@reason-machines/cli-linux-x64 0.2.566 → 0.2.568

package/bin/vm-hands/{vm-hands-entry-lite-72084j3g.js → vm-hands-entry-lite-rpf4t8r4.js}

@@ -1,5 +1,5 @@
 // @bun
-import{rr,Br,Hn,Gi,Fr,jr,da,Ki,pa,ha,Hr}from"./vm-hands-entry-lite-gxf2r5en.js";import{Ct,Bn,bs,Or,Vc,Je,Gc,Kc,Qt,Xe,M,At,Es,Fn,ks,Lr,Ps,Rs,Ts,Is,Ds,Os,Ns,Ls,$s,Ms,Bs,Fs,js,ct,Le,Pt,xe,Hs,Us,zs,qs,Ws,Vs,Gs,Ks,$r,Js,Mr,Ys,Vi,Zs,Qs,ea,ta,ra,na,ia,oa,sa,aa,ca,la,ua}from"./vm-hands-entry-lite-fxptf351.js";import{at,Oe,X,te}from"./vm-hands-entry-lite-kbnxk71q.js";import{F,_n}from"./vm-hands-entry-lite-zp7chzcc.js";import{ni,Wa,Va,Qe,Ga,Ka,rn,Ja,Xa,Ya,oi,ai,ci,So,Eo,li,rc,ko,ui,Pe,J,sn,di,hi,et}from"./vm-hands-entry-lite-fs6jbfp3.js";import{U,H,T}from"./vm-hands-entry-lite-qjrgvdbj.js";import{Ba,Fa,_o,Ha,yo,Ua,lr,Qn}from"./vm-hands-entry-lite-5qrft0nw.js";import{ue}from"./vm-hands-entry-lite-cc8hwgxc.js";import{je}from"./vm-hands-entry-lite-s93f3pbv.js";import{Se}from"./vm-hands-entry-lite-xfak34av.js";import{Xn,Yn,$a}from"./vm-hands-entry-lite-ngry8nkq.js";import{Pc,Rc,Ar,Tc,Ic,Dc,Oc,Nc,Lc,$c}from"./vm-hands-entry-lite-13nx02p7.js";import{yi,pn,wi,Bo,Fo}from"./vm-hands-entry-lite-3q2ng4e9.js";import{un,jt,dn}from"./vm-hands-entry-lite-x6ybft9v.js";import{A,Qo}from"./vm-hands-entry-lite-50kqbrb7.js";import{xc,Cc}from"./vm-hands-entry-lite-b2w5071h.js";import{vr}from"./vm-hands-entry-lite-chq0qx9f.js";import{Xo}from"./vm-hands-entry-lite-2gxv7v1h.js";import{hr,$o}from"./vm-hands-entry-lite-ezhfkjqr.js";import{tt,sc,ac}from"./vm-hands-entry-lite-b1vanmtv.js";import{ln}from"./vm-hands-entry-lite-q62g6sx0.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{vt,Rn,Tn,In,L}from"./vm-hands-entry-lite-fccn6s4j.js";import{s,Ge}from"./vm-hands-entry-lite-12ck5swp.js";import{t,V,o,_,d,n,we,P,$e,c,i,Yc}from"./vm-hands-entry-lite-zpvr7wc6.js";import{Y,Me,Dt,Be,Yi}from"./vm-hands-entry-lite-pg7nnyc6.js";import{Ot}from"./vm-hands-entry-lite-wnqqjsew.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{request as lc}from"http";import{request as cc}from"https";import{lookup as uc}from"dns/promises";import{isIP as dc}from"net";async function pc(e){let a=new URL(e.url);return await new Promise((l,u)=>{let p=(a.protocol==="https:"?cc:lc)(a,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:da},(m)=>l({response:m,close:()=>{m.destroy(),p.destroy(),m.socket?.destroy()}}));p.once("error",u),p.once("timeout",()=>p.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),p.end(e.body)})}var fi=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),mc=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function gi(e,a=0){if(!e||typeof e!=="object"||a>3)return null;let l=e.code;if(typeof l==="string"){if(fi.has(l))return"custom_endpoint_host_not_found";if(mc.has(l))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(l))return"custom_endpoint_tls_failed"}for(let u of[...e instanceof AggregateError?e.errors:[],e.cause]){let p=gi(u,a+1);if(p)return p}return null}async function fc(e,a){let l=gi(e),u=new URL(a).hostname.replace(/^\[|\]$/g,"");if(l!==null&&l!=="custom_endpoint_connection_failed"||dc(u)!==0)return l;let p;return await Promise.race([uc(u).then(()=>!0,(f)=>!fi.has(String(f?.code))),new Promise((f)=>{p=setTimeout(()=>f(!0),5000)})]).finally(()=>clearTimeout(p))?l:"custom_endpoint_host_not_found"}function hc(e){for(let a=42;;a++){if(a===127)a=256;let l=String.fromCodePoint(a);if(!e.includes(l))return l}}function gc(e,a){let l=Buffer.from(e),u=Buffer.from(a),p=new Uint32Array(l.length);for(let f=1,g=0;f<l.length;f++){while(g&&l[f]!==l[g])g=p[g-1];if(l[f]===l[g])g++;p[f]=g}let m=0;return(f,g=!1)=>{let b=Buffer.allocUnsafe(f.length*u.length+m),y=0;for(let h of f){while(m&&l[m]!==h){let w=p[m-1];y+=l.copy(b,y,0,m-w),m=w}if(l[m]===h){if(m++,m===l.length)y+=u.copy(b,y),m=0}else b[y++]=h}if(g)y+=l.copy(b,y,0,m),m=0;return b.subarray(0,y)}}async function _i(e){e.signal.throwIfAborted();let a=pa.safeParse(e.payload);if(!a.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let l=a.data,u=ha.parse(await e.credential(e.signal));if(!Ki(l,{baseUrl:l.baseUrl,api:u.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let p,m,f=0,g=0,b=0,y=hc(u.apiKey),h=gc(u.apiKey,y),w=async(v,R)=>{e.signal.throwIfAborted(),await new Promise((I,x)=>{let E=()=>{e.signal.removeEventListener("abort",E),x(e.signal.reason)};if(e.signal.addEventListener("abort",E,{once:!0}),e.signal.aborted){E();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(v,R))).then(()=>{e.signal.removeEventListener("abort",E),I()},(O)=>{e.signal.removeEventListener("abort",E),x(O)})})},S=async(v)=>{if(f+=v.length,f>Hn)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let R=0;R<v.length;R+=Br){if(b>=Gi)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await w(`custom_endpoint.chunk.${b++}`,{eof:!1,data:v.subarray(R,R+Br).toString("base64")})}};try{let v=await pc({url:l.url,body:l.body,signal:e.signal,headers:{...l.headers,...u.api==="anthropic-messages"?{"x-api-key":u.apiKey}:{authorization:`Bearer ${u.apiKey}`}}});p=v.response,m=v.close;let R=p.statusCode??500;if(R>=300&&R<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(p.headers["content-encoding"]&&p.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let I={};for(let x of["content-type","retry-after","x-request-id","request-id"]){let E=p.headers[x];if(typeof E==="string")I[x]=E.replaceAll(u.apiKey,y).slice(0,4096)}await w("custom_endpoint.headers",{status:R,statusText:(p.statusMessage??"").replaceAll(u.apiKey,y).slice(0,256),headers:I});for await(let x of p){e.signal.throwIfAborted();let E=Buffer.isBuffer(x)?x:Buffer.from(x);if(g+=E.length,g>Hn)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await S(h(E))}return await S(h(Buffer.alloc(0),!0)),await w(`custom_endpoint.chunk.${b}`,{eof:!0}),{bytes:f,chunks:b}}catch(v){if(e.signal.throwIfAborted(),v instanceof r)throw v;throw new r((p?null:await fc(v,l.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{m?.()}}import{join as bi}from"path";function _c(e,a){return e===bi(a,".ara","workspace")||e===bi(a,".reason","workspace")}function Si(e,a){let l=e.filter((u)=>_c(u.path,a));return l.length===1?l[0].path:null}var yc=/^[a-f0-9]{64}$/;var Yr=32,bc=/^\/[^\x00-\x1f\x7f\\]*$/;function tr(e){if(typeof e!=="string"||e.length>4096||!bc.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((a)=>a!==""&&a!=="."&&a!=="..")}function nr(e,a){let l=a==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!l)return e;let u=l[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${l[1].toUpperCase()}:${u?`/${u}`:""}`}function ir(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let a=e;if(!tr(a.home)||!Array.isArray(a.roots)||a.roots.length>Yr)return;let l=[];for(let u of a.roots){if(!u||typeof u!=="object"||Array.isArray(u))return;let{path_fingerprint:p,path:m}=u;if(typeof p!=="string"||!yc.test(p)||!tr(m))return;l.push({path_fingerprint:p,path:m})}return{home:a.home,roots:l}}function wc(e){let a=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&a?a:void 0}function Sc(e){return wc(e)??e.email.toLowerCase()}function Kr(e){let a=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return a?Sc({name:a[1],email:a[2]}):e.trim().toLowerCase()}var Lt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(a)=>`[${a.toLowerCase()}${a.toUpperCase()}]`),vc=[...vt.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...Rn.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...[...Tn].map((e)=>`/(${Lt(e)})$`),`/${Lt(".env.")}[^/]*$`,...In.map((e)=>`/[^/]*${Lt(e)}$`)],vi=`function localGithubSandboxProfile(root, temporary) {
+import{rr,Br,Un,Ki,Fr,jr,pa,Ji,ha,fa,Hr}from"./vm-hands-entry-lite-1cdtev4n.js";import{Ct,Fn,vs,Or,Vc,Je,Gc,Kc,Qt,Xe,M,At,ks,jn,xs,Lr,Rs,Ts,Is,Ds,Os,Ns,Ls,$s,Ms,Bs,Fs,js,Hs,ct,Le,Pt,xe,Us,zs,qs,Ws,Vs,Gs,Ks,Js,$r,Xs,Mr,Zs,Gi,Qs,ea,ta,ra,na,ia,oa,sa,aa,ca,la,ua,da}from"./vm-hands-entry-lite-vvhfaxpd.js";import{at,Oe,X,te}from"./vm-hands-entry-lite-hpw27zfb.js";import{F,yn}from"./vm-hands-entry-lite-bc9zq8gx.js";import{ii,Va,Ga,Qe,Ka,Ja,rn,Xa,Ya,Za,si,ci,li,Eo,ko,ui,nc,xo,di,Pe,J,sn,pi,fi,et}from"./vm-hands-entry-lite-mktndd2r.js";import{U,H,T}from"./vm-hands-entry-lite-bbjsnjct.js";import{Fa,ja,yo,Ua,wo,za,lr,ei}from"./vm-hands-entry-lite-7jmt3q38.js";import{ue}from"./vm-hands-entry-lite-t2rhwchw.js";import{je}from"./vm-hands-entry-lite-732hnx41.js";import{Se}from"./vm-hands-entry-lite-1as6h9ed.js";import{Yn,Zn,Ma}from"./vm-hands-entry-lite-bqs4pkyb.js";import{Pc,Rc,Ar,Tc,Ic,Dc,Oc,Nc,Lc,$c}from"./vm-hands-entry-lite-hh0kba1y.js";import{wi,hn,bi,Fo,jo}from"./vm-hands-entry-lite-3594pdj0.js";import{dn,jt,pn}from"./vm-hands-entry-lite-jm9jpj77.js";import{A,es}from"./vm-hands-entry-lite-9meg54bs.js";import{xc,Cc}from"./vm-hands-entry-lite-bcz4qpp6.js";import{vr}from"./vm-hands-entry-lite-g0bpdyfz.js";import{Yo}from"./vm-hands-entry-lite-ksfd234v.js";import{hr,Mo}from"./vm-hands-entry-lite-kzygj0q8.js";import{tt,sc,ac}from"./vm-hands-entry-lite-sxnvhzy5.js";import{un}from"./vm-hands-entry-lite-chve4vmh.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{vt,Tn,In,Dn,L}from"./vm-hands-entry-lite-hpe54h0b.js";import{s,Ge}from"./vm-hands-entry-lite-tzv8s0e7.js";import{t,V,o,_,d,n,we,P,$e,c,i,Yc}from"./vm-hands-entry-lite-bt6skt4h.js";import{Y,Me,Dt,Be,Zi}from"./vm-hands-entry-lite-04nx5y4f.js";import{Ot}from"./vm-hands-entry-lite-wnqqjsew.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{request as lc}from"http";import{request as cc}from"https";import{lookup as uc}from"dns/promises";import{isIP as dc}from"net";async function pc(e){let a=new URL(e.url);return await new Promise((l,u)=>{let p=(a.protocol==="https:"?cc:lc)(a,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:pa},(m)=>l({response:m,close:()=>{m.destroy(),p.destroy(),m.socket?.destroy()}}));p.once("error",u),p.once("timeout",()=>p.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),p.end(e.body)})}var mi=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),mc=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function hi(e,a=0){if(!e||typeof e!=="object"||a>3)return null;let l=e.code;if(typeof l==="string"){if(mi.has(l))return"custom_endpoint_host_not_found";if(mc.has(l))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(l))return"custom_endpoint_tls_failed"}for(let u of[...e instanceof AggregateError?e.errors:[],e.cause]){let p=hi(u,a+1);if(p)return p}return null}async function fc(e,a){let l=hi(e),u=new URL(a).hostname.replace(/^\[|\]$/g,"");if(l!==null&&l!=="custom_endpoint_connection_failed"||dc(u)!==0)return l;let p;return await Promise.race([uc(u).then(()=>!0,(f)=>!mi.has(String(f?.code))),new Promise((f)=>{p=setTimeout(()=>f(!0),5000)})]).finally(()=>clearTimeout(p))?l:"custom_endpoint_host_not_found"}function hc(e){for(let a=42;;a++){if(a===127)a=256;let l=String.fromCodePoint(a);if(!e.includes(l))return l}}function gc(e,a){let l=Buffer.from(e),u=Buffer.from(a),p=new Uint32Array(l.length);for(let f=1,g=0;f<l.length;f++){while(g&&l[f]!==l[g])g=p[g-1];if(l[f]===l[g])g++;p[f]=g}let m=0;return(f,g=!1)=>{let b=Buffer.allocUnsafe(f.length*u.length+m),y=0;for(let h of f){while(m&&l[m]!==h){let w=p[m-1];y+=l.copy(b,y,0,m-w),m=w}if(l[m]===h){if(m++,m===l.length)y+=u.copy(b,y),m=0}else b[y++]=h}if(g)y+=l.copy(b,y,0,m),m=0;return b.subarray(0,y)}}async function gi(e){e.signal.throwIfAborted();let a=ha.safeParse(e.payload);if(!a.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let l=a.data,u=fa.parse(await e.credential(e.signal));if(!Ji(l,{baseUrl:l.baseUrl,api:u.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let p,m,f=0,g=0,b=0,y=hc(u.apiKey),h=gc(u.apiKey,y),w=async(v,R)=>{e.signal.throwIfAborted(),await new Promise((I,x)=>{let E=()=>{e.signal.removeEventListener("abort",E),x(e.signal.reason)};if(e.signal.addEventListener("abort",E,{once:!0}),e.signal.aborted){E();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(v,R))).then(()=>{e.signal.removeEventListener("abort",E),I()},(O)=>{e.signal.removeEventListener("abort",E),x(O)})})},S=async(v)=>{if(f+=v.length,f>Un)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let R=0;R<v.length;R+=Br){if(b>=Ki)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await w(`custom_endpoint.chunk.${b++}`,{eof:!1,data:v.subarray(R,R+Br).toString("base64")})}};try{let v=await pc({url:l.url,body:l.body,signal:e.signal,headers:{...l.headers,...u.api==="anthropic-messages"?{"x-api-key":u.apiKey}:{authorization:`Bearer ${u.apiKey}`}}});p=v.response,m=v.close;let R=p.statusCode??500;if(R>=300&&R<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(p.headers["content-encoding"]&&p.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let I={};for(let x of["content-type","retry-after","x-request-id","request-id"]){let E=p.headers[x];if(typeof E==="string")I[x]=E.replaceAll(u.apiKey,y).slice(0,4096)}await w("custom_endpoint.headers",{status:R,statusText:(p.statusMessage??"").replaceAll(u.apiKey,y).slice(0,256),headers:I});for await(let x of p){e.signal.throwIfAborted();let E=Buffer.isBuffer(x)?x:Buffer.from(x);if(g+=E.length,g>Un)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await S(h(E))}return await S(h(Buffer.alloc(0),!0)),await w(`custom_endpoint.chunk.${b}`,{eof:!0}),{bytes:f,chunks:b}}catch(v){if(e.signal.throwIfAborted(),v instanceof r)throw v;throw new r((p?null:await fc(v,l.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{m?.()}}import{join as _i}from"path";function _c(e,a){return e===_i(a,".ara","workspace")||e===_i(a,".reason","workspace")}function yi(e,a){let l=e.filter((u)=>_c(u.path,a));return l.length===1?l[0].path:null}var yc=/^[a-f0-9]{64}$/;var Yr=32,bc=/^\/[^\x00-\x1f\x7f\\]*$/;function tr(e){if(typeof e!=="string"||e.length>4096||!bc.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((a)=>a!==""&&a!=="."&&a!=="..")}function nr(e,a){let l=a==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!l)return e;let u=l[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${l[1].toUpperCase()}:${u?`/${u}`:""}`}function ir(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let a=e;if(!tr(a.home)||!Array.isArray(a.roots)||a.roots.length>Yr)return;let l=[];for(let u of a.roots){if(!u||typeof u!=="object"||Array.isArray(u))return;let{path_fingerprint:p,path:m}=u;if(typeof p!=="string"||!yc.test(p)||!tr(m))return;l.push({path_fingerprint:p,path:m})}return{home:a.home,roots:l}}function wc(e){let a=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&a?a:void 0}function Sc(e){return wc(e)??e.email.toLowerCase()}function Kr(e){let a=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return a?Sc({name:a[1],email:a[2]}):e.trim().toLowerCase()}var Lt=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(a)=>`[${a.toLowerCase()}${a.toUpperCase()}]`),vc=[...vt.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...Tn.map((e)=>`/(${e.map(Lt).join("/")})(/|$)`),...[...In].map((e)=>`/(${Lt(e)})$`),`/${Lt(".env.")}[^/]*$`,...Dn.map((e)=>`/[^/]*${Lt(e)}$`)],Si=`function localGithubSandboxProfile(root, temporary) {
   return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
     '(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
     '(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',
@@ -10,32 +10,32 @@ import{rr,Br,Hn,Gi,Fr,jr,da,Ki,pa,ha,Hr}from"./vm-hands-entry-lite-gxf2r5en.js";
     '(deny file-write* (subpath "/opt/homebrew") (subpath "/usr/local") (subpath "/Library/Developer") (subpath "/cores"))',
     ...${JSON.stringify(vc)}.map(pattern => '(deny file-read* file-write* (regex #"'+pattern+'"))'),
     '(deny network*)','(deny mach-lookup)','(deny process-info*)','(allow process-info* (target same-sandbox))','(allow process-info-listpids)','(allow file-read-metadata (subpath "/dev"))','(deny signal)','(allow signal (target same-sandbox))'].join('\\n');
-}`;import{spawn as Ac,spawnSync as kc}from"child_process";import*as z from"fs";import*as oe from"path";import{homedir as Mc}from"os";function Ri(e,a,l,u="gh"){if(!["gh","git"].includes(u))throw Error("local_device_gh_unavailable");let p=e.realpathSync(l);if(process.platform==="win32"){let f=(g)=>g.toLowerCase()===p.toLowerCase()||g.toLowerCase().startsWith(p.toLowerCase()+a.sep);for(let g of new Set([process.env.ProgramW6432,process.env.ProgramFiles])){if(!g)continue;try{let b=e.realpathSync(u==="gh"?`${g}\\GitHub CLI\\gh.exe`:`${g}\\Git\\cmd\\git.exe`);if(!f(b)&&b.toLowerCase().startsWith(g.toLowerCase()+"\\")&&e.statSync(b).isFile())return b}catch{}}throw Error("local_device_gh_unavailable")}let m=u==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+u;for(let f of["/opt/homebrew/bin/"+u,"/usr/local/bin/"+u,m])try{let g=e.realpathSync(f);if(g===p||g.startsWith(p+a.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...u==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((y)=>g.startsWith(y)))continue;let b=e.statSync(g);if(!b.isFile()||(b.mode&18)!==0||![0,process.getuid()].includes(b.uid))continue;return e.accessSync(g,e.constants.X_OK),g}catch{continue}throw Error("local_device_gh_unavailable")}function xi(e,a){let l=1;for(let u=0;u<a;u+=1)if(e.charCodeAt(u)===10)l+=1;return l}var Ei=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function Xr(e){let a=e.trim().replaceAll("\\","/");if(!a)return{valid:!1,reason:"empty_path"};if(a.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(a.split("/").includes("..")||a.includes("../")||a.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(a===".git"||a.startsWith(".git/")||a.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function Ci(e){return[...new Set(e.map((a)=>a.trim()).filter((a)=>a.length>=8))]}function Pi(e,a){return[...a.matchAll(new RegExp(e.regex.source,`${e.regex.flags}g`))]}function cr(e,a=[],l={}){let u=[],p=l.published??new Set,m=Ci(a).filter((f)=>!p.has(f));for(let f of e){let g=Xr(f.path);if(!g.valid){u.push({path:f.path,reason:g.reason??"invalid_path"});continue}let b=f.content??"",y=m.map((h)=>({secret:h,offset:b.indexOf(h)})).filter((h)=>h.offset>=0).sort((h,w)=>h.offset-w.offset);if(y.length>0){let h=[...new Set(y.flatMap((w)=>l.secretNames?.(w.secret)??[]))];u.push({path:f.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:xi(b,y[0].offset),...h.length>0?{secretNames:h}:{}})}for(let h of Ei){let w=Pi(h,b).find((S)=>!p.has(S[0]));if(w){u.push({path:f.path,reason:`credential_pattern_detected: ${h.name}`,pattern:h.name,ruleId:h.name,line:xi(b,w.index)});break}}}return{clean:u.length===0,violations:u,scannedObjectCount:e.length}}function Oi(e,a=[]){let l=Ci(a),u=new Set;for(let{content:p}of e){for(let m of l)if(p.includes(m))u.add(m);for(let m of Ei)for(let f of Pi(m,p))u.add(f[0])}return[...u]}function Ec(e,a){let l=0;for(let u=e.indexOf(a);u>=0;u=e.indexOf(a,u+a.length))l+=1;return l}function Ii(e,a,l){let u=(p,m)=>p.reduce((f,g)=>f+Ec(g,m),0);return new Set(e.filter((p)=>u(a,p)<=u(l,p)))}var ut=4194304,Fe=process.platform==="win32",Tt=process.env.SystemRoot??"C:\\Windows",Bc=(e)=>Fe?kc(oe.win32.join(Tt,"System32","taskkill.exe"),["/PID",String(e),"/T","/F"],{stdio:"ignore",windowsHide:!0}):process.kill(-e,"SIGKILL"),kt=Fe?[oe.win32.join(Tt,"System32"),Tt].join(";"):"/usr/bin:/bin:/usr/sbin:/sbin",ur=Fe?{SystemRoot:Tt,WINDIR:Tt}:{},Fc=(e)=>Fe?oe.win32.resolve(e,"..","..","bin","sh.exe"):"/bin/sh",Ai=536870912,Jr=/^[a-f0-9]{40}$/,Uc=(e,a,l)=>new Promise((u)=>{if(l.signal?.aborted){u({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let p;try{p=Ac(e,a,{cwd:l.cwd,env:l.env,...Fe?{windowsHide:!0}:{detached:!0},stdio:["pipe","pipe","pipe"]})}catch{u({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let m=Buffer.alloc(0),f=Buffer.alloc(0),g,b=!1,y=(v)=>{if(g??=Error(v),p.pid)try{Bc(p.pid)}catch{}},h=()=>y("cancelled"),w=setTimeout(()=>y("timeout"),l.timeout);l.signal?.addEventListener("abort",h,{once:!0});let S=(v)=>{if(b)return;b=!0,clearTimeout(w),l.signal?.removeEventListener("abort",h),u({status:v,stdout:m,stderr:f,...g?{error:g}:{}})};if(p.stdout.on("data",(v)=>{if(m.length+f.length+v.length>l.maxBuffer)y("output_limit");else m=Buffer.concat([m,v])}),p.stderr.on("data",(v)=>{if(m.length+f.length+v.length>l.maxBuffer)y("output_limit");else f=Buffer.concat([f,v])}),p.on("error",()=>{if(y("spawn_failed"),!p.pid)S(null)}),p.on("close",(v)=>S(v)),p.stdin.on("error",()=>y("input_failed")),p.stdin.end(l.input),l.signal?.aborted)h()}),Hc={command:Uc,gh:(e,a)=>Ri(z,oe,e,a),home:Mc};function N(e){throw Error(e)}function tn(e,a){let[l,u]=Fe?[e.toLowerCase(),a.toLowerCase()]:[e,a];return u===l||u.startsWith(l+oe.sep)}function jc(e,a){let l=new Set(e.split(/\r?\n/).map(Kr));return a.filter((u)=>{let p=Kr(u);if(l.has(p))return!1;return l.add(p),!0})}var qc=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),Wc=(e)=>JSON.stringify(e,(a,l)=>qc.has(a)?void 0:l);function Li(e,a,l){let u=[...new Set(e.map((m)=>`${a(m.path)}${m.line?`:${m.line}`:""} (${m.reason==="literal_secret_detected"?`value of ${m.secretNames?.length?m.secretNames.slice(0,3).join(", "):"a session variable"}`:`${m.ruleId??"credential"} credential`})`))].slice(0,10),p=e.some((m)=>m.reason==="literal_secret_detected");N(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${u.join("; ")}. Nothing was sent. ${l}${p?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function ki(e,a,l=Hc){let u=Ct.parse(e),p="local_device_gh_prepare_setup";try{if(!["darwin","linux","win32"].includes(process.platform))N("local_device_gh_platform_unavailable");a.assertCurrent();let m=z.realpathSync(a.root);if(m===oe.parse(m).root)N("local_device_gh_root_unavailable");if(!Qt(u)&&!a.forbiddenSecretValues)N("local_device_gh_secret_scope_unavailable");if(!Qt(u)&&a.readOnly)N("local_device_gh_read_only");if(!Qt(u)){let C=cr([{path:"github-operation",content:Wc(u)}],a.forbiddenSecretValues,a.secretNames?{secretNames:a.secretNames}:{});if(!C.clean)Li(C.violations,()=>`the ${u.kind} request text`,"Remove it from the pull request text and try again.")}let f=l.gh(m),g=l.home(),b=l.gh(m,"git"),y=a.privateDirectory?z.realpathSync(a.privateDirectory):z.realpathSync(g);if(!Qt(u)&&(!a.privateDirectory||tn(m,y)))N("local_device_gh_private_scope_unavailable");let h={...ur,PATH:Fe?[oe.dirname(b),kt].join(";"):kt,HOME:g,GH_CONFIG_DIR:Fe&&process.env.APPDATA?oe.join(process.env.APPDATA,"GitHub CLI"):oe.join(g,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:Fe?"":"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((C)=>process.env[C]?[[C,process.env[C]]]:[])):{}},w=async(C,j,W=y,Z,ie=ut)=>{a.assertCurrent();let se=await l.command(C,j,{cwd:W,env:h,input:Z,maxBuffer:ie,timeout:Math.max(1,Math.min(60000,(a.deadlineMs??Date.now()+60000)-Date.now())),signal:a.signal});if(a.assertCurrent(),se.error||se.status!==0)N("local_device_gh_command_failed");return se.stdout},S=async(C)=>(await w(f,C)).toString("utf8").trim(),v=async(C,j="application/vnd.github+json")=>{Gc(u.repoFullName,C,{headers:{accept:j}}),a.assertCurrent();let W=await l.command(f,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${j}`,C],{cwd:y,env:h,maxBuffer:ut,timeout:Math.max(1,Math.min(25000,(a.deadlineMs??Date.now()+25000)-Date.now())),signal:a.signal});if(a.assertCurrent(),W.error&&W.status===null)N("local_device_gh_response_unavailable");let Z=W.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!Z)N("local_device_gh_response_invalid");let ie=Number(Z[1]);if(ie>=200&&ie<300&&W.status!==0)N("local_device_gh_response_unavailable");if(Buffer.byteLength(Z[3])>Or)N("local_device_gh_response_too_large");let se={};for(let ye of Z[2].split(/\r?\n/)){let Re=ye.indexOf(":"),Ze=ye.slice(0,Re).toLowerCase();if(["link","content-type"].includes(Ze))se[Ze]=ye.slice(Re+1).trim().slice(0,8192)}return{kind:"read",status:ie,headers:se,body:ie>=200&&ie<300?Z[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(u.kind==="read")return v(u.path,u.accept);if(u.kind==="pr_review_context"){let[C,j]=u.repoFullName.split("/"),W=await S(["api","graphql","--hostname","github.com","-f",`query=${Kc}`,"-f",`owner=${C}`,"-f",`repo=${j}`,"-F",`number=${u.number}`,...u.after?["-f",`after=${u.after}`]:[]]);if(Buffer.byteLength(W)>Or)N("local_device_gh_response_too_large");let Z=JSON.parse(W);if(Z.errors||Z.data?.repository?.nameWithOwner?.toLowerCase()!==u.repoFullName.toLowerCase()||Z.data.repository.pullRequest?.number!==u.number)N("local_device_gh_response_invalid");return{kind:"pr_review_context",body:W}}if(u.kind==="pr_merge"){let C=await v(`/repos/${u.repoFullName}/pulls/${u.number}`),j=JSON.parse(C.body),W=(se)=>se.number===u.number&&se.html_url===`https://github.com/${u.repoFullName}/pull/${u.number}`&&se.base?.repo?.full_name?.toLowerCase()===u.repoFullName.toLowerCase()&&se.base?.ref===u.expectedBaseRef&&se.head?.sha===u.expectedHeadSha;if(C.status!==200||!W(j)||j.state!=="open"||j.draft!==!1||j.head?.sha!==u.expectedHeadSha||j.base?.repo?.full_name?.toLowerCase()!==u.repoFullName.toLowerCase())N("local_device_gh_merge_target_changed");await S(["pr","merge",String(u.number),`--repo=${u.repoFullName}`,`--${u.method}`,"--match-head-commit",u.expectedHeadSha,...u.commitBody!==void 0&&u.method!=="rebase"?[`--body=${u.commitBody}`]:[]]);let Z=await v(`/repos/${u.repoFullName}/pulls/${u.number}`),ie=JSON.parse(Z.body);if(Z.status!==200||!W(ie)||ie.merged!==!0)N("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:u.number,merged:!0}}if(u.kind==="pr_create"){if(u.head===u.base)N("local_device_gh_default_branch");let C=await S(["pr","create","--repo",u.repoFullName,"--head",u.head,"--base",u.base,`--title=${u.title}`,`--body=${u.body}`,...u.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+u.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(C))N("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:C}}if(u.kind==="pr_mutation"){let C=u.mutation,j=C.action==="edit"?["edit",...C.title!==void 0?[`--title=${C.title}`]:[],...C.body!==void 0?[`--body=${C.body}`]:[],...C.base?[`--base=${C.base}`]:[]]:C.action==="metadata"?["edit",`--${C.change}-${C.field}=${C.value}`]:C.action==="ready"?["ready"]:C.action==="draft"?["ready","--undo"]:["close"];return await S(["pr",...j,String(u.number),"--repo",u.repoFullName]),{kind:"pr_mutation",number:u.number,applied:!0}}if(!a.repoPath)N("local_device_gh_workspace_unavailable");let R=z.realpathSync(a.repoPath);if(!tn(m,R))N("local_device_gh_workspace_unavailable");let I=`https://github.com/${u.repoFullName}.git`,x="!'"+(Fe?f.replace(/\\/g,"/"):f).replace(/'/g,"'\\''")+"' auth git-credential",E=Ot(vi),O=(C,j,W)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",C,j,...W]]:[j,W],D=async(C,j,W,Z=ut)=>{let ie=tn(y,C),se=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...ie?["-c",`credential.https://github.com.helper=${x}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",...j];if(ie)return w(b,se,C,W,Z);let ye=oe.join(R,".ara-local-gh-tmp");if(z.mkdirSync(ye,{recursive:!0,mode:448}),z.lstatSync(ye).isSymbolicLink()||z.realpathSync(ye)!==ye)N("local_device_gh_workspace_unavailable");a.assertCurrent();let Re=await l.command(...O(E(R,ye),b,se),{cwd:C,input:W,maxBuffer:Z,timeout:Math.max(1,Math.min(25000,(a.deadlineMs??Date.now()+25000)-Date.now())),signal:a.signal,env:{...ur,PATH:kt,HOME:R,TMPDIR:ye,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(a.assertCurrent(),Re.error||Re.status!==0)N("local_device_gh_collection_failed");return Re.stdout},B=async(C,j)=>(await D(C,j)).toString("utf8").trim(),ne=async(C,j)=>{let W=oe.join(C,".ara-local-gh-tmp");if(z.mkdirSync(W,{recursive:!0,mode:448}),z.lstatSync(W).isSymbolicLink()||z.realpathSync(W)!==W)N("local_device_gh_workspace_unavailable");a.assertCurrent();let Z=await l.command(...O(E(C,W),Fc(b),["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",j]),{cwd:C,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(a.deadlineMs??Date.now()+25000)-Date.now())),signal:a.signal,env:{...ur,PATH:kt,HOME:C,TMPDIR:W}});if(a.assertCurrent(),Z.error||Z.status!==0)N("local_device_gh_materialization_failed")},de=async(C)=>{let j=new Map;if(C.length===0)return j;let W=await D(ce,["cat-file","--batch"],[...new Set(C)].join(`
