@reason-machines/cli-linux-x64 0.2.505 → 0.2.507

package/bin/vm-hands/vm-hands-entry-lite-0572m6cr.js

@@ -1,344 +0,0 @@
-// @bun
-import{y as g0}from"./vm-hands-entry-lite-x3pbyg92.js";import{z as ZJ}from"./vm-hands-entry-lite-pmw3ycgc.js";import{A as e2,C as d7,D as e4}from"./vm-hands-entry-lite-rck5h8fr.js";import{I as K5,J as B5,K as z7,M as m0,Q as O7,R as C$}from"./vm-hands-entry-lite-6x5pj2y0.js";import{S as B8,U as u7}from"./vm-hands-entry-lite-0a4cy8gw.js";import{Ba as Z$,Ea as c2,Ga as z3,ga as a8}from"./vm-hands-entry-lite-zz8tr0bm.js";import{$a as x0,Xa as K9,Ya as N0,Za as E2,_a as S2,ab as l2,bb as rJ,cb as oJ,db as r9,eb as o9,fb as zJ,gb as v1,hb as $J,lb as JJ,ub as m3,vb as g3,wb as u3,xb as d3,yb as R4}from"./vm-hands-entry-lite-vqr3zrqr.js";import{Ab as g4,Bb as i9,Cb as k2,Db as s7,Gb as B9,zb as m4}from"./vm-hands-entry-lite-00y3kn86.js";import{Jb as q9,Kb as U9,Nb as h3,Wb as f3,Xb as A4}from"./vm-hands-entry-lite-ah2ep922.js";import{$b as l7,$c as r1,Ac as W9,Bc as w3,Cc as T2,Fc as y3,Kc as jJ,Mc as v5,Pc as b8,Rc as t9,Sc as J4,Uc as k9,Yb as Q1,Zb as X1,_b as p7,_c as k3,ac as c7,bc as w0,cc as J0,dc as u,ec as P4,fc as z2,gc as o2,hc as q0,kc as j9,mc as C9,pc as x9,uc as w9,vc as y9,wc as H9,xc as E3,yc as S3}from"./vm-hands-entry-lite-v0k8b768.js";import{ed as a9}from"./vm-hands-entry-lite-s8zfzv0k.js";import{kd as E9,ld as S9,sd as b9}from"./vm-hands-entry-lite-b7wy89y0.js";import{Fd as n9,wd as G7}from"./vm-hands-entry-lite-dhqmbqsh.js";import{Hd as T$}from"./vm-hands-entry-lite-3882raa5.js";import{Ld as d,Md as e,Nd as i,Od as a}from"./vm-hands-entry-lite-tafgty5k.js";import{be as G9}from"./vm-hands-entry-lite-8xe0wzp9.js";import{ne as VJ,qe as p3,te as Z3,ue as Q3}from"./vm-hands-entry-lite-s8ty42st.js";import{Ae as V$,Be as x$,Ce as M2,Ee as A7,Fe as a7,Ge as i7,Ie as L2,Je as n7,Ke as u4,Le as t7,Me as e8,Ne as G$,Oe as S5,Pe as $1,xe as W3,ye as s$}from"./vm-hands-entry-lite-g6r5xrk0.js";import{eg as Y9,og as L7,pg as e$,tf as _8,xf as C3,yf as x3,zg as G8}from"./vm-hands-entry-lite-p9fwt68c.js";import{Og as e9}from"./vm-hands-entry-lite-v0bp1v66.js";import{Vg as l8,Wg as f7,ch as v3,fh as f2,hh as FZ,ih as TZ}from"./vm-hands-entry-lite-zj3hb5jk.js";import{Vh as h9}from"./vm-hands-entry-lite-rj8yq6gp.js";import{ei as V0,fi as Y8,gi as s3,hi as a3,ii as o$,ji as M1,ki as C8,li as L5,ni as x8,oi as h$,pi as f0,qi as $2,ri as E8,ui as f$}from"./vm-hands-entry-lite-td309c1y.js";import{zi as I9}from"./vm-hands-entry-lite-1nj03gbj.js";import{uj as s2,vj as l9}from"./vm-hands-entry-lite-k9n1pk42.js";import{Uj as b7,ak as c9,bk as _4,dk as V9}from"./vm-hands-entry-lite-r374pchj.js";import{gk as j8,hk as g7,ik as z4,jk as x5,kk as E5,lk as J2}from"./vm-hands-entry-lite-3rg3znp8.js";import{mk as U0,ok as L3}from"./vm-hands-entry-lite-56v9haps.js";import{Mk as r}from"./vm-hands-entry-lite-q9g11dbj.js";import{$k as v7,Tk as Y$,Yk as P$,Zk as C0,_k as Z5,al as m7}from"./vm-hands-entry-lite-e1xjfj57.js";import{bl as p2,cl as R2}from"./vm-hands-entry-lite-8p8hz0j1.js";import{dl as B}from"./vm-hands-entry-lite-e4hwb89r.js";import{gl as b3}from"./vm-hands-entry-lite-r665z809.js";import{ll as v0}from"./vm-hands-entry-lite-v4r1fggm.js";import{ml as s9,ol as V2,sl as j3}from"./vm-hands-entry-lite-kqbats5n.js";import{Gl as jG}from"./vm-hands-entry-lite-pkk555dx.js";import{spawn as r7,spawnSync as WG}from"child_process";import{closeSync as o7,existsSync as DG,mkdirSync as _G,openSync as e7,readdirSync as zG,realpathSync as K$,rmSync as W2}from"fs";import{hostname as OG}from"os";import{dirname as d4,join as M0,resolve as AG}from"path";var X8={ENOENT:"native_enoent",EACCES:"native_permission_denied",EPERM:"native_permission_denied",ETIMEDOUT:"native_timeout",ECONNREFUSED:"native_network",ECONNRESET:"native_network",ENOTFOUND:"native_network",EAI_AGAIN:"native_network",ENETUNREACH:"native_network",EHOSTUNREACH:"native_network",EPIPE:"native_pipe_closed",ENOSPC:"native_disk_full",EMFILE:"native_too_many_files",EBUSY:"native_busy",E2BIG:"native_args_too_large"};function o4($){if(!($ instanceof Error))return $===void 0||$===null?"native_no_error":"native_non_error";let J=$.code;if(typeof J==="string"&&X8[J])return X8[J];let Z=$.message;if($.name==="TimeoutError"||$.name==="AbortError")return"native_timeout";if(/No handler registered for /.test(Z))return"ipc_handler_missing";if(/could not be cloned/i.test(Z))return"ipc_clone_failed";if(/Render frame was disposed|Object has been destroyed|WebContents was destroyed/i.test(Z))return"ipc_window_closed";let Q=/\b(E[A-Z0-9]{2,15})\b/.exec(Z)?.[1];if(Q&&X8[Q])return X8[Q];if(/timed? ?out|timeout/i.test(Z))return"native_timeout";if(/fetch failed|failed to fetch|network|socket hang up|getaddrinfo/i.test(Z))return"native_network";if($.name==="TypeError"&&Z==="Load failed")return"native_network";if(/unexpected token|is not valid JSON|JSON\.parse|Unexpected end of JSON/i.test(Z))return"native_unreadable_output";if(/keychain|secitem|errSec/i.test(Z))return"native_keychain_error";if(/Error invoking remote method/.test(Z))return"ipc_remote_error";switch($.name){case"TypeError":return"native_type_error";case"RangeError":return"native_range_error";case"SyntaxError":return"native_unreadable_output"}return"native_unexpected"}import{createHash as LZ}from"crypto";import{unlinkSync as jZ}from"fs";import{platform as WZ}from"os";import{join as DZ}from"path";var $5=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),k$=($)=>DZ($,"api-key.json");function _$($){let J=LZ("sha256").update(`reason-connect-api-key
-${$}`).digest("hex");return new o$(Y8(),WZ(),J)}function F1($,J,Z=_$($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),a(k$($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof V0))throw Q}a(k$($),{version:1,store:"file",api_key:J})}function p0($,J=_$($)){if(!d(k$($)))return null;let Z=$5.parse(JSON.parse(i(k$($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof V0))throw Q;throw Error("worker_api_key_unreadable")}}function J5($,J=_$($)){if(!d(k$($)))return;if($5.parse(JSON.parse(i(k$($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof V0))throw Z}jZ(k$($))}async function T1($,J){let Z;try{Z=await e4({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:w0($.proxy)})}catch(Q){if(Q instanceof m0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as mZ,renameSync as gZ,rmSync as v$}from"fs";import{join as H0}from"path";import{createHash as _Z}from"crypto";import{realpathSync as zZ,statSync as OZ,unlinkSync as V8}from"fs";import{platform as AZ}from"os";import{join as y0}from"path";function p($){return{state:y0(u($),"device.json"),control:y0(u($),"control.json"),lock:y0(u($),"lifecycle.lock"),socket:y0(u($),"control.sock"),daemon:y0(u($),"daemon.json"),releaseCheck:y0(u($),"release-check.json"),updateDeferral:y0(u($),"update-deferral.json"),firstHeartbeat:y0(u($),"first-heartbeat.json")}}var PZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max(e$).optional()});function Q5($,J,Z){e(u($),!0),a(p($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function L1($,J){let Z=p($).firstHeartbeat;try{if(!d(Z))return null;let Q=PZ.safeParse(JSON.parse(i(Z)));if(V8(Z),!Q.success||Q.data.device_id!==J)return null;let X=G8(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(u($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(u($),Q);if(!d(X))return!1;return i(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?j1($):new M1(u($))}function K8($,J){T0($,!0),CZ($);let Z=J??j1($),Q=new M1(u($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof V0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function j1($){return new o$(Y8(),AZ(),RZ($))}function RZ($){let J=W1($);return _Z("sha256").update(`reason-worker
-${J?.directory??u($)}`).digest("hex")}function O2($,J){a(y0(u($),A2),{version:1,directory:W1($)?.directory??u($),devicePublicKey:J})}var A2="keychain-scope.json";function X5($){return d(y0(u($),A2))}var IZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function W1($){let J=y0(u($),A2);if(!d(J))return null;let Z=IZ.safeParse(JSON.parse(i(J))),Q=p($).state;if(!Z.success||!d(Q))return null;return JSON.parse(i(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function CZ($){let J=y0(u($),A2);if(!d(J))return;if(W1($))try{let Z=j1($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof V0))throw Z}V8(J)}function H$($){let J=zZ($.workspaceRoot);if(J!==$.workspaceRoot||!OZ(J).isDirectory()||!z2(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function o($){if(!d(u($)))return null;let J=h$(p($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&Z5($.apiOrigin,J.apiOrigin),Q=Z?[q0($),q0({...$,apiOrigin:J.apiOrigin})]:[q0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var Y5=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=p($).control;return d(J)?Y5.parse(JSON.parse(i(J))):{version:1,drained:!1,revoked:!1}}function I0($,J){a(p($).control,Y5.parse(J))}function k0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(u($),A2);if(d(Z))V8(Z);let Q=p($).state;if(d(Q))V8(Q)}var xZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),D1=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:xZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),EZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),_1=30000;class $$ extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function SZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(_1)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new $$(X?.error==="device_revoked")}return Q.json()}async function z1($,J,Z,Q){g0();let X=D1.parse(JSON.parse(i(J)));return J$($,X,Z,Q)}async function J$($,J,Z,Q=(Y,V)=>SZ(Y,V,w0($.proxy)),X=performance.now()){let Y=G5($,J,Z),V=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(V,X)}async function V5($,J,Z,Q,X=performance.now()){let Y=G5($,J,Z),V=await Q(Y.request,J.code_verifier);return V===null?null:Y.receipt(V,X)}function G5($,J,Z){if(g0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=f$([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((G,H)=>{let F=f$([G],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(F.path!==G||F.pathFingerprint!==J.folders?.[H]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return F});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],V;try{V=Z.loadPublicKey()}catch{V=Z.createFreshPublicKey()}return{request:{device_public_key:V,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:J.root.permissions}))},receipt(G,H){let F=EZ.parse(G);if(F.organization_id!==J.organization_id||F.roots.length!==Y.length||F.roots.some((K,N)=>K.path_fingerprint!==Y[N].pathFingerprint)||F.headless.lifecycle!==$.lifetime||Date.parse(F.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let q=G8(F.first_heartbeat);try{Q5($,F.device_id,{...q?{offer:q}:{},enrollmentMs:Math.min(e$,Math.max(0,Math.round(performance.now()-H)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:F.organization_id,deviceId:F.device_id,devicePublicKey:V,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:q0($),lifetime:$.lifetime,expiresAt:F.headless.expires_at},roots:F.roots.map((K,N)=>({id:K.id,label:K.label,path:Y[N].path,pathFingerprint:K.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as bZ,randomUUID as wZ}from"crypto";import{unlinkSync as yZ}from"fs";import{join as kZ}from"path";var q5=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),hZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function O1($){return hZ.parse($)}var fZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function z$($){return B8(R2("REASON_CLI_CHANNEL",$.channel),U0())}async function O$($,J=z$($)){if(!d(J))return null;let Z=fZ.parse(JSON.parse(i(J)));if(!C0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=w0($.proxy),X=Object.assign((V,U)=>Q(V,{...U,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await B5({path:J,fetchImpl:X});if(Y&&!C0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function U5($,J,Z){if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A$($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function H5($,J,Z,Q,X){let Y=performance.now();if(!C0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let V=A$($),U=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(U){let G=await V5($,V.direct(J.orgId),Q,(H,F)=>U({approval:V.request,code_verifier:F,registration:H}).catch((q)=>{throw vZ(q)}),Y);if(G)return G}return J$($,V.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(V.request)),Q,X,Y)}function vZ($){if(!($ instanceof m0))return $;if($.status===409)return new $$($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new $$(!1);return $}var P2=($)=>kZ(u($),"enrollment-install.json");function N5($){if(d(P2($)))yZ(P2($))}function A$($,{stored:J=!0}={}){g0();let Z=P2($),Q=J&&d(Z)?q5.parse(JSON.parse(i(Z))):{version:1,install_id:wZ(),fingerprint_key:bZ(32).toString("hex")};if(J&&!d(Z))a(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),V=f$([$.workspaceRoot],X,Y)[0];if(V.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let U=($.folders??[]).map((q)=>{let K=f$([q],X,Y)[0];if(K.path!==q)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:K.pathFingerprint}}),G=K5(),H={install_id:Q.install_id,code_challenge:G.challenge,lifecycle:$.lifetime,roots:[V.pathFingerprint,...U.map((q)=>q.path_fingerprint)].map((q)=>({path_fingerprint:q,permissions:X,execution_mode:$.executionMode}))},F=(q)=>({version:1,organization_id:q,code_verifier:G.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:V.pathFingerprint,permissions:X,execution_mode:$.executionMode},...U.length?{folders:U}:{}});return{request:H,saveInstall(q){e(u(q),!0),a(P2(q),Q)},complete(q,K){let N=O1(K);if(N.lifecycle!==$.lifetime||Date.parse(N.expires_at)<=Date.now()||Date.parse(N.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...F(q),enrollment_ticket:N.enrollment_ticket}},direct:F}}function F5($,J,Z){let Q=P2($);if(!d(Q))throw Error("worker_folders_unavailable");let X=q5.parse(JSON.parse(i(Q)));return f$([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var q8=8,R1=600000,j5=15000,uZ=3600000,dZ=new Set(["device_not_eligible","sign_in_not_eligible"]),T5=new Set(["device_revoked","invalid_device_credential"]),U8=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,N$=($)=>H0(u($),"workspaces"),W5="account.json",A1=($)=>d(H0($,W5));function h0($){let J;try{J=mZ(N$($))}catch{return[]}return J.filter((Z)=>U8.test(Z)).sort().map((Z)=>{let Q=H0(N$($),Z),X=H0(Q,"worker.json"),Y=null;try{let V=J0.safeParse(JSON.parse(i(X)));if(V.success&&V.data.stateDirectory===Q)Y=V.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:A1(Q)}})}function H8($,J){let Z=J.toLowerCase();if(!U8.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:H0(N$($),Z)});return e(Q.stateDirectory,!0),a(H0(Q.stateDirectory,W5),{version:1}),{config:Q,configPath:H0(Q.stateDirectory,"worker.json")}}function N8($,J){try{let{config:Z,configPath:Q}=H8($,J);e(u(Z),!0),I0(Z,{version:1,drained:!0,revoked:!0}),a(Q,Z)}catch{}}function I2($,J){let Z=J.toLowerCase(),Q=null;try{Q=o($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var P1=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function M5($,J){let Z=o($);if(!Z?.worker)throw Error("worker_identity_missing");O2($,Z.devicePublicKey),e(u(J),!0);for(let Y of P1)v$(H0(u(J),Y),{force:!0});for(let Y of P1){let V=H0(u($),Y);if(d(V))gZ(V,H0(u(J),Y))}let Q=T0(J),X=h$(p(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");f0({...X,worker:{...X.worker,configDigest:q0(J)}},p(J).state,{proofStore:Q})}function I1($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&d(p(J.config).state))k0(J.config)}catch{}v$(J.directory,{recursive:!0,force:!0})}v$(x1($),{force:!0})}function F8($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(q)=>Number(Date.parse(q.worker?.expiresAt??"")>X+60000),U=h0($).flatMap((q)=>{if(!q.account||!q.config)return[];try{if($0(q.config).revoked)return[];let K=o(q.config);return K&&K.orgId.toLowerCase()===q.organizationId&&(!Q||Y(K))?[{...q,config:q.config,state:K}]:[]}catch{return[]}}).sort((q,K)=>Number(K.organizationId===J)-Number(q.organizationId===J)||Y(K.state)-Y(q.state))[0];if(!U)return null;let G=null;try{G=$0($).revoked?null:o($)}catch{}let H=G?.orgId.toLowerCase()??"";if(Z&&G&&U8.test(H)&&H!==U.organizationId){let q=H8($,H);M5($,q.config),a(q.configPath,q.config)}else if(d(u($))){try{if(d(p($).state))k0($)}catch{}for(let q of P1)v$(H0(u($),q),{force:!0})}I1($);let F=J0.parse({...U.config,stateDirectory:$.stateDirectory});return M5(U.config,F),a(H0($.stateDirectory,"worker.json"),F),v$(U.directory,{recursive:!0,force:!0}),F}var C1={before($){for(let{config:J}of h0($))try{let Z=J?o(J):null;if(J&&Z)O2(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let V=J0.parse(JSON.parse(i(X)));if(V.stateDirectory!==H0(N$($),Z))continue;let U=J0.parse({...V,stateDirectory:Q}),G=T0(U),H=h$(p(U).state,{proofStore:G,repair:!1});if(H?.worker?.configDigest===q0(V))f0({...H,worker:{...H.worker,configDigest:q0(U)}},p(U).state,{proofStore:G});a(X,U)}catch{}}}},x1=($)=>H0(N$($),"listed.json");function D5($){try{let J=JSON.parse(i(x1($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((X)=>typeof X[1]==="string")):{},Q=J.refused&&typeof J.refused==="object"?J.refused:null;return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((X)=>typeof X==="string"):[],names:Z,...Q&&typeof Q.device==="string"&&typeof Q.roots==="string"&&typeof Q.at==="number"&&Number.isFinite(Q.at)&&typeof Q.count==="number"&&Number.isInteger(Q.count)&&Q.count>=1?{refused:{device:Q.device,roots:Q.roots,at:Q.at,count:Q.count}}:{}}}catch{return null}}function _5($,J){let Z=h0($),Q=Z.filter((G)=>G.account),X=Z.filter((G)=>!G.account),Y=D5($),V=Y&&!Y.listed?Y.reason:null,U=V||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&U.length===0&&(V||Y&&!Y.listed))return{workspaces:null,off:V};return{off:V,workspaces:[...Q,...U].map(({organizationId:G,config:H,account:F})=>{let q=!1,K=null,N=!1,T=null;try{q=H?$0(H).revoked:!1,K=H&&!q?o(H):null;let M=H?$2(p(H).daemon):null;N=J&&!!K&&M?.state==="connected",T=N?L5(M,K):null}catch{}return{...T?{permission_recovery:T}:{},organization_id:G,device_id:K?.deviceId??null,name:Y?.names?.[G]??null,root:K?.roots[0]?{id:K.roots[0].id,permissions:K.roots[0].permissions}:null,state:q?"removed":N?"connected":"not_running",blocked:!F&&!q&&!N&&(Y?.blocked.includes(G)??!1),...F?{account:!0}:{}}})}}function z5($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),V=$.intervalMs??R1,U=new Map,G=null,H=!1,F=D5(J)??{listed:!1,reason:null,blocked:[]},q=()=>Z.roots.map((P)=>P.id).join(","),K=(P)=>{if(!P||P.device!==Z.deviceId||P.roots!==q())return!1;let W=Date.now();return W>=P.at&&W<P.at+Math.min(uZ,V*2**Math.min(P.count-1,10))},N=(P)=>{let{folders:W,...O}=J,y=Z.roots.slice(1).map((b)=>b.path);return J0.parse({...O,...y.length?{folders:y}:{},stateDirectory:H0(N$(J),P)})},T=async(P)=>{let W=U.get(P);if(!W)return;W.controller.abort(),await W.done},M=(P,W=!1)=>{let O=new AbortController,y=()=>O.abort();if(X.addEventListener("abort",y,{once:!0}),X.aborted)O.abort();let b={...P,controller:O,claims:0,done:Promise.resolve(),account:W};b.done=$.serve(P,O.signal,(w)=>{b.claims=w}).then(()=>{return},(w)=>{if(W&&w instanceof N0&&w.status===401&&T5.has(w.code)){try{I0(P.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${P.organizationId} (another account's) no longer accepts this computer (${w.code}); run \`reason connect\` signed in as that account to connect it again
-`)}else if(w instanceof N0&&w.status===401&&T5.has(w.code)){try{k0(P.config)}catch{}Y(`Reason worker: workspace ${P.organizationId} no longer accepts this computer
-`)}else if(!O.signal.aborted)Y(`Reason worker: workspace ${P.organizationId} stopped (worker_workspace_failed); it starts again on the next check
-`)}).finally(()=>{if(O.abort(),X.removeEventListener("abort",y),b.claims=0,U.get(P.organizationId)===b)U.delete(P.organizationId);let w=P.config.stateDirectory;if(W&&!A1(w)&&!d(H0(w,"worker.json")))v$(w,{recursive:!0,force:!0})}),U.set(P.organizationId,b)},L=(P,W)=>{if(!W)return null;try{let O=N(P),y=o(W);if(!y||y.orgId!==P||Date.parse(y.worker?.expiresAt??"")<=Date.now()+60000||W.name!==O.name||W.executionMode!==O.executionMode||!C0(W.apiOrigin,O.apiOrigin)||y.roots.map((b)=>b.path).join(`
-`)!==Z.roots.map((b)=>b.path).join(`
-`))return null;return{organizationId:P,config:W,state:y,proofStore:T0(W)}}catch{return null}},D=(P,W)=>{if(!W)return null;try{if($0(W).revoked)return null;let O=o(W);if(!O||O.orgId.toLowerCase()!==P||Date.parse(O.worker?.expiresAt??"")<=Date.now()+60000||W.executionMode!==J.executionMode||!C0(W.apiOrigin,J.apiOrigin))return null;return{organizationId:P,config:W,state:O,proofStore:T0(W)}}catch{return null}},_=(P,W)=>P.deviceId===W.deviceId&&P.devicePublicKey===W.devicePublicKey&&JSON.stringify(P.roots.map((O)=>[O.id,O.path]))===JSON.stringify(W.roots.map((O)=>[O.id,O.path])),j=async(P)=>{for(let[W,O]of P){if(X.aborted)return;let y=U.get(W),b=D(W,O.config);if(y&&b&&_(y.state,b.state))continue;if(y){if(y.claims>0)continue;await T(W)}if(b&&!X.aborted)M(b,!0)}for(let[W,O]of U)if(O.account&&!P.has(W)&&O.claims===0)await T(W)},z=async(P)=>{let W=N(P),O=J0.parse({...W,stateDirectory:J.stateDirectory});if(!d(H0(u(J),"enrollment-install.json")))return null;let y=A$(O),b=await Q.ownerWorkspaceEnrollment(Z,{organization_id:P,install_id:y.request.install_id,code_challenge:y.request.code_challenge},X),w=y.complete(P,b);if(e(u(W),!0),d(p(W).state))k0(W);let l=K8(W);try{let k=await J$(W,w,l,$.enroll);return f0(k,p(W).state,{proofStore:l}),I0(W,{version:1,drained:!1,revoked:!1}),a(H0(W.stateDirectory,"worker.json"),W),{organizationId:P,config:W,state:k,proofStore:l}}catch(k){if(k instanceof $$&&k.deviceRemoved)return I0(W,{version:1,drained:!0,revoked:!0}),a(H0(W.stateDirectory,"worker.json"),W),null;throw k}},A=async()=>{let P=h0(J),W=new Map(P.filter((R)=>R.account).map((R)=>[R.organizationId,R]));await j(W);let O=new Map(P.filter((R)=>!R.account).map((R)=>[R.organizationId,R])),y=(R)=>W.has(R)||U.get(R)?.account===!0||A1(H0(N$(J),R)),b=(R)=>{let c=O.get(R)?.config;try{return c?$0(c).revoked:!1}catch{return!1}};for(let[R,c]of O){if(U.has(R)||b(R)||F.blocked.includes(R))continue;let n=L(R,c.config);if(n&&!X.aborted)M(n)}if(K(F.refused))return!0;let w;try{w=await Q.ownerWorkspaces(Z,X)}catch(R){let c=R instanceof N0&&R.status===403&&dZ.has(R.code),n=F.refused,K0=q(),R0=c?{device:Z.deviceId,roots:K0,at:Date.now(),count:n?.device===Z.deviceId&&n.roots===K0?n.count+1:1}:n;return F={listed:!1,blocked:F.blocked,...F.names?{names:F.names}:{},reason:R instanceof N0&&R.status===403&&R.code==="sign_in_not_eligible"?"sign_in":null,...R0?{refused:R0}:{}},c}let l=new Map(w.map((R)=>[R.id.toLowerCase(),R.blocked]).filter(([R])=>U8.test(R)&&R!==Z.orgId.toLowerCase()&&!y(R))),k=[...l.keys()].filter((R)=>O.has(R)?!b(R):!l.get(R)).slice(0,q8),C=[...U.values()].filter((R)=>!R.account&&R.claims>0&&!k.includes(R.organizationId)).length,S=k.filter((R)=>!O.has(R)),E=S.slice(S.length-Math.min(Math.max(0,k.length+C-q8),S.length)),v=k.filter((R)=>!E.includes(R)),f=Object.fromEntries(w.flatMap((R)=>R.name&&v.includes(R.id.toLowerCase())?[[R.id.toLowerCase(),R.name]]:[]));F={listed:!0,reason:null,blocked:v.filter((R)=>l.get(R)),names:f};for(let R of new Set([...O.keys(),...U.keys()])){if(v.includes(R)||y(R))continue;if(l.has(R)&&b(R))continue;if((U.get(R)?.claims??0)>0)continue;await T(R);let c=O.get(R)?.config;try{if(c&&d(p(c).state))k0(c)}catch{}v$(H0(N$(J),R),{recursive:!0,force:!0}),Y(`Reason worker: left workspace ${R}
-`)}for(let R of v){if(X.aborted)return!0;if(y(R))continue;try{let c=U.get(R);if(l.get(R)){if(c&&c.claims===0)await T(R),Y(`Reason worker: offline in workspace ${R} (outside its allowed networks)
-`);continue}let n=L(R,O.get(R)?.config??null);if(n&&c)continue;if(!n){if(c&&c.claims>0)continue;if(await T(R),n=await z(R),n)Y(`Reason worker: connected in workspace ${R}
-`)}if(n&&!X.aborted)M(n)}catch{Y(`Reason worker: could not connect in workspace ${R} (worker_workspace_failed); it is tried again
