==="mode"||ve==="allowed_domains")&&W.mode==="enforce"&&Array.isArray(W.allowed_domains)&&W.allowed_domains.length<=256&&W.allowed_domains.every((ve)=>typeof ve==="string"&&Ln(ve));if(!Pt(e)||w.some((ve)=>!(ve in e))||Object.keys(e).some((ve)=>!S.has(ve))||!G||M!==void 0&&M!==pe||I?.[q]!==void 0&&I[q]!==Re||I?.personal_workspace!==void 0&&(I.personal_workspace!==!0||I[Ye]!==qr)||I?.cloud_browser!==void 0&&(I.cloud_browser!==!0||I[Ye]!==qr)||I?.sandbox_provider!==void 0&&!fo(I.sandbox_provider)||I?.sandbox_os!==void 0&&I.sandbox_os!=="linux"||x!==void 0&&(I?.[Ye]!==kt||!Fs(x))||Ye in e&&e[Ye]!==qr&&e[Ye]!==kt&&e[Ye]!==Br||e.workspace_path!==void 0&&(!X(e.workspace_path)||e[Ye]!==Br)||e.workspace_worktree!==void 0&&(e.workspace_path===void 0||!Wd(e.workspace_worktree))||typeof e.relay_url!=="string"||typeof e.session_id!=="string"||!Yr.test(e.session_id)||e.workspace_id!==void 0&&(typeof e.workspace_id!=="string"||!Yr.test(e.workspace_id))||e.legacy_workspace_id!==void 0&&(typeof e.legacy_workspace_id!=="string"||!Yr.test(e.legacy_workspace_id))||e[Ce]!==void 0&&(e[Ce]!==ue||(Ye in e))||e[Ae]!==void 0&&(e[Ae]!==Z||(Ye in e))||e[Q]!==void 0&&(typeof e[Q]!=="string"||!Yr.test(e[Q]))||typeof e.environment_id!=="string"||!Yr.test(e.environment_id)||typeof e.expires_at!=="string"||e.policy_mode!=="full_access"||e.policy_version!==1||e.hands_protocol_version!==P||e.hands_worker_version!==D||e.hands_worker_artifact_sha256!==b||!Vs(e.hands_worker_entrypoint)||!U(e.target_generation)||!N(e.target_fence_id))throw new r("invalid_hands_payload","Reason Hands connection payload is invalid.");let F;try{F=new URL(e.relay_url)}catch{throw new r("invalid_hands_relay","Reason Hands relay URL is invalid.")}if((ui(F.hostname)?F.protocol!=="ws:":F.protocol!=="wss:")||F.username||F.password||F.hash||!/^\/device\/[A-Za-z0-9-]+\/[A-Za-z0-9]+$/.test(F.pathname))throw new r("invalid_hands_relay","Reason Hands relay URL is not allowed.");let re=Date.parse(e.expires_at),J=Number.isNaN(re)?"parse":new Date(re).toISOString()!==e.expires_at?"noncanonical":re<=_?"expired":re-_>ai?"over_cap":"accepted",z={version:1,outcome:J,clock_source:l===void 0?"date_now":"injected",validation_now_ms:gt(_),expiry_ms:gt(re),remaining_ms:Number.isSafeInteger(re-_)?re-_:null,maximum_lifetime_ms:ai,cli_artifact:qs()};if(J!=="accepted")throw new br(z);try{f?.(z)}catch{}let fe=e.environment_binding===void 0?void 0:Dn.safeParse(e.environment_binding);if(fe&&!fe.success)throw new r("invalid_hands_request","Reason Hands environment binding is invalid.");return{...e.cloud_browser===!0?{cloud_browser:!0}:{},...fo(e.sandbox_provider)?{sandbox_provider:e.sandbox_provider}:{},...e.sandbox_os==="linux"?{sandbox_os:e.sandbox_os}:{},...e.personal_workspace===!0?{personal_workspace:!0}:{},relay_url:F.toString(),...fe?.success?{environment_binding:fe.data}:{},session_id:e.session_id,...e.workspace_id===void 0?{}:{workspace_id:e.workspace_id},...e.legacy_workspace_id===void 0?{}:{legacy_workspace_id:e.legacy_workspace_id},...e[Ce]===ue?{[Ce]:ue}:{},...e[Ae]===Z?{[Ae]:Z}:{},...typeof e[Q]==="string"?{[Q]:e[Q]}:{},...e[Y]===pe?{[Y]:pe}:{},...e[q]===Re?{[q]:Re}:{},...typeof e.workspace_path==="string"?{workspace_path:e.workspace_path}:{},...Pt(e.workspace_worktree)?{workspace_worktree:{...typeof e.workspace_worktree.source_path==="string"?{source_path:e.workspace_worktree.source_path}:{},branch:String(e.workspace_worktree.branch)}}:{},environment_id:e.environment_id,expires_at:e.expires_at,policy_mode:"full_access",policy_version:1,hands_protocol_version:P,hands_worker_version:D,hands_worker_artifact_sha256:b,hands_worker_entrypoint:R,target_generation:e.target_generation,target_fence_id:e.target_fence_id,...Ye in e?{[Ye]:e[Ye]}:{},...x===void 0?{}:{[St]:x},...W===void 0?{}:{[po]:{mode:"enforce",allowed_domains:[...new Set(W.allowed_domains)].sort()}}}}function Ud(){let e=new Map;return{acquire(l,f){if(e.has(l))return null;let _=[...e.values()],w=(I)=>f.group!==void 0&&I.group===f.group;if(f.exclusive?!_.every(w):_.some((I)=>I.exclusive))return null;if(f.limit!==void 0&&!_.some(w)&&new Set(_.map((I,W)=>I.group??W)).size>=f.limit)return null;e.set(l,f);let S=!1;return()=>{if(S)return;S=!0,e.delete(l)}},activeOwners:()=>[...e.keys()]}}var zd=Ud();function $d(e,l){Tt(e,{recursive:!0,mode:448});let f=er(e),_=()=>new r("invalid_hands_workspace","Reason Hands managed workspace ancestor must be a real directory, not a link.");for(let I of l.split("/")){let W=ar(f,I);try{let M=cr(W);if(M.isSymbolicLink()||!M.isDirectory())throw _()}catch(M){if(!