@reason-machines/cli-linux-x64 0.2.561 → 0.2.563

package/bin/vm-hands/{vm-hands-entry-lite-y3nz20wb.js → vm-hands-entry-lite-frg1b1rg.js}

@@ -1,29 +1,29 @@
 // @bun
-import{P,xn}from"./vm-hands-entry-lite-2rgf8866.js";import{w,ye,W,En,kn,vr}from"./vm-hands-entry-lite-q9s1e2y1.js";import{Q,ve}from"./vm-hands-entry-lite-a7bf7xr7.js";import{ya,be,wa,C,eo,me}from"./vm-hands-entry-lite-ht6hzkgj.js";import{g}from"./vm-hands-entry-lite-bj3w2ven.js";import{lt,Un,ir}from"./vm-hands-entry-lite-7pfhwxn5.js";import{a,cn,jt,yi,ft,ln,fr,un,mr,Ht,ae,tt,wi,Ut}from"./vm-hands-entry-lite-pxtycfdv.js";import{Pr,ps,hs,pe,Us,tr,Mn}from"./vm-hands-entry-lite-71ebge0c.js";import{Lr}from"./vm-hands-entry-lite-57ajjwmh.js";import{Ea,k,or,sr,ee,ar,so,ao,Vr,ut,co,Gr,Kr,qn,Wn,uo,po,ho,Vn}from"./vm-hands-entry-lite-h7nk2848.js";import{Zn,Qn,K,La,$a,oe,x,p,_o,ge,se,D,Lt,Ze,Xr,yo,E,_e,qa,Wa,Va,ni,Yr,dt,Ga,$t,Zr,Pe,J,Ja,So,Eo,Xa,Qe}from"./vm-hands-entry-lite-vkhacd00.js";import{je}from"./vm-hands-entry-lite-weqam12f.js";import{cr,Ae,ka,Jr,xa,Aa}from"./vm-hands-entry-lite-52qz0n30.js";import{ne}from"./vm-hands-entry-lite-nn6zcvmp.js";import{le,Jt,T,pc,hc}from"./vm-hands-entry-lite-hn9pq7zj.js";import{Tn,In,Bi,Dc}from"./vm-hands-entry-lite-6jxshhps.js";import{wr,ue}from"./vm-hands-entry-lite-q9djb28r.js";import{Nt,ie,N,Qi}from"./vm-hands-entry-lite-gxpw14jv.js";import{Ti,ke,de,j,Ue,Jo,bn,Xo,ze,Ii,Di,Yo,vn,Ie,Zo,Sn}from"./vm-hands-entry-lite-m1we91g4.js";import{F}from"./vm-hands-entry-lite-jpvmkce5.js";import{U,H,R}from"./vm-hands-entry-lite-v4hr9x9h.js";import{Jn,Ra,Da,go,Yn}from"./vm-hands-entry-lite-5y4phfv1.js";import{ua}from"./vm-hands-entry-lite-z0ht62s4.js";import{fi}from"./vm-hands-entry-lite-hxfxs7r9.js";import{No}from"./vm-hands-entry-lite-z213y4pj.js";import{hr,To,Io,Do}from"./vm-hands-entry-lite-2dak7e1h.js";import{Zi}from"./vm-hands-entry-lite-ms99mzp0.js";import{di,ec}from"./vm-hands-entry-lite-0wb1n769.js";import{u,b,m,y}from"./vm-hands-entry-lite-yvws5zpx.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{De,yt,es,mc,gc,wt}from"./vm-hands-entry-lite-hs6sdn60.js";import{s,St}from"./vm-hands-entry-lite-zawytz09.js";import{Uc,Vi,I,t,V,Mr,o,_,Pt,d,n,h,A,nl,c,i,Gi}from"./vm-hands-entry-lite-k5ytpgzz.js";import{ha,Y,B}from"./vm-hands-entry-lite-8xv6c0rm.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{spawn as Du,spawnSync as Xw}from"child_process";import{closeSync as Mu,existsSync as Zw,mkdirSync as Qw,openSync as Tu,readdirSync as ey,realpathSync as nn,rmSync as ro}from"fs";import{hostname as ty}from"os";import{dirname as js,join as Bt,resolve as ry}from"path";var Go={ENOENT:"native_enoent",EACCES:"native_permission_denied",EPERM:"native_permission_denied",ETIMEDOUT:"native_timeout",ECONNREFUSED:"native_network",ECONNRESET:"native_network",ENOTFOUND:"native_network",EAI_AGAIN:"native_network",ENETUNREACH:"native_network",EHOSTUNREACH:"native_network",EPIPE:"native_pipe_closed",ENOSPC:"native_disk_full",EMFILE:"native_too_many_files",EBUSY:"native_busy",E2BIG:"native_args_too_large"};function oc(e){if(!(e instanceof Error))return e===void 0||e===null?"native_no_error":"native_non_error";let l=e.code;if(typeof l==="string"&&Go[l])return Go[l];let v=e.message;if(e.name==="TimeoutError"||e.name==="AbortError")return"native_timeout";if(/No handler registered for /.test(v))return"ipc_handler_missing";if(/could not be cloned/i.test(v))return"ipc_clone_failed";if(/Render frame was disposed|Object has been destroyed|WebContents was destroyed/i.test(v))return"ipc_window_closed";let O=/\b(E[A-Z0-9]{2,15})\b/.exec(v)?.[1];if(O&&Go[O])return Go[O];if(/timed? ?out|timeout/i.test(v))return"native_timeout";if(/fetch failed|failed to fetch|network|socket hang up|getaddrinfo/i.test(v))return"native_network";if(e.name==="TypeError"&&v==="Load failed")return"native_network";if(/unexpected token|is not valid JSON|JSON\.parse|Unexpected end of JSON/i.test(v))return"native_unreadable_output";if(/keychain|secitem|errSec/i.test(v))return"native_keychain_error";if(/Error invoking remote method/.test(v))return"ipc_remote_error";switch(e.name){case"TypeError":return"native_type_error";case"RangeError":return"native_range_error";case"SyntaxError":return"native_unreadable_output"}return"native_unexpected"}import{createHash as Gu}from"crypto";import{unlinkSync as Yu}from"fs";import{platform as Xu}from"os";import{join as Zu}from"path";var ic=A("store",[h({version:i(1),store:i("keychain")}),h({version:i(1),store:i("file"),api_key:t().min(1).max(4096)})]),fn=(e)=>Zu(e,"api-key.json");function jr(e){let l=Gu("sha256").update(`reason-connect-api-key
-${e}`).digest("hex");return new ft(cn(),Xu(),l)}function aa(e,l,v=jr(e)){try{v.deleteBinding(),v.createBinding(new TextEncoder().encode(l)),y(fn(e),{version:1,store:"keychain"});return}catch(O){if(!(O instanceof a))throw O}y(fn(e),{version:1,store:"file",api_key:l})}function lr(e,l=jr(e)){if(!u(fn(e)))return null;let v=ic.parse(JSON.parse(m(fn(e))));if(v.store==="file")return v.api_key;try{let O=l.loadBinding();return O?new TextDecoder().decode(O):null}catch(O){if(!(O instanceof a))throw O;throw Error("worker_api_key_unreadable")}}function ac(e,l=jr(e)){if(!u(fn(e)))return;if(ic.parse(JSON.parse(m(fn(e)))).store==="keychain")try{l.deleteBinding()}catch(v){if(!(v instanceof a))throw v}Yu(fn(e))}async function sa(e,l){let v;try{v=await ir({env:{REASON_API_KEY:l,REASON_API_URL:e.apiOrigin},fetchImpl:oe(e.proxy)})}catch(O){if(O instanceof C&&(O.status===401||O.status===403))throw Error("worker_api_key_rejected");throw O}if(!v)throw Error("worker_api_key_rejected");if(!v.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return v}import{readdirSync as yf,renameSync as _f,rmSync as mn}from"fs";import{join as Et}from"path";import{createHash as Qu}from"crypto";import{realpathSync as ef,statSync as tf,unlinkSync as Qo}from"fs";import{platform as rf}from"os";import{join as Xt}from"path";function f(e){return{state:Xt(p(e),"device.json"),control:Xt(p(e),"control.json"),lock:Xt(p(e),"lifecycle.lock"),socket:Xt(p(e),"control.sock"),daemon:Xt(p(e),"daemon.json"),releaseCheck:Xt(p(e),"release-check.json"),updateDeferral:Xt(p(e),"update-deferral.json"),firstHeartbeat:Xt(p(e),"first-heartbeat.json")}}var nf=n({version:i(1),device_id:t().min(1).max(160),offer:Pt().optional(),enrollment_ms:o().int().nonnegative().max(tr).optional()});function sc(e,l,v){b(p(e),!0),y(f(e).firstHeartbeat,{version:1,device_id:l,...v.offer?{offer:v.offer}:{},...v.enrollmentMs!==void 0?{enrollment_ms:v.enrollmentMs}:{}})}function ca(e,l){let v=f(e).firstHeartbeat;try{if(!u(v))return null;let O=nf.safeParse(JSON.parse(m(v)));if(Qo(v),!O.success||O.data.device_id!==l)return null;let M=Mn(O.data.offer);return{...M?{offer:M}:{},...O.data.enrollment_ms!==void 0?{enrollmentMs:O.data.enrollment_ms}:{}}}catch{return null}}function xt(e,l=!1){b(p(e),l);let v=["local-device.key","local-device.binding","device.json"].filter((O)=>{let M=Xt(p(e),O);if(!u(M))return!1;return m(M),!0});return e.lifetime==="persistent"&&v.join()==="device.json"?la(e):new ln(p(e))}function ei(e,l){xt(e,!0),sf(e);let v=l??la(e),O=new ln(p(e));try{v.deleteBinding(),v.deleteKey(),v.createFreshPublicKey()}catch(M){if(M instanceof a)return O;throw M}return O.deleteBinding(),O.deleteKey(),v}function la(e){return new ft(cn(),rf(),of(e))}function of(e){let l=da(e);return Qu("sha256").update(`reason-worker
-${l?.directory??p(e)}`).digest("hex")}function lo(e,l){y(Xt(p(e),fo),{version:1,directory:da(e)?.directory??p(e),devicePublicKey:l})}var fo="keychain-scope.json";function cc(e){return u(Xt(p(e),fo))}var af=h({version:i(1),directory:t().min(1),devicePublicKey:t().min(1)});function da(e){let l=Xt(p(e),fo);if(!u(l))return null;let v=af.safeParse(JSON.parse(m(l))),O=f(e).state;if(!v.success||!u(O))return null;return JSON.parse(m(O))?.devicePublicKey===v.data.devicePublicKey?v.data:null}function sf(e){let l=Xt(p(e),fo);if(!u(l))return;if(da(e))try{let v=la(e);v.deleteBinding(),v.deleteKey()}catch(v){if(!(v instanceof a))throw v}Qo(l)}function Dr(e){let l=ef(e.workspaceRoot);if(l!==e.workspaceRoot||!tf(l).isDirectory()||!ge(l,e.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function S(e){if(!u(p(e)))return null;let l=Ht(f(e).state,{proofStore:xt(e),repair:!1}),v=l!==null&&En(e.apiOrigin,l.apiOrigin),O=v?[D(e),D({...e,apiOrigin:l.apiOrigin})]:[D(e)];if(l&&(!O.includes(l.worker?.configDigest??"")||l.worker.lifetime!==e.lifetime||l.apiOrigin!==e.apiOrigin&&!v||l.roots.length>32||l.roots[0]?.path!==e.workspaceRoot||l.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return l}var lc=h({version:i(1),drained:_(),revoked:_()});function pt(e){let l=f(e).control;return u(l)?lc.parse(JSON.parse(m(l))):{version:1,drained:!1,revoked:!1}}function zt(e,l){y(f(e).control,lc.parse(l))}function Zt(e){let l=xt(e);l.deleteBinding(),l.deleteKey();let v=Xt(p(e),fo);if(u(v))Qo(v);let O=f(e).state;if(u(O))Qo(O)}var cf=h({read:_(),write:_(),execute:_(),discover_environment:_(),expose_mcp:i(!1)}),fa=h({version:i(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:cf,execution_mode:c(["confined","host"]).default("confined")}),folders:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),lf=n({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:i("p256"),protocol_version:i(2),roots:d(n({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:n({lifecycle:c(["persistent","ephemeral"]),expires_at:I.datetime({offset:!0})}),first_heartbeat:Pt().optional()}),ma=30000;class Er extends Error{deviceRemoved;constructor(e){super("worker_enrollment_rejected");this.deviceRemoved=e}}async function df(e,l,v=fetch){let O=await v(`${e}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(l),redirect:"error",signal:AbortSignal.timeout(ma)});if(!O.ok){let M=O.status===409?await O.json().catch(()=>null):null;throw new Er(M?.error==="device_revoked")}return O.json()}async function pa(e,l,v,O){ne();let M=fa.parse(JSON.parse(m(l)));return Cr(e,M,v,O)}async function Cr(e,l,v,O=(L,z)=>df(L,z,oe(e.proxy)),M=performance.now()){let L=uc(e,l,v),z=await O(e.apiOrigin,{...L.request,enrollment_ticket:l.enrollment_ticket,code_verifier:l.code_verifier});return L.receipt(z,M)}async function dc(e,l,v,O,M=performance.now()){let L=uc(e,l,v),z=await O(L.request,l.code_verifier);return z===null?null:L.receipt(z,M)}function uc(e,l,v){if(ne(),l.root.execution_mode!==e.executionMode)throw Error("worker_enrollment_mode_mismatch");let O=Ut([e.workspaceRoot],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(O.path!==e.workspaceRoot||O.pathFingerprint!==l.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let M=(e.folders??[]).map((G,ce)=>{let we=Ut([G],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(we.path!==G||we.pathFingerprint!==l.folders?.[ce]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return we});if((l.folders?.length??0)!==M.length)throw Error("worker_enrollment_root_mismatch");let L=[{...O,label:"workspace"},...M],z;try{z=v.loadPublicKey()}catch{z=v.createFreshPublicKey()}return{request:{device_public_key:z,name:e.name,os:process.platform,architecture:process.arch,reason_runtime_version:g,bridge_version:g,protocol_version:2,capabilities:{supported_operations:[]},roots:L.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:l.root.permissions}))},receipt(G,ce){let we=lf.parse(G);if(we.organization_id!==l.organization_id||we.roots.length!==L.length||we.roots.some((X,he)=>X.path_fingerprint!==L[he].pathFingerprint)||we.headless.lifecycle!==e.lifetime||Date.parse(we.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let te=Mn(we.first_heartbeat);try{sc(e,we.device_id,{...te?{offer:te}:{},enrollmentMs:Math.min(tr,Math.max(0,Math.round(performance.now()-ce)))})}catch{}return{version:4,apiOrigin:e.apiOrigin,orgId:we.organization_id,deviceId:we.device_id,devicePublicKey:z,displayName:e.name,registeredAt:new Date().toISOString(),handsSlots:e.slots,worker:{configDigest:D(e),lifetime:e.lifetime,expiresAt:we.headless.expires_at},roots:we.roots.map((X,he)=>({id:X.id,label:X.label,path:L[he].path,pathFingerprint:X.path_fingerprint,permissions:l.root.permissions}))}}}}import{randomBytes as uf,randomUUID as ff}from"crypto";import{unlinkSync as mf}from"fs";import{join as pf}from"path";var fc=h({version:i(1),install_id:V(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),hf=n({enrollment_ticket:t().min(1).max(4096),expires_at:I.datetime({offset:!0}),device_kind:i("headless"),lifecycle:c(["persistent","ephemeral"]),device_expires_at:I.datetime({offset:!0})});function ga(e){return hf.parse(e)}var gf=n({credentialKind:c(["oauth","api_key"]).optional(),apiOrigin:Mr(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:I.datetime({offset:!0}),scopes:d(t().max(128)).max(128),orgId:t().min(1).max(160)});function qr(e){return Q(xn("REASON_CLI_CHANNEL",e.channel),s())}async function zr(e,l=qr(e)){if(!u(l))return null;let v=gf.parse(JSON.parse(m(l)));if(!W(v.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(v.credentialKind==="api_key")return Date.parse(v.expiresAt)>Date.now()?v:null;let O=oe(e.proxy),M=Object.assign((z,re)=>O(z,{...re,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),L=await be({path:l,fetchImpl:M});if(L&&!W(L.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");return L}async function wc(e,l,v){if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let O=Qr(e);return O.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(O.request))}async function yc(e,l,v,O,M){let L=performance.now();if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let z=Qr(e),re=M?void 0:v.enrollHeadlessDevice?.bind(v);if(re){let G=await dc(e,z.direct(l.orgId),O,(ce,we)=>re({approval:z.request,code_verifier:we,registration:ce}).catch((te)=>{throw wf(te)}),L);if(G)return G}return Cr(e,z.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(z.request)),O,M,L)}function wf(e){if(!(e instanceof C))return e;if(e.status===409)return new Er(e.code==="device_revoked");if(e.status===410||e.status===401&&e.code==="invalid_enrollment_ticket"||e.status===403&&e.code==="grant_exceeded"||e.status===400&&e.code==="invalid_device_enrollment")return new Er(!1);return e}var mo=(e)=>pf(p(e),"enrollment-install.json");function _c(e){if(u(mo(e)))mf(mo(e))}function Qr(e,{stored:l=!0}={}){ne();let v=mo(e),O=l&&u(v)?fc.parse(JSON.parse(m(v))):{version:1,install_id:ff(),fingerprint_key:uf(32).toString("hex")};if(l&&!u(v))y(v,O);let M={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},L=Buffer.from(O.fingerprint_key,"hex"),z=Ut([e.workspaceRoot],M,L)[0];if(z.path!==e.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let re=(e.folders??[]).map((te)=>{let X=Ut([te],M,L)[0];if(X.path!==te)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:X.pathFingerprint}}),G=ya(),ce={install_id:O.install_id,code_challenge:G.challenge,lifecycle:e.lifetime,roots:[z.pathFingerprint,...re.map((te)=>te.path_fingerprint)].map((te)=>({path_fingerprint:te,permissions:M,execution_mode:e.executionMode}))},we=(te)=>({version:1,organization_id:te,code_verifier:G.verifier,root_fingerprint_key:O.fingerprint_key,root:{path_fingerprint:z.pathFingerprint,permissions:M,execution_mode:e.executionMode},...re.length?{folders:re}:{}});return{request:ce,saveInstall(te){b(p(te),!0),y(mo(te),O)},complete(te,X){let he=ga(X);if(he.lifecycle!==e.lifetime||Date.parse(he.expires_at)<=Date.now()||Date.parse(he.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...we(te),enrollment_ticket:he.enrollment_ticket}},direct:we}}function bc(e,l,v){let O=mo(e);if(!u(O))throw Error("worker_folders_unavailable");let M=fc.parse(JSON.parse(m(O)));return Ut([l],v,Buffer.from(M.fingerprint_key,"hex"))[0]}var ti=8,va=600000,Sc=15000,bf=3600000,kf=new Set(["device_not_eligible","sign_in_not_eligible"]),kc=new Set(["device_revoked","invalid_device_credential"]),ri=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,Tr=(e)=>Et(p(e),"workspaces"),Rc="account.json",_a=(e)=>u(Et(e,Rc));function Qt(e){let l;try{l=yf(Tr(e))}catch{return[]}return l.filter((v)=>ri.test(v)).sort().map((v)=>{let O=Et(Tr(e),v),M=Et(O,"worker.json"),L=null;try{let z=x.safeParse(JSON.parse(m(M)));if(z.success&&z.data.stateDirectory===O)L=z.data}catch{}return{organizationId:v,directory:O,configPath:M,config:L,account:_a(O)}})}function oi(e,l){let v=l.toLowerCase();if(!ri.test(v))throw Error("worker_workspace_id_invalid");let O=x.parse({...e,stateDirectory:Et(Tr(e),v)});return b(O.stateDirectory,!0),y(Et(O.stateDirectory,Rc),{version:1}),{config:O,configPath:Et(O.stateDirectory,"worker.json")}}function ii(e,l){try{let{config:v,configPath:O}=oi(e,l);b(p(v),!0),zt(v,{version:1,drained:!0,revoked:!0}),y(O,v)}catch{}}function wo(e,l){let v=l.toLowerCase(),O=null;try{O=S(e)?.orgId.toLowerCase()??null}catch{}return O===v||Qt(e).some((M)=>!M.account&&M.config!==null&&M.organizationId===v)}var ba=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function vc(e,l){let v=S(e);if(!v?.worker)throw Error("worker_identity_missing");lo(e,v.devicePublicKey),b(p(l),!0);for(let L of ba)mn(Et(p(l),L),{force:!0});for(let L of ba){let z=Et(p(e),L);if(u(z))_f(z,Et(p(l),L))}let O=xt(l),M=Ht(f(l).state,{proofStore:O,repair:!1});if(!M?.worker)throw Error("worker_identity_missing");ae({...M,worker:{...M.worker,configDigest:D(l)}},f(l).state,{proofStore:O})}function Sa(e){for(let l of Qt(e)){if(l.account)continue;try{if(l.config&&u(f(l.config).state))Zt(l.config)}catch{}mn(l.directory,{recursive:!0,force:!0})}mn(Ca(e),{force:!0})}function ai(e,{prefer:l,keep:v,live:O=!1}){let M=Date.now(),L=(te)=>Number(Date.parse(te.worker?.expiresAt??"")>M+60000),re=Qt(e).flatMap((te)=>{if(!te.account||!te.config)return[];try{if(pt(te.config).revoked)return[];let X=S(te.config);return X&&X.orgId.toLowerCase()===te.organizationId&&(!O||L(X))?[{...te,config:te.config,state:X}]:[]}catch{return[]}}).sort((te,X)=>Number(X.organizationId===l)-Number(te.organizationId===l)||L(X.state)-L(te.state))[0];if(!re)return null;let G=null;try{G=pt(e).revoked?null:S(e)}catch{}let ce=G?.orgId.toLowerCase()??"";if(v&&G&&ri.test(ce)&&ce!==re.organizationId){let te=oi(e,ce);vc(e,te.config),y(te.configPath,te.config)}else if(u(p(e))){try{if(u(f(e).state))Zt(e)}catch{}for(let te of ba)mn(Et(p(e),te),{force:!0})}Sa(e);let we=x.parse({...re.config,stateDirectory:e.stateDirectory});return vc(re.config,we),y(Et(e.stateDirectory,"worker.json"),we),mn(re.directory,{recursive:!0,force:!0}),we}var Pa={before(e){for(let{config:l}of Qt(e))try{let v=l?S(l):null;if(l&&v)lo(l,v.devicePublicKey)}catch{}},after(e,l){for(let{organizationId:v,directory:O,configPath:M,config:L}of Qt(l)){if(L)continue;try{let z=x.parse(JSON.parse(m(M)));if(z.stateDirectory!==Et(Tr(e),v))continue;let re=x.parse({...z,stateDirectory:O}),G=xt(re),ce=Ht(f(re).state,{proofStore:G,repair:!1});if(ce?.worker?.configDigest===D(z))ae({...ce,worker:{...ce.worker,configDigest:D(re)}},f(re).state,{proofStore:G});y(M,re)}catch{}}}},Ca=(e)=>Et(Tr(e),"listed.json");function Ec(e){try{let l=JSON.parse(m(Ca(e))),v=l.names&&typeof l.names==="object"&&!Array.isArray(l.names)?Object.fromEntries(Object.entries(l.names).filter((M)=>typeof M[1]==="string")):{},O=l.refused&&typeof l.refused==="object"?l.refused:null;return{listed:l.listed===!0,reason:l.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(l.blocked)?l.blocked.filter((M)=>typeof M==="string"):[],names:v,...O&&typeof O.device==="string"&&typeof O.roots==="string"&&typeof O.at==="number"&&Number.isFinite(O.at)&&typeof O.count==="number"&&Number.isInteger(O.count)&&O.count>=1?{refused:{device:O.device,roots:O.roots,at:O.at,count:O.count}}:{}}}catch{return null}}function Pc(e,l){let v=Qt(e),O=v.filter((G)=>G.account),M=v.filter((G)=>!G.account),L=Ec(e),z=L&&!L.listed?L.reason:null,re=z||M.length===0&&L&&!L.listed?[]:M;if(O.length===0&&re.length===0&&(z||L&&!L.listed))return{workspaces:null,off:z};return{off:z,workspaces:[...O,...re].map(({organizationId:G,config:ce,account:we})=>{let te=!1,X=null,he=!1,Se=null;try{te=ce?pt(ce).revoked:!1,X=ce&&!te?S(ce):null;let Re=ce?tt(f(ce).daemon):null;he=l&&!!X&&Re?.state==="connected",Se=he?un(Re,X):null}catch{}return{...Se?{permission_recovery:Se}:{},organization_id:G,device_id:X?.deviceId??null,name:L?.names?.[G]??null,root:X?.roots[0]?{id:X.roots[0].id,permissions:X.roots[0].permissions}:null,state:te?"removed":he?"connected":"not_running",blocked:!we&&!te&&!he&&(L?.blocked.includes(G)??!1),...we?{account:!0}:{}}})}}function Cc(e){let{config:l,state:v,client:O,signal:M}=e,L=e.log??(()=>{return}),z=e.intervalMs??va,re=new Map,G=null,ce=!1,we=Ec(l)??{listed:!1,reason:null,blocked:[]},te=()=>v.roots.map((Ne)=>Ne.id).join(","),X=(Ne)=>{if(!Ne||Ne.device!==v.deviceId||Ne.roots!==te())return!1;let xe=Date.now();return xe>=Ne.at&&xe<Ne.at+Math.min(bf,z*2**Math.min(Ne.count-1,10))},he=(Ne)=>{let{folders:xe,...Le}=l,Ge=v.roots.slice(1).map((Ve)=>Ve.path);return x.parse({...Le,...Ge.length?{folders:Ge}:{},stateDirectory:Et(Tr(l),Ne)})},Se=async(Ne)=>{let xe=re.get(Ne);if(!xe)return;xe.controller.abort(),await xe.done},Re=(Ne,xe=!1)=>{let Le=new AbortController,Ge=()=>Le.abort();if(M.addEventListener("abort",Ge,{once:!0}),M.aborted)Le.abort();let Ve={...Ne,controller:Le,claims:0,done:Promise.resolve(),account:xe};Ve.done=e.serve(Ne,Le.signal,(Je)=>{Ve.claims=Je}).then(()=>{return},(Je)=>{if(xe&&Je instanceof k&&Je.status===401&&kc.has(Je.code)){try{zt(Ne.config,{version:1,drained:!0,revoked:!0})}catch{}L(`Reason worker: workspace ${Ne.organizationId} (another account's) no longer accepts this computer (${Je.code}); run \`reason connect\` signed in as that account to connect it again
-`)}else if(Je instanceof k&&Je.status===401&&kc.has(Je.code)){try{Zt(Ne.config)}catch{}L(`Reason worker: workspace ${Ne.organizationId} no longer accepts this computer
+import{R,Pn}from"./vm-hands-entry-lite-z65xva21.js";import{w,ye,W,Cn,An,Cr}from"./vm-hands-entry-lite-33at6g06.js";import{Q,ve}from"./vm-hands-entry-lite-2qfmabqn.js";import{Ca,be,Aa,C,no,me}from"./vm-hands-entry-lite-0jy8mv4a.js";import{g}from"./vm-hands-entry-lite-1w39j6vz.js";import{ut,Wn,ir}from"./vm-hands-entry-lite-d431ffz0.js";import{a,hn,Ht,vi,mt,fn,fr,mn,mr,Ut,ae,rt,Si,zt}from"./vm-hands-entry-lite-xfak34av.js";import{Nr,vs,Ss,pe,Xs,tr,jn}from"./vm-hands-entry-lite-fxptf351.js";import{Hr}from"./vm-hands-entry-lite-gxf2r5en.js";import{Ia,k,or,sr,ee,ar,lo,uo,Zr,dt,po,Qr,en,Gn,Kn,fo,mo,go,Jn}from"./vm-hands-entry-lite-j8s2vqpf.js";import{ti,ri,K,za,qa,oe,x,p,bo,ge,se,O,$t,Qe,rn,vo,E,_e,Za,Qa,ec,si,nn,pt,tc,Mt,on,Pe,J,nc,xo,Co,ic,et}from"./vm-hands-entry-lite-61p78r72.js";import{je}from"./vm-hands-entry-lite-s93f3pbv.js";import{cr,Ae,Da,tn,Oa,La}from"./vm-hands-entry-lite-ngry8nkq.js";import{ne}from"./vm-hands-entry-lite-997y1m1r.js";import{le,A,es,ts}from"./vm-hands-entry-lite-pe374cn6.js";import{On,Nn,Hi,Fc}from"./vm-hands-entry-lite-thstg177.js";import{kr,ue}from"./vm-hands-entry-lite-cc8hwgxc.js";import{Lt,ie,N,ro}from"./vm-hands-entry-lite-1wxwsb3f.js";import{Oi,ke,de,j,ze,ns,En,is,qe,Ni,Li,os,kn,Ie,ss,xn}from"./vm-hands-entry-lite-mn8rjpxq.js";import{F}from"./vm-hands-entry-lite-zp7chzcc.js";import{U,H,T}from"./vm-hands-entry-lite-qjrgvdbj.js";import{Zn,Ma,ja,wo,ei}from"./vm-hands-entry-lite-43bv9hf0.js";import{ya}from"./vm-hands-entry-lite-sh4mqy93.js";import{_i}from"./vm-hands-entry-lite-3q2ng4e9.js";import{Mo}from"./vm-hands-entry-lite-41nn0vbf.js";import{Jt}from"./vm-hands-entry-lite-srtqjjqb.js";import{hr,Oo,No,Lo}from"./vm-hands-entry-lite-jgwjt10t.js";import{to}from"./vm-hands-entry-lite-284z7ct8.js";import{mi,cc}from"./vm-hands-entry-lite-b1vanmtv.js";import{u,b,m,y}from"./vm-hands-entry-lite-yg4dk99m.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{De,wt,cs,Sc,Ec,bt}from"./vm-hands-entry-lite-88dxn9b5.js";import{s,Et}from"./vm-hands-entry-lite-12ck5swp.js";import{Jc,Ji,I,t,V,zr,o,_,Rt,d,n,h,P,ul,c,i,Xi}from"./vm-hands-entry-lite-zpvr7wc6.js";import{va,Y,B}from"./vm-hands-entry-lite-pg7nnyc6.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{spawn as Du,spawnSync as Xw}from"child_process";import{closeSync as Mu,existsSync as Zw,mkdirSync as Qw,openSync as Tu,readdirSync as ey,realpathSync as Yr,rmSync as Xn}from"fs";import{hostname as ty}from"os";import{dirname as Bs,join as Bt,resolve as ry}from"path";var Jo={ENOENT:"native_enoent",EACCES:"native_permission_denied",EPERM:"native_permission_denied",ETIMEDOUT:"native_timeout",ECONNREFUSED:"native_network",ECONNRESET:"native_network",ENOTFOUND:"native_network",EAI_AGAIN:"native_network",ENETUNREACH:"native_network",EHOSTUNREACH:"native_network",EPIPE:"native_pipe_closed",ENOSPC:"native_disk_full",EMFILE:"native_too_many_files",EBUSY:"native_busy",E2BIG:"native_args_too_large"};function oc(e){if(!(e instanceof Error))return e===void 0||e===null?"native_no_error":"native_non_error";let l=e.code;if(typeof l==="string"&&Jo[l])return Jo[l];let v=e.message;if(e.name==="TimeoutError"||e.name==="AbortError")return"native_timeout";if(/No handler registered for /.test(v))return"ipc_handler_missing";if(/could not be cloned/i.test(v))return"ipc_clone_failed";if(/Render frame was disposed|Object has been destroyed|WebContents was destroyed/i.test(v))return"ipc_window_closed";let D=/\b(E[A-Z0-9]{2,15})\b/.exec(v)?.[1];if(D&&Jo[D])return Jo[D];if(/timed? ?out|timeout/i.test(v))return"native_timeout";if(/fetch failed|failed to fetch|network|socket hang up|getaddrinfo/i.test(v))return"native_network";if(e.name==="TypeError"&&v==="Load failed")return"native_network";if(/unexpected token|is not valid JSON|JSON\.parse|Unexpected end of JSON/i.test(v))return"native_unreadable_output";if(/keychain|secitem|errSec/i.test(v))return"native_keychain_error";if(/Error invoking remote method/.test(v))return"ipc_remote_error";switch(e.name){case"TypeError":return"native_type_error";case"RangeError":return"native_range_error";case"SyntaxError":return"native_unreadable_output"}return"native_unexpected"}import{createHash as Gu}from"crypto";import{unlinkSync as Yu}from"fs";import{platform as Xu}from"os";import{join as Zu}from"path";var ac=P("store",[h({version:i(1),store:i("keychain")}),h({version:i(1),store:i("file"),api_key:t().min(1).max(4096)})]),ln=(e)=>Zu(e,"api-key.json");function Fr(e){let l=Gu("sha256").update(`reason-connect-api-key
+${e}`).digest("hex");return new mt(hn(),Xu(),l)}function ra(e,l,v=Fr(e)){try{v.deleteBinding(),v.createBinding(new TextEncoder().encode(l)),y(ln(e),{version:1,store:"keychain"});return}catch(D){if(!(D instanceof a))throw D}y(ln(e),{version:1,store:"file",api_key:l})}function lr(e,l=Fr(e)){if(!u(ln(e)))return null;let v=ac.parse(JSON.parse(m(ln(e))));if(v.store==="file")return v.api_key;try{let D=l.loadBinding();return D?new TextDecoder().decode(D):null}catch(D){if(!(D instanceof a))throw D;throw Error("worker_api_key_unreadable")}}function sc(e,l=Fr(e)){if(!u(ln(e)))return;if(ac.parse(JSON.parse(m(ln(e)))).store==="keychain")try{l.deleteBinding()}catch(v){if(!(v instanceof a))throw v}Yu(ln(e))}async function na(e,l){let v;try{v=await ir({env:{REASON_API_KEY:l,REASON_API_URL:e.apiOrigin},fetchImpl:oe(e.proxy)})}catch(D){if(D instanceof C&&(D.status===401||D.status===403))throw Error("worker_api_key_rejected");throw D}if(!v)throw Error("worker_api_key_rejected");if(!v.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return v}import{readdirSync as yf,renameSync as _f,rmSync as dn}from"fs";import{join as Pt}from"path";import{createHash as Qu}from"crypto";import{realpathSync as ef,statSync as tf,unlinkSync as Go}from"fs";import{platform as rf}from"os";import{join as Xt}from"path";function f(e){return{state:Xt(p(e),"device.json"),control:Xt(p(e),"control.json"),lock:Xt(p(e),"lifecycle.lock"),socket:Xt(p(e),"control.sock"),daemon:Xt(p(e),"daemon.json"),releaseCheck:Xt(p(e),"release-check.json"),updateDeferral:Xt(p(e),"update-deferral.json"),firstHeartbeat:Xt(p(e),"first-heartbeat.json")}}var nf=n({version:i(1),device_id:t().min(1).max(160),offer:Rt().optional(),enrollment_ms:o().int().nonnegative().max(tr).optional()});function lc(e,l,v){b(p(e),!0),y(f(e).firstHeartbeat,{version:1,device_id:l,...v.offer?{offer:v.offer}:{},...v.enrollmentMs!==void 0?{enrollment_ms:v.enrollmentMs}:{}})}function oa(e,l){let v=f(e).firstHeartbeat;try{if(!u(v))return null;let D=nf.safeParse(JSON.parse(m(v)));if(Go(v),!D.success||D.data.device_id!==l)return null;let M=jn(D.data.offer);return{...M?{offer:M}:{},...D.data.enrollment_ms!==void 0?{enrollmentMs:D.data.enrollment_ms}:{}}}catch{return null}}function xt(e,l=!1){b(p(e),l);let v=["local-device.key","local-device.binding","device.json"].filter((D)=>{let M=Xt(p(e),D);if(!u(M))return!1;return m(M),!0});return e.lifetime==="persistent"&&v.join()==="device.json"?ia(e):new fn(p(e))}function Yo(e,l){xt(e,!0),sf(e);let v=l??ia(e),D=new fn(p(e));try{v.deleteBinding(),v.deleteKey(),v.createFreshPublicKey()}catch(M){if(M instanceof a)return D;throw M}return D.deleteBinding(),D.deleteKey(),v}function ia(e){return new mt(hn(),rf(),of(e))}function of(e){let l=aa(e);return Qu("sha256").update(`reason-worker
+${l?.directory??p(e)}`).digest("hex")}function ao(e,l){y(Xt(p(e),so),{version:1,directory:aa(e)?.directory??p(e),devicePublicKey:l})}var so="keychain-scope.json";function dc(e){return u(Xt(p(e),so))}var af=h({version:i(1),directory:t().min(1),devicePublicKey:t().min(1)});function aa(e){let l=Xt(p(e),so);if(!u(l))return null;let v=af.safeParse(JSON.parse(m(l))),D=f(e).state;if(!v.success||!u(D))return null;return JSON.parse(m(D))?.devicePublicKey===v.data.devicePublicKey?v.data:null}function sf(e){let l=Xt(p(e),so);if(!u(l))return;if(aa(e))try{let v=ia(e);v.deleteBinding(),v.deleteKey()}catch(v){if(!(v instanceof a))throw v}Go(l)}function Or(e){let l=ef(e.workspaceRoot);if(l!==e.workspaceRoot||!tf(l).isDirectory()||!ge(l,e.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function S(e){if(!u(p(e)))return null;let l=Ut(f(e).state,{proofStore:xt(e),repair:!1}),v=l!==null&&Cn(e.apiOrigin,l.apiOrigin),D=v?[O(e),O({...e,apiOrigin:l.apiOrigin})]:[O(e)];if(l&&(!D.includes(l.worker?.configDigest??"")||l.worker.lifetime!==e.lifetime||l.apiOrigin!==e.apiOrigin&&!v||l.roots.length>32||l.roots[0]?.path!==e.workspaceRoot||l.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return l}var uc=h({version:i(1),drained:_(),revoked:_()});function ft(e){let l=f(e).control;return u(l)?uc.parse(JSON.parse(m(l))):{version:1,drained:!1,revoked:!1}}function qt(e,l){y(f(e).control,uc.parse(l))}function Zt(e){let l=xt(e);l.deleteBinding(),l.deleteKey();let v=Xt(p(e),so);if(u(v))Go(v);let D=f(e).state;if(u(D))Go(D)}var cf=h({read:_(),write:_(),execute:_(),discover_environment:_(),expose_mcp:i(!1)}),sa=h({version:i(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:cf,execution_mode:c(["confined","host"]).default("confined")}),folders:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),lf=n({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:i("p256"),protocol_version:i(2),roots:d(n({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:n({lifecycle:c(["persistent","ephemeral"]),expires_at:I.datetime({offset:!0})}),first_heartbeat:Rt().optional()}),ca=30000;class Rr extends Error{deviceRemoved;constructor(e){super("worker_enrollment_rejected");this.deviceRemoved=e}}async function df(e,l,v=fetch){let D=await v(`${e}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(l),redirect:"error",signal:AbortSignal.timeout(ca)});if(!D.ok){let M=D.status===409?await D.json().catch(()=>null):null;throw new Rr(M?.error==="device_revoked")}return D.json()}async function la(e,l,v,D){ne();let M=sa.parse(JSON.parse(m(l)));return Er(e,M,v,D)}async function Er(e,l,v,D=(L,z)=>df(L,z,oe(e.proxy)),M=performance.now()){let L=mc(e,l,v),z=await D(e.apiOrigin,{...L.request,enrollment_ticket:l.enrollment_ticket,code_verifier:l.code_verifier});return L.receipt(z,M)}async function fc(e,l,v,D,M=performance.now()){let L=mc(e,l,v),z=await D(L.request,l.code_verifier);return z===null?null:L.receipt(z,M)}function mc(e,l,v){if(ne(),l.root.execution_mode!==e.executionMode)throw Error("worker_enrollment_mode_mismatch");let D=zt([e.workspaceRoot],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(D.path!==e.workspaceRoot||D.pathFingerprint!==l.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let M=(e.folders??[]).map((G,ce)=>{let we=zt([G],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(we.path!==G||we.pathFingerprint!==l.folders?.[ce]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return we});if((l.folders?.length??0)!==M.length)throw Error("worker_enrollment_root_mismatch");let L=[{...D,label:"workspace"},...M],z;try{z=v.loadPublicKey()}catch{z=v.createFreshPublicKey()}return{request:{device_public_key:z,name:e.name,os:process.platform,architecture:process.arch,reason_runtime_version:g,bridge_version:g,protocol_version:2,capabilities:{supported_operations:[]},roots:L.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:l.root.permissions}))},receipt(G,ce){let we=lf.parse(G);if(we.organization_id!==l.organization_id||we.roots.length!==L.length||we.roots.some((X,he)=>X.path_fingerprint!==L[he].pathFingerprint)||we.headless.lifecycle!==e.lifetime||Date.parse(we.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let te=jn(we.first_heartbeat);try{lc(e,we.device_id,{...te?{offer:te}:{},enrollmentMs:Math.min(tr,Math.max(0,Math.round(performance.now()-ce)))})}catch{}return{version:4,apiOrigin:e.apiOrigin,orgId:we.organization_id,deviceId:we.device_id,devicePublicKey:z,displayName:e.name,registeredAt:new Date().toISOString(),handsSlots:e.slots,worker:{configDigest:O(e),lifetime:e.lifetime,expiresAt:we.headless.expires_at},roots:we.roots.map((X,he)=>({id:X.id,label:X.label,path:L[he].path,pathFingerprint:X.path_fingerprint,permissions:l.root.permissions}))}}}}import{randomBytes as uf,randomUUID as ff}from"crypto";import{unlinkSync as mf}from"fs";import{join as pf}from"path";var pc=h({version:i(1),install_id:V(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),hf=n({enrollment_ticket:t().min(1).max(4096),expires_at:I.datetime({offset:!0}),device_kind:i("headless"),lifecycle:c(["persistent","ephemeral"]),device_expires_at:I.datetime({offset:!0})});function da(e){return hf.parse(e)}var gf=n({credentialKind:c(["oauth","api_key"]).optional(),apiOrigin:zr(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:I.datetime({offset:!0}),scopes:d(t().max(128)).max(128),orgId:t().min(1).max(160)});function jr(e){return Q(Pn("REASON_CLI_CHANNEL",e.channel),s())}async function qr(e,l=jr(e)){if(!u(l))return null;let v=gf.parse(JSON.parse(m(l)));if(!W(v.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(v.credentialKind==="api_key")return Date.parse(v.expiresAt)>Date.now()?v:null;let D=oe(e.proxy),M=Object.assign((z,re)=>D(z,{...re,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),L=await be({path:l,fetchImpl:M});if(L&&!W(L.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");return L}async function hc(e,l,v){if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let D=Kr(e);return D.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(D.request))}async function gc(e,l,v,D,M){let L=performance.now();if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let z=Kr(e),re=M?void 0:v.enrollHeadlessDevice?.bind(v);if(re){let G=await fc(e,z.direct(l.orgId),D,(ce,we)=>re({approval:z.request,code_verifier:we,registration:ce}).catch((te)=>{throw wf(te)}),L);if(G)return G}return Er(e,z.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(z.request)),D,M,L)}function wf(e){if(!(e instanceof C))return e;if(e.status===409)return new Rr(e.code==="device_revoked");if(e.status===410||e.status===401&&e.code==="invalid_enrollment_ticket"||e.status===403&&e.code==="grant_exceeded"||e.status===400&&e.code==="invalid_device_enrollment")return new Rr(!1);return e}var co=(e)=>pf(p(e),"enrollment-install.json");function wc(e){if(u(co(e)))mf(co(e))}function Kr(e,{stored:l=!0}={}){ne();let v=co(e),D=l&&u(v)?pc.parse(JSON.parse(m(v))):{version:1,install_id:ff(),fingerprint_key:uf(32).toString("hex")};if(l&&!u(v))y(v,D);let M={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},L=Buffer.from(D.fingerprint_key,"hex"),z=zt([e.workspaceRoot],M,L)[0];if(z.path!==e.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let re=(e.folders??[]).map((te)=>{let X=zt([te],M,L)[0];if(X.path!==te)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:X.pathFingerprint}}),G=Ca(),ce={install_id:D.install_id,code_challenge:G.challenge,lifecycle:e.lifetime,roots:[z.pathFingerprint,...re.map((te)=>te.path_fingerprint)].map((te)=>({path_fingerprint:te,permissions:M,execution_mode:e.executionMode}))},we=(te)=>({version:1,organization_id:te,code_verifier:G.verifier,root_fingerprint_key:D.fingerprint_key,root:{path_fingerprint:z.pathFingerprint,permissions:M,execution_mode:e.executionMode},...re.length?{folders:re}:{}});return{request:ce,saveInstall(te){b(p(te),!0),y(co(te),D)},complete(te,X){let he=da(X);if(he.lifecycle!==e.lifetime||Date.parse(he.expires_at)<=Date.now()||Date.parse(he.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...we(te),enrollment_ticket:he.enrollment_ticket}},direct:we}}function yc(e,l,v){let D=co(e);if(!u(D))throw Error("worker_folders_unavailable");let M=pc.parse(JSON.parse(m(D)));return zt([l],v,Buffer.from(M.fingerprint_key,"hex"))[0]}var Xo=8,ma=600000,kc=15000,bf=3600000,kf=new Set(["device_not_eligible","sign_in_not_eligible"]),_c=new Set(["device_revoked","invalid_device_credential"]),Zo=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,Dr=(e)=>Pt(p(e),"workspaces"),vc="account.json",ua=(e)=>u(Pt(e,vc));function Qt(e){let l;try{l=yf(Dr(e))}catch{return[]}return l.filter((v)=>Zo.test(v)).sort().map((v)=>{let D=Pt(Dr(e),v),M=Pt(D,"worker.json"),L=null;try{let z=x.safeParse(JSON.parse(m(M)));if(z.success&&z.data.stateDirectory===D)L=z.data}catch{}return{organizationId:v,directory:D,configPath:M,config:L,account:ua(D)}})}function Qo(e,l){let v=l.toLowerCase();if(!Zo.test(v))throw Error("worker_workspace_id_invalid");let D=x.parse({...e,stateDirectory:Pt(Dr(e),v)});return b(D.stateDirectory,!0),y(Pt(D.stateDirectory,vc),{version:1}),{config:D,configPath:Pt(D.stateDirectory,"worker.json")}}function ni(e,l){try{let{config:v,configPath:D}=Qo(e,l);b(p(v),!0),qt(v,{version:1,drained:!0,revoked:!0}),y(D,v)}catch{}}function ho(e,l){let v=l.toLowerCase(),D=null;try{D=S(e)?.orgId.toLowerCase()??null}catch{}return D===v||Qt(e).some((M)=>!M.account&&M.config!==null&&M.organizationId===v)}var fa=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function bc(e,l){let v=S(e);if(!v?.worker)throw Error("worker_identity_missing");ao(e,v.devicePublicKey),b(p(l),!0);for(let L of fa)dn(Pt(p(l),L),{force:!0});for(let L of fa){let z=Pt(p(e),L);if(u(z))_f(z,Pt(p(l),L))}let D=xt(l),M=Ut(f(l).state,{proofStore:D,repair:!1});if(!M?.worker)throw Error("worker_identity_missing");ae({...M,worker:{...M.worker,configDigest:O(l)}},f(l).state,{proofStore:D})}function pa(e){for(let l of Qt(e)){if(l.account)continue;try{if(l.config&&u(f(l.config).state))Zt(l.config)}catch{}dn(l.directory,{recursive:!0,force:!0})}dn(ga(e),{force:!0})}function oi(e,{prefer:l,keep:v,live:D=!1}){let M=Date.now(),L=(te)=>Number(Date.parse(te.worker?.expiresAt??"")>M+60000),re=Qt(e).flatMap((te)=>{if(!te.account||!te.config)return[];try{if(ft(te.config).revoked)return[];let X=S(te.config);return X&&X.orgId.toLowerCase()===te.organizationId&&(!D||L(X))?[{...te,config:te.config,state:X}]:[]}catch{return[]}}).sort((te,X)=>Number(X.organizationId===l)-Number(te.organizationId===l)||L(X.state)-L(te.state))[0];if(!re)return null;let G=null;try{G=ft(e).revoked?null:S(e)}catch{}let ce=G?.orgId.toLowerCase()??"";if(v&&G&&Zo.test(ce)&&ce!==re.organizationId){let te=Qo(e,ce);bc(e,te.config),y(te.configPath,te.config)}else if(u(p(e))){try{if(u(f(e).state))Zt(e)}catch{}for(let te of fa)dn(Pt(p(e),te),{force:!0})}pa(e);let we=x.parse({...re.config,stateDirectory:e.stateDirectory});return bc(re.config,we),y(Pt(e.stateDirectory,"worker.json"),we),dn(re.directory,{recursive:!0,force:!0}),we}var ha={before(e){for(let{config:l}of Qt(e))try{let v=l?S(l):null;if(l&&v)ao(l,v.devicePublicKey)}catch{}},after(e,l){for(let{organizationId:v,directory:D,configPath:M,config:L}of Qt(l)){if(L)continue;try{let z=x.parse(JSON.parse(m(M)));if(z.stateDirectory!==Pt(Dr(e),v))continue;let re=x.parse({...z,stateDirectory:D}),G=xt(re),ce=Ut(f(re).state,{proofStore:G,repair:!1});if(ce?.worker?.configDigest===O(z))ae({...ce,worker:{...ce.worker,configDigest:O(re)}},f(re).state,{proofStore:G});y(M,re)}catch{}}}},ga=(e)=>Pt(Dr(e),"listed.json");function Rc(e){try{let l=JSON.parse(m(ga(e))),v=l.names&&typeof l.names==="object"&&!Array.isArray(l.names)?Object.fromEntries(Object.entries(l.names).filter((M)=>typeof M[1]==="string")):{},D=l.refused&&typeof l.refused==="object"?l.refused:null;return{listed:l.listed===!0,reason:l.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(l.blocked)?l.blocked.filter((M)=>typeof M==="string"):[],names:v,...D&&typeof D.device==="string"&&typeof D.roots==="string"&&typeof D.at==="number"&&Number.isFinite(D.at)&&typeof D.count==="number"&&Number.isInteger(D.count)&&D.count>=1?{refused:{device:D.device,roots:D.roots,at:D.at,count:D.count}}:{}}}catch{return null}}function Pc(e,l){let v=Qt(e),D=v.filter((G)=>G.account),M=v.filter((G)=>!G.account),L=Rc(e),z=L&&!L.listed?L.reason:null,re=z||M.length===0&&L&&!L.listed?[]:M;if(D.length===0&&re.length===0&&(z||L&&!L.listed))return{workspaces:null,off:z};return{off:z,workspaces:[...D,...re].map(({organizationId:G,config:ce,account:we})=>{let te=!1,X=null,he=!1,Se=null;try{te=ce?ft(ce).revoked:!1,X=ce&&!te?S(ce):null;let Re=ce?rt(f(ce).daemon):null;he=l&&!!X&&Re?.state==="connected",Se=he?mn(Re,X):null}catch{}return{...Se?{permission_recovery:Se}:{},organization_id:G,device_id:X?.deviceId??null,name:L?.names?.[G]??null,root:X?.roots[0]?{id:X.roots[0].id,permissions:X.roots[0].permissions}:null,state:te?"removed":he?"connected":"not_running",blocked:!we&&!te&&!he&&(L?.blocked.includes(G)??!1),...we?{account:!0}:{}}})}}function Cc(e){let{config:l,state:v,client:D,signal:M}=e,L=e.log??(()=>{return}),z=e.intervalMs??ma,re=new Map,G=null,ce=!1,we=Rc(l)??{listed:!1,reason:null,blocked:[]},te=()=>v.roots.map((Ne)=>Ne.id).join(","),X=(Ne)=>{if(!Ne||Ne.device!==v.deviceId||Ne.roots!==te())return!1;let xe=Date.now();return xe>=Ne.at&&xe<Ne.at+Math.min(bf,z*2**Math.min(Ne.count-1,10))},he=(Ne)=>{let{folders:xe,...Le}=l,Ge=v.roots.slice(1).map((Ve)=>Ve.path);return x.parse({...Le,...Ge.length?{folders:Ge}:{},stateDirectory:Pt(Dr(l),Ne)})},Se=async(Ne)=>{let xe=re.get(Ne);if(!xe)return;xe.controller.abort(),await xe.done},Re=(Ne,xe=!1)=>{let Le=new AbortController,Ge=()=>Le.abort();if(M.addEventListener("abort",Ge,{once:!0}),M.aborted)Le.abort();let Ve={...Ne,controller:Le,claims:0,done:Promise.resolve(),account:xe};Ve.done=e.serve(Ne,Le.signal,(Je)=>{Ve.claims=Je}).then(()=>{return},(Je)=>{if(xe&&Je instanceof k&&Je.status===401&&_c.has(Je.code)){try{qt(Ne.config,{version:1,drained:!0,revoked:!0})}catch{}L(`Reason worker: workspace ${Ne.organizationId} (another account's) no longer accepts this computer (${Je.code}); run \`reason connect\` signed in as that account to connect it again
+`)}else if(Je instanceof k&&Je.status===401&&_c.has(Je.code)){try{Zt(Ne.config)}catch{}L(`Reason worker: workspace ${Ne.organizationId} no longer accepts this computer
 `)}else if(!Le.signal.aborted)L(`Reason worker: workspace ${Ne.organizationId} stopped (worker_workspace_failed); it starts again on the next check
-`)}).finally(()=>{if(Le.abort(),M.removeEventListener("abort",Ge),Ve.claims=0,re.get(Ne.organizationId)===Ve)re.delete(Ne.organizationId);let Je=Ne.config.stateDirectory;if(xe&&!_a(Je)&&!u(Et(Je,"worker.json")))mn(Je,{recursive:!0,force:!0})}),re.set(Ne.organizationId,Ve)},Ee=(Ne,xe)=>{if(!xe)return null;try{let Le=he(Ne),Ge=S(xe);if(!Ge||Ge.orgId!==Ne||Date.parse(Ge.worker?.expiresAt??"")<=Date.now()+60000||xe.name!==Le.name||xe.executionMode!==Le.executionMode||!W(xe.apiOrigin,Le.apiOrigin)||Ge.roots.map((Ve)=>Ve.path).join(`
+`)}).finally(()=>{if(Le.abort(),M.removeEventListener("abort",Ge),Ve.claims=0,re.get(Ne.organizationId)===Ve)re.delete(Ne.organizationId);let Je=Ne.config.stateDirectory;if(xe&&!ua(Je)&&!u(Pt(Je,"worker.json")))dn(Je,{recursive:!0,force:!0})}),re.set(Ne.organizationId,Ve)},Ee=(Ne,xe)=>{if(!xe)return null;try{let Le=he(Ne),Ge=S(xe);if(!Ge||Ge.orgId!==Ne||Date.parse(Ge.worker?.expiresAt??"")<=Date.now()+60000||xe.name!==Le.name||xe.executionMode!==Le.executionMode||!W(xe.apiOrigin,Le.apiOrigin)||Ge.roots.map((Ve)=>Ve.path).join(`
 `)!==v.roots.map((Ve)=>Ve.path).join(`
-`))return null;return{organizationId:Ne,config:xe,state:Ge,proofStore:xt(xe)}}catch{return null}},Oe=(Ne,xe)=>{if(!xe)return null;try{if(pt(xe).revoked)return null;let Le=S(xe);if(!Le||Le.orgId.toLowerCase()!==Ne||Date.parse(Le.worker?.expiresAt??"")<=Date.now()+60000||xe.executionMode!==l.executionMode||!W(xe.apiOrigin,l.apiOrigin))return null;return{organizationId:Ne,config:xe,state:Le,proofStore:xt(xe)}}catch{return null}},Me=(Ne,xe)=>Ne.deviceId===xe.deviceId&&Ne.devicePublicKey===xe.devicePublicKey&&JSON.stringify(Ne.roots.map((Le)=>[Le.id,Le.path]))===JSON.stringify(xe.roots.map((Le)=>[Le.id,Le.path])),Ce=async(Ne)=>{for(let[xe,Le]of Ne){if(M.aborted)return;let Ge=re.get(xe),Ve=Oe(xe,Le.config);if(Ge&&Ve&&Me(Ge.state,Ve.state))continue;if(Ge){if(Ge.claims>0)continue;await Se(xe)}if(Ve&&!M.aborted)Re(Ve,!0)}for(let[xe,Le]of re)if(Le.account&&!Ne.has(xe)&&Le.claims===0)await Se(xe)},Te=async(Ne)=>{let xe=he(Ne),Le=x.parse({...xe,stateDirectory:l.stateDirectory});if(!u(Et(p(l),"enrollment-install.json")))return null;let Ge=Qr(Le),Ve=await O.ownerWorkspaceEnrollment(v,{organization_id:Ne,install_id:Ge.request.install_id,code_challenge:Ge.request.code_challenge},M),Je=Ge.complete(Ne,Ve);if(b(p(xe),!0),u(f(xe).state))Zt(xe);let it=ei(xe);try{let Ye=await Cr(xe,Je,it,e.enroll);return ae(Ye,f(xe).state,{proofStore:it}),zt(xe,{version:1,drained:!1,revoked:!1}),y(Et(xe.stateDirectory,"worker.json"),xe),{organizationId:Ne,config:xe,state:Ye,proofStore:it}}catch(Ye){if(Ye instanceof Er&&Ye.deviceRemoved)return zt(xe,{version:1,drained:!0,revoked:!0}),y(Et(xe.stateDirectory,"worker.json"),xe),null;throw Ye}},We=async()=>{let Ne=Qt(l),xe=new Map(Ne.filter((He)=>He.account).map((He)=>[He.organizationId,He]));await Ce(xe);let Le=new Map(Ne.filter((He)=>!He.account).map((He)=>[He.organizationId,He])),Ge=(He)=>xe.has(He)||re.get(He)?.account===!0||_a(Et(Tr(l),He)),Ve=(He)=>{let at=Le.get(He)?.config;try{return at?pt(at).revoked:!1}catch{return!1}};for(let[He,at]of Le){if(re.has(He)||Ve(He)||we.blocked.includes(He))continue;let mt=Ee(He,at.config);if(mt&&!M.aborted)Re(mt)}if(X(we.refused))return!0;let Je;try{Je=await O.ownerWorkspaces(v,M)}catch(He){let at=He instanceof k&&He.status===403&&kf.has(He.code),mt=we.refused,kt=te(),qt=at?{device:v.deviceId,roots:kt,at:Date.now(),count:mt?.device===v.deviceId&&mt.roots===kt?mt.count+1:1}:mt;return we={listed:!1,blocked:we.blocked,...we.names?{names:we.names}:{},reason:He instanceof k&&He.status===403&&He.code==="sign_in_not_eligible"?"sign_in":null,...qt?{refused:qt}:{}},at}let it=new Map(Je.map((He)=>[He.id.toLowerCase(),He.blocked]).filter(([He])=>ri.test(He)&&He!==v.orgId.toLowerCase()&&!Ge(He))),Ye=[...it.keys()].filter((He)=>Le.has(He)?!Ve(He):!it.get(He)).slice(0,ti),Be=[...re.values()].filter((He)=>!He.account&&He.claims>0&&!Ye.includes(He.organizationId)).length,Ke=Ye.filter((He)=>!Le.has(He)),qe=Ke.slice(Ke.length-Math.min(Math.max(0,Ye.length+Be-ti),Ke.length)),nt=Ye.filter((He)=>!qe.includes(He)),et=Object.fromEntries(Je.flatMap((He)=>He.name&&nt.includes(He.id.toLowerCase())?[[He.id.toLowerCase(),He.name]]:[]));we={listed:!0,reason:null,blocked:nt.filter((He)=>it.get(He)),names:et};for(let He of new Set([...Le.keys(),...re.keys()])){if(nt.includes(He)||Ge(He))continue;if(it.has(He)&&Ve(He))continue;if((re.get(He)?.claims??0)>0)continue;await Se(He);let at=Le.get(He)?.config;try{if(at&&u(f(at).state))Zt(at)}catch{}mn(Et(Tr(l),He),{recursive:!0,force:!0}),L(`Reason worker: left workspace ${He}
+`))return null;return{organizationId:Ne,config:xe,state:Ge,proofStore:xt(xe)}}catch{return null}},Oe=(Ne,xe)=>{if(!xe)return null;try{if(ft(xe).revoked)return null;let Le=S(xe);if(!Le||Le.orgId.toLowerCase()!==Ne||Date.parse(Le.worker?.expiresAt??"")<=Date.now()+60000||xe.executionMode!==l.executionMode||!W(xe.apiOrigin,l.apiOrigin))return null;return{organizationId:Ne,config:xe,state:Le,proofStore:xt(xe)}}catch{return null}},Me=(Ne,xe)=>Ne.deviceId===xe.deviceId&&Ne.devicePublicKey===xe.devicePublicKey&&JSON.stringify(Ne.roots.map((Le)=>[Le.id,Le.path]))===JSON.stringify(xe.roots.map((Le)=>[Le.id,Le.path])),Ce=async(Ne)=>{for(let[xe,Le]of Ne){if(M.aborted)return;let Ge=re.get(xe),Ve=Oe(xe,Le.config);if(Ge&&Ve&&Me(Ge.state,Ve.state))continue;if(Ge){if(Ge.claims>0)continue;await Se(xe)}if(Ve&&!M.aborted)Re(Ve,!0)}for(let[xe,Le]of re)if(Le.account&&!Ne.has(xe)&&Le.claims===0)await Se(xe)},Te=async(Ne)=>{let xe=he(Ne),Le=x.parse({...xe,stateDirectory:l.stateDirectory});if(!u(Pt(p(l),"enrollment-install.json")))return null;let Ge=Kr(Le),Ve=await D.ownerWorkspaceEnrollment(v,{organization_id:Ne,install_id:Ge.request.install_id,code_challenge:Ge.request.code_challenge},M),Je=Ge.complete(Ne,Ve);if(b(p(xe),!0),u(f(xe).state))Zt(xe);let it=Yo(xe);try{let Ye=await Er(xe,Je,it,e.enroll);return ae(Ye,f(xe).state,{proofStore:it}),qt(xe,{version:1,drained:!1,revoked:!1}),y(Pt(xe.stateDirectory,"worker.json"),xe),{organizationId:Ne,config:xe,state:Ye,proofStore:it}}catch(Ye){if(Ye instanceof Rr&&Ye.deviceRemoved)return qt(xe,{version:1,drained:!0,revoked:!0}),y(Pt(xe.stateDirectory,"worker.json"),xe),null;throw Ye}},We=async()=>{let Ne=Qt(l),xe=new Map(Ne.filter((He)=>He.account).map((He)=>[He.organizationId,He]));await Ce(xe);let Le=new Map(Ne.filter((He)=>!He.account).map((He)=>[He.organizationId,He])),Ge=(He)=>xe.has(He)||re.get(He)?.account===!0||ua(Pt(Dr(l),He)),Ve=(He)=>{let at=Le.get(He)?.config;try{return at?ft(at).revoked:!1}catch{return!1}};for(let[He,at]of Le){if(re.has(He)||Ve(He)||we.blocked.includes(He))continue;let lt=Ee(He,at.config);if(lt&&!M.aborted)Re(lt)}if(X(we.refused))return!0;let Je;try{Je=await D.ownerWorkspaces(v,M)}catch(He){let at=He instanceof k&&He.status===403&&kf.has(He.code),lt=we.refused,kt=te(),jt=at?{device:v.deviceId,roots:kt,at:Date.now(),count:lt?.device===v.deviceId&&lt.roots===kt?lt.count+1:1}:lt;return we={listed:!1,blocked:we.blocked,...we.names?{names:we.names}:{},reason:He instanceof k&&He.status===403&&He.code==="sign_in_not_eligible"?"sign_in":null,...jt?{refused:jt}:{}},at}let it=new Map(Je.map((He)=>[He.id.toLowerCase(),He.blocked]).filter(([He])=>Zo.test(He)&&He!==v.orgId.toLowerCase()&&!Ge(He))),Ye=[...it.keys()].filter((He)=>Le.has(He)?!Ve(He):!it.get(He)).slice(0,Xo),Be=[...re.values()].filter((He)=>!He.account&&He.claims>0&&!Ye.includes(He.organizationId)).length,Ke=Ye.filter((He)=>!Le.has(He)),Fe=Ke.slice(Ke.length-Math.min(Math.max(0,Ye.length+Be-Xo),Ke.length)),nt=Ye.filter((He)=>!Fe.includes(He)),Ze=Object.fromEntries(Je.flatMap((He)=>He.name&&nt.includes(He.id.toLowerCase())?[[He.id.toLowerCase(),He.name]]:[]));we={listed:!0,reason:null,blocked:nt.filter((He)=>it.get(He)),names:Ze};for(let He of new Set([...Le.keys(),...re.keys()])){if(nt.includes(He)||Ge(He))continue;if(it.has(He)&&Ve(He))continue;if((re.get(He)?.claims??0)>0)continue;await Se(He);let at=Le.get(He)?.config;try{if(at&&u(f(at).state))Zt(at)}catch{}dn(Pt(Dr(l),He),{recursive:!0,force:!0}),L(`Reason worker: left workspace ${He}
 `)}for(let He of nt){if(M.aborted)return!0;if(Ge(He))continue;try{let at=re.get(He);if(it.get(He)){if(at&&at.claims===0)await Se(He),L(`Reason worker: offline in workspace ${He} (outside its allowed networks)
-`);continue}let mt=Ee(He,Le.get(He)?.config??null);if(mt&&at)continue;if(!mt){if(at&&at.claims>0)continue;if(await Se(He),mt=await Te(He),mt)L(`Reason worker: connected in workspace ${He}
-`)}if(mt&&!M.aborted)Re(mt)}catch{L(`Reason worker: could not connect in workspace ${He} (worker_workspace_failed); it is tried again
-`)}}return!0},$e=null,Fe=async()=>{let Ne=!1;do ce=!1,Ne=await We().catch(()=>!1);while(ce&&!M.aborted);let xe=JSON.stringify({version:1,...we});if($e!==xe)try{b(Tr(l),!0),y(Ca(l),JSON.parse(xe)),$e=xe}catch{}return Ne};return{check(){if(G)ce=!0;else G=Fe().finally(()=>{G=null});return G},claims:()=>[...re.values()].reduce((Ne,xe)=>Ne+xe.claims,0),async settled(){await G,await Promise.all([...re.values()].map((Ne)=>Ne.done))}}}import{dirname as vf}from"path";function Ic(e){let l={saved:e.saved,configPath:e.configPath};if(!e.saved||!Sf(e.saved))return l;let v=e.saved,O=(z,re)=>e.log(JSON.stringify({event:"worker.api_origin_move",outcome:z,...re?{code:`worker_api_origin_move_${z}:${re}`}:{},timestamp:new Date().toISOString()})),M=e.native===void 0?wt():e.native;if(!M)return l;let L=[];try{let z=M.lock(vf(e.configPath));if(!z)return l;if(L.push(z),u(p(v))){let we=ie({path:f(v).lock,runtimeVersion:g});if(!we.acquired)return l;L.push(()=>we.release())}let re=x.parse(JSON.parse(m(e.configPath)));if(re.stateDirectory!==v.stateDirectory)return l;let G=Oc(re),ce={saved:re,configPath:e.configPath};if(!si(re)&&G.length===0)return O("unchanged"),ce;if(si(re)){let we=Ac(re);y(e.configPath,we),ce={saved:we,configPath:e.configPath}}for(let we of G)try{y(we.configPath,Ac(we.config))}catch(te){O("failed",`workspace:${xc(te)}`)}return O("moved"),ce}catch(z){return O("failed",xc(z)),l}finally{for(let z of L.reverse())z()}}function si(e){return ye(e.apiOrigin)!==e.apiOrigin}function Oc(e){return Qt(e).filter((l)=>l.config!==null&&si(l.config))}function Sf(e){return si(e)||Oc(e).length>0}function Ac(e){let l=x.parse({...e,apiOrigin:ye(e.apiOrigin)}),v=S(e);if(!v)return l;if(!v.worker)throw Error("worker_identity_missing");let O=D(l);if(v.apiOrigin!==l.apiOrigin||v.worker.configDigest!==O)ae({...v,apiOrigin:l.apiOrigin,worker:{...v.worker,configDigest:O}},f(l).state,{proofStore:xt(l)});return l}function xc(e){if(e instanceof a)return e.code;if(e instanceof Error&&/^worker_[a-z_]+$/.test(e.message))return e.message;return e instanceof Error&&"code"in e&&typeof e.code==="string"?e.code:"unexpected"}import{chmodSync as Rf,lstatSync as Ma,readdirSync as Lc,readlinkSync as Ef,unlinkSync as Pf}from"fs";import{join as Tt,sep as Cf}from"path";var ci="rehome.json";class li extends Error{code;constructor(e){super(e);this.code=e}}function Wc(e){let l={saved:e.saved,configPath:e.configPath},v=Tt(e.home,".config"),O=Tt(v,"ara"),M=e.channel==="production"?["connect"]:[e.channel,"connect"],L=Tt(O,...M),z=Tt(v,"reason",...M),re=(te,X)=>e.log(JSON.stringify({event:"worker.state_rehome",outcome:te,...X?{code:`worker_state_rehome_${te}:${X}`}:{},timestamp:new Date().toISOString()})),G=e.native===void 0?wt():e.native,ce=e.saved,we=[];try{if(ce&&Tc(O)&&ce.stateDirectory===L){let Oe={...ce,stateDirectory:z};if(!Ia(G,z,Oe,we))return l;return Mc(ce,Oe,e.host,re)}if(ce&&Tc(O)&&ce.stateDirectory===z&&cc(ce)&&Ia(G,z,ce,we))return Nc({...ce,stateDirectory:L},ce,e.host),l;if(!ce||ce.lifetime!=="persistent"||ce.stateDirectory!==L||!Dn(O)?.isDirectory())return l;if(Mf(L)===g)return l;let X=(Oe,Me=!0)=>{if(Me)y(Tt(L,ci),{version:g});return re("skipped",Oe),l},he=[L];for(let Oe of xf(O,L)){if(Oe.config?.lifetime!=="ephemeral")return X("several_connections");if(!Af(Oe.directory,Oe.config,we))return X("once_running",!1);he.push(Oe.directory)}if(!G)return X("config_rename_unavailable:no_native");if(!Ia(G,L,ce,we))return l;let Se=S(ce);if(!Se||pt(ce).revoked)return l;if(mc(v)!==null)return X("conflicting_identity");if(gc(v)!==null)return X("conflicting_files");if(Dn(z)&&(!Dn(z).isDirectory()||Lc(z).length>0))return X("connection_folder_taken");lo(ce,Se.devicePublicKey),Pa.before(ce);let Re=lr(L);if(Re&&Oa(L))If(z,Re);let Ee=De(v,G,he);if(Ee.state!=="renamed"&&Ee.state!=="linked"){if(Re&&Oa(L))Hc(z);return X(Ee.problem??"config_folder_kept")}return Mc(ce,{...ce,stateDirectory:z},e.host,re)}catch(te){try{if(Dn(L)?.isDirectory())y(Tt(L,ci),{version:g})}catch{}return re("failed",Tf(te)),Df(ce,L,z,l)}finally{for(let te of we.reverse())te()}}function Mc(e,l,v,O){let M=Ma(l.stateDirectory);if(M.isDirectory()&&M.uid===process.getuid?.()&&(M.mode&63)!==0)Rf(l.stateDirectory,448);let L=xt(l),z=Ht(f(l).state,{proofStore:L,repair:!1});if(!z?.worker)throw new li("identity_missing");let re=D(l);if(z.worker.configDigest===D(e))ae({...z,worker:{...z.worker,configDigest:re}},f(l).state,{proofStore:L});else if(z.worker.configDigest!==re)throw new li("worker_config_binding_mismatch");y(Tt(l.stateDirectory,"worker.json"),l),Pa.after(e,l),Nc(e,l,v);let G=Tt(l.stateDirectory,ci);if(u(G))Pf(G);return O("moved"),{saved:l,configPath:Tt(l.stateDirectory,"worker.json")}}function Nc(e,l,v){if(Zo(e,l,v,"connect"),!Oa(l.stateDirectory))return;let O=Of(jr(e.stateDirectory));if(!O)return;let M=jr(l.stateDirectory),L;try{L=M.loadBinding()}catch{return}if(!L)M.createBinding(O);Hc(e.stateDirectory)}function Ia(e,l,v,O){if(e){let L=e.lock(l);if(!L)return!1;O.push(L)}if(!u(p(v)))return!0;let M=ie({path:f(v).lock,runtimeVersion:g});if(!M.acquired)return!1;return O.push(()=>M.release()),!0}function Af(e,l,v){if(u(p(l))){let M=ie({path:f(l).lock,runtimeVersion:g});if(!M.acquired)return!1;return v.push(()=>M.release()),!0}let O=Dn(Tt(e,"worker.json"));return O!==null&&Date.now()-O.mtimeMs>60000}function xf(e,l){let v=[e,...Lc(e,{withFileTypes:!0}).filter((M)=>M.isDirectory()&&!M.name.startsWith(".")).map((M)=>Tt(e,M.name))],O=[];for(let M of v)for(let L of["connect","connect-once"]){let z=Tt(M,L);if(z===l||!Dn(Tt(z,"worker.json")))continue;let re=$c(z);if(!re||re.stateDirectory===e||re.stateDirectory.startsWith(e+Cf))O.push({directory:z,config:re})}return O}function Oa(e){try{return JSON.parse(m(Tt(e,"api-key.json"))).store==="keychain"}catch{return!1}}function If(e,l){let v=jr(e);v.deleteBinding(),v.createBinding(new TextEncoder().encode(l))}function Hc(e){try{jr(e).deleteBinding()}catch(l){if(!(l instanceof a))throw l}}function Of(e){try{return e.loadBinding()}catch(l){if(l instanceof a)return null;throw l}}function Df(e,l,v,O){if(e?.stateDirectory!==l)return O;let M=$c(v);return M?.stateDirectory===v?{saved:M,configPath:Tt(v,"worker.json")}:O}function Tc(e){try{return Ma(e).isSymbolicLink()&&Ef(e)==="reason"}catch{return!1}}function Mf(e){try{let l=JSON.parse(m(Tt(e,ci)));return typeof l.version==="string"?l.version:null}catch{return null}}function $c(e){try{let l=Tt(e,"worker.json");return u(l)?x.parse(JSON.parse(m(l))):null}catch{return null}}function Dn(e){try{return Ma(e)}catch{return null}}function Tf(e){if(e instanceof li)return e.code;if(e instanceof Error&&/^worker_[a-z_]+$/.test(e.message))return e.message;if(e instanceof a)return e.code;return e instanceof Error&&"code"in e&&typeof e.code==="string"?e.code:"unexpected"}import{readFileSync as Lf}from"fs";function nr(e){try{let l=JSON.parse(Lf(`${e}.keep-awake.json`,"utf8"));return l!==null&&typeof l==="object"&&"version"in l&&l.version===1&&"enabled"in l&&l.enabled===!0?"battery_and_ac":void 0}catch(l){return l.code==="ENOENT"?"battery_and_ac":void 0}}function Bc(e,l){y(`${e}.keep-awake.json`,{version:1,enabled:l})}import{createHash as Aw}from"crypto";import{readdirSync as xw,realpathSync as Ws,statSync as Iw}from"fs";import{hostname as Ow}from"os";import{join as Cn,resolve as Dw}from"path";var ui="cloud",Wf=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function bo(e){return Wf.test(e)&&!Zr.test(e)}var Nf={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings \u203A API keys) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_api_unreachable:"This computer could not reach Reason. Check its internet connection, and any VPN, proxy or firewall that lets the Reason app through but not the reason command, then try again.",worker_api_certificate_untrusted:"This computer did not trust Reason's certificate. A proxy, VPN or security software inspecting HTTPS, or a wrong clock, usually causes this: let Reason through it, then try again.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Ln(e){return Nf[e]}import{randomUUID as Hf}from"crypto";import{chmodSync as $f,lstatSync as mi,mkdtempSync as Bf,realpathSync as zc,rmdirSync as Uf,rmSync as Ff,unlinkSync as jf}from"fs";import{createConnection as qf,createServer as zf}from"net";import{basename as Fc,dirname as jc,join as pn}from"path";var Kf=c(["status","drain","resume","stop","reload_roots"]),Vf=h({version:i(1),instanceId:t(),deviceId:t(),phase:c(["starting","running","reconnecting","stopping"]),drained:_(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:_(),supportedOperations:d(c(Pr)).max(Pr.length).optional(),capabilityReadiness:nl(c(Pr),_()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),Jf=h({nonce:t(),action:Kf}),Gf=n({nonce:V()}),Kc=h({version:i(1),nonce:V(),socketPath:t().max(100)});function Vc(e){return pn(f(e).lock,"control.json")}function pi(e){return b(f(e).lock),Gf.parse(JSON.parse(m(pn(f(e).lock,"owner.json"))))}function qc(e){if(!u(e))return!1;let l=mi(e);if(!l.isSocket()||l.uid!==process.getuid?.()||(l.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function Jc(e,l){let v=Vc(e);if(!u(v)){let L=f(e).socket;if(!u(L)||!mi(L).isSocket())return null;return qc(L)?L:null}let O=Kc.parse(JSON.parse(m(v)));if(O.nonce!==l)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!Yf.test(O.socketPath))throw Error("worker_control_endpoint_invalid");return O.socketPath}let M=jc(O.socketPath);if(jc(M)!==zc("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Fc(M))||Fc(O.socketPath)!=="control.sock"||Buffer.byteLength(O.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(M))return null;return b(M),qc(O.socketPath)?O.socketPath:null}var Yf=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;async function hi(e,l,v){if(pi(e).nonce!==l)throw Error("worker_instance_changed");let O=Vc(e);if(u(O))throw Error("worker_control_already_serving");let M=process.platform==="win32",L=M?null:Bf(pn(zc("/tmp"),"ara-worker-")),z=L?pn(L,"control.sock"):`\\\\.\\pipe\\reason-worker-${Hf()}`;if(L)b(L);if(Buffer.byteLength(z)>100)throw Error("worker_socket_path_too_long");let re=new Set,G=zf((X)=>{re.add(X),X.once("close",()=>re.delete(X)),X.setTimeout(2000,()=>X.destroy());let he="",Se=!1;X.on("error",()=>X.destroy()),X.on("data",(Re)=>{if(Se)return;if(he+=Re.toString(),Buffer.byteLength(he)>4096){X.destroy();return}if(!he.includes(`