-`)}}return!0},I=null,x=async()=>{let P=!1;do H=!1,P=await A().catch(()=>!1);while(H&&!X.aborted);let W=JSON.stringify({version:1,...F});if(I!==W)try{e(N$(J),!0),a(x1(J),JSON.parse(W)),I=W}catch{}return P};return{check(){if(G)H=!0;else G=x().finally(()=>{G=null});return G},claims:()=>[...U.values()].reduce((P,W)=>P+W.claims,0),async settled(){await G,await Promise.all([...U.values()].map((P)=>P.done))}}}import{dirname as pZ}from"path";function P5($){let J={saved:$.saved,configPath:$.configPath};if(!$.saved||!lZ($.saved))return J;let Z=$.saved,Q=(V,U)=>$.log(JSON.stringify({event:"worker.api_origin_move",outcome:V,...U?{code:`worker_api_origin_move_${V}:${U}`}:{},timestamp:new Date().toISOString()})),X=$.native===void 0?J2():$.native;if(!X)return J;let Y=[];try{let V=X.lock(pZ($.configPath));if(!V)return J;if(Y.push(V),d(u(Z))){let F=Z$({path:p(Z).lock,runtimeVersion:r});if(!F.acquired)return J;Y.push(()=>F.release())}let U=J0.parse(JSON.parse(i($.configPath)));if(U.stateDirectory!==Z.stateDirectory)return J;let G=R5(U),H={saved:U,configPath:$.configPath};if(!T8(U)&&G.length===0)return Q("unchanged"),H;if(T8(U)){let F=O5(U);a($.configPath,F),H={saved:F,configPath:$.configPath}}for(let F of G)try{a(F.configPath,O5(F.config))}catch(q){Q("failed",`workspace:${A5(q)}`)}return Q("moved"),H}catch(V){return Q("failed",A5(V)),J}finally{for(let V of Y.reverse())V()}}function T8($){return P$($.apiOrigin)!==$.apiOrigin}function R5($){return h0($).filter((J)=>J.config!==null&&T8(J.config))}function lZ($){return T8($)||R5($).length>0}function O5($){let J=J0.parse({...$,apiOrigin:P$($.apiOrigin)}),Z=o($);if(!Z)return J;if(!Z.worker)throw Error("worker_identity_missing");let Q=q0(J);if(Z.apiOrigin!==J.apiOrigin||Z.worker.configDigest!==Q)f0({...Z,apiOrigin:J.apiOrigin,worker:{...Z.worker,configDigest:Q}},p(J).state,{proofStore:T0(J)});return J}function A5($){if($ instanceof V0)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{chmodSync as cZ,lstatSync as b1,readdirSync as b5,readlinkSync as sZ,unlinkSync as aZ}from"fs";import{join as z0,sep as iZ}from"path";var M8="rehome.json";class L8 extends Error{code;constructor($){super($);this.code=$}}function w5($){let J={saved:$.saved,configPath:$.configPath},Z=z0($.home,".config"),Q=z0(Z,"ara"),X=$.channel==="production"?["connect"]:[$.channel,"connect"],Y=z0(Q,...X),V=z0(Z,"reason",...X),U=(q,K)=>$.log(JSON.stringify({event:"worker.state_rehome",outcome:q,...K?{code:`worker_state_rehome_${q}:${K}`}:{},timestamp:new Date().toISOString()})),G=$.native===void 0?J2():$.native,H=$.saved,F=[];try{if(H&&C5(Q)&&H.stateDirectory===Y){let D={...H,stateDirectory:V};if(!E1(G,V,D,F))return J;return I5(H,D,$.host,U)}if(H&&C5(Q)&&H.stateDirectory===V&&X5(H)&&E1(G,V,H,F))return y5({...H,stateDirectory:Y},H,$.host),J;if(!H||H.lifetime!=="persistent"||H.stateDirectory!==Y||!Z2(Q)?.isDirectory())return J;if($6(Y)===r)return J;let K=(D,_=!0)=>{if(_)a(z0(Y,M8),{version:r});return U("skipped",D),J},N=[Y];for(let D of tZ(Q,Y)){if(D.config?.lifetime!=="ephemeral")return K("several_connections");if(!nZ(D.directory,D.config,F))return K("once_running",!1);N.push(D.directory)}if(!G)return K("config_rename_unavailable:no_native");if(!E1(G,Y,H,F))return J;let T=o(H);if(!T||$0(H).revoked)return J;if(x5(Z)!==null)return K("conflicting_identity");if(E5(Z)!==null)return K("conflicting_files");if(Z2(V)&&(!Z2(V).isDirectory()||b5(V).length>0))return K("connection_folder_taken");O2(H,T.devicePublicKey),C1.before(H);let M=p0(Y);if(M&&S1(Y))rZ(V,M);let L=j8(Z,G,N);if(L.state!=="renamed"&&L.state!=="linked"){if(M&&S1(Y))k5(V);return K(L.problem??"config_folder_kept")}return I5(H,{...H,stateDirectory:V},$.host,U)}catch(q){try{if(Z2(Y)?.isDirectory())a(z0(Y,M8),{version:r})}catch{}return U("failed",J6(q)),eZ(H,Y,V,J)}finally{for(let q of F.reverse())q()}}function I5($,J,Z,Q){let X=b1(J.stateDirectory);if(X.isDirectory()&&X.uid===process.getuid?.()&&(X.mode&63)!==0)cZ(J.stateDirectory,448);let Y=T0(J),V=h$(p(J).state,{proofStore:Y,repair:!1});if(!V?.worker)throw new L8("identity_missing");let U=q0(J);if(V.worker.configDigest===q0($))f0({...V,worker:{...V.worker,configDigest:U}},p(J).state,{proofStore:Y});else if(V.worker.configDigest!==U)throw new L8("worker_config_binding_mismatch");a(z0(J.stateDirectory,"worker.json"),J),C1.after($,J),y5($,J,Z);let G=z0(J.stateDirectory,M8);if(d(G))aZ(G);return Q("moved"),{saved:J,configPath:z0(J.stateDirectory,"worker.json")}}function y5($,J,Z){if(S5($,J,Z,"connect"),!S1(J.stateDirectory))return;let Q=oZ(_$($.stateDirectory));if(!Q)return;let X=_$(J.stateDirectory),Y;try{Y=X.loadBinding()}catch{return}if(!Y)X.createBinding(Q);k5($.stateDirectory)}function E1($,J,Z,Q){if($){let Y=$.lock(J);if(!Y)return!1;Q.push(Y)}if(!d(u(Z)))return!0;let X=Z$({path:p(Z).lock,runtimeVersion:r});if(!X.acquired)return!1;return Q.push(()=>X.release()),!0}function nZ($,J,Z){if(d(u(J))){let X=Z$({path:p(J).lock,runtimeVersion:r});if(!X.acquired)return!1;return Z.push(()=>X.release()),!0}let Q=Z2(z0($,"worker.json"));return Q!==null&&Date.now()-Q.mtimeMs>60000}function tZ($,J){let Z=[$,...b5($,{withFileTypes:!0}).filter((X)=>X.isDirectory()&&!X.name.startsWith(".")).map((X)=>z0($,X.name))],Q=[];for(let X of Z)for(let Y of["connect","connect-once"]){let V=z0(X,Y);if(V===J||!Z2(z0(V,"worker.json")))continue;let U=h5(V);if(!U||U.stateDirectory===$||U.stateDirectory.startsWith($+iZ))Q.push({directory:V,config:U})}return Q}function S1($){try{return JSON.parse(i(z0($,"api-key.json"))).store==="keychain"}catch{return!1}}function rZ($,J){let Z=_$($);Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J))}function k5($){try{_$($).deleteBinding()}catch(J){if(!(J instanceof V0))throw J}}function oZ($){try{return $.loadBinding()}catch(J){if(J instanceof V0)return null;throw J}}function eZ($,J,Z,Q){if($?.stateDirectory!==J)return Q;let X=h5(Z);return X?.stateDirectory===Z?{saved:X,configPath:z0(Z,"worker.json")}:Q}function C5($){try{return b1($).isSymbolicLink()&&sZ($)==="reason"}catch{return!1}}function $6($){try{let J=JSON.parse(i(z0($,M8)));return typeof J.version==="string"?J.version:null}catch{return null}}function h5($){try{let J=z0($,"worker.json");return d(J)?J0.parse(JSON.parse(i(J))):null}catch{return null}}function Z2($){try{return b1($)}catch{return null}}function J6($){if($ instanceof L8)return $.code;if($ instanceof Error&&/^worker_[a-z_]+$/.test($.message))return $.message;if($ instanceof V0)return $.code;return $ instanceof Error&&"code"in $&&typeof $.code==="string"?$.code:"unexpected"}import{readFileSync as Z6}from"fs";function W8($){try{let J=JSON.parse(Z6(`${$}.keep-awake.json`,"utf8"));return J!==null&&typeof J==="object"&&"version"in J&&J.version===1&&"enabled"in J&&J.enabled===!0?"battery_and_ac":void 0}catch(J){return J.code==="ENOENT"?"battery_and_ac":void 0}}function f5($,J){a(`${$}.keep-awake.json`,{version:1,enabled:J})}import{createHash as nV}from"crypto";import{readdirSync as tV,realpathSync as b4,statSync as rV}from"fs";import{hostname as oV}from"os";import{join as i$,resolve as eV}from"path";var D8="cloud",Q6=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function C2($){return Q6.test($)&&!v5.test($)}var X6={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings > API) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_api_unreachable:"This computer could not reach Reason. Check its internet connection, and any VPN, proxy or firewall that lets the Reason app through but not the reason command, then try again.",worker_api_certificate_untrusted:"This computer did not trust Reason's certificate. A proxy, VPN or security software inspecting HTTPS, or a wrong clock, usually causes this: let Reason through it, then try again.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Q2($){return X6[$]}import{randomUUID as Y6}from"crypto";import{chmodSync as V6,lstatSync as z8,mkdtempSync as G6,realpathSync as d5,rmdirSync as K6,rmSync as B6,unlinkSync as q6}from"fs";import{createConnection as U6,createServer as H6}from"net";import{basename as m5,dirname as g5,join as m$}from"path";var N6=B.enum(["status","drain","resume","stop","reload_roots"]),F6=B.strictObject({version:B.literal(1),instanceId:B.string(),deviceId:B.string(),phase:B.enum(["starting","running","reconnecting","stopping"]),drained:B.boolean(),activeClaims:B.number().int().nonnegative(),activeSessions:B.number().int().nonnegative().optional(),executionEligible:B.boolean(),supportedOperations:B.array(B.enum(_8)).max(_8.length).optional(),capabilityReadiness:B.partialRecord(B.enum(_8),B.boolean()).optional(),lastHeartbeat:B.string().nullable(),expiresAt:B.string()}),T6=B.strictObject({nonce:B.string(),action:N6}),M6=B.object({nonce:B.uuid()}),p5=B.strictObject({version:B.literal(1),nonce:B.uuid(),socketPath:B.string().max(100)});function l5($){return m$(p($).lock,"control.json")}function O8($){return e(p($).lock),M6.parse(JSON.parse(i(m$(p($).lock,"owner.json"))))}function u5($){if(!d($))return!1;let J=z8($);if(!J.isSocket()||J.uid!==process.getuid?.()||(J.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function c5($,J){let Z=l5($);if(!d(Z)){let Y=p($).socket;if(!d(Y)||!z8(Y).isSocket())return null;return u5(Y)?Y:null}let Q=p5.parse(JSON.parse(i(Z)));if(Q.nonce!==J)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!L6.test(Q.socketPath))throw Error("worker_control_endpoint_invalid");return Q.socketPath}let X=g5(Q.socketPath);if(g5(X)!==d5("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(m5(X))||m5(Q.socketPath)!=="control.sock"||Buffer.byteLength(Q.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!d(X))return null;return e(X),u5(Q.socketPath)?Q.socketPath:null}var L6=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;async function A8($,J,Z){if(O8($).nonce!==J)throw Error("worker_instance_changed");let Q=l5($);if(d(Q))throw Error("worker_control_already_serving");let X=process.platform==="win32",Y=X?null:G6(m$(d5("/tmp"),"ara-worker-")),V=Y?m$(Y,"control.sock"):`\\\\.\\pipe\\reason-worker-${Y6()}`;if(Y)e(Y);if(Buffer.byteLength(V)>100)throw Error("worker_socket_path_too_long");let U=new Set,G=H6((K)=>{U.add(K),K.once("close",()=>U.delete(K)),K.setTimeout(2000,()=>K.destroy());let N="",T=!1;K.on("error",()=>K.destroy()),K.on("data",(M)=>{if(T)return;if(N+=M.toString(),Buffer.byteLength(N)>4096){K.destroy();return}if(!N.includes(`
-`))return;T=!0;try{let L=T6.parse(JSON.parse(N));if(L.nonce!==J){K.destroy();return}K.end(JSON.stringify(Z(L.action))+`
-`)}catch{K.destroy()}})});G.maxConnections=32;let H,F=!1,q=async()=>{if(F)return;F=!0;for(let K of U)K.destroy();if(await new Promise((K)=>G.close(()=>K())),H&&d(Q)){let K=z8(Q);if(K.isFile()&&K.dev===H.dev&&K.ino===H.ino)try{let N=p5.parse(JSON.parse(i(Q)));if(N.nonce===J&&N.socketPath===V)q6(Q)}catch{}}try{if(Y)K6(Y)}catch{}};try{if(await new Promise((K,N)=>{G.once("error",N),G.listen(V,()=>{if(!X)V6(V,384);K()})}),O8($).nonce!==J)throw Error("worker_instance_changed");return a(Q,{version:1,nonce:J,socketPath:V}),H=z8(Q),q}catch(K){throw await q(),K}}function s5($,J){try{let Z=JSON.parse(i(m$(p($).lock,"owner.json"))),Q=Z&&typeof Z==="object"?Z[J]:void 0;return typeof Q==="string"?Q:null}catch{return null}}function x2($){return s5($,"runtime_version")}function j6($){return s5($,"nonce")}function a5($,J){if(J)return J.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!d(m$(p($).lock,"owner.json")))return"no_lock";return c5($,O8($).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var W6=21600000,D6=B.strictObject({instance:B.string().nullable(),since:B.number().int().nonnegative()});function _6($,J){let Z=p($).updateDeferral;try{if(!d(Z))return null;let Q=D6.safeParse(JSON.parse(i(Z)));if(Q.success&&Q.data.instance===J)return Q.data.since;w1($)}catch{}return null}function w1($){try{B6(p($).updateDeferral,{force:!0})}catch{}}async function P8($,J,Z=()=>!1){let Q=j6($),X=_6($,Q);if(J!==void 0){let H=x2($);if(H===null||H===J&&X===null&&!Z())return{state:"current"}}let Y;try{let H=await B0($,"status");Y=H?H.activeSessions??H.activeClaims:0}catch{Y=null}if(Y===0)return{state:"restarted"};let V=Date.now(),U=X;if(U===null){U=V;try{a(p($).updateDeferral,{instance:Q,since:U})}catch{}}let G=V-U;return{state:G<W6?"busy":"drained",sessions:Y,waitedMs:G}}async function B0($,J){let Z=p($);if(!d(m$(Z.lock,"owner.json")))return null;let Q=O8($),X=c5($,Q.nonce);if(!X)return null;return new Promise((Y,V)=>{let U=U6(X),G="",H=!1,F=(q,K)=>{if(H)return;if(H=!0,U.destroy(),K)V(K);else Y(q)};U.setTimeout(2000,()=>U.destroy(Error("worker_control_timeout"))),U.on("connect",()=>U.write(JSON.stringify({nonce:Q.nonce,action:J})+`
-`)),U.on("data",(q)=>{if(G+=q.toString(),Buffer.byteLength(G)>16384)U.destroy(Error("worker_control_oversize"))}),U.on("error",(q)=>{if("code"in q&&["ECONNREFUSED","ENOENT"].includes(String(q.code)))F(null);else F(null,q.message==="worker_control_timeout"?q:Error("worker_control_unavailable"))}),U.on("end",()=>{try{let q=F6.parse(JSON.parse(G));if(q.instanceId!==Q.nonce)throw Error("worker_instance_changed");F(q)}catch{F(null,Error("worker_control_invalid_response"))}}),U.once("close",()=>F(null,Error("worker_control_unavailable")))})}import{randomUUID as bY}from"crypto";import{homedir as A3}from"os";import{spawn as z6}from"child_process";import{createRequire as O6}from"module";var i5=2147483648,A6=1;function P6(){try{let $=O6(import.meta.url)("bun:ffi"),J=$.dlopen("kernel32.dll",{SetThreadExecutionState:{args:[$.FFIType.u32],returns:$.FFIType.u32}});return(Z)=>J.symbols.SetThreadExecutionState(Z)}catch{return null}}function R6($,J){if($==="ac_only"||!J)return{status:"unsupported",release:async()=>"unsupported"};let Z=J((i5|A6)>>>0)===0?"failed":"held";return{get status(){return Z},async release(){if(Z==="held")J(i5);return Z="failed","released"}}}async function n5($,J={}){let Z=J.platform??process.platform;if(Z==="win32")return R6($,J.setExecutionState??P6());if(Z!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let Q,X="failed",Y=!1,V,U=Promise.resolve(),G=(K)=>{if(X===K)return;X=K,J.onStatusChange?.(K)},H=()=>{if(Y||V)return;V=setTimeout(()=>{V=void 0,U=F()},J.retryMs??5000),V.unref()},F=async()=>{try{let K=(J.spawn??z6)("/usr/bin/caffeinate",[$==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(Q=K,K.once("exit",()=>{if(!Y&&Q===K)G("failed"),H()}),await new Promise((N,T)=>{K.once("spawn",N),K.once("error",T)}),K.exitCode===null&&K.signalCode===null)G("held")}catch{G("failed"),H()}};U=F(),await U;let q;return{get status(){return X},release(){return q??=(async()=>{Y=!0,clearTimeout(V),await U;let K=Q;if(!K||K.exitCode!==null||K.signalCode!==null||!K.pid)return X="failed","released";let N=await new Promise((T)=>{let M,L=setTimeout(()=>{try{K.kill("SIGKILL")}catch{}M=setTimeout(()=>T("failed"),1000)},1000);K.once("exit",()=>{clearTimeout(L),clearTimeout(M),T("released")});try{K.kill("SIGTERM")}catch{}});if(N==="released")X="failed";return N})()}}}class X2 extends Error{constructor(){super("Reason Device operation lease expired.")}}class R8{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor($,J,Z){this.now=J;this.onExpire=Z;this.clockFloor=J(),this.install($)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let $=new X2;if(!this.closed)this.close(),this.onExpire($);throw $}acknowledge($){this.assertCurrent(),this.install($)}close(){this.closed=!0,clearTimeout(this.timer)}install($){let J=Date.parse($);if(!Number.isFinite(J))throw Error("Reason returned an invalid operation lease deadline.");if(J-this.clockNow()<=0)throw new X2;this.deadline=J,clearTimeout(this.timer),this.arm()}clockNow(){let $=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,$-this.clockTick)),this.clockTick=$,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new X2)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as S6}from"fs";import{randomUUID as b6}from"crypto";import{constants as y1}from"fs";import{open as I6}from"fs/promises";import{join as C6}from"path";var x6={platform:process.platform,home:U0,async openFile($){let J=await I6($,y1.O_RDONLY|y1.O_NOFOLLOW|y1.O_NONBLOCK);return{isFile:async()=>(await J.stat()).isFile(),close:()=>J.close()}}};async function t5($=x6){if($.platform!=="darwin")return"unknown";try{let J=await $.openFile(C6($.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await J.isFile()?"granted":"unknown"}finally{await J.close()}}catch(J){return J instanceof Error&&"code"in J&&["EACCES","EPERM"].includes(String(J.code))?"not_granted":"unknown"}}class k1 extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function E6($,J,Z){J.throwIfAborted();let Q=new AbortController,X=()=>{},Y,V=new Promise((U,G)=>{X=()=>{Q.abort(J.reason),G(J.reason)},J.addEventListener("abort",X,{once:!0}),Y=setTimeout(()=>{let H=new k1;Q.abort(H),G(H)},Z)});try{return await Promise.race([$(Q.signal),V])}finally{clearTimeout(Y),J.removeEventListener("abort",X),Q.abort()}}function r5($){let J=0,Z=0;return async(Q)=>{for(;;){Q.throwIfAborted(),$.lease.assertCurrent();while(performance.now()<Z)await $.sleep(Math.min(Z-performance.now(),$.lease.remainingMs()),Q),Q.throwIfAborted(),$.lease.assertCurrent();try{let X=await E6($.send,Q,Math.min(8000,$.lease.remainingMs()));return Q.throwIfAborted(),$.lease.assertCurrent(),X}catch(X){let Y=X instanceof k1||(X instanceof N0?E2(X.status):S2(X));if(Y){let V=Math.max(Math.min(500*2**Math.min(J++,4),5000),$.retryAfterMs(X));Z=performance.now()+V}if(Q.throwIfAborted(),$.lease.assertCurrent(),!Y)throw X}}}}function c1($,J=process.env){return!$.proxied&&J.REASON_DEVICE_SESSION!=="0"}function N9($,J,Z){let Q=$?.permissionRecovery;return C8(Q,Z)&&Q.deviceId===J.deviceId&&Q.organizationId===J.orgId?{permissionRecovery:Q}:{}}var w6=1000,y6=250,k6=16,h6=5000,f6=V9(S6(process.execPath)),o5=null,e5=null;function F9($){if(process.platform!=="darwin")return{};return e5??=t5().then((J)=>{o5={status:J,checkedAt:$().getTime()}}).finally(()=>{e5=null}),{fullDiskAccess:{...o5??{status:"unknown",checkedAt:$().getTime()},executablePath:f6}}}var v6=8,m6=64,g6=2000,u6=2000,s1=8000,$9=3,d6=250,J9=1000,Z9=30000,p6=0.2,l6=30000,c6=21600000,s6=300000,a6=3600000,i6=0.1,T9=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function n6($){return Math.min($9,Math.max(1,$??$9))}function t6($){return typeof $.reason_code==="string"&&T9.has($.reason_code)?$.reason_code:"cancelled"}function h1($){return $.reason instanceof v0&&($.reason.code==="cancelled"||T9.has($.reason.code))?$.reason.code:"cancelled"}function Q9($){return $ instanceof v0&&/^[A-Za-z0-9._:-]{1,160}$/.test($.code)?$.code:"capability_failed"}function M9($){return $.capability==="hands.connect"&&H9($.payload)}function f1($,J=Math.random){let Z=Math.min(Math.max(J(),0),1);return Math.max(0,Math.floor($*(1+Z*i6)))}function r6($,J=Math.random){let Z=Math.min(Z9,J9*2**Math.max(0,$-1)),Q=Math.min(Math.max(J(),0),1),X=Z*p6*(Q*2-1);return Math.min(Z9,Math.max(J9,Math.round(Z+X)))}function a1($,J){return new Promise((Z,Q)=>{if(J.aborted){Q(J.reason??new DOMException("Aborted","AbortError"));return}let X=()=>{clearTimeout(Y),Q(J.reason??new DOMException("Aborted","AbortError"))},Y=setTimeout(()=>{J.removeEventListener("abort",X),Z()},$);J.addEventListener("abort",X,{once:!0})})}class m1 extends Error{updateError;constructor($){super("Managed runtime update check failed.");this.updateError=$;this.name="RuntimeUpdateCheckError"}}async function o6($,J,Z,Q){let X=new AbortController,Y=()=>X.abort(Z.reason);if(Z.aborted)Y();else Z.addEventListener("abort",Y,{once:!0});try{return await Promise.race([$,Q(J,X.signal).then(()=>({kind:"heartbeat"}))])}finally{X.abort(),Z.removeEventListener("abort",Y)}}function g1($){return $ instanceof Error?$.message:String($)}function u1($,J){return J.aborted||$ instanceof DOMException&&$.name==="AbortError"||$ instanceof Error&&$.name==="AbortError"}function t0($){return $ instanceof N0&&$.status===409&&$.code==="attempt_fenced"}function d1($){return $.capability==="environment.install"}function e6($){if($ instanceof S8||$ instanceof X2||$ instanceof w2)return"timeout";if(!($ instanceof Error)||$ instanceof N0)return"transport_unknown";for(let J of[$,$.cause]){if(!(J instanceof Error)||J instanceof N0||!("code"in J))continue;switch(J.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function b2($,J,Z){if(!$.state.worker&&!$.connectionDiagnostics)return;if(t0(Z))return;let Q=Z instanceof N0&&Number.isInteger(Z.status)&&Z.status>=100&&Z.status<=599?{stage:J,category:"http",httpStatus:Z.status}:{stage:J,category:e6(Z)};$.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:Q})}async function Y2($,J,Z){try{return await Z()}catch(Q){if(!$.signal.aborted)b2($,J,Q);throw Q}}class w2 extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function p1($,J,Z,Q){let X=J.capability==="inference.custom.v1"&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":G9(Z.error_code)?Z.error_code:"custom_endpoint_unavailable"}:d1(J)&&Z.status!=="succeeded"?{status:Z.status,error_code:Z.status==="cancelled"?"operation_cancelled":Z.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:Z,Y=new AbortController,V=Q?AbortSignal.any([Q,Y.signal]):Y.signal,U=$.sleep??a1,G=$.operationCompletionTimeoutMs??s1,H=performance.now()+G,F,q,K=new Promise((M,L)=>{let D=()=>{let j=new w2;Y.abort(j),L(j)},_=(j)=>{clearTimeout(F),F=setTimeout(D,j)};if(q=()=>_(Math.max(0,Math.min(H-performance.now(),g6))),_(G),$.signal.addEventListener("abort",q,{once:!0}),$.signal.aborted)q()}),N,T=0;try{while(!0)try{N=await Promise.race([$.client.completeOperation($.state,J,X,V),K]);break}catch(M){if(V.aborted||$.signal.aborted||x0(M)||t0(M)||!$Q(M)||performance.now()>=H)throw b2($,"completion",M),M;T+=1;let L=Math.min(500*2**Math.min(T-1,4),Math.max(0,H-performance.now()));if(L<=0)throw b2($,"completion",M),M;try{await U(L,V)}catch{throw b2($,"completion",M),M}}}finally{clearTimeout(F),$.signal.removeEventListener("abort",q),Y.abort()}$.onEvent?.({type:"completed",operationId:J.operation_id,status:N.status})}function $Q($){if(x0($))return!1;if(t0($))return!1;if($ instanceof N0)return $.status===408||$.status===429||$.status>=500&&$.status<=504;if($ instanceof Error){if($.name==="AbortError"||$ instanceof w2)return!1;return!0}return!1}class S8 extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function I8($){if($ instanceof S8)return!0;return $ instanceof N0?E2($.status):S2($)}function l1($,J){if(!($ instanceof N0)||!$.retryAfter)return 0;let Z=$.retryAfter.trim(),Q=/^\d+(?:\.\d+)?$/.test(Z)?Number(Z)*1000:Date.parse(Z)-J;return Number.isNaN(Q)?0:Math.max(0,Q)}async function JQ($,J,Z,Q,X){let Y=new AbortController,V,U=()=>{return},G=new Promise((F,q)=>{let K=()=>{let N=Q.reason??new DOMException("Aborted","AbortError");Y.abort(N),q(N)};if(U=()=>Q.removeEventListener("abort",K),Q.aborted)K();else Q.addEventListener("abort",K,{once:!0})}),H=new Promise((F,q)=>{V=setTimeout(()=>{let K=new S8;Y.abort(K),q(K)},X)});try{return await Promise.race([$.client.operationHeartbeat($.state,J,{transientRetryOwner:"caller",...Z.controlAckSeq===void 0?{}:{controlAckSeq:Z.controlAckSeq},clientRetryCount:Z.clientRetryCount,...Z.waitMs===void 0?{}:{waitMs:Z.waitMs},signal:Y.signal}),G,H])}finally{if(V!==void 0)clearTimeout(V);U()}}async function X9($,J,Z,Q,X,Y){let V=n6($.operationHeartbeatMaxAttempts),U=$.operationHeartbeatAttemptTimeoutMs??s1,G=$.operationHeartbeatRetryDelayMs??d6,H=Y.remainingMs(),F=Math.min(H,V*U+G*V*(V-1)/2);for(let q=0;q<V;q+=1)try{Q.throwIfAborted(),Y.assertCurrent();let K=Math.min(U,Y.remainingMs()),N=await JQ($,J,{...Z,waitMs:Z.waitMs===void 0?void 0:Math.min(Z.waitMs,Math.max(0,Math.floor(K-1000))),clientRetryCount:q},Q,K);return Q.throwIfAborted(),Y.acknowledge(N.lease_until),N}catch(K){if(Q.aborted||q+1>=V||t0(K)||x0(K)||!I8(K)){if(!Q.aborted)b2($,"operation_heartbeat",K);throw K}let N=H-Y.remainingMs(),T=l1(K,($.now?.()??new Date).getTime()),M=Math.max(G*(q+1),F*(q+1)/V-N,T);await X(Math.min(Y.remainingMs(),M),Q),Y.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function ZQ($,J,Z,Q,X){let Y=M9(J),V=new AbortController,U=new AbortController,G=()=>{V.abort($.signal.reason),U.abort($.signal.reason)};if($.signal.aborted)G();else $.signal.addEventListener("abort",G,{once:!0});let H=null,F,q,K=-1,N=0,T=Promise.resolve(),M=[],L=new AbortController,D=!1,_,j=null,z=!1,A,I,x={},P=(b)=>{D=!0,L.abort(b),V.abort(b),U.abort(b)},W=(b)=>{if(_)return _;let w=structuredClone(b),l=N;return _=(async()=>{let k=new AbortController,C=k.signal;C.throwIfAborted();let S,E=()=>{},v=new Promise((f,R)=>{if(E=()=>R(C.reason),C.addEventListener("abort",E,{once:!0}),S=setTimeout(()=>k.abort(Error("Hands stop receipt delivery timed out.")),4000),C.aborted)E()});try{for(let f=0;f<3;f+=1){C.throwIfAborted();try{let R=await Promise.race([Y2($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:l,events:[w],signal:C,transientRetryOwner:"caller"})),v]);if(C.throwIfAborted(),R.next_event_seq!==l+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");N=R.next_event_seq;return}catch(R){if(x0(R))X(R);let c=R instanceof N0?E2(R.status):S2(R);if(C.aborted||!c||f===2)throw R;let n=Math.max(500*2**f,l1(R,($.now?.()??new Date).getTime()));await Promise.race([Z(n,C),v])}}}finally{clearTimeout(S),C.removeEventListener("abort",E),k.abort()}})(),_},O=(b,w,l)=>{let k=(S)=>Y2($,"event",()=>$.client.operationEvents($.state,J,{eventSeqStart:w,events:b,signal:S,...l?{transientRetryOwner:"caller"}:{}})).catch((E)=>{if(J.capability==="hands.connect"&&t0(E))P(E);if(l&&(x0(E)||t0(E))){if(x0(E))X(E);V.abort(E),U.abort(E),L.abort(E)}throw E});if(!l)return async(S)=>{if(J.capability!=="hands.connect"&&J.capability!=="inference.custom.v1"){N=(await k(S)).next_event_seq;return}S.throwIfAborted();let E=()=>{},v=new Promise((f,R)=>{E=()=>R(S.reason),S.addEventListener("abort",E,{once:!0})});try{let f=await Promise.race([k(S),v]);S.throwIfAborted(),N=f.next_event_seq}finally{S.removeEventListener("abort",E)}};let C=r5({send:k,lease:I,sleep:Z,retryAfterMs:(S)=>l1(S,($.now?.()??new Date).getTime())});return async(S)=>{let E=await C(S);if(E.next_event_seq!==w+b.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");N=E.next_event_seq}},y=async(b,w)=>{let l=b??await X9($,J,{controlAckSeq:K,waitMs:w},U.signal,Z,I),k=null,C=!1;for(let S=0;S<10;S+=1){let E=K+1;for(let v of l.controls){if(v.seq!==E)throw Error("Reason returned an out-of-order Device operation control.");if(v.kind==="cancel"||v.kind==="operation.cancel")k??=t6(v.payload),V.abort(new v0(k,"Reason closed the Device operation."));if(v.kind!=="cancel"&&v.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability)){let f,R,c=new Promise((n,K0)=>{f=n,R=K0});c.catch(()=>{}),x.current={promise:c,resolve:f,reject:R}}try{C||=!await $.onControl?.(J,v)}catch(f){if(f instanceof v0)F??=Q9(f);throw x.current?.reject(f),f}}K=v.seq,E+=1}if(l.controls.length===0){if(l.next_control_seq!==K+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:k,unsupported:C}}try{l=await X9($,J,{controlAckSeq:K},U.signal,Z,I),x.current?.resolve()}catch(v){if(x.current?.reject(v),!k||t0(v)||x0(v))throw v;return{cancellationReason:k,unsupported:C}}}throw Error("Reason returned too many Device operation control batches.")};try{let b;try{if(!Y)I=new R8(J.lease_until,()=>($.now?.()??new Date).getTime(),(w)=>{if(!V.signal.aborted)H=w;V.abort(w),U.abort(w)});b=Y||J.capability==="hands.connect"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||v1.has(J.capability)||J.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await y()}catch(w){if(!d1(J)||t0(w)||x0(w))throw w;await p1($,J,{status:$.signal.aborted?"cancelled":"failed"});return}if(b.cancellationReason||$.signal.aborted){let w=b.cancellationReason??h1($.signal);V.abort(new v0(w,"Reason closed the Device operation.")),q={status:"cancelled",error_code:w}}else if(b.unsupported)V.abort(),q={status:"failed",error_code:"control_unsupported"};else{let w=Y?Promise.resolve():(async()=>{let k=$.operationHeartbeatIntervalMs??$.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(J.capability)?u6:15000),C=Math.min(k,Math.max(0,($.operationHeartbeatAttemptTimeoutMs??s1)-1000)),S=J.capability==="hands.connect"||J.capability==="pty.start"||J.capability==="display.stream.v1"||J.capability==="simulator.stream.v1"||J.capability==="browser.recording.v1"||J.capability==="browser.pr-proof.v1"||J.capability==="process.run.v1"||J.capability==="process.full.v1"||J.capability==="preview.serve.v1"||J.capability==="inference.custom.v1";while(!U.signal.aborted)try{if(!S){if(await Z(k,U.signal),U.signal.aborted)return}let E=await y(void 0,S?C:void 0);if(E.cancellationReason||E.unsupported){if(E.unsupported)H=Error("Reason requested an unsupported Device operation control.");V.abort(E.cancellationReason?new v0(E.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(E){if(x0(E))X(E);if(t0(E))H=E,P(E);if(!U.signal.aborted)H=E,V.abort();return}})();try{if(I?.assertCurrent(),V.signal.throwIfAborted(),Q.authorized=()=>!V.signal.aborted&&(Y||(I?.remainingMs()??0)>0),q=await $.onClaim(J,V.signal,async(k)=>{if(d1(J))return;if(k.kind==="permission.denied"){if(!Q.authorized())return;let c=k.data,n=($.now??(()=>new Date))().getTime(),K0=$.statusPath??x8(),R0=($.loadStatus??$2)(K0),E0={id:b6(),kind:"permission_denied",operation:c?.operation,provenance:c?.provenance,occurredAt:new Date(n).toISOString(),expiresAt:new Date(n+600000).toISOString(),sessionId:J.run_id,deviceId:$.state.deviceId,organizationId:$.state.orgId};if(R0&&C8(E0,n)){let s0=R0.permissionRecovery;if(!s0||!C8(s0,n)||s0.sessionId!==E0.sessionId||s0.operation!==E0.operation||s0.provenance!==E0.provenance)($.saveStatus??E8)({...R0,permissionRecovery:E0},K0)}return}let C=J.capability==="hands.connect"&&k.capability==="hands.connect"&&k.kind==="hands.stopped",S=J.capability==="hands.connect"&&k.kind==="hands.reconnected",E=S||J.capability==="inference.custom.v1"?AbortSignal.any([V.signal,L.signal,...k.deliverySignal?[k.deliverySignal]:[]]):J.capability==="hands.connect"?AbortSignal.any([$.signal,L.signal]):$.signal,v={kind:k.kind,payload:{sequence:k.sequence,capability:k.capability,...k.data?{data:S?structuredClone(k.data):k.data}:{}}};if(J.capability==="hands.connect"&&k.capability==="hands.connect"&&(k.kind==="started"||k.kind==="hands.started")||(v1.has(J.capability)||J.capability==="pty.start")&&k.kind==="started")return new Promise((c,n)=>{M.push({wireEvent:v,settle:(K0)=>K0===void 0?c():n(K0)})});let f=M;M=[];let R=T.then(async()=>{if((D||$.signal.aborted)&&J.capability==="hands.connect"&&!Y){if(C)await W(v);return}if(j!==null){if(k.kind!=="hands.stopped"||!z||!A)throw j;let n=new AbortController,K0=AbortSignal.any([$.signal,L.signal,n.signal]),R0=setTimeout(()=>n.abort(Error("Hands stop receipt reconciliation timed out.")),4000);z=!1;try{await A(K0),A=void 0,await O([v],N,!0)(K0),j=null}catch(E0){throw j=E0??Error("Hands stop receipt could not be confirmed."),E0}finally{clearTimeout(R0),n.abort()}return}if(S&&!I){let n=Math.min(Date.parse(J.lease_until),Date.parse(String(J.payload.expires_at)));I=new R8(new Date(n).toISOString(),()=>($.now?.()??new Date).getTime(),(K0)=>{V.abort(K0),U.abort(K0)})}let c=N;if(S)A=O([...f.map((n)=>n.wireEvent),v],c,!0),await A(E),A=void 0;else await O([...f.map((n)=>n.wireEvent),v],c,!1)(E)});R.then(()=>{for(let c of f)c.settle()},(c)=>{for(let n of f)n.settle(c??Error("Hands event delivery failed."))}),T=R.catch((c)=>{if(x0(c))X(c);if(S){if(j===null)z=E.aborted&&!L.signal.aborted,j=c??Error("Hands generation receipt delivery failed.");if(!E.aborted)V.abort(c),U.abort(c)}}),await R}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(J.capability))await x.current?.promise}catch(k){q=V.signal.aborted?