(M&&typeof M==="object"&&("code"in M)&&M.code==="ENOENT"))throw M;try{Tt(W,{mode:448})}catch(G){if(!(G&&typeof G==="object"&&("code"in G)&&G.code==="EEXIST"))throw G}}let x=cr(W);if(x.isSymbolicLink()||!x.isDirectory()||er(W)!==W)throw _();f=W}if(process.platform==="win32"){let I=cr(f);if(I.isSymbolicLink()||!I.isDirectory()||er(f)!==f||!Fr(er(e),f))throw _();return f}let w=cr(f),S=Pd(f,At.O_RDONLY|At.O_DIRECTORY|At.O_NOFOLLOW);try{let I=xd(S);if(!I.isDirectory()||I.dev!==w.dev||I.ino!==w.ino||er(f)!==f)throw _();Od(S,448)}finally{Rd(S)}return f}function Kd(e,l=$o(),f,_,w){if(!Yr.test(e)||f!==void 0&&!Yr.test(f))throw new r("invalid_hands_workspace","Reason Hands run identity is invalid.");let S=Ar(O({kind:"managed",workspaceId:e,..._?{base:_}:{},...w?{layout:w}:{}})),I=$d(l,Ar(S)),W=ar(I,Cd(S)),x=!1;try{let T=cr(W);if(x=!0,T.isSymbolicLink())throw new r("invalid_hands_workspace","Reason Hands workspace cannot be a symbolic link.");if(!T.isDirectory())throw new r("invalid_hands_workspace","Reason Hands workspace must be a managed directory.")}catch(T){if(T instanceof r||!(T&&typeof T==="object"&&("code"in T)&&T.code==="ENOENT"))throw T}if(w&&!x)try{let T=ar(er(l),Ar(O({kind:"managed",workspaceId:e,..._?{base:_}:{}}))),re=cr(T);if(!re.isSymbolicLink()&&re.isDirectory()&&er(T)===T)cn(T,W),x=!0}catch{}if(f&&f!==e){let T=ar(I,f);try{let re=cr(T);if(re.isSymbolicLink()||!re.isDirectory())throw new r("invalid_hands_workspace","Reason Hands legacy workspace must be a managed directory.");let J=er(T);if(Ar(J)!==I)throw new r("invalid_hands_workspace","Reason Hands legacy workspace escaped its managed parent.");let z=null;if(x){for(let fe=1;fe<=1000&&!z;fe++){let ve=ar(I,fe===1?`.${e}.previous`:`.${e}.previous.${fe}`);try{cr(ve)}catch(be){if(!(be&&typeof be==="object"&&("code"in be)&&be.code==="ENOENT"))throw be;z=ve}}if(!z)throw new r("invalid_hands_workspace","Reason Hands has too many previous workspace backups.");cn(W,z)}try{cn(J,W)}catch(fe){if(z)cn(z,W);throw fe}x=!0}catch(re){if(re instanceof r||!(re&&typeof re==="object"&&("code"in re)&&re.code==="ENOENT"))throw re}}Tt(W,{recursive:!0,mode:448}),Wt(W,448);let M=er(W);if(Ar(M)!==I)throw new r("invalid_hands_workspace","Reason Hands workspace escaped its managed parent.");let G=ar(M,"repo");try{let T=cr(G);if(T.isSymbolicLink()||!T.isDirectory())throw new r("invalid_hands_workspace","Reason Hands repository must be a managed directory.")}catch(T){if(T instanceof r||!(T&&typeof T==="object"&&("code"in T)&&T.code==="ENOENT"))throw T}Tt(G,{recursive:!0,mode:448}),Wt(G,448);let F=er(G);if(Ar(F)!==M)throw new r("invalid_hands_workspace","Reason Hands repository escaped its managed run workspace.");return{workRoot:M,repoPath:F}}function vr(e){let l=null;try{l=cr(e)}catch{}if(!l||l.isSymbolicLink()||!l.isDirectory()||l.uid!==0||l.gid!==0||(l.mode&4095)!==493)throw new r("cloud_workspace_root_invalid","This cloud Session's workspace root is not root's 0755 directory, so Reason Hands cannot use it.")}function Gd(e,l,f=process.geteuid?.(),_=process.platform){if(_==="win32")return"unknown";let w;try{if(w=dt(e),!w.isDirectory())return"unready";Ed(e,At.R_OK|At.W_OK|At.X_OK)}catch{return"unready"}try{if(cr(e).isSymbolicLink()||er(e)!==e)return"unknown"}catch{return"unknown"}if(f!==0)return"checked";if(l===null||w.uid!==l.uid||(w.mode&448)!==448)return"unknown";for(let S=Ar(e);;S=Ar(S)){let I;try{I=dt(S)}catch{return"unknown"}if(!(I.uid===l.uid?(I.mode&64)!==0:I.gid===l.gid?(I.mode&8)!==0:(I.mode&1)!==0))return"unknown";if(S===Ar(S))return"checked"}}function Jd(e,l){let f="/";for(let _ of["",...e.split("/"),...l.split("/")].filter((w,S)=>S===0||w)){if(_)f=ar(f,_);let w;try{w=cr(f)}catch{return null}if(w.uid!==0)return w.uid;if((w.mode&2)!==0&&(w.mode&512)===0&&!w.isSymbolicLink())return-1;if(w.isSymbolicLink()||!w.isDirectory())return null}return null}function Vd(e,l,f,_=process.geteuid?.(),w){if(!Yr.test(l))return null;let S,I;try{S=er(e),I=Ar(O({kind:"managed",workspaceId:l,...f?{base:f}:{},...w?{layout:w}:{}}))}catch{return null}let W=ar(S,I),x=tn(W)!==null,M=(J)=>new r("cloud_workspace_root_invalid",J),G;if(_===0){let J=Jd(S,I);if(J===null)return null;if(!x)throw new r("invalid_hands_workspace","As root, Reason Hands never prepares a workspace in folders another user owns.");G=J}else{if(!x)return null;let J,z;try{J=cr(Ar(W)),z=cr(W)}catch{return null}if(J.isSymbolicLink()||!J.isDirectory()||J.uid===0||z.uid!