+}`;import{spawn as Ac,spawnSync as kc}from"child_process";import*as z from"fs";import*as oe from"path";import{homedir as Mc}from"os";function vi(e,a,l,u="gh"){if(!["gh","git"].includes(u))throw Error("local_device_gh_unavailable");let p=e.realpathSync(l);if(process.platform==="win32"){let f=(g)=>g.toLowerCase()===p.toLowerCase()||g.toLowerCase().startsWith(p.toLowerCase()+a.sep);for(let g of new Set([process.env.ProgramW6432,process.env.ProgramFiles])){if(!g)continue;try{let b=e.realpathSync(u==="gh"?`${g}\\GitHub CLI\\gh.exe`:`${g}\\Git\\cmd\\git.exe`);if(!f(b)&&b.toLowerCase().startsWith(g.toLowerCase()+"\\")&&e.statSync(b).isFile())return b}catch{}}throw Error("local_device_gh_unavailable")}let m=u==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+u;for(let f of["/opt/homebrew/bin/"+u,"/usr/local/bin/"+u,m])try{let g=e.realpathSync(f);if(g===p||g.startsWith(p+a.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...u==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((y)=>g.startsWith(y)))continue;let b=e.statSync(g);if(!b.isFile()||(b.mode&18)!==0||![0,process.getuid()].includes(b.uid))continue;return e.accessSync(g,e.constants.X_OK),g}catch{continue}throw Error("local_device_gh_unavailable")}function Ri(e,a){let l=1;for(let u=0;u<a;u+=1)if(e.charCodeAt(u)===10)l+=1;return l}var xi=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function Xr(e){let a=e.trim().replaceAll("\\","/");if(!a)return{valid:!1,reason:"empty_path"};if(a.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(a.split("/").includes("..")||a.includes("../")||a.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(a===".git"||a.startsWith(".git/")||a.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function Ei(e){return[...new Set(e.map((a)=>a.trim()).filter((a)=>a.length>=8))]}function Ci(e,a){return[...a.matchAll(new RegExp(e.regex.source,`${e.regex.flags}g`))]}function cr(e,a=[],l={}){let u=[],p=l.published??new Set,m=Ei(a).filter((f)=>!p.has(f));for(let f of e){let g=Xr(f.path);if(!g.valid){u.push({path:f.path,reason:g.reason??"invalid_path"});continue}let b=f.content??"",y=m.map((h)=>({secret:h,offset:b.indexOf(h)})).filter((h)=>h.offset>=0).sort((h,w)=>h.offset-w.offset);if(y.length>0){let h=[...new Set(y.flatMap((w)=>l.secretNames?.(w.secret)??[]))];u.push({path:f.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:Ri(b,y[0].offset),...h.length>0?{secretNames:h}:{}})}for(let h of xi){let w=Ci(h,b).find((S)=>!p.has(S[0]));if(w){u.push({path:f.path,reason:`credential_pattern_detected: ${h.name}`,pattern:h.name,ruleId:h.name,line:Ri(b,w.index)});break}}}return{clean:u.length===0,violations:u,scannedObjectCount:e.length}}function Pi(e,a=[]){let l=Ei(a),u=new Set;for(let{content:p}of e){for(let m of l)if(p.includes(m))u.add(m);for(let m of xi)for(let f of Ci(m,p))u.add(f[0])}return[...u]}function Ec(e,a){let l=0;for(let u=e.indexOf(a);u>=0;u=e.indexOf(a,u+a.length))l+=1;return l}function Oi(e,a,l){let u=(p,m)=>p.reduce((f,g)=>f+Ec(g,m),0);return new Set(e.filter((p)=>u(a,p)<=u(l,p)))}var ut=4194304,Fe=process.platform==="win32",Tt=process.env.SystemRoot??"C:\\Windows",Bc=(e)=>Fe?kc(oe.win32.join(Tt,"System32","taskkill.exe"),["/PID",String(e),"/T","/F"],{stdio:"ignore",windowsHide:!0}):process.kill(-e,"SIGKILL"),kt=Fe?[oe.win32.join(Tt,"System32"),Tt].join(";"):"/usr/bin:/bin:/usr/sbin:/sbin",ur=Fe?{SystemRoot:Tt,WINDIR:Tt}:{},Fc=(e)=>Fe?oe.win32.resolve(e,"..","..","bin","sh.exe"):"/bin/sh",Ii=536870912,Jr=/^[a-f0-9]{40}$/,Uc=(e,a,l)=>new Promise((u)=>{if(l.signal?.aborted){u({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let p;try{p=Ac(e,a,{cwd:l.cwd,env:l.env,...Fe?{windowsHide:!0}:{detached:!0},stdio:["pipe","pipe","pipe"]})}catch{u({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let m=Buffer.alloc(0),f=Buffer.alloc(0),g,b=!1,y=(v)=>{if(g??=Error(v),p.pid)try{Bc(p.pid)}catch{}},h=()=>y("cancelled"),w=setTimeout(()=>y("timeout"),l.timeout);l.signal?.addEventListener("abort",h,{once:!0});let S=(v)=>{if(b)return;b=!0,clearTimeout(w),l.signal?.removeEventListener("abort",h),u({status:v,stdout:m,stderr:f,...g?{error:g}:{}})};if(p.stdout.on("data",(v)=>{if(m.length+f.length+v.length>l.maxBuffer)y("output_limit");else m=Buffer.concat([m,v])}),p.stderr.on("data",(v)=>{if(m.length+f.length+v.length>l.maxBuffer)y("output_limit");else f=Buffer.concat([f,v])}),p.on("error",()=>{if(y("spawn_failed"),!p.pid)S(null)}),p.on("close",(v)=>S(v)),p.stdin.on("error",()=>y("input_failed")),p.stdin.end(l.input),l.signal?.aborted)h()}),Hc={command:Uc,gh:(e,a)=>vi(z,oe,e,a),home:Mc};function N(e){throw Error(e)}function tn(e,a){let[l,u]=Fe?[e.toLowerCase(),a.toLowerCase()]:[e,a];return u===l||u.startsWith(l+oe.sep)}function jc(e,a){let l=new Set(e.split(/\r?\n/).map(Kr));return a.filter((u)=>{let p=Kr(u);if(l.has(p))return!1;return l.add(p),!0})}var qc=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),Wc=(e)=>JSON.stringify(e,(a,l)=>qc.has(a)?void 0:l);function Ai(e,a,l){let u=[...new Set(e.map((m)=>`${a(m.path)}${m.line?`:${m.line}`:""} (${m.reason==="literal_secret_detected"?`value of ${m.secretNames?.length?m.secretNames.slice(0,3).join(", "):"a session variable"}`:`${m.ruleId??"credential"} credential`})`))].slice(0,10),p=e.some((m)=>m.reason==="literal_secret_detected");N(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${u.join("; ")}. Nothing was sent. ${l}${p?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function Li(e,a,l=Hc){let u=Ct.parse(e),p="local_device_gh_prepare_setup";try{if(!["darwin","linux","win32"].includes(process.platform))N("local_device_gh_platform_unavailable");a.assertCurrent();let m=z.realpathSync(a.root);if(m===oe.parse(m).root)N("local_device_gh_root_unavailable");if(!Qt(u)&&!a.forbiddenSecretValues)N("local_device_gh_secret_scope_unavailable");if(!Qt(u)&&a.readOnly)N("local_device_gh_read_only");if(!Qt(u)){let C=cr([{path:"github-operation",content:Wc(u)}],a.forbiddenSecretValues,a.secretNames?{secretNames:a.secretNames}:{});if(!C.clean)Ai(C.violations,()=>`the ${u.kind} request text`,"Remove it from the pull request text and try again.")}let f=l.gh(m),g=l.home(),b=l.gh(m,"git"),y=a.privateDirectory?z.realpathSync(a.privateDirectory):z.realpathSync(g);if(!Qt(u)&&(!a.privateDirectory||tn(m,y)))N("local_device_gh_private_scope_unavailable");let h={...ur,PATH:Fe?[oe.dirname(b),kt].join(";"):kt,HOME:g,GH_CONFIG_DIR:Fe&&process.env.APPDATA?oe.join(process.env.APPDATA,"GitHub CLI"):oe.join(g,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:Fe?"":"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((C)=>process.env[C]?[[C,process.env[C]]]:[])):{}},w=async(C,j,W=y,Z,ie=ut)=>{a.assertCurrent();let se=await l.command(C,j,{cwd:W,env:h,input:Z,maxBuffer:ie,timeout:Math.max(1,Math.min(60000,(a.deadlineMs??Date.now()+60000)-Date.now())),signal:a.signal});if(a.assertCurrent(),se.error||se.status!==0)N("local_device_gh_command_failed");return se.stdout},S=async(C)=>(await w(f,C)).toString("utf8").trim(),v=async(C,j="application/vnd.github+json")=>{Gc(u.repoFullName,C,{headers:{accept:j}}),a.assertCurrent();let W=await l.command(f,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${j}`,C],{cwd:y,env:h,maxBuffer:ut,timeout:Math.max(1,Math.min(25000,(a.deadlineMs??Date.now()+25000)-Date.now())),signal:a.signal});if(a.assertCurrent(),W.error&&W.status===null)N("local_device_gh_response_unavailable");let Z=W.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!Z)N("local_device_gh_response_invalid");let ie=Number(Z[1]);if(ie>=200&&ie<300&&W.status!==0)N("local_device_gh_response_unavailable");if(Buffer.byteLength(Z[3])>Or)N("local_device_gh_response_too_large");let se={};for(let ye of Z[2].split(/\r?\n/)){let Re=ye.indexOf(":"),Ze=ye.slice(0,Re).toLowerCase();if(["link","content-type"].includes(Ze))se[Ze]=ye.slice(Re+1).trim().slice(0,8192)}return{kind:"read",status:ie,headers:se,body:ie>=200&&ie<300?Z[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(u.kind==="read")return v(u.path,u.accept);if(u.kind==="pr_review_context"){let[C,j]=u.repoFullName.split("/"),W=await S(["api","graphql","--hostname","github.com","-f",`query=${Kc}`,"-f",`owner=${C}`,"-f",`repo=${j}`,"-F",`number=${u.number}`,...u.after?["-f",`after=${u.after}`]:[]]);if(Buffer.byteLength(W)>Or)N("local_device_gh_response_too_large");let Z=JSON.parse(W);if(Z.errors||Z.data?.repository?.nameWithOwner?.toLowerCase()!==u.repoFullName.toLowerCase()||Z.data.repository.pullRequest?.number!==u.number)N("local_device_gh_response_invalid");return{kind:"pr_review_context",body:W}}if(u.kind==="pr_merge"){let C=await v(`/repos/${u.repoFullName}/pulls/${u.number}`),j=JSON.parse(C.body),W=(se)=>se.number===u.number&&se.html_url===`https://github.com/${u.repoFullName}/pull/${u.number}`&&se.base?.repo?.full_name?.toLowerCase()===u.repoFullName.toLowerCase()&&se.base?.ref===u.expectedBaseRef&&se.head?.sha===u.expectedHeadSha;if(C.status!==200||!W(j)||j.state!=="open"||j.draft!==!1||j.head?.sha!==u.expectedHeadSha||j.base?.repo?.full_name?.toLowerCase()!==u.repoFullName.toLowerCase())N("local_device_gh_merge_target_changed");await S(["pr","merge",String(u.number),`--repo=${u.repoFullName}`,`--${u.method}`,"--match-head-commit",u.expectedHeadSha,...u.commitBody!==void 0&&u.method!=="rebase"?[`--body=${u.commitBody}`]:[]]);let Z=await v(`/repos/${u.repoFullName}/pulls/${u.number}`),ie=JSON.parse(Z.body);if(Z.status!==200||!W(ie)||ie.merged!==!0)N("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:u.number,merged:!0}}if(u.kind==="pr_create"){if(u.head===u.base)N("local_device_gh_default_branch");let C=await S(["pr","create","--repo",u.repoFullName,"--head",u.head,"--base",u.base,`--title=${u.title}`,`--body=${u.body}`,...u.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+u.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(C))N("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:C}}if(u.kind==="pr_mutation"){let C=u.mutation,j=C.action==="edit"?["edit",...C.title!==void 0?[`--title=${C.title}`]:[],...C.body!==void 0?[`--body=${C.body}`]:[],...C.base?[`--base=${C.base}`]:[]]:C.action==="metadata"?["edit",`--${C.change}-${C.field}=${C.value}`]:C.action==="ready"?["ready"]:C.action==="draft"?["ready","--undo"]:["close"];return await S(["pr",...j,String(u.number),"--repo",u.repoFullName]),{kind:"pr_mutation",number:u.number,applied:!0}}if(!a.repoPath)N("local_device_gh_workspace_unavailable");let R=z.realpathSync(a.repoPath);if(!tn(m,R))N("local_device_gh_workspace_unavailable");let I=`https://github.com/${u.repoFullName}.git`,x="!'"+(Fe?f.replace(/\\/g,"/"):f).replace(/'/g,"'\\''")+"' auth git-credential",E=Ot(Si),O=(C,j,W)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",C,j,...W]]:[j,W],D=async(C,j,W,Z=ut)=>{let ie=tn(y,C),se=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...ie?["-c",`credential.https://github.com.helper=${x}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",...j];if(ie)return w(b,se,C,W,Z);let ye=oe.join(R,".ara-local-gh-tmp");if(z.mkdirSync(ye,{recursive:!0,mode:448}),z.lstatSync(ye).isSymbolicLink()||z.realpathSync(ye)!==ye)N("local_device_gh_workspace_unavailable");a.assertCurrent();let Re=await l.command(...O(E(R,ye),b,se),{cwd:C,input:W,maxBuffer:Z,timeout:Math.max(1,Math.min(25000,(a.deadlineMs??Date.now()+25000)-Date.now())),signal:a.signal,env:{...ur,PATH:kt,HOME:R,TMPDIR:ye,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(a.assertCurrent(),Re.error||Re.status!==0)N("local_device_gh_collection_failed");return Re.stdout},B=async(C,j)=>(await D(C,j)).toString("utf8").trim(),ne=async(C,j)=>{let W=oe.join(C,".ara-local-gh-tmp");if(z.mkdirSync(W,{recursive:!0,mode:448}),z.lstatSync(W).isSymbolicLink()||z.realpathSync(W)!==W)N("local_device_gh_workspace_unavailable");a.assertCurrent();let Z=await l.command(...O(E(C,W),Fc(b),["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",j]),{cwd:C,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(a.deadlineMs??Date.now()+25000)-Date.now())),signal:a.signal,env:{...ur,PATH:kt,HOME:C,TMPDIR:W}});if(a.assertCurrent(),Z.error||Z.status!==0)N("local_device_gh_materialization_failed")},de=async(C)=>{let j=new Map;if(C.length===0)return j;let W=await D(ce,["cat-file","--batch"],[...new Set(C)].join(`
 `)+`
 `,ut*8);for(let Z=0;Z<W.length;){let ie=W.indexOf(10,Z),[se,ye,Re]=W.subarray(Z,ie).toString("utf8").split(" ");if(ie<0||!se||ye!=="blob"||!/^[0-9]+$/.test(Re??""))N("local_device_gh_object_invalid");j.set(se,W.subarray(ie+1,ie+1+Number(Re)).toString("utf8")),Z=ie+1+Number(Re)+1}return j},he=async(C,j,W)=>{let Z=oe.join(R,".ara-local-gh-tmp"),ie=E(R,Z)+`
 (allow file-read* file-write* (subpath ${JSON.stringify(R)}))
 (allow file-read* (subpath ${JSON.stringify(C)}))
 (allow file-read-metadata (path-ancestors ${JSON.stringify(C)}))`,se=async(Re,Ze)=>{a.assertCurrent();let xt=await l.command(...O(ie,Re,Ze),{cwd:R,maxBuffer:ut,timeout:Math.max(1,Math.min(25000,(a.deadlineMs??Date.now()+25000)-Date.now())),signal:a.signal,env:{...ur,PATH:kt,HOME:R,TMPDIR:Z,GIT_INDEX_FILE:oe.join(R,".git","index"),OPENSSL_CONF:"/dev/null",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(a.assertCurrent(),xt.error||xt.status!==0)N("local_device_gh_materialization_failed")},ye=["--git-dir="+C,"--work-tree="+R,"-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=","-c","protocol.allow=never"];await se(b,[...ye,"read-tree",j]),await se(b,[...ye,"checkout-index","--all","--index"]),await D(R,["update-ref","refs/heads/"+W,j]),await D(R,["symbolic-ref","HEAD","refs/heads/"+W])};p="local_device_gh_prepare_metadata";let We=await v(`/repos/${u.repoFullName}`);if(We.status!==200)N("local_device_gh_repository_unavailable");let Ke=JSON.parse(We.body);if(Ke.full_name?.toLowerCase()!==u.repoFullName.toLowerCase()||Ke.default_branch!==u.defaultBranch||u.kind==="publish"&&Ke.permissions?.push!==!0)N("local_device_gh_repository_authority_changed");if(u.branch===u.defaultBranch)N("local_device_gh_default_branch");p="local_device_gh_prepare_private_init";let ce=z.mkdtempSync(oe.join(y,"github-publication-"));z.chmodSync(ce,448);let Zt=!1;try{if(await D(ce,["init","--bare","--template="]),u.kind==="prepare"){if(p="local_device_gh_prepare_fetch",await D(ce,["fetch","--depth=1","--no-tags","--no-recurse-submodules",I,u.baseSha]),await B(ce,["rev-parse","FETCH_HEAD"])!==u.baseSha)p="local_device_gh_prepare_base_mismatch",N("local_device_gh_base_changed");p="local_device_gh_prepare_checkout_validation";let pe=oe.join(R,".git"),Te=!1;if(z.existsSync(pe)){if(!z.lstatSync(pe).isDirectory()||z.lstatSync(pe).isSymbolicLink()||["objects/info/alternates","info/grafts"].some((ge)=>z.existsSync(oe.join(pe,ge))))N("local_device_gh_repository_layout_invalid");let ve=await D(R,["rev-parse","--verify","-q","HEAD"]).then((ge)=>ge.toString("utf8").trim(),()=>null),De=await D(R,["config","--local","--get","remote.origin.url"]).then((ge)=>ge.toString("utf8").trim(),()=>"");if(ve!==null||De){if(ve!==u.baseSha||await B(R,["branch","--show-current"])!==u.branch)N("local_device_gh_checkout_exists");return{kind:"prepare",headSha:u.baseSha}}Te=!0}let Ee=z.readdirSync(R).filter((ve)=>!(Te&&ve===".git")),He=[".ara-local-gh-tmp",".reason-local-gh-tmp"];if(Ee.some((ve)=>!He.includes(ve))||Ee.some((ve)=>{let De=oe.join(R,ve);return!z.lstatSync(De).isDirectory()||z.lstatSync(De).isSymbolicLink()||z.readdirSync(De).length>0}))N("local_device_gh_checkout_not_empty");if(p="local_device_gh_prepare_checkout_init",!Te)await D(R,["init","--template="]);p="local_device_gh_prepare_materialization";let Ve=await D(ce,["pack-objects","--stdout","--revs"],u.baseSha+`
-`,Ai);return await ne(R,u.baseSha),await D(R,["index-pack","--strict","--stdin"],Ve,65536),await D(R,["remote","add","origin",I]),await he(ce,u.baseSha,u.branch),{kind:"prepare",headSha:u.baseSha}}let C=oe.join(R,".git");if(!z.lstatSync(C).isDirectory()||z.lstatSync(C).isSymbolicLink()||["objects/info/alternates","info/grafts"].some((pe)=>z.existsSync(oe.join(C,pe))))N("local_device_gh_repository_layout_invalid");if(await B(R,["branch","--show-current"])!==u.branch)N("local_device_gh_branch_changed");let j=await B(R,["rev-parse","--verify","HEAD"]);if(!Jr.test(j))N("local_device_gh_head_invalid");let W=await v(`/repos/${u.repoFullName}/commits/${u.baseSha}`);if(W.status!==200||JSON.parse(W.body).sha!==u.baseSha)N("local_device_gh_base_unverified");let Z=await v(`/repos/${u.repoFullName}/git/ref/heads/${encodeURIComponent(u.branch)}`);if(u.remoteHeadSha===null?Z.status!==404:Z.status!==200||JSON.parse(Z.body).object?.sha!==u.remoteHeadSha)N("local_device_gh_remote_changed");let ie=[...(await B(R,["rev-list","--objects","--no-object-names",j,"--not",u.baseSha])).split(`
+`,Ii);return await ne(R,u.baseSha),await D(R,["index-pack","--strict","--stdin"],Ve,65536),await D(R,["remote","add","origin",I]),await he(ce,u.baseSha,u.branch),{kind:"prepare",headSha:u.baseSha}}let C=oe.join(R,".git");if(!z.lstatSync(C).isDirectory()||z.lstatSync(C).isSymbolicLink()||["objects/info/alternates","info/grafts"].some((pe)=>z.existsSync(oe.join(C,pe))))N("local_device_gh_repository_layout_invalid");if(await B(R,["branch","--show-current"])!==u.branch)N("local_device_gh_branch_changed");let j=await B(R,["rev-parse","--verify","HEAD"]);if(!Jr.test(j))N("local_device_gh_head_invalid");let W=await v(`/repos/${u.repoFullName}/commits/${u.baseSha}`);if(W.status!==200||JSON.parse(W.body).sha!==u.baseSha)N("local_device_gh_base_unverified");let Z=await v(`/repos/${u.repoFullName}/git/ref/heads/${encodeURIComponent(u.branch)}`);if(u.remoteHeadSha===null?Z.status!==404:Z.status!==200||JSON.parse(Z.body).object?.sha!==u.remoteHeadSha)N("local_device_gh_remote_changed");let ie=[...(await B(R,["rev-list","--objects","--no-object-names",j,"--not",u.baseSha])).split(`
 `),...(await B(R,["rev-list","--objects","--no-object-names","--no-walk",u.baseSha])).split(`
 `)].filter(Boolean);if(ie.some((pe)=>!Jr.test(pe)))N("local_device_gh_object_invalid");let se=await D(R,["pack-objects","--stdout"],[...new Set(ie)].join(`
 `)+`
-`,Ai);if(z.writeFileSync(oe.join(ce,"shallow"),u.baseSha+`
+`,Ii);if(z.writeFileSync(oe.join(ce,"shallow"),u.baseSha+`
 `,{flag:"wx",mode:384}),await D(ce,["index-pack","--strict","--stdin"],se,65536),await D(ce,["merge-base","--is-ancestor",u.baseSha,j]),u.remoteHeadSha)await D(ce,["merge-base","--is-ancestor",u.remoteHeadSha,j]);let ye=await D(ce,["show","-s","--format=%B",j]),Re=(await D(ce,["interpret-trailers","--parse"],ye)).toString("utf8"),Ze=u.contributorTrailers?{expectedTrailers:u.contributorTrailers,missingFromHead:jc(Re,u.contributorTrailers)}:void 0,xt=(await B(ce,["rev-list","--objects","--no-object-names",j,"--not",u.baseSha,...u.remoteHeadSha?[u.remoteHeadSha]:[]])).split(`
-`).filter(Boolean);if(xt.length>5000)N("local_device_gh_collection_too_large");let Et=[],ii=0;for(let pe of xt){if(!Jr.test(pe))N("local_device_gh_object_invalid");let Te=await B(ce,["cat-file","-t",pe]);if(!["blob","commit","tree"].includes(Te))N("local_device_gh_object_invalid");let Ee=await D(ce,["cat-file",Te,pe]);if(ii+=Ee.length,ii>ut)N("local_device_gh_collection_too_large");if(Te==="tree"){let He=0;while(He<Ee.length){let Ve=Ee.indexOf(32,He),ve=Ee.indexOf(0,Ve+1);if(Ve<He||ve<=Ve||ve+21>Ee.length)N("local_device_gh_object_invalid");let De=Ee.subarray(Ve+1,ve).toString("utf8");if(De.includes("/")||!Xr(De).valid)N("local_device_gh_object_invalid");He=ve+21}}Et.push({path:`object-${pe}`,content:Ee.toString("utf8")})}let si=a.secretNames?{secretNames:a.secretNames}:{},It=cr(Et,a.forbiddenSecretValues,si),pi=new Map;if(!It.clean)try{let pe=(await D(ce,["diff","--no-renames","--no-abbrev","--raw","-z",u.baseSha,j])).toString("utf8").split("\x00"),Te=[],Ee=[];for(let ge=0;ge+1<pe.length;ge+=2){let[,oc,ic,Gr,er]=pe[ge].slice(1).match(/^([0-7]{6}) ([0-7]{6}) ([0-9a-f]{40}) ([0-9a-f]{40}) /)??[];if(!Gr||!er)continue;if(oc!=="160000"&&!/^0+$/.test(Gr))Te.push(Gr);if(ic!=="160000"&&!/^0+$/.test(er))Ee.push(er),pi.set(`object-${er}`,pe[ge+1])}let He=await de([...Te,...Ee]),Ve=new Set(It.violations.map((ge)=>ge.path)),ve=Oi(Et.filter((ge)=>Ve.has(ge.path)),a.forbiddenSecretValues),De=Ii(ve,Ee.map((ge)=>He.get(ge)??""),Te.map((ge)=>He.get(ge)??""));if(De.size>0)It=cr(Et,a.forbiddenSecretValues,{...si,published:De})}catch{}if(!It.clean)Li(It.violations,(pe)=>pi.get(pe)??`an object in the pushed history (${pe})`,"Remove it from the files and commit again; a commit or message in the pushed history that holds it must be amended before this branch can be pushed.");await D(ce,["push","--no-recurse-submodules",I,`${j}:refs/heads/${u.branch}`]);let mi=await v(`/repos/${u.repoFullName}/git/ref/heads/${encodeURIComponent(u.branch)}`);if(mi.status!==200||JSON.parse(mi.body).object?.sha!==j)N("local_device_gh_push_unconfirmed");return{kind:"publish",headSha:j,scannedObjectCount:Et.length,...Ze?{attribution:Ze}:{}}}catch(C){throw Zt=!0,C}finally{try{z.rmSync(ce,{recursive:!0,force:!0})}catch(C){if(!Zt||u.kind!=="prepare")throw p=null,C}}}catch(m){if(u.kind==="prepare"&&u.diagnosticsVersion===1&&p&&!a.signal?.aborted)throw new Bn(p);throw m}}var pt=n({profile:t().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:t().min(1).max(1024)}).strict(),on={ready:i(!0),boot_generation:t().uuid(),proof_ready:i(!1),result:i("metadata_only")},lo=n({...on,version:i(2),development_only:i(!1),image:i(!0),video:i(!1),source_bound:i(!1),profiles:d(pt.shape.profile).min(1).max(16),extension_instance_ids:d(pt.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine((e)=>new Set(e.profiles).size===e.profiles.length&&e.profiles.length===e.extension_instance_ids.length),uo=n({...on,version:i(3),development_only:i(!1),image:i(!0),video:i(!0),source_bound:i(!1),max_seconds:i(15),profiles:d(pt.shape.profile).min(1).max(16),extension_instance_ids:d(pt.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine((e)=>new Set(e.profiles).size===e.profiles.length&&e.profiles.length===e.extension_instance_ids.length),an=we([lo,uo]),xf=we([n({...on,version:i(1),development_only:i(!0),profile:pt.shape.profile,extension_instance_id:pt.shape.extension_instance_id,max_seconds:i(15)}).strict(),an]);import{createServer as zc,request as Xc}from"http";import{connect as Jc,isIP as Zc}from"net";var Mi=120000,Qc=15000;function eu(e,a,l){let u=li(a).toLowerCase().replace(/\.$/,"");if(!u||Zc(u))return!1;return e.some((p)=>{if(!yo.test(p))return!1;let m=p.lastIndexOf(":"),f=m>0?p.slice(0,m):p;if(m>0&&Number(p.slice(m+1))!==l)return!1;return f.startsWith("*.")?u.endsWith(f.slice(1)):u===f})}function tu(e,a){let l=/^\[?([^\]]+?)\]?:([0-9]{1,5})$/.exec(e),u=l?l[1]:e,p=l?Number(l[2]):a;return u&&p>=1&&p<=65535?{host:u,port:p}:null}async function cn(e,a,l){if(!eu(l,e,a))return null;let u=await rc(e);return u.ok?u.addresses[0]:null}function Nt(e,a){e.end(`HTTP/1.1 ${a} ${a===403?"Forbidden":"Bad Gateway"}\r
+`).filter(Boolean);if(xt.length>5000)N("local_device_gh_collection_too_large");let Et=[],ri=0;for(let pe of xt){if(!Jr.test(pe))N("local_device_gh_object_invalid");let Te=await B(ce,["cat-file","-t",pe]);if(!["blob","commit","tree"].includes(Te))N("local_device_gh_object_invalid");let Ee=await D(ce,["cat-file",Te,pe]);if(ri+=Ee.length,ri>ut)N("local_device_gh_collection_too_large");if(Te==="tree"){let He=0;while(He<Ee.length){let Ve=Ee.indexOf(32,He),ve=Ee.indexOf(0,Ve+1);if(Ve<He||ve<=Ve||ve+21>Ee.length)N("local_device_gh_object_invalid");let De=Ee.subarray(Ve+1,ve).toString("utf8");if(De.includes("/")||!Xr(De).valid)N("local_device_gh_object_invalid");He=ve+21}}Et.push({path:`object-${pe}`,content:Ee.toString("utf8")})}let ni=a.secretNames?{secretNames:a.secretNames}:{},It=cr(Et,a.forbiddenSecretValues,ni),oi=new Map;if(!It.clean)try{let pe=(await D(ce,["diff","--no-renames","--no-abbrev","--raw","-z",u.baseSha,j])).toString("utf8").split("\x00"),Te=[],Ee=[];for(let ge=0;ge+1<pe.length;ge+=2){let[,oc,ic,Gr,er]=pe[ge].slice(1).match(/^([0-7]{6}) ([0-7]{6}) ([0-9a-f]{40}) ([0-9a-f]{40}) /)??[];if(!Gr||!er)continue;if(oc!=="160000"&&!/^0+$/.test(Gr))Te.push(Gr);if(ic!=="160000"&&!/^0+$/.test(er))Ee.push(er),oi.set(`object-${er}`,pe[ge+1])}let He=await de([...Te,...Ee]),Ve=new Set(It.violations.map((ge)=>ge.path)),ve=Pi(Et.filter((ge)=>Ve.has(ge.path)),a.forbiddenSecretValues),De=Oi(ve,Ee.map((ge)=>He.get(ge)??""),Te.map((ge)=>He.get(ge)??""));if(De.size>0)It=cr(Et,a.forbiddenSecretValues,{...ni,published:De})}catch{}if(!It.clean)Ai(It.violations,(pe)=>oi.get(pe)??`an object in the pushed history (${pe})`,"Remove it from the files and commit again; a commit or message in the pushed history that holds it must be amended before this branch can be pushed.");await D(ce,["push","--no-recurse-submodules",I,`${j}:refs/heads/${u.branch}`]);let ai=await v(`/repos/${u.repoFullName}/git/ref/heads/${encodeURIComponent(u.branch)}`);if(ai.status!==200||JSON.parse(ai.body).object?.sha!==j)N("local_device_gh_push_unconfirmed");return{kind:"publish",headSha:j,scannedObjectCount:Et.length,...Ze?{attribution:Ze}:{}}}catch(C){throw Zt=!0,C}finally{try{z.rmSync(ce,{recursive:!0,force:!0})}catch(C){if(!Zt||u.kind!=="prepare")throw p=null,C}}}catch(m){if(u.kind==="prepare"&&u.diagnosticsVersion===1&&p&&!a.signal?.aborted)throw new Fn(p);throw m}}var pt=n({profile:t().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:t().min(1).max(1024)}).strict(),on={ready:i(!0),boot_generation:t().uuid(),proof_ready:i(!1),result:i("metadata_only")},uo=n({...on,version:i(2),development_only:i(!1),image:i(!0),video:i(!1),source_bound:i(!1),profiles:d(pt.shape.profile).min(1).max(16),extension_instance_ids:d(pt.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine((e)=>new Set(e.profiles).size===e.profiles.length&&e.profiles.length===e.extension_instance_ids.length),po=n({...on,version:i(3),development_only:i(!1),image:i(!0),video:i(!0),source_bound:i(!1),max_seconds:i(15),profiles:d(pt.shape.profile).min(1).max(16),extension_instance_ids:d(pt.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine((e)=>new Set(e.profiles).size===e.profiles.length&&e.profiles.length===e.extension_instance_ids.length),an=we([uo,po]),xf=we([n({...on,version:i(1),development_only:i(!0),profile:pt.shape.profile,extension_instance_id:pt.shape.extension_instance_id,max_seconds:i(15)}).strict(),an]);import{createServer as zc,request as Xc}from"http";import{connect as Jc,isIP as Zc}from"net";var Ni=120000,Qc=15000;function eu(e,a,l){let u=ui(a).toLowerCase().replace(/\.$/,"");if(!u||Zc(u))return!1;return e.some((p)=>{if(!wo.test(p))return!1;let m=p.lastIndexOf(":"),f=m>0?p.slice(0,m):p;if(m>0&&Number(p.slice(m+1))!==l)return!1;return f.startsWith("*.")?u.endsWith(f.slice(1)):u===f})}function tu(e,a){let l=/^\[?([^\]]+?)\]?:([0-9]{1,5})$/.exec(e),u=l?l[1]:e,p=l?Number(l[2]):a;return u&&p>=1&&p<=65535?{host:u,port:p}:null}async function ln(e,a,l){if(!eu(l,e,a))return null;let u=await nc(e);return u.ok?u.addresses[0]:null}function Nt(e,a){e.end(`HTTP/1.1 ${a} ${a===403?"Forbidden":"Bad Gateway"}\r
 Connection: close\r
 Content-Length: 0\r
 \r
-`)}function Ti(e,a){return new Promise((l,u)=>{let p=Jc({host:e,port:a}),m=setTimeout(()=>p.destroy(Error("connect_timeout")),Qc);p.once("connect",()=>{clearTimeout(m),l(p)}),p.once("error",(f)=>{clearTimeout(m),u(f)})})}function Di(e,a,l){for(let u of[e,a])u.on("error",()=>{e.destroy(),a.destroy()}),u.on("close",()=>{e.destroy(),a.destroy()});if(a.setTimeout(Mi,()=>a.destroy()),l.length)a.write(l);e.pipe(a).pipe(e)}function Ni(e,a){let l={...e,host:a};return delete l["proxy-authorization"],delete l["proxy-connection"],l}async function $i(e,a=()=>{}){let l=[...e],u=new Set,p=(g)=>{u.add(g),g.once("close",()=>u.delete(g))},m=zc((g,b)=>{(async()=>{let y;try{y=new URL(g.url??"")}catch{y=new URL("invalid:")}let h=Number(y.port||80),w=y.protocol==="http:"?await cn(y.hostname,h,l):null;if(!w){a(),b.writeHead(403,{connection:"close"}).end();return}let S=Xc({host:w,port:h,method:g.method,path:`${y.pathname}${y.search}`,headers:Ni(g.headers,y.host),agent:!1,timeout:Mi},(v)=>{b.writeHead(v.statusCode??502,v.headers),v.pipe(b)});S.on("timeout",()=>S.destroy()),S.on("error",()=>{if(!b.headersSent)b.writeHead(502);b.end()}),b.on("close",()=>S.destroy()),g.pipe(S)})().catch(()=>{if(!b.headersSent)b.writeHead(502);b.end()})});m.on("connection",p),m.on("connect",(g,b,y)=>{p(b),b.on("error",()=>b.destroy()),(async()=>{let h=tu(g.url??"",443),w=h?await cn(h.host,h.port,l):null;if(!h||!w){a(),Nt(b,403);return}let S=await Ti(w,h.port).catch(()=>null);if(!S){Nt(b,502);return}if(b.destroyed){S.destroy();return}p(S),b.write(`HTTP/1.1 200 Connection Established\r
+`)}function ki(e,a){return new Promise((l,u)=>{let p=Jc({host:e,port:a}),m=setTimeout(()=>p.destroy(Error("connect_timeout")),Qc);p.once("connect",()=>{clearTimeout(m),l(p)}),p.once("error",(f)=>{clearTimeout(m),u(f)})})}function Ti(e,a,l){for(let u of[e,a])u.on("error",()=>{e.destroy(),a.destroy()}),u.on("close",()=>{e.destroy(),a.destroy()});if(a.setTimeout(Ni,()=>a.destroy()),l.length)a.write(l);e.pipe(a).pipe(e)}function Di(e,a){let l={...e,host:a};return delete l["proxy-authorization"],delete l["proxy-connection"],l}async function Mi(e,a=()=>{}){let l=[...e],u=new Set,p=(g)=>{u.add(g),g.once("close",()=>u.delete(g))},m=zc((g,b)=>{(async()=>{let y;try{y=new URL(g.url??"")}catch{y=new URL("invalid:")}let h=Number(y.port||80),w=y.protocol==="http:"?await ln(y.hostname,h,l):null;if(!w){a(),b.writeHead(403,{connection:"close"}).end();return}let S=Xc({host:w,port:h,method:g.method,path:`${y.pathname}${y.search}`,headers:Di(g.headers,y.host),agent:!1,timeout:Ni},(v)=>{b.writeHead(v.statusCode??502,v.headers),v.pipe(b)});S.on("timeout",()=>S.destroy()),S.on("error",()=>{if(!b.headersSent)b.writeHead(502);b.end()}),b.on("close",()=>S.destroy()),g.pipe(S)})().catch(()=>{if(!b.headersSent)b.writeHead(502);b.end()})});m.on("connection",p),m.on("connect",(g,b,y)=>{p(b),b.on("error",()=>b.destroy()),(async()=>{let h=tu(g.url??"",443),w=h?await ln(h.host,h.port,l):null;if(!h||!w){a(),Nt(b,403);return}let S=await ki(w,h.port).catch(()=>null);if(!S){Nt(b,502);return}if(b.destroyed){S.destroy();return}p(S),b.write(`HTTP/1.1 200 Connection Established\r
 \r
-`),Di(b,S,y)})().catch(()=>b.destroy())}),m.on("upgrade",(g,b,y)=>{p(b),b.on("error",()=>b.destroy()),(async()=>{let h;try{h=new URL(g.url??"")}catch{Nt(b,403);return}let w=Number(h.port||80),S=["http:","ws:"].includes(h.protocol)?await cn(h.hostname,w,l):null;if(!S){a(),Nt(b,403);return}let v=await Ti(S,w).catch(()=>null);if(!v){Nt(b,502);return}p(v);let R=Ni(g.headers,h.host),I=[`${g.method} ${h.pathname}${h.search} HTTP/1.1`];for(let[x,E]of Object.entries(R))for(let O of Array.isArray(E)?E:E===void 0?[]:[E])I.push(`${x}: ${O}`);v.write(`${I.join(`\r
+`),Ti(b,S,y)})().catch(()=>b.destroy())}),m.on("upgrade",(g,b,y)=>{p(b),b.on("error",()=>b.destroy()),(async()=>{let h;try{h=new URL(g.url??"")}catch{Nt(b,403);return}let w=Number(h.port||80),S=["http:","ws:"].includes(h.protocol)?await ln(h.hostname,w,l):null;if(!S){a(),Nt(b,403);return}let v=await ki(S,w).catch(()=>null);if(!v){Nt(b,502);return}p(v);let R=Di(g.headers,h.host),I=[`${g.method} ${h.pathname}${h.search} HTTP/1.1`];for(let[x,E]of Object.entries(R))for(let O of Array.isArray(E)?E:E===void 0?[]:[E])I.push(`${x}: ${O}`);v.write(`${I.join(`\r
 `)}\r
 \r
-`),Di(b,v,y)})().catch(()=>b.destroy())}),await new Promise((g,b)=>{m.once("error",b),m.listen(0,"127.0.0.1",()=>g())});let{port:f}=m.address();return{url:`http://127.0.0.1:${f}`,close(){m.close();for(let g of u)g.destroy()}}}import{createHash as xn,randomUUID as iu}from"crypto";import{closeSync as yr,constants as Ce,fchownSync as su,fstatSync as rt,fsyncSync as au,linkSync as Qi,lstatSync as bn,mkdirSync as es,openSync as gr,readSync as ns,realpathSync as wn,unlinkSync as ts,writeSync as lu}from"fs";import{isAbsolute as cu,join as uu,relative as du,sep as pu}from"path";import{platform as Sn}from"os";import{getSystemErrorName as mu}from"util";var Bi={type:"string",format:"uuid"},ji=String.raw`^(?![\\/])(?![A-Za-z]:[\\/])(?!.*(?:^|[\\/])\.\.(?:[\\/]|$))(?!.*\u0000)(?=.*\S)[\s\S]+$`,dr={type:"string",minLength:1,maxLength:4096,pattern:ji},mn=t().min(1).max(4096).regex(new RegExp(ji)),pr={device_id:t().uuid(),root_id:t().uuid(),timeout_ms:o().int().min(1000).max(60000).optional()},mr={device_id:Bi,root_id:Bi,timeout_ms:{type:"integer",minimum:1000,maximum:60000}},kf={read:{schema:n({...pr,path:mn,offset:o().int().min(0).optional(),max_bytes:o().int().min(1).max(131072).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path"],properties:{...mr,path:dr,offset:{type:"integer",minimum:0},max_bytes:{type:"integer",minimum:1,maximum:131072}},additionalProperties:!1}},write:{schema:n({...pr,path:mn,content:t().max(131072),mode:c(["overwrite","append"]).optional(),create_parents:_().optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path","content"],properties:{...mr,path:dr,content:{type:"string",maxLength:131072},mode:{type:"string",enum:["overwrite","append"]},create_parents:{type:"boolean"}},additionalProperties:!1}},exec:{schema:n({...pr,command:t().min(1).max(16000),cwd:mn.optional(),mode:c(["confined","host"]).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","command"],properties:{...mr,command:{type:"string",minLength:1,maxLength:16000},cwd:dr,mode:{type:"string",enum:["confined","host"],description:"Defaults to host: the existing permitted login shell with OS/account access, requiring execute and environment-discovery permission. Request confined explicitly for a scrubbed shell without network."}},additionalProperties:!1}}},qe=1073741824,Mt=600000,Fi=String.raw`(?!\.{1,2}(?:/|(?![\s\S])))[^/\\\u0000]+`,qi=String.raw`^(?![A-Za-z]:/)(?=[\s\S]*\S)${Fi}(?:/${Fi})*(?![\s\S])`,Wi=new RegExp(qi);function zi(e){return typeof e==="string"&&e.length>0&&e.length<=4096&&Wi.test(e)}var fn=t().min(1).max(4096).regex(Wi),hn={...dr,pattern:qi},Xi=t().regex(/^[a-f0-9]{64}$/),Ji=n({kind:i("workspace"),path:fn}).strict(),ru=P("kind",[Ji,n({kind:i("attachment"),attachment_id:t().min(1).max(120),sha256:Xi}).strict()]),fr=1,$t="cloud_workspace_id",gn="cloud_workspace",yn=1,nu=P("kind",[Ji,n({kind:i("attachment"),download_url:t().min(1).max(16384),size_bytes:o().int().min(0).max(qe),sha256:Xi}).strict()]),Zi=n({source_version:i(fr),source:nu,url:t().min(1).max(16384),transfer_cloud_scope:n({sandboxId:t().min(1).max(256),revision:o().int().nonnegative(),brainFence:t().uuid()}).strict().optional(),[$t]:t().min(1).max(160).optional()}).strict(),Tf=n({ready:i(!0),cloud_source_version:i(fr),source_kinds:d(c(["workspace","attachment"]))});var Ui=n({...pr,timeout_ms:o().int().min(1000).max(Mt).optional(),source_path:fn,destination_path:fn,idempotency_key:t().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/).optional()}).strict(),Hi={type:"object",required:["device_id","root_id","source_path","destination_path"],properties:{...mr,timeout_ms:{type:"integer",minimum:1000,maximum:Mt},source_path:hn,destination_path:hn,idempotency_key:{type:"string",minLength:1,maxLength:160,pattern:"^[A-Za-z0-9._:-]+$"}},additionalProperties:!1},ou={oneOf:[{type:"object",required:["kind","path"],properties:{kind:{type:"string",const:"workspace"},path:hn},additionalProperties:!1},{type:"object",required:["kind","attachment_id","sha256"],properties:{kind:{type:"string",const:"attachment"},attachment_id:{type:"string",minLength:1,maxLength:120},sha256:{type:"string",pattern:"^[a-f0-9]{64}$"}},additionalProperties:!1}]},Df=we([Ui,Ui.omit({source_path:!0}).extend({source:ru}).strict()]),Nf={...Hi,required:["device_id","root_id","destination_path"],properties:{...Hi.properties,source:ou},oneOf:[{required:["source_path"],not:{required:["source"]}},{required:["source"],not:{required:["source_path"]}}]};var En=65536;function me(e){throw new r(e,e)}function br(e){return typeof e==="object"&&e!==null&&"code"in e&&typeof e.code==="string"?e.code:void 0}function _r(e,a,l){if(a.throwIfAborted(),e instanceof r||e instanceof Error&&e.name==="AbortError")throw e;return me(l)}function fu(e,a,l){let u;switch(br(e)){case"ENOENT":u=l==="export"?"transfer_source_missing":"transfer_path_unavailable";break;case"EACCES":case"EPERM":case"EROFS":u="transfer_permission_denied";break;case"ELOOP":case"ENOTDIR":u="transfer_path_unsafe";break;case"EEXIST":u="transfer_destination_exists";break;default:u="transfer_path_unavailable"}return _r(e,a,u)}function hu(e){if(typeof e!=="string"||e.length>16384)return me("transfer_url_invalid");let a;try{a=new URL(e)}catch{return me("transfer_url_invalid")}if(a.protocol!=="https:"||a.username||a.password||a.hash)return me("transfer_url_invalid");return a.href}var vn=Ce.O_RDONLY|Ce.O_DIRECTORY|Ce.O_NOFOLLOW;async function gu(){if(Sn()==="win32"){let y=new Map,h,w=-1,S=()=>Object.assign(Error("transfer_path_unsafe"),{code:"ELOOP"}),v=(E)=>{let O=du(h,E);return O===""||O!==".."&&!O.startsWith(`..${pu}`)&&!cu(O)},R=(E)=>{let O=bn(E);if(O.isSymbolicLink())throw S();if(!O.isDirectory())throw Object.assign(Error("transfer_path_unsafe"),{code:"ENOTDIR"});let D=wn(E);if(h??=D,!v(D))throw S();return y.set(w,{path:E,real:D}),w--},I=(E)=>{let O=y.get(E);if(wn(O.path)!==O.real)throw S();return O.path},x=(E,O)=>{if(Yi(O))throw Object.assign(Error("transfer_path_invalid"),{code:"ENOTDIR"});return uu(y.get(E).path,O)};return{root:R,openDirectory:(E,O)=>R(x(E,O)),open:(E,O,D,B=384)=>{let ne=x(E,O);if(bn(ne,{throwIfNoEntry:!1})?.isSymbolicLink())throw S();I(E);let de=gr(ne,D,B);try{let he=rt(de),We=bn(ne);if(We.isSymbolicLink()||he.ino!