{status:"cancelled",error_code:h1(V.signal)}:{status:"failed",error_code:Q9(k)}}finally{Q.authorized=()=>!1,L.abort();for(let k of M.splice(0))k.settle();U.abort(),await w}let l=q9(J.capability)?U9(q.result,J.operation_id):null;if(H){if(x0(H))throw H;q={status:"failed",error_code:F??"control_or_heartbeat_failed",...l?{result:l}:{}}}else if(V.signal.aborted&&q.status==="succeeded")q={status:"cancelled",error_code:h1(V.signal),...l?{result:l}:{}}}if(I?.close(),x0($.signal.reason))throw $.signal.reason;await p1($,J,q)}finally{I?.close(),L.abort(),U.abort(),$.signal.removeEventListener("abort",G)}}async function i1($){let J=$.now??(()=>new Date),Z=$.sleep??a1,Q=$.saveStatus??E8,X=$.loadStatus??$2,Y=$.statusPath??x8(),V=J().toISOString(),U=X(Y)?.lastUsedAt,G=!1,H=()=>({version:1,pid:process.pid,startedAt:V,...F9(J),...N9(X(Y),$.state,J().getTime()),deviceId:$.state.deviceId,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:G}:{},...U?{lastUsedAt:U}:{}}),F=0,q,K=!1,N,T,M,L=Promise.resolve();Q({...H(),state:"starting"},Y),$.onEvent?.({type:"started",deviceId:$.state.deviceId}),B9();try{let D=async()=>{let _=$.readIdleSleepPolicy?$.readIdleSleepPolicy():$.idleSleepPolicy;if($.signal.aborted||_===T)return;if(N&&T){let A=await N.release();if($.onEvent?.({type:"idle_sleep",status:A,policy:T}),A==="failed")return;N=void 0,T=void 0,G=!1;let I=X(Y);if(I)Q({...I,idleSleepHold:G},Y)}if(!_)return;T=_;let j=!0;N=await($.acquireAwakeHold??n5)(_,{onStatusChange:(A)=>{if(j)return;G=A==="held";let I=X(Y);if(I)Q({...I,idleSleepHold:G},Y);$.onEvent?.({type:"idle_sleep",status:A,policy:_})}}),j=!1,G=N.status==="held";let z=X(Y);if(z)Q({...z,idleSleepHold:G},Y);$.onEvent?.({type:"idle_sleep",status:N.status,policy:_})};if(await D(),$.readIdleSleepPolicy)M=setInterval(()=>{L=L.then(D).catch(()=>{$.onEvent?.({type:"idle_sleep",status:"failed",policy:T??"battery_and_ac"})})},$.idleSleepPollMs??1000),M.unref();while(!$.signal.aborted){let _=!1;try{await QQ({...$,saveStatus:(j,z)=>{if(j.state==="starting"||j.state==="error"||j.state==="stopped")return;U=j.lastUsedAt??U,Q({...j,startedAt:V,...$.idleSleepPolicy||$.readIdleSleepPolicy?{idleSleepHold:G}:{}},z)},onEvent:(j)=>{if(j.type==="error"&&j.diagnostic){$.onEvent?.(j);return}if(j.type==="started"||j.type==="error"||j.type==="stopped")return;if(j.type==="heartbeat"&&F>0&&!_){_=!0;let z=F;F=0,q=void 0,$.onEvent?.({type:"reconnected",attempts:z})}$.onEvent?.(j)}});return}catch(j){if(u1(j,$.signal))return;if(x0(j)){K=!0;let A=$.state.worker?"worker_connection_failed":g1(j);throw Q({...H(),state:"error",error:A},Y),$.onEvent?.({type:"error",message:A}),j}F+=1;let z=r6(F,$.reconnectRandom);q??=J().toISOString(),Q({...H(),state:"starting",reconnectingSince:q},Y),$.onEvent?.({type:"reconnecting",message:$.state.worker?"worker_connection_failed":g1(j),attempt:F,retryInMs:z}),await Z(z,$.signal)}}}catch(D){if(!u1(D,$.signal))throw D}finally{if($.client.close?.(),clearInterval(M),await L,N&&T){let D=await N.release();G=D==="failed"&&N.status==="held",$.onEvent?.({type:"idle_sleep",status:D,policy:T})}if(!K)Q({...H(),state:"stopped"},Y);else{let D=X(Y);if(D)Q({...D,idleSleepHold:G},Y)}$.onEvent?.({type:"stopped"})}}async function QQ($){let J=$.now??(()=>new Date),Z=$.sleep??a1,Q=$.statusPath??x8(),X=$.saveStatus??E8,Y=$.loadStatus??$2,V=J().toISOString(),U=Y(Q)?.lastUsedAt,G=$.runtimeUpdate,H=new AbortController,F=()=>H.abort($.signal.reason);if($.signal.aborted)F();else $.signal.addEventListener("abort",F,{once:!0});let q=G?.random??Math.random,K=$.maxConcurrentClaims,N=typeof K==="number"&&Number.isSafeInteger(K)&&K>0?Math.min(m6,K):v6,T=0,M=!1,L=null,D=(g)=>{L??=g,H.abort(g)},_=new Map,j=()=>{let g=new Set,Z0=0;for(let{claim:j$}of _.values()){let U$=j$.capability==="hands.connect"?j$.payload[Y9]:void 0;if(typeof U$==="string"){if(g.has(U$))continue;g.add(U$)}Z0+=1}return Z0},z=null,A=()=>[..._.values()].some((g)=>g.authorized()),I=()=>[..._.values()].every((g)=>g.claim.capability==="preview.serve.v1"),x=G?new Date(V).getTime()+f1(G.initialDelayMs??l6,q):Number.POSITIVE_INFINITY,P=null,W=!1,O=$.firstHeartbeat,y=O?.account_root_metadata_supported===!0,b=O?.workspace_root_metadata_supported===!0,w=O?.account_root_path_supported===!0,l=O?.home_contained_roots_supported===!0,k=O?.root_paths_supported===!0,C=O?.startup_supported===!0,S=O!==void 0,E=O?{challenge:O.challenge,expires_at:O.expires_at}:void 0,v,f=!$.startup,R=()=>({version:1,pid:process.pid,startedAt:V,...F9(J),...N9(Y(Q),$.state,J().getTime()),...U?{lastUsedAt:U}:{},deviceId:$.state.deviceId,...P?{organizationId:P.organization_id,organizationName:P.organization_name,organizationSlug:P.organization_slug}:{}}),c=()=>{let g=($.advertised??$.claimable)?.()!==!1;if(!f)v??=$.startup?.();return{...$.deviceMetadata?.device_model!=null?{device_model:$.deviceMetadata.device_model}:{},...$.deviceMetadata?.device_chip!=null?{device_chip:$.deviceMetadata.device_chip}:{},...$.deviceMetadata?.device_location!=null?{device_location:$.deviceMetadata.device_location}:{},reason_runtime_version:$.runtimeVersion,bridge_version:$.bridgeVersion,protocol_version:$.protocolVersion,execution_eligible:g,...C&&!f&&v?{startup:v}:{},capabilities:g?K9($.capabilities,{accountRootMetadataSupported:y,workspaceRootMetadataSupported:b,accountRootPathSupported:w,homeContainedRootsSupported:l,rootPathsSupported:k}):{supported_operations:[]}}},n=()=>{if(W||!$.client.identity)return;W=!0,$.client.identity($.state,$.signal).then((g)=>{if(g.organization_id!==$.state.orgId)return;P=g;let Z0=Y(Q);if(!Z0)return;X({...Z0,organizationId:g.organization_id,organizationName:g.organization_name,organizationSlug:g.organization_slug},Q)}).catch(()=>{return})},K0=(g)=>{y=g.account_root_metadata_supported===!0,b=g.workspace_root_metadata_supported===!0,w=g.account_root_path_supported===!0,l=g.home_contained_roots_supported===!0,k=g.root_paths_supported===!0,C=g.startup_supported===!0,S=!1},R0=(g)=>{if(g.startup)f=!0},E0=(g,Z0)=>{if(!(Z0 instanceof N0&&Z0.status===400&&Z0.code==="invalid_heartbeat")||!g.startup&&!S)throw Z0;if(f=!0,S)y=b=w=!1,l=k=C=S=!1;return null},s0=(g)=>{K0(g),X({...R(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),n(),$.onEvent?.({type:"heartbeat",serverTime:g.server_time,drain:g.drain,...g.latest_cli_versions?{latestCliVersions:g.latest_cli_versions}:{},...g.hands_prespawn?{handsPrespawn:!0}:{}})},S$=!1,n$=!1;$.registerHeartbeatNow?.(()=>{if($.signal.aborted)return;if(S$)n$=!0;let g=c();Y2($,"heartbeat",()=>$.client.heartbeat($.state,g,H.signal).catch((Z0)=>E0(g,Z0))).then((Z0)=>{if(!Z0)return;R0(g),K0(Z0),s0(Z0)},()=>{return})});let L$=(g)=>Z(g,$.signal);X({...R(),state:"starting"},Q),$.onEvent?.({type:"started",deviceId:$.state.deviceId});let B$=!1,b$=$.maxConsecutiveHeartbeatFailures??3,q$=0,d0=0,D2=0,t$=null;try{while(!$.signal.aborted){if(L)throw L;if(M&&I())break;let g,Z0=d0>0&&d0<k6&&performance.now()-D2<h6&&t$!==null;if(!Z0)d0=0;$:{if(Z0&&t$){g=t$;break $}let X0=c(),a0=E;E=void 0,S$=!0,n$=!1;try{let D0=await Y2($,"heartbeat",()=>$.client.heartbeat($.state,X0,H.signal,...a0?[a0]:[]).catch((e0)=>E0(X0,e0)));if(S$=!1,!D0)continue;g=D0,R0(X0),D2=performance.now(),q$=0}catch(D0){if(S$=!1,$.signal.aborted)break;if(!I8(D0))throw D0;if(q$+=1,q$>=b$&&!A())throw D0;await Z(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000),$.signal);continue}if(K0(g),Object.keys(c().capabilities).length>Object.keys(X0.capabilities).length)continue;if(n$)continue;if(s0(g),L)throw L;if($.signal.aborted)break;if(G&&["available","required"].includes(g.update_policy??""))x=Math.min(x,J().getTime());if(G&&J().getTime()>=x)try{let D0=new AbortController,e0=()=>D0.abort($.signal.reason);if($.signal.aborted)e0();else $.signal.addEventListener("abort",e0,{once:!0});let W$;try{W$=G.check(D0.signal)}catch(A0){W$=Promise.reject(A0)}let w$=W$.then((A0)=>({kind:"completed",result:A0}),(A0)=>({kind:"failed",error:A0})),r$;try{while(!0){let A0=await o6(w$,$.heartbeatIntervalMs??15000,$.signal,Z);if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(A0.kind==="failed")throw new m1(A0.error);if(A0.kind==="completed"){r$=A0.result;break}try{let _0=c(),y$=await Y2($,"heartbeat",()=>$.client.heartbeat($.state,_0,H.signal).catch((J8)=>E0(_0,J8)));if(!y$)continue;g=y$,R0(_0),s0(g),q$=0}catch(_0){if($.signal.aborted)throw _0;if(!I8(_0))throw _0;if(q$+=1,q$>=b$&&!A())throw _0}}}catch(A0){D0.abort(A0);let _0=await w$;if(_0.kind==="completed"&&_0.result==="activated")r$="activated";else throw A0}finally{$.signal.removeEventListener("abort",e0)}if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");if(T=0,r$==="activated"){if($.signal.aborted)throw $.signal.reason??new DOMException("Aborted","AbortError");$.onEvent?.({type:"runtime_updated"}),M=!0}x=J().getTime()+f1(G.intervalMs??c6,q)}catch(D0){if(!(D0 instanceof m1))throw D0;T+=1;let e0=G.retryBaseMs??s6,W$=G.retryMaxMs??a6,w$=Math.min(W$,e0*2**Math.min(T-1,8));x=J().getTime()+f1(w$,q)}}if(t$=g,$.signal.aborted)break;if(M&&I())break;if(M){await L$($.heartbeatIntervalMs??15000);continue}let j$=$.client.sessionCadence?.($.state)??null,U$=j$?.presenceIntervalMs??$.heartbeatIntervalMs??15000;if(g.drain||$.claimable?.()===!1){d0=0,await L$(U$);continue}if(j()>=N){d0=0;let X0=new AbortController;z=X0;try{await Z(U$,AbortSignal.any([$.signal,X0.signal]))}catch(a0){if(!X0.signal.aborted)throw a0}finally{if(z===X0)z=null}continue}let h,t=Z0?0:j$?.claimWaitMs??Math.min($.heartbeatIntervalMs??15000,30000),F0=performance.now();try{h=await Y2($,"claim",()=>$.client.claimOperation($.state,{waitMs:t,signal:H.signal}))}catch(X0){if(d0=0,$.signal.aborted||!I8(X0)||!A())throw X0;await L$(Math.min($.heartbeatRetryDelayMs??2000,$.heartbeatIntervalMs??15000));continue}if(L)throw L;if(!h){if(Z0){d0=0;continue}if(performance.now()-F0<t-y6)await L$(w6);continue}if($.claimable?.()===!1){d0=0,await p1($,h,{status:"cancelled",error_code:"execution_authority_withdrawn"},$.signal);continue}U=J().toISOString(),X({...R(),state:"connected",lastHeartbeatAt:J().toISOString()},Q),$.onEvent?.({type:"claim",operationId:h.operation_id,runId:h.run_id,attemptId:h.attempt_id,capability:h.capability});let W0,S0={authorized:()=>!1,claim:h};if(W0=ZQ({...$,signal:H.signal},h,Z,S0,D).catch((X0)=>{if(x0(X0))D(X0);else if(!t0(X0)&&[..._].some(([a0,D0])=>a0!==W0&&D0.authorized())){if(X0 instanceof w2)$.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!t0(X0)&&L===null)L=X0}).finally(()=>{_.delete(W0),z?.abort(),$.onEvent?.({type:"claims_changed",activeClaims:_.size})}),_.set(W0,S0),$.onEvent?.({type:"claims_changed",activeClaims:_.size}),d0+=1,M9(h)){if(d0=0,await W0,L)throw L}}}catch(g){if(!u1(g,$.signal)){H.abort(g),B$=!0;let Z0=$.state.worker?"worker_connection_failed":g1(g);throw X({...R(),state:"error",error:Z0},Q),$.onEvent?.({type:"error",message:Z0}),g}}finally{if(H.abort(),await Promise.allSettled(_.keys()),$.signal.removeEventListener("abort",F),!B$)X({...R(),state:"stopped"},Q);$.onEvent?.({type:"stopped"})}}import{execFile as EQ}from"child_process";import{constants as g9,existsSync as SQ,mkdtempSync as e1,rmSync as QJ}from"fs";import{access as u9,open as bQ,readFile as d9,readlink as wQ,readdir as p9,unlink as yQ,rmdir as kQ}from"fs/promises";import{tmpdir as hQ}from"os";import{basename as $4,join as k8}from"path";import{randomUUID as g$}from"crypto";import{chmodSync as XQ,closeSync as YQ,fsyncSync as VQ,openSync as GQ,readFileSync as KQ,rmdirSync as L9,unlinkSync as D9,writeFileSync as BQ}from"fs";import{createConnection as qQ,createServer as UQ}from"net";import{dirname as HQ,join as NQ}from"path";var FQ=5000;async function _9($,J,Z){if(Z.aborted)return!1;let Q={generation:1,fenceId:g$()},X={runId:g$(),deviceId:g$(),rootId:g$(),apiOrigin:$.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>Q},Y=W9(J,X),V={version:1,snapshot_id:g$(),revision:1,run_id:X.runId,device_id:X.deviceId,root_id:X.rootId,binding:{...X.binding,target_generation:Q.generation,target_fence_id:Q.fenceId},expires_at:new Date(X.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return Y.install(V).installed&&Y.current().snapshot_id===V.snapshot_id&&!Z.aborted}catch{return!1}finally{try{D9(Y.path)}catch{}}}async function z9($,J,Z=j9){if(J.aborted)return!1;let Q,X,Y=new Set,V=g$(),U=UQ((K)=>{Y.add(K),K.once("close",()=>Y.delete(K)),K.on("error",()=>K.destroy()),K.end(V)});U.maxConnections=1;let G,H,F=new Promise((K)=>{H=()=>K(!1)}),q=setTimeout(H,FQ);J.addEventListener("abort",H,{once:!0});try{Q=Z({runtimeDirectory:u($),root:$.workspaceRoot,runId:`readiness-${g$()}`}),X=NQ(Q.journalDirectory,"readiness.json");let K=GQ(X,"wx",384);try{BQ(K,V),VQ(K)}finally{YQ(K)}if(KQ(X,"utf8")!==V||J.aborted)return!1;let N=new Promise((T)=>{U.once("error",()=>T(!1)),U.listen(Q.socketPath,()=>{try{if(process.platform!=="win32")XQ(Q.socketPath,384)}catch{T(!1);return}G=qQ(Q.socketPath);let M="";G.setEncoding("utf8"),G.once("error",()=>T(!1)),G.on("data",(L)=>{if(M+=L,M.length>V.length)G?.destroy(),T(!1)}),G.once("end",()=>T(M===V)),G.once("close",()=>T(!1))})});return await Promise.race([N,F])&&!J.aborted}catch{return!1}finally{clearTimeout(q),J.removeEventListener("abort",H),G?.destroy();for(let K of Y)K.destroy();if(await new Promise((K)=>U.close(()=>K())),Q?.disposeSocket(),X)try{D9(X)}catch{}if(Q){try{L9(Q.journalDirectory)}catch{}try{L9(HQ(Q.journalDirectory))}catch{}}}}import{execFileSync as w8}from"child_process";import{randomUUID as l0}from"crypto";import{chmodSync as O9,chownSync as f9,closeSync as n1,constants as F$,existsSync as TQ,fstatSync as v9,mkdirSync as A9,mkdtempSync as MQ,openSync as t1,readFileSync as LQ,readSync as jQ,realpathSync as WQ,rmdirSync as DQ,rmSync as _Q}from"fs";import{join as u$}from"path";import{fileURLToPath as zQ}from"url";var P9=1e4,OQ=!1;function y8(){if(process.platform!=="linux")return!1;return OQ||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some(($)=>{try{let J=w8($,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),Z=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(J);return Z!==null&&Number(Z[1])*100+Number(Z[2])>=302}catch{return!1}})}var AQ=Buffer.from([0,255,3,4]);function R9($){return`printf "%s\\n" ${$==="foreground"?"$$":"$!"} > ${$}.pid.tmp; /bin/mv ${$}.pid.tmp ${$}.pid`}function PQ($,J,Z){if(!Number.isSafeInteger(J)||J<2||!Number.isSafeInteger(Z)||Z<2||$.length>4096||!$.startsWith(`${J} (`))return!1;let Q=$.lastIndexOf(") ");if(Q<0)return!1;let X=$.slice(Q+2).trim().split(/\s+/);return X.length>=20&&/^[A-Za-z]$/.test(X[0])&&/^\d+$/.test(X[1])&&X[2]===String(J)&&X[3]===String(Z)&&/^[1-9][0-9]*$/.test(X[19])}async function y2($,J={}){if(process.platform==="win32")return!$.aborted&&h9();if($.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let Z=b8(),{directory:Q,root:X,runtimeDirectory:Y}=CQ(Z),V=new AbortController,U=()=>V.abort();$.addEventListener("abort",U,{once:!0});let G;V.signal.addEventListener("abort",()=>G?.close(),{once:!0});let H=setTimeout(U,P9),F={organization_id:l0(),user_id:l0(),device_id:l0()},q=l0(),K=l0(),N=l0(),T=l0(),M=Date.now()+P9,L={kind:"workspace_source",target_revision:0,root_grant_revision:1},D=l0().replaceAll("-",""),_,j=Buffer.alloc(0),z,A=!1,I=!1,x=!1,P=!1,W,O,y,b=async(l)=>{while(!l()){if(V.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((k)=>setTimeout(k,20))}if(V.signal.aborted)throw Error("pty_probe_cancelled")},w=!1;try{G=RQ(Q,Z),W=Bun.serve({hostname:"127.0.0.1",port:0,fetch(C,S){let E=new URL(C.url).pathname,v=E===`/device/hands/${D}`?"hands":E===`/device/pty/${D}`?"pty":null;if(v&&S.upgrade(C,{data:{lane:v}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(C){if(C.data.lane==="pty")_=C},message(C,S){if(C.data.lane!=="pty")return;if(typeof S==="string"){try{if(JSON.parse(S).t==="open")A=!0}catch{U()}return}if(j.length+S.length>8192){U();return}j=Buffer.concat([j,S])}}});let l=`ws://127.0.0.1:${W.port}`;if(O=r1({headless:!0,managedPty:{version:1},root:X,runtimeDirectory:Y,runId:q,operationId:l0(),attemptId:l0(),claimOwner:F,deviceIdentity:{deviceId:F.device_id,rootId:K,apiOrigin:"https://worker-probe.invalid"},signal:V.signal,payload:{relay_url:`${l}/device/hands/${D}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(M).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:I9,hands_worker_version:E9,hands_worker_artifact_sha256:b9,hands_worker_entrypoint:S9,target_generation:1,target_fence_id:N,environment_binding:L,[w9]:y9},emitEvent:async(C)=>{if(C==="hands.started")P=!0;if(C==="hands.ready")I=!0;if(C==="hands.stopped")x=!0}},{browserExecutablePath:null,slot:k9(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:zQ(new URL("./worker-candidate-entry.ts",import.meta.url)),...J}).catch(()=>{if(!I)U()}),await b(()=>I),C9({root:X,runId:q,payload:{version:1,snapshot_id:T,revision:1,run_id:q,root_id:K,device_id:F.device_id,binding:{...L,target_generation:1,target_fence_id:N},expires_at:new Date(M).toISOString(),variables:{PTY_PROBE_VALUE:D},git:null}}),y=x9({root:X,runId:q,rootId:K,deviceId:F.device_id,owner:F,workspace:{kind:"root"},authority:{device_id:F.device_id,binding:L.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:N},signal:V.signal,session:{jobId:`pty-${l0()}`,sessionId:"pty-readiness",operationId:l0(),cols:80,rows:24,leaseExpiresAtMs:M,relayUrl:`${l}/device/pty/${D}`},emit:async(C,S)=>{if(C==="pty.ready")z=S}}).catch(()=>{U()}),await b(()=>Boolean(z&&_&&A)),_.send(JSON.stringify({t:"resize",cols:100,rows:30})),_.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${D}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${G.wait("background")}) & ${R9("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${R9("foreground")}; ${G.wait("foreground")}'
-`)),await b(()=>TQ(u$(X,"foreground.pid"))&&j.includes(AQ)),!j.includes("30 100")||z.job.environmentSnapshotId!==T||z.job.environmentRevision!==1)return!1;let k=["background.pid","foreground.pid"].map((C)=>IQ(u$(X,C)));if(new Set(k).size!==2||k.some((C)=>!Number.isSafeInteger(C)||C<2||C===z.job.process.pid))return!1;if(process.platform==="linux"){if(!k.every((C)=>PQ(LQ(`/proc/${C}/stat`,"utf8"),C,z.job.process.pid)))return!1}else{let S=w8("/bin/ps",["-o","pid=,pgid=","-p",k.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((E)=>E.trim().split(/\s+/).map(Number));if(S.length!==2||new Set(S.map(([E])=>E)).size!==2||S.some((E)=>E.length!==2||!k.includes(E[0])||E[0]!==E[1]))return!1}if(_.send(JSON.stringify({t:"close"})),await y,V.signal.aborted)return!1;for(let C of[z.job.process.pid,...k])try{return process.kill(C,0),!1}catch(S){if(!(S instanceof Error&&("code"in S)&&S.code==="ESRCH"))return!1}w=!0}catch{w=!1}finally{if(clearTimeout(H),$.removeEventListener("abort",U),U(),G?.close(),await y,await O,await W?.stop(!0),!P||x)xQ({directory:Q,root:X},Z)}return w&&x&&!$.aborted}function RQ($,J){let Z={foreground:u$($,"foreground.lifeline"),background:u$($,"background.lifeline")};if(!Object.values(Z).every((Y)=>/^\/[A-Za-z0-9/._-]+$/.test(Y)))throw Error("pty_probe_path");w8("/usr/bin/mkfifo",["-m","0600",...Object.values(Z)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let Q=[],X=()=>{for(let Y of Q.splice(0))n1(Y)};try{for(let Y of Object.values(Z)){let V=t1(Y,F$.O_RDONLY|F$.O_NONBLOCK|F$.O_NOFOLLOW);try{if(Q.push(t1(Y,F$.O_WRONLY|F$.O_NONBLOCK|F$.O_NOFOLLOW)),!v9(Q.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{n1(V)}if(J)f9(Y,J.uid,J.gid)}}catch(Y){throw X(),Y}return{wait:(Y)=>`exec 3<>${Z[Y]} <${Z[Y]} 3>&-; exec /bin/cat`,close:X}}function m9($=(J)=>y2(J)){let J=new AbortController,Z=JSON.stringify(b8()),Q=(async()=>{try{return await $(J.signal)===!0&&!J.signal.aborted}catch{return!1}})();return{result:Q,matches:(X)=>X.executionMode==="host"&&JSON.stringify(b8())===Z,stop:async(X=1500)=>{J.abort();let Y;await Promise.race([Q,new Promise((V)=>{Y=setTimeout(V,X)})]),clearTimeout(Y)}}}function IQ($){let J;try{J=t1($,F$.O_RDONLY|F$.O_NOFOLLOW|F$.O_NONBLOCK)}catch{return Number.NaN}try{let Z=v9(J);if(!Z.isFile()||Z.size>32)return Number.NaN;let Q=Buffer.alloc(32),X=jQ(J,Q,0,Q.length,0),Y=Q.subarray(0,X).toString("utf8").trim();return/^[0-9]{1,10}$/.test(Y)?Number(Y):Number.NaN}catch{return Number.NaN}finally{n1(J)}}function CQ($,J=WQ("/tmp")){let Z=MQ(u$(J,"reason-pty-probe-")),Q=u$(Z,"workspace"),X=u$(Z,"private");if(A9(Q,{mode:448}),A9(X,{mode:448}),$)O9(Z,493),O9(Q,493),f9(Q,$.uid,$.gid);return{directory:Z,root:Q,runtimeDirectory:X}}function xQ($,J){if(J)try{w8("/usr/bin/setpriv",[`--reuid=${J.uid}`,`--regid=${J.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",$.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),DQ($.root)}catch{return}_Q($.directory,{recursive:!0,force:!0})}var XJ=5000,d$="ARA_WORKER_PROBE_READY";function fQ($,J,Z,Q,X){if(X.aborted)return Promise.resolve(!1);return new Promise((Y)=>{EQ($,J,{cwd:Z,env:Q,signal:X,timeout:XJ,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8",windowsHide:!0},(V,U)=>Y(!V&&!X.aborted&&U===d$))})}function vQ($,J){let Z=$4($).replace(/\.exe$/i,"");if(Z==="bash")return["--noprofile","--norc","-c",J];if(Z==="zsh"||Z==="sh")return["-f","-c",J];return null}function mQ($,J){let Z=a9({home:J,temporaryDirectory:J}),Q=(Y,V,U)=>fQ(Y,V,$.workspaceRoot,Z,U),X=async(Y,V,U,G=(F)=>F===d$,H=!1)=>{let F=process.platform==="win32"?e1(k8(hQ(),"reason-device-probe-")):$.workspaceRoot;try{let q=await JJ(Y,V,{cwd:F,root:F,allowWrite:!1,allowProcessInspection:H,timeoutMs:XJ,signal:U,workerProbe:!0}),K=!U.aborted&&!q.timedOut&&!q.truncated&&q.exitCode===0&&G(q.stdout);if(!K&&process.platform==="win32")process.stderr.write(`Reason worker: confined ${$4(Y)} probe failed (exit ${q.exitCode}${q.timedOut?", timed out":""}): ${q.stderr.slice(-300).trim()}
-`);return K}catch(q){if(process.platform==="win32")process.stderr.write(`Reason worker: confined ${$4(Y)} probe failed: ${String(q)}
-`);throw q}finally{if(F!==$.workspaceRoot)QJ(F,{recursive:!0,force:!0})}};return{workspaceRead:async(Y)=>{return await u9($.workspaceRoot,g9.R_OK),await p9($.workspaceRoot),!Y.aborted},workspaceWrite:async(Y)=>{if(await u9($.workspaceRoot,g9.W_OK),Y.aborted)return!1;let V=e1(k8($.workspaceRoot,".ara-worker-probe-")),U=k8(V,"receipt");try{let G=await bQ(U,"wx",384);try{await G.writeFile(d$),await G.sync()}finally{await G.close()}return await d9(U,"utf8")===d$&&!Y.aborted}finally{await yQ(U).catch(()=>{}),await kQ(V).catch(()=>{})}},confinedShell:(Y)=>{if(process.platform==="win32"&&!k2())return process.stderr.write(`Reason worker: ${i9}
-`),Promise.resolve(!1);return X($J(),["-c",`printf ${d$}`],Y)},confinedGit:(Y)=>X("git",["--version"],Y,(V)=>/^git version \S+/.test(V)),processInspection:async(Y)=>{if(process.platform==="darwin")return X("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],Y,(H)=>H.includes(`p${process.pid}
-`)&&/^n\//m.test(H),!0);if(process.platform==="win32")return n9(Y);if(process.platform!=="linux")return!1;let[V,U,G]=await Promise.all([wQ("/proc/self/cwd"),p9("/proc/self/fd"),d9("/proc/net/tcp","utf8")]);return!Y.aborted&&V.length>0&&U.length>0&&G.includes("local_address")},bash:async(Y)=>{let V=process.platform==="win32"?V2():"/bin/bash";if(!V)return process.stderr.write(`Reason worker: ${process.platform==="win32"?s9:"bash is unavailable"}
-`),!1;return Q(V,["--noprofile","--norc","-c",`printf ${d$}`],Y)},jobs:(Y)=>z9($,Y),environment:(Y)=>_9($,J,Y),preview:(Y)=>ZJ(J,Y),boundPty:(Y)=>y2(Y),desktopDisplay:()=>e9(),desktopAutomation:async()=>{let Y=Z4();if(Y)process.stderr.write(`Reason worker: computer and browser use need setup (${Y})
-`);return VJ()},desktopBrowser:async()=>f2()?.features.browser===!0,fullControlShell:(Y)=>{let V=o9(),U=vQ(V,`printf ${d$}`);return U?Q(V,U,Y):Promise.resolve(!1)}}}function Z4(){return process.platform==="darwin"&&f2()?.features.computer===!0?c9():null}var Q4=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function gQ($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=J4()){return h2($,J,Z,Q,X).final}function h2($,J,Z=new AbortController().signal,Q={read:!0,write:!1},X=J4(),Y,V){let U,G;try{if(H$($),g0(),!J)e(u($),!0),U=e1(k8(u($),"probe-")),J=mQ($,U);G=J}catch(_){let j=Promise.reject(_);return j.catch(()=>{}),{initial:j,final:j,pty:j}}let H=async(_,j)=>{if(Z.aborted||!j&&!G[_])return!1;let z,A=new Promise((I)=>{z=()=>I(!1)});Z.addEventListener("abort",z,{once:!0});try{return await Promise.race([j??G[_](Z),A])===!0&&!Z.aborted}catch{return!1}finally{Z.removeEventListener("abort",z)}},F=$.executionMode==="host",q=F?H("boundPty",Y):Promise.resolve(!1),K=Promise.resolve(V).then(()=>Promise.all(F?[H("preview"),q,H("desktopDisplay"),H("desktopAutomation"),H("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),N=(async()=>{let[_,j,z,A,I,x,P,W,O]=await Promise.all([Promise.resolve(Q).then((y)=>y.read?H("workspaceRead"):!1,()=>!1),Promise.resolve(Q).then((y)=>y.write?H("workspaceWrite"):!1,()=>!1),X?H("confinedShell"):!1,X?H("confinedGit"):!1,H("processInspection"),...F?[H("bash"),H("jobs"),H("environment"),H("fullControlShell")]:[!1,!1,!1,!1]]);if(F&&(!x||!P||!W)&&!V)await K;if(F){if(!x)x=await H("bash");if(!P)P=await H("jobs");if(!W)W=await H("environment")}return{read:_,write:j,shell:z,git:A,processes:I,bash:x,jobs:P,environment:W,full:O}})(),T=(_,j)=>{let{read:z,write:A,shell:I,git:x,processes:P,bash:W,jobs:O,environment:y,full:b}=_,{preview:w,boundPty:l,desktopDisplay:k,desktopAutomation:C,desktopBrowser:S}=j,E=t9(),v=F&&process.platform==="darwin"&&b&&SQ("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":z,"fs.write":A,"inference.custom.v1":F&&z,"fs.export":z&&E,"fs.import":A&&E,"exec.run":I&&X,"git.run":I&&x&&X,"process.list":(process.platform==="linux"||process.platform==="win32"||I)&&P,"ports.list":(process.platform==="linux"||process.platform==="win32"||I)&&P,"exec.full":W&&b&&X,"hands.connect":z&&A&&W&&O,"jobs.control":z&&A&&W&&O,"pty.start":z&&A&&W&&O&&y&&l,"environment.install":z&&A&&W&&O&&y,"github.local.v1":(process.platform==="darwin"||process.platform==="win32"||process.platform==="linux"&&process.geteuid?.()!==0)&&z&&A&&W&&O&&y,"tunnel.open":z&&A&&W&&O&&y&&w,"tunnel.close":z&&A&&W&&O&&y&&w,"preview.serve.v1":z&&W&&O&&w&&b,"display.stream.v1":k,"automation.call.v1":C,"simulator.call.v1":v,"simulator.stream.v1":v,"browser.pr-proof.v1":C&&S&&l9()===null&&process.platform!=="win32","workspace.setup.v1":F&&r9()})},M=N.then(async(_)=>T(_,{preview:!1,boundPty:await Promise.race([q,new Promise((j)=>setImmediate(()=>j(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),L=(async()=>{try{let _=await N,[j,z,A,I,x]=await K;if(F&&!z&&_.read&&_.write&&_.bash&&_.jobs&&_.environment)z=await H("boundPty");return T(_,{preview:j,boundPty:z,desktopDisplay:A,desktopAutomation:I,desktopBrowser:x})}finally{if(U)QJ(U,{recursive:!0,force:!0})}})();M.catch(()=>{});let D=(async()=>{let _=await N;if(!(_.read&&_.write&&_.bash&&_.jobs&&_.environment))return!1;return await q||(await L)["pty.start"]===!0})();return D.catch(()=>{}),{initial:M,final:L,pty:D}}var uQ=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],dQ=[60000,300000,900000];function o1($,J){if($.executionMode!=="host"||J["fs.read"]!==!0)return[];return uQ.filter((Z)=>J[Z]!==!0)}function YJ($){let J=$.log??((Y)=>{process.stderr.write(Y)}),Z=$.resolve??((Y)=>gQ($.config,void 0,Y,$.permissions)),Q=$.readiness,X=o1($.config,Q);if(X.length===0)return Promise.resolve();return J(`Reason worker: withheld at start (${X.join(", ")}); probing them again while idle.
-`),(async()=>{for(let Y of $.delaysMs??dQ){if(await new Promise((G)=>{let H=setTimeout(G,Y);$.signal.addEventListener("abort",()=>{clearTimeout(H),G()},{once:!0})}),$.signal.aborted)return;if(!$.idle())continue;let V;try{V=await Z(AbortSignal.any([$.signal,AbortSignal.timeout(30000)]))}catch{continue}if($.signal.aborted)return;let U=o1($.config,Q).filter((G)=>V[G]===!0);if(U.length>0)Q=Object.freeze({...Q,...Object.fromEntries(U.map((G)=>[G,!0]))}),J(`Reason worker: ready after probing again (${U.join(", ")}).