==0)return null;G=J.uid}let F=S;for(let J of I.split("/")){let z=ar(F,J),fe=!1;try{let ve=cr(z);fe=!ve.isSymbolicLink()&&ve.isDirectory()&&er(z)===z}catch{}if(!fe)throw M("This cloud Session's workspace root is missing or is not a real directory.");F=z}vr(W);let T;try{T=Sr(W)}catch(J){if(J instanceof r)throw J;throw M("This cloud Session's workspace root changed while Reason Hands checked it.")}let re=null;try{re=dt(T.repoPath).uid}catch{}if(re!==G)throw new r("invalid_hands_workspace","Reason Hands repository must belong to the cloud Session's user.");return T}function Sr(e,l=!1){let f=er(e),_=ar(f,"repo"),w;try{w=cr(_)}catch{throw new r("invalid_hands_workspace","Reason Hands repository is missing from the granted root.")}if(l){if(!/^\/var\/lib\/reason\/sessions\/[0-9a-f-]{36}$/.test(f))throw new r("invalid_hands_workspace","Personal runtime identity is invalid.");if(an(f.slice(f.lastIndexOf("/")+1)).runtimeRoot!==f)throw new r("invalid_hands_workspace","Personal runtime identity is invalid.");let W=er("/workspace"),x=er(_);if(W!=="/workspace"||!dt(x).isDirectory()||!x.startsWith("/workspace/"))throw new r("invalid_hands_workspace","Personal files escaped the personal computer.");return{workRoot:f,repoPath:x}}let S=Bs(f);if(S&&w.isSymbolicLink()){let W=er(_);if(W!==er(S)||!dt(W).isDirectory())throw new r("invalid_hands_workspace","Side chat repository must be its parent's checkout.");return{workRoot:f,repoPath:W}}if(w.isSymbolicLink()||!w.isDirectory())throw new r("invalid_hands_workspace","Reason Hands repository must be a managed directory.");let I=er(_);if(Ar(I)!==f)throw new r("invalid_hands_workspace","Reason Hands repository escaped its granted root.");return{workRoot:f,repoPath:I}}function mo(e,l,f){if(l!==void 0&&!X(l))throw new r("invalid_hands_workspace",`Reason Hands ${f} is invalid.`);let _=li(e,l??".");if(!Fr(e,_))throw new r("invalid_hands_workspace",`Reason Hands ${f} escapes its granted root.`);return _}function fi(e,l,f){if(et(l)){let _=er(f);return{anchor:_,target:li(_,l),boundary:ar(_,de)}}return{anchor:e,target:mo(e,l,"folder"),boundary:e}}function qd(e,l){if(!Fr(e,l))throw new r("invalid_hands_workspace","Reason Hands folder escapes its granted root.");let f=e;for(let _ of l.slice(e.length).split(Hd).filter(Boolean)){f=ar(f,_);let w=null;try{w=cr(f)}catch(S){if(S.code!=="ENOENT")throw S}if(!w)Tt(f,{mode:448});else if(w.isSymbolicLink()||!w.isDirectory())throw new r("invalid_hands_workspace","Reason Hands folder must be made of real directories.")}}function pi(e,l){let f=er(mo(e,l.source_path,"repository"));if(!Fr(e,f)||!dt(f).isDirectory())throw new r("invalid_hands_workspace","Reason Hands repository must be a folder in its granted root.");return f}async function Yd(e,l,f,_=a()){try{let w=er(e);if(_o(fi(w,l,_).target))return;return await zs(pi(w,f))??void 0}catch{return}}function Xd(e,l,f,_,w=Zd,S=a()){let I=er(e),{target:W,boundary:x,anchor:M}=fi(I,l,S);if(f&&!_o(W)){let T=pi(I,f);qd(M,Ar(W));let re=["-c","core.hooksPath=/dev/null","-C",T];if(_)w([...re,"update-ref","--create-reflog","-m",_.note,`refs/heads/${f.branch}`,_.commit,""]);let J=_?w([...re,"worktree","add",W,f.branch]):w([...re,"worktree","add","-b",f.branch,W]);if(!_&&J.status!==0&&/already exists/.test(J.stderr)&&!_o(W))J=w([...re,"worktree","add",W,f.branch]);if(J.status!==0)throw new r(/not a git repository/i.test(J.stderr)?"workspace_not_git_repository":"workspace_worktree_failed","Reason could not create this Session's git worktree.")}let G;try{G=cr(W)}catch{throw new r("workspace_folder_missing","This Session's folder no longer exists.")}let F=er(W);if(G.isSymbolicLink()&&!Fr(x,F))throw new r("invalid_hands_workspace","Reason Hands folder resolves outside its granted root.");if(!dt(F).isDirectory()||!Fr(x,F))throw new r("invalid_hands_workspace","Reason Hands folder must be a directory in its granted root.");if(E(F))throw new r("protected_path","Credential and secret folders are unavailable to Sessions.");return F}function Zd(e){let l=qo();if(!l)return{status:null,stderr:"git was not found. Install Git for Windows (https://git-scm.com/download/win)."};let f=Sd(l,e,{encoding:"utf8",timeout:60000,env:{...process.env,GIT_TERMINAL_PROMPT:"0"},stdio:["ignore","ignore","pipe"]});return{status:f.status,stderr:f.stderr??""