==We.ino||he.dev!==We.dev||!v(wn(ne)))throw S()}catch(he){throw yr(de),he}return de},mkdir:(E,O)=>{let D=x(E,O);I(E),es(D)},link:(E,O,D)=>{let B=x(E,O),ne=x(E,D);I(E),Qi(B,ne)},unlink:(E,O)=>ts(x(E,O)),closeDirectory:(E)=>{y.delete(E)},inherit:()=>{},close:()=>{}}}let e={root:(y)=>gr(y,vn),closeDirectory:yr,inherit:_u};if(Sn()==="linux")return{...e,openDirectory:(y,h)=>gr(`/proc/self/fd/${y}/${h}`,vn),open:(y,h,w,S=384)=>gr(`/proc/self/fd/${y}/${h}`,w,S),mkdir:(y,h)=>es(`/proc/self/fd/${y}/${h}`,{mode:448}),link:(y,h,w)=>Qi(`/proc/self/fd/${y}/${h}`,`/proc/self/fd/${y}/${w}`),unlink:(y,h)=>ts(`/proc/self/fd/${y}/${h}`),close:()=>{}};if(Sn()!=="darwin")return me("transfer_platform_unsupported");let{dlopen:a,FFIType:l,ptr:u,read:p}=await import("bun:ffi"),m=a("/usr/lib/libSystem.B.dylib",{__error:{args:[],returns:l.ptr},openat:{args:[l.i32,l.ptr,l.i32,l.i32,l.i32,l.i32,l.i32,l.i32,l.i32],returns:l.i32},mkdirat:{args:[l.i32,l.ptr,l.i32],returns:l.i32},linkat:{args:[l.i32,l.ptr,l.i32,l.ptr,l.i32],returns:l.i32},unlinkat:{args:[l.i32,l.ptr,l.i32],returns:l.i32}}),f=m.symbols.__error();if(f===null)return m.close(),me("transfer_path_unavailable");let g=(y)=>{if(y<0){let h=mu(-p.i32(f));throw Object.assign(Error("transfer_path_unavailable"),{code:h})}return y},b=(y,h,w,S=384)=>g(m.symbols.openat(y,u(Buffer.from(`${h}\x00`)),w,S,0,0,0,0,S));return{...e,openDirectory:(y,h)=>b(y,h,vn),open:b,mkdir:(y,h)=>{g(m.symbols.mkdirat(y,u(Buffer.from(`${h}\x00`)),448))},link:(y,h,w)=>{g(m.symbols.linkat(y,u(Buffer.from(`${h}\x00`)),y,u(Buffer.from(`${w}\x00`)),0))},unlink:(y,h)=>{g(m.symbols.unlinkat(y,u(Buffer.from(`${h}\x00`)),0))},close:()=>m.close()}}function _u(e,a){let l=rt(e),u=rt(a);if(u.uid!==l.uid||u.gid!==l.gid)su(a,l.uid,l.gid)}function yu(e,a,l,u){if(!zi(l))return me("transfer_path_invalid");let p=l.split("/"),m=e.root(a);try{for(let f of p.slice(0,-1)){let g;try{g=e.openDirectory(m,f)}catch(b){if(!u||br(b)!=="ENOENT")throw b;try{e.mkdir(m,f)}catch(y){if(br(y)!=="EEXIST")throw y}g=e.openDirectory(m,f),e.inherit(m,g)}e.closeDirectory(m),m=g}return{fd:m,leaf:p.at(-1)}}catch(f){throw e.closeDirectory(m),f}}function rs(e,a){let l=rt(e,{bigint:!0});if(!l.isFile()||l.size>qe)return me("transfer_file_invalid");let u=xn("sha256"),p=Buffer.alloc(En),m=0;while(!0){a.throwIfAborted();let g=ns(e,p,0,p.length,m);if(!g)break;if(m+=g,m>qe)return me("transfer_size_exceeded");u.update(p.subarray(0,g))}let f=rt(e,{bigint:!0});if(BigInt(m)!==l.size||f.size!==l.size||f.mtimeNs!==l.mtimeNs||f.ctimeNs!==l.ctimeNs)return me("transfer_source_changed");return{size_bytes:m,sha256:u.digest("hex")}}async function mt(e){e.signal.throwIfAborted();try{let a=hu(e.payload.url),l=await gu(),u,p,m;try{if(u=yu(l,e.root,e.path,e.direction==="import"),e.direction==="export"){p=l.open(u.fd,u.leaf,Ce.O_RDONLY|Ce.O_NOFOLLOW|Ce.O_NONBLOCK);let S=rt(p,{bigint:!0});if(!S.isFile()||S.size>qe)return me("transfer_file_invalid");let v=xn("sha256"),R=0,I=p,x,E=new ReadableStream({pull(ne){try{e.signal.throwIfAborted();let de=Buffer.alloc(En),he=ns(I,de,0,de.length,R);if(!he){ne.close();return}if(R+=he,R>S.size)return me("transfer_source_changed");v.update(de.subarray(0,he)),ne.enqueue(de.subarray(0,he))}catch(de){throw x=de,de}}});try{let ne=await(e.fetchImpl??fetch)(a,Object.assign({method:"PUT",body:E,redirect:"error",signal:e.signal,headers:{"content-type":"application/octet-stream","content-length":String(S.size)}},{duplex:"half"}));if(x!==void 0)throw x;if(!ne.ok)return me("transfer_upload_failed");await ne.body?.cancel()}catch(ne){if(x!==void 0)throw x;return _r(ne,e.signal,"transfer_upload_failed")}let O=rt(p,{bigint:!0});if(BigInt(R)!==S.size||O.size!==S.size||O.mtimeNs!==S.mtimeNs||O.ctimeNs!==S.ctimeNs)return me("transfer_source_changed");let D=v.digest("hex"),B=rs(p,e.signal);if(B.size_bytes!==R||B.sha256!==D)return me("transfer_source_changed");return{size_bytes:R,sha256:D,outcome:"copied"}}let f=e.payload.size_bytes,g=e.payload.sha256;if(typeof f!=="number"||!Number.isSafeInteger(f)||f<0||f>qe||typeof g!=="string"||!/^[a-f0-9]{64}$/.test(g))return me("transfer_receipt_invalid");let b;try{b=l.open(u.fd,u.leaf,Ce.O_RDONLY|Ce.O_NOFOLLOW|Ce.O_NONBLOCK)}catch(S){if(br(S)!=="ENOENT")throw S}if(b!==void 0){try{let S=rs(b,e.signal);if(S.size_bytes===f&&S.sha256===g)return{...S,outcome:"already_present"}}finally{yr(b)}return me("transfer_destination_exists")}m=`.reason-copy-${iu()}`,p=l.open(u.fd,m,Ce.O_CREAT|Ce.O_EXCL|Ce.O_WRONLY|Ce.O_NOFOLLOW,384),l.inherit(u.fd,p);let y;try{let S=await(e.fetchImpl??fetch)(a,{redirect:"error",signal:e.signal});if(!S.ok||!S.body)return me("transfer_download_failed");y=S.body.getReader()}catch(S){return _r(S,e.signal,"transfer_download_failed")}let h=xn("sha256"),w=0;try{while(!0){e.signal.throwIfAborted();let S=await y.read().catch((v)=>_r(v,e.signal,"transfer_download_failed"));if(S.done)break;if(w+=S.value.length,w>f)return me("transfer_size_mismatch");h.update(S.value);for(let v=0;v<S.value.length;)e.signal.throwIfAborted(),v+=lu(p,S.value,v,Math.min(En,S.value.length-v))}}finally{await y.cancel().catch(()=>{})}if(w!==f||h.digest("hex")!==g)return me("transfer_hash_mismatch");return au(p),await e.beforeCommit?.(),e.signal.throwIfAborted(),l.link(u.fd,m,u.leaf),{size_bytes:f,sha256:g,outcome:"copied"}}finally{try{if(p!==void 0)yr(p)}finally{try{if(u){if(m)try{l.unlink(u.fd,m)}catch{}l.closeDirectory(u.fd)}}finally{l.close()}}}}catch(a){return fu(a,e.signal,e.direction)}}import{spawn as wu}from"child_process";import{mkdtempSync as Su,rmSync as vu,writeFileSync as Ru}from"fs";import{constants as xu,platform as Eu,tmpdir as Cu}from"os";import{join as as}from"path";import{gunzipSync as bu,gzipSync as Gf}from"zlib";var is=900000,Kf=is+60000,Bt=49152,os=(e)=>t().min(1).max(e).regex(/^[A-Za-z0-9+/]+=*$/),ss=n({version:i(1),script_gzip:os(163840),stdin_gzip:os(65536),cwd:t().min(1).max(4096).startsWith("/"),env:$e(t().regex(/^[A-Z_][A-Z0-9_]{0,63}$/),t().max(4096)).refine((e)=>Object.keys(e).length<=16,"too many variables"),timeout_ms:o().int().min(1000).max(is)}).strict(),Cn=t().max(Bt+256),Xf=n({exit_code:o().int().min(0).max(255),stdout:Cn,stderr:Cn,combined:Cn.optional()}).strict();function Pn(e){return bu(Buffer.from(e,"base64")).toString("utf8")}var Pu="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",Ou=["RUSTUP_HOME","TZ","LC_ALL"],Iu=2000,Au=100;function Zr(){return Eu()==="linux"&&process.geteuid?.()===0}function On(e){let a=Math.floor(e/2),l=[],u=0,p=Buffer.alloc(0),m=0;return{push(f){m+=f.length;let g=f;if(u<a){let b=g.subarray(0,a-u);l.push(b),u+=b.length,g=g.subarray(b.length)}if(g.length)p=Buffer.concat([p,g]).subarray(-a)},text(){let f=m-u-p.length;return Buffer.concat(l).toString("utf8")+(f>0?`
+`),Ti(b,v,y)})().catch(()=>b.destroy())}),await new Promise((g,b)=>{m.once("error",b),m.listen(0,"127.0.0.1",()=>g())});let{port:f}=m.address();return{url:`http://127.0.0.1:${f}`,close(){m.close();for(let g of u)g.destroy()}}}import{createHash as Rn,randomUUID as iu}from"crypto";import{closeSync as yr,constants as Ce,fchownSync as su,fstatSync as rt,fsyncSync as au,linkSync as Xi,lstatSync as bn,mkdirSync as Qi,openSync as gr,readSync as ns,realpathSync as wn,unlinkSync as ts,writeSync as lu}from"fs";import{isAbsolute as cu,join as uu,relative as du,sep as pu}from"path";import{platform as Sn}from"os";import{getSystemErrorName as mu}from"util";var $i={type:"string",format:"uuid"},Hi=String.raw`^(?![\\/])(?![A-Za-z]:[\\/])(?!.*(?:^|[\\/])\.\.(?:[\\/]|$))(?!.*\u0000)(?=.*\S)[\s\S]+$`,dr={type:"string",minLength:1,maxLength:4096,pattern:Hi},cn=t().min(1).max(4096).regex(new RegExp(Hi)),pr={device_id:t().uuid(),root_id:t().uuid(),timeout_ms:o().int().min(1000).max(60000).optional()},mr={device_id:$i,root_id:$i,timeout_ms:{type:"integer",minimum:1000,maximum:60000}},kf={read:{schema:n({...pr,path:cn,offset:o().int().min(0).optional(),max_bytes:o().int().min(1).max(131072).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path"],properties:{...mr,path:dr,offset:{type:"integer",minimum:0},max_bytes:{type:"integer",minimum:1,maximum:131072}},additionalProperties:!1}},write:{schema:n({...pr,path:cn,content:t().max(131072),mode:c(["overwrite","append"]).optional(),create_parents:_().optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path","content"],properties:{...mr,path:dr,content:{type:"string",maxLength:131072},mode:{type:"string",enum:["overwrite","append"]},create_parents:{type:"boolean"}},additionalProperties:!1}},exec:{schema:n({...pr,command:t().min(1).max(16000),cwd:cn.optional(),mode:c(["confined","host"]).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","command"],properties:{...mr,command:{type:"string",minLength:1,maxLength:16000},cwd:dr,mode:{type:"string",enum:["confined","host"],description:"Defaults to host: the existing permitted login shell with OS/account access, requiring execute and environment-discovery permission. Request confined explicitly for a scrubbed shell without network."}},additionalProperties:!1}}},qe=1073741824,Mt=600000,Bi=String.raw`(?!\.{1,2}(?:/|(?![\s\S])))[^/\\\u0000]+`,ji=String.raw`^(?![A-Za-z]:/)(?=[\s\S]*\S)${Bi}(?:/${Bi})*(?![\s\S])`,qi=new RegExp(ji);function Wi(e){return typeof e==="string"&&e.length>0&&e.length<=4096&&qi.test(e)}var mn=t().min(1).max(4096).regex(qi),fn={...dr,pattern:ji},Vi=t().regex(/^[a-f0-9]{64}$/),zi=n({kind:i("workspace"),path:mn}).strict(),ru=P("kind",[zi,n({kind:i("attachment"),attachment_id:t().min(1).max(120),sha256:Vi}).strict()]),fr=1,$t="cloud_workspace_id",gn="cloud_workspace",_n=1,nu=P("kind",[zi,n({kind:i("attachment"),download_url:t().min(1).max(16384),size_bytes:o().int().min(0).max(qe),sha256:Vi}).strict()]),Yi=n({source_version:i(fr),source:nu,url:t().min(1).max(16384),transfer_cloud_scope:n({sandboxId:t().min(1).max(256),revision:o().int().nonnegative(),brainFence:t().uuid()}).strict().optional(),[$t]:t().min(1).max(160).optional()}).strict(),Tf=n({ready:i(!0),cloud_source_version:i(fr),source_kinds:d(c(["workspace","attachment"]))});var Fi=n({...pr,timeout_ms:o().int().min(1000).max(Mt).optional(),source_path:mn,destination_path:mn,idempotency_key:t().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/).optional()}).strict(),Ui={type:"object",required:["device_id","root_id","source_path","destination_path"],properties:{...mr,timeout_ms:{type:"integer",minimum:1000,maximum:Mt},source_path:fn,destination_path:fn,idempotency_key:{type:"string",minLength:1,maxLength:160,pattern:"^[A-Za-z0-9._:-]+$"}},additionalProperties:!1},ou={oneOf:[{type:"object",required:["kind","path"],properties:{kind:{type:"string",const:"workspace"},path:fn},additionalProperties:!1},{type:"object",required:["kind","attachment_id","sha256"],properties:{kind:{type:"string",const:"attachment"},attachment_id:{type:"string",minLength:1,maxLength:120},sha256:{type:"string",pattern:"^[a-f0-9]{64}$"}},additionalProperties:!1}]},Df=we([Fi,Fi.omit({source_path:!0}).extend({source:ru}).strict()]),Nf={...Ui,required:["device_id","root_id","destination_path"],properties:{...Ui.properties,source:ou},oneOf:[{required:["source_path"],not:{required:["source"]}},{required:["source"],not:{required:["source_path"]}}]};var xn=65536;function me(e){throw new r(e,e)}function br(e){return typeof e==="object"&&e!==null&&"code"in e&&typeof e.code==="string"?e.code:void 0}function _r(e,a,l){if(a.throwIfAborted(),e instanceof r||e instanceof Error&&e.name==="AbortError")throw e;return me(l)}function fu(e,a,l){let u;switch(br(e)){case"ENOENT":u=l==="export"?"transfer_source_missing":"transfer_path_unavailable";break;case"EACCES":case"EPERM":case"EROFS":u="transfer_permission_denied";break;case"ELOOP":case"ENOTDIR":u="transfer_path_unsafe";break;case"EEXIST":u="transfer_destination_exists";break;default:u="transfer_path_unavailable"}return _r(e,a,u)}function hu(e){if(typeof e!=="string"||e.length>16384)return me("transfer_url_invalid");let a;try{a=new URL(e)}catch{return me("transfer_url_invalid")}if(a.protocol!=="https:"||a.username||a.password||a.hash)return me("transfer_url_invalid");return a.href}var vn=Ce.O_RDONLY|Ce.O_DIRECTORY|Ce.O_NOFOLLOW;async function gu(){if(Sn()==="win32"){let y=new Map,h,w=-1,S=()=>Object.assign(Error("transfer_path_unsafe"),{code:"ELOOP"}),v=(E)=>{let O=du(h,E);return O===""||O!==".."&&!O.startsWith(`..${pu}`)&&!cu(O)},R=(E)=>{let O=bn(E);if(O.isSymbolicLink())throw S();if(!O.isDirectory())throw Object.assign(Error("transfer_path_unsafe"),{code:"ENOTDIR"});let D=wn(E);if(h??=D,!v(D))throw S();return y.set(w,{path:E,real:D}),w--},I=(E)=>{let O=y.get(E);if(wn(O.path)!==O.real)throw S();return O.path},x=(E,O)=>{if(Zi(O))throw Object.assign(Error("transfer_path_invalid"),{code:"ENOTDIR"});return uu(y.get(E).path,O)};return{root:R,openDirectory:(E,O)=>R(x(E,O)),open:(E,O,D,B=384)=>{let ne=x(E,O);if(bn(ne,{throwIfNoEntry:!1})?.isSymbolicLink())throw S();I(E);let de=gr(ne,D,B);try{let he=rt(de),We=bn(ne);if(We.isSymbolicLink()||he.ino!==We.ino||he.dev!==We.dev||!v(wn(ne)))throw S()}catch(he){throw yr(de),he}return de},mkdir:(E,O)=>{let D=x(E,O);I(E),Qi(D)},link:(E,O,D)=>{let B=x(E,O),ne=x(E,D);I(E),Xi(B,ne)},unlink:(E,O)=>ts(x(E,O)),closeDirectory:(E)=>{y.delete(E)},inherit:()=>{},close:()=>{}}}let e={root:(y)=>gr(y,vn),closeDirectory:yr,inherit:_u};if(Sn()==="linux")return{...e,openDirectory:(y,h)=>gr(`/proc/self/fd/${y}/${h}`,vn),open:(y,h,w,S=384)=>gr(`/proc/self/fd/${y}/${h}`,w,S),mkdir:(y,h)=>Qi(`/proc/self/fd/${y}/${h}`,{mode:448}),link:(y,h,w)=>Xi(`/proc/self/fd/${y}/${h}`,`/proc/self/fd/${y}/${w}`),unlink:(y,h)=>ts(`/proc/self/fd/${y}/${h}`),close:()=>{}};if(Sn()!=="darwin")return me("transfer_platform_unsupported");let{dlopen:a,FFIType:l,ptr:u,read:p}=await import("bun:ffi"),m=a("/usr/lib/libSystem.B.dylib",{__error:{args:[],returns:l.ptr},openat:{args:[l.i32,l.ptr,l.i32,l.i32,l.i32,l.i32,l.i32,l.i32,l.i32],returns:l.i32},mkdirat:{args:[l.i32,l.ptr,l.i32],returns:l.i32},linkat:{args:[l.i32,l.ptr,l.i32,l.ptr,l.i32],returns:l.i32},unlinkat:{args:[l.i32,l.ptr,l.i32],returns:l.i32}}),f=m.symbols.__error();if(f===null)return m.close(),me("transfer_path_unavailable");let g=(y)=>{if(y<0){let h=mu(-p.i32(f));throw Object.assign(Error("transfer_path_unavailable"),{code:h})}return y},b=(y,h,w,S=384)=>g(m.symbols.openat(y,u(Buffer.from(`${h}\x00`)),w,S,0,0,0,0,S));return{...e,openDirectory:(y,h)=>b(y,h,vn),open:b,mkdir:(y,h)=>{g(m.symbols.mkdirat(y,u(Buffer.from(`${h}\x00`)),448))},link:(y,h,w)=>{g(m.symbols.linkat(y,u(Buffer.from(`${h}\x00`)),y,u(Buffer.from(`${w}\x00`)),0))},unlink:(y,h)=>{g(m.symbols.unlinkat(y,u(Buffer.from(`${h}\x00`)),0))},close:()=>m.close()}}function _u(e,a){let l=rt(e),u=rt(a);if(u.uid!==l.uid||u.gid!==l.gid)su(a,l.uid,l.gid)}function yu(e,a,l,u){if(!Wi(l))return me("transfer_path_invalid");let p=l.split("/"),m=e.root(a);try{for(let f of p.slice(0,-1)){let g;try{g=e.openDirectory(m,f)}catch(b){if(!u||br(b)!=="ENOENT")throw b;try{e.mkdir(m,f)}catch(y){if(br(y)!=="EEXIST")throw y}g=e.openDirectory(m,f),e.inherit(m,g)}e.closeDirectory(m),m=g}return{fd:m,leaf:p.at(-1)}}catch(f){throw e.closeDirectory(m),f}}function rs(e,a){let l=rt(e,{bigint:!0});if(!l.isFile()||l.size>qe)return me("transfer_file_invalid");let u=Rn("sha256"),p=Buffer.alloc(xn),m=0;while(!0){a.throwIfAborted();let g=ns(e,p,0,p.length,m);if(!g)break;if(m+=g,m>qe)return me("transfer_size_exceeded");u.update(p.subarray(0,g))}let f=rt(e,{bigint:!0});if(BigInt(m)!==l.size||f.size!==l.size||f.mtimeNs!==l.mtimeNs||f.ctimeNs!==l.ctimeNs)return me("transfer_source_changed");return{size_bytes:m,sha256:u.digest("hex")}}async function mt(e){e.signal.throwIfAborted();try{let a=hu(e.payload.url),l=await gu(),u,p,m;try{if(u=yu(l,e.root,e.path,e.direction==="import"),e.direction==="export"){p=l.open(u.fd,u.leaf,Ce.O_RDONLY|Ce.O_NOFOLLOW|Ce.O_NONBLOCK);let S=rt(p,{bigint:!0});if(!S.isFile()||S.size>qe)return me("transfer_file_invalid");let v=Rn("sha256"),R=0,I=p,x,E=new ReadableStream({pull(ne){try{e.signal.throwIfAborted();let de=Buffer.alloc(xn),he=ns(I,de,0,de.length,R);if(!he){ne.close();return}if(R+=he,R>S.size)return me("transfer_source_changed");v.update(de.subarray(0,he)),ne.enqueue(de.subarray(0,he))}catch(de){throw x=de,de}}});try{let ne=await(e.fetchImpl??fetch)(a,Object.assign({method:"PUT",body:E,redirect:"error",signal:e.signal,headers:{"content-type":"application/octet-stream","content-length":String(S.size)}},{duplex:"half"}));if(x!==void 0)throw x;if(!ne.ok)return me("transfer_upload_failed");await ne.body?.cancel()}catch(ne){if(x!==void 0)throw x;return _r(ne,e.signal,"transfer_upload_failed")}let O=rt(p,{bigint:!0});if(BigInt(R)!==S.size||O.size!==S.size||O.mtimeNs!==S.mtimeNs||O.ctimeNs!==S.ctimeNs)return me("transfer_source_changed");let D=v.digest("hex"),B=rs(p,e.signal);if(B.size_bytes!==R||B.sha256!==D)return me("transfer_source_changed");return{size_bytes:R,sha256:D,outcome:"copied"}}let f=e.payload.size_bytes,g=e.payload.sha256;if(typeof f!=="number"||!Number.isSafeInteger(f)||f<0||f>qe||typeof g!=="string"||!/^[a-f0-9]{64}$/.test(g))return me("transfer_receipt_invalid");let b;try{b=l.open(u.fd,u.leaf,Ce.O_RDONLY|Ce.O_NOFOLLOW|Ce.O_NONBLOCK)}catch(S){if(br(S)!=="ENOENT")throw S}if(b!==void 0){try{let S=rs(b,e.signal);if(S.size_bytes===f&&S.sha256===g)return{...S,outcome:"already_present"}}finally{yr(b)}return me("transfer_destination_exists")}m=`.reason-copy-${iu()}`,p=l.open(u.fd,m,Ce.O_CREAT|Ce.O_EXCL|Ce.O_WRONLY|Ce.O_NOFOLLOW,384),l.inherit(u.fd,p);let y;try{let S=await(e.fetchImpl??fetch)(a,{redirect:"error",signal:e.signal});if(!S.ok||!S.body)return me("transfer_download_failed");y=S.body.getReader()}catch(S){return _r(S,e.signal,"transfer_download_failed")}let h=Rn("sha256"),w=0;try{while(!0){e.signal.throwIfAborted();let S=await y.read().catch((v)=>_r(v,e.signal,"transfer_download_failed"));if(S.done)break;if(w+=S.value.length,w>f)return me("transfer_size_mismatch");h.update(S.value);for(let v=0;v<S.value.length;)e.signal.throwIfAborted(),v+=lu(p,S.value,v,Math.min(xn,S.value.length-v))}}finally{await y.cancel().catch(()=>{})}if(w!==f||h.digest("hex")!==g)return me("transfer_hash_mismatch");return au(p),await e.beforeCommit?.(),e.signal.throwIfAborted(),l.link(u.fd,m,u.leaf),{size_bytes:f,sha256:g,outcome:"copied"}}finally{try{if(p!==void 0)yr(p)}finally{try{if(u){if(m)try{l.unlink(u.fd,m)}catch{}l.closeDirectory(u.fd)}}finally{l.close()}}}}catch(a){return fu(a,e.signal,e.direction)}}import{spawn as wu}from"child_process";import{mkdtempSync as Su,rmSync as vu,writeFileSync as Ru}from"fs";import{constants as xu,platform as Eu,tmpdir as Cu}from"os";import{join as as}from"path";import{gunzipSync as bu,gzipSync as Gf}from"zlib";var is=900000,Kf=is+60000,Bt=49152,os=(e)=>t().min(1).max(e).regex(/^[A-Za-z0-9+/]+=*$/),ss=n({version:i(1),script_gzip:os(163840),stdin_gzip:os(65536),cwd:t().min(1).max(4096).startsWith("/"),env:$e(t().regex(/^[A-Z_][A-Z0-9_]{0,63}$/),t().max(4096)).refine((e)=>Object.keys(e).length<=16,"too many variables"),timeout_ms:o().int().min(1000).max(is)}).strict(),En=t().max(Bt+256),Xf=n({exit_code:o().int().min(0).max(255),stdout:En,stderr:En,combined:En.optional()}).strict();function Cn(e){return bu(Buffer.from(e,"base64")).toString("utf8")}var Pu="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",Ou=["RUSTUP_HOME","TZ","LC_ALL"],Iu=2000,Au=100;function Zr(){return Eu()==="linux"&&process.geteuid?.()===0}function Pn(e){let a=Math.floor(e/2),l=[],u=0,p=Buffer.alloc(0),m=0;return{push(f){m+=f.length;let g=f;if(u<a){let b=g.subarray(0,a-u);l.push(b),u+=b.length,g=g.subarray(b.length)}if(g.length)p=Buffer.concat([p,g]).subarray(-a)},text(){let f=m-u-p.length;return Buffer.concat(l).toString("utf8")+(f>0?`
 [reason: ${f} bytes of output omitted]
-`:"")+p.toString("utf8")}}}async function ls(e,a){if(!Zr())throw new r("workspace_setup_requires_root","Workspace setup runs only on a root Linux worker.");let l=ss.safeParse(e);if(!l.success)throw new r("invalid_request","Reason sent an invalid workspace setup.");let u=l.data,p,m;try{p=Pn(u.script_gzip),m=Pn(u.stdin_gzip)}catch{throw new r("invalid_request","Reason sent an unreadable workspace setup.")}a.throwIfAborted();let f=Su(as(Cu(),"reason-workspace-setup-"));try{let g=as(f,"setup.sh");Ru(g,p,{mode:384});let b={PATH:Pu,LANG:"C.UTF-8",HOME:"/root",USER:"root",LOGNAME:"root",SHELL:"/bin/bash",TMPDIR:"/tmp"};for(let B of Ou)if(process.env[B])b[B]=process.env[B];Object.assign(b,u.env);let y=wu("/bin/bash",[g],{cwd:u.cwd,env:b,detached:!0,stdio:["pipe","pipe","pipe"]}),h=On(Bt),w=On(Bt),S=On(Bt);y.stdout.on("data",(B)=>{h.push(B),S.push(B)}),y.stderr.on("data",(B)=>{w.push(B),S.push(B)}),y.stdin.on("error",()=>{}),y.stdin.end(m);let v=(B)=>{try{if(y.pid)process.kill(-y.pid,B)}catch{}},R=!1,I,x=()=>{v("SIGTERM"),I??=setTimeout(()=>v("SIGKILL"),Iu)},E=setTimeout(()=>{R=!0,x()},u.timeout_ms);a.addEventListener("abort",x,{once:!0});let O=await new Promise((B,ne)=>{y.once("error",()=>ne(new r("workspace_setup_start_failed","The workspace setup did not start."))),y.once("exit",(de,he)=>B({code:de,signal:he}))}).finally(()=>{clearTimeout(E),clearTimeout(I),a.removeEventListener("abort",x)});await new Promise((B)=>{let ne=setTimeout(B,Au);y.once("close",()=>{clearTimeout(ne),B()})}),y.stdout.destroy(),y.stderr.destroy(),a.throwIfAborted();let D=R?124:O.signal?128+(xu.signals[O.signal]??0):O.code??1;return{exit_code:Math.min(255,D),stdout:h.text(),stderr:w.text(),...D!==0?{combined:S.text()}:{}}}finally{vu(f,{recursive:!0,force:!0})}}import{chmodSync as Lu,mkdtempSync as ku,realpathSync as cs,rmSync as Tu}from"fs";import{tmpdir as Du}from"os";import{dirname as Nu,join as An,sep as Mu}from"path";function Ln(e){return hi(e,ui(e)!==null).repoPath}function us(e,a){let l;try{if(typeof a!=="string")throw Error("invalid");l=[Oe,void 0].map((p)=>Nu(X({kind:"managed",workspaceId:a,...p?{layout:p}:{}})))}catch{throw new r("cloud_copy_workspace_invalid","The Cloud copy workspace is invalid.")}let u;for(let p of l)try{u=cs(An(e,p));break}catch{}if(u===void 0)throw new r("cloud_copy_workspace_unavailable","The Session workspace is not on this computer.");if(!u.startsWith(`${e}${Mu}`))throw new r("cloud_copy_workspace_invalid","The Cloud copy workspace is outside this worker's root.");return u}async function ds(e){e.signal.throwIfAborted();let a=e.source;if(a.kind==="workspace"){let u=Ln(e.runtimeRoot);if(L(u)||L(An(u,a.path)))throw new r("protected_path","Credential and secret paths are unavailable to local tasks.");return mt({direction:"export",root:u,path:a.path,payload:{url:e.url},signal:e.signal,fetchImpl:e.fetchImpl})}let l=ku(An(Du(),`reason-cloud-copy-${process.pid}-`));try{Lu(l,448);let u=cs(l);await mt({direction:"import",root:u,path:"source",payload:{url:a.download_url,size_bytes:a.size_bytes,sha256:a.sha256},signal:e.signal,fetchImpl:e.fetchImpl});let p=await mt({direction:"export",root:u,path:"source",payload:{url:e.url},signal:e.signal,fetchImpl:e.fetchImpl});if(p.size_bytes!==a.size_bytes||p.sha256!==a.sha256)throw new r("transfer_source_changed","The verified attachment changed before export.");return p}finally{Tu(l,{recursive:!0,force:!0})}}import{constants as ke}from"fs";import{closeSync as Hl,existsSync as Ue,fstatSync as jl,ftruncateSync as mm,lstatSync as zo,mkdirSync as fm,mkdtempSync as hm,openSync as ql,readSync as gm,realpathSync as Ne,rmSync as _m,statSync as Jt,writeSync as ym}from"fs";import{homedir as Yt,platform as G,tmpdir as bm}from"os";import{dirname as Kt,isAbsolute as wm,join as Wl,relative as Go,resolve as Sm,sep as vm}from"path";import{spawn as Rm}from"child_process";import{createHash as Hu,randomBytes as ju}from"crypto";var kn=30000,$u=1800000,Bu=5000,wr=30000,Fu=Fn+15000,ps=/^\/app\/local-runtime\/operations\/[0-9a-fA-F-]{36}\/heartbeat$/,Uu=[/^\/app\/local-runtime\/operations\/claim$/,ps];class Dn{options;current=null;connecting=null;retryAt=0;failures=0;nextId=0;closed=!1;reconnectTimer=null;constructor(e){this.options=e}now(){return(this.options.now??Date.now)()}jitter(e){return Math.floor((this.options.random??Math.random)()*e)}async request(e,a,l){l?.throwIfAborted();let u=this.current;if(!u)return this.connect(),null;if(u.pending.size>=u.maxInFlight)return null;let p=String(++this.nextId),m=new Promise((b)=>u.pending.set(p,{path:e,resolve:b}));if(!this.send(u,{t:"req",id:p,path:e,body:a}))return u.pending.delete(p),null;let f;if(Uu.some((b)=>b.test(e)))f=setTimeout(()=>{if(u.pending.has(p))this.drop(u)},Fu);else{let b=()=>{if(!u.pending.has(p))return;let y=this.now()-u.lastFrameAt;if(y>=wr)this.drop(u);else f=setTimeout(b,wr-y)};f=setTimeout(b,wr)}if(m.finally(()=>clearTimeout(f)),!l)return await m;let g=new Promise((b,y)=>{let h=()=>{if(u.pending.delete(p),clearTimeout(f),this.send(u,{t:"abort",id:p}),this.now()-u.lastFrameAt>wr)this.drop(u);y(l.reason)};if(l.aborted)h();else l.addEventListener("abort",h,{once:!0}),m.finally(()=>l.removeEventListener("abort",h))});return await Promise.race([m,g])}cadence(){return this.current?.cadence??null}close(){if(this.closed=!0,this.reconnectTimer)clearTimeout(this.reconnectTimer);for(let e of[this.current,this.connecting])if(e)this.drop(e)}send(e,a){try{return e.socket.send(JSON.stringify(a)),!0}catch{return this.drop(e),!1}}drop(e){if(e.dropped)return;e.dropped=!0,this.settle(e);try{e.socket.close()}catch{}}settle(e){for(let a of e.pending.values())a.resolve(null);if(e.pending.clear(),this.current===e)this.current=null,this.retryAt=Math.max(this.retryAt,this.now()+this.jitter(Bu));if(this.connecting===e){this.connecting=null,this.failures+=1;let a=Math.min($u,kn*2**Math.min(this.failures-1,10));this.retryAt=Math.max(this.retryAt,this.now()+a/2+this.jitter(a/2))}}connect(){if(this.closed||this.connecting||this.now()<this.retryAt)return;let e=this.options.WebSocket??globalThis.WebSocket;if(!e){this.retryAt=Number.POSITIVE_INFINITY;return}let a=new URL(At,this.options.apiOrigin);a.protocol=a.protocol==="https:"?"wss:":"ws:",a.searchParams.set("device_id",this.options.deviceId);let l;try{l=new e(a.toString())}catch{this.failures+=1,this.retryAt=this.now()+kn;return}let u={socket:l,pending:new Map,maxInFlight:0,cadence:null,lastFrameAt:this.now(),dropped:!1};this.connecting=u,l.onmessage=(p)=>this.receive(u,p.data),l.onclose=()=>this.settle(u),l.onerror=()=>this.settle(u)}receive(e,a){if(typeof a!=="string")return;let l;try{l=JSON.parse(a)}catch{return}if(e.lastFrameAt=this.now(),l.t==="res"){let u=e.pending.get(l.id);e.pending.delete(l.id),u?.resolve({status:l.status,body:l.body,retryAfter:l.retry_after??null});return}if(l.t==="challenge"&&this.connecting===e){let u;try{u=this.options.signHello(l.challenge)}catch{this.drop(e);return}this.send(e,{t:"hello",...u});return}if(l.t==="ready"&&this.connecting===e){this.connecting=null,this.failures=0,e.maxInFlight=Math.max(1,Math.min(l.max_in_flight,1000)),e.cadence=l.cadence??null;let u=this.current;if(this.current=e,u){for(let[p,m]of u.pending){if(!ps.test(m.path))continue;u.pending.delete(p),this.send(u,{t:"abort",id:p}),m.resolve(null)}if(u.pending.size===0)this.drop(u)}return}if(l.t==="fallback"){this.retryAt=this.now()+Math.max(kn,Math.min(l.retry_after_ms,86400000)),this.drop(e);return}if(l.t==="reconnect"&&this.current===e&&!this.reconnectTimer)this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.retryAt=0,this.connect()},Math.max(0,Math.min(l.after_ms,60000)))}}var Mn=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.run.v1","process.full.v1","preview.serve.v1","pty.start","git.run","process.list","ports.list","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.custom.v1","display.stream.v1","automation.call.v1","simulator.call.v1","simulator.stream.v1","tunnel.open","tunnel.close","workspace.setup.v1"];function Ia(e,a={}){let l=qu(e),u=a.rootPathsSupported===!0?ir(e.root_paths):void 0;return{supported_operations:[...e.supported_operations],...a.accountRootMetadataSupported===!0&&typeof e.account_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test(e.account_root_fingerprint)?{account_root_fingerprint:e.account_root_fingerprint}:{},...a.workspaceRootMetadataSupported===!0&&typeof e.workspace_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test(e.workspace_root_fingerprint)?{workspace_root_fingerprint:e.workspace_root_fingerprint}:{},...a.accountRootPathSupported===!0&&typeof e.account_root_path==="string"&&e.account_root_path.startsWith("/")&&e.account_root_path.length<=4096?{account_root_path:e.account_root_path}:{},...a.homeContainedRootsSupported===!0&&Array.isArray(e.home_contained_root_fingerprints)&&e.home_contained_root_fingerprints.length<=32&&e.home_contained_root_fingerprints.every((p)=>/^[a-f0-9]{64}$/.test(p))?{home_contained_root_fingerprints:[...e.home_contained_root_fingerprints]}:{},...u?{root_paths:u}:{},...Object.keys(l).length?{operation_constraints:l}:{},...e.hands_worker_artifact_sha256&&e.hands_worker_entrypoint?{hands_worker_artifact_sha256:e.hands_worker_artifact_sha256,hands_worker_entrypoint:e.hands_worker_entrypoint}:{},...e.hands_slots!==void 0?{hands_slots:e.hands_slots}:{}}}function qu(e){let a=(u)=>u===null||typeof u==="boolean"||typeof u==="number"&&Number.isFinite(u)||typeof u==="string"&&u.length<=512,l={};for(let u of e.supported_operations){let p=e.operation_constraints?.[u];if(!p||typeof p!=="object"||Array.isArray(p))continue;if(!("ready"in p)||typeof p.ready!=="boolean")continue;let m={};for(let[f,g]of Object.entries(p).slice(0,32)){if(!f.length||f.length>64||["__proto__","constructor","prototype"].includes(f))continue;if(a(g)||Array.isArray(g)&&g.length<=64&&g.every(a))m[f]=g}if(Object.keys(m).length)l[u]=m}return l}class k extends Error{status;code;retryAfter;constructor(e,a,l,u=null){super(l);this.status=e;this.code=a;this.retryAfter=u;this.name="LocalRuntimeHttpError"}}class Sr extends Error{timeoutMs;constructor(e){super(`Reason Device request did not answer within ${e}ms.`);this.timeoutMs=e;this.name="LocalRuntimeRequestTimeoutError"}}function or(e){return e===408||e===429||e===500||e===502||e===503||e===504}function sr(e){if(e instanceof k)return!1;if(e instanceof Sr)return!0;if(!(e instanceof Error))return!1;if(e.name==="AbortError")return!1;if(e instanceof TypeError&&e.message.toLowerCase().includes("fetch failed"))return!0;for(let a of[e,e.cause])if(a&&typeof a==="object"&&"code"in a){let l=String(a.code);if(["ECONNRESET","ECONNREFUSED","ETIMEDOUT","EHOSTUNREACH","ENOTFOUND","EAI_AGAIN","ConnectionClosed","ConnectionRefused","UND_ERR_SOCKET","UND_ERR_CONNECT_TIMEOUT"].includes(l))return!0}return!1}function Wu(e,a,l=500){if(a instanceof k&&a.retryAfter){let m=parseFloat(a.retryAfter);if(Number.isFinite(m)&&m>0)return Math.min(m*1000,1e4)}let u=l*2**e,p=Math.floor(Math.random()*200);return Math.min(u+p,5000)}async function Vu(e,a){if(a?.aborted)throw a.reason??new DOMException("The operation was aborted.","AbortError");await new Promise((l,u)=>{let p=()=>{clearTimeout(m),u(a?.reason??new DOMException("The operation was aborted.","AbortError"))},m=setTimeout(()=>{a?.removeEventListener("abort",p),l()},e);a?.addEventListener("abort",p,{once:!0})})}function ee(e){return e instanceof k&&e.status===401&&(e.code==="device_revoked"||e.code==="invalid_device_credential")}function ms(e){return Buffer.byteLength(JSON.stringify(e)??"null","utf8")}function fs(e){return Hu("sha256").update(e??"").digest("hex")}function zu(e){return Mr({method:e.method,pathAndQuery:e.route,timestamp:e.timestamp,nonce:e.nonce,challenge:e.challenge,bodySha256:e.bodySha256})}function hs(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}var Gu=20000,Yu=1e4,gs=[2000,4000],Ku=30000,Xu=15000;function _s(e){return e?{keepalive:!1}:{}}class Nn extends Error{constructor(e){super(`Reason Device proof challenge did not answer within ${e}ms.`)}}class ar{fetchImpl;proofStore;proofOptions;apiOrigin;spareChallenge=null;sessions=new Map;sessionsClosed=!1;constructor(e,a=fetch,l,u={}){this.fetchImpl=a;this.proofStore=l;this.proofOptions=u;let p=new URL(e);if(p.protocol!=="https:"&&p.hostname!=="127.0.0.1"&&p.hostname!=="localhost"&&p.hostname!=="[::1]"&&p.hostname!=="::1")throw Error("Reason Device API must use HTTPS, except for localhost development.");this.apiOrigin=p.origin}async parseResponse(e){if(e.status===204)return null;let a=await e.json().catch(()=>({}));if(!e.ok){let{code:l,message:u}=Ys(a,e.status),p=e.headers?.get?.