-`),$.onReady(Q,U);if(o1($.config,Q).length===0)return}})()}import{execFile as dX}from"child_process";import{createHash as pX,randomUUID as W4}from"crypto";import{lstat as lX,readdir as iJ,readFile as eJ,realpath as cX,stat as sX}from"fs/promises";import{basename as aX,join as L4}from"path";import{promisify as iX}from"util";import{createConnection as pQ}from"net";import{endianness as BJ}from"os";var v2=4,X4=1e4;class R${socketPath;sessionId;turnId;timeoutMs;#J=null;#$=Buffer.alloc(0);#Y=1;#Z=new Map;#Q=new Set;constructor($){this.socketPath=$.socketPath,this.sessionId=$.sessionId??"open-browser-use-js",this.turnId=$.turnId??`turn-${Date.now()}`,this.timeoutMs=$.timeoutMs??1e4}async connect(){if(this.#J)return this;let $=pQ(this.socketPath);return this.#J=$,$.on("data",(J)=>this.#V(Buffer.from(J))),$.on("close",()=>this.#X(Error("Open Browser Use socket closed"))),$.on("error",(J)=>this.#X(J)),await new Promise((J,Z)=>{$.once("connect",J),$.once("error",Z)}),this}close(){this.#J?.end(),this.#J=null}onNotification($){return this.#Q.add($),()=>{this.#Q.delete($)}}async request($,J={}){await this.connect();let Z=this.#J;if(!Z)throw Error("Open Browser Use socket is not connected");let Q=String(this.#Y++),X={session_id:this.sessionId,turn_id:this.turnId,...J},V=lQ({jsonrpc:"2.0",id:Q,method:$,params:X}),U=new Promise((G,H)=>{let F=setTimeout(()=>{this.#Z.delete(Q),H(Error(`Open Browser Use request timed out: ${$}`))},this.timeoutMs);this.#Z.set(Q,{resolve:G,reject:H,timeout:F})});return Z.write(V),await U}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory($={}){return this.request("getUserHistory",$)}claimUserTab($){return this.request("claimUserTab",{tabId:$})}finalizeTabs($){return this.request("finalizeTabs",{keep:$})}nameSession($){return this.request("nameSession",{name:$})}attach($){return this.request("attach",{tabId:$})}detach($){return this.request("detach",{tabId:$})}executeCdp($,J,Z={}){return this.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z})}moveMouse($,J,Z,Q=!0){return this.request("moveMouse",{tabId:$,x:J,y:Z,waitForArrival:Q})}waitForFileChooser($,J){return this.request("waitForFileChooser",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}setFileChooserFiles($,J){return this.request("setFileChooserFiles",{fileChooserId:$,files:J})}waitForDownload($,J){return this.request("waitForDownload",{tabId:$,...J===void 0?{}:{timeoutMs:J}})}downloadPath($,J){return this.request("downloadPath",{downloadId:$,...J===void 0?{}:{timeoutMs:J}})}browserUserHistory($={}){return this.getUserHistory($)}readClipboardText($){return this.request("readClipboardText",{tabId:$})}writeClipboardText($,J){return this.request("writeClipboardText",{tabId:$,text:J})}readClipboard($){return this.request("readClipboard",{tabId:$})}writeClipboard($,J){return this.request("writeClipboard",{tabId:$,items:J})}turnEnded(){return this.request("turnEnded")}#V($){this.#$=Buffer.concat([this.#$,$]);while(this.#$.length>=v2){let J=BJ()==="LE"?this.#$.readUInt32LE(0):this.#$.readUInt32BE(0),Z=v2+J;if(this.#$.length<Z)return;let Q=this.#$.subarray(v2,Z);this.#$=this.#$.subarray(Z),this.#G(JSON.parse(Q.toString("utf8")))}}#G($){if(!r0($))return;let J=typeof $.id==="string"||typeof $.id==="number"?String($.id):null;if(!J&&typeof $.method==="string"){let Q={method:$.method,params:$.params};for(let X of this.#Q)X(Q);return}if(!J)return;let Z=this.#Z.get(J);if(!Z)return;if(this.#Z.delete(J),clearTimeout(Z.timeout),r0($.error)){Z.reject(Error(String($.error.message??"Open Browser Use request failed")));return}Z.resolve($.result??null)}#X($){for(let[J,Z]of this.#Z)this.#Z.delete(J),clearTimeout(Z.timeout),Z.reject($)}}class h8{client;cdp;constructor($){this.client="client"in $?$.client:new R$($),this.cdp=new HJ(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab($={}){let J=await this.client.createTab(),Z=cQ(J,"createTab response"),Q=this.tab(Z);if($.url)await Q.goto($.url,$);return Q}tab($){return new qJ(this,$)}getTabs(){return this.client.getTabs()}}class qJ{browser;id;playwright;constructor($,J){this.browser=$,this.id=J,this.playwright=new UJ(this)}goto($,J={}){return this.browser.cdp.navigate(this.id,$,J)}waitForLoadState($={}){return this.browser.cdp.waitForLoadState(this.id,$)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then(($)=>String($??""))}evaluate($,J={}){return this.browser.cdp.evaluate(this.id,$,J)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class UJ{tab;constructor($){this.tab=$}waitForLoadState($={}){return this.tab.waitForLoadState($)}domSnapshot(){return this.tab.domSnapshot()}}class HJ{client;#J=new Set;constructor($){this.client=$}async call($,J,Z={},Q={}){return await this.ensureAttached($),this.client.request("executeCdp",{target:{tabId:$},method:J,commandParams:Z,...Q.timeoutMs===void 0?{}:{timeoutMs:Q.timeoutMs}})}async evaluate($,J,Z={}){let Q=await this.call($,"Runtime.evaluate",{expression:J,returnByValue:!0,...Z.awaitPromise===void 0?{}:{awaitPromise:Z.awaitPromise}});if(r0(Q)&&r0(Q.exceptionDetails))throw Error(String(Q.exceptionDetails.text??"Open Browser Use evaluation failed"));return r0(Q)&&r0(Q.result)?Q.result.value??null:null}async navigate($,J,Z={}){if(!J)throw Error("goto requires a URL");let Q=Z.waitUntil??"load";GJ(Q);let X=Z.timeoutMs??X4;await this.call($,"Page.enable");let Y=this.waitForLoadEvent($,Q,X),V=await this.call($,"Page.navigate",{url:J},{timeoutMs:X});if(r0(V)&&typeof V.errorText==="string"&&V.errorText)throw Error(`Browser failed to navigate tab ${$}: ${V.errorText}`);return await Y.catch(async(U)=>{let G=await this.readDocumentState($);if(KJ(G,Q))return;throw U}),V}async waitForLoadState($,J={}){let Z=J.state??"load";GJ(Z),await this.call($,"Page.enable");let Q=await this.readDocumentState($);if(KJ(Q,Z))return;await this.waitForLoadEvent($,Z,J.timeoutMs??X4)}async readDocumentState($){try{let J=await this.evaluate($,"({ href: window.location.href, readyState: document.readyState })");return r0(J)?{href:Y4(J.href),readyState:Y4(J.readyState)}:void 0}catch{return}}waitForEvent($,J,Z={}){let Q=Z.timeoutMs??X4;return new Promise((X,Y)=>{let V=!1,U=null,G,H=()=>{if(V)return!1;return V=!0,clearTimeout(G),U?.(),!0};G=setTimeout(()=>{if(H())Y(Error(Z.timeoutMessage??`Timed out waiting for tab ${$} event`))},Q),U=this.client.onNotification((F)=>{try{if(J(F)){if(H())X(F)}}catch(q){if(H())Y(q instanceof Error?q:Error(String(q)))}})})}waitForLoadEvent($,J,Z){return this.waitForEvent($,(Q)=>{let X=sQ(Q,$);if(!X)return!1;if(X.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${$}`);return J==="domcontentloaded"?X.method==="Page.domContentEventFired":X.method==="Page.loadEventFired"},{timeoutMs:Z,timeoutMessage:`Timed out waiting for ${J} in tab ${$}`}).then(()=>{return})}async ensureAttached($){if(this.#J.has($))return;await this.client.attach($),this.#J.add($)}}function lQ($){let J=Buffer.from(JSON.stringify($),"utf8"),Z=Buffer.alloc(v2+J.length);if(BJ()==="LE")Z.writeUInt32LE(J.length,0);else Z.writeUInt32BE(J.length,0);return J.copy(Z,v2),Z}function r0($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function cQ($,J){if(!r0($))throw Error(`${J} did not include a tab object`);let Z=$.id;if(typeof Z==="number"&&Number.isInteger(Z)&&Z>0)return Z;if(typeof Z==="string"){let Q=Number(Z);if(Number.isInteger(Q)&&Q>0)return Q}throw Error(`${J} did not include a numeric tab id`)}function GJ($){if($!=="domcontentloaded"&&$!=="load")throw Error(`Unsupported load state "${$}". Use "domcontentloaded" or "load".`)}function KJ($,J){if($?.readyState==="complete")return!0;return J==="domcontentloaded"&&$?.readyState==="interactive"}function sQ($,J){if($.method!=="onCDPEvent"||!r0($.params))return null;let Z=$.params.source;if(!r0(Z)||Z.tabId!==J)return null;return{method:Y4($.params.method)}}function Y4($){return typeof $==="string"?$:void 0}import{createHash as aQ}from"crypto";function NJ($,J,Z,Q){let X=JSON.stringify([$.trim().toLowerCase(),J.trim().toLowerCase(),Z,Q]);return`reason-cloud-${aQ("sha256").update(X).digest("hex")}`}import{AsyncLocalStorage as mX}from"async_hooks";import{isDeepStrictEqual as sJ}from"util";import{createHash as gX}from"crypto";var iQ=/#w=(\d{1,5})&h=(\d{1,5})$/;function FJ($){return typeof $==="number"&&Number.isInteger($)&&$>0&&$<=32768?$:void 0}function TJ($){let J=iQ.exec($);if(!J)return;let Z=FJ(Number(J[1])),Q=FJ(Number(J[2]));return Z&&Q?{width:Z,height:Q}:void 0}var MJ="[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}",nQ=new RegExp(`^/media/pr-screenshots/(${MJ})/(${MJ})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$`,"i");var tQ=new Set(["png","jpg","jpeg","gif","webp"]),rQ=new Set(["webm","mp4"]);function oQ($){if(!$)return null;try{return new URL($).origin}catch{return null}}function eQ($){let J=TJ($);return Boolean(J&&$===`#w=${J.width}&h=${J.height}`)}function LJ($,J){let Z;try{Z=new URL($)}catch{return null}let Q=oQ(J),X=Z.hostname==="ara.so"||Z.hostname.endsWith(".ara.so")||Z.hostname==="reasonmachines.ai"||Z.hostname.endsWith(".reasonmachines.ai")||Z.hostname==="reasonmachines.com"||Z.hostname.endsWith(".reasonmachines.com");if(Z.protocol!=="https:"||!X&&Z.origin!==Q||Z.username||Z.password||Z.port||Z.search||Z.hash&&!eQ(Z.hash))return null;let Y=nQ.exec(Z.pathname);if(!Y)return null;let V=Y[1]?.toLowerCase(),U=Y[2]?.toLowerCase(),G=Y[3]?.toLowerCase(),H=Y[4]?.toLowerCase();if(!V||!U||!G||!H)return null;let F=tQ.has(H)?"image":rQ.has(H)?"video":null;if(!F)return null;let q=/^(before|after)[\s:_-]+/.exec(G),K=Z.pathname.replace(/^\/media\//,"");return{url:Z.toString(),storagePath:K,runId:V,artifactId:U,fileName:`${G}.${H}`,kind:F,phase:q?.[1]==="before"||q?.[1]==="after"?q[1]:null}}var $X=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,f8=($)=>Boolean($&&typeof $==="object"&&!Array.isArray($)),p$=()=>{throw Error("cloud_browser_media_request_invalid")};function v8($){if(!f8($)||Object.keys($).some((Y)=>!["runId","configuredMediaOrigin","media"].includes(Y))||typeof $.runId!=="string"||!$X.test($.runId)||typeof $.configuredMediaOrigin!=="string"||$.configuredMediaOrigin.length>2048||!Array.isArray($.media)||$.media.length<1||$.media.length>8)return p$();let J;try{J=new URL($.configuredMediaOrigin)}catch{return p$()}if(J.protocol!=="https:"||J.username||J.password||J.port||!jJ(J.origin,{mode:"public_web"}).allowed)return p$();let Z=$.runId.toLowerCase(),Q=new Set,X=$.media.map((Y)=>{if(!f8(Y)||Object.keys(Y).some((U)=>!["url","sourceUrl","kind"].includes(U))||typeof Y.url!=="string"||Y.url.length>2048||typeof Y.sourceUrl!=="string"||Y.sourceUrl.length>8192||!["image","video"].includes(String(Y.kind)))return p$();let V=LJ(Y.url,J.origin);if(!V||new URL(V.url).origin!==J.origin||V.runId!==Z||V.kind!==Y.kind||V.url!==Y.url||Q.has(Y.url))return p$();if(Q.add(Y.url),Y.sourceUrl!==Y.url){let U;try{U=new URL(Y.sourceUrl)}catch{return p$()}let G=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(U.pathname)?.[1];if(Y.kind!=="image"||U.origin!=="https://camo.githubusercontent.com"||U.username||U.password||U.search||U.hash||!G||G.length%2!==0||Buffer.from(G,"hex").toString("utf8")!==Y.url)return p$()}return{url:Y.url,sourceUrl:Y.sourceUrl,kind:Y.kind}});return{runId:$.runId,configuredMediaOrigin:J.origin,media:X}}function WJ($,J){let Z=()=>{throw Error("cloud_browser_media_verification_failed")};if(!f8($)||$.verified!==!0||!Array.isArray($.items)||$.items.length!==J.media.length)return Z();return{verified:!0,items:$.items.map((X,Y)=>{let V=J.media[Y];if(!f8(X)||X.url!==V.url||X.sourceUrl!==V.sourceUrl||X.kind!==V.kind||typeof X.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(X.sourceSha256)||!Number.isSafeInteger(X.width)||!Number.isSafeInteger(X.height)||Number(X.width)<1||Number(X.height)<1||Number(X.width)>16384||Number(X.height)>16384||V.kind==="video"&&(typeof X.advancedSeconds!=="number"||!Number.isFinite(X.advancedSeconds)||X.advancedSeconds<0.05||X.advancedSeconds>30))return Z();return{...V,width:Number(X.width),height:Number(X.height),sourceSha256:X.sourceSha256,...V.kind==="video"?{advancedSeconds:X.advancedSeconds}:{}}})}}var G4="browser.pr-proof.v1",j0=B.string().uuid(),G2=B.string().regex(/^[a-f0-9]{64}$/),c$=B.iso.datetime({precision:3}),V4=B.string().regex(/^[a-zA-Z0-9_-]{1,160}$/),OJ=B.string().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine(($)=>![".",".."].includes($.split("/")[4])),c0=B.object({kind:B.literal("primary_mac"),version:B.literal(1),organizationId:V4,userId:V4,sessionId:V4,runId:j0,deviceId:j0,rootId:j0,rootRevision:B.string().min(1).max(64),binding:B.enum(["workspace_source","mcp_control"]),targetRevision:B.number().int().nonnegative(),generation:j0,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024)}).strict().refine(($)=>$.binding!=="workspace_source"||$.targetRevision===0),JX=B.custom().transform(($,J)=>{try{return zJ($)}catch{return J.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),B.NEVER}}),K2=B.object({version:B.literal(1),owner:c0,contextId:j0,preparedAt:c$,expiresAt:c$,prUrl:OJ,headSha:B.string().regex(/^[a-f0-9]{40}$/),skillDigest:G2,evidenceKind:B.enum(["image","video"]),visualPlan:JX.optional(),uploadOrigin:B.string().url().refine(($)=>{let J=new URL($);return J.protocol==="https:"&&J.origin===$&&!J.username&&!J.password}).optional()}).strict().refine(($)=>Date.parse($.expiresAt)>Date.parse($.preparedAt)&&Date.parse($.expiresAt)-Date.parse($.preparedAt)<=300000),K4=B.object({version:B.literal(1),producer:B.literal("primary_mac"),context:K2,captureId:j0,operationId:j0,attemptId:j0,tabId:B.number().int().positive(),startedAt:c$,finishedAt:c$,sha256:G2,media:B.discriminatedUnion("contentType",[B.object({contentType:B.literal("image/png"),sizeBytes:B.number().int().min(24).max(8388608),width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096)}).strict(),B.object({contentType:B.literal("video/webm"),sizeBytes:B.number().int().min(128).max(10485760),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000)}).strict()])}).strict().superRefine(($,J)=>{let Z=Date.parse($.startedAt),Q=Date.parse($.finishedAt);if(Z<Date.parse($.context.preparedAt)||Q<Z||Q>Date.parse($.context.expiresAt)||Q-Z>30000||$.media.contentType==="video/webm"&&($.media.receivedFrameCount<$.media.frameCount||Math.abs((Q-Z)/1000-$.media.durationSeconds)>0.1))J.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),AU=B.discriminatedUnion("action",[B.object({action:B.literal("screenshot"),context_id:j0,tab_id:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),context_id:j0,tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("stop_video"),recording_operation_id:j0}).strict()]),g8=B.object({login:B.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:B.string().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),m8=B.string().regex(/^[1-9][0-9]{0,19}$/),m2=B.object({version:B.literal(1),owner:c0,expectedActorId:m8.nullable(),repositoryId:m8,repositoryFullName:B.string().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine(($)=>![".",".."].includes($.split("/")[1]))}).strict(),ZX=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],B4=B.discriminatedUnion("status",[m2.extend({status:B.literal("ready"),observedActor:g8,checkedAt:c$}),m2.extend({status:B.literal("not_ready"),reason:B.enum(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:B.enum(ZX).optional()})]).refine(($)=>$.status!=="ready"||$.expectedActorId===null||$.observedActor.id===$.expectedActorId),l$=B.object({version:B.literal(1),owner:c0,expectedActorId:m8.nullable(),authenticatedActor:g8,attemptId:j0,captureId:j0,prUrl:OJ,repositoryId:m8,headSha:B.string().regex(/^[a-f0-9]{40}$/),sha256:G2,sizeBytes:B.number().int().min(128).max(10485760),contentType:B.literal("video/webm")}).strict(),AJ=B.string().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),B2=B.discriminatedUnion("status",[l$.extend({status:B.literal("not_attempted"),reason:B.enum(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),l$.extend({status:B.literal("uncertain"),reason:B.literal("upload_outcome_unknown")}),l$.extend({status:B.literal("uploaded"),observedActor:g8,nativeUrl:AJ,uploadedAt:c$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&($.status!=="uploaded"||$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login)),g2=l$.extend({nativeUrl:AJ,observedActor:g8,bodySha256:G2}),q4=B.discriminatedUnion("status",[g2.extend({status:B.literal("incomplete"),reason:B.enum(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),g2.extend({status:B.literal("verified"),sourceSha256:G2,width:B.number().int().min(1).max(4096),height:B.number().int().min(1).max(4096),durationSeconds:B.number().positive().max(30),advancedSeconds:B.number().min(0.05).max(10),advancedFrames:B.number().int().positive(),playbackRestored:B.literal(!0),verifiedAt:c$})]).refine(($)=>($.expectedActorId===null||$.authenticatedActor.id===$.expectedActorId)&&$.observedActor.id===$.authenticatedActor.id&&$.observedActor.login===$.authenticatedActor.login&&($.status!=="verified"||$.sourceSha256===$.sha256)),QX=B.custom().transform(($,J)=>{try{let Z=v8($);if(Z.media.some((Q)=>Q.kind!=="image"))throw Error();return Z}catch{return J.addIssue({code:"custom",message:"proof_media_request_invalid"}),B.NEVER}}),XX=B.discriminatedUnion("action",[B.object({action:B.literal("auth_check"),input:m2}).strict(),B.object({action:B.literal("prepare"),context:K2}).strict(),B.object({action:B.literal("capture_png"),owner:c0,contextId:j0,tabId:B.number().int().positive()}).strict(),B.object({action:B.literal("start_video"),owner:c0,contextId:j0,tabId:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),B.object({action:B.literal("inspect_capture"),owner:c0,captureId:j0}).strict(),B.object({action:B.literal("publish_video"),input:l$}).strict(),B.object({action:B.literal("verify_png_media"),owner:c0,media:QX}).strict().refine(($)=>$.media.runId===$.owner.runId),B.object({action:B.literal("verify_saved_media"),input:g2}).strict(),B.object({action:B.literal("publish_png"),owner:c0,attemptId:j0,captureId:j0,sha256:G2,sizeBytes:B.number().int().min(24).max(8388608),storagePath:B.string().max(512),uploadUrl:B.string().url().max(8192)}).strict()]);var PJ="pr-proof.stop.v1",U4=B.object({requestId:j0,command:XX}).strict();var YX={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},DJ={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},_J={type:"integer",minimum:1,description:"An already-owned tab's id."},PU={...YX,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:DJ,tab_id:_J}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:DJ,tab_id:_J,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};import{createHash as VX,randomUUID as GX}from"crypto";import{isDeepStrictEqual as q2}from"util";var RJ=B.object({operationId:B.string().uuid(),attemptId:B.string().uuid(),contextId:B.string().uuid(),tabId:B.number().int().positive()}).strict(),G0=()=>Error("mac_pr_proof_capture_unavailable"),H4=($)=>VX("sha256").update($).digest("hex");function IJ($){let J=c0.parse($.owner),Z=new Map,Q=new Map,X=!1,Y=async()=>{if(X)throw G0();if(await $.assertCurrent(),X)throw G0()},V=(K)=>{let N=Z.get(K);if(!N||Date.parse(N.expiresAt)<=Date.now())throw G0();return N},U=(K)=>K.disposal??=(async()=>{K.controller.abort(),K.bytes?.fill(0),K.bytes=void 0,K.receipt=void 0;try{await K.host?.close()}catch{throw X=!0,G0()}})(),G=async()=>{for(let[K,N]of Z){if(Date.parse(N.expiresAt)>Date.now())continue;let T=[...Q.entries()].filter(([,L])=>L.claim.contextId===K);if((await Promise.allSettled(T.map(([,L])=>U(L)))).some((L)=>L.status==="rejected"))throw G0();for(let[L]of T)Q.delete(L);Z.delete(K)}},H=setInterval(()=>{G().catch(()=>{X=!0})},1000);H.unref();let F=(K)=>{if(K.stopRequested=!0,K.started&&K.host&&!K.stop)K.stop=K.host.stop(),K.stop.catch(()=>K.controller.abort())};async function q(K,N){let T=RJ.parse(K.claim);if(N==="video"&&(!Number.isInteger(K.seconds)||K.seconds<1||K.seconds>15))throw G0();await Y(),K.signal.throwIfAborted(),await G();let M=V(T.contextId);if(N==="video"&&M.evidenceKind!=="video")throw G0();let L=Q.get(T.operationId);if(L){if(!q2(L.claim,T)||L.kind!==N||L.seconds!==K.seconds||L.controller.signal.aborted)throw G0();let P=await L.completion;if(await Y(),V(T.contextId),L.controller.signal.aborted)throw G0();return structuredClone(P)}if(Q.size>=16||[...Q.values()].some((P)=>!P.receipt&&!P.controller.signal.aborted&&P.claim.tabId===T.tabId))throw G0();let D,_,j=new Promise((P,W)=>{D=P,_=W});j.catch(()=>{});let z={claim:T,kind:N,seconds:K.seconds,controller:new AbortController,completion:j,stopRequested:!1,started:!1};Q.set(T.operationId,z);let A=()=>{U(z).catch(()=>{})};K.signal.addEventListener("abort",A,{once:!0});let I=async()=>{await Y(),V(T.contextId),K.signal.throwIfAborted(),z.controller.signal.throwIfAborted()},x;try{await I();let P;if(N==="image"){let W=new Date().toISOString();x=await $.screenshot(structuredClone(M),T.tabId,z.controller.signal);let O=new Date().toISOString();if(await I(),x.length<24||x.length>8388608||!x.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||x.readUInt32BE(8)!==13||x.toString("ascii",12,16)!=="IHDR")throw G0();P=K4.parse({version:1,producer:"primary_mac",context:M,captureId:GX(),operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:W,finishedAt:O,sha256:H4(x),media:{contentType:"image/png",sizeBytes:x.length,width:x.readUInt32BE(16),height:x.readUInt32BE(20)}})}else{if(z.host=await $.createVideo(structuredClone(M),T.tabId,K.seconds,z.controller.signal),z.controller.signal.aborted||K.signal.aborted||X)throw await z.host.close(),G0();await z.host.start(),z.started=!0;let W=z.host.completed();if(W.catch(()=>{}),await I(),await K.started?.(),z.stopRequested)F(z);let O=await W;if(z.stop)await z.stop;await I();let y=await z.host.read(O.captureId);x=y.bytes;let b={runId:J.runId,deviceId:J.deviceId,rootId:J.rootId,rootRevision:J.rootRevision,generation:J.generation,profile:J.profile,extensionInstanceId:J.extensionInstanceId,browserScope:$.browserScope,tabId:T.tabId};if(!q2(O,y.capture)||!q2(O.owner,b)||x.length!==O.sizeBytes||H4(x)!==O.sha256||x.length<128||x.readUInt32BE(0)!==440786851)throw G0();await z.host.close(),await I(),P=K4.parse({version:1,producer:"primary_mac",context:M,captureId:O.captureId,operationId:T.operationId,attemptId:T.attemptId,tabId:T.tabId,startedAt:O.startedAt,finishedAt:O.finishedAt,sha256:O.sha256,media:{contentType:"video/webm",sizeBytes:O.sizeBytes,durationSeconds:O.durationSeconds,frameCount:O.frameCount,receivedFrameCount:O.receivedFrameCount}})}if(await I(),[...Q.values()].reduce((W,O)=>W+(O.bytes?.length??0),x.length)>20971520)throw G0();return z.bytes=Buffer.from(x),z.receipt=P,D(P),structuredClone(P)}catch(P){let W=N==="video"&&!K.signal.aborted&&!z.controller.signal.aborted&&P instanceof Error&&P.message==="mac_recording_worker_failed:no_frames"?new v0("proof_capture_no_frames","The owned tab emitted no recording frames."):G0();throw await U(z).catch(()=>{}),_(W),W}finally{x?.fill(0),K.signal.removeEventListener("abort",A)}}return{async prepare(K){let N=K2.parse(K);if(!q2(N.owner,J))throw G0();if(await Y(),await G(),Date.parse(N.preparedAt)>Date.now()||Date.parse(N.expiresAt)<=Date.now())throw G0();let T=Z.get(N.contextId);if(T){if(!q2(T,N))throw G0();return structuredClone(T)}if(Z.size>=4)throw G0();return Z.set(N.contextId,N),structuredClone(N)},screenshot:(K)=>q(K,"image"),record:(K)=>q(K,"video"),async stop(K){let N=RJ.parse(K);await Y(),V(N.contextId);let T=Q.get(N.operationId);if(!T||T.kind!=="video"||!q2(N,T.claim)||T.controller.signal.aborted)throw G0();F(T)},async publicationCapture(K){await Y(),await G();let N=[...Q.values()].find((T)=>T.receipt?.captureId===K);if(!N?.receipt||!N.bytes||N.controller.signal.aborted)throw G0();if(V(N.claim.contextId),N.bytes.length!==N.receipt.media.sizeBytes||H4(N.bytes)!==N.receipt.sha256)throw G0();return{capture:structuredClone(N.receipt),bytes:Buffer.from(N.bytes)}},async inspect(K){await Y(),await G();let N=[...Q.values()].find((T)=>T.receipt?.captureId===K);if(!N?.receipt||N.controller.signal.aborted)throw G0();return V(N.claim.contextId),structuredClone(N.receipt)},async close(){X=!0,clearInterval(H);let K=await Promise.allSettled([...Q.values()].map(U));if(Q.clear(),Z.clear(),K.some((N)=>N.status==="rejected"))throw G0()}}}import{createHash as SJ,randomUUID as MX}from"crypto";import{isDeepStrictEqual as u2}from"util";import{realpath as LX}from"fs/promises";var CJ=String.raw`async (media) => {
-  const deadline = (promise) => {
-    let timer;
-    return Promise.race([promise, new Promise((_, reject) => {
-      timer = setTimeout(() => reject(new Error("media_decode_timeout")), 12000);
-    })]).finally(() => clearTimeout(timer));
-  };
-  const items = await Promise.all(media.map(async (item) => {
-    const element = document.createElement(item.kind === "image" ? "img" : "video");
-    document.body.append(element);
-    try {
-      if (item.kind === "image") {
-        element.src = item.sourceUrl;
-        await deadline(element.decode());
-        if (!element.complete || !element.naturalWidth || !element.naturalHeight) throw new Error("media_image_not_decoded");
-        return { ...item, width: element.naturalWidth, height: element.naturalHeight };
-      }
-      element.muted = true;
-      element.playsInline = true;
-      element.preload = "auto";
-      const loaded = new Promise((resolve, reject) => {
-        element.addEventListener("loadeddata", resolve, { once: true });
-        element.addEventListener("error", () => reject(new Error("media_video_not_decoded")), { once: true });
-      });
-      element.src = item.sourceUrl;
-      await deadline(loaded);
-      if (!element.videoWidth || !element.videoHeight || !Number.isFinite(element.duration) || element.duration <= 0) throw new Error("media_video_not_decoded");
-      const initial = element.currentTime;
-      await deadline(element.play());
-      await deadline(new Promise((resolve, reject) => {
-        let timer;
-        const check = () => {
-          if (element.error) { clearTimeout(timer); reject(new Error("media_video_not_decoded")); return; }
-          if (element.currentTime - initial >= 0.05) { clearTimeout(timer); resolve(); return; }
-          timer = setTimeout(check, 25);
-        };
-        element.addEventListener("pause", () => { clearTimeout(timer); reject(new Error("media_video_not_advancing")); }, { once: true });
-        check();
-      }));
-      return { ...item, width: element.videoWidth, height: element.videoHeight, advancedSeconds: element.currentTime - initial };
-    } finally {
-      if (item.kind === "video") element.pause();
-      element.removeAttribute("src");
-      element.remove();
-    }
-  }));
-  return { verified: true, items };
-}`;var xJ=function($){let J=this??globalThis,Z=10485760,Q=(V,U)=>{if(J.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let G=J.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!G&&(J.location.href===V.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(J.location.pathname)))return{ok:!1,reason:"authentication_required"};if(J.location.href!==V.prUrl||!G)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(G))return{ok:!1,reason:"identity_mismatch"};let H=J.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),F=/^[1-9][0-9]{0,19}$/.test(H||"")?H:null,q={login:G,id:F};if(V.expectedActorId!==null&&F!==V.expectedActorId||V.authenticatedActor&&(G!==V.authenticatedActor.login||F!==V.authenticatedActor.id)||V.observedActor&&(G!==V.observedActor.login||F!==V.observedActor.id)||J.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==V.repositoryId)return{ok:!1,reason:"identity_mismatch"};let K=J.document.querySelector('link[rel="canonical"]');if(K&&K.href!==V.prUrl)return{ok:!1,reason:"identity_mismatch"};if(U){let N=J.document.querySelector("#new_comment_field"),T=J.document.querySelector("#fc-new_comment_field"),M=N?.closest("file-attachment"),L=N?.closest("form"),D=new J.URL(V.prUrl).pathname+"/comment";if(!N||N.value!==""||!T||T.type!=="file"||T.disabled||!M||M.getAttribute("input")!==T.id||M.getAttribute("data-upload-repository-id")!==V.repositoryId||!L||new J.URL(L.action,J.location.href).origin!=="https://github.com"||new J.URL(L.action,J.location.href).pathname!==D)return{ok:!1,reason:"attachment_unavailable"};let _=M.getAttribute("data-upload-policy-url");if(!_||new J.URL(_,J.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:q}};if($.operation==="preflight")return Q($.expected,!1);if($.operation==="identity")return Q($.expected,!0);if($.operation==="upload"){let V=$.expected,U=Q(V,!0);if(!U.ok)return{dispatched:!1,reason:U.reason};let G=J.Uint8Array.from(J.atob($.base64||""),(K)=>K.charCodeAt(0));if(G.length!==V.sizeBytes||G.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let H=new J.File([G],V.captureId+".webm",{type:"video/webm"}),F=new J.DataTransfer;F.items.add(H);let q=J.document.querySelector("#fc-new_comment_field");if(!q)return{dispatched:!1,reason:"attachment_unavailable"};return q.files=F.files,q.dispatchEvent(new J.Event("change",{bubbles:!0})),{dispatched:!0,actor:U.actor}}if($.operation==="upload_result"){let V=Q($.expected,!1);if(!V.ok)throw Error("github_video_identity_changed");let U=J.document.querySelector("#new_comment_field")?.value?.trim(),G="["+$.expected.captureId+".webm](",H=U?.startsWith(G)&&U.endsWith(")")?U.slice(G.length,-1):U;if(!H||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(H))return null;return{nativeUrl:H,actor:V.actor}}let X=$.expected,Y=Q(X,!1);if(!Y.ok)return{status:"incomplete",reason:Y.reason};return(async()=>{let V=X.nativeUrl.split("/").pop(),U=(D)=>{try{let _=new J.URL(D,J.location.href);if(_.protocol!=="https:"||_.username||_.password||_.port||_.hash)return!1;if(_.origin==="https://github.com")return _.href===X.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(_.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+V+"\\.(webm|mp4)$").test(_.pathname)}catch{return!1}},G=[...J.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((D)=>/^issue-[1-9][0-9]*$/.test(D.closest('[id^="issue-"]')?.id||"")&&!D.closest("form")&&!D.closest(".preview-content"));if(G.length!==1)throw Error("saved_body_missing");let H=G[0],F=[...H.querySelectorAll("video")].filter((D)=>[D.currentSrc,D.src,...[...D.querySelectorAll("source")].map((_)=>_.src)].some(U));if(F.length!==1)throw Error("saved_player_missing");let q=F[0],K={muted:q.muted,volume:q.volume,rate:q.playbackRate,preload:q.preload},N=new J.AbortController,T=J.setTimeout(()=>N.abort(),12000),M=(D)=>J.Promise.race([D,new J.Promise((_,j)=>{if(N.signal.aborted)j(Error("playback_timeout"));else N.signal.addEventListener("abort",()=>j(Error("playback_timeout")),{once:!0})})]),L=async(D)=>{while(!D()){if(q.error||N.signal.aborted)throw Error("playback_unverified");await new J.Promise((_)=>J.setTimeout(_,25))}};try{if(q.muted=!0,q.playbackRate=1,q.currentTime=0,q.readyState<2)q.preload="auto",q.load();await L(()=>q.readyState>=2&&q.videoWidth>0&&q.videoHeight>0);let D=q.currentSrc;if(!U(D))throw Error("source_unbound");let _=await M(J.fetch(D,{credentials:"same-origin",redirect:"error",signal:N.signal}));if(_.status!==200||!U(_.url)||_.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(_.headers.get("content-type")||"")||!_.body)throw Error("source_unverifiable");let j=_.headers.get("content-length");if(j!==null&&(!/^[1-9][0-9]*$/.test(j)||Number(j)!==X.sizeBytes))throw Error("source_size_mismatch");let z=_.body.getReader(),A=[],I=0;try{for(;;){let w=await M(z.read());if(w.done)break;if(I+=w.value.length,I>10485760||I>X.sizeBytes)throw Error("source_too_large");A.push(w.value)}}finally{await z.cancel().catch(()=>{}),z.releaseLock()}if(I!==X.sizeBytes)throw Error("source_size_mismatch");let x=new J.Uint8Array(I),P=0;for(let w of A)x.set(w,P),P+=w.length;let W=[...new J.Uint8Array(await M(J.crypto.subtle.digest("SHA-256",x)))].map((w)=>w.toString(16).padStart(2,"0")).join("");if(W!==X.sha256||q.currentSrc!==D||!H.contains(q))throw Error("source_changed");let O=q.currentTime,y=q.getVideoPlaybackQuality().totalVideoFrames;if(await M(q.play()),await L(()=>q.currentTime-O>=0.05&&q.getVideoPlaybackQuality().totalVideoFrames>y),!Q(X,!1).ok||q.currentSrc!==D||!H.contains(q)||q.error)throw Error("player_changed");return{status:"verified",sourceSha256:W,width:q.videoWidth,height:q.videoHeight,durationSeconds:q.duration,advancedSeconds:q.currentTime-O,advancedFrames:q.getVideoPlaybackQuality().totalVideoFrames-y,playbackRestored:!0}}finally{if(J.clearTimeout(T),N.abort(),q.pause(),q.currentTime=0,q.muted=K.muted,q.volume=K.volume,q.playbackRate=K.rate,q.preload=K.preload,!q.paused||q.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as KX}from"child_process";import{lstat as BX,realpath as qX}from"fs/promises";import{join as EJ,resolve as UX}from"path";import{promisify as HX}from"util";var NX=HX(KX);async function FX($,J){let Z=await qX($),{stdout:Q}=await NX(EJ(Z,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:J});return B.array(B.object({browser:B.string(),directory:B.string(),connected:B.boolean().optional(),source:B.string(),socketPath:B.string().optional(),instanceId:B.string().optional(),extensionId:B.string().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(Q)).filter((Y)=>Y.browser==="chrome"&&Y.connected===!0&&/^(Default|Profile [0-9]+)$/.test(Y.directory)&&UX(Y.source)===EJ(Z,"Reason Browser Use","manifest.json"))}async function u8($,J,Z){if(!/^(Default|Profile [0-9]+)$/.test(J))throw Error("mac_recording_profile_unavailable");let Q=(await FX($,Z)).filter((V)=>V.directory===J),X=Q[0];if(Q.length!==1||!X?.socketPath||!X.instanceId)throw Error("mac_recording_profile_unavailable");let Y=await BX(X.socketPath);if(!Y.isSocket()||Y.uid!==process.getuid?.()||Y.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:X.socketPath,instanceId:X.instanceId,extensionId:X.extensionId}}import{createHash as TX}from"crypto";function U2($){return`reason-browser-${TX("sha256").update(`reason:mac-browser:v1:${$}`).digest("hex")}`}var bJ=B.discriminatedUnion("ok",[B.object({ok:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({ok:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),wJ=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})}),Q0=()=>Error("mac_pr_proof_browser_unavailable");async function N4($){let J=c0.parse($.owner),Z="endpoint"in $?$.endpoint(J):await jX($.automationDirectory,J),Q=new Map,X=`reason-pr-proof-${MX()}`,Y=!1,V=async()=>{if(Y)throw Q0();if(await $.assertCurrent(),Y)throw Q0()},U=async(F)=>{if(!u2(J,F.owner))throw Q0();await V()},G=async(F)=>{await U(F);let q=await $.readVideo(F.captureId);try{await V();let K=q.capture;if(!u2(K.context.owner,J)||K.captureId!==F.captureId||K.context.prUrl!==F.prUrl||K.context.headSha!==F.headSha||K.media.contentType!=="video/webm"||K.media.sizeBytes!==F.sizeBytes||K.sha256!==F.sha256||q.bytes.length!==F.sizeBytes||q.bytes.length<128||q.bytes.length>10485760||q.bytes.readUInt32BE(0)!==440786851||SJ("sha256").update(q.bytes).digest("hex")!==F.sha256)throw Q0();return q}catch(K){throw q.bytes.fill(0),K}};async function H(F,q,K){await V();let N=await Z.discover(AbortSignal.timeout(5000)),T=new h8({socketPath:N.socketPath,sessionId:X,timeoutMs:5000}),M,L=!1,D,_=new Promise((A,I)=>{D=setTimeout(()=>{L=!0,I(Q0())},60000)});_.catch(()=>{});let j=(A)=>Promise.race([A,_]),z=async()=>{if(L)throw Q0();if(await V(),L)throw Q0()};try{await j(T.connect());let A=wJ.parse(await j(T.client.getInfo()));if(A.metadata.extensionId!==N.extensionId||A.metadata.extensionInstanceId!==N.instanceId||!A.metadata.nativeHostName)throw Q0();await z(),K?.("connected");let I=T.newTab();I.then((W)=>{if(L)W.close().catch(()=>{Y=!0})},()=>{}),M=await j(I),await z(),await j(M.goto(F,{waitUntil:"domcontentloaded",timeoutMs:15000})),await z(),K?.("loaded");let P=await j(q(M,async(W)=>{await z();let O=await j(M.evaluate(`(${xJ.toString()})(${JSON.stringify(W)})`,{awaitPromise:!0}));return await z(),O},z));return await z(),P}finally{L=!0,clearTimeout(D);try{if(M){let A;try{await Promise.race([M.close(),new Promise((I,x)=>{A=setTimeout(()=>x(Q0()),5000)})])}finally{clearTimeout(A)}}}catch{throw Y=!0,Q0()}finally{T.close()}await V()}}return{async screenshot(F,q,K){let N=K2.parse(F);if(await U(N),!Number.isSafeInteger(q)||q<1||Date.parse(N.expiresAt)<=Date.now())throw Q0();K.throwIfAborted();let T=await Z.discover(K),M=new h8({socketPath:T.socketPath,sessionId:Z.tabScope,timeoutMs:5000}),L;try{await M.connect();let D=wJ.parse(await M.client.getInfo());if(D.metadata.extensionId!==T.extensionId||D.metadata.extensionInstanceId!==T.instanceId)throw Q0();if(!B.array(B.object({id:B.number()})).max(256).parse(await M.getTabs()).some((z)=>z.id===q))throw Q0();await V(),K.throwIfAborted();let j=B.object({data:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await M.cdp.call(q,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(j.data)||j.data.length%4)throw Q0();if(L=Buffer.from(j.data,"base64"),L.toString("base64")!==j.data||L.length>8388608)throw Q0();if(await V(),K.throwIfAborted(),Date.parse(N.expiresAt)<=Date.now())throw Q0();return L}catch{throw L?.fill(0),Q0()}finally{M.close()}},async verifyImages(F){let q=v8(F);if(q.runId!==J.runId||q.media.some((K)=>K.kind!=="image"))throw Q0();return H("about:blank",async(K,N,T)=>{let M=K.browser.client,L=new Set(q.media.map((W)=>W.sourceUrl)),D=new Map,_=new Set,j=!1,z=0,A=!1,I=new Set,x=(W,O)=>{if(I.size>=32){j=!0;return}let y=M.executeCdp(K.id,W,O);I.add(y),y.catch(()=>{j=!0}).finally(()=>I.delete(y))},P=M.onNotification((W)=>{if(W.method!=="onCDPEvent"||!T$(W.params)||!T$(W.params.source)||W.params.source.tabId!==K.id||!T$(W.params.params))return;let O=W.params.params;if(++z>512){j=!0;return}if(W.params.method==="Fetch.requestPaused"){let w=typeof O.requestId==="string"&&T$(O.request)&&O.request.method==="GET"&&typeof O.request.url==="string"&&L.has(O.request.url)&&O.resourceType==="Image";if(typeof O.requestId!=="string"){j=!0;return}if(!w)j=!0;x(w?"Fetch.continueRequest":"Fetch.failRequest",{requestId:O.requestId,...w?{}:{errorReason:"BlockedByClient"}})}if(W.params.method==="Network.requestWillBeSent"&&O.redirectResponse)j=!0;if(W.params.method==="Network.loadingFailed")j=!0;if(W.params.method==="Network.loadingFinished"&&typeof O.requestId==="string")_.add(O.requestId);if(W.params.method!=="Network.responseReceived")return;if(!T$(O.response)||typeof O.response.url!=="string"||!L.has(O.response.url)||typeof O.requestId!=="string"||!T$(O.response.headers)||O.type!=="Image"){j=!0;return}let y=Object.fromEntries(Object.entries(O.response.headers).map(([w,l])=>[w.toLowerCase(),l])),b=Number(y["content-length"]);if(D.has(O.response.url)||O.response.status!==200||O.response.fromServiceWorker===!0||typeof y["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(y["content-length"])||!Number.isSafeInteger(b)||b>8388608||y["content-range"]||y["content-encoding"]&&y["content-encoding"]!=="identity"){j=!0;return}D.set(O.response.url,{id:O.requestId,length:b})});try{await M.executeCdp(K.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await M.executeCdp(K.id,"Network.setBypassServiceWorker",{bypass:!0}),await M.executeCdp(K.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await M.executeCdp(K.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let W=B.object({frameTree:B.object({frame:B.object({id:B.string().min(1).max(256)})})}).parse(await M.executeCdp(K.id,"Page.getFrameTree",{})),O=[...new Set(q.media.map((w)=>new URL(w.sourceUrl).origin))].join(" ");await M.executeCdp(K.id,"Page.setDocumentContent",{frameId:W.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${O}; style-src 'none'"><body></body>`}),await T(),A=!0;try{await M.executeCdp(K.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new v0("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await T();let y;try{y=await K.evaluate(`(${CJ})(${JSON.stringify(q.media)})`,{awaitPromise:!0})}catch{throw new v0("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await T(),!T$(y)||!Array.isArray(y.items)||y.items.length!==q.media.length)throw Q0();await Promise.all(I);let b=[];for(let w=0;w<q.media.length;w++){await V();let l=D.get(q.media[w].sourceUrl);if(j||!l||!_.has(l.id))throw Q0();let k=B.object({base64Encoded:B.literal(!0),body:B.string().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await M.executeCdp(K.id,"Network.getResponseBody",{requestId:l.id})),C=Buffer.from(k.body,"base64");try{let S=y.items[w];if(C.length!==l.length||C.toString("base64")!==k.body||!T$(S))throw Q0();b.push({...S,sourceSha256:SJ("sha256").update(C).digest("hex")})}finally{C.fill(0)}}if(j)throw Q0();return WJ({verified:!0,items:b},q)}finally{if(P(),await Promise.allSettled(I),A)try{await M.executeCdp(K.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new v0("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(F){let q=m2.parse(F);await U(q);let K="browser_unavailable";try{return await H(`https://github.com/${q.repositoryFullName}`,async(N,T)=>{let M=bJ.parse(await T({operation:"preflight",expected:{...q,prUrl:`https://github.com/${q.repositoryFullName}`}}));return B4.parse(M.ok?{...q,status:"ready",observedActor:M.actor,checkedAt:new Date().toISOString()}:M.reason==="attachment_unavailable"?{...q,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...q,status:"not_ready",reason:M.reason})},(N)=>{K=N==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return B4.parse({...q,status:"not_ready",reason:"unavailable",cause:K})}},async publish(F){let q=l$.parse(F);if(await U(q),q.expectedActorId!==null&&q.authenticatedActor.id!==q.expectedActorId)throw Q0();let K=Q.get(q.attemptId);if(K){if(!u2(K.binding,q))throw Q0();return structuredClone(K.result)}if(Q.size>=3)throw Error("proof_native_publication_limit");let N={binding:structuredClone(q),result:B2.parse({...q,status:"uncertain",reason:"upload_outcome_unknown"})};Q.set(q.attemptId,N);let T=!1,M="dispatch";try{(await G(q)).bytes.fill(0),N.result=await H(q.prUrl,async(L,D)=>{let _=bJ.parse(await D({operation:"identity",expected:q}));if(!_.ok)return B2.parse({...q,status:"not_attempted",reason:_.reason});let j=await G(q),z;try{T=!0,z=B.discriminatedUnion("dispatched",[B.object({dispatched:B.literal(!0),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict(),B.object({dispatched:B.literal(!1),reason:B.enum(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await D({operation:"upload",expected:q,base64:j.bytes.toString("base64")}))}finally{j.bytes.fill(0)}if(!z.dispatched)return T=!1,B2.parse({...q,status:"not_attempted",reason:z.reason});if(!u2(z.actor,_.actor))throw M="actor_changed",Q0();M="result";let A=performance.now();while(performance.now()-A<30000){let I=await D({operation:"upload_result",expected:{...q,observedActor:_.actor}});if(I!==null){let x=B.object({nativeUrl:B.string(),actor:B.object({login:B.string(),id:B.string().nullable()}).strict()}).strict().parse(I);return M="finalize",await V(),B2.parse({...q,status:"uploaded",nativeUrl:x.nativeUrl,observedActor:x.actor,uploadedAt:new Date().toISOString()})}await new Promise((x)=>setTimeout(x,100))}throw M="result_timeout",Q0()})}catch{if(T)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${M})