}}function _i(e){return wr(e)??tn(e)?.jobEnv??ar(e,"job.env")}function Qd(e,l){let f=_i(e),_=cr(f);if(_.isSymbolicLink()||!_.isFile())throw new r("invalid_hands_workspace","Reason Hands job environment must be a managed regular file.");Id(f,l),Wt(l,384)}function el(e){if(e.workspaceMode===Br&&e.workspacePath!==void 0){let I=e.home??a(),W=Xd(e.grantedRoot,e.workspacePath,e.workspaceWorktree,e.workspaceWorktreeStart,void 0,I);if(e.workspaceWorktree&&e.deviceId)Ks(I,e.workspacePath,e.deviceId);return{workRoot:W,repoPath:W,workspace:{kind:"root",path:e.workspacePath},jobEnvPath:ar(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}if(e.workspaceMode===qr)return{...Sr(e.grantedRoot,e.personalWorkspace),workspace:{kind:"root"},jobEnvPath:ar(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1};if(e.workspaceMode===kt||e.workspaceMode===Br){let I=cr(e.grantedRoot);if(I.isSymbolicLink()||!I.isDirectory())throw new r("invalid_hands_workspace","Reason Hands root must be a real directory.");let W=er(e.grantedRoot);return{workRoot:W,repoPath:W,workspace:{kind:"root"},jobEnvPath:ar(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!0}}let l=e.workspaceId??e.runId,f={kind:"managed",workspaceId:l,...e.workspaceBase?{base:e.workspaceBase}:{},...e.workspaceLayout?{layout:e.workspaceLayout}:{}},_=ie(e.grantedRoot,f,e.home).anchor,w=Vd(_,l,e.workspaceBase,void 0,e.workspaceLayout);if(w)return{...w,workspace:f,jobEnvPath:ar(e.temporaryDirectory,"job.env"),workspacePoolPath:null,managedWorkspace:!1,cloudSessionRoot:!0};let S=Kd(l,_,e.legacyWorkspaceId,e.workspaceBase,e.workspaceLayout);return{...S,workspace:f,jobEnvPath:ar(e.temporaryDirectory,"job.env"),workspacePoolPath:Ar(S.workRoot),managedWorkspace:!0}}function wn(e){let{command:l,prefix:f}=Cn(e.executablePath,e.sourceEntrypoint),_=He({home:Dd(),temporaryDirectory:e.temporaryDirectory,path:e.path});if(_.REASON_DEVICE_ROOT=_.ARA_DEVICE_ROOT=e.grantedRoot,_.REASON_HANDS_WORKSPACE=_.ARA_HANDS_WORKSPACE=e.workRoot,_.REASON_HANDS_REPO=_.ARA_HANDS_REPO=e.root,e.workspacePoolPath)_.REASON_HANDS_WORKSPACE_POOL=_.ARA_HANDS_WORKSPACE_POOL=e.workspacePoolPath;return{command:l,args:[...f,"__device","__hands-worker","--config",e.configPath],options:{cwd:e.root,env:_,shell:!1,stdio:[bn,"ignore","pipe"]}}}var bn=process.platform==="win32"?"pipe":"ignore";function st(e,l){if(process.platform!=="win32")return e.kill(l);if(l==="SIGTERM")e.stdin?.end();else if(e.pid)Me(e.pid);return!0}function rl(e,l){let f="",_=!1,w=Date.now(),S=0,I=new Set(["connecting","open","dial_pending","socket_error","close","claim_accepted","claim_rejected","stopping","stopped","request_cancelled","permission_denied"].map((F)=>`hands.worker.${F}`)),W=new Set([null,"open_not_received","current_connection","obsolete_connection","request_aborted","request_timeout","client_closed","driver_stopped","driver_handoff","run_cancelled","run_finished","other","frame_too_large","invalid_json","invalid_claim","executor_mismatch","stale_generation","fence_conflict","SIGTERM","SIGINT","SIGHUP","expired","cleanup_complete","cleanup_failed","cancelled","settled","unsupported","unconfirmed",...["sandbox_policy","os_permission_unknown"].flatMap((F)=>["bash","read","write","edit"].map((T)=>`${F}:${T}`))]),x=["timestampMs","connectionAttempt","connectionGeneration","targetGeneration","activeRequestCount","remainingLifetimeMs","suppressedDiagnostics"],M=["peerGeneration","socketState","closeCode"],G=new Set(["event","reason","launchId",...x,...M]);return(F)=>{for(let T of F.toString().split(/(?<=\n)/)){let re=T.endsWith(`
-`);if(!_&&f.length+T.length<=2048)f+=T;else _=!0;if(!re)continue;let J=f;if(f="",_){_=!1;continue}try{let z=JSON.parse(J);if(!z||typeof z!=="object"||Array.isArray(z)||Object.keys(z).some((fe)=>!G.has(fe))||!I.has(z.event)||!W.has(z.reason)||z.event==="hands.worker.permission_denied"!==(typeof z.reason==="string"&&z.reason.includes(":"))||z.launchId!==e||x.some((fe)=>!Number.isSafeInteger(z[fe])||z[fe]<0)||M.some((fe)=>z[fe]!==null&&(!Number.isSafeInteger(z[fe])||z[fe]<0)))continue;if(Date.now()-w>=60000)w=Date.now(),S=0;if(S>=122)continue;S+=1,l(z)}catch{}}}}async function tl(e){let l=e.now()+e.timeoutMs;while(e.now()<l){if(e.signal.aborted)throw new r("cancelled","Reason Hands start was cancelled.");if(e.spawnFailed?.()||e.child.exitCode!==null||e.child.signalCode!==null)throw new r("hands_worker_exited","Reason Hands exited before ready.");let f=on(e.path,{pid:e.child.pid??