("retry-after")??null;throw new k(e.status,l,u,p)}return a}async challenge(e,a,l={fresh:!1}){let u=this.proofOptions.challengeAttemptTimeoutsMs??gs;for(let p of u)try{return await this.challengeAttempt(e,a,p,l.fresh)}catch(m){if(a?.aborted||!(m instanceof Nn))throw m;l.fresh=!0}return await this.challengeAttempt(e,a,null,l.fresh)}async challengeAttempt(e,a,l,u=!1){let p=JSON.stringify({device_id:e}),m=l===null?null:new AbortController,f=m&&l!==null?setTimeout(()=>m.abort(new Nn(l)),l):null;try{let g=await this.fetchImpl(`${this.apiOrigin}${M.authChallenge.path}`,{method:"POST",redirect:"error",headers:{accept:"application/json","content-type":"application/json"},body:p,..._s(u),signal:m?a?AbortSignal.any([a,m.signal]):m.signal:a});return Vi(await this.parseResponse(g))}catch(g){if(!a?.aborted&&m?.signal.aborted)throw m.signal.reason;throw g}finally{if(f)clearTimeout(f)}}async takeSpareChallenge(e){let a=this.spareChallenge;if(this.spareChallenge=null,!a||a.deviceId!==e)return null;let l=await a.challenge,u=(this.proofOptions.now??Date.now)();return l&&Date.parse(l.expires_at)-u>=Gu?l:null}refillSpareChallenge(e){let a=this.challengeAttempt(e,void 0,gs[0]??2000).catch(()=>null);this.spareChallenge={deviceId:e,challenge:a}}async proofHeaders(e,a,l,u,p=!1,m,f){let g=m&&Date.parse(m.expires_at)-(this.proofOptions.now??Date.now)()>=Yu?m:null,b=!g&&p?await this.takeSpareChallenge(l.deviceId):null,y=g??b??await this.challenge(l.deviceId,u,f);if(p)this.refillSpareChallenge(l.deviceId);let h=fs(a),w=this.signProof("POST",e,y.challenge,h);return{"x-device-id":l.deviceId,"x-device-timestamp":w.timestamp,"x-device-nonce":w.nonce,"x-device-challenge":y.challenge,"x-device-body-sha256":h,"x-device-signature":w.signature}}signProof(e,a,l,u){let p=String(Math.trunc((this.proofOptions.now??Date.now)())),m=(this.proofOptions.nonce??(()=>ju(24)))();if(m.byteLength<16||m.byteLength>32)throw Error("Invalid Reason Device proof nonce.");let f=Buffer.from(m).toString("base64url"),g=this.proofStore.sign(zu({method:e,route:a,timestamp:p,nonce:f,challenge:l,bodySha256:u}));if(!/^[A-Za-z0-9_-]{8,128}$/.test(g))throw Error("Reason Device proof boundary returned an invalid signature.");return{timestamp:p,nonce:f,signature:g}}sessionFor(e,a){if(!this.proofOptions.deviceSession||this.sessionsClosed||!a||!Es(e.path))return null;let l=this.sessions.get(a.deviceId);if(!l)l=new Dn({apiOrigin:this.apiOrigin,deviceId:a.deviceId,signHello:(u)=>this.signProof("GET",At,u,fs("")),...this.proofOptions.webSocket?{WebSocket:this.proofOptions.webSocket}:{},...this.proofOptions.now?{now:this.proofOptions.now}:{}}),this.sessions.set(a.deviceId,l);return l}sessionCadence(e){let a=this.proofOptions.deviceSession&&!this.sessionsClosed?this.sessions.get(e.deviceId)?.cadence()??null:null;return a?{presenceIntervalMs:a.presence_interval_ms,claimWaitMs:a.claim_wait_ms}:null}close(){this.sessionsClosed=!0;for(let e of this.sessions.values())e.close();this.sessions.clear()}async request(e,a){if(a.body!==void 0&&ms(a.body)>Xe)throw Error("Reason Device request exceeds the 256 KB protocol limit.");if(a.authorization!==void 0&&a.device!==void 0)throw Error("Reason Device request cannot combine bearer and proof authentication.");let l=a.authorization!==void 0,u=a.device!==void 0;if(!(e.auth==="none"?!l&&!u:e.auth==="registration_bearer"?l&&!u:l!==u))throw Error(`Reason Device request used invalid authentication for ${e.path}.`);let m=a.body===void 0?void 0:JSON.stringify(a.body),f=this.proofOptions.maxAttempts??4,g=this.proofOptions.sleep??Vu,b=this.sessionFor(e,a.device),y=Math.max(Ku,(a.holdMs??0)+Xu),h={fresh:!1},w;for(let S=0;S<f;S+=1)try{let v=await b?.request(e.path,a.sessionBody===void 0?m??"":JSON.stringify(a.sessionBody),a.signal)??null;if(v)return await this.parseResponse(new Response(v.status===204?null:v.body,{status:v.status,headers:v.retryAfter===null?{}:{"retry-after":v.retryAfter}}));let R=new AbortController,I=setTimeout(()=>R.abort(new Sr(y)),y),x=a.signal?AbortSignal.any([a.signal,R.signal]):R.signal;try{let E=a.device===void 0?{}:await this.proofHeaders(e.path,m,a.device,x,a.useSpareChallenge===!0&&S===0,S===0?a.issuedChallenge:void 0,h),O=await this.fetchImpl(`${this.apiOrigin}${e.path}`,{method:"POST",redirect:"error",headers:{...a.authorization===void 0?{}:{authorization:`Bearer ${a.authorization}`},...E,accept:"application/json",...a.body===void 0?{}:{"content-type":"application/json"}},body:m,..._s(h.fresh),signal:x});return await this.parseResponse(O)}catch(E){if(!a.signal?.aborted&&R.signal.aborted)throw R.signal.reason;throw E}finally{clearTimeout(I)}}catch(v){if(w=v,v instanceof Sr)h.fresh=!0;if(a.signal?.aborted)throw v;let R=a.device!==void 0&&v instanceof k&&v.status===401&&["invalid_device_proof","device_proof_replayed"].includes(v.code),I=v instanceof k&&or(v.status),x=sr(v),E=a.transientRetryOwner!=="caller"&&(I||x);if((R||E)&&S+1<f){let O=R?0:Wu(S,v,this.proofOptions.retryBaseDelayMs??500);if(O>0)await g(O,a.signal);continue}throw v}throw w??Error("Reason Device request failed.")}async register(e,a,l){let u=await this.request(M.register,{authorization:e,body:a,signal:l});return Zs(u)}async enroll(e,a,l,u){let p=await this.request(M.enroll,{body:{...l,enrollment_ticket:e,code_verifier:a},signal:u});return Qs(p)}async heartbeat(e,a,l,u){let p=await this.request(M.heartbeat,{device:e,body:a,signal:l,...u?{issuedChallenge:u}:{}});return ea(p)}async syncRoots(e,a,l){let u=await this.request(M.rootsSync,{device:e,body:{roots:a},signal:l});return ta(u)}async identity(e,a){let l=await this.request(M.identity,{device:e,signal:a});return ra(l)}async disconnect(e,a,l,u=[]){let p=await this.request(M.disconnect,{device:e,body:l?{successor_device_id:l,...u.length?{successor_roots:u}:{}}:{},signal:a});return na(p)}async deviceLifecycle(e,a,l){let u=await this.request(M.lifecycle,{device:e,body:a,signal:l});oa(u)}async localSubscription(e,a,l){return ia(await this.request(M.localSubscription,{device:e,body:a,signal:l}))}async ownerWorkspaces(e,a){let u=(await this.request(M.ownerWorkspaces,{device:e,body:{},signal:a}))?.organizations;if(!Array.isArray(u))throw Error("Reason returned an invalid workspace list.");return u.flatMap((p)=>{let m=p;return typeof m?.id==="string"?[{id:m.id,...typeof m.name==="string"&&m.name.trim()?{name:m.name.trim()}:{},blocked:m.blocked===!0}]:[]})}async ownerWorkspaceEnrollment(e,a,l){return this.request(M.ownerWorkspaceEnrollment,{device:e,body:a,signal:l})}async liveSessionWorktrees(e,a,l){let u=await this.request(M.sessionWorktrees,{device:e,body:{worktree_ids:[...a]},signal:l}).catch((p)=>{if(p instanceof k&&p.status===404)return null;throw p});if(u===null)return null;if(!hs(u)||!Array.isArray(u.live)||!u.live.every((p)=>typeof p==="string"&&a.includes(p)))throw Error("Reason returned an invalid Session worktree answer.");return u.live}async claimOperation(e,a={}){let l=Math.max(a.waitMs??25000,0),u=(f)=>({wait_ms:Math.min(l,f),...a.instanceGeneration===void 0?{}:{instance_generation:a.instanceGeneration}}),p=this.sessionCadence(e)?.claimWaitMs,m=await this.request(M.operationClaim,{device:e,body:u(30000),holdMs:Math.min(l,30000),...p===void 0?{}:{sessionBody:u(Math.min(p,Fn))},signal:a.signal});if(m===null)return null;return sa(m,Mn)}async operationHeartbeat(e,a,l={}){let u=(f)=>this.request(M.operationHeartbeat.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token,...l.controlAckSeq===void 0?{}:{control_ack_seq:l.controlAckSeq},...f?{client_retry_count:l.clientRetryCount}:{},...f&&l.waitMs!==void 0?{wait_ms:Math.min(Math.max(l.waitMs,0),30000)}:{}},signal:l.signal,transientRetryOwner:l.transientRetryOwner,...f&&l.waitMs!==void 0?{holdMs:Math.min(Math.max(l.waitMs,0),30000)}:{}}),p=(l.clientRetryCount??0)>0||l.waitMs!==void 0,m;try{m=await u(p)}catch(f){if(!p||!(f instanceof k)||f.status!==400||f.code!=="invalid_operation_heartbeat")throw f;m=await u(!1)}return aa(m)}async operationEvents(e,a,l){if(!Number.isInteger(l.eventSeqStart)||l.eventSeqStart<0||l.events.length<1||l.events.length>100||l.events.some((p)=>!/^[A-Za-z0-9._:-]{1,64}$/.test(p.kind)||!hs(p.payload)))throw Error("Invalid Reason Device operation event batch.");let u=await this.request(M.operationEvents.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token,event_seq_start:l.eventSeqStart,events:l.events},signal:l.signal,transientRetryOwner:l.transientRetryOwner,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return ca(u)}async completeOperation(e,a,l,u){let p={attempt_id:a.attempt_id,attempt_token:a.attempt_token,status:l.status,...l.result===void 0?{}:{result:l.result},...l.error_code?{error_code:l.error_code}:{}};if(ms(p)>Xe)throw Error("Reason Device operation result exceeds the 256 KB protocol limit.");let m=await this.request(M.operationComplete.forOperation(a.operation_id),{device:e,body:p,signal:u});return ua(m)}async operationCustomEndpointCredential(e,a,l){let{CustomEndpointDeviceCredentialSchema:u}=await import("./custom-endpoint-device-3jscber1.js");return u.parse(await this.request(M.operationCustomEndpointCredential.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token},signal:l}))}async operationEnvironment(e,a,l,u){let p=await this.request(M.operationEnvironment.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token,snapshot_id:l},signal:u,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return la(p)}async acknowledgeOperationEnvironment(e,a,l,u){await this.request(M.operationEnvironmentAck.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token,...l},signal:u,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}})}}var Ju=new Set(["process.run.v1","process.full.v1","computer.use","browser.use"]),Ft=new Set(["jobs.control","environment.install","tunnel.open","tunnel.close","display.stream.v1","automation.call.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"]);function Rr(e,a){if(Ju.has(e))return!1;if(Ft.has(e)&&!a.runtimeDirectory)return!1;if((e==="inference.custom.v1"||e==="preview.serve.v1"||e==="simulator.call.v1"||e==="simulator.stream.v1")&&(a.executionMode!=="unsandboxed"||!a.runtimeDirectory))return!1;if(a.executionMode!=="unsandboxed"&&(["exec.full","hands.connect","pty.start","browser.pr-proof.v1"].includes(e)||Ft.has(e)))return!1;return!0}import{accessSync as Zu,constants as Qu,existsSync as ed,statSync as td}from"fs";import{basename as rd,isAbsolute as nd}from"path";var Ut=["-lic"],ys="/bin/zsh",od=new Set(["zsh","bash"]),ws=20000,$n=60000,id=65536,sd=64,ad=8192,ld=new Set(["NODE_OPTIONS","PATH","ZDOTDIR","BASH_ENV","ENV"]),cd=["DYLD_","LD_"];function ud(e){let a=e.toUpperCase();return ld.has(a)||cd.some((l)=>a.startsWith(l))}function Ss(e=process.env){return!0}function dd(e){if(!nd(e)||e.includes("\x00"))return!1;if(!od.has(rd(e)))return!1;try{if(!td(e).isFile())return!1;return Zu(e,Qu.X_OK),!0}catch{return!1}}function dt(e=process.env){if(process.platform==="win32")return Y()??ys;let a=e.SHELL?.trim();if(a&&dd(a))return a;return ys}function Un(e=process.env){return Ss(e)&&ed(dt(e))}function jn(e=process.env){if(!Ss(e))throw new r("full_control_disabled","Full-control execution is unavailable on this Reason Device.")}function qn(e){if(typeof e!=="string"||e.length===0||e.includes("\x00")||Buffer.byteLength(e,"utf8")>id)throw new r("invalid_payload","command is missing or too large.");return e}function Wn(e){if(e===void 0||e===null)return{forwarded:{},ignored:[]};if(typeof e!=="object"||Array.isArray(e))throw new r("invalid_payload","env must be an object of strings.");let a=Object.entries(e);if(a.length>sd)throw new r("invalid_payload","env has too many entries.");let l={},u=[];for(let[p,m]of a){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(p)||typeof m!=="string"||m.includes("\x00")||Buffer.byteLength(m,"utf8")>ad)throw new r("invalid_payload","env entry is invalid or too large.");if(ud(p)){u.push(p);continue}l[p]=m}return{forwarded:l,ignored:u}}async function vs(e){let a=e.processEnv??process.env;if(jn(a),e.signal.aborted)throw new r("cancelled","Operation was cancelled.");let l=qn(e.command),u=dt(a),{forwarded:p,ignored:m}=Wn(e.requestEnv),f=await e.spawn(u,[...Ut,l],{cwd:e.cwd,timeoutMs:e.timeoutMs,signal:e.signal,env:{...a,...p}});return{exit_code:f.exitCode,signal:f.signal,stdout:f.stdout,stderr:f.stderr,timed_out:f.timedOut,truncated:f.truncated,shell:u,shell_flags:[...Ut],login:!0,interactive:!0,sandbox:"none",ignored_env:m}}function xs(e=process.env){return{transport:"shell",shell:`${dt(e)} ${Ut.join(" ")}`,login_shell:!0,interactive_shell:!0,rc_files_loaded:!0,sandbox:"none",network:!0,environment:"inherited",privilege:"user",sudo:"argv_exact_nopasswd_only",activation:"explicit_device_grant",max_timeout_ms:$n}}import{readFile as pd,readdir as md,readlink as fd,realpath as hd}from"fs/promises";import{basename as gd,relative as _d,sep as yd}from"path";var nt="/proc",bd=250,Cs=500,wd=50,Sd=250,vd=1024,As=4096,Rd=1,xd=3,Xs=9,Ed="0A",Cd=/^socket:\[(\d+)\]$/,Vn={readDirectory:(e)=>md(e),readLink:(e)=>fd(e),readTextFile:(e)=>pd(e,"utf8"),realPath:(e)=>hd(e)};function fa(e,a){return a===e||a.startsWith(`${e}${yd}`)}function Pd(e,a){return _d(e,a)||"."}async function ga(e){let a;try{a=await e.readDirectory(nt)}catch{return[]}return a.filter((l)=>/^[0-9]+$/.test(l)).map((l)=>Number(l)).filter((l)=>Number.isSafeInteger(l)&&l>0).sort((l,u)=>l-u)}async function _a(e,a){try{let u=(await a.readTextFile(`${nt}/${e}/comm`)).slice(0,As).split(`
-`,1)[0]?.trim();if(u)return u}catch{}try{let u=(await a.readTextFile(`${nt}/${e}/cmdline`)).slice(0,As).split("\x00",1)[0]?.trim();return u?gd(u):null}catch{return null}}async function ya(e,a=Vn){let l;try{l=await a.readLink(`${nt}/${e}/cwd`)}catch{return null}if(!l)return null;try{return await a.realPath(l)}catch{return null}}async function ba(e,a=Vn){let l=[];for(let u of await ga(a)){if(l.length>=bd)break;let p=await ya(u,a);if(!p||!fa(e,p))continue;l.push({pid:u,command:await _a(u,a),cwd:Pd(e,p)})}return{processes:l}}function ma(e){let a=[];for(let l=0;l<8;l+=2)a.unshift(Number.parseInt(e.slice(l,l+2),16));return a}function Od(e){let a=[];for(let b=0;b<16;b+=2)a.push(e[b]<<8|e[b+1]);if(a.slice(0,5).every((b)=>b===0)&&a[5]===65535)return`::ffff:${e.slice(12).join(".")}`;let l=-1,u=0,p=-1;for(let b=0;b<=a.length;b+=1){if(b<a.length&&a[b]===0){if(p<0)p=b;continue}if(p>=0){let y=b-p;if(y>u)l=p,u=y;p=-1}}let m=a.map((b)=>b.toString(16));if(u<2)return m.join(":");let f=m.slice(0,l).join(":"),g=m.slice(l+u).join(":");return`${f}::${g}`}function Id(e,a){if(/^[0-9A-Fa-f]{8}$/.test(e)){let l=ma(e);if(l.every((u)=>u===0))return`*:${a}`;return`${l.join(".")}:${a}`}if(/^[0-9A-Fa-f]{32}$/.test(e)){let l=[];for(let u=0;u<4;u+=1)l.push(...ma(e.slice(u*8,u*8+8)));if(l.every((u)=>u===0))return`*:${a}`;return`[${Od(l)}]:${a}`}return null}function Ad(e,a){let l=[];for(let u of e.split(`
-`).slice(1)){if(l.length>=a)break;let p=u.trim().split(/\s+/);if(p.length<=Xs)continue;if(p[xd]?.toUpperCase()!==Ed)continue;let m=p[Rd]??"",f=m.lastIndexOf(":");if(f<0)continue;let g=Number.parseInt(m.slice(f+1),16);if(!Number.isInteger(g)||g<=0||g>65535)continue;let b=Id(m.slice(0,f),g),y=p[Xs];if(!b||!y||!/^[0-9]+$/.test(y))continue;l.push({inode:y,port:g,address:b})}return l}async function Ld(e){let a=[];for(let l of["tcp","tcp6"]){if(a.length>=Cs)break;let u;try{u=await e.readTextFile(`${nt}/net/${l}`)}catch{continue}a.push(...Ad(u,Cs-a.length))}return a}async function kd(e,a){let l=new Map;if(e.size===0)return l;for(let u of await ga(a)){if(l.size>=e.size)break;let p;try{p=await a.readDirectory(`${nt}/${u}/fd`)}catch{continue}for(let m of p.slice(0,vd)){let f;try{f=await a.readLink(`${nt}/${u}/fd/${m}`)}catch{continue}let g=f.match(Cd)?.[1];if(!g||!e.has(g)||l.has(g))continue;l.set(g,u)}}return l}async function wa(e,a=Vn){let l=await Ld(a),u=await kd(new Set(l.map((h)=>h.inode)),a),p=[];for(let h of l){let w=u.get(h.inode);if(w===void 0)continue;p.push({pid:w,port:h.port,address:h.address})}p.sort((h,w)=>h.pid-w.pid||h.port-w.port||(h.address<w.address?-1:h.address>w.address?1:0));let m=[...new Set(p.map((h)=>h.pid))].slice(0,wd),f=await Promise.all(m.map(async(h)=>[h,await ya(h,a)])),g=new Map(f),b=p.filter((h)=>{let w=g.get(h.pid);return Boolean(w&&fa(e,w))}),y=new Map(await Promise.all([...new Set(b.map((h)=>h.pid))].map(async(h)=>[h,await _a(h,a)])));return{ports:b.slice(0,Sd).map((h)=>({pid:h.pid,command:y.get(h.pid)??null,address:h.address}))}}import{posix as Zn}from"path";var xr=200,Td=250,Dd=250;async function Er(e,a){let l=await e(a);if(l.timedOut||l.truncated||l.exitCode!==0&&l.exitCode!==1)throw new r("process_inspection_failed","Reading this Mac's processes did not complete.");let u=[],p=null;for(let m of l.stdout.split(/\r?\n/))if(m.startsWith("p")){let f=Number(m.slice(1));if(p=Number.isInteger(f)&&f>0?{pid:f,command:null,names:[]}:null,p)u.push(p)}else if(p&&m.startsWith("c"))p.command=m.slice(1)||null;else if(p&&m.startsWith("n"))p.names.push(m.slice(1));return u}function zn(e,a){return a===e||a.startsWith(e==="/"?e:`${e}/`)}var Sa="/System/Volumes/Data",Nd=["/tmp","/var","/etc"];function eo(e){let a=Zn.normalize(e);if(a.startsWith(`${Sa}/`))a=a.slice(Sa.length);return Nd.find((u)=>a===u||a.startsWith(`${u}/`))?`/private${a}`:a}function va(e){return e&&Zn.isAbsolute(e)?eo(e):null}async function Ra(e,a){let l=new Map;for(let u=0;u<a.length;u+=xr){let p=a.slice(u,u+xr).join(",");for(let m of await Er(e,["-a","-p",p,"-d","cwd","-Fpcn"]))l.set(m.pid,{command:m.command,cwd:va(m.names[0])})}return l}async function xa(e,a){let l=eo(e),u=(await Er(a,["-d","cwd","-Fpn"])).filter((m)=>{let f=va(m.names[0]);return f!==null&&zn(l,f)}).map((m)=>m.pid).slice(0,Td),p=await Ra(a,u);return{processes:u.flatMap((m)=>{let f=p.get(m);return f?.cwd&&zn(l,f.cwd)?[{pid:m,command:f.command,cwd:Zn.relative(l,f.cwd)||"."}]:[]})}}async function Ea(e,a){let l=eo(e),u=["-nP","-iTCP","-sTCP:LISTEN","-Fpcn"],p=await Er(a,u),m=await Ra(a,p.map((y)=>y.pid)),f=p.map((y)=>y.pid).filter((y)=>{let h=m.get(y)?.cwd;return Boolean(h&&zn(l,h))});if(f.length===0)return{ports:[]};let g=new Set(p.flatMap((y)=>y.names.map((h)=>`${y.pid} ${h}`))),b=[];for(let y=0;y<f.length;y+=xr){let h=f.slice(y,y+xr).join(",");for(let w of await Er(a,["-a","-p",h,...u]))for(let S of w.names)if(g.has(`${w.pid} ${S}`))b.push({pid:w.pid,command:w.command,address:S})}return{ports:b.slice(0,Dd)}}import{join as Gd}from"path";import{spawn as Hd}from"child_process";import{randomUUID as jd}from"crypto";import{chmodSync as Oa,lstatSync as Aa,mkdirSync as qd,readdirSync as Wd,statSync as Vd,unlinkSync as zd}from"fs";import{join as ro}from"path";var to={targets:24,assets:128,sourceFiles:2000,sourceBytes:20000000,outputBytes:20000000};var Cr=(e,a=0,l=1e6)=>typeof e==="number"&&Number.isFinite(e)&&e>=a&&e<=l;var ot=()=>{throw Error("proof_visual_contract_invalid")};class Ca extends Error{constructor(){super("proof_visual_contract_invalid")}}function po(e){if(!q(e)||e.version!==1)return ot();if(typeof e.route!=="string"||!e.route.startsWith("/")||e.route.length>512||/[\x00-\x20\x7f\\?#%]/.test(e.route)||e.route.startsWith("//"))throw new Ca;if(!q(e.viewport)||!Cr(e.viewport.width,1,4096)||!Cr(e.viewport.height,1,4096)||!Array.isArray(e.targets)||e.targets.length<1||e.targets.length>to.targets||Object.keys(e).some((u)=>!["version","route","viewport","targets","additionalViewports"].includes(u)))return ot();let a=e.targets.map((u)=>{if(!q(u)||typeof u.id!=="string"||!/^[a-zA-Z0-9_-]{1,64}$/.test(u.id)||typeof u.selector!=="string"||!u.selector.trim()||u.selector.length>256||/[\x00-\x1f\x7f]/.test(u.selector)||Object.keys(u).some((p)=>!["id","selector"].includes(p)))return ot();return{id:u.id,selector:u.selector}});if(new Set(a.map((u)=>u.id)).size!==a.length)return ot();let l;if(e.additionalViewports!==void 0){if(!Array.isArray(e.additionalViewports)||e.additionalViewports.length<1||e.additionalViewports.length>3)return ot();l=e.additionalViewports.map((p)=>{if(!q(p)||!Cr(p.width,1,4096)||!Number.isInteger(p.width)||!Cr(p.height,1,4096)||!Number.isInteger(p.height)||Object.keys(p).some((m)=>!["width","height"].includes(m)))return ot();return{width:p.width,height:p.height}});let u=[e.viewport,...l].map((p)=>`${p.width}x${p.height}`);if(new Set(u).size!==u.length)return ot()}return{version:1,route:e.route,viewport:{width:e.viewport.width,height:e.viewport.height},targets:a,...l?{additionalViewports:l}:{}}}var Bd=["organizationId","userId","sessionId","runId"],Fd=[...Bd,"prUrl","headSha","skillDigest","evidenceKind"],Hh=[...Fd,"contextId","preparedAt","captureId","startedAt","finishedAt","sha256","kind","visualPlan","visualObservation"];var Ud={"image/png":{kind:"image",directory:"/tmp/ara-public-screenshots",extension:"png",maxBytes:8388608},"video/webm":{kind:"video",directory:"/tmp/ara-public-recordings",extension:"webm",maxBytes:10551296}};function Pa(e){return Ud[e].directory}var La=10485760;function ka(e={}){let a=e.directory??Pa("video/webm"),l=null;return{async start(u){if(l)throw Error("cloud_browser_recording_active");let p=u?.seconds;if(!Number.isInteger(p)||Number(p)<1||Number(p)>15||!u||Object.keys(u).some((x)=>x!=="seconds"))throw Error("cloud_browser_recording_seconds_1_to_15_required");qd(a,{recursive:!0,mode:457});let m=Aa(a);if(!m.isDirectory()||m.isSymbolicLink()||m.uid!==process.getuid?.())throw Error("cloud_browser_recording_directory_invalid");Oa(a,457);let f=Wd(a).filter((x)=>/^[a-f0-9-]{36}\.webm$/.test(x)).map((x)=>({name:x,time:Vd(ro(a,x)).mtimeMs})).sort((x,E)=>E.time-x.time);for(let x of f.slice(9))zd(ro(a,x.name));let g=ro(a,`${jd()}.webm`),b=["-f","x11grab","-framerate","12","-i",e.display??":99"],y=(e.spawn??Hd)(e.ffmpeg??"ffmpeg",["-nostdin","-hide_banner","-loglevel","error","-y",...b,"-t",String(p),"-vf","scale=1280:-2","-c:v","libvpx","-deadline","realtime","-b:v","700k","-an","-fs",String(La),"-progress","pipe:1",g],{stdio:["ignore","pipe","ignore"],...e.env?{env:e.env}:{}}),h,w,S=!1,v=new Promise((x,E)=>{h=x,w=E});y.stdout.on("data",(x)=>{if(/frame=\s*[1-9]/.test(String(x)))S=!0,h()});let R=new Promise((x,E)=>{y.once("error",()=>{w(Error("cloud_browser_recording_unavailable")),E(Error("cloud_browser_recording_unavailable"))}),y.once("exit",(O)=>{try{if(O!==0&&O!==255)throw Error();let D=Aa(g);if(!S||!D.isFile()||D.isSymbolicLink()||D.uid!==process.getuid?.()||D.size<128||D.size>La+65536)throw Error();Oa(g,420),h(),x({path:g,mimeType:"video/webm"})}catch{w(Error("cloud_browser_recording_failed")),E(Error("cloud_browser_recording_failed"))}})});R.catch(()=>{});let I=setTimeout(()=>y.kill("SIGKILL"),(Number(p)+5)*1000);R.finally(()=>clearTimeout(I)).catch(()=>{}),l={done:R,stop:()=>(y.kill("SIGINT"),R)};try{await v}catch(x){throw l=null,x}return{recording:!0,seconds:Number(p)}},async stop(){if(!l)throw Error("cloud_browser_recording_not_started");let u=l;return l=null,u.stop()},async close(){if(l)await this.stop().catch(()=>{})}}}function Ta(e,a={}){if(e.executionMode!=="unsandboxed"||!e.runtimeDirectory||(a.platform??process.platform)!=="linux")return null;let l=(a.components??A)(),u=l?.features.display?l.ffmpeg:null;if(!u)return null;let p=Gd(e.runtimeDirectory,"recordings"),m=null;return{async start(f){let g=await(a.desktop??jt)();return m??=ka({directory:p,display:g.display,ffmpeg:u,env:{HOME:s(),PATH:"/usr/local/bin:/usr/bin:/bin",XAUTHORITY:g.xauthority},...a.spawn?{spawn:a.spawn}:{}}),m.start(f)},async stop(){if(!m)throw Error("cloud_browser_recording_not_started");return m.stop()},async close(){await m?.close()}}}import{spawn as Do}from"child_process";import{createHash as mp,randomUUID as fp}from"crypto";import{existsSync as Ae,mkdirSync as Oo,mkdtempSync as No,readdirSync as Wr,readFileSync as Mo,renameSync as hp,rmSync as Wt,statSync as Dr,writeFileSync as gp}from"fs";import{homedir as Uo,tmpdir as fl}from"os";import{basename as hl,dirname as Io,join as K,relative as gl,resolve as Ao,sep as _l}from"path";var _e=t().min(1).max(200),Ie=o().finite().min(0).max(1e4),Pr=t().min(1).max(4096).refine((e)=>!e.includes("\x00")),Da=t().regex(/^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/),oo=n({id:t().min(1).max(500).optional(),label:t().min(1).max(500).optional()}).strict(),io=["home","lock","side_button","siri","apple_pay"],Yd=c(["tree","screenshot","both","none"]),Kd=n({...oo.shape,gone:_().optional()}).strict().refine((e)=>Boolean(e.id||e.label),"wait_for needs an id or label"),ze={observe:Yd.optional(),wait_for:Kd.optional(),timeout:o().min(0).max(20).optional()},no=P("action",[n({action:i("tap"),x:Ie.optional(),y:Ie.optional(),...oo.shape,duration:o().min(0).max(10).optional()}).strict().refine((e)=>e.x!==void 0&&e.y!==void 0||Boolean(e.id||e.label),"pass x and y, or an id or label"),n({action:i("swipe"),x:Ie,y:Ie,x2:Ie,y2:Ie,duration:o().min(0.05).max(5).optional()}).strict(),n({action:i("type"),text:t().min(1).max(4000)}).strict(),n({action:i("button"),name:c(io)}).strict(),n({action:i("sleep"),seconds:o().min(0).max(10)}).strict()]),so=P("action",[n({action:i("devices")}).strict(),n({action:i("boot"),device:_e}).strict(),n({action:i("shutdown"),device:_e}).strict(),n({action:i("build"),path:Pr.optional(),scheme:t().min(1).max(200).optional(),configuration:t().min(1).max(100).optional(),device:_e.optional(),wait:_().optional()}).strict(),n({action:i("run"),path:Pr.optional(),scheme:t().min(1).max(200).optional(),configuration:t().min(1).max(100).optional(),device:_e.optional(),steps:d(Yc(()=>no)).max(30).optional(),...ze}).strict(),n({action:i("build_status"),build_id:t().regex(/^build-[0-9a-z-]{4,64}$/),device:_e.optional(),wait:_().optional()}).strict(),n({action:i("launch"),device:_e.optional(),app_path:Pr.optional(),bundle_id:Da.optional(),steps:d(Yc(()=>no)).max(30).optional(),...ze}).strict().refine((e)=>Boolean(e.app_path)!==Boolean(e.bundle_id),"pass exactly one of app_path or bundle_id"),n({action:i("terminate"),device:_e.optional(),bundle_id:Da}).strict(),n({action:i("logs"),device:_e.optional(),after:o().int().min(0).optional()}).strict(),n({action:i("screenshot"),device:_e.optional(),scale:we([i(1),i(2)]).optional(),save_path:Pr.optional()}).strict(),n({action:i("chrome"),device:_e.optional()}).strict(),n({action:i("inspect"),device:_e.optional()}).strict(),n({action:i("tap"),device:_e.optional(),x:Ie.optional(),y:Ie.optional(),...oo.shape,duration:o().min(0).max(10).optional(),...ze}).strict().refine((e)=>e.x!==void 0&&e.y!==void 0||Boolean(e.id||e.label),"pass x and y, or an id or label"),n({action:i("swipe"),device:_e.optional(),x:Ie,y:Ie,x2:Ie,y2:Ie,duration:o().min(0.05).max(5).optional(),...ze}).strict(),n({action:i("type"),device:_e.optional(),text:t().min(1).max(4000),...ze}).strict(),n({action:i("button"),device:_e.optional(),name:c(io),...ze}).strict(),n({action:i("open_url"),device:_e.optional(),url:t().min(1).max(4000),...ze}).strict(),n({action:i("steps"),device:_e.optional(),steps:d(no).min(1).max(30),...ze}).strict(),n({action:i("appearance"),device:_e.optional(),mode:c(["light","dark"])}).strict()]),Na=n({udid:t(),name:t(),runtime:t(),state:c(["booted","shutdown","booting","shutting_down"]),kind:c(["iphone","ipad","other"])}).strict(),sg=n({text:t(),error:t().optional(),device:Na.optional(),devices:d(Na).optional(),image:n({mime:i("image/jpeg"),data:t(),width:o(),height:o()}).strict().optional(),build:n({id:t(),status:c(["running","succeeded","failed"]),app_path:t().optional(),bundle_id:t().optional(),errors:d(t()),log_tail:t(),elapsed_ms:o()}).strict().optional(),logs:n({lines:d(t()),next:o()}).strict().optional(),screen:t().optional(),chrome:n({identifier:t(),screen:n({width:o(),height:o()}).strict(),inset:n({top:o(),left:o(),bottom:o(),right:o()}).strict(),padding:n({top:o(),left:o(),bottom:o(),right:o()}).strict(),screen_mask:t().optional(),pieces:$e(c(["topLeft","top","topRight","right","bottomRight","bottom","bottomLeft","left"]),n({image:t(),width:o(),height:o()}).strict()),buttons:d(n({name:t(),image:t(),x:o(),y:o(),width:o(),height:o()}).strict())}).strict().optional()}).strict();var ag=n({device_id:V().optional(),root_id:V().optional()}),Ir={device_id:{type:"string",format:"uuid",description:"Reason machine id from devices.list; omit for the machine this Session runs on."},root_id:{type:"string",format:"uuid"},device:{type:"string",description:"Simulator UDID or exact name. Required for boot and shutdown; for other actions omit it for the booted one."},path:{type:"string",description:"build or run: a .xcodeproj, .xcworkspace, or a folder holding one (project.yml is generated with XcodeGen), absolute or relative to the Session's folder. Omit it when the folder holds one app project."},scheme:{type:"string"},configuration:{type:"string"},build_id:{type:"string",description:"build_status (required): the build_id a build or run returned."},app_path:{type:"string",description:"launch: the built .app from build_status (or pass bundle_id instead)."},bundle_id:{type:"string",description:"terminate (required); launch: an installed app's bundle id instead of app_path."},after:{type:"integer",minimum:0,description:"logs: only lines after this sequence number."},x:{type:"number",description:"tap (with y, unless id or label is given) or swipe (required): start point in device points."},y:{type:"number"},x2:{type:"number",description:"swipe (required, with y2): end point in device points."},y2:{type:"number"},id:{type:"string",description:"tap: accessibility identifier from inspect (instead of x and y)."},label:{type:"string",description:"tap: accessibility label from inspect (instead of x and y)."},duration:{type:"number",description:"tap: seconds held (above 0.5 is a long press); swipe: seconds."},text:{type:"string",description:"type (required): the text to type."},name:{type:"string",enum:[...io],description:"button (required)."},url:{type:"string",description:"open_url (required): the URL or deep link."},mode:{type:"string",enum:["light","dark"],description:"appearance (required)."},steps:{type:"array",maxItems:30,description:"steps (required, at least one) or launch and run: run in order in one call (after launch, once the app is up). Each item is {action:'tap', id|label|x,y} | {action:'swipe', x,y,x2,y2} | {action:'type', text} | {action:'button', name} | {action:'sleep', seconds}. Taps by id or label wait for their element to appear.",items:{type:"object"}},observe:{type:"string",enum:["tree","screenshot","both","none"],description:"After tap, swipe, type, button, open_url, launch or steps: what to return about the settled screen. Default tree (the accessibility tree, so no separate inspect is needed); screenshot or both to see it."},wait_for:{type:"object",description:"After the action, wait until this element is on screen: {id} or {label}; add gone:true to wait for it to disappear.",properties:{id:{type:"string"},label:{type:"string"},gone:{type:"boolean"}},additionalProperties:!1},timeout:{type:"number",description:"Seconds to wait for wait_for (default 5, max 20)."},wait:{type:"boolean",description:"build or build_status: wait for the build to finish (up to ~45 s) instead of returning at once."},save_path:{type:"string",description:"screenshot: also save the full-resolution PNG at this path (absolute or relative to the Session's folder), for example to show the user."}},ja=so.options.map((e)=>e.shape).filter((e)=>e.action.value!=="chrome"),Xd={tap:[{required:["x","y"]},{required:["id"]},{required:["label"]}],launch:[{required:["app_path"],without:["bundle_id"]},{required:["bundle_id"],without:["app_path"]}]},Ma=new Set;function Jd(e,a){let{description:l,...u}=e==="steps"&&a==="steps"?{...Ir.steps,minItems:1}:Ir[e];if(l===void 0||Ma.has(e))return u;return Ma.add(e),{...u,description:l}}var Zd=ja.flatMap((e)=>{let a=e.action.value,l=Object.keys(e).filter((p)=>Object.hasOwn(Ir,p)),u=l.filter((p)=>!e[p].safeParse(void 0).success);return(Xd[a]??[{required:[]}]).map((p)=>({type:"object",properties:Object.fromEntries([["action",{type:"string",const:a}],...["device_id","root_id",...l].filter((m)=>!p.without?.includes(m)).map((m)=>[m,Jd(m,a)])]),required:["action",...u,...p.required],additionalProperties:!1}))}),Qd={type:"object",properties:{action:{type:"string",enum:ja.map((e)=>e.action.value)},...Ir},required:["action"],additionalProperties:!1},lg={...Qd,anyOf:Zd};import{spawn as wo}from"child_process";import{createHash as tp}from"crypto";import{existsSync as co,mkdirSync as kr,mkdtempSync as rp,readdirSync as qa,readFileSync as za,renameSync as np,rmSync as Za,symlinkSync as bo,writeFileSync as Ht}from"fs";import{homedir as op}from"os";import{dirname as ol,join as re}from"path";import{createInterface as ip}from"readline";var ao=`// Reason's simulator host: one warm process per booted iOS Simulator.