+`);continue}let lt=Ee(He,Le.get(He)?.config??null);if(lt&&at)continue;if(!lt){if(at&&at.claims>0)continue;if(await Se(He),lt=await Te(He),lt)L(`Reason worker: connected in workspace ${He}
+`)}if(lt&&!M.aborted)Re(lt)}catch{L(`Reason worker: could not connect in workspace ${He} (worker_workspace_failed); it is tried again
+`)}}return!0},$e=null,Ue=async()=>{let Ne=!1;do ce=!1,Ne=await We().catch(()=>!1);while(ce&&!M.aborted);let xe=JSON.stringify({version:1,...we});if($e!==xe)try{b(Dr(l),!0),y(ga(l),JSON.parse(xe)),$e=xe}catch{}return Ne};return{check(){if(G)ce=!0;else G=Ue().finally(()=>{G=null});return G},claims:()=>[...re.values()].reduce((Ne,xe)=>Ne+xe.claims,0),async settled(){await G,await Promise.all([...re.values()].map((Ne)=>Ne.done))}}}import{dirname as vf}from"path";function Ic(e){let l={saved:e.saved,configPath:e.configPath};if(!e.saved||!Sf(e.saved))return l;let v=e.saved,D=(z,re)=>e.log(JSON.stringify({event:"worker.api_origin_move",outcome:z,...re?{code:`worker_api_origin_move_${z}:${re}`}:{},timestamp:new Date().toISOString()})),M=e.native===void 0?bt():e.native;if(!M)return l;let L=[];try{let z=M.lock(vf(e.configPath));if(!z)return l;if(L.push(z),u(p(v))){let we=ie({path:f(v).lock,runtimeVersion:g});if(!we.acquired)return l;L.push(()=>we.release())}let re=x.parse(JSON.parse(m(e.configPath)));if(re.stateDirectory!==v.stateDirectory)return l;let G=Oc(re),ce={saved:re,configPath:e.configPath};if(!ii(re)&&G.length===0)return D("unchanged"),ce;if(ii(re)){let we=Ac(re);y(e.configPath,we),ce={saved:we,configPath:e.configPath}}for(let we of G)try{y(we.configPath,Ac(we.config))}catch(te){D("failed",`workspace:${xc(te)}`)}return D("moved"),ce}catch(z){return D("failed",xc(z)),l}finally{for(let z of L.reverse())z()}}function ii(e){return ye(e.apiOrigin)!==e.apiOrigin}function Oc(e){return Qt(e).filter((l)=>l.config!==null&&ii(l.config))}function Sf(e){return ii(e)||Oc(e).length>0}function Ac(e){let l=x.parse({...e,apiOrigin:ye(e.apiOrigin)}),v=S(e);if(!v)return l;if(!v.worker)throw Error("worker_identity_missing");let D=O(l);if(v.apiOrigin!==l.apiOrigin||v.worker.configDigest!==D)ae({...v,apiOrigin:l.apiOrigin,worker:{...v.worker,configDigest:D}},f(l).state,{proofStore:xt(l)});return l}function xc(e){if(e instanceof a)return e.code;if(e instanceof Error&&/^worker_[a-z_]+$/.test(e.message))return e.message;return e instanceof Error&&"code"in e&&typeof e.code==="string"?e.code:"unexpected"}import{chmodSync as Rf,lstatSync as ba,readdirSync as Tc,readlinkSync as Ef,unlinkSync as Pf}from"fs";import{join as Wt,sep as Cf}from"path";var ai="rehome.json";class ci extends Error{code;constructor(e){super(e);this.code=e}}function Lc(e){let l={saved:e.saved,configPath:e.configPath},v=Wt(e.home,".config"),D=Wt(v,"ara"),M=e.channel==="production"?["connect"]:[e.channel,"connect"],L=Wt(D,...M),z=Wt(v,"reason",...M),re=(te,X)=>e.log(JSON.stringify({event:"worker.state_rehome",outcome:te,...X?{code:`worker_state_rehome_${te}:${X}`}:{},timestamp:new Date().toISOString()})),G=e.native===void 0?bt():e.native,ce=e.saved,we=[];try{if(ce&&Mc(D)&&ce.stateDirectory===L){let Oe={...ce,stateDirectory:z};if(!wa(G,z,Oe,we))return l;return Dc(ce,Oe,e.host,re)}if(ce&&Mc(D)&&ce.stateDirectory===z&&dc(ce)&&wa(G,z,ce,we))return Wc({...ce,stateDirectory:L},ce,e.host),l;if(!ce||ce.lifetime!=="persistent"||ce.stateDirectory!==L||!Dn(D)?.isDirectory())return l;if(Mf(L)===g)return l;let X=(Oe,Me=!0)=>{if(Me)y(Wt(L,ai),{version:g});return re("skipped",Oe),l},he=[L];for(let Oe of xf(D,L)){if(Oe.config?.lifetime!=="ephemeral")return X("several_connections");if(!Af(Oe.directory,Oe.config,we))return X("once_running",!1);he.push(Oe.directory)}if(!G)return X("config_rename_unavailable:no_native");if(!wa(G,L,ce,we))return l;let Se=S(ce);if(!Se||ft(ce).revoked)return l;if(Sc(v)!==null)return X("conflicting_identity");if(Ec(v)!==null)return X("conflicting_files");if(Dn(z)&&(!Dn(z).isDirectory()||Tc(z).length>0))return X("connection_folder_taken");ao(ce,Se.devicePublicKey),ha.before(ce);let Re=lr(L);if(Re&&_a(L))If(z,Re);let Ee=De(v,G,he);if(Ee.state!=="renamed"&&Ee.state!=="linked"){if(Re&&_a(L))Nc(z);return X(Ee.problem??"config_folder_kept")}return Dc(ce,{...ce,stateDirectory:z},e.host,re)}catch(te){try{if(Dn(L)?.isDirectory())y(Wt(L,ai),{version:g})}catch{}return re("failed",Tf(te)),Df(ce,L,z,l)}finally{for(let te of we.reverse())te()}}function Dc(e,l,v,D){let M=ba(l.stateDirectory);if(M.isDirectory()&&M.uid===process.getuid?.()&&(M.mode&63)!==0)Rf(l.stateDirectory,448);let L=xt(l),z=Ut(f(l).state,{proofStore:L,repair:!1});if(!z?.worker)throw new ci("identity_missing");let re=O(l);if(z.worker.configDigest===O(e))ae({...z,worker:{...z.worker,configDigest:re}},f(l).state,{proofStore:L});else if(z.worker.configDigest!==re)throw new ci("worker_config_binding_mismatch");y(Wt(l.stateDirectory,"worker.json"),l),ha.after(e,l),Wc(e,l,v);let G=Wt(l.stateDirectory,ai);if(u(G))Pf(G);return D("moved"),{saved:l,configPath:Wt(l.stateDirectory,"worker.json")}}function Wc(e,l,v){if(ss(e,l,v,"connect"),!_a(l.stateDirectory))return;let D=Of(Fr(e.stateDirectory));if(!D)return;let M=Fr(l.stateDirectory),L;try{L=M.loadBinding()}catch{return}if(!L)M.createBinding(D);Nc(e.stateDirectory)}function wa(e,l,v,D){if(e){let L=e.lock(l);if(!L)return!1;D.push(L)}if(!u(p(v)))return!0;let M=ie({path:f(v).lock,runtimeVersion:g});if(!M.acquired)return!1;return D.push(()=>M.release()),!0}function Af(e,l,v){if(u(p(l))){let M=ie({path:f(l).lock,runtimeVersion:g});if(!M.acquired)return!1;return v.push(()=>M.release()),!0}let D=Dn(Wt(e,"worker.json"));return D!==null&&Date.now()-D.mtimeMs>60000}function xf(e,l){let v=[e,...Tc(e,{withFileTypes:!0}).filter((M)=>M.isDirectory()&&!M.name.startsWith(".")).map((M)=>Wt(e,M.name))],D=[];for(let M of v)for(let L of["connect","connect-once"]){let z=Wt(M,L);if(z===l||!Dn(Wt(z,"worker.json")))continue;let re=Hc(z);if(!re||re.stateDirectory===e||re.stateDirectory.startsWith(e+Cf))D.push({directory:z,config:re})}return D}function _a(e){try{return JSON.parse(m(Wt(e,"api-key.json"))).store==="keychain"}catch{return!1}}function If(e,l){let v=Fr(e);v.deleteBinding(),v.createBinding(new TextEncoder().encode(l))}function Nc(e){try{Fr(e).deleteBinding()}catch(l){if(!(l instanceof a))throw l}}function Of(e){try{return e.loadBinding()}catch(l){if(l instanceof a)return null;throw l}}function Df(e,l,v,D){if(e?.stateDirectory!==l)return D;let M=Hc(v);return M?.stateDirectory===v?{saved:M,configPath:Wt(v,"worker.json")}:D}function Mc(e){try{return ba(e).isSymbolicLink()&&Ef(e)==="reason"}catch{return!1}}function Mf(e){try{let l=JSON.parse(m(Wt(e,ai)));return typeof l.version==="string"?l.version:null}catch{return null}}function Hc(e){try{let l=Wt(e,"worker.json");return u(l)?x.parse(JSON.parse(m(l))):null}catch{return null}}function Dn(e){try{return ba(e)}catch{return null}}function Tf(e){if(e instanceof ci)return e.code;if(e instanceof Error&&/^worker_[a-z_]+$/.test(e.message))return e.message;if(e instanceof a)return e.code;return e instanceof Error&&"code"in e&&typeof e.code==="string"?e.code:"unexpected"}import{readFileSync as Lf}from"fs";function nr(e){try{let l=JSON.parse(Lf(`${e}.keep-awake.json`,"utf8"));return l!==null&&typeof l==="object"&&"version"in l&&l.version===1&&"enabled"in l&&l.enabled===!0?"battery_and_ac":void 0}catch(l){return l.code==="ENOENT"?"battery_and_ac":void 0}}function $c(e,l){y(`${e}.keep-awake.json`,{version:1,enabled:l})}import{createHash as Aw}from"crypto";import{readdirSync as xw,realpathSync as Ts,statSync as Iw}from"fs";import{hostname as Ow}from"os";import{join as Sn,resolve as Dw}from"path";var li="cloud",Wf=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function yo(e){return Wf.test(e)&&!on.test(e)}var Nf={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings \u203A API keys) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_api_unreachable:"This computer could not reach Reason. Check its internet connection, and any VPN, proxy or firewall that lets the Reason app through but not the reason command, then try again.",worker_api_certificate_untrusted:"This computer did not trust Reason's certificate. A proxy, VPN or security software inspecting HTTPS, or a wrong clock, usually causes this: let Reason through it, then try again.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Mn(e){return Nf[e]}import{randomUUID as Hf}from"crypto";import{chmodSync as $f,lstatSync as di,mkdtempSync as Bf,realpathSync as qc,rmdirSync as Uf,rmSync as Ff,unlinkSync as jf}from"fs";import{createConnection as qf,createServer as zf}from"net";import{basename as Bc,dirname as Uc,join as un}from"path";var Kf=c(["status","drain","resume","stop","reload_roots"]),Vf=h({version:i(1),instanceId:t(),deviceId:t(),phase:c(["starting","running","reconnecting","stopping"]),drained:_(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:_(),supportedOperations:d(c(Nr)).max(Nr.length).optional(),capabilityReadiness:ul(c(Nr),_()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),Jf=h({nonce:t(),action:Kf}),Gf=n({nonce:V()}),zc=h({version:i(1),nonce:V(),socketPath:t().max(100)});function Kc(e){return un(f(e).lock,"control.json")}function ui(e){return b(f(e).lock),Gf.parse(JSON.parse(m(un(f(e).lock,"owner.json"))))}function jc(e){if(!u(e))return!1;let l=di(e);if(!l.isSocket()||l.uid!==process.getuid?.()||(l.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function Vc(e,l){let v=Kc(e);if(!u(v)){let L=f(e).socket;if(!u(L)||!di(L).isSocket())return null;return jc(L)?L:null}let D=zc.parse(JSON.parse(m(v)));if(D.nonce!==l)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!Yf.test(D.socketPath))throw Error("worker_control_endpoint_invalid");return D.socketPath}let M=Uc(D.socketPath);if(Uc(M)!==qc("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Bc(M))||Bc(D.socketPath)!=="control.sock"||Buffer.byteLength(D.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(M))return null;return b(M),jc(D.socketPath)?D.socketPath:null}var Yf=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;async function fi(e,l,v){if(ui(e).nonce!==l)throw Error("worker_instance_changed");let D=Kc(e);if(u(D))throw Error("worker_control_already_serving");let M=process.platform==="win32",L=M?null:Bf(un(qc("/tmp"),"ara-worker-")),z=L?un(L,"control.sock"):`\\\\.\\pipe\\reason-worker-${Hf()}`;if(L)b(L);if(Buffer.byteLength(z)>100)throw Error("worker_socket_path_too_long");let re=new Set,G=zf((X)=>{re.add(X),X.once("close",()=>re.delete(X)),X.setTimeout(2000,()=>X.destroy());let he="",Se=!1;X.on("error",()=>X.destroy()),X.on("data",(Re)=>{if(Se)return;if(he+=Re.toString(),Buffer.byteLength(he)>4096){X.destroy();return}if(!he.includes(`
 `))return;Se=!0;try{let Ee=Jf.parse(JSON.parse(he));if(Ee.nonce!==l){X.destroy();return}X.end(JSON.stringify(v(Ee.action))+`
-`)}catch{X.destroy()}})});G.maxConnections=32;let ce,we=!1,te=async()=>{if(we)return;we=!0;for(let X of re)X.destroy();if(await new Promise((X)=>G.close(()=>X())),ce&&u(O)){let X=mi(O);if(X.isFile()&&X.dev===ce.dev&&X.ino===ce.ino)try{let he=Kc.parse(JSON.parse(m(O)));if(he.nonce===l&&he.socketPath===z)jf(O)}catch{}}try{if(L)Uf(L)}catch{}};try{if(await new Promise((X,he)=>{G.once("error",he),G.listen(z,()=>{if(!M)$f(z,384);X()})}),pi(e).nonce!==l)throw Error("worker_instance_changed");return y(O,{version:1,nonce:l,socketPath:z}),ce=mi(O),te}catch(X){throw await te(),X}}function Gc(e,l){try{let v=JSON.parse(m(pn(f(e).lock,"owner.json"))),O=v&&typeof v==="object"?v[l]:void 0;return typeof O==="string"?O:null}catch{return null}}function ko(e){return Gc(e,"runtime_version")}function Xf(e){return Gc(e,"nonce")}function Yc(e,l){if(l)return l.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(pn(f(e).lock,"owner.json")))return"no_lock";return Jc(e,pi(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var Zf=21600000,Qf=h({instance:t().nullable(),since:o().int().nonnegative()});function em(e,l){let v=f(e).updateDeferral;try{if(!u(v))return null;let O=Qf.safeParse(JSON.parse(m(v)));if(O.success&&O.data.instance===l)return O.data.since;Ta(e)}catch{}return null}function Ta(e){try{Ff(f(e).updateDeferral,{force:!0})}catch{}}async function gi(e,l,v=()=>!1){let O=Xf(e),M=em(e,O);if(l!==void 0){let ce=ko(e);if(ce===null||ce===l&&M===null&&!v())return{state:"current"}}let L;try{let ce=await Rt(e,"status");L=ce?ce.activeSessions??ce.activeClaims:0}catch{L=null}if(L===0)return{state:"restarted"};let z=Date.now(),re=M;if(re===null){re=z;try{y(f(e).updateDeferral,{instance:O,since:re})}catch{}}let G=z-re;return{state:G<Zf?"busy":"drained",sessions:L,waitedMs:G}}async function Rt(e,l){let v=f(e);if(!u(pn(v.lock,"owner.json")))return null;let O=pi(e),M=Jc(e,O.nonce);if(!M)return null;return new Promise((L,z)=>{let re=qf(M),G="",ce=!1,we=(te,X)=>{if(ce)return;if(ce=!0,re.destroy(),X)z(X);else L(te)};re.setTimeout(2000,()=>re.destroy(Error("worker_control_timeout"))),re.on("connect",()=>re.write(JSON.stringify({nonce:O.nonce,action:l})+`
-`)),re.on("data",(te)=>{if(G+=te.toString(),Buffer.byteLength(G)>16384)re.destroy(Error("worker_control_oversize"))}),re.on("error",(te)=>{if("code"in te&&["ECONNREFUSED","ENOENT"].includes(String(te.code)))we(null);else we(null,te.message==="worker_control_timeout"?te:Error("worker_control_unavailable"))}),re.on("end",()=>{try{let te=Vf.parse(JSON.parse(G));if(te.instanceId!==O.nonce)throw Error("worker_instance_changed");we(te)}catch{we(null,Error("worker_control_invalid_response"))}}),re.once("close",()=>we(null,Error("worker_control_unavailable")))})}import{randomUUID as Fd}from"crypto";import{homedir as jd}from"os";import{spawn as tm}from"child_process";import{createRequire as rm}from"module";var Xc=2147483648,nm=1;function om(){try{let e=rm(import.meta.url)("bun:ffi"),l=e.dlopen("kernel32.dll",{SetThreadExecutionState:{args:[e.FFIType.u32],returns:e.FFIType.u32}});return(v)=>l.symbols.SetThreadExecutionState(v)}catch{return null}}function im(e,l){if(e==="ac_only"||!l)return{status:"unsupported",release:async()=>"unsupported"};let v=l((Xc|nm)>>>0)===0?"failed":"held";return{get status(){return v},async release(){if(v==="held")l(Xc);return v="failed","released"}}}async function Zc(e,l={}){let v=l.platform??process.platform;if(v==="win32")return im(e,l.setExecutionState??om());if(v!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let O,M="failed",L=!1,z,re=Promise.resolve(),G=(X)=>{if(M===X)return;M=X,l.onStatusChange?.(X)},ce=()=>{if(L||z)return;z=setTimeout(()=>{z=void 0,re=we()},l.retryMs??5000),z.unref()},we=async()=>{try{let X=(l.spawn??tm)("/usr/bin/caffeinate",[e==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(O=X,X.once("exit",()=>{if(!L&&O===X)G("failed"),ce()}),await new Promise((he,Se)=>{X.once("spawn",he),X.once("error",Se)}),X.exitCode===null&&X.signalCode===null)G("held")}catch{G("failed"),ce()}};re=we(),await re;let te;return{get status(){return M},release(){return te??=(async()=>{L=!0,clearTimeout(z),await re;let X=O;if(!X||X.exitCode!==null||X.signalCode!==null||!X.pid)return M="failed","released";let he=await new Promise((Se)=>{let Re,Ee=setTimeout(()=>{try{X.kill("SIGKILL")}catch{}Re=setTimeout(()=>Se("failed"),1000)},1000);X.once("exit",()=>{clearTimeout(Ee),clearTimeout(Re),Se("released")});try{X.kill("SIGTERM")}catch{}});if(he==="released")M="failed";return he})()}}}class Nn extends Error{constructor(){super("Reason Device operation lease expired.")}}class _i{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor(e,l,v){this.now=l;this.onExpire=v;this.clockFloor=l(),this.install(e)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let e=new Nn;if(!this.closed)this.close(),this.onExpire(e);throw e}acknowledge(e){this.assertCurrent(),this.install(e)}close(){this.closed=!0,clearTimeout(this.timer)}install(e){let l=Date.parse(e);if(!Number.isFinite(l))throw Error("Reason returned an invalid operation lease deadline.");if(l-this.clockNow()<=0)throw new Nn;this.deadline=l,clearTimeout(this.timer),this.arm()}clockNow(){let e=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,e-this.clockTick)),this.clockTick=e,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new Nn)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as dm}from"fs";import{randomUUID as um}from"crypto";import{constants as Na}from"fs";import{open as am}from"fs/promises";import{join as sm}from"path";var cm={platform:process.platform,home:s,async openFile(e){let l=await am(e,Na.O_RDONLY|Na.O_NOFOLLOW|Na.O_NONBLOCK);return{isFile:async()=>(await l.stat()).isFile(),close:()=>l.close()}}};async function Qc(e=cm){if(e.platform!=="darwin")return"unknown";try{let l=await e.openFile(sm(e.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await l.isFile()?"granted":"unknown"}finally{await l.close()}}catch(l){return l instanceof Error&&"code"in l&&["EACCES","EPERM"].includes(String(l.code))?"not_granted":"unknown"}}class Ha extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function lm(e,l,v){l.throwIfAborted();let O=new AbortController,M=()=>{},L,z=new Promise((re,G)=>{M=()=>{O.abort(l.reason),G(l.reason)},l.addEventListener("abort",M,{once:!0}),L=setTimeout(()=>{let ce=new Ha;O.abort(ce),G(ce)},v)});try{return await Promise.race([e(O.signal),z])}finally{clearTimeout(L),l.removeEventListener("abort",M),O.abort()}}function el(e){let l=0,v=0;return async(O)=>{for(;;){O.throwIfAborted(),e.lease.assertCurrent();while(performance.now()<v)await e.sleep(Math.min(v-performance.now(),e.lease.remainingMs()),O),O.throwIfAborted(),e.lease.assertCurrent();try{let M=await lm(e.send,O,Math.min(8000,e.lease.remainingMs()));return O.throwIfAborted(),e.lease.assertCurrent(),M}catch(M){let L=M instanceof Ha||(M instanceof k?or(M.status):sr(M));if(L){let z=Math.max(Math.min(500*2**Math.min(l++,4),5000),e.retryAfterMs(M));v=performance.now()+z}if(O.throwIfAborted(),e.lease.assertCurrent(),!L)throw M}}}}function Za(e,l=process.env){return!e.proxied&&l.REASON_DEVICE_SESSION!=="0"}function fl(e,l,v){let O=e?.permissionRecovery;return fr(O,v)&&O.deviceId===l.deviceId&&O.organizationId===l.orgId?{permissionRecovery:O}:{}}var fm=1000,mm=250,pm=16,hm=5000,gm=Dc(dm(process.execPath)),tl=null,rl=null;function ml(e){if(process.platform!=="darwin")return{};return rl??=Qc().then((l)=>{tl={status:l,checkedAt:e().getTime()}}).finally(()=>{rl=null}),{fullDiskAccess:{...tl??{status:"unknown",checkedAt:e().getTime()},executablePath:gm}}}var wm=8,ym=64,_m=2000,bm=2000,Qa=8000,ol=3,km=250,il=1000,al=30000,vm=0.2,Sm=30000,Rm=21600000,Em=300000,Pm=3600000,Cm=0.1,hl=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function Am(e){return Math.min(ol,Math.max(1,e??ol))}function xm(e){return typeof e.reason_code==="string"&&hl.has(e.reason_code)?e.reason_code:"cancelled"}function Ba(e){return e.reason instanceof r&&(e.reason.code==="cancelled"||hl.has(e.reason.code))?e.reason.code:"cancelled"}function sl(e){return e instanceof r&&/^[A-Za-z0-9._:-]{1,160}$/.test(e.code)?e.code:"capability_failed"}function gl(e){return e.capability==="hands.connect"&&qa(e.payload)}function Ua(e,l=Math.random){let v=Math.min(Math.max(l(),0),1);return Math.max(0,Math.floor(e*(1+v*Cm)))}function Im(e,l=Math.random){let v=Math.min(al,il*2**Math.max(0,e-1)),O=Math.min(Math.max(l(),0),1),M=v*vm*(O*2-1);return Math.min(al,Math.max(il,Math.round(v+M)))}function ts(e,l){return new Promise((v,O)=>{if(l.aborted){O(l.reason??new DOMException("Aborted","AbortError"));return}let M=()=>{clearTimeout(L),O(l.reason??new DOMException("Aborted","AbortError"))},L=setTimeout(()=>{l.removeEventListener("abort",M),v()},e);l.addEventListener("abort",M,{once:!0})})}class Fa extends Error{updateError;constructor(e){super("Managed runtime update check failed.");this.updateError=e;this.name="RuntimeUpdateCheckError"}}async function Om(e,l,v,O){let M=new AbortController,L=()=>M.abort(v.reason);if(v.aborted)L();else v.addEventListener("abort",L,{once:!0});try{return await Promise.race([e,O(l,M.signal).then(()=>({kind:"heartbeat"}))])}finally{M.abort(),v.removeEventListener("abort",L)}}function ja(e){return e instanceof Error?e.message:String(e)}function za(e,l){return l.aborted||e instanceof DOMException&&e.name==="AbortError"||e instanceof Error&&e.name==="AbortError"}function br(e){return e instanceof k&&e.status===409&&e.code==="attempt_fenced"}function Ka(e){return e.capability==="environment.install"}function Dm(e){if(e instanceof vi||e instanceof Nn||e instanceof Ro)return"timeout";if(!(e instanceof Error)||e instanceof k)return"transport_unknown";for(let l of[e,e.cause]){if(!(l instanceof Error)||l instanceof k||!("code"in l))continue;switch(l.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function vo(e,l,v){if(!e.state.worker&&!e.connectionDiagnostics)return;if(br(v))return;let O=v instanceof k&&Number.isInteger(v.status)&&v.status>=100&&v.status<=599?{stage:l,category:"http",httpStatus:v.status}:{stage:l,category:Dm(v)};e.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:O})}async function Hn(e,l,v){try{return await v()}catch(O){if(!e.signal.aborted)vo(e,l,O);throw O}}class Ro extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function Ya(e,l,v,O){let M=l.capability==="inference.custom.v1"&&v.status!=="succeeded"?{status:v.status,error_code:v.status==="cancelled"?"operation_cancelled":Lr(v.error_code)?v.error_code:"custom_endpoint_unavailable"}:Ka(l)&&v.status!=="succeeded"?{status:v.status,error_code:v.status==="cancelled"?"operation_cancelled":v.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:v,L=new AbortController,z=O?AbortSignal.any([O,L.signal]):L.signal,re=e.sleep??ts,G=e.operationCompletionTimeoutMs??Qa,ce=performance.now()+G,we,te,X=new Promise((Re,Ee)=>{let Oe=()=>{let Ce=new Ro;L.abort(Ce),Ee(Ce)},Me=(Ce)=>{clearTimeout(we),we=setTimeout(Oe,Ce)};if(te=()=>Me(Math.max(0,Math.min(ce-performance.now(),_m))),Me(G),e.signal.addEventListener("abort",te,{once:!0}),e.signal.aborted)te()}),he,Se=0;try{while(!0)try{he=await Promise.race([e.client.completeOperation(e.state,l,M,z),X]);break}catch(Re){if(z.aborted||e.signal.aborted||ee(Re)||br(Re)||!Mm(Re)||performance.now()>=ce)throw vo(e,"completion",Re),Re;Se+=1;let Ee=Math.min(500*2**Math.min(Se-1,4),Math.max(0,ce-performance.now()));if(Ee<=0)throw vo(e,"completion",Re),Re;try{await re(Ee,z)}catch{throw vo(e,"completion",Re),Re}}}finally{clearTimeout(we),e.signal.removeEventListener("abort",te),L.abort()}e.onEvent?.({type:"completed",operationId:l.operation_id,status:he.status})}function Mm(e){if(ee(e))return!1;if(br(e))return!1;if(e instanceof k)return e.status===408||e.status===429||e.status>=500&&e.status<=504;if(e instanceof Error){if(e.name==="AbortError"||e instanceof Ro)return!1;return!0}return!1}class vi extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function bi(e){if(e instanceof vi)return!0;return e instanceof k?or(e.status):sr(e)}function Tm(e,l,v,O){let M=Math.min(v,l*2**Math.min(e-1,10));return e<=1?M:Math.round(M/2+M/2*O())}function ki(e,l){if(!(e instanceof k)||!e.retryAfter)return 0;let v=e.retryAfter.trim(),O=/^\d+(?:\.\d+)?$/.test(v)?Number(v)*1000:Date.parse(v)-l;return Number.isNaN(O)?0:Math.max(0,O)}async function Lm(e,l,v,O,M){let L=new AbortController,z,re=()=>{return},G=new Promise((we,te)=>{let X=()=>{let he=O.reason??new DOMException("Aborted","AbortError");L.abort(he),te(he)};if(re=()=>O.removeEventListener("abort",X),O.aborted)X();else O.addEventListener("abort",X,{once:!0})}),ce=new Promise((we,te)=>{z=setTimeout(()=>{let X=new vi;L.abort(X),te(X)},M)});try{return await Promise.race([e.client.operationHeartbeat(e.state,l,{transientRetryOwner:"caller",...v.controlAckSeq===void 0?{}:{controlAckSeq:v.controlAckSeq},clientRetryCount:v.clientRetryCount,...v.waitMs===void 0?{}:{waitMs:v.waitMs},signal:L.signal}),G,ce])}finally{if(z!==void 0)clearTimeout(z);re()}}async function cl(e,l,v,O,M,L){let z=Am(e.operationHeartbeatMaxAttempts),re=e.operationHeartbeatAttemptTimeoutMs??Qa,G=e.operationHeartbeatRetryDelayMs??km,ce=L.remainingMs(),we=Math.min(ce,z*re+G*z*(z-1)/2);for(let te=0;te<z;te+=1)try{O.throwIfAborted(),L.assertCurrent();let X=Math.min(re,L.remainingMs()),he=await Lm(e,l,{...v,waitMs:v.waitMs===void 0?void 0:Math.min(v.waitMs,Math.max(0,Math.floor(X-1000))),clientRetryCount:te},O,X);return O.throwIfAborted(),L.acknowledge(he.lease_until),he}catch(X){if(O.aborted||te+1>=z||br(X)||ee(X)||!bi(X)){if(!O.aborted)vo(e,"operation_heartbeat",X);throw X}let he=ce-L.remainingMs(),Se=ki(X,(e.now?.()??new Date).getTime()),Re=Math.max(G*(te+1),we*(te+1)/z-he,Se);await M(Math.min(L.remainingMs(),Re),O),L.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function Wm(e,l,v,O,M){let L=gl(l),z=new AbortController,re=new AbortController,G=()=>{z.abort(e.signal.reason),re.abort(e.signal.reason)};if(e.signal.aborted)G();else e.signal.addEventListener("abort",G,{once:!0});let ce=null,we,te,X=-1,he=0,Se=Promise.resolve(),Re=[],Ee=new AbortController,Oe=!1,Me,Ce=null,Te=!1,We,$e,Fe={},Ne=(Ve)=>{Oe=!0,Ee.abort(Ve),z.abort(Ve),re.abort(Ve)},xe=(Ve)=>{if(Me)return Me;let Je=structuredClone(Ve),it=he;return Me=(async()=>{let Ye=new AbortController,Be=Ye.signal;Be.throwIfAborted();let Ke,qe=()=>{},nt=new Promise((et,He)=>{if(qe=()=>He(Be.reason),Be.addEventListener("abort",qe,{once:!0}),Ke=setTimeout(()=>Ye.abort(Error("Hands stop receipt delivery timed out.")),4000),Be.aborted)qe()});try{for(let et=0;et<3;et+=1){Be.throwIfAborted();try{let He=await Promise.race([Hn(e,"event",()=>e.client.operationEvents(e.state,l,{eventSeqStart:it,events:[Je],signal:Be,transientRetryOwner:"caller"})),nt]);if(Be.throwIfAborted(),He.next_event_seq!==it+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");he=He.next_event_seq;return}catch(He){if(ee(He))M(He);let at=He instanceof k?or(He.status):sr(He);if(Be.aborted||!at||et===2)throw He;let mt=Math.max(500*2**et,ki(He,(e.now?.()??new Date).getTime()));await Promise.race([v(mt,Be),nt])}}}finally{clearTimeout(Ke),Be.removeEventListener("abort",qe),Ye.abort()}})(),Me},Le=(Ve,Je,it)=>{let Ye=(Ke)=>Hn(e,"event",()=>e.client.operationEvents(e.state,l,{eventSeqStart:Je,events:Ve,signal:Ke,...it?{transientRetryOwner:"caller"}:{}})).catch((qe)=>{if(l.capability==="hands.connect"&&br(qe))Ne(qe);if(it&&(ee(qe)||br(qe))){if(ee(qe))M(qe);z.abort(qe),re.abort(qe),Ee.abort(qe)}throw qe});if(!it)return async(Ke)=>{if(l.capability!=="hands.connect"&&l.capability!=="inference.custom.v1"){he=(await Ye(Ke)).next_event_seq;return}Ke.throwIfAborted();let qe=()=>{},nt=new Promise((et,He)=>{qe=()=>He(Ke.reason),Ke.addEventListener("abort",qe,{once:!0})});try{let et=await Promise.race([Ye(Ke),nt]);Ke.throwIfAborted(),he=et.next_event_seq}finally{Ke.removeEventListener("abort",qe)}};let Be=el({send:Ye,lease:$e,sleep:v,retryAfterMs:(Ke)=>ki(Ke,(e.now?.()??new Date).getTime())});return async(Ke)=>{let qe=await Be(Ke);if(qe.next_event_seq!==Je+Ve.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");he=qe.next_event_seq}},Ge=async(Ve,Je)=>{let it=Ve??await cl(e,l,{controlAckSeq:X,waitMs:Je},re.signal,v,$e),Ye=null,Be=!1;for(let Ke=0;Ke<10;Ke+=1){let qe=X+1;for(let nt of it.controls){if(nt.seq!==qe)throw Error("Reason returned an out-of-order Device operation control.");if(nt.kind==="cancel"||nt.kind==="operation.cancel")Ye??=xm(nt.payload),z.abort(new r(Ye,"Reason closed the Device operation."));if(nt.kind!=="cancel"&&nt.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(l.capability)){let et,He,at=new Promise((mt,kt)=>{et=mt,He=kt});at.catch(()=>{}),Fe.current={promise:at,resolve:et,reject:He}}try{Be||=!await e.onControl?.(l,nt)}catch(et){if(et instanceof r)we??=sl(et);throw Fe.current?.reject(et),et}}X=nt.seq,qe+=1}if(it.controls.length===0){if(it.next_control_seq!==X+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:Ye,unsupported:Be}}try{it=await cl(e,l,{controlAckSeq:X},re.signal,v,$e),Fe.current?.resolve()}catch(nt){if(Fe.current?.reject(nt),!Ye||br(nt)||ee(nt))throw nt;return{cancellationReason:Ye,unsupported:Be}}}throw Error("Reason returned too many Device operation control batches.")};try{let Ve;try{if(!L)$e=new _i(l.lease_until,()=>(e.now?.()??new Date).getTime(),(Je)=>{if(!z.signal.aborted)ce=Je;z.abort(Je),re.abort(Je)});Ve=L||l.capability==="hands.connect"||l.capability==="display.stream.v1"||l.capability==="simulator.stream.v1"||Gr.has(l.capability)||l.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await Ge()}catch(Je){if(!Ka(l)||br(Je)||ee(Je))throw Je;await Ya(e,l,{status:e.signal.aborted?"cancelled":"failed"});return}if(Ve.cancellationReason||e.signal.aborted){let Je=Ve.cancellationReason??Ba(e.signal);z.abort(new r(Je,"Reason closed the Device operation.")),te={status:"cancelled",error_code:Je}}else if(Ve.unsupported)z.abort(),te={status:"failed",error_code:"control_unsupported"};else{let Je=L?Promise.resolve():(async()=>{let Ye=e.operationHeartbeatIntervalMs??e.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(l.capability)?bm:15000),Be=Math.min(Ye,Math.max(0,(e.operationHeartbeatAttemptTimeoutMs??Qa)-1000)),Ke=l.capability==="hands.connect"||l.capability==="pty.start"||l.capability==="display.stream.v1"||l.capability==="simulator.stream.v1"||l.capability==="browser.recording.v1"||l.capability==="browser.pr-proof.v1"||l.capability==="process.run.v1"||l.capability==="process.full.v1"||l.capability==="preview.serve.v1"||l.capability==="inference.custom.v1";while(!re.signal.aborted)try{if(!Ke){if(await v(Ye,re.signal),re.signal.aborted)return}let qe=await Ge(void 0,Ke?Be:void 0);if(qe.cancellationReason||qe.unsupported){if(qe.unsupported)ce=Error("Reason requested an unsupported Device operation control.");z.abort(qe.cancellationReason?new r(qe.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(qe){if(ee(qe))M(qe);if(br(qe))ce=qe,Ne(qe);if(!re.signal.aborted)ce=qe,z.abort();return}})();try{if($e?.assertCurrent(),z.signal.throwIfAborted(),O.authorized=()=>!z.signal.aborted&&(L||($e?.remainingMs()??0)>0),te=await e.onClaim(l,z.signal,async(Ye)=>{if(Ka(l))return;if(Ye.kind==="permission.denied"){if(!O.authorized())return;let at=Ye.data,mt=(e.now??(()=>new Date))().getTime(),kt=e.statusPath??mr(),qt=(e.loadStatus??tt)(kt),Kt={id:um(),kind:"permission_denied",operation:at?.operation,provenance:at?.provenance,occurredAt:new Date(mt).toISOString(),expiresAt:new Date(mt+600000).toISOString(),sessionId:l.run_id,deviceId:e.state.deviceId,organizationId:e.state.orgId};if(qt&&fr(Kt,mt)){let pr=qt.permissionRecovery;if(!pr||!fr(pr,mt)||pr.sessionId!==Kt.sessionId||pr.operation!==Kt.operation||pr.provenance!==Kt.provenance)(e.saveStatus??wi)({...qt,permissionRecovery:Kt},kt)}return}let Be=l.capability==="hands.connect"&&Ye.capability==="hands.connect"&&Ye.kind==="hands.stopped",Ke=l.capability==="hands.connect"&&Ye.kind==="hands.reconnected",qe=Ke||l.capability==="inference.custom.v1"?AbortSignal.any([z.signal,Ee.signal,...Ye.deliverySignal?[Ye.deliverySignal]:[]]):l.capability==="hands.connect"?AbortSignal.any([e.signal,Ee.signal]):e.signal,nt={kind:Ye.kind,payload:{sequence:Ye.sequence,capability:Ye.capability,...Ye.data?{data:Ke?structuredClone(Ye.data):Ye.data}:{}}};if(l.capability==="hands.connect"&&Ye.capability==="hands.connect"&&(Ye.kind==="started"||Ye.kind==="hands.started")||(Gr.has(l.capability)||l.capability==="pty.start")&&Ye.kind==="started")return new Promise((at,mt)=>{Re.push({wireEvent:nt,settle:(kt)=>kt===void 0?at():mt(kt)})});let et=Re;Re=[];let He=Se.then(async()=>{if((Oe||e.signal.aborted)&&l.capability==="hands.connect"&&!L){if(Be)await xe(nt);return}if(Ce!==null){if(Ye.kind!=="hands.stopped"||!Te||!We)throw Ce;let mt=new AbortController,kt=AbortSignal.any([e.signal,Ee.signal,mt.signal]),qt=setTimeout(()=>mt.abort(Error("Hands stop receipt reconciliation timed out.")),4000);Te=!1;try{await We(kt),We=void 0,await Le([nt],he,!0)(kt),Ce=null}catch(Kt){throw Ce=Kt??Error("Hands stop receipt could not be confirmed."),Kt}finally{clearTimeout(qt),mt.abort()}return}if(Ke&&!$e){let mt=Math.min(Date.parse(l.lease_until),Date.parse(String(l.payload.expires_at)));$e=new _i(new Date(mt).toISOString(),()=>(e.now?.()??new Date).getTime(),(kt)=>{z.abort(kt),re.abort(kt)})}let at=he;if(Ke)We=Le([...et.map((mt)=>mt.wireEvent),nt],at,!0),await We(qe),We=void 0;else await Le([...et.map((mt)=>mt.wireEvent),nt],at,!1)(qe)});He.then(()=>{for(let at of et)at.settle()},(at)=>{for(let mt of et)mt.settle(at??Error("Hands event delivery failed."))}),Se=He.catch((at)=>{if(ee(at))M(at);if(Ke){if(Ce===null)Te=qe.aborted&&!Ee.signal.aborted,Ce=at??Error("Hands generation receipt delivery failed.");if(!qe.aborted)z.abort(at),re.abort(at)}}),await He}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(l.capability))await Fe.current?.promise}catch(Ye){te=z.signal.aborted?{status:"cancelled",error_code:Ba(z.signal)}:{status:"failed",error_code:sl(Ye)}}finally{O.authorized=()=>!1,Ee.abort();for(let Ye of Re.splice(0))Ye.settle();re.abort(),await Je}let it=Jn(l.capability)?Ra(te.result,l.operation_id):null;if(ce){if(ee(ce))throw ce;te={status:"failed",error_code:we??"control_or_heartbeat_failed",...it?{result:it}:{}}}else if(z.signal.aborted&&te.status==="succeeded")te={status:"cancelled",error_code:Ba(z.signal),...it?{result:it}:{}}}if($e?.close(),ee(e.signal.reason))throw e.signal.reason;await Ya(e,l,te)}finally{$e?.close(),Ee.abort(),re.abort(),e.signal.removeEventListener("abort",G)}}async function rs(e){let l=e.now??(()=>new Date),v=e.sleep??ts,O=e.saveStatus??wi,M=e.loadStatus??tt,L=e.statusPath??mr(),z=l().toISOString(),re=M(L)?.lastUsedAt,G=!1,ce=()=>({version:1,pid:process.pid,startedAt:z,...ml(l),...fl(M(L),e.state,l().getTime()),deviceId:e.state.deviceId,...e.idleSleepPolicy||e.readIdleSleepPolicy?{idleSleepHold:G}:{},...re?{lastUsedAt:re}:{}}),we=0,te,X=!1,he,Se,Re,Ee=Promise.resolve();O({...ce(),state:"starting"},L),e.onEvent?.({type:"started",deviceId:e.state.deviceId}),Aa();try{let Oe=async()=>{let Me=e.readIdleSleepPolicy?e.readIdleSleepPolicy():e.idleSleepPolicy;if(e.signal.aborted||Me===Se)return;if(he&&Se){let We=await he.release();if(e.onEvent?.({type:"idle_sleep",status:We,policy:Se}),We==="failed")return;he=void 0,Se=void 0,G=!1;let $e=M(L);if($e)O({...$e,idleSleepHold:G},L)}if(!Me)return;Se=Me;let Ce=!0;he=await(e.acquireAwakeHold??Zc)(Me,{onStatusChange:(We)=>{if(Ce)return;G=We==="held";let $e=M(L);if($e)O({...$e,idleSleepHold:G},L);e.onEvent?.({type:"idle_sleep",status:We,policy:Me})}}),Ce=!1,G=he.status==="held";let Te=M(L);if(Te)O({...Te,idleSleepHold:G},L);e.onEvent?.({type:"idle_sleep",status:he.status,policy:Me})};if(await Oe(),e.readIdleSleepPolicy)Re=setInterval(()=>{Ee=Ee.then(Oe).catch(()=>{e.onEvent?.({type:"idle_sleep",status:"failed",policy:Se??"battery_and_ac"})})},e.idleSleepPollMs??1000),Re.unref();while(!e.signal.aborted){let Me=!1;try{await Nm({...e,saveStatus:(Ce,Te)=>{if(Ce.state==="starting"||Ce.state==="error"||Ce.state==="stopped")return;re=Ce.lastUsedAt??re,O({...Ce,startedAt:z,...e.idleSleepPolicy||e.readIdleSleepPolicy?{idleSleepHold:G}:{}},Te)},onEvent:(Ce)=>{if(Ce.type==="error"&&Ce.diagnostic){e.onEvent?.(Ce);return}if(Ce.type==="started"||Ce.type==="error"||Ce.type==="stopped")return;if(Ce.type==="heartbeat"&&we>0&&!Me){Me=!0;let Te=we;we=0,te=void 0,e.onEvent?.({type:"reconnected",attempts:Te})}e.onEvent?.(Ce)}});return}catch(Ce){if(za(Ce,e.signal))return;if(ee(Ce)){X=!0;let We=e.state.worker?"worker_connection_failed":ja(Ce);throw O({...ce(),state:"error",error:We},L),e.onEvent?.({type:"error",message:We}),Ce}we+=1;let Te=Im(we,e.reconnectRandom);te??=l().toISOString(),O({...ce(),state:"starting",reconnectingSince:te},L),e.onEvent?.({type:"reconnecting",message:e.state.worker?"worker_connection_failed":ja(Ce),attempt:we,retryInMs:Te}),await v(Te,e.signal)}}}catch(Oe){if(!za(Oe,e.signal))throw Oe}finally{if(e.client.close?.(),clearInterval(Re),await Ee,he&&Se){let Oe=await he.release();G=Oe==="failed"&&he.status==="held",e.onEvent?.({type:"idle_sleep",status:Oe,policy:Se})}if(!X)O({...ce(),state:"stopped"},L);else{let Oe=M(L);if(Oe)O({...Oe,idleSleepHold:G},L)}e.onEvent?.({type:"stopped"})}}async function Nm(e){let l=e.now??(()=>new Date),v=e.sleep??ts,O=e.statusPath??mr(),M=e.saveStatus??wi,L=e.loadStatus??tt,z=l().toISOString(),re=L(O)?.lastUsedAt,G=e.runtimeUpdate,ce=new AbortController,we=()=>ce.abort(e.signal.reason);if(e.signal.aborted)we();else e.signal.addEventListener("abort",we,{once:!0});let te=G?.random??Math.random,X=e.maxConcurrentClaims,he=typeof X==="number"&&Number.isSafeInteger(X)&&X>0?Math.min(ym,X):wm,Se=0,Re=!1,Ee=null,Oe=(rt)=>{Ee??=rt,ce.abort(rt)},Me=new Map,Ce=()=>{let rt=new Set,_t=0;for(let{claim:$r}of Me.values()){let Xe=$r.capability==="hands.connect"?$r.payload[pe]:void 0;if(typeof Xe==="string"){if(rt.has(Xe))continue;rt.add(Xe)}_t+=1}return _t},Te=null,We=()=>[...Me.values()].some((rt)=>rt.authorized()),$e=()=>[...Me.values()].every((rt)=>rt.claim.capability==="preview.serve.v1"),Fe=G?new Date(z).getTime()+Ua(G.initialDelayMs??Sm,te):Number.POSITIVE_INFINITY,Ne=null,xe=!1,Le=e.firstHeartbeat,Ge=Le?.account_root_metadata_supported===!0,Ve=Le?.workspace_root_metadata_supported===!0,Je=Le?.account_root_path_supported===!0,it=Le?.home_contained_roots_supported===!0,Ye=Le?.root_paths_supported===!0,Be=Le?.startup_supported===!0,Ke=Le!==void 0,qe=Le?{challenge:Le.challenge,expires_at:Le.expires_at}:void 0,nt,et=!e.startup,He=()=>({version:1,pid:process.pid,startedAt:z,...ml(l),...fl(L(O),e.state,l().getTime()),...re?{lastUsedAt:re}:{},deviceId:e.state.deviceId,...Ne?{organizationId:Ne.organization_id,organizationName:Ne.organization_name,organizationSlug:Ne.organization_slug}:{}}),at=()=>{let rt=(e.advertised??e.claimable)?.()!==!1;if(!et)nt??=e.startup?.();return{...e.deviceMetadata?.device_model!=null?{device_model:e.deviceMetadata.device_model}:{},...e.deviceMetadata?.device_chip!=null?{device_chip:e.deviceMetadata.device_chip}:{},...e.deviceMetadata?.device_location!=null?{device_location:e.deviceMetadata.device_location}:{},reason_runtime_version:e.runtimeVersion,bridge_version:e.bridgeVersion,protocol_version:e.protocolVersion,execution_eligible:rt,...Be&&!et&&nt?{startup:nt}:{},capabilities:rt?Ea(e.capabilities,{accountRootMetadataSupported:Ge,workspaceRootMetadataSupported:Ve,accountRootPathSupported:Je,homeContainedRootsSupported:it,rootPathsSupported:Ye}):{supported_operations:[]}}},mt=()=>{if(xe||!e.client.identity)return;xe=!0,e.client.identity(e.state,e.signal).then((rt)=>{if(rt.organization_id!==e.state.orgId)return;Ne=rt;let _t=L(O);if(!_t)return;M({..._t,organizationId:rt.organization_id,organizationName:rt.organization_name,organizationSlug:rt.organization_slug},O)}).catch(()=>{return})},kt=(rt)=>{Ge=rt.account_root_metadata_supported===!0,Ve=rt.workspace_root_metadata_supported===!0,Je=rt.account_root_path_supported===!0,it=rt.home_contained_roots_supported===!0,Ye=rt.root_paths_supported===!0,Be=rt.startup_supported===!0,Ke=!1},qt=(rt)=>{if(rt.startup)et=!0},Kt=(rt,_t)=>{if(!(_t instanceof k&&_t.status===400&&_t.code==="invalid_heartbeat")||!rt.startup&&!Ke)throw _t;if(et=!0,Ke)Ge=Ve=Je=!1,it=Ye=Be=Ke=!1;return null},pr=(rt)=>{kt(rt),M({...He(),state:"connected",lastHeartbeatAt:l().toISOString()},O),mt(),e.onEvent?.({type:"heartbeat",serverTime:rt.server_time,drain:rt.drain,...rt.latest_cli_versions?{latestCliVersions:rt.latest_cli_versions}:{},...rt.hands_prespawn?{handsPrespawn:!0}:{}})},on=!1,An=!1;e.registerHeartbeatNow?.(()=>{if(e.signal.aborted)return;if(on)An=!0;let rt=at();Hn(e,"heartbeat",()=>e.client.heartbeat(e.state,rt,ce.signal).catch((_t)=>Kt(rt,_t))).then((_t)=>{if(!_t)return;qt(rt),kt(_t),pr(_t)},()=>{return})});let Hr=(rt)=>v(rt,e.signal);M({...He(),state:"starting"},O),e.onEvent?.({type:"started",deviceId:e.state.deviceId});let Ir=!1,an=e.maxConsecutiveHeartbeatFailures??3,Or=0,er=0,On=0,jo=0,sn=null;try{while(!e.signal.aborted){if(Ee)throw Ee;if(Re&&$e())break;let rt,_t=er>0&&er<pm&&performance.now()-jo<hm&&sn!==null;if(!_t)er=0;e:{if(_t&&sn){rt=sn;break e}let vt=at(),rr=qe;qe=void 0,on=!0,An=!1;try{let At=await Hn(e,"heartbeat",()=>e.client.heartbeat(e.state,vt,ce.signal,...rr?[rr]:[]).catch((Rr)=>Kt(vt,Rr)));if(on=!1,!At)continue;rt=At,qt(vt),jo=performance.now(),Or=0}catch(At){if(on=!1,e.signal.aborted)break;if(!bi(At))throw At;if(Or+=1,Or>=an&&!We())throw At;await v(Math.min(e.heartbeatRetryDelayMs??2000,e.heartbeatIntervalMs??15000),e.signal);continue}if(kt(rt),Object.keys(at().capabilities).length>Object.keys(vt.capabilities).length)continue;if(An)continue;if(pr(rt),Ee)throw Ee;if(e.signal.aborted)break;if(G&&["available","required"].includes(rt.update_policy??""))Fe=Math.min(Fe,l().getTime());if(G&&l().getTime()>=Fe)try{let At=new AbortController,Rr=()=>At.abort(e.signal.reason);if(e.signal.aborted)Rr();else e.signal.addEventListener("abort",Rr,{once:!0});let Br;try{Br=G.check(At.signal)}catch(Ft){Br=Promise.reject(Ft)}let dn=Br.then((Ft)=>({kind:"completed",result:Ft}),(Ft)=>({kind:"failed",error:Ft})),Ur;try{while(!0){let Ft=await Om(dn,e.heartbeatIntervalMs??15000,e.signal,v);if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");if(Ft.kind==="failed")throw new Fa(Ft.error);if(Ft.kind==="completed"){Ur=Ft.result;break}try{let Gt=at(),no=await Hn(e,"heartbeat",()=>e.client.heartbeat(e.state,Gt,ce.signal).catch((qo)=>Kt(Gt,qo)));if(!no)continue;rt=no,qt(Gt),pr(rt),Or=0}catch(Gt){if(e.signal.aborted)throw Gt;if(!bi(Gt))throw Gt;if(Or+=1,Or>=an&&!We())throw Gt}}}catch(Ft){At.abort(Ft);let Gt=await dn;if(Gt.kind==="completed"&&Gt.result==="activated")Ur="activated";else throw Ft}finally{e.signal.removeEventListener("abort",Rr)}if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");if(Se=0,Ur==="activated"){if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");e.onEvent?.({type:"runtime_updated"}),Re=!0}Fe=l().getTime()+Ua(G.intervalMs??Rm,te)}catch(At){if(!(At instanceof Fa))throw At;Se+=1;let Rr=G.retryBaseMs??Em,Br=G.retryMaxMs??Pm,dn=Math.min(Br,Rr*2**Math.min(Se-1,8));Fe=l().getTime()+Ua(dn,te)}}if(sn=rt,e.signal.aborted)break;if(Re&&$e())break;if(Re){await Hr(e.heartbeatIntervalMs??15000);continue}let $r=e.client.sessionCadence?.(e.state)??null,Xe=$r?.presenceIntervalMs??e.heartbeatIntervalMs??15000;if(rt.drain||e.claimable?.()===!1){er=0,await Hr(Xe);continue}if(Ce()>=he){er=0;let vt=new AbortController;Te=vt;try{await v(Xe,AbortSignal.any([e.signal,vt.signal]))}catch(rr){if(!vt.signal.aborted)throw rr}finally{if(Te===vt)Te=null}continue}let st,Ct=_t?0:$r?.claimWaitMs??Math.min(e.heartbeatIntervalMs??15000,30000),Vt=performance.now();try{st=await Hn(e,"claim",()=>e.client.claimOperation(e.state,{waitMs:Ct,signal:ce.signal}))}catch(vt){if(er=0,e.signal.aborted||!bi(vt)||!We())throw vt;On+=1;let rr=Math.min(e.heartbeatRetryDelayMs??2000,e.heartbeatIntervalMs??15000);await Hr(Math.max(Tm(On,rr,Math.max(rr,Ct),te),ki(vt,(e.now?.()??new Date).getTime())));continue}if(On=0,Ee)throw Ee;if(!st){if(_t){er=0;continue}if(performance.now()-Vt<Ct-mm)await Hr(fm);continue}if(e.claimable?.()===!1){er=0,await Ya(e,st,{status:"cancelled",error_code:"execution_authority_withdrawn"},e.signal);continue}re=l().toISOString(),M({...He(),state:"connected",lastHeartbeatAt:l().toISOString()},O),e.onEvent?.({type:"claim",operationId:st.operation_id,runId:st.run_id,attemptId:st.attempt_id,capability:st.capability});let Mt,gr={authorized:()=>!1,claim:st};if(Mt=Wm({...e,signal:ce.signal},st,v,gr,Oe).catch((vt)=>{if(ee(vt))Oe(vt);else if(!br(vt)&&[...Me].some(([rr,At])=>rr!==Mt&&At.authorized())){if(vt instanceof Ro)e.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!br(vt)&&Ee===null)Ee=vt}).finally(()=>{Me.delete(Mt),Te?.abort(),e.onEvent?.({type:"claims_changed",activeClaims:Me.size})}),Me.set(Mt,gr),e.onEvent?.({type:"claims_changed",activeClaims:Me.size}),er+=1,gl(st)){if(er=0,await Mt,Ee)throw Ee}}}catch(rt){if(!za(rt,e.signal)){ce.abort(rt),Ir=!0;let _t=e.state.worker?"worker_connection_failed":ja(rt);throw M({...He(),state:"error",error:_t},O),e.onEvent?.({type:"error",message:_t}),rt}}finally{if(ce.abort(),await Promise.allSettled(Me.keys()),e.signal.removeEventListener("abort",we),!Ir)M({...He(),state:"stopped"},O);e.onEvent?.({type:"stopped"})}}import{execFile as dp}from"child_process";import{constants as Al,existsSync as up,mkdtempSync as as,rmSync as Dl}from"fs";import{access as xl,open as fp,readFile as Il,readlink as mp,readdir as Ol,unlink as pp,rmdir as hp}from"fs/promises";import{tmpdir as gp}from"os";import{basename as ss,join as Ei}from"path";import{randomUUID as hn}from"crypto";import{chmodSync as Hm,closeSync as $m,fsyncSync as Bm,openSync as Um,readFileSync as Fm,rmdirSync as wl,unlinkSync as yl,writeFileSync as jm}from"fs";import{createConnection as qm,createServer as zm}from"net";import{dirname as Km,join as Vm}from"path";var Jm=5000;async function _l(e,l,v){if(v.aborted)return!1;let O={generation:1,fenceId:hn()},M={runId:hn(),deviceId:hn(),rootId:hn(),apiOrigin:e.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>O},L=ni(l,M),z={version:1,snapshot_id:hn(),revision:1,run_id:M.runId,device_id:M.deviceId,root_id:M.rootId,binding:{...M.binding,target_generation:O.generation,target_fence_id:O.fenceId},expires_at:new Date(M.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return L.install(z).installed&&L.current().snapshot_id===z.snapshot_id&&!v.aborted}catch{return!1}finally{try{yl(L.path)}catch{}}}async function bl(e,l,v=Lt){if(l.aborted)return!1;let O,M,L=new Set,z=hn(),re=zm((X)=>{L.add(X),X.once("close",()=>L.delete(X)),X.on("error",()=>X.destroy()),X.end(z)});re.maxConnections=1;let G,ce,we=new Promise((X)=>{ce=()=>X(!1)}),te=setTimeout(ce,Jm);l.addEventListener("abort",ce,{once:!0});try{O=v({runtimeDirectory:p(e),root:e.workspaceRoot,runId:`readiness-${hn()}`}),M=Vm(O.journalDirectory,"readiness.json");let X=Um(M,"wx",384);try{jm(X,z),Bm(X)}finally{$m(X)}if(Fm(M,"utf8")!==z||l.aborted)return!1;let he=new Promise((Se)=>{re.once("error",()=>Se(!1)),re.listen(O.socketPath,()=>{try{if(process.platform!=="win32")Hm(O.socketPath,384)}catch{Se(!1);return}G=qm(O.socketPath);let Re="";G.setEncoding("utf8"),G.once("error",()=>Se(!1)),G.on("data",(Ee)=>{if(Re+=Ee,Re.length>z.length)G?.destroy(),Se(!1)}),G.once("end",()=>Se(Re===z)),G.once("close",()=>Se(!1))})});return await Promise.race([he,we])&&!l.aborted}catch{return!1}finally{clearTimeout(te),l.removeEventListener("abort",ce),G?.destroy();for(let X of L)X.destroy();if(await new Promise((X)=>re.close(()=>X())),O?.disposeSocket(),M)try{yl(M)}catch{}if(O){try{wl(O.journalDirectory)}catch{}try{wl(Km(O.journalDirectory))}catch{}}}}import{execFileSync as Si}from"child_process";import{randomUUID as dr}from"crypto";import{chmodSync as kl,chownSync as El,closeSync as ns,constants as Wr,existsSync as Gm,fstatSync as Pl,mkdirSync as vl,mkdtempSync as Ym,openSync as os,readFileSync as Xm,readSync as Zm,realpathSync as Qm,rmdirSync as ep,rmSync as tp}from"fs";import{join as gn}from"path";import{fileURLToPath as rp}from"url";var Sl=1e4,np=!1;function Ri(){if(process.platform!=="linux")return!1;return np||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some((e)=>{try{let l=Si(e,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),v=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(l);return v!==null&&Number(v[1])*100+Number(v[2])>=302}catch{return!1}})}var op=Buffer.from([0,255,3,4]);function Rl(e){return`printf "%s\\n" ${e==="foreground"?"$$":"$!"} > ${e}.pid.tmp; /bin/mv ${e}.pid.tmp ${e}.pid`}function ip(e,l,v){if(!Number.isSafeInteger(l)||l<2||!Number.isSafeInteger(v)||v<2||e.length>4096||!e.startsWith(`${l} (`))return!1;let O=e.lastIndexOf(") ");if(O<0)return!1;let M=e.slice(O+2).trim().split(/\s+/);return M.length>=20&&/^[A-Za-z]$/.test(M[0])&&/^\d+$/.test(M[1])&&M[2]===String(l)&&M[3]===String(v)&&/^[1-9][0-9]*$/.test(M[19])}async function Po(e,l={}){if(process.platform==="win32")return!e.aborted&&fi();if(e.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let v=J(),{directory:O,root:M,runtimeDirectory:L}=cp(v),z=new AbortController,re=()=>z.abort();e.addEventListener("abort",re,{once:!0});let G;z.signal.addEventListener("abort",()=>G?.close(),{once:!0});let ce=setTimeout(re,Sl),we={organization_id:dr(),user_id:dr(),device_id:dr()},te=dr(),X=dr(),he=dr(),Se=dr(),Re=Date.now()+Sl,Ee={kind:"workspace_source",target_revision:0,root_grant_revision:1},Oe=dr().replaceAll("-",""),Me,Ce=Buffer.alloc(0),Te,We=!1,$e=!1,Fe=!1,Ne=!1,xe,Le,Ge,Ve=async(it)=>{while(!it()){if(z.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((Ye)=>setTimeout(Ye,20))}if(z.signal.aborted)throw Error("pty_probe_cancelled")},Je=!1;try{G=ap(O,v),xe=Bun.serve({hostname:"127.0.0.1",port:0,fetch(Be,Ke){let qe=new URL(Be.url).pathname,nt=qe===`/device/hands/${Oe}`?"hands":qe===`/device/pty/${Oe}`?"pty":null;if(nt&&Ke.upgrade(Be,{data:{lane:nt}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(Be){if(Be.data.lane==="pty")Me=Be},message(Be,Ke){if(Be.data.lane!=="pty")return;if(typeof Ke==="string"){try{if(JSON.parse(Ke).t==="open")We=!0}catch{re()}return}if(Ce.length+Ke.length>8192){re();return}Ce=Buffer.concat([Ce,Ke])}}});let it=`ws://127.0.0.1:${xe.port}`;if(Le=Qe({headless:!0,managedPty:{version:1},root:M,runtimeDirectory:L,runId:te,operationId:dr(),attemptId:dr(),claimOwner:we,deviceIdentity:{deviceId:we.device_id,rootId:X,apiOrigin:"https://worker-probe.invalid"},signal:z.signal,payload:{relay_url:`${it}/device/hands/${Oe}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(Re).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:F,hands_worker_version:U,hands_worker_artifact_sha256:R,hands_worker_entrypoint:H,target_generation:1,target_fence_id:he,environment_binding:Ee,[E]:_e},emitEvent:async(Be)=>{if(Be==="hands.started")Ne=!0;if(Be==="hands.ready")$e=!0;if(Be==="hands.stopped")Fe=!0}},{browserExecutablePath:null,slot:Eo(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:rp(new URL("./worker-candidate-entry.ts",import.meta.url)),...l}).catch(()=>{if(!$e)re()}),await Ve(()=>$e),Ze({root:M,runId:te,payload:{version:1,snapshot_id:Se,revision:1,run_id:te,root_id:X,device_id:we.device_id,binding:{...Ee,target_generation:1,target_fence_id:he},expires_at:new Date(Re).toISOString(),variables:{PTY_PROBE_VALUE:Oe},git:null}}),Ge=Xr({root:M,runId:te,rootId:X,deviceId:we.device_id,owner:we,workspace:{kind:"root"},authority:{device_id:we.device_id,binding:Ee.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:he},signal:z.signal,session:{jobId:`pty-${dr()}`,sessionId:"pty-readiness",operationId:dr(),cols:80,rows:24,leaseExpiresAtMs:Re,relayUrl:`${it}/device/pty/${Oe}`},emit:async(Be,Ke)=>{if(Be==="pty.ready")Te=Ke}}).catch(()=>{re()}),await Ve(()=>Boolean(Te&&Me&&We)),Me.send(JSON.stringify({t:"resize",cols:100,rows:30})),Me.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${Oe}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${G.wait("background")}) & ${Rl("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${Rl("foreground")}; ${G.wait("foreground")}'
-`)),await Ve(()=>Gm(gn(M,"foreground.pid"))&&Ce.includes(op)),!Ce.includes("30 100")||Te.job.environmentSnapshotId!==Se||Te.job.environmentRevision!==1)return!1;let Ye=["background.pid","foreground.pid"].map((Be)=>sp(gn(M,Be)));if(new Set(Ye).size!==2||Ye.some((Be)=>!Number.isSafeInteger(Be)||Be<2||Be===Te.job.process.pid))return!1;if(process.platform==="linux"){if(!Ye.every((Be)=>ip(Xm(`/proc/${Be}/stat`,"utf8"),Be,Te.job.process.pid)))return!1}else{let Ke=Si("/bin/ps",["-o","pid=,pgid=","-p",Ye.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((qe)=>qe.trim().split(/\s+/).map(Number));if(Ke.length!==2||new Set(Ke.map(([qe])=>qe)).size!==2||Ke.some((qe)=>qe.length!==2||!Ye.includes(qe[0])||qe[0]!==qe[1]))return!1}if(Me.send(JSON.stringify({t:"close"})),await Ge,z.signal.aborted)return!1;for(let Be of[Te.job.process.pid,...Ye])try{return process.kill(Be,0),!1}catch(Ke){if(!(Ke instanceof Error&&("code"in Ke)&&Ke.code==="ESRCH"))return!1}Je=!0}catch{Je=!1}finally{if(clearTimeout(ce),e.removeEventListener("abort",re),re(),G?.close(),await Ge,await Le,await xe?.stop(!0),!Ne||Fe)lp({directory:O,root:M},v)}return Je&&Fe&&!e.aborted}function ap(e,l){let v={foreground:gn(e,"foreground.lifeline"),background:gn(e,"background.lifeline")};if(!Object.values(v).every((L)=>/^\/[A-Za-z0-9/._-]+$/.test(L)))throw Error("pty_probe_path");Si("/usr/bin/mkfifo",["-m","0600",...Object.values(v)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let O=[],M=()=>{for(let L of O.splice(0))ns(L)};try{for(let L of Object.values(v)){let z=os(L,Wr.O_RDONLY|Wr.O_NONBLOCK|Wr.O_NOFOLLOW);try{if(O.push(os(L,Wr.O_WRONLY|Wr.O_NONBLOCK|Wr.O_NOFOLLOW)),!Pl(O.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{ns(z)}if(l)El(L,l.uid,l.gid)}}catch(L){throw M(),L}return{wait:(L)=>`exec 3<>${v[L]} <${v[L]} 3>&-; exec /bin/cat`,close:M}}function Cl(e=(l)=>Po(l)){let l=new AbortController,v=JSON.stringify(J()),O=(async()=>{try{return await e(l.signal)===!0&&!l.signal.aborted}catch{return!1}})();return{result:O,matches:(M)=>M.executionMode==="host"&&JSON.stringify(J())===v,stop:async(M=1500)=>{l.abort();let L;await Promise.race([O,new Promise((z)=>{L=setTimeout(z,M)})]),clearTimeout(L)}}}function sp(e){let l;try{l=os(e,Wr.O_RDONLY|Wr.O_NOFOLLOW|Wr.O_NONBLOCK)}catch{return Number.NaN}try{let v=Pl(l);if(!v.isFile()||v.size>32)return Number.NaN;let O=Buffer.alloc(32),M=Zm(l,O,0,O.length,0),L=O.subarray(0,M).toString("utf8").trim();return/^[0-9]{1,10}$/.test(L)?Number(L):Number.NaN}catch{return Number.NaN}finally{ns(l)}}function cp(e,l=Qm("/tmp")){let v=Ym(gn(l,"reason-pty-probe-")),O=gn(v,"workspace"),M=gn(v,"private");if(vl(O,{mode:448}),vl(M,{mode:448}),e)kl(v,493),kl(O,493),El(O,e.uid,e.gid);return{directory:v,root:O,runtimeDirectory:M}}function lp(e,l){if(l)try{Si("/usr/bin/setpriv",[`--reuid=${l.uid}`,`--regid=${l.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",e.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),ep(e.root)}catch{return}tp(e.directory,{recursive:!0,force:!0})}var Ml=5000,wn="ARA_WORKER_PROBE_READY";function wp(e,l,v,O,M){if(M.aborted)return Promise.resolve(!1);return new Promise((L)=>{dp(e,l,{cwd:v,env:O,signal:M,timeout:Ml,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8",windowsHide:!0},(z,re)=>L(!z&&!M.aborted&&re===wn))})}function yp(e,l){let v=ss(e).replace(/\.exe$/i,"");if(v==="bash")return["--noprofile","--norc","-c",l];if(v==="zsh"||v==="sh")return["-f","-c",l];return null}function _p(e,l){let v=je({home:l,temporaryDirectory:l}),O=(L,z,re)=>wp(L,z,e.workspaceRoot,v,re),M=async(L,z,re,G=(we)=>we===wn,ce=!1)=>{let we=process.platform==="win32"?as(Ei(gp(),"reason-device-probe-")):e.workspaceRoot;try{let te=await qn(L,z,{cwd:we,root:we,allowWrite:!1,allowProcessInspection:ce,timeoutMs:Ml,signal:re,workerProbe:!0}),X=!re.aborted&&!te.timedOut&&!te.truncated&&te.exitCode===0&&G(te.stdout);if(!X&&process.platform==="win32")process.stderr.write(`Reason worker: confined ${ss(L)} probe failed (exit ${te.exitCode}${te.timedOut?", timed out":""}): ${te.stderr.slice(-300).trim()}
-`);return X}catch(te){if(process.platform==="win32")process.stderr.write(`Reason worker: confined ${ss(L)} probe failed: ${String(te)}
-`);throw te}finally{if(we!==e.workspaceRoot)Dl(we,{recursive:!0,force:!0})}};return{workspaceRead:async(L)=>(await xl(e.workspaceRoot,Al.R_OK),await Ol(e.workspaceRoot),!L.aborted),workspaceWrite:async(L)=>{if(await xl(e.workspaceRoot,Al.W_OK),L.aborted)return!1;let z=as(Ei(e.workspaceRoot,".ara-worker-probe-")),re=Ei(z,"receipt");try{let G=await fp(re,"wx",384);try{await G.writeFile(wn),await G.sync()}finally{await G.close()}return await Il(re,"utf8")===wn&&!L.aborted}finally{await pp(re).catch(()=>{}),await hp(z).catch(()=>{})}},confinedShell:(L)=>{if(process.platform==="win32"&&!Jr())return process.stderr.write(`Reason worker: ${ka}
-`),Promise.resolve(!1);return M(Kr(),["-c",`printf ${wn}`],L)},confinedGit:(L)=>M("git",["--version"],L,(z)=>/^git version \S+/.test(z)),processInspection:async(L)=>{if(process.platform==="darwin")return M("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],L,(ce)=>ce.includes(`p${process.pid}
-`)&&/^n\//m.test(ce),!0);if(process.platform==="win32")return ec(L);if(process.platform!=="linux")return!1;let[z,re,G]=await Promise.all([mp("/proc/self/cwd"),Ol("/proc/self/fd"),Il("/proc/net/tcp","utf8")]);return!L.aborted&&z.length>0&&re.length>0&&G.includes("local_address")},bash:async(L)=>{let z=process.platform==="win32"?Y():"/bin/bash";if(!z)return process.stderr.write(`Reason worker: ${process.platform==="win32"?ha:"bash is unavailable"}
-`),!1;return O(z,["--noprofile","--norc","-c",`printf ${wn}`],L)},jobs:(L)=>bl(e,L),environment:(L)=>_l(e,l,L),preview:(L)=>Zi(l,L),boundPty:(L)=>Po(L),desktopDisplay:()=>No(),desktopAutomation:async()=>{let L=cs();if(L)process.stderr.write(`Reason worker: computer and browser use need setup (${L})
-`);return hr()},desktopBrowser:async()=>T()?.features.browser===!0,fullControlShell:(L)=>{let z=ut(),re=yp(z,`printf ${wn}`);return re?O(z,re,L):Promise.resolve(!1)}}}function cs(){return process.platform==="darwin"&&T()?.features.computer===!0?In():null}var ls=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function bp(e,l,v=new AbortController().signal,O={read:!0,write:!1},M=So()){return Co(e,l,v,O,M).final}function Co(e,l,v=new AbortController().signal,O={read:!0,write:!1},M=So(),L,z){let re,G;try{if(Dr(e),ne(),!l)b(p(e),!0),re=as(Ei(p(e),"probe-")),l=_p(e,re);G=l}catch(Me){let Ce=Promise.reject(Me);return Ce.catch(()=>{}),{initial:Ce,final:Ce,pty:Ce}}let ce=async(Me,Ce)=>{if(v.aborted||!Ce&&!G[Me])return!1;let Te,We=new Promise(($e)=>{Te=()=>$e(!1)});v.addEventListener("abort",Te,{once:!0});try{return await Promise.race([Ce??G[Me](v),We])===!0&&!v.aborted}catch{return!1}finally{v.removeEventListener("abort",Te)}},we=e.executionMode==="host",te=we?ce("boundPty",L):Promise.resolve(!1),X=Promise.resolve(z).then(()=>Promise.all(we?[ce("preview"),te,ce("desktopDisplay"),ce("desktopAutomation"),ce("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),he=(async()=>{let[Me,Ce,Te,We,$e,Fe,Ne,xe,Le]=await Promise.all([Promise.resolve(O).then((Ge)=>Ge.read?ce("workspaceRead"):!1,()=>!1),Promise.resolve(O).then((Ge)=>Ge.write?ce("workspaceWrite"):!1,()=>!1),M?ce("confinedShell"):!1,M?ce("confinedGit"):!1,ce("processInspection"),...we?[ce("bash"),ce("jobs"),ce("environment"),ce("fullControlShell")]:[!1,!1,!1,!1]]);if(we&&(!Fe||!Ne||!xe)&&!z)await X;if(we){if(!Fe)Fe=await ce("bash");if(!Ne)Ne=await ce("jobs");if(!xe)xe=await ce("environment")}return{read:Me,write:Ce,shell:Te,git:We,processes:$e,bash:Fe,jobs:Ne,environment:xe,full:Le}})(),Se=(Me,Ce)=>{let{read:Te,write:We,shell:$e,git:Fe,processes:Ne,bash:xe,jobs:Le,environment:Ge,full:Ve}=Me,{preview:Je,boundPty:it,desktopDisplay:Ye,desktopAutomation:Be,desktopBrowser:Ke}=Ce,qe=Ja(),nt=we&&process.platform==="darwin"&&Ve&&up("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":Te,"fs.write":We,"inference.custom.v1":we&&Te,"fs.export":Te&&qe,"fs.import":We&&qe,"exec.run":$e&&M,"git.run":$e&&Fe&&M,"process.list":(process.platform==="linux"||process.platform==="win32"||$e)&&Ne,"ports.list":(process.platform==="linux"||process.platform==="win32"||$e)&&Ne,"exec.full":xe&&Ve&&M,"hands.connect":Te&&We&&xe&&Le,"jobs.control":Te&&We&&xe&&Le,"pty.start":Te&&We&&xe&&Le&&Ge&&it,"environment.install":Te&&We&&xe&&Le&&Ge,"github.local.v1":(process.platform==="darwin"||process.platform==="win32"||process.platform==="linux"&&process.geteuid?.()!==0)&&Te&&We&&xe&&Le&&Ge,"tunnel.open":Te&&We&&xe&&Le&&Ge&&Je,"tunnel.close":Te&&We&&xe&&Le&&Ge&&Je,"preview.serve.v1":Te&&xe&&Le&&Je&&Ve,"display.stream.v1":Ye,"automation.call.v1":Be,"simulator.call.v1":nt,"simulator.stream.v1":nt,"browser.pr-proof.v1":Be&&Ke&&ue()===null&&process.platform!=="win32","workspace.setup.v1":we&&Vr()})},Re=he.then(async(Me)=>Se(Me,{preview:!1,boundPty:await Promise.race([te,new Promise((Ce)=>setImmediate(()=>Ce(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),Ee=(async()=>{try{let Me=await he,[Ce,Te,We,$e,Fe]=await X;if(we&&!Te&&Me.read&&Me.write&&Me.bash&&Me.jobs&&Me.environment)Te=await ce("boundPty");return Se(Me,{preview:Ce,boundPty:Te,desktopDisplay:We,desktopAutomation:$e,desktopBrowser:Fe})}finally{if(re)Dl(re,{recursive:!0,force:!0})}})();Re.catch(()=>{});let Oe=(async()=>{let Me=await he;if(!(Me.read&&Me.write&&Me.bash&&Me.jobs&&Me.environment))return!1;return await te||(await Ee)["pty.start"]===!0})();return Oe.catch(()=>{}),{initial:Re,final:Ee,pty:Oe}}var kp=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],vp=[60000,300000,900000];function is(e,l){if(e.executionMode!=="host"||l["fs.read"]!==!0)return[];return kp.filter((v)=>l[v]!==!0)}function Tl(e){let l=e.log??((L)=>{process.stderr.write(L)}),v=e.resolve??((L)=>bp(e.config,void 0,L,e.permissions)),O=e.readiness,M=is(e.config,O);if(M.length===0)return Promise.resolve();return l(`Reason worker: withheld at start (${M.join(", ")}); probing them again while idle.