-`);N.result=B2.parse({...q,...T?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(N.result)},async verify(F){let q=g2.parse(F);await U(q);try{return(await G(q)).bytes.fill(0),await H(q.prUrl,async(K,N)=>{await K.browser.client.executeCdp(K.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let T=await N({operation:"saved_player",expected:q});if(!T||typeof T!=="object"||Array.isArray(T))throw Q0();let M=q4.parse({...q,...T,..."status"in T&&T.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(q).some(([L,D])=>!u2(D,M[L])))throw Q0();return M}finally{await K.browser.client.executeCdp(K.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return q4.parse({...q,status:"incomplete",reason:"playback_unverified"})}},close(){Y=!0}}}async function jX($,J){let Z=await LX($);return{async discover(Q){let X=await u8(Z,J.profile,Q);if(X.instanceId!==J.extensionInstanceId)throw Q0();return X},tabScope:U2(J.runId)}}import{realpath as vX}from"fs/promises";var XH=B.object({version:B.literal(1),recording_operation_id:B.string().uuid(),proof_ready:B.literal(!1),acknowledged_at:B.iso.datetime()}).strict(),d8=B.object({action:B.literal("start"),request_id:B.string().uuid(),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),tab_id:B.number().int().positive(),seconds:B.number().int().min(1).max(15)}).strict(),yJ=B.object({action:B.literal("inspect"),recording_operation_id:B.string().uuid()}).strict(),YH=B.discriminatedUnion("action",[d8,yJ]),kJ=B.object({recording_operation_id:B.string().uuid()}).strict(),F4={device_id:B.string().uuid(),root_id:B.string().uuid()},WX=B.discriminatedUnion("action",[d8.extend(F4),yJ.extend(F4),kJ.extend({...F4,action:B.literal("stop")})]),VH=B.toJSONSchema(WX),GH=B.object({version:B.literal(1),recordingId:B.string().uuid(),proofReady:B.literal(!1),capture:B.object({captureId:B.string().uuid(),contentType:B.literal("video/webm"),sha256:B.string().regex(/^[a-f0-9]{64}$/),sizeBytes:B.number().int().min(128).max(10485760),startedAt:B.iso.datetime(),finishedAt:B.iso.datetime(),durationSeconds:B.number().min(0.05).max(15),frameCount:B.number().int().min(1).max(450),receivedFrameCount:B.number().int().min(1).max(2000),owner:B.object({runId:B.string().uuid(),deviceId:B.string().uuid(),rootId:B.string().uuid(),rootRevision:B.string().max(64),profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:B.string().min(1).max(1024),generation:B.string().uuid(),browserScope:B.string().max(128),tabId:B.number().int().positive()}).strict()}).strict().refine(($)=>$.receivedFrameCount>=$.frameCount&&Math.abs((Date.parse($.finishedAt)-Date.parse($.startedAt))/1000-$.durationSeconds)<=0.1)}).strict();var LH=d8.extend({action:B.enum(["start","inspect"]),recording_boot_generation:B.string().uuid(),recording_operation_id:B.string().uuid().optional(),recording_attempt_id:B.string().uuid().optional()}).strict();import{createHash as xX,randomUUID as EX}from"crypto";import{mkdtemp as SX,realpath as bX,rm as pJ}from"fs/promises";import{tmpdir as wX}from"os";import{join as yX}from"path";import{spawn as kX}from"child_process";import{isDeepStrictEqual as hX}from"util";import{createHash as DX}from"crypto";import{execFile as _X}from"child_process";import{chmod as zX,lstat as fJ,mkdtemp as OX,readFile as vJ,realpath as mJ,rm as AX,writeFile as hJ}from"fs/promises";import{tmpdir as PX}from"os";import{isAbsolute as RX,join as p8}from"path";import{promisify as IX}from"util";var T4=IX(_X),CX=($)=>DX("sha256").update($).digest("hex");async function Q$($){if(!RX($.path)||!/^[a-f0-9]{64}$/.test($.sha256)||await mJ($.path)!==$.path)throw Error("mac_recording_encoder_unqualified");let J=await fJ($.path);if(!J.isFile()||!(J.mode&73)||J.mode&18||J.size>134217728||CX(await vJ($.path))!==$.sha256)throw Error("mac_recording_encoder_unqualified")}async function d2($,J){if(!$)return null;let Z=structuredClone($);try{await Promise.all([Q$(Z.ffmpeg),Q$(Z.ffprobe)])}catch{return null}return{async encode(Q,X,Y){if(Y.aborted||!Q.length||!Number.isFinite(X)||X<0.05||X>15)throw Error("mac_recording_encoding_invalid");await Promise.all([Q$(Z.ffmpeg),Q$(Z.ffprobe)]);let V=await mJ(await OX(p8(J??PX(),"reason-owned-recording-")));await zX(V,448);let U=p8(V,"capture.webm"),G="frames";try{let H=["ffconcat version 1.0"];for(let[L,D]of Q.entries()){let _=`${L}.jpg`;await hJ(p8(V,_),D.jpeg,{mode:384,flag:"wx"});let j=Q[L+1]?.timestamp??Q[0].timestamp+X;H.push(`file '${_}'`,`duration ${Math.max(0.001,j-D.timestamp).toFixed(6)}`)}H.push(`file '${Q.length-1}.jpg'`),await hJ(p8(V,"frames.ffconcat"),H.join(`
-`)+`
-`,{mode:384,flag:"wx"});let F={cwd:V,signal:Y,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};G="encode",await T4(Z.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(X),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${X},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",U],F),G="output";let q=await fJ(U);if(!q.isFile()||q.isSymbolicLink()||q.nlink!==1||q.size<128||q.size>10485760)throw Error();G="probe";let{stdout:K}=await T4(Z.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",U],F),N=JSON.parse(K),T=N.streams,M=Number(N.format?.duration);if(G="probe_streams",!Array.isArray(T)||T.length!==1||T[0]?.codec_type!=="video"||T[0]?.codec_name!=="vp8")throw Error();if(G="probe_dimensions",!Number.isSafeInteger(T[0].width)||T[0].width<2||T[0].width>1600||!Number.isSafeInteger(T[0].height)||T[0].height<2||T[0].height>1000)throw Error();if(G="probe_duration",!Number.isFinite(M)||Math.abs(M-X)>0.25)throw Error();if(G="probe_frames",!Number.isSafeInteger(Number(T[0].nb_read_frames))||Number(T[0].nb_read_frames)<1)throw Error();if(G="probe_format",N.format?.format_name!=="matroska,webm")throw Error();return G="decode",await T4(Z.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",U,"-f","null","-"],F),G="pin",await Promise.all([Q$(Z.ffmpeg),Q$(Z.ffprobe)]),await vJ(U)}catch{throw Error(Y.aborted?"mac_recording_cancelled":`mac_recording_encoding_${G}_failed`)}finally{await AX(V,{recursive:!0,force:!0})}}}}var uJ=B.enum(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var X$=B.string().min(1).max(1024),gJ=B.object({path:X$,sha256:B.string().regex(/^[a-f0-9]{64}$/)}).strict(),dJ=B.object({owner:B.object({runId:X$,deviceId:X$,rootId:X$,rootRevision:X$,profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:X$,generation:X$,browserScope:X$,tabId:B.number().int().positive()}).strict(),socketPath:X$,extensionId:B.string().regex(/^[a-p]{32}$/),nativeHostName:X$,seconds:B.number().int().min(1).max(15),encoder:B.object({ffmpeg:gJ,ffprobe:gJ}).strict()}).strict();var fX=15728640,I$=()=>Error("mac_recording_worker_failed");function lJ($){let J=dJ.parse($.configuration),Z={...$.worker},Q=new Map,X=!1,Y=!1,V=null,U=async()=>{},G=async(K,N=3000)=>{let T;try{return await Promise.race([K,new Promise((M,L)=>{T=setTimeout(()=>L(I$()),N)})])}finally{clearTimeout(T)}},H=()=>V??=G((async()=>{let N=(await Promise.allSettled([U(),$.cleanup()])).find((T)=>T.status==="rejected");if(N?.status==="rejected")throw N.reason})(),5000).catch((K)=>{X=!0;let N=K&&typeof K==="object"&&"code"in K?K.code:null,T=typeof N==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(N)?N:"unknown";throw Error(`mac_recording_cleanup_failed:${T}`)}),F=null,q=async()=>{if(X)throw I$();if(await G($.assertCurrent()),X)throw I$()};return{async start(){if(Y||F)throw Error("mac_recording_already_active");Y=!0;try{await q(),await Q$({path:Z.path,sha256:Z.sha256}),await q(),V=null;let K=await bX(await SX(yX(wX(),"reason-recording-host-")));try{await q()}catch(C){throw await pJ(K,{recursive:!0,force:!0}),C}let N=kX(Z.path,[...Z.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),T=new Promise((C)=>N.once("close",()=>C())),M=()=>{if(N.pid)try{process.kill(-N.pid,"SIGKILL")}catch(C){if(C.code!=="ESRCH")throw C}},L=null;U=()=>L??=(async()=>{try{M()}catch(C){if(C.code!=="EPERM")throw C}await T;try{for(let C=0;;C++)try{M();break}catch(S){if(S.code!=="EPERM"||C>=20)throw S;await new Promise((E)=>setTimeout(E,25))}}finally{await pJ(K,{recursive:!0,force:!0})}})();let D="",_=0,j=!1,z=!1,A=null,I,x,P=new Promise((C,S)=>{I=C,x=S}),W,O,y=new Promise((C,S)=>{W=C,O=S});y.catch(()=>{});let b=(C=I$())=>{if(j)return;j=!0,clearTimeout(w),clearInterval(k),H().then(()=>{x(C),O(C)},(S)=>{x(S),O(S)})},w=setTimeout(()=>b(),(J.seconds+25)*1000),l=!1,k=setInterval(()=>{if(l||j)return;l=!0,q().catch(()=>b()).finally(()=>{l=!1})},250);F={completion:y,stop:()=>{if(!j)N.stdin.write(`{"type":"stop"}
-`)},cancel:()=>b()},N.on("error",()=>b()),N.stdin.on("error",()=>b()),N.stdout.on("data",(C)=>{if(j)return;if(_+=C.length,_>fX){b();return}D+=C.toString("utf8");let S;while((S=D.indexOf(`
-`))!==-1){let E=D.slice(0,S);D=D.slice(S+1);try{let v=JSON.parse(E);if(v.type==="failed"&&Object.keys(v).sort().join(",")==="reason,type"){let c=uJ.safeParse(v.reason);b(c.success?Error(`mac_recording_worker_failed:${c.data}`):I$());return}if(v.type==="unsupported"&&!z){b(Error("mac_recording_encoder_unavailable"));return}if(v.type==="started"&&!z&&Object.keys(v).length===1){z=!0,I({recording:!0});continue}if(!z||v.type!=="capture"||A||Object.keys(v).sort().join(",")!=="bytes,capture,type")throw I$();let f=v.capture;if(!f||Object.keys(f).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof f.sha256!=="string"||typeof f.startedAt!=="string"||typeof f.finishedAt!=="string"||!hX(f.owner,J.owner)||f.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(f.sha256)||!Number.isSafeInteger(f.sizeBytes)||f.sizeBytes<128||f.sizeBytes>10485760||!Number.isSafeInteger(f.frameCount)||f.frameCount<1||f.frameCount>450||!Number.isSafeInteger(f.receivedFrameCount)||f.receivedFrameCount<f.frameCount||f.receivedFrameCount>2000||!Number.isFinite(f.durationSeconds)||f.durationSeconds<0.05||f.durationSeconds>J.seconds||!Number.isFinite(Date.parse(f.startedAt))||!Number.isFinite(Date.parse(f.finishedAt))||Math.abs((Date.parse(f.finishedAt)-Date.parse(f.startedAt))/1000-f.durationSeconds)>0.1||typeof v.bytes!=="string"||v.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(v.bytes))throw I$();let R=Buffer.from(v.bytes,"base64");if(R.length!==f.sizeBytes||xX("sha256").update(R).digest("hex")!==f.sha256||!R.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw I$();A={capture:Object.freeze({...f,captureId:EX(),owner:Object.freeze({...J.owner})}),bytes:R}}catch{b();return}}}),N.once("close",(C)=>{if(j)return;if(C!==0||!A||D.trim()){b();return}let S=A;q().then(async()=>{if(await U(),j)return;j=!0,clearTimeout(w),clearInterval(k),Q.set(S.capture.captureId,S);while(Q.size>2)Q.delete(Q.keys().next().value);W(S.capture)}).catch(()=>b())}),N.stdin.write(JSON.stringify({...J,scratchDirectory:K})+`
-`);try{return await P}catch(C){throw F=null,C}}finally{Y=!1}},async completed(){if(await q(),!F)throw Error("mac_recording_not_active");return F.completion},async stop(){await q();let K=F;if(!K)throw Error("mac_recording_not_started");K.stop();try{return await K.completion}finally{if(F===K)F=null}},async read(K){await q();let N=Q.get(K);if(!N)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(N.capture),bytes:Buffer.from(N.bytes)}},async close(){if(X)return;X=!0;let K=F;K?.cancel(),Q.clear();try{await H(),await K?.completion.catch(()=>{})}finally{F=null}}}}var cJ=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.string(),extensionInstanceId:B.string(),nativeHostName:B.string()})});async function M4($){await $.assertCurrent();let J;if("discover"in $)J=$.discover;else{let Z=await vX($.automationDirectory);J=(Q,X)=>u8(Z,Q,X)}if(await Q$({path:$.worker.path,sha256:$.worker.sha256}),!await d2($.encoder))throw Error("mac_recording_encoder_unavailable");return async(Z,Q,X,Y)=>{Y.throwIfAborted(),await $.assertCurrent();let V=await J(Z,Y),U=new R$({socketPath:V.socketPath,sessionId:X,timeoutMs:2000}),G;try{if(await U.connect(),G=cJ.parse(await U.getInfo()),G.metadata.extensionId!==V.extensionId||G.metadata.extensionInstanceId!==V.instanceId)throw Error("mac_recording_profile_changed");if(!B.array(B.object({id:B.number()})).parse(await U.getTabs()).some((F)=>F.id===Q))throw Error("mac_recording_tab_not_owned");await $.assertCurrent(),Y.throwIfAborted()}finally{U.close()}return{extensionInstanceId:V.instanceId,async createHost(H,F,q){let K=new R$({socketPath:V.socketPath,sessionId:H.browser.browserScope,timeoutMs:2000});return lJ({worker:$.worker,configuration:{owner:H.browser,seconds:F,encoder:$.encoder,socketPath:V.socketPath,extensionId:V.extensionId,nativeHostName:G.metadata.nativeHostName},async assertCurrent(){q.throwIfAborted(),Y.throwIfAborted(),await $.assertCurrent()},async cleanup(){try{await K.connect();let T=cJ.parse(await K.getInfo());if(T.metadata.extensionInstanceId!==H.browser.extensionInstanceId||T.metadata.extensionId!==V.extensionId||T.metadata.nativeHostName!==G.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await K.executeCdp(Q,"Page.stopScreencast",{})}finally{K.close()}}})}}}}var O0=()=>Error("mac_pr_proof_unavailable"),uX=B.object({operationId:B.string().uuid()}).strict();function aJ($){let J=$.qualifiedProfiles??[{profile:$.profile,extension_instance_id:$.extensionInstanceId}],Z=B.array(B.object({profile:B.string().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:B.string().min(1).max(1024)}).strict()).min(1).max(16).parse(J);if(!B.string().uuid().safeParse($.generation).success||new Set(Z.map((K)=>K.profile)).size!==Z.length)throw O0();if(!$.qualifiedProfiles){let K=new URL($.uploadOrigin);if(!$.resolveBrowser||K.protocol!=="https:"||K.origin!==$.uploadOrigin||K.username||K.password)throw O0()}let Q=new Map,X=new Map,Y=new Map,V=!1,U=new mX,G=async(K)=>{let N=U.getStore();if(V||!K&&!N)throw O0();if(N?.signal.throwIfAborted(),await $.assertCurrent(K??N.claim),V)throw O0();N?.signal.throwIfAborted()},H=(K,N)=>{let T="owner"in N?N.owner:("context"in N)?N.context.owner:N.input.owner;if(K.capability!==G4||!K.owner||T.generation!==$.generation||!Z.some((M)=>M.profile===T.profile&&M.extension_instance_id===T.extensionInstanceId)||T.organizationId!==K.owner.organization_id||T.userId!==K.owner.user_id||T.deviceId!==K.owner.device_id||T.rootId!==K.root_id||T.runId!==K.run_id)throw O0();return T},F=async(K)=>{await G();let N=JSON.stringify([K.runId,K.profile]),T=Q.get(N);if(!T){if(Q.size>=4)throw O0();T=(async()=>{let L,D=$.browserScope?.(K)??U2(K.runId),_=await $.createBrowser({owner:K,assertCurrent:()=>G(),readVideo:(j)=>L.publicationCapture(j)});if(L=IJ({owner:K,browserScope:D,assertCurrent:()=>G(),screenshot:_.screenshot,async createVideo(j,z,A,I){if(!$.resolveBrowser)throw O0();let x=await $.resolveBrowser(K.profile,z,D,I);if(x.extensionInstanceId!==K.extensionInstanceId)throw O0();return x.createHost({organizationId:K.organizationId,userId:K.userId,operationId:j.contextId,attemptId:j.contextId,recordingId:j.contextId,browser:{runId:K.runId,deviceId:K.deviceId,rootId:K.rootId,rootRevision:K.rootRevision,generation:K.generation,profile:K.profile,extensionInstanceId:K.extensionInstanceId,browserScope:D,tabId:z}},A,I)}}),V)throw _.close(),await L.close(),O0();return{owner:structuredClone(K),browser:_,capture:L,expiresAt:Date.now()+300000}})(),Q.set(N,T)}let M=await T;if(!sJ(M.owner,K)||M.expiresAt<=Date.now())throw O0();return M},q=setInterval(()=>{for(let[K,N]of Q)N.then(async(T)=>{if(T.expiresAt>Date.now()||[...X.values()].some((M)=>M.runtime===T))return;if(T.browser.close(),await T.capture.close(),Q.get(K)===N)Q.delete(K)}).catch(()=>{V=!0})},1000);return q.unref(),{generation:$.generation,async execute(K,N,T){return U.run({claim:K,signal:N},async()=>{let M=U4.parse(K.payload).command,L=H(K,M);if(await G(K),N.throwIfAborted(),$.qualifiedProfiles&&!$.resolveBrowser&&(M.action==="prepare"?M.context.evidenceKind!=="image"||Boolean(M.context.visualPlan)||!M.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(M.action)))throw Error("proof_png_only");let D=await F(L),_=async()=>{await G(K),N.throwIfAborted()},j;switch(M.action){case"auth_check":j=await D.browser.preflight(M.input);break;case"prepare":if(M.context.visualPlan)throw Error("proof_source_unavailable");if($.qualifiedProfiles&&!M.context.uploadOrigin)throw O0();j=await D.capture.prepare(M.context);break;case"capture_png":j=await D.capture.screenshot({claim:{operationId:K.operation_id,attemptId:K.attempt_id,contextId:M.contextId,tabId:M.tabId},signal:N});break;case"start_video":{let z={runtime:D,contextId:M.contextId,attemptId:K.attempt_id,tabId:M.tabId,signal:N};if(X.has(K.operation_id))throw O0();X.set(K.operation_id,z);try{j=await D.capture.record({claim:{operationId:K.operation_id,attemptId:K.attempt_id,contextId:M.contextId,tabId:M.tabId},signal:N,seconds:M.seconds,started:async()=>{await _(),await T({version:1,operationId:K.operation_id,contextId:M.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{X.delete(K.operation_id)}break}case"inspect_capture":j=await D.capture.inspect(M.captureId);break;case"publish_video":j=await D.browser.publish(M.input);break;case"verify_saved_media":j=await D.browser.verify(M.input);break;case"verify_png_media":j=await D.browser.verifyImages(M.media);break;case"publish_png":{let z=`${L.runId}:${M.attemptId}`,A=Y.get(z);if(A){if(!sJ(A.request,M))throw O0();j=A.result;break}if(Y.size>=16)throw O0();let I=new URL(M.uploadUrl);if(I.protocol!=="https:"||I.username||I.password||I.hash||I.pathname!==`/${M.storagePath}`||!M.storagePath.startsWith(`pr-screenshots/${L.runId}/${M.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(M.storagePath.split("/").at(-1))||M.storagePath.split("/").length!==4)throw O0();let x=await D.capture.publicationCapture(M.captureId);try{if(I.origin!==($.qualifiedProfiles?x.capture.context.uploadOrigin:$.uploadOrigin)||x.capture.media.contentType!=="image/png"||x.capture.sha256!==M.sha256||x.bytes.length!==M.sizeBytes||gX("sha256").update(x.bytes).digest("hex")!==M.sha256)throw O0();await _();let P={request:structuredClone(M),result:{status:"uncertain",sha256:M.sha256,sizeBytes:M.sizeBytes}};Y.set(z,P);try{let W=await fetch(I,{method:"PUT",body:x.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([N,AbortSignal.timeout(20000)])});if(await W.body?.cancel(),await _(),W.ok)P.result={...P.result,status:"uploaded"}}catch{}j=P.result}finally{x.bytes.fill(0)}break}}return await _(),structuredClone(j)})},async control(K,N){if(K.capability!==G4||N.kind!==PJ)return!1;let T=uX.safeParse(N.payload),M=X.get(K.operation_id);if(!T.success||T.data.operationId!==K.operation_id||!M||M.attemptId!==K.attempt_id)return!1;let L=U4.parse(K.payload).command;return H(K,L),await G(K),await U.run({claim:K,signal:M.signal},()=>M.runtime.capture.stop({operationId:K.operation_id,attemptId:K.attempt_id,contextId:M.contextId,tabId:M.tabId})),!0},async close(){V=!0,clearInterval(q);let K=await Promise.allSettled([...Q.values()].map(async(N)=>{let T=await N;T.browser.close(),await T.capture.close()}));if(Q.clear(),X.clear(),Y.clear(),K.some((N)=>N.status==="rejected"))throw O0()}}}var nX="__browser-recorder",tX=iX(dX),rX="/tmp/open-browser-use",oX=33554432,eX=B.object({version:B.literal("0.1.42"),metadata:B.object({extensionId:B.literal(l8),extensionInstanceId:B.string().min(1).max(1024)})}),nJ=()=>Error("worker_pr_proof_browser_unavailable"),D4={components:f2,ensureBrowser:Z3,socketDirectory:rX,async identity($){let J=new R$({socketPath:$,sessionId:`reason-proof-qualification-${W4()}`,timeoutMs:2000});try{return await J.connect(),await J.getInfo()}finally{J.close()}}};async function tJ($,J=D4){let Z=J.components();if(!Z?.features.browser)throw nJ();await J.ensureBrowser(Z),$.throwIfAborted();let Q=L4(Q3(Z),"Default","Local Extension Settings",l8),X=(await iJ(Q)).filter((Y)=>Y.endsWith(".log")||Y.endsWith(".ldb")).map((Y)=>L4(Q,Y));for(let Y of(await iJ(J.socketDirectory)).filter((V)=>V.endsWith(".sock"))){$.throwIfAborted();let V=L4(J.socketDirectory,Y);try{let U=await lX(V);if(!U.isSocket()||U.uid!==process.getuid?.())continue;let G=eX.parse(await J.identity(V)).metadata.extensionInstanceId;for(let H of X)if((await sX(H)).size<=oX&&(await eJ(H)).includes(G))return{socketPath:V,instanceId:G,extensionId:l8}}catch{}}throw nJ()}async function j4($){let J=await cX($);return{path:J,sha256:pX("sha256").update(await eJ(J)).digest("hex")}}async function $3($={}){let J={...D4,...$};try{let Z=J.components();if(!Z?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!Z.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let Q=await j4(Z.ffmpeg),{stdout:X}=await tX(Q.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(X))return{error:"worker_recording_libvpx_unavailable"};let Y={ffmpeg:Q,ffprobe:await j4(Z.ffprobe)};if(!await d2(Y))return{error:"worker_recording_encoder_unqualified"};let V=$.recorder??{path:process.execPath,args:[...aX(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],nX]};return{worker:{...await j4(V.path),args:V.args},encoder:Y}}catch{return{error:"worker_recording_unqualified"}}}function J3($,J={}){let Z={...D4,...J},Q=W4(),X=W4(),Y=rJ.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:Q,profiles:["Default"],extension_instance_ids:[X],image:!0,video:!1,source_bound:!1}),V=$.recording?oJ.parse({...Y,version:3,video:!0,max_seconds:15}):Y,U=(q)=>NJ(q.organizationId,q.sessionId,q.deviceId,1),G=$.recording,H,F=aJ({generation:Q,qualifiedProfiles:[{profile:"Default",extension_instance_id:X}],assertCurrent:$.assertCurrent,browserScope:U,...G?{resolveBrowser:async(q,K,N,T)=>{H??=M4({...G,assertCurrent:()=>$.assertCurrent(),discover:(L,D)=>tJ(D,Z)}),H.catch(()=>{H=void 0});let M=await(await H)(q,K,N,T);return{extensionInstanceId:X,createHost:async(L,D,_)=>$Y(await M.createHost({...L,browser:{...L.browser,extensionInstanceId:M.extensionInstanceId}},D,_),X)}}}:{},createBrowser:(q)=>N4({...q,endpoint:(K)=>({discover:(N)=>tJ(N,Z),tabScope:U(K)})})});return{capability:V,broker:F}}function $Y($,J){let Z=(Q)=>({...Q,owner:{...Q.owner,extensionInstanceId:J}});return{start:()=>$.start(),close:()=>$.close(),completed:async()=>Z(await $.completed()),stop:async()=>Z(await $.stop()),read:async(Q)=>{let X=await $.read(Q);return{capture:Z(X.capture),bytes:X.bytes}}}}import{execFile as LY}from"child_process";import{execFile as JY}from"child_process";import{readFile as ZY}from"fs/promises";import{join as o0}from"path";var QY="Claude Code-credentials",XY="/usr/bin/security",YY=120000,VY=8192,c8={exec:($,J,Z)=>new Promise((Q)=>{JY($,J,{timeout:Z,maxBuffer:8388608},(X,Y)=>{let V=X?typeof X.code==="number"?X.code:1:0;Q({code:V,stdout:String(Y??"")})})}),readText:async($)=>{try{return await ZY($,"utf8")}catch{return null}}};function H2($){return typeof $==="string"&&$.length>0&&$.length<=VY?$:null}function GY($,J){return $.CLAUDE_CONFIG_DIR||o0(J,".claude")}function KY($,J){return $.CODEX_HOME||o0(J,".codex")}function X3($){if(!$)return null;try{let J=JSON.parse($).claudeAiOauth,Z=H2(J?.accessToken),Q=H2(J?.refreshToken),X=typeof J?.expiresAt==="number"&&Number.isFinite(J.expiresAt)?J.expiresAt:null;return Z&&Q&&X!==null?{provider:"anthropic",access:Z,refresh:Q,expires:X}:null}catch{return null}}function BY($){try{let J=JSON.parse(Buffer.from($.split(".")[1]??"","base64url").toString("utf8"));return typeof J.exp==="number"?J.exp*1000:null}catch{return null}}function qY($){if(!$)return null;try{let J=JSON.parse($);if(J.auth_mode!==void 0&&J.auth_mode!=="chatgpt")return null;let Z=H2(J.tokens?.access_token),Q=H2(J.tokens?.refresh_token);if(!Z||!Q)return null;return{provider:"openai-codex",access:Z,refresh:Q,expires:BY(Z)??Date.now()}}catch{return null}}function UY($,J){return o0($.XDG_DATA_HOME||o0(J,".local","share"),"opencode","auth.json")}var HY={anthropic:"anthropic",openai:"openai-codex"};function NY($){return K3($,HY)}function K3($,J){if(!$)return[];try{let Z=JSON.parse($),Q=[];for(let[X,Y]of Object.entries(J)){let V=Z[X];if(V?.type!=="oauth")continue;let U=H2(V.access),G=H2(V.refresh),H=typeof V.expires==="number"&&Number.isFinite(V.expires)?V.expires:null;if(U&&G&&H!==null)Q.push({provider:Y,access:U,refresh:G,expires:H})}return Q}catch{return[]}}function FY($){return K3($,{anthropic:"anthropic","openai-codex":"openai-codex"})}function TY($,J){let Z=$.PI_CODING_AGENT_DIR;return Z==="~"?J:Z?.startsWith("~/")?o0(J,Z.slice(2)):Z||o0(J,".pi","agent")}async function B3($,J,Z=c8){let Q=[],X=await Z.exec(XY,["find-generic-password","-s",QY,"-w"],YY),Y=Date.now()+300000,V=(G)=>{if(!G)return;let H=Q.findIndex((F)=>F.provider===G.provider);if(H<0)Q.push(G);else if(Q[H].expires<=Y&&G.expires>Y)Q[H]=G};if(V(X.code===0?X3(X.stdout.trim()):null),!Q.some((G)=>G.provider==="anthropic"&&G.expires>Y))V(X3(await Z.readText(o0(GY($,J),".credentials.json"))));let U=qY(await Z.readText(o0(KY($,J),"auth.json")));V(U),V(MY(await Z.readText(o0($.GROK_HOME||o0(J,".grok"),"auth.json"))));for(let G of NY(await Z.readText(UY($,J))))V(G);for(let G of FY(await Z.readText(o0(TY($,J),"auth.json"))))V(G);return Q}function q3($){return $.map(({provider:J,access:Z,expires:Q})=>({provider:J,access:Z,expires:Q}))}var Y3="https://auth.x.ai",V3="b1a00492-073a-47ea-816f-4c329264a828",G3=($)=>typeof $==="string"&&$.length>0&&$.length<=8192&&$.trim()===$;function MY($){if(!$)return null;try{let J=JSON.parse($);if(!J||typeof J!=="object"||Array.isArray(J))return null;let Z=J[`${Y3}::${V3}`];if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let Q=Z;if(Q.auth_mode!=="oidc"||Q.oidc_issuer!==Y3||Q.oidc_client_id!==V3||!G3(Q.key)||!G3(Q.refresh_token)||typeof Q.expires_at!=="string")return null;let X=Date.parse(Q.expires_at);if(!Number.isFinite(X)||X<=0)return null;return{provider:"xai",access:Q.key,refresh:Q.refresh_token,expires:X}}catch{return null}}var U3=330000,jY=300000,WY=60000;function DY($,J,Z=Date.now()){return $.filter((Q)=>{if(!Number.isFinite(Q.expires)||Q.expires<=Z+U3)return!1;let X=J.get(Q.provider);return!X||X.access!==Q.access||X.expires!==Q.expires})}function _Y($,J=Date.now()){return[...$.values()].some((Q)=>Q.expires<=J+2*U3)?WY:jY}var zY=($,J)=>new Promise((Z)=>{if(J.aborted)return Z();let Q=setTimeout(X,$);function X(){clearTimeout(Q),J.removeEventListener("abort",X),Z()}J.addEventListener("abort",X,{once:!0})});async function H3($){let J=new Map,Z=$.wait??zY,Q=$.stores??(process.platform==="darwin"?c8:{...c8,exec:async()=>({code:1,stdout:""})});while(!$.signal.aborted){try{let X=q3(await B3($.environment??process.env,$.home,Q));for(let Y of DY(X,J)){if($.signal.aborted)return;let V=await $.client.localSubscription($.state,Y,AbortSignal.any([$.signal,AbortSignal.timeout(30000)]));J.set(Y.provider,{access:Y.access,expires:Y.expires}),$.onOutcome?.({provider:Y.provider,ok:V.ok,...V.ok?{}:{error:V.error}})}}catch{}await Z(_Y(J),$.signal)}}function N3($=process.env){return new Promise((J)=>{LY("gh",["auth","status","--hostname","github.com"],{env:$,timeout:8000,maxBuffer:65536},(Z)=>J(!Z))})}import{execFile as OY,spawn as sN,spawnSync as aN}from"child_process";import{chmodSync as nN,existsSync as AY,mkdirSync as tN,readFileSync as rN,renameSync as oN,rmSync as eN,statSync as $F,writeFileSync as JF}from"fs";import{dirname as QF,isAbsolute as XF,join as s8}from"path";var F3=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function T3($,J){if(!F3.test($)||!F3.test(J))throw Error("Invalid CLI version");let Z=$.split(".").map(BigInt),Q=J.split(".").map(BigInt);for(let X=0;X<3;X++){if(Z[X]<Q[X])return-1;if(Z[X]>Q[X])return 1}return 0}var PY="com.reasonmachines.updater",RY=["so.ara.updater","so.reason.updater"];function IY($){let J=$==="staging"?".staging":"";return{label:`${PY}${J}`,legacyLabels:[...RY].reverse().map((Z)=>`${Z}${J}`)}}function CY($,J){return J==="darwin"?$.launchAgent:J==="win32"?$.scheduledTask:$.systemdService}function xY($,J,Z){return{launchAgent:s8(J,"Library","LaunchAgents",`${$}.plist`),systemdService:s8(Z,"systemd","user",`${$}.service`),systemdTimer:s8(Z,"systemd","user",`${$}.timer`),scheduledTask:s8(W3(J),`${$}.xml`)}}function EY($,J){return new Promise((Z)=>{OY(j3($),[...J],{timeout:1e4},(Q)=>{Z(Q?typeof Q.code==="number"?Q.code:1:0)})})}async function D3($){let J=$.runtimePlatform??process.platform;if(J!=="darwin"&&J!=="linux"&&J!=="win32")return"absent";let Z=$.uid??process.getuid?.();if(J!=="win32"&&(typeof Z!=="number"||!Number.isSafeInteger(Z)||Z<=0))return"absent";let Q=$.home??U0(),{label:X,legacyLabels:Y}=IY($.channel),V=$.configHome??L3(Q),U=[X,...Y].filter((q)=>{return AY(CY(xY(q,Q,V),J))});if(U.length===0)return"absent";let G=$.command??EY,H=U[0];if(U.length>1){for(let q of U)if((J==="darwin"?await G("/bin/launchctl",["print",`gui/${Z}/${q}`]):J==="win32"?await G("schtasks",["/Query","/TN",q]):await G("systemctl",["--user","is-enabled",`${q}.timer`]))===0){H=q;break}}return(J==="darwin"?await G("/bin/launchctl",["kickstart",`gui/${Z}/${H}`]):J==="win32"?await G("schtasks",["/Run","/TN",H]):await G("systemctl",["--user","start","--no-block",`${H}.service`]))===0?"started":"failed"}var M3=60000;function _3($){let J=(X,Y)=>{try{return T3(X,Y)>0}catch{return!1}},Z=$.actedOn&&J($.actedOn,"0.0.0")?$.actedOn:null,Q=$.schedule??((X,Y)=>{let V=setTimeout(X,Y);V.unref?.(),$.signal.addEventListener("abort",()=>clearTimeout(V),{once:!0})});return(X)=>{if($.signal.aborted||X===void 0||!J(X,$.currentVersion))return;if(Z!==null&&!J(X,Z))return;Z=X;let Y=($.random??Math.random)(),V=Number.isFinite(Y)?Math.min(Math.max(Y,0),1):0;Q(()=>{if(!$.signal.aborted)$.check(X).catch(()=>{return})},Math.min(M3-1,Math.floor(V*M3)))}}var SY=30000;async function O3($){return($.flush??z3)($.paths,async(J)=>{let{schema_version:Z,...Q}=J,X=AbortSignal.timeout(SY);try{await $.client.deviceLifecycle($.device,Q,$.signal?AbortSignal.any([$.signal,X]):X)}catch(Y){if(Y instanceof N0&&Y.status===400&&Y.code==="invalid_device_lifecycle_event")return;throw Y}},$.accept)}var P3=25000,wY=5000,yY=600000,kY=["display.stream.v1","pty.start"],hY=64;function O4($,J,Z=P4($),Q){return g0(),g3(J.roots,{...Z,...Q?{productionProof:Q}:{}})}var R3=5000,fY=600000;function vY($,J){if($.lifetime!=="persistent"||J!=="darwin"||!process.env[s$])return null;try{return a8({platform:J})}catch{return null}}function mY($){return $.event.startsWith("update.")||$.event.startsWith("executor.update.")||$.event.startsWith("identity.")||$.event.startsWith("worker.")}function gY($,J){let Z=Object.keys(J).filter((Q)=>J[Q]!==!0).sort();try{let Q=Z4();if(Z.length>0)c2($,{event:"worker.capabilities_withheld",runtime_version:r,capabilities:Z});if(Q)c2($,{event:"identity.computer_use_unavailable",runtime_version:r,reason_code:Q})}catch{}}async function a2($,J,Z,Q,X={}){if(g0(),$.executionMode==="host")s2();let Y=J.worker?.expiresAt;if(!Y||Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let V=$0($);if(V.revoked)throw Error("worker_revoked");let U=AbortSignal.any([...X.signal?[X.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(Y)-Date.now())))]);if(!X.prestartedReadiness)X.onStartup?.("readiness_started");let G,H=()=>G??=$.executionMode==="host"?v3():Promise.resolve(!1),F=y3(),q=X.prestartedReadiness??h2($,X.readinessProbes,U,J.roots[0].permissions),K=X.deferOptionalLanes===!0,N=await(K?q.initial:q.final);if(X.signal?.aborted)throw Error("worker_start_cancelled");if(X.onStartup?.("readiness_completed"),Date.parse(Y)<=Date.now())throw Error("worker_credential_expired");let T,M=N["github.local.v1"]===!0?(X.probeGithubSignedIn??N3)().catch(()=>!1):null,L=new AbortController,D=null,_=async(h,t)=>{let W0=($.userChrome??X.ownComputer===!0)&&h["automation.call.v1"]===!0?p3():null;if(W0&&"code"in W0)process.stderr.write(`Reason worker: your own Chrome unavailable (${W0.code})
-`);let S0=P4($,h,{displayVideo:h["display.stream.v1"]===!0&&await H(),handsBrowser:h["hands.connect"]===!0&&F,userChrome:W0&&"host"in W0?W0.host:null,...T===void 0?{}:{githubSignedIn:T},persistentTerminals:h["pty.start"]===!0&&y8(),probing:t,ownComputer:X.ownComputer===!0});if(!D&&S0.worker.readiness?.["browser.pr-proof.v1"]===!0){let X0=await $3();if(D||L.signal.aborted)return S0;process.stderr.write("error"in X0?`Reason worker: PR video proof unavailable (${X0.error})
-`:`Reason worker: PR video proof ready (ffmpeg ${X0.encoder.ffmpeg.path})
-`),D=J3({assertCurrent:async()=>{if(!k())throw Error("proof_authority_lost")},...!("error"in X0)?{recording:X0}:{}})}return S0},j=await _(N,K?Q4.filter((h)=>N[h]!==!0):[]),z=O4($,J,j,D?.capability);X.onStartup?.("inventory_completed");let A=!1,I=0,x=0,P="starting",W=null,O=!1,y=!1,b=null,w,l=()=>!V.drained&&Date.parse(Y)>Date.now()&&z.supported_operations.some((h)=>j.worker.readiness?.[h]===!0),k=()=>!A&&l(),C=null,S=()=>I+(C?.claims()??0),E=null,v=new Set,f=(h)=>{let t=h.capabilities.root_paths;if(Object.assign(h.capabilities,O4(h.config,h.state,j,D?.capability)),t)h.capabilities.root_paths=t},R=(h)=>{j=h,f({config:$,state:J,capabilities:z}),E?.();for(let t of v)f(t),t.heartbeatNow?.()},c=new Set,n=new Set,K0=setInterval(()=>{let h=new Set;for(let t of[{state:J,capabilities:z},...v])for(let F0 of kY){if(t.capabilities.operation_constraints?.[F0]?.probing!==!0)continue;let S0=`${t.state.deviceId} ${F0}`;if(h.add(S0),!c.has(S0)||n.has(S0))continue;n.add(S0),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:t.state.deviceId,lane:F0,login_device:t.state===J,timestamp:new Date().toISOString()})}
-`)}c.clear();for(let t of h)c.add(t)},yY);K0.unref();let R0=(h)=>{if(!X.readinessProbes)YJ({config:$,readiness:h,signal:L.signal,idle:()=>S()===0,permissions:J.roots[0].permissions,onReady:(t)=>{_(t,[]).then(R)}})},E0=K?q.final.then(async(h)=>{if(L.signal.aborted)return;R(await _(h,[]));let t=Q4.filter((F0)=>h[F0]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${t.length?`ready: ${t.join(", ")}`:"none ready"}).