+`:"")+p.toString("utf8")}}}async function ls(e,a){if(!Zr())throw new r("workspace_setup_requires_root","Workspace setup runs only on a root Linux worker.");let l=ss.safeParse(e);if(!l.success)throw new r("invalid_request","Reason sent an invalid workspace setup.");let u=l.data,p,m;try{p=Cn(u.script_gzip),m=Cn(u.stdin_gzip)}catch{throw new r("invalid_request","Reason sent an unreadable workspace setup.")}a.throwIfAborted();let f=Su(as(Cu(),"reason-workspace-setup-"));try{let g=as(f,"setup.sh");Ru(g,p,{mode:384});let b={PATH:Pu,LANG:"C.UTF-8",HOME:"/root",USER:"root",LOGNAME:"root",SHELL:"/bin/bash",TMPDIR:"/tmp"};for(let B of Ou)if(process.env[B])b[B]=process.env[B];Object.assign(b,u.env);let y=wu("/bin/bash",[g],{cwd:u.cwd,env:b,detached:!0,stdio:["pipe","pipe","pipe"]}),h=Pn(Bt),w=Pn(Bt),S=Pn(Bt);y.stdout.on("data",(B)=>{h.push(B),S.push(B)}),y.stderr.on("data",(B)=>{w.push(B),S.push(B)}),y.stdin.on("error",()=>{}),y.stdin.end(m);let v=(B)=>{try{if(y.pid)process.kill(-y.pid,B)}catch{}},R=!1,I,x=()=>{v("SIGTERM"),I??=setTimeout(()=>v("SIGKILL"),Iu)},E=setTimeout(()=>{R=!0,x()},u.timeout_ms);a.addEventListener("abort",x,{once:!0});let O=await new Promise((B,ne)=>{y.once("error",()=>ne(new r("workspace_setup_start_failed","The workspace setup did not start."))),y.once("exit",(de,he)=>B({code:de,signal:he}))}).finally(()=>{clearTimeout(E),clearTimeout(I),a.removeEventListener("abort",x)});await new Promise((B)=>{let ne=setTimeout(B,Au);y.once("close",()=>{clearTimeout(ne),B()})}),y.stdout.destroy(),y.stderr.destroy(),a.throwIfAborted();let D=R?124:O.signal?128+(xu.signals[O.signal]??0):O.code??1;return{exit_code:Math.min(255,D),stdout:h.text(),stderr:w.text(),...D!==0?{combined:S.text()}:{}}}finally{vu(f,{recursive:!0,force:!0})}}import{chmodSync as Lu,mkdtempSync as ku,realpathSync as cs,rmSync as Tu}from"fs";import{tmpdir as Du}from"os";import{dirname as Nu,join as On,sep as Mu}from"path";function An(e){return fi(e,di(e)!==null).repoPath}function us(e,a){let l;try{if(typeof a!=="string")throw Error("invalid");l=[Oe,void 0].map((p)=>Nu(X({kind:"managed",workspaceId:a,...p?{layout:p}:{}})))}catch{throw new r("cloud_copy_workspace_invalid","The Cloud copy workspace is invalid.")}let u;for(let p of l)try{u=cs(On(e,p));break}catch{}if(u===void 0)throw new r("cloud_copy_workspace_unavailable","The Session workspace is not on this computer.");if(!u.startsWith(`${e}${Mu}`))throw new r("cloud_copy_workspace_invalid","The Cloud copy workspace is outside this worker's root.");return u}async function ds(e){e.signal.throwIfAborted();let a=e.source;if(a.kind==="workspace"){let u=An(e.runtimeRoot);if(L(u)||L(On(u,a.path)))throw new r("protected_path","Credential and secret paths are unavailable to local tasks.");return mt({direction:"export",root:u,path:a.path,payload:{url:e.url},signal:e.signal,fetchImpl:e.fetchImpl})}let l=ku(On(Du(),`reason-cloud-copy-${process.pid}-`));try{Lu(l,448);let u=cs(l);await mt({direction:"import",root:u,path:"source",payload:{url:a.download_url,size_bytes:a.size_bytes,sha256:a.sha256},signal:e.signal,fetchImpl:e.fetchImpl});let p=await mt({direction:"export",root:u,path:"source",payload:{url:e.url},signal:e.signal,fetchImpl:e.fetchImpl});if(p.size_bytes!==a.size_bytes||p.sha256!==a.sha256)throw new r("transfer_source_changed","The verified attachment changed before export.");return p}finally{Tu(l,{recursive:!0,force:!0})}}import{constants as ke}from"fs";import{closeSync as Hl,existsSync as Ue,fstatSync as jl,ftruncateSync as mm,lstatSync as Vo,mkdirSync as fm,mkdtempSync as hm,openSync as ql,readSync as gm,realpathSync as Ne,rmSync as _m,statSync as Jt,writeSync as ym}from"fs";import{homedir as Yt,platform as G,tmpdir as bm}from"os";import{dirname as Kt,isAbsolute as wm,join as Wl,relative as zo,resolve as Sm,sep as vm}from"path";import{spawn as Rm}from"child_process";import{createHash as Hu,randomBytes as ju}from"crypto";var Ln=30000,$u=1800000,Bu=5000,wr=30000,Fu=jn+15000,ps=/^\/app\/local-runtime\/operations\/[0-9a-fA-F-]{36}\/heartbeat$/,Uu=[/^\/app\/local-runtime\/operations\/claim$/,ps];class kn{options;current=null;connecting=null;retryAt=0;failures=0;nextId=0;closed=!1;reconnectTimer=null;constructor(e){this.options=e}now(){return(this.options.now??Date.now)()}jitter(e){return Math.floor((this.options.random??Math.random)()*e)}async request(e,a,l){l?.throwIfAborted();let u=this.current;if(!u)return this.connect(),null;if(u.pending.size>=u.maxInFlight)return null;let p=String(++this.nextId),m=new Promise((b)=>u.pending.set(p,{path:e,resolve:b}));if(!this.send(u,{t:"req",id:p,path:e,body:a}))return u.pending.delete(p),null;let f;if(Uu.some((b)=>b.test(e)))f=setTimeout(()=>{if(u.pending.has(p))this.drop(u)},Fu);else{let b=()=>{if(!u.pending.has(p))return;let y=this.now()-u.lastFrameAt;if(y>=wr)this.drop(u);else f=setTimeout(b,wr-y)};f=setTimeout(b,wr)}if(m.finally(()=>clearTimeout(f)),!l)return await m;let g=new Promise((b,y)=>{let h=()=>{if(u.pending.delete(p),clearTimeout(f),this.send(u,{t:"abort",id:p}),this.now()-u.lastFrameAt>wr)this.drop(u);y(l.reason)};if(l.aborted)h();else l.addEventListener("abort",h,{once:!0}),m.finally(()=>l.removeEventListener("abort",h))});return await Promise.race([m,g])}cadence(){return this.current?.cadence??null}close(){if(this.closed=!0,this.reconnectTimer)clearTimeout(this.reconnectTimer);for(let e of[this.current,this.connecting])if(e)this.drop(e)}send(e,a){try{return e.socket.send(JSON.stringify(a)),!0}catch{return this.drop(e),!1}}drop(e){if(e.dropped)return;e.dropped=!0,this.settle(e);try{e.socket.close()}catch{}}settle(e){for(let a of e.pending.values())a.resolve(null);if(e.pending.clear(),this.current===e)this.current=null,this.retryAt=Math.max(this.retryAt,this.now()+this.jitter(Bu));if(this.connecting===e){this.connecting=null,this.failures+=1;let a=Math.min($u,Ln*2**Math.min(this.failures-1,10));this.retryAt=Math.max(this.retryAt,this.now()+a/2+this.jitter(a/2))}}connect(){if(this.closed||this.connecting||this.now()<this.retryAt)return;let e=this.options.WebSocket??globalThis.WebSocket;if(!e){this.retryAt=Number.POSITIVE_INFINITY;return}let a=new URL(At,this.options.apiOrigin);a.protocol=a.protocol==="https:"?"wss:":"ws:",a.searchParams.set("device_id",this.options.deviceId);let l;try{l=new e(a.toString())}catch{this.failures+=1,this.retryAt=this.now()+Ln;return}let u={socket:l,pending:new Map,maxInFlight:0,cadence:null,lastFrameAt:this.now(),dropped:!1};this.connecting=u,l.onmessage=(p)=>this.receive(u,p.data),l.onclose=()=>this.settle(u),l.onerror=()=>this.settle(u)}receive(e,a){if(typeof a!=="string")return;let l;try{l=JSON.parse(a)}catch{return}if(e.lastFrameAt=this.now(),l.t==="res"){let u=e.pending.get(l.id);e.pending.delete(l.id),u?.resolve({status:l.status,body:l.body,retryAfter:l.retry_after??null});return}if(l.t==="challenge"&&this.connecting===e){let u;try{u=this.options.signHello(l.challenge)}catch{this.drop(e);return}this.send(e,{t:"hello",...u});return}if(l.t==="ready"&&this.connecting===e){this.connecting=null,this.failures=0,e.maxInFlight=Math.max(1,Math.min(l.max_in_flight,1000)),e.cadence=l.cadence??null;let u=this.current;if(this.current=e,u){for(let[p,m]of u.pending){if(!ps.test(m.path))continue;u.pending.delete(p),this.send(u,{t:"abort",id:p}),m.resolve(null)}if(u.pending.size===0)this.drop(u)}return}if(l.t==="fallback"){this.retryAt=this.now()+Math.max(Ln,Math.min(l.retry_after_ms,86400000)),this.drop(e);return}if(l.t==="reconnect"&&this.current===e&&!this.reconnectTimer)this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.retryAt=0,this.connect()},Math.max(0,Math.min(l.after_ms,60000)))}}var Mn=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.run.v1","process.full.v1","preview.serve.v1","pty.start","git.run","process.list","ports.list","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.custom.v1","display.stream.v1","automation.call.v1","simulator.call.v1","simulator.stream.v1","tunnel.open","tunnel.close","workspace.setup.v1"];function Da(e,a={}){let l=qu(e),u=a.rootPathsSupported===!0?ir(e.root_paths):void 0;return{supported_operations:[...e.supported_operations],...a.accountRootMetadataSupported===!0&&typeof e.account_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test(e.account_root_fingerprint)?{account_root_fingerprint:e.account_root_fingerprint}:{},...a.workspaceRootMetadataSupported===!0&&typeof e.workspace_root_fingerprint==="string"&&/^[a-f0-9]{64}$/.test(e.workspace_root_fingerprint)?{workspace_root_fingerprint:e.workspace_root_fingerprint}:{},...a.accountRootPathSupported===!0&&typeof e.account_root_path==="string"&&e.account_root_path.startsWith("/")&&e.account_root_path.length<=4096?{account_root_path:e.account_root_path}:{},...a.homeContainedRootsSupported===!0&&Array.isArray(e.home_contained_root_fingerprints)&&e.home_contained_root_fingerprints.length<=32&&e.home_contained_root_fingerprints.every((p)=>/^[a-f0-9]{64}$/.test(p))?{home_contained_root_fingerprints:[...e.home_contained_root_fingerprints]}:{},...u?{root_paths:u}:{},...Object.keys(l).length?{operation_constraints:l}:{},...e.hands_worker_artifact_sha256&&e.hands_worker_entrypoint?{hands_worker_artifact_sha256:e.hands_worker_artifact_sha256,hands_worker_entrypoint:e.hands_worker_entrypoint}:{},...e.hands_slots!==void 0?{hands_slots:e.hands_slots}:{}}}function qu(e){let a=(u)=>u===null||typeof u==="boolean"||typeof u==="number"&&Number.isFinite(u)||typeof u==="string"&&u.length<=512,l={};for(let u of e.supported_operations){let p=e.operation_constraints?.[u];if(!p||typeof p!=="object"||Array.isArray(p))continue;if(!("ready"in p)||typeof p.ready!=="boolean")continue;let m={};for(let[f,g]of Object.entries(p).slice(0,32)){if(!f.length||f.length>64||["__proto__","constructor","prototype"].includes(f))continue;if(a(g)||Array.isArray(g)&&g.length<=64&&g.every(a))m[f]=g}if(Object.keys(m).length)l[u]=m}return l}class k extends Error{status;code;retryAfter;constructor(e,a,l,u=null){super(l);this.status=e;this.code=a;this.retryAfter=u;this.name="LocalRuntimeHttpError"}}class Sr extends Error{timeoutMs;constructor(e){super(`Reason Device request did not answer within ${e}ms.`);this.timeoutMs=e;this.name="LocalRuntimeRequestTimeoutError"}}function or(e){return e===408||e===429||e===500||e===502||e===503||e===504}function sr(e){if(e instanceof k)return!1;if(e instanceof Sr)return!0;if(!(e instanceof Error))return!1;if(e.name==="AbortError")return!1;if(e instanceof TypeError&&e.message.toLowerCase().includes("fetch failed"))return!0;for(let a of[e,e.cause])if(a&&typeof a==="object"&&"code"in a){let l=String(a.code);if(["ECONNRESET","ECONNREFUSED","ETIMEDOUT","EHOSTUNREACH","ENOTFOUND","EAI_AGAIN","ConnectionClosed","ConnectionRefused","UND_ERR_SOCKET","UND_ERR_CONNECT_TIMEOUT"].includes(l))return!0}return!1}function Wu(e,a,l=500){if(a instanceof k&&a.retryAfter){let m=parseFloat(a.retryAfter);if(Number.isFinite(m)&&m>0)return Math.min(m*1000,1e4)}let u=l*2**e,p=Math.floor(Math.random()*200);return Math.min(u+p,5000)}async function Vu(e,a){if(a?.aborted)throw a.reason??new DOMException("The operation was aborted.","AbortError");await new Promise((l,u)=>{let p=()=>{clearTimeout(m),u(a?.reason??new DOMException("The operation was aborted.","AbortError"))},m=setTimeout(()=>{a?.removeEventListener("abort",p),l()},e);a?.addEventListener("abort",p,{once:!0})})}function ee(e){return e instanceof k&&e.status===401&&(e.code==="device_revoked"||e.code==="invalid_device_credential")}function ms(e){return Buffer.byteLength(JSON.stringify(e)??"null","utf8")}function fs(e){return Hu("sha256").update(e??"").digest("hex")}function zu(e){return Mr({method:e.method,pathAndQuery:e.route,timestamp:e.timestamp,nonce:e.nonce,challenge:e.challenge,bodySha256:e.bodySha256})}function hs(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}var Gu=20000,Yu=1e4,gs=[2000,4000],Ku=30000,Xu=15000;function _s(e){return e?{keepalive:!1}:{}}class Nn extends Error{constructor(e){super(`Reason Device proof challenge did not answer within ${e}ms.`)}}class ar{fetchImpl;proofStore;proofOptions;apiOrigin;spareChallenge=null;sessions=new Map;sessionsClosed=!1;constructor(e,a=fetch,l,u={}){this.fetchImpl=a;this.proofStore=l;this.proofOptions=u;let p=new URL(e);if(p.protocol!=="https:"&&p.hostname!=="127.0.0.1"&&p.hostname!=="localhost"&&p.hostname!=="[::1]"&&p.hostname!=="::1")throw Error("Reason Device API must use HTTPS, except for localhost development.");this.apiOrigin=p.origin}async parseResponse(e){if(e.status===204)return null;let a=await e.json().catch(()=>({}));if(!e.ok){let{code:l,message:u}=Zs(a,e.status),p=e.headers?.get?.("retry-after")??null;throw new k(e.status,l,u,p)}return a}async challenge(e,a,l={fresh:!1}){let u=this.proofOptions.challengeAttemptTimeoutsMs??gs;for(let p of u)try{return await this.challengeAttempt(e,a,p,l.fresh)}catch(m){if(a?.aborted||!(m instanceof Nn))throw m;l.fresh=!0}return await this.challengeAttempt(e,a,null,l.fresh)}async challengeAttempt(e,a,l,u=!1){let p=JSON.stringify({device_id:e}),m=l===null?null:new AbortController,f=m&&l!==null?setTimeout(()=>m.abort(new Nn(l)),l):null;try{let g=await this.fetchImpl(`${this.apiOrigin}${M.authChallenge.path}`,{method:"POST",redirect:"error",headers:{accept:"application/json","content-type":"application/json"},body:p,..._s(u),signal:m?a?AbortSignal.any([a,m.signal]):m.signal:a});return Gi(await this.parseResponse(g))}catch(g){if(!a?.aborted&&m?.signal.aborted)throw m.signal.reason;throw g}finally{if(f)clearTimeout(f)}}async takeSpareChallenge(e){let a=this.spareChallenge;if(this.spareChallenge=null,!a||a.deviceId!==e)return null;let l=await a.challenge,u=(this.proofOptions.now??Date.now)();return l&&Date.parse(l.expires_at)-u>=Gu?l:null}refillSpareChallenge(e){let a=this.challengeAttempt(e,void 0,gs[0]??2000).catch(()=>null);this.spareChallenge={deviceId:e,challenge:a}}async proofHeaders(e,a,l,u,p=!1,m,f){let g=m&&Date.parse(m.expires_at)-(this.proofOptions.now??Date.now)()>=Yu?m:null,b=!g&&p?await this.takeSpareChallenge(l.deviceId):null,y=g??b??await this.challenge(l.deviceId,u,f);if(p)this.refillSpareChallenge(l.deviceId);let h=fs(a),w=this.signProof("POST",e,y.challenge,h);return{"x-device-id":l.deviceId,"x-device-timestamp":w.timestamp,"x-device-nonce":w.nonce,"x-device-challenge":y.challenge,"x-device-body-sha256":h,"x-device-signature":w.signature}}signProof(e,a,l,u){let p=String(Math.trunc((this.proofOptions.now??Date.now)())),m=(this.proofOptions.nonce??(()=>ju(24)))();if(m.byteLength<16||m.byteLength>32)throw Error("Invalid Reason Device proof nonce.");let f=Buffer.from(m).toString("base64url"),g=this.proofStore.sign(zu({method:e,route:a,timestamp:p,nonce:f,challenge:l,bodySha256:u}));if(!/^[A-Za-z0-9_-]{8,128}$/.test(g))throw Error("Reason Device proof boundary returned an invalid signature.");return{timestamp:p,nonce:f,signature:g}}sessionFor(e,a){if(!this.proofOptions.deviceSession||this.sessionsClosed||!a||!ks(e.path))return null;let l=this.sessions.get(a.deviceId);if(!l)l=new kn({apiOrigin:this.apiOrigin,deviceId:a.deviceId,signHello:(u)=>this.signProof("GET",At,u,fs("")),...this.proofOptions.webSocket?{WebSocket:this.proofOptions.webSocket}:{},...this.proofOptions.now?{now:this.proofOptions.now}:{}}),this.sessions.set(a.deviceId,l);return l}sessionCadence(e){let a=this.proofOptions.deviceSession&&!this.sessionsClosed?this.sessions.get(e.deviceId)?.cadence()??null:null;return a?{presenceIntervalMs:a.presence_interval_ms,claimWaitMs:a.claim_wait_ms}:null}close(){this.sessionsClosed=!0;for(let e of this.sessions.values())e.close();this.sessions.clear()}async request(e,a){if(a.body!==void 0&&ms(a.body)>Xe)throw Error("Reason Device request exceeds the 256 KB protocol limit.");if(a.authorization!==void 0&&a.device!==void 0)throw Error("Reason Device request cannot combine bearer and proof authentication.");let l=a.authorization!==void 0,u=a.device!==void 0;if(!(e.auth==="none"?!l&&!u:e.auth==="registration_bearer"?l&&!u:l!==u))throw Error(`Reason Device request used invalid authentication for ${e.path}.`);let m=a.body===void 0?void 0:JSON.stringify(a.body),f=this.proofOptions.maxAttempts??4,g=this.proofOptions.sleep??Vu,b=this.sessionFor(e,a.device),y=Math.max(Ku,(a.holdMs??0)+Xu),h={fresh:!1},w;for(let S=0;S<f;S+=1)try{let v=await b?.request(e.path,a.sessionBody===void 0?m??"":JSON.stringify(a.sessionBody),a.signal)??null;if(v)return await this.parseResponse(new Response(v.status===204?null:v.body,{status:v.status,headers:v.retryAfter===null?{}:{"retry-after":v.retryAfter}}));let R=new AbortController,I=setTimeout(()=>R.abort(new Sr(y)),y),x=a.signal?AbortSignal.any([a.signal,R.signal]):R.signal;try{let E=a.device===void 0?{}:await this.proofHeaders(e.path,m,a.device,x,a.useSpareChallenge===!0&&S===0,S===0?a.issuedChallenge:void 0,h),O=await this.fetchImpl(`${this.apiOrigin}${e.path}`,{method:"POST",redirect:"error",headers:{...a.authorization===void 0?{}:{authorization:`Bearer ${a.authorization}`},...E,accept:"application/json",...a.body===void 0?{}:{"content-type":"application/json"}},body:m,..._s(h.fresh),signal:x});return await this.parseResponse(O)}catch(E){if(!a.signal?.aborted&&R.signal.aborted)throw R.signal.reason;throw E}finally{clearTimeout(I)}}catch(v){if(w=v,v instanceof Sr)h.fresh=!0;if(a.signal?.aborted)throw v;let R=a.device!==void 0&&v instanceof k&&v.status===401&&["invalid_device_proof","device_proof_replayed"].includes(v.code),I=v instanceof k&&or(v.status),x=sr(v),E=a.transientRetryOwner!=="caller"&&(I||x);if((R||E)&&S+1<f){let O=R?0:Wu(S,v,this.proofOptions.retryBaseDelayMs??500);if(O>0)await g(O,a.signal);continue}throw v}throw w??Error("Reason Device request failed.")}async register(e,a,l){let u=await this.request(M.register,{authorization:e,body:a,signal:l});return Qs(u)}async enroll(e,a,l,u){let p=await this.request(M.enroll,{body:{...l,enrollment_ticket:e,code_verifier:a},signal:u});return ea(p)}async heartbeat(e,a,l,u){let p=await this.request(M.heartbeat,{device:e,body:a,signal:l,...u?{issuedChallenge:u}:{}});return ta(p)}async syncRoots(e,a,l){let u=await this.request(M.rootsSync,{device:e,body:{roots:a},signal:l});return ra(u)}async identity(e,a){let l=await this.request(M.identity,{device:e,signal:a});return na(l)}async disconnect(e,a,l,u=[]){let p=await this.request(M.disconnect,{device:e,body:l?{successor_device_id:l,...u.length?{successor_roots:u}:{}}:{},signal:a});return ia(p)}async deviceLifecycle(e,a,l){let u=await this.request(M.lifecycle,{device:e,body:a,signal:l});sa(u)}async localSubscription(e,a,l){return oa(await this.request(M.localSubscription,{device:e,body:a,signal:l}))}async ownerWorkspaces(e,a){let u=(await this.request(M.ownerWorkspaces,{device:e,body:{},signal:a}))?.organizations;if(!Array.isArray(u))throw Error("Reason returned an invalid workspace list.");return u.flatMap((p)=>{let m=p;return typeof m?.id==="string"?[{id:m.id,...typeof m.name==="string"&&m.name.trim()?{name:m.name.trim()}:{},blocked:m.blocked===!0}]:[]})}async ownerWorkspaceEnrollment(e,a,l){return this.request(M.ownerWorkspaceEnrollment,{device:e,body:a,signal:l})}async liveSessionWorktrees(e,a,l){let u=await this.request(M.sessionWorktrees,{device:e,body:{worktree_ids:[...a]},signal:l}).catch((p)=>{if(p instanceof k&&p.status===404)return null;throw p});if(u===null)return null;if(!hs(u)||!Array.isArray(u.live)||!u.live.every((p)=>typeof p==="string"&&a.includes(p)))throw Error("Reason returned an invalid Session worktree answer.");return u.live}async claimOperation(e,a={}){let l=Math.max(a.waitMs??25000,0),u=(f)=>({wait_ms:Math.min(l,f),...a.instanceGeneration===void 0?{}:{instance_generation:a.instanceGeneration}}),p=this.sessionCadence(e)?.claimWaitMs,m=await this.request(M.operationClaim,{device:e,body:u(30000),holdMs:Math.min(l,30000),...p===void 0?{}:{sessionBody:u(Math.min(p,jn))},signal:a.signal});if(m===null)return null;return aa(m,Mn)}async operationHeartbeat(e,a,l={}){let u=(f)=>this.request(M.operationHeartbeat.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token,...l.controlAckSeq===void 0?{}:{control_ack_seq:l.controlAckSeq},...f?{client_retry_count:l.clientRetryCount}:{},...f&&l.waitMs!==void 0?{wait_ms:Math.min(Math.max(l.waitMs,0),30000)}:{}},signal:l.signal,transientRetryOwner:l.transientRetryOwner,...f&&l.waitMs!==void 0?{holdMs:Math.min(Math.max(l.waitMs,0),30000)}:{}}),p=(l.clientRetryCount??0)>0||l.waitMs!==void 0,m;try{m=await u(p)}catch(f){if(!p||!(f instanceof k)||f.status!==400||f.code!=="invalid_operation_heartbeat")throw f;m=await u(!1)}return ca(m)}async operationEvents(e,a,l){if(!Number.isInteger(l.eventSeqStart)||l.eventSeqStart<0||l.events.length<1||l.events.length>100||l.events.some((p)=>!/^[A-Za-z0-9._:-]{1,64}$/.test(p.kind)||!hs(p.payload)))throw Error("Invalid Reason Device operation event batch.");let u=await this.request(M.operationEvents.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token,event_seq_start:l.eventSeqStart,events:l.events},signal:l.signal,transientRetryOwner:l.transientRetryOwner,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return la(u)}async completeOperation(e,a,l,u){let p={attempt_id:a.attempt_id,attempt_token:a.attempt_token,status:l.status,...l.result===void 0?{}:{result:l.result},...l.error_code?{error_code:l.error_code}:{}};if(ms(p)>Xe)throw Error("Reason Device operation result exceeds the 256 KB protocol limit.");let m=await this.request(M.operationComplete.forOperation(a.operation_id),{device:e,body:p,signal:u});return da(m)}async operationCustomEndpointCredential(e,a,l){let{CustomEndpointDeviceCredentialSchema:u}=await import("./custom-endpoint-device-5047vdn3.js");return u.parse(await this.request(M.operationCustomEndpointCredential.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token},signal:l}))}async operationEnvironment(e,a,l,u){let p=await this.request(M.operationEnvironment.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token,snapshot_id:l},signal:u,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}});return ua(p)}async acknowledgeOperationEnvironment(e,a,l,u){await this.request(M.operationEnvironmentAck.forOperation(a.operation_id),{device:e,body:{attempt_id:a.attempt_id,attempt_token:a.attempt_token,...l},signal:u,...this.proofOptions.prefetchEventChallenges===!0?{useSpareChallenge:!0}:{}})}}var Ju=new Set(["process.run.v1","process.full.v1","computer.use","browser.use"]),Ft=new Set(["jobs.control","environment.install","tunnel.open","tunnel.close","display.stream.v1","automation.call.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"]);function Rr(e,a){if(Ju.has(e))return!1;if(Ft.has(e)&&!a.runtimeDirectory)return!1;if((e==="inference.custom.v1"||e==="preview.serve.v1"||e==="simulator.call.v1"||e==="simulator.stream.v1")&&(a.executionMode!=="unsandboxed"||!a.runtimeDirectory))return!1;if(a.executionMode!=="unsandboxed"&&(["exec.full","hands.connect","pty.start","browser.pr-proof.v1"].includes(e)||Ft.has(e)))return!1;return!0}import{accessSync as Zu,constants as Qu,existsSync as ed,statSync as td}from"fs";import{basename as rd,isAbsolute as nd}from"path";var Ut=["-lic"],ys="/bin/zsh",od=new Set(["zsh","bash"]),bs=20000,$n=60000,id=65536,sd=64,ad=8192,ld=new Set(["NODE_OPTIONS","PATH","ZDOTDIR","BASH_ENV","ENV"]),cd=["DYLD_","LD_"];function ud(e){let a=e.toUpperCase();return ld.has(a)||cd.some((l)=>a.startsWith(l))}function ws(e=process.env){return!0}function dd(e){if(!nd(e)||e.includes("\x00"))return!1;if(!od.has(rd(e)))return!1;try{if(!td(e).isFile())return!1;return Zu(e,Qu.X_OK),!0}catch{return!1}}function dt(e=process.env){if(process.platform==="win32")return Y()??ys;let a=e.SHELL?.trim();if(a&&dd(a))return a;return ys}function Bn(e=process.env){return ws(e)&&ed(dt(e))}function Hn(e=process.env){if(!ws(e))throw new r("full_control_disabled","Full-control execution is unavailable on this Reason Device.")}function qn(e){if(typeof e!=="string"||e.length===0||e.includes("\x00")||Buffer.byteLength(e,"utf8")>id)throw new r("invalid_payload","command is missing or too large.");return e}function Wn(e){if(e===void 0||e===null)return{forwarded:{},ignored:[]};if(typeof e!=="object"||Array.isArray(e))throw new r("invalid_payload","env must be an object of strings.");let a=Object.entries(e);if(a.length>sd)throw new r("invalid_payload","env has too many entries.");let l={},u=[];for(let[p,m]of a){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(p)||typeof m!=="string"||m.includes("\x00")||Buffer.byteLength(m,"utf8")>ad)throw new r("invalid_payload","env entry is invalid or too large.");if(ud(p)){u.push(p);continue}l[p]=m}return{forwarded:l,ignored:u}}async function Ss(e){let a=e.processEnv??process.env;if(Hn(a),e.signal.aborted)throw new r("cancelled","Operation was cancelled.");let l=qn(e.command),u=dt(a),{forwarded:p,ignored:m}=Wn(e.requestEnv),f=await e.spawn(u,[...Ut,l],{cwd:e.cwd,timeoutMs:e.timeoutMs,signal:e.signal,env:{...a,...p}});return{exit_code:f.exitCode,signal:f.signal,stdout:f.stdout,stderr:f.stderr,timed_out:f.timedOut,truncated:f.truncated,shell:u,shell_flags:[...Ut],login:!0,interactive:!0,sandbox:"none",ignored_env:m}}function Es(e=process.env){return{transport:"shell",shell:`${dt(e)} ${Ut.join(" ")}`,login_shell:!0,interactive_shell:!0,rc_files_loaded:!0,sandbox:"none",network:!0,environment:"inherited",privilege:"user",sudo:"argv_exact_nopasswd_only",activation:"explicit_device_grant",max_timeout_ms:$n}}import{readFile as pd,readdir as md,readlink as fd,realpath as hd}from"fs/promises";import{basename as gd,relative as _d,sep as yd}from"path";var nt="/proc",bd=250,Cs=500,wd=50,Sd=250,vd=1024,Ps=4096,Rd=1,xd=3,As=9,Ed="0A",Cd=/^socket:\[(\d+)\]$/,Vn={readDirectory:(e)=>md(e),readLink:(e)=>fd(e),readTextFile:(e)=>pd(e,"utf8"),realPath:(e)=>hd(e)};function ma(e,a){return a===e||a.startsWith(`${e}${yd}`)}function Pd(e,a){return _d(e,a)||"."}async function ga(e){let a;try{a=await e.readDirectory(nt)}catch{return[]}return a.filter((l)=>/^[0-9]+$/.test(l)).map((l)=>Number(l)).filter((l)=>Number.isSafeInteger(l)&&l>0).sort((l,u)=>l-u)}async function _a(e,a){try{let u=(await a.readTextFile(`${nt}/${e}/comm`)).slice(0,Ps).split(`
+`,1)[0]?.trim();if(u)return u}catch{}try{let u=(await a.readTextFile(`${nt}/${e}/cmdline`)).slice(0,Ps).split("\x00",1)[0]?.trim();return u?gd(u):null}catch{return null}}async function ya(e,a=Vn){let l;try{l=await a.readLink(`${nt}/${e}/cwd`)}catch{return null}if(!l)return null;try{return await a.realPath(l)}catch{return null}}async function ba(e,a=Vn){let l=[];for(let u of await ga(a)){if(l.length>=bd)break;let p=await ya(u,a);if(!p||!ma(e,p))continue;l.push({pid:u,command:await _a(u,a),cwd:Pd(e,p)})}return{processes:l}}function Ys(e){let a=[];for(let l=0;l<8;l+=2)a.unshift(Number.parseInt(e.slice(l,l+2),16));return a}function Od(e){let a=[];for(let b=0;b<16;b+=2)a.push(e[b]<<8|e[b+1]);if(a.slice(0,5).every((b)=>b===0)&&a[5]===65535)return`::ffff:${e.slice(12).join(".")}`;let l=-1,u=0,p=-1;for(let b=0;b<=a.length;b+=1){if(b<a.length&&a[b]===0){if(p<0)p=b;continue}if(p>=0){let y=b-p;if(y>u)l=p,u=y;p=-1}}let m=a.map((b)=>b.toString(16));if(u<2)return m.join(":");let f=m.slice(0,l).join(":"),g=m.slice(l+u).join(":");return`${f}::${g}`}function Id(e,a){if(/^[0-9A-Fa-f]{8}$/.test(e)){let l=Ys(e);if(l.every((u)=>u===0))return`*:${a}`;return`${l.join(".")}:${a}`}if(/^[0-9A-Fa-f]{32}$/.test(e)){let l=[];for(let u=0;u<4;u+=1)l.push(...Ys(e.slice(u*8,u*8+8)));if(l.every((u)=>u===0))return`*:${a}`;return`[${Od(l)}]:${a}`}return null}function Ad(e,a){let l=[];for(let u of e.split(`
+`).slice(1)){if(l.length>=a)break;let p=u.trim().split(/\s+/);if(p.length<=As)continue;if(p[xd]?.toUpperCase()!==Ed)continue;let m=p[Rd]??"",f=m.lastIndexOf(":");if(f<0)continue;let g=Number.parseInt(m.slice(f+1),16);if(!Number.isInteger(g)||g<=0||g>65535)continue;let b=Id(m.slice(0,f),g),y=p[As];if(!b||!y||!/^[0-9]+$/.test(y))continue;l.push({inode:y,port:g,address:b})}return l}async function Ld(e){let a=[];for(let l of["tcp","tcp6"]){if(a.length>=Cs)break;let u;try{u=await e.readTextFile(`${nt}/net/${l}`)}catch{continue}a.push(...Ad(u,Cs-a.length))}return a}async function kd(e,a){let l=new Map;if(e.size===0)return l;for(let u of await ga(a)){if(l.size>=e.size)break;let p;try{p=await a.readDirectory(`${nt}/${u}/fd`)}catch{continue}for(let m of p.slice(0,vd)){let f;try{f=await a.readLink(`${nt}/${u}/fd/${m}`)}catch{continue}let g=f.match(Cd)?.[1];if(!g||!e.has(g)||l.has(g))continue;l.set(g,u)}}return l}async function wa(e,a=Vn){let l=await Ld(a),u=await kd(new Set(l.map((h)=>h.inode)),a),p=[];for(let h of l){let w=u.get(h.inode);if(w===void 0)continue;p.push({pid:w,port:h.port,address:h.address})}p.sort((h,w)=>h.pid-w.pid||h.port-w.port||(h.address<w.address?-1:h.address>w.address?1:0));let m=[...new Set(p.map((h)=>h.pid))].slice(0,wd),f=await Promise.all(m.map(async(h)=>[h,await ya(h,a)])),g=new Map(f),b=p.filter((h)=>{let w=g.get(h.pid);return Boolean(w&&ma(e,w))}),y=new Map(await Promise.all([...new Set(b.map((h)=>h.pid))].map(async(h)=>[h,await _a(h,a)])));return{ports:b.slice(0,Sd).map((h)=>({pid:h.pid,command:y.get(h.pid)??null,address:h.address}))}}import{posix as Gn}from"path";var xr=200,Td=250,Dd=250;async function Er(e,a){let l=await e(a);if(l.timedOut||l.truncated||l.exitCode!==0&&l.exitCode!==1)throw new r("process_inspection_failed","Reading this Mac's processes did not complete.");let u=[],p=null;for(let m of l.stdout.split(/\r?\n/))if(m.startsWith("p")){let f=Number(m.slice(1));if(p=Number.isInteger(f)&&f>0?{pid:f,command:null,names:[]}:null,p)u.push(p)}else if(p&&m.startsWith("c"))p.command=m.slice(1)||null;else if(p&&m.startsWith("n"))p.names.push(m.slice(1));return u}function zn(e,a){return a===e||a.startsWith(e==="/"?e:`${e}/`)}var Sa="/System/Volumes/Data",Nd=["/tmp","/var","/etc"];function Qn(e){let a=Gn.normalize(e);if(a.startsWith(`${Sa}/`))a=a.slice(Sa.length);return Nd.find((u)=>a===u||a.startsWith(`${u}/`))?`/private${a}`:a}function va(e){return e&&Gn.isAbsolute(e)?Qn(e):null}async function Ra(e,a){let l=new Map;for(let u=0;u<a.length;u+=xr){let p=a.slice(u,u+xr).join(",");for(let m of await Er(e,["-a","-p",p,"-d","cwd","-Fpcn"]))l.set(m.pid,{command:m.command,cwd:va(m.names[0])})}return l}async function xa(e,a){let l=Qn(e),u=(await Er(a,["-d","cwd","-Fpn"])).filter((m)=>{let f=va(m.names[0]);return f!==null&&zn(l,f)}).map((m)=>m.pid).slice(0,Td),p=await Ra(a,u);return{processes:u.flatMap((m)=>{let f=p.get(m);return f?.cwd&&zn(l,f.cwd)?[{pid:m,command:f.command,cwd:Gn.relative(l,f.cwd)||"."}]:[]})}}async function Ea(e,a){let l=Qn(e),u=["-nP","-iTCP","-sTCP:LISTEN","-Fpcn"],p=await Er(a,u),m=await Ra(a,p.map((y)=>y.pid)),f=p.map((y)=>y.pid).filter((y)=>{let h=m.get(y)?.cwd;return Boolean(h&&zn(l,h))});if(f.length===0)return{ports:[]};let g=new Set(p.flatMap((y)=>y.names.map((h)=>`${y.pid} ${h}`))),b=[];for(let y=0;y<f.length;y+=xr){let h=f.slice(y,y+xr).join(",");for(let w of await Er(a,["-a","-p",h,...u]))for(let S of w.names)if(g.has(`${w.pid} ${S}`))b.push({pid:w.pid,command:w.command,address:S})}return{ports:b.slice(0,Dd)}}import{join as Gd}from"path";import{spawn as Hd}from"child_process";import{randomUUID as jd}from"crypto";import{chmodSync as Oa,lstatSync as Ia,mkdirSync as qd,readdirSync as Wd,statSync as Vd,unlinkSync as zd}from"fs";import{join as to}from"path";var eo={targets:24,assets:128,sourceFiles:2000,sourceBytes:20000000,outputBytes:20000000};var Cr=(e,a=0,l=1e6)=>typeof e==="number"&&Number.isFinite(e)&&e>=a&&e<=l;var ot=()=>{throw Error("proof_visual_contract_invalid")};class Ca extends Error{constructor(){super("proof_visual_contract_invalid")}}function ho(e){if(!q(e)||e.version!==1)return ot();if(typeof e.route!=="string"||!e.route.startsWith("/")||e.route.length>512||/[\x00-\x20\x7f\\?#%]/.test(e.route)||e.route.startsWith("//"))throw new Ca;if(!q(e.viewport)||!Cr(e.viewport.width,1,4096)||!Cr(e.viewport.height,1,4096)||!Array.isArray(e.targets)||e.targets.length<1||e.targets.length>eo.targets||Object.keys(e).some((u)=>!["version","route","viewport","targets","additionalViewports"].includes(u)))return ot();let a=e.targets.map((u)=>{if(!q(u)||typeof u.id!=="string"||!/^[a-zA-Z0-9_-]{1,64}$/.test(u.id)||typeof u.selector!=="string"||!u.selector.trim()||u.selector.length>256||/[\x00-\x1f\x7f]/.test(u.selector)||Object.keys(u).some((p)=>!["id","selector"].includes(p)))return ot();return{id:u.id,selector:u.selector}});if(new Set(a.map((u)=>u.id)).size!==a.length)return ot();let l;if(e.additionalViewports!==void 0){if(!Array.isArray(e.additionalViewports)||e.additionalViewports.length<1||e.additionalViewports.length>3)return ot();l=e.additionalViewports.map((p)=>{if(!q(p)||!Cr(p.width,1,4096)||!Number.isInteger(p.width)||!Cr(p.height,1,4096)||!Number.isInteger(p.height)||Object.keys(p).some((m)=>!["width","height"].includes(m)))return ot();return{width:p.width,height:p.height}});let u=[e.viewport,...l].map((p)=>`${p.width}x${p.height}`);if(new Set(u).size!==u.length)return ot()}return{version:1,route:e.route,viewport:{width:e.viewport.width,height:e.viewport.height},targets:a,...l?{additionalViewports:l}:{}}}var Bd=["organizationId","userId","sessionId","runId"],Fd=[...Bd,"prUrl","headSha","skillDigest","evidenceKind"],Hh=[...Fd,"contextId","preparedAt","captureId","startedAt","finishedAt","sha256","kind","visualPlan","visualObservation"];var Ud={"image/png":{kind:"image",directory:"/tmp/ara-public-screenshots",extension:"png",maxBytes:8388608},"video/webm":{kind:"video",directory:"/tmp/ara-public-recordings",extension:"webm",maxBytes:10551296}};function Pa(e){return Ud[e].directory}var Aa=10485760;function La(e={}){let a=e.directory??Pa("video/webm"),l=null;return{async start(u){if(l)throw Error("cloud_browser_recording_active");let p=u?.seconds;if(!Number.isInteger(p)||Number(p)<1||Number(p)>15||!u||Object.keys(u).some((x)=>x!=="seconds"))throw Error("cloud_browser_recording_seconds_1_to_15_required");qd(a,{recursive:!0,mode:457});let m=Ia(a);if(!m.isDirectory()||m.isSymbolicLink()||m.uid!==process.getuid?.())throw Error("cloud_browser_recording_directory_invalid");Oa(a,457);let f=Wd(a).filter((x)=>/^[a-f0-9-]{36}\.webm$/.test(x)).map((x)=>({name:x,time:Vd(to(a,x)).mtimeMs})).sort((x,E)=>E.time-x.time);for(let x of f.slice(9))zd(to(a,x.name));let g=to(a,`${jd()}.webm`),b=["-f","x11grab","-framerate","12","-i",e.display??":99"],y=(e.spawn??Hd)(e.ffmpeg??"ffmpeg",["-nostdin","-hide_banner","-loglevel","error","-y",...b,"-t",String(p),"-vf","scale=1280:-2","-c:v","libvpx","-deadline","realtime","-b:v","700k","-an","-fs",String(Aa),"-progress","pipe:1",g],{stdio:["ignore","pipe","ignore"],...e.env?{env:e.env}:{}}),h,w,S=!1,v=new Promise((x,E)=>{h=x,w=E});y.stdout.on("data",(x)=>{if(/frame=\s*[1-9]/.test(String(x)))S=!0,h()});let R=new Promise((x,E)=>{y.once("error",()=>{w(Error("cloud_browser_recording_unavailable")),E(Error("cloud_browser_recording_unavailable"))}),y.once("exit",(O)=>{try{if(O!==0&&O!==255)throw Error();let D=Ia(g);if(!S||!D.isFile()||D.isSymbolicLink()||D.uid!==process.getuid?.()||D.size<128||D.size>Aa+65536)throw Error();Oa(g,420),h(),x({path:g,mimeType:"video/webm"})}catch{w(Error("cloud_browser_recording_failed")),E(Error("cloud_browser_recording_failed"))}})});R.catch(()=>{});let I=setTimeout(()=>y.kill("SIGKILL"),(Number(p)+5)*1000);R.finally(()=>clearTimeout(I)).catch(()=>{}),l={done:R,stop:()=>(y.kill("SIGINT"),R)};try{await v}catch(x){throw l=null,x}return{recording:!0,seconds:Number(p)}},async stop(){if(!l)throw Error("cloud_browser_recording_not_started");let u=l;return l=null,u.stop()},async close(){if(l)await this.stop().catch(()=>{})}}}function ka(e,a={}){if(e.executionMode!=="unsandboxed"||!e.runtimeDirectory||(a.platform??process.platform)!=="linux")return null;let l=(a.components??A)(),u=l?.features.display?l.ffmpeg:null;if(!u)return null;let p=Gd(e.runtimeDirectory,"recordings"),m=null;return{async start(f){let g=await(a.desktop??jt)();return m??=La({directory:p,display:g.display,ffmpeg:u,env:{HOME:s(),PATH:"/usr/local/bin:/usr/bin:/bin",XAUTHORITY:g.xauthority},...a.spawn?{spawn:a.spawn}:{}}),m.start(f)},async stop(){if(!m)throw Error("cloud_browser_recording_not_started");return m.stop()},async close(){await m?.close()}}}import{spawn as To}from"child_process";import{createHash as mp,randomUUID as fp}from"crypto";import{existsSync as Ae,mkdirSync as Po,mkdtempSync as Do,readdirSync as Wr,readFileSync as No,renameSync as hp,rmSync as Wt,statSync as Dr,writeFileSync as gp}from"fs";import{homedir as $o,tmpdir as fl}from"os";import{basename as hl,dirname as Oo,join as K,relative as gl,resolve as Io,sep as _l}from"path";var _e=t().min(1).max(200),Ie=o().finite().min(0).max(1e4),Pr=t().min(1).max(4096).refine((e)=>!e.includes("\x00")),Ta=t().regex(/^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/),no=n({id:t().min(1).max(500).optional(),label:t().min(1).max(500).optional()}).strict(),oo=["home","lock","side_button","siri","apple_pay"],Yd=c(["tree","screenshot","both","none"]),Kd=n({...no.shape,gone:_().optional()}).strict().refine((e)=>Boolean(e.id||e.label),"wait_for needs an id or label"),ze={observe:Yd.optional(),wait_for:Kd.optional(),timeout:o().min(0).max(20).optional()},ro=P("action",[n({action:i("tap"),x:Ie.optional(),y:Ie.optional(),...no.shape,duration:o().min(0).max(10).optional()}).strict().refine((e)=>e.x!==void 0&&e.y!==void 0||Boolean(e.id||e.label),"pass x and y, or an id or label"),n({action:i("swipe"),x:Ie,y:Ie,x2:Ie,y2:Ie,duration:o().min(0.05).max(5).optional()}).strict(),n({action:i("type"),text:t().min(1).max(4000)}).strict(),n({action:i("button"),name:c(oo)}).strict(),n({action:i("sleep"),seconds:o().min(0).max(10)}).strict()]),io=P("action",[n({action:i("devices")}).strict(),n({action:i("boot"),device:_e}).strict(),n({action:i("shutdown"),device:_e}).strict(),n({action:i("build"),path:Pr.optional(),scheme:t().min(1).max(200).optional(),configuration:t().min(1).max(100).optional(),device:_e.optional(),wait:_().optional()}).strict(),n({action:i("run"),path:Pr.optional(),scheme:t().min(1).max(200).optional(),configuration:t().min(1).max(100).optional(),device:_e.optional(),steps:d(Yc(()=>ro)).max(30).optional(),...ze}).strict(),n({action:i("build_status"),build_id:t().regex(/^build-[0-9a-z-]{4,64}$/),device:_e.optional(),wait:_().optional()}).strict(),n({action:i("launch"),device:_e.optional(),app_path:Pr.optional(),bundle_id:Ta.optional(),steps:d(Yc(()=>ro)).max(30).optional(),...ze}).strict().refine((e)=>Boolean(e.app_path)!==Boolean(e.bundle_id),"pass exactly one of app_path or bundle_id"),n({action:i("terminate"),device:_e.optional(),bundle_id:Ta}).strict(),n({action:i("logs"),device:_e.optional(),after:o().int().min(0).optional()}).strict(),n({action:i("screenshot"),device:_e.optional(),scale:we([i(1),i(2)]).optional(),save_path:Pr.optional()}).strict(),n({action:i("chrome"),device:_e.optional()}).strict(),n({action:i("inspect"),device:_e.optional()}).strict(),n({action:i("tap"),device:_e.optional(),x:Ie.optional(),y:Ie.optional(),...no.shape,duration:o().min(0).max(10).optional(),...ze}).strict().refine((e)=>e.x!==void 0&&e.y!==void 0||Boolean(e.id||e.label),"pass x and y, or an id or label"),n({action:i("swipe"),device:_e.optional(),x:Ie,y:Ie,x2:Ie,y2:Ie,duration:o().min(0.05).max(5).optional(),...ze}).strict(),n({action:i("type"),device:_e.optional(),text:t().min(1).max(4000),...ze}).strict(),n({action:i("button"),device:_e.optional(),name:c(oo),...ze}).strict(),n({action:i("open_url"),device:_e.optional(),url:t().min(1).max(4000),...ze}).strict(),n({action:i("steps"),device:_e.optional(),steps:d(ro).min(1).max(30),...ze}).strict(),n({action:i("appearance"),device:_e.optional(),mode:c(["light","dark"])}).strict()]),Na=n({udid:t(),name:t(),runtime:t(),state:c(["booted","shutdown","booting","shutting_down"]),kind:c(["iphone","ipad","other"])}).strict(),sg=n({text:t(),error:t().optional(),device:Na.optional(),devices:d(Na).optional(),image:n({mime:i("image/jpeg"),data:t(),width:o(),height:o()}).strict().optional(),build:n({id:t(),status:c(["running","succeeded","failed"]),app_path:t().optional(),bundle_id:t().optional(),errors:d(t()),log_tail:t(),elapsed_ms:o()}).strict().optional(),logs:n({lines:d(t()),next:o()}).strict().optional(),screen:t().optional(),chrome:n({identifier:t(),screen:n({width:o(),height:o()}).strict(),inset:n({top:o(),left:o(),bottom:o(),right:o()}).strict(),padding:n({top:o(),left:o(),bottom:o(),right:o()}).strict(),screen_mask:t().optional(),pieces:$e(c(["topLeft","top","topRight","right","bottomRight","bottom","bottomLeft","left"]),n({image:t(),width:o(),height:o()}).strict()),buttons:d(n({name:t(),image:t(),x:o(),y:o(),width:o(),height:o()}).strict())}).strict().optional()}).strict();var ag=n({device_id:V().optional(),root_id:V().optional()}),Ir={device_id:{type:"string",format:"uuid",description:"Reason machine id from devices.list; omit for the machine this Session runs on."},root_id:{type:"string",format:"uuid"},device:{type:"string",description:"Simulator UDID or exact name. Required for boot and shutdown; for other actions omit it for the booted one."},path:{type:"string",description:"build or run: a .xcodeproj, .xcworkspace, or a folder holding one (project.yml is generated with XcodeGen), absolute or relative to the Session's folder. Omit it when the folder holds one app project."},scheme:{type:"string"},configuration:{type:"string"},build_id:{type:"string",description:"build_status (required): the build_id a build or run returned."},app_path:{type:"string",description:"launch: the built .app from build_status (or pass bundle_id instead)."},bundle_id:{type:"string",description:"terminate (required); launch: an installed app's bundle id instead of app_path."},after:{type:"integer",minimum:0,description:"logs: only lines after this sequence number."},x:{type:"number",description:"tap (with y, unless id or label is given) or swipe (required): start point in device points."},y:{type:"number"},x2:{type:"number",description:"swipe (required, with y2): end point in device points."},y2:{type:"number"},id:{type:"string",description:"tap: accessibility identifier from inspect (instead of x and y)."},label:{type:"string",description:"tap: accessibility label from inspect (instead of x and y)."},duration:{type:"number",description:"tap: seconds held (above 0.5 is a long press); swipe: seconds."},text:{type:"string",description:"type (required): the text to type."},name:{type:"string",enum:[...oo],description:"button (required)."},url:{type:"string",description:"open_url (required): the URL or deep link."},mode:{type:"string",enum:["light","dark"],description:"appearance (required)."},steps:{type:"array",maxItems:30,description:"steps (required, at least one) or launch and run: run in order in one call (after launch, once the app is up). Each item is {action:'tap', id|label|x,y} | {action:'swipe', x,y,x2,y2} | {action:'type', text} | {action:'button', name} | {action:'sleep', seconds}. Taps by id or label wait for their element to appear.",items:{type:"object"}},observe:{type:"string",enum:["tree","screenshot","both","none"],description:"After tap, swipe, type, button, open_url, launch or steps: what to return about the settled screen. Default tree (the accessibility tree, so no separate inspect is needed); screenshot or both to see it."},wait_for:{type:"object",description:"After the action, wait until this element is on screen: {id} or {label}; add gone:true to wait for it to disappear.",properties:{id:{type:"string"},label:{type:"string"},gone:{type:"boolean"}},additionalProperties:!1},timeout:{type:"number",description:"Seconds to wait for wait_for (default 5, max 20)."},wait:{type:"boolean",description:"build or build_status: wait for the build to finish (up to ~45 s) instead of returning at once."},save_path:{type:"string",description:"screenshot: also save the full-resolution PNG at this path (absolute or relative to the Session's folder), for example to show the user."}},Ba=io.options.map((e)=>e.shape).filter((e)=>e.action.value!=="chrome"),Xd={tap:[{required:["x","y"]},{required:["id"]},{required:["label"]}],launch:[{required:["app_path"],without:["bundle_id"]},{required:["bundle_id"],without:["app_path"]}]},$a=new Set;function Jd(e,a){let{description:l,...u}=e==="steps"&&a==="steps"?{...Ir.steps,minItems:1}:Ir[e];if(l===void 0||$a.has(e))return u;return $a.add(e),{...u,description:l}}var Zd=Ba.flatMap((e)=>{let a=e.action.value,l=Object.keys(e).filter((p)=>Object.hasOwn(Ir,p)),u=l.filter((p)=>!e[p].safeParse(void 0).success);return(Xd[a]??[{required:[]}]).map((p)=>({type:"object",properties:Object.fromEntries([["action",{type:"string",const:a}],...["device_id","root_id",...l].filter((m)=>!p.without?.includes(m)).map((m)=>[m,Jd(m,a)])]),required:["action",...u,...p.required],additionalProperties:!1}))}),Qd={type:"object",properties:{action:{type:"string",enum:Ba.map((e)=>e.action.value)},...Ir},required:["action"],additionalProperties:!1},lg={...Qd,anyOf:Zd};import{spawn as co}from"child_process";import{createHash as tp}from"crypto";import{existsSync as ao,mkdirSync as kr,mkdtempSync as rp,readdirSync as Ha,readFileSync as qa,renameSync as np,rmSync as Wa,symlinkSync as lo,writeFileSync as Ht}from"fs";import{homedir as op}from"os";import{dirname as ol,join as re}from"path";import{createInterface as ip}from"readline";var so=`// Reason's simulator host: one warm process per booted iOS Simulator.