-`),(async()=>{for(let L of e.delaysMs??vp){if(await new Promise((G)=>{let ce=setTimeout(G,L);e.signal.addEventListener("abort",()=>{clearTimeout(ce),G()},{once:!0})}),e.signal.aborted)return;if(!e.idle())continue;let z;try{z=await v(AbortSignal.any([e.signal,AbortSignal.timeout(30000)]))}catch{continue}if(e.signal.aborted)return;let re=is(e.config,O).filter((G)=>z[G]===!0);if(re.length>0)O=Object.freeze({...O,...Object.fromEntries(re.map((G)=>[G,!0]))}),l(`Reason worker: ready after probing again (${re.join(", ")}).
-`),e.onReady(O,re);if(is(e.config,O).length===0)return}})()}import{execFile as vh}from"child_process";import{createHash as Sh,randomUUID as Cs}from"crypto";import{lstat as Rh,readdir as bd,readFile as Sd,realpath as Eh,stat as Ph}from"fs/promises";import{basename as Ch,join as Es}from"path";import{promisify as Ah}from"util";import{createConnection as Sp}from"net";import{endianness as Nl}from"os";var Ao=4,ds=1e4;class en{socketPath;sessionId;turnId;timeoutMs;#t=null;#e=Buffer.alloc(0);#i=1;#r=new Map;#n=new Set;constructor(e){this.socketPath=e.socketPath,this.sessionId=e.sessionId??"open-browser-use-js",this.turnId=e.turnId??`turn-${Date.now()}`,this.timeoutMs=e.timeoutMs??1e4}async connect(){if(this.#t)return this;let e=Sp(this.socketPath);return this.#t=e,e.on("data",(l)=>this.#a(Buffer.from(l))),e.on("close",()=>this.#o(Error("Open Browser Use socket closed"))),e.on("error",(l)=>this.#o(l)),await new Promise((l,v)=>{e.once("connect",l),e.once("error",v)}),this}close(){this.#t?.end(),this.#t=null}onNotification(e){return this.#n.add(e),()=>{this.#n.delete(e)}}async request(e,l={}){await this.connect();let v=this.#t;if(!v)throw Error("Open Browser Use socket is not connected");let O=String(this.#i++),M={session_id:this.sessionId,turn_id:this.turnId,...l},z=Rp({jsonrpc:"2.0",id:O,method:e,params:M}),re=new Promise((G,ce)=>{let we=setTimeout(()=>{this.#r.delete(O),ce(Error(`Open Browser Use request timed out: ${e}`))},this.timeoutMs);this.#r.set(O,{resolve:G,reject:ce,timeout:we})});return v.write(z),await re}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory(e={}){return this.request("getUserHistory",e)}claimUserTab(e){return this.request("claimUserTab",{tabId:e})}finalizeTabs(e){return this.request("finalizeTabs",{keep:e})}nameSession(e){return this.request("nameSession",{name:e})}attach(e){return this.request("attach",{tabId:e})}detach(e){return this.request("detach",{tabId:e})}executeCdp(e,l,v={}){return this.request("executeCdp",{target:{tabId:e},method:l,commandParams:v})}moveMouse(e,l,v,O=!0){return this.request("moveMouse",{tabId:e,x:l,y:v,waitForArrival:O})}waitForFileChooser(e,l){return this.request("waitForFileChooser",{tabId:e,...l===void 0?{}:{timeoutMs:l}})}setFileChooserFiles(e,l){return this.request("setFileChooserFiles",{fileChooserId:e,files:l})}waitForDownload(e,l){return this.request("waitForDownload",{tabId:e,...l===void 0?{}:{timeoutMs:l}})}downloadPath(e,l){return this.request("downloadPath",{downloadId:e,...l===void 0?{}:{timeoutMs:l}})}browserUserHistory(e={}){return this.getUserHistory(e)}readClipboardText(e){return this.request("readClipboardText",{tabId:e})}writeClipboardText(e,l){return this.request("writeClipboardText",{tabId:e,text:l})}readClipboard(e){return this.request("readClipboard",{tabId:e})}writeClipboard(e,l){return this.request("writeClipboard",{tabId:e,items:l})}turnEnded(){return this.request("turnEnded")}#a(e){this.#e=Buffer.concat([this.#e,e]);while(this.#e.length>=Ao){let l=Nl()==="LE"?this.#e.readUInt32LE(0):this.#e.readUInt32BE(0),v=Ao+l;if(this.#e.length<v)return;let O=this.#e.subarray(Ao,v);this.#e=this.#e.subarray(v),this.#s(JSON.parse(O.toString("utf8")))}}#s(e){if(!kr(e))return;let l=typeof e.id==="string"||typeof e.id==="number"?String(e.id):null;if(!l&&typeof e.method==="string"){let O={method:e.method,params:e.params};for(let M of this.#n)M(O);return}if(!l)return;let v=this.#r.get(l);if(!v)return;if(this.#r.delete(l),clearTimeout(v.timeout),kr(e.error)){v.reject(Error(String(e.error.message??"Open Browser Use request failed")));return}v.resolve(e.result??null)}#o(e){for(let[l,v]of this.#r)this.#r.delete(l),clearTimeout(v.timeout),v.reject(e)}}class Pi{client;cdp;constructor(e){this.client="client"in e?e.client:new en(e),this.cdp=new Bl(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab(e={}){let l=await this.client.createTab(),v=Ep(l,"createTab response"),O=this.tab(v);if(e.url)await O.goto(e.url,e);return O}tab(e){return new Hl(this,e)}getTabs(){return this.client.getTabs()}}class Hl{browser;id;playwright;constructor(e,l){this.browser=e,this.id=l,this.playwright=new $l(this)}goto(e,l={}){return this.browser.cdp.navigate(this.id,e,l)}waitForLoadState(e={}){return this.browser.cdp.waitForLoadState(this.id,e)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then((e)=>String(e??""))}evaluate(e,l={}){return this.browser.cdp.evaluate(this.id,e,l)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class $l{tab;constructor(e){this.tab=e}waitForLoadState(e={}){return this.tab.waitForLoadState(e)}domSnapshot(){return this.tab.domSnapshot()}}class Bl{client;#t=new Set;constructor(e){this.client=e}async call(e,l,v={},O={}){return await this.ensureAttached(e),this.client.request("executeCdp",{target:{tabId:e},method:l,commandParams:v,...O.timeoutMs===void 0?{}:{timeoutMs:O.timeoutMs}})}async evaluate(e,l,v={}){let O=await this.call(e,"Runtime.evaluate",{expression:l,returnByValue:!0,...v.awaitPromise===void 0?{}:{awaitPromise:v.awaitPromise}});if(kr(O)&&kr(O.exceptionDetails))throw Error(String(O.exceptionDetails.text??"Open Browser Use evaluation failed"));return kr(O)&&kr(O.result)?O.result.value??null:null}async navigate(e,l,v={}){if(!l)throw Error("goto requires a URL");let O=v.waitUntil??"load";Ll(O);let M=v.timeoutMs??ds;await this.call(e,"Page.enable");let L=this.waitForLoadEvent(e,O,M),z=await this.call(e,"Page.navigate",{url:l},{timeoutMs:M});if(kr(z)&&typeof z.errorText==="string"&&z.errorText)throw Error(`Browser failed to navigate tab ${e}: ${z.errorText}`);return await L.catch(async(re)=>{let G=await this.readDocumentState(e);if(Wl(G,O))return;throw re}),z}async waitForLoadState(e,l={}){let v=l.state??"load";Ll(v),await this.call(e,"Page.enable");let O=await this.readDocumentState(e);if(Wl(O,v))return;await this.waitForLoadEvent(e,v,l.timeoutMs??ds)}async readDocumentState(e){try{let l=await this.evaluate(e,"({ href: window.location.href, readyState: document.readyState })");return kr(l)?{href:us(l.href),readyState:us(l.readyState)}:void 0}catch{return}}waitForEvent(e,l,v={}){let O=v.timeoutMs??ds;return new Promise((M,L)=>{let z=!1,re=null,G,ce=()=>{if(z)return!1;return z=!0,clearTimeout(G),re?.(),!0};G=setTimeout(()=>{if(ce())L(Error(v.timeoutMessage??`Timed out waiting for tab ${e} event`))},O),re=this.client.onNotification((we)=>{try{if(l(we)){if(ce())M(we)}}catch(te){if(ce())L(te instanceof Error?te:Error(String(te)))}})})}waitForLoadEvent(e,l,v){return this.waitForEvent(e,(O)=>{let M=Pp(O,e);if(!M)return!1;if(M.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${e}`);return l==="domcontentloaded"?M.method==="Page.domContentEventFired":M.method==="Page.loadEventFired"},{timeoutMs:v,timeoutMessage:`Timed out waiting for ${l} in tab ${e}`}).then(()=>{return})}async ensureAttached(e){if(this.#t.has(e))return;await this.client.attach(e),this.#t.add(e)}}function Rp(e){let l=Buffer.from(JSON.stringify(e),"utf8"),v=Buffer.alloc(Ao+l.length);if(Nl()==="LE")v.writeUInt32LE(l.length,0);else v.writeUInt32BE(l.length,0);return l.copy(v,Ao),v}function kr(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Ep(e,l){if(!kr(e))throw Error(`${l} did not include a tab object`);let v=e.id;if(typeof v==="number"&&Number.isInteger(v)&&v>0)return v;if(typeof v==="string"){let O=Number(v);if(Number.isInteger(O)&&O>0)return O}throw Error(`${l} did not include a numeric tab id`)}function Ll(e){if(e!=="domcontentloaded"&&e!=="load")throw Error(`Unsupported load state "${e}". Use "domcontentloaded" or "load".`)}function Wl(e,l){if(e?.readyState==="complete")return!0;return l==="domcontentloaded"&&e?.readyState==="interactive"}function Pp(e,l){if(e.method!=="onCDPEvent"||!kr(e.params))return null;let v=e.params.source;if(!kr(v)||v.tabId!==l)return null;return{method:us(e.params.method)}}function us(e){return typeof e==="string"?e:void 0}import{createHash as Cp}from"crypto";function Ul(e,l,v,O){let M=JSON.stringify([e.trim().toLowerCase(),l.trim().toLowerCase(),v,O]);return`reason-cloud-${Cp("sha256").update(M).digest("hex")}`}import{AsyncLocalStorage as _h}from"async_hooks";import{isDeepStrictEqual as yd}from"util";import{createHash as bh}from"crypto";var Ap=/#w=(\d{1,5})&h=(\d{1,5})$/;function Fl(e){return typeof e==="number"&&Number.isInteger(e)&&e>0&&e<=32768?e:void 0}function jl(e){let l=Ap.exec(e);if(!l)return;let v=Fl(Number(l[1])),O=Fl(Number(l[2]));return v&&O?{width:v,height:O}:void 0}var ql="[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}",xp=new RegExp(`^/media/pr-screenshots/(${ql})/(${ql})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$`,"i");var Ip=new Set(["png","jpg","jpeg","gif","webp"]),Op=new Set(["webm","mp4"]);function Dp(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function Mp(e){let l=jl(e);return Boolean(l&&e===`#w=${l.width}&h=${l.height}`)}function zl(e,l){let v;try{v=new URL(e)}catch{return null}let O=Dp(l),M=v.hostname==="ara.so"||v.hostname.endsWith(".ara.so")||v.hostname==="reasonmachines.ai"||v.hostname.endsWith(".reasonmachines.ai")||v.hostname==="reasonmachines.com"||v.hostname.endsWith(".reasonmachines.com");if(v.protocol!=="https:"||!M&&v.origin!==O||v.username||v.password||v.port||v.search||v.hash&&!Mp(v.hash))return null;let L=xp.exec(v.pathname);if(!L)return null;let z=L[1]?.toLowerCase(),re=L[2]?.toLowerCase(),G=L[3]?.toLowerCase(),ce=L[4]?.toLowerCase();if(!z||!re||!G||!ce)return null;let we=Ip.has(ce)?"image":Op.has(ce)?"video":null;if(!we)return null;let te=/^(before|after)[\s:_-]+/.exec(G),X=v.pathname.replace(/^\/media\//,"");return{url:v.toString(),storagePath:X,runId:z,artifactId:re,fileName:`${G}.${ce}`,kind:we,phase:te?.[1]==="before"||te?.[1]==="after"?te[1]:null}}var Tp=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Ci=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),yn=()=>{throw Error("cloud_browser_media_request_invalid")};function Ai(e){if(!Ci(e)||Object.keys(e).some((L)=>!["runId","configuredMediaOrigin","media"].includes(L))||typeof e.runId!=="string"||!Tp.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return yn();let l;try{l=new URL(e.configuredMediaOrigin)}catch{return yn()}if(l.protocol!=="https:"||l.username||l.password||l.port||!$t(l.origin,{mode:"public_web"}).allowed)return yn();let v=e.runId.toLowerCase(),O=new Set,M=e.media.map((L)=>{if(!Ci(L)||Object.keys(L).some((re)=>!["url","sourceUrl","kind"].includes(re))||typeof L.url!=="string"||L.url.length>2048||typeof L.sourceUrl!=="string"||L.sourceUrl.length>8192||!["image","video"].includes(String(L.kind)))return yn();let z=zl(L.url,l.origin);if(!z||new URL(z.url).origin!==l.origin||z.runId!==v||z.kind!==L.kind||z.url!==L.url||O.has(L.url))return yn();if(O.add(L.url),L.sourceUrl!==L.url){let re;try{re=new URL(L.sourceUrl)}catch{return yn()}let G=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(re.pathname)?.[1];if(L.kind!=="image"||re.origin!=="https://camo.githubusercontent.com"||re.username||re.password||re.search||re.hash||!G||G.length%2!==0||Buffer.from(G,"hex").toString("utf8")!==L.url)return yn()}return{url:L.url,sourceUrl:L.sourceUrl,kind:L.kind}});return{runId:e.runId,configuredMediaOrigin:l.origin,media:M}}function Kl(e,l){let v=()=>{throw Error("cloud_browser_media_verification_failed")};if(!Ci(e)||e.verified!==!0||!Array.isArray(e.items)||e.items.length!==l.media.length)return v();return{verified:!0,items:e.items.map((M,L)=>{let z=l.media[L];if(!Ci(M)||M.url!==z.url||M.sourceUrl!==z.sourceUrl||M.kind!==z.kind||typeof M.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(M.sourceSha256)||!Number.isSafeInteger(M.width)||!Number.isSafeInteger(M.height)||Number(M.width)<1||Number(M.height)<1||Number(M.width)>16384||Number(M.height)>16384||z.kind==="video"&&(typeof M.advancedSeconds!=="number"||!Number.isFinite(M.advancedSeconds)||M.advancedSeconds<0.05||M.advancedSeconds>30))return v();return{...z,width:Number(M.width),height:Number(M.height),sourceSha256:M.sourceSha256,...z.kind==="video"?{advancedSeconds:M.advancedSeconds}:{}}})}}var ms="browser.pr-proof.v1",Dt=t().uuid(),$n=t().regex(/^[a-f0-9]{64}$/),Rn=I.datetime({precision:3}),fs=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),Gl=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),ur=n({kind:i("primary_mac"),version:i(1),organizationId:fs,userId:fs,sessionId:fs,runId:Dt,deviceId:Dt,rootId:Dt,rootRevision:t().min(1).max(64),binding:c(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:Dt,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Lp=Gi().transform((e,l)=>{try{return co(e)}catch{return l.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),Uc}}),Bn=n({version:i(1),owner:ur,contextId:Dt,preparedAt:Rn,expiresAt:Rn,prUrl:Gl,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:$n,evidenceKind:c(["image","video"]),visualPlan:Lp.optional(),uploadOrigin:t().url().refine((e)=>{let l=new URL(e);return l.protocol==="https:"&&l.origin===e&&!l.username&&!l.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),gs=n({version:i(1),producer:i("primary_mac"),context:Bn,captureId:Dt,operationId:Dt,attemptId:Dt,tabId:o().int().positive(),startedAt:Rn,finishedAt:Rn,sha256:$n,media:A("contentType",[n({contentType:i("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),n({contentType:i("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,l)=>{let v=Date.parse(e.startedAt),O=Date.parse(e.finishedAt);if(v<Date.parse(e.context.preparedAt)||O<v||O>Date.parse(e.context.expiresAt)||O-v>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((O-v)/1000-e.media.durationSeconds)>0.1))l.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),ov=A("action",[n({action:i("screenshot"),context_id:Dt,tab_id:o().int().positive()}).strict(),n({action:i("start_video"),context_id:Dt,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("stop_video"),recording_operation_id:Dt}).strict()]),Oi=n({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),xi=t().regex(/^[1-9][0-9]{0,19}$/),xo=n({version:i(1),owner:ur,expectedActorId:xi.nullable(),repositoryId:xi,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Wp=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],ws=A("status",[xo.extend({status:i("ready"),observedActor:Oi,checkedAt:Rn}),xo.extend({status:i("not_ready"),reason:c(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:c(Wp).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),_n=n({version:i(1),owner:ur,expectedActorId:xi.nullable(),authenticatedActor:Oi,attemptId:Dt,captureId:Dt,prUrl:Gl,repositoryId:xi,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:$n,sizeBytes:o().int().min(128).max(10485760),contentType:i("video/webm")}).strict(),Yl=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),Fn=A("status",[_n.extend({status:i("not_attempted"),reason:c(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),_n.extend({status:i("uncertain"),reason:i("upload_outcome_unknown")}),_n.extend({status:i("uploaded"),observedActor:Oi,nativeUrl:Yl,uploadedAt:Rn})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),Oo=_n.extend({nativeUrl:Yl,observedActor:Oi,bodySha256:$n}),ys=A("status",[Oo.extend({status:i("incomplete"),reason:c(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),Oo.extend({status:i("verified"),sourceSha256:$n,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:i(!0),verifiedAt:Rn})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Np=Gi().transform((e,l)=>{try{let v=Ai(e);if(v.media.some((O)=>O.kind!=="image"))throw Error();return v}catch{return l.addIssue({code:"custom",message:"proof_media_request_invalid"}),Uc}}),Hp=A("action",[n({action:i("auth_check"),input:xo}).strict(),n({action:i("prepare"),context:Bn}).strict(),n({action:i("capture_png"),owner:ur,contextId:Dt,tabId:o().int().positive()}).strict(),n({action:i("start_video"),owner:ur,contextId:Dt,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("inspect_capture"),owner:ur,captureId:Dt}).strict(),n({action:i("publish_video"),input:_n}).strict(),n({action:i("verify_png_media"),owner:ur,media:Np}).strict().refine((e)=>e.media.runId===e.owner.runId),n({action:i("verify_saved_media"),input:Oo}).strict(),n({action:i("publish_png"),owner:ur,attemptId:Dt,captureId:Dt,sha256:$n,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var Xl="pr-proof.stop.v1",_s=n({requestId:Dt,command:Hp}).strict();var $p={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},Vl={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},Jl={type:"integer",minimum:1,description:"An already-owned tab's id."},iv={...$p,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:Vl,tab_id:Jl}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:Vl,tab_id:Jl,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};import{createHash as Bp,randomUUID as Up}from"crypto";import{isDeepStrictEqual as jn}from"util";var Zl=n({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict(),bt=()=>Error("mac_pr_proof_capture_unavailable"),bs=(e)=>Bp("sha256").update(e).digest("hex");function Ql(e){let l=ur.parse(e.owner),v=new Map,O=new Map,M=!1,L=async()=>{if(M)throw bt();if(await e.assertCurrent(),M)throw bt()},z=(X)=>{let he=v.get(X);if(!he||Date.parse(he.expiresAt)<=Date.now())throw bt();return he},re=(X)=>X.disposal??=(async()=>{X.controller.abort(),X.bytes?.fill(0),X.bytes=void 0,X.receipt=void 0;try{await X.host?.close()}catch{throw M=!0,bt()}})(),G=async()=>{for(let[X,he]of v){if(Date.parse(he.expiresAt)>Date.now())continue;let Se=[...O.entries()].filter(([,Ee])=>Ee.claim.contextId===X);if((await Promise.allSettled(Se.map(([,Ee])=>re(Ee)))).some((Ee)=>Ee.status==="rejected"))throw bt();for(let[Ee]of Se)O.delete(Ee);v.delete(X)}},ce=setInterval(()=>{G().catch(()=>{M=!0})},1000);ce.unref();let we=(X)=>{if(X.stopRequested=!0,X.started&&X.host&&!X.stop)X.stop=X.host.stop(),X.stop.catch(()=>X.controller.abort())};async function te(X,he){let Se=Zl.parse(X.claim);if(he==="video"&&(!Number.isInteger(X.seconds)||X.seconds<1||X.seconds>15))throw bt();await L(),X.signal.throwIfAborted(),await G();let Re=z(Se.contextId);if(he==="video"&&Re.evidenceKind!=="video")throw bt();let Ee=O.get(Se.operationId);if(Ee){if(!jn(Ee.claim,Se)||Ee.kind!==he||Ee.seconds!==X.seconds||Ee.controller.signal.aborted)throw bt();let Ne=await Ee.completion;if(await L(),z(Se.contextId),Ee.controller.signal.aborted)throw bt();return structuredClone(Ne)}if(O.size>=16||[...O.values()].some((Ne)=>!Ne.receipt&&!Ne.controller.signal.aborted&&Ne.claim.tabId===Se.tabId))throw bt();let Oe,Me,Ce=new Promise((Ne,xe)=>{Oe=Ne,Me=xe});Ce.catch(()=>{});let Te={claim:Se,kind:he,seconds:X.seconds,controller:new AbortController,completion:Ce,stopRequested:!1,started:!1};O.set(Se.operationId,Te);let We=()=>{re(Te).catch(()=>{})};X.signal.addEventListener("abort",We,{once:!0});let $e=async()=>{await L(),z(Se.contextId),X.signal.throwIfAborted(),Te.controller.signal.throwIfAborted()},Fe;try{await $e();let Ne;if(he==="image"){let xe=new Date().toISOString();Fe=await e.screenshot(structuredClone(Re),Se.tabId,Te.controller.signal);let Le=new Date().toISOString();if(await $e(),Fe.length<24||Fe.length>8388608||!Fe.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||Fe.readUInt32BE(8)!==13||Fe.toString("ascii",12,16)!=="IHDR")throw bt();Ne=gs.parse({version:1,producer:"primary_mac",context:Re,captureId:Up(),operationId:Se.operationId,attemptId:Se.attemptId,tabId:Se.tabId,startedAt:xe,finishedAt:Le,sha256:bs(Fe),media:{contentType:"image/png",sizeBytes:Fe.length,width:Fe.readUInt32BE(16),height:Fe.readUInt32BE(20)}})}else{if(Te.host=await e.createVideo(structuredClone(Re),Se.tabId,X.seconds,Te.controller.signal),Te.controller.signal.aborted||X.signal.aborted||M)throw await Te.host.close(),bt();await Te.host.start(),Te.started=!0;let xe=Te.host.completed();if(xe.catch(()=>{}),await $e(),await X.started?.(),Te.stopRequested)we(Te);let Le=await xe;if(Te.stop)await Te.stop;await $e();let Ge=await Te.host.read(Le.captureId);Fe=Ge.bytes;let Ve={runId:l.runId,deviceId:l.deviceId,rootId:l.rootId,rootRevision:l.rootRevision,generation:l.generation,profile:l.profile,extensionInstanceId:l.extensionInstanceId,browserScope:e.browserScope,tabId:Se.tabId};if(!jn(Le,Ge.capture)||!jn(Le.owner,Ve)||Fe.length!==Le.sizeBytes||bs(Fe)!==Le.sha256||Fe.length<128||Fe.readUInt32BE(0)!==440786851)throw bt();await Te.host.close(),await $e(),Ne=gs.parse({version:1,producer:"primary_mac",context:Re,captureId:Le.captureId,operationId:Se.operationId,attemptId:Se.attemptId,tabId:Se.tabId,startedAt:Le.startedAt,finishedAt:Le.finishedAt,sha256:Le.sha256,media:{contentType:"video/webm",sizeBytes:Le.sizeBytes,durationSeconds:Le.durationSeconds,frameCount:Le.frameCount,receivedFrameCount:Le.receivedFrameCount}})}if(await $e(),[...O.values()].reduce((xe,Le)=>xe+(Le.bytes?.length??0),Fe.length)>20971520)throw bt();return Te.bytes=Buffer.from(Fe),Te.receipt=Ne,Oe(Ne),structuredClone(Ne)}catch(Ne){let xe=he==="video"&&!X.signal.aborted&&!Te.controller.signal.aborted&&Ne instanceof Error&&Ne.message==="mac_recording_worker_failed:no_frames"?new r("proof_capture_no_frames","The owned tab emitted no recording frames."):bt();throw await re(Te).catch(()=>{}),Me(xe),xe}finally{Fe?.fill(0),X.signal.removeEventListener("abort",We)}}return{async prepare(X){let he=Bn.parse(X);if(!jn(he.owner,l))throw bt();if(await L(),await G(),Date.parse(he.preparedAt)>Date.now()||Date.parse(he.expiresAt)<=Date.now())throw bt();let Se=v.get(he.contextId);if(Se){if(!jn(Se,he))throw bt();return structuredClone(Se)}if(v.size>=4)throw bt();return v.set(he.contextId,he),structuredClone(he)},screenshot:(X)=>te(X,"image"),record:(X)=>te(X,"video"),async stop(X){let he=Zl.parse(X);await L(),z(he.contextId);let Se=O.get(he.operationId);if(!Se||Se.kind!=="video"||!jn(he,Se.claim)||Se.controller.signal.aborted)throw bt();we(Se)},async publicationCapture(X){await L(),await G();let he=[...O.values()].find((Se)=>Se.receipt?.captureId===X);if(!he?.receipt||!he.bytes||he.controller.signal.aborted)throw bt();if(z(he.claim.contextId),he.bytes.length!==he.receipt.media.sizeBytes||bs(he.bytes)!==he.receipt.sha256)throw bt();return{capture:structuredClone(he.receipt),bytes:Buffer.from(he.bytes)}},async inspect(X){await L(),await G();let he=[...O.values()].find((Se)=>Se.receipt?.captureId===X);if(!he?.receipt||he.controller.signal.aborted)throw bt();return z(he.claim.contextId),structuredClone(he.receipt)},async close(){M=!0,clearInterval(ce);let X=await Promise.allSettled([...O.values()].map(re));if(O.clear(),v.clear(),X.some((he)=>he.status==="rejected"))throw bt()}}}import{createHash as nd,randomUUID as Yp}from"crypto";import{isDeepStrictEqual as Mo}from"util";import{realpath as Xp}from"fs/promises";var ed=String.raw`async (media) => {
+`)}catch{X.destroy()}})});G.maxConnections=32;let ce,we=!1,te=async()=>{if(we)return;we=!0;for(let X of re)X.destroy();if(await new Promise((X)=>G.close(()=>X())),ce&&u(D)){let X=di(D);if(X.isFile()&&X.dev===ce.dev&&X.ino===ce.ino)try{let he=zc.parse(JSON.parse(m(D)));if(he.nonce===l&&he.socketPath===z)jf(D)}catch{}}try{if(L)Uf(L)}catch{}};try{if(await new Promise((X,he)=>{G.once("error",he),G.listen(z,()=>{if(!M)$f(z,384);X()})}),ui(e).nonce!==l)throw Error("worker_instance_changed");return y(D,{version:1,nonce:l,socketPath:z}),ce=di(D),te}catch(X){throw await te(),X}}function Gc(e,l){try{let v=JSON.parse(m(un(f(e).lock,"owner.json"))),D=v&&typeof v==="object"?v[l]:void 0;return typeof D==="string"?D:null}catch{return null}}function _o(e){return Gc(e,"runtime_version")}function Xf(e){return Gc(e,"nonce")}function Yc(e,l){if(l)return l.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(un(f(e).lock,"owner.json")))return"no_lock";return Vc(e,ui(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var Zf=21600000,Qf=h({instance:t().nullable(),since:o().int().nonnegative()});function em(e,l){let v=f(e).updateDeferral;try{if(!u(v))return null;let D=Qf.safeParse(JSON.parse(m(v)));if(D.success&&D.data.instance===l)return D.data.since;ka(e)}catch{}return null}function ka(e){try{Ff(f(e).updateDeferral,{force:!0})}catch{}}async function pi(e,l,v=()=>!1){let D=Xf(e),M=em(e,D);if(l!==void 0){let ce=_o(e);if(ce===null||ce===l&&M===null&&!v())return{state:"current"}}let L;try{let ce=await St(e,"status");L=ce?ce.activeSessions??ce.activeClaims:0}catch{L=null}if(L===0)return{state:"restarted"};let z=Date.now(),re=M;if(re===null){re=z;try{y(f(e).updateDeferral,{instance:D,since:re})}catch{}}let G=z-re;return{state:G<Zf?"busy":"drained",sessions:L,waitedMs:G}}async function St(e,l){let v=f(e);if(!u(un(v.lock,"owner.json")))return null;let D=ui(e),M=Vc(e,D.nonce);if(!M)return null;return new Promise((L,z)=>{let re=qf(M),G="",ce=!1,we=(te,X)=>{if(ce)return;if(ce=!0,re.destroy(),X)z(X);else L(te)};re.setTimeout(2000,()=>re.destroy(Error("worker_control_timeout"))),re.on("connect",()=>re.write(JSON.stringify({nonce:D.nonce,action:l})+`
+`)),re.on("data",(te)=>{if(G+=te.toString(),Buffer.byteLength(G)>16384)re.destroy(Error("worker_control_oversize"))}),re.on("error",(te)=>{if("code"in te&&["ECONNREFUSED","ENOENT"].includes(String(te.code)))we(null);else we(null,te.message==="worker_control_timeout"?te:Error("worker_control_unavailable"))}),re.on("end",()=>{try{let te=Vf.parse(JSON.parse(G));if(te.instanceId!==D.nonce)throw Error("worker_instance_changed");we(te)}catch{we(null,Error("worker_control_invalid_response"))}}),re.once("close",()=>we(null,Error("worker_control_unavailable")))})}import{randomUUID as Fd}from"crypto";import{homedir as jd}from"os";import{spawn as tm}from"child_process";import{createRequire as rm}from"module";var Xc=2147483648,nm=1;function om(){try{let e=rm(import.meta.url)("bun:ffi"),l=e.dlopen("kernel32.dll",{SetThreadExecutionState:{args:[e.FFIType.u32],returns:e.FFIType.u32}});return(v)=>l.symbols.SetThreadExecutionState(v)}catch{return null}}function im(e,l){if(e==="ac_only"||!l)return{status:"unsupported",release:async()=>"unsupported"};let v=l((Xc|nm)>>>0)===0?"failed":"held";return{get status(){return v},async release(){if(v==="held")l(Xc);return v="failed","released"}}}async function Zc(e,l={}){let v=l.platform??process.platform;if(v==="win32")return im(e,l.setExecutionState??om());if(v!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let D,M="failed",L=!1,z,re=Promise.resolve(),G=(X)=>{if(M===X)return;M=X,l.onStatusChange?.(X)},ce=()=>{if(L||z)return;z=setTimeout(()=>{z=void 0,re=we()},l.retryMs??5000),z.unref()},we=async()=>{try{let X=(l.spawn??tm)("/usr/bin/caffeinate",[e==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(D=X,X.once("exit",()=>{if(!L&&D===X)G("failed"),ce()}),await new Promise((he,Se)=>{X.once("spawn",he),X.once("error",Se)}),X.exitCode===null&&X.signalCode===null)G("held")}catch{G("failed"),ce()}};re=we(),await re;let te;return{get status(){return M},release(){return te??=(async()=>{L=!0,clearTimeout(z),await re;let X=D;if(!X||X.exitCode!==null||X.signalCode!==null||!X.pid)return M="failed","released";let he=await new Promise((Se)=>{let Re,Ee=setTimeout(()=>{try{X.kill("SIGKILL")}catch{}Re=setTimeout(()=>Se("failed"),1000)},1000);X.once("exit",()=>{clearTimeout(Ee),clearTimeout(Re),Se("released")});try{X.kill("SIGTERM")}catch{}});if(he==="released")M="failed";return he})()}}}class Tn extends Error{constructor(){super("Reason Device operation lease expired.")}}class hi{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor(e,l,v){this.now=l;this.onExpire=v;this.clockFloor=l(),this.install(e)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let e=new Tn;if(!this.closed)this.close(),this.onExpire(e);throw e}acknowledge(e){this.assertCurrent(),this.install(e)}close(){this.closed=!0,clearTimeout(this.timer)}install(e){let l=Date.parse(e);if(!Number.isFinite(l))throw Error("Reason returned an invalid operation lease deadline.");if(l-this.clockNow()<=0)throw new Tn;this.deadline=l,clearTimeout(this.timer),this.arm()}clockNow(){let e=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,e-this.clockTick)),this.clockTick=e,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new Tn)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as dm}from"fs";import{randomUUID as um}from"crypto";import{constants as Sa}from"fs";import{open as am}from"fs/promises";import{join as sm}from"path";var cm={platform:process.platform,home:s,async openFile(e){let l=await am(e,Sa.O_RDONLY|Sa.O_NOFOLLOW|Sa.O_NONBLOCK);return{isFile:async()=>(await l.stat()).isFile(),close:()=>l.close()}}};async function Qc(e=cm){if(e.platform!=="darwin")return"unknown";try{let l=await e.openFile(sm(e.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await l.isFile()?"granted":"unknown"}finally{await l.close()}}catch(l){return l instanceof Error&&"code"in l&&["EACCES","EPERM"].includes(String(l.code))?"not_granted":"unknown"}}class Ra extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function lm(e,l,v){l.throwIfAborted();let D=new AbortController,M=()=>{},L,z=new Promise((re,G)=>{M=()=>{D.abort(l.reason),G(l.reason)},l.addEventListener("abort",M,{once:!0}),L=setTimeout(()=>{let ce=new Ra;D.abort(ce),G(ce)},v)});try{return await Promise.race([e(D.signal),z])}finally{clearTimeout(L),l.removeEventListener("abort",M),D.abort()}}function el(e){let l=0,v=0;return async(D)=>{for(;;){D.throwIfAborted(),e.lease.assertCurrent();while(performance.now()<v)await e.sleep(Math.min(v-performance.now(),e.lease.remainingMs()),D),D.throwIfAborted(),e.lease.assertCurrent();try{let M=await lm(e.send,D,Math.min(8000,e.lease.remainingMs()));return D.throwIfAborted(),e.lease.assertCurrent(),M}catch(M){let L=M instanceof Ra||(M instanceof k?or(M.status):sr(M));if(L){let z=Math.max(Math.min(500*2**Math.min(l++,4),5000),e.retryAfterMs(M));v=performance.now()+z}if(D.throwIfAborted(),e.lease.assertCurrent(),!L)throw M}}}}function $a(e,l=process.env){return!e.proxied&&l.REASON_DEVICE_SESSION!=="0"}function cl(e,l,v){let D=e?.permissionRecovery;return fr(D,v)&&D.deviceId===l.deviceId&&D.organizationId===l.orgId?{permissionRecovery:D}:{}}var fm=1000,mm=250,pm=16,hm=5000,gm=Fc(dm(process.execPath)),tl=null,rl=null;function ll(e){if(process.platform!=="darwin")return{};return rl??=Qc().then((l)=>{tl={status:l,checkedAt:e().getTime()}}).finally(()=>{rl=null}),{fullDiskAccess:{...tl??{status:"unknown",checkedAt:e().getTime()},executablePath:gm}}}var wm=8,ym=64,_m=2000,bm=2000,Ba=8000,nl=3,km=250,ol=1000,il=30000,vm=0.2,Sm=30000,Rm=21600000,Em=300000,Pm=3600000,Cm=0.1,dl=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function Am(e){return Math.min(nl,Math.max(1,e??nl))}function xm(e){return typeof e.reason_code==="string"&&dl.has(e.reason_code)?e.reason_code:"cancelled"}function Ea(e){return e.reason instanceof r&&(e.reason.code==="cancelled"||dl.has(e.reason.code))?e.reason.code:"cancelled"}function al(e){return e instanceof r&&/^[A-Za-z0-9._:-]{1,160}$/.test(e.code)?e.code:"capability_failed"}function fl(e){return e.capability==="hands.connect"&&Za(e.payload)}function Pa(e,l=Math.random){let v=Math.min(Math.max(l(),0),1);return Math.max(0,Math.floor(e*(1+v*Cm)))}function Im(e,l=Math.random){let v=Math.min(il,ol*2**Math.max(0,e-1)),D=Math.min(Math.max(l(),0),1),M=v*vm*(D*2-1);return Math.min(il,Math.max(ol,Math.round(v+M)))}function Ua(e,l){return new Promise((v,D)=>{if(l.aborted){D(l.reason??new DOMException("Aborted","AbortError"));return}let M=()=>{clearTimeout(L),D(l.reason??new DOMException("Aborted","AbortError"))},L=setTimeout(()=>{l.removeEventListener("abort",M),v()},e);l.addEventListener("abort",M,{once:!0})})}class xa extends Error{updateError;constructor(e){super("Managed runtime update check failed.");this.updateError=e;this.name="RuntimeUpdateCheckError"}}async function Om(e,l,v,D){let M=new AbortController,L=()=>M.abort(v.reason);if(v.aborted)L();else v.addEventListener("abort",L,{once:!0});try{return await Promise.race([e,D(l,M.signal).then(()=>({kind:"heartbeat"}))])}finally{M.abort(),v.removeEventListener("abort",L)}}function Ta(e){return e instanceof Error?e.message:String(e)}function Wa(e,l){return l.aborted||e instanceof DOMException&&e.name==="AbortError"||e instanceof Error&&e.name==="AbortError"}function _r(e){return e instanceof k&&e.status===409&&e.code==="attempt_fenced"}function Na(e){return e.capability==="environment.install"}function Dm(e){if(e instanceof yi||e instanceof Tn||e instanceof So)return"timeout";if(!(e instanceof Error)||e instanceof k)return"transport_unknown";for(let l of[e,e.cause]){if(!(l instanceof Error)||l instanceof k||!("code"in l))continue;switch(l.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function ko(e,l,v){if(!e.state.worker&&!e.connectionDiagnostics)return;if(_r(v))return;let D=v instanceof k&&Number.isInteger(v.status)&&v.status>=100&&v.status<=599?{stage:l,category:"http",httpStatus:v.status}:{stage:l,category:Dm(v)};e.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:D})}async function Ln(e,l,v){try{return await v()}catch(D){if(!e.signal.aborted)ko(e,l,D);throw D}}class So extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function Ha(e,l,v,D){let M=l.capability==="inference.custom.v1"&&v.status!=="succeeded"?{status:v.status,error_code:v.status==="cancelled"?"operation_cancelled":Hr(v.error_code)?v.error_code:"custom_endpoint_unavailable"}:Na(l)&&v.status!=="succeeded"?{status:v.status,error_code:v.status==="cancelled"?"operation_cancelled":v.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:v,L=new AbortController,z=D?AbortSignal.any([D,L.signal]):L.signal,re=e.sleep??Ua,G=e.operationCompletionTimeoutMs??Ba,ce=performance.now()+G,we,te,X=new Promise((Re,Ee)=>{let Oe=()=>{let Ce=new So;L.abort(Ce),Ee(Ce)},Me=(Ce)=>{clearTimeout(we),we=setTimeout(Oe,Ce)};if(te=()=>Me(Math.max(0,Math.min(ce-performance.now(),_m))),Me(G),e.signal.addEventListener("abort",te,{once:!0}),e.signal.aborted)te()}),he,Se=0;try{while(!0)try{he=await Promise.race([e.client.completeOperation(e.state,l,M,z),X]);break}catch(Re){if(z.aborted||e.signal.aborted||ee(Re)||_r(Re)||!Mm(Re)||performance.now()>=ce)throw ko(e,"completion",Re),Re;Se+=1;let Ee=Math.min(500*2**Math.min(Se-1,4),Math.max(0,ce-performance.now()));if(Ee<=0)throw ko(e,"completion",Re),Re;try{await re(Ee,z)}catch{throw ko(e,"completion",Re),Re}}}finally{clearTimeout(we),e.signal.removeEventListener("abort",te),L.abort()}e.onEvent?.({type:"completed",operationId:l.operation_id,status:he.status})}function Mm(e){if(ee(e))return!1;if(_r(e))return!1;if(e instanceof k)return e.status===408||e.status===429||e.status>=500&&e.status<=504;if(e instanceof Error){if(e.name==="AbortError"||e instanceof So)return!1;return!0}return!1}class yi extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function gi(e){if(e instanceof yi)return!0;return e instanceof k?or(e.status):sr(e)}function Tm(e,l,v,D){let M=Math.min(v,l*2**Math.min(e-1,10));return e<=1?M:Math.round(M/2+M/2*D())}function wi(e,l){if(!(e instanceof k)||!e.retryAfter)return 0;let v=e.retryAfter.trim(),D=/^\d+(?:\.\d+)?$/.test(v)?Number(v)*1000:Date.parse(v)-l;return Number.isNaN(D)?0:Math.max(0,D)}async function Lm(e,l,v,D,M){let L=new AbortController,z,re=()=>{return},G=new Promise((we,te)=>{let X=()=>{let he=D.reason??new DOMException("Aborted","AbortError");L.abort(he),te(he)};if(re=()=>D.removeEventListener("abort",X),D.aborted)X();else D.addEventListener("abort",X,{once:!0})}),ce=new Promise((we,te)=>{z=setTimeout(()=>{let X=new yi;L.abort(X),te(X)},M)});try{return await Promise.race([e.client.operationHeartbeat(e.state,l,{transientRetryOwner:"caller",...v.controlAckSeq===void 0?{}:{controlAckSeq:v.controlAckSeq},clientRetryCount:v.clientRetryCount,...v.waitMs===void 0?{}:{waitMs:v.waitMs},signal:L.signal}),G,ce])}finally{if(z!==void 0)clearTimeout(z);re()}}async function sl(e,l,v,D,M,L){let z=Am(e.operationHeartbeatMaxAttempts),re=e.operationHeartbeatAttemptTimeoutMs??Ba,G=e.operationHeartbeatRetryDelayMs??km,ce=L.remainingMs(),we=Math.min(ce,z*re+G*z*(z-1)/2);for(let te=0;te<z;te+=1)try{D.throwIfAborted(),L.assertCurrent();let X=Math.min(re,L.remainingMs()),he=await Lm(e,l,{...v,waitMs:v.waitMs===void 0?void 0:Math.min(v.waitMs,Math.max(0,Math.floor(X-1000))),clientRetryCount:te},D,X);return D.throwIfAborted(),L.acknowledge(he.lease_until),he}catch(X){if(D.aborted||te+1>=z||_r(X)||ee(X)||!gi(X)){if(!D.aborted)ko(e,"operation_heartbeat",X);throw X}let he=ce-L.remainingMs(),Se=wi(X,(e.now?.()??new Date).getTime()),Re=Math.max(G*(te+1),we*(te+1)/z-he,Se);await M(Math.min(L.remainingMs(),Re),D),L.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function Wm(e,l,v,D,M){let L=fl(l),z=new AbortController,re=new AbortController,G=()=>{z.abort(e.signal.reason),re.abort(e.signal.reason)};if(e.signal.aborted)G();else e.signal.addEventListener("abort",G,{once:!0});let ce=null,we,te,X=-1,he=0,Se=Promise.resolve(),Re=[],Ee=new AbortController,Oe=!1,Me,Ce=null,Te=!1,We,$e,Ue={},Ne=(Ve)=>{Oe=!0,Ee.abort(Ve),z.abort(Ve),re.abort(Ve)},xe=(Ve)=>{if(Me)return Me;let Je=structuredClone(Ve),it=he;return Me=(async()=>{let Ye=new AbortController,Be=Ye.signal;Be.throwIfAborted();let Ke,Fe=()=>{},nt=new Promise((Ze,He)=>{if(Fe=()=>He(Be.reason),Be.addEventListener("abort",Fe,{once:!0}),Ke=setTimeout(()=>Ye.abort(Error("Hands stop receipt delivery timed out.")),4000),Be.aborted)Fe()});try{for(let Ze=0;Ze<3;Ze+=1){Be.throwIfAborted();try{let He=await Promise.race([Ln(e,"event",()=>e.client.operationEvents(e.state,l,{eventSeqStart:it,events:[Je],signal:Be,transientRetryOwner:"caller"})),nt]);if(Be.throwIfAborted(),He.next_event_seq!==it+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");he=He.next_event_seq;return}catch(He){if(ee(He))M(He);let at=He instanceof k?or(He.status):sr(He);if(Be.aborted||!at||Ze===2)throw He;let lt=Math.max(500*2**Ze,wi(He,(e.now?.()??new Date).getTime()));await Promise.race([v(lt,Be),nt])}}}finally{clearTimeout(Ke),Be.removeEventListener("abort",Fe),Ye.abort()}})(),Me},Le=(Ve,Je,it)=>{let Ye=(Ke)=>Ln(e,"event",()=>e.client.operationEvents(e.state,l,{eventSeqStart:Je,events:Ve,signal:Ke,...it?{transientRetryOwner:"caller"}:{}})).catch((Fe)=>{if(l.capability==="hands.connect"&&_r(Fe))Ne(Fe);if(it&&(ee(Fe)||_r(Fe))){if(ee(Fe))M(Fe);z.abort(Fe),re.abort(Fe),Ee.abort(Fe)}throw Fe});if(!it)return async(Ke)=>{if(l.capability!=="hands.connect"&&l.capability!=="inference.custom.v1"){he=(await Ye(Ke)).next_event_seq;return}Ke.throwIfAborted();let Fe=()=>{},nt=new Promise((Ze,He)=>{Fe=()=>He(Ke.reason),Ke.addEventListener("abort",Fe,{once:!0})});try{let Ze=await Promise.race([Ye(Ke),nt]);Ke.throwIfAborted(),he=Ze.next_event_seq}finally{Ke.removeEventListener("abort",Fe)}};let Be=el({send:Ye,lease:$e,sleep:v,retryAfterMs:(Ke)=>wi(Ke,(e.now?.()??new Date).getTime())});return async(Ke)=>{let Fe=await Be(Ke);if(Fe.next_event_seq!==Je+Ve.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");he=Fe.next_event_seq}},Ge=async(Ve,Je)=>{let it=Ve??await sl(e,l,{controlAckSeq:X,waitMs:Je},re.signal,v,$e),Ye=null,Be=!1;for(let Ke=0;Ke<10;Ke+=1){let Fe=X+1;for(let nt of it.controls){if(nt.seq!==Fe)throw Error("Reason returned an out-of-order Device operation control.");if(nt.kind==="cancel"||nt.kind==="operation.cancel")Ye??=xm(nt.payload),z.abort(new r(Ye,"Reason closed the Device operation."));if(nt.kind!=="cancel"&&nt.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(l.capability)){let Ze,He,at=new Promise((lt,kt)=>{Ze=lt,He=kt});at.catch(()=>{}),Ue.current={promise:at,resolve:Ze,reject:He}}try{Be||=!await e.onControl?.(l,nt)}catch(Ze){if(Ze instanceof r)we??=al(Ze);throw Ue.current?.reject(Ze),Ze}}X=nt.seq,Fe+=1}if(it.controls.length===0){if(it.next_control_seq!==X+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:Ye,unsupported:Be}}try{it=await sl(e,l,{controlAckSeq:X},re.signal,v,$e),Ue.current?.resolve()}catch(nt){if(Ue.current?.reject(nt),!Ye||_r(nt)||ee(nt))throw nt;return{cancellationReason:Ye,unsupported:Be}}}throw Error("Reason returned too many Device operation control batches.")};try{let Ve;try{if(!L)$e=new hi(l.lease_until,()=>(e.now?.()??new Date).getTime(),(Je)=>{if(!z.signal.aborted)ce=Je;z.abort(Je),re.abort(Je)});Ve=L||l.capability==="hands.connect"||l.capability==="display.stream.v1"||l.capability==="simulator.stream.v1"||Qr.has(l.capability)||l.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await Ge()}catch(Je){if(!Na(l)||_r(Je)||ee(Je))throw Je;await Ha(e,l,{status:e.signal.aborted?"cancelled":"failed"});return}if(Ve.cancellationReason||e.signal.aborted){let Je=Ve.cancellationReason??Ea(e.signal);z.abort(new r(Je,"Reason closed the Device operation.")),te={status:"cancelled",error_code:Je}}else if(Ve.unsupported)z.abort(),te={status:"failed",error_code:"control_unsupported"};else{let Je=L?Promise.resolve():(async()=>{let Ye=e.operationHeartbeatIntervalMs??e.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(l.capability)?bm:15000),Be=Math.min(Ye,Math.max(0,(e.operationHeartbeatAttemptTimeoutMs??Ba)-1000)),Ke=l.capability==="hands.connect"||l.capability==="pty.start"||l.capability==="display.stream.v1"||l.capability==="simulator.stream.v1"||l.capability==="browser.recording.v1"||l.capability==="browser.pr-proof.v1"||l.capability==="process.run.v1"||l.capability==="process.full.v1"||l.capability==="preview.serve.v1"||l.capability==="inference.custom.v1";while(!re.signal.aborted)try{if(!Ke){if(await v(Ye,re.signal),re.signal.aborted)return}let Fe=await Ge(void 0,Ke?Be:void 0);if(Fe.cancellationReason||Fe.unsupported){if(Fe.unsupported)ce=Error("Reason requested an unsupported Device operation control.");z.abort(Fe.cancellationReason?new r(Fe.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(Fe){if(ee(Fe))M(Fe);if(_r(Fe))ce=Fe,Ne(Fe);if(!re.signal.aborted)ce=Fe,z.abort();return}})();try{if($e?.assertCurrent(),z.signal.throwIfAborted(),D.authorized=()=>!z.signal.aborted&&(L||($e?.remainingMs()??0)>0),te=await e.onClaim(l,z.signal,async(Ye)=>{if(Na(l))return;if(Ye.kind==="permission.denied"){if(!D.authorized())return;let at=Ye.data,lt=(e.now??(()=>new Date))().getTime(),kt=e.statusPath??mr(),jt=(e.loadStatus??rt)(kt),Kt={id:um(),kind:"permission_denied",operation:at?.operation,provenance:at?.provenance,occurredAt:new Date(lt).toISOString(),expiresAt:new Date(lt+600000).toISOString(),sessionId:l.run_id,deviceId:e.state.deviceId,organizationId:e.state.orgId};if(jt&&fr(Kt,lt)){let pr=jt.permissionRecovery;if(!pr||!fr(pr,lt)||pr.sessionId!==Kt.sessionId||pr.operation!==Kt.operation||pr.provenance!==Kt.provenance)(e.saveStatus??Si)({...jt,permissionRecovery:Kt},kt)}return}let Be=l.capability==="hands.connect"&&Ye.capability==="hands.connect"&&Ye.kind==="hands.stopped",Ke=l.capability==="hands.connect"&&Ye.kind==="hands.reconnected",Fe=Ke||l.capability==="inference.custom.v1"?AbortSignal.any([z.signal,Ee.signal,...Ye.deliverySignal?[Ye.deliverySignal]:[]]):l.capability==="hands.connect"?AbortSignal.any([e.signal,Ee.signal]):e.signal,nt={kind:Ye.kind,payload:{sequence:Ye.sequence,capability:Ye.capability,...Ye.data?{data:Ke?structuredClone(Ye.data):Ye.data}:{}}};if(l.capability==="hands.connect"&&Ye.capability==="hands.connect"&&(Ye.kind==="started"||Ye.kind==="hands.started")||(Qr.has(l.capability)||l.capability==="pty.start")&&Ye.kind==="started")return new Promise((at,lt)=>{Re.push({wireEvent:nt,settle:(kt)=>kt===void 0?at():lt(kt)})});let Ze=Re;Re=[];let He=Se.then(async()=>{if((Oe||e.signal.aborted)&&l.capability==="hands.connect"&&!L){if(Be)await xe(nt);return}if(Ce!==null){if(Ye.kind!=="hands.stopped"||!Te||!We)throw Ce;let lt=new AbortController,kt=AbortSignal.any([e.signal,Ee.signal,lt.signal]),jt=setTimeout(()=>lt.abort(Error("Hands stop receipt reconciliation timed out.")),4000);Te=!1;try{await We(kt),We=void 0,await Le([nt],he,!0)(kt),Ce=null}catch(Kt){throw Ce=Kt??Error("Hands stop receipt could not be confirmed."),Kt}finally{clearTimeout(jt),lt.abort()}return}if(Ke&&!$e){let lt=Math.min(Date.parse(l.lease_until),Date.parse(String(l.payload.expires_at)));$e=new hi(new Date(lt).toISOString(),()=>(e.now?.()??new Date).getTime(),(kt)=>{z.abort(kt),re.abort(kt)})}let at=he;if(Ke)We=Le([...Ze.map((lt)=>lt.wireEvent),nt],at,!0),await We(Fe),We=void 0;else await Le([...Ze.map((lt)=>lt.wireEvent),nt],at,!1)(Fe)});He.then(()=>{for(let at of Ze)at.settle()},(at)=>{for(let lt of Ze)lt.settle(at??Error("Hands event delivery failed."))}),Se=He.catch((at)=>{if(ee(at))M(at);if(Ke){if(Ce===null)Te=Fe.aborted&&!Ee.signal.aborted,Ce=at??Error("Hands generation receipt delivery failed.");if(!Fe.aborted)z.abort(at),re.abort(at)}}),await He}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(l.capability))await Ue.current?.promise}catch(Ye){te=z.signal.aborted?{status:"cancelled",error_code:Ea(z.signal)}:{status:"failed",error_code:al(Ye)}}finally{D.authorized=()=>!1,Ee.abort();for(let Ye of Re.splice(0))Ye.settle();re.abort(),await Je}let it=Zn(l.capability)?Ma(te.result,l.operation_id):null;if(ce){if(ee(ce))throw ce;te={status:"failed",error_code:we??"control_or_heartbeat_failed",...it?{result:it}:{}}}else if(z.signal.aborted&&te.status==="succeeded")te={status:"cancelled",error_code:Ea(z.signal),...it?{result:it}:{}}}if($e?.close(),ee(e.signal.reason))throw e.signal.reason;await Ha(e,l,te)}finally{$e?.close(),Ee.abort(),re.abort(),e.signal.removeEventListener("abort",G)}}async function Fa(e){let l=e.now??(()=>new Date),v=e.sleep??Ua,D=e.saveStatus??Si,M=e.loadStatus??rt,L=e.statusPath??mr(),z=l().toISOString(),re=M(L)?.lastUsedAt,G=!1,ce=()=>({version:1,pid:process.pid,startedAt:z,...ll(l),...cl(M(L),e.state,l().getTime()),deviceId:e.state.deviceId,...e.idleSleepPolicy||e.readIdleSleepPolicy?{idleSleepHold:G}:{},...re?{lastUsedAt:re}:{}}),we=0,te,X=!1,he,Se,Re,Ee=Promise.resolve();D({...ce(),state:"starting"},L),e.onEvent?.({type:"started",deviceId:e.state.deviceId}),La();try{let Oe=async()=>{let Me=e.readIdleSleepPolicy?e.readIdleSleepPolicy():e.idleSleepPolicy;if(e.signal.aborted||Me===Se)return;if(he&&Se){let We=await he.release();if(e.onEvent?.({type:"idle_sleep",status:We,policy:Se}),We==="failed")return;he=void 0,Se=void 0,G=!1;let $e=M(L);if($e)D({...$e,idleSleepHold:G},L)}if(!Me)return;Se=Me;let Ce=!0;he=await(e.acquireAwakeHold??Zc)(Me,{onStatusChange:(We)=>{if(Ce)return;G=We==="held";let $e=M(L);if($e)D({...$e,idleSleepHold:G},L);e.onEvent?.({type:"idle_sleep",status:We,policy:Me})}}),Ce=!1,G=he.status==="held";let Te=M(L);if(Te)D({...Te,idleSleepHold:G},L);e.onEvent?.({type:"idle_sleep",status:he.status,policy:Me})};if(await Oe(),e.readIdleSleepPolicy)Re=setInterval(()=>{Ee=Ee.then(Oe).catch(()=>{e.onEvent?.({type:"idle_sleep",status:"failed",policy:Se??"battery_and_ac"})})},e.idleSleepPollMs??1000),Re.unref();while(!e.signal.aborted){let Me=!1;try{await Nm({...e,saveStatus:(Ce,Te)=>{if(Ce.state==="starting"||Ce.state==="error"||Ce.state==="stopped")return;re=Ce.lastUsedAt??re,D({...Ce,startedAt:z,...e.idleSleepPolicy||e.readIdleSleepPolicy?{idleSleepHold:G}:{}},Te)},onEvent:(Ce)=>{if(Ce.type==="error"&&Ce.diagnostic){e.onEvent?.(Ce);return}if(Ce.type==="started"||Ce.type==="error"||Ce.type==="stopped")return;if(Ce.type==="heartbeat"&&we>0&&!Me){Me=!0;let Te=we;we=0,te=void 0,e.onEvent?.({type:"reconnected",attempts:Te})}e.onEvent?.(Ce)}});return}catch(Ce){if(Wa(Ce,e.signal))return;if(ee(Ce)){X=!0;let We=e.state.worker?"worker_connection_failed":Ta(Ce);throw D({...ce(),state:"error",error:We},L),e.onEvent?.({type:"error",message:We}),Ce}we+=1;let Te=Im(we,e.reconnectRandom);te??=l().toISOString(),D({...ce(),state:"starting",reconnectingSince:te},L),e.onEvent?.({type:"reconnecting",message:e.state.worker?"worker_connection_failed":Ta(Ce),attempt:we,retryInMs:Te}),await v(Te,e.signal)}}}catch(Oe){if(!Wa(Oe,e.signal))throw Oe}finally{if(e.client.close?.(),clearInterval(Re),await Ee,he&&Se){let Oe=await he.release();G=Oe==="failed"&&he.status==="held",e.onEvent?.({type:"idle_sleep",status:Oe,policy:Se})}if(!X)D({...ce(),state:"stopped"},L);else{let Oe=M(L);if(Oe)D({...Oe,idleSleepHold:G},L)}e.onEvent?.({type:"stopped"})}}async function Nm(e){let l=e.now??(()=>new Date),v=e.sleep??Ua,D=e.statusPath??mr(),M=e.saveStatus??Si,L=e.loadStatus??rt,z=l().toISOString(),re=L(D)?.lastUsedAt,G=e.runtimeUpdate,ce=new AbortController,we=()=>ce.abort(e.signal.reason);if(e.signal.aborted)we();else e.signal.addEventListener("abort",we,{once:!0});let te=G?.random??Math.random,X=e.maxConcurrentClaims,he=typeof X==="number"&&Number.isSafeInteger(X)&&X>0?Math.min(ym,X):wm,Se=0,Re=!1,Ee=null,Oe=(tt)=>{Ee??=tt,ce.abort(tt)},Me=new Map,Ce=()=>{let tt=new Set,yt=0;for(let{claim:Wr}of Me.values()){let Xe=Wr.capability==="hands.connect"?Wr.payload[pe]:void 0;if(typeof Xe==="string"){if(tt.has(Xe))continue;tt.add(Xe)}yt+=1}return yt},Te=null,We=()=>[...Me.values()].some((tt)=>tt.authorized()),$e=()=>[...Me.values()].every((tt)=>tt.claim.capability==="preview.serve.v1"),Ue=G?new Date(z).getTime()+Pa(G.initialDelayMs??Sm,te):Number.POSITIVE_INFINITY,Ne=null,xe=!1,Le=e.firstHeartbeat,Ge=Le?.account_root_metadata_supported===!0,Ve=Le?.workspace_root_metadata_supported===!0,Je=Le?.account_root_path_supported===!0,it=Le?.home_contained_roots_supported===!0,Ye=Le?.root_paths_supported===!0,Be=Le?.startup_supported===!0,Ke=Le!==void 0,Fe=Le?{challenge:Le.challenge,expires_at:Le.expires_at}:void 0,nt,Ze=!e.startup,He=()=>({version:1,pid:process.pid,startedAt:z,...ll(l),...cl(L(D),e.state,l().getTime()),...re?{lastUsedAt:re}:{},deviceId:e.state.deviceId,...Ne?{organizationId:Ne.organization_id,organizationName:Ne.organization_name,organizationSlug:Ne.organization_slug}:{}}),at=()=>{let tt=(e.advertised??e.claimable)?.()!==!1;if(!Ze)nt??=e.startup?.();return{...e.deviceMetadata?.device_model!=null?{device_model:e.deviceMetadata.device_model}:{},...e.deviceMetadata?.device_chip!=null?{device_chip:e.deviceMetadata.device_chip}:{},...e.deviceMetadata?.device_location!=null?{device_location:e.deviceMetadata.device_location}:{},reason_runtime_version:e.runtimeVersion,bridge_version:e.bridgeVersion,protocol_version:e.protocolVersion,execution_eligible:tt,...Be&&!Ze&&nt?{startup:nt}:{},capabilities:tt?Ia(e.capabilities,{accountRootMetadataSupported:Ge,workspaceRootMetadataSupported:Ve,accountRootPathSupported:Je,homeContainedRootsSupported:it,rootPathsSupported:Ye}):{supported_operations:[]}}},lt=()=>{if(xe||!e.client.identity)return;xe=!0,e.client.identity(e.state,e.signal).then((tt)=>{if(tt.organization_id!==e.state.orgId)return;Ne=tt;let yt=L(D);if(!yt)return;M({...yt,organizationId:tt.organization_id,organizationName:tt.organization_name,organizationSlug:tt.organization_slug},D)}).catch(()=>{return})},kt=(tt)=>{Ge=tt.account_root_metadata_supported===!0,Ve=tt.workspace_root_metadata_supported===!0,Je=tt.account_root_path_supported===!0,it=tt.home_contained_roots_supported===!0,Ye=tt.root_paths_supported===!0,Be=tt.startup_supported===!0,Ke=!1},jt=(tt)=>{if(tt.startup)Ze=!0},Kt=(tt,yt)=>{if(!(yt instanceof k&&yt.status===400&&yt.code==="invalid_heartbeat")||!tt.startup&&!Ke)throw yt;if(Ze=!0,Ke)Ge=Ve=Je=!1,it=Ye=Be=Ke=!1;return null},pr=(tt)=>{kt(tt),M({...He(),state:"connected",lastHeartbeatAt:l().toISOString()},D),lt(),e.onEvent?.({type:"heartbeat",serverTime:tt.server_time,drain:tt.drain,...tt.latest_cli_versions?{latestCliVersions:tt.latest_cli_versions}:{},...tt.hands_prespawn?{handsPrespawn:!0}:{}})},Xr=!1,Rn=!1;e.registerHeartbeatNow?.(()=>{if(e.signal.aborted)return;if(Xr)Rn=!0;let tt=at();Ln(e,"heartbeat",()=>e.client.heartbeat(e.state,tt,ce.signal).catch((yt)=>Kt(tt,yt))).then((yt)=>{if(!yt)return;jt(tt),kt(yt),pr(yt)},()=>{return})});let Lr=(tt)=>v(tt,e.signal);M({...He(),state:"starting"},D),e.onEvent?.({type:"started",deviceId:e.state.deviceId});let xr=!1,an=e.maxConsecutiveHeartbeatFailures??3,Ir=0,er=0,In=0,jo=0,sn=null;try{while(!e.signal.aborted){if(Ee)throw Ee;if(Re&&$e())break;let tt,yt=er>0&&er<pm&&performance.now()-jo<hm&&sn!==null;if(!yt)er=0;e:{if(yt&&sn){tt=sn;break e}let vt=at(),rr=Fe;Fe=void 0,Xr=!0,Rn=!1;try{let At=await Ln(e,"heartbeat",()=>e.client.heartbeat(e.state,vt,ce.signal,...rr?[rr]:[]).catch((Sr)=>Kt(vt,Sr)));if(Xr=!1,!At)continue;tt=At,jt(vt),jo=performance.now(),Ir=0}catch(At){if(Xr=!1,e.signal.aborted)break;if(!gi(At))throw At;if(Ir+=1,Ir>=an&&!We())throw At;await v(Math.min(e.heartbeatRetryDelayMs??2000,e.heartbeatIntervalMs??15000),e.signal);continue}if(kt(tt),Object.keys(at().capabilities).length>Object.keys(vt.capabilities).length)continue;if(Rn)continue;if(pr(tt),Ee)throw Ee;if(e.signal.aborted)break;if(G&&["available","required"].includes(tt.update_policy??""))Ue=Math.min(Ue,l().getTime());if(G&&l().getTime()>=Ue)try{let At=new AbortController,Sr=()=>At.abort(e.signal.reason);if(e.signal.aborted)Sr();else e.signal.addEventListener("abort",Sr,{once:!0});let $r;try{$r=G.check(At.signal)}catch(Ft){$r=Promise.reject(Ft)}let cn=$r.then((Ft)=>({kind:"completed",result:Ft}),(Ft)=>({kind:"failed",error:Ft})),Br;try{while(!0){let Ft=await Om(cn,e.heartbeatIntervalMs??15000,e.signal,v);if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");if(Ft.kind==="failed")throw new xa(Ft.error);if(Ft.kind==="completed"){Br=Ft.result;break}try{let Gt=at(),Qn=await Ln(e,"heartbeat",()=>e.client.heartbeat(e.state,Gt,ce.signal).catch((qo)=>Kt(Gt,qo)));if(!Qn)continue;tt=Qn,jt(Gt),pr(tt),Ir=0}catch(Gt){if(e.signal.aborted)throw Gt;if(!gi(Gt))throw Gt;if(Ir+=1,Ir>=an&&!We())throw Gt}}}catch(Ft){At.abort(Ft);let Gt=await cn;if(Gt.kind==="completed"&&Gt.result==="activated")Br="activated";else throw Ft}finally{e.signal.removeEventListener("abort",Sr)}if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");if(Se=0,Br==="activated"){if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");e.onEvent?.({type:"runtime_updated"}),Re=!0}Ue=l().getTime()+Pa(G.intervalMs??Rm,te)}catch(At){if(!(At instanceof xa))throw At;Se+=1;let Sr=G.retryBaseMs??Em,$r=G.retryMaxMs??Pm,cn=Math.min($r,Sr*2**Math.min(Se-1,8));Ue=l().getTime()+Pa(cn,te)}}if(sn=tt,e.signal.aborted)break;if(Re&&$e())break;if(Re){await Lr(e.heartbeatIntervalMs??15000);continue}let Wr=e.client.sessionCadence?.(e.state)??null,Xe=Wr?.presenceIntervalMs??e.heartbeatIntervalMs??15000;if(tt.drain||e.claimable?.()===!1){er=0,await Lr(Xe);continue}if(Ce()>=he){er=0;let vt=new AbortController;Te=vt;try{await v(Xe,AbortSignal.any([e.signal,vt.signal]))}catch(rr){if(!vt.signal.aborted)throw rr}finally{if(Te===vt)Te=null}continue}let st,Ct=yt?0:Wr?.claimWaitMs??Math.min(e.heartbeatIntervalMs??15000,30000),Vt=performance.now();try{st=await Ln(e,"claim",()=>e.client.claimOperation(e.state,{waitMs:Ct,signal:ce.signal}))}catch(vt){if(er=0,e.signal.aborted||!gi(vt)||!We())throw vt;In+=1;let rr=Math.min(e.heartbeatRetryDelayMs??2000,e.heartbeatIntervalMs??15000);await Lr(Math.max(Tm(In,rr,Math.max(rr,Ct),te),wi(vt,(e.now?.()??new Date).getTime())));continue}if(In=0,Ee)throw Ee;if(!st){if(yt){er=0;continue}if(performance.now()-Vt<Ct-mm)await Lr(fm);continue}if(e.claimable?.()===!1){er=0,await Ha(e,st,{status:"cancelled",error_code:"execution_authority_withdrawn"},e.signal);continue}re=l().toISOString(),M({...He(),state:"connected",lastHeartbeatAt:l().toISOString()},D),e.onEvent?.({type:"claim",operationId:st.operation_id,runId:st.run_id,attemptId:st.attempt_id,capability:st.capability});let Tt,gr={authorized:()=>!1,claim:st};if(Tt=Wm({...e,signal:ce.signal},st,v,gr,Oe).catch((vt)=>{if(ee(vt))Oe(vt);else if(!_r(vt)&&[...Me].some(([rr,At])=>rr!==Tt&&At.authorized())){if(vt instanceof So)e.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!_r(vt)&&Ee===null)Ee=vt}).finally(()=>{Me.delete(Tt),Te?.abort(),e.onEvent?.({type:"claims_changed",activeClaims:Me.size})}),Me.set(Tt,gr),e.onEvent?.({type:"claims_changed",activeClaims:Me.size}),er+=1,fl(st)){if(er=0,await Tt,Ee)throw Ee}}}catch(tt){if(!Wa(tt,e.signal)){ce.abort(tt),xr=!0;let yt=e.state.worker?"worker_connection_failed":Ta(tt);throw M({...He(),state:"error",error:yt},D),e.onEvent?.({type:"error",message:yt}),tt}}finally{if(ce.abort(),await Promise.allSettled(Me.keys()),e.signal.removeEventListener("abort",we),!xr)M({...He(),state:"stopped"},D);e.onEvent?.({type:"stopped"})}}import{execFile as dp}from"child_process";import{constants as Al,existsSync as up,mkdtempSync as Ga,rmSync as Dl}from"fs";import{access as xl,open as fp,readFile as Il,readlink as mp,readdir as Ol,unlink as pp,rmdir as hp}from"fs/promises";import{tmpdir as gp}from"os";import{basename as Ya,join as Ri}from"path";import{randomUUID as pn}from"crypto";import{chmodSync as Hm,closeSync as $m,fsyncSync as Bm,openSync as Um,readFileSync as Fm,rmdirSync as ml,unlinkSync as pl,writeFileSync as jm}from"fs";import{createConnection as qm,createServer as zm}from"net";import{dirname as Km,join as Vm}from"path";var Jm=5000;async function hl(e,l,v){if(v.aborted)return!1;let D={generation:1,fenceId:pn()},M={runId:pn(),deviceId:pn(),rootId:pn(),apiOrigin:e.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>D},L=si(l,M),z={version:1,snapshot_id:pn(),revision:1,run_id:M.runId,device_id:M.deviceId,root_id:M.rootId,binding:{...M.binding,target_generation:D.generation,target_fence_id:D.fenceId},expires_at:new Date(M.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return L.install(z).installed&&L.current().snapshot_id===z.snapshot_id&&!v.aborted}catch{return!1}finally{try{pl(L.path)}catch{}}}async function bl(e,l,v=$t){if(l.aborted)return!1;let D,M,L=new Set,z=pn(),re=zm((X)=>{L.add(X),X.once("close",()=>L.delete(X)),X.on("error",()=>X.destroy()),X.end(z)});re.maxConnections=1;let G,ce,we=new Promise((X)=>{ce=()=>X(!1)}),te=setTimeout(ce,Jm);l.addEventListener("abort",ce,{once:!0});try{D=v({runtimeDirectory:p(e),root:e.workspaceRoot,runId:`readiness-${pn()}`}),M=Vm(D.journalDirectory,"readiness.json");let X=Um(M,"wx",384);try{jm(X,z),Bm(X)}finally{$m(X)}if(Fm(M,"utf8")!==z||l.aborted)return!1;let he=new Promise((Se)=>{re.once("error",()=>Se(!1)),re.listen(D.socketPath,()=>{try{if(process.platform!=="win32")Hm(D.socketPath,384)}catch{Se(!1);return}G=qm(D.socketPath);let Re="";G.setEncoding("utf8"),G.once("error",()=>Se(!1)),G.on("data",(Ee)=>{if(Re+=Ee,Re.length>z.length)G?.destroy(),Se(!1)}),G.once("end",()=>Se(Re===z)),G.once("close",()=>Se(!1))})});return await Promise.race([he,we])&&!l.aborted}catch{return!1}finally{clearTimeout(te),l.removeEventListener("abort",ce),G?.destroy();for(let X of L)X.destroy();if(await new Promise((X)=>re.close(()=>X())),D?.disposeSocket(),M)try{pl(M)}catch{}if(D){try{ml(D.journalDirectory)}catch{}try{ml(Km(D.journalDirectory))}catch{}}}}import{execFileSync as bi}from"child_process";import{randomUUID as dr}from"crypto";import{chmodSync as kl,chownSync as El,closeSync as Ka,constants as Mr,existsSync as Gm,fstatSync as Pl,mkdirSync as vl,mkdtempSync as Ym,openSync as Va,readFileSync as Xm,readSync as Zm,realpathSync as Qm,rmdirSync as ep,rmSync as tp}from"fs";import{join as gn}from"path";import{fileURLToPath as rp}from"url";var Sl=1e4,np=!1;function ki(){if(process.platform!=="linux")return!1;return np||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some((e)=>{try{let l=bi(e,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),v=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(l);return v!==null&&Number(v[1])*100+Number(v[2])>=302}catch{return!1}})}var op=Buffer.from([0,255,3,4]);function Rl(e){return`printf "%s\\n" ${e==="foreground"?"$$":"$!"} > ${e}.pid.tmp; /bin/mv ${e}.pid.tmp ${e}.pid`}function ip(e,l,v){if(!Number.isSafeInteger(l)||l<2||!Number.isSafeInteger(v)||v<2||e.length>4096||!e.startsWith(`${l} (`))return!1;let D=e.lastIndexOf(") ");if(D<0)return!1;let M=e.slice(D+2).trim().split(/\s+/);return M.length>=20&&/^[A-Za-z]$/.test(M[0])&&/^\d+$/.test(M[1])&&M[2]===String(l)&&M[3]===String(v)&&/^[1-9][0-9]*$/.test(M[19])}async function Ro(e,l={}){if(process.platform==="win32")return!e.aborted&&_i();if(e.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let v=J(),{directory:D,root:M,runtimeDirectory:L}=cp(v),z=new AbortController,re=()=>z.abort();e.addEventListener("abort",re,{once:!0});let G;z.signal.addEventListener("abort",()=>G?.close(),{once:!0});let ce=setTimeout(re,Sl),we={organization_id:dr(),user_id:dr(),device_id:dr()},te=dr(),X=dr(),he=dr(),Se=dr(),Re=Date.now()+Sl,Ee={kind:"workspace_source",target_revision:0,root_grant_revision:1},Oe=dr().replaceAll("-",""),Me,Ce=Buffer.alloc(0),Te,We=!1,$e=!1,Ue=!1,Ne=!1,xe,Le,Ge,Ve=async(it)=>{while(!it()){if(z.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((Ye)=>setTimeout(Ye,20))}if(z.signal.aborted)throw Error("pty_probe_cancelled")},Je=!1;try{G=ap(D,v),xe=Bun.serve({hostname:"127.0.0.1",port:0,fetch(Be,Ke){let Fe=new URL(Be.url).pathname,nt=Fe===`/device/hands/${Oe}`?"hands":Fe===`/device/pty/${Oe}`?"pty":null;if(nt&&Ke.upgrade(Be,{data:{lane:nt}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(Be){if(Be.data.lane==="pty")Me=Be},message(Be,Ke){if(Be.data.lane!=="pty")return;if(typeof Ke==="string"){try{if(JSON.parse(Ke).t==="open")We=!0}catch{re()}return}if(Ce.length+Ke.length>8192){re();return}Ce=Buffer.concat([Ce,Ke])}}});let it=`ws://127.0.0.1:${xe.port}`;if(Le=et({headless:!0,managedPty:{version:1},root:M,runtimeDirectory:L,runId:te,operationId:dr(),attemptId:dr(),claimOwner:we,deviceIdentity:{deviceId:we.device_id,rootId:X,apiOrigin:"https://worker-probe.invalid"},signal:z.signal,payload:{relay_url:`${it}/device/hands/${Oe}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(Re).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:F,hands_worker_version:U,hands_worker_artifact_sha256:T,hands_worker_entrypoint:H,target_generation:1,target_fence_id:he,environment_binding:Ee,[E]:_e},emitEvent:async(Be)=>{if(Be==="hands.started")Ne=!0;if(Be==="hands.ready")$e=!0;if(Be==="hands.stopped")Ue=!0}},{browserExecutablePath:null,slot:Co(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:rp(new URL("./worker-candidate-entry.ts",import.meta.url)),...l}).catch(()=>{if(!$e)re()}),await Ve(()=>$e),Qe({root:M,runId:te,payload:{version:1,snapshot_id:Se,revision:1,run_id:te,root_id:X,device_id:we.device_id,binding:{...Ee,target_generation:1,target_fence_id:he},expires_at:new Date(Re).toISOString(),variables:{PTY_PROBE_VALUE:Oe},git:null}}),Ge=rn({root:M,runId:te,rootId:X,deviceId:we.device_id,owner:we,workspace:{kind:"root"},authority:{device_id:we.device_id,binding:Ee.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:he},signal:z.signal,session:{jobId:`pty-${dr()}`,sessionId:"pty-readiness",operationId:dr(),cols:80,rows:24,leaseExpiresAtMs:Re,relayUrl:`${it}/device/pty/${Oe}`},emit:async(Be,Ke)=>{if(Be==="pty.ready")Te=Ke}}).catch(()=>{re()}),await Ve(()=>Boolean(Te&&Me&&We)),Me.send(JSON.stringify({t:"resize",cols:100,rows:30})),Me.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${Oe}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${G.wait("background")}) & ${Rl("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${Rl("foreground")}; ${G.wait("foreground")}'