-`),R0(h)},()=>{}):Promise.resolve();if(!K)R0(N);M?.then(async(h)=>{T=h;for(;;){let t=j,F0=await _(t.worker.readiness??{},t.worker.probing??[]);if(L.signal.aborted)return;if(j!==t)continue;R(F0);return}});let s0=K&&j.worker.probing?.includes("pty.start")?q.pty.then(async(h)=>{let t=()=>j.worker.probing?.includes("pty.start")===!0;if(L.signal.aborted||!t())return;let F0=await _({...j.worker.readiness,"pty.start":h},(j.worker.probing??[]).filter((W0)=>W0!=="pty.start"));if(L.signal.aborted||!t())return;R(F0)},()=>{}):Promise.resolve(),S$=()=>({version:1,instanceId:Q,deviceId:J.deviceId,phase:P,drained:V.drained||A||O,activeClaims:S(),activeSessions:x,lastHeartbeat:W,expiresAt:Y,supportedOperations:[...z.supported_operations],capabilityReadiness:j.worker.readiness,executionEligible:k()&&!O&&P==="running"}),n$=!1,L$=()=>{n$=!0,B$()},B$=()=>{if(A)return;if(A=!0,P="stopping",b?.close(),S()===0)L.abort();else w=setTimeout(()=>L.abort(),$.shutdownGraceMs)},b$=$.channel==="production"||$.channel==="staging"?$.channel:null,q$=p($).releaseCheck,d0=X.publishedRelease??(b$&&$.lifetime==="persistent"?_3({currentVersion:r,signal:L.signal,actedOn:(()=>{try{let h=JSON.parse(i(q$));return typeof h==="string"?h:null}catch{return null}})(),check:async(h)=>{try{a(q$,h)}catch{}let t=await D3({channel:b$});process.stderr.write(t==="started"?`Reason worker: CLI ${h} is published; the updater is checking now.
-`:t==="absent"?`Reason worker: CLI ${h} is published; no updater is installed for it here.
-`:`Reason worker: CLI ${h} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),D2=(h)=>{if(h==="stop")L$();if(h==="reload_roots"){let t=o($);if(!t||t.deviceId!==J.deviceId)throw Error("worker_identity_changed");J.roots=t.roots;let F0=m3(J.roots,A3());if(F0)z.root_paths=F0;else delete z.root_paths;C?.check()}if(h==="drain"||h==="resume"){if(A||Date.parse(Y)<=Date.now())throw Error("worker_stopping_or_expired");V={...V,drained:h==="drain"},I0($,V)}return S$()};X.prestartedControl?.handle(D2);let t$=X.prestartedControl?await X.prestartedControl.closed:await A8($,Q,D2),g,Z0=!1,j$=()=>{let h=Date.parse(Y)-Date.now();if(h>0){g=setTimeout(j$,Math.min(h,2147483647));return}A=!0,b?.close(),Z0=!0,P="stopping",L.abort(Error("worker_credential_expired"))};j$(),X.signal?.addEventListener("abort",B$,{once:!0});let U$=X.processSignals!==!1;if(U$)process.once("SIGTERM",B$),process.once("SIGINT",L$);if(X.signal?.aborted)B$();try{X.onStartup?.("control_ready");let h=X.client??new l2(P$($.apiOrigin),w0($.proxy,I3()),Z,{deviceSession:c1({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),t=p($).daemon,F0=L1($,J.deviceId),W0=X.startupTiming,S0=W0?()=>({...W0(),...F0?.enrollmentMs!==void 0?{enrollment_ms:F0.enrollmentMs}:{}}):void 0,X0=(m)=>{let i0=m.client.localSubscription?.bind(m.client);if($.localLogins===!0&&i0)(X.handOverLocalLogins??H3)({state:m.state,client:{localSubscription:i0},signal:m.signal,home:U0()}).catch(()=>{return});let L0=A3(),b0=m.client.liveSessionWorktrees?.bind(m.client);if(b0)S3(()=>E3({home:L0,deviceId:m.state.deviceId,liveIds:(D$)=>b0(m.state,D$,m.signal)}),m.signal)};X0({state:J,client:h,signal:L.signal});let a0=vY($,X.platform??process.platform),D0=h.deviceLifecycle?.bind(h),e0=Promise.resolve(),W$=0,w$=()=>{if(!a0||!D0||A||Date.now()<W$)return;W$=Date.now()+fY,e0=e0.then(()=>O3({paths:a0,device:J,client:{deviceLifecycle:D0},accept:mY,signal:L.signal})).catch(()=>{return})};if(w$(),a0)q.final.then((m)=>gY(a0,m),()=>{});let r$=(m,i0)=>({state:m.state,client:m.client,...m.firstHeartbeat?{firstHeartbeat:m.firstHeartbeat}:{},runtimeVersion:r,bridgeVersion:r,protocolVersion:2,capabilities:m.capabilities,signal:m.signal,statusPath:m.statusPath,maxConcurrentClaims:X.ownComputer===!0?hY:4*$.slots+h3,heartbeatIntervalMs:X.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:P3,operationCompletionTimeoutMs:P3,maxConsecutiveHeartbeatFailures:3,claimable:k,advertised:l,onClaim:async(L0,b0,D$)=>{let _2=Date.now();if(!m.capabilities.supported_operations.includes(L0.capability))return{status:"failed",error_code:"unsupported_capability"};let n0=j.worker.probing??[],t4=n0.includes(L0.capability)?E0:L0.capability==="hands.connect"&&$.executionMode==="host"&&n0.includes("pty.start")?s0:null;if(t4){let Q8,N1=()=>{};await Promise.race([t4,new Promise((r4)=>{Q8=setTimeout(r4,wY),N1=()=>r4(),b0.addEventListener("abort",N1,{once:!0})})]),clearTimeout(Q8),b0.removeEventListener("abort",N1)}let Z8=L0.capability==="hands.connect",H1=Z8?b:null,MZ={signal:b0,emit:D$,...j,...D?{proveMac:D.broker.execute}:{},...L0.capability==="inference.custom.v1"&&m.client.operationCustomEndpointCredential?{customEndpointCredential:(Q8)=>m.client.operationCustomEndpointCredential(m.state,L0,Q8)}:{},...Z8?{handsLaunch:{claimedAtMs:_2,...H1?{takePrespawnedWorker:H1.take,adoptSpawnedWorker:H1.adopt}:{}}}:{}};if(Z8)x+=1;try{return await(X.execute??R4)(m.state,L0,MZ)}finally{if(Z8)x-=1}},onControl:async(L0,b0)=>await u3(m.state,L0,b0,m.client)||await d3(m.state,L0,b0)||await f3(L0,b0)||await D?.broker.control(L0,b0)||!1,onEvent:i0}),A0=async(m)=>{await m.client.deviceLifecycle?.(m.state,{event_id:bY(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:r,reason_code:"worker_stopped"},AbortSignal.timeout(R3)).catch(()=>{return})},_0=$.lifetime==="persistent"?X.ownerWorkspaces:void 0,y$=_0?.intervalMs??R1,J8=h.ownerWorkspaces?.bind(h),n4=h.ownerWorkspaceEnrollment?.bind(h);if(_0&&J8&&n4)C=z5({config:$,state:J,signal:L.signal,client:{ownerWorkspaces:J8,ownerWorkspaceEnrollment:n4},..._0.enroll?{enroll:_0.enroll}:{},intervalMs:y$,log:(m)=>{process.stderr.write(m)},serve:async(m,i0,L0)=>{let b0=L1(m.config,m.state.deviceId),D$={config:m.config,state:m.state,signal:i0,statusPath:p(m.config).daemon,...b0?.offer?{firstHeartbeat:b0.offer}:{},capabilities:O4(m.config,m.state,j,D?.capability),client:_0.client?.(m)??new l2(P$($.apiOrigin),w0($.proxy,I3()),m.proofStore,{deviceSession:c1({proxied:Boolean($.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};X0(D$);let _2={...D$,heartbeatNow:null};v.add(_2);try{await i1({registerHeartbeatNow:(n0)=>{_2.heartbeatNow=n0},...r$(D$,(n0)=>{if(n0.type==="completed")A4(n0.operationId,n0.status);if(n0.type==="claims_changed"){if(L0(n0.activeClaims),A&&S()===0)L.abort()}if(n0.type==="stopped")L0(0)})})}finally{v.delete(_2)}if(A&&!Z0)await A0(D$)}});let q1=0,U1=0;if(await i1({...(X.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>S()>0?W8(t):void 0,...X.acquireAwakeHold?{acquireAwakeHold:X.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(m)=>{E=m},...S0?{startup:S0}:{},...r$({state:J,client:h,capabilities:z,signal:L.signal,statusPath:t,...F0?.offer?{firstHeartbeat:F0.offer}:{}},(m)=>{if(m.type==="completed")A4(m.operationId,m.status);if(m.type==="claims_changed"){if(I=m.activeClaims,A&&S()===0)L.abort()}if(m.type==="heartbeat"&&!A){if(m.handsPrespawn&&$.lifetime==="ephemeral"&&!b)b=w3({log:(i0,L0)=>{process.stderr.write(`${JSON.stringify({event:i0,...L0})}
-`)}}),b.arm(),setTimeout(k3,0);else if(!m.handsPrespawn&&b)b.close(),b=null}if(m.type==="heartbeat"){if(C&&!A&&Date.now()>=q1)q1=Date.now()+y$,C.check().then((i0)=>{U1=i0?0:U1+1,q1=Date.now()+(i0?y$:Math.min(y$,j5*2**Math.min(U1-1,10)))});if(W=m.serverTime,O=m.drain,w$(),!A&&b$)d0?.(m.latestCliVersions?.[b$]);if(!A)P="running";if(!A&&!y&&S$().executionEligible){if(y=!0,X.onStartup?.("ready"),(X.platform??process.platform)==="darwin")setTimeout(()=>{try{_4({skipWhenSettled:!0})}catch{}},0)}}if(m.type==="reconnecting"&&!A)P="reconnecting";if(m.type==="stopped")I=0;X.onEvent?.(m)})}),await C?.settled(),A&&!Z0&&$.lifetime==="ephemeral")await h.disconnect?.(J,AbortSignal.timeout(R3)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(A&&!Z0)await A0({state:J,client:h});if(n$)await b3().catch(()=>{return})}catch(h){if(!(h instanceof N0&&h.status===401)||h.code==="invalid_device_proof"||h.code==="device_proof_replayed")throw h;if(I0($,{...V,revoked:!0}),h.code==="device_revoked")X.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(g),clearInterval(K0),w)clearTimeout(w);if(U$)process.removeListener("SIGTERM",B$),process.removeListener("SIGINT",L$);X.signal?.removeEventListener("abort",B$),L.abort(),b?.close(),await C?.settled().catch(()=>{return}),await D?.broker.close().catch(()=>{return}),await t$()}}function I3($=process.env){if($.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((Z,Q)=>{let X=new Headers(Q?.headers);return X.set(C3,x3),fetch(Z,{...Q,headers:X})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as uY,sign as dY}from"crypto";var l3=65536,pY=65536;function lY($){let J=$.export({format:"jwk"});if(J.crv!=="P-256"||typeof J.x!=="string"||typeof J.y!=="string")throw new V0("invalid_public_key");let Z=Buffer.from(J.x,"base64url"),Q=Buffer.from(J.y,"base64url");if(Z.byteLength!==32||Q.byteLength!==32)throw new V0("invalid_public_key");let X=Buffer.concat([Buffer.of(4),Z,Q]).toString("base64url");if(!s3(X))throw new V0("invalid_public_key");return X}function c3(){try{let{privateKey:$,publicKey:J}=uY("ec",{namedCurve:"P-256"});return{privateKey:$,publicPoint:lY(J)}}catch($){if($ instanceof V0)throw $;throw new V0("proof_key_generation_failed")}}class i2{keyPair=c3();binding=null;loadPublicKey(){if(!this.keyPair)throw new V0("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=c3(),this.keyPair.publicPoint}sign($){if(!this.keyPair||$.byteLength<1||$.byteLength>pY)throw new V0("proof_sign_failed");let J;try{J=dY("sha256",$,this.keyPair.privateKey)}catch{throw new V0("proof_sign_failed")}if(!a3(J))throw new V0("invalid_signature");return J.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding($){if($.byteLength<1||$.byteLength>l3)throw new V0("invalid_binding");if(this.binding)throw new V0("binding_create_failed");this.binding=Uint8Array.from($)}updateBinding($){if($.byteLength<1||$.byteLength>l3)throw new V0("invalid_binding");if(!this.binding)throw new V0("binding_update_failed");this.binding=Uint8Array.from($)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as rY,spawn as oY}from"child_process";import{isAbsolute as eY}from"path";import{promisify as $V}from"util";var n2={now:()=>Date.now(),after($,J){let Z=setTimeout(J,$);return()=>clearTimeout(Z)},every($,J){let Z=setInterval(J,$);return()=>clearInterval(Z)}};class t2{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=($)=>{let J=Buffer.isBuffer($)?$:Buffer.from($),Z=0;while(Z<J.length&&!this.failure){let Q=J.indexOf(10,Z),X=Q<0?J.length:Q;if(this.buffer.length+X-Z+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,J.subarray(Z,X)]),Q<0)return;try{let Y=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let V=this.waiter;this.waiter=void 0,V.resolve(Y)}else if(this.queue.length<4)this.queue.push(Y);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}Z=X+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor($,J,Z=n2){this.input=$;this.output=J;this.clock=Z;$.on("data",this.onData),$.on("end",this.onEnd),$.on("close",this.onEnd),$.on("error",this.onError),J.on("error",this.onError)}fail($,J=!1){if(this.failure??=$,this.buffer=Buffer.alloc(0),!J)this.queue=[];this.lifetime.abort();let Z=this.waiter;this.waiter=void 0,Z?.reject(this.failure)}async send($,J=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let Z=JSON.stringify($)+`
-`;if(Buffer.byteLength(Z)>65536)throw Error("worker_ssh_frame_too_large");let Q;try{await new Promise((X,Y)=>{Q=this.clock.after(J,()=>Y(Error("worker_ssh_write_timeout"))),this.output.write(Z,(V)=>V?Y(Error("worker_ssh_connection_failed")):X())})}finally{Q?.()}}async receive($=30000,J){if(J?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let Z,Q;try{return await new Promise((X,Y)=>{this.waiter={resolve:X,reject:Y},Q=()=>{this.waiter=void 0,Y(Error("worker_ssh_cancelled"))},Z=this.clock.after($,()=>{this.waiter=void 0,Y(Error("worker_ssh_handshake_timeout"))}),J?.addEventListener("abort",Q,{once:!0})})}finally{Z?.(),J?.removeEventListener("abort",Q)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as cY}from"crypto";import{unlinkSync as sY}from"fs";import{join as aY}from"path";var r2=1,i8=45000,iY=B.strictObject({type:B.literal("configure"),protocol:B.literal(r2),version:B.string(),config:J0}),nY=B.strictObject({type:B.literal("ticket"),organizationId:B.string().min(1).max(160),receipt:B.unknown()}),tY=B.strictObject({type:B.enum(["ping","stop"])});async function i3($={}){let J=$.clock??n2,Z=new t2($.input??process.stdin,$.output??process.stdout,J),Q=new AbortController,X=new AbortController,Y=()=>Q.abort(),V,U,G,H,F=!1;process.once("SIGHUP",Y),Z.signal.addEventListener("abort",Y,{once:!0}),$.signal?.addEventListener("abort",Y,{once:!0});try{if($.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:q,version:K}=iY.parse(await Z.receive(30000,Q.signal));if(K!==r)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(H$(q),e(u(q),!0),U=Z$({path:p(q).lock,runtimeVersion:r}),!U.acquired)throw Error("worker_already_running_or_lifecycle_busy");let N=aY(u(q),`ssh-preflight-${cY()}.json`);try{a(N,{version:1}),i(N)}finally{try{sY(N)}catch{}}let T=o(q),M=$0(q);if(M.revoked||M.drained)throw Error("worker_ssh_revoked_or_drained");if(T&&Date.parse(T.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(T&&q.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await Z.send({type:"hello",protocol:r2,version:r,platform:process.platform,architecture:process.arch,enrolled:!!T});let L=q.lifetime==="ephemeral"?G=new i2:T0(q,!0);if(!T){let A=A$(q);await Z.send({type:"ticket-request",request:A.request});let I=nY.parse(await Z.receive(70000,Q.signal)),x=A.complete(I.organizationId,I.receipt);if(T=await J$(q,x,L,$.enroll),q.lifetime==="persistent")f0(T,p(q).state,{proofStore:L});I0(q,{version:1,drained:!1,revoked:!1})}if(Q.signal.aborted)throw Error("worker_ssh_cancelled");V=(async()=>{try{while(!X.signal.aborted){if(tY.parse(await Z.receive(35000,X.signal)).type==="stop"){Y();return}await Z.send({type:"pong"})}}catch{if(!X.signal.aborted)Y()}})();let D=!1,_,j=!1;H=J.after(Math.max(1,Math.min(i8,$.startupTimeoutMs??i8)),()=>{j=!0,Y()});let z=U.owner.nonce;if(await a2(q,T,L,z,{...$,signal:Q.signal,onEvent(A){if($.onEvent?.(A),A.type==="heartbeat"&&!D&&!_)_=(async()=>{let I=await B0(q,"status");if(!I?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await Z.send({type:"running",deviceId:I.deviceId,expiresAt:I.expiresAt,lifetime:q.lifetime,supervision:"ssh-foreground"}),D=!0,H?.()})().catch(()=>{j=!0,Y()})}}),await _,j||!D)throw Error("worker_ssh_outbound_or_readiness_failed");return F=!0,0}catch(q){let K=q instanceof Error&&/^worker_[a-z_]+$/.test(q.message)?q.message:"worker_ssh_bootstrap_failed";try{await Z.send({type:"error",code:K})}catch{}return 1}finally{if(H?.(),Y(),X.abort(),await V,G?.deleteBinding(),G?.deleteKey(),U?.acquired)U.release();if(process.removeListener("SIGHUP",Y),$.signal?.removeEventListener("abort",Y),Z.signal.removeEventListener("abort",Y),F)try{await Z.send({type:"stopped"})}catch{}Z.dispose()}}var C4=($)=>eY($)&&$.length<=4096&&!/[\x00-\x1f\x7f]/.test($),I4=($)=>`'${$.replaceAll("'","'\\''")}'`,JV=B.strictObject({type:B.literal("hello"),protocol:B.literal(r2),version:B.string(),platform:B.enum(["linux","darwin"]),architecture:B.enum(["arm64","x64"]),enrolled:B.boolean()}),ZV=B.strictObject({type:B.literal("ticket-request"),request:B.strictObject({install_id:B.uuid(),code_challenge:B.string().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:B.enum(["persistent","ephemeral"]),roots:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),execution_mode:B.enum(["confined","host"]),permissions:B.strictObject({read:B.literal(!0),write:B.literal(!0),execute:B.literal(!0),discover_environment:B.literal(!0),expose_mcp:B.literal(!1)})})).length(1)})}),n3=B.discriminatedUnion("type",[B.strictObject({type:B.literal("running"),deviceId:B.string().min(1).max(160),expiresAt:B.iso.datetime({offset:!0}),lifetime:B.enum(["persistent","ephemeral"]),supervision:B.literal("ssh-foreground")}),B.strictObject({type:B.literal("pong")}),B.strictObject({type:B.literal("stopped")})]),QV=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function n8($){if($&&typeof $==="object"&&"type"in $&&$.type==="error"){let J="code"in $&&typeof $.code==="string"&&QV.has($.code)?$.code:"worker_ssh_remote_failed";throw Error(J)}return $}function t3($){if(!C4($.remoteCli)||!/^[a-f0-9]{64}$/.test($.sha256))throw Error("worker_ssh_invalid_target");let J=`set -eu
-a=${I4($.remoteCli)}
-[ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
-p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
-p=$(cd -P "$p" && pwd -P)
-[ "\${p%/}/$f" = "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
-if [ -x /usr/bin/sha256sum ]; then h=$(/usr/bin/sha256sum < "$a");
-elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
-else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
-h=\${h%% *}
-[ "$h" = ${I4($.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${I4(J)}`}function r3($,J){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test($.alias)||!C4($.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",$.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...J?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",$.alias,t3($)]}function XV($){return r3($,!1)}function o3(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:U0(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function YV($){let J;try{({stdout:J}=await $V(rY)("/usr/bin/ssh",["-G",...r3($,!0)],{env:o3(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let Z of J.split(`
-`)){let[Q,...X]=Z.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(Q??"")&&X.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function VV($){let J=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((Z)=>$.includes(`worker_ssh_${Z}`));return J?`worker_ssh_${J}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test($)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test($)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function GV($){await YV($);let J=oY("/usr/bin/ssh",XV($),{stdio:["pipe","pipe","pipe"],env:o3()}),Z="";J.stderr.on("data",(X)=>{if(Buffer.byteLength(Z)+X.length<=65536)Z+=X.toString("utf8");else J.kill("SIGKILL")});let Q=new Promise((X)=>{J.once("error",()=>X({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),J.once("close",(Y)=>{let V=VV(Z);Z="",X({exitCode:Y??1,errorCode:V})})});return{input:J.stdin,output:J.stdout,result:Q,close(){if(J.stdin.destroy(),J.exitCode===null&&J.signalCode===null){J.kill("SIGTERM");let X=setTimeout(()=>J.kill("SIGKILL"),2000);X.unref(),Q.finally(()=>clearTimeout(X))}}}}function KV($){let J=new Map,Z=!1;for(let V=0;V<$.length;V++){let U=$[V];if(U==="--foreground"&&!Z){Z=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(U)||J.has(U))throw Error("worker_unknown_or_duplicate_flag");let G=$[++V];if(!G||G.startsWith("--"))throw Error("worker_missing_flag_value");J.set(U,G)}if(!Z)throw Error("worker_ssh_foreground_required");let Q=(V)=>{let U=J.get(V);if(!U)throw Error("worker_required_input_missing");return U},X={alias:Q("--ssh"),sshConfig:Q("--ssh-config"),remoteCli:Q("--remote-cli"),sha256:Q("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(X.alias)||!C4(X.sshConfig))throw Error("worker_ssh_invalid_target");t3(X),i(X.sshConfig);let Y=J0.parse(JSON.parse(i(Q("--config"))));if(o2(Y.workspaceRoot,X.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:X,config:Y,credentialPath:J.get("--credential-file")}}async function BV($,J,Z,Q,X){let{request:Y}=ZV.parse(n8(await $.receive(30000,X)));if(Y.lifecycle!==J.lifetime||Y.roots[0].execution_mode!==J.executionMode)throw Error("worker_ticket_receipt_mismatch");let V=()=>{if(X.aborted)throw Error("worker_ssh_cancelled")},U=(async()=>{V();let H=Z??z$(J),F=await(Q.enrollmentCredentials??O$)(J,H);if(V(),!F)throw Error("worker_session_login_required");if(!C0(F.apiOrigin,J.apiOrigin))throw Error("worker_session_origin_mismatch");if(!F.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let q=Q.createTicketClient?.(F)??new C$(F,{credentialsPath:H}),K=O1(await q.createHeadlessDeviceEnrollmentTicket(Y));return V(),{type:"ticket",organizationId:F.orgId,receipt:K}})(),G;try{let H=await Promise.race([U,new Promise((F,q)=>{if(G=()=>q(Error("worker_ssh_cancelled")),X.aborted)G();else X.addEventListener("abort",G,{once:!0})})]);V(),await $.send(H)}finally{X.removeEventListener("abort",G)}}async function e3($,J={}){let{config:Z,target:Q,credentialPath:X}=KV($);if(J.signal?.aborted)throw Error("worker_ssh_cancelled");let Y=J.clock??n2,V=await(J.sshTransport??GV)(Q),U=new t2(V.output,V.input,Y),G=new AbortController,H=()=>G.abort(),F,q;if(V.result.then((K)=>{q=K}),process.once("SIGINT",H),process.once("SIGTERM",H),J.signal?.addEventListener("abort",H,{once:!0}),J.signal?.aborted)H();try{if(G.signal.aborted)throw Error("worker_ssh_cancelled");await U.send({type:"configure",protocol:r2,version:r,config:Z});let K=JV.parse(n8(await U.receive(30000,G.signal)));if(K.version!==r)throw Error("worker_ssh_version_mismatch");if(!K.enrolled)await BV(U,Z,X,J,AbortSignal.any([G.signal,U.signal]));F=Y.every(1e4,()=>{U.send({type:"ping"}).catch(H)});let N=!1,T=Y.now()+(K.enrolled?0:_1)+i8+5000;while(!0){let M=N?35000:Math.max(1,T-Y.now()),L=n3.parse(n8(await U.receive(M,G.signal)));if(L.type==="running"){if(N||L.lifetime!==Z.lifetime||Date.parse(L.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");N=!0,(J.io??process).stdout.write(JSON.stringify(L)+`
-`)}if(L.type==="stopped"){if(!N)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(K){if(G.signal.aborted){F?.();try{await U.send({type:"stop"});let N=Y.now()+Z.shutdownGraceMs+1e4;while(Y.now()<N)if(n3.parse(n8(await U.receive(Math.max(1,N-Y.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(K instanceof Error&&K.message==="worker_ssh_connection_closed"){let N=q??await Promise.race([V.result,new Promise((T)=>setTimeout(T,100))]);if(N?.exitCode)throw Error(N.errorCode)}throw K}finally{F?.(),process.removeListener("SIGINT",H),process.removeListener("SIGTERM",H),J.signal?.removeEventListener("abort",H),V.close(),U.dispose()}}import{createConnection as FV}from"net";import{WebSocket as t8}from"ws";var qV=1,F2=65536,$7=4096,J7=67108864,Z7=4194304,N2=B.uuid(),UV=B.strictObject({kind:B.literal("install_only"),authorityId:N2,organizationId:N2,userId:N2,connectionId:N2,attemptId:N2,purpose:B.literal("install"),generation:B.number().int().positive(),transport:B.literal("reverse_ssh"),expiresAt:B.iso.datetime({offset:!0}),maxDurationMs:B.literal(300000),maxChannels:B.literal(1),allowTcpForwarding:B.literal(!1),allowPty:B.literal(!1)}),HV=B.string().max(2048).superRefine(($,J)=>{let Z;try{Z=new URL($)}catch{J.addIssue({code:"custom",message:"invalid relay url"});return}if(Z.protocol!=="ws:"&&Z.protocol!=="wss:"){J.addIssue({code:"custom",message:"invalid relay protocol"});return}if(Z.username||Z.password||Z.search||Z.hash){J.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let Q=Z.pathname.split("/");if(Q.length!==4||Q[1]!=="device"||!N2.safeParse(Q[2]).success||!/^[a-f0-9]{64}$/.test(Q[3]??""))J.addIssue({code:"custom",message:"invalid device relay path"});if(Z.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(Z.hostname))J.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var NV=B.strictObject({protocol:B.literal(qV),type:B.literal("ssh_install_relay"),authorityToken:B.string().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:UV,relayUrl:HV,endpoint:B.strictObject({host:B.literal("127.0.0.1"),port:B.literal(22)})});function x4($,J=Date.now()){let Z=NV.parse($),Q=Date.parse(Z.authority.expiresAt);if(!Number.isFinite(Q)||Q<=J)throw Error("ssh_install_relay_expired");if(Q>J+Z.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return Z}function Q7($){let J=JSON.stringify($);if(Buffer.byteLength(J)>F2)throw Error("ssh_install_relay_frame_too_large");return J}function X7($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("ssh_install_relay_control_invalid");let J=$;if(J.type==="ssh_install_relay_receipt")return{type:J.type,receipt:x4(J.receipt)};if(J.type==="ssh_install_relay_ready"&&typeof J.authorityId==="string")return{type:J.type,authorityId:J.authorityId};throw Error("ssh_install_relay_control_invalid")}var Y7="ssh_install_relay_closed";function TV($){if(typeof $==="string")return Buffer.byteLength($,"utf8");if(Buffer.isBuffer($))return $.length;if($ instanceof ArrayBuffer)return $.byteLength;if(ArrayBuffer.isView($))return $.byteLength;return Number.POSITIVE_INFINITY}function MV($){if(Buffer.isBuffer($))return $;if($ instanceof ArrayBuffer)return Buffer.from($);if(ArrayBuffer.isView($))return Buffer.from($.buffer,$.byteOffset,$.byteLength);return null}function LV($,J=Y7){try{$.close(1000,J)}catch{$.terminate()}}async function jV($){let J=$.now??(()=>Date.now()),Z=x4($.receipt,J()),X=($.createWebSocket??((A)=>new t8(A,{followRedirects:!1,perMessageDeflate:!1,maxPayload:F2})))(Z.relayUrl),Y=$.connectLocal??(()=>FV({host:"127.0.0.1",port:22})),V,U=!1,G=!1,H=0,F=0,q,K=(A)=>{if(q)clearTimeout(q);q=setTimeout(()=>M("ssh_install_relay_expired"),Math.max(1,A)),q.unref?.()},N,T=new Promise((A)=>{N=A}),M=(A=Y7)=>{if(G)return;if(G=!0,q)clearTimeout(q);if($.signal?.removeEventListener("abort",L),V?.destroy(),X.readyState===t8.OPEN)LV(X,A);else if(X.readyState!==t8.CLOSED)X.terminate();N()},L=()=>M("ssh_install_relay_aborted"),D=()=>M("ssh_install_relay_protocol_error"),_=(A)=>{return H+=1,F+=A,A<=F2&&H<=$7&&F<=J7},j=(A)=>{if(G||!U||X.readyState!==t8.OPEN||X.bufferedAmount>Z7||!_(A.length)){D();return}X.send(A,{binary:!0},(I)=>{if(I)D()})};X.on("open",()=>{if(G)return;try{let A=Q7({type:"ssh_install_relay_receipt",receipt:Z});X.send(A,{binary:!1},(I)=>{if(I)D()})}catch{D()}}),X.on("message",(A,I)=>{if(G)return;let x=TV(A);if(x>F2||!_(x))return D();if(!U){if(I)return D();try{let W=X7(JSON.parse(String(A)));if(W.type!=="ssh_install_relay_ready"||W.authorityId!==Z.authority.authorityId)return D();U=!0,K(Z.authority.maxDurationMs),V=Y(),V.setNoDelay(!0),V.on("data",j),V.on("error",D),V.on("close",()=>M("ssh_install_relay_peer_closed")),V.on("drain",()=>X._socket?.resume()),V.on("connect",()=>{})}catch{D()}return}if(!I)return D();let P=MV(A);if(!P||!V||V.destroyed||!V.write(P))X._socket?.pause()}),X.on("error",D),X.on("close",()=>M("ssh_install_relay_peer_closed"));let z=Math.max(1,Math.min(Z.authority.maxDurationMs,Date.parse(Z.authority.expiresAt)-J()));if(K(z),$.signal?.addEventListener("abort",L,{once:!0}),$.signal?.aborted)L();return{receipt:Z,closed:T,close:()=>M()}}async function V7($=process.stdin){let J=[],Z=0;for await(let Q of $){let X=Buffer.isBuffer(Q)?Q:Buffer.from(Q);if(Z+=X.length,Z>F2)return 1;J.push(X)}try{let Q=JSON.parse(Buffer.concat(J).toString("utf8"));return await(await jV({receipt:Q})).closed,0}catch{return 1}}import{randomBytes as WV}from"crypto";var a$="ARA_WORKER_PREVIEW_PROBE";async function K7(){if(typeof Bun>"u")return 1;let $=WV(32).toString("base64url"),J,Z=new Promise((V)=>{J=V}),Q=setTimeout(()=>J(1),5000),X=()=>J(0);process.stdin.once("end",X),process.stdin.resume();let Y=Bun.serve({hostname:"127.0.0.1",port:0,fetch(V,U){let G=new URL(V.url).pathname;if(V.method!=="GET")return new Response(null,{status:405});if(G==="/readiness")return new Response(a$);if((G==="/readiness-ws"||G===`/device/readiness/${$}`)&&U.upgrade(V,{data:{relay:G.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(V,U){if(typeof U!=="string"||U.length>8192){V.close();return}if(!V.data.relay){if(U===a$)V.send(a$);else V.close();return}try{let G=G7(U),H=(F)=>V.send(JSON.stringify(F));if(G.type==="hello")H(G),H({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(G.type==="head"&&G.id==="http"&&G.status===200)H({type:"credit",id:"http"});else if(G.type==="data"&&G.id==="http"){if(V.data.http+=Buffer.from(G.data,"base64").toString(),V.data.http.length>a$.length)throw Error("probe_overflow");H({type:"credit",id:"http"})}else if(G.type==="end"&&G.id==="http"&&V.data.http===a$)H({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(G.type==="ws"&&G.id==="ws")H({type:"data",id:"ws",data:Buffer.from(a$).toString("base64"),binary:!1});else if(G.type==="data"&&G.id==="ws"&&!G.binary&&Buffer.from(G.data,"base64").toString()===a$&&!V.data.reported)V.data.reported=!0,process.stdout.write(`ready
-`);else throw Error("probe_protocol_failed")}catch{V.close(),J(1)}}}});try{return process.stdout.write(JSON.stringify({port:Y.port,token:$})+`
-`),await Z}finally{clearTimeout(Q),Y.stop(!0),process.stdin.removeListener("end",X),process.stdin.pause()}}import{closeSync as zV,createReadStream as OV,fstatSync as AV,readFileSync as PV}from"fs";var B7="/run/sc/instance-generation";var DV=/^[1-9][0-9]{0,15}\n?$/;function _V($){return typeof $==="number"&&Number.isSafeInteger($)&&$>0}function q7($){if(typeof $!=="string"||!DV.test($))return null;let J=Number($.trim());return _V(J)?J:null}var U7=3,RV=600000,IV=65536,CV=500;function H7($){if($.length!==3||$[0]!=="standby"||$[1]!=="--handoff-fd"||$[2]!==String(U7))throw Error("worker_standby_invalid_invocation");return{handoffFd:U7}}function xV($=(J)=>PV(J,"utf8")){try{return q7($(B7))}catch{return null}}function EV($){let J;try{J=JSON.parse($)}catch{throw Error("worker_standby_handoff_invalid")}if(!J||typeof J!=="object"||Array.isArray(J))throw Error("worker_standby_handoff_invalid");let Z=Object.keys(J).sort();if(Z.length!==2||Z[0]!=="config"||Z[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let Q=J,X=J0.safeParse(Q.config),Y=D1.safeParse(Q.enrollment);if(!X.success||!Y.success)throw Error("worker_standby_handoff_invalid");if(X.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:X.data,enrollment:Y.data}}var N7={isPipe:($)=>AV($).isFIFO(),stream:($)=>{let J=OV("",{fd:$,autoClose:!0,highWaterMark:16384});return{chunks:J,close:()=>J.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:($,J)=>{let Z=setInterval(J,$);return Z.unref?.(),()=>clearInterval(Z)}};async function SV($,J=N7){if(!J.isPipe($.fd)){try{zV($.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let Z=J.now()+($.armMs??RV),Q=J.stream($.fd),X=null,Y=()=>{},V=new Promise((G,H)=>{Y=(F)=>{X??=F,H(F)}});V.catch(()=>{});let U=J.every(CV,()=>{if(J.parentPid()!==$.parentPid)Y(Error("worker_standby_parent_changed"));else if(J.now()>=Z)Y(Error("worker_standby_arm_expired"))});try{let G=(async()=>{let F=[],q=0;for await(let K of Q.chunks){if(X)throw X;if(q===0)$.onArriving?.();if(q+=K.length,q>IV)throw Error("worker_standby_handoff_too_large");F.push(K)}return Buffer.concat(F).toString("utf8")})(),H=await Promise.race([G,V]);if(J.parentPid()!==$.parentPid)throw Error("worker_standby_parent_changed");return H}finally{U(),Q.close()}}async function F7($,J=N7){let Z=$.readGeneration??(()=>xV()),Q=J.parentPid(),X=Z();if(X===null)throw Error("worker_standby_no_instance_generation");$.onBooted?.();let Y=await SV({fd:$.fd,parentPid:Q,armMs:$.armMs,onArriving:$.onArriving},J);if(Z()!==X)throw Error("worker_standby_generation_changed");return EV(Y)}var bV=`Usage: reason worker <command> --config PATH [--json]
-
-  enroll                        Obtain/redeem a ticket using the current Reason login
-  start                         Run the existing Device daemon in the foreground
-  status                        Read enrollment and live local control state
-  doctor                        Read local prerequisites; never enroll or repair
-  drain                         Persist withdrawal of new claims; keep current work
-  resume                        Explicitly clear persistent drain
-  stop                          Drain, then cancel at shutdownGraceMs (ephemeral: ends its Device)
-  revoke                        Revoke an offline Device and remove its local key
-  attach                        Start this same worker over verified system SSH
-
-Config: version 1; apiOrigin, channel, stateDirectory, workspaceRoot, lifetime
-(persistent|ephemeral); executionMode defaults confined (host is explicit consent);
-slots (Sessions at once, 1-4) defaults 1 and a Machine worker runs one;
-shutdownGraceMs defaults 30000. Paths must be absolute and canonical.