-1,launchId:e.launchId,workerVersion:D,protocolVersion:P,workerArtifactSha256:b,workerEntrypoint:R});if(f?.targetGeneration===e.targetGeneration&&f.fenceId===e.fenceId)return f;await new Promise((_)=>setTimeout(_,10))}throw new r("hands_ready_timeout","Reason Hands did not become ready.")}function nl(e){let l=e.exitCode===null?void 0:En[e.exitCode];return{exit_code:e.exitCode,exit_signal:e.signalCode,...l?{exit_reason:l}:{}}}async function ol(e,l){let f=()=>e.exitCode===0&&e.signalCode===null;if(e.exitCode!==null||e.signalCode!==null)return f()?"stopped":"already_exited";let _=new Promise((I)=>e.once("exit",()=>I()));try{if(!st(e,"SIGTERM"))return f()?"stopped":"unobserved"}catch{return f()?"stopped":"unobserved"}if(await ci(_,l))return f()?"stopped":"unobserved";try{st(e,"SIGKILL")}catch{}return await ci(_,l)?"forced":"unobserved"}async function ci(e,l){let f;try{return await Promise.race([e.then(()=>!0),new Promise((_)=>{f=setTimeout(()=>_(!1),l)})])}finally{clearTimeout(f)}}function sl(e){return new Promise((l)=>{let f=!1,_=(W)=>{if(f)return;f=!0,clearTimeout(I),e.signal.removeEventListener("abort",w),e.child.off("exit",S),l(W)},w=()=>_("cancelled"),S=()=>_("exited"),I=setTimeout(()=>_("expired"),Math.max(0,e.expiresAt-e.now()));if(e.signal.addEventListener("abort",w,{once:!0}),e.child.once("exit",S),e.signal.aborted)w();else if(e.child.exitCode!==null||e.child.signalCode!==null)S()})}var il=oo();function al(e,l){if(!(e instanceof Error)||e instanceof r)return!1;let f=["hands_browser_driver_missing","hands_browser_driver_version_mismatch","hands_browser_executable_missing","hands_browser_unsupported_platform","hands_browser_unavailable"].includes(e.message),_=["ENOENT","EACCES","EPERM"].includes(e.code??"");if(!f&&!_)return!1;try{return cr(l),!1}catch(w){return Pt(w)&&w.code==="ENOENT"}}function cl(e){return e.sandbox_provider==="compute"&&!e.cloud_browser&&e[Ye]===qr}function dl(e,l,f){return e===void 0?{}:{dispatch_stages:{version:1,claim_to_entered_ms:Nr(e,l),...f===void 0?{}:{worker_prespawned:f}}}}async function Ot(e,l={}){let f=l.logDiagnostic??((le)=>console.warn(le)),_=new Map,w=(le)=>{let he=Date.now();_.set(le,he);try{f(JSON.stringify({event:"sandbox.hands_startup",stage:le,timestampMs:he}))}catch{}};w("entered");let S=e.claimEnvironment;e.claimEnvironment=void 0;let I=l.now??Date.now,W,x=Fd(e.payload,l.now?.(),(le)=>{W=le});if(e.managedPty&&(e.managedPty.version!==1||!e.headless||!e.runtimeDirectory||![void 0,!0].includes(e.managedPty.startupVerified)||!e.deviceIdentity||!e.claimOwner||e.claimOwner.device_id!==e.deviceIdentity.deviceId||!x.environment_binding||!["darwin","linux","win32"].includes(process.platform)))throw new r("pty_unsupported","Bound PTY requires qualified headless Hands with private jobs and environment.");let M=async(le)=>{let he;try{await Promise.race([le,new Promise((xe,Ke)=>{he=setTimeout(()=>Ke(new r("hands_event_delivery_unavailable","Hands event delivery did not settle within its deadline.")),Math.max(1,Math.min(l.eventDeliveryTimeoutMs??5000,5000)))})])}finally{clearTimeout(he)}},G=async(le,he)=>M(e.emitEvent(le,he));if(e.headless&&(x.cloud_browser===!0||e.managedBrowser!==void 0||x[St]!==void 0||x[Ye]!==void 0&&x[Ye]!==Br))throw new r("invalid_hands_request","Managed sandbox extensions are unavailable to a headless worker.");let F=ge(),T=x[q]===void 0?null:Rt(F);if(x[q]!==void 0&&(T===null||!e.headless||!me(e.hostExecution,l.hostIdentity?.platform,l.hostIdentity?.euid)))throw new r("hands_model_jobs_egress_unavailable","This worker cannot hold its jobs to the guest egress guard; the Hands did not start.");if(x[Y]!==void 0&&!(e.headless&&me(e.hostExecution,l.hostIdentity?.platform,l.hostIdentity?.euid)))throw new r("hands_confinement_unavailable","Confined Hands need a root Linux worker in host mode.");if(x.cloud_browser&&process.platform!=="linux")throw new r("cloud_browser_target_invalid","Cloud browser is available only on a cloud machine.");let re=`${e.operationId}:${e.attemptId}`,J=x[Ye]===kt,z=e.headless||process.platform==="darwin"&&e.managedBrowser===void 0&&!x.cloud_browser&&!x.browser_egress&&(x[Ye]===void 0||x[Ye]===Br)||cl(x),fe=J?x[St]??"bash":null,ve=fe?Ws(fe):null;if(ve)throw new r(ve,"Persistent Node REPL execution is unavailable; this benchmark profile cannot start.");let be=x[Ye],Oe=e.headless===!0&&e.ownComputer!==!0?e.handsSlots??1:void 0,$e=(l.slot??zd).acquire(re,{exclusive:Oe===1||be!==void 0&&be!==Br,...Oe!==void 0&&Oe>1?