 //
 // Built on the Mac on first use (cli/simulator-host.ts) against the MIT
 // FBSimulatorControl frameworks that the pinned AXe ships, so loading
@@ -496,27 +496,27 @@ default:
 }
 `;var Qa=process.arch==="arm64"?"arm64-apple-macos":"x86_64-apple-macos",sp=180000,ap=15000,lp=30000,cp=600000,up=["SimDevice","SimDeviceSet","SimDeviceType","SimRuntime"].map((e)=>`@interface ${e} : NSObject
 @end
-`).join("");function el(e,a,l){return new Promise((u)=>{let p=wo(e,a,{stdio:["ignore","pipe","pipe"],timeout:l}),m="";p.stdout.on("data",(f)=>{m+=f}),p.stderr.on("data",(f)=>{m+=f}),p.once("error",(f)=>u({code:-1,output:String(f)})),p.once("close",(f)=>u({code:f??-1,output:m}))})}var nl=new Map;function vo(e){let a=re(ol(e),"Frameworks"),l=nl.get(a);if(!l)nl.set(a,l=dp(a));return l}async function dp(e){if(process.platform!=="darwin"||!co(re(e,"FBSimulatorControl.framework")))return null;let a=await el("xcrun",["swiftc","--version"],30000);if(a.code!==0)return null;let l=tp("sha256").update(ao).update(a.output).update(e).digest("hex").slice(0,16),u=re(op(),".local","share","reason","simulator","host"),p=re(u,l,"simulator-host");if(co(p))return p;kr(u,{recursive:!0,mode:448});let m=rp(re(u,".staging-"));try{let f=re(m,"Frameworks"),g=re(f,"FBSimulatorControl.framework"),b=re(g,"Modules","FBSimulatorControl.swiftmodule");kr(b,{recursive:!0});for(let I of qa(e))if(I!=="FBSimulatorControl.framework")bo(re(e,I),re(f,I));let y=re(e,"FBSimulatorControl.framework");bo(re(y,"FBSimulatorControl"),re(g,"FBSimulatorControl")),bo(re(y,"Headers"),re(g,"Headers")),Ht(re(g,"Modules","module.modulemap"),za(re(y,"Modules","module.modulemap")));let h=za(re(y,"Modules","FBSimulatorControl.swiftmodule",`${Qa}.swiftinterface`),"utf8");Ht(re(b,`${Qa}.swiftinterface`),h.replace(/FBSimulatorControl\.(?=[A-Za-z_])/g,"").replace(/IOSurface\.IOSurface/g,"IOSurface"));let w=re(m,"include","CoreSimulator");kr(w,{recursive:!0}),Ht(re(w,"module.modulemap"),`module CoreSimulator {
+`).join("");function el(e,a,l){return new Promise((u)=>{let p=co(e,a,{stdio:["ignore","pipe","pipe"],timeout:l}),m="";p.stdout.on("data",(f)=>{m+=f}),p.stderr.on("data",(f)=>{m+=f}),p.once("error",(f)=>u({code:-1,output:String(f)})),p.once("close",(f)=>u({code:f??-1,output:m}))})}var nl=new Map;function bo(e){let a=re(ol(e),"Frameworks"),l=nl.get(a);if(!l)nl.set(a,l=dp(a));return l}async function dp(e){if(process.platform!=="darwin"||!ao(re(e,"FBSimulatorControl.framework")))return null;let a=await el("xcrun",["swiftc","--version"],30000);if(a.code!==0)return null;let l=tp("sha256").update(so).update(a.output).update(e).digest("hex").slice(0,16),u=re(op(),".local","share","reason","simulator","host"),p=re(u,l,"simulator-host");if(ao(p))return p;kr(u,{recursive:!0,mode:448});let m=rp(re(u,".staging-"));try{let f=re(m,"Frameworks"),g=re(f,"FBSimulatorControl.framework"),b=re(g,"Modules","FBSimulatorControl.swiftmodule");kr(b,{recursive:!0});for(let I of Ha(e))if(I!=="FBSimulatorControl.framework")lo(re(e,I),re(f,I));let y=re(e,"FBSimulatorControl.framework");lo(re(y,"FBSimulatorControl"),re(g,"FBSimulatorControl")),lo(re(y,"Headers"),re(g,"Headers")),Ht(re(g,"Modules","module.modulemap"),qa(re(y,"Modules","module.modulemap")));let h=qa(re(y,"Modules","FBSimulatorControl.swiftmodule",`${Qa}.swiftinterface`),"utf8");Ht(re(b,`${Qa}.swiftinterface`),h.replace(/FBSimulatorControl\.(?=[A-Za-z_])/g,"").replace(/IOSurface\.IOSurface/g,"IOSurface"));let w=re(m,"include","CoreSimulator");kr(w,{recursive:!0}),Ht(re(w,"module.modulemap"),`module CoreSimulator {
   header "CoreSimulator.h"
   export *
 }
 `),Ht(re(w,"CoreSimulator.h"),`#import <Foundation/Foundation.h>
-${up}`);let S=re(m,"main.swift");Ht(S,ao);let v=re(m,"simulator-host"),R=await el("xcrun",["swiftc","-O","-F",f,"-I",re(m,"include"),"-module-cache-path",re(m,"cache"),"-Xlinker","-rpath","-Xlinker",e,S,"-o",v],sp);if(R.code!==0||!co(v))return process.stderr.write(`Reason: the simulator host did not build; simulator actions use AXe.
+${up}`);let S=re(m,"main.swift");Ht(S,so);let v=re(m,"simulator-host"),R=await el("xcrun",["swiftc","-O","-F",f,"-I",re(m,"include"),"-module-cache-path",re(m,"cache"),"-Xlinker","-rpath","-Xlinker",e,S,"-o",v],sp);if(R.code!==0||!ao(v))return process.stderr.write(`Reason: the simulator host did not build; simulator actions use AXe.
 ${R.output.slice(-2000)}
-`),null;kr(ol(p),{recursive:!0}),np(v,p);for(let I of qa(u))if(I!==l&&!I.startsWith(".staging-"))Za(re(u,I),{recursive:!0,force:!0});return p}catch{return null}finally{Za(m,{recursive:!0,force:!0})}}class qt extends Error{}class ht extends Error{}class il{child;onGone;nextId=1;pending=new Map;idle;gone=!1;constructor(e,a){this.child=e;this.onGone=a;ip({input:e.stdout}).on("line",(u)=>{let p;try{p=JSON.parse(u)}catch{return}let m=this.pending.get(Number(p.id));if(!m)return;if(this.pending.delete(Number(p.id)),clearTimeout(m.timer),p.ok===!0)m.resolve(p);else m.reject(new qt(String(p.error??"The simulator refused the action.")))}),e.once("exit",()=>this.end()),e.once("error",()=>this.end()),this.touch()}call(e){if(this.gone)return Promise.reject(new ht("The simulator host has exited."));this.touch();let a=this.nextId++;return new Promise((l,u)=>{let p=setTimeout(()=>{this.pending.delete(a),u(new ht("The simulator host did not answer.")),this.close()},lp);this.pending.set(a,{resolve:l,reject:u,timer:p}),this.child.stdin.write(`${JSON.stringify({id:a,...e})}
-`)})}close(){if(this.child.exitCode===null&&this.child.signalCode===null)this.child.kill("SIGTERM");this.end()}touch(){clearTimeout(this.idle),this.idle=setTimeout(()=>this.close(),cp),this.idle.unref?.()}end(){if(this.gone)return;this.gone=!0,clearTimeout(this.idle);for(let e of this.pending.values())clearTimeout(e.timer),e.reject(new ht("The simulator host has exited."));this.pending.clear(),this.onGone()}}var ft=new Map;async function Tr(e,a,l=!1){let u=ft.get(a);if(!u){let p={started:pp(e,a)};ft.set(a,u=p),p.started.then((m)=>{if(p.host=m,!m&&ft.get(a)===p)ft.delete(a)})}if(u.host!==void 0)return u.host;return l?u.started:null}async function pp(e,a){let l=await vo(e);if(!l)return null;let u=wo(l,["serve",a],{stdio:["pipe","pipe","ignore"]});if(!await new Promise((f)=>{let g=setTimeout(()=>f(!1),ap);u.stdout.once("data",(b)=>{clearTimeout(g),f(String(b).includes('"ready":true'))}),u.once("exit",()=>{clearTimeout(g),f(!1)}),u.once("error",()=>{clearTimeout(g),f(!1)})})){if(u.exitCode===null)u.kill("SIGTERM");return null}let m=new il(u,()=>{let f=ft.get(a);if(f&&(f.host===m||f.host===void 0))ft.delete(a)});return m}function sl(e,a,l,u,p){return wo(e,["stream",a,String(l),String(Math.round(u)),String(p)],{stdio:["pipe","pipe","ignore"]})}var gt={version:"1.8.0",url:"https://github.com/cameroncooke/AXe/releases/download/v1.8.0/AXe-macOS-v1.8.0-universal.tar.gz",sha256:"7b76340b72e90d0f211bc7c4636f15009076eff07acef2f2b632b175debd8834"},_p=50000,yp=112640,bp=174080,Ro=2,wp=60000,Sp=2000,vp=300,Rp=40,xp=new Set(["file:","javascript:","data:","vbscript:","blob:"]);function bt(e,a,l={}){return new Promise((u,p)=>{let m=Do(e,a,{cwd:l.cwd,stdio:["ignore","pipe","pipe"],signal:l.signal}),f=[],g=[];m.stdout.on("data",(y)=>f.push(y)),m.stderr.on("data",(y)=>g.push(y));let b=setTimeout(()=>m.kill("SIGKILL"),l.timeoutMs??_p);m.on("error",(y)=>{clearTimeout(b),p(y)}),m.on("close",(y)=>{clearTimeout(b),u({code:y??-1,stdout:Buffer.concat(f).toString("utf8"),stderr:Buffer.concat(g).toString("utf8")})})})}function Q(e,a){throw new r(e,a)}async function fe(e,a,l,u={}){let p=await bt(e,a,u);if(p.code!==0)Q("simulator_command_failed",`${l} failed: ${(p.stderr||p.stdout).trim().slice(-1500)}`);return p.stdout}function Vt(){return process.platform==="darwin"&&Ae("/Library/Developer/PrivateFrameworks/CoreSimulator.framework")&&Ae("/usr/bin/xcrun")}var xo=null;function it(){return K(Uo(),".local","share","reason","simulator","axe")}function Ho(){let e=K(it(),gt.version,"axe");if(Ae(e))return Promise.resolve(e);return xo??=(async()=>{Oo(it(),{recursive:!0,mode:448});let a=No(K(it(),".staging-"));try{let l=K(a,"axe.tgz");await Qo(gt.url,gt.sha256,l);let u=K(a,"tree");if(Oo(u),await fe("tar",["-xzf",l,"-C",u],"Extracting AXe"),!Ae(K(u,"axe"))||!Ae(K(u,"Frameworks")))Q("simulator_axe_missing","The AXe archive has an unexpected layout.");Wt(K(it(),gt.version),{recursive:!0,force:!0}),hp(u,K(it(),gt.version));for(let p of Wr(it()))if(p!==gt.version&&!p.startsWith(".staging-"))Wt(K(it(),p),{recursive:!0,force:!0});return e}finally{Wt(a,{recursive:!0,force:!0}),xo=null}})(),xo}var yl=Ho;async function bl(e){let a=await Ho().catch(()=>null);return a?Tr(a,e.udid).catch(()=>null):null}async function Nr(e,a,l){let u=await Ho().catch(()=>Q("simulator_axe_missing","AXe could not be installed on this Mac.")),p=await bt(u,[...e,"--udid",a]);if(p.code===0)return p.stdout;let m=(p.stderr||p.stdout).trim();if(/no (matching |accessibility )?element|element not found|could not find|no elements? match/i.test(m))Q("simulator_element_not_found",m.slice(-500));return Q("simulator_command_failed",`${l} failed: ${m.slice(-1500)}`)}function Ep(e){let a=e.match(/SimRuntime\.([A-Za-z]+)-(\d+)-(\d+)(?:-(\d+))?$/);return a?`${a[1]} ${a[2]}.${a[3]}${a[4]?`.${a[4]}`:""}`:e}function Cp(e){switch(e){case"Booted":return"booted";case"Booting":return"booting";case"Shutting Down":return"shutting_down";default:return"shutdown"}}async function jo(){let a=JSON.parse(await fe("xcrun",["simctl","list","devices","available","-j"],"Listing simulators")).devices??{},l=[];for(let[u,p]of Object.entries(a)){if(!u.includes("SimRuntime.iOS"))continue;for(let m of p){if(m.isAvailable===!1)continue;let f=m.name.toLowerCase();if(m.deviceTypeIdentifier)Lo.set(m.udid,m.deviceTypeIdentifier);l.push({udid:m.udid,name:m.name,runtime:Ep(u),state:Cp(m.state),kind:f.includes("iphone")?"iphone":f.includes("ipad")?"ipad":"other"})}}return l.sort((u,p)=>Number(p.state==="booted")-Number(u.state==="booted")||p.runtime.localeCompare(u.runtime,void 0,{numeric:!0})||u.name.localeCompare(p.name))}var Lo=new Map,To=null;async function be(e,a){let l=await jo(),u;if(e){let p=l.filter((m)=>m.udid===e||m.name===e);if(u=p.find((m)=>m.state==="booted")??p[0],!u)Q("simulator_device_not_found",`No simulator named "${e}". Call devices to list them.`)}else{let p=l.filter((m)=>m.state==="booted");if(u=p.find((m)=>m.udid===To)??p.find((m)=>m.kind==="iphone")??p[0],!u)Q("simulator_not_booted","No simulator is booted. Call devices, then boot one.")}if(a.booted&&u.state!=="booted")Q("simulator_not_booted",`${u.name} is not booted. Boot it first.`);return To=u.udid,u}function ae(e){return`${e.name} (${e.runtime})`}async function Pp(e){if(e.state!=="booted"){let a=await bt("xcrun",["simctl","boot",e.udid]);if(a.code!==0&&!/current state: Booted/i.test(a.stderr))Q("simulator_command_failed",`Booting ${e.name} failed: ${a.stderr.trim().slice(-1000)}`);await fe("xcrun",["simctl","bootstatus",e.udid,"-b"],`Waiting for ${e.name} to boot`,{timeoutMs:45000})}return To=e.udid,{...e,state:"booted"}}function qo(e,a){let l=Ao(e,a),u=gl(e,l);if(u.startsWith("..")||u.startsWith(_l)||Ao(e,u)!==l)Q("simulator_path_outside_root",`${a} is outside this machine's granted folder (${e}). Pass a path inside it, or one relative to it.`);return l}var al=4,Op=new Set(["node_modules","Pods","DerivedData","build","Carthage","vendor"]);function Ip(e){let a=[],l=(u,p)=>{let m;try{m=Wr(u)}catch{return}if(m.includes("project.yml")||m.some((f)=>f.endsWith(".xcworkspace")||f.endsWith(".xcodeproj"))){a.push(u);return}if(p>=al)return;for(let f of m.sort()){if(f.startsWith(".")||Op.has(f))continue;let g=K(u,f);try{if(Dr(g).isDirectory())l(g,p+1)}catch{}}};if(l(e,0),a.length===1)return a[0];if(!a.length)Q("simulator_project_not_found",`No Xcode project or project.yml within ${al} folders of ${e}; pass path.`);return Q("simulator_project_not_found",`${e} holds several Xcode projects; pass path as one of: ${a.map((u)=>gl(e,u)||".").join(", ")}.`)}var yt=new Map;async function Ap(e){if(e.endsWith(".xcworkspace"))return{flag:"-workspace",path:e,dir:Io(e)};if(e.endsWith(".xcodeproj"))return{flag:"-project",path:e,dir:Io(e)};if(!Dr(e).isDirectory())Q("simulator_project_not_found",`${e} is not a project, workspace or folder.`);let a=(p)=>Wr(e).filter((m)=>m.endsWith(p)).sort();if(Ae(K(e,"project.yml")))await fe("xcodegen",["generate","--quiet"],"xcodegen generate",{cwd:e,timeoutMs:45000}).catch((p)=>Ae("/opt/homebrew/bin/xcodegen")?fe("/opt/homebrew/bin/xcodegen",["generate","--quiet"],"xcodegen generate",{cwd:e,timeoutMs:45000}):Promise.reject(p));let l=a(".xcworkspace")[0];if(l)return{flag:"-workspace",path:K(e,l),dir:e};let u=a(".xcodeproj")[0];if(u)return{flag:"-project",path:K(e,u),dir:e};return Q("simulator_project_not_found",`No .xcodeproj or .xcworkspace in ${e}.`)}async function wl(e){let a=JSON.parse(await fe("xcodebuild",["-list","-json",e.flag,e.path],"Listing schemes"));return a.workspace?.schemes??a.project?.schemes??[]}async function Lp(e){let a=(await wl(e))[0];if(!a)Q("simulator_build_no_scheme",`${e.path} has no schemes; pass scheme.`);return a}function kp(e){let a=[],l=new Set;return e.forEach((u,p)=>{if(a.length>=20||!/(^|\s)error: /.test(u)||u.startsWith("note:")||l.has(u))return;l.add(u);let m=e.slice(p+1,p+3).filter((f)=>f.trim()!==""&&!/(^|\s)(error|warning|note): /.test(f));a.push([u,...m].join(`
-`).slice(0,800))}),a}async function Tp(e,a,l){if(e.ended=Date.now(),a!==0){if(e.log.some((m)=>m.includes("does not contain a scheme named"))){let m=await wl(l).catch(()=>[]);if(m.length)e.log.push(`error: this project's schemes are: ${m.join(", ")}`)}e.status="failed";return}let u=K(e.productsDir,`${e.configuration}-iphonesimulator`),p=Ae(u)?Wr(u).filter((m)=>m.endsWith(".app")).map((m)=>K(u,m)).sort((m,f)=>Dr(f).mtimeMs-Dr(m).mtimeMs):[];if(e.appPath=p[0],e.appPath)e.bundleId=await Rl(e.appPath).catch(()=>{return});if(e.status=e.appPath?"succeeded":"failed",!e.appPath)e.log.push("error: the build succeeded but produced no .app for the iOS Simulator")}async function ll(e,a){let l=e.path?qo(a,e.path):Ip(a),u=await Ap(l),p=e.scheme??await Lp(u),m=e.configuration??"Debug",f=await be(e.device,{booted:!1}).catch(()=>null),g=f?`platform=iOS Simulator,id=${f.udid}`:"generic/platform=iOS Simulator",b=mp("sha256").update(u.path).digest("hex").slice(0,16),y=K(Uo(),"Library","Caches","reason","simulator-builds",b),h={id:`build-${fp().slice(0,8)}`,status:"running",started:Date.now(),log:[],productsDir:K(y,"Build","Products"),configuration:m};yt.set(h.id,h);for(let[R,I]of yt)if(yt.size>20&&I.status!=="running")yt.delete(R);let w=Do("xcodebuild",[u.flag,u.path,"-scheme",p,"-configuration",m,"-destination",g,"-derivedDataPath",y,"-skipMacroValidation","build"],{cwd:u.dir,stdio:["ignore","pipe","pipe"]}),S="",v=(R)=>{let I=(S+R.toString("utf8")).split(`
+`),null;kr(ol(p),{recursive:!0}),np(v,p);for(let I of Ha(u))if(I!==l&&!I.startsWith(".staging-"))Wa(re(u,I),{recursive:!0,force:!0});return p}catch{return null}finally{Wa(m,{recursive:!0,force:!0})}}class qt extends Error{}class ht extends Error{}class il{child;onGone;nextId=1;pending=new Map;idle;gone=!1;constructor(e,a){this.child=e;this.onGone=a;ip({input:e.stdout}).on("line",(u)=>{let p;try{p=JSON.parse(u)}catch{return}let m=this.pending.get(Number(p.id));if(!m)return;if(this.pending.delete(Number(p.id)),clearTimeout(m.timer),p.ok===!0)m.resolve(p);else m.reject(new qt(String(p.error??"The simulator refused the action.")))}),e.once("exit",()=>this.end()),e.once("error",()=>this.end()),this.touch()}call(e){if(this.gone)return Promise.reject(new ht("The simulator host has exited."));this.touch();let a=this.nextId++;return new Promise((l,u)=>{let p=setTimeout(()=>{this.pending.delete(a),u(new ht("The simulator host did not answer.")),this.close()},lp);this.pending.set(a,{resolve:l,reject:u,timer:p}),this.child.stdin.write(`${JSON.stringify({id:a,...e})}
+`)})}close(){if(this.child.exitCode===null&&this.child.signalCode===null)this.child.kill("SIGTERM");this.end()}touch(){clearTimeout(this.idle),this.idle=setTimeout(()=>this.close(),cp),this.idle.unref?.()}end(){if(this.gone)return;this.gone=!0,clearTimeout(this.idle);for(let e of this.pending.values())clearTimeout(e.timer),e.reject(new ht("The simulator host has exited."));this.pending.clear(),this.onGone()}}var ft=new Map;async function Tr(e,a,l=!1){let u=ft.get(a);if(!u){let p={started:pp(e,a)};ft.set(a,u=p),p.started.then((m)=>{if(p.host=m,!m&&ft.get(a)===p)ft.delete(a)})}if(u.host!==void 0)return u.host;return l?u.started:null}async function pp(e,a){let l=await bo(e);if(!l)return null;let u=co(l,["serve",a],{stdio:["pipe","pipe","ignore"]});if(!await new Promise((f)=>{let g=setTimeout(()=>f(!1),ap);u.stdout.once("data",(b)=>{clearTimeout(g),f(String(b).includes('"ready":true'))}),u.once("exit",()=>{clearTimeout(g),f(!1)}),u.once("error",()=>{clearTimeout(g),f(!1)})})){if(u.exitCode===null)u.kill("SIGTERM");return null}let m=new il(u,()=>{let f=ft.get(a);if(f&&(f.host===m||f.host===void 0))ft.delete(a)});return m}function sl(e,a,l,u,p){return co(e,["stream",a,String(l),String(Math.round(u)),String(p)],{stdio:["pipe","pipe","ignore"]})}var gt={version:"1.8.0",url:"https://github.com/cameroncooke/AXe/releases/download/v1.8.0/AXe-macOS-v1.8.0-universal.tar.gz",sha256:"7b76340b72e90d0f211bc7c4636f15009076eff07acef2f2b632b175debd8834"},_p=50000,yp=112640,bp=174080,So=2,wp=60000,Sp=2000,vp=300,Rp=40,xp=new Set(["file:","javascript:","data:","vbscript:","blob:"]);function bt(e,a,l={}){return new Promise((u,p)=>{let m=To(e,a,{cwd:l.cwd,stdio:["ignore","pipe","pipe"],signal:l.signal}),f=[],g=[];m.stdout.on("data",(y)=>f.push(y)),m.stderr.on("data",(y)=>g.push(y));let b=setTimeout(()=>m.kill("SIGKILL"),l.timeoutMs??_p);m.on("error",(y)=>{clearTimeout(b),p(y)}),m.on("close",(y)=>{clearTimeout(b),u({code:y??-1,stdout:Buffer.concat(f).toString("utf8"),stderr:Buffer.concat(g).toString("utf8")})})})}function Q(e,a){throw new r(e,a)}async function fe(e,a,l,u={}){let p=await bt(e,a,u);if(p.code!==0)Q("simulator_command_failed",`${l} failed: ${(p.stderr||p.stdout).trim().slice(-1500)}`);return p.stdout}function Vt(){return process.platform==="darwin"&&Ae("/Library/Developer/PrivateFrameworks/CoreSimulator.framework")&&Ae("/usr/bin/xcrun")}var vo=null;function it(){return K($o(),".local","share","reason","simulator","axe")}function Bo(){let e=K(it(),gt.version,"axe");if(Ae(e))return Promise.resolve(e);return vo??=(async()=>{Po(it(),{recursive:!0,mode:448});let a=Do(K(it(),".staging-"));try{let l=K(a,"axe.tgz");await es(gt.url,gt.sha256,l);let u=K(a,"tree");if(Po(u),await fe("tar",["-xzf",l,"-C",u],"Extracting AXe"),!Ae(K(u,"axe"))||!Ae(K(u,"Frameworks")))Q("simulator_axe_missing","The AXe archive has an unexpected layout.");Wt(K(it(),gt.version),{recursive:!0,force:!0}),hp(u,K(it(),gt.version));for(let p of Wr(it()))if(p!==gt.version&&!p.startsWith(".staging-"))Wt(K(it(),p),{recursive:!0,force:!0});return e}finally{Wt(a,{recursive:!0,force:!0}),vo=null}})(),vo}var yl=Bo;async function bl(e){let a=await Bo().catch(()=>null);return a?Tr(a,e.udid).catch(()=>null):null}async function Nr(e,a,l){let u=await Bo().catch(()=>Q("simulator_axe_missing","AXe could not be installed on this Mac.")),p=await bt(u,[...e,"--udid",a]);if(p.code===0)return p.stdout;let m=(p.stderr||p.stdout).trim();if(/no (matching |accessibility )?element|element not found|could not find|no elements? match/i.test(m))Q("simulator_element_not_found",m.slice(-500));return Q("simulator_command_failed",`${l} failed: ${m.slice(-1500)}`)}function Ep(e){let a=e.match(/SimRuntime\.([A-Za-z]+)-(\d+)-(\d+)(?:-(\d+))?$/);return a?`${a[1]} ${a[2]}.${a[3]}${a[4]?`.${a[4]}`:""}`:e}function Cp(e){switch(e){case"Booted":return"booted";case"Booting":return"booting";case"Shutting Down":return"shutting_down";default:return"shutdown"}}async function Uo(){let a=JSON.parse(await fe("xcrun",["simctl","list","devices","available","-j"],"Listing simulators")).devices??{},l=[];for(let[u,p]of Object.entries(a)){if(!u.includes("SimRuntime.iOS"))continue;for(let m of p){if(m.isAvailable===!1)continue;let f=m.name.toLowerCase();if(m.deviceTypeIdentifier)Ao.set(m.udid,m.deviceTypeIdentifier);l.push({udid:m.udid,name:m.name,runtime:Ep(u),state:Cp(m.state),kind:f.includes("iphone")?"iphone":f.includes("ipad")?"ipad":"other"})}}return l.sort((u,p)=>Number(p.state==="booted")-Number(u.state==="booted")||p.runtime.localeCompare(u.runtime,void 0,{numeric:!0})||u.name.localeCompare(p.name))}var Ao=new Map,Lo=null;async function be(e,a){let l=await Uo(),u;if(e){let p=l.filter((m)=>m.udid===e||m.name===e);if(u=p.find((m)=>m.state==="booted")??p[0],!u)Q("simulator_device_not_found",`No simulator named "${e}". Call devices to list them.`)}else{let p=l.filter((m)=>m.state==="booted");if(u=p.find((m)=>m.udid===Lo)??p.find((m)=>m.kind==="iphone")??p[0],!u)Q("simulator_not_booted","No simulator is booted. Call devices, then boot one.")}if(a.booted&&u.state!=="booted")Q("simulator_not_booted",`${u.name} is not booted. Boot it first.`);return Lo=u.udid,u}function ae(e){return`${e.name} (${e.runtime})`}async function Pp(e){if(e.state!=="booted"){let a=await bt("xcrun",["simctl","boot",e.udid]);if(a.code!==0&&!/current state: Booted/i.test(a.stderr))Q("simulator_command_failed",`Booting ${e.name} failed: ${a.stderr.trim().slice(-1000)}`);await fe("xcrun",["simctl","bootstatus",e.udid,"-b"],`Waiting for ${e.name} to boot`,{timeoutMs:45000})}return Lo=e.udid,{...e,state:"booted"}}function Ho(e,a){let l=Io(e,a),u=gl(e,l);if(u.startsWith("..")||u.startsWith(_l)||Io(e,u)!==l)Q("simulator_path_outside_root",`${a} is outside this machine's granted folder (${e}). Pass a path inside it, or one relative to it.`);return l}var al=4,Op=new Set(["node_modules","Pods","DerivedData","build","Carthage","vendor"]);function Ip(e){let a=[],l=(u,p)=>{let m;try{m=Wr(u)}catch{return}if(m.includes("project.yml")||m.some((f)=>f.endsWith(".xcworkspace")||f.endsWith(".xcodeproj"))){a.push(u);return}if(p>=al)return;for(let f of m.sort()){if(f.startsWith(".")||Op.has(f))continue;let g=K(u,f);try{if(Dr(g).isDirectory())l(g,p+1)}catch{}}};if(l(e,0),a.length===1)return a[0];if(!a.length)Q("simulator_project_not_found",`No Xcode project or project.yml within ${al} folders of ${e}; pass path.`);return Q("simulator_project_not_found",`${e} holds several Xcode projects; pass path as one of: ${a.map((u)=>gl(e,u)||".").join(", ")}.`)}var yt=new Map;async function Ap(e){if(e.endsWith(".xcworkspace"))return{flag:"-workspace",path:e,dir:Oo(e)};if(e.endsWith(".xcodeproj"))return{flag:"-project",path:e,dir:Oo(e)};if(!Dr(e).isDirectory())Q("simulator_project_not_found",`${e} is not a project, workspace or folder.`);let a=(p)=>Wr(e).filter((m)=>m.endsWith(p)).sort();if(Ae(K(e,"project.yml")))await fe("xcodegen",["generate","--quiet"],"xcodegen generate",{cwd:e,timeoutMs:45000}).catch((p)=>Ae("/opt/homebrew/bin/xcodegen")?fe("/opt/homebrew/bin/xcodegen",["generate","--quiet"],"xcodegen generate",{cwd:e,timeoutMs:45000}):Promise.reject(p));let l=a(".xcworkspace")[0];if(l)return{flag:"-workspace",path:K(e,l),dir:e};let u=a(".xcodeproj")[0];if(u)return{flag:"-project",path:K(e,u),dir:e};return Q("simulator_project_not_found",`No .xcodeproj or .xcworkspace in ${e}.`)}async function wl(e){let a=JSON.parse(await fe("xcodebuild",["-list","-json",e.flag,e.path],"Listing schemes"));return a.workspace?.schemes??a.project?.schemes??[]}async function Lp(e){let a=(await wl(e))[0];if(!a)Q("simulator_build_no_scheme",`${e.path} has no schemes; pass scheme.`);return a}function kp(e){let a=[],l=new Set;return e.forEach((u,p)=>{if(a.length>=20||!/(^|\s)error: /.test(u)||u.startsWith("note:")||l.has(u))return;l.add(u);let m=e.slice(p+1,p+3).filter((f)=>f.trim()!==""&&!/(^|\s)(error|warning|note): /.test(f));a.push([u,...m].join(`
+`).slice(0,800))}),a}async function Tp(e,a,l){if(e.ended=Date.now(),a!==0){if(e.log.some((m)=>m.includes("does not contain a scheme named"))){let m=await wl(l).catch(()=>[]);if(m.length)e.log.push(`error: this project's schemes are: ${m.join(", ")}`)}e.status="failed";return}let u=K(e.productsDir,`${e.configuration}-iphonesimulator`),p=Ae(u)?Wr(u).filter((m)=>m.endsWith(".app")).map((m)=>K(u,m)).sort((m,f)=>Dr(f).mtimeMs-Dr(m).mtimeMs):[];if(e.appPath=p[0],e.appPath)e.bundleId=await Rl(e.appPath).catch(()=>{return});if(e.status=e.appPath?"succeeded":"failed",!e.appPath)e.log.push("error: the build succeeded but produced no .app for the iOS Simulator")}async function ll(e,a){let l=e.path?Ho(a,e.path):Ip(a),u=await Ap(l),p=e.scheme??await Lp(u),m=e.configuration??"Debug",f=await be(e.device,{booted:!1}).catch(()=>null),g=f?`platform=iOS Simulator,id=${f.udid}`:"generic/platform=iOS Simulator",b=mp("sha256").update(u.path).digest("hex").slice(0,16),y=K($o(),"Library","Caches","reason","simulator-builds",b),h={id:`build-${fp().slice(0,8)}`,status:"running",started:Date.now(),log:[],productsDir:K(y,"Build","Products"),configuration:m};yt.set(h.id,h);for(let[R,I]of yt)if(yt.size>20&&I.status!=="running")yt.delete(R);let w=To("xcodebuild",[u.flag,u.path,"-scheme",p,"-configuration",m,"-destination",g,"-derivedDataPath",y,"-skipMacroValidation","build"],{cwd:u.dir,stdio:["ignore","pipe","pipe"]}),S="",v=(R)=>{let I=(S+R.toString("utf8")).split(`
 `);if(S=I.pop()??"",h.log.push(...I),h.log.length>5000)h.log.splice(0,h.log.length-5000)};return w.stdout.on("data",v),w.stderr.on("data",v),w.on("error",(R)=>{h.log.push(`error: ${R.message}`),h.status="failed",h.ended=Date.now()}),w.on("close",(R)=>{if(S)h.log.push(S);Tp(h,R??-1,u)}),{text:`Build ${h.id} started: ${p} (${m}) for ${f?ae(f):"the iOS Simulator"}. Poll build_status with this build_id; a first build can take minutes, later ones are incremental.`,build:Sl(h)}}function Sl(e){return{id:e.id,status:e.status,errors:kp(e.log),log_tail:e.log.slice(-Rp).join(`
-`).slice(-4000),elapsed_ms:(e.ended??Date.now())-e.started,...e.appPath?{app_path:e.appPath}:{},...e.bundleId?{bundle_id:e.bundleId}:{}}}var Dp=45000,Np=30000;async function Co(e,a=Dp){let l=Date.now()+a;while(yt.get(e)?.status==="running"&&Date.now()<l)await Bun.sleep(500);let u=vl(e);return u.build?.status==="running"?{...u,text:`${u.text} Still running: call build_status with wait again.`}:u}function vl(e){let a=yt.get(e);if(!a)Q("simulator_build_not_found",`No build ${e} on this Mac (a worker restart forgets builds); start a new one.`);let l=Sl(a);return{text:a.status==="running"?`Build ${e} is running (${Math.round(l.elapsed_ms/1000)} s).`:a.status==="succeeded"?`Build ${e} succeeded: ${a.appPath}. Launch it with app_path.`:`Build ${e} failed with ${l.errors.length} error(s).`,build:l}}async function Rl(e){return(await fe("plutil",["-extract","CFBundleIdentifier","raw","-o","-",K(e,"Info.plist")],"Reading the bundle id")).trim()}var Ye=new Map;function Mp(e,a){Ye.get(e.udid)?.stop();let l=Do("script",["-q","/dev/null","xcrun","simctl","launch","--console-pty","--terminate-running-process",e.udid,a],{stdio:["ignore","pipe","pipe"]}),u={udid:e.udid,bundleId:a,lines:[],first:0,stop:()=>l.kill("SIGTERM")};Ye.set(e.udid,u);let p="",m=(f)=>{let g=(p+f.toString("utf8").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\r]/g,"")).split(`
+`).slice(-4000),elapsed_ms:(e.ended??Date.now())-e.started,...e.appPath?{app_path:e.appPath}:{},...e.bundleId?{bundle_id:e.bundleId}:{}}}var Dp=45000,Np=30000;async function Ro(e,a=Dp){let l=Date.now()+a;while(yt.get(e)?.status==="running"&&Date.now()<l)await Bun.sleep(500);let u=vl(e);return u.build?.status==="running"?{...u,text:`${u.text} Still running: call build_status with wait again.`}:u}function vl(e){let a=yt.get(e);if(!a)Q("simulator_build_not_found",`No build ${e} on this Mac (a worker restart forgets builds); start a new one.`);let l=Sl(a);return{text:a.status==="running"?`Build ${e} is running (${Math.round(l.elapsed_ms/1000)} s).`:a.status==="succeeded"?`Build ${e} succeeded: ${a.appPath}. Launch it with app_path.`:`Build ${e} failed with ${l.errors.length} error(s).`,build:l}}async function Rl(e){return(await fe("plutil",["-extract","CFBundleIdentifier","raw","-o","-",K(e,"Info.plist")],"Reading the bundle id")).trim()}var Ye=new Map;function Mp(e,a){Ye.get(e.udid)?.stop();let l=To("script",["-q","/dev/null","xcrun","simctl","launch","--console-pty","--terminate-running-process",e.udid,a],{stdio:["ignore","pipe","pipe"]}),u={udid:e.udid,bundleId:a,lines:[],first:0,stop:()=>l.kill("SIGTERM")};Ye.set(e.udid,u);let p="",m=(f)=>{let g=(p+f.toString("utf8").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\r]/g,"")).split(`
 `);p=g.pop()??"",u.lines.push(...g);let b=u.lines.length-Sp;if(b>0)u.lines.splice(0,b),u.first+=b};return l.stdout.on("data",m),l.stderr.on("data",m),new Promise((f)=>{let g=setTimeout(()=>f(null),15000),b=()=>{let y=u.lines.concat(p).join(`
 `).match(new RegExp(`${a.replace(/\./g,"\\.")}: (\\d+)`))?.[1];if(y)clearTimeout(g),f(Number(y))};l.stdout.on("data",b),l.on("close",()=>{clearTimeout(g),f(null)})})}async function $p(e,a){let l=await be(e.device,{booted:!0}),u=e.bundle_id;if(e.app_path){let m=Bp(a,e.app_path);await fe("xcrun",["simctl","install",l.udid,m],`Installing ${hl(m)}`),u=await Rl(m)}if(e.bundle_id){if((await bt("xcrun",["simctl","get_app_container",l.udid,e.bundle_id])).code!==0)Q("simulator_app_not_installed",`${e.bundle_id} is not installed on ${ae(l)}.`)}let p=await Mp(l,u);if(p===null){let m=Ye.get(l.udid)?.lines.slice(-20).join(`