-Config and enrollment files must be owned by the current user with mode 0600.
-Enroll: --enrollment-file PATH redeems a platform-provided ticket instead.
-Enroll: --credential-file PATH selects a protected Reason credentials JSON file
-(including credentialKind: api_key). Credentials never belong in argv or worker state.
-The current login needs devices:write; enrollment never opens a browser or starts work.
-Ephemeral: start keeps its proof key only in this process. It redeems
---enrollment-file PATH, or else obtains a ticket with the current login.
-Its Device ends when the process exits; every start enrolls a new Device.
-Use lifetime persistent to stop and start the same Device.
-Simple setup: \`reason serve NAME\` writes this config and enrolls for you.
-State is isolated under stateDirectory/headless-<channel>, never Desktop identity.
-Persistent keys: a new identity's is a non-extractable login Keychain key on a Mac
-where the CLI can create one there, otherwise an extractable owner-only file.
-proxy {version 1, url, caFile?} carries enrollment, control, Hands and desktop relay
-traffic (not yet previews or kept terminals); proxy environment variables stay refused.
-No service is installed, no update is performed, and no desktop/VNC is enabled.
-SSH: attach --ssh ALIAS --ssh-config PATH --remote-cli /absolute/path/reason
-  --artifact-sha256 HASH --config PATH --foreground [--credential-file PATH]
-The config describes remote paths. An existing, SHA-256-pinned CLI is required.
-SSH config must be protected (0600); it explicitly owns IdentityFile and host trust.
-ProxyJump/ProxyCommand are unsupported; configure a directly reachable alias.
-Pretrust known_hosts. No agent forwarding, automatic installation or detached service.
-SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
-are not forwarded/supported; running is not a browser-readiness receipt.
-Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function wV($){let[J,...Z]=$;if(!J||J==="help"||J==="--help"||J==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(J))throw Error("worker_unknown_command");let Q,X,Y,V=!1;for(let U=0;U<Z.length;U++){let G=Z[U];if(G==="--json"&&!V){V=!0;continue}if(G!=="--config"&&G!=="--enrollment-file"&&G!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let H=Z[++U];if(!H||H.startsWith("--"))throw Error("worker_missing_flag_value");if(G==="--config"&&!Q)Q=H;else if(G==="--enrollment-file"&&!X&&["enroll","start"].includes(J))X=H;else if(G==="--credential-file"&&!Y&&J==="enroll")Y=H;else throw Error("worker_unknown_or_duplicate_flag")}if(!Q)throw Error("worker_required_input_missing");if(Y&&X)throw Error("worker_enrollment_inputs_conflict");return{action:J,configPath:Q,enrollmentPath:X,credentialPath:Y,json:V}}var yV=1e4,kV=2000,T7=15000,hV=50;async function j7($,J,Z,Q,X,Y){let V=new i2,U=new AbortController,G,H,F=new Promise((P,W)=>{G=P,H=W});if(F.catch(()=>{}),g0(),$.executionMode==="host")s2();Z("enrollment_started");let q=X(V);q.catch(()=>{});let K=null,N=A8($,J,(P)=>{if(!K)throw Error("worker_starting");return K(P)});N.catch(()=>{}),Z("readiness_started");let T=new AbortController,M,L=AbortSignal.any([U.signal,T.signal,...Q.signal?[Q.signal]:[]]),D=Y?.matches($)?Y.result:void 0;if(Y&&!D)await Y.stop();if(D)L.addEventListener("abort",()=>void Y.stop(),{once:!0});let _,j=new Promise((P)=>{_=P}),z=setTimeout(()=>_(),yV);L.addEventListener("abort",()=>_(),{once:!0});let A,I=(P)=>{if(P==="ready")A=setTimeout(()=>_(),kV);Q.onStartup?.(P)},x=h2($,Q.readinessProbes,L,F,void 0,D,j);x.final.catch(()=>{});try{let P;try{P=await q}catch(W){throw U.abort(),H(Error("worker_enrollment_failed")),await x.final.catch(()=>{}),await N.then((O)=>O(),()=>{}),W}Z("enrollment_completed"),M=setTimeout(()=>T.abort(),Math.max(1,Math.min(T7,Date.parse(P.worker?.expiresAt??"")-Date.now()||T7))),G(P.roots[0].permissions),I0($,{version:1,drained:!1,revoked:!1}),await a2($,P,V,J,{...Q,onStartup:I,prestartedReadiness:x,prestartedControl:{closed:N,handle:(W)=>{K=W}},deferOptionalLanes:!0})}finally{clearTimeout(M),clearTimeout(z),clearTimeout(A),U.abort(),V.deleteBinding(),V.deleteKey(),await N.then((P)=>P(),()=>{})}}async function fV($,J,Z,Q){let{handoffFd:X}=H7($);if(T2(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((J.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let Y,V,U=()=>{let N=Z.readinessProbes?Z.readinessProbes.boundPty:(T)=>y2(T);if(G||!N)return;try{g0(),s2()}catch{return}if(Y=m9(N),!Z.readinessProbes)setImmediate(()=>{if(G)return;try{y8()}catch{}})},G=!1,H=()=>{G=!0,clearTimeout(V),(Y?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",H),process.once("SIGINT",H);let F;try{F=await(J.receiveStandbyHandoff??F7)({fd:X,onBooted:()=>{Q("standby_booted"),V=setTimeout(U,hV)},onArriving:()=>clearTimeout(V)})}catch(N){clearTimeout(V);let T=N instanceof Error&&/^worker_standby_[a-z_]+$/.test(N.message)?N.message:"worker_standby_failed";return(J.io??process).stderr.write(`Reason worker: ${T}.
-`),await Y?.stop(),(J.exitProcess??((M)=>process.exit(M)))(1),1}finally{clearTimeout(V),process.off("SIGTERM",H),process.off("SIGINT",H)}if(G)return 0;Q("handoff_received");let{config:q,enrollment:K}=F;try{e(u(q),!0);let N=await W7(q,()=>{});try{if(Q("lock_acquired"),o(q))throw Error("worker_ephemeral_requires_fresh_enrollment");return H$(q),await j7(q,N.owner.nonce,Q,Z,(T)=>J$(q,K,T,J.enroll),Y),0}finally{N.release()}}finally{await Y?.stop()}}async function M$($,J={}){let Z=J.io??process,Q=!1,X=!1,Y=new Map,V=(G)=>{Y.set(G,performance.now()),Z.stderr.write(JSON.stringify({event:"worker.startup",stage:G,pid:process.pid,timestamp:new Date().toISOString()})+`
-`),J.onStartup?.(G)},U={...J,onStartup:V,onDeviceRevoked:()=>{X=!0,J.onDeviceRevoked?.()},startupTiming:()=>{let G=(N)=>Math.min(e$,Math.max(0,Math.round(N))),H=Y.get("readiness_started"),F=Y.get("readiness_completed"),q=Y.get("handoff_received")??0,K=Object.fromEntries(L7.flatMap((N)=>{let T=Y.get(N);return T===void 0?[]:[[N,G(T-q)]]}));return{service_start_to_heartbeat_ms:G(performance.now()-q),stage_ms:K,...H!==void 0&&F!==void 0?{readiness_ms:G(F-H)}:{}}},onEvent:(G)=>{if(G.type==="error"&&G.diagnostic){Q=!0;let H=G.diagnostic;Z.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:H.stage,category:H.category,httpStatus:H.category==="http"?H.httpStatus:void 0})+`
-`)}J.onEvent?.(G)}};try{if($[0]==="__preview-probe"){if($.length!==1||T2(J.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await K7()}if($[0]==="attach"||$[0]==="__ssh-bootstrap"||$[0]==="__ssh-reverse"){if(T2(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if($[0]==="attach")return await e3($.slice(1),J);if($.length!==1)throw Error("worker_unknown_or_duplicate_flag");if($[0]==="__ssh-reverse")return await V7();return await i3(J)}if($[0]==="__update-restart"){let N=$.length===4&&$[3]==="--changed";if($[1]!=="--config"||!$[2]||$.length!==3&&!N)throw Error("worker_unknown_or_duplicate_flag");if(T2(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");let T=J0.parse(JSON.parse(i($[2]))),M=await P8(T,N?void 0:r);return Z.stdout.write(JSON.stringify(M)+`
-`),M.state==="current"?3:M.state==="busy"?75:0}if($[0]==="standby")return await fV($,J,U,V);let G=wV($);if(!G)return Z.stdout.write(bV),0;if(T2(J.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux","win32"].includes(process.platform))throw Error("worker_platform_unsupported");let H=J0.parse(JSON.parse(i(G.configPath))),F=(N)=>Z.stdout.write(JSON.stringify(N)+`
-`),q=o(H);if(G.action==="status"||G.action==="doctor"){let N=await B0(H,"status"),T=$0(H),M={enrolled:!!q||!!N,deviceId:q?.deviceId??N?.deviceId??null,lifetime:H.lifetime,expired:q||N?Date.parse(q?.worker?.expiresAt??N.expiresAt)<=Date.now():null,drained:T.drained,revoked:T.revoked,live:N};if(G.action==="status")return F(M),0;let L=!0;try{H$(H)}catch{L=!1}return F({...M,workspace:L,platform:process.platform,executionMode:H.executionMode,proofStorage:H.lifetime==="ephemeral"?"process-memory":q&&T0(H)instanceof o$?"login-keychain":"owner-only-file",confinement:H.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:N?.supportedOperations?"live-worker":"unavailable",reportedOperations:N?.supportedOperations??null,capabilityReadiness:N?.capabilityReadiness??null,ready:N?.executionEligible===!0&&!M.expired}),L&&(q||N)&&!M.revoked&&!M.expired?0:1}if(["drain","resume","stop"].includes(G.action)){let N=G.action==="drain"?"drain":G.action==="resume"?"resume":"stop",T=await B0(H,N);if(T){if(F(T),N==="stop"&&H.lifetime==="ephemeral"&&!G.json)Z.stderr.write(mV);return 0}}e(u(H),!0);let K=await W7(H,()=>{if(!G.json)Z.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(G.action==="start")V("lock_acquired");let N=o(H);if(["drain","resume","stop"].includes(G.action)){if(!N)throw Error("worker_not_enrolled");let T=$0(H);if(T.revoked||Date.parse(N.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(G.action!=="stop")I0(H,{...T,drained:G.action==="drain"});return F({running:!1,drained:G.action==="stop"?T.drained:G.action==="drain"}),0}if(G.action==="enroll"){if(H.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let T=G.enrollmentPath,M=!T&&$0(H).revoked;if(N&&!M)throw Error("worker_already_enrolled");H$(H);let L=()=>{k0(H),N5(H)};if(M)L();let D=async()=>{let z=K8(H),A=T?await z1(H,T,z,J.enroll):await M7(H,G.credentialPath,J,z);return{proof:z,enrolled:A}},{proof:_,enrolled:j}=await D().catch((z)=>{if(T||!(z instanceof $$)||!z.deviceRemoved)throw z;return L(),D()});return f0(j,p(H).state,{proofStore:_}),I0(H,{version:1,drained:!1,revoked:!1}),F({enrolled:!0,deviceId:j.deviceId,lifetime:H.lifetime}),0}if(G.action==="revoke"){if(!N)throw Error("worker_not_enrolled");let T=T0(H),M=new l2(P$(H.apiOrigin),w0(H.proxy),T);if(I0(H,{version:1,drained:!0,revoked:!0}),J.revoke)await J.revoke(N,M);else await M.disconnect(N,AbortSignal.timeout(30000));return k0(H),F({revoked:!0,localKeyRemoved:!0}),0}if(H$(H),H.lifetime==="ephemeral"){if(N)throw Error("worker_ephemeral_requires_fresh_enrollment");await j7(H,K.owner.nonce,V,U,async(T)=>G.enrollmentPath?z1(H,G.enrollmentPath,T,J.enroll):M7(H,void 0,J,T,"worker_ephemeral_enrollment_required"))}else{if(G.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!N)throw Error("worker_not_enrolled");if($0(H).revoked)X=!0;await a2(H,N,T0(H),K.owner.nonce,U)}return 0}finally{K.release()}}catch(G){let H=G instanceof Error&&(G.message==="worker_revoked"||!Q&&/^worker_[a-z_]+$/.test(G.message))?G.message:"worker_command_failed";Z.stderr.write(`Reason worker: ${H}.
-`);let F=$.includes("--json")?void 0:Q2(G instanceof $$&&G.deviceRemoved?"worker_enrollment_device_removed":H);if(F)Z.stderr.write(`${F}
-`);return H==="worker_revoked"&&X?0:1}}var vV=60000;async function W7($,J){let Z=Date.now()+$.shutdownGraceMs+vV,Q=!1;for(;;){let X=Z$({path:p($).lock,runtimeVersion:r});if(X.acquired)return X;let Y=await B0($,"status").catch(()=>null);if(!(Y?Y.phase==="stopping":Q)||Date.now()>=Z)throw Error("worker_already_running_or_lifecycle_busy");if(!Q)Q=!0,J();await new Promise((U)=>setTimeout(U,250))}}var mV='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function M7($,J,Z,Q,X="worker_session_login_required"){if(Z.enrollmentInput&&!J){let G=performance.now();return J$($,await Z.enrollmentInput($),Q,Z.enroll,G)}let Y=J??z$($),V=await(Z.enrollmentCredentials??O$)($,Y);if(!V)throw Error(X);let U=Z.createTicketClient?.(V)??new C$(V,{credentialsPath:Y,fetchImpl:w0($.proxy)});return H5($,V,U,Q,Z.enroll)}import{spawn as gV}from"child_process";import{readFileSync as uV,unlinkSync as dV}from"fs";import{join as pV}from"path";var lV=120,cV=15,sV=5000;function r8($={}){let J=$.stateDirectory?pV($.stateDirectory,aV):null;if(J)iV(J);let Z=V2();if(!Z)return null;let Q=process.platform==="win32",X=Math.max(1,Math.floor($.limitSeconds??lV)),Y=$.pid??process.pid,V=Math.min(cV,X),U=J?`printf '%s %s %s\\n' "$(date +%s)" ${X+V} ${D7(r)} > ${D7(J)} 2>/dev/null
-`:"",G=(T)=>`[ $((SECONDS - started)) -ge ${Math.max(1,T-1)} ]`,H=Q?":":`[ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${Y}" ]`,F=Q?`"$SYSTEMROOT/System32/taskkill.exe" /PID ${Y} /F >/dev/null`:`kill -KILL ${Y}`,q=`parent_is_worker() { ${H}; }
-while :; do started=$SECONDS
-IFS= read -r -t ${X} pulse && continue
-${G(X)} && parent_is_worker || exit 0
-started=$SECONDS
-IFS= read -r -t ${V} pulse && continue
-if ${G(V)} && parent_is_worker; then
-  echo "Reason: worker_event_loop_stalled; no progress for ${X+V}s, restarting the worker." >&2
-  ${U}${F}
-fi
-exit 0
-done`,K=gV(Z,["-c",q],{stdio:["pipe","ignore","inherit"],windowsHide:!0,...Q?{env:{...process.env,MSYS_NO_PATHCONV:"1"}}:{}});K.on("error",()=>{}),K.stdin.on("error",()=>{});let N=setInterval(()=>K.stdin.write(`
-`),Math.min(sV,X*1000/4));return N.unref(),K.unref(),{stop(){clearInterval(N),K.stdin.end()}}}var aV="worker-stalled";function D7($){return`'${$.replaceAll("'","'\\''")}'`}function iV($){let J;try{J=uV($,"utf8"),dV($)}catch{return}let Z=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(J);if(!Z)return;try{c2(a8(),{event:"worker.previous_exit",runtime_version:Z[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(Z[2])*1000)},{now:()=>new Date(Number(Z[1])*1000)})}catch{}}var $G=`Share this computer as a machine
-
-Usage:
-  reason serve                     This computer, signed in (machine name: its hostname)
-  reason serve --token rmt_\u2026       Any server, no login: the token names the machine
-  reason serve NAME [--dir PATH] [--once] [--sandbox] [--yes]
-  reason serve [NAME | --token rmt_\u2026] [--dir PATH] --service
-  reason serve NAME --stop [--json]  (same as: reason stop NAME)
-
-Adds this computer as a worker of a machine and waits for sessions. Start one
-from anywhere with: reason "fix the flaky test" --on NAME
-(To run one session here yourself, run \`reason "PROMPT"\` in the folder; it
-needs no machine and serves only while that command runs.)
-Sessions queue on the machine until one of its workers is free. Run
-\`reason serve\` on more computers, or in more folders, to add workers.
-
-Signed in, the machine is created if it doesn't exist (owners and admins).
-Without a login, use a token from \`reason machines token NAME\`: --token, or
-REASON_TOKEN. The token is used once to join and is never saved. Reconnect
-later with \`reason serve NAME\` or the same command. Press Ctrl-C to stop.
-
-With --service (macOS and Linux), this computer joins in the foreground, then
-keeps the worker running in the background: it starts again at login (Linux:
-at boot, when user lingering is allowed) and restarts if it fails. The service
-runs \`reason serve NAME --dir PATH\` with this worker's saved identity; the
-token is never saved. \`reason stop NAME\` stops and removes it.
-
-Options:
-  --dir PATH   Folder sessions work in (default: the current directory)
-  --once       Keep the worker only while this command runs; nothing is saved
-  --sandbox    Run confined. Sandboxed machines can't host sessions yet.
-  --yes        Accept the first-run confirmation (required without a terminal;
-               a token already carries it)
-  --service    Keep this worker running as a background service (see above)
-  --stop       Stop this computer's running workers for NAME and remove
-               their background services. They stay in Reason and can
-               start again; \`reason disconnect NAME\` removes them.
-
-Sessions run commands in the folder with the permissions of the user who runs
-the worker unless --sandbox is set. Settings live in
-~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
-folder served for NAME is its own worker. Use
-\`reason worker status|revoke --config <that file>\` for advanced control.
-`,JG=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,ZG=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,P7="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",_7=["REASON_TOKEN","REASON_MACHINE_TOKEN"],R7="my-computer";function w4($){let J=($.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return J&&C2(J)&&J!==D8?J:R7}class Y0 extends Error{}function QG($,J){let Z,Q=new Map,X=new Set;for(let H=0;H<$.length;H+=1){let F=$[H];if(F==="--help"||F==="-h"||F==="help")return null;if(F==="--dir"||F==="--token"||F==="--org"){let q=$[H+1];if(!q||q.startsWith("-"))throw new Y0(`Missing value after ${F}.`);if(Q.has(F))throw new Y0(`${F} may be specified only once.`);Q.set(F,q),H+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(F)){X.add(F==="-y"?"--yes":F);continue}if(F.startsWith("-"))throw new Y0(`Unknown option: ${F}. Run \`reason serve --help\`.`);if(Z!==void 0)throw new Y0("Expected one machine NAME.");Z=F}let Y=X.has("--stop");if(Z===void 0&&Y)throw new Y0("Missing machine NAME. Usage: reason stop NAME");if(Z!==void 0){if(!C2(Z)&&!JG.test(Z))throw new Y0(P7);if(Z.toLowerCase()===D8)throw new Y0(`"${D8}" is reserved for Reason's cloud. Choose another NAME.`)}if(Y&&(Q.size>0||[...X].some((H)=>H!=="--stop"&&H!=="--json")))throw new Y0("--stop takes only NAME and --json.");if(!Y&&X.has("--json"))throw new Y0("--json is only used with --stop.");if(X.has("--service")&&X.has("--once"))throw new Y0("--service keeps the worker running; it cannot be combined with --once.");let V=Y?void 0:Q.get("--token")??J,U=Q.get("--org");if(V!==void 0){if(!V.startsWith("rmt_"))throw new Y0("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(U!==void 0&&!ZG.test(U))throw new Y0("--org must be a workspace id.")}else if(U!==void 0)throw new Y0("--org is only used with --token.");let G=Q.get("--dir");return{...Z===void 0?{}:{name:Z},...G===void 0?{}:{dir:G},once:X.has("--once"),sandbox:X.has("--sandbox"),yes:X.has("--yes"),stop:Y,json:X.has("--json"),service:X.has("--service"),...V===void 0?{}:{token:V},...U===void 0?{}:{org:U.toLowerCase()}}}function J1($,J){let Z=eV($,J??"."),Q;try{Q=process.platform==="win32"?b4.native(Z):b4(Z)}catch{throw new Y0(`Folder not found: ${Z}`)}if(!rV(Q).isDirectory())throw new Y0(`Not a folder: ${Q}`);return Q}var o8=($)=>i$($,".reason","workers"),E4=($)=>d(p($).state);function XG($,J,Z){let Q=i$(o8($),J);if(P0(i$(Q,"worker.json"))?.workspaceRoot===Z)return Q;return i$(o8($),`${J}@${nV("sha256").update(Z).digest("hex").slice(0,8)}`)}function I7($){let{stateDirectory:J}=$;if(o2($.workspaceRoot,J)||o2(J,$.workspaceRoot))throw new Y0(`${$.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return J0.parse({version:1,apiOrigin:$.apiOrigin,channel:$.channel,stateDirectory:J,workspaceRoot:$.workspaceRoot,lifetime:$.once?"ephemeral":"persistent",executionMode:$.sandbox?"confined":"host",name:$.name})}function P0($){if(!d($))return null;let J=new Y0(`${$} is not a valid worker config. Remove it to start over.`),Z;try{Z=JSON.parse(i($))}catch(X){if(X instanceof SyntaxError)throw J;throw X}let Q=J0.safeParse(Z);if(!Q.success)throw J;return Q.data}function S4($){return[`--dir ${$.workspaceRoot}`,...$.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function YG($,J){$.stdout.write(`${J} [y/N] `);let Z=await z7($.stdin,new AbortController().signal);return/^(y|yes)$/i.test(Z?.trim()??"")}function Z1($){return{write(J){if(J.startsWith('{"event":"worker.startup"'))return!0;return $.write(J)}}}var VG={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function C7($){try{return await $()}catch(J){let Z=J instanceof m0?VG[J.code]:void 0;throw Z?Error(Z):J}}async function GG($,J,Z,Q){let X=I7({...J,name:$.name??R7,stateDirectory:i$(o8(Z),".token-enrollment")}),Y=A$(X,{stored:!1}),V=await C7(()=>O7({apiOrigin:X.apiOrigin,token:$.token,body:Y.request,...Q.fetchImpl?{fetchImpl:Q.fetchImpl}:{}}));if(!C2(V.machine_name))throw Error("worker_ticket_receipt_mismatch");if($.name!==void 0&&$.name.toLowerCase()!==V.machine_name.toLowerCase())throw new Y0(`This token is for machine "${V.machine_name}", not "${$.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if($.org!==void 0&&$.org!==V.organization_id.toLowerCase())throw new Y0(`This token is for workspace ${V.organization_id}, not ${$.org}. Drop --org; the token names its workspace.`);let U=!1;return{name:$.name??V.machine_name,input:(G)=>{if(U)throw Error("worker_ticket_receipt_mismatch");return U=!0,Y.saveInstall(G),Y.complete(V.organization_id,V)}}}function KG($,J,Z,Q){return async(X)=>{if(J)return J.input(X);let Y=await(Z.worker?.enrollmentCredentials??O$)(X);if(!Y)throw Error("worker_session_login_required");let V=(Z.createApi??((U)=>new C$(U)))(Y);return U5(X,Y,{createHeadlessDeviceEnrollmentTicket:(U)=>C7(async()=>{try{return await V.createMachineEnrollmentTicket($,U)}catch(G){if(!(G instanceof m0)||G.code!=="machine_not_found")throw G}try{await V.createMachine({name:$}),Q.stdout.write(`Created machine "${$}".
-`)}catch(G){if(!(G instanceof m0)||G.status!==409)throw G}return V.createMachineEnrollmentTicket($,U)})})}}async function x7($,J,Z,Q){let X=await P8($,Q,()=>A7($,J,Z));if(X.state==="current"||X.state==="busy")return X;if(!G$($,J,Z))return null;return w1($),X}function y4($,J){let Z=o8($);if(!d(Z))return[];let Q=J.toLowerCase();return tV(Z).sort().flatMap((X)=>{let Y=X.toLowerCase();if(Y!==Q&&!Y.startsWith(`${Q}@`))return[];let V=i$(Z,X,"worker.json"),U=P0(V);return U?[{path:V,config:U}]:[]})}async function BG($,J,Z,Q,X){let Y=y4(J,$.name);if(Y.length===0)throw new Y0(`No worker for machine "${$.name}" on this computer.`);let V=Q.controlWorker??B0,U=[];for(let G of Y){let H=await V(G.config,"stop")!==null,F=$1(G.config,X),q=H||F!==null;if(U.push({config:G.path,folder:G.config.workspaceRoot,running:q,service:F?.label??null}),!$.json&&F)Z.stdout.write(`Removed background service ${F.label} (${G.config.workspaceRoot}); it won't start again.
-`);if(!$.json)Z.stdout.write(q?`Stopping machine "${$.name}" in ${G.config.workspaceRoot}; current work finishes first.
-`:`Machine "${$.name}" in ${G.config.workspaceRoot} is not running.
-`)}if($.json)Z.stdout.write(`${JSON.stringify({machine:$.name,workers:U})}
-`);return 0}async function E7($,J={}){let Z=J.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},Q=J.runWorker??M$,X=J.env??process.env,Y=_7.map((V)=>X[V]?.trim()).find(Boolean)||void 0;if(!J.env)for(let V of _7)delete process.env[V];try{let V=QG($,Y);if(!V)return Z.stdout.write($G),0;let U=b4(J.home??U0()),G=J.serviceHost??V$(U);if(V.stop)return await BG({...V,name:V.name},U,Z,J,G);let H=J.channel??Y$(),F=J1(J.cwd??process.cwd(),V.dir),q=V.service?M2(G,X):void 0,K={channel:H,apiOrigin:e2(X,H),workspaceRoot:F,once:V.once,sandbox:V.sandbox},N=V.token?await GG({...V,token:V.token},K,U,J):void 0,T=N?.name??V.name??w4((J.hostname??oV)()),M=XG(U,T,F),L=i$(M,"worker.json"),D=P0(L);if(N&&D&&E4(D)&&$0(D).revoked)k0(D);let _=!N&&D!==null&&E4(D)&&(!p2(X,"REASON_API_URL")?.trim()||C0(K.apiOrigin,D.apiOrigin))?D.apiOrigin:void 0,j=I7({...K,..._?{apiOrigin:_}:{},name:T,stateDirectory:M}),z=D!==null&&E4(D);if(z&&q0(D)!==q0(j)){if(j.lifetime==="ephemeral")throw new Y0(`Machine "${T}" is already saved for this folder; --once needs another folder or NAME.`);throw new Y0(`Machine "${T}" is already set up with different settings (${D.workspaceRoot}, ${D.executionMode==="host"?"your user permissions":"sandboxed"}).
-Run it with: reason serve ${T} ${S4(D)}
-Or remove it first: reason worker revoke --config ${L}`)}let A=j.lifetime==="persistent"?L2(j,G):null;if(A&&!V.service&&X[s$]!==A.label)return Z.stdout.write(`Machine "${T}" in ${F} already runs as a background service (${A.label}).
-  Logs: ${A.logs}
-  Stop it with: reason stop ${T}
-`),0;if(V.service&&z&&!A&&await(J.controlWorker??B0)(j,"status")!==null)throw new Y0(`Machine "${T}" is already running in ${F}. Stop it first (Ctrl-C, or reason stop ${T}), then run this again.`);let I=j.lifetime==="ephemeral"||!z;if(I&&!C2(T))throw new Y0(P7);if(j.executionMode==="confined")Z.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
-`);else if(I&&!V.yes&&!N){let W=`Sessions on "${T}" will run commands in ${F} with your user permissions (no sandbox). Continue?`,O=Boolean(Z.stdin&&Z.stdinIsTty);if(!J.confirm&&!O)throw new Y0(`${W.replace(/ Continue\?$/,"")}
-Re-run with --yes to confirm.`);if(!await(J.confirm??((y)=>YG(Z,y)))(W))return Z.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!z)e(j.stateDirectory,!0),a(L,j);let x={...J.worker,enrollmentInput:KG(T,N,J,Z)};if(j.lifetime==="persistent"&&!z){Z.stdout.write(`Adding this computer to machine "${T}"\u2026
-`);let O=await Q(["enroll","--config",L],{...x,io:{stdout:{write:()=>!0},stderr:Z.stderr}});if(O!==0)return O}if(q){let W;try{W=e8({config:j,launcher:q,path:X.PATH||"/usr/local/bin:/usr/bin:/bin",host:G})}catch(O){if(!(O instanceof x$))throw O;throw new Y0(`${O.message}
-This computer is added to machine "${T}". Run it in this terminal with: reason serve ${T} ${S4(j)}
-Or try the background service again with: reason serve ${T} ${S4(j)} --service`)}return Z.stdout.write([`Reason machine "${T}" runs in the background`,`  Folder:   ${F}`,`  Mode:     ${j.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${W.label} (starts at ${W.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${W.logs}`,`Start a session with: reason "\u2026" --on ${T}`,`Stop it with: reason stop ${T}`,...W.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
-`)),0}Z.stdout.write([`Reason machine "${T}"`,`  Folder:   ${F}`,`  Mode:     ${j.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Lifetime: ${j.lifetime==="persistent"?`saved; run \`reason serve ${T}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
-`));let P=A&&X[s$]===A.label&&!J.runWorker?r8({stateDirectory:j.stateDirectory}):null;try{return await Q(["start","--config",L],{...x,io:{stdout:Z.stdout,stderr:Z1(Z.stderr)},onStartup:(W)=>{if(W==="ready")Z.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${T}
-`);J.worker?.onStartup?.(W)}})}finally{P?.stop()}}catch(V){if(V instanceof Y0||V instanceof x$){let H=V instanceof x$&&V.code?` (${V.code})`:"";return Z.stderr.write(`Reason: ${V.message}${H}
-`),2}let U=V instanceof Error&&/^worker_[a-z_]+$/.test(V.message)?V.message:null,G=U?Q2(U):void 0;return Z.stderr.write(`Reason: ${U?G?`${G} (${U})`:U:"could not prepare this machine."}
-`),1}}var qG=200;var TL=B.strictObject({version:B.literal(1),session_ids:B.array(B.string().min(1).max(200)).max(qG)});function j2($){let J=o($);return J!==null&&Date.parse(J.worker?.expiresAt??"")>Date.now()&&!$0($).revoked}import{spawnSync as S7}from"child_process";import{readFileSync as UG,rmdirSync as HG,rmSync as NG}from"fs";import{join as k4}from"path";var FG=["Reason.app","Ara Sidecar.app","Ara Device.app"],TG="sidecar_retire_failed";function MG($){return k4($,"Library","Application Support","Ara","Sidecar")}function LG($){try{let J=UG(k4($,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(J)}catch{return!1}}function w7($,J={}){let Z=MG($),Q=FG.map((U)=>k4(Z,U)).filter(LG);if(Q.length===0)return{status:"absent"};let X=J.processTable??(()=>S7("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),Y=J.signal??((U)=>process.kill(U,"SIGTERM")),V=J.command??((U,G)=>S7(U,[...G],{stdio:"ignore",timeout:1e4}).status??1);try{for(let U of X().split(`
-`)){let G=U.trim().match(/^(\d+)\s+(.+)$/);if(!G)continue;if(!Q.some((H)=>G[2].startsWith(`${H}/Contents/MacOS/`)))continue;try{Y(Number(G[1]))}catch{}}for(let U of Q)V(b7,["-u",U]),NG(U,{recursive:!0,force:!0});try{HG(Z)}catch{}}catch{return{status:"failed",code:TG}}return{status:"removed",bundles:Q}}var PG=`Connect this computer to Reason
-
-Usage:
-  reason connect                 Your computer, kept connected in the background
-  reason connect --to NAME       Add it to team machine NAME (as reason serve NAME --service)
-  reason connect --token rmt_\u2026   Join a machine with no login (as reason serve --token \u2026 --service)
-  reason connect --once          Only while this command runs; nothing is saved
-  reason connect --api-key KEY   Without reason login: a headless box, with an API key that has
-                                 devices:write (or set REASON_API_KEY, which keeps it out of ps).
-                                 The connection keeps the key to renew itself (macOS: Keychain).
-  reason disconnect [NAME]       Stop and remove it (NAME: this computer's workers for machine NAME);
-                                 it stays disconnected until you run reason connect
-
-Settings, saved; run reason connect again to change them:
-  --folder PATH                  Where Sessions may run (yours: your home folder; a machine: the current folder)
-  --sessions N                   No longer needed: your computer runs every Session you start
-  --name NAME                    This computer's name in Reason (default: its hostname)
-  --api-url URL                  The Reason API to connect to (as REASON_API_URL)
-  --proxy URL                    Reach Reason through this proxy (HTTPS_PROXY is not used)
-  --proxy-ca-file PATH           The proxy's PEM CA bundle
-  --user-chrome on|off           Your Sessions may use your own Chrome and its signed-in profiles
-                                 (macOS, through the Reason extension; on by default)
-  --cloud-sessions on|off        No longer needed: Reason does not read it
-  --minimal                      Keep this computer minimal: files, shell and terminal, no desktop,
-                                 computer use or browser use (reason desktop install adds them)
-  --local-logins on|off          Your Sessions run on the Claude Code, Codex and Grok logins
-                                 on this computer (on by default; off with an API key).
-                                 Reason gets each login's current access token, never
-                                 its refresh token.
-
-  --keep-awake on|off            macOS: keep this Mac awake while it runs Sessions (default on).
-                                 Applies at once, without reconnecting.
-  --add-folder PATH              Let Sessions run in another folder too, on the same computer in
-  --remove-folder PATH           Reason; or stop that. Applies at once; running Sessions in other
-                                 folders keep running. \`reason status --json\` lists the folders.
-
-Your computer is Personal: it needs no machine and no admin role, and only you
-start Sessions on it until you make it Team in Settings \u203A Computers. They run commands
-with your user permissions (there is no sandbox mode). It starts again at login (Linux:
-at boot, when lingering is allowed), restarts if it fails, and \`reason update\`
-restarts it on the new version. \`reason status\` shows it.
-
-It is connected in the workspace you signed in to. It is also connected, by
-itself, in up to 8 other workspaces you belong to, as each one's own computer,
-when this computer was signed in with the setup command Reason shows you (it
-ends in --pair CODE, a one-time code from your signed-in Reason) or by the
-Reason app, and was connected after that. Signed in with \`reason login\`
-alone, or connected with --api-key or --once, it stays in the one workspace:
-run the setup command from Reason here, then \`reason disconnect\` and
-\`reason connect\` if it was connected before. One sign-in covers one computer;
-a second computer needs its own. \`reason status\` says when this applies.
-
-One computer serves several Reason accounts. Signed in as another account than
-the one it is connected for, reason connect connects it for that account too,
-as that account's own computer in the workspace it signed in to; the other
-accounts stay connected. That account's \`reason logout\` removes only its own.