{limit:Oe}:{},...e.headless===!0&&x[Q]!==void 0?{group:x[Q]}:{}});if(!$e)throw new r("hands_slot_busy",Oe!==void 0&&Oe>1?`This Reason worker runs at most ${Oe} sessions at a time.`:"This Reason Device runs one session at a time.");let qe=e.headless===!0?Mi(e.runId):null,ye=null,Fe=null,Ve,Te;try{w("browser_resolution");let le=e.headless&&l.browserExecutablePath===void 0?await jt():null,he=J||x.cloud_browser?null:l.browserExecutablePath===void 0?e.headless?le?.status==="resolved"?le.executablePath:null:await Cs(void 0,process.platform,e.managedBrowser):l.browserExecutablePath;if(!J&&!x.cloud_browser&&!z&&!he)throw new r("hands_browser_unavailable","Reason Hands requires Chrome, Edge, Brave, Chromium, or a Playwright Chromium install.");w("path_resolution");let xe;try{xe=await(l.resolvePathEnvironment??il)()}catch{xe={path:vn(),source:"fallback"}}if(w("workspace_setup"),process.platform==="darwin"){let Qe=x[Ye]===Br&&x.workspace_path!==void 0?mo(e.root,x.workspace_worktree?x.workspace_worktree.source_path:x.workspace_path,"folder"):null;for(let ur of new Set([e.root,...Qe?[Qe]:[]]))await cs(ur)}let Le=x[Ye]===qr||x[Ye]===kt?jd(process.platform,l.sandboxRuntimeRoot):null,Be=e.headless&&e.runtimeDirectory?e.runtimeDirectory:Le?Le.temporaryRoot:di();if(ye="private_runtime",e.headless&&e.runtimeDirectory){v(Be);let Qe=er(e.root);if(!je(Qe,Be))throw new r("invalid_hands_workspace","Private worker state must not overlap the granted workspace.")}if(e.headless&&e.runtimeDirectory&&(!e.deviceIdentity||!x.environment_binding))throw new r("environment_unavailable","Headless Hands requires a server-bound private environment.");if(ye="runtime_root",Le?.prepareRoot)Tt(Be,{recursive:!0,mode:457}),Wt(Be,457);ye="temporary_directory";let ke=er(Ad(ar(Be,"reason-hands-session-")));Fe=ke,Wt(ke,Le?.sessionMode??448);let We=ar(ke,"hands-config.json"),tr=ar(ke,"hands-ready.json"),nr=vd(),Pr=x.target_fence_id;if(e.workspaceGrant){ye="workspace_grant",w("workspace_grant_wait");let Qe=e.workspaceGrant;await new Promise((ur,rt)=>{let ft=()=>rt(new r("cancelled","Reason Hands was cancelled."));if(e.signal.aborted){ft();return}e.signal.addEventListener("abort",ft,{once:!0}),Qe.then(ur,rt).finally(()=>e.signal.removeEventListener("abort",ft))})}ye="granted_root";let Ge=er(e.root);ye="workspace_layout";let or=x[Ye]===Br&&x.workspace_path!==void 0&&x.workspace_worktree?await Yd(Ge,x.workspace_path,x.workspace_worktree):void 0,{workRoot:sr,repoPath:dr,jobEnvPath:Wr,workspacePoolPath:ln,managedWorkspace:Kr,workspace:lt,cloudSessionRoot:Ft}=el({grantedRoot:Ge,personalWorkspace:x.personal_workspace===!0,runId:e.runId,workspaceId:x.workspace_id,legacyWorkspaceId:x.legacy_workspace_id,workspaceBase:x[Ce],workspaceLayout:x[Ae],temporaryDirectory:ke,workspaceMode:x[Ye],applicationSupportPath:l.applicationSupportPath,...x.workspace_path===void 0?{}:{workspacePath:x.workspace_path},...x.workspace_worktree?{workspaceWorktree:x.workspace_worktree}:{},...or?{workspaceWorktreeStart:or}:{},...e.deviceIdentity?{deviceId:e.deviceIdentity.deviceId}:{}}),Xr="ara_device_wss";ye="jobs";let lr=e.headless&&e.runtimeDirectory?hr({runtimeDirectory:e.runtimeDirectory,root:Ge,runId:e.runId}):void 0;Ve=lr?.disposeSocket;let jr=lr?Yo(lr):null;if(jr)try{f(JSON.stringify({event:"hands.journal_owner_retired",run_id:e.runId,reason:jr.reason,prior_executor_launch_id:jr.executorLaunchId}))}catch{}if(lr&&[sr,dr].some((Qe)=>!je(Qe,lr.journalDirectory)))throw new r("invalid_hands_workspace","A Session can't work in the folder that holds this worker's settings; start it in a project or repository inside it.");let ut=x.personal_workspace?sr.slice(sr.lastIndexOf("/")+1):void 0;if(ut&&ut!==x.workspace_id)throw new r("invalid_hands_workspace","Personal session identity does not match its Device grant.");ye="browser_socket";let Lr=x.cloud_browser?Md(x.sandbox_os,ut):process.platform==="win32"?`\\\\.\\pipe\\reason-repl-${nr}`:ar(lr?lr.launchDirectory:ke,"repl.sock");ye="relay_url";let Mr=ui(new URL(x.relay_url).hostname),Zr=Xr==="ara_device_wss"&&!Mr?(l.loadProxy??j)()?.url:void 0,Tr;ye="environment_owner";let Ir=e.headless&&e.deviceIdentity&&x.environment_binding?Gs(ke,{runId:e.runId,...e.deviceIdentity,binding:x.environment_binding,expiresAtMs:Date.parse(x.expires_at),identity:()=>Tr?.()??null}):void 0;ye="job_environment";let Ct=!Ir&&lt.kind==="managed"&&Kr?ar(sr,"job.env"):null;if(Ct)try{dn(Ct,"",{mode:384,flag:"wx"})}catch(Qe){if(!