 `)??"";Q("simulator_launch_failed",`${u} did not start on ${ae(l)}.${m?`
-${m}`:""}`)}return{text:`Launched ${u} on ${ae(l)} (pid ${p}). Its console is captured; read it with logs.`,device:l}}function Bp(e,a){let l=Ao(a),u=K(Uo(),"Library","Caches","reason","simulator-builds")+_l;return l.startsWith(u)&&l.endsWith(".app")?l:qo(e,l)}function Fp(e,a){let l=Ye.get(e.udid);if(!l)return{text:`No app launched by Reason is running on ${ae(e)}; launch one to capture its capture.`,logs:{lines:[],next:0}};let u=Math.max(a??0,l.first,l.first+l.lines.length-vp),p=l.lines.slice(u-l.first).map((m)=>m.slice(0,2000));return{text:`${p.length} console line(s) from ${l.bundleId} on ${ae(e)}.`,logs:{lines:p,next:l.first+l.lines.length}}}var Ur=new Map;function cl(e,...a){let l=Ur.get(e.udid);if(!l)return;for(let[u,p]of a)if(u>l.width||p>l.height)Q("simulator_point_off_screen",`(${u}, ${p}) is off ${e.name}'s ${l.width}x${l.height}-point screen.`)}function ul(e,a){if(e.kind==="ipad")return 2;return a===750||a===828||a===640?2:3}async function Wo(e,a=1,l){let u=No(K(fl(),"reason-sim-"));try{let p=K(u,"screen.png");if(await fe("xcrun",["simctl","io",e.udid,"screenshot","--type=png",p],"Taking a screenshot"),l){Oo(Io(l),{recursive:!0});let v=await fe("sips",["-g","pixelWidth","-g","pixelHeight",p],"Reading the screenshot size"),R=Number(v.match(/pixelWidth: (\d+)/)?.[1]),I=Number(v.match(/pixelHeight: (\d+)/)?.[1]),x=2/ul(e,R);await fe("sips",["-z",String(Math.round(I*x)),String(Math.round(R*x)),p,"--out",l],"Saving the screenshot")}let m=await fe("sips",["-g","pixelWidth","-g","pixelHeight",p],"Reading the screenshot size"),f=Number(m.match(/pixelWidth: (\d+)/)?.[1]),g=Number(m.match(/pixelHeight: (\d+)/)?.[1]),b=ul(e,f),y=Math.round(f/b),h=Math.round(g/b);Ur.set(e.udid,{width:y,height:h});let w=Buffer.alloc(0),S=a===2?bp:yp;for(let v of[70,50,35]){let R=K(u,`screen-${v}.jpg`);if(await fe("sips",["-z",String(h*a),String(y*a),"-s","format","jpeg","-s","formatOptions",String(v),p,"--out",R],"Encoding the screenshot"),w=Mo(R),w.byteLength<=S)break}return{text:`Screenshot of ${ae(e)} at ${y}x${h} points: image pixels are tap coordinates.`+(l?` Saved at ${l}.`:""),device:e,image:{mime:"image/jpeg",data:w.toString("base64"),width:y,height:h}}}finally{Wt(u,{recursive:!0,force:!0})}}async function Up(e){let a=await bl(e);if(a)try{return String((await a.call({op:"tree"})).tree)}catch{}return Nr(["describe-ui"],e.udid,"Reading the accessibility tree")}async function qr(e){let a=JSON.parse(await Up(e)),l={lines:[],compact:[],ids:new Set,labels:new Set,targets:[]},u=(p,m,f="")=>{let g=(p.role??p.type??"?").replace(/^AX/,""),b=p.AXLabel||p.title||"",y=p.AXValue?` value="${String(p.AXValue).slice(0,120)}"`:"",h=p.AXUniqueId?` id=${p.AXUniqueId}`:"";if(p.AXUniqueId)l.ids.add(p.AXUniqueId);if(b)l.labels.add(b);let w=p.frame;if(g==="Application"&&w&&!l.bounds)l.bounds={width:w.width,height:w.height};if(w&&w.width>0&&w.height>0&&(p.AXUniqueId||p.AXLabel))l.targets.push({...p.AXUniqueId?{id:p.AXUniqueId.trim()}:{},...p.AXLabel?{label:p.AXLabel.trim()}:{},role:g,frame:w});let S=Boolean(b||h||y||!["Group","Other"].includes(g));if(S){let v=`${"  ".repeat(Math.min(m,12))}${g} "${b.slice(0,160)}"${h}${y}`+(w?` (${Math.round(w.x)},${Math.round(w.y)} ${Math.round(w.width)}x${Math.round(w.height)})`:"")+(p.enabled===!1?" disabled":"");l.lines.push(v);let R=g==="Image"&&!h,I=(g==="StaticText"||g==="Image")&&!h&&b!==""&&f.includes(b);if(!R&&!I)l.compact.push(v)}for(let v of p.children??[])u(v,S?m+1:m,b||f)};for(let p of a)u(p,0);return l}function xl(e,a,l=!1){let u=(l?e.compact:e.lines).join(`
+${m}`:""}`)}return{text:`Launched ${u} on ${ae(l)} (pid ${p}). Its console is captured; read it with logs.`,device:l}}function Bp(e,a){let l=Io(a),u=K($o(),"Library","Caches","reason","simulator-builds")+_l;return l.startsWith(u)&&l.endsWith(".app")?l:Ho(e,l)}function Fp(e,a){let l=Ye.get(e.udid);if(!l)return{text:`No app launched by Reason is running on ${ae(e)}; launch one to capture its capture.`,logs:{lines:[],next:0}};let u=Math.max(a??0,l.first,l.first+l.lines.length-vp),p=l.lines.slice(u-l.first).map((m)=>m.slice(0,2000));return{text:`${p.length} console line(s) from ${l.bundleId} on ${ae(e)}.`,logs:{lines:p,next:l.first+l.lines.length}}}var Ur=new Map;function cl(e,...a){let l=Ur.get(e.udid);if(!l)return;for(let[u,p]of a)if(u>l.width||p>l.height)Q("simulator_point_off_screen",`(${u}, ${p}) is off ${e.name}'s ${l.width}x${l.height}-point screen.`)}function ul(e,a){if(e.kind==="ipad")return 2;return a===750||a===828||a===640?2:3}async function qo(e,a=1,l){let u=Do(K(fl(),"reason-sim-"));try{let p=K(u,"screen.png");if(await fe("xcrun",["simctl","io",e.udid,"screenshot","--type=png",p],"Taking a screenshot"),l){Po(Oo(l),{recursive:!0});let v=await fe("sips",["-g","pixelWidth","-g","pixelHeight",p],"Reading the screenshot size"),R=Number(v.match(/pixelWidth: (\d+)/)?.[1]),I=Number(v.match(/pixelHeight: (\d+)/)?.[1]),x=2/ul(e,R);await fe("sips",["-z",String(Math.round(I*x)),String(Math.round(R*x)),p,"--out",l],"Saving the screenshot")}let m=await fe("sips",["-g","pixelWidth","-g","pixelHeight",p],"Reading the screenshot size"),f=Number(m.match(/pixelWidth: (\d+)/)?.[1]),g=Number(m.match(/pixelHeight: (\d+)/)?.[1]),b=ul(e,f),y=Math.round(f/b),h=Math.round(g/b);Ur.set(e.udid,{width:y,height:h});let w=Buffer.alloc(0),S=a===2?bp:yp;for(let v of[70,50,35]){let R=K(u,`screen-${v}.jpg`);if(await fe("sips",["-z",String(h*a),String(y*a),"-s","format","jpeg","-s","formatOptions",String(v),p,"--out",R],"Encoding the screenshot"),w=No(R),w.byteLength<=S)break}return{text:`Screenshot of ${ae(e)} at ${y}x${h} points: image pixels are tap coordinates.`+(l?` Saved at ${l}.`:""),device:e,image:{mime:"image/jpeg",data:w.toString("base64"),width:y,height:h}}}finally{Wt(u,{recursive:!0,force:!0})}}async function Up(e){let a=await bl(e);if(a)try{return String((await a.call({op:"tree"})).tree)}catch{}return Nr(["describe-ui"],e.udid,"Reading the accessibility tree")}async function qr(e){let a=JSON.parse(await Up(e)),l={lines:[],compact:[],ids:new Set,labels:new Set,targets:[]},u=(p,m,f="")=>{let g=(p.role??p.type??"?").replace(/^AX/,""),b=p.AXLabel||p.title||"",y=p.AXValue?` value="${String(p.AXValue).slice(0,120)}"`:"",h=p.AXUniqueId?` id=${p.AXUniqueId}`:"";if(p.AXUniqueId)l.ids.add(p.AXUniqueId);if(b)l.labels.add(b);let w=p.frame;if(g==="Application"&&w&&!l.bounds)l.bounds={width:w.width,height:w.height};if(w&&w.width>0&&w.height>0&&(p.AXUniqueId||p.AXLabel))l.targets.push({...p.AXUniqueId?{id:p.AXUniqueId.trim()}:{},...p.AXLabel?{label:p.AXLabel.trim()}:{},role:g,frame:w});let S=Boolean(b||h||y||!["Group","Other"].includes(g));if(S){let v=`${"  ".repeat(Math.min(m,12))}${g} "${b.slice(0,160)}"${h}${y}`+(w?` (${Math.round(w.x)},${Math.round(w.y)} ${Math.round(w.width)}x${Math.round(w.height)})`:"")+(p.enabled===!1?" disabled":"");l.lines.push(v);let R=g==="Image"&&!h,I=(g==="StaticText"||g==="Image")&&!h&&b!==""&&f.includes(b);if(!R&&!I)l.compact.push(v)}for(let v of p.children??[])u(v,S?m+1:m,b||f)};for(let p of a)u(p,0);return l}function xl(e,a,l=!1){let u=(l?e.compact:e.lines).join(`
 `);return u.length>a?`${u.slice(0,a)}
 \u2026 (truncated)`:u}async function Hp(e){let a=await qr(e);return{text:`Accessibility tree of ${ae(e)} (frames in points; tap by id or label):
 ${xl(a,wp)}`,device:e}}var jp=450,qp=1e4;function Wp(e,a){let l=a.id?e.ids.has(a.id):[...e.labels].some((u)=>u===a.label||u.includes(a.label));return a.gone?!l:l}async function st(e,a,l){let u=a.observe??"tree";if(u==="none"&&!a.wait_for)return l;let p=null,m="";if(a.wait_for){let g=Date.now()+(a.timeout??5)*1000,b=a.wait_for,y=b.id?`id ${b.id}`:`"${b.label}"`;for(;;){if(p=await qr(e),Wp(p,b)){m=` ${y} is ${b.gone?"gone":"on screen"}.`;break}if(Date.now()>=g){m=b.gone?` Waited ${a.timeout??5} s: ${y} is still on screen.`:` Waited ${a.timeout??5} s: ${y} is not in the visible accessibility tree. Lists only build their visible rows, so check the screen below: it may be open with that element further down (scroll to it), or wait for something at its top.`;break}await Bun.sleep(250)}}else await Bun.sleep(jp);let f={...l,text:`${l.text}${m}`};if(u==="tree"||u==="both")p??=await qr(e),f.screen=xl(p,qp,!0),f.text+=`
 Screen now:
-${f.screen}`;if(u==="screenshot"||u==="both"){let g=await Wo(e);f.image=g.image}return f}function dl(e){return`'${e.replace(/'/g,"'\\''")}'`}function Vp(e){switch(e.action){case"tap":if(e.x!==void 0&&e.y!==void 0)return e.duration?`touch -x ${e.x} -y ${e.y} --down --up --delay ${e.duration}`:`tap -x ${e.x} -y ${e.y}`;return e.id?`tap --id ${dl(e.id)}`:`tap --label ${dl(e.label)}`;case"swipe":return`swipe --start-x ${e.x} --start-y ${e.y} --end-x ${e.x2} --end-y ${e.y2} --duration ${e.duration??0.3}`;case"button":return`button ${e.name.replace("_","-")}`;case"sleep":return`sleep ${e.seconds}`}}var El=0.35,zp=new Set(["Button","Link","Cell","MenuItem","Switch","Toggle","CheckBox","PopUpButton","TextField","SecureTextField","SearchField","TextArea","Slider","Tab","RadioButton"]);function Gp(e,a){let l=e.targets.filter((y)=>a.id!==void 0?y.id===a.id.trim():y.label===a.label?.trim()),u=(y)=>({x:y.frame.x+y.frame.width/2,y:y.frame.y+y.frame.height/2}),p=e.bounds,m=p?l.filter((y)=>{let{x:h,y:w}=u(y);return h>=0&&w>=0&&h<=p.width&&w<=p.height}):l,f=m.length?m:l,g=f.filter((y)=>zp.has(y.role)),b=(g.length?g:f)[0];return b?u(b):null}async function Yp(e,a,l,u,p){let m=Date.now()+l*1000;for(;;){let f=Gp(await qr(e),a);if(f)return f;if(Date.now()>=m){let g=a.id!==void 0?`--id '${a.id}'`:`--label '${a.label}'`;return Q("simulator_element_not_found",`Error: Step ${u} failed: [tap]
+${f.screen}`;if(u==="screenshot"||u==="both"){let g=await qo(e);f.image=g.image}return f}function dl(e){return`'${e.replace(/'/g,"'\\''")}'`}function Vp(e){switch(e.action){case"tap":if(e.x!==void 0&&e.y!==void 0)return e.duration?`touch -x ${e.x} -y ${e.y} --down --up --delay ${e.duration}`:`tap -x ${e.x} -y ${e.y}`;return e.id?`tap --id ${dl(e.id)}`:`tap --label ${dl(e.label)}`;case"swipe":return`swipe --start-x ${e.x} --start-y ${e.y} --end-x ${e.x2} --end-y ${e.y2} --duration ${e.duration??0.3}`;case"button":return`button ${e.name.replace("_","-")}`;case"sleep":return`sleep ${e.seconds}`}}var El=0.35,zp=new Set(["Button","Link","Cell","MenuItem","Switch","Toggle","CheckBox","PopUpButton","TextField","SecureTextField","SearchField","TextArea","Slider","Tab","RadioButton"]);function Gp(e,a){let l=e.targets.filter((y)=>a.id!==void 0?y.id===a.id.trim():y.label===a.label?.trim()),u=(y)=>({x:y.frame.x+y.frame.width/2,y:y.frame.y+y.frame.height/2}),p=e.bounds,m=p?l.filter((y)=>{let{x:h,y:w}=u(y);return h>=0&&w>=0&&h<=p.width&&w<=p.height}):l,f=m.length?m:l,g=f.filter((y)=>zp.has(y.role)),b=(g.length?g:f)[0];return b?u(b):null}async function Yp(e,a,l,u,p){let m=Date.now()+l*1000;for(;;){let f=Gp(await qr(e),a);if(f)return f;if(Date.now()>=m){let g=a.id!==void 0?`--id '${a.id}'`:`--label '${a.label}'`;return Q("simulator_element_not_found",`Error: Step ${u} failed: [tap]
 No accessibility element matched ${g}. Make sure the app is on the expected screen, then inspect it and prefer an id when there is one.
 (${u-1} of ${p} steps had completed.)`)}await Bun.sleep(250)}}async function _t(e,a,l){let u=await bl(e);if(!u)return pl(e,a,l);for(let[p,m]of a.entries()){try{switch(m.action){case"tap":{let g=m.x!==void 0&&m.y!==void 0?{x:m.x,y:m.y}:await Yp(e,m,l,p+1,a.length);await u.call(m.duration?{op:"tap",...g,duration:m.duration}:{op:"tap",...g});break}case"swipe":await u.call({op:"swipe",x:m.x,y:m.y,x2:m.x2,y2:m.y2,duration:m.duration??0.3});break;case"button":await u.call({op:"button",name:m.name});break;case"type":await u.call({op:"text",text:m.text}).catch((g)=>g instanceof qt?Nr(["type",m.text],e.udid,`Step ${p+1} (typing)`):Promise.reject(g));break;case"sleep":await Bun.sleep(m.seconds*1000);break}}catch(g){if(g instanceof ht)return await pl(e,a.slice(p),l),`Ran ${a.length} step(s) on ${ae(e)}.`;if(g instanceof qt)Q("simulator_command_failed",`Step ${p+1} failed: ${g.message}
 (${p} of ${a.length} steps had completed.)`);throw g}let f=a[p+1];if(m.action!=="sleep"&&f&&f.action!=="sleep")await Bun.sleep(El*1000)}return`Ran ${a.length} step(s) on ${ae(e)}.`}async function pl(e,a,l){let u=[],p=[],m=0,f=0,g=async()=>{if(u.length===0)return;let b=["batch","--ax-cache","perStep","--wait-timeout",String(l)];for(let y of u)b.push("--step",y);try{await Nr(b,e.udid,`Steps ${f+1}-${f+m}`)}catch(y){if(y instanceof r){let h=y.message.replace(/Step (\d+) failed/,(w,S)=>{let v=p[Number(S)-1];return v?`Step ${v} failed`:w});Q(y.code,`${h}
@@ -532,8 +532,8 @@ function run(argv) {
   image.drawInRectFromRectOperationFraction($.NSMakeRect(0, 0, w, h), $.NSZeroRect, $.NSCompositingOperationCopy, 1);
   $.NSGraphicsContext.restoreGraphicsState;
   rep.representationUsingTypeProperties($.NSBitmapImageFileTypePNG, $()).writeToFileAtomically(output, true);
-}`;async function Po(e,a,l){let u=await fe("sips",["-g","pixelWidth","-g","pixelHeight",e],"Reading the frame size"),p=Number(u.match(/pixelWidth: ([\d.]+)/)?.[1]),m=Number(u.match(/pixelHeight: ([\d.]+)/)?.[1]);if(l!==void 0)p=p*l/m,m=l;let f=No(K(fl(),"reason-chrome-"));try{let g=K(f,"render.js"),b=K(f,"out.png");if(gp(g,Xp),await fe("osascript",["-l","JavaScript",g,e,b,String(Math.max(1,Math.round(p*a))),String(Math.max(1,Math.round(m*a)))],"Rendering the frame"),!Ae(b))Q("simulator_command_failed",`Rendering ${hl(e)} produced no image.`);return{image:Mo(b).toString("base64"),width:p,height:m}}finally{Wt(f,{recursive:!0,force:!0})}}async function Jp(e){if(!Lo.has(e.udid))await jo();let a=Lo.get(e.udid),u=JSON.parse(await fe("xcrun",["simctl","list","devicetypes","-j"],"Listing device types")).devicetypes?.find((p)=>p.identifier===a)?.bundlePath;if(!u)Q("simulator_command_failed",`No device type bundle for ${e.name}.`);return u}async function Zp(e){let a=await Jp(e),l=Ur.get(e.udid)??(e.state==="booted"?(await Wo(e),Ur.get(e.udid)):void 0);if(!l)Q("simulator_not_booted",`${e.name} is not booted.`);let u=ml.get(a);if(u)return{text:`Frame of ${ae(e)}.`,device:e,chrome:u};let p=K(a,"Contents","Resources"),m=JSON.parse(await fe("plutil",["-convert","json","-o","-",K(p,"profile.plist")],"Reading the device profile")),f=m.framebufferMask?K(p,`${m.framebufferMask}.pdf`):null,g=f&&Ae(f)?await Po(f,Ro,l.height):null,b=m.chromeIdentifier?.split(".").pop(),y=b?K("/Library/Developer/DeviceKit/Chrome",`${b}.devicechrome`,"Contents","Resources"):"";if(!b||!Ae(K(y,"chrome.json")))Q("simulator_command_failed",`${e.name} has no device frame in this Xcode.`);let h=JSON.parse(Mo(K(y,"chrome.json"),"utf8")),w={};for(let O of Kp){let D=h.images[O];if(!D)Q("simulator_command_failed",`${e.name}'s frame has no ${O} piece.`);w[O]=await Po(K(y,`${D}.pdf`),Ro)}let{sizing:S}=h.images,v={top:S.topHeight,left:S.leftWidth,bottom:S.bottomHeight,right:S.rightWidth},R=l.width+v.left+v.right,I=l.height+v.top+v.bottom,x=[];for(let O of h.inputs??[]){let D=K(y,`${O.image}.pdf`);if(!Ae(D))continue;let B=await Po(D,Ro),{x:ne,y:de}=O.offsets.normal,he=(Ke,ce,Zt)=>Ke<0?ce+Ke-Zt:Ke,We=O.anchor==="left"?{x:ne-B.width,y:he(de,I,B.height)}:O.anchor==="right"?{x:R+ne,y:he(de,I,B.height)}:O.anchor==="top"?{x:he(ne,R,B.width),y:de-B.height}:{x:he(ne,R,B.width),y:I+de};x.push({name:O.name,image:B.image,...We,width:B.width,height:B.height})}let E={identifier:h.identifier,screen:{width:l.width,height:l.height},inset:v,padding:h.images.devicePadding??{top:0,left:0,bottom:0,right:0},pieces:w,buttons:x,...g?{screen_mask:g.image}:{}};return ml.set(a,E),{text:`Frame of ${ae(e)}.`,device:e,chrome:E}}var Qp=new Set(["simulator_command_failed","simulator_launch_failed","simulator_point_off_screen","simulator_build_no_scheme","simulator_element_not_found","simulator_path_outside_root","simulator_project_not_found"]);async function zt(e){try{return await Cl(e)}catch(a){if(a instanceof r&&Qp.has(a.code))return{text:a.message,error:a.code};throw a}}async function Cl(e){if(!Vt())Q("simulator_xcode_missing","Xcode's iOS Simulator is not available on this Mac.");let a=so.safeParse(e.payload);if(!a.success)Q("simulator_invalid_request",a.error.issues.map((u)=>u.message).join("; "));let l=a.data;switch(l.action){case"devices":{let u=await jo(),p=u.filter((m)=>m.state==="booted");return{text:`${p.length} booted (${p.map(ae).join(", ")||"none"}), ${u.length} available.`,devices:u}}case"boot":{let u=await Pp(await be(l.device,{booted:!1}));return{text:`${ae(u)} is booted.`,device:u}}case"shutdown":{let u=await be(l.device,{booted:!1});Ye.get(u.udid)?.stop(),Ye.delete(u.udid);let p=await bt("xcrun",["simctl","shutdown",u.udid]);if(p.code!==0&&!/current state: Shutdown/i.test(p.stderr))Q("simulator_command_failed",p.stderr.trim().slice(-1000));return{text:`${ae(u)} is shut down.`,device:{...u,state:"shutdown"}}}case"build":{let u=await ll(l,e.root);return l.wait&&u.build?Co(u.build.id):u}case"build_status":return l.wait?Co(l.build_id):vl(l.build_id);case"run":{let u=await ll({...l,action:"build"},e.root),p=await Co(u.build.id,Np);if(p.build?.status!=="succeeded"||!p.build.app_path)return p;let m=await Cl({root:e.root,payload:{action:"launch",app_path:p.build.app_path,...l.device?{device:l.device}:{},...l.steps?{steps:l.steps}:{},...l.observe?{observe:l.observe}:{},...l.wait_for?{wait_for:l.wait_for}:{},...l.timeout!==void 0?{timeout:l.timeout}:{}}});return{...m,text:`Built in ${Math.round(p.build.elapsed_ms/1000)} s. ${m.text}`,build:p.build}}case"launch":{let u=await $p(l,e.root);if(!u.device)return u;if(l.steps?.length)u.text+=` ${await _t(u.device,l.steps,l.timeout??8)}`;else if(!l.wait_for)await Bun.sleep(1000);return st(u.device,l,u)}case"steps":{let u=await be(l.device,{booted:!0});return st(u,l,{text:await _t(u,l.steps,l.timeout??5),device:u})}case"terminate":{let u=await be(l.device,{booted:!0});if(Ye.get(u.udid)?.bundleId===l.bundle_id)Ye.get(u.udid)?.stop();return await bt("xcrun",["simctl","terminate",u.udid,l.bundle_id]),{text:`Terminated ${l.bundle_id} on ${ae(u)}.`,device:u}}case"logs":return Fp(await be(l.device,{booted:!1}),l.after);case"screenshot":return Wo(await be(l.device,{booted:!0}),l.scale,l.save_path?qo(e.root,l.save_path):void 0);case"chrome":return Zp(await be(l.device,{booted:!1}));case"inspect":return Hp(await be(l.device,{booted:!0}));case"tap":{let u=await be(l.device,{booted:!0}),p=l.x!==void 0&&l.y!==void 0;if(p)cl(u,[l.x,l.y]);await _t(u,[p?{action:"tap",x:l.x,y:l.y,...l.duration&&l.duration>0?{duration:l.duration}:{}}:l.id?{action:"tap",id:l.id}:{action:"tap",label:l.label}],3);let m=p?`(${l.x}, ${l.y})`:l.id?`id ${l.id}`:`"${l.label}"`;return st(u,l,{text:`Tapped ${m} on ${ae(u)}.`,device:u})}case"swipe":{let u=await be(l.device,{booted:!0});return cl(u,[l.x,l.y],[l.x2,l.y2]),await _t(u,[{action:"swipe",x:l.x,y:l.y,x2:l.x2,y2:l.y2,...l.duration!==void 0?{duration:l.duration}:{}}],3),st(u,l,{text:`Swiped (${l.x}, ${l.y}) \u2192 (${l.x2}, ${l.y2}) on ${ae(u)}.`,device:u})}case"type":{let u=await be(l.device,{booted:!0});return await _t(u,[{action:"type",text:l.text}],3),st(u,l,{text:`Typed ${l.text.length} character(s) on ${ae(u)}.`,device:u})}case"button":{let u=await be(l.device,{booted:!0});return await _t(u,[{action:"button",name:l.name}],3),st(u,l,{text:`Pressed ${l.name} on ${ae(u)}.`,device:u})}case"open_url":{let u=await be(l.device,{booted:!0}),p;try{p=new URL(l.url)}catch{Q("simulator_invalid_request","open_url needs an absolute URL.")}if(xp.has(p.protocol))Q("simulator_invalid_request",`${p.protocol} URLs are not allowed.`);return await fe("xcrun",["simctl","openurl",u.udid,p.href],"Opening the URL"),st(u,l,{text:`Opened ${p.href} on ${ae(u)}.`,device:u})}case"appearance":{let u=await be(l.device,{booted:!0});return await fe("xcrun",["simctl","ui",u.udid,"appearance",l.mode],"Setting the appearance"),{text:`${ae(u)} is in ${l.mode} mode.`,device:u}}}}import{mkdtempSync as em,readFileSync as tm,rmSync as rm}from"fs";import{tmpdir as nm}from"os";import{join as Pl}from"path";import{spawn as Al}from"child_process";var om=/^[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}$/i,Gt=1,im=[{bit:8,dx:0,dy:1},{bit:16,dx:0,dy:-1},{bit:32,dx:1,dy:0},{bit:64,dx:-1,dy:0}],Ol=60,sm=8,Ll=Vt;var Il={65293:40,65421:40,65307:41,65288:42,65289:43,65535:76,65360:74,65367:77,65365:75,65366:78,65361:80,65362:82,65363:79,65364:81,65505:225,65506:229,65507:224,65508:228,65513:226,65514:230,65515:227,65516:231,65511:227,65512:231,65509:57},am=(()=>{let e={" ":44};"abcdefghijklmnopqrstuvwxyz".split("").forEach((l,u)=>{e[l]=4+u,e[l.toUpperCase()]=4+u}),"1234567890".split("").forEach((l,u)=>{e[l]=30+u}),"!@#$%^&*()".split("").forEach((l,u)=>{e[l]=30+u});let a=[["-","_",45],["=","+",46],["[","{",47],["]","}",48],["\\","|",49],[";",":",51],["'",'"',52],["`","~",53],[",","<",54],[".",">",55],["/","?",56]];for(let[l,u,p]of a)e[l]=p,e[u]=p;return e})();function lm(e){if(Il[e]!==void 0)return Il[e];return e>=32&&e<=126?am[String.fromCharCode(e)]??null:null}function kl(e,a){let l=Al("xcrun",["simctl","pbcopy",e],{stdio:["pipe","ignore","ignore"]});l.once("error",()=>{}),l.stdin.end(a)}function cm(e,a){let l=0,u={x:0,y:0},p=(m)=>{a.call(m).catch(()=>{})};return{pointer(m,f,g){let b=(g&Gt)!==0;if(b&&!(l&Gt))p({op:"touch",phase:"down",x:m,y:f});else if(b&&(m!==u.x||f!==u.y))p({op:"touch",phase:"move",x:m,y:f});else if(!b&&l&Gt)p({op:"touch",phase:"up",x:m,y:f});for(let y of im)if(g&y.bit&&!(l&y.bit))p({op:"swipe",x:m,y:f,x2:m+y.dx*Ol,y2:f+y.dy*Ol,duration:0.08});l=g,u={x:m,y:f}},key(m,f){let g=lm(f);if(g!==null)p({op:"key",usage:g,down:m})},clipboard(m){kl(e,m)},close(){if(l&Gt)p({op:"touch",phase:"up",...u});l=0}}}function um(e,a){let l=null,u="",p,m=(f)=>{zt({payload:{...f,device:e,observe:"none"},root:a}).catch(()=>{})};return{pointer(f,g,b){let y=(b&Gt)!==0;if(y&&!l)l={x:f,y:g,at:Date.now()};if(!y&&l){let h=(Date.now()-l.at)/1000;if(Math.hypot(f-l.x,g-l.y)>sm)m({action:"swipe",x:l.x,y:l.y,x2:f,y2:g,duration:Math.min(Math.max(h,0.05),1)});else m({action:"tap",x:l.x,y:l.y,...h>0.5?{duration:Math.min(h,10)}:{}});l=null}},key(f,g){if(!f)return;let b=g===65293?`
-`:g>=32&&g<=126?String.fromCharCode(g):null;if(b===null)return;u+=b,clearTimeout(p),p=setTimeout(()=>{let y=u;u="",m({action:"type",text:y})},250)},clipboard(f){kl(e,f)},close(){clearTimeout(p),l=null}}}function dm(e,a,l){return new Promise((u,p)=>{let m=Al(e,a,{stdio:"ignore",signal:l});m.once("error",p),m.once("exit",(f)=>u(f??-1))})}async function pm(e,a){let l=em(Pl(nm(),"reason-simulator-stream-"));try{let u=Pl(l,"screen.png");if(await dm("xcrun",["simctl","io",e,"screenshot","--type=png",u],a)!==0)throw new r("simulator_not_booted","That simulator is not booted.");let p=tm(u).subarray(16,24);return{width:p.readUInt32BE(0),height:p.readUInt32BE(4)}}finally{rm(l,{recursive:!0,force:!0})}}async function Tl(e,a={}){let{udid:l,...u}=e.payload;if(typeof l!=="string"||!om.test(l)||!u.video)throw new r("invalid_display_request","Reason simulator stream request is malformed.");let p=await yl().catch(()=>{throw new r("simulator_axe_missing","AXe could not be installed on this Mac.")}),m=await zt({payload:{action:"screenshot",device:l},root:e.root});if(m.error||!m.image)throw new r("simulator_not_booted","That simulator is not booted.");let f={width:m.image.width,height:m.image.height},g=await vo(p),b=g?await Tr(p,l,!0):null,y=g?null:await Xo();if(!g&&!y)throw new r("display_video_unsupported","This Mac can build neither the simulator host nor find an H.264 ffmpeg.");let h={kind:"simulator",udid:l,axe:p,points:f,sound:null,size:g?f:await pm(l,e.signal),stream:g?(w,S,v)=>sl(g,l,Math.min(w,60),v,S):null,input:b?cm(l,b):um(l,e.root)};return await dn({payload:u,signal:e.signal},{...a,video:{desktop:async()=>h,...y?{ffmpeg:()=>y}:{}}})}var Vl=131072,xm=131072,Em=128,zl=8192,Zo=30000,ei=15000,Cm=/^[a-z][a-z0-9_]{0,63}$/,Qr=new Set(["jobs.control","fs.read","fs.write"]),Dl=new Set(["cancelled","run_finished","run_cancelled","driver_handoff","driver_stopped"]);function Vr(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(a)=>`[${a.toLowerCase()}${a.toUpperCase()}]`)}function Nl(e){return e.map(Vr).join("/")}function Vo(e,a){let l=[];for(let u=0;u<e.length;u+=a)l.push(e.slice(u,u+a));return l}var Pm=[...Vo(vt,4).map((e)=>`/(${e.map(Nl).join("|")})(/|$)`),...Vo(Rn,4).map((e)=>`/(${e.map(Nl).join("|")})$`),...Vo([...Tn],6).map((e)=>`/(${e.map(Vr).join("|")})$`),`/${Vr(".env")}\\.[^/]+$`,`/[^/]+(${In.map(Vr).join("|")})$`],Yo=new Set(["add","am","apply","branch","checkout","cherry-pick","clean","commit","merge","mv","rebase","remote","reset","restore","revert","rm","stash","switch","tag"]),Gl=new Set(["blame","diff","for-each-ref","grep","log","ls-files","rev-list","rev-parse","shortlog","show","status"]);function Yl(e){return[e.requiredPermission,...e.additionalPermissions??[]]}function Om(e){return ln(e)}function Ko(){if(G()==="darwin")return Ue("/usr/bin/sandbox-exec");if(G()==="linux"||G()==="win32")return Xn();return!1}function Ml(){if(G()==="linux")return Ue("/proc");if(G()==="win32")return tt()!==null;if(!Ko())return!1;if(G()==="darwin")return Ue("/usr/sbin/lsof");return!1}function en(){return G()==="darwin"?"/bin/zsh":Yn()}function Jo(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function Im(e,a){if(!Jo(e))throw new r("invalid_payload","Operation payload must be an object.");let l=a===rr?jr:Xe;if(Buffer.byteLength(JSON.stringify(e),"utf8")>l)throw new r("payload_too_large",`Operation payload exceeds ${l/1024} KB.`);return e}function Rt(e,a){let l=e[a];if(l===void 0||l===null)return;if(typeof l!=="string")throw new r("invalid_payload",`${a} must be a string.`);return l}function zr(e,a,l=zl){let u=Rt(e,a);if(!u||Buffer.byteLength(u,"utf8")>l||u.includes("\x00"))throw new r("invalid_payload",`${a} is missing or too large.`);return u}function Am(e,a,l){let u=e[a];if(typeof u!=="string"||u.includes("\x00")||Buffer.byteLength(u,"utf8")>l)throw new r("invalid_payload",`${a} is missing or too large.`);return u}function Xt(e,a,l,u){if(e===void 0||e===null)return a;if(typeof e!=="number"||!Number.isInteger(e))throw new r("invalid_payload","Expected a bounded integer.");return Math.min(Math.max(e,l),u)}function lt(e,a){if(G()==="win32")[e,a]=[e.toLowerCase(),a.toLowerCase()];return a===e||a.startsWith(`${e}${vm}`)}function wt(e){if(xc(e))throw new r("protected_path","This path is on Reason's credential denylist. The Mac's owner can allow it with `reason permissions protected allow <path>` or Request permission in Files.")}function le(e){let a;try{a=Ne(e.path)}catch(l){if(process.platform==="darwin"&&So(l))throw Eo(e.path);throw new r("root_unavailable","The granted root is unavailable.")}if(a!==e.path||!Jt(a).isDirectory())throw new r("root_changed","The granted root changed after registration.");return wt(a),a}function ti(e,a="."){if(!a||a.includes("\x00")||wm(a))throw new r("path_outside_root","Paths must be relative to the granted root.");if(G()==="win32"&&a.split(/[\\/]/).some(Yi))throw new r("invalid_path","Windows reserves this file name.");let l=Sm(e,a);if(!lt(e,l))throw new r("path_outside_root","Path escapes the granted root.");return l}function St(e,a=".",l=!1){let u=ti(e,a),p;try{p=Ne(u)}catch(m){if(Zl(m))throw Ql();throw new r("path_not_found","Path does not exist.")}if(!lt(e,p))throw new r("symlink_escape","Path resolves outside the granted root.");if(!l)wt(p);return p}function Lm(e,a){let l=ti(e,a);if(wt(l),Ue(l)){let m=Ne(l);if(!lt(e,m))throw new r("symlink_escape","Write target resolves outside the granted root.");if(zo(l).isSymbolicLink())throw new r("symlink_escape","Writing through a symlink is not allowed.");return wt(m),m}let u=Kt(l);while(!Ue(u)){let m=Kt(u);if(m===u)throw new r("path_outside_root","No safe write parent.");u=m}let p=Ne(u);if(!lt(e,p))throw new r("symlink_escape","Write parent resolves outside the granted root.");return wt(p),l}function Kl(e,a){return Go(e,a)||"."}function km(e,a=Vl){let l=Buffer.from(e,"utf8");if(l.byteLength<=a)return{value:e,truncated:!1};return{value:l.subarray(0,a).toString("utf8"),truncated:!0}}function Xl(e,a){return{...je({home:e,temporaryDirectory:a}),ZDOTDIR:a,BASH_ENV:"/dev/null",ENV:"/dev/null",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_OPTIONAL_LOCKS:"0"}}function Tm(e,a,l,u=!1){return["(version 1)","(deny default)",'(import "system.sb")',"(allow process*)",'(allow file-read* (subpath "/opt/homebrew") (subpath "/usr/local"))',...u?['(allow file-read* (subpath "/dev"))']:[],`(allow file-read* (subpath ${JSON.stringify(e)}))`,`(allow file-read* file-write* (subpath ${JSON.stringify(a)}))`,...l?[`(allow file-write* (subpath ${JSON.stringify(e)}))`]:[],...Pm.map((p)=>`(deny file-read* file-write* (regex #"${p}"))`),...Cc(e,l),"(deny network*)"].join(`