-`,RG=`Disconnect this computer from Reason
-
-Usage:
-  reason disconnect              Stop your computer's connection and remove it from Reason, in every
-                                 workspace and for every Reason account it is connected for. It stays
-                                 disconnected (reason "\u2026" won't connect it) until you run reason connect
-  reason disconnect NAME         Stop this computer's workers for machine NAME and remove them from Reason
-
-  --account                      Only the signed-in account's computer leaves Reason (all of it when it is
-                                 the only account here); it stays disconnected for that account until
-                                 its reason connect (the Reason app's Disconnect)
-  --temporary                    The Reason app's sign-out: only the signed-in account's computer leaves
-                                 Reason (all of it when it is the only account here), and it is not kept
-                                 disconnected: the next reason "\u2026" connects it again
-  --yes, -y                      Accepted for scripts; disconnect never asks
-`;class s extends Error{code;constructor($,J="worker_connect_refused"){super($);this.code=J}}var IG=4,Y1={write:()=>!0};function u0($,J,Z=!1){let Q=JZ($,J,Z);return Q.length===1?Q[0]:M0(g7(M0($,".config")),...$Z(J,Z))}var $Z=($,J)=>[...$==="production"?[]:[$],J?"connect-once":"connect"];function JZ($,J,Z=!1){let Q=$;try{Q=K$($)}catch{}return["ara","reason"].map((X)=>M0(Q,".config",X,...$Z(J,Z))).filter(CG)}function CG($){try{if(K$($)!==$)return!1;return P0(M0($,"worker.json"))?.stateDirectory===$}catch{return!1}}var ZZ="disconnected.json";function Yj($,J){return d(M0(u0($,J),ZZ))}function V1($,J,Z){let Q=M0(u0($,J),ZZ);if(!Z){W2(Q,{force:!0});return}e(d4(Q),!0),a(Q,{version:1,disconnected_at:new Date().toISOString()})}function xG($){let J=new Map,Z=new Set;for(let q=0;q<$.length;q+=1){let K=$[q];if(K==="--help"||K==="-h"||K==="help")return null;if(["--to","--token","--folder","--sessions",Q1,X1,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(K)){let N=$[q+1];if(!N||N.startsWith("-"))throw new s(`Missing value after ${K}.`);if(J.has(K))throw new s(`${K} may be specified only once.`);J.set(K,N),q+=1;continue}if(["--once","--yes","-y","--minimal"].includes(K)){Z.add(K==="-y"?"--yes":K);continue}if(K.startsWith("-"))throw new s(`Unknown option: ${K}. Run \`reason connect --help\`.`);throw new s(`Unexpected argument: ${K}. To add this computer to a team machine, use --to ${K}.`)}let Q=J.get("--sessions");if(Q!==void 0&&!/^[1-4]$/.test(Q))throw new s("--sessions takes a number from 1 to 4.");if(J.has(X1)&&!J.has(Q1))throw new s("--proxy-ca-file requires --proxy.");let X=J.get("--keep-awake");if(X!==void 0&&!["on","off"].includes(X))throw new s("--keep-awake takes on or off.");if(X!==void 0&&(J.size>1||[...Z].some((q)=>q!=="--yes")))throw new s("Run reason connect --keep-awake on|off on its own.");let Y=["--add-folder","--remove-folder"].filter((q)=>J.has(q));if(Y.length>0&&(J.size>1||[...Z].some((q)=>q!=="--yes")))throw new s(`Run reason connect ${Y[0]} PATH on its own.`);let V=J.get("--user-chrome");if(V!==void 0&&V!=="on"&&V!=="off")throw new s("--user-chrome takes on or off.");let U=J.get("--cloud-sessions");if(U!==void 0&&U!=="on"&&U!=="off")throw new s("--cloud-sessions takes on or off.");let G=J.get("--local-logins");if(G!==void 0&&G!=="on"&&G!=="off")throw new s("--local-logins takes on or off.");let H=J.get("--name")?.trim();if(H!==void 0&&(H.length===0||H.length>160))throw new s("--name takes a name of 1 to 160 characters.");let F=(q,K)=>K===void 0?{}:{[q]:K};return{...F("to",J.get("--to")),...F("token",J.get("--token")),...F("folder",J.get("--folder")),...F("sessions",Q===void 0?void 0:Number(Q)),...F("keepAwake",X===void 0?void 0:X==="on"),...F("userChrome",V===void 0?void 0:V==="on"),...F("cloudSessions",U===void 0?void 0:U==="on"),...F("localLogins",G===void 0?void 0:G==="on"),once:Z.has("--once"),yes:Z.has("--yes"),minimal:Z.has("--minimal"),...F("proxy",J.get(Q1)),...F("proxyCaFile",J.get(X1)),...F("apiKey",J.get("--api-key")),...F("name",H),...F("apiUrl",J.get("--api-url")),...F("addFolder",J.get("--add-folder")),...F("removeFolder",J.get("--remove-folder"))}}var E$=($)=>d(p($).state),QZ=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function XZ($){return $.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function YZ($){let{parsed:J,saved:Z}=$,Q=Z?.workspaceRoot??$.home;if(J.folder!==void 0)try{Q=J1($.options.cwd??process.cwd(),J.folder)}catch(U){throw new s(U instanceof Error?U.message:String(U))}if(!z2(Q,$.stateDirectory))throw new s(`${Q} holds Reason's own settings. Pick another folder with --folder.`);let X;try{X=J.apiUrl!==void 0?e2({REASON_API_URL:J.apiUrl},$.channel):Z&&!p2($.environment,"REASON_API_URL")?.trim()?Z.apiOrigin:e2($.environment,$.channel)}catch(U){throw new s(`${J.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${U instanceof Error?U.message:String(U)}`)}if(Z&&X!==Z.apiOrigin&&C0(X,Z.apiOrigin))X=Z.apiOrigin;if(!m7(X)&&!v7($.channel,X))throw new s(`${X} is not the ${$.channel} Reason API this CLI connects to.`+($.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let Y=Z?.proxy;if(J.proxy!==void 0)try{Y=c7({proxyUrl:J.proxy,caFile:J.proxyCaFile},{home:$.home,statePath:$.stateDirectory})}catch(U){if(!(U instanceof p7))throw U;throw new s(U.message)}let V=(Z?.folders??[]).filter((U)=>U!==Q);return J0.parse({...V.length?{folders:V}:{},version:1,apiOrigin:X,channel:$.channel,stateDirectory:$.stateDirectory,workspaceRoot:Q,lifetime:$.lifetime,executionMode:"host",name:J.name??Z?.name??w4(($.options.hostname??OG)()),slots:J.sessions??Z?.slots??IG,...Y?{proxy:Y}:{},...(J.userChrome??Z?.userChrome)===void 0?{}:{userChrome:J.userChrome??Z?.userChrome},...J.cloudSessions??Z?.cloudSessions?{cloudSessions:!0}:{},...(J.localLogins??Z?.localLogins)===void 0?{}:{localLogins:J.localLogins??Z?.localLogins}})}function VZ($,J){if($.localLogins!==void 0||J)return $;return J0.parse({...$,localLogins:!0})}async function p4($,J,Z,Q,X){if($0($).revoked){if(E$($))try{k0($)}catch{}I1($);let U=[];try{U=zG(u($))}catch{}for(let G of U)if(G!=="workspaces")W2(M0(u($),G),{recursive:!0,force:!0})}else if(E$($))k0($);e($.stateDirectory,!0),a(J,$);let Y=EG(Z.stderr),V=await(Q.runWorker??M$)(["enroll","--config",J],{...l4(Q.worker,X),io:{stdout:Y1,stderr:Y}});if(V!==0)Z.stderr.write(`Reason: this computer was not connected. (${Y.code()??"worker_command_failed"})
-`);return V}function EG($){let J=null;return{write:(Z)=>{for(let Q of Z.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))J=Q[1];return $.write(Z)},code:()=>J}}function $8($,J,Z){let Q=u7(B8(R2("REASON_CLI_CHANNEL",J),$));return Q&&C0(Q.apiOrigin,Z.apiOrigin)?Q.orgId.toLowerCase():null}async function SG($,J,Z,Q){let{config:X,configPath:Y}=H8($,J),V=(H)=>{try{return H!==null&&j2(H)&&o(H)?.orgId.toLowerCase()===J}catch{return!1}},U=null;try{U=P0(Y)}catch{}if(V(U))return 0;Z.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let G=await p4(X,Y,Z,Q,void 0);if(G===0&&V(X))return 0;if(G===0&&E$(X))await G1(X,Y,Z,Q);if(W2(X.stateDirectory,{recursive:!0,force:!0}),G!==0)return G;throw new s("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function l4($,J){return J?{...$,enrollmentCredentials:(Z)=>T1(Z,J)}:{...$}}async function c4($,J,Z,Q,X,Y="connect"){if(await s4($,Q,X,Y),Y==="connect"&&!await HZ($,Z,Q))return!1;if(!await G1($,J,Z,Q))return!1;return J5($.stateDirectory),W2($.stateDirectory,{recursive:!0,force:!0}),!0}async function G1($,J,Z,Q){if(!E$($)||$0($).revoked)return!0;for(let X=1;;X+=1){let Y=X===3;if(await(Q.runWorker??M$)(["revoke","--config",J],{...Q.worker,io:{stdout:Y1,stderr:Y?Z.stderr:Y1}})===0)return!0;if(Y)return!1;await new Promise((U)=>setTimeout(U,1000))}}async function s4($,J,Z,Q="connect",X=!1){let Y=J.controlWorker??B0,V=async()=>Y($,"status").catch(()=>null),U=await Y($,"stop").catch(()=>null)!==null,G=!X&&$1($,Z,Q);if(U||G){let H=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<H&&await V()!==null)await new Promise((F)=>setTimeout(F,250))}}function a4($,J){return J==="darwin"&&$.userChrome!==!1}function h4($,J,Z){let Q=[...a4($,J)?["your own Chrome profiles"]:[],...$.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${$.name}" \xB7 Sessions run here, ${XZ($).replace(/^runs /,"")}`,...Q.length>0?[`  Uses ${Q.join(" and ")} (reason connect --help to change)`]:[],...Z,""].join(`
-`)}function f4($,J,Z,Q){return[$,`  Name:      ${J.name}`,`  Folder:    ${J.workspaceRoot}`,...(J.folders??[]).map((X)=>`             ${X}`),"  Sessions:  every Session you start",`  Mode:      ${XZ(J)}`,...J.proxy?[`  Proxy:     ${l7(J.proxy)}`]:[],...a4(J,Z)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...J.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...J.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...Q,""].join(`
-`)}async function y7($,J,Z){let{io:Q,options:X}=Z;if(JZ(Z.home,Z.channel).length===2)Q.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:d4(J),timestamp:new Date().toISOString()})}
-`);let Y=j8(M0(Z.home,".config"));if(Y.problem)Q.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:Y.problem,timestamp:new Date().toISOString()})}
-`);z4(Z.home,Z.host.platform);let V=w5({home:Z.home,channel:Z.channel,saved:$,configPath:J,log:(N)=>Q.stderr.write(`${N}
-`),host:Z.host}),U=P5({...V,log:(N)=>Q.stderr.write(`${N}
-`)}),{configPath:G}=U,H=U.saved;if(!H)return Q.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let F=(N,T)=>{let M=B1(Z.home,Z.channel),L;try{let _=null;try{_=T.keep?null:o(H)?.orgId.toLowerCase()??null}catch{}if(L=F8(H,{prefer:$8(Z.home,Z.channel,H),...T}),L&&_)N8(L,_)}finally{M()}if(!L)return!1;H=L;let D="";try{D=` (workspace ${o(L)?.orgId??"unknown"})`}catch{}return Q.stderr.write(`Reason: ${N}; this computer goes on running Sessions for its other Reason account${D}.
-`),!0};if($0(H).revoked&&!F("this computer's connection was removed from Reason",{keep:!1}))return Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(H.executionMode==="confined"||!j2(H)){let N=p0(H.stateDirectory)??void 0,T=N?null:$8(Z.home,Z.channel,H);if(!N&&!(T&&I2(H,T)))F("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let q=H.executionMode==="confined";if(q||!j2(H)){let N=p0(H.stateDirectory)??void 0;if(Q.stderr.write(q?QZ:`Reason: this computer's connection expired; renewing it with ${N?"its API key":"your login"}\u2026
-`),await p4(J0.parse({...H,executionMode:"host"}),G,Q,X,N)!==0)return Q.stderr.write(N?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let K=new AbortController;if(!X.runWorker)import("./ask-relay-zpp0rkhg.js").then(({runBackgroundAskRelay:N})=>N(K.signal,(T)=>Q.stderr.write(`${T}
-`))).catch(()=>{});try{for(;;){let N=p0(H.stateDirectory)===null?{ownerWorkspaces:X.worker?.ownerWorkspaces??{}}:{},T=X.runWorker?null:r8({stateDirectory:H.stateDirectory}),M=!1,L;try{L=await(X.runWorker??M$)(["start","--config",G],{deferOptionalLanes:!0,...X.worker,...N,ownComputer:!0,io:{stdout:Q.stdout,stderr:Q.stderr},onDeviceRevoked:()=>{M=!0}})}finally{T?.stop()}if(!M)return L;if(!F("this computer's connection was removed from Reason",{keep:!1}))break}return V1(Z.home,Z.channel,!0),Q.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{K.abort()}}async function bG($,J,Z){let{io:Q,options:X,home:Y,channel:V,environment:U}=Z;if(J&&await(X.controlWorker??B0)(J,"status").catch(()=>null))throw new s("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=u0(Y,V,!0),H=YZ({parsed:$,saved:J,stateDirectory:G,lifetime:"ephemeral",home:Y,channel:V,options:X,environment:U}),F=VZ(H,Z.apiKey??(J?p0(J.stateDirectory)??void 0:void 0)),q=M0(G,"worker.json");return e(G,!0),a(q,F),Q.stdout.write(f4(`Reason: connecting "${F.name}" while this command runs`,F,Z.host.platform,["Connecting\u2026"])),(X.runWorker??M$)(["start","--config",q],{...l4(X.worker,Z.apiKey),ownComputer:!0,io:{stdout:Q.stdout,stderr:Z1(Q.stderr)},onStartup:(K)=>{if(K==="ready")Q.stdout.write(`Connected. Start Sessions on "${F.name}" from Reason. Press Ctrl-C to stop.
-`);X.worker?.onStartup?.(K)}})}function wG($,J,Z,Q){if(Z.platform!=="darwin")throw new s("--keep-awake is for macOS.");if(!J)throw new s("This computer is not connected to Reason. Run reason connect first.");e(u(J),!0),f5(p(J).daemon,$);let X=W8(p(J).daemon)==="battery_and_ac";return Q.stdout.write(`Keep awake: ${X?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var yG=B.object({root:B.object({id:B.string().min(1).max(160),label:B.string().max(160),path_fingerprint:B.string()})});async function GZ($,J,Z,Q){let X=await(l4(Q.worker,Z).enrollmentCredentials??O$)($,z$($));if(!X)throw Error("worker_session_login_required");if(!X.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Y=Q.folderApi?.(X)??new C$(X,{credentialsPath:z$($),fetchImpl:w0($.proxy)}),V=(U)=>U instanceof m0&&U.status===404&&!["device_not_found","root_not_found"].includes(U.code);return{add:async(U)=>{let G=F5($,U,{...J.roots[0].permissions,expose_mcp:!1}),H=await Y.addDeviceRoot(J.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((q)=>{if(V(q))throw Error("worker_folders_unavailable");if(q instanceof m0&&q.code==="root_limit_reached")throw new s("This computer already has the most folders Reason allows (32).");throw q}),F=yG.parse(H).root;if(F.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:F.id,label:F.label}},remove:async(U)=>{await Y.removeDeviceRoot(J.deviceId,U).catch((G)=>{if(V(G))throw Error("worker_folders_unavailable");if(!(G instanceof m0&&G.code==="root_not_found"))throw G})}}}function KZ($,J,Z){f0({...J,roots:Z,handsSlots:$.slots,worker:{...J.worker,configDigest:q0($)}},p($).state,{proofStore:T0($)})}async function BZ($,J,Z,Q){let{io:X,options:Y,host:V}=Q,U=J&&!Q.apiKey&&p0(J.stateDirectory)===null?$8(Q.home,Q.channel,J):null,G=J&&U&&E$(J)&&!I2(J,U)?h0(J).find((W)=>W.account&&W.organizationId===U)??null:void 0;if(G===null)throw new s("This computer is not connected for your account. Run reason connect first.");let H=G?G.config:J,F=G?G.configPath:Z,q=H&&E$(H)&&!$0(H).revoked?o(H):null;if(!J||!H||!q||H.lifetime!=="persistent")throw new s("This computer is not connected to Reason. Run reason connect first.");let K=$.addFolder!==void 0,N=K?$.addFolder:$.removeFolder,T=Y.cwd??process.cwd(),M;try{M=J1(T,N)}catch(W){if(K)throw new s(W instanceof Error?W.message:String(W));M=AG(T,N)}if(M===H.workspaceRoot)throw new s(`${M} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let L=H.folders??[],D=q.roots.slice(1).find((W)=>W.path===M);if(!K&&!D&&!L.includes(M))throw new s(`${M} is not one of this computer's folders.`);if(K&&!z2(M,H.stateDirectory))throw new s(`${M} holds Reason's own settings.`);if(K&&!D&&L.length>=31)throw new s("This computer already has the most folders Reason allows (32).");let _=Q.apiKey??p0(H.stateDirectory)??void 0,j=await GZ(H,q,_,Y),z=q.roots.filter((W)=>W.path!==M);if(K)z=[...z,await j.add(M)];else if(D)await j.remove(D.id);KZ(H,q,z);let A=K?[...L.filter((W)=>W!==M),M]:L.filter((W)=>W!==M),{folders:I,...x}=H;if(a(F,J0.parse({...x,...A.length?{folders:A}:{}})),!await(Y.controlWorker??B0)(J,"reload_roots").then(()=>!0,()=>!1))G$(J,V,"connect");return X.stdout.write(K?`Added ${M}. Sessions on "${H.name}" may run in it.
-`:`Removed ${M}. Sessions on "${H.name}" no longer run in it.
-`),0}async function Vj($,J,Z){let Q=v4(Z),X=B1(Q.home,Q.channel);try{let Y=M0(u0(Q.home,Q.channel),"worker.json");return await BZ({once:!1,yes:J,addFolder:$},P0(Y),Y,Q)===0}finally{X()}}function v4($,J){let Z=K$($.home??U0()),Q=$.env??process.env;return{io:$.io??K1(),options:$,home:Z,channel:$.channel??Y$(),environment:Q,apiKey:J??d7(Q),host:$.serviceHost??V$(Z)}}async function kG($,J,Z,Q){let X=o($),Y=X.roots;if(J.workspaceRoot!==$.workspaceRoot){let V=await GZ($,X,Z,Q),U=Y.find((G)=>G.path===J.workspaceRoot)??await V.add(J.workspaceRoot);await V.remove(Y[0].id),Y=[U,...Y.slice(1).filter((G)=>G.id!==U.id)]}KZ(J,X,Y)}var qZ=Symbol("serve here");async function hG($,J,Z,Q){let{io:X,options:Y,home:V,channel:U,environment:G,host:H}=Q;if(H.platform==="darwin"){let E=w7(V);if(E.status==="failed")X.stderr.write(`Reason: could not remove the retired Reason Device helper (${E.code}).
-`)}let F=J&&!Q.apiKey&&p0(J.stateDirectory)===null?$8(V,U,J):null,q=J&&F&&$0(J).revoked&&h0(J).some((E)=>E.account&&E.organizationId===F)?F8(J,{prefer:F,keep:!1})??J:J,K=YZ({parsed:$,saved:q,stateDirectory:u0(V,U),lifetime:"persistent",home:V,channel:U,options:Y,environment:G});if(V1(V,U,!1),q?.executionMode==="confined")X.stdout.write(QZ);let N=q?p0(q.stateDirectory):null,T=VZ(K,Q.apiKey??N??void 0),M=M2(H,G),L=q!==null&&E$(q),D=L&&q0(q)===q0(T),_=D&&j2(T),j=q?.userChrome!==!1===(T.userChrome!==!1)&&q?.cloudSessions===T.cloudSessions&&q?.localLogins===T.localLogins,z=Q.apiKey??N??void 0,A=F!==null&&L&&!$0(q).revoked&&!I2(q,F);if(A){if(!D||!j||JSON.stringify(q.proxy)!==JSON.stringify(T.proxy))throw new s("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let E=await SG(q,F,X,Y);if(E!==0)return E}let I=A?[`  Account:   yours too, in workspace ${F}, beside this computer's other Reason account`]:[],x=async()=>{if($.apiKey===void 0||$.apiKey===N)return;await T1(T,$.apiKey),F1(T.stateDirectory,$.apiKey)},P=G.PATH||"/usr/local/bin:/usr/bin:/bin",W=_&&JSON.stringify(q?.proxy)===JSON.stringify(T.proxy)&&j?L2(T,H,"connect"):null,O=W?.label===a7(T.channel),y=O?await(Y.controlWorker??B0)(T,"status").catch(()=>null):null,b=y!==null,w=O&&!b&&u4(W,H)&&t7({config:T,launcher:M,path:P,host:H,kind:"connect"}),l=y!==null&&(y.activeSessions??y.activeClaims)>0;if((b||w)&&(l||[null,r].includes(x2(T)))){await x();let E=n7(T,H,"connect");if(E==="retired"){let v=w?null:await(Y.controlWorker??B0)(T,"status").catch(()=>null);if(!w&&(!v||v.phase==="stopping"))G$(T,H,"connect")}else if(E==="current_not_running")G$(T,H,"connect");else if(H.platform==="win32"&&y&&(y.capabilityReadiness?.["exec.run"]===!1||y.supportedOperations?.includes("exec.run")===!1)&&dG())G$(T,H,"connect");return await(Y.controlWorker??B0)(T,"reload_roots").catch(()=>null),X.stdout.write(G.REASON_INSTALLER==="1"?h4(T,H.platform,I):f4("This computer is connected to Reason",T,H.platform,[...I,...w?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let k=!_&&!A;if(L&&!D)if(q.apiOrigin!==T.apiOrigin||q.name!==T.name){if(X.stdout.write(`Reconnecting this computer with its new settings\u2026
-`),!await c4(q,Z,X,Y,H))throw new s("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(q.executionMode==="host"&&j2(q))X.stdout.write(`Applying the new settings to this computer\u2026
-`),await kG(q,T,z,Y),k=!1;else await s4(q,Y,H);if(k){if(G.REASON_INSTALLER!=="1")X.stdout.write(`Connecting this computer to Reason\u2026
-`);let E=await p4(T,Z,X,Y,z);if(E!==0)return E;if(z)F1(T.stateDirectory,z)}else a(Z,T),await x();let C;try{C=e8({config:T,launcher:M,path:P,host:H,kind:"connect"})}catch(E){if(!(E instanceof x$))throw E;if(E.code!=="worker_service_manager_missing")throw new s(`${E.message}
-This computer is set up; run reason connect again to start it.`,E.code??"worker_service_start_failed");if(Y.serveHere&&G.REASON_INSTALLER!=="1")return X.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),qZ;if(Y.serveHere&&G.REASON_INSTALLER==="1"&&await fG(T,M,G,Y))return X.stdout.write(h4(T,H.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${M} connect under a process manager)`])),0;throw new x$(`${E.message}
-This computer is set up. Keep it connected by running ${M} connect in a terminal or under this box's process manager.`,E.code)}let S=[...I,...C.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...C.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${C.identityProblem}).`]:[]];return X.stdout.write(G.REASON_INSTALLER==="1"?h4(T,H.platform,S):f4("This computer is connected to Reason",T,H.platform,[`  Service:   ${C.label} (starts at ${C.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${C.logs}`,`Start Sessions on "${T.name}" from Reason. Remove it with: reason disconnect`,...S])),0}async function fG($,J,Z,Q){let{REASON_INSTALLER:X,...Y}=Z;(Q.startConnection??UZ)(J,Y,M0($.stateDirectory,"connect.log"));for(let V=0;V<60;V+=1)if(await new Promise((U)=>setTimeout(U,500)),await(Q.controlWorker??B0)($,"status").catch(()=>null))return!0;return!1}function UZ($,J,Z){let Q=e7(Z,"a",384);try{let X=r7($,["connect"],{detached:!0,stdio:["ignore",Q,Q],env:J});X.on("error",()=>{return}),X.unref()}finally{o7(Q)}}async function HZ($,J,Z,Q=!1){let X=!0;for(let Y of h0($)){if(Q&&Y.account)continue;if(Y.config&&E$(Y.config)&&!$0(Y.config).revoked){if(await(Z.runWorker??M$)(["revoke","--config",Y.configPath],{...Z.worker,io:{stdout:Y1,stderr:J.stderr}})!==0){X=!1;continue}}W2(Y.directory,{recursive:!0,force:!0})}return X}function K1(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function i4($,J){if($ instanceof s||$ instanceof x$)return J.stderr.write(`Reason: ${$.message} (${$.code??"worker_service_failed"})
-`),2;let Z=$ instanceof Error&&/^worker_[a-z_]+$/.test($.message)?$.message:gG($);return J.stderr.write(`Reason: ${Q2(Z)??"could not connect this computer."} (${Z})
-`),1}var vG=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]),mG=new Set(["ConnectionRefused","ConnectionClosed","FailedToOpenSocket","ECONNREFUSED","ECONNRESET","ENOTFOUND","EAI_AGAIN","ENETUNREACH","EHOSTUNREACH"]);function gG($){if($ instanceof m0)return $.status>=500?"worker_api_unavailable":"worker_api_refused";let J=$?.code;if(typeof J==="string"&&vG.has(J))return`worker_file_${J.toLowerCase()}`;if(typeof J==="string"&&mG.has(J))return"worker_api_unreachable";if(typeof J==="string"&&(/CERT|SSL|TLS/.test(J)||J==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"))return"worker_api_certificate_untrusted";if($ instanceof Error&&$.message.startsWith("Command failed"))return"worker_connect_command_failed";let Z=o4($);if(Z==="native_network")return"worker_api_unreachable";return/^native_[a-z_]+$/.test(Z)?`worker_connect_${Z.slice(7)}`:"worker_connect_unexpected"}function k7($,J){if($.minimal){FZ({home:J.home});return}if($.once||J.options.desktop===!1||!J.io.stdinIsTty||TZ({home:J.home})!=="install")return;let Z;try{Z=M2(J.host,J.environment)}catch{return}if(J.host.platform==="darwin"){let X=M0(J.home,".local","share","reason","desktop-install.log");(J.options.installDesktop??h7)(Z,J.environment,{log:X}),J.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${X}).
-`);return}J.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let Q=(J.options.installDesktop??h7)(Z,J.environment,null);if(Q!==0&&Q!==3)J.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function uG($){if($.host.platform!=="win32"||!$.io.stdinIsTty)return;m4();let J=g4();if(!DG(J)||k2(J))return;$.io.stdout.write(`Setting up the Windows sandbox for confined commands; approve the Windows prompt\u2026
-`);let Z=s7(J);if(Z!=="installed")$.io.stderr.write(`Reason: the Windows sandbox was not set up (${Z==="cancelled"?"prompt declined":"install failed"}); connecting without confined commands. Run reason connect again to retry. (windows_sandbox_unavailable)
-`)}function dG(){if(V2()===null)return!1;return m4(),k2(g4())}function h7($,J,Z){if(!Z){let X=()=>WG($,["desktop","install"],{env:J,stdio:"inherit"}).status??1,Y=X();return Y===3221225477?X():Y}_G(d4(Z.log),{recursive:!0,mode:448});let Q=e7(Z.log,"w",384);try{let X=r7($,["desktop","install"],{detached:!0,stdio:["ignore",Q,Q],env:{...J,REASON_DESKTOP_BACKGROUND:"1"}});X.on("error",()=>{return}),X.unref()}finally{o7(Q)}return 0}async function Gj($,J={}){let Z=J.io??K1();try{let Q=xG($);if(!Q)return Z.stdout.write(PG),0;if(Q.to!==void 0||Q.token!==void 0){if(Q.sessions!==void 0)throw new s("A machine's workers run one Session at a time; --sessions does not apply to them.");if(Q.proxy!==void 0)throw new s("--proxy is for your own computer; a machine's workers don't take it yet.");if(Q.userChrome!==void 0)throw new s("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(Q.cloudSessions!==void 0)throw new s("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(Q.localLogins!==void 0)throw new s("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[H,F]of[["--api-key",Q.apiKey],["--name",Q.name],["--api-url",Q.apiUrl]])if(F!==void 0)throw new s(`${H} is for your own computer; reason serve sets up a machine's workers.`);return k7(Q,v4(J)),await(J.runServe??E7)([...Q.to===void 0?[]:[Q.to],...Q.token===void 0?[]:["--token",Q.token],...Q.folder===void 0?[]:["--dir",Q.folder],...Q.yes?["--yes"]:[],Q.once?"--once":"--service"],{io:Z,...J.cwd?{cwd:J.cwd}:{},...J.home?{home:J.home}:{},...J.channel?{channel:J.channel}:{},...J.env?{env:J.env}:{},...J.serviceHost?{serviceHost:J.serviceHost}:{},...J.worker?{worker:J.worker}:{}})}let X=v4(J,Q.apiKey),{channel:Y,environment:V}=X;if(!J.env)for(let H of["REASON_API_KEY","ARA_API_KEY"])delete process.env[H];if(Q.userChrome&&X.host.platform!=="darwin")throw new s("--user-chrome is for a Mac.");let U=i7(V[s$],Y),G=U||Q.once?()=>{return}:B1(X.home,Y);try{let H=M0(u0(X.home,Y),"worker.json"),F=P0(H);if(U)return await y7(F,H,X);if(Q.keepAwake!==void 0)return wG(Q.keepAwake,F,X.host,Z);if(Q.addFolder!==void 0||Q.removeFolder!==void 0)return await BZ(Q,F,H,X);if(k7(Q,X),uG(X),Q.once)return await bG(Q,F,X);let q=await hG(Q,F,H,X);if(q!==qZ)return q;return G(),G=()=>{return},await y7(P0(H),H,X)}finally{G()}}catch(Q){return i4(Q,Z)}}async function Kj($,J={}){let Z=J.io??K1();try{if($.some((V)=>["--help","-h","help"].includes(V)))return Z.stdout.write(RG),0;let Q=$.filter((V)=>!["--yes","-y","--temporary","--account"].includes(V)),X=$.includes("--temporary"),Y=$.includes("--account");if(Q.length>1||Q[0]?.startsWith("-")||(X||Y)&&Q.length>0||X&&Y)throw new s("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(Q[0]!==void 0)return await cG(Q[0],Z,J);return await NZ(Z,J,X?"temporary":Y?"account":"disconnect")}catch(Q){return i4(Q,Z)}}async function Bj($={}){let J=$.io??K1();try{return await NZ(J,$,"logout")}catch(Z){return i4(Z,J)}}async function NZ($,J,Z){let Q=K$(J.home??U0()),X=J.channel??Y$(),Y=B1(Q,X);try{return await pG($,J,Z,Q,X)}finally{Y()}}function B1($,J){let Z=u0($,J),Q=d(Z)?J2():null;if(!Q)return()=>{return};for(let X=0;X<300;X+=1){let Y=Q.lock(Z);if(Y)return Y;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new s("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function pG($,J,Z,Q,X){let Y=M0(u0(Q,X),"worker.json"),V=P0(Y);if(!V){if(Z==="disconnect")V1(Q,X,!0);if(Z!=="logout")$.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(Z!=="disconnect"){let G=await lG(V,Y,$,J,Z,Q,X);if(G!==null)return G}let U=!1;try{U=await c4(V,Y,$,J,J.serviceHost??V$(Q))}finally{if(Z!=="temporary")V1(Q,X,!0)}if(!U)return $.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
-`),1;return $.stdout.write(`Disconnected "${V.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function lG($,J,Z,Q,X,Y,V){let U=h0($).filter((L)=>L.account);if(U.length===0)return null;let G=$8(Y,V,$),H=Q.controlWorker??B0,F=U.find((L)=>L.organizationId===G);if(F){if(F.config&&!await G1(F.config,F.configPath,Z,Q))return Z.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
-`),1;if(X!=="account"||!F.config)W2(F.directory,{recursive:!0,force:!0});return await H($,"reload_roots").catch(()=>null),Z.stdout.write(`Disconnected this computer from workspace ${G} for your account. It stays connected for its other Reason accounts.
-`),0}if(!G&&X==="account")throw new s("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!G||!I2($,G)){if(X==="account"&&G)N8($,G);if(X!=="logout")Z.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let q=Q.serviceHost??V$(Y),K=null;try{K=o($)?.orgId.toLowerCase()??null}catch{}if(await s4($,Q,q,"connect",!0),!await HZ($,Z,Q,!0)||!await G1($,J,Z,Q))return G$($,q,"connect"),Z.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
-`),1;let N=F8($,{prefer:null,keep:!1});if(!N)return null;if(X==="account"&&K)N8(N,K);let T=G$(N,q,"connect")!==null,M="";try{M=` in workspace ${o(N)?.orgId??""}`}catch{}return Z.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${M}${T?"":"; run reason connect to start it again"}.
-`),0}async function cG($,J,Z){let Q=K$(Z.home??U0()),X=Z.serviceHost??V$(Q),Y=y4(Q,$);if(Y.length===0)throw new s(`No worker for machine "${$}" on this computer.`);let V=!1;for(let U of Y)if(await c4(U.config,U.path,J,Z,X,"serve"))J.stdout.write(`Disconnected machine "${$}" in ${U.config.workspaceRoot}.
-`);else V=!0,J.stderr.write(`Reason: machine "${$}" in ${U.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${$} again.
-`);return V?1:0}async function qj($={}){let J=K$($.home??U0()),Z=P0(M0(u0(J,$.channel??Y$()),"worker.json"));if(!Z)return null;let Q,X=await($.controlWorker??B0)(Z,"status").catch((N)=>{return Q=N instanceof Error?N:Error(String(N)),null}),Y=X?x2(Z):null,V=$.serviceHost??V$(J),U=L2(Z,V,"connect"),G=$0(Z).revoked,H=!G&&!X,F=(()=>{try{return o(Z)}catch{return null}})(),{workspaces:q,off:K}=G||p0(Z.stateDirectory)!==null?{workspaces:null,off:null}:_5(Z,X?.phase==="running");return{workspaces:q,workspaces_off:K,workspaces_max:q8+(q?.filter((N)=>N.account).length??0),name:Z.name,device_id:F?.deviceId??null,organization_id:F?.orgId??null,folder:Z.workspaceRoot,mode:Z.executionMode,sessions_max:null,user_chrome:a4(Z,V.platform),cloud_sessions:Z.cloudSessions===!0,root:F?.roots[0]?{id:F.roots[0].id,permissions:F.roots[0].permissions}:null,roots:F?.roots.map((N)=>({id:N.id,folder:N.path,permissions:N.permissions}))??[],state:G?"removed":X?X.phase==="running"?"connected":X.phase:"not_running",not_running_reason:H?a5(Z,Q):null,worker_alive:H&&U?u4(U,V):null,sessions_running:X?.activeSessions??null,version:Y,service:U?{label:U.label,logs:U.logs}:null}}async function Uj($,J,Z=B0){let Q={version:1,status:"unavailable"},X=P0(M0(u0(K$($),J==="stable"?"production":"staging"),"worker.json")),Y=X?await Z(X,"status").catch(()=>null):null;return X&&Y?.phase==="running"?f7({version:1,status:"connected",deviceId:Y.deviceId,apiOrigin:X.apiOrigin,managedRootIds:[]})??Q:Q}function Hj($={}){try{let J=K$($.home??U0());return P0(M0(u0(J,$.channel??Y$()),"worker.json"))?.userChrome!==!1}catch{return!1}}function Nj($={}){let J=K$($.home??U0()),Z=P0(M0(u0(J,$.channel??Y$()),"worker.json"));if(!Z)return null;return G$(Z,$.serviceHost??V$(J),"connect")?.label??null}async function Fj($={}){let J=K$($.home??U0()),Z=P0(M0(u0(J,$.channel??Y$()),"worker.json"));if(!Z)return null;let Q=$.serviceHost??V$(J),X=await x7(Z,Q,"connect",$.current);if(X!==null||L2(Z,Q,"connect"))return X;return sG(Z,Q,$)}async function sG($,J,Z){let Q=Z.controlWorker??B0,X=await Q($,"status").catch(()=>null);if(!X)return null;if(Z.current!==void 0&&x2($)===Z.current)return{state:"current"};let Y=X.activeSessions??X.activeClaims;if(Y!==0)return{state:"busy",sessions:Y,waitedMs:0};let V;try{V=M2(J,Z.env??process.env)}catch{return null}await Q($,"stop").catch(()=>null);let U=Date.now()+$.shutdownGraceMs+60000;while(Date.now()<U&&await Q($,"status").catch(()=>null)!==null)await new Promise((q)=>setTimeout(q,250));let{REASON_INSTALLER:G,REASON_DESKTOP_BACKGROUND:H,...F}=Z.env??process.env;return(Z.startConnection??UZ)(V,F,M0($.stateDirectory,"connect.log")),{state:"restarted"}}
-export{p as h,o as i,W8 as j,P0 as k,PG as l,RG as m,u0 as n,Yj as o,Vj as p,Gj as q,Kj as r,Bj as s,qj as t,Uj as u,Hj as v,Nj as w,Fj as x};