+`)),await Ve(()=>Gm(gn(M,"foreground.pid"))&&Ce.includes(op)),!Ce.includes("30 100")||Te.job.environmentSnapshotId!==Se||Te.job.environmentRevision!==1)return!1;let Ye=["background.pid","foreground.pid"].map((Be)=>sp(gn(M,Be)));if(new Set(Ye).size!==2||Ye.some((Be)=>!Number.isSafeInteger(Be)||Be<2||Be===Te.job.process.pid))return!1;if(process.platform==="linux"){if(!Ye.every((Be)=>ip(Xm(`/proc/${Be}/stat`,"utf8"),Be,Te.job.process.pid)))return!1}else{let Ke=bi("/bin/ps",["-o","pid=,pgid=","-p",Ye.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((Fe)=>Fe.trim().split(/\s+/).map(Number));if(Ke.length!==2||new Set(Ke.map(([Fe])=>Fe)).size!==2||Ke.some((Fe)=>Fe.length!==2||!Ye.includes(Fe[0])||Fe[0]!==Fe[1]))return!1}if(Me.send(JSON.stringify({t:"close"})),await Ge,z.signal.aborted)return!1;for(let Be of[Te.job.process.pid,...Ye])try{return process.kill(Be,0),!1}catch(Ke){if(!(Ke instanceof Error&&("code"in Ke)&&Ke.code==="ESRCH"))return!1}Je=!0}catch{Je=!1}finally{if(clearTimeout(ce),e.removeEventListener("abort",re),re(),G?.close(),await Ge,await Le,await xe?.stop(!0),!Ne||Ue)lp({directory:D,root:M},v)}return Je&&Ue&&!e.aborted}function ap(e,l){let v={foreground:gn(e,"foreground.lifeline"),background:gn(e,"background.lifeline")};if(!Object.values(v).every((L)=>/^\/[A-Za-z0-9/._-]+$/.test(L)))throw Error("pty_probe_path");bi("/usr/bin/mkfifo",["-m","0600",...Object.values(v)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let D=[],M=()=>{for(let L of D.splice(0))Ka(L)};try{for(let L of Object.values(v)){let z=Va(L,Mr.O_RDONLY|Mr.O_NONBLOCK|Mr.O_NOFOLLOW);try{if(D.push(Va(L,Mr.O_WRONLY|Mr.O_NONBLOCK|Mr.O_NOFOLLOW)),!Pl(D.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{Ka(z)}if(l)El(L,l.uid,l.gid)}}catch(L){throw M(),L}return{wait:(L)=>`exec 3<>${v[L]} <${v[L]} 3>&-; exec /bin/cat`,close:M}}function Cl(e=(l)=>Ro(l)){let l=new AbortController,v=JSON.stringify(J()),D=(async()=>{try{return await e(l.signal)===!0&&!l.signal.aborted}catch{return!1}})();return{result:D,matches:(M)=>M.executionMode==="host"&&JSON.stringify(J())===v,stop:async(M=1500)=>{l.abort();let L;await Promise.race([D,new Promise((z)=>{L=setTimeout(z,M)})]),clearTimeout(L)}}}function sp(e){let l;try{l=Va(e,Mr.O_RDONLY|Mr.O_NOFOLLOW|Mr.O_NONBLOCK)}catch{return Number.NaN}try{let v=Pl(l);if(!v.isFile()||v.size>32)return Number.NaN;let D=Buffer.alloc(32),M=Zm(l,D,0,D.length,0),L=D.subarray(0,M).toString("utf8").trim();return/^[0-9]{1,10}$/.test(L)?Number(L):Number.NaN}catch{return Number.NaN}finally{Ka(l)}}function cp(e,l=Qm("/tmp")){let v=Ym(gn(l,"reason-pty-probe-")),D=gn(v,"workspace"),M=gn(v,"private");if(vl(D,{mode:448}),vl(M,{mode:448}),e)kl(v,493),kl(D,493),El(D,e.uid,e.gid);return{directory:v,root:D,runtimeDirectory:M}}function lp(e,l){if(l)try{bi("/usr/bin/setpriv",[`--reuid=${l.uid}`,`--regid=${l.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",e.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),ep(e.root)}catch{return}tp(e.directory,{recursive:!0,force:!0})}var Ml=5000,wn="ARA_WORKER_PROBE_READY";function wp(e,l,v,D,M){if(M.aborted)return Promise.resolve(!1);return new Promise((L)=>{dp(e,l,{cwd:v,env:D,signal:M,timeout:Ml,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8",windowsHide:!0},(z,re)=>L(!z&&!M.aborted&&re===wn))})}function yp(e,l){let v=Ya(e).replace(/\.exe$/i,"");if(v==="bash")return["--noprofile","--norc","-c",l];if(v==="zsh"||v==="sh")return["-f","-c",l];return null}function _p(e,l){let v=je({home:l,temporaryDirectory:l}),D=(L,z,re)=>wp(L,z,e.workspaceRoot,v,re),M=async(L,z,re,G=(we)=>we===wn,ce=!1)=>{let we=process.platform==="win32"?Ga(Ri(gp(),"reason-device-probe-")):e.workspaceRoot;try{let te=await Gn(L,z,{cwd:we,root:we,allowWrite:!1,allowProcessInspection:ce,timeoutMs:Ml,signal:re,workerProbe:!0}),X=!re.aborted&&!te.timedOut&&!te.truncated&&te.exitCode===0&&G(te.stdout);if(!X&&process.platform==="win32")process.stderr.write(`Reason worker: confined ${Ya(L)} probe failed (exit ${te.exitCode}${te.timedOut?", timed out":""}): ${te.stderr.slice(-300).trim()}
+`);return X}catch(te){if(process.platform==="win32")process.stderr.write(`Reason worker: confined ${Ya(L)} probe failed: ${String(te)}
+`);throw te}finally{if(we!==e.workspaceRoot)Dl(we,{recursive:!0,force:!0})}};return{workspaceRead:async(L)=>(await xl(e.workspaceRoot,Al.R_OK),await Ol(e.workspaceRoot),!L.aborted),workspaceWrite:async(L)=>{if(await xl(e.workspaceRoot,Al.W_OK),L.aborted)return!1;let z=Ga(Ri(e.workspaceRoot,".ara-worker-probe-")),re=Ri(z,"receipt");try{let G=await fp(re,"wx",384);try{await G.writeFile(wn),await G.sync()}finally{await G.close()}return await Il(re,"utf8")===wn&&!L.aborted}finally{await pp(re).catch(()=>{}),await hp(z).catch(()=>{})}},confinedShell:(L)=>{if(process.platform==="win32"&&!tn())return process.stderr.write(`Reason worker: ${Da}
+`),Promise.resolve(!1);return M(en(),["-c",`printf ${wn}`],L)},confinedGit:(L)=>M("git",["--version"],L,(z)=>/^git version \S+/.test(z)),processInspection:async(L)=>{if(process.platform==="darwin")return M("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],L,(ce)=>ce.includes(`p${process.pid}
+`)&&/^n\//m.test(ce),!0);if(process.platform==="win32")return cc(L);if(process.platform!=="linux")return!1;let[z,re,G]=await Promise.all([mp("/proc/self/cwd"),Ol("/proc/self/fd"),Il("/proc/net/tcp","utf8")]);return!L.aborted&&z.length>0&&re.length>0&&G.includes("local_address")},bash:async(L)=>{let z=process.platform==="win32"?Y():"/bin/bash";if(!z)return process.stderr.write(`Reason worker: ${process.platform==="win32"?va:"bash is unavailable"}
+`),!1;return D(z,["--noprofile","--norc","-c",`printf ${wn}`],L)},jobs:(L)=>bl(e,L),environment:(L)=>hl(e,l,L),preview:(L)=>to(l,L),boundPty:(L)=>Ro(L),desktopDisplay:()=>Mo(),desktopAutomation:async()=>{let L=Xa();if(L)process.stderr.write(`Reason worker: computer and browser use need setup (${L})
+`);return hr()},desktopBrowser:async()=>A()?.features.browser===!0,fullControlShell:(L)=>{let z=dt(),re=yp(z,`printf ${wn}`);return re?D(z,re,L):Promise.resolve(!1)}}}function Xa(){return process.platform==="darwin"&&A()?.features.computer===!0?Nn():null}var rs=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function bp(e,l,v=new AbortController().signal,D={read:!0,write:!1},M=xo()){return Eo(e,l,v,D,M).final}function Eo(e,l,v=new AbortController().signal,D={read:!0,write:!1},M=xo(),L,z){let re,G;try{if(Or(e),ne(),!l)b(p(e),!0),re=Ga(Ri(p(e),"probe-")),l=_p(e,re);G=l}catch(Me){let Ce=Promise.reject(Me);return Ce.catch(()=>{}),{initial:Ce,final:Ce,pty:Ce}}let ce=async(Me,Ce)=>{if(v.aborted||!Ce&&!G[Me])return!1;let Te,We=new Promise(($e)=>{Te=()=>$e(!1)});v.addEventListener("abort",Te,{once:!0});try{return await Promise.race([Ce??G[Me](v),We])===!0&&!v.aborted}catch{return!1}finally{v.removeEventListener("abort",Te)}},we=e.executionMode==="host",te=we?ce("boundPty",L):Promise.resolve(!1),X=Promise.resolve(z).then(()=>Promise.all(we?[ce("preview"),te,ce("desktopDisplay"),ce("desktopAutomation"),ce("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),he=(async()=>{let[Me,Ce,Te,We,$e,Ue,Ne,xe,Le]=await Promise.all([Promise.resolve(D).then((Ge)=>Ge.read?ce("workspaceRead"):!1,()=>!1),Promise.resolve(D).then((Ge)=>Ge.write?ce("workspaceWrite"):!1,()=>!1),M?ce("confinedShell"):!1,M?ce("confinedGit"):!1,ce("processInspection"),...we?[ce("bash"),ce("jobs"),ce("environment"),ce("fullControlShell")]:[!1,!1,!1,!1]]);if(we&&(!Ue||!Ne||!xe)&&!z)await X;if(we){if(!Ue)Ue=await ce("bash");if(!Ne)Ne=await ce("jobs");if(!xe)xe=await ce("environment")}return{read:Me,write:Ce,shell:Te,git:We,processes:$e,bash:Ue,jobs:Ne,environment:xe,full:Le}})(),Se=(Me,Ce)=>{let{read:Te,write:We,shell:$e,git:Ue,processes:Ne,bash:xe,jobs:Le,environment:Ge,full:Ve}=Me,{preview:Je,boundPty:it,desktopDisplay:Ye,desktopAutomation:Be,desktopBrowser:Ke}=Ce,Fe=nc(),nt=we&&process.platform==="darwin"&&Ve&&up("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":Te,"fs.write":We,"inference.custom.v1":we&&Te,"fs.export":Te&&Fe,"fs.import":We&&Fe,"exec.run":$e&&M,"git.run":$e&&Ue&&M,"process.list":(process.platform==="linux"||process.platform==="win32"||$e)&&Ne,"ports.list":(process.platform==="linux"||process.platform==="win32"||$e)&&Ne,"exec.full":xe&&Ve&&M,"hands.connect":Te&&We&&xe&&Le,"jobs.control":Te&&We&&xe&&Le,"pty.start":Te&&We&&xe&&Le&&Ge&&it,"environment.install":Te&&We&&xe&&Le&&Ge,"github.local.v1":(process.platform==="darwin"||process.platform==="win32"||process.platform==="linux"&&process.geteuid?.()!==0)&&Te&&We&&xe&&Le&&Ge,"tunnel.open":Te&&We&&xe&&Le&&Ge&&Je,"tunnel.close":Te&&We&&xe&&Le&&Ge&&Je,"preview.serve.v1":Te&&xe&&Le&&Je&&Ve,"display.stream.v1":Ye,"automation.call.v1":Be,"simulator.call.v1":nt,"simulator.stream.v1":nt,"browser.pr-proof.v1":Be&&Ke&&ue()===null&&process.platform!=="win32","workspace.setup.v1":we&&Zr()})},Re=he.then(async(Me)=>Se(Me,{preview:!1,boundPty:await Promise.race([te,new Promise((Ce)=>setImmediate(()=>Ce(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),Ee=(async()=>{try{let Me=await he,[Ce,Te,We,$e,Ue]=await X;if(we&&!Te&&Me.read&&Me.write&&Me.bash&&Me.jobs&&Me.environment)Te=await ce("boundPty");return Se(Me,{preview:Ce,boundPty:Te,desktopDisplay:We,desktopAutomation:$e,desktopBrowser:Ue})}finally{if(re)Dl(re,{recursive:!0,force:!0})}})();Re.catch(()=>{});let Oe=(async()=>{let Me=await he;if(!(Me.read&&Me.write&&Me.bash&&Me.jobs&&Me.environment))return!1;return await te||(await Ee)["pty.start"]===!0})();return Oe.catch(()=>{}),{initial:Re,final:Ee,pty:Oe}}var kp=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],vp=[60000,300000,900000];function Ja(e,l){if(e.executionMode!=="host"||l["fs.read"]!==!0)return[];return kp.filter((v)=>l[v]!==!0)}function Tl(e){let l=e.log??((L)=>{process.stderr.write(L)}),v=e.resolve??((L)=>bp(e.config,void 0,L,e.permissions)),D=e.readiness,M=Ja(e.config,D);if(M.length===0)return Promise.resolve();return l(`Reason worker: withheld at start (${M.join(", ")}); probing them again while idle.
+`),(async()=>{for(let L of e.delaysMs??vp){if(await new Promise((G)=>{let ce=setTimeout(G,L);e.signal.addEventListener("abort",()=>{clearTimeout(ce),G()},{once:!0})}),e.signal.aborted)return;if(!e.idle())continue;let z;try{z=await v(AbortSignal.any([e.signal,AbortSignal.timeout(30000)]))}catch{continue}if(e.signal.aborted)return;let re=Ja(e.config,D).filter((G)=>z[G]===!0);if(re.length>0)D=Object.freeze({...D,...Object.fromEntries(re.map((G)=>[G,!0]))}),l(`Reason worker: ready after probing again (${re.join(", ")}).
+`),e.onReady(D,re);if(Ja(e.config,D).length===0)return}})()}import{execFile as vh}from"child_process";import{createHash as Sh,randomUUID as Es}from"crypto";import{lstat as Rh,readdir as bd,readFile as Sd,realpath as Eh,stat as Ph}from"fs/promises";import{basename as Ch,join as ks}from"path";import{promisify as Ah}from"util";import{createConnection as Sp}from"net";import{endianness as Nl}from"os";var Po=4,as=1e4;class Vr{socketPath;sessionId;turnId;timeoutMs;#t=null;#e=Buffer.alloc(0);#i=1;#r=new Map;#n=new Set;constructor(e){this.socketPath=e.socketPath,this.sessionId=e.sessionId??"open-browser-use-js",this.turnId=e.turnId??`turn-${Date.now()}`,this.timeoutMs=e.timeoutMs??1e4}async connect(){if(this.#t)return this;let e=Sp(this.socketPath);return this.#t=e,e.on("data",(l)=>this.#a(Buffer.from(l))),e.on("close",()=>this.#o(Error("Open Browser Use socket closed"))),e.on("error",(l)=>this.#o(l)),await new Promise((l,v)=>{e.once("connect",l),e.once("error",v)}),this}close(){this.#t?.end(),this.#t=null}onNotification(e){return this.#n.add(e),()=>{this.#n.delete(e)}}async request(e,l={}){await this.connect();let v=this.#t;if(!v)throw Error("Open Browser Use socket is not connected");let D=String(this.#i++),M={session_id:this.sessionId,turn_id:this.turnId,...l},z=Rp({jsonrpc:"2.0",id:D,method:e,params:M}),re=new Promise((G,ce)=>{let we=setTimeout(()=>{this.#r.delete(D),ce(Error(`Open Browser Use request timed out: ${e}`))},this.timeoutMs);this.#r.set(D,{resolve:G,reject:ce,timeout:we})});return v.write(z),await re}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory(e={}){return this.request("getUserHistory",e)}claimUserTab(e){return this.request("claimUserTab",{tabId:e})}finalizeTabs(e){return this.request("finalizeTabs",{keep:e})}nameSession(e){return this.request("nameSession",{name:e})}attach(e){return this.request("attach",{tabId:e})}detach(e){return this.request("detach",{tabId:e})}executeCdp(e,l,v={}){return this.request("executeCdp",{target:{tabId:e},method:l,commandParams:v})}moveMouse(e,l,v,D=!0){return this.request("moveMouse",{tabId:e,x:l,y:v,waitForArrival:D})}waitForFileChooser(e,l){return this.request("waitForFileChooser",{tabId:e,...l===void 0?{}:{timeoutMs:l}})}setFileChooserFiles(e,l){return this.request("setFileChooserFiles",{fileChooserId:e,files:l})}waitForDownload(e,l){return this.request("waitForDownload",{tabId:e,...l===void 0?{}:{timeoutMs:l}})}downloadPath(e,l){return this.request("downloadPath",{downloadId:e,...l===void 0?{}:{timeoutMs:l}})}browserUserHistory(e={}){return this.getUserHistory(e)}readClipboardText(e){return this.request("readClipboardText",{tabId:e})}writeClipboardText(e,l){return this.request("writeClipboardText",{tabId:e,text:l})}readClipboard(e){return this.request("readClipboard",{tabId:e})}writeClipboard(e,l){return this.request("writeClipboard",{tabId:e,items:l})}turnEnded(){return this.request("turnEnded")}#a(e){this.#e=Buffer.concat([this.#e,e]);while(this.#e.length>=Po){let l=Nl()==="LE"?this.#e.readUInt32LE(0):this.#e.readUInt32BE(0),v=Po+l;if(this.#e.length<v)return;let D=this.#e.subarray(Po,v);this.#e=this.#e.subarray(v),this.#s(JSON.parse(D.toString("utf8")))}}#s(e){if(!br(e))return;let l=typeof e.id==="string"||typeof e.id==="number"?String(e.id):null;if(!l&&typeof e.method==="string"){let D={method:e.method,params:e.params};for(let M of this.#n)M(D);return}if(!l)return;let v=this.#r.get(l);if(!v)return;if(this.#r.delete(l),clearTimeout(v.timeout),br(e.error)){v.reject(Error(String(e.error.message??"Open Browser Use request failed")));return}v.resolve(e.result??null)}#o(e){for(let[l,v]of this.#r)this.#r.delete(l),clearTimeout(v.timeout),v.reject(e)}}class Ei{client;cdp;constructor(e){this.client="client"in e?e.client:new Vr(e),this.cdp=new Bl(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab(e={}){let l=await this.client.createTab(),v=Ep(l,"createTab response"),D=this.tab(v);if(e.url)await D.goto(e.url,e);return D}tab(e){return new Hl(this,e)}getTabs(){return this.client.getTabs()}}class Hl{browser;id;playwright;constructor(e,l){this.browser=e,this.id=l,this.playwright=new $l(this)}goto(e,l={}){return this.browser.cdp.navigate(this.id,e,l)}waitForLoadState(e={}){return this.browser.cdp.waitForLoadState(this.id,e)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then((e)=>String(e??""))}evaluate(e,l={}){return this.browser.cdp.evaluate(this.id,e,l)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class $l{tab;constructor(e){this.tab=e}waitForLoadState(e={}){return this.tab.waitForLoadState(e)}domSnapshot(){return this.tab.domSnapshot()}}class Bl{client;#t=new Set;constructor(e){this.client=e}async call(e,l,v={},D={}){return await this.ensureAttached(e),this.client.request("executeCdp",{target:{tabId:e},method:l,commandParams:v,...D.timeoutMs===void 0?{}:{timeoutMs:D.timeoutMs}})}async evaluate(e,l,v={}){let D=await this.call(e,"Runtime.evaluate",{expression:l,returnByValue:!0,...v.awaitPromise===void 0?{}:{awaitPromise:v.awaitPromise}});if(br(D)&&br(D.exceptionDetails))throw Error(String(D.exceptionDetails.text??"Open Browser Use evaluation failed"));return br(D)&&br(D.result)?D.result.value??null:null}async navigate(e,l,v={}){if(!l)throw Error("goto requires a URL");let D=v.waitUntil??"load";Ll(D);let M=v.timeoutMs??as;await this.call(e,"Page.enable");let L=this.waitForLoadEvent(e,D,M),z=await this.call(e,"Page.navigate",{url:l},{timeoutMs:M});if(br(z)&&typeof z.errorText==="string"&&z.errorText)throw Error(`Browser failed to navigate tab ${e}: ${z.errorText}`);return await L.catch(async(re)=>{let G=await this.readDocumentState(e);if(Wl(G,D))return;throw re}),z}async waitForLoadState(e,l={}){let v=l.state??"load";Ll(v),await this.call(e,"Page.enable");let D=await this.readDocumentState(e);if(Wl(D,v))return;await this.waitForLoadEvent(e,v,l.timeoutMs??as)}async readDocumentState(e){try{let l=await this.evaluate(e,"({ href: window.location.href, readyState: document.readyState })");return br(l)?{href:ls(l.href),readyState:ls(l.readyState)}:void 0}catch{return}}waitForEvent(e,l,v={}){let D=v.timeoutMs??as;return new Promise((M,L)=>{let z=!1,re=null,G,ce=()=>{if(z)return!1;return z=!0,clearTimeout(G),re?.(),!0};G=setTimeout(()=>{if(ce())L(Error(v.timeoutMessage??`Timed out waiting for tab ${e} event`))},D),re=this.client.onNotification((we)=>{try{if(l(we)){if(ce())M(we)}}catch(te){if(ce())L(te instanceof Error?te:Error(String(te)))}})})}waitForLoadEvent(e,l,v){return this.waitForEvent(e,(D)=>{let M=Pp(D,e);if(!M)return!1;if(M.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${e}`);return l==="domcontentloaded"?M.method==="Page.domContentEventFired":M.method==="Page.loadEventFired"},{timeoutMs:v,timeoutMessage:`Timed out waiting for ${l} in tab ${e}`}).then(()=>{return})}async ensureAttached(e){if(this.#t.has(e))return;await this.client.attach(e),this.#t.add(e)}}function Rp(e){let l=Buffer.from(JSON.stringify(e),"utf8"),v=Buffer.alloc(Po+l.length);if(Nl()==="LE")v.writeUInt32LE(l.length,0);else v.writeUInt32BE(l.length,0);return l.copy(v,Po),v}function br(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Ep(e,l){if(!br(e))throw Error(`${l} did not include a tab object`);let v=e.id;if(typeof v==="number"&&Number.isInteger(v)&&v>0)return v;if(typeof v==="string"){let D=Number(v);if(Number.isInteger(D)&&D>0)return D}throw Error(`${l} did not include a numeric tab id`)}function Ll(e){if(e!=="domcontentloaded"&&e!=="load")throw Error(`Unsupported load state "${e}". Use "domcontentloaded" or "load".`)}function Wl(e,l){if(e?.readyState==="complete")return!0;return l==="domcontentloaded"&&e?.readyState==="interactive"}function Pp(e,l){if(e.method!=="onCDPEvent"||!br(e.params))return null;let v=e.params.source;if(!br(v)||v.tabId!==l)return null;return{method:ls(e.params.method)}}function ls(e){return typeof e==="string"?e:void 0}import{createHash as Cp}from"crypto";function Ul(e,l,v,D){let M=JSON.stringify([e.trim().toLowerCase(),l.trim().toLowerCase(),v,D]);return`reason-cloud-${Cp("sha256").update(M).digest("hex")}`}import{AsyncLocalStorage as _h}from"async_hooks";import{isDeepStrictEqual as yd}from"util";import{createHash as bh}from"crypto";var Ap=/#w=(\d{1,5})&h=(\d{1,5})$/;function Fl(e){return typeof e==="number"&&Number.isInteger(e)&&e>0&&e<=32768?e:void 0}function jl(e){let l=Ap.exec(e);if(!l)return;let v=Fl(Number(l[1])),D=Fl(Number(l[2]));return v&&D?{width:v,height:D}:void 0}var ql="[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}",xp=new RegExp(`^/media/pr-screenshots/(${ql})/(${ql})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$`,"i");var Ip=new Set(["png","jpg","jpeg","gif","webp"]),Op=new Set(["webm","mp4"]);function Dp(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function Mp(e){let l=jl(e);return Boolean(l&&e===`#w=${l.width}&h=${l.height}`)}function zl(e,l){let v;try{v=new URL(e)}catch{return null}let D=Dp(l),M=v.hostname==="ara.so"||v.hostname.endsWith(".ara.so")||v.hostname==="reasonmachines.ai"||v.hostname.endsWith(".reasonmachines.ai")||v.hostname==="reasonmachines.com"||v.hostname.endsWith(".reasonmachines.com");if(v.protocol!=="https:"||!M&&v.origin!==D||v.username||v.password||v.port||v.search||v.hash&&!Mp(v.hash))return null;let L=xp.exec(v.pathname);if(!L)return null;let z=L[1]?.toLowerCase(),re=L[2]?.toLowerCase(),G=L[3]?.toLowerCase(),ce=L[4]?.toLowerCase();if(!z||!re||!G||!ce)return null;let we=Ip.has(ce)?"image":Op.has(ce)?"video":null;if(!we)return null;let te=/^(before|after)[\s:_-]+/.exec(G),X=v.pathname.replace(/^\/media\//,"");return{url:v.toString(),storagePath:X,runId:z,artifactId:re,fileName:`${G}.${ce}`,kind:we,phase:te?.[1]==="before"||te?.[1]==="after"?te[1]:null}}var Tp=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Pi=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),yn=()=>{throw Error("cloud_browser_media_request_invalid")};function Ci(e){if(!Pi(e)||Object.keys(e).some((L)=>!["runId","configuredMediaOrigin","media"].includes(L))||typeof e.runId!=="string"||!Tp.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return yn();let l;try{l=new URL(e.configuredMediaOrigin)}catch{return yn()}if(l.protocol!=="https:"||l.username||l.password||l.port||!Mt(l.origin,{mode:"public_web"}).allowed)return yn();let v=e.runId.toLowerCase(),D=new Set,M=e.media.map((L)=>{if(!Pi(L)||Object.keys(L).some((re)=>!["url","sourceUrl","kind"].includes(re))||typeof L.url!=="string"||L.url.length>2048||typeof L.sourceUrl!=="string"||L.sourceUrl.length>8192||!["image","video"].includes(String(L.kind)))return yn();let z=zl(L.url,l.origin);if(!z||new URL(z.url).origin!==l.origin||z.runId!==v||z.kind!==L.kind||z.url!==L.url||D.has(L.url))return yn();if(D.add(L.url),L.sourceUrl!==L.url){let re;try{re=new URL(L.sourceUrl)}catch{return yn()}let G=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(re.pathname)?.[1];if(L.kind!=="image"||re.origin!=="https://camo.githubusercontent.com"||re.username||re.password||re.search||re.hash||!G||G.length%2!==0||Buffer.from(G,"hex").toString("utf8")!==L.url)return yn()}return{url:L.url,sourceUrl:L.sourceUrl,kind:L.kind}});return{runId:e.runId,configuredMediaOrigin:l.origin,media:M}}function Kl(e,l){let v=()=>{throw Error("cloud_browser_media_verification_failed")};if(!Pi(e)||e.verified!==!0||!Array.isArray(e.items)||e.items.length!==l.media.length)return v();return{verified:!0,items:e.items.map((M,L)=>{let z=l.media[L];if(!Pi(M)||M.url!==z.url||M.sourceUrl!==z.sourceUrl||M.kind!==z.kind||typeof M.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(M.sourceSha256)||!Number.isSafeInteger(M.width)||!Number.isSafeInteger(M.height)||Number(M.width)<1||Number(M.height)<1||Number(M.width)>16384||Number(M.height)>16384||z.kind==="video"&&(typeof M.advancedSeconds!=="number"||!Number.isFinite(M.advancedSeconds)||M.advancedSeconds<0.05||M.advancedSeconds>30))return v();return{...z,width:Number(M.width),height:Number(M.height),sourceSha256:M.sourceSha256,...z.kind==="video"?{advancedSeconds:M.advancedSeconds}:{}}})}}var us="browser.pr-proof.v1",Dt=t().uuid(),Hn=t().regex(/^[a-f0-9]{64}$/),bn=I.datetime({precision:3}),ds=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),Gl=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),ur=n({kind:i("primary_mac"),version:i(1),organizationId:ds,userId:ds,sessionId:ds,runId:Dt,deviceId:Dt,rootId:Dt,rootRevision:t().min(1).max(64),binding:c(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:Dt,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Lp=Xi().transform((e,l)=>{try{return po(e)}catch{return l.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),Jc}}),$n=n({version:i(1),owner:ur,contextId:Dt,preparedAt:bn,expiresAt:bn,prUrl:Gl,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:Hn,evidenceKind:c(["image","video"]),visualPlan:Lp.optional(),uploadOrigin:t().url().refine((e)=>{let l=new URL(e);return l.protocol==="https:"&&l.origin===e&&!l.username&&!l.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),fs=n({version:i(1),producer:i("primary_mac"),context:$n,captureId:Dt,operationId:Dt,attemptId:Dt,tabId:o().int().positive(),startedAt:bn,finishedAt:bn,sha256:Hn,media:P("contentType",[n({contentType:i("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),n({contentType:i("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,l)=>{let v=Date.parse(e.startedAt),D=Date.parse(e.finishedAt);if(v<Date.parse(e.context.preparedAt)||D<v||D>Date.parse(e.context.expiresAt)||D-v>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((D-v)/1000-e.media.durationSeconds)>0.1))l.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),ov=P("action",[n({action:i("screenshot"),context_id:Dt,tab_id:o().int().positive()}).strict(),n({action:i("start_video"),context_id:Dt,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("stop_video"),recording_operation_id:Dt}).strict()]),xi=n({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),Ai=t().regex(/^[1-9][0-9]{0,19}$/),Ao=n({version:i(1),owner:ur,expectedActorId:Ai.nullable(),repositoryId:Ai,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Wp=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],ms=P("status",[Ao.extend({status:i("ready"),observedActor:xi,checkedAt:bn}),Ao.extend({status:i("not_ready"),reason:c(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:c(Wp).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),_n=n({version:i(1),owner:ur,expectedActorId:Ai.nullable(),authenticatedActor:xi,attemptId:Dt,captureId:Dt,prUrl:Gl,repositoryId:Ai,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:Hn,sizeBytes:o().int().min(128).max(10485760),contentType:i("video/webm")}).strict(),Yl=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),Bn=P("status",[_n.extend({status:i("not_attempted"),reason:c(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),_n.extend({status:i("uncertain"),reason:i("upload_outcome_unknown")}),_n.extend({status:i("uploaded"),observedActor:xi,nativeUrl:Yl,uploadedAt:bn})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),Io=_n.extend({nativeUrl:Yl,observedActor:xi,bodySha256:Hn}),ps=P("status",[Io.extend({status:i("incomplete"),reason:c(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),Io.extend({status:i("verified"),sourceSha256:Hn,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:i(!0),verifiedAt:bn})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Np=Xi().transform((e,l)=>{try{let v=Ci(e);if(v.media.some((D)=>D.kind!=="image"))throw Error();return v}catch{return l.addIssue({code:"custom",message:"proof_media_request_invalid"}),Jc}}),Hp=P("action",[n({action:i("auth_check"),input:Ao}).strict(),n({action:i("prepare"),context:$n}).strict(),n({action:i("capture_png"),owner:ur,contextId:Dt,tabId:o().int().positive()}).strict(),n({action:i("start_video"),owner:ur,contextId:Dt,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("inspect_capture"),owner:ur,captureId:Dt}).strict(),n({action:i("publish_video"),input:_n}).strict(),n({action:i("verify_png_media"),owner:ur,media:Np}).strict().refine((e)=>e.media.runId===e.owner.runId),n({action:i("verify_saved_media"),input:Io}).strict(),n({action:i("publish_png"),owner:ur,attemptId:Dt,captureId:Dt,sha256:Hn,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var Xl="pr-proof.stop.v1",hs=n({requestId:Dt,command:Hp}).strict();var $p={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},Vl={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},Jl={type:"integer",minimum:1,description:"An already-owned tab's id."},iv={...$p,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:Vl,tab_id:Jl}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:Vl,tab_id:Jl,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};import{createHash as Bp,randomUUID as Up}from"crypto";import{isDeepStrictEqual as Un}from"util";var Zl=n({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict(),_t=()=>Error("mac_pr_proof_capture_unavailable"),gs=(e)=>Bp("sha256").update(e).digest("hex");function Ql(e){let l=ur.parse(e.owner),v=new Map,D=new Map,M=!1,L=async()=>{if(M)throw _t();if(await e.assertCurrent(),M)throw _t()},z=(X)=>{let he=v.get(X);if(!he||Date.parse(he.expiresAt)<=Date.now())throw _t();return he},re=(X)=>X.disposal??=(async()=>{X.controller.abort(),X.bytes?.fill(0),X.bytes=void 0,X.receipt=void 0;try{await X.host?.close()}catch{throw M=!0,_t()}})(),G=async()=>{for(let[X,he]of v){if(Date.parse(he.expiresAt)>Date.now())continue;let Se=[...D.entries()].filter(([,Ee])=>Ee.claim.contextId===X);if((await Promise.allSettled(Se.map(([,Ee])=>re(Ee)))).some((Ee)=>Ee.status==="rejected"))throw _t();for(let[Ee]of Se)D.delete(Ee);v.delete(X)}},ce=setInterval(()=>{G().catch(()=>{M=!0})},1000);ce.unref();let we=(X)=>{if(X.stopRequested=!0,X.started&&X.host&&!X.stop)X.stop=X.host.stop(),X.stop.catch(()=>X.controller.abort())};async function te(X,he){let Se=Zl.parse(X.claim);if(he==="video"&&(!Number.isInteger(X.seconds)||X.seconds<1||X.seconds>15))throw _t();await L(),X.signal.throwIfAborted(),await G();let Re=z(Se.contextId);if(he==="video"&&Re.evidenceKind!=="video")throw _t();let Ee=D.get(Se.operationId);if(Ee){if(!Un(Ee.claim,Se)||Ee.kind!==he||Ee.seconds!==X.seconds||Ee.controller.signal.aborted)throw _t();let Ne=await Ee.completion;if(await L(),z(Se.contextId),Ee.controller.signal.aborted)throw _t();return structuredClone(Ne)}if(D.size>=16||[...D.values()].some((Ne)=>!Ne.receipt&&!Ne.controller.signal.aborted&&Ne.claim.tabId===Se.tabId))throw _t();let Oe,Me,Ce=new Promise((Ne,xe)=>{Oe=Ne,Me=xe});Ce.catch(()=>{});let Te={claim:Se,kind:he,seconds:X.seconds,controller:new AbortController,completion:Ce,stopRequested:!1,started:!1};D.set(Se.operationId,Te);let We=()=>{re(Te).catch(()=>{})};X.signal.addEventListener("abort",We,{once:!0});let $e=async()=>{await L(),z(Se.contextId),X.signal.throwIfAborted(),Te.controller.signal.throwIfAborted()},Ue;try{await $e();let Ne;if(he==="image"){let xe=new Date().toISOString();Ue=await e.screenshot(structuredClone(Re),Se.tabId,Te.controller.signal);let Le=new Date().toISOString();if(await $e(),Ue.length<24||Ue.length>8388608||!Ue.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||Ue.readUInt32BE(8)!==13||Ue.toString("ascii",12,16)!=="IHDR")throw _t();Ne=fs.parse({version:1,producer:"primary_mac",context:Re,captureId:Up(),operationId:Se.operationId,attemptId:Se.attemptId,tabId:Se.tabId,startedAt:xe,finishedAt:Le,sha256:gs(Ue),media:{contentType:"image/png",sizeBytes:Ue.length,width:Ue.readUInt32BE(16),height:Ue.readUInt32BE(20)}})}else{if(Te.host=await e.createVideo(structuredClone(Re),Se.tabId,X.seconds,Te.controller.signal),Te.controller.signal.aborted||X.signal.aborted||M)throw await Te.host.close(),_t();await Te.host.start(),Te.started=!0;let xe=Te.host.completed();if(xe.catch(()=>{}),await $e(),await X.started?.(),Te.stopRequested)we(Te);let Le=await xe;if(Te.stop)await Te.stop;await $e();let Ge=await Te.host.read(Le.captureId);Ue=Ge.bytes;let Ve={runId:l.runId,deviceId:l.deviceId,rootId:l.rootId,rootRevision:l.rootRevision,generation:l.generation,profile:l.profile,extensionInstanceId:l.extensionInstanceId,browserScope:e.browserScope,tabId:Se.tabId};if(!Un(Le,Ge.capture)||!Un(Le.owner,Ve)||Ue.length!==Le.sizeBytes||gs(Ue)!==Le.sha256||Ue.length<128||Ue.readUInt32BE(0)!==440786851)throw _t();await Te.host.close(),await $e(),Ne=fs.parse({version:1,producer:"primary_mac",context:Re,captureId:Le.captureId,operationId:Se.operationId,attemptId:Se.attemptId,tabId:Se.tabId,startedAt:Le.startedAt,finishedAt:Le.finishedAt,sha256:Le.sha256,media:{contentType:"video/webm",sizeBytes:Le.sizeBytes,durationSeconds:Le.durationSeconds,frameCount:Le.frameCount,receivedFrameCount:Le.receivedFrameCount}})}if(await $e(),[...D.values()].reduce((xe,Le)=>xe+(Le.bytes?.length??0),Ue.length)>20971520)throw _t();return Te.bytes=Buffer.from(Ue),Te.receipt=Ne,Oe(Ne),structuredClone(Ne)}catch(Ne){let xe=he==="video"&&!X.signal.aborted&&!Te.controller.signal.aborted&&Ne instanceof Error&&Ne.message==="mac_recording_worker_failed:no_frames"?new r("proof_capture_no_frames","The owned tab emitted no recording frames."):_t();throw await re(Te).catch(()=>{}),Me(xe),xe}finally{Ue?.fill(0),X.signal.removeEventListener("abort",We)}}return{async prepare(X){let he=$n.parse(X);if(!Un(he.owner,l))throw _t();if(await L(),await G(),Date.parse(he.preparedAt)>Date.now()||Date.parse(he.expiresAt)<=Date.now())throw _t();let Se=v.get(he.contextId);if(Se){if(!Un(Se,he))throw _t();return structuredClone(Se)}if(v.size>=4)throw _t();return v.set(he.contextId,he),structuredClone(he)},screenshot:(X)=>te(X,"image"),record:(X)=>te(X,"video"),async stop(X){let he=Zl.parse(X);await L(),z(he.contextId);let Se=D.get(he.operationId);if(!Se||Se.kind!=="video"||!Un(he,Se.claim)||Se.controller.signal.aborted)throw _t();we(Se)},async publicationCapture(X){await L(),await G();let he=[...D.values()].find((Se)=>Se.receipt?.captureId===X);if(!he?.receipt||!he.bytes||he.controller.signal.aborted)throw _t();if(z(he.claim.contextId),he.bytes.length!==he.receipt.media.sizeBytes||gs(he.bytes)!==he.receipt.sha256)throw _t();return{capture:structuredClone(he.receipt),bytes:Buffer.from(he.bytes)}},async inspect(X){await L(),await G();let he=[...D.values()].find((Se)=>Se.receipt?.captureId===X);if(!he?.receipt||he.controller.signal.aborted)throw _t();return z(he.claim.contextId),structuredClone(he.receipt)},async close(){M=!0,clearInterval(ce);let X=await Promise.allSettled([...D.values()].map(re));if(D.clear(),v.clear(),X.some((he)=>he.status==="rejected"))throw _t()}}}import{createHash as nd,randomUUID as Yp}from"crypto";import{isDeepStrictEqual as Do}from"util";import{realpath as Xp}from"fs/promises";var ed=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -70,26 +70,26 @@ ${l?.directory??p(e)}`).digest("hex")}function lo(e,l){y(Xt(p(e),fo),{version:1,
     }
   }));
   return { verified: true, items };
-}`;var td=function(e){let l=this??globalThis,v=10485760,O=(z,re)=>{if(l.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let G=l.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!G&&(l.location.href===z.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(l.location.pathname)))return{ok:!1,reason:"authentication_required"};if(l.location.href!==z.prUrl||!G)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(G))return{ok:!1,reason:"identity_mismatch"};let ce=l.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),we=/^[1-9][0-9]{0,19}$/.test(ce||"")?ce:null,te={login:G,id:we};if(z.expectedActorId!==null&&we!==z.expectedActorId||z.authenticatedActor&&(G!==z.authenticatedActor.login||we!==z.authenticatedActor.id)||z.observedActor&&(G!==z.observedActor.login||we!==z.observedActor.id)||l.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==z.repositoryId)return{ok:!1,reason:"identity_mismatch"};let X=l.document.querySelector('link[rel="canonical"]');if(X&&X.href!==z.prUrl)return{ok:!1,reason:"identity_mismatch"};if(re){let he=l.document.querySelector("#new_comment_field"),Se=l.document.querySelector("#fc-new_comment_field"),Re=he?.closest("file-attachment"),Ee=he?.closest("form"),Oe=new l.URL(z.prUrl).pathname+"/comment";if(!he||he.value!==""||!Se||Se.type!=="file"||Se.disabled||!Re||Re.getAttribute("input")!==Se.id||Re.getAttribute("data-upload-repository-id")!==z.repositoryId||!Ee||new l.URL(Ee.action,l.location.href).origin!=="https://github.com"||new l.URL(Ee.action,l.location.href).pathname!==Oe)return{ok:!1,reason:"attachment_unavailable"};let Me=Re.getAttribute("data-upload-policy-url");if(!Me||new l.URL(Me,l.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:te}};if(e.operation==="preflight")return O(e.expected,!1);if(e.operation==="identity")return O(e.expected,!0);if(e.operation==="upload"){let z=e.expected,re=O(z,!0);if(!re.ok)return{dispatched:!1,reason:re.reason};let G=l.Uint8Array.from(l.atob(e.base64||""),(X)=>X.charCodeAt(0));if(G.length!==z.sizeBytes||G.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let ce=new l.File([G],z.captureId+".webm",{type:"video/webm"}),we=new l.DataTransfer;we.items.add(ce);let te=l.document.querySelector("#fc-new_comment_field");if(!te)return{dispatched:!1,reason:"attachment_unavailable"};return te.files=we.files,te.dispatchEvent(new l.Event("change",{bubbles:!0})),{dispatched:!0,actor:re.actor}}if(e.operation==="upload_result"){let z=O(e.expected,!1);if(!z.ok)throw Error("github_video_identity_changed");let re=l.document.querySelector("#new_comment_field")?.value?.trim(),G="["+e.expected.captureId+".webm](",ce=re?.startsWith(G)&&re.endsWith(")")?re.slice(G.length,-1):re;if(!ce||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(ce))return null;return{nativeUrl:ce,actor:z.actor}}let M=e.expected,L=O(M,!1);if(!L.ok)return{status:"incomplete",reason:L.reason};return(async()=>{let z=M.nativeUrl.split("/").pop(),re=(Oe)=>{try{let Me=new l.URL(Oe,l.location.href);if(Me.protocol!=="https:"||Me.username||Me.password||Me.port||Me.hash)return!1;if(Me.origin==="https://github.com")return Me.href===M.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(Me.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+z+"\\.(webm|mp4)$").test(Me.pathname)}catch{return!1}},G=[...l.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((Oe)=>/^issue-[1-9][0-9]*$/.test(Oe.closest('[id^="issue-"]')?.id||"")&&!Oe.closest("form")&&!Oe.closest(".preview-content"));if(G.length!==1)throw Error("saved_body_missing");let ce=G[0],we=[...ce.querySelectorAll("video")].filter((Oe)=>[Oe.currentSrc,Oe.src,...[...Oe.querySelectorAll("source")].map((Me)=>Me.src)].some(re));if(we.length!==1)throw Error("saved_player_missing");let te=we[0],X={muted:te.muted,volume:te.volume,rate:te.playbackRate,preload:te.preload},he=new l.AbortController,Se=l.setTimeout(()=>he.abort(),12000),Re=(Oe)=>l.Promise.race([Oe,new l.Promise((Me,Ce)=>{if(he.signal.aborted)Ce(Error("playback_timeout"));else he.signal.addEventListener("abort",()=>Ce(Error("playback_timeout")),{once:!0})})]),Ee=async(Oe)=>{while(!Oe()){if(te.error||he.signal.aborted)throw Error("playback_unverified");await new l.Promise((Me)=>l.setTimeout(Me,25))}};try{if(te.muted=!0,te.playbackRate=1,te.currentTime=0,te.readyState<2)te.preload="auto",te.load();await Ee(()=>te.readyState>=2&&te.videoWidth>0&&te.videoHeight>0);let Oe=te.currentSrc;if(!re(Oe))throw Error("source_unbound");let Me=await Re(l.fetch(Oe,{credentials:"same-origin",redirect:"error",signal:he.signal}));if(Me.status!==200||!re(Me.url)||Me.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(Me.headers.get("content-type")||"")||!Me.body)throw Error("source_unverifiable");let Ce=Me.headers.get("content-length");if(Ce!==null&&(!/^[1-9][0-9]*$/.test(Ce)||Number(Ce)!==M.sizeBytes))throw Error("source_size_mismatch");let Te=Me.body.getReader(),We=[],$e=0;try{for(;;){let Je=await Re(Te.read());if(Je.done)break;if($e+=Je.value.length,$e>10485760||$e>M.sizeBytes)throw Error("source_too_large");We.push(Je.value)}}finally{await Te.cancel().catch(()=>{}),Te.releaseLock()}if($e!==M.sizeBytes)throw Error("source_size_mismatch");let Fe=new l.Uint8Array($e),Ne=0;for(let Je of We)Fe.set(Je,Ne),Ne+=Je.length;let xe=[...new l.Uint8Array(await Re(l.crypto.subtle.digest("SHA-256",Fe)))].map((Je)=>Je.toString(16).padStart(2,"0")).join("");if(xe!==M.sha256||te.currentSrc!==Oe||!ce.contains(te))throw Error("source_changed");let Le=te.currentTime,Ge=te.getVideoPlaybackQuality().totalVideoFrames;if(await Re(te.play()),await Ee(()=>te.currentTime-Le>=0.05&&te.getVideoPlaybackQuality().totalVideoFrames>Ge),!O(M,!1).ok||te.currentSrc!==Oe||!ce.contains(te)||te.error)throw Error("player_changed");return{status:"verified",sourceSha256:xe,width:te.videoWidth,height:te.videoHeight,durationSeconds:te.duration,advancedSeconds:te.currentTime-Le,advancedFrames:te.getVideoPlaybackQuality().totalVideoFrames-Ge,playbackRestored:!0}}finally{if(l.clearTimeout(Se),he.abort(),te.pause(),te.currentTime=0,te.muted=X.muted,te.volume=X.volume,te.playbackRate=X.rate,te.preload=X.preload,!te.paused||te.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as Fp}from"child_process";import{lstat as jp,realpath as qp}from"fs/promises";import{join as rd,resolve as zp}from"path";import{promisify as Kp}from"util";var Vp=Kp(Fp);async function Jp(e,l){let v=await qp(e),{stdout:O}=await Vp(rd(v,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:l});return d(n({browser:t(),directory:t(),connected:_().optional(),source:t(),socketPath:t().optional(),instanceId:t().optional(),extensionId:t().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(O)).filter((L)=>L.browser==="chrome"&&L.connected===!0&&/^(Default|Profile [0-9]+)$/.test(L.directory)&&zp(L.source)===rd(v,"Reason Browser Use","manifest.json"))}async function Mi(e,l,v){if(!/^(Default|Profile [0-9]+)$/.test(l))throw Error("mac_recording_profile_unavailable");let O=(await Jp(e,v)).filter((z)=>z.directory===l),M=O[0];if(O.length!==1||!M?.socketPath||!M.instanceId)throw Error("mac_recording_profile_unavailable");let L=await jp(M.socketPath);if(!L.isSocket()||L.uid!==process.getuid?.()||L.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:M.socketPath,instanceId:M.instanceId,extensionId:M.extensionId}}import{createHash as Gp}from"crypto";function zn(e){return`reason-browser-${Gp("sha256").update(`reason:mac-browser:v1:${e}`).digest("hex")}`}var od=A("ok",[n({ok:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({ok:i(!1),reason:c(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),id=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})}),ht=()=>Error("mac_pr_proof_browser_unavailable");async function ks(e){let l=ur.parse(e.owner),v="endpoint"in e?e.endpoint(l):await Zp(e.automationDirectory,l),O=new Map,M=`reason-pr-proof-${Yp()}`,L=!1,z=async()=>{if(L)throw ht();if(await e.assertCurrent(),L)throw ht()},re=async(we)=>{if(!Mo(l,we.owner))throw ht();await z()},G=async(we)=>{await re(we);let te=await e.readVideo(we.captureId);try{await z();let X=te.capture;if(!Mo(X.context.owner,l)||X.captureId!==we.captureId||X.context.prUrl!==we.prUrl||X.context.headSha!==we.headSha||X.media.contentType!=="video/webm"||X.media.sizeBytes!==we.sizeBytes||X.sha256!==we.sha256||te.bytes.length!==we.sizeBytes||te.bytes.length<128||te.bytes.length>10485760||te.bytes.readUInt32BE(0)!==440786851||nd("sha256").update(te.bytes).digest("hex")!==we.sha256)throw ht();return te}catch(X){throw te.bytes.fill(0),X}};async function ce(we,te,X){await z();let he=await v.discover(AbortSignal.timeout(5000)),Se=new Pi({socketPath:he.socketPath,sessionId:M,timeoutMs:5000}),Re,Ee=!1,Oe,Me=new Promise((We,$e)=>{Oe=setTimeout(()=>{Ee=!0,$e(ht())},60000)});Me.catch(()=>{});let Ce=(We)=>Promise.race([We,Me]),Te=async()=>{if(Ee)throw ht();if(await z(),Ee)throw ht()};try{await Ce(Se.connect());let We=id.parse(await Ce(Se.client.getInfo()));if(We.metadata.extensionId!==he.extensionId||We.metadata.extensionInstanceId!==he.instanceId||!We.metadata.nativeHostName)throw ht();await Te(),X?.("connected");let $e=Se.newTab();$e.then((xe)=>{if(Ee)xe.close().catch(()=>{L=!0})},()=>{}),Re=await Ce($e),await Te(),await Ce(Re.goto(we,{waitUntil:"domcontentloaded",timeoutMs:15000})),await Te(),X?.("loaded");let Ne=await Ce(te(Re,async(xe)=>{await Te();let Le=await Ce(Re.evaluate(`(${td.toString()})(${JSON.stringify(xe)})`,{awaitPromise:!0}));return await Te(),Le},Te));return await Te(),Ne}finally{Ee=!0,clearTimeout(Oe);try{if(Re){let We;try{await Promise.race([Re.close(),new Promise(($e,Fe)=>{We=setTimeout(()=>Fe(ht()),5000)})])}finally{clearTimeout(We)}}}catch{throw L=!0,ht()}finally{Se.close()}await z()}}return{async screenshot(we,te,X){let he=Bn.parse(we);if(await re(he),!Number.isSafeInteger(te)||te<1||Date.parse(he.expiresAt)<=Date.now())throw ht();X.throwIfAborted();let Se=await v.discover(X),Re=new Pi({socketPath:Se.socketPath,sessionId:v.tabScope,timeoutMs:5000}),Ee;try{await Re.connect();let Oe=id.parse(await Re.client.getInfo());if(Oe.metadata.extensionId!==Se.extensionId||Oe.metadata.extensionInstanceId!==Se.instanceId)throw ht();if(!d(n({id:o()})).max(256).parse(await Re.getTabs()).some((Te)=>Te.id===te))throw ht();await z(),X.throwIfAborted();let Ce=n({data:t().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await Re.cdp.call(te,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(Ce.data)||Ce.data.length%4)throw ht();if(Ee=Buffer.from(Ce.data,"base64"),Ee.toString("base64")!==Ce.data||Ee.length>8388608)throw ht();if(await z(),X.throwIfAborted(),Date.parse(he.expiresAt)<=Date.now())throw ht();return Ee}catch{throw Ee?.fill(0),ht()}finally{Re.close()}},async verifyImages(we){let te=Ai(we);if(te.runId!==l.runId||te.media.some((X)=>X.kind!=="image"))throw ht();return ce("about:blank",async(X,he,Se)=>{let Re=X.browser.client,Ee=new Set(te.media.map((xe)=>xe.sourceUrl)),Oe=new Map,Me=new Set,Ce=!1,Te=0,We=!1,$e=new Set,Fe=(xe,Le)=>{if($e.size>=32){Ce=!0;return}let Ge=Re.executeCdp(X.id,xe,Le);$e.add(Ge),Ge.catch(()=>{Ce=!0}).finally(()=>$e.delete(Ge))},Ne=Re.onNotification((xe)=>{if(xe.method!=="onCDPEvent"||!q(xe.params)||!q(xe.params.source)||xe.params.source.tabId!==X.id||!q(xe.params.params))return;let Le=xe.params.params;if(++Te>512){Ce=!0;return}if(xe.params.method==="Fetch.requestPaused"){let Je=typeof Le.requestId==="string"&&q(Le.request)&&Le.request.method==="GET"&&typeof Le.request.url==="string"&&Ee.has(Le.request.url)&&Le.resourceType==="Image";if(typeof Le.requestId!=="string"){Ce=!0;return}if(!Je)Ce=!0;Fe(Je?"Fetch.continueRequest":"Fetch.failRequest",{requestId:Le.requestId,...Je?{}:{errorReason:"BlockedByClient"}})}if(xe.params.method==="Network.requestWillBeSent"&&Le.redirectResponse)Ce=!0;if(xe.params.method==="Network.loadingFailed")Ce=!0;if(xe.params.method==="Network.loadingFinished"&&typeof Le.requestId==="string")Me.add(Le.requestId);if(xe.params.method!=="Network.responseReceived")return;if(!q(Le.response)||typeof Le.response.url!=="string"||!Ee.has(Le.response.url)||typeof Le.requestId!=="string"||!q(Le.response.headers)||Le.type!=="Image"){Ce=!0;return}let Ge=Object.fromEntries(Object.entries(Le.response.headers).map(([Je,it])=>[Je.toLowerCase(),it])),Ve=Number(Ge["content-length"]);if(Oe.has(Le.response.url)||Le.response.status!==200||Le.response.fromServiceWorker===!0||typeof Ge["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(Ge["content-length"])||!Number.isSafeInteger(Ve)||Ve>8388608||Ge["content-range"]||Ge["content-encoding"]&&Ge["content-encoding"]!=="identity"){Ce=!0;return}Oe.set(Le.response.url,{id:Le.requestId,length:Ve})});try{await Re.executeCdp(X.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await Re.executeCdp(X.id,"Network.setBypassServiceWorker",{bypass:!0}),await Re.executeCdp(X.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await Re.executeCdp(X.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let xe=n({frameTree:n({frame:n({id:t().min(1).max(256)})})}).parse(await Re.executeCdp(X.id,"Page.getFrameTree",{})),Le=[...new Set(te.media.map((Je)=>new URL(Je.sourceUrl).origin))].join(" ");await Re.executeCdp(X.id,"Page.setDocumentContent",{frameId:xe.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${Le}; style-src 'none'"><body></body>`}),await Se(),We=!0;try{await Re.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new r("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await Se();let Ge;try{Ge=await X.evaluate(`(${ed})(${JSON.stringify(te.media)})`,{awaitPromise:!0})}catch{throw new r("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await Se(),!q(Ge)||!Array.isArray(Ge.items)||Ge.items.length!==te.media.length)throw ht();await Promise.all($e);let Ve=[];for(let Je=0;Je<te.media.length;Je++){await z();let it=Oe.get(te.media[Je].sourceUrl);if(Ce||!it||!Me.has(it.id))throw ht();let Ye=n({base64Encoded:i(!0),body:t().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await Re.executeCdp(X.id,"Network.getResponseBody",{requestId:it.id})),Be=Buffer.from(Ye.body,"base64");try{let Ke=Ge.items[Je];if(Be.length!==it.length||Be.toString("base64")!==Ye.body||!q(Ke))throw ht();Ve.push({...Ke,sourceSha256:nd("sha256").update(Be).digest("hex")})}finally{Be.fill(0)}}if(Ce)throw ht();return Kl({verified:!0,items:Ve},te)}finally{if(Ne(),await Promise.allSettled($e),We)try{await Re.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new r("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(we){let te=xo.parse(we);await re(te);let X="browser_unavailable";try{return await ce(`https://github.com/${te.repositoryFullName}`,async(he,Se)=>{let Re=od.parse(await Se({operation:"preflight",expected:{...te,prUrl:`https://github.com/${te.repositoryFullName}`}}));return ws.parse(Re.ok?{...te,status:"ready",observedActor:Re.actor,checkedAt:new Date().toISOString()}:Re.reason==="attachment_unavailable"?{...te,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...te,status:"not_ready",reason:Re.reason})},(he)=>{X=he==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return ws.parse({...te,status:"not_ready",reason:"unavailable",cause:X})}},async publish(we){let te=_n.parse(we);if(await re(te),te.expectedActorId!==null&&te.authenticatedActor.id!==te.expectedActorId)throw ht();let X=O.get(te.attemptId);if(X){if(!Mo(X.binding,te))throw ht();return structuredClone(X.result)}if(O.size>=3)throw Error("proof_native_publication_limit");let he={binding:structuredClone(te),result:Fn.parse({...te,status:"uncertain",reason:"upload_outcome_unknown"})};O.set(te.attemptId,he);let Se=!1,Re="dispatch";try{(await G(te)).bytes.fill(0),he.result=await ce(te.prUrl,async(Ee,Oe)=>{let Me=od.parse(await Oe({operation:"identity",expected:te}));if(!Me.ok)return Fn.parse({...te,status:"not_attempted",reason:Me.reason});let Ce=await G(te),Te;try{Se=!0,Te=A("dispatched",[n({dispatched:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({dispatched:i(!1),reason:c(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await Oe({operation:"upload",expected:te,base64:Ce.bytes.toString("base64")}))}finally{Ce.bytes.fill(0)}if(!Te.dispatched)return Se=!1,Fn.parse({...te,status:"not_attempted",reason:Te.reason});if(!Mo(Te.actor,Me.actor))throw Re="actor_changed",ht();Re="result";let We=performance.now();while(performance.now()-We<30000){let $e=await Oe({operation:"upload_result",expected:{...te,observedActor:Me.actor}});if($e!==null){let Fe=n({nativeUrl:t(),actor:n({login:t(),id:t().nullable()}).strict()}).strict().parse($e);return Re="finalize",await z(),Fn.parse({...te,status:"uploaded",nativeUrl:Fe.nativeUrl,observedActor:Fe.actor,uploadedAt:new Date().toISOString()})}await new Promise((Fe)=>setTimeout(Fe,100))}throw Re="result_timeout",ht()})}catch{if(Se)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${Re})
-`);he.result=Fn.parse({...te,...Se?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(he.result)},async verify(we){let te=Oo.parse(we);await re(te);try{return(await G(te)).bytes.fill(0),await ce(te.prUrl,async(X,he)=>{await X.browser.client.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let Se=await he({operation:"saved_player",expected:te});if(!Se||typeof Se!=="object"||Array.isArray(Se))throw ht();let Re=ys.parse({...te,...Se,..."status"in Se&&Se.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(te).some(([Ee,Oe])=>!Mo(Oe,Re[Ee])))throw ht();return Re}finally{await X.browser.client.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return ys.parse({...te,status:"incomplete",reason:"playback_unverified"})}},close(){L=!0}}}async function Zp(e,l){let v=await Xp(e);return{async discover(O){let M=await Mi(v,l.profile,O);if(M.instanceId!==l.extensionInstanceId)throw ht();return M},tabScope:zn(l.runId)}}import{realpath as yh}from"fs/promises";var Hv=n({version:i(1),recording_operation_id:t().uuid(),proof_ready:i(!1),acknowledged_at:I.datetime()}).strict(),Li=n({action:i("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),ad=n({action:i("inspect"),recording_operation_id:t().uuid()}).strict(),$v=A("action",[Li,ad]),sd=n({recording_operation_id:t().uuid()}).strict(),vs={device_id:t().uuid(),root_id:t().uuid()},Qp=A("action",[Li.extend(vs),ad.extend(vs),sd.extend({...vs,action:i("stop")})]),Bv=Vi(Qp),Uv=n({version:i(1),recordingId:t().uuid(),proofReady:i(!1),capture:n({captureId:t().uuid(),contentType:i("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:I.datetime(),finishedAt:I.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:n({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var Xv=Li.extend({action:c(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{createHash as lh,randomUUID as dh}from"crypto";import{mkdtemp as uh,realpath as fh,rm as hd}from"fs/promises";import{tmpdir as mh}from"os";import{join as ph}from"path";import{spawn as hh}from"child_process";import{isDeepStrictEqual as gh}from"util";import{createHash as eh}from"crypto";import{execFile as th}from"child_process";import{chmod as rh,lstat as ld,mkdtemp as nh,readFile as dd,realpath as ud,rm as oh,writeFile as cd}from"fs/promises";import{tmpdir as ih}from"os";import{isAbsolute as ah,join as Wi}from"path";import{promisify as sh}from"util";var Ss=sh(th),ch=(e)=>eh("sha256").update(e).digest("hex");async function Ar(e){if(!ah(e.path)||!/^[a-f0-9]{64}$/.test(e.sha256)||await ud(e.path)!==e.path)throw Error("mac_recording_encoder_unqualified");let l=await ld(e.path);if(!l.isFile()||!(l.mode&73)||l.mode&18||l.size>134217728||ch(await dd(e.path))!==e.sha256)throw Error("mac_recording_encoder_unqualified")}async function Lo(e,l){if(!e)return null;let v=structuredClone(e);try{await Promise.all([Ar(v.ffmpeg),Ar(v.ffprobe)])}catch{return null}return{async encode(O,M,L){if(L.aborted||!O.length||!Number.isFinite(M)||M<0.05||M>15)throw Error("mac_recording_encoding_invalid");await Promise.all([Ar(v.ffmpeg),Ar(v.ffprobe)]);let z=await ud(await nh(Wi(l??ih(),"reason-owned-recording-")));await rh(z,448);let re=Wi(z,"capture.webm"),G="frames";try{let ce=["ffconcat version 1.0"];for(let[Ee,Oe]of O.entries()){let Me=`${Ee}.jpg`;await cd(Wi(z,Me),Oe.jpeg,{mode:384,flag:"wx"});let Ce=O[Ee+1]?.timestamp??O[0].timestamp+M;ce.push(`file '${Me}'`,`duration ${Math.max(0.001,Ce-Oe.timestamp).toFixed(6)}`)}ce.push(`file '${O.length-1}.jpg'`),await cd(Wi(z,"frames.ffconcat"),ce.join(`
+}`;var td=function(e){let l=this??globalThis,v=10485760,D=(z,re)=>{if(l.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let G=l.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!G&&(l.location.href===z.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(l.location.pathname)))return{ok:!1,reason:"authentication_required"};if(l.location.href!==z.prUrl||!G)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(G))return{ok:!1,reason:"identity_mismatch"};let ce=l.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),we=/^[1-9][0-9]{0,19}$/.test(ce||"")?ce:null,te={login:G,id:we};if(z.expectedActorId!==null&&we!==z.expectedActorId||z.authenticatedActor&&(G!==z.authenticatedActor.login||we!==z.authenticatedActor.id)||z.observedActor&&(G!==z.observedActor.login||we!==z.observedActor.id)||l.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==z.repositoryId)return{ok:!1,reason:"identity_mismatch"};let X=l.document.querySelector('link[rel="canonical"]');if(X&&X.href!==z.prUrl)return{ok:!1,reason:"identity_mismatch"};if(re){let he=l.document.querySelector("#new_comment_field"),Se=l.document.querySelector("#fc-new_comment_field"),Re=he?.closest("file-attachment"),Ee=he?.closest("form"),Oe=new l.URL(z.prUrl).pathname+"/comment";if(!he||he.value!==""||!Se||Se.type!=="file"||Se.disabled||!Re||Re.getAttribute("input")!==Se.id||Re.getAttribute("data-upload-repository-id")!==z.repositoryId||!Ee||new l.URL(Ee.action,l.location.href).origin!=="https://github.com"||new l.URL(Ee.action,l.location.href).pathname!==Oe)return{ok:!1,reason:"attachment_unavailable"};let Me=Re.getAttribute("data-upload-policy-url");if(!Me||new l.URL(Me,l.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:te}};if(e.operation==="preflight")return D(e.expected,!1);if(e.operation==="identity")return D(e.expected,!0);if(e.operation==="upload"){let z=e.expected,re=D(z,!0);if(!re.ok)return{dispatched:!1,reason:re.reason};let G=l.Uint8Array.from(l.atob(e.base64||""),(X)=>X.charCodeAt(0));if(G.length!==z.sizeBytes||G.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let ce=new l.File([G],z.captureId+".webm",{type:"video/webm"}),we=new l.DataTransfer;we.items.add(ce);let te=l.document.querySelector("#fc-new_comment_field");if(!te)return{dispatched:!1,reason:"attachment_unavailable"};return te.files=we.files,te.dispatchEvent(new l.Event("change",{bubbles:!0})),{dispatched:!0,actor:re.actor}}if(e.operation==="upload_result"){let z=D(e.expected,!1);if(!z.ok)throw Error("github_video_identity_changed");let re=l.document.querySelector("#new_comment_field")?.value?.trim(),G="["+e.expected.captureId+".webm](",ce=re?.startsWith(G)&&re.endsWith(")")?re.slice(G.length,-1):re;if(!ce||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(ce))return null;return{nativeUrl:ce,actor:z.actor}}let M=e.expected,L=D(M,!1);if(!L.ok)return{status:"incomplete",reason:L.reason};return(async()=>{let z=M.nativeUrl.split("/").pop(),re=(Oe)=>{try{let Me=new l.URL(Oe,l.location.href);if(Me.protocol!=="https:"||Me.username||Me.password||Me.port||Me.hash)return!1;if(Me.origin==="https://github.com")return Me.href===M.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(Me.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+z+"\\.(webm|mp4)$").test(Me.pathname)}catch{return!1}},G=[...l.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((Oe)=>/^issue-[1-9][0-9]*$/.test(Oe.closest('[id^="issue-"]')?.id||"")&&!Oe.closest("form")&&!Oe.closest(".preview-content"));if(G.length!==1)throw Error("saved_body_missing");let ce=G[0],we=[...ce.querySelectorAll("video")].filter((Oe)=>[Oe.currentSrc,Oe.src,...[...Oe.querySelectorAll("source")].map((Me)=>Me.src)].some(re));if(we.length!==1)throw Error("saved_player_missing");let te=we[0],X={muted:te.muted,volume:te.volume,rate:te.playbackRate,preload:te.preload},he=new l.AbortController,Se=l.setTimeout(()=>he.abort(),12000),Re=(Oe)=>l.Promise.race([Oe,new l.Promise((Me,Ce)=>{if(he.signal.aborted)Ce(Error("playback_timeout"));else he.signal.addEventListener("abort",()=>Ce(Error("playback_timeout")),{once:!0})})]),Ee=async(Oe)=>{while(!Oe()){if(te.error||he.signal.aborted)throw Error("playback_unverified");await new l.Promise((Me)=>l.setTimeout(Me,25))}};try{if(te.muted=!0,te.playbackRate=1,te.currentTime=0,te.readyState<2)te.preload="auto",te.load();await Ee(()=>te.readyState>=2&&te.videoWidth>0&&te.videoHeight>0);let Oe=te.currentSrc;if(!re(Oe))throw Error("source_unbound");let Me=await Re(l.fetch(Oe,{credentials:"same-origin",redirect:"error",signal:he.signal}));if(Me.status!==200||!re(Me.url)||Me.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(Me.headers.get("content-type")||"")||!Me.body)throw Error("source_unverifiable");let Ce=Me.headers.get("content-length");if(Ce!==null&&(!/^[1-9][0-9]*$/.test(Ce)||Number(Ce)!==M.sizeBytes))throw Error("source_size_mismatch");let Te=Me.body.getReader(),We=[],$e=0;try{for(;;){let Je=await Re(Te.read());if(Je.done)break;if($e+=Je.value.length,$e>10485760||$e>M.sizeBytes)throw Error("source_too_large");We.push(Je.value)}}finally{await Te.cancel().catch(()=>{}),Te.releaseLock()}if($e!==M.sizeBytes)throw Error("source_size_mismatch");let Ue=new l.Uint8Array($e),Ne=0;for(let Je of We)Ue.set(Je,Ne),Ne+=Je.length;let xe=[...new l.Uint8Array(await Re(l.crypto.subtle.digest("SHA-256",Ue)))].map((Je)=>Je.toString(16).padStart(2,"0")).join("");if(xe!==M.sha256||te.currentSrc!==Oe||!ce.contains(te))throw Error("source_changed");let Le=te.currentTime,Ge=te.getVideoPlaybackQuality().totalVideoFrames;if(await Re(te.play()),await Ee(()=>te.currentTime-Le>=0.05&&te.getVideoPlaybackQuality().totalVideoFrames>Ge),!D(M,!1).ok||te.currentSrc!==Oe||!ce.contains(te)||te.error)throw Error("player_changed");return{status:"verified",sourceSha256:xe,width:te.videoWidth,height:te.videoHeight,durationSeconds:te.duration,advancedSeconds:te.currentTime-Le,advancedFrames:te.getVideoPlaybackQuality().totalVideoFrames-Ge,playbackRestored:!0}}finally{if(l.clearTimeout(Se),he.abort(),te.pause(),te.currentTime=0,te.muted=X.muted,te.volume=X.volume,te.playbackRate=X.rate,te.preload=X.preload,!te.paused||te.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as Fp}from"child_process";import{lstat as jp,realpath as qp}from"fs/promises";import{join as rd,resolve as zp}from"path";import{promisify as Kp}from"util";var Vp=Kp(Fp);async function Jp(e,l){let v=await qp(e),{stdout:D}=await Vp(rd(v,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:l});return d(n({browser:t(),directory:t(),connected:_().optional(),source:t(),socketPath:t().optional(),instanceId:t().optional(),extensionId:t().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(D)).filter((L)=>L.browser==="chrome"&&L.connected===!0&&/^(Default|Profile [0-9]+)$/.test(L.directory)&&zp(L.source)===rd(v,"Reason Browser Use","manifest.json"))}async function Ii(e,l,v){if(!/^(Default|Profile [0-9]+)$/.test(l))throw Error("mac_recording_profile_unavailable");let D=(await Jp(e,v)).filter((z)=>z.directory===l),M=D[0];if(D.length!==1||!M?.socketPath||!M.instanceId)throw Error("mac_recording_profile_unavailable");let L=await jp(M.socketPath);if(!L.isSocket()||L.uid!==process.getuid?.()||L.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:M.socketPath,instanceId:M.instanceId,extensionId:M.extensionId}}import{createHash as Gp}from"crypto";function Fn(e){return`reason-browser-${Gp("sha256").update(`reason:mac-browser:v1:${e}`).digest("hex")}`}var od=P("ok",[n({ok:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({ok:i(!1),reason:c(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),id=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})}),ht=()=>Error("mac_pr_proof_browser_unavailable");async function ws(e){let l=ur.parse(e.owner),v="endpoint"in e?e.endpoint(l):await Zp(e.automationDirectory,l),D=new Map,M=`reason-pr-proof-${Yp()}`,L=!1,z=async()=>{if(L)throw ht();if(await e.assertCurrent(),L)throw ht()},re=async(we)=>{if(!Do(l,we.owner))throw ht();await z()},G=async(we)=>{await re(we);let te=await e.readVideo(we.captureId);try{await z();let X=te.capture;if(!Do(X.context.owner,l)||X.captureId!==we.captureId||X.context.prUrl!==we.prUrl||X.context.headSha!==we.headSha||X.media.contentType!=="video/webm"||X.media.sizeBytes!==we.sizeBytes||X.sha256!==we.sha256||te.bytes.length!==we.sizeBytes||te.bytes.length<128||te.bytes.length>10485760||te.bytes.readUInt32BE(0)!==440786851||nd("sha256").update(te.bytes).digest("hex")!==we.sha256)throw ht();return te}catch(X){throw te.bytes.fill(0),X}};async function ce(we,te,X){await z();let he=await v.discover(AbortSignal.timeout(5000)),Se=new Ei({socketPath:he.socketPath,sessionId:M,timeoutMs:5000}),Re,Ee=!1,Oe,Me=new Promise((We,$e)=>{Oe=setTimeout(()=>{Ee=!0,$e(ht())},60000)});Me.catch(()=>{});let Ce=(We)=>Promise.race([We,Me]),Te=async()=>{if(Ee)throw ht();if(await z(),Ee)throw ht()};try{await Ce(Se.connect());let We=id.parse(await Ce(Se.client.getInfo()));if(We.metadata.extensionId!==he.extensionId||We.metadata.extensionInstanceId!==he.instanceId||!We.metadata.nativeHostName)throw ht();await Te(),X?.("connected");let $e=Se.newTab();$e.then((xe)=>{if(Ee)xe.close().catch(()=>{L=!0})},()=>{}),Re=await Ce($e),await Te(),await Ce(Re.goto(we,{waitUntil:"domcontentloaded",timeoutMs:15000})),await Te(),X?.("loaded");let Ne=await Ce(te(Re,async(xe)=>{await Te();let Le=await Ce(Re.evaluate(`(${td.toString()})(${JSON.stringify(xe)})`,{awaitPromise:!0}));return await Te(),Le},Te));return await Te(),Ne}finally{Ee=!0,clearTimeout(Oe);try{if(Re){let We;try{await Promise.race([Re.close(),new Promise(($e,Ue)=>{We=setTimeout(()=>Ue(ht()),5000)})])}finally{clearTimeout(We)}}}catch{throw L=!0,ht()}finally{Se.close()}await z()}}return{async screenshot(we,te,X){let he=$n.parse(we);if(await re(he),!Number.isSafeInteger(te)||te<1||Date.parse(he.expiresAt)<=Date.now())throw ht();X.throwIfAborted();let Se=await v.discover(X),Re=new Ei({socketPath:Se.socketPath,sessionId:v.tabScope,timeoutMs:5000}),Ee;try{await Re.connect();let Oe=id.parse(await Re.client.getInfo());if(Oe.metadata.extensionId!==Se.extensionId||Oe.metadata.extensionInstanceId!==Se.instanceId)throw ht();if(!d(n({id:o()})).max(256).parse(await Re.getTabs()).some((Te)=>Te.id===te))throw ht();await z(),X.throwIfAborted();let Ce=n({data:t().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await Re.cdp.call(te,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(Ce.data)||Ce.data.length%4)throw ht();if(Ee=Buffer.from(Ce.data,"base64"),Ee.toString("base64")!==Ce.data||Ee.length>8388608)throw ht();if(await z(),X.throwIfAborted(),Date.parse(he.expiresAt)<=Date.now())throw ht();return Ee}catch{throw Ee?.fill(0),ht()}finally{Re.close()}},async verifyImages(we){let te=Ci(we);if(te.runId!==l.runId||te.media.some((X)=>X.kind!=="image"))throw ht();return ce("about:blank",async(X,he,Se)=>{let Re=X.browser.client,Ee=new Set(te.media.map((xe)=>xe.sourceUrl)),Oe=new Map,Me=new Set,Ce=!1,Te=0,We=!1,$e=new Set,Ue=(xe,Le)=>{if($e.size>=32){Ce=!0;return}let Ge=Re.executeCdp(X.id,xe,Le);$e.add(Ge),Ge.catch(()=>{Ce=!0}).finally(()=>$e.delete(Ge))},Ne=Re.onNotification((xe)=>{if(xe.method!=="onCDPEvent"||!q(xe.params)||!q(xe.params.source)||xe.params.source.tabId!==X.id||!q(xe.params.params))return;let Le=xe.params.params;if(++Te>512){Ce=!0;return}if(xe.params.method==="Fetch.requestPaused"){let Je=typeof Le.requestId==="string"&&q(Le.request)&&Le.request.method==="GET"&&typeof Le.request.url==="string"&&Ee.has(Le.request.url)&&Le.resourceType==="Image";if(typeof Le.requestId!=="string"){Ce=!0;return}if(!Je)Ce=!0;Ue(Je?"Fetch.continueRequest":"Fetch.failRequest",{requestId:Le.requestId,...Je?{}:{errorReason:"BlockedByClient"}})}if(xe.params.method==="Network.requestWillBeSent"&&Le.redirectResponse)Ce=!0;if(xe.params.method==="Network.loadingFailed")Ce=!0;if(xe.params.method==="Network.loadingFinished"&&typeof Le.requestId==="string")Me.add(Le.requestId);if(xe.params.method!=="Network.responseReceived")return;if(!q(Le.response)||typeof Le.response.url!=="string"||!Ee.has(Le.response.url)||typeof Le.requestId!=="string"||!q(Le.response.headers)||Le.type!=="Image"){Ce=!0;return}let Ge=Object.fromEntries(Object.entries(Le.response.headers).map(([Je,it])=>[Je.toLowerCase(),it])),Ve=Number(Ge["content-length"]);if(Oe.has(Le.response.url)||Le.response.status!==200||Le.response.fromServiceWorker===!0||typeof Ge["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(Ge["content-length"])||!Number.isSafeInteger(Ve)||Ve>8388608||Ge["content-range"]||Ge["content-encoding"]&&Ge["content-encoding"]!=="identity"){Ce=!0;return}Oe.set(Le.response.url,{id:Le.requestId,length:Ve})});try{await Re.executeCdp(X.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await Re.executeCdp(X.id,"Network.setBypassServiceWorker",{bypass:!0}),await Re.executeCdp(X.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await Re.executeCdp(X.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let xe=n({frameTree:n({frame:n({id:t().min(1).max(256)})})}).parse(await Re.executeCdp(X.id,"Page.getFrameTree",{})),Le=[...new Set(te.media.map((Je)=>new URL(Je.sourceUrl).origin))].join(" ");await Re.executeCdp(X.id,"Page.setDocumentContent",{frameId:xe.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${Le}; style-src 'none'"><body></body>`}),await Se(),We=!0;try{await Re.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new r("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await Se();let Ge;try{Ge=await X.evaluate(`(${ed})(${JSON.stringify(te.media)})`,{awaitPromise:!0})}catch{throw new r("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await Se(),!q(Ge)||!Array.isArray(Ge.items)||Ge.items.length!==te.media.length)throw ht();await Promise.all($e);let Ve=[];for(let Je=0;Je<te.media.length;Je++){await z();let it=Oe.get(te.media[Je].sourceUrl);if(Ce||!it||!Me.has(it.id))throw ht();let Ye=n({base64Encoded:i(!0),body:t().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await Re.executeCdp(X.id,"Network.getResponseBody",{requestId:it.id})),Be=Buffer.from(Ye.body,"base64");try{let Ke=Ge.items[Je];if(Be.length!==it.length||Be.toString("base64")!==Ye.body||!q(Ke))throw ht();Ve.push({...Ke,sourceSha256:nd("sha256").update(Be).digest("hex")})}finally{Be.fill(0)}}if(Ce)throw ht();return Kl({verified:!0,items:Ve},te)}finally{if(Ne(),await Promise.allSettled($e),We)try{await Re.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new r("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(we){let te=Ao.parse(we);await re(te);let X="browser_unavailable";try{return await ce(`https://github.com/${te.repositoryFullName}`,async(he,Se)=>{let Re=od.parse(await Se({operation:"preflight",expected:{...te,prUrl:`https://github.com/${te.repositoryFullName}`}}));return ms.parse(Re.ok?{...te,status:"ready",observedActor:Re.actor,checkedAt:new Date().toISOString()}:Re.reason==="attachment_unavailable"?{...te,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...te,status:"not_ready",reason:Re.reason})},(he)=>{X=he==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return ms.parse({...te,status:"not_ready",reason:"unavailable",cause:X})}},async publish(we){let te=_n.parse(we);if(await re(te),te.expectedActorId!==null&&te.authenticatedActor.id!==te.expectedActorId)throw ht();let X=D.get(te.attemptId);if(X){if(!Do(X.binding,te))throw ht();return structuredClone(X.result)}if(D.size>=3)throw Error("proof_native_publication_limit");let he={binding:structuredClone(te),result:Bn.parse({...te,status:"uncertain",reason:"upload_outcome_unknown"})};D.set(te.attemptId,he);let Se=!1,Re="dispatch";try{(await G(te)).bytes.fill(0),he.result=await ce(te.prUrl,async(Ee,Oe)=>{let Me=od.parse(await Oe({operation:"identity",expected:te}));if(!Me.ok)return Bn.parse({...te,status:"not_attempted",reason:Me.reason});let Ce=await G(te),Te;try{Se=!0,Te=P("dispatched",[n({dispatched:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({dispatched:i(!1),reason:c(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await Oe({operation:"upload",expected:te,base64:Ce.bytes.toString("base64")}))}finally{Ce.bytes.fill(0)}if(!Te.dispatched)return Se=!1,Bn.parse({...te,status:"not_attempted",reason:Te.reason});if(!Do(Te.actor,Me.actor))throw Re="actor_changed",ht();Re="result";let We=performance.now();while(performance.now()-We<30000){let $e=await Oe({operation:"upload_result",expected:{...te,observedActor:Me.actor}});if($e!==null){let Ue=n({nativeUrl:t(),actor:n({login:t(),id:t().nullable()}).strict()}).strict().parse($e);return Re="finalize",await z(),Bn.parse({...te,status:"uploaded",nativeUrl:Ue.nativeUrl,observedActor:Ue.actor,uploadedAt:new Date().toISOString()})}await new Promise((Ue)=>setTimeout(Ue,100))}throw Re="result_timeout",ht()})}catch{if(Se)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${Re})