(Qe instanceof Error&&("code"in Qe)&&Qe.code==="EEXIST"))throw Qe}let un={url:x.relay_url,transport:Xr,...Zr===void 0?{}:{proxyUrl:Zr},...e.localGithubConfinement?{localGithubConfinement:!0}:{},...x[Y]&&Ir?{gitCredentialEnvironment:!0}:{},workerVersion:D,protocolVersion:P,workerArtifactSha256:b,workerEntrypoint:R,...process.platform==="win32"?{bashExecutable:se()}:{},targetGeneration:x.target_generation,fenceId:Pr,workRoot:sr,workspaceAliasPath:sr,jobEnvPath:Wr,...Ir?{environmentSnapshotPath:Ir.path,...e.hostExecution?{executionEnvironment:gr()}:{},environmentExpectedBinding:{runId:e.runId,...e.deviceIdentity,binding:x.environment_binding}}:Ct?{jobEnvSourcePath:Ct,workspacePoolPath:Ar(sr)}:Kr?{}:{jobEnvSourcePath:_i(sr)},repoPath:dr,replSocketPath:Lr,...x.cloud_browser?{browserRunId:e.runId}:{},readyPath:tr,launchId:nr,expiresAtMs:Date.parse(x.expires_at),bashTimeoutMs:300000,replTimeoutMs:120000,...lr?{managedJobs:{journalDirectory:lr.journalDirectory,scopeId:lr.scopeId},jobControlSocketPath:lr.socketPath}:{},...lr&&F?{jobsUser:{...F,...T!==null?{modelGid:T}:{}}}:{},...e.managedPty&&lr&&Ir?{managedPty:{version:1,...e.managedPty.startupVerified===!0?{persistent:!0}:{},...process.platform==="darwin"?{shell:_r()}:{}}}:{},...z&&!he?{allowedTools:["bash","read","write","edit"]}:J?{allowedTools:fe==="bash"?["bash"]:["bash","repl"]}:{}};if(Ir||Kr&&!Ct)dn(Wr,"",{mode:384});else Qd(sr,Wr);ye="config_write",dn(We,JSON.stringify(un),{mode:384}),ye=null;let Qr={session_id:x.session_id,environment_id:x.environment_id,hands_protocol_version:P,hands_worker_version:D,hands_worker_artifact_sha256:b,hands_worker_entrypoint:R,target_generation:x.target_generation,target_fence_id:x.target_fence_id,executor_launch_id:nr},Ut=null,ho=!1,go=!1,bo,Rr=null,wo,yo,zt="failed",vo=null,fn=Promise.resolve(),ko=null,pn=async(Qe,ur)=>{try{await G(Qe,ur)}catch{}};try{w("event_started");let Qe,ur=(async()=>{await e.emitEvent("hands.started",{...Qr,policy_mode:"full_access",policy_version:1,path_source:xe.source}),Qe=Date.now()})();ur.catch(()=>{return}),w("worker_setup");let rt=x.browser_egress?{mode:"enforce",allowedDomains:x.browser_egress.allowed_domains}:{mode:"off"};if(fe&&fe!=="bash")Ut=await(l.startNodeRepl??ti)({socketPath:Lr,workRoot:sr});else if(!J&&!x.cloud_browser&&he)Ut=await(l.startRepl??Hs)({socketPath:Lr,browserExecutablePath:he,workspaceRoot:dr,...e.managedBrowser?{managedBrowser:e.managedBrowser}:{},...e.desktopRecording?{recording:e.desktopRecording}:{},networkPolicy:rt,onEgressDenied:(Ne)=>{let Cr=js(Ne.host);f(JSON.stringify({event:"sandbox.repl_egress_denied",destination_id:Cr,reason:Ne.reason,run_id:e.runId})),fn=fn.then(()=>G("hands.browser_egress_denied",{destination_id:Cr,reason:Ne.reason})).catch((Kt)=>{ko??=Kt})}}).catch((Ne)=>{if(!z||e.signal.aborted||I()>=Date.parse(x.expires_at)||!al(Ne,Lr))throw Ne;return Object.assign(un,{allowedTools:["bash","read","write","edit"]}),dn(We,JSON.stringify(un),{mode:384}),go=!0,null});let ft=wn({configPath:We,root:dr,grantedRoot:Ge,workRoot:sr,workspacePoolPath:ln,temporaryDirectory:ke,path:xe.path,executablePath:l.executablePath,sourceEntrypoint:l.sourceEntrypoint}),mn=Date.now(),hn,So,kn=l.takePrespawnedWorker?.(ft)??null;if(bo=l.takePrespawnedWorker?kn!==null:void 0,Rr=kn??(l.spawnWorker??((Ne)=>kd(Ne.command,Ne.args,Ne.options)))(ft),!kn)l.adoptSpawnedWorker?.(Rr);Rr.stderr?.on("data",rl(nr,(Ne)=>{if(Ne.event==="hands.worker.connecting")hn??=Ne.timestampMs;else if(Ne.event==="hands.worker.open")So??=Ne.timestampMs;if(f(JSON.stringify({...Ne,run_id:e.runId})),Ne.event==="hands.worker.permission_denied"&&typeof Ne.reason==="string"){let[Cr,Kt]=Ne.reason.split(":");if(["sandbox_policy","os_permission_unknown"].includes(Cr??"")&&["bash","read","write","edit"].includes(Kt??""))G("permission.denied",{provenance:Cr,operation:Kt}).catch(()=>{return})}}));let Eo=!1;Rr.on("error",()=>{Eo=!0}),Rr.once("exit",(Ne,Cr)=>{try{f(JSON.stringify({event:"hands.worker.exited",run_id:e.runId,launchId:nr,exit_code:Ne,exit_signal:Cr}))}catch{}}),Te=Rr,w("worker_ready_wait");let Ht=await tl({path:tr,launchId:nr,fenceId:Pr,targetGeneration:x.target_generation,child:Rr,spawnFailed:()=>Eo,signal:e.signal,timeoutMs:l.readyTimeoutMs??Nd,now:I}),mi=Date.now();if(Tr=()=>{if(!Rr||Rr.exitCode!==null||Rr.signalCode!==null)return null;let Ne=on(tr,Ht);return Ne?{generation:Ne.targetGeneration,fenceId:Ne.fenceId}:null},lr){let Ne={root:Ge,runId:e.runId,operationId:e.operationId,scopeId:lr.scopeId,socketPath:lr.socketPath,generation:Ht.targetGeneration,fenceId:Ht.fenceId,executorLaunchId:nr,expiresAtMs:Date.parse(x.expires_at),readIdentity:Tr,workspace:lt,localGithubConfinement:e.localGithubConfinement===!0};if(Ir)Ne.environment=Ir;if(e.claimOwner&&e.deviceIdentity&&e.claimOwner.device_id===e.deviceIdentity.deviceId){let Cr=[e.deviceIdentity.apiOrigin,x.relay_url];if(Zr)Cr.push(Zr);Ne.previewAuthority={owner:Object.freeze({...e.claimOwner}),rootId:e.deviceIdentity.rootId,relayOrigin:new URL(x.relay_url).origin,deniedPorts:pr(Cr)}}yo=Xo(Ne)}if(await new Promise((Ne)=>{setImmediate(Ne)}),Ft)vr(sr);let $t;if(S&&Ir){try{let Ne=Ir.install(S);$t={snapshot_id:Ne.snapshot_id,installed_revision:Ne.installed_revision}}catch{}try{f(JSON.stringify({event:"hands.environment_at_claim",run_id:e.runId,installed:$t!==void 0}))}catch{}}S=void 0;let Ro=!1;if(e.headless){let Ne=Gd(dr,F);try{f(JSON.stringify({event:"hands.workspace_check",run_id:e.runId,outcome:Ne}))}catch{}if(Ne==="unready")throw new r("hands_workspace_unready","This Session's checkout is not a readable, writable directory at its own path, so Reason Hands cannot use it.");Ro=Ne==="checked"}w("event_ready");let Oo=M(ur);Oo.catch(()=>{return});let Po=Date.now();ho=!0,await G("hands.ready",{...Qr,expiry_diagnostic:W,startup_stages:{version:1,browser_resolution_ms:Nr(_.get("browser_resolution"),_.get("path_resolution")),path_resolution_ms:Nr(_.get("path_resolution"),_.get("workspace_setup")),workspace_setup_ms:Nr(_.get("workspace_setup"),_.get("event_started")),repl_setup_ms:Nr(_.get("worker_setup"),mn),worker_boot_ms:Nr(mn,hn),worker_dial_ms:Nr(hn,So),worker_ready_ms:Nr(mn,mi),started_event_ms:Nr(_.get("event_started"),Qe),started_join_wait_ms:Nr(_.get("event_ready"),Po),total_ms:Nr(_.get("entered"),Po)},...dl(e.claimedAtMs,_.get("entered"),bo),...e.managedPty?.startupVerified===!0?{managed_pty:{version:1,execution_mode:"host",descendant_cleanup_verified:!0}}:{},policy_mode:"full_access",policy_version:1,path_source:xe.source,connection_generation:Ht.generation,...$t?{environment_installed:$t}:{},...Ro?{workspace_checked:!0}:{},...z&&!Ut?{browser_state:"unavailable",browser_reason_code:go?"setup_failed":"not_resolved"}:{viewport_width:1440,viewport_height:900}}),await Oo,w("ready"),wo=Zs({path:tr,initial:Ht,signal:e.signal,isAlive:()=>Rr!==null&&Rr.exitCode===null&&Rr.signalCode===null&&I()<Date.parse(x.expires_at),publish:(Ne,Cr)=>e.emitEvent("hands.reconnected",{...Qr,target_generation:Ne.targetGeneration,target_fence_id:Ne.fenceId,connection_generation:Ne.generation},Cr),failed:()=>f(JSON.stringify({event:"hands.worker.generation_proof_failed",run_id:e.runId,executor_launch_id:nr}))});let Io=await sl({child:Rr,signal:e.signal,expiresAt:Date.parse(x.expires_at),now:I});if(Io==="cancelled"){let Ne=e.signal.reason instanceof r?e.signal.reason.code:"cancelled";throw zt=Ne,new r(Ne,"Reason Hands was cancelled.")}if(Io==="exited")throw new r("hands_worker_exited","Reason Hands exited unexpectedly.");return zt="expired",{...Qr,policy_mode:"full_access",policy_version:1,ended:"expired"}}catch(Qe){vo=Qe;let ur=Qe instanceof r?Qe.code:"hands_failed",rt=ur==="cancelled"||["run_finished","run_cancelled","driver_handoff","driver_stopped"].includes(ur);if(zt=rt?ur:"failed",!rt)await pn("hands.failed",{...Qr,reason_code:ur,...ur==="hands_worker_exited"&&Rr?nl(Rr):{}});throw Qe}finally{wo?.stop(),yo?.();let Qe=Rr?await ol(Rr,l.stopTimeoutMs??Ld):null,ur=!1;await e.desktopRecording?.close();try{await Ut?.stop()}catch{ur=!0}if(await fn,(Qe==="stopped"||Qe==="already_exited"&&!ho)&&!ur)await pn("hands.stopped",{...Qr,reason_code:zt});else if(Qe!==null||ur){if(await pn("hands.failed",{...Qr,reason_code:Qe==="forced"?"hands_stop_forced":"hands_stop_unconfirmed"}),vo===null||ur)throw new r("hands_stop_unconfirmed","Reason Hands resource cleanup could not be proven.")}if(ko!==null)throw new r("hands_egress_audit_failed","Reason Hands could not persist a browser egress denial receipt.")}}catch(le){let he=Ns(ye,le);if(he)try{f(JSON.stringify({event:"sandbox.hands_workspace_failed",...he}))}catch{}throw le}finally{try{if(!Te||Te.exitCode!==null||Te.signalCode!==null)Ve?.();if(Fe!==null&&(!Te||Te.exitCode!==null||Te.signalCode!==null))Td(Fe,{recursive:!0,force:!0})}finally{qe?.(),$e()}}}
-export{B,m,je,te,pr,Ji,hr,Zi,ot,Xi,Yi,Qi,eo,fr,to,ro,mr,no,gr,_r,gn,_n,yr,io,Ue,yn,wr,me,ge,Rt,br,vr,Sr,wn,bn,st,Ot};