+`);he.result=Bn.parse({...te,...Se?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(he.result)},async verify(we){let te=Io.parse(we);await re(te);try{return(await G(te)).bytes.fill(0),await ce(te.prUrl,async(X,he)=>{await X.browser.client.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let Se=await he({operation:"saved_player",expected:te});if(!Se||typeof Se!=="object"||Array.isArray(Se))throw ht();let Re=ps.parse({...te,...Se,..."status"in Se&&Se.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(te).some(([Ee,Oe])=>!Do(Oe,Re[Ee])))throw ht();return Re}finally{await X.browser.client.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return ps.parse({...te,status:"incomplete",reason:"playback_unverified"})}},close(){L=!0}}}async function Zp(e,l){let v=await Xp(e);return{async discover(D){let M=await Ii(v,l.profile,D);if(M.instanceId!==l.extensionInstanceId)throw ht();return M},tabScope:Fn(l.runId)}}import{realpath as yh}from"fs/promises";var Hv=n({version:i(1),recording_operation_id:t().uuid(),proof_ready:i(!1),acknowledged_at:I.datetime()}).strict(),Di=n({action:i("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),ad=n({action:i("inspect"),recording_operation_id:t().uuid()}).strict(),$v=P("action",[Di,ad]),sd=n({recording_operation_id:t().uuid()}).strict(),ys={device_id:t().uuid(),root_id:t().uuid()},Qp=P("action",[Di.extend(ys),ad.extend(ys),sd.extend({...ys,action:i("stop")})]),Bv=Ji(Qp),Uv=n({version:i(1),recordingId:t().uuid(),proofReady:i(!1),capture:n({captureId:t().uuid(),contentType:i("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:I.datetime(),finishedAt:I.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:n({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var Xv=Di.extend({action:c(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{createHash as lh,randomUUID as dh}from"crypto";import{mkdtemp as uh,realpath as fh,rm as hd}from"fs/promises";import{tmpdir as mh}from"os";import{join as ph}from"path";import{spawn as hh}from"child_process";import{isDeepStrictEqual as gh}from"util";import{createHash as eh}from"crypto";import{execFile as th}from"child_process";import{chmod as rh,lstat as ld,mkdtemp as nh,readFile as dd,realpath as ud,rm as oh,writeFile as cd}from"fs/promises";import{tmpdir as ih}from"os";import{isAbsolute as ah,join as Mi}from"path";import{promisify as sh}from"util";var _s=sh(th),ch=(e)=>eh("sha256").update(e).digest("hex");async function Pr(e){if(!ah(e.path)||!/^[a-f0-9]{64}$/.test(e.sha256)||await ud(e.path)!==e.path)throw Error("mac_recording_encoder_unqualified");let l=await ld(e.path);if(!l.isFile()||!(l.mode&73)||l.mode&18||l.size>134217728||ch(await dd(e.path))!==e.sha256)throw Error("mac_recording_encoder_unqualified")}async function To(e,l){if(!e)return null;let v=structuredClone(e);try{await Promise.all([Pr(v.ffmpeg),Pr(v.ffprobe)])}catch{return null}return{async encode(D,M,L){if(L.aborted||!D.length||!Number.isFinite(M)||M<0.05||M>15)throw Error("mac_recording_encoding_invalid");await Promise.all([Pr(v.ffmpeg),Pr(v.ffprobe)]);let z=await ud(await nh(Mi(l??ih(),"reason-owned-recording-")));await rh(z,448);let re=Mi(z,"capture.webm"),G="frames";try{let ce=["ffconcat version 1.0"];for(let[Ee,Oe]of D.entries()){let Me=`${Ee}.jpg`;await cd(Mi(z,Me),Oe.jpeg,{mode:384,flag:"wx"});let Ce=D[Ee+1]?.timestamp??D[0].timestamp+M;ce.push(`file '${Me}'`,`duration ${Math.max(0.001,Ce-Oe.timestamp).toFixed(6)}`)}ce.push(`file '${D.length-1}.jpg'`),await cd(Mi(z,"frames.ffconcat"),ce.join(`
 `)+`
-`,{mode:384,flag:"wx"});let we={cwd:z,signal:L,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};G="encode",await Ss(v.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(M),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${M},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",re],we),G="output";let te=await ld(re);if(!te.isFile()||te.isSymbolicLink()||te.nlink!==1||te.size<128||te.size>10485760)throw Error();G="probe";let{stdout:X}=await Ss(v.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",re],we),he=JSON.parse(X),Se=he.streams,Re=Number(he.format?.duration);if(G="probe_streams",!Array.isArray(Se)||Se.length!==1||Se[0]?.codec_type!=="video"||Se[0]?.codec_name!=="vp8")throw Error();if(G="probe_dimensions",!Number.isSafeInteger(Se[0].width)||Se[0].width<2||Se[0].width>1600||!Number.isSafeInteger(Se[0].height)||Se[0].height<2||Se[0].height>1000)throw Error();if(G="probe_duration",!Number.isFinite(Re)||Math.abs(Re-M)>0.25)throw Error();if(G="probe_frames",!Number.isSafeInteger(Number(Se[0].nb_read_frames))||Number(Se[0].nb_read_frames)<1)throw Error();if(G="probe_format",he.format?.format_name!=="matroska,webm")throw Error();return G="decode",await Ss(v.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",re,"-f","null","-"],we),G="pin",await Promise.all([Ar(v.ffmpeg),Ar(v.ffprobe)]),await dd(re)}catch{throw Error(L.aborted?"mac_recording_cancelled":`mac_recording_encoding_${G}_failed`)}finally{await oh(z,{recursive:!0,force:!0})}}}}var md=c(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var xr=t().min(1).max(1024),fd=n({path:xr,sha256:t().regex(/^[a-f0-9]{64}$/)}).strict(),pd=n({owner:n({runId:xr,deviceId:xr,rootId:xr,rootRevision:xr,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:xr,generation:xr,browserScope:xr,tabId:o().int().positive()}).strict(),socketPath:xr,extensionId:t().regex(/^[a-p]{32}$/),nativeHostName:xr,seconds:o().int().min(1).max(15),encoder:n({ffmpeg:fd,ffprobe:fd}).strict()}).strict();var wh=15728640,tn=()=>Error("mac_recording_worker_failed");function gd(e){let l=pd.parse(e.configuration),v={...e.worker},O=new Map,M=!1,L=!1,z=null,re=async()=>{},G=async(X,he=3000)=>{let Se;try{return await Promise.race([X,new Promise((Re,Ee)=>{Se=setTimeout(()=>Ee(tn()),he)})])}finally{clearTimeout(Se)}},ce=()=>z??=G((async()=>{let he=(await Promise.allSettled([re(),e.cleanup()])).find((Se)=>Se.status==="rejected");if(he?.status==="rejected")throw he.reason})(),5000).catch((X)=>{M=!0;let he=X&&typeof X==="object"&&"code"in X?X.code:null,Se=typeof he==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(he)?he:"unknown";throw Error(`mac_recording_cleanup_failed:${Se}`)}),we=null,te=async()=>{if(M)throw tn();if(await G(e.assertCurrent()),M)throw tn()};return{async start(){if(L||we)throw Error("mac_recording_already_active");L=!0;try{await te(),await Ar({path:v.path,sha256:v.sha256}),await te(),z=null;let X=await fh(await uh(ph(mh(),"reason-recording-host-")));try{await te()}catch(Be){throw await hd(X,{recursive:!0,force:!0}),Be}let he=hh(v.path,[...v.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),Se=new Promise((Be)=>he.once("close",()=>Be())),Re=()=>{if(he.pid)try{process.kill(-he.pid,"SIGKILL")}catch(Be){if(Be.code!=="ESRCH")throw Be}},Ee=null;re=()=>Ee??=(async()=>{try{Re()}catch(Be){if(Be.code!=="EPERM")throw Be}await Se;try{for(let Be=0;;Be++)try{Re();break}catch(Ke){if(Ke.code!=="EPERM"||Be>=20)throw Ke;await new Promise((qe)=>setTimeout(qe,25))}}finally{await hd(X,{recursive:!0,force:!0})}})();let Oe="",Me=0,Ce=!1,Te=!1,We=null,$e,Fe,Ne=new Promise((Be,Ke)=>{$e=Be,Fe=Ke}),xe,Le,Ge=new Promise((Be,Ke)=>{xe=Be,Le=Ke});Ge.catch(()=>{});let Ve=(Be=tn())=>{if(Ce)return;Ce=!0,clearTimeout(Je),clearInterval(Ye),ce().then(()=>{Fe(Be),Le(Be)},(Ke)=>{Fe(Ke),Le(Ke)})},Je=setTimeout(()=>Ve(),(l.seconds+25)*1000),it=!1,Ye=setInterval(()=>{if(it||Ce)return;it=!0,te().catch(()=>Ve()).finally(()=>{it=!1})},250);we={completion:Ge,stop:()=>{if(!Ce)he.stdin.write(`{"type":"stop"}
+`,{mode:384,flag:"wx"});let we={cwd:z,signal:L,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};G="encode",await _s(v.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(M),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${M},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",re],we),G="output";let te=await ld(re);if(!te.isFile()||te.isSymbolicLink()||te.nlink!==1||te.size<128||te.size>10485760)throw Error();G="probe";let{stdout:X}=await _s(v.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",re],we),he=JSON.parse(X),Se=he.streams,Re=Number(he.format?.duration);if(G="probe_streams",!Array.isArray(Se)||Se.length!==1||Se[0]?.codec_type!=="video"||Se[0]?.codec_name!=="vp8")throw Error();if(G="probe_dimensions",!Number.isSafeInteger(Se[0].width)||Se[0].width<2||Se[0].width>1600||!Number.isSafeInteger(Se[0].height)||Se[0].height<2||Se[0].height>1000)throw Error();if(G="probe_duration",!Number.isFinite(Re)||Math.abs(Re-M)>0.25)throw Error();if(G="probe_frames",!Number.isSafeInteger(Number(Se[0].nb_read_frames))||Number(Se[0].nb_read_frames)<1)throw Error();if(G="probe_format",he.format?.format_name!=="matroska,webm")throw Error();return G="decode",await _s(v.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",re,"-f","null","-"],we),G="pin",await Promise.all([Pr(v.ffmpeg),Pr(v.ffprobe)]),await dd(re)}catch{throw Error(L.aborted?"mac_recording_cancelled":`mac_recording_encoding_${G}_failed`)}finally{await oh(z,{recursive:!0,force:!0})}}}}var md=c(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var Ar=t().min(1).max(1024),fd=n({path:Ar,sha256:t().regex(/^[a-f0-9]{64}$/)}).strict(),pd=n({owner:n({runId:Ar,deviceId:Ar,rootId:Ar,rootRevision:Ar,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:Ar,generation:Ar,browserScope:Ar,tabId:o().int().positive()}).strict(),socketPath:Ar,extensionId:t().regex(/^[a-p]{32}$/),nativeHostName:Ar,seconds:o().int().min(1).max(15),encoder:n({ffmpeg:fd,ffprobe:fd}).strict()}).strict();var wh=15728640,Jr=()=>Error("mac_recording_worker_failed");function gd(e){let l=pd.parse(e.configuration),v={...e.worker},D=new Map,M=!1,L=!1,z=null,re=async()=>{},G=async(X,he=3000)=>{let Se;try{return await Promise.race([X,new Promise((Re,Ee)=>{Se=setTimeout(()=>Ee(Jr()),he)})])}finally{clearTimeout(Se)}},ce=()=>z??=G((async()=>{let he=(await Promise.allSettled([re(),e.cleanup()])).find((Se)=>Se.status==="rejected");if(he?.status==="rejected")throw he.reason})(),5000).catch((X)=>{M=!0;let he=X&&typeof X==="object"&&"code"in X?X.code:null,Se=typeof he==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(he)?he:"unknown";throw Error(`mac_recording_cleanup_failed:${Se}`)}),we=null,te=async()=>{if(M)throw Jr();if(await G(e.assertCurrent()),M)throw Jr()};return{async start(){if(L||we)throw Error("mac_recording_already_active");L=!0;try{await te(),await Pr({path:v.path,sha256:v.sha256}),await te(),z=null;let X=await fh(await uh(ph(mh(),"reason-recording-host-")));try{await te()}catch(Be){throw await hd(X,{recursive:!0,force:!0}),Be}let he=hh(v.path,[...v.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),Se=new Promise((Be)=>he.once("close",()=>Be())),Re=()=>{if(he.pid)try{process.kill(-he.pid,"SIGKILL")}catch(Be){if(Be.code!=="ESRCH")throw Be}},Ee=null;re=()=>Ee??=(async()=>{try{Re()}catch(Be){if(Be.code!=="EPERM")throw Be}await Se;try{for(let Be=0;;Be++)try{Re();break}catch(Ke){if(Ke.code!=="EPERM"||Be>=20)throw Ke;await new Promise((Fe)=>setTimeout(Fe,25))}}finally{await hd(X,{recursive:!0,force:!0})}})();let Oe="",Me=0,Ce=!1,Te=!1,We=null,$e,Ue,Ne=new Promise((Be,Ke)=>{$e=Be,Ue=Ke}),xe,Le,Ge=new Promise((Be,Ke)=>{xe=Be,Le=Ke});Ge.catch(()=>{});let Ve=(Be=Jr())=>{if(Ce)return;Ce=!0,clearTimeout(Je),clearInterval(Ye),ce().then(()=>{Ue(Be),Le(Be)},(Ke)=>{Ue(Ke),Le(Ke)})},Je=setTimeout(()=>Ve(),(l.seconds+25)*1000),it=!1,Ye=setInterval(()=>{if(it||Ce)return;it=!0,te().catch(()=>Ve()).finally(()=>{it=!1})},250);we={completion:Ge,stop:()=>{if(!Ce)he.stdin.write(`{"type":"stop"}
 `)},cancel:()=>Ve()},he.on("error",()=>Ve()),he.stdin.on("error",()=>Ve()),he.stdout.on("data",(Be)=>{if(Ce)return;if(Me+=Be.length,Me>wh){Ve();return}Oe+=Be.toString("utf8");let Ke;while((Ke=Oe.indexOf(`
-`))!==-1){let qe=Oe.slice(0,Ke);Oe=Oe.slice(Ke+1);try{let nt=JSON.parse(qe);if(nt.type==="failed"&&Object.keys(nt).sort().join(",")==="reason,type"){let at=md.safeParse(nt.reason);Ve(at.success?Error(`mac_recording_worker_failed:${at.data}`):tn());return}if(nt.type==="unsupported"&&!Te){Ve(Error("mac_recording_encoder_unavailable"));return}if(nt.type==="started"&&!Te&&Object.keys(nt).length===1){Te=!0,$e({recording:!0});continue}if(!Te||nt.type!=="capture"||We||Object.keys(nt).sort().join(",")!=="bytes,capture,type")throw tn();let et=nt.capture;if(!et||Object.keys(et).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof et.sha256!=="string"||typeof et.startedAt!=="string"||typeof et.finishedAt!=="string"||!gh(et.owner,l.owner)||et.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(et.sha256)||!Number.isSafeInteger(et.sizeBytes)||et.sizeBytes<128||et.sizeBytes>10485760||!Number.isSafeInteger(et.frameCount)||et.frameCount<1||et.frameCount>450||!Number.isSafeInteger(et.receivedFrameCount)||et.receivedFrameCount<et.frameCount||et.receivedFrameCount>2000||!Number.isFinite(et.durationSeconds)||et.durationSeconds<0.05||et.durationSeconds>l.seconds||!Number.isFinite(Date.parse(et.startedAt))||!Number.isFinite(Date.parse(et.finishedAt))||Math.abs((Date.parse(et.finishedAt)-Date.parse(et.startedAt))/1000-et.durationSeconds)>0.1||typeof nt.bytes!=="string"||nt.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(nt.bytes))throw tn();let He=Buffer.from(nt.bytes,"base64");if(He.length!==et.sizeBytes||lh("sha256").update(He).digest("hex")!==et.sha256||!He.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw tn();We={capture:Object.freeze({...et,captureId:dh(),owner:Object.freeze({...l.owner})}),bytes:He}}catch{Ve();return}}}),he.once("close",(Be)=>{if(Ce)return;if(Be!==0||!We||Oe.trim()){Ve();return}let Ke=We;te().then(async()=>{if(await re(),Ce)return;Ce=!0,clearTimeout(Je),clearInterval(Ye),O.set(Ke.capture.captureId,Ke);while(O.size>2)O.delete(O.keys().next().value);xe(Ke.capture)}).catch(()=>Ve())}),he.stdin.write(JSON.stringify({...l,scratchDirectory:X})+`
-`);try{return await Ne}catch(Be){throw we=null,Be}}finally{L=!1}},async completed(){if(await te(),!we)throw Error("mac_recording_not_active");return we.completion},async stop(){await te();let X=we;if(!X)throw Error("mac_recording_not_started");X.stop();try{return await X.completion}finally{if(we===X)we=null}},async read(X){await te();let he=O.get(X);if(!he)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(he.capture),bytes:Buffer.from(he.bytes)}},async close(){if(M)return;M=!0;let X=we;X?.cancel(),O.clear();try{await ce(),await X?.completion.catch(()=>{})}finally{we=null}}}}var wd=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});async function Rs(e){await e.assertCurrent();let l;if("discover"in e)l=e.discover;else{let v=await yh(e.automationDirectory);l=(O,M)=>Mi(v,O,M)}if(await Ar({path:e.worker.path,sha256:e.worker.sha256}),!await Lo(e.encoder))throw Error("mac_recording_encoder_unavailable");return async(v,O,M,L)=>{L.throwIfAborted(),await e.assertCurrent();let z=await l(v,L),re=new en({socketPath:z.socketPath,sessionId:M,timeoutMs:2000}),G;try{if(await re.connect(),G=wd.parse(await re.getInfo()),G.metadata.extensionId!==z.extensionId||G.metadata.extensionInstanceId!==z.instanceId)throw Error("mac_recording_profile_changed");if(!d(n({id:o()})).parse(await re.getTabs()).some((we)=>we.id===O))throw Error("mac_recording_tab_not_owned");await e.assertCurrent(),L.throwIfAborted()}finally{re.close()}return{extensionInstanceId:z.instanceId,async createHost(ce,we,te){let X=new en({socketPath:z.socketPath,sessionId:ce.browser.browserScope,timeoutMs:2000});return gd({worker:e.worker,configuration:{owner:ce.browser,seconds:we,encoder:e.encoder,socketPath:z.socketPath,extensionId:z.extensionId,nativeHostName:G.metadata.nativeHostName},async assertCurrent(){te.throwIfAborted(),L.throwIfAborted(),await e.assertCurrent()},async cleanup(){try{await X.connect();let Se=wd.parse(await X.getInfo());if(Se.metadata.extensionInstanceId!==ce.browser.extensionInstanceId||Se.metadata.extensionId!==z.extensionId||Se.metadata.nativeHostName!==G.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await X.executeCdp(O,"Page.stopScreencast",{})}finally{X.close()}}})}}}}var Wt=()=>Error("mac_pr_proof_unavailable"),kh=n({operationId:t().uuid()}).strict();function _d(e){let l=e.qualifiedProfiles??[{profile:e.profile,extension_instance_id:e.extensionInstanceId}],v=d(n({profile:t().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:t().min(1).max(1024)}).strict()).min(1).max(16).parse(l);if(!t().uuid().safeParse(e.generation).success||new Set(v.map((X)=>X.profile)).size!==v.length)throw Wt();if(!e.qualifiedProfiles){let X=new URL(e.uploadOrigin);if(!e.resolveBrowser||X.protocol!=="https:"||X.origin!==e.uploadOrigin||X.username||X.password)throw Wt()}let O=new Map,M=new Map,L=new Map,z=!1,re=new _h,G=async(X)=>{let he=re.getStore();if(z||!X&&!he)throw Wt();if(he?.signal.throwIfAborted(),await e.assertCurrent(X??he.claim),z)throw Wt();he?.signal.throwIfAborted()},ce=(X,he)=>{let Se="owner"in he?he.owner:("context"in he)?he.context.owner:he.input.owner;if(X.capability!==ms||!X.owner||Se.generation!==e.generation||!v.some((Re)=>Re.profile===Se.profile&&Re.extension_instance_id===Se.extensionInstanceId)||Se.organizationId!==X.owner.organization_id||Se.userId!==X.owner.user_id||Se.deviceId!==X.owner.device_id||Se.rootId!==X.root_id||Se.runId!==X.run_id)throw Wt();return Se},we=async(X)=>{await G();let he=JSON.stringify([X.runId,X.profile]),Se=O.get(he);if(!Se){if(O.size>=4)throw Wt();Se=(async()=>{let Ee,Oe=e.browserScope?.(X)??zn(X.runId),Me=await e.createBrowser({owner:X,assertCurrent:()=>G(),readVideo:(Ce)=>Ee.publicationCapture(Ce)});if(Ee=Ql({owner:X,browserScope:Oe,assertCurrent:()=>G(),screenshot:Me.screenshot,async createVideo(Ce,Te,We,$e){if(!e.resolveBrowser)throw Wt();let Fe=await e.resolveBrowser(X.profile,Te,Oe,$e);if(Fe.extensionInstanceId!==X.extensionInstanceId)throw Wt();return Fe.createHost({organizationId:X.organizationId,userId:X.userId,operationId:Ce.contextId,attemptId:Ce.contextId,recordingId:Ce.contextId,browser:{runId:X.runId,deviceId:X.deviceId,rootId:X.rootId,rootRevision:X.rootRevision,generation:X.generation,profile:X.profile,extensionInstanceId:X.extensionInstanceId,browserScope:Oe,tabId:Te}},We,$e)}}),z)throw Me.close(),await Ee.close(),Wt();return{owner:structuredClone(X),browser:Me,capture:Ee,expiresAt:Date.now()+300000}})(),O.set(he,Se)}let Re=await Se;if(!yd(Re.owner,X)||Re.expiresAt<=Date.now())throw Wt();return Re},te=setInterval(()=>{for(let[X,he]of O)he.then(async(Se)=>{if(Se.expiresAt>Date.now()||[...M.values()].some((Re)=>Re.runtime===Se))return;if(Se.browser.close(),await Se.capture.close(),O.get(X)===he)O.delete(X)}).catch(()=>{z=!0})},1000);return te.unref(),{generation:e.generation,async execute(X,he,Se){return re.run({claim:X,signal:he},async()=>{let Re=_s.parse(X.payload).command,Ee=ce(X,Re);if(await G(X),he.throwIfAborted(),e.qualifiedProfiles&&!e.resolveBrowser&&(Re.action==="prepare"?Re.context.evidenceKind!=="image"||Boolean(Re.context.visualPlan)||!Re.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(Re.action)))throw Error("proof_png_only");let Oe=await we(Ee),Me=async()=>{await G(X),he.throwIfAborted()},Ce;switch(Re.action){case"auth_check":Ce=await Oe.browser.preflight(Re.input);break;case"prepare":if(Re.context.visualPlan)throw Error("proof_source_unavailable");if(e.qualifiedProfiles&&!Re.context.uploadOrigin)throw Wt();Ce=await Oe.capture.prepare(Re.context);break;case"capture_png":Ce=await Oe.capture.screenshot({claim:{operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId},signal:he});break;case"start_video":{let Te={runtime:Oe,contextId:Re.contextId,attemptId:X.attempt_id,tabId:Re.tabId,signal:he};if(M.has(X.operation_id))throw Wt();M.set(X.operation_id,Te);try{Ce=await Oe.capture.record({claim:{operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId},signal:he,seconds:Re.seconds,started:async()=>{await Me(),await Se({version:1,operationId:X.operation_id,contextId:Re.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{M.delete(X.operation_id)}break}case"inspect_capture":Ce=await Oe.capture.inspect(Re.captureId);break;case"publish_video":Ce=await Oe.browser.publish(Re.input);break;case"verify_saved_media":Ce=await Oe.browser.verify(Re.input);break;case"verify_png_media":Ce=await Oe.browser.verifyImages(Re.media);break;case"publish_png":{let Te=`${Ee.runId}:${Re.attemptId}`,We=L.get(Te);if(We){if(!yd(We.request,Re))throw Wt();Ce=We.result;break}if(L.size>=16)throw Wt();let $e=new URL(Re.uploadUrl);if($e.protocol!=="https:"||$e.username||$e.password||$e.hash||$e.pathname!==`/${Re.storagePath}`||!Re.storagePath.startsWith(`pr-screenshots/${Ee.runId}/${Re.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(Re.storagePath.split("/").at(-1))||Re.storagePath.split("/").length!==4)throw Wt();let Fe=await Oe.capture.publicationCapture(Re.captureId);try{if($e.origin!==(e.qualifiedProfiles?Fe.capture.context.uploadOrigin:e.uploadOrigin)||Fe.capture.media.contentType!=="image/png"||Fe.capture.sha256!==Re.sha256||Fe.bytes.length!==Re.sizeBytes||bh("sha256").update(Fe.bytes).digest("hex")!==Re.sha256)throw Wt();await Me();let Ne={request:structuredClone(Re),result:{status:"uncertain",sha256:Re.sha256,sizeBytes:Re.sizeBytes}};L.set(Te,Ne);try{let xe=await fetch($e,{method:"PUT",body:Fe.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([he,AbortSignal.timeout(20000)])});if(await xe.body?.cancel(),await Me(),xe.ok)Ne.result={...Ne.result,status:"uploaded"}}catch{}Ce=Ne.result}finally{Fe.bytes.fill(0)}break}}return await Me(),structuredClone(Ce)})},async control(X,he){if(X.capability!==ms||he.kind!==Xl)return!1;let Se=kh.safeParse(he.payload),Re=M.get(X.operation_id);if(!Se.success||Se.data.operationId!==X.operation_id||!Re||Re.attemptId!==X.attempt_id)return!1;let Ee=_s.parse(X.payload).command;return ce(X,Ee),await G(X),await re.run({claim:X,signal:Re.signal},()=>Re.runtime.capture.stop({operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId})),!0},async close(){z=!0,clearInterval(te);let X=await Promise.allSettled([...O.values()].map(async(he)=>{let Se=await he;Se.browser.close(),await Se.capture.close()}));if(O.clear(),M.clear(),L.clear(),X.some((he)=>he.status==="rejected"))throw Wt()}}}var xh="__browser-recorder",Ih=Ah(vh),Oh="/tmp/open-browser-use",Dh=33554432,Mh=n({version:i("0.1.42"),metadata:n({extensionId:i(le),extensionInstanceId:t().min(1).max(1024)})}),kd=()=>Error("worker_pr_proof_browser_unavailable"),As={components:T,ensureBrowser:Io,socketDirectory:Oh,async identity(e){let l=new en({socketPath:e,sessionId:`reason-proof-qualification-${Cs()}`,timeoutMs:2000});try{return await l.connect(),await l.getInfo()}finally{l.close()}}};async function vd(e,l=As){let v=l.components();if(!v?.features.browser)throw kd();await l.ensureBrowser(v),e.throwIfAborted();let O=Es(Do(v),"Default","Local Extension Settings",le),M=(await bd(O)).filter((L)=>L.endsWith(".log")||L.endsWith(".ldb")).map((L)=>Es(O,L));for(let L of(await bd(l.socketDirectory)).filter((z)=>z.endsWith(".sock"))){e.throwIfAborted();let z=Es(l.socketDirectory,L);try{let re=await Rh(z);if(!re.isSocket()||re.uid!==process.getuid?.())continue;let G=Mh.parse(await l.identity(z)).metadata.extensionInstanceId;for(let ce of M)if((await Ph(ce)).size<=Dh&&(await Sd(ce)).includes(G))return{socketPath:z,instanceId:G,extensionId:le}}catch{}}throw kd()}async function Ps(e){let l=await Eh(e);return{path:l,sha256:Sh("sha256").update(await Sd(l)).digest("hex")}}async function Rd(e={}){let l={...As,...e};try{let v=l.components();if(!v?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!v.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let O=await Ps(v.ffmpeg),{stdout:M}=await Ih(O.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(M))return{error:"worker_recording_libvpx_unavailable"};let L={ffmpeg:O,ffprobe:await Ps(v.ffprobe)};if(!await Lo(L))return{error:"worker_recording_encoder_unqualified"};let z=e.recorder??{path:process.execPath,args:[...Ch(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],xh]};return{worker:{...await Ps(z.path),args:z.args},encoder:L}}catch{return{error:"worker_recording_unqualified"}}}function Ed(e,l={}){let v={...As,...l},O=Cs(),M=Cs(),L=so.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:O,profiles:["Default"],extension_instance_ids:[M],image:!0,video:!1,source_bound:!1}),z=e.recording?ao.parse({...L,version:3,video:!0,max_seconds:15}):L,re=(te)=>Ul(te.organizationId,te.sessionId,te.deviceId,1),G=e.recording,ce,we=_d({generation:O,qualifiedProfiles:[{profile:"Default",extension_instance_id:M}],assertCurrent:e.assertCurrent,browserScope:re,...G?{resolveBrowser:async(te,X,he,Se)=>{ce??=Rs({...G,assertCurrent:()=>e.assertCurrent(),discover:(Ee,Oe)=>vd(Oe,v)}),ce.catch(()=>{ce=void 0});let Re=await(await ce)(te,X,he,Se);return{extensionInstanceId:M,createHost:async(Ee,Oe,Me)=>Th(await Re.createHost({...Ee,browser:{...Ee.browser,extensionInstanceId:Re.extensionInstanceId}},Oe,Me),M)}}}:{},createBrowser:(te)=>ks({...te,endpoint:(X)=>({discover:(he)=>vd(he,v),tabScope:re(X)})})});return{capability:z,broker:we}}function Th(e,l){let v=(O)=>({...O,owner:{...O.owner,extensionInstanceId:l}});return{start:()=>e.start(),close:()=>e.close(),completed:async()=>v(await e.completed()),stop:async()=>v(await e.stop()),read:async(O)=>{let M=await e.read(O);return{capture:v(M.capture),bytes:M.bytes}}}}import{execFile as Xh}from"child_process";import{execFile as Lh}from"child_process";import{readFile as Wh}from"fs/promises";import{join as Sr}from"path";var Nh="Claude Code-credentials",Hh="/usr/bin/security",$h=120000,Bh=8192,Ni={exec:(e,l,v)=>new Promise((O)=>{Lh(e,l,{timeout:v,maxBuffer:8388608},(M,L)=>{let z=M?typeof M.code==="number"?M.code:1:0;O({code:z,stdout:String(L??"")})})}),readText:async(e)=>{try{return await Wh(e,"utf8")}catch{return null}}};function Kn(e){return typeof e==="string"&&e.length>0&&e.length<=Bh?e:null}function Uh(e,l){return e.CLAUDE_CONFIG_DIR||Sr(l,".claude")}function Fh(e,l){return e.CODEX_HOME||Sr(l,".codex")}function Pd(e){if(!e)return null;try{let l=JSON.parse(e).claudeAiOauth,v=Kn(l?.accessToken),O=Kn(l?.refreshToken),M=typeof l?.expiresAt==="number"&&Number.isFinite(l.expiresAt)?l.expiresAt:null;return v&&O&&M!==null?{provider:"anthropic",access:v,refresh:O,expires:M}:null}catch{return null}}function jh(e){try{let l=JSON.parse(Buffer.from(e.split(".")[1]??"","base64url").toString("utf8"));return typeof l.exp==="number"?l.exp*1000:null}catch{return null}}function qh(e){if(!e)return null;try{let l=JSON.parse(e);if(l.auth_mode!==void 0&&l.auth_mode!=="chatgpt")return null;let v=Kn(l.tokens?.access_token),O=Kn(l.tokens?.refresh_token);if(!v||!O)return null;return{provider:"openai-codex",access:v,refresh:O,expires:jh(v)??Date.now()}}catch{return null}}function zh(e,l){return Sr(e.XDG_DATA_HOME||Sr(l,".local","share"),"opencode","auth.json")}var Kh={anthropic:"anthropic",openai:"openai-codex"};function Vh(e){return Id(e,Kh)}function Id(e,l){if(!e)return[];try{let v=JSON.parse(e),O=[];for(let[M,L]of Object.entries(l)){let z=v[M];if(z?.type!=="oauth")continue;let re=Kn(z.access),G=Kn(z.refresh),ce=typeof z.expires==="number"&&Number.isFinite(z.expires)?z.expires:null;if(re&&G&&ce!==null)O.push({provider:L,access:re,refresh:G,expires:ce})}return O}catch{return[]}}function Jh(e){return Id(e,{anthropic:"anthropic","openai-codex":"openai-codex"})}function Gh(e,l){let v=e.PI_CODING_AGENT_DIR;return v==="~"?l:v?.startsWith("~/")?Sr(l,v.slice(2)):v||Sr(l,".pi","agent")}async function Od(e,l,v=Ni){let O=[],M=await v.exec(Hh,["find-generic-password","-s",Nh,"-w"],$h),L=Date.now()+300000,z=(G)=>{if(!G)return;let ce=O.findIndex((we)=>we.provider===G.provider);if(ce<0)O.push(G);else if(O[ce].expires<=L&&G.expires>L)O[ce]=G};if(z(M.code===0?Pd(M.stdout.trim()):null),!O.some((G)=>G.provider==="anthropic"&&G.expires>L))z(Pd(await v.readText(Sr(Uh(e,l),".credentials.json"))));let re=qh(await v.readText(Sr(Fh(e,l),"auth.json")));z(re),z(Yh(await v.readText(Sr(e.GROK_HOME||Sr(l,".grok"),"auth.json"))));for(let G of Vh(await v.readText(zh(e,l))))z(G);for(let G of Jh(await v.readText(Sr(Gh(e,l),"auth.json"))))z(G);return O}function Dd(e){return e.map(({provider:l,access:v,expires:O})=>({provider:l,access:v,expires:O}))}var Cd="https://auth.x.ai",Ad="b1a00492-073a-47ea-816f-4c329264a828",xd=(e)=>typeof e==="string"&&e.length>0&&e.length<=8192&&e.trim()===e;function Yh(e){if(!e)return null;try{let l=JSON.parse(e);if(!l||typeof l!=="object"||Array.isArray(l))return null;let v=l[`${Cd}::${Ad}`];if(!v||typeof v!=="object"||Array.isArray(v))return null;let O=v;if(O.auth_mode!=="oidc"||O.oidc_issuer!==Cd||O.oidc_client_id!==Ad||!xd(O.key)||!xd(O.refresh_token)||typeof O.expires_at!=="string")return null;let M=Date.parse(O.expires_at);if(!Number.isFinite(M)||M<=0)return null;return{provider:"xai",access:O.key,refresh:O.refresh_token,expires:M}}catch{return null}}var Md=330000,Zh=300000,Qh=60000;function eg(e,l,v=Date.now()){return e.filter((O)=>{if(!Number.isFinite(O.expires)||O.expires<=v+Md)return!1;let M=l.get(O.provider);return!M||M.access!==O.access||M.expires!==O.expires})}function tg(e,l=Date.now()){return[...e.values()].some((O)=>O.expires<=l+2*Md)?Qh:Zh}var rg=(e,l)=>new Promise((v)=>{if(l.aborted)return v();let O=setTimeout(M,e);function M(){clearTimeout(O),l.removeEventListener("abort",M),v()}l.addEventListener("abort",M,{once:!0})});async function Td(e){let l=new Map,v=e.wait??rg,O=e.stores??(process.platform==="darwin"?Ni:{...Ni,exec:async()=>({code:1,stdout:""})});while(!e.signal.aborted){try{let M=Dd(await Od(e.environment??process.env,e.home,O));for(let L of eg(M,l)){if(e.signal.aborted)return;let z=await e.client.localSubscription(e.state,L,AbortSignal.any([e.signal,AbortSignal.timeout(30000)]));l.set(L.provider,{access:L.access,expires:L.expires}),e.onOutcome?.({provider:L.provider,ok:z.ok,...z.ok?{}:{error:z.error}})}}catch{}await v(tg(l),e.signal)}}function Ld(e=process.env){return new Promise((l)=>{Xh("gh",["auth","status","--hostname","github.com"],{env:e,timeout:8000,maxBuffer:65536},(v)=>l(!v))})}import{execFile as ng,spawn as PR,spawnSync as CR}from"child_process";import{chmodSync as xR,existsSync as og,mkdirSync as IR,readFileSync as OR,renameSync as DR,rmSync as MR,statSync as TR,writeFileSync as LR}from"fs";import{dirname as NR,isAbsolute as HR,join as Hi}from"path";var Wd=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function Nd(e,l){if(!Wd.test(e)||!Wd.test(l))throw Error("Invalid CLI version");let v=e.split(".").map(BigInt),O=l.split(".").map(BigInt);for(let M=0;M<3;M++){if(v[M]<O[M])return-1;if(v[M]>O[M])return 1}return 0}var ig="com.reasonmachines.updater",ag=["so.ara.updater","so.reason.updater"];function sg(e){let l=e==="staging"?".staging":"";return{label:`${ig}${l}`,legacyLabels:[...ag].reverse().map((v)=>`${v}${l}`)}}function cg(e,l){return l==="darwin"?e.launchAgent:l==="win32"?e.scheduledTask:e.systemdService}function lg(e,l,v){return{launchAgent:Hi(l,"Library","LaunchAgents",`${e}.plist`),systemdService:Hi(v,"systemd","user",`${e}.service`),systemdTimer:Hi(v,"systemd","user",`${e}.timer`),scheduledTask:Hi(Ti(l),`${e}.xml`)}}function dg(e,l){return new Promise((v)=>{ng(B(e),[...l],{timeout:1e4},(O)=>{v(O?typeof O.code==="number"?O.code:1:0)})})}async function $d(e){let l=e.runtimePlatform??process.platform;if(l!=="darwin"&&l!=="linux"&&l!=="win32")return"absent";let v=e.uid??process.getuid?.();if(l!=="win32"&&(typeof v!=="number"||!Number.isSafeInteger(v)||v<=0))return"absent";let O=e.home??s(),{label:M,legacyLabels:L}=sg(e.channel),z=e.configHome??St(O),re=[M,...L].filter((te)=>og(cg(lg(te,O,z),l)));if(re.length===0)return"absent";let G=e.command??dg,ce=re[0];if(re.length>1){for(let te of re)if((l==="darwin"?await G("/bin/launchctl",["print",`gui/${v}/${te}`]):l==="win32"?await G("schtasks",["/Query","/TN",te]):await G("systemctl",["--user","is-enabled",`${te}.timer`]))===0){ce=te;break}}return(l==="darwin"?await G("/bin/launchctl",["kickstart",`gui/${v}/${ce}`]):l==="win32"?await G("schtasks",["/Run","/TN",ce]):await G("systemctl",["--user","start","--no-block",`${ce}.service`]))===0?"started":"failed"}var Hd=60000;function Bd(e){let l=(M,L)=>{try{return Nd(M,L)>0}catch{return!1}},v=e.actedOn&&l(e.actedOn,"0.0.0")?e.actedOn:null,O=e.schedule??((M,L)=>{let z=setTimeout(M,L);z.unref?.(),e.signal.addEventListener("abort",()=>clearTimeout(z),{once:!0})});return(M)=>{if(e.signal.aborted||M===void 0||!l(M,e.currentVersion))return;if(v!==null&&!l(M,v))return;v=M;let L=(e.random??Math.random)(),z=Number.isFinite(L)?Math.min(Math.max(L,0),1):0;O(()=>{if(!e.signal.aborted)e.check(M).catch(()=>{return})},Math.min(Hd-1,Math.floor(z*Hd)))}}var ug=30000;async function Ud(e){return(e.flush??Qi)(e.paths,async(l)=>{let{schema_version:v,...O}=l,M=AbortSignal.timeout(ug);try{await e.client.deviceLifecycle(e.device,O,e.signal?AbortSignal.any([e.signal,M]):M)}catch(L){if(L instanceof k&&L.status===400&&L.code==="invalid_device_lifecycle_event")return;throw L}},e.accept)}var qd=25000,fg=5000,mg=600000,pg=["display.stream.v1","pty.start"],hg=64;function xs(e,l,v=_o(e),O){return ne(),uo(l.roots,{...v,...O?{productionProof:O}:{}})}var Is=5000,gg=600000;function wg(e,l){if(e.lifetime!=="persistent"||l!=="darwin"||!process.env[ke])return null;try{return Nt({platform:l})}catch{return null}}function yg(e){return e.event.startsWith("update.")||e.event.startsWith("executor.update.")||e.event.startsWith("identity.")||e.event.startsWith("worker.")}function _g(e,l){let v=Object.keys(l).filter((O)=>l[O]!==!0).sort();try{let O=cs();if(v.length>0)N(e,{event:"worker.capabilities_withheld",runtime_version:g,capabilities:v});if(O)N(e,{event:"identity.computer_use_unavailable",runtime_version:g,reason_code:O})}catch{}}async function Wo(e,l,v,O,M={}){if(ne(),e.executionMode==="host")wr();let L=l.worker?.expiresAt;if(!L||Date.parse(L)<=Date.now())throw Error("worker_credential_expired");let z=pt(e);if(z.revoked)throw Error("worker_revoked");let re=AbortSignal.any([...M.signal?[M.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(L)-Date.now())))]);if(!M.prestartedReadiness)M.onStartup?.("readiness_started");let G,ce=()=>G??=e.executionMode==="host"?Jt():Promise.resolve(!1),we=Ga(),te=M.prestartedReadiness??Co(e,M.readinessProbes,re,l.roots[0].permissions),X=M.deferOptionalLanes===!0,he=await(X?te.initial:te.final);if(M.signal?.aborted)throw Error("worker_start_cancelled");if(M.onStartup?.("readiness_completed"),Date.parse(L)<=Date.now())throw Error("worker_credential_expired");let Se,Re=he["github.local.v1"]===!0?(M.probeGithubSignedIn??Ld)().catch(()=>!1):null,Ee=new AbortController,Oe=null,Me=async(Xe,st)=>{let Vt=(e.userChrome??M.ownComputer===!0)&&Xe["automation.call.v1"]===!0?To():null;if(Vt&&"code"in Vt)process.stderr.write(`Reason worker: your own Chrome unavailable (${Vt.code})
-`);let Mt=_o(e,Xe,{displayVideo:Xe["display.stream.v1"]===!0&&await ce(),handsBrowser:Xe["hands.connect"]===!0&&we,userChrome:Vt&&"host"in Vt?Vt.host:null,...Se===void 0?{}:{githubSignedIn:Se},persistentTerminals:Xe["pty.start"]===!0&&Ri(),probing:st,ownComputer:M.ownComputer===!0});if(!Oe&&Mt.worker.readiness?.["browser.pr-proof.v1"]===!0){let gr=await Rd();if(Oe||Ee.signal.aborted)return Mt;process.stderr.write("error"in gr?`Reason worker: PR video proof unavailable (${gr.error})
+`))!==-1){let Fe=Oe.slice(0,Ke);Oe=Oe.slice(Ke+1);try{let nt=JSON.parse(Fe);if(nt.type==="failed"&&Object.keys(nt).sort().join(",")==="reason,type"){let at=md.safeParse(nt.reason);Ve(at.success?Error(`mac_recording_worker_failed:${at.data}`):Jr());return}if(nt.type==="unsupported"&&!Te){Ve(Error("mac_recording_encoder_unavailable"));return}if(nt.type==="started"&&!Te&&Object.keys(nt).length===1){Te=!0,$e({recording:!0});continue}if(!Te||nt.type!=="capture"||We||Object.keys(nt).sort().join(",")!=="bytes,capture,type")throw Jr();let Ze=nt.capture;if(!Ze||Object.keys(Ze).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof Ze.sha256!=="string"||typeof Ze.startedAt!=="string"||typeof Ze.finishedAt!=="string"||!gh(Ze.owner,l.owner)||Ze.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(Ze.sha256)||!Number.isSafeInteger(Ze.sizeBytes)||Ze.sizeBytes<128||Ze.sizeBytes>10485760||!Number.isSafeInteger(Ze.frameCount)||Ze.frameCount<1||Ze.frameCount>450||!Number.isSafeInteger(Ze.receivedFrameCount)||Ze.receivedFrameCount<Ze.frameCount||Ze.receivedFrameCount>2000||!Number.isFinite(Ze.durationSeconds)||Ze.durationSeconds<0.05||Ze.durationSeconds>l.seconds||!Number.isFinite(Date.parse(Ze.startedAt))||!Number.isFinite(Date.parse(Ze.finishedAt))||Math.abs((Date.parse(Ze.finishedAt)-Date.parse(Ze.startedAt))/1000-Ze.durationSeconds)>0.1||typeof nt.bytes!=="string"||nt.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(nt.bytes))throw Jr();let He=Buffer.from(nt.bytes,"base64");if(He.length!==Ze.sizeBytes||lh("sha256").update(He).digest("hex")!==Ze.sha256||!He.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw Jr();We={capture:Object.freeze({...Ze,captureId:dh(),owner:Object.freeze({...l.owner})}),bytes:He}}catch{Ve();return}}}),he.once("close",(Be)=>{if(Ce)return;if(Be!==0||!We||Oe.trim()){Ve();return}let Ke=We;te().then(async()=>{if(await re(),Ce)return;Ce=!0,clearTimeout(Je),clearInterval(Ye),D.set(Ke.capture.captureId,Ke);while(D.size>2)D.delete(D.keys().next().value);xe(Ke.capture)}).catch(()=>Ve())}),he.stdin.write(JSON.stringify({...l,scratchDirectory:X})+`
+`);try{return await Ne}catch(Be){throw we=null,Be}}finally{L=!1}},async completed(){if(await te(),!we)throw Error("mac_recording_not_active");return we.completion},async stop(){await te();let X=we;if(!X)throw Error("mac_recording_not_started");X.stop();try{return await X.completion}finally{if(we===X)we=null}},async read(X){await te();let he=D.get(X);if(!he)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(he.capture),bytes:Buffer.from(he.bytes)}},async close(){if(M)return;M=!0;let X=we;X?.cancel(),D.clear();try{await ce(),await X?.completion.catch(()=>{})}finally{we=null}}}}var wd=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});async function bs(e){await e.assertCurrent();let l;if("discover"in e)l=e.discover;else{let v=await yh(e.automationDirectory);l=(D,M)=>Ii(v,D,M)}if(await Pr({path:e.worker.path,sha256:e.worker.sha256}),!await To(e.encoder))throw Error("mac_recording_encoder_unavailable");return async(v,D,M,L)=>{L.throwIfAborted(),await e.assertCurrent();let z=await l(v,L),re=new Vr({socketPath:z.socketPath,sessionId:M,timeoutMs:2000}),G;try{if(await re.connect(),G=wd.parse(await re.getInfo()),G.metadata.extensionId!==z.extensionId||G.metadata.extensionInstanceId!==z.instanceId)throw Error("mac_recording_profile_changed");if(!d(n({id:o()})).parse(await re.getTabs()).some((we)=>we.id===D))throw Error("mac_recording_tab_not_owned");await e.assertCurrent(),L.throwIfAborted()}finally{re.close()}return{extensionInstanceId:z.instanceId,async createHost(ce,we,te){let X=new Vr({socketPath:z.socketPath,sessionId:ce.browser.browserScope,timeoutMs:2000});return gd({worker:e.worker,configuration:{owner:ce.browser,seconds:we,encoder:e.encoder,socketPath:z.socketPath,extensionId:z.extensionId,nativeHostName:G.metadata.nativeHostName},async assertCurrent(){te.throwIfAborted(),L.throwIfAborted(),await e.assertCurrent()},async cleanup(){try{await X.connect();let Se=wd.parse(await X.getInfo());if(Se.metadata.extensionInstanceId!==ce.browser.extensionInstanceId||Se.metadata.extensionId!==z.extensionId||Se.metadata.nativeHostName!==G.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await X.executeCdp(D,"Page.stopScreencast",{})}finally{X.close()}}})}}}}var Nt=()=>Error("mac_pr_proof_unavailable"),kh=n({operationId:t().uuid()}).strict();function _d(e){let l=e.qualifiedProfiles??[{profile:e.profile,extension_instance_id:e.extensionInstanceId}],v=d(n({profile:t().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:t().min(1).max(1024)}).strict()).min(1).max(16).parse(l);if(!t().uuid().safeParse(e.generation).success||new Set(v.map((X)=>X.profile)).size!==v.length)throw Nt();if(!e.qualifiedProfiles){let X=new URL(e.uploadOrigin);if(!e.resolveBrowser||X.protocol!=="https:"||X.origin!==e.uploadOrigin||X.username||X.password)throw Nt()}let D=new Map,M=new Map,L=new Map,z=!1,re=new _h,G=async(X)=>{let he=re.getStore();if(z||!X&&!he)throw Nt();if(he?.signal.throwIfAborted(),await e.assertCurrent(X??he.claim),z)throw Nt();he?.signal.throwIfAborted()},ce=(X,he)=>{let Se="owner"in he?he.owner:("context"in he)?he.context.owner:he.input.owner;if(X.capability!==us||!X.owner||Se.generation!==e.generation||!v.some((Re)=>Re.profile===Se.profile&&Re.extension_instance_id===Se.extensionInstanceId)||Se.organizationId!==X.owner.organization_id||Se.userId!==X.owner.user_id||Se.deviceId!==X.owner.device_id||Se.rootId!==X.root_id||Se.runId!==X.run_id)throw Nt();return Se},we=async(X)=>{await G();let he=JSON.stringify([X.runId,X.profile]),Se=D.get(he);if(!Se){if(D.size>=4)throw Nt();Se=(async()=>{let Ee,Oe=e.browserScope?.(X)??Fn(X.runId),Me=await e.createBrowser({owner:X,assertCurrent:()=>G(),readVideo:(Ce)=>Ee.publicationCapture(Ce)});if(Ee=Ql({owner:X,browserScope:Oe,assertCurrent:()=>G(),screenshot:Me.screenshot,async createVideo(Ce,Te,We,$e){if(!e.resolveBrowser)throw Nt();let Ue=await e.resolveBrowser(X.profile,Te,Oe,$e);if(Ue.extensionInstanceId!==X.extensionInstanceId)throw Nt();return Ue.createHost({organizationId:X.organizationId,userId:X.userId,operationId:Ce.contextId,attemptId:Ce.contextId,recordingId:Ce.contextId,browser:{runId:X.runId,deviceId:X.deviceId,rootId:X.rootId,rootRevision:X.rootRevision,generation:X.generation,profile:X.profile,extensionInstanceId:X.extensionInstanceId,browserScope:Oe,tabId:Te}},We,$e)}}),z)throw Me.close(),await Ee.close(),Nt();return{owner:structuredClone(X),browser:Me,capture:Ee,expiresAt:Date.now()+300000}})(),D.set(he,Se)}let Re=await Se;if(!yd(Re.owner,X)||Re.expiresAt<=Date.now())throw Nt();return Re},te=setInterval(()=>{for(let[X,he]of D)he.then(async(Se)=>{if(Se.expiresAt>Date.now()||[...M.values()].some((Re)=>Re.runtime===Se))return;if(Se.browser.close(),await Se.capture.close(),D.get(X)===he)D.delete(X)}).catch(()=>{z=!0})},1000);return te.unref(),{generation:e.generation,async execute(X,he,Se){return re.run({claim:X,signal:he},async()=>{let Re=hs.parse(X.payload).command,Ee=ce(X,Re);if(await G(X),he.throwIfAborted(),e.qualifiedProfiles&&!e.resolveBrowser&&(Re.action==="prepare"?Re.context.evidenceKind!=="image"||Boolean(Re.context.visualPlan)||!Re.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(Re.action)))throw Error("proof_png_only");let Oe=await we(Ee),Me=async()=>{await G(X),he.throwIfAborted()},Ce;switch(Re.action){case"auth_check":Ce=await Oe.browser.preflight(Re.input);break;case"prepare":if(Re.context.visualPlan)throw Error("proof_source_unavailable");if(e.qualifiedProfiles&&!Re.context.uploadOrigin)throw Nt();Ce=await Oe.capture.prepare(Re.context);break;case"capture_png":Ce=await Oe.capture.screenshot({claim:{operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId},signal:he});break;case"start_video":{let Te={runtime:Oe,contextId:Re.contextId,attemptId:X.attempt_id,tabId:Re.tabId,signal:he};if(M.has(X.operation_id))throw Nt();M.set(X.operation_id,Te);try{Ce=await Oe.capture.record({claim:{operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId},signal:he,seconds:Re.seconds,started:async()=>{await Me(),await Se({version:1,operationId:X.operation_id,contextId:Re.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{M.delete(X.operation_id)}break}case"inspect_capture":Ce=await Oe.capture.inspect(Re.captureId);break;case"publish_video":Ce=await Oe.browser.publish(Re.input);break;case"verify_saved_media":Ce=await Oe.browser.verify(Re.input);break;case"verify_png_media":Ce=await Oe.browser.verifyImages(Re.media);break;case"publish_png":{let Te=`${Ee.runId}:${Re.attemptId}`,We=L.get(Te);if(We){if(!yd(We.request,Re))throw Nt();Ce=We.result;break}if(L.size>=16)throw Nt();let $e=new URL(Re.uploadUrl);if($e.protocol!=="https:"||$e.username||$e.password||$e.hash||$e.pathname!==`/${Re.storagePath}`||!Re.storagePath.startsWith(`pr-screenshots/${Ee.runId}/${Re.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(Re.storagePath.split("/").at(-1))||Re.storagePath.split("/").length!==4)throw Nt();let Ue=await Oe.capture.publicationCapture(Re.captureId);try{if($e.origin!==(e.qualifiedProfiles?Ue.capture.context.uploadOrigin:e.uploadOrigin)||Ue.capture.media.contentType!=="image/png"||Ue.capture.sha256!==Re.sha256||Ue.bytes.length!==Re.sizeBytes||bh("sha256").update(Ue.bytes).digest("hex")!==Re.sha256)throw Nt();await Me();let Ne={request:structuredClone(Re),result:{status:"uncertain",sha256:Re.sha256,sizeBytes:Re.sizeBytes}};L.set(Te,Ne);try{let xe=await fetch($e,{method:"PUT",body:Ue.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([he,AbortSignal.timeout(20000)])});if(await xe.body?.cancel(),await Me(),xe.ok)Ne.result={...Ne.result,status:"uploaded"}}catch{}Ce=Ne.result}finally{Ue.bytes.fill(0)}break}}return await Me(),structuredClone(Ce)})},async control(X,he){if(X.capability!==us||he.kind!==Xl)return!1;let Se=kh.safeParse(he.payload),Re=M.get(X.operation_id);if(!Se.success||Se.data.operationId!==X.operation_id||!Re||Re.attemptId!==X.attempt_id)return!1;let Ee=hs.parse(X.payload).command;return ce(X,Ee),await G(X),await re.run({claim:X,signal:Re.signal},()=>Re.runtime.capture.stop({operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId})),!0},async close(){z=!0,clearInterval(te);let X=await Promise.allSettled([...D.values()].map(async(he)=>{let Se=await he;Se.browser.close(),await Se.capture.close()}));if(D.clear(),M.clear(),L.clear(),X.some((he)=>he.status==="rejected"))throw Nt()}}}var xh="__browser-recorder",Ih=Ah(vh),Oh="/tmp/open-browser-use",Dh=33554432,Mh=n({version:i("0.1.42"),metadata:n({extensionId:i(le),extensionInstanceId:t().min(1).max(1024)})}),kd=()=>Error("worker_pr_proof_browser_unavailable"),Ps={components:A,ensureBrowser:No,socketDirectory:Oh,async identity(e){let l=new Vr({socketPath:e,sessionId:`reason-proof-qualification-${Es()}`,timeoutMs:2000});try{return await l.connect(),await l.getInfo()}finally{l.close()}}};async function vd(e,l=Ps){let v=l.components();if(!v?.features.browser)throw kd();await l.ensureBrowser(v),e.throwIfAborted();let D=ks(Lo(v),"Default","Local Extension Settings",le),M=(await bd(D)).filter((L)=>L.endsWith(".log")||L.endsWith(".ldb")).map((L)=>ks(D,L));for(let L of(await bd(l.socketDirectory)).filter((z)=>z.endsWith(".sock"))){e.throwIfAborted();let z=ks(l.socketDirectory,L);try{let re=await Rh(z);if(!re.isSocket()||re.uid!==process.getuid?.())continue;let G=Mh.parse(await l.identity(z)).metadata.extensionInstanceId;for(let ce of M)if((await Ph(ce)).size<=Dh&&(await Sd(ce)).includes(G))return{socketPath:z,instanceId:G,extensionId:le}}catch{}}throw kd()}async function Rs(e){let l=await Eh(e);return{path:l,sha256:Sh("sha256").update(await Sd(l)).digest("hex")}}async function Rd(e={}){let l={...Ps,...e};try{let v=l.components();if(!v?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!v.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let D=await Rs(v.ffmpeg),{stdout:M}=await Ih(D.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(M))return{error:"worker_recording_libvpx_unavailable"};let L={ffmpeg:D,ffprobe:await Rs(v.ffprobe)};if(!await To(L))return{error:"worker_recording_encoder_unqualified"};let z=e.recorder??{path:process.execPath,args:[...Ch(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],xh]};return{worker:{...await Rs(z.path),args:z.args},encoder:L}}catch{return{error:"worker_recording_unqualified"}}}function Ed(e,l={}){let v={...Ps,...l},D=Es(),M=Es(),L=lo.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:D,profiles:["Default"],extension_instance_ids:[M],image:!0,video:!1,source_bound:!1}),z=e.recording?uo.parse({...L,version:3,video:!0,max_seconds:15}):L,re=(te)=>Ul(te.organizationId,te.sessionId,te.deviceId,1),G=e.recording,ce,we=_d({generation:D,qualifiedProfiles:[{profile:"Default",extension_instance_id:M}],assertCurrent:e.assertCurrent,browserScope:re,...G?{resolveBrowser:async(te,X,he,Se)=>{ce??=bs({...G,assertCurrent:()=>e.assertCurrent(),discover:(Ee,Oe)=>vd(Oe,v)}),ce.catch(()=>{ce=void 0});let Re=await(await ce)(te,X,he,Se);return{extensionInstanceId:M,createHost:async(Ee,Oe,Me)=>Th(await Re.createHost({...Ee,browser:{...Ee.browser,extensionInstanceId:Re.extensionInstanceId}},Oe,Me),M)}}}:{},createBrowser:(te)=>ws({...te,endpoint:(X)=>({discover:(he)=>vd(he,v),tabScope:re(X)})})});return{capability:z,broker:we}}function Th(e,l){let v=(D)=>({...D,owner:{...D.owner,extensionInstanceId:l}});return{start:()=>e.start(),close:()=>e.close(),completed:async()=>v(await e.completed()),stop:async()=>v(await e.stop()),read:async(D)=>{let M=await e.read(D);return{capture:v(M.capture),bytes:M.bytes}}}}import{execFile as Xh}from"child_process";import{execFile as Lh}from"child_process";import{readFile as Wh}from"fs/promises";import{join as vr}from"path";var Nh="Claude Code-credentials",Hh="/usr/bin/security",$h=120000,Bh=8192,Ti={exec:(e,l,v)=>new Promise((D)=>{Lh(e,l,{timeout:v,maxBuffer:8388608},(M,L)=>{let z=M?typeof M.code==="number"?M.code:1:0;D({code:z,stdout:String(L??"")})})}),readText:async(e)=>{try{return await Wh(e,"utf8")}catch{return null}}};function qn(e){return typeof e==="string"&&e.length>0&&e.length<=Bh?e:null}function Uh(e,l){return e.CLAUDE_CONFIG_DIR||vr(l,".claude")}function Fh(e,l){return e.CODEX_HOME||vr(l,".codex")}function Pd(e){if(!e)return null;try{let l=JSON.parse(e).claudeAiOauth,v=qn(l?.accessToken),D=qn(l?.refreshToken),M=typeof l?.expiresAt==="number"&&Number.isFinite(l.expiresAt)?l.expiresAt:null;return v&&D&&M!==null?{provider:"anthropic",access:v,refresh:D,expires:M}:null}catch{return null}}function jh(e){try{let l=JSON.parse(Buffer.from(e.split(".")[1]??"","base64url").toString("utf8"));return typeof l.exp==="number"?l.exp*1000:null}catch{return null}}function qh(e){if(!e)return null;try{let l=JSON.parse(e);if(l.auth_mode!==void 0&&l.auth_mode!=="chatgpt")return null;let v=qn(l.tokens?.access_token),D=qn(l.tokens?.refresh_token);if(!v||!D)return null;return{provider:"openai-codex",access:v,refresh:D,expires:jh(v)??Date.now()}}catch{return null}}function zh(e,l){return vr(e.XDG_DATA_HOME||vr(l,".local","share"),"opencode","auth.json")}var Kh={anthropic:"anthropic",openai:"openai-codex"};function Vh(e){return Id(e,Kh)}function Id(e,l){if(!e)return[];try{let v=JSON.parse(e),D=[];for(let[M,L]of Object.entries(l)){let z=v[M];if(z?.type!=="oauth")continue;let re=qn(z.access),G=qn(z.refresh),ce=typeof z.expires==="number"&&Number.isFinite(z.expires)?z.expires:null;if(re&&G&&ce!==null)D.push({provider:L,access:re,refresh:G,expires:ce})}return D}catch{return[]}}function Jh(e){return Id(e,{anthropic:"anthropic","openai-codex":"openai-codex"})}function Gh(e,l){let v=e.PI_CODING_AGENT_DIR;return v==="~"?l:v?.startsWith("~/")?vr(l,v.slice(2)):v||vr(l,".pi","agent")}async function Od(e,l,v=Ti){let D=[],M=await v.exec(Hh,["find-generic-password","-s",Nh,"-w"],$h),L=Date.now()+300000,z=(G)=>{if(!G)return;let ce=D.findIndex((we)=>we.provider===G.provider);if(ce<0)D.push(G);else if(D[ce].expires<=L&&G.expires>L)D[ce]=G};if(z(M.code===0?Pd(M.stdout.trim()):null),!D.some((G)=>G.provider==="anthropic"&&G.expires>L))z(Pd(await v.readText(vr(Uh(e,l),".credentials.json"))));let re=qh(await v.readText(vr(Fh(e,l),"auth.json")));z(re),z(Yh(await v.readText(vr(e.GROK_HOME||vr(l,".grok"),"auth.json"))));for(let G of Vh(await v.readText(zh(e,l))))z(G);for(let G of Jh(await v.readText(vr(Gh(e,l),"auth.json"))))z(G);return D}function Dd(e){return e.map(({provider:l,access:v,expires:D})=>({provider:l,access:v,expires:D}))}var Cd="https://auth.x.ai",Ad="b1a00492-073a-47ea-816f-4c329264a828",xd=(e)=>typeof e==="string"&&e.length>0&&e.length<=8192&&e.trim()===e;function Yh(e){if(!e)return null;try{let l=JSON.parse(e);if(!l||typeof l!=="object"||Array.isArray(l))return null;let v=l[`${Cd}::${Ad}`];if(!v||typeof v!=="object"||Array.isArray(v))return null;let D=v;if(D.auth_mode!=="oidc"||D.oidc_issuer!==Cd||D.oidc_client_id!==Ad||!xd(D.key)||!xd(D.refresh_token)||typeof D.expires_at!=="string")return null;let M=Date.parse(D.expires_at);if(!Number.isFinite(M)||M<=0)return null;return{provider:"xai",access:D.key,refresh:D.refresh_token,expires:M}}catch{return null}}var Md=330000,Zh=300000,Qh=60000;function eg(e,l,v=Date.now()){return e.filter((D)=>{if(!Number.isFinite(D.expires)||D.expires<=v+Md)return!1;let M=l.get(D.provider);return!M||M.access!==D.access||M.expires!==D.expires})}function tg(e,l=Date.now()){return[...e.values()].some((D)=>D.expires<=l+2*Md)?Qh:Zh}var rg=(e,l)=>new Promise((v)=>{if(l.aborted)return v();let D=setTimeout(M,e);function M(){clearTimeout(D),l.removeEventListener("abort",M),v()}l.addEventListener("abort",M,{once:!0})});async function Td(e){let l=new Map,v=e.wait??rg,D=e.stores??(process.platform==="darwin"?Ti:{...Ti,exec:async()=>({code:1,stdout:""})});while(!e.signal.aborted){try{let M=Dd(await Od(e.environment??process.env,e.home,D));for(let L of eg(M,l)){if(e.signal.aborted)return;let z=await e.client.localSubscription(e.state,L,AbortSignal.any([e.signal,AbortSignal.timeout(30000)]));l.set(L.provider,{access:L.access,expires:L.expires}),e.onOutcome?.({provider:L.provider,ok:z.ok,...z.ok?{}:{error:z.error}})}}catch{}await v(tg(l),e.signal)}}function Ld(e=process.env){return new Promise((l)=>{Xh("gh",["auth","status","--hostname","github.com"],{env:e,timeout:8000,maxBuffer:65536},(v)=>l(!v))})}import{execFile as ng,spawn as PR,spawnSync as CR}from"child_process";import{chmodSync as xR,existsSync as og,mkdirSync as IR,readFileSync as OR,renameSync as DR,rmSync as MR,statSync as TR,writeFileSync as LR}from"fs";import{dirname as NR,isAbsolute as HR,join as Wi}from"path";var Wd=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function Nd(e,l){if(!Wd.test(e)||!Wd.test(l))throw Error("Invalid CLI version");let v=e.split(".").map(BigInt),D=l.split(".").map(BigInt);for(let M=0;M<3;M++){if(v[M]<D[M])return-1;if(v[M]>D[M])return 1}return 0}var ig="com.reasonmachines.updater",ag=["so.ara.updater","so.reason.updater"];function sg(e){let l=e==="staging"?".staging":"";return{label:`${ig}${l}`,legacyLabels:[...ag].reverse().map((v)=>`${v}${l}`)}}function cg(e,l){return l==="darwin"?e.launchAgent:l==="win32"?e.scheduledTask:e.systemdService}function lg(e,l,v){return{launchAgent:Wi(l,"Library","LaunchAgents",`${e}.plist`),systemdService:Wi(v,"systemd","user",`${e}.service`),systemdTimer:Wi(v,"systemd","user",`${e}.timer`),scheduledTask:Wi(Oi(l),`${e}.xml`)}}function dg(e,l){return new Promise((v)=>{ng(B(e),[...l],{timeout:1e4},(D)=>{v(D?typeof D.code==="number"?D.code:1:0)})})}async function $d(e){let l=e.runtimePlatform??process.platform;if(l!=="darwin"&&l!=="linux"&&l!=="win32")return"absent";let v=e.uid??process.getuid?.();if(l!=="win32"&&(typeof v!=="number"||!Number.isSafeInteger(v)||v<=0))return"absent";let D=e.home??s(),{label:M,legacyLabels:L}=sg(e.channel),z=e.configHome??Et(D),re=[M,...L].filter((te)=>og(cg(lg(te,D,z),l)));if(re.length===0)return"absent";let G=e.command??dg,ce=re[0];if(re.length>1){for(let te of re)if((l==="darwin"?await G("/bin/launchctl",["print",`gui/${v}/${te}`]):l==="win32"?await G("schtasks",["/Query","/TN",te]):await G("systemctl",["--user","is-enabled",`${te}.timer`]))===0){ce=te;break}}return(l==="darwin"?await G("/bin/launchctl",["kickstart",`gui/${v}/${ce}`]):l==="win32"?await G("schtasks",["/Run","/TN",ce]):await G("systemctl",["--user","start","--no-block",`${ce}.service`]))===0?"started":"failed"}var Hd=60000;function Bd(e){let l=(M,L)=>{try{return Nd(M,L)>0}catch{return!1}},v=e.actedOn&&l(e.actedOn,"0.0.0")?e.actedOn:null,D=e.schedule??((M,L)=>{let z=setTimeout(M,L);z.unref?.(),e.signal.addEventListener("abort",()=>clearTimeout(z),{once:!0})});return(M)=>{if(e.signal.aborted||M===void 0||!l(M,e.currentVersion))return;if(v!==null&&!l(M,v))return;v=M;let L=(e.random??Math.random)(),z=Number.isFinite(L)?Math.min(Math.max(L,0),1):0;D(()=>{if(!e.signal.aborted)e.check(M).catch(()=>{return})},Math.min(Hd-1,Math.floor(z*Hd)))}}var ug=30000;async function Ud(e){return(e.flush??ro)(e.paths,async(l)=>{let{schema_version:v,...D}=l,M=AbortSignal.timeout(ug);try{await e.client.deviceLifecycle(e.device,D,e.signal?AbortSignal.any([e.signal,M]):M)}catch(L){if(L instanceof k&&L.status===400&&L.code==="invalid_device_lifecycle_event")return;throw L}},e.accept)}var qd=25000,fg=5000,mg=600000,pg=["display.stream.v1","pty.start"],hg=64;function Cs(e,l,v=bo(e),D){return ne(),fo(l.roots,{...v,...D?{productionProof:D}:{}})}var As=5000,gg=600000;function wg(e,l){if(e.lifetime!=="persistent"||l!=="darwin"||!process.env[ke])return null;try{return Lt({platform:l})}catch{return null}}function yg(e){return e.event.startsWith("update.")||e.event.startsWith("executor.update.")||e.event.startsWith("identity.")||e.event.startsWith("worker.")}function _g(e,l){let v=Object.keys(l).filter((D)=>l[D]!==!0).sort();try{let D=Xa();if(v.length>0)N(e,{event:"worker.capabilities_withheld",runtime_version:g,capabilities:v});if(D)N(e,{event:"identity.computer_use_unavailable",runtime_version:g,reason_code:D})}catch{}}async function Wo(e,l,v,D,M={}){if(ne(),e.executionMode==="host")kr();let L=l.worker?.expiresAt;if(!L||Date.parse(L)<=Date.now())throw Error("worker_credential_expired");let z=ft(e);if(z.revoked)throw Error("worker_revoked");let re=AbortSignal.any([...M.signal?[M.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(L)-Date.now())))]);if(!M.prestartedReadiness)M.onStartup?.("readiness_started");let G,ce=()=>G??=e.executionMode==="host"?Jt():Promise.resolve(!1),we=tc(),te=M.prestartedReadiness??Eo(e,M.readinessProbes,re,l.roots[0].permissions),X=M.deferOptionalLanes===!0,he=await(X?te.initial:te.final);if(M.signal?.aborted)throw Error("worker_start_cancelled");if(M.onStartup?.("readiness_completed"),Date.parse(L)<=Date.now())throw Error("worker_credential_expired");let Se,Re=he["github.local.v1"]===!0?(M.probeGithubSignedIn??Ld)().catch(()=>!1):null,Ee=new AbortController,Oe=null,Me=async(Xe,st)=>{let Vt=(e.userChrome??M.ownComputer===!0)&&Xe["automation.call.v1"]===!0?Oo():null;if(Vt&&"code"in Vt)process.stderr.write(`Reason worker: your own Chrome unavailable (${Vt.code})
+`);let Tt=bo(e,Xe,{displayVideo:Xe["display.stream.v1"]===!0&&await ce(),handsBrowser:Xe["hands.connect"]===!0&&we,userChrome:Vt&&"host"in Vt?Vt.host:null,...Se===void 0?{}:{githubSignedIn:Se},persistentTerminals:Xe["pty.start"]===!0&&ki(),probing:st,ownComputer:M.ownComputer===!0});if(!Oe&&Tt.worker.readiness?.["browser.pr-proof.v1"]===!0){let gr=await Rd();if(Oe||Ee.signal.aborted)return Tt;process.stderr.write("error"in gr?`Reason worker: PR video proof unavailable (${gr.error})
 `:`Reason worker: PR video proof ready (ffmpeg ${gr.encoder.ffmpeg.path})
-`),Oe=Ed({assertCurrent:async()=>{if(!Ye())throw Error("proof_authority_lost")},...!("error"in gr)?{recording:gr}:{}})}return Mt},Ce=await Me(he,X?ls.filter((Xe)=>he[Xe]!==!0):[]),Te=xs(e,l,Ce,Oe?.capability);M.onStartup?.("inventory_completed");let We=!1,$e=0,Fe=0,Ne="starting",xe=null,Le=!1,Ge=!1,Ve=null,Je,it=()=>!z.drained&&Date.parse(L)>Date.now()&&Te.supported_operations.some((Xe)=>Ce.worker.readiness?.[Xe]===!0),Ye=()=>!We&&it(),Be=null,Ke=()=>$e+(Be?.claims()??0),qe=null,nt=new Set,et=(Xe)=>{let st=Xe.capabilities.root_paths;if(Object.assign(Xe.capabilities,xs(Xe.config,Xe.state,Ce,Oe?.capability)),st)Xe.capabilities.root_paths=st},He=(Xe)=>{Ce=Xe,et({config:e,state:l,capabilities:Te}),qe?.();for(let st of nt)et(st),st.heartbeatNow?.()},at=new Set,mt=new Set,kt=setInterval(()=>{let Xe=new Set;for(let st of[{state:l,capabilities:Te},...nt])for(let Ct of pg){if(st.capabilities.operation_constraints?.[Ct]?.probing!==!0)continue;let Mt=`${st.state.deviceId} ${Ct}`;if(Xe.add(Mt),!at.has(Mt)||mt.has(Mt))continue;mt.add(Mt),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:st.state.deviceId,lane:Ct,login_device:st.state===l,timestamp:new Date().toISOString()})}
-`)}at.clear();for(let st of Xe)at.add(st)},mg);kt.unref();let qt=(Xe)=>{if(!M.readinessProbes)Tl({config:e,readiness:Xe,signal:Ee.signal,idle:()=>Ke()===0,permissions:l.roots[0].permissions,onReady:(st)=>{Me(st,[]).then(He)}})},Kt=X?te.final.then(async(Xe)=>{if(Ee.signal.aborted)return;He(await Me(Xe,[]));let st=ls.filter((Ct)=>Xe[Ct]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${st.length?`ready: ${st.join(", ")}`:"none ready"}).
-`),qt(Xe)},()=>{}):Promise.resolve();if(!X)qt(he);Re?.then(async(Xe)=>{Se=Xe;for(;;){let st=Ce,Ct=await Me(st.worker.readiness??{},st.worker.probing??[]);if(Ee.signal.aborted)return;if(Ce!==st)continue;He(Ct);return}});let pr=X&&Ce.worker.probing?.includes("pty.start")?te.pty.then(async(Xe)=>{let st=()=>Ce.worker.probing?.includes("pty.start")===!0;if(Ee.signal.aborted||!st())return;let Ct=await Me({...Ce.worker.readiness,"pty.start":Xe},(Ce.worker.probing??[]).filter((Vt)=>Vt!=="pty.start"));if(Ee.signal.aborted||!st())return;He(Ct)},()=>{}):Promise.resolve(),on=()=>({version:1,instanceId:O,deviceId:l.deviceId,phase:Ne,drained:z.drained||We||Le,activeClaims:Ke(),activeSessions:Fe,lastHeartbeat:xe,expiresAt:L,supportedOperations:[...Te.supported_operations],capabilityReadiness:Ce.worker.readiness,executionEligible:Ye()&&!Le&&Ne==="running"}),An=!1,Hr=()=>{An=!0,Ir()},Ir=()=>{if(We)return;if(We=!0,Ne="stopping",Ve?.close(),Ke()===0)Ee.abort();else Je=setTimeout(()=>Ee.abort(),e.shutdownGraceMs)},an=e.channel==="production"||e.channel==="staging"?e.channel:null,Or=f(e).releaseCheck,er=M.publishedRelease??(an&&e.lifetime==="persistent"?Bd({currentVersion:g,signal:Ee.signal,actedOn:(()=>{try{let Xe=JSON.parse(m(Or));return typeof Xe==="string"?Xe:null}catch{return null}})(),check:async(Xe)=>{try{y(Or,Xe)}catch{}let st=await $d({channel:an});process.stderr.write(st==="started"?`Reason worker: CLI ${Xe} is published; the updater is checking now.
+`),Oe=Ed({assertCurrent:async()=>{if(!Ye())throw Error("proof_authority_lost")},...!("error"in gr)?{recording:gr}:{}})}return Tt},Ce=await Me(he,X?rs.filter((Xe)=>he[Xe]!==!0):[]),Te=Cs(e,l,Ce,Oe?.capability);M.onStartup?.("inventory_completed");let We=!1,$e=0,Ue=0,Ne="starting",xe=null,Le=!1,Ge=!1,Ve=null,Je,it=()=>!z.drained&&Date.parse(L)>Date.now()&&Te.supported_operations.some((Xe)=>Ce.worker.readiness?.[Xe]===!0),Ye=()=>!We&&it(),Be=null,Ke=()=>$e+(Be?.claims()??0),Fe=null,nt=new Set,Ze=(Xe)=>{let st=Xe.capabilities.root_paths;if(Object.assign(Xe.capabilities,Cs(Xe.config,Xe.state,Ce,Oe?.capability)),st)Xe.capabilities.root_paths=st},He=(Xe)=>{Ce=Xe,Ze({config:e,state:l,capabilities:Te}),Fe?.();for(let st of nt)Ze(st),st.heartbeatNow?.()},at=new Set,lt=new Set,kt=setInterval(()=>{let Xe=new Set;for(let st of[{state:l,capabilities:Te},...nt])for(let Ct of pg){if(st.capabilities.operation_constraints?.[Ct]?.probing!==!0)continue;let Tt=`${st.state.deviceId} ${Ct}`;if(Xe.add(Tt),!at.has(Tt)||lt.has(Tt))continue;lt.add(Tt),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:st.state.deviceId,lane:Ct,login_device:st.state===l,timestamp:new Date().toISOString()})}
+`)}at.clear();for(let st of Xe)at.add(st)},mg);kt.unref();let jt=(Xe)=>{if(!M.readinessProbes)Tl({config:e,readiness:Xe,signal:Ee.signal,idle:()=>Ke()===0,permissions:l.roots[0].permissions,onReady:(st)=>{Me(st,[]).then(He)}})},Kt=X?te.final.then(async(Xe)=>{if(Ee.signal.aborted)return;He(await Me(Xe,[]));let st=rs.filter((Ct)=>Xe[Ct]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${st.length?`ready: ${st.join(", ")}`:"none ready"}).
+`),jt(Xe)},()=>{}):Promise.resolve();if(!X)jt(he);Re?.then(async(Xe)=>{Se=Xe;for(;;){let st=Ce,Ct=await Me(st.worker.readiness??{},st.worker.probing??[]);if(Ee.signal.aborted)return;if(Ce!==st)continue;He(Ct);return}});let pr=X&&Ce.worker.probing?.includes("pty.start")?te.pty.then(async(Xe)=>{let st=()=>Ce.worker.probing?.includes("pty.start")===!0;if(Ee.signal.aborted||!st())return;let Ct=await Me({...Ce.worker.readiness,"pty.start":Xe},(Ce.worker.probing??[]).filter((Vt)=>Vt!=="pty.start"));if(Ee.signal.aborted||!st())return;He(Ct)},()=>{}):Promise.resolve(),Xr=()=>({version:1,instanceId:D,deviceId:l.deviceId,phase:Ne,drained:z.drained||We||Le,activeClaims:Ke(),activeSessions:Ue,lastHeartbeat:xe,expiresAt:L,supportedOperations:[...Te.supported_operations],capabilityReadiness:Ce.worker.readiness,executionEligible:Ye()&&!Le&&Ne==="running"}),Rn=!1,Lr=()=>{Rn=!0,xr()},xr=()=>{if(We)return;if(We=!0,Ne="stopping",Ve?.close(),Ke()===0)Ee.abort();else Je=setTimeout(()=>Ee.abort(),e.shutdownGraceMs)},an=e.channel==="production"||e.channel==="staging"?e.channel:null,Ir=f(e).releaseCheck,er=M.publishedRelease??(an&&e.lifetime==="persistent"?Bd({currentVersion:g,signal:Ee.signal,actedOn:(()=>{try{let Xe=JSON.parse(m(Ir));return typeof Xe==="string"?Xe:null}catch{return null}})(),check:async(Xe)=>{try{y(Ir,Xe)}catch{}let st=await $d({channel:an});process.stderr.write(st==="started"?`Reason worker: CLI ${Xe} is published; the updater is checking now.
 `:st==="absent"?`Reason worker: CLI ${Xe} is published; no updater is installed for it here.
 `:`Reason worker: CLI ${Xe} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),On=(Xe)=>{if(Xe==="stop")Hr();if(Xe==="reload_roots"){let st=S(e);if(!st||st.deviceId!==l.deviceId)throw Error("worker_identity_changed");l.roots=st.roots;let Ct=Wn(l.roots,jd());if(Ct)Te.root_paths=Ct;else delete Te.root_paths;Be?.check()}if(Xe==="drain"||Xe==="resume"){if(We||Date.parse(L)<=Date.now())throw Error("worker_stopping_or_expired");z={...z,drained:Xe==="drain"},zt(e,z)}return on()};M.prestartedControl?.handle(On);let jo=M.prestartedControl?await M.prestartedControl.closed:await hi(e,O,On),sn,rt=!1,_t=()=>{let Xe=Date.parse(L)-Date.now();if(Xe>0){sn=setTimeout(_t,Math.min(Xe,2147483647));return}We=!0,Ve?.close(),rt=!0,Ne="stopping",Ee.abort(Error("worker_credential_expired"))};_t(),M.signal?.addEventListener("abort",Ir,{once:!0});let $r=M.processSignals!==!1;if($r)process.once("SIGTERM",Ir),process.once("SIGINT",Hr);if(M.signal?.aborted)Ir();try{M.onStartup?.("control_ready");let Xe=M.client??new ar(ye(e.apiOrigin),oe(e.proxy,zd()),v,{deviceSession:Za({proxied:Boolean(e.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),st=!Pe(e.executionMode==="host")?"not_root_host":!J()?"no_jobs_user":yo(),Ct={event_id:Fd(),event:"worker.model_jobs_egress",occurred_at:new Date().toISOString(),runtime_version:g,reason_code:st==="active"?"gid_v1":st};process.stderr.write(`${JSON.stringify({...Ct,device_id:l.deviceId})}
-`);let Vt=!0,Mt=!1,gr=0,vt=()=>{if(!Xe.deviceLifecycle||!Vt||Mt||Ee.signal.aborted||Date.now()<gr)return;Mt=!0,gr=Date.now()+30000,Xe.deviceLifecycle(l,Ct,AbortSignal.any([Ee.signal,AbortSignal.timeout(Is)])).then(()=>{Vt=!1},()=>{}).finally(()=>{Mt=!1})};vt();let rr=f(e).daemon,At=ca(e,l.deviceId),Rr=M.startupTiming,Br=Rr?()=>({...Rr(),...At?.enrollmentMs!==void 0?{enrollment_ms:At.enrollmentMs}:{}}):void 0,dn=(ot)=>{let yr=ot.client.localSubscription?.bind(ot.client);if(e.localLogins===!0&&yr)(M.handOverLocalLogins??Td)({state:ot.state,client:{localSubscription:yr},signal:ot.signal,home:s()}).catch(()=>{return});let It=jd(),Yt=ot.client.liveSessionWorktrees?.bind(ot.client);if(Yt)Va(()=>Wa({home:It,deviceId:ot.state.deviceId,liveIds:(Fr)=>Yt(ot.state,Fr,ot.signal)}),ot.signal)};dn({state:l,client:Xe,signal:Ee.signal});let Ur=wg(e,M.platform??process.platform),Ft=Xe.deviceLifecycle?.bind(Xe),Gt=Promise.resolve(),no=0,qo=()=>{if(!Ur||!Ft||We||Date.now()<no)return;no=Date.now()+gg,Gt=Gt.then(()=>Ud({paths:Ur,device:l,client:{deviceLifecycle:Ft},accept:yg,signal:Ee.signal})).catch(()=>{return})};if(qo(),Ur)te.final.then((ot)=>_g(Ur,ot),()=>{});let Xs=(ot,yr)=>({state:ot.state,client:ot.client,...ot.firstHeartbeat?{firstHeartbeat:ot.firstHeartbeat}:{},runtimeVersion:g,bridgeVersion:g,protocolVersion:2,capabilities:ot.capabilities,signal:ot.signal,statusPath:ot.statusPath,maxConcurrentClaims:M.ownComputer===!0?hg:4*e.slots+Da,heartbeatIntervalMs:M.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:qd,operationCompletionTimeoutMs:qd,maxConsecutiveHeartbeatFailures:3,claimable:Ye,advertised:it,onClaim:async(It,Yt,Fr)=>{let io=Date.now();if(!ot.capabilities.supported_operations.includes(It.capability))return{status:"failed",error_code:"unsupported_capability"};let _r=Ce.worker.probing??[],rc=_r.includes(It.capability)?Kt:It.capability==="hands.connect"&&e.executionMode==="host"&&_r.includes("pty.start")?pr:null;if(rc){let Vo,ia=()=>{};await Promise.race([rc,new Promise((nc)=>{Vo=setTimeout(nc,fg),ia=()=>nc(),Yt.addEventListener("abort",ia,{once:!0})})]),clearTimeout(Vo),Yt.removeEventListener("abort",ia)}let Ko=It.capability==="hands.connect",oa=Ko?Ve:null,Ju={signal:Yt,emit:Fr,...Ce,...Oe?{proveMac:Oe.broker.execute}:{},...It.capability==="inference.custom.v1"&&ot.client.operationCustomEndpointCredential?{customEndpointCredential:(Vo)=>ot.client.operationCustomEndpointCredential(ot.state,It,Vo)}:{},...Ko?{handsLaunch:{claimedAtMs:io,...oa?{takePrespawnedWorker:oa.take,adoptSpawnedWorker:oa.adopt}:{}}}:{}};if(Ko)Fe+=1;try{return await(M.execute??Vn)(ot.state,It,Ju)}finally{if(Ko)Fe-=1}},onControl:async(It,Yt)=>await po(ot.state,It,Yt,ot.client)||await ho(ot.state,It,Yt)||await go(It,Yt)||await Oe?.broker.control(It,Yt)||!1,onEvent:yr}),Zs=async(ot)=>{await ot.client.deviceLifecycle?.(ot.state,{event_id:Fd(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:g,reason_code:"worker_stopped"},AbortSignal.timeout(Is)).catch(()=>{return})},oo=e.lifetime==="persistent"?M.ownerWorkspaces:void 0,zo=oo?.intervalMs??va,Qs=Xe.ownerWorkspaces?.bind(Xe),tc=Xe.ownerWorkspaceEnrollment?.bind(Xe);if(oo&&Qs&&tc)Be=Cc({config:e,state:l,signal:Ee.signal,client:{ownerWorkspaces:Qs,ownerWorkspaceEnrollment:tc},...oo.enroll?{enroll:oo.enroll}:{},intervalMs:zo,log:(ot)=>{process.stderr.write(ot)},serve:async(ot,yr,It)=>{let Yt=ca(ot.config,ot.state.deviceId),Fr={config:ot.config,state:ot.state,signal:yr,statusPath:f(ot.config).daemon,...Yt?.offer?{firstHeartbeat:Yt.offer}:{},capabilities:xs(ot.config,ot.state,Ce,Oe?.capability),client:oo.client?.(ot)??new ar(ye(e.apiOrigin),oe(e.proxy,zd()),ot.proofStore,{deviceSession:Za({proxied:Boolean(e.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};dn(Fr);let io={...Fr,heartbeatNow:null};nt.add(io);try{await rs({registerHeartbeatNow:(_r)=>{io.heartbeatNow=_r},...Xs(Fr,(_r)=>{if(_r.type==="completed")Yn(_r.operationId,_r.status);if(_r.type==="claims_changed"){if(It(_r.activeClaims),We&&Ke()===0)Ee.abort()}if(_r.type==="stopped")It(0)})})}finally{nt.delete(io)}if(We&&!rt)await Zs(Fr)}});let ra=0,na=0;if(await rs({...(M.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>Ke()>0?nr(rr):void 0,...M.acquireAwakeHold?{acquireAwakeHold:M.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(ot)=>{qe=ot},...Br?{startup:Br}:{},...Xs({state:l,client:Xe,capabilities:Te,signal:Ee.signal,statusPath:rr,...At?.offer?{firstHeartbeat:At.offer}:{}},(ot)=>{if(ot.type==="completed")Yn(ot.operationId,ot.status);if(ot.type==="claims_changed"){if($e=ot.activeClaims,We&&Ke()===0)Ee.abort()}if(ot.type==="heartbeat"&&!We){if(ot.handsPrespawn&&e.lifetime==="ephemeral"&&!Ve)Ve=Yr({log:(yr,It)=>{process.stderr.write(`${JSON.stringify({event:yr,...It})}
-`)}}),Ve.arm(),setTimeout(Xa,0);else if(!ot.handsPrespawn&&Ve)Ve.close(),Ve=null}if(ot.type==="heartbeat"){if(Be&&!We&&Date.now()>=ra)ra=Date.now()+zo,Be.check().then((yr)=>{na=yr?0:na+1,ra=Date.now()+(yr?zo:Math.min(zo,Sc*2**Math.min(na-1,10)))});if(xe=ot.serverTime,Le=ot.drain,vt(),qo(),!We&&an)er?.(ot.latestCliVersions?.[an]);if(!We)Ne="running";if(!We&&!Ge&&on().executionEligible){if(Ge=!0,M.onStartup?.("ready"),(M.platform??process.platform)==="darwin")setTimeout(()=>{try{Bi({skipWhenSettled:!0})}catch{}},0)}}if(ot.type==="reconnecting"&&!We)Ne="reconnecting";if(ot.type==="stopped")$e=0;M.onEvent?.(ot)})}),await Be?.settled(),We&&!rt&&e.lifetime==="ephemeral")await Xe.disconnect?.(l,AbortSignal.timeout(Is)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(We&&!rt)await Zs({state:l,client:Xe});if(An)await ua().catch(()=>{return})}catch(Xe){if(!(Xe instanceof k&&Xe.status===401)||Xe.code==="invalid_device_proof"||Xe.code==="device_proof_replayed")throw Xe;if(zt(e,{...z,revoked:!0}),Xe.code==="device_revoked")M.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(sn),clearInterval(kt),Je)clearTimeout(Je);if($r)process.removeListener("SIGTERM",Ir),process.removeListener("SIGINT",Hr);M.signal?.removeEventListener("abort",Ir),Ee.abort(),Ve?.close(),await Be?.settled().catch(()=>{return}),await Oe?.broker.close().catch(()=>{return}),await jo()}}function zd(e=process.env){if(e.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((v,O)=>{let M=new Headers(O?.headers);return M.set(ps,hs),fetch(v,{...O,headers:M})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as bg,sign as kg}from"crypto";var Kd=65536,vg=65536;function Sg(e){let l=e.export({format:"jwk"});if(l.crv!=="P-256"||typeof l.x!=="string"||typeof l.y!=="string")throw new a("invalid_public_key");let v=Buffer.from(l.x,"base64url"),O=Buffer.from(l.y,"base64url");if(v.byteLength!==32||O.byteLength!==32)throw new a("invalid_public_key");let M=Buffer.concat([Buffer.of(4),v,O]).toString("base64url");if(!jt(M))throw new a("invalid_public_key");return M}function Vd(){try{let{privateKey:e,publicKey:l}=bg("ec",{namedCurve:"P-256"});return{privateKey:e,publicPoint:Sg(l)}}catch(e){if(e instanceof a)throw e;throw new a("proof_key_generation_failed")}}class Ho{keyPair=Vd();binding=null;loadPublicKey(){if(!this.keyPair)throw new a("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=Vd(),this.keyPair.publicPoint}sign(e){if(!this.keyPair||e.byteLength<1||e.byteLength>vg)throw new a("proof_sign_failed");let l;try{l=kg("sha256",e,this.keyPair.privateKey)}catch{throw new a("proof_sign_failed")}if(!yi(l))throw new a("invalid_signature");return l.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding(e){if(e.byteLength<1||e.byteLength>Kd)throw new a("invalid_binding");if(this.binding)throw new a("binding_create_failed");this.binding=Uint8Array.from(e)}updateBinding(e){if(e.byteLength<1||e.byteLength>Kd)throw new a("invalid_binding");if(!this.binding)throw new a("binding_update_failed");this.binding=Uint8Array.from(e)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as Ig,spawn as Og}from"child_process";import{isAbsolute as Dg}from"path";import{promisify as Mg}from"util";var $o={now:()=>Date.now(),after(e,l){let v=setTimeout(l,e);return()=>clearTimeout(v)},every(e,l){let v=setInterval(l,e);return()=>clearInterval(v)}};class Bo{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=(e)=>{let l=Buffer.isBuffer(e)?e:Buffer.from(e),v=0;while(v<l.length&&!this.failure){let O=l.indexOf(10,v),M=O<0?l.length:O;if(this.buffer.length+M-v+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,l.subarray(v,M)]),O<0)return;try{let L=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let z=this.waiter;this.waiter=void 0,z.resolve(L)}else if(this.queue.length<4)this.queue.push(L);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}v=M+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor(e,l,v=$o){this.input=e;this.output=l;this.clock=v;e.on("data",this.onData),e.on("end",this.onEnd),e.on("close",this.onEnd),e.on("error",this.onError),l.on("error",this.onError)}fail(e,l=!1){if(this.failure??=e,this.buffer=Buffer.alloc(0),!l)this.queue=[];this.lifetime.abort();let v=this.waiter;this.waiter=void 0,v?.reject(this.failure)}async send(e,l=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let v=JSON.stringify(e)+`
-`;if(Buffer.byteLength(v)>65536)throw Error("worker_ssh_frame_too_large");let O;try{await new Promise((M,L)=>{O=this.clock.after(l,()=>L(Error("worker_ssh_write_timeout"))),this.output.write(v,(z)=>z?L(Error("worker_ssh_connection_failed")):M())})}finally{O?.()}}async receive(e=30000,l){if(l?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let v,O;try{return await new Promise((M,L)=>{this.waiter={resolve:M,reject:L},O=()=>{this.waiter=void 0,L(Error("worker_ssh_cancelled"))},v=this.clock.after(e,()=>{this.waiter=void 0,L(Error("worker_ssh_handshake_timeout"))}),l?.addEventListener("abort",O,{once:!0})})}finally{v?.(),l?.removeEventListener("abort",O)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as Rg}from"crypto";import{unlinkSync as Eg}from"fs";import{join as Pg}from"path";var Uo=1,$i=45000,Cg=h({type:i("configure"),protocol:i(Uo),version:t(),config:x}),Ag=h({type:i("ticket"),organizationId:t().min(1).max(160),receipt:Pt()}),xg=h({type:c(["ping","stop"])});async function Jd(e={}){let l=e.clock??$o,v=new Bo(e.input??process.stdin,e.output??process.stdout,l),O=new AbortController,M=new AbortController,L=()=>O.abort(),z,re,G,ce,we=!1;process.once("SIGHUP",L),v.signal.addEventListener("abort",L,{once:!0}),e.signal?.addEventListener("abort",L,{once:!0});try{if(e.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:te,version:X}=Cg.parse(await v.receive(30000,O.signal));if(X!==g)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(Dr(te),b(p(te),!0),re=ie({path:f(te).lock,runtimeVersion:g}),!re.acquired)throw Error("worker_already_running_or_lifecycle_busy");let he=Pg(p(te),`ssh-preflight-${Rg()}.json`);try{y(he,{version:1}),m(he)}finally{try{Eg(he)}catch{}}let Se=S(te),Re=pt(te);if(Re.revoked||Re.drained)throw Error("worker_ssh_revoked_or_drained");if(Se&&Date.parse(Se.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(Se&&te.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await v.send({type:"hello",protocol:Uo,version:g,platform:process.platform,architecture:process.arch,enrolled:!!Se});let Ee=te.lifetime==="ephemeral"?G=new Ho:xt(te,!0);if(!Se){let We=Qr(te);await v.send({type:"ticket-request",request:We.request});let $e=Ag.parse(await v.receive(70000,O.signal)),Fe=We.complete($e.organizationId,$e.receipt);if(Se=await Cr(te,Fe,Ee,e.enroll),te.lifetime==="persistent")ae(Se,f(te).state,{proofStore:Ee});zt(te,{version:1,drained:!1,revoked:!1})}if(O.signal.aborted)throw Error("worker_ssh_cancelled");z=(async()=>{try{while(!M.signal.aborted){if(xg.parse(await v.receive(35000,M.signal)).type==="stop"){L();return}await v.send({type:"pong"})}}catch{if(!M.signal.aborted)L()}})();let Oe=!1,Me,Ce=!1;ce=l.after(Math.max(1,Math.min($i,e.startupTimeoutMs??$i)),()=>{Ce=!0,L()});let Te=re.owner.nonce;if(await Wo(te,Se,Ee,Te,{...e,signal:O.signal,onEvent(We){if(e.onEvent?.(We),We.type==="heartbeat"&&!Oe&&!Me)Me=(async()=>{let $e=await Rt(te,"status");if(!$e?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await v.send({type:"running",deviceId:$e.deviceId,expiresAt:$e.expiresAt,lifetime:te.lifetime,supervision:"ssh-foreground"}),Oe=!0,ce?.()})().catch(()=>{Ce=!0,L()})}}),await Me,Ce||!Oe)throw Error("worker_ssh_outbound_or_readiness_failed");return we=!0,0}catch(te){let X=te instanceof Error&&/^worker_[a-z_]+$/.test(te.message)?te.message:"worker_ssh_bootstrap_failed";try{await v.send({type:"error",code:X})}catch{}return 1}finally{if(ce?.(),L(),M.abort(),await z,G?.deleteBinding(),G?.deleteKey(),re?.acquired)re.release();if(process.removeListener("SIGHUP",L),e.signal?.removeEventListener("abort",L),v.signal.removeEventListener("abort",L),we)try{await v.send({type:"stopped"})}catch{}v.dispose()}}var Ds=(e)=>Dg(e)&&e.length<=4096&&!/[\x00-\x1f\x7f]/.test(e),Os=(e)=>`'${e.replaceAll("'","'\\''")}'`,Tg=h({type:i("hello"),protocol:i(Uo),version:t(),platform:c(["linux","darwin"]),architecture:c(["arm64","x64"]),enrolled:_()}),Lg=h({type:i("ticket-request"),request:h({install_id:V(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:c(["persistent","ephemeral"]),roots:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:c(["confined","host"]),permissions:h({read:i(!0),write:i(!0),execute:i(!0),discover_environment:i(!0),expose_mcp:i(!1)})})).length(1)})}),Gd=A("type",[h({type:i("running"),deviceId:t().min(1).max(160),expiresAt:I.datetime({offset:!0}),lifetime:c(["persistent","ephemeral"]),supervision:i("ssh-foreground")}),h({type:i("pong")}),h({type:i("stopped")})]),Wg=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function Ui(e){if(e&&typeof e==="object"&&"type"in e&&e.type==="error"){let l="code"in e&&typeof e.code==="string"&&Wg.has(e.code)?e.code:"worker_ssh_remote_failed";throw Error(l)}return e}function Yd(e){if(!Ds(e.remoteCli)||!/^[a-f0-9]{64}$/.test(e.sha256))throw Error("worker_ssh_invalid_target");let l=`set -eu
-a=${Os(e.remoteCli)}
+`)}}):void 0),In=(Xe)=>{if(Xe==="stop")Lr();if(Xe==="reload_roots"){let st=S(e);if(!st||st.deviceId!==l.deviceId)throw Error("worker_identity_changed");l.roots=st.roots;let Ct=Kn(l.roots,jd());if(Ct)Te.root_paths=Ct;else delete Te.root_paths;Be?.check()}if(Xe==="drain"||Xe==="resume"){if(We||Date.parse(L)<=Date.now())throw Error("worker_stopping_or_expired");z={...z,drained:Xe==="drain"},qt(e,z)}return Xr()};M.prestartedControl?.handle(In);let jo=M.prestartedControl?await M.prestartedControl.closed:await fi(e,D,In),sn,tt=!1,yt=()=>{let Xe=Date.parse(L)-Date.now();if(Xe>0){sn=setTimeout(yt,Math.min(Xe,2147483647));return}We=!0,Ve?.close(),tt=!0,Ne="stopping",Ee.abort(Error("worker_credential_expired"))};yt(),M.signal?.addEventListener("abort",xr,{once:!0});let Wr=M.processSignals!==!1;if(Wr)process.once("SIGTERM",xr),process.once("SIGINT",Lr);if(M.signal?.aborted)xr();try{M.onStartup?.("control_ready");let Xe=M.client??new ar(ye(e.apiOrigin),oe(e.proxy,zd()),v,{deviceSession:$a({proxied:Boolean(e.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),st=!Pe(e.executionMode==="host")?"not_root_host":!J()?"no_jobs_user":vo(),Ct={event_id:Fd(),event:"worker.model_jobs_egress",occurred_at:new Date().toISOString(),runtime_version:g,reason_code:st==="active"?"gid_v1":st};process.stderr.write(`${JSON.stringify({...Ct,device_id:l.deviceId})}
+`);let Vt=!0,Tt=!1,gr=0,vt=()=>{if(!Xe.deviceLifecycle||!Vt||Tt||Ee.signal.aborted||Date.now()<gr)return;Tt=!0,gr=Date.now()+30000,Xe.deviceLifecycle(l,Ct,AbortSignal.any([Ee.signal,AbortSignal.timeout(As)])).then(()=>{Vt=!1},()=>{}).finally(()=>{Tt=!1})};vt();let rr=f(e).daemon,At=oa(e,l.deviceId),Sr=M.startupTiming,$r=Sr?()=>({...Sr(),...At?.enrollmentMs!==void 0?{enrollment_ms:At.enrollmentMs}:{}}):void 0,cn=(ot)=>{let wr=ot.client.localSubscription?.bind(ot.client);if(e.localLogins===!0&&wr)(M.handOverLocalLogins??Td)({state:ot.state,client:{localSubscription:wr},signal:ot.signal,home:s()}).catch(()=>{return});let It=jd(),Yt=ot.client.liveSessionWorktrees?.bind(ot.client);if(Yt)ec(()=>Qa({home:It,deviceId:ot.state.deviceId,liveIds:(Ur)=>Yt(ot.state,Ur,ot.signal)}),ot.signal)};cn({state:l,client:Xe,signal:Ee.signal});let Br=wg(e,M.platform??process.platform),Ft=Xe.deviceLifecycle?.bind(Xe),Gt=Promise.resolve(),Qn=0,qo=()=>{if(!Br||!Ft||We||Date.now()<Qn)return;Qn=Date.now()+gg,Gt=Gt.then(()=>Ud({paths:Br,device:l,client:{deviceLifecycle:Ft},accept:yg,signal:Ee.signal})).catch(()=>{return})};if(qo(),Br)te.final.then((ot)=>_g(Br,ot),()=>{});let Js=(ot,wr)=>({state:ot.state,client:ot.client,...ot.firstHeartbeat?{firstHeartbeat:ot.firstHeartbeat}:{},runtimeVersion:g,bridgeVersion:g,protocolVersion:2,capabilities:ot.capabilities,signal:ot.signal,statusPath:ot.statusPath,maxConcurrentClaims:M.ownComputer===!0?hg:4*e.slots+ja,heartbeatIntervalMs:M.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:qd,operationCompletionTimeoutMs:qd,maxConsecutiveHeartbeatFailures:3,claimable:Ye,advertised:it,onClaim:async(It,Yt,Ur)=>{let io=Date.now();if(!ot.capabilities.supported_operations.includes(It.capability))return{status:"failed",error_code:"unsupported_capability"};let yr=Ce.worker.probing??[],Qs=yr.includes(It.capability)?Kt:It.capability==="hands.connect"&&e.executionMode==="host"&&yr.includes("pty.start")?pr:null;if(Qs){let Vo,ta=()=>{};await Promise.race([Qs,new Promise((rc)=>{Vo=setTimeout(rc,fg),ta=()=>rc(),Yt.addEventListener("abort",ta,{once:!0})})]),clearTimeout(Vo),Yt.removeEventListener("abort",ta)}let Ko=It.capability==="hands.connect",ea=Ko?Ve:null,Ju={signal:Yt,emit:Ur,...Ce,...Oe?{proveMac:Oe.broker.execute}:{},...It.capability==="inference.custom.v1"&&ot.client.operationCustomEndpointCredential?{customEndpointCredential:(Vo)=>ot.client.operationCustomEndpointCredential(ot.state,It,Vo)}:{},...Ko?{handsLaunch:{claimedAtMs:io,...ea?{takePrespawnedWorker:ea.take,adoptSpawnedWorker:ea.adopt}:{}}}:{}};if(Ko)Ue+=1;try{return await(M.execute??Jn)(ot.state,It,Ju)}finally{if(Ko)Ue-=1}},onControl:async(It,Yt)=>await mo(ot.state,It,Yt,ot.client)||await go(ot.state,It,Yt)||await wo(It,Yt)||await Oe?.broker.control(It,Yt)||!1,onEvent:wr}),Gs=async(ot)=>{await ot.client.deviceLifecycle?.(ot.state,{event_id:Fd(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:g,reason_code:"worker_stopped"},AbortSignal.timeout(As)).catch(()=>{return})},oo=e.lifetime==="persistent"?M.ownerWorkspaces:void 0,zo=oo?.intervalMs??ma,Ys=Xe.ownerWorkspaces?.bind(Xe),Zs=Xe.ownerWorkspaceEnrollment?.bind(Xe);if(oo&&Ys&&Zs)Be=Cc({config:e,state:l,signal:Ee.signal,client:{ownerWorkspaces:Ys,ownerWorkspaceEnrollment:Zs},...oo.enroll?{enroll:oo.enroll}:{},intervalMs:zo,log:(ot)=>{process.stderr.write(ot)},serve:async(ot,wr,It)=>{let Yt=oa(ot.config,ot.state.deviceId),Ur={config:ot.config,state:ot.state,signal:wr,statusPath:f(ot.config).daemon,...Yt?.offer?{firstHeartbeat:Yt.offer}:{},capabilities:Cs(ot.config,ot.state,Ce,Oe?.capability),client:oo.client?.(ot)??new ar(ye(e.apiOrigin),oe(e.proxy,zd()),ot.proofStore,{deviceSession:$a({proxied:Boolean(e.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};cn(Ur);let io={...Ur,heartbeatNow:null};nt.add(io);try{await Fa({registerHeartbeatNow:(yr)=>{io.heartbeatNow=yr},...Js(Ur,(yr)=>{if(yr.type==="completed")ei(yr.operationId,yr.status);if(yr.type==="claims_changed"){if(It(yr.activeClaims),We&&Ke()===0)Ee.abort()}if(yr.type==="stopped")It(0)})})}finally{nt.delete(io)}if(We&&!tt)await Gs(Ur)}});let Yi=0,Zi=0;if(await Fa({...(M.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>Ke()>0?nr(rr):void 0,...M.acquireAwakeHold?{acquireAwakeHold:M.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(ot)=>{Fe=ot},...$r?{startup:$r}:{},...Js({state:l,client:Xe,capabilities:Te,signal:Ee.signal,statusPath:rr,...At?.offer?{firstHeartbeat:At.offer}:{}},(ot)=>{if(ot.type==="completed")ei(ot.operationId,ot.status);if(ot.type==="claims_changed"){if($e=ot.activeClaims,We&&Ke()===0)Ee.abort()}if(ot.type==="heartbeat"&&!We){if(ot.handsPrespawn&&e.lifetime==="ephemeral"&&!Ve)Ve=nn({log:(wr,It)=>{process.stderr.write(`${JSON.stringify({event:wr,...It})}
+`)}}),Ve.arm(),setTimeout(ic,0);else if(!ot.handsPrespawn&&Ve)Ve.close(),Ve=null}if(ot.type==="heartbeat"){if(Be&&!We&&Date.now()>=Yi)Yi=Date.now()+zo,Be.check().then((wr)=>{Zi=wr?0:Zi+1,Yi=Date.now()+(wr?zo:Math.min(zo,kc*2**Math.min(Zi-1,10)))});if(xe=ot.serverTime,Le=ot.drain,vt(),qo(),!We&&an)er?.(ot.latestCliVersions?.[an]);if(!We)Ne="running";if(!We&&!Ge&&Xr().executionEligible){if(Ge=!0,M.onStartup?.("ready"),(M.platform??process.platform)==="darwin")setTimeout(()=>{try{Hi({skipWhenSettled:!0})}catch{}},0)}}if(ot.type==="reconnecting"&&!We)Ne="reconnecting";if(ot.type==="stopped")$e=0;M.onEvent?.(ot)})}),await Be?.settled(),We&&!tt&&e.lifetime==="ephemeral")await Xe.disconnect?.(l,AbortSignal.timeout(As)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
+`)});else if(We&&!tt)await Gs({state:l,client:Xe});if(Rn)await ya().catch(()=>{return})}catch(Xe){if(!(Xe instanceof k&&Xe.status===401)||Xe.code==="invalid_device_proof"||Xe.code==="device_proof_replayed")throw Xe;if(qt(e,{...z,revoked:!0}),Xe.code==="device_revoked")M.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(sn),clearInterval(kt),Je)clearTimeout(Je);if(Wr)process.removeListener("SIGTERM",xr),process.removeListener("SIGINT",Lr);M.signal?.removeEventListener("abort",xr),Ee.abort(),Ve?.close(),await Be?.settled().catch(()=>{return}),await Oe?.broker.close().catch(()=>{return}),await jo()}}function zd(e=process.env){if(e.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((v,D)=>{let M=new Headers(D?.headers);return M.set(vs,Ss),fetch(v,{...D,headers:M})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as bg,sign as kg}from"crypto";var Kd=65536,vg=65536;function Sg(e){let l=e.export({format:"jwk"});if(l.crv!=="P-256"||typeof l.x!=="string"||typeof l.y!=="string")throw new a("invalid_public_key");let v=Buffer.from(l.x,"base64url"),D=Buffer.from(l.y,"base64url");if(v.byteLength!==32||D.byteLength!==32)throw new a("invalid_public_key");let M=Buffer.concat([Buffer.of(4),v,D]).toString("base64url");if(!Ht(M))throw new a("invalid_public_key");return M}function Vd(){try{let{privateKey:e,publicKey:l}=bg("ec",{namedCurve:"P-256"});return{privateKey:e,publicPoint:Sg(l)}}catch(e){if(e instanceof a)throw e;throw new a("proof_key_generation_failed")}}class Ho{keyPair=Vd();binding=null;loadPublicKey(){if(!this.keyPair)throw new a("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=Vd(),this.keyPair.publicPoint}sign(e){if(!this.keyPair||e.byteLength<1||e.byteLength>vg)throw new a("proof_sign_failed");let l;try{l=kg("sha256",e,this.keyPair.privateKey)}catch{throw new a("proof_sign_failed")}if(!vi(l))throw new a("invalid_signature");return l.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding(e){if(e.byteLength<1||e.byteLength>Kd)throw new a("invalid_binding");if(this.binding)throw new a("binding_create_failed");this.binding=Uint8Array.from(e)}updateBinding(e){if(e.byteLength<1||e.byteLength>Kd)throw new a("invalid_binding");if(!this.binding)throw new a("binding_update_failed");this.binding=Uint8Array.from(e)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as Ig,spawn as Og}from"child_process";import{isAbsolute as Dg}from"path";import{promisify as Mg}from"util";var $o={now:()=>Date.now(),after(e,l){let v=setTimeout(l,e);return()=>clearTimeout(v)},every(e,l){let v=setInterval(l,e);return()=>clearInterval(v)}};class Bo{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=(e)=>{let l=Buffer.isBuffer(e)?e:Buffer.from(e),v=0;while(v<l.length&&!this.failure){let D=l.indexOf(10,v),M=D<0?l.length:D;if(this.buffer.length+M-v+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,l.subarray(v,M)]),D<0)return;try{let L=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let z=this.waiter;this.waiter=void 0,z.resolve(L)}else if(this.queue.length<4)this.queue.push(L);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}v=M+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor(e,l,v=$o){this.input=e;this.output=l;this.clock=v;e.on("data",this.onData),e.on("end",this.onEnd),e.on("close",this.onEnd),e.on("error",this.onError),l.on("error",this.onError)}fail(e,l=!1){if(this.failure??=e,this.buffer=Buffer.alloc(0),!l)this.queue=[];this.lifetime.abort();let v=this.waiter;this.waiter=void 0,v?.reject(this.failure)}async send(e,l=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let v=JSON.stringify(e)+`
+`;if(Buffer.byteLength(v)>65536)throw Error("worker_ssh_frame_too_large");let D;try{await new Promise((M,L)=>{D=this.clock.after(l,()=>L(Error("worker_ssh_write_timeout"))),this.output.write(v,(z)=>z?L(Error("worker_ssh_connection_failed")):M())})}finally{D?.()}}async receive(e=30000,l){if(l?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let v,D;try{return await new Promise((M,L)=>{this.waiter={resolve:M,reject:L},D=()=>{this.waiter=void 0,L(Error("worker_ssh_cancelled"))},v=this.clock.after(e,()=>{this.waiter=void 0,L(Error("worker_ssh_handshake_timeout"))}),l?.addEventListener("abort",D,{once:!0})})}finally{v?.(),l?.removeEventListener("abort",D)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as Rg}from"crypto";import{unlinkSync as Eg}from"fs";import{join as Pg}from"path";var Uo=1,$i=45000,Cg=h({type:i("configure"),protocol:i(Uo),version:t(),config:x}),Ag=h({type:i("ticket"),organizationId:t().min(1).max(160),receipt:Rt()}),xg=h({type:c(["ping","stop"])});async function Jd(e={}){let l=e.clock??$o,v=new Bo(e.input??process.stdin,e.output??process.stdout,l),D=new AbortController,M=new AbortController,L=()=>D.abort(),z,re,G,ce,we=!1;process.once("SIGHUP",L),v.signal.addEventListener("abort",L,{once:!0}),e.signal?.addEventListener("abort",L,{once:!0});try{if(e.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:te,version:X}=Cg.parse(await v.receive(30000,D.signal));if(X!==g)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(Or(te),b(p(te),!0),re=ie({path:f(te).lock,runtimeVersion:g}),!re.acquired)throw Error("worker_already_running_or_lifecycle_busy");let he=Pg(p(te),`ssh-preflight-${Rg()}.json`);try{y(he,{version:1}),m(he)}finally{try{Eg(he)}catch{}}let Se=S(te),Re=ft(te);if(Re.revoked||Re.drained)throw Error("worker_ssh_revoked_or_drained");if(Se&&Date.parse(Se.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(Se&&te.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await v.send({type:"hello",protocol:Uo,version:g,platform:process.platform,architecture:process.arch,enrolled:!!Se});let Ee=te.lifetime==="ephemeral"?G=new Ho:xt(te,!0);if(!Se){let We=Kr(te);await v.send({type:"ticket-request",request:We.request});let $e=Ag.parse(await v.receive(70000,D.signal)),Ue=We.complete($e.organizationId,$e.receipt);if(Se=await Er(te,Ue,Ee,e.enroll),te.lifetime==="persistent")ae(Se,f(te).state,{proofStore:Ee});qt(te,{version:1,drained:!1,revoked:!1})}if(D.signal.aborted)throw Error("worker_ssh_cancelled");z=(async()=>{try{while(!M.signal.aborted){if(xg.parse(await v.receive(35000,M.signal)).type==="stop"){L();return}await v.send({type:"pong"})}}catch{if(!M.signal.aborted)L()}})();let Oe=!1,Me,Ce=!1;ce=l.after(Math.max(1,Math.min($i,e.startupTimeoutMs??$i)),()=>{Ce=!0,L()});let Te=re.owner.nonce;if(await Wo(te,Se,Ee,Te,{...e,signal:D.signal,onEvent(We){if(e.onEvent?.(We),We.type==="heartbeat"&&!Oe&&!Me)Me=(async()=>{let $e=await St(te,"status");if(!$e?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await v.send({type:"running",deviceId:$e.deviceId,expiresAt:$e.expiresAt,lifetime:te.lifetime,supervision:"ssh-foreground"}),Oe=!0,ce?.()})().catch(()=>{Ce=!0,L()})}}),await Me,Ce||!Oe)throw Error("worker_ssh_outbound_or_readiness_failed");return we=!0,0}catch(te){let X=te instanceof Error&&/^worker_[a-z_]+$/.test(te.message)?te.message:"worker_ssh_bootstrap_failed";try{await v.send({type:"error",code:X})}catch{}return 1}finally{if(ce?.(),L(),M.abort(),await z,G?.deleteBinding(),G?.deleteKey(),re?.acquired)re.release();if(process.removeListener("SIGHUP",L),e.signal?.removeEventListener("abort",L),v.signal.removeEventListener("abort",L),we)try{await v.send({type:"stopped"})}catch{}v.dispose()}}var Is=(e)=>Dg(e)&&e.length<=4096&&!/[\x00-\x1f\x7f]/.test(e),xs=(e)=>`'${e.replaceAll("'","'\\''")}'`,Tg=h({type:i("hello"),protocol:i(Uo),version:t(),platform:c(["linux","darwin"]),architecture:c(["arm64","x64"]),enrolled:_()}),Lg=h({type:i("ticket-request"),request:h({install_id:V(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:c(["persistent","ephemeral"]),roots:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:c(["confined","host"]),permissions:h({read:i(!0),write:i(!0),execute:i(!0),discover_environment:i(!0),expose_mcp:i(!1)})})).length(1)})}),Gd=P("type",[h({type:i("running"),deviceId:t().min(1).max(160),expiresAt:I.datetime({offset:!0}),lifetime:c(["persistent","ephemeral"]),supervision:i("ssh-foreground")}),h({type:i("pong")}),h({type:i("stopped")})]),Wg=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function Bi(e){if(e&&typeof e==="object"&&"type"in e&&e.type==="error"){let l="code"in e&&typeof e.code==="string"&&Wg.has(e.code)?e.code:"worker_ssh_remote_failed";throw Error(l)}return e}function Yd(e){if(!Is(e.remoteCli)||!/^[a-f0-9]{64}$/.test(e.sha256))throw Error("worker_ssh_invalid_target");let l=`set -eu
+a=${xs(e.remoteCli)}
 [ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
 p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
 p=$(cd -P "$p" && pwd -P)
@@ -98,12 +98,12 @@ if [ -x /usr/bin/sha256sum ]; then h=$(/usr/bin/sha256sum < "$a");
 elif [ -x /usr/bin/shasum ]; then h=$(/usr/bin/shasum -a 256 < "$a");
 else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
 h=\${h%% *}
-[ "$h" = ${Os(e.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
-exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${Os(l)}`}function Xd(e,l){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(e.alias)||!Ds(e.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",e.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...l?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",e.alias,Yd(e)]}function Ng(e){return Xd(e,!1)}function Zd(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:s(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function Hg(e){let l;try{({stdout:l}=await Mg(Ig)("/usr/bin/ssh",["-G",...Xd(e,!0)],{env:Zd(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let v of l.split(`
-`)){let[O,...M]=v.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(O??"")&&M.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function $g(e){let l=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((v)=>e.includes(`worker_ssh_${v}`));return l?`worker_ssh_${l}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test(e)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test(e)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function Bg(e){await Hg(e);let l=Og("/usr/bin/ssh",Ng(e),{stdio:["pipe","pipe","pipe"],env:Zd()}),v="";l.stderr.on("data",(M)=>{if(Buffer.byteLength(v)+M.length<=65536)v+=M.toString("utf8");else l.kill("SIGKILL")});let O=new Promise((M)=>{l.once("error",()=>M({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),l.once("close",(L)=>{let z=$g(v);v="",M({exitCode:L??1,errorCode:z})})});return{input:l.stdin,output:l.stdout,result:O,close(){if(l.stdin.destroy(),l.exitCode===null&&l.signalCode===null){l.kill("SIGTERM");let M=setTimeout(()=>l.kill("SIGKILL"),2000);M.unref(),O.finally(()=>clearTimeout(M))}}}}function Ug(e){let l=new Map,v=!1;for(let z=0;z<e.length;z++){let re=e[z];if(re==="--foreground"&&!v){v=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(re)||l.has(re))throw Error("worker_unknown_or_duplicate_flag");let G=e[++z];if(!G||G.startsWith("--"))throw Error("worker_missing_flag_value");l.set(re,G)}if(!v)throw Error("worker_ssh_foreground_required");let O=(z)=>{let re=l.get(z);if(!re)throw Error("worker_required_input_missing");return re},M={alias:O("--ssh"),sshConfig:O("--ssh-config"),remoteCli:O("--remote-cli"),sha256:O("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(M.alias)||!Ds(M.sshConfig))throw Error("worker_ssh_invalid_target");Yd(M),m(M.sshConfig);let L=x.parse(JSON.parse(m(O("--config"))));if(se(L.workspaceRoot,M.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:M,config:L,credentialPath:l.get("--credential-file")}}async function Fg(e,l,v,O,M){let{request:L}=Lg.parse(Ui(await e.receive(30000,M)));if(L.lifecycle!==l.lifetime||L.roots[0].execution_mode!==l.executionMode)throw Error("worker_ticket_receipt_mismatch");let z=()=>{if(M.aborted)throw Error("worker_ssh_cancelled")},re=(async()=>{z();let ce=v??qr(l),we=await(O.enrollmentCredentials??zr)(l,ce);if(z(),!we)throw Error("worker_session_login_required");if(!W(we.apiOrigin,l.apiOrigin))throw Error("worker_session_origin_mismatch");if(!we.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let te=O.createTicketClient?.(we)??new me(we,{credentialsPath:ce}),X=ga(await te.createHeadlessDeviceEnrollmentTicket(L));return z(),{type:"ticket",organizationId:we.orgId,receipt:X}})(),G;try{let ce=await Promise.race([re,new Promise((we,te)=>{if(G=()=>te(Error("worker_ssh_cancelled")),M.aborted)G();else M.addEventListener("abort",G,{once:!0})})]);z(),await e.send(ce)}finally{M.removeEventListener("abort",G)}}async function Qd(e,l={}){let{config:v,target:O,credentialPath:M}=Ug(e);if(l.signal?.aborted)throw Error("worker_ssh_cancelled");let L=l.clock??$o,z=await(l.sshTransport??Bg)(O),re=new Bo(z.output,z.input,L),G=new AbortController,ce=()=>G.abort(),we,te;if(z.result.then((X)=>{te=X}),process.once("SIGINT",ce),process.once("SIGTERM",ce),l.signal?.addEventListener("abort",ce,{once:!0}),l.signal?.aborted)ce();try{if(G.signal.aborted)throw Error("worker_ssh_cancelled");await re.send({type:"configure",protocol:Uo,version:g,config:v});let X=Tg.parse(Ui(await re.receive(30000,G.signal)));if(X.version!==g)throw Error("worker_ssh_version_mismatch");if(!X.enrolled)await Fg(re,v,M,l,AbortSignal.any([G.signal,re.signal]));we=L.every(1e4,()=>{re.send({type:"ping"}).catch(ce)});let he=!1,Se=L.now()+(X.enrolled?0:ma)+$i+5000;while(!0){let Re=he?35000:Math.max(1,Se-L.now()),Ee=Gd.parse(Ui(await re.receive(Re,G.signal)));if(Ee.type==="running"){if(he||Ee.lifetime!==v.lifetime||Date.parse(Ee.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");he=!0,(l.io??process).stdout.write(JSON.stringify(Ee)+`
-`)}if(Ee.type==="stopped"){if(!he)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(X){if(G.signal.aborted){we?.();try{await re.send({type:"stop"});let he=L.now()+v.shutdownGraceMs+1e4;while(L.now()<he)if(Gd.parse(Ui(await re.receive(Math.max(1,he-L.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(X instanceof Error&&X.message==="worker_ssh_connection_closed"){let he=te??await Promise.race([z.result,new Promise((Se)=>setTimeout(Se,100))]);if(he?.exitCode)throw Error(he.errorCode)}throw X}finally{we?.(),process.removeListener("SIGINT",ce),process.removeListener("SIGTERM",ce),l.signal?.removeEventListener("abort",ce),z.close(),re.dispose()}}import{createConnection as Vg}from"net";import{WebSocket as Fi}from"ws";var jg=1,Xn=65536,eu=4096,tu=67108864,ru=4194304,Gn=V(),qg=h({kind:i("install_only"),authorityId:Gn,organizationId:Gn,userId:Gn,connectionId:Gn,attemptId:Gn,purpose:i("install"),generation:o().int().positive(),transport:i("reverse_ssh"),expiresAt:I.datetime({offset:!0}),maxDurationMs:i(300000),maxChannels:i(1),allowTcpForwarding:i(!1),allowPty:i(!1)}),zg=t().max(2048).superRefine((e,l)=>{let v;try{v=new URL(e)}catch{l.addIssue({code:"custom",message:"invalid relay url"});return}if(v.protocol!=="ws:"&&v.protocol!=="wss:"){l.addIssue({code:"custom",message:"invalid relay protocol"});return}if(v.username||v.password||v.search||v.hash){l.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let O=v.pathname.split("/");if(O.length!==4||O[1]!=="device"||!Gn.safeParse(O[2]).success||!/^[a-f0-9]{64}$/.test(O[3]??""))l.addIssue({code:"custom",message:"invalid device relay path"});if(v.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(v.hostname))l.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var Kg=h({protocol:i(jg),type:i("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:qg,relayUrl:zg,endpoint:h({host:i("127.0.0.1"),port:i(22)})});function Ms(e,l=Date.now()){let v=Kg.parse(e),O=Date.parse(v.authority.expiresAt);if(!Number.isFinite(O)||O<=l)throw Error("ssh_install_relay_expired");if(O>l+v.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return v}function nu(e){let l=JSON.stringify(e);if(Buffer.byteLength(l)>Xn)throw Error("ssh_install_relay_frame_too_large");return l}function ou(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("ssh_install_relay_control_invalid");let l=e;if(l.type==="ssh_install_relay_receipt")return{type:l.type,receipt:Ms(l.receipt)};if(l.type==="ssh_install_relay_ready"&&typeof l.authorityId==="string")return{type:l.type,authorityId:l.authorityId};throw Error("ssh_install_relay_control_invalid")}var iu="ssh_install_relay_closed";function Jg(e){if(typeof e==="string")return Buffer.byteLength(e,"utf8");if(Buffer.isBuffer(e))return e.length;if(e instanceof ArrayBuffer)return e.byteLength;if(ArrayBuffer.isView(e))return e.byteLength;return Number.POSITIVE_INFINITY}function Gg(e){if(Buffer.isBuffer(e))return e;if(e instanceof ArrayBuffer)return Buffer.from(e);if(ArrayBuffer.isView(e))return Buffer.from(e.buffer,e.byteOffset,e.byteLength);return null}function Yg(e,l=iu){try{e.close(1000,l)}catch{e.terminate()}}async function Xg(e){let l=e.now??(()=>Date.now()),v=Ms(e.receipt,l()),M=(e.createWebSocket??((We)=>new Fi(We,{followRedirects:!1,perMessageDeflate:!1,maxPayload:Xn})))(v.relayUrl),L=e.connectLocal??(()=>Vg({host:"127.0.0.1",port:22})),z,re=!1,G=!1,ce=0,we=0,te,X=(We)=>{if(te)clearTimeout(te);te=setTimeout(()=>Re("ssh_install_relay_expired"),Math.max(1,We)),te.unref?.()},he,Se=new Promise((We)=>{he=We}),Re=(We=iu)=>{if(G)return;if(G=!0,te)clearTimeout(te);if(e.signal?.removeEventListener("abort",Ee),z?.destroy(),M.readyState===Fi.OPEN)Yg(M,We);else if(M.readyState!==Fi.CLOSED)M.terminate();he()},Ee=()=>Re("ssh_install_relay_aborted"),Oe=()=>Re("ssh_install_relay_protocol_error"),Me=(We)=>(ce+=1,we+=We,We<=Xn&&ce<=eu&&we<=tu),Ce=(We)=>{if(G||!re||M.readyState!==Fi.OPEN||M.bufferedAmount>ru||!Me(We.length)){Oe();return}M.send(We,{binary:!0},($e)=>{if($e)Oe()})};M.on("open",()=>{if(G)return;try{let We=nu({type:"ssh_install_relay_receipt",receipt:v});M.send(We,{binary:!1},($e)=>{if($e)Oe()})}catch{Oe()}}),M.on("message",(We,$e)=>{if(G)return;let Fe=Jg(We);if(Fe>Xn||!Me(Fe))return Oe();if(!re){if($e)return Oe();try{let xe=ou(JSON.parse(String(We)));if(xe.type!=="ssh_install_relay_ready"||xe.authorityId!==v.authority.authorityId)return Oe();re=!0,X(v.authority.maxDurationMs),z=L(),z.setNoDelay(!0),z.on("data",Ce),z.on("error",Oe),z.on("close",()=>Re("ssh_install_relay_peer_closed")),z.on("drain",()=>M._socket?.resume()),z.on("connect",()=>{})}catch{Oe()}return}if(!$e)return Oe();let Ne=Gg(We);if(!Ne||!z||z.destroyed||!z.write(Ne))M._socket?.pause()}),M.on("error",Oe),M.on("close",()=>Re("ssh_install_relay_peer_closed"));let Te=Math.max(1,Math.min(v.authority.maxDurationMs,Date.parse(v.authority.expiresAt)-l()));if(X(Te),e.signal?.addEventListener("abort",Ee,{once:!0}),e.signal?.aborted)Ee();return{receipt:v,closed:Se,close:()=>Re()}}async function au(e=process.stdin){let l=[],v=0;for await(let O of e){let M=Buffer.isBuffer(O)?O:Buffer.from(O);if(v+=M.length,v>Xn)return 1;l.push(M)}try{let O=JSON.parse(Buffer.concat(l).toString("utf8"));return await(await Xg({receipt:O})).closed,0}catch{return 1}}import{randomBytes as Zg}from"crypto";var Pn="ARA_WORKER_PREVIEW_PROBE";async function su(){if(typeof Bun>"u")return 1;let e=Zg(32).toString("base64url"),l,v=new Promise((z)=>{l=z}),O=setTimeout(()=>l(1),5000),M=()=>l(0);process.stdin.once("end",M),process.stdin.resume();let L=Bun.serve({hostname:"127.0.0.1",port:0,fetch(z,re){let G=new URL(z.url).pathname;if(z.method!=="GET")return new Response(null,{status:405});if(G==="/readiness")return new Response(Pn);if((G==="/readiness-ws"||G===`/device/readiness/${e}`)&&re.upgrade(z,{data:{relay:G.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(z,re){if(typeof re!=="string"||re.length>8192){z.close();return}if(!z.data.relay){if(re===Pn)z.send(Pn);else z.close();return}try{let G=di(re),ce=(we)=>z.send(JSON.stringify(we));if(G.type==="hello")ce(G),ce({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(G.type==="head"&&G.id==="http"&&G.status===200)ce({type:"credit",id:"http"});else if(G.type==="data"&&G.id==="http"){if(z.data.http+=Buffer.from(G.data,"base64").toString(),z.data.http.length>Pn.length)throw Error("probe_overflow");ce({type:"credit",id:"http"})}else if(G.type==="end"&&G.id==="http"&&z.data.http===Pn)ce({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(G.type==="ws"&&G.id==="ws")ce({type:"data",id:"ws",data:Buffer.from(Pn).toString("base64"),binary:!1});else if(G.type==="data"&&G.id==="ws"&&!G.binary&&Buffer.from(G.data,"base64").toString()===Pn&&!z.data.reported)z.data.reported=!0,process.stdout.write(`ready
+[ "$h" = ${xs(e.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
+exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${xs(l)}`}function Xd(e,l){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(e.alias)||!Is(e.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",e.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...l?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",e.alias,Yd(e)]}function Ng(e){return Xd(e,!1)}function Zd(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:s(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function Hg(e){let l;try{({stdout:l}=await Mg(Ig)("/usr/bin/ssh",["-G",...Xd(e,!0)],{env:Zd(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let v of l.split(`
+`)){let[D,...M]=v.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(D??"")&&M.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function $g(e){let l=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((v)=>e.includes(`worker_ssh_${v}`));return l?`worker_ssh_${l}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test(e)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test(e)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function Bg(e){await Hg(e);let l=Og("/usr/bin/ssh",Ng(e),{stdio:["pipe","pipe","pipe"],env:Zd()}),v="";l.stderr.on("data",(M)=>{if(Buffer.byteLength(v)+M.length<=65536)v+=M.toString("utf8");else l.kill("SIGKILL")});let D=new Promise((M)=>{l.once("error",()=>M({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),l.once("close",(L)=>{let z=$g(v);v="",M({exitCode:L??1,errorCode:z})})});return{input:l.stdin,output:l.stdout,result:D,close(){if(l.stdin.destroy(),l.exitCode===null&&l.signalCode===null){l.kill("SIGTERM");let M=setTimeout(()=>l.kill("SIGKILL"),2000);M.unref(),D.finally(()=>clearTimeout(M))}}}}function Ug(e){let l=new Map,v=!1;for(let z=0;z<e.length;z++){let re=e[z];if(re==="--foreground"&&!v){v=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(re)||l.has(re))throw Error("worker_unknown_or_duplicate_flag");let G=e[++z];if(!G||G.startsWith("--"))throw Error("worker_missing_flag_value");l.set(re,G)}if(!v)throw Error("worker_ssh_foreground_required");let D=(z)=>{let re=l.get(z);if(!re)throw Error("worker_required_input_missing");return re},M={alias:D("--ssh"),sshConfig:D("--ssh-config"),remoteCli:D("--remote-cli"),sha256:D("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(M.alias)||!Is(M.sshConfig))throw Error("worker_ssh_invalid_target");Yd(M),m(M.sshConfig);let L=x.parse(JSON.parse(m(D("--config"))));if(se(L.workspaceRoot,M.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:M,config:L,credentialPath:l.get("--credential-file")}}async function Fg(e,l,v,D,M){let{request:L}=Lg.parse(Bi(await e.receive(30000,M)));if(L.lifecycle!==l.lifetime||L.roots[0].execution_mode!==l.executionMode)throw Error("worker_ticket_receipt_mismatch");let z=()=>{if(M.aborted)throw Error("worker_ssh_cancelled")},re=(async()=>{z();let ce=v??jr(l),we=await(D.enrollmentCredentials??qr)(l,ce);if(z(),!we)throw Error("worker_session_login_required");if(!W(we.apiOrigin,l.apiOrigin))throw Error("worker_session_origin_mismatch");if(!we.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let te=D.createTicketClient?.(we)??new me(we,{credentialsPath:ce}),X=da(await te.createHeadlessDeviceEnrollmentTicket(L));return z(),{type:"ticket",organizationId:we.orgId,receipt:X}})(),G;try{let ce=await Promise.race([re,new Promise((we,te)=>{if(G=()=>te(Error("worker_ssh_cancelled")),M.aborted)G();else M.addEventListener("abort",G,{once:!0})})]);z(),await e.send(ce)}finally{M.removeEventListener("abort",G)}}async function Qd(e,l={}){let{config:v,target:D,credentialPath:M}=Ug(e);if(l.signal?.aborted)throw Error("worker_ssh_cancelled");let L=l.clock??$o,z=await(l.sshTransport??Bg)(D),re=new Bo(z.output,z.input,L),G=new AbortController,ce=()=>G.abort(),we,te;if(z.result.then((X)=>{te=X}),process.once("SIGINT",ce),process.once("SIGTERM",ce),l.signal?.addEventListener("abort",ce,{once:!0}),l.signal?.aborted)ce();try{if(G.signal.aborted)throw Error("worker_ssh_cancelled");await re.send({type:"configure",protocol:Uo,version:g,config:v});let X=Tg.parse(Bi(await re.receive(30000,G.signal)));if(X.version!==g)throw Error("worker_ssh_version_mismatch");if(!X.enrolled)await Fg(re,v,M,l,AbortSignal.any([G.signal,re.signal]));we=L.every(1e4,()=>{re.send({type:"ping"}).catch(ce)});let he=!1,Se=L.now()+(X.enrolled?0:ca)+$i+5000;while(!0){let Re=he?35000:Math.max(1,Se-L.now()),Ee=Gd.parse(Bi(await re.receive(Re,G.signal)));if(Ee.type==="running"){if(he||Ee.lifetime!==v.lifetime||Date.parse(Ee.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");he=!0,(l.io??process).stdout.write(JSON.stringify(Ee)+`
+`)}if(Ee.type==="stopped"){if(!he)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(X){if(G.signal.aborted){we?.();try{await re.send({type:"stop"});let he=L.now()+v.shutdownGraceMs+1e4;while(L.now()<he)if(Gd.parse(Bi(await re.receive(Math.max(1,he-L.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(X instanceof Error&&X.message==="worker_ssh_connection_closed"){let he=te??await Promise.race([z.result,new Promise((Se)=>setTimeout(Se,100))]);if(he?.exitCode)throw Error(he.errorCode)}throw X}finally{we?.(),process.removeListener("SIGINT",ce),process.removeListener("SIGTERM",ce),l.signal?.removeEventListener("abort",ce),z.close(),re.dispose()}}import{createConnection as Vg}from"net";import{WebSocket as Ui}from"ws";var jg=1,Vn=65536,eu=4096,tu=67108864,ru=4194304,zn=V(),qg=h({kind:i("install_only"),authorityId:zn,organizationId:zn,userId:zn,connectionId:zn,attemptId:zn,purpose:i("install"),generation:o().int().positive(),transport:i("reverse_ssh"),expiresAt:I.datetime({offset:!0}),maxDurationMs:i(300000),maxChannels:i(1),allowTcpForwarding:i(!1),allowPty:i(!1)}),zg=t().max(2048).superRefine((e,l)=>{let v;try{v=new URL(e)}catch{l.addIssue({code:"custom",message:"invalid relay url"});return}if(v.protocol!=="ws:"&&v.protocol!=="wss:"){l.addIssue({code:"custom",message:"invalid relay protocol"});return}if(v.username||v.password||v.search||v.hash){l.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let D=v.pathname.split("/");if(D.length!==4||D[1]!=="device"||!zn.safeParse(D[2]).success||!/^[a-f0-9]{64}$/.test(D[3]??""))l.addIssue({code:"custom",message:"invalid device relay path"});if(v.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(v.hostname))l.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var Kg=h({protocol:i(jg),type:i("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:qg,relayUrl:zg,endpoint:h({host:i("127.0.0.1"),port:i(22)})});function Os(e,l=Date.now()){let v=Kg.parse(e),D=Date.parse(v.authority.expiresAt);if(!Number.isFinite(D)||D<=l)throw Error("ssh_install_relay_expired");if(D>l+v.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return v}function nu(e){let l=JSON.stringify(e);if(Buffer.byteLength(l)>Vn)throw Error("ssh_install_relay_frame_too_large");return l}function ou(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("ssh_install_relay_control_invalid");let l=e;if(l.type==="ssh_install_relay_receipt")return{type:l.type,receipt:Os(l.receipt)};if(l.type==="ssh_install_relay_ready"&&typeof l.authorityId==="string")return{type:l.type,authorityId:l.authorityId};throw Error("ssh_install_relay_control_invalid")}var iu="ssh_install_relay_closed";function Jg(e){if(typeof e==="string")return Buffer.byteLength(e,"utf8");if(Buffer.isBuffer(e))return e.length;if(e instanceof ArrayBuffer)return e.byteLength;if(ArrayBuffer.isView(e))return e.byteLength;return Number.POSITIVE_INFINITY}function Gg(e){if(Buffer.isBuffer(e))return e;if(e instanceof ArrayBuffer)return Buffer.from(e);if(ArrayBuffer.isView(e))return Buffer.from(e.buffer,e.byteOffset,e.byteLength);return null}function Yg(e,l=iu){try{e.close(1000,l)}catch{e.terminate()}}async function Xg(e){let l=e.now??(()=>Date.now()),v=Os(e.receipt,l()),M=(e.createWebSocket??((We)=>new Ui(We,{followRedirects:!1,perMessageDeflate:!1,maxPayload:Vn})))(v.relayUrl),L=e.connectLocal??(()=>Vg({host:"127.0.0.1",port:22})),z,re=!1,G=!1,ce=0,we=0,te,X=(We)=>{if(te)clearTimeout(te);te=setTimeout(()=>Re("ssh_install_relay_expired"),Math.max(1,We)),te.unref?.()},he,Se=new Promise((We)=>{he=We}),Re=(We=iu)=>{if(G)return;if(G=!0,te)clearTimeout(te);if(e.signal?.removeEventListener("abort",Ee),z?.destroy(),M.readyState===Ui.OPEN)Yg(M,We);else if(M.readyState!==Ui.CLOSED)M.terminate();he()},Ee=()=>Re("ssh_install_relay_aborted"),Oe=()=>Re("ssh_install_relay_protocol_error"),Me=(We)=>(ce+=1,we+=We,We<=Vn&&ce<=eu&&we<=tu),Ce=(We)=>{if(G||!re||M.readyState!==Ui.OPEN||M.bufferedAmount>ru||!Me(We.length)){Oe();return}M.send(We,{binary:!0},($e)=>{if($e)Oe()})};M.on("open",()=>{if(G)return;try{let We=nu({type:"ssh_install_relay_receipt",receipt:v});M.send(We,{binary:!1},($e)=>{if($e)Oe()})}catch{Oe()}}),M.on("message",(We,$e)=>{if(G)return;let Ue=Jg(We);if(Ue>Vn||!Me(Ue))return Oe();if(!re){if($e)return Oe();try{let xe=ou(JSON.parse(String(We)));if(xe.type!=="ssh_install_relay_ready"||xe.authorityId!==v.authority.authorityId)return Oe();re=!0,X(v.authority.maxDurationMs),z=L(),z.setNoDelay(!0),z.on("data",Ce),z.on("error",Oe),z.on("close",()=>Re("ssh_install_relay_peer_closed")),z.on("drain",()=>M._socket?.resume()),z.on("connect",()=>{})}catch{Oe()}return}if(!$e)return Oe();let Ne=Gg(We);if(!Ne||!z||z.destroyed||!z.write(Ne))M._socket?.pause()}),M.on("error",Oe),M.on("close",()=>Re("ssh_install_relay_peer_closed"));let Te=Math.max(1,Math.min(v.authority.maxDurationMs,Date.parse(v.authority.expiresAt)-l()));if(X(Te),e.signal?.addEventListener("abort",Ee,{once:!0}),e.signal?.aborted)Ee();return{receipt:v,closed:Se,close:()=>Re()}}async function au(e=process.stdin){let l=[],v=0;for await(let D of e){let M=Buffer.isBuffer(D)?D:Buffer.from(D);if(v+=M.length,v>Vn)return 1;l.push(M)}try{let D=JSON.parse(Buffer.concat(l).toString("utf8"));return await(await Xg({receipt:D})).closed,0}catch{return 1}}import{randomBytes as Zg}from"crypto";var vn="ARA_WORKER_PREVIEW_PROBE";async function su(){if(typeof Bun>"u")return 1;let e=Zg(32).toString("base64url"),l,v=new Promise((z)=>{l=z}),D=setTimeout(()=>l(1),5000),M=()=>l(0);process.stdin.once("end",M),process.stdin.resume();let L=Bun.serve({hostname:"127.0.0.1",port:0,fetch(z,re){let G=new URL(z.url).pathname;if(z.method!=="GET")return new Response(null,{status:405});if(G==="/readiness")return new Response(vn);if((G==="/readiness-ws"||G===`/device/readiness/${e}`)&&re.upgrade(z,{data:{relay:G.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(z,re){if(typeof re!=="string"||re.length>8192){z.close();return}if(!z.data.relay){if(re===vn)z.send(vn);else z.close();return}try{let G=mi(re),ce=(we)=>z.send(JSON.stringify(we));if(G.type==="hello")ce(G),ce({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(G.type==="head"&&G.id==="http"&&G.status===200)ce({type:"credit",id:"http"});else if(G.type==="data"&&G.id==="http"){if(z.data.http+=Buffer.from(G.data,"base64").toString(),z.data.http.length>vn.length)throw Error("probe_overflow");ce({type:"credit",id:"http"})}else if(G.type==="end"&&G.id==="http"&&z.data.http===vn)ce({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(G.type==="ws"&&G.id==="ws")ce({type:"data",id:"ws",data:Buffer.from(vn).toString("base64"),binary:!1});else if(G.type==="data"&&G.id==="ws"&&!G.binary&&Buffer.from(G.data,"base64").toString()===vn&&!z.data.reported)z.data.reported=!0,process.stdout.write(`ready
 `);else throw Error("probe_protocol_failed")}catch{z.close(),l(1)}}}});try{return process.stdout.write(JSON.stringify({port:L.port,token:e})+`
-`),await v}finally{clearTimeout(O),L.stop(!0),process.stdin.removeListener("end",M),process.stdin.pause()}}import{closeSync as tw,createReadStream as rw,fstatSync as nw,readFileSync as ow}from"fs";var cu="/run/sc/instance-generation";var Qg=/^[1-9][0-9]{0,15}\n?$/;function ew(e){return typeof e==="number"&&Number.isSafeInteger(e)&&e>0}function lu(e){if(typeof e!=="string"||!Qg.test(e))return null;let l=Number(e.trim());return ew(l)?l:null}var du=3,iw=600000,aw=65536,sw=500;function uu(e){if(e.length!==3||e[0]!=="standby"||e[1]!=="--handoff-fd"||e[2]!==String(du))throw Error("worker_standby_invalid_invocation");return{handoffFd:du}}function cw(e=(l)=>ow(l,"utf8")){try{return lu(e(cu))}catch{return null}}function lw(e){let l;try{l=JSON.parse(e)}catch{throw Error("worker_standby_handoff_invalid")}if(!l||typeof l!=="object"||Array.isArray(l))throw Error("worker_standby_handoff_invalid");let v=Object.keys(l).sort();if(v.length!==2||v[0]!=="config"||v[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let O=l,M=x.safeParse(O.config),L=fa.safeParse(O.enrollment);if(!M.success||!L.success)throw Error("worker_standby_handoff_invalid");if(M.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:M.data,enrollment:L.data}}var fu={isPipe:(e)=>nw(e).isFIFO(),stream:(e)=>{let l=rw("",{fd:e,autoClose:!0,highWaterMark:16384});return{chunks:l,close:()=>l.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:(e,l)=>{let v=setInterval(l,e);return v.unref?.(),()=>clearInterval(v)}};async function dw(e,l=fu){if(!l.isPipe(e.fd)){try{tw(e.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let v=l.now()+(e.armMs??iw),O=l.stream(e.fd),M=null,L=()=>{},z=new Promise((G,ce)=>{L=(we)=>{M??=we,ce(we)}});z.catch(()=>{});let re=l.every(sw,()=>{if(l.parentPid()!==e.parentPid)L(Error("worker_standby_parent_changed"));else if(l.now()>=v)L(Error("worker_standby_arm_expired"))});try{let G=(async()=>{let we=[],te=0;for await(let X of O.chunks){if(M)throw M;if(te===0)e.onArriving?.();if(te+=X.length,te>aw)throw Error("worker_standby_handoff_too_large");we.push(X)}return Buffer.concat(we).toString("utf8")})(),ce=await Promise.race([G,z]);if(l.parentPid()!==e.parentPid)throw Error("worker_standby_parent_changed");return ce}finally{re(),O.close()}}async function mu(e,l=fu){let v=e.readGeneration??(()=>cw()),O=l.parentPid(),M=v();if(M===null)throw Error("worker_standby_no_instance_generation");e.onBooted?.();let L=await dw({fd:e.fd,parentPid:O,armMs:e.armMs,onArriving:e.onArriving},l);if(v()!==M)throw Error("worker_standby_generation_changed");return lw(L)}var uw=`Usage: reason worker <command> --config PATH [--json]
+`),await v}finally{clearTimeout(D),L.stop(!0),process.stdin.removeListener("end",M),process.stdin.pause()}}import{closeSync as tw,createReadStream as rw,fstatSync as nw,readFileSync as ow}from"fs";var cu="/run/sc/instance-generation";var Qg=/^[1-9][0-9]{0,15}\n?$/;function ew(e){return typeof e==="number"&&Number.isSafeInteger(e)&&e>0}function lu(e){if(typeof e!=="string"||!Qg.test(e))return null;let l=Number(e.trim());return ew(l)?l:null}var du=3,iw=600000,aw=65536,sw=500;function uu(e){if(e.length!==3||e[0]!=="standby"||e[1]!=="--handoff-fd"||e[2]!==String(du))throw Error("worker_standby_invalid_invocation");return{handoffFd:du}}function cw(e=(l)=>ow(l,"utf8")){try{return lu(e(cu))}catch{return null}}function lw(e){let l;try{l=JSON.parse(e)}catch{throw Error("worker_standby_handoff_invalid")}if(!l||typeof l!=="object"||Array.isArray(l))throw Error("worker_standby_handoff_invalid");let v=Object.keys(l).sort();if(v.length!==2||v[0]!=="config"||v[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let D=l,M=x.safeParse(D.config),L=sa.safeParse(D.enrollment);if(!M.success||!L.success)throw Error("worker_standby_handoff_invalid");if(M.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:M.data,enrollment:L.data}}var fu={isPipe:(e)=>nw(e).isFIFO(),stream:(e)=>{let l=rw("",{fd:e,autoClose:!0,highWaterMark:16384});return{chunks:l,close:()=>l.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:(e,l)=>{let v=setInterval(l,e);return v.unref?.(),()=>clearInterval(v)}};async function dw(e,l=fu){if(!l.isPipe(e.fd)){try{tw(e.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let v=l.now()+(e.armMs??iw),D=l.stream(e.fd),M=null,L=()=>{},z=new Promise((G,ce)=>{L=(we)=>{M??=we,ce(we)}});z.catch(()=>{});let re=l.every(sw,()=>{if(l.parentPid()!==e.parentPid)L(Error("worker_standby_parent_changed"));else if(l.now()>=v)L(Error("worker_standby_arm_expired"))});try{let G=(async()=>{let we=[],te=0;for await(let X of D.chunks){if(M)throw M;if(te===0)e.onArriving?.();if(te+=X.length,te>aw)throw Error("worker_standby_handoff_too_large");we.push(X)}return Buffer.concat(we).toString("utf8")})(),ce=await Promise.race([G,z]);if(l.parentPid()!==e.parentPid)throw Error("worker_standby_parent_changed");return ce}finally{re(),D.close()}}async function mu(e,l=fu){let v=e.readGeneration??(()=>cw()),D=l.parentPid(),M=v();if(M===null)throw Error("worker_standby_no_instance_generation");e.onBooted?.();let L=await dw({fd:e.fd,parentPid:D,armMs:e.armMs,onArriving:e.onArriving},l);if(v()!==M)throw Error("worker_standby_generation_changed");return lw(L)}var uw=`Usage: reason worker <command> --config PATH [--json]
 
   enroll                        Obtain/redeem a ticket using the current Reason login
   start                         Run the existing Device daemon in the foreground
@@ -144,16 +144,16 @@ Pretrust known_hosts. No agent forwarding, automatic installation or detached se
 SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
 are not forwarded/supported; running is not a browser-readiness receipt.
 Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function fw(e){let[l,...v]=e;if(!l||l==="help"||l==="--help"||l==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(l))throw Error("worker_unknown_command");let O,M,L,z=!1;for(let re=0;re<v.length;re++){let G=v[re];if(G==="--json"&&!z){z=!0;continue}if(G!=="--config"&&G!=="--enrollment-file"&&G!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let ce=v[++re];if(!ce||ce.startsWith("--"))throw Error("worker_missing_flag_value");if(G==="--config"&&!O)O=ce;else if(G==="--enrollment-file"&&!M&&["enroll","start"].includes(l))M=ce;else if(G==="--credential-file"&&!L&&l==="enroll")L=ce;else throw Error("worker_unknown_or_duplicate_flag")}if(!O)throw Error("worker_required_input_missing");if(L&&M)throw Error("worker_enrollment_inputs_conflict");return{action:l,configPath:O,enrollmentPath:M,credentialPath:L,json:z}}var mw=1e4,pw=2000,pu=15000,hw=50;async function gu(e,l,v,O,M,L){let z=new Ho,re=new AbortController,G,ce,we=new Promise((Ne,xe)=>{G=Ne,ce=xe});if(we.catch(()=>{}),ne(),e.executionMode==="host")wr();v("enrollment_started");let te=M(z);te.catch(()=>{});let X=null,he=hi(e,l,(Ne)=>{if(!X)throw Error("worker_starting");return X(Ne)});he.catch(()=>{}),v("readiness_started");let Se=new AbortController,Re,Ee=AbortSignal.any([re.signal,Se.signal,...O.signal?[O.signal]:[]]),Oe=L?.matches(e)?L.result:void 0;if(L&&!Oe)await L.stop();if(Oe)Ee.addEventListener("abort",()=>void L.stop(),{once:!0});let Me,Ce=new Promise((Ne)=>{Me=Ne}),Te=setTimeout(()=>Me(),mw);Ee.addEventListener("abort",()=>Me(),{once:!0});let We,$e=(Ne)=>{if(Ne==="ready")We=setTimeout(()=>Me(),pw);O.onStartup?.(Ne)},Fe=Co(e,O.readinessProbes,Ee,we,void 0,Oe,Ce);Fe.final.catch(()=>{});try{let Ne;try{Ne=await te}catch(xe){throw re.abort(),ce(Error("worker_enrollment_failed")),await Fe.final.catch(()=>{}),await he.then((Le)=>Le(),()=>{}),xe}v("enrollment_completed"),Re=setTimeout(()=>Se.abort(),Math.max(1,Math.min(pu,Date.parse(Ne.worker?.expiresAt??"")-Date.now()||pu))),G(Ne.roots[0].permissions),zt(e,{version:1,drained:!1,revoked:!1}),await Wo(e,Ne,z,l,{...O,onStartup:$e,prestartedReadiness:Fe,prestartedControl:{closed:he,handle:(xe)=>{X=xe}},deferOptionalLanes:!0})}finally{clearTimeout(Re),clearTimeout(Te),clearTimeout(We),re.abort(),z.deleteBinding(),z.deleteKey(),await he.then((Ne)=>Ne(),()=>{})}}async function gw(e,l,v,O){let{handoffFd:M}=uu(e);if(dt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((l.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let L,z,re=()=>{let he=v.readinessProbes?v.readinessProbes.boundPty:(Se)=>Po(Se);if(G||!he)return;try{ne(),wr()}catch{return}if(L=Cl(he),!v.readinessProbes)setImmediate(()=>{if(G)return;try{Ri()}catch{}})},G=!1,ce=()=>{G=!0,clearTimeout(z),(L?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",ce),process.once("SIGINT",ce);let we;try{we=await(l.receiveStandbyHandoff??mu)({fd:M,onBooted:()=>{O("standby_booted"),z=setTimeout(re,hw)},onArriving:()=>clearTimeout(z)})}catch(he){clearTimeout(z);let Se=he instanceof Error&&/^worker_standby_[a-z_]+$/.test(he.message)?he.message:"worker_standby_failed";return(l.io??process).stderr.write(`Reason worker: ${Se}.
-`),await L?.stop(),(l.exitProcess??((Re)=>process.exit(Re)))(1),1}finally{clearTimeout(z),process.off("SIGTERM",ce),process.off("SIGINT",ce)}if(G)return 0;O("handoff_received");let{config:te,enrollment:X}=we;try{b(p(te),!0);let he=await wu(te,()=>{});try{if(O("lock_acquired"),S(te))throw Error("worker_ephemeral_requires_fresh_enrollment");return Dr(te),await gu(te,he.owner.nonce,O,v,(Se)=>Cr(te,X,Se,l.enroll),L),0}finally{he.release()}}finally{await L?.stop()}}async function Nr(e,l={}){let v=l.io??process,O=!1,M=!1,L=new Map,z=(G)=>{L.set(G,performance.now()),v.stderr.write(JSON.stringify({event:"worker.startup",stage:G,pid:process.pid,timestamp:new Date().toISOString()})+`
-`),l.onStartup?.(G)},re={...l,onStartup:z,onDeviceRevoked:()=>{M=!0,l.onDeviceRevoked?.()},startupTiming:()=>{let G=(he)=>Math.min(tr,Math.max(0,Math.round(he))),ce=L.get("readiness_started"),we=L.get("readiness_completed"),te=L.get("handoff_received")??0,X=Object.fromEntries(Us.flatMap((he)=>{let Se=L.get(he);return Se===void 0?[]:[[he,G(Se-te)]]}));return{service_start_to_heartbeat_ms:G(performance.now()-te),stage_ms:X,...ce!==void 0&&we!==void 0?{readiness_ms:G(we-ce)}:{}}},onEvent:(G)=>{if(G.type==="error"&&G.diagnostic){O=!0;let ce=G.diagnostic;v.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:ce.stage,category:ce.category,httpStatus:ce.category==="http"?ce.httpStatus:void 0})+`
-`)}l.onEvent?.(G)}};try{if(e[0]==="__preview-probe"){if(e.length!==1||dt(l.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await su()}if(e[0]==="attach"||e[0]==="__ssh-bootstrap"||e[0]==="__ssh-reverse"){if(dt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(e[0]==="attach")return await Qd(e.slice(1),l);if(e.length!==1)throw Error("worker_unknown_or_duplicate_flag");if(e[0]==="__ssh-reverse")return await au();return await Jd(l)}if(e[0]==="__update-restart"){let he=e.length===4&&e[3]==="--changed";if(e[1]!=="--config"||!e[2]||e.length!==3&&!he)throw Error("worker_unknown_or_duplicate_flag");if(dt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");let Se=x.parse(JSON.parse(m(e[2]))),Re=await gi(Se,he?void 0:g);return v.stdout.write(JSON.stringify(Re)+`
-`),Re.state==="current"?3:Re.state==="busy"?75:0}if(e[0]==="standby")return await gw(e,l,re,z);let G=fw(e);if(!G)return v.stdout.write(uw),0;if(dt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux","win32"].includes(process.platform))throw Error("worker_platform_unsupported");let ce=x.parse(JSON.parse(m(G.configPath))),we=(he)=>v.stdout.write(JSON.stringify(he)+`
-`),te=S(ce);if(G.action==="status"||G.action==="doctor"){let he=await Rt(ce,"status"),Se=pt(ce),Re={enrolled:!!te||!!he,deviceId:te?.deviceId??he?.deviceId??null,lifetime:ce.lifetime,expired:te||he?Date.parse(te?.worker?.expiresAt??he.expiresAt)<=Date.now():null,drained:Se.drained,revoked:Se.revoked,live:he};if(G.action==="status")return we(Re),0;let Ee=!0;try{Dr(ce)}catch{Ee=!1}return we({...Re,workspace:Ee,platform:process.platform,executionMode:ce.executionMode,proofStorage:ce.lifetime==="ephemeral"?"process-memory":te&&xt(ce)instanceof ft?"login-keychain":"owner-only-file",confinement:ce.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:he?.supportedOperations?"live-worker":"unavailable",reportedOperations:he?.supportedOperations??null,capabilityReadiness:he?.capabilityReadiness??null,ready:he?.executionEligible===!0&&!Re.expired}),Ee&&(te||he)&&!Re.revoked&&!Re.expired?0:1}if(["drain","resume","stop"].includes(G.action)){let he=G.action==="drain"?"drain":G.action==="resume"?"resume":"stop",Se=await Rt(ce,he);if(Se){if(we(Se),he==="stop"&&ce.lifetime==="ephemeral"&&!G.json)v.stderr.write(yw);return 0}}b(p(ce),!0);let X=await wu(ce,()=>{if(!G.json)v.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(G.action==="start")z("lock_acquired");let he=S(ce);if(["drain","resume","stop"].includes(G.action)){if(!he)throw Error("worker_not_enrolled");let Se=pt(ce);if(Se.revoked||Date.parse(he.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(G.action!=="stop")zt(ce,{...Se,drained:G.action==="drain"});return we({running:!1,drained:G.action==="stop"?Se.drained:G.action==="drain"}),0}if(G.action==="enroll"){if(ce.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let Se=G.enrollmentPath,Re=!Se&&pt(ce).revoked;if(he&&!Re)throw Error("worker_already_enrolled");Dr(ce);let Ee=()=>{Zt(ce),_c(ce)};if(Re)Ee();let Oe=async()=>{let Te=ei(ce),We=Se?await pa(ce,Se,Te,l.enroll):await hu(ce,G.credentialPath,l,Te);return{proof:Te,enrolled:We}},{proof:Me,enrolled:Ce}=await Oe().catch((Te)=>{if(Se||!(Te instanceof Er)||!Te.deviceRemoved)throw Te;return Ee(),Oe()});return ae(Ce,f(ce).state,{proofStore:Me}),zt(ce,{version:1,drained:!1,revoked:!1}),we({enrolled:!0,deviceId:Ce.deviceId,lifetime:ce.lifetime}),0}if(G.action==="revoke"){if(!he)throw Error("worker_not_enrolled");let Se=xt(ce),Re=new ar(ye(ce.apiOrigin),oe(ce.proxy),Se);if(zt(ce,{version:1,drained:!0,revoked:!0}),l.revoke)await l.revoke(he,Re);else await Re.disconnect(he,AbortSignal.timeout(30000));return Zt(ce),we({revoked:!0,localKeyRemoved:!0}),0}if(Dr(ce),ce.lifetime==="ephemeral"){if(he)throw Error("worker_ephemeral_requires_fresh_enrollment");await gu(ce,X.owner.nonce,z,re,async(Se)=>G.enrollmentPath?pa(ce,G.enrollmentPath,Se,l.enroll):hu(ce,void 0,l,Se,"worker_ephemeral_enrollment_required"))}else{if(G.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!he)throw Error("worker_not_enrolled");if(pt(ce).revoked)M=!0;await Wo(ce,he,xt(ce),X.owner.nonce,re)}return 0}finally{X.release()}}catch(G){let ce=G instanceof Error&&(G.message==="worker_revoked"||!O&&/^worker_[a-z_]+$/.test(G.message))?G.message:"worker_command_failed";v.stderr.write(`Reason worker: ${ce}.
-`);let we=e.includes("--json")?void 0:Ln(G instanceof Er&&G.deviceRemoved?"worker_enrollment_device_removed":ce);if(we)v.stderr.write(`${we}
-`);return ce==="worker_revoked"&&M?0:1}}var ww=60000;async function wu(e,l){let v=Date.now()+e.shutdownGraceMs+ww,O=!1;for(;;){let M=ie({path:f(e).lock,runtimeVersion:g});if(M.acquired)return M;let L=await Rt(e,"status").catch(()=>null);if(!(L?L.phase==="stopping":O)||Date.now()>=v)throw Error("worker_already_running_or_lifecycle_busy");if(!O)O=!0,l();await new Promise((re)=>setTimeout(re,250))}}var yw='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function hu(e,l,v,O,M="worker_session_login_required"){if(v.enrollmentInput&&!l){let G=performance.now();return Cr(e,await v.enrollmentInput(e),O,v.enroll,G)}let L=l??qr(e),z=await(v.enrollmentCredentials??zr)(e,L);if(!z)throw Error(M);let re=v.createTicketClient?.(z)??new me(z,{credentialsPath:L,fetchImpl:oe(e.proxy)});return yc(e,z,re,O,v.enroll)}import{spawn as _w}from"child_process";import{readFileSync as bw,unlinkSync as kw}from"fs";import{join as vw}from"path";var Sw=120,Rw=15,Ew=5000;function ji(e={}){let l=e.stateDirectory?vw(e.stateDirectory,Pw):null;if(l)Cw(l);let v=Y();if(!v)return null;let O=process.platform==="win32",M=Math.max(1,Math.floor(e.limitSeconds??Sw)),L=e.pid??process.pid,z=Math.min(Rw,M),re=l?`printf '%s %s %s\\n' "$(date +%s)" ${M+z} ${yu(g)} > ${yu(l)} 2>/dev/null
-`:"",G=(Se)=>`[ $((SECONDS - started)) -ge ${Math.max(1,Se-1)} ]`,ce=O?":":`[ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${L}" ]`,we=O?`"$SYSTEMROOT/System32/taskkill.exe" /PID ${L} /F >/dev/null`:`kill -KILL ${L}`,te=`parent_is_worker() { ${ce}; }
+`;function fw(e){let[l,...v]=e;if(!l||l==="help"||l==="--help"||l==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(l))throw Error("worker_unknown_command");let D,M,L,z=!1;for(let re=0;re<v.length;re++){let G=v[re];if(G==="--json"&&!z){z=!0;continue}if(G!=="--config"&&G!=="--enrollment-file"&&G!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let ce=v[++re];if(!ce||ce.startsWith("--"))throw Error("worker_missing_flag_value");if(G==="--config"&&!D)D=ce;else if(G==="--enrollment-file"&&!M&&["enroll","start"].includes(l))M=ce;else if(G==="--credential-file"&&!L&&l==="enroll")L=ce;else throw Error("worker_unknown_or_duplicate_flag")}if(!D)throw Error("worker_required_input_missing");if(L&&M)throw Error("worker_enrollment_inputs_conflict");return{action:l,configPath:D,enrollmentPath:M,credentialPath:L,json:z}}var mw=1e4,pw=2000,pu=15000,hw=50;async function gu(e,l,v,D,M,L){let z=new Ho,re=new AbortController,G,ce,we=new Promise((Ne,xe)=>{G=Ne,ce=xe});if(we.catch(()=>{}),ne(),e.executionMode==="host")kr();v("enrollment_started");let te=M(z);te.catch(()=>{});let X=null,he=fi(e,l,(Ne)=>{if(!X)throw Error("worker_starting");return X(Ne)});he.catch(()=>{}),v("readiness_started");let Se=new AbortController,Re,Ee=AbortSignal.any([re.signal,Se.signal,...D.signal?[D.signal]:[]]),Oe=L?.matches(e)?L.result:void 0;if(L&&!Oe)await L.stop();if(Oe)Ee.addEventListener("abort",()=>void L.stop(),{once:!0});let Me,Ce=new Promise((Ne)=>{Me=Ne}),Te=setTimeout(()=>Me(),mw);Ee.addEventListener("abort",()=>Me(),{once:!0});let We,$e=(Ne)=>{if(Ne==="ready")We=setTimeout(()=>Me(),pw);D.onStartup?.(Ne)},Ue=Eo(e,D.readinessProbes,Ee,we,void 0,Oe,Ce);Ue.final.catch(()=>{});try{let Ne;try{Ne=await te}catch(xe){throw re.abort(),ce(Error("worker_enrollment_failed")),await Ue.final.catch(()=>{}),await he.then((Le)=>Le(),()=>{}),xe}v("enrollment_completed"),Re=setTimeout(()=>Se.abort(),Math.max(1,Math.min(pu,Date.parse(Ne.worker?.expiresAt??"")-Date.now()||pu))),G(Ne.roots[0].permissions),qt(e,{version:1,drained:!1,revoked:!1}),await Wo(e,Ne,z,l,{...D,onStartup:$e,prestartedReadiness:Ue,prestartedControl:{closed:he,handle:(xe)=>{X=xe}},deferOptionalLanes:!0})}finally{clearTimeout(Re),clearTimeout(Te),clearTimeout(We),re.abort(),z.deleteBinding(),z.deleteKey(),await he.then((Ne)=>Ne(),()=>{})}}async function gw(e,l,v,D){let{handoffFd:M}=uu(e);if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((l.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let L,z,re=()=>{let he=v.readinessProbes?v.readinessProbes.boundPty:(Se)=>Ro(Se);if(G||!he)return;try{ne(),kr()}catch{return}if(L=Cl(he),!v.readinessProbes)setImmediate(()=>{if(G)return;try{ki()}catch{}})},G=!1,ce=()=>{G=!0,clearTimeout(z),(L?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",ce),process.once("SIGINT",ce);let we;try{we=await(l.receiveStandbyHandoff??mu)({fd:M,onBooted:()=>{D("standby_booted"),z=setTimeout(re,hw)},onArriving:()=>clearTimeout(z)})}catch(he){clearTimeout(z);let Se=he instanceof Error&&/^worker_standby_[a-z_]+$/.test(he.message)?he.message:"worker_standby_failed";return(l.io??process).stderr.write(`Reason worker: ${Se}.
+`),await L?.stop(),(l.exitProcess??((Re)=>process.exit(Re)))(1),1}finally{clearTimeout(z),process.off("SIGTERM",ce),process.off("SIGINT",ce)}if(G)return 0;D("handoff_received");let{config:te,enrollment:X}=we;try{b(p(te),!0);let he=await wu(te,()=>{});try{if(D("lock_acquired"),S(te))throw Error("worker_ephemeral_requires_fresh_enrollment");return Or(te),await gu(te,he.owner.nonce,D,v,(Se)=>Er(te,X,Se,l.enroll),L),0}finally{he.release()}}finally{await L?.stop()}}async function Tr(e,l={}){let v=l.io??process,D=!1,M=!1,L=new Map,z=(G)=>{L.set(G,performance.now()),v.stderr.write(JSON.stringify({event:"worker.startup",stage:G,pid:process.pid,timestamp:new Date().toISOString()})+`
+`),l.onStartup?.(G)},re={...l,onStartup:z,onDeviceRevoked:()=>{M=!0,l.onDeviceRevoked?.()},startupTiming:()=>{let G=(he)=>Math.min(tr,Math.max(0,Math.round(he))),ce=L.get("readiness_started"),we=L.get("readiness_completed"),te=L.get("handoff_received")??0,X=Object.fromEntries(Xs.flatMap((he)=>{let Se=L.get(he);return Se===void 0?[]:[[he,G(Se-te)]]}));return{service_start_to_heartbeat_ms:G(performance.now()-te),stage_ms:X,...ce!==void 0&&we!==void 0?{readiness_ms:G(we-ce)}:{}}},onEvent:(G)=>{if(G.type==="error"&&G.diagnostic){D=!0;let ce=G.diagnostic;v.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:ce.stage,category:ce.category,httpStatus:ce.category==="http"?ce.httpStatus:void 0})+`
+`)}l.onEvent?.(G)}};try{if(e[0]==="__preview-probe"){if(e.length!==1||pt(l.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await su()}if(e[0]==="attach"||e[0]==="__ssh-bootstrap"||e[0]==="__ssh-reverse"){if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(e[0]==="attach")return await Qd(e.slice(1),l);if(e.length!==1)throw Error("worker_unknown_or_duplicate_flag");if(e[0]==="__ssh-reverse")return await au();return await Jd(l)}if(e[0]==="__update-restart"){let he=e.length===4&&e[3]==="--changed";if(e[1]!=="--config"||!e[2]||e.length!==3&&!he)throw Error("worker_unknown_or_duplicate_flag");if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");let Se=x.parse(JSON.parse(m(e[2]))),Re=await pi(Se,he?void 0:g);return v.stdout.write(JSON.stringify(Re)+`
+`),Re.state==="current"?3:Re.state==="busy"?75:0}if(e[0]==="standby")return await gw(e,l,re,z);let G=fw(e);if(!G)return v.stdout.write(uw),0;if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux","win32"].includes(process.platform))throw Error("worker_platform_unsupported");let ce=x.parse(JSON.parse(m(G.configPath))),we=(he)=>v.stdout.write(JSON.stringify(he)+`
+`),te=S(ce);if(G.action==="status"||G.action==="doctor"){let he=await St(ce,"status"),Se=ft(ce),Re={enrolled:!!te||!!he,deviceId:te?.deviceId??he?.deviceId??null,lifetime:ce.lifetime,expired:te||he?Date.parse(te?.worker?.expiresAt??he.expiresAt)<=Date.now():null,drained:Se.drained,revoked:Se.revoked,live:he};if(G.action==="status")return we(Re),0;let Ee=!0;try{Or(ce)}catch{Ee=!1}return we({...Re,workspace:Ee,platform:process.platform,executionMode:ce.executionMode,proofStorage:ce.lifetime==="ephemeral"?"process-memory":te&&xt(ce)instanceof mt?"login-keychain":"owner-only-file",confinement:ce.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:he?.supportedOperations?"live-worker":"unavailable",reportedOperations:he?.supportedOperations??null,capabilityReadiness:he?.capabilityReadiness??null,ready:he?.executionEligible===!0&&!Re.expired}),Ee&&(te||he)&&!Re.revoked&&!Re.expired?0:1}if(["drain","resume","stop"].includes(G.action)){let he=G.action==="drain"?"drain":G.action==="resume"?"resume":"stop",Se=await St(ce,he);if(Se){if(we(Se),he==="stop"&&ce.lifetime==="ephemeral"&&!G.json)v.stderr.write(yw);return 0}}b(p(ce),!0);let X=await wu(ce,()=>{if(!G.json)v.stderr.write(`Waiting for the previous worker to stop\u2026
+`)});try{if(G.action==="start")z("lock_acquired");let he=S(ce);if(["drain","resume","stop"].includes(G.action)){if(!he)throw Error("worker_not_enrolled");let Se=ft(ce);if(Se.revoked||Date.parse(he.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(G.action!=="stop")qt(ce,{...Se,drained:G.action==="drain"});return we({running:!1,drained:G.action==="stop"?Se.drained:G.action==="drain"}),0}if(G.action==="enroll"){if(ce.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let Se=G.enrollmentPath,Re=!Se&&ft(ce).revoked;if(he&&!Re)throw Error("worker_already_enrolled");Or(ce);let Ee=()=>{Zt(ce),wc(ce)};if(Re)Ee();let Oe=async()=>{let Te=Yo(ce),We=Se?await la(ce,Se,Te,l.enroll):await hu(ce,G.credentialPath,l,Te);return{proof:Te,enrolled:We}},{proof:Me,enrolled:Ce}=await Oe().catch((Te)=>{if(Se||!(Te instanceof Rr)||!Te.deviceRemoved)throw Te;return Ee(),Oe()});return ae(Ce,f(ce).state,{proofStore:Me}),qt(ce,{version:1,drained:!1,revoked:!1}),we({enrolled:!0,deviceId:Ce.deviceId,lifetime:ce.lifetime}),0}if(G.action==="revoke"){if(!he)throw Error("worker_not_enrolled");let Se=xt(ce),Re=new ar(ye(ce.apiOrigin),oe(ce.proxy),Se);if(qt(ce,{version:1,drained:!0,revoked:!0}),l.revoke)await l.revoke(he,Re);else await Re.disconnect(he,AbortSignal.timeout(30000));return Zt(ce),we({revoked:!0,localKeyRemoved:!0}),0}if(Or(ce),ce.lifetime==="ephemeral"){if(he)throw Error("worker_ephemeral_requires_fresh_enrollment");await gu(ce,X.owner.nonce,z,re,async(Se)=>G.enrollmentPath?la(ce,G.enrollmentPath,Se,l.enroll):hu(ce,void 0,l,Se,"worker_ephemeral_enrollment_required"))}else{if(G.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!he)throw Error("worker_not_enrolled");if(ft(ce).revoked)M=!0;await Wo(ce,he,xt(ce),X.owner.nonce,re)}return 0}finally{X.release()}}catch(G){let ce=G instanceof Error&&(G.message==="worker_revoked"||!D&&/^worker_[a-z_]+$/.test(G.message))?G.message:"worker_command_failed";v.stderr.write(`Reason worker: ${ce}.
+`);let we=e.includes("--json")?void 0:Mn(G instanceof Rr&&G.deviceRemoved?"worker_enrollment_device_removed":ce);if(we)v.stderr.write(`${we}
+`);return ce==="worker_revoked"&&M?0:1}}var ww=60000;async function wu(e,l){let v=Date.now()+e.shutdownGraceMs+ww,D=!1;for(;;){let M=ie({path:f(e).lock,runtimeVersion:g});if(M.acquired)return M;let L=await St(e,"status").catch(()=>null);if(!(L?L.phase==="stopping":D)||Date.now()>=v)throw Error("worker_already_running_or_lifecycle_busy");if(!D)D=!0,l();await new Promise((re)=>setTimeout(re,250))}}var yw='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function hu(e,l,v,D,M="worker_session_login_required"){if(v.enrollmentInput&&!l){let G=performance.now();return Er(e,await v.enrollmentInput(e),D,v.enroll,G)}let L=l??jr(e),z=await(v.enrollmentCredentials??qr)(e,L);if(!z)throw Error(M);let re=v.createTicketClient?.(z)??new me(z,{credentialsPath:L,fetchImpl:oe(e.proxy)});return gc(e,z,re,D,v.enroll)}import{spawn as _w}from"child_process";import{readFileSync as bw,unlinkSync as kw}from"fs";import{join as vw}from"path";var Sw=120,Rw=15,Ew=5000;function Fi(e={}){let l=e.stateDirectory?vw(e.stateDirectory,Pw):null;if(l)Cw(l);let v=Y();if(!v)return null;let D=process.platform==="win32",M=Math.max(1,Math.floor(e.limitSeconds??Sw)),L=e.pid??process.pid,z=Math.min(Rw,M),re=l?`printf '%s %s %s\\n' "$(date +%s)" ${M+z} ${yu(g)} > ${yu(l)} 2>/dev/null
+`:"",G=(Se)=>`[ $((SECONDS - started)) -ge ${Math.max(1,Se-1)} ]`,ce=D?":":`[ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${L}" ]`,we=D?`"$SYSTEMROOT/System32/taskkill.exe" /PID ${L} /F >/dev/null`:`kill -KILL ${L}`,te=`parent_is_worker() { ${ce}; }
 while :; do started=$SECONDS
 IFS= read -r -t ${M} pulse && continue
 ${G(M)} && parent_is_worker || exit 0
@@ -164,8 +164,8 @@ if ${G(z)} && parent_is_worker; then
   ${re}${we}
 fi
 exit 0
-done`,X=_w(v,["-c",te],{stdio:["pipe","ignore","inherit"],windowsHide:!0,...O?{env:{...process.env,MSYS_NO_PATHCONV:"1"}}:{}});X.on("error",()=>{}),X.stdin.on("error",()=>{});let he=setInterval(()=>X.stdin.write(`
-`),Math.min(Ew,M*1000/4));return he.unref(),X.unref(),{stop(){clearInterval(he),X.stdin.end()}}}var Pw="worker-stalled";function yu(e){return`'${e.replaceAll("'","'\\''")}'`}function Cw(e){let l;try{l=bw(e,"utf8"),kw(e)}catch{return}let v=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(l);if(!v)return;try{N(Nt(),{event:"worker.previous_exit",runtime_version:v[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(v[2])*1000)},{now:()=>new Date(Number(v[1])*1000)})}catch{}}var Mw=`Share this computer as a machine
+done`,X=_w(v,["-c",te],{stdio:["pipe","ignore","inherit"],windowsHide:!0,...D?{env:{...process.env,MSYS_NO_PATHCONV:"1"}}:{}});X.on("error",()=>{}),X.stdin.on("error",()=>{});let he=setInterval(()=>X.stdin.write(`
+`),Math.min(Ew,M*1000/4));return he.unref(),X.unref(),{stop(){clearInterval(he),X.stdin.end()}}}var Pw="worker-stalled";function yu(e){return`'${e.replaceAll("'","'\\''")}'`}function Cw(e){let l;try{l=bw(e,"utf8"),kw(e)}catch{return}let v=/^(\d{1,12}) (\d{1,6}) ([0-9A-Za-z.+-]{1,64})\n?$/.exec(l);if(!v)return;try{N(Lt(),{event:"worker.previous_exit",runtime_version:v[3],reason_code:"worker_event_loop_stalled",duration_ms:Math.min(86400000,Number(v[2])*1000)},{now:()=>new Date(Number(v[1])*1000)})}catch{}}var Mw=`Share this computer as a machine
 
 Usage:
   reason serve                     This computer, signed in (machine name: its hostname)
@@ -208,29 +208,29 @@ the worker unless --sandbox is set. Settings live in
 ~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
 folder served for NAME is its own worker. Use
 \`reason worker status|revoke --config <that file>\` for advanced control.
-`,Tw=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,Lw=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,bu="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",_u=["REASON_TOKEN","REASON_MACHINE_TOKEN"],ku="my-computer";function Ns(e){let l=(e.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return l&&bo(l)&&l!==ui?l:ku}class gt extends Error{}function Ww(e,l){let v,O=new Map,M=new Set;for(let ce=0;ce<e.length;ce+=1){let we=e[ce];if(we==="--help"||we==="-h"||we==="help")return null;if(we==="--dir"||we==="--token"||we==="--org"){let te=e[ce+1];if(!te||te.startsWith("-"))throw new gt(`Missing value after ${we}.`);if(O.has(we))throw new gt(`${we} may be specified only once.`);O.set(we,te),ce+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(we)){M.add(we==="-y"?"--yes":we);continue}if(we.startsWith("-"))throw new gt(`Unknown option: ${we}. Run \`reason serve --help\`.`);if(v!==void 0)throw new gt("Expected one machine NAME.");v=we}let L=M.has("--stop");if(v===void 0&&L)throw new gt("Missing machine NAME. Usage: reason stop NAME");if(v!==void 0){if(!bo(v)&&!Tw.test(v))throw new gt(bu);if(v.toLowerCase()===ui)throw new gt(`"${ui}" is reserved for Reason's cloud. Choose another NAME.`)}if(L&&(O.size>0||[...M].some((ce)=>ce!=="--stop"&&ce!=="--json")))throw new gt("--stop takes only NAME and --json.");if(!L&&M.has("--json"))throw new gt("--json is only used with --stop.");if(M.has("--service")&&M.has("--once"))throw new gt("--service keeps the worker running; it cannot be combined with --once.");let z=L?void 0:O.get("--token")??l,re=O.get("--org");if(z!==void 0){if(!z.startsWith("rmt_"))throw new gt("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(re!==void 0&&!Lw.test(re))throw new gt("--org must be a workspace id.")}else if(re!==void 0)throw new gt("--org is only used with --token.");let G=O.get("--dir");return{...v===void 0?{}:{name:v},...G===void 0?{}:{dir:G},once:M.has("--once"),sandbox:M.has("--sandbox"),yes:M.has("--yes"),stop:L,json:M.has("--json"),service:M.has("--service"),...z===void 0?{}:{token:z},...re===void 0?{}:{org:re.toLowerCase()}}}function zi(e,l){let v=Dw(e,l??"."),O;try{O=process.platform==="win32"?Ws.native(v):Ws(v)}catch{throw new gt(`Folder not found: ${v}`)}if(!Iw(O).isDirectory())throw new gt(`Not a folder: ${O}`);return O}var qi=(e)=>Cn(e,".reason","workers"),Ts=(e)=>u(f(e).state);function Nw(e,l,v){let O=Cn(qi(e),l);if(Z(Cn(O,"worker.json"))?.workspaceRoot===v)return O;return Cn(qi(e),`${l}@${Aw("sha256").update(v).digest("hex").slice(0,8)}`)}function vu(e){let{stateDirectory:l}=e;if(se(e.workspaceRoot,l)||se(l,e.workspaceRoot))throw new gt(`${e.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return x.parse({version:1,apiOrigin:e.apiOrigin,channel:e.channel,stateDirectory:l,workspaceRoot:e.workspaceRoot,lifetime:e.once?"ephemeral":"persistent",executionMode:e.sandbox?"confined":"host",name:e.name})}function Z(e){if(!u(e))return null;let l=new gt(`${e} is not a valid worker config. Remove it to start over.`),v;try{v=JSON.parse(m(e))}catch(M){if(M instanceof SyntaxError)throw l;throw M}let O=x.safeParse(v);if(!O.success)throw l;return O.data}function Ls(e){return[`--dir ${e.workspaceRoot}`,...e.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function Hw(e,l){e.stdout.write(`${l} [y/N] `);let v=await wa(e.stdin,new AbortController().signal);return/^(y|yes)$/i.test(v?.trim()??"")}function Ki(e){return{write(l){if(l.startsWith('{"event":"worker.startup"'))return!0;return e.write(l)}}}var $w={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function Su(e){try{return await e()}catch(l){let v=l instanceof C?$w[l.code]:void 0;throw v?Error(v):l}}async function Bw(e,l,v,O){let M=vu({...l,name:e.name??ku,stateDirectory:Cn(qi(v),".token-enrollment")}),L=Qr(M,{stored:!1}),z=await Su(()=>eo({apiOrigin:M.apiOrigin,token:e.token,body:L.request,...O.fetchImpl?{fetchImpl:O.fetchImpl}:{}}));if(!bo(z.machine_name))throw Error("worker_ticket_receipt_mismatch");if(e.name!==void 0&&e.name.toLowerCase()!==z.machine_name.toLowerCase())throw new gt(`This token is for machine "${z.machine_name}", not "${e.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if(e.org!==void 0&&e.org!==z.organization_id.toLowerCase())throw new gt(`This token is for workspace ${z.organization_id}, not ${e.org}. Drop --org; the token names its workspace.`);let re=!1;return{name:e.name??z.machine_name,input:(G)=>{if(re)throw Error("worker_ticket_receipt_mismatch");return re=!0,L.saveInstall(G),L.complete(z.organization_id,z)}}}function Uw(e,l,v,O){return async(M)=>{if(l)return l.input(M);let L=await(v.worker?.enrollmentCredentials??zr)(M);if(!L)throw Error("worker_session_login_required");let z=(v.createApi??((re)=>new me(re)))(L);return wc(M,L,{createHeadlessDeviceEnrollmentTicket:(re)=>Su(async()=>{try{return await z.createMachineEnrollmentTicket(e,re)}catch(G){if(!(G instanceof C)||G.code!=="machine_not_found")throw G}try{await z.createMachine({name:e}),O.stdout.write(`Created machine "${e}".
-`)}catch(G){if(!(G instanceof C)||G.status!==409)throw G}return z.createMachineEnrollmentTicket(e,re)})})}}async function Ru(e,l,v,O){let M=await gi(e,O,()=>Jo(e,l,v));if(M.state==="current"||M.state==="busy")return M;if(!Ie(e,l,v))return null;return Ta(e),M}function Hs(e,l){let v=qi(e);if(!u(v))return[];let O=l.toLowerCase();return xw(v).sort().flatMap((M)=>{let L=M.toLowerCase();if(L!==O&&!L.startsWith(`${O}@`))return[];let z=Cn(v,M,"worker.json"),re=Z(z);return re?[{path:z,config:re}]:[]})}async function Fw(e,l,v,O,M){let L=Hs(l,e.name);if(L.length===0)throw new gt(`No worker for machine "${e.name}" on this computer.`);let z=O.controlWorker??Rt,re=[];for(let G of L){let ce=await z(G.config,"stop")!==null,we=Sn(G.config,M),te=ce||we!==null;if(re.push({config:G.path,folder:G.config.workspaceRoot,running:te,service:we?.label??null}),!e.json&&we)v.stdout.write(`Removed background service ${we.label} (${G.config.workspaceRoot}); it won't start again.
+`,Tw=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,Lw=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,bu="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",_u=["REASON_TOKEN","REASON_MACHINE_TOKEN"],ku="my-computer";function Ls(e){let l=(e.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return l&&yo(l)&&l!==li?l:ku}class gt extends Error{}function Ww(e,l){let v,D=new Map,M=new Set;for(let ce=0;ce<e.length;ce+=1){let we=e[ce];if(we==="--help"||we==="-h"||we==="help")return null;if(we==="--dir"||we==="--token"||we==="--org"){let te=e[ce+1];if(!te||te.startsWith("-"))throw new gt(`Missing value after ${we}.`);if(D.has(we))throw new gt(`${we} may be specified only once.`);D.set(we,te),ce+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(we)){M.add(we==="-y"?"--yes":we);continue}if(we.startsWith("-"))throw new gt(`Unknown option: ${we}. Run \`reason serve --help\`.`);if(v!==void 0)throw new gt("Expected one machine NAME.");v=we}let L=M.has("--stop");if(v===void 0&&L)throw new gt("Missing machine NAME. Usage: reason stop NAME");if(v!==void 0){if(!yo(v)&&!Tw.test(v))throw new gt(bu);if(v.toLowerCase()===li)throw new gt(`"${li}" is reserved for Reason's cloud. Choose another NAME.`)}if(L&&(D.size>0||[...M].some((ce)=>ce!=="--stop"&&ce!=="--json")))throw new gt("--stop takes only NAME and --json.");if(!L&&M.has("--json"))throw new gt("--json is only used with --stop.");if(M.has("--service")&&M.has("--once"))throw new gt("--service keeps the worker running; it cannot be combined with --once.");let z=L?void 0:D.get("--token")??l,re=D.get("--org");if(z!==void 0){if(!z.startsWith("rmt_"))throw new gt("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(re!==void 0&&!Lw.test(re))throw new gt("--org must be a workspace id.")}else if(re!==void 0)throw new gt("--org is only used with --token.");let G=D.get("--dir");return{...v===void 0?{}:{name:v},...G===void 0?{}:{dir:G},once:M.has("--once"),sandbox:M.has("--sandbox"),yes:M.has("--yes"),stop:L,json:M.has("--json"),service:M.has("--service"),...z===void 0?{}:{token:z},...re===void 0?{}:{org:re.toLowerCase()}}}function qi(e,l){let v=Dw(e,l??"."),D;try{D=process.platform==="win32"?Ts.native(v):Ts(v)}catch{throw new gt(`Folder not found: ${v}`)}if(!Iw(D).isDirectory())throw new gt(`Not a folder: ${D}`);return D}var ji=(e)=>Sn(e,".reason","workers"),Ds=(e)=>u(f(e).state);function Nw(e,l,v){let D=Sn(ji(e),l);if(Z(Sn(D,"worker.json"))?.workspaceRoot===v)return D;return Sn(ji(e),`${l}@${Aw("sha256").update(v).digest("hex").slice(0,8)}`)}function vu(e){let{stateDirectory:l}=e;if(se(e.workspaceRoot,l)||se(l,e.workspaceRoot))throw new gt(`${e.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return x.parse({version:1,apiOrigin:e.apiOrigin,channel:e.channel,stateDirectory:l,workspaceRoot:e.workspaceRoot,lifetime:e.once?"ephemeral":"persistent",executionMode:e.sandbox?"confined":"host",name:e.name})}function Z(e){if(!u(e))return null;let l=new gt(`${e} is not a valid worker config. Remove it to start over.`),v;try{v=JSON.parse(m(e))}catch(M){if(M instanceof SyntaxError)throw l;throw M}let D=x.safeParse(v);if(!D.success)throw l;return D.data}function Ms(e){return[`--dir ${e.workspaceRoot}`,...e.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function Hw(e,l){e.stdout.write(`${l} [y/N] `);let v=await Aa(e.stdin,new AbortController().signal);return/^(y|yes)$/i.test(v?.trim()??"")}function zi(e){return{write(l){if(l.startsWith('{"event":"worker.startup"'))return!0;return e.write(l)}}}var $w={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function Su(e){try{return await e()}catch(l){let v=l instanceof C?$w[l.code]:void 0;throw v?Error(v):l}}async function Bw(e,l,v,D){let M=vu({...l,name:e.name??ku,stateDirectory:Sn(ji(v),".token-enrollment")}),L=Kr(M,{stored:!1}),z=await Su(()=>no({apiOrigin:M.apiOrigin,token:e.token,body:L.request,...D.fetchImpl?{fetchImpl:D.fetchImpl}:{}}));if(!yo(z.machine_name))throw Error("worker_ticket_receipt_mismatch");if(e.name!==void 0&&e.name.toLowerCase()!==z.machine_name.toLowerCase())throw new gt(`This token is for machine "${z.machine_name}", not "${e.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if(e.org!==void 0&&e.org!==z.organization_id.toLowerCase())throw new gt(`This token is for workspace ${z.organization_id}, not ${e.org}. Drop --org; the token names its workspace.`);let re=!1;return{name:e.name??z.machine_name,input:(G)=>{if(re)throw Error("worker_ticket_receipt_mismatch");return re=!0,L.saveInstall(G),L.complete(z.organization_id,z)}}}function Uw(e,l,v,D){return async(M)=>{if(l)return l.input(M);let L=await(v.worker?.enrollmentCredentials??qr)(M);if(!L)throw Error("worker_session_login_required");let z=(v.createApi??((re)=>new me(re)))(L);return hc(M,L,{createHeadlessDeviceEnrollmentTicket:(re)=>Su(async()=>{try{return await z.createMachineEnrollmentTicket(e,re)}catch(G){if(!(G instanceof C)||G.code!=="machine_not_found")throw G}try{await z.createMachine({name:e}),D.stdout.write(`Created machine "${e}".
+`)}catch(G){if(!(G instanceof C)||G.status!==409)throw G}return z.createMachineEnrollmentTicket(e,re)})})}}async function Ru(e,l,v,D){let M=await pi(e,D,()=>ns(e,l,v));if(M.state==="current"||M.state==="busy")return M;if(!Ie(e,l,v))return null;return ka(e),M}function Ws(e,l){let v=ji(e);if(!u(v))return[];let D=l.toLowerCase();return xw(v).sort().flatMap((M)=>{let L=M.toLowerCase();if(L!==D&&!L.startsWith(`${D}@`))return[];let z=Sn(v,M,"worker.json"),re=Z(z);return re?[{path:z,config:re}]:[]})}async function Fw(e,l,v,D,M){let L=Ws(l,e.name);if(L.length===0)throw new gt(`No worker for machine "${e.name}" on this computer.`);let z=D.controlWorker??St,re=[];for(let G of L){let ce=await z(G.config,"stop")!==null,we=xn(G.config,M),te=ce||we!==null;if(re.push({config:G.path,folder:G.config.workspaceRoot,running:te,service:we?.label??null}),!e.json&&we)v.stdout.write(`Removed background service ${we.label} (${G.config.workspaceRoot}); it won't start again.
 `);if(!e.json)v.stdout.write(te?`Stopping machine "${e.name}" in ${G.config.workspaceRoot}; current work finishes first.
 `:`Machine "${e.name}" in ${G.config.workspaceRoot} is not running.
 `)}if(e.json)v.stdout.write(`${JSON.stringify({machine:e.name,workers:re})}
-`);return 0}async function Eu(e,l={}){let v=l.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},O=l.runWorker??Nr,M=l.env??process.env,L=_u.map((z)=>M[z]?.trim()).find(Boolean)||void 0;if(!l.env)for(let z of _u)delete process.env[z];try{let z=Ww(e,L);if(!z)return v.stdout.write(Mw),0;let re=Ws(l.home??s()),G=l.serviceHost??de(re);if(z.stop)return await Fw({...z,name:z.name},re,v,l,G);let ce=l.channel??w(),we=zi(l.cwd??process.cwd(),z.dir),te=z.service?Ue(G,M):void 0,X={channel:ce,apiOrigin:lt(M,ce),workspaceRoot:we,once:z.once,sandbox:z.sandbox},he=z.token?await Bw({...z,token:z.token},X,re,l):void 0,Se=he?.name??z.name??Ns((l.hostname??Ow)()),Re=Nw(re,Se,we),Ee=Cn(Re,"worker.json"),Oe=Z(Ee);if(he&&Oe&&Ts(Oe)&&pt(Oe).revoked)Zt(Oe);let Me=!he&&Oe!==null&&Ts(Oe)&&(!P(M,"REASON_API_URL")?.trim()||W(X.apiOrigin,Oe.apiOrigin))?Oe.apiOrigin:void 0,Ce=vu({...X,...Me?{apiOrigin:Me}:{},name:Se,stateDirectory:Re}),Te=Oe!==null&&Ts(Oe);if(Te&&D(Oe)!==D(Ce)){if(Ce.lifetime==="ephemeral")throw new gt(`Machine "${Se}" is already saved for this folder; --once needs another folder or NAME.`);throw new gt(`Machine "${Se}" is already set up with different settings (${Oe.workspaceRoot}, ${Oe.executionMode==="host"?"your user permissions":"sandboxed"}).
-Run it with: reason serve ${Se} ${Ls(Oe)}
-Or remove it first: reason worker revoke --config ${Ee}`)}let We=Ce.lifetime==="persistent"?ze(Ce,G):null;if(We&&!z.service&&M[ke]!==We.label)return v.stdout.write(`Machine "${Se}" in ${we} already runs as a background service (${We.label}).
+`);return 0}async function Eu(e,l={}){let v=l.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},D=l.runWorker??Tr,M=l.env??process.env,L=_u.map((z)=>M[z]?.trim()).find(Boolean)||void 0;if(!l.env)for(let z of _u)delete process.env[z];try{let z=Ww(e,L);if(!z)return v.stdout.write(Mw),0;let re=Ts(l.home??s()),G=l.serviceHost??de(re);if(z.stop)return await Fw({...z,name:z.name},re,v,l,G);let ce=l.channel??w(),we=qi(l.cwd??process.cwd(),z.dir),te=z.service?ze(G,M):void 0,X={channel:ce,apiOrigin:ut(M,ce),workspaceRoot:we,once:z.once,sandbox:z.sandbox},he=z.token?await Bw({...z,token:z.token},X,re,l):void 0,Se=he?.name??z.name??Ls((l.hostname??Ow)()),Re=Nw(re,Se,we),Ee=Sn(Re,"worker.json"),Oe=Z(Ee);if(he&&Oe&&Ds(Oe)&&ft(Oe).revoked)Zt(Oe);let Me=!he&&Oe!==null&&Ds(Oe)&&(!R(M,"REASON_API_URL")?.trim()||W(X.apiOrigin,Oe.apiOrigin))?Oe.apiOrigin:void 0,Ce=vu({...X,...Me?{apiOrigin:Me}:{},name:Se,stateDirectory:Re}),Te=Oe!==null&&Ds(Oe);if(Te&&O(Oe)!==O(Ce)){if(Ce.lifetime==="ephemeral")throw new gt(`Machine "${Se}" is already saved for this folder; --once needs another folder or NAME.`);throw new gt(`Machine "${Se}" is already set up with different settings (${Oe.workspaceRoot}, ${Oe.executionMode==="host"?"your user permissions":"sandboxed"}).
+Run it with: reason serve ${Se} ${Ms(Oe)}
+Or remove it first: reason worker revoke --config ${Ee}`)}let We=Ce.lifetime==="persistent"?qe(Ce,G):null;if(We&&!z.service&&M[ke]!==We.label)return v.stdout.write(`Machine "${Se}" in ${we} already runs as a background service (${We.label}).
   Logs: ${We.logs}
   Stop it with: reason stop ${Se}
-`),0;if(z.service&&Te&&!We&&await(l.controlWorker??Rt)(Ce,"status")!==null)throw new gt(`Machine "${Se}" is already running in ${we}. Stop it first (Ctrl-C, or reason stop ${Se}), then run this again.`);let $e=Ce.lifetime==="ephemeral"||!Te;if($e&&!bo(Se))throw new gt(bu);if(Ce.executionMode==="confined")v.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
+`),0;if(z.service&&Te&&!We&&await(l.controlWorker??St)(Ce,"status")!==null)throw new gt(`Machine "${Se}" is already running in ${we}. Stop it first (Ctrl-C, or reason stop ${Se}), then run this again.`);let $e=Ce.lifetime==="ephemeral"||!Te;if($e&&!yo(Se))throw new gt(bu);if(Ce.executionMode==="confined")v.stderr.write(`Note: sandboxed machines can't host sessions yet. Drop --sandbox to run sessions here.
 `);else if($e&&!z.yes&&!he){let xe=`Sessions on "${Se}" will run commands in ${we} with your user permissions (no sandbox). Continue?`,Le=Boolean(v.stdin&&v.stdinIsTty);if(!l.confirm&&!Le)throw new gt(`${xe.replace(/ Continue\?$/,"")}
 Re-run with --yes to confirm.`);if(!await(l.confirm??((Ge)=>Hw(v,Ge)))(xe))return v.stderr.write(`Cancelled. Nothing was added.
-`),1}if(!Te)b(Ce.stateDirectory,!0),y(Ee,Ce);let Fe={...l.worker,enrollmentInput:Uw(Se,he,l,v)};if(Ce.lifetime==="persistent"&&!Te){v.stdout.write(`Adding this computer to machine "${Se}"\u2026
-`);let Le=await O(["enroll","--config",Ee],{...Fe,io:{stdout:{write:()=>!0},stderr:v.stderr}});if(Le!==0)return Le}if(te){let xe;try{xe=vn({config:Ce,launcher:te,path:M.PATH||"/usr/local/bin:/usr/bin:/bin",host:G})}catch(Le){if(!(Le instanceof j))throw Le;throw new gt(`${Le.message}
-This computer is added to machine "${Se}". Run it in this terminal with: reason serve ${Se} ${Ls(Ce)}
-Or try the background service again with: reason serve ${Se} ${Ls(Ce)} --service`)}return v.stdout.write([`Reason machine "${Se}" runs in the background`,`  Folder:   ${we}`,`  Mode:     ${Ce.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${xe.label} (starts at ${xe.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${xe.logs}`,`Start a session with: reason "\u2026" --on ${Se}`,`Stop it with: reason stop ${Se}`,...xe.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
+`),1}if(!Te)b(Ce.stateDirectory,!0),y(Ee,Ce);let Ue={...l.worker,enrollmentInput:Uw(Se,he,l,v)};if(Ce.lifetime==="persistent"&&!Te){v.stdout.write(`Adding this computer to machine "${Se}"\u2026
+`);let Le=await D(["enroll","--config",Ee],{...Ue,io:{stdout:{write:()=>!0},stderr:v.stderr}});if(Le!==0)return Le}if(te){let xe;try{xe=kn({config:Ce,launcher:te,path:M.PATH||"/usr/local/bin:/usr/bin:/bin",host:G})}catch(Le){if(!(Le instanceof j))throw Le;throw new gt(`${Le.message}
+This computer is added to machine "${Se}". Run it in this terminal with: reason serve ${Se} ${Ms(Ce)}
+Or try the background service again with: reason serve ${Se} ${Ms(Ce)} --service`)}return v.stdout.write([`Reason machine "${Se}" runs in the background`,`  Folder:   ${we}`,`  Mode:     ${Ce.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${xe.label} (starts at ${xe.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${xe.logs}`,`Start a session with: reason "\u2026" --on ${Se}`,`Stop it with: reason stop ${Se}`,...xe.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
 `)),0}v.stdout.write([`Reason machine "${Se}"`,`  Folder:   ${we}`,`  Mode:     ${Ce.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Lifetime: ${Ce.lifetime==="persistent"?`saved; run \`reason serve ${Se}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
-`));let Ne=We&&M[ke]===We.label&&!l.runWorker?ji({stateDirectory:Ce.stateDirectory}):null;try{return await O(["start","--config",Ee],{...Fe,io:{stdout:v.stdout,stderr:Ki(v.stderr)},onStartup:(xe)=>{if(xe==="ready")v.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${Se}
+`));let Ne=We&&M[ke]===We.label&&!l.runWorker?Fi({stateDirectory:Ce.stateDirectory}):null;try{return await D(["start","--config",Ee],{...Ue,io:{stdout:v.stdout,stderr:zi(v.stderr)},onStartup:(xe)=>{if(xe==="ready")v.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${Se}
 `);l.worker?.onStartup?.(xe)}})}finally{Ne?.stop()}}catch(z){if(z instanceof gt||z instanceof j){let ce=z instanceof j&&z.code?` (${z.code})`:"";return v.stderr.write(`Reason: ${z.message}${ce}
-`),2}let re=z instanceof Error&&/^worker_[a-z_]+$/.test(z.message)?z.message:null,G=re?Ln(re):void 0;return v.stderr.write(`Reason: ${re?G?`${G} (${re})`:re:"could not prepare this machine."}
-`),1}}var jw=200;var YC=h({version:i(1),session_ids:d(t().min(1).max(200)).max(jw)});function to(e){let l=S(e);return l!==null&&Date.parse(l.worker?.expiresAt??"")>Date.now()&&!pt(e).revoked}import{spawnSync as Pu}from"child_process";import{readFileSync as qw,rmdirSync as zw,rmSync as Kw}from"fs";import{join as $s}from"path";var Vw=["Reason.app","Ara Sidecar.app","Ara Device.app"],Jw="sidecar_retire_failed";function Gw(e){return $s(e,"Library","Application Support","Ara","Sidecar")}function Yw(e){try{let l=qw($s(e,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(l)}catch{return!1}}function Cu(e,l={}){let v=Gw(e),O=Vw.map((re)=>$s(v,re)).filter(Yw);if(O.length===0)return{status:"absent"};let M=l.processTable??(()=>Pu("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),L=l.signal??((re)=>process.kill(re,"SIGTERM")),z=l.command??((re,G)=>Pu(re,[...G],{stdio:"ignore",timeout:1e4}).status??1);try{for(let re of M().split(`
-`)){let G=re.trim().match(/^(\d+)\s+(.+)$/);if(!G)continue;if(!O.some((ce)=>G[2].startsWith(`${ce}/Contents/MacOS/`)))continue;try{L(Number(G[1]))}catch{}}for(let re of O)z(Tn,["-u",re]),Kw(re,{recursive:!0,force:!0});try{zw(v)}catch{}}catch{return{status:"failed",code:Jw}}return{status:"removed",bundles:O}}var ny=`Connect this computer to Reason
+`),2}let re=z instanceof Error&&/^worker_[a-z_]+$/.test(z.message)?z.message:null,G=re?Mn(re):void 0;return v.stderr.write(`Reason: ${re?G?`${G} (${re})`:re:"could not prepare this machine."}
+`),1}}var jw=200;var YC=h({version:i(1),session_ids:d(t().min(1).max(200)).max(jw)});function Yn(e){let l=S(e);return l!==null&&Date.parse(l.worker?.expiresAt??"")>Date.now()&&!ft(e).revoked}import{spawnSync as Pu}from"child_process";import{readFileSync as qw,rmdirSync as zw,rmSync as Kw}from"fs";import{join as Ns}from"path";var Vw=["Reason.app","Ara Sidecar.app","Ara Device.app"],Jw="sidecar_retire_failed";function Gw(e){return Ns(e,"Library","Application Support","Ara","Sidecar")}function Yw(e){try{let l=qw(Ns(e,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(l)}catch{return!1}}function Cu(e,l={}){let v=Gw(e),D=Vw.map((re)=>Ns(v,re)).filter(Yw);if(D.length===0)return{status:"absent"};let M=l.processTable??(()=>Pu("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),L=l.signal??((re)=>process.kill(re,"SIGTERM")),z=l.command??((re,G)=>Pu(re,[...G],{stdio:"ignore",timeout:1e4}).status??1);try{for(let re of M().split(`
+`)){let G=re.trim().match(/^(\d+)\s+(.+)$/);if(!G)continue;if(!D.some((ce)=>G[2].startsWith(`${ce}/Contents/MacOS/`)))continue;try{L(Number(G[1]))}catch{}}for(let re of D)z(On,["-u",re]),Kw(re,{recursive:!0,force:!0});try{zw(v)}catch{}}catch{return{status:"failed",code:Jw}}return{status:"removed",bundles:D}}var ny=`Connect this computer to Reason
 
 Usage:
   reason connect                 Your computer, kept connected in the background
@@ -301,45 +301,45 @@ Usage:
                                  Reason (all of it when it is the only account here), and it is not kept
                                  disconnected: the next reason "\u2026" connects it again
   --yes, -y                      Accepted for scripts; disconnect never asks
-`;class ct extends Error{code;constructor(e,l="worker_connect_refused"){super(e);this.code=l}}var iy=4,Ji={write:()=>!0};function fe(e,l,v=!1){let O=Wu(e,l,v);return O.length===1?O[0]:Bt(yt(Bt(e,".config")),...Lu(l,v))}var Lu=(e,l)=>[...e==="production"?[]:[e],l?"connect-once":"connect"];function Wu(e,l,v=!1){let O=e;try{O=nn(e)}catch{}return["ara","reason"].map((M)=>Bt(O,".config",M,...Lu(l,v))).filter(ay)}function ay(e){try{if(nn(e)!==e)return!1;return Z(Bt(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var Nu="disconnected.json";function Xi(e,l){return u(Bt(fe(e,l),Nu))}function ea(e,l,v){let O=Bt(fe(e,l),Nu);if(!v){ro(O,{force:!0});return}b(js(O),!0),y(O,{version:1,disconnected_at:new Date().toISOString()})}function sy(e){let l=new Map,v=new Set;for(let te=0;te<e.length;te+=1){let X=e[te];if(X==="--help"||X==="-h"||X==="help")return null;if(["--to","--token","--folder","--sessions",Zn,Qn,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(X)){let he=e[te+1];if(!he||he.startsWith("-"))throw new ct(`Missing value after ${X}.`);if(l.has(X))throw new ct(`${X} may be specified only once.`);l.set(X,he),te+=1;continue}if(["--once","--yes","-y","--minimal"].includes(X)){v.add(X==="-y"?"--yes":X);continue}if(X.startsWith("-"))throw new ct(`Unknown option: ${X}. Run \`reason connect --help\`.`);throw new ct(`Unexpected argument: ${X}. To add this computer to a team machine, use --to ${X}.`)}let O=l.get("--sessions");if(O!==void 0&&!/^[1-4]$/.test(O))throw new ct("--sessions takes a number from 1 to 4.");if(l.has(Qn)&&!l.has(Zn))throw new ct("--proxy-ca-file requires --proxy.");let M=l.get("--keep-awake");if(M!==void 0&&!["on","off"].includes(M))throw new ct("--keep-awake takes on or off.");if(M!==void 0&&(l.size>1||[...v].some((te)=>te!=="--yes")))throw new ct("Run reason connect --keep-awake on|off on its own.");let L=["--add-folder","--remove-folder"].filter((te)=>l.has(te));if(L.length>0&&(l.size>1||[...v].some((te)=>te!=="--yes")))throw new ct(`Run reason connect ${L[0]} PATH on its own.`);let z=l.get("--user-chrome");if(z!==void 0&&z!=="on"&&z!=="off")throw new ct("--user-chrome takes on or off.");let re=l.get("--cloud-sessions");if(re!==void 0&&re!=="on"&&re!=="off")throw new ct("--cloud-sessions takes on or off.");let G=l.get("--local-logins");if(G!==void 0&&G!=="on"&&G!=="off")throw new ct("--local-logins takes on or off.");let ce=l.get("--name")?.trim();if(ce!==void 0&&(ce.length===0||ce.length>160))throw new ct("--name takes a name of 1 to 160 characters.");let we=(te,X)=>X===void 0?{}:{[te]:X};return{...we("to",l.get("--to")),...we("token",l.get("--token")),...we("folder",l.get("--folder")),...we("sessions",O===void 0?void 0:Number(O)),...we("keepAwake",M===void 0?void 0:M==="on"),...we("userChrome",z===void 0?void 0:z==="on"),...we("cloudSessions",re===void 0?void 0:re==="on"),...we("localLogins",G===void 0?void 0:G==="on"),once:v.has("--once"),yes:v.has("--yes"),minimal:v.has("--minimal"),...we("proxy",l.get(Zn)),...we("proxyCaFile",l.get(Qn)),...we("apiKey",l.get("--api-key")),...we("name",ce),...we("apiUrl",l.get("--api-url")),...we("addFolder",l.get("--add-folder")),...we("removeFolder",l.get("--remove-folder"))}}var rn=(e)=>u(f(e).state),Hu=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function $u(e){return e.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function Bu(e){let{parsed:l,saved:v}=e,O=v?.workspaceRoot??e.home;if(l.folder!==void 0)try{O=zi(e.options.cwd??process.cwd(),l.folder)}catch(re){throw new ct(re instanceof Error?re.message:String(re))}if(!ge(O,e.stateDirectory))throw new ct(`${O} holds Reason's own settings. Pick another folder with --folder.`);let M;try{M=l.apiUrl!==void 0?lt({REASON_API_URL:l.apiUrl},e.channel):v&&!P(e.environment,"REASON_API_URL")?.trim()?v.apiOrigin:lt(e.environment,e.channel)}catch(re){throw new ct(`${l.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${re instanceof Error?re.message:String(re)}`)}if(v&&M!==v.apiOrigin&&W(M,v.apiOrigin))M=v.apiOrigin;if(!vr(M)&&!kn(e.channel,M))throw new ct(`${M} is not the ${e.channel} Reason API this CLI connects to.`+(e.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let L=v?.proxy;if(l.proxy!==void 0)try{L=$a({proxyUrl:l.proxy,caFile:l.proxyCaFile},{home:e.home,statePath:e.stateDirectory})}catch(re){if(!(re instanceof K))throw re;throw new ct(re.message)}let z=(v?.folders??[]).filter((re)=>re!==O);return x.parse({...z.length?{folders:z}:{},version:1,apiOrigin:M,channel:e.channel,stateDirectory:e.stateDirectory,workspaceRoot:O,lifetime:e.lifetime,executionMode:"host",name:l.name??v?.name??Ns((e.options.hostname??ty)()),slots:l.sessions??v?.slots??iy,...L?{proxy:L}:{},...(l.userChrome??v?.userChrome)===void 0?{}:{userChrome:l.userChrome??v?.userChrome},...l.cloudSessions??v?.cloudSessions?{cloudSessions:!0}:{},...(l.localLogins??v?.localLogins)===void 0?{}:{localLogins:l.localLogins??v?.localLogins}})}function Uu(e,l){if(e.localLogins!==void 0||l)return e;return x.parse({...e,localLogins:!0})}async function qs(e,l,v,O,M){if(pt(e).revoked){if(rn(e))try{Zt(e)}catch{}Sa(e);let re=[];try{re=ey(p(e))}catch{}for(let G of re)if(G!=="workspaces")ro(Bt(p(e),G),{recursive:!0,force:!0})}else if(rn(e))Zt(e);b(e.stateDirectory,!0),y(l,e);let L=cy(v.stderr),z=await(O.runWorker??Nr)(["enroll","--config",l],{...zs(O.worker,M),io:{stdout:Ji,stderr:L}});if(z!==0)v.stderr.write(`Reason: this computer was not connected. (${L.code()??"worker_command_failed"})
-`);return z}function cy(e){let l=null;return{write:(v)=>{for(let O of v.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))l=O[1];return e.write(v)},code:()=>l}}function Fo(e,l,v){let O=ve(Q(xn("REASON_CLI_CHANNEL",l),e));return O&&W(O.apiOrigin,v.apiOrigin)?O.orgId.toLowerCase():null}async function ly(e,l,v,O){let{config:M,configPath:L}=oi(e,l),z=(ce)=>{try{return ce!==null&&to(ce)&&S(ce)?.orgId.toLowerCase()===l}catch{return!1}},re=null;try{re=Z(L)}catch{}if(z(re))return 0;v.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let G=await qs(M,L,v,O,void 0);if(G===0&&z(M))return 0;if(G===0&&rn(M))await ta(M,L,v,O);if(ro(M.stateDirectory,{recursive:!0,force:!0}),G!==0)return G;throw new ct("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function zs(e,l){return l?{...e,enrollmentCredentials:(v)=>sa(v,l)}:{...e}}async function Ks(e,l,v,O,M,L="connect"){if(await Vs(e,O,M,L),L==="connect"&&!await Ku(e,v,O))return!1;if(!await ta(e,l,v,O))return!1;return ac(e.stateDirectory),ro(e.stateDirectory,{recursive:!0,force:!0}),!0}async function ta(e,l,v,O){if(!rn(e)||pt(e).revoked)return!0;for(let M=1;;M+=1){let L=M===3;if(await(O.runWorker??Nr)(["revoke","--config",l],{...O.worker,io:{stdout:Ji,stderr:L?v.stderr:Ji}})===0)return!0;if(L)return!1;await new Promise((re)=>setTimeout(re,1000))}}async function Vs(e,l,v,O="connect",M=!1){let L=l.controlWorker??Rt,z=async()=>L(e,"status").catch(()=>null),re=await L(e,"stop").catch(()=>null)!==null,G=!M&&Sn(e,v,O);if(re||G){let ce=Date.now()+e.shutdownGraceMs+60000;while(Date.now()<ce&&await z()!==null)await new Promise((we)=>setTimeout(we,250))}}function Js(e,l){return l==="darwin"&&e.userChrome!==!1}function Bs(e,l,v){let O=[...Js(e,l)?["your own Chrome profiles"]:[],...e.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${e.name}" \xB7 Sessions run here, ${$u(e).replace(/^runs /,"")}`,...O.length>0?[`  Uses ${O.join(" and ")} (reason connect --help to change)`]:[],...v,""].join(`
-`)}function Fs(e,l,v,O){return[e,`  Name:      ${l.name}`,`  Folder:    ${l.workspaceRoot}`,...(l.folders??[]).map((M)=>`             ${M}`),"  Sessions:  every Session you start",`  Mode:      ${$u(l)}`,...l.proxy?[`  Proxy:     ${La(l.proxy)}`]:[],...Js(l,v)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...l.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...l.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...O,""].join(`
-`)}async function Au(e,l,v){let{io:O,options:M}=v;if(Wu(v.home,v.channel).length===2)O.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:js(l),timestamp:new Date().toISOString()})}
-`);let L=De(Bt(v.home,".config"));if(L.problem)O.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:L.problem,timestamp:new Date().toISOString()})}
-`);es(v.home,v.host.platform);let z=Wc({home:v.home,channel:v.channel,saved:e,configPath:l,log:(he)=>O.stderr.write(`${he}
-`),host:v.host}),re=Ic({...z,log:(he)=>O.stderr.write(`${he}
-`)}),{configPath:G}=re,ce=re.saved;if(!ce)return O.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let we=(he,Se)=>{let Re=Ys(v.home,v.channel),Ee;try{let Me=null;try{Me=Se.keep?null:S(ce)?.orgId.toLowerCase()??null}catch{}if(Ee=ai(ce,{prefer:Fo(v.home,v.channel,ce),...Se}),Ee&&Me)ii(Ee,Me)}finally{Re()}if(!Ee)return!1;ce=Ee;let Oe="";try{Oe=` (workspace ${S(Ee)?.orgId??"unknown"})`}catch{}return O.stderr.write(`Reason: ${he}; this computer goes on running Sessions for its other Reason account${Oe}.
-`),!0};if(pt(ce).revoked&&!we("this computer's connection was removed from Reason",{keep:!1}))return O.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(ce.executionMode==="confined"||!to(ce)){let he=lr(ce.stateDirectory)??void 0,Se=he?null:Fo(v.home,v.channel,ce);if(!he&&!(Se&&wo(ce,Se)))we("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let te=ce.executionMode==="confined";if(te||!to(ce)){let he=lr(ce.stateDirectory)??void 0;if(O.stderr.write(te?Hu:`Reason: this computer's connection expired; renewing it with ${he?"its API key":"your login"}\u2026
-`),await qs(x.parse({...ce,executionMode:"host"}),G,O,M,he)!==0)return O.stderr.write(he?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let X=new AbortController;if(!M.runWorker)import("./ask-relay-xx0rzpch.js").then(({runBackgroundAskRelay:he})=>he(X.signal,(Se)=>O.stderr.write(`${Se}
-`))).catch(()=>{});try{for(;;){let he=lr(ce.stateDirectory)===null?{ownerWorkspaces:M.worker?.ownerWorkspaces??{}}:{},Se=M.runWorker?null:ji({stateDirectory:ce.stateDirectory}),Re=!1,Ee;try{Ee=await(M.runWorker??Nr)(["start","--config",G],{deferOptionalLanes:!0,...M.worker,...he,ownComputer:!0,io:{stdout:O.stdout,stderr:O.stderr},onDeviceRevoked:()=>{Re=!0}})}finally{Se?.stop()}if(!Re)return Ee;if(!we("this computer's connection was removed from Reason",{keep:!1}))break}return ea(v.home,v.channel,!0),O.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{X.abort()}}async function dy(e,l,v){let{io:O,options:M,home:L,channel:z,environment:re}=v;if(l&&await(M.controlWorker??Rt)(l,"status").catch(()=>null))throw new ct("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=fe(L,z,!0),ce=Bu({parsed:e,saved:l,stateDirectory:G,lifetime:"ephemeral",home:L,channel:z,options:M,environment:re}),we=Uu(ce,v.apiKey??(l?lr(l.stateDirectory)??void 0:void 0)),te=Bt(G,"worker.json");return b(G,!0),y(te,we),O.stdout.write(Fs(`Reason: connecting "${we.name}" while this command runs`,we,v.host.platform,["Connecting\u2026"])),(M.runWorker??Nr)(["start","--config",te],{...zs(M.worker,v.apiKey),ownComputer:!0,io:{stdout:O.stdout,stderr:Ki(O.stderr)},onStartup:(X)=>{if(X==="ready")O.stdout.write(`Connected. Start Sessions on "${we.name}" from Reason. Press Ctrl-C to stop.
-`);M.worker?.onStartup?.(X)}})}function uy(e,l,v,O){if(v.platform!=="darwin")throw new ct("--keep-awake is for macOS.");if(!l)throw new ct("This computer is not connected to Reason. Run reason connect first.");b(p(l),!0),Bc(f(l).daemon,e);let M=nr(f(l).daemon)==="battery_and_ac";return O.stdout.write(`Keep awake: ${M?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var fy=n({root:n({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});async function Fu(e,l,v,O){let M=await(zs(O.worker,v).enrollmentCredentials??zr)(e,qr(e));if(!M)throw Error("worker_session_login_required");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let L=O.folderApi?.(M)??new me(M,{credentialsPath:qr(e),fetchImpl:oe(e.proxy)}),z=(re)=>re instanceof C&&re.status===404&&!["device_not_found","root_not_found"].includes(re.code);return{add:async(re)=>{let G=bc(e,re,{...l.roots[0].permissions,expose_mcp:!1}),ce=await L.addDeviceRoot(l.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((te)=>{if(z(te))throw Error("worker_folders_unavailable");if(te instanceof C&&te.code==="root_limit_reached")throw new ct("This computer already has the most folders Reason allows (32).");throw te}),we=fy.parse(ce).root;if(we.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:we.id,label:we.label}},remove:async(re)=>{await L.removeDeviceRoot(l.deviceId,re).catch((G)=>{if(z(G))throw Error("worker_folders_unavailable");if(!(G instanceof C&&G.code==="root_not_found"))throw G})}}}function ju(e,l,v){ae({...l,roots:v,handsSlots:e.slots,worker:{...l.worker,configDigest:D(e)}},f(e).state,{proofStore:xt(e)})}async function my(e,l,v,O){let{io:M,options:L,host:z}=O,re=l&&!O.apiKey&&lr(l.stateDirectory)===null?Fo(O.home,O.channel,l):null,G=l&&re&&rn(l)&&!wo(l,re)?Qt(l).find((xe)=>xe.account&&xe.organizationId===re)??null:void 0;if(G===null)throw new ct("This computer is not connected for your account. Run reason connect first.");let ce=G?G.config:l,we=G?G.configPath:v,te=ce&&rn(ce)&&!pt(ce).revoked?S(ce):null;if(!l||!ce||!te||ce.lifetime!=="persistent")throw new ct("This computer is not connected to Reason. Run reason connect first.");let X=e.addFolder!==void 0,he=X?e.addFolder:e.removeFolder,Se=L.cwd??process.cwd(),Re;try{Re=zi(Se,he)}catch(xe){if(X)throw new ct(xe instanceof Error?xe.message:String(xe));Re=ry(Se,he)}if(Re===ce.workspaceRoot)throw new ct(`${Re} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let Ee=ce.folders??[],Oe=te.roots.slice(1).find((xe)=>xe.path===Re);if(!X&&!Oe&&!Ee.includes(Re))throw new ct(`${Re} is not one of this computer's folders.`);if(X&&!ge(Re,ce.stateDirectory))throw new ct(`${Re} holds Reason's own settings.`);if(X&&!Oe&&Ee.length>=31)throw new ct("This computer already has the most folders Reason allows (32).");let Me=O.apiKey??lr(ce.stateDirectory)??void 0,Ce=await Fu(ce,te,Me,L),Te=te.roots.filter((xe)=>xe.path!==Re);if(X)Te=[...Te,await Ce.add(Re)];else if(Oe)await Ce.remove(Oe.id);ju(ce,te,Te);let We=X?[...Ee.filter((xe)=>xe!==Re),Re]:Ee.filter((xe)=>xe!==Re),{folders:$e,...Fe}=ce;if(y(we,x.parse({...Fe,...We.length?{folders:We}:{}})),!await(L.controlWorker??Rt)(l,"reload_roots").then(()=>!0,()=>!1))Ie(l,z,"connect");return M.stdout.write(X?`Added ${Re}. Sessions on "${ce.name}" may run in it.
+`;class ct extends Error{code;constructor(e,l="worker_connect_refused"){super(e);this.code=l}}var iy=4,Ki={write:()=>!0};function fe(e,l,v=!1){let D=Wu(e,l,v);return D.length===1?D[0]:Bt(wt(Bt(e,".config")),...Lu(l,v))}var Lu=(e,l)=>[...e==="production"?[]:[e],l?"connect-once":"connect"];function Wu(e,l,v=!1){let D=e;try{D=Yr(e)}catch{}return["ara","reason"].map((M)=>Bt(D,".config",M,...Lu(l,v))).filter(ay)}function ay(e){try{if(Yr(e)!==e)return!1;return Z(Bt(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var Nu="disconnected.json";function Qi(e,l){return u(Bt(fe(e,l),Nu))}function Vi(e,l,v){let D=Bt(fe(e,l),Nu);if(!v){Xn(D,{force:!0});return}b(Bs(D),!0),y(D,{version:1,disconnected_at:new Date().toISOString()})}function sy(e){let l=new Map,v=new Set;for(let te=0;te<e.length;te+=1){let X=e[te];if(X==="--help"||X==="-h"||X==="help")return null;if(["--to","--token","--folder","--sessions",ti,ri,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(X)){let he=e[te+1];if(!he||he.startsWith("-"))throw new ct(`Missing value after ${X}.`);if(l.has(X))throw new ct(`${X} may be specified only once.`);l.set(X,he),te+=1;continue}if(["--once","--yes","-y","--minimal"].includes(X)){v.add(X==="-y"?"--yes":X);continue}if(X.startsWith("-"))throw new ct(`Unknown option: ${X}. Run \`reason connect --help\`.`);throw new ct(`Unexpected argument: ${X}. To add this computer to a team machine, use --to ${X}.`)}let D=l.get("--sessions");if(D!==void 0&&!/^[1-4]$/.test(D))throw new ct("--sessions takes a number from 1 to 4.");if(l.has(ri)&&!l.has(ti))throw new ct("--proxy-ca-file requires --proxy.");let M=l.get("--keep-awake");if(M!==void 0&&!["on","off"].includes(M))throw new ct("--keep-awake takes on or off.");if(M!==void 0&&(l.size>1||[...v].some((te)=>te!=="--yes")))throw new ct("Run reason connect --keep-awake on|off on its own.");let L=["--add-folder","--remove-folder"].filter((te)=>l.has(te));if(L.length>0&&(l.size>1||[...v].some((te)=>te!=="--yes")))throw new ct(`Run reason connect ${L[0]} PATH on its own.`);let z=l.get("--user-chrome");if(z!==void 0&&z!=="on"&&z!=="off")throw new ct("--user-chrome takes on or off.");let re=l.get("--cloud-sessions");if(re!==void 0&&re!=="on"&&re!=="off")throw new ct("--cloud-sessions takes on or off.");let G=l.get("--local-logins");if(G!==void 0&&G!=="on"&&G!=="off")throw new ct("--local-logins takes on or off.");let ce=l.get("--name")?.trim();if(ce!==void 0&&(ce.length===0||ce.length>160))throw new ct("--name takes a name of 1 to 160 characters.");let we=(te,X)=>X===void 0?{}:{[te]:X};return{...we("to",l.get("--to")),...we("token",l.get("--token")),...we("folder",l.get("--folder")),...we("sessions",D===void 0?void 0:Number(D)),...we("keepAwake",M===void 0?void 0:M==="on"),...we("userChrome",z===void 0?void 0:z==="on"),...we("cloudSessions",re===void 0?void 0:re==="on"),...we("localLogins",G===void 0?void 0:G==="on"),once:v.has("--once"),yes:v.has("--yes"),minimal:v.has("--minimal"),...we("proxy",l.get(ti)),...we("proxyCaFile",l.get(ri)),...we("apiKey",l.get("--api-key")),...we("name",ce),...we("apiUrl",l.get("--api-url")),...we("addFolder",l.get("--add-folder")),...we("removeFolder",l.get("--remove-folder"))}}var Gr=(e)=>u(f(e).state),Hu=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function $u(e){return e.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function Bu(e){let{parsed:l,saved:v}=e,D=v?.workspaceRoot??e.home;if(l.folder!==void 0)try{D=qi(e.options.cwd??process.cwd(),l.folder)}catch(re){throw new ct(re instanceof Error?re.message:String(re))}if(!ge(D,e.stateDirectory))throw new ct(`${D} holds Reason's own settings. Pick another folder with --folder.`);let M;try{M=l.apiUrl!==void 0?ut({REASON_API_URL:l.apiUrl},e.channel):v&&!R(e.environment,"REASON_API_URL")?.trim()?v.apiOrigin:ut(e.environment,e.channel)}catch(re){throw new ct(`${l.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${re instanceof Error?re.message:String(re)}`)}if(v&&M!==v.apiOrigin&&W(M,v.apiOrigin))M=v.apiOrigin;if(!Cr(M)&&!An(e.channel,M))throw new ct(`${M} is not the ${e.channel} Reason API this CLI connects to.`+(e.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let L=v?.proxy;if(l.proxy!==void 0)try{L=qa({proxyUrl:l.proxy,caFile:l.proxyCaFile},{home:e.home,statePath:e.stateDirectory})}catch(re){if(!(re instanceof K))throw re;throw new ct(re.message)}let z=(v?.folders??[]).filter((re)=>re!==D);return x.parse({...z.length?{folders:z}:{},version:1,apiOrigin:M,channel:e.channel,stateDirectory:e.stateDirectory,workspaceRoot:D,lifetime:e.lifetime,executionMode:"host",name:l.name??v?.name??Ls((e.options.hostname??ty)()),slots:l.sessions??v?.slots??iy,...L?{proxy:L}:{},...(l.userChrome??v?.userChrome)===void 0?{}:{userChrome:l.userChrome??v?.userChrome},...l.cloudSessions??v?.cloudSessions?{cloudSessions:!0}:{},...(l.localLogins??v?.localLogins)===void 0?{}:{localLogins:l.localLogins??v?.localLogins}})}function Uu(e,l){if(e.localLogins!==void 0||l)return e;return x.parse({...e,localLogins:!0})}async function Us(e,l,v,D,M){if(ft(e).revoked){if(Gr(e))try{Zt(e)}catch{}pa(e);let re=[];try{re=ey(p(e))}catch{}for(let G of re)if(G!=="workspaces")Xn(Bt(p(e),G),{recursive:!0,force:!0})}else if(Gr(e))Zt(e);b(e.stateDirectory,!0),y(l,e);let L=cy(v.stderr),z=await(D.runWorker??Tr)(["enroll","--config",l],{...Fs(D.worker,M),io:{stdout:Ki,stderr:L}});if(z!==0)v.stderr.write(`Reason: this computer was not connected. (${L.code()??"worker_command_failed"})
+`);return z}function cy(e){let l=null;return{write:(v)=>{for(let D of v.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))l=D[1];return e.write(v)},code:()=>l}}function Fo(e,l,v){let D=ve(Q(Pn("REASON_CLI_CHANNEL",l),e));return D&&W(D.apiOrigin,v.apiOrigin)?D.orgId.toLowerCase():null}async function ly(e,l,v,D){let{config:M,configPath:L}=Qo(e,l),z=(ce)=>{try{return ce!==null&&Yn(ce)&&S(ce)?.orgId.toLowerCase()===l}catch{return!1}},re=null;try{re=Z(L)}catch{}if(z(re))return 0;v.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let G=await Us(M,L,v,D,void 0);if(G===0&&z(M))return 0;if(G===0&&Gr(M))await Gi(M,L,v,D);if(Xn(M.stateDirectory,{recursive:!0,force:!0}),G!==0)return G;throw new ct("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function Fs(e,l){return l?{...e,enrollmentCredentials:(v)=>na(v,l)}:{...e}}async function js(e,l,v,D,M,L="connect"){if(await qs(e,D,M,L),L==="connect"&&!await Ku(e,v,D))return!1;if(!await Gi(e,l,v,D))return!1;return sc(e.stateDirectory),Xn(e.stateDirectory,{recursive:!0,force:!0}),!0}async function Gi(e,l,v,D){if(!Gr(e)||ft(e).revoked)return!0;for(let M=1;;M+=1){let L=M===3;if(await(D.runWorker??Tr)(["revoke","--config",l],{...D.worker,io:{stdout:Ki,stderr:L?v.stderr:Ki}})===0)return!0;if(L)return!1;await new Promise((re)=>setTimeout(re,1000))}}async function qs(e,l,v,D="connect",M=!1){let L=l.controlWorker??St,z=async()=>L(e,"status").catch(()=>null),re=await L(e,"stop").catch(()=>null)!==null,G=!M&&xn(e,v,D);if(re||G){let ce=Date.now()+e.shutdownGraceMs+60000;while(Date.now()<ce&&await z()!==null)await new Promise((we)=>setTimeout(we,250))}}function zs(e,l){return l==="darwin"&&e.userChrome!==!1}function Hs(e,l,v){let D=[...zs(e,l)?["your own Chrome profiles"]:[],...e.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${e.name}" \xB7 Sessions run here, ${$u(e).replace(/^runs /,"")}`,...D.length>0?[`  Uses ${D.join(" and ")} (reason connect --help to change)`]:[],...v,""].join(`
+`)}function $s(e,l,v,D){return[e,`  Name:      ${l.name}`,`  Folder:    ${l.workspaceRoot}`,...(l.folders??[]).map((M)=>`             ${M}`),"  Sessions:  every Session you start",`  Mode:      ${$u(l)}`,...l.proxy?[`  Proxy:     ${za(l.proxy)}`]:[],...zs(l,v)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...l.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...l.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...D,""].join(`
+`)}async function Au(e,l,v){let{io:D,options:M}=v;if(Wu(v.home,v.channel).length===2)D.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:Bs(l),timestamp:new Date().toISOString()})}
+`);let L=De(Bt(v.home,".config"));if(L.problem)D.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:L.problem,timestamp:new Date().toISOString()})}
+`);cs(v.home,v.host.platform);let z=Lc({home:v.home,channel:v.channel,saved:e,configPath:l,log:(he)=>D.stderr.write(`${he}
+`),host:v.host}),re=Ic({...z,log:(he)=>D.stderr.write(`${he}
+`)}),{configPath:G}=re,ce=re.saved;if(!ce)return D.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let we=(he,Se)=>{let Re=Vs(v.home,v.channel),Ee;try{let Me=null;try{Me=Se.keep?null:S(ce)?.orgId.toLowerCase()??null}catch{}if(Ee=oi(ce,{prefer:Fo(v.home,v.channel,ce),...Se}),Ee&&Me)ni(Ee,Me)}finally{Re()}if(!Ee)return!1;ce=Ee;let Oe="";try{Oe=` (workspace ${S(Ee)?.orgId??"unknown"})`}catch{}return D.stderr.write(`Reason: ${he}; this computer goes on running Sessions for its other Reason account${Oe}.
+`),!0};if(ft(ce).revoked&&!we("this computer's connection was removed from Reason",{keep:!1}))return D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(ce.executionMode==="confined"||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0,Se=he?null:Fo(v.home,v.channel,ce);if(!he&&!(Se&&ho(ce,Se)))we("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let te=ce.executionMode==="confined";if(te||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0;if(D.stderr.write(te?Hu:`Reason: this computer's connection expired; renewing it with ${he?"its API key":"your login"}\u2026
+`),await Us(x.parse({...ce,executionMode:"host"}),G,D,M,he)!==0)return D.stderr.write(he?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let X=new AbortController;if(!M.runWorker)import("./ask-relay-5f92e4c5.js").then(({runBackgroundAskRelay:he})=>he(X.signal,(Se)=>D.stderr.write(`${Se}
+`))).catch(()=>{});try{for(;;){let he=lr(ce.stateDirectory)===null?{ownerWorkspaces:M.worker?.ownerWorkspaces??{}}:{},Se=M.runWorker?null:Fi({stateDirectory:ce.stateDirectory}),Re=!1,Ee;try{Ee=await(M.runWorker??Tr)(["start","--config",G],{deferOptionalLanes:!0,...M.worker,...he,ownComputer:!0,io:{stdout:D.stdout,stderr:D.stderr},onDeviceRevoked:()=>{Re=!0}})}finally{Se?.stop()}if(!Re)return Ee;if(!we("this computer's connection was removed from Reason",{keep:!1}))break}return Vi(v.home,v.channel,!0),D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{X.abort()}}async function dy(e,l,v){let{io:D,options:M,home:L,channel:z,environment:re}=v;if(l&&await(M.controlWorker??St)(l,"status").catch(()=>null))throw new ct("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=fe(L,z,!0),ce=Bu({parsed:e,saved:l,stateDirectory:G,lifetime:"ephemeral",home:L,channel:z,options:M,environment:re}),we=Uu(ce,v.apiKey??(l?lr(l.stateDirectory)??void 0:void 0)),te=Bt(G,"worker.json");return b(G,!0),y(te,we),D.stdout.write($s(`Reason: connecting "${we.name}" while this command runs`,we,v.host.platform,["Connecting\u2026"])),(M.runWorker??Tr)(["start","--config",te],{...Fs(M.worker,v.apiKey),ownComputer:!0,io:{stdout:D.stdout,stderr:zi(D.stderr)},onStartup:(X)=>{if(X==="ready")D.stdout.write(`Connected. Start Sessions on "${we.name}" from Reason. Press Ctrl-C to stop.
+`);M.worker?.onStartup?.(X)}})}function uy(e,l,v,D){if(v.platform!=="darwin")throw new ct("--keep-awake is for macOS.");if(!l)throw new ct("This computer is not connected to Reason. Run reason connect first.");b(p(l),!0),$c(f(l).daemon,e);let M=nr(f(l).daemon)==="battery_and_ac";return D.stdout.write(`Keep awake: ${M?"on (this Mac stays awake while it runs Sessions)":"off"}
+`),0}var fy=n({root:n({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});async function Fu(e,l,v,D){let M=await(Fs(D.worker,v).enrollmentCredentials??qr)(e,jr(e));if(!M)throw Error("worker_session_login_required");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let L=D.folderApi?.(M)??new me(M,{credentialsPath:jr(e),fetchImpl:oe(e.proxy)}),z=(re)=>re instanceof C&&re.status===404&&!["device_not_found","root_not_found"].includes(re.code);return{add:async(re)=>{let G=yc(e,re,{...l.roots[0].permissions,expose_mcp:!1}),ce=await L.addDeviceRoot(l.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((te)=>{if(z(te))throw Error("worker_folders_unavailable");if(te instanceof C&&te.code==="root_limit_reached")throw new ct("This computer already has the most folders Reason allows (32).");throw te}),we=fy.parse(ce).root;if(we.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:we.id,label:we.label}},remove:async(re)=>{await L.removeDeviceRoot(l.deviceId,re).catch((G)=>{if(z(G))throw Error("worker_folders_unavailable");if(!(G instanceof C&&G.code==="root_not_found"))throw G})}}}function ju(e,l,v){ae({...l,roots:v,handsSlots:e.slots,worker:{...l.worker,configDigest:O(e)}},f(e).state,{proofStore:xt(e)})}async function my(e,l,v,D){let{io:M,options:L,host:z}=D,re=l&&!D.apiKey&&lr(l.stateDirectory)===null?Fo(D.home,D.channel,l):null,G=l&&re&&Gr(l)&&!ho(l,re)?Qt(l).find((xe)=>xe.account&&xe.organizationId===re)??null:void 0;if(G===null)throw new ct("This computer is not connected for your account. Run reason connect first.");let ce=G?G.config:l,we=G?G.configPath:v,te=ce&&Gr(ce)&&!ft(ce).revoked?S(ce):null;if(!l||!ce||!te||ce.lifetime!=="persistent")throw new ct("This computer is not connected to Reason. Run reason connect first.");let X=e.addFolder!==void 0,he=X?e.addFolder:e.removeFolder,Se=L.cwd??process.cwd(),Re;try{Re=qi(Se,he)}catch(xe){if(X)throw new ct(xe instanceof Error?xe.message:String(xe));Re=ry(Se,he)}if(Re===ce.workspaceRoot)throw new ct(`${Re} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let Ee=ce.folders??[],Oe=te.roots.slice(1).find((xe)=>xe.path===Re);if(!X&&!Oe&&!Ee.includes(Re))throw new ct(`${Re} is not one of this computer's folders.`);if(X&&!ge(Re,ce.stateDirectory))throw new ct(`${Re} holds Reason's own settings.`);if(X&&!Oe&&Ee.length>=31)throw new ct("This computer already has the most folders Reason allows (32).");let Me=D.apiKey??lr(ce.stateDirectory)??void 0,Ce=await Fu(ce,te,Me,L),Te=te.roots.filter((xe)=>xe.path!==Re);if(X)Te=[...Te,await Ce.add(Re)];else if(Oe)await Ce.remove(Oe.id);ju(ce,te,Te);let We=X?[...Ee.filter((xe)=>xe!==Re),Re]:Ee.filter((xe)=>xe!==Re),{folders:$e,...Ue}=ce;if(y(we,x.parse({...Ue,...We.length?{folders:We}:{}})),!await(L.controlWorker??St)(l,"reload_roots").then(()=>!0,()=>!1))Ie(l,z,"connect");return M.stdout.write(X?`Added ${Re}. Sessions on "${ce.name}" may run in it.
 `:`Removed ${Re}. Sessions on "${ce.name}" no longer run in it.
-`),0}function xu(e,l){let v=nn(e.home??s()),O=e.env??process.env;return{io:e.io??Gs(),options:e,home:v,channel:e.channel??w(),environment:O,apiKey:l??Un(O),host:e.serviceHost??de(v)}}async function py(e,l,v,O){let M=S(e),L=M.roots;if(l.workspaceRoot!==e.workspaceRoot){let z=await Fu(e,M,v,O),re=L.find((G)=>G.path===l.workspaceRoot)??await z.add(l.workspaceRoot);await z.remove(L[0].id),L=[re,...L.slice(1).filter((G)=>G.id!==re.id)]}ju(l,M,L)}var qu=Symbol("serve here");async function hy(e,l,v,O){let{io:M,options:L,home:z,channel:re,environment:G,host:ce}=O;if(ce.platform==="darwin"){let qe=Cu(z);if(qe.status==="failed")M.stderr.write(`Reason: could not remove the retired Reason Device helper (${qe.code}).
-`)}let we=l&&!O.apiKey&&lr(l.stateDirectory)===null?Fo(z,re,l):null,te=l&&we&&pt(l).revoked&&Qt(l).some((qe)=>qe.account&&qe.organizationId===we)?ai(l,{prefer:we,keep:!1})??l:l,X=Bu({parsed:e,saved:te,stateDirectory:fe(z,re),lifetime:"persistent",home:z,channel:re,options:L,environment:G});if(ea(z,re,!1),te?.executionMode==="confined")M.stdout.write(Hu);let he=te?lr(te.stateDirectory):null,Se=Uu(X,O.apiKey??he??void 0),Re=Ue(ce,G),Ee=te!==null&&rn(te),Oe=Ee&&D(te)===D(Se),Me=Oe&&to(Se),Ce=te?.userChrome!==!1===(Se.userChrome!==!1)&&te?.cloudSessions===Se.cloudSessions&&te?.localLogins===Se.localLogins,Te=O.apiKey??he??void 0,We=we!==null&&Ee&&!pt(te).revoked&&!wo(te,we);if(We){if(!Oe||!Ce||JSON.stringify(te.proxy)!==JSON.stringify(Se.proxy))throw new ct("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let qe=await ly(te,we,M,L);if(qe!==0)return qe}let $e=We?[`  Account:   yours too, in workspace ${we}, beside this computer's other Reason account`]:[],Fe=async()=>{if(e.apiKey===void 0||e.apiKey===he)return;await sa(Se,e.apiKey),aa(Se.stateDirectory,e.apiKey)},Ne=G.PATH||"/usr/local/bin:/usr/bin:/bin",xe=Me&&JSON.stringify(te?.proxy)===JSON.stringify(Se.proxy)&&Ce?ze(Se,ce,"connect"):null,Le=xe?.label===bn(Se.channel),Ge=Le?await(L.controlWorker??Rt)(Se,"status").catch(()=>null):null,Ve=Ge!==null,Je=Le&&!Ve&&Di(xe,ce)&&Yo({config:Se,launcher:Re,path:Ne,host:ce,kind:"connect"}),it=Ge!==null&&(Ge.activeSessions??Ge.activeClaims)>0;if((Ve||Je)&&(it||[null,g].includes(ko(Se)))){await Fe();let qe=Ii(Se,ce,"connect");if(qe==="retired"){let nt=Je?null:await(L.controlWorker??Rt)(Se,"status").catch(()=>null);if(!Je&&(!nt||nt.phase==="stopping"))Ie(Se,ce,"connect")}else if(qe==="current_not_running")Ie(Se,ce,"connect");else if(ce.platform==="win32"&&Ge&&(Ge.capabilityReadiness?.["exec.run"]===!1||Ge.supportedOperations?.includes("exec.run")===!1)&&ky())Ie(Se,ce,"connect");return await(L.controlWorker??Rt)(Se,"reload_roots").catch(()=>null),M.stdout.write(G.REASON_INSTALLER==="1"?Bs(Se,ce.platform,$e):Fs("This computer is connected to Reason",Se,ce.platform,[...$e,...Je?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let Ye=!Me&&!We;if(Ee&&!Oe)if(te.apiOrigin!==Se.apiOrigin||te.name!==Se.name){if(M.stdout.write(`Reconnecting this computer with its new settings\u2026
-`),!await Ks(te,v,M,L,ce))throw new ct("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(te.executionMode==="host"&&to(te))M.stdout.write(`Applying the new settings to this computer\u2026
-`),await py(te,Se,Te,L),Ye=!1;else await Vs(te,L,ce);if(Ye){if(G.REASON_INSTALLER!=="1")M.stdout.write(`Connecting this computer to Reason\u2026
-`);let qe=await qs(Se,v,M,L,Te);if(qe!==0)return qe;if(Te)aa(Se.stateDirectory,Te)}else y(v,Se),await Fe();let Be;try{Be=vn({config:Se,launcher:Re,path:Ne,host:ce,kind:"connect"})}catch(qe){if(!(qe instanceof j))throw qe;if(qe.code!=="worker_service_manager_missing")throw new ct(`${qe.message}
-This computer is set up; run reason connect again to start it.`,qe.code??"worker_service_start_failed");if(L.serveHere&&G.REASON_INSTALLER!=="1")return M.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
-`),qu;if(L.serveHere&&G.REASON_INSTALLER==="1"&&await gy(Se,Re,G,L))return M.stdout.write(Bs(Se,ce.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${Re} connect under a process manager)`])),0;throw new j(`${qe.message}
-This computer is set up. Keep it connected by running ${Re} connect in a terminal or under this box's process manager.`,qe.code)}let Ke=[...$e,...Be.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...Be.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${Be.identityProblem}).`]:[]];return M.stdout.write(G.REASON_INSTALLER==="1"?Bs(Se,ce.platform,Ke):Fs("This computer is connected to Reason",Se,ce.platform,[`  Service:   ${Be.label} (starts at ${Be.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${Be.logs}`,`Start Sessions on "${Se.name}" from Reason. Remove it with: reason disconnect`,...Ke])),0}async function gy(e,l,v,O){let{REASON_INSTALLER:M,...L}=v;(O.startConnection??zu)(l,L,Bt(e.stateDirectory,"connect.log"));for(let z=0;z<60;z+=1)if(await new Promise((re)=>setTimeout(re,500)),await(O.controlWorker??Rt)(e,"status").catch(()=>null))return!0;return!1}function zu(e,l,v){let O=Tu(v,"a",384);try{let M=Du(e,["connect"],{detached:!0,stdio:["ignore",O,O],env:l});M.on("error",()=>{return}),M.unref()}finally{Mu(O)}}async function Ku(e,l,v,O=!1){let M=!0;for(let L of Qt(e)){if(O&&L.account)continue;if(L.config&&rn(L.config)&&!pt(L.config).revoked){if(await(v.runWorker??Nr)(["revoke","--config",L.configPath],{...v.worker,io:{stdout:Ji,stderr:l.stderr}})!==0){M=!1;continue}}ro(L.directory,{recursive:!0,force:!0})}return M}function Gs(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function Vu(e,l){if(e instanceof ct||e instanceof j)return l.stderr.write(`Reason: ${e.message} (${e.code??"worker_service_failed"})
-`),2;let v=e instanceof Error&&/^worker_[a-z_]+$/.test(e.message)?e.message:_y(e);return l.stderr.write(`Reason: ${Ln(v)??"could not connect this computer."} (${v})
-`),1}var wy=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]),yy=new Set(["ConnectionRefused","ConnectionClosed","FailedToOpenSocket","ECONNREFUSED","ECONNRESET","ENOTFOUND","EAI_AGAIN","ENETUNREACH","EHOSTUNREACH"]);function _y(e){if(e instanceof C)return e.status>=500?"worker_api_unavailable":"worker_api_refused";let l=e?.code;if(typeof l==="string"&&wy.has(l))return`worker_file_${l.toLowerCase()}`;if(typeof l==="string"&&yy.has(l))return"worker_api_unreachable";if(typeof l==="string"&&(/CERT|SSL|TLS/.test(l)||l==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"))return"worker_api_certificate_untrusted";if(e instanceof Error&&e.message.startsWith("Command failed"))return"worker_connect_command_failed";let v=oc(e);if(v==="native_network")return"worker_api_unreachable";return/^native_[a-z_]+$/.test(v)?`worker_connect_${v.slice(7)}`:"worker_connect_unexpected"}function Iu(e,l){if(e.minimal){pc({home:l.home});return}if(e.once||l.options.desktop===!1||!l.io.stdinIsTty||hc({home:l.home})!=="install")return;let v;try{v=Ue(l.host,l.environment)}catch{return}if(l.host.platform==="darwin"){let M=Bt(l.home,".local","share","reason","desktop-install.log");(l.options.installDesktop??Ou)(v,l.environment,{log:M}),l.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${M}).
+`),0}function xu(e,l){let v=Yr(e.home??s()),D=e.env??process.env;return{io:e.io??Ks(),options:e,home:v,channel:e.channel??w(),environment:D,apiKey:l??Wn(D),host:e.serviceHost??de(v)}}async function py(e,l,v,D){let M=S(e),L=M.roots;if(l.workspaceRoot!==e.workspaceRoot){let z=await Fu(e,M,v,D),re=L.find((G)=>G.path===l.workspaceRoot)??await z.add(l.workspaceRoot);await z.remove(L[0].id),L=[re,...L.slice(1).filter((G)=>G.id!==re.id)]}ju(l,M,L)}var qu=Symbol("serve here");async function hy(e,l,v,D){let{io:M,options:L,home:z,channel:re,environment:G,host:ce}=D;if(ce.platform==="darwin"){let Fe=Cu(z);if(Fe.status==="failed")M.stderr.write(`Reason: could not remove the retired Reason Device helper (${Fe.code}).
+`)}let we=l&&!D.apiKey&&lr(l.stateDirectory)===null?Fo(z,re,l):null,te=l&&we&&ft(l).revoked&&Qt(l).some((Fe)=>Fe.account&&Fe.organizationId===we)?oi(l,{prefer:we,keep:!1})??l:l,X=Bu({parsed:e,saved:te,stateDirectory:fe(z,re),lifetime:"persistent",home:z,channel:re,options:L,environment:G});if(Vi(z,re,!1),te?.executionMode==="confined")M.stdout.write(Hu);let he=te?lr(te.stateDirectory):null,Se=Uu(X,D.apiKey??he??void 0),Re=ze(ce,G),Ee=te!==null&&Gr(te),Oe=Ee&&O(te)===O(Se),Me=Oe&&Yn(Se),Ce=te?.userChrome!==!1===(Se.userChrome!==!1)&&te?.cloudSessions===Se.cloudSessions&&te?.localLogins===Se.localLogins,Te=D.apiKey??he??void 0,We=we!==null&&Ee&&!ft(te).revoked&&!ho(te,we);if(We){if(!Oe||!Ce||JSON.stringify(te.proxy)!==JSON.stringify(Se.proxy))throw new ct("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let Fe=await ly(te,we,M,L);if(Fe!==0)return Fe}let $e=We?[`  Account:   yours too, in workspace ${we}, beside this computer's other Reason account`]:[],Ue=async()=>{if(e.apiKey===void 0||e.apiKey===he)return;await na(Se,e.apiKey),ra(Se.stateDirectory,e.apiKey)},Ne=G.PATH||"/usr/local/bin:/usr/bin:/bin",xe=Me&&JSON.stringify(te?.proxy)===JSON.stringify(Se.proxy)&&Ce?qe(Se,ce,"connect"):null,Le=xe?.label===En(Se.channel),Ge=Le?await(L.controlWorker??St)(Se,"status").catch(()=>null):null,Ve=Ge!==null,Je=Le&&!Ve&&Li(xe,ce)&&os({config:Se,launcher:Re,path:Ne,host:ce,kind:"connect"}),it=Ge!==null&&(Ge.activeSessions??Ge.activeClaims)>0;if((Ve||Je)&&(it||[null,g].includes(_o(Se)))){await Ue();let Fe=Ni(Se,ce,"connect");if(Fe==="retired"){let nt=Je?null:await(L.controlWorker??St)(Se,"status").catch(()=>null);if(!Je&&(!nt||nt.phase==="stopping"))Ie(Se,ce,"connect")}else if(Fe==="current_not_running")Ie(Se,ce,"connect");else if(ce.platform==="win32"&&Ge&&(Ge.capabilityReadiness?.["exec.run"]===!1||Ge.supportedOperations?.includes("exec.run")===!1)&&ky())Ie(Se,ce,"connect");return await(L.controlWorker??St)(Se,"reload_roots").catch(()=>null),M.stdout.write(G.REASON_INSTALLER==="1"?Hs(Se,ce.platform,$e):$s("This computer is connected to Reason",Se,ce.platform,[...$e,...Je?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let Ye=!Me&&!We;if(Ee&&!Oe)if(te.apiOrigin!==Se.apiOrigin||te.name!==Se.name){if(M.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),!await js(te,v,M,L,ce))throw new ct("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(te.executionMode==="host"&&Yn(te))M.stdout.write(`Applying the new settings to this computer\u2026
+`),await py(te,Se,Te,L),Ye=!1;else await qs(te,L,ce);if(Ye){if(G.REASON_INSTALLER!=="1")M.stdout.write(`Connecting this computer to Reason\u2026
+`);let Fe=await Us(Se,v,M,L,Te);if(Fe!==0)return Fe;if(Te)ra(Se.stateDirectory,Te)}else y(v,Se),await Ue();let Be;try{Be=kn({config:Se,launcher:Re,path:Ne,host:ce,kind:"connect"})}catch(Fe){if(!(Fe instanceof j))throw Fe;if(Fe.code!=="worker_service_manager_missing")throw new ct(`${Fe.message}
+This computer is set up; run reason connect again to start it.`,Fe.code??"worker_service_start_failed");if(L.serveHere&&G.REASON_INSTALLER!=="1")return M.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
+`),qu;if(L.serveHere&&G.REASON_INSTALLER==="1"&&await gy(Se,Re,G,L))return M.stdout.write(Hs(Se,ce.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${Re} connect under a process manager)`])),0;throw new j(`${Fe.message}
+This computer is set up. Keep it connected by running ${Re} connect in a terminal or under this box's process manager.`,Fe.code)}let Ke=[...$e,...Be.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...Be.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${Be.identityProblem}).`]:[]];return M.stdout.write(G.REASON_INSTALLER==="1"?Hs(Se,ce.platform,Ke):$s("This computer is connected to Reason",Se,ce.platform,[`  Service:   ${Be.label} (starts at ${Be.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${Be.logs}`,`Start Sessions on "${Se.name}" from Reason. Remove it with: reason disconnect`,...Ke])),0}async function gy(e,l,v,D){let{REASON_INSTALLER:M,...L}=v;(D.startConnection??zu)(l,L,Bt(e.stateDirectory,"connect.log"));for(let z=0;z<60;z+=1)if(await new Promise((re)=>setTimeout(re,500)),await(D.controlWorker??St)(e,"status").catch(()=>null))return!0;return!1}function zu(e,l,v){let D=Tu(v,"a",384);try{let M=Du(e,["connect"],{detached:!0,stdio:["ignore",D,D],env:l});M.on("error",()=>{return}),M.unref()}finally{Mu(D)}}async function Ku(e,l,v,D=!1){let M=!0;for(let L of Qt(e)){if(D&&L.account)continue;if(L.config&&Gr(L.config)&&!ft(L.config).revoked){if(await(v.runWorker??Tr)(["revoke","--config",L.configPath],{...v.worker,io:{stdout:Ki,stderr:l.stderr}})!==0){M=!1;continue}}Xn(L.directory,{recursive:!0,force:!0})}return M}function Ks(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function Vu(e,l){if(e instanceof ct||e instanceof j)return l.stderr.write(`Reason: ${e.message} (${e.code??"worker_service_failed"})
+`),2;let v=e instanceof Error&&/^worker_[a-z_]+$/.test(e.message)?e.message:_y(e);return l.stderr.write(`Reason: ${Mn(v)??"could not connect this computer."} (${v})
+`),1}var wy=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]),yy=new Set(["ConnectionRefused","ConnectionClosed","FailedToOpenSocket","ECONNREFUSED","ECONNRESET","ENOTFOUND","EAI_AGAIN","ENETUNREACH","EHOSTUNREACH"]);function _y(e){if(e instanceof C)return e.status>=500?"worker_api_unavailable":"worker_api_refused";let l=e?.code;if(typeof l==="string"&&wy.has(l))return`worker_file_${l.toLowerCase()}`;if(typeof l==="string"&&yy.has(l))return"worker_api_unreachable";if(typeof l==="string"&&(/CERT|SSL|TLS/.test(l)||l==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"))return"worker_api_certificate_untrusted";if(e instanceof Error&&e.message.startsWith("Command failed"))return"worker_connect_command_failed";let v=oc(e);if(v==="native_network")return"worker_api_unreachable";return/^native_[a-z_]+$/.test(v)?`worker_connect_${v.slice(7)}`:"worker_connect_unexpected"}function Iu(e,l){if(e.minimal){es({home:l.home});return}if(e.once||l.options.desktop===!1||!l.io.stdinIsTty||ts({home:l.home})!=="install")return;let v;try{v=ze(l.host,l.environment)}catch{return}if(l.host.platform==="darwin"){let M=Bt(l.home,".local","share","reason","desktop-install.log");(l.options.installDesktop??Ou)(v,l.environment,{log:M}),l.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${M}).
 `);return}l.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
-`);let O=(l.options.installDesktop??Ou)(v,l.environment,null);if(O!==0&&O!==3)l.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
-`)}function by(e){if(e.host.platform!=="win32"||!e.io.stdinIsTty)return;cr();let l=Ae();if(!Zw(l)||Jr(l))return;e.io.stdout.write(`Setting up the Windows sandbox for confined commands; approve the Windows prompt\u2026
-`);let v=xa(l);if(v!=="installed")e.io.stderr.write(`Reason: the Windows sandbox was not set up (${v==="cancelled"?"prompt declined":"install failed"}); connecting without confined commands. Run reason connect again to retry. (windows_sandbox_unavailable)
-`)}function ky(){if(Y()===null)return!1;return cr(),Jr(Ae())}function Ou(e,l,v){if(!v){let M=()=>Xw(e,["desktop","install"],{env:l,stdio:"inherit"}).status??1,L=M();return L===3221225477?M():L}Qw(js(v.log),{recursive:!0,mode:448});let O=Tu(v.log,"w",384);try{let M=Du(e,["desktop","install"],{detached:!0,stdio:["ignore",O,O],env:{...l,REASON_DESKTOP_BACKGROUND:"1"}});M.on("error",()=>{return}),M.unref()}finally{Mu(O)}return 0}async function ll(e,l={}){let v=l.io??Gs();try{let O=sy(e);if(!O)return v.stdout.write(ny),0;if(O.to!==void 0||O.token!==void 0){if(O.sessions!==void 0)throw new ct("A machine's workers run one Session at a time; --sessions does not apply to them.");if(O.proxy!==void 0)throw new ct("--proxy is for your own computer; a machine's workers don't take it yet.");if(O.userChrome!==void 0)throw new ct("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(O.cloudSessions!==void 0)throw new ct("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(O.localLogins!==void 0)throw new ct("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[ce,we]of[["--api-key",O.apiKey],["--name",O.name],["--api-url",O.apiUrl]])if(we!==void 0)throw new ct(`${ce} is for your own computer; reason serve sets up a machine's workers.`);return Iu(O,xu(l)),await(l.runServe??Eu)([...O.to===void 0?[]:[O.to],...O.token===void 0?[]:["--token",O.token],...O.folder===void 0?[]:["--dir",O.folder],...O.yes?["--yes"]:[],O.once?"--once":"--service"],{io:v,...l.cwd?{cwd:l.cwd}:{},...l.home?{home:l.home}:{},...l.channel?{channel:l.channel}:{},...l.env?{env:l.env}:{},...l.serviceHost?{serviceHost:l.serviceHost}:{},...l.worker?{worker:l.worker}:{}})}let M=xu(l,O.apiKey),{channel:L,environment:z}=M;if(!l.env)for(let ce of["REASON_API_KEY","ARA_API_KEY"])delete process.env[ce];if(O.userChrome&&M.host.platform!=="darwin")throw new ct("--user-chrome is for a Mac.");let re=Xo(z[ke],L),G=re||O.once?()=>{return}:Ys(M.home,L);try{let ce=Bt(fe(M.home,L),"worker.json"),we=Z(ce);if(re)return await Au(we,ce,M);if(O.keepAwake!==void 0)return uy(O.keepAwake,we,M.host,v);if(O.addFolder!==void 0||O.removeFolder!==void 0)return await my(O,we,ce,M);if(Iu(O,M),by(M),O.once)return await dy(O,we,M);let te=await hy(O,we,ce,M);if(te!==qu)return te;return G(),G=()=>{return},await Au(Z(ce),ce,M)}finally{G()}}catch(O){return Vu(O,v)}}async function ul(e,l={}){let v=l.io??Gs();try{if(e.some((z)=>["--help","-h","help"].includes(z)))return v.stdout.write(oy),0;let O=e.filter((z)=>!["--yes","-y","--temporary","--account"].includes(z)),M=e.includes("--temporary"),L=e.includes("--account");if(O.length>1||O[0]?.startsWith("-")||(M||L)&&O.length>0||M&&L)throw new ct("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(O[0]!==void 0)return await Ey(O[0],v,l);return await vy(v,l,M?"temporary":L?"account":"disconnect")}catch(O){return Vu(O,v)}}async function vy(e,l,v){let O=nn(l.home??s()),M=l.channel??w(),L=Ys(O,M);try{return await Sy(e,l,v,O,M)}finally{L()}}function Ys(e,l){let v=fe(e,l),O=u(v)?wt():null;if(!O)return()=>{return};for(let M=0;M<300;M+=1){let L=O.lock(v);if(L)return L;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new ct("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function Sy(e,l,v,O,M){let L=Bt(fe(O,M),"worker.json"),z=Z(L);if(!z){if(v==="disconnect")ea(O,M,!0);if(v!=="logout")e.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(v!=="disconnect"){let G=await Ry(z,L,e,l,v,O,M);if(G!==null)return G}let re=!1;try{re=await Ks(z,L,e,l,l.serviceHost??de(O))}finally{if(v!=="temporary")ea(O,M,!0)}if(!re)return e.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`);let D=(l.options.installDesktop??Ou)(v,l.environment,null);if(D!==0&&D!==3)l.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
+`)}function by(e){if(e.host.platform!=="win32"||!e.io.stdinIsTty)return;cr();let l=Ae();if(!Zw(l)||tn(l))return;e.io.stdout.write(`Setting up the Windows sandbox for confined commands; approve the Windows prompt\u2026
+`);let v=Oa(l);if(v!=="installed")e.io.stderr.write(`Reason: the Windows sandbox was not set up (${v==="cancelled"?"prompt declined":"install failed"}); connecting without confined commands. Run reason connect again to retry. (windows_sandbox_unavailable)
+`)}function ky(){if(Y()===null)return!1;return cr(),tn(Ae())}function Ou(e,l,v){if(!v){let M=()=>Xw(e,["desktop","install"],{env:l,stdio:"inherit"}).status??1,L=M();return L===3221225477?M():L}Qw(Bs(v.log),{recursive:!0,mode:448});let D=Tu(v.log,"w",384);try{let M=Du(e,["desktop","install"],{detached:!0,stdio:["ignore",D,D],env:{...l,REASON_DESKTOP_BACKGROUND:"1"}});M.on("error",()=>{return}),M.unref()}finally{Mu(D)}return 0}async function gl(e,l={}){let v=l.io??Ks();try{let D=sy(e);if(!D)return v.stdout.write(ny),0;if(D.to!==void 0||D.token!==void 0){if(D.sessions!==void 0)throw new ct("A machine's workers run one Session at a time; --sessions does not apply to them.");if(D.proxy!==void 0)throw new ct("--proxy is for your own computer; a machine's workers don't take it yet.");if(D.userChrome!==void 0)throw new ct("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(D.cloudSessions!==void 0)throw new ct("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(D.localLogins!==void 0)throw new ct("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[ce,we]of[["--api-key",D.apiKey],["--name",D.name],["--api-url",D.apiUrl]])if(we!==void 0)throw new ct(`${ce} is for your own computer; reason serve sets up a machine's workers.`);return Iu(D,xu(l)),await(l.runServe??Eu)([...D.to===void 0?[]:[D.to],...D.token===void 0?[]:["--token",D.token],...D.folder===void 0?[]:["--dir",D.folder],...D.yes?["--yes"]:[],D.once?"--once":"--service"],{io:v,...l.cwd?{cwd:l.cwd}:{},...l.home?{home:l.home}:{},...l.channel?{channel:l.channel}:{},...l.env?{env:l.env}:{},...l.serviceHost?{serviceHost:l.serviceHost}:{},...l.worker?{worker:l.worker}:{}})}let M=xu(l,D.apiKey),{channel:L,environment:z}=M;if(!l.env)for(let ce of["REASON_API_KEY","ARA_API_KEY"])delete process.env[ce];if(D.userChrome&&M.host.platform!=="darwin")throw new ct("--user-chrome is for a Mac.");let re=is(z[ke],L),G=re||D.once?()=>{return}:Vs(M.home,L);try{let ce=Bt(fe(M.home,L),"worker.json"),we=Z(ce);if(re)return await Au(we,ce,M);if(D.keepAwake!==void 0)return uy(D.keepAwake,we,M.host,v);if(D.addFolder!==void 0||D.removeFolder!==void 0)return await my(D,we,ce,M);if(Iu(D,M),by(M),D.once)return await dy(D,we,M);let te=await hy(D,we,ce,M);if(te!==qu)return te;return G(),G=()=>{return},await Au(Z(ce),ce,M)}finally{G()}}catch(D){return Vu(D,v)}}async function _l(e,l={}){let v=l.io??Ks();try{if(e.some((z)=>["--help","-h","help"].includes(z)))return v.stdout.write(oy),0;let D=e.filter((z)=>!["--yes","-y","--temporary","--account"].includes(z)),M=e.includes("--temporary"),L=e.includes("--account");if(D.length>1||D[0]?.startsWith("-")||(M||L)&&D.length>0||M&&L)throw new ct("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(D[0]!==void 0)return await Ey(D[0],v,l);return await vy(v,l,M?"temporary":L?"account":"disconnect")}catch(D){return Vu(D,v)}}async function vy(e,l,v){let D=Yr(l.home??s()),M=l.channel??w(),L=Vs(D,M);try{return await Sy(e,l,v,D,M)}finally{L()}}function Vs(e,l){let v=fe(e,l),D=u(v)?bt():null;if(!D)return()=>{return};for(let M=0;M<300;M+=1){let L=D.lock(v);if(L)return L;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new ct("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function Sy(e,l,v,D,M){let L=Bt(fe(D,M),"worker.json"),z=Z(L);if(!z){if(v==="disconnect")Vi(D,M,!0);if(v!=="logout")e.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(v!=="disconnect"){let G=await Ry(z,L,e,l,v,D,M);if(G!==null)return G}let re=!1;try{re=await js(z,L,e,l,l.serviceHost??de(D))}finally{if(v!=="temporary")Vi(D,M,!0)}if(!re)return e.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
 `),1;return e.stdout.write(`Disconnected "${z.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function Ry(e,l,v,O,M,L,z){let re=Qt(e).filter((Ee)=>Ee.account);if(re.length===0)return null;let G=Fo(L,z,e),ce=O.controlWorker??Rt,we=re.find((Ee)=>Ee.organizationId===G);if(we){if(we.config&&!await ta(we.config,we.configPath,v,O))return v.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
-`),1;if(M!=="account"||!we.config)ro(we.directory,{recursive:!0,force:!0});return await ce(e,"reload_roots").catch(()=>null),v.stdout.write(`Disconnected this computer from workspace ${G} for your account. It stays connected for its other Reason accounts.
-`),0}if(!G&&M==="account")throw new ct("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!G||!wo(e,G)){if(M==="account"&&G)ii(e,G);if(M!=="logout")v.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let te=O.serviceHost??de(L),X=null;try{X=S(e)?.orgId.toLowerCase()??null}catch{}if(await Vs(e,O,te,"connect",!0),!await Ku(e,v,O,!0)||!await ta(e,l,v,O))return Ie(e,te,"connect"),v.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
-`),1;let he=ai(e,{prefer:null,keep:!1});if(!he)return null;if(M==="account"&&X)ii(he,X);let Se=Ie(he,te,"connect")!==null,Re="";try{Re=` in workspace ${S(he)?.orgId??""}`}catch{}return v.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${Re}${Se?"":"; run reason connect to start it again"}.
-`),0}async function Ey(e,l,v){let O=nn(v.home??s()),M=v.serviceHost??de(O),L=Hs(O,e);if(L.length===0)throw new ct(`No worker for machine "${e}" on this computer.`);let z=!1;for(let re of L)if(await Ks(re.config,re.path,l,v,M,"serve"))l.stdout.write(`Disconnected machine "${e}" in ${re.config.workspaceRoot}.
+`),0}async function Ry(e,l,v,D,M,L,z){let re=Qt(e).filter((Ee)=>Ee.account);if(re.length===0)return null;let G=Fo(L,z,e),ce=D.controlWorker??St,we=re.find((Ee)=>Ee.organizationId===G);if(we){if(we.config&&!await Gi(we.config,we.configPath,v,D))return v.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),1;if(M!=="account"||!we.config)Xn(we.directory,{recursive:!0,force:!0});return await ce(e,"reload_roots").catch(()=>null),v.stdout.write(`Disconnected this computer from workspace ${G} for your account. It stays connected for its other Reason accounts.
+`),0}if(!G&&M==="account")throw new ct("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!G||!ho(e,G)){if(M==="account"&&G)ni(e,G);if(M!=="logout")v.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
+`);return 0}let te=D.serviceHost??de(L),X=null;try{X=S(e)?.orgId.toLowerCase()??null}catch{}if(await qs(e,D,te,"connect",!0),!await Ku(e,v,D,!0)||!await Gi(e,l,v,D))return Ie(e,te,"connect"),v.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`),1;let he=oi(e,{prefer:null,keep:!1});if(!he)return null;if(M==="account"&&X)ni(he,X);let Se=Ie(he,te,"connect")!==null,Re="";try{Re=` in workspace ${S(he)?.orgId??""}`}catch{}return v.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${Re}${Se?"":"; run reason connect to start it again"}.
+`),0}async function Ey(e,l,v){let D=Yr(v.home??s()),M=v.serviceHost??de(D),L=Ws(D,e);if(L.length===0)throw new ct(`No worker for machine "${e}" on this computer.`);let z=!1;for(let re of L)if(await js(re.config,re.path,l,v,M,"serve"))l.stdout.write(`Disconnected machine "${e}" in ${re.config.workspaceRoot}.
 `);else z=!0,l.stderr.write(`Reason: machine "${e}" in ${re.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${e} again.
-`);return z?1:0}async function Yi(e={}){let l=nn(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;let O,M=await(e.controlWorker??Rt)(v,"status").catch((he)=>(O=he instanceof Error?he:Error(String(he)),null)),L=M?ko(v):null,z=e.serviceHost??de(l),re=ze(v,z,"connect"),G=pt(v).revoked,ce=!G&&!M,we=(()=>{try{return S(v)}catch{return null}})(),{workspaces:te,off:X}=G||lr(v.stateDirectory)!==null?{workspaces:null,off:null}:Pc(v,M?.phase==="running");return{workspaces:te,workspaces_off:X,workspaces_max:ti+(te?.filter((he)=>he.account).length??0),name:v.name,device_id:we?.deviceId??null,organization_id:we?.orgId??null,folder:v.workspaceRoot,mode:v.executionMode,sessions_max:null,user_chrome:Js(v,z.platform),cloud_sessions:v.cloudSessions===!0,root:we?.roots[0]?{id:we.roots[0].id,permissions:we.roots[0].permissions}:null,roots:we?.roots.map((he)=>({id:he.id,folder:he.path,permissions:he.permissions}))??[],state:G?"removed":M?M.phase==="running"?"connected":M.phase:"not_running",not_running_reason:ce?Yc(v,O):null,worker_alive:ce&&re?Di(re,z):null,sessions_running:M?.activeSessions??null,version:L,service:re?{label:re.label,logs:re.logs}:null}}function dl(e={}){let l=nn(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;return Ie(v,e.serviceHost??de(l),"connect")?.label??null}async function pl(e={}){let l=nn(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;let O=e.serviceHost??de(l),M=await Ru(v,O,"connect",e.current);if(M!==null||ze(v,O,"connect"))return M;return Py(v,O,e)}async function Py(e,l,v){let O=v.controlWorker??Rt,M=await O(e,"status").catch(()=>null);if(!M)return null;if(v.current!==void 0&&ko(e)===v.current)return{state:"current"};let L=M.activeSessions??M.activeClaims;if(L!==0)return{state:"busy",sessions:L,waitedMs:0};let z;try{z=Ue(l,v.env??process.env)}catch{return null}await O(e,"stop").catch(()=>null);let re=Date.now()+e.shutdownGraceMs+60000;while(Date.now()<re&&await O(e,"status").catch(()=>null)!==null)await new Promise((te)=>setTimeout(te,250));let{REASON_INSTALLER:G,REASON_DESKTOP_BACKGROUND:ce,...we}=v.env??process.env;return(v.startConnection??zu)(z,we,Bt(e.stateDirectory,"connect.log")),{state:"restarted"}}
-export{f,S,nr,Z,fe,Xi,ll,ul,Yi,dl,pl};
+`);return z?1:0}async function eo(e={}){let l=Yr(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;let D,M=await(e.controlWorker??St)(v,"status").catch((he)=>(D=he instanceof Error?he:Error(String(he)),null)),L=M?_o(v):null,z=e.serviceHost??de(l),re=qe(v,z,"connect"),G=ft(v).revoked,ce=!G&&!M,we=(()=>{try{return S(v)}catch{return null}})(),{workspaces:te,off:X}=G||lr(v.stateDirectory)!==null?{workspaces:null,off:null}:Pc(v,M?.phase==="running");return{workspaces:te,workspaces_off:X,workspaces_max:Xo+(te?.filter((he)=>he.account).length??0),name:v.name,device_id:we?.deviceId??null,organization_id:we?.orgId??null,folder:v.workspaceRoot,mode:v.executionMode,sessions_max:null,user_chrome:zs(v,z.platform),cloud_sessions:v.cloudSessions===!0,root:we?.roots[0]?{id:we.roots[0].id,permissions:we.roots[0].permissions}:null,roots:we?.roots.map((he)=>({id:he.id,folder:he.path,permissions:he.permissions}))??[],state:G?"removed":M?M.phase==="running"?"connected":M.phase:"not_running",not_running_reason:ce?Yc(v,D):null,worker_alive:ce&&re?Li(re,z):null,sessions_running:M?.activeSessions??null,version:L,service:re?{label:re.label,logs:re.logs}:null}}function yl(e={}){let l=Yr(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;return Ie(v,e.serviceHost??de(l),"connect")?.label??null}async function wl(e={}){let l=Yr(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;let D=e.serviceHost??de(l),M=await Ru(v,D,"connect",e.current);if(M!==null||qe(v,D,"connect"))return M;return Py(v,D,e)}async function Py(e,l,v){let D=v.controlWorker??St,M=await D(e,"status").catch(()=>null);if(!M)return null;if(v.current!==void 0&&_o(e)===v.current)return{state:"current"};let L=M.activeSessions??M.activeClaims;if(L!==0)return{state:"busy",sessions:L,waitedMs:0};let z;try{z=ze(l,v.env??process.env)}catch{return null}await D(e,"stop").catch(()=>null);let re=Date.now()+e.shutdownGraceMs+60000;while(Date.now()<re&&await D(e,"status").catch(()=>null)!==null)await new Promise((te)=>setTimeout(te,250));let{REASON_INSTALLER:G,REASON_DESKTOP_BACKGROUND:ce,...we}=v.env??process.env;return(v.startConnection??zu)(z,we,Bt(e.stateDirectory,"connect.log")),{state:"restarted"}}
+export{f,S,nr,Z,fe,Qi,gl,_l,eo,yl,wl};