-`)}async function ho(e,a,l){return new Promise((u,p)=>{let m="",f="",g=!1,b=!1,y=!1,h;try{h=Rm(e,a,{cwd:l.cwd,env:l.env,shell:!1,stdio:["ignore","pipe","pipe"],...Me()}),Dt(h)}catch(I){p(I);return}let w=(I,x)=>{if(y)return;y=!0,clearTimeout(R),l.signal.removeEventListener("abort",v),u({exitCode:I,signal:x,stdout:m,stderr:f,timedOut:b,truncated:g})},S=(I,x)=>{let E=`${I}${String(x)}`,O=km(E);return g||=O.truncated,O.value};h.stdout.on("data",(I)=>{m=S(m,I)}),h.stderr.on("data",(I)=>{f=S(f,I)}),h.once("error",p),h.once("exit",w);let v=()=>{try{if(G()==="win32"&&h.pid)Be(h.pid);else h.kill("SIGTERM")}catch{}};l.signal.addEventListener("abort",v,{once:!0});let R=setTimeout(()=>{b=!0,v()},l.timeoutMs)})}var $l=null;function Dm(){return $l??=$a({scrubEnvironment:Xl,spawnCaptured:ho,isProtectedPath:L}),$l}var Gn=async(e,a,l)=>{if(G()==="linux"||G()==="win32")return Dm()(e,a,l);if(G()!=="darwin"||!Ue("/usr/bin/sandbox-exec"))throw new r("sandbox_unavailable","Confined command execution is unavailable on this operating system.");let u=hm(Wl(bm(),"reason-device-"));try{return await ho("/usr/bin/sandbox-exec",["-p",Tm(l.root,u,l.allowWrite,l.allowProcessInspection===!0),e,...a],{cwd:l.cwd,timeoutMs:l.timeoutMs,signal:l.signal,env:Xl(l.root,u)})}finally{_m(u,{recursive:!0,force:!0})}};function Nm(e){let a=e.args;if(a===void 0)return[];if(!Array.isArray(a)||a.length>Em)throw new r("invalid_payload","args must be a bounded string array.");return a.map((l)=>{if(typeof l!=="string"||l.includes("\x00")||Buffer.byteLength(l,"utf8")>zl)throw new r("invalid_payload","Command argument is invalid or too large.");return l})}async function Jl(e,a,l,u={}){if(e.signal.aborted)throw new r("cancelled","Operation was cancelled.");let p=le(e.root),m=u.cwd??p,f=await e.runCommand(a,l,{cwd:m,root:p,allowWrite:u.allowWrite===!0,timeoutMs:u.timeoutMs??ei,signal:e.signal});if(f.exitCode!==0&&/permission denied|operation not permitted|EACCES|EPERM/i.test(f.stderr))await e.emit("permission.denied",{operation:"bash",provenance:e.worker?.executionMode==="unsandboxed"?"os_permission_unknown":"sandbox_policy"});return{exit_code:f.exitCode,signal:f.signal,stdout:f.stdout,stderr:f.stderr,timed_out:f.timedOut,truncated:f.truncated}}function Zl(e){let a=e instanceof Error&&"code"in e?e.code:null;return a==="EACCES"||a==="EPERM"}var Ql=()=>new r("path_unreadable","The path is not readable.");function Mm(e){try{return ql(e,ke.O_RDONLY)}catch(a){throw Zl(a)?Ql():a}}function Bl(e,a){let l=J()?ue():null;return l?vr(l,{op:"fs",capability:e,root:a.root,payload:a.payload},a.signal).then((u)=>u.value):tl(e,a)}function tl(e,a){return e==="fs.read"?$m(a):Fm(a)}async function $m(e){let a=le(e.root),l=St(a,zr(e.payload,"path"));if(!Jt(l).isFile())throw new r("not_a_file","Read target is not a file.");let u=Xt(e.payload.offset,0,0,Number.MAX_SAFE_INTEGER),p=Xt(e.payload.max_bytes,65536,1,Vl),m=Rt(e.payload,"encoding");if(m!==void 0&&m!=="base64")throw new r("invalid_payload","encoding must be base64.");let f=Mm(l),g,b;try{g=jl(f).size;let h=Buffer.alloc(Math.max(0,Math.min(p,g-u)));b=h.subarray(0,h.byteLength?gm(f,h,0,h.byteLength,u):0)}finally{Hl(f)}let y=m==="base64"||b.includes(0);return{path:Kl(a,l),content:y?b.toString("base64"):b.toString("utf8"),encoding:y?"base64":"utf8",offset:u,bytes:b.byteLength,size:g,truncated:u+b.byteLength<g}}function Bm(e,a,l=G()){let u=e==="append"?ke.O_APPEND:ke.O_TRUNC;if(l==="win32")return a?ke.O_WRONLY|(e==="append"?ke.O_APPEND:0):ke.O_WRONLY|ke.O_CREAT|ke.O_EXCL;return ke.O_WRONLY|ke.O_NOFOLLOW|u|(a?0:ke.O_CREAT|ke.O_EXCL)}async function Fm(e){let a=le(e.root),l=zr(e.payload,"path"),u=Am(e.payload,"content",xm),p=Rt(e.payload,"mode")??"overwrite";if(!["create","overwrite","append"].includes(p))throw new r("invalid_payload","mode must be create, overwrite, or append.");let m=Lm(a,l);if(e.payload.create_parents===!0||e.payload.create_directories===!0){fm(Kt(m),{recursive:!0,mode:448});let y=Ne(Kt(m));if(!lt(a,y))throw new r("symlink_escape","Write parent escaped root.")}if(!Ue(Kt(m)))throw new r("path_not_found","Write parent does not exist.");if(p==="create"&&Ue(m))throw new r("path_exists","Create mode will not overwrite an existing file.");let f=Ue(m),g=f?zo(m):null,b=ql(m,Bm(p,f),384);try{let y=jl(b),h=g??(G()==="win32"?zo(m):null);if(h&&(y.ino!==h.ino||y.dev!==h.dev||G()==="win32"&&!lt(a,Ne(m))))throw new r("symlink_escape","The write target changed between validation and opening.");if(G()==="win32"&&g&&p!=="append")mm(b,0);ym(b,u,null,"utf8")}finally{Hl(b)}return{path:Kl(a,m),bytes_written:Buffer.byteLength(u,"utf8"),mode:p}}async function Um(e){let a=le(e.root),l=zr(e.payload,"command",65536),u=St(a,Rt(e.payload,"cwd")??".");if(!Jt(u).isDirectory())throw new r("invalid_cwd","cwd is not a directory.");let p=Xt(e.payload.timeout_ms,ei,100,Zo);return Jl(e,en(),["-lc",l],{cwd:u,allowWrite:e.root.permissions.write,timeoutMs:p})}function ec(e,a){let l=Ge(e,a),u=l.boundary===e?e:St(l.anchor,Go(l.anchor,l.boundary)||".");return{boundary:u,checkout:St(u,Go(u,l.path)||".")}}async function Hm(e){let a=Ua.safeParse(e.payload),l=e.worker;if(!a.success||!e.claimOwner||(l?!l.runtimeDirectory:G()!=="darwin"))throw new r("preview_unavailable","Preview servers are unavailable on this computer.");let u=le(e.root),{boundary:p,checkout:m}=ec(u,a.data.workspace);if(!Jt(m).isDirectory())throw new r("invalid_cwd","The Session checkout is not a directory.");let f=Math.min(Date.parse(a.data.expires_at),Date.now()+Fa);if(!(f>Date.now()))throw new r("process_authority_lost","The preview server lease is unavailable.");let g=(x)=>e.emit("progress",{process:x});if(!l?.runtimeDirectory){if(e.claim.local_github_authority)throw new r("local_device_gh_confinement_unavailable","Only a worker runs a local GitHub Session's dev server.");return{...await Qn({claim:e.claim,root:p,cwd:m,command:a.data.command,mode:"host",shell:dt(),environment:process.env,expiresAtMs:f,signal:e.signal,emit:g})}}let b={directory:Wl(l.runtimeDirectory,"processes")},y={deniedPorts:ni([e.apiOrigin])},h=ai(),w=ci(),S=J(),v=a.data.egress?sn(S):null;if(a.data.egress&&(v===null||!Pe(l.executionMode==="unsandboxed")))throw new r("preview_egress_unavailable","This computer cannot hold a dev server to the run's network allowlist; no command was dispatched.");let R=a.data.egress?await $i(a.data.egress.allowed_domains):null,I=R?[`export ${["HTTP_PROXY","HTTPS_PROXY","http_proxy","https_proxy"].map((x)=>`${x}=${R.url}`).join(" ")}`,"export NO_PROXY=localhost,127.0.0.1,::1 no_proxy=localhost,127.0.0.1,::1 NODE_USE_ENV_PROXY=1",a.data.command].join(`
-`):a.data.command;try{return{...await Qn({claim:e.claim,root:m,cwd:m,command:I,mode:"host",shell:w,expiresAtMs:f,signal:e.signal,emit:g,...S?{jobsUser:{...S,...v!==null?{modelGid:v}:{}}}:{},environment:{...h.variables,HOME:h.home,PATH:h.path,TMPDIR:h.temporaryDirectory,SHELL:w},journals:b,preview:y})}}finally{R?.close()}}async function jm(e){jn();let a=le(e.root),l=qn(e.payload.command),u=St(a,Rt(e.payload,"cwd")??".");if(!Jt(u).isDirectory())throw new r("invalid_cwd","cwd is not a directory.");let p=Xt(e.payload.timeout_ms,ws,100,$n),{ignored:m}=Wn(e.payload.env);return await e.emit("progress",{shell:dt(),shell_flags:[...Ut],sandbox:"none",ignored_env:m}),vs({command:l,cwd:u,timeoutMs:p,signal:e.signal,spawn:e.spawnFullControl,requestEnv:e.payload.env})}async function qm(e){let a=le(e.root),l=Nm(e.payload),u=l[0];if(!u||!Gl.has(u)&&!Yo.has(u))throw new r("git_command_not_allowed","Git subcommand is not in the Device allowlist.");if(l.some((f)=>f==="-C"||f==="-c"||f.startsWith("--git-dir")||f.startsWith("--work-tree")||f.startsWith("--config-env")||f.startsWith("--exec-path")))throw new r("git_argument_not_allowed","Git path/config overrides are not allowed.");let p=Yo.has(u);if(p&&!e.root.permissions.write)throw new r("permission_denied","Mutating Git commands require the write grant.");let m=St(a,Rt(e.payload,"cwd")??".");return Jl(e,"git",["-c","core.hooksPath=/dev/null","-c","credential.helper=",...l],{cwd:m,allowWrite:p||process.platform==="win32"&&e.root.permissions.write,timeoutMs:Xt(e.payload.timeout_ms,ei,100,Zo)})}function tc(e,a){return async(l)=>{let u=await e.runCommand("/usr/sbin/lsof",l,{cwd:a,root:a,allowWrite:!1,allowProcessInspection:!0,timeoutMs:1e4,signal:e.signal});if(e.signal.aborted)throw new r("cancelled","Operation was cancelled.");return u}}async function Wm(e){let a=le(e.root);if(G()==="linux")return ba(a);if(G()==="win32")return sc(a);return xa(a,tc(e,a))}async function Vm(e){let a=le(e.root),l=a;if(e.payload.workspace!==void 0){let u=te(e.payload.workspace);if(!u)throw new r("invalid_workspace","The workspace is not a valid Device workspace.");l=ec(a,u).checkout}if(G()==="linux")return wa(l);if(G()==="win32")return ac(l);return Ea(l,tc(e,a))}async function zm(e){let a=e.worker?Ta(e.worker):null,l=e.claim.environment;delete e.claim.environment;let u=e.worker&&l&&ri({deviceId:e.deviceId},e.root.id,e.runId,l.payload,l.authority)?l.payload:void 0;return e.runHandsRelay({...e.claimedAtMs===void 0?{}:{claimedAtMs:e.claimedAtMs},claimOwner:e.claimOwner,...u?{claimEnvironment:u}:{},localGithubConfinement:Boolean(e.claim.local_github_authority),...e.worker?{headless:!0,runtimeDirectory:e.worker.runtimeDirectory,...e.worker.handsSlots?{handsSlots:e.worker.handsSlots}:{},...e.worker.ownComputer?{ownComputer:!0}:{},hostExecution:e.worker.executionMode==="unsandboxed",...e.worker.executionMode==="unsandboxed"&&e.worker.readiness?.["pty.start"]===!0?{managedPty:{version:1,startupVerified:!0}}:{},deviceIdentity:{deviceId:e.deviceId,rootId:e.root.id,apiOrigin:e.apiOrigin},...a?{desktopRecording:a}:{}}:{},root:le(e.root),runId:e.runId,operationId:e.operationId,attemptId:e.attemptId,payload:e.payload,signal:e.signal,emitEvent:(p,m,f)=>e.emit(p,m,f)})}async function Gm(e){if(e.worker){if(!e.root.permissions.read||!e.root.permissions.write)throw new r("permission_denied","Bound Hands terminals require the workspace read/write grants.");let{workspace:a,session:l}=Wa(e.payload,e.operationId);return rn({root:le(e.root),runId:e.runId,deviceId:e.deviceId,rootId:e.root.id,workspace:a,session:l,owner:e.claimOwner,authority:e.claimAuthority,signal:e.signal,emit:(u,p)=>e.emit(u,p)})}return e.runPtySession({root:le(e.root),runId:e.runId,operationId:e.operationId,payload:e.payload,signal:e.signal,emitEvent:(a,l)=>e.emit(a,l)})}function Fl(e,a){let l=J()?ue():null;return l?vr(l,{op:"transfer",direction:a,root:e.root,payload:e.payload,worker:Boolean(e.worker)},e.signal).then((u)=>u.value):rl(a,{root:e.root,payload:e.payload,signal:e.signal,worker:Boolean(e.worker),fetchImpl:e.fetchImpl,beforeCommit:()=>e.emit("progress",{phase:"file_transfer_verified"})})}async function rl(e,a){let l=le(a.root),u=$t in a.payload;if(u&&!a.worker)throw new r("cloud_copy_workspace_invalid","Only a worker resolves a Cloud copy workspace.");let p=u?us(l,a.payload[$t]):l;if("source"in a.payload||"source_version"in a.payload){if(e!=="export"||!u)throw new r("cloud_copy_source_unsupported","Explicit sources require the private Cloud exporter.");let g=Zi.safeParse(a.payload);if(!g.success)throw new r("invalid_payload","Invalid Cloud export request.");return ds({runtimeRoot:p,source:g.data.source,url:g.data.url,signal:a.signal,fetchImpl:a.fetchImpl})}let m=zr(a.payload,"path",4096),f=e==="import"&&u?Ln(p):p;return wt(ti(f,m)),mt({direction:e,root:f,path:m,payload:a.payload,signal:a.signal,fetchImpl:a.fetchImpl,beforeCommit:a.beforeCommit})}var nc={"inference.custom.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],execute:(e)=>{if(!e.customEndpointCredential||!e.claimOwner)throw new r("custom_endpoint_credential_unavailable","Local model credentials require a signed Device claim.");return _i({payload:e.payload,signal:e.signal,credential:e.customEndpointCredential,emit:(a,l)=>e.emit(a,l,e.signal)})}},"fs.read":{requiredPermission:"read",execute:(e)=>Bl("fs.read",e)},"fs.write":{requiredPermission:"write",execute:(e)=>Bl("fs.write",e)},"fs.export":{requiredPermission:"read",execute:(e)=>Fl(e,"export")},"fs.import":{requiredPermission:"write",execute:(e)=>Fl(e,"import")},"preview.serve.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>G()==="darwin"&&Un(),execute:Hm},"exec.run":{requiredPermission:"execute",available:Ko,execute:Um},"exec.full":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>Un(),execute:jm},"git.run":{requiredPermission:"execute",available:()=>Ko()&&Om("git"),execute:qm},"process.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:Ml,execute:Wm},"ports.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:Ml,execute:Vm},"hands.connect":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>G()==="darwin"||Boolean(ko()),execute:zm},"pty.start":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:Bo,execute:Gm},"display.stream.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:un,execute:(e)=>{let a=ue();return a?vr(a,{op:"display",payload:e.payload,proxy:(e.relay.loadProxy??Se)()},e.signal):dn({payload:e.payload,signal:e.signal},e.relay)}},"automation.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:()=>hr(),execute:(e)=>$o({runId:e.runId,payload:e.payload,signal:e.signal,...e.worker?.userChrome?{userChrome:e.worker.userChrome}:{}})},"simulator.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:Vt,execute:(e)=>zt({payload:e.payload,root:le(e.root)})},"simulator.stream.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:Ll,execute:(e)=>Tl({payload:e.payload,root:le(e.root),signal:e.signal},e.relay)},"jobs.control":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>!0,execute:(e)=>Ja({root:le(e.root),runId:e.runId,payload:e.payload,signal:e.signal})},"github.local.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],available:()=>G()==="darwin"?Ue("/usr/bin/sandbox-exec"):G()==="linux"||G()==="win32",execute:async(e)=>{let a=Ct.parse(e.payload),l=Je.parse(e.claim.local_github_authority);if(l.userId!==e.claimOwner?.user_id||l.deviceId!==e.deviceId||l.rootId!==e.root.id||l.runId!==e.runId||l.repoFullName!==a.repoFullName||!l.readOnly&&!e.root.permissions.write||!Qt(a)&&(l.readOnly||l.generation===null&&!(a.kind==="pr_merge"&&l.merge?.source==="human")&&!(a.kind==="pr_mutation"&&l.contributorRefresh)))throw Error("local_device_gh_authority_changed");return Xa({root:le(e.root),runId:e.runId,request:a,authority:l,signal:e.signal,leaseUntil:e.claim.lease_until},(u)=>ki(a,u))}},"environment.install":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:async(e)=>Qe({root:le(e.root),runId:e.runId,payload:e.payload})},"browser.pr-proof.v1":{requiredPermission:"read",additionalPermissions:["execute"],available:()=>!1,execute:async(e)=>{if(!e.proveMac)throw new r("capability_unsupported","PR proof host is not installed.");return e.proveMac()}},"tunnel.open":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:(e)=>Ga({root:le(e.root),runId:e.runId,owner:e.claimOwner,payload:e.payload,signal:e.signal})},"tunnel.close":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:(e)=>Ka({root:le(e.root),runId:e.runId,owner:e.claimOwner,payload:e.payload,signal:e.signal})},"workspace.setup.v1":{requiredPermission:"execute",additionalPermissions:["read","write"],available:Zr,execute:(e)=>ls(e.payload,e.signal)}};function Ym(e,a){try{let l=Si(e,Ne(a)),u=l?e.find((p)=>p.path===l):void 0;return u&&/^[a-f0-9]{64}$/.test(u.pathFingerprint)?u.pathFingerprint:void 0}catch{return}}function Km(e,a){try{let l=Ne(a);return e.some((u)=>u.path===l)?nr(l,G()):void 0}catch{return}}function Xm(e,a){try{let l=Ne(a),u=e.find((p)=>p.path===l);return u&&/^[a-f0-9]{64}$/.test(u.pathFingerprint)?u.pathFingerprint:void 0}catch{return}}function Jm(e,a){try{let l=Ne(a);if(!e.some((u)=>u.path===l))return;return e.filter((u)=>u.path!==l&&lt(l,u.path)&&/^[a-f0-9]{64}$/.test(u.pathFingerprint)).map((u)=>u.pathFingerprint)}catch{return}}function Kn(e,a,l=G()){try{return ir({home:nr(Ne(a),l),roots:e.map((u)=>({path_fingerprint:u.pathFingerprint,path:nr(u.path,l)})).filter((u)=>/^[a-f0-9]{64}$/.test(u.path_fingerprint)&&tr(u.path)).slice(0,Yr)})}catch{return}}function fo(e,a={}){let l=a.worker?a.worker.handsSlots??1:a.handsSlots===1?1:void 0,u=Boolean(a.worker)||G()==="darwin",p=u?Xm(e,Yt()):void 0,m=!a.worker&&G()==="darwin"?Ym(e,Yt()):void 0,f=u?Km(e,Yt()):void 0,g=!a.worker&&G()==="darwin"?Jm(e,Yt()):void 0,b=u?Kn(e,Yt()):void 0,y=Mn.filter((h)=>{if(Ft.has(h)&&!a.worker)return!1;if(a.worker&&!Rr(h,a.worker))return!1;let w=nc[h];if(!w)return!1;return(h==="hands.connect"&&(a.terminalOnlyHands===!0||Boolean(a.worker))||(h==="pty.start"||h==="preview.serve.v1")&&Boolean(a.worker)||h==="browser.pr-proof.v1"&&Boolean(a.productionProof)?!0:w.available?.()??!0)&&e.some((v)=>(!a.worker||h!=="pty.start"||v.permissions.read&&v.permissions.write)&&Yl(w).every((R)=>v.permissions[R]))});return{supported_operations:y,...p?{account_root_fingerprint:p}:{},...m?{workspace_root_fingerprint:m}:{},...f?{account_root_path:f}:{},...g?{home_contained_root_fingerprints:g}:{},...b?{root_paths:b}:{},...y.includes("hands.connect")?{hands_worker_artifact_sha256:T,hands_worker_entrypoint:H,...l?{hands_slots:l}:{}}:{},max_payload_bytes:Xe,max_result_bytes:Xe,operation_constraints:{...y.includes("browser.pr-proof.v1")&&a.productionProof?{"browser.pr-proof.v1":an.parse(a.productionProof)}:{},...y.includes("exec.run")?{"exec.run":{transport:"shell",shell:en(),sandbox:G()==="linux"?"linux_sandbox_runtime":G()==="win32"?"windows_srt":"macos_seatbelt",network:!1,max_timeout_ms:Zo}}:{},...y.includes("exec.full")?{"exec.full":xs()}:{},"git.run":{read_only_subcommands:[...Gl].sort(),mutating_subcommands:[...Yo].sort(),push:!1,credential_helpers:!1},"fs.export":{transport:"https_signed_url",max_bytes:qe,max_timeout_ms:Mt,result:"sha256_and_size"},"fs.import":{transport:"https_signed_url",max_bytes:qe,max_timeout_ms:Mt,atomic:!0,overwrite:!1},"hands.connect":{transport:"wss_relay",worker:"ara_hands",worker_version:U,protocol_version:F,worker_artifact_sha256:T,worker_entrypoint:H,policy_mode:"full_access",policy_version:1,workspace_base:at,workspace_layout:Oe,...l?{slots:l}:{},browser_state:a.worker?"optional_headless":a.terminalOnlyHands===!0?"disabled_terminal_only":G()==="darwin"?"optional_isolated_per_session":"isolated_per_session",max_session_ms:43200000},...y.includes("pty.start")?{"pty.start":{transport:"wss_relay",shell:"login_shell",resize:!0,slots:wi,max_session_ms:yi,max_buffered_output_bytes:pn}}:{},...a.worker?Object.fromEntries(y.filter((h)=>h!=="browser.pr-proof.v1").map((h)=>[h,{ready:a.worker?.readiness?.[h]===!0,...a.worker?.readiness?.[h]!==!0&&a.worker?.probing?.includes(h)?{probing:!0}:{},execution_mode:Rr(h,{...a.worker,executionMode:"sandboxed"})?"confined":"host",...h==="pty.start"?{transport:"wss_relay",worker:"ara_hands",shell:"bound_job",protocol_version:_n,environment:"private_snapshot",receipt:"metadata_only",...a.worker?.persistentTerminals&&!J()?{persistent_terminals:!0}:{}}:{},...h===rr?{max_body_bytes:Fr}:{},...h==="github.local.v1"?{contributor_attribution:2,prepare_diagnostics:1,...a.worker?.githubSignedIn!==void 0?{gh_authenticated:a.worker.githubSignedIn}:{}}:{},...h==="hands.connect"?{transport:"wss_relay",worker:"ara_hands",slots:l,session_group:zs,...a.worker?.ownComputer?{[qs]:Ws}:{},workspace_base:at,workspace_layout:Oe,browser_state:"optional_headless",desktop:!1,worker_version:U,protocol_version:F,...a.worker?.readiness?.["environment.install"]===!0&&y.includes("environment.install")?{environment_delivery:ks,[Rs]:Ps}:{},...a.worker?{[Os]:Ds}:{},...a.worker?{[Is]:Ts}:{},...a.worker?.handsBrowser?{[Bs]:Ms}:{},[$s]:Ls,[js]:Fs,...Pe(a.worker?.executionMode==="unsandboxed")?{[Le]:ct}:{},...Pe(a.worker?.executionMode==="unsandboxed")&&sn()!==null?{[xe]:Pt}:{},...Pe(a.worker?.executionMode==="unsandboxed")&&J()?{[Us]:Hs}:{}}:{},...h==="fs.export"?{cloud_source_version:fr,source_kinds:["workspace","attachment"],[gn]:yn}:{},...h==="fs.import"?{[gn]:yn}:{},...h===Ba&&sn()!==null&&Pe(a.worker?.executionMode==="unsandboxed")?{[Ha]:_o}:{},...h==="tunnel.open"?{carried_jobs:Vs}:{},...h==="jobs.control"?{[Ks]:Gs}:{},...h==="display.stream.v1"&&a.worker?.displayVideo?{[Rc]:Pc,[Tc]:Ar.join(","),[Ic]:Dc,[Oc]:Nc,[Lc]:$c}:{},...h==="automation.call.v1"&&a.worker?.userChrome?{[$r]:!0}:{},...h==="automation.call.v1"&&a.worker?.cloudSessions?{[Js]:!0}:{}}])):{}}}}function ri(e,a,l,u,p){let m=oi.safeParse(u);return m.success&&p!==void 0&&p.device_id===e.deviceId&&m.data.device_id===e.deviceId&&m.data.root_id===a&&m.data.run_id===l&&m.data.binding.kind===p.binding&&m.data.binding.target_revision===p.target_revision&&m.data.binding.root_grant_revision===p.root_grant_revision&&m.data.binding.target_generation===p.target_generation&&m.data.binding.target_fence_id===p.target_fence_id}async function mo(e,a,l,u,p){if(a.capability!=="hands.connect"||l.kind!==Lr||!u.operationEnvironment||!u.acknowledgeOperationEnvironment)return!1;let m=l.payload.snapshot_id;if(l.payload.version!==1||typeof m!=="string"||Object.keys(l.payload).length!==2)throw new r("environment_unavailable","Reason sent an invalid environment delivery.");let f=e.roots.find((y)=>y.id===a.root_id);if(!f)throw new r("root_not_granted","The Hands root is no longer granted.");let g=await u.operationEnvironment(e,a,m,p);if(!ri(e,f.id,a.run_id,g.payload,g.authority)||g.payload.snapshot_id!==m)throw new r("environment_unavailable","The delivered environment does not match this Hands.");let b=Qe({root:le(f),operationId:a.operation_id,payload:g.payload});return await u.acknowledgeOperationEnvironment(e,a,{snapshot_id:b.snapshot_id,installed_revision:b.installed_revision,installed:!0},p),!0}async function go(e,a,l,u){if(a.capability!=="hands.connect"||l.kind!==Ns)return!1;let{version:p,run_id:m,target_generation:f,target_fence_id:g}=l.payload;if(p!==1||Object.keys(l.payload).length!==4||typeof m!=="string"||typeof f!=="number"||typeof g!=="string")throw new r("hands_rebind_unavailable","Reason sent an invalid Hands rebind.");let b=e.roots.find((y)=>y.id===a.root_id);if(!b)throw new r("root_not_granted","The Hands root is no longer granted.");return await Va({operationId:a.operation_id,root:le(b),runId:m,targetGeneration:f,fenceId:g,...u?{signal:u}:{}}),!0}async function Jn(e,a,l){if(a.capability!=="github.local.v1")return Ul(e,a,l);try{let u=await Ul(e,a,l);if(u.status==="succeeded"||bs(a.payload,u.status,u.error_code))return u;return{status:u.status,error_code:u.status==="cancelled"?"operation_cancelled":"local_github_unavailable"}}catch{return{status:l.signal.aborted?"cancelled":"failed",error_code:l.signal.aborted?"operation_cancelled":"local_github_unavailable"}}}async function Ul(e,a,l){if(Ft.has(a.capability)&&!l.worker)return{status:"failed",error_code:"capability_not_granted"};if(l.worker&&!Rr(a.capability,l.worker))return{status:"failed",error_code:"capability_not_granted"};if(l.worker&&l.worker.readiness?.[a.capability]!==!0)return{status:"failed",error_code:"capability_unavailable"};if(a.local_github_authority){let h=Je.safeParse(a.local_github_authority);if(!h.success||h.data.deviceId!==e.deviceId||h.data.rootId!==a.root_id||h.data.runId!==a.run_id||h.data.userId!==a.owner?.user_id||!["github.local.v1","hands.connect","environment.install","jobs.control","preview.serve.v1"].includes(a.capability))return{status:"failed",error_code:"local_device_gh_capability_denied"}}let u=nc[a.capability];if(!u)return{status:"failed",error_code:"capability_unsupported"};if(u.available&&!u.available()&&!(["hands.connect","pty.start","preview.serve.v1"].includes(a.capability)&&l.worker)&&!l.runCommand&&!l.runHandsRelay&&!l.spawnFullControl&&!l.runPtySession&&!(a.capability==="browser.pr-proof.v1"&&l.proveMac))return{status:"failed",error_code:"capability_unavailable"};if(a.protocol_version!==2)return{status:"failed",error_code:"protocol_unsupported"};let p=e.roots.find((h)=>h.id===a.root_id);if(!p)return{status:"failed",error_code:"root_not_granted"};if((a.capability==="fs.export"||a.capability==="fs.import")&&Jo(a.payload)&&(("source"in a.payload)||("source_version"in a.payload))){let h=Boolean(l.worker||e.worker)&&$t in a.payload;if(a.capability!=="fs.export"||!h)return{status:"failed",error_code:"cloud_copy_source_unsupported"}}if(a.owner&&(a.owner.device_id!==e.deviceId||a.owner.organization_id!==e.orgId))return{status:"failed",error_code:"capability_not_granted"};if((a.capability==="tunnel.open"||a.capability==="tunnel.close")&&!a.owner)return{status:"failed",error_code:"preview_unavailable"};if(a.capability==="environment.install"&&!ri(e,p.id,a.run_id,a.payload,a.authority))return{status:"failed",error_code:"environment_unavailable"};if(Yl(u).some((h)=>!p.permissions[h]))return{status:"failed",error_code:"permission_denied"};let m=0,f=async(h,w,S)=>{if(["environment.install","github.local.v1"].includes(a.capability)||a.capability==="inference.custom.v1"&&(h==="started"||h==="completed"))return;await l.emit?.({sequence:m++,kind:h,capability:a.capability,data:w,...(h==="hands.reconnected"||a.capability==="inference.custom.v1")&&S?{deliverySignal:S}:{}})},g=a.capability==="hands.connect"||a.capability==="display.stream.v1"||a.capability==="simulator.stream.v1"||Qr.has(a.capability)||a.capability==="pty.start",b,y=async(h,w,S)=>{let v=b;b=void 0,await Promise.all([v,f(h,w,S)])};try{if(g)b=f("started"),b.catch(()=>{return});else await f("started");let h={...l.proxy===void 0?{}:{loadProxy:()=>l.proxy??null},...l.handsLaunch?.takePrespawnedWorker?{takePrespawnedWorker:l.handsLaunch.takePrespawnedWorker}:{},...l.handsLaunch?.adoptSpawnedWorker?{adoptSpawnedWorker:l.handsLaunch.adoptSpawnedWorker}:{}},w=await u.execute({...l.proveMac?{proveMac:()=>l.proveMac(a,l.signal,(S)=>f("pr-proof.started.v1",S))}:{},claim:a,worker:l.worker,claimOwner:a.owner,claimAuthority:a.authority,organizationId:e.orgId,deviceId:e.deviceId,apiOrigin:e.apiOrigin,root:p,payload:Im(a.payload,a.capability),runId:a.run_id,operationId:a.operation_id,attemptId:a.attempt_id,...l.handsLaunch?{claimedAtMs:l.handsLaunch.claimedAtMs}:{},signal:l.signal,...l.customEndpointCredential?{customEndpointCredential:l.customEndpointCredential}:{},fetchImpl:l.fetchImpl??fetch,relay:h,runCommand:l.runCommand??Gn,spawnFullControl:l.spawnFullControl??ho,emit:g?y:f,runHandsRelay:l.runHandsRelay??((S)=>et(S,h)),runPtySession:l.runPtySession??Fo});if(a.capability==="github.local.v1")Vc.parse(w);if(!Jo(w))throw new r("invalid_result","Operation result must be a JSON object.");if(Buffer.byteLength(JSON.stringify(w)??"null","utf8")>Xe)throw new r("result_too_large","Operation result exceeds 256 KB.");return await(g?y:f)("completed",{ok:!0}),{status:"succeeded",result:w,error_code:null}}catch(h){let w=l.signal.reason instanceof r&&Dl.has(l.signal.reason.code)?l.signal.reason.code:h instanceof r&&Dl.has(h.code)?h.code:null;if(l.signal.aborted||w)return{status:"cancelled",...h instanceof lr?{result:{process_terminal_observation:h.observation}}:{},error_code:["environment.install","github.local.v1","inference.custom.v1"].includes(a.capability)?"operation_cancelled":w??"cancelled"};if(["fs.read","fs.write"].includes(a.capability)&&h instanceof Error&&"code"in h&&["EACCES","EPERM"].includes(String(h.code)))await f("permission.denied",{operation:a.capability==="fs.read"?"read":"write",provenance:"os_permission_unknown"});let S=a.capability==="inference.custom.v1"?h instanceof r&&Hr(h.code)?h.code:"custom_endpoint_unavailable":a.capability==="github.local.v1"?h instanceof Bn&&bs(a.payload,"failed",h.code)?h.code:"local_github_unavailable":a.capability==="environment.install"?"environment_install_failed":h instanceof r&&Cm.test(h.code)?h.code:"capability_failed",v=a.capability==="hands.connect"&&h instanceof di?Ya(h.expiryDiagnostic):null;return await f("completed",{ok:!1,error_code:S,...v?{expiry_diagnostic:v}:{}}),{status:"failed",error_code:S}}}
-export{Ia,k,or,sr,ee,ar,lo,uo,Zr,dt,po,Qr,en,ho,Gn,tl,rl,Kn,fo,mo,go,Jn};
+}`;async function Co(e,a,l){let u=await fe("sips",["-g","pixelWidth","-g","pixelHeight",e],"Reading the frame size"),p=Number(u.match(/pixelWidth: ([\d.]+)/)?.[1]),m=Number(u.match(/pixelHeight: ([\d.]+)/)?.[1]);if(l!==void 0)p=p*l/m,m=l;let f=Do(K(fl(),"reason-chrome-"));try{let g=K(f,"render.js"),b=K(f,"out.png");if(gp(g,Xp),await fe("osascript",["-l","JavaScript",g,e,b,String(Math.max(1,Math.round(p*a))),String(Math.max(1,Math.round(m*a)))],"Rendering the frame"),!Ae(b))Q("simulator_command_failed",`Rendering ${hl(e)} produced no image.`);return{image:No(b).toString("base64"),width:p,height:m}}finally{Wt(f,{recursive:!0,force:!0})}}async function Jp(e){if(!Ao.has(e.udid))await Uo();let a=Ao.get(e.udid),u=JSON.parse(await fe("xcrun",["simctl","list","devicetypes","-j"],"Listing device types")).devicetypes?.find((p)=>p.identifier===a)?.bundlePath;if(!u)Q("simulator_command_failed",`No device type bundle for ${e.name}.`);return u}async function Zp(e){let a=await Jp(e),l=Ur.get(e.udid)??(e.state==="booted"?(await qo(e),Ur.get(e.udid)):void 0);if(!l)Q("simulator_not_booted",`${e.name} is not booted.`);let u=ml.get(a);if(u)return{text:`Frame of ${ae(e)}.`,device:e,chrome:u};let p=K(a,"Contents","Resources"),m=JSON.parse(await fe("plutil",["-convert","json","-o","-",K(p,"profile.plist")],"Reading the device profile")),f=m.framebufferMask?K(p,`${m.framebufferMask}.pdf`):null,g=f&&Ae(f)?await Co(f,So,l.height):null,b=m.chromeIdentifier?.split(".").pop(),y=b?K("/Library/Developer/DeviceKit/Chrome",`${b}.devicechrome`,"Contents","Resources"):"";if(!b||!Ae(K(y,"chrome.json")))Q("simulator_command_failed",`${e.name} has no device frame in this Xcode.`);let h=JSON.parse(No(K(y,"chrome.json"),"utf8")),w={};for(let O of Kp){let D=h.images[O];if(!D)Q("simulator_command_failed",`${e.name}'s frame has no ${O} piece.`);w[O]=await Co(K(y,`${D}.pdf`),So)}let{sizing:S}=h.images,v={top:S.topHeight,left:S.leftWidth,bottom:S.bottomHeight,right:S.rightWidth},R=l.width+v.left+v.right,I=l.height+v.top+v.bottom,x=[];for(let O of h.inputs??[]){let D=K(y,`${O.image}.pdf`);if(!Ae(D))continue;let B=await Co(D,So),{x:ne,y:de}=O.offsets.normal,he=(Ke,ce,Zt)=>Ke<0?ce+Ke-Zt:Ke,We=O.anchor==="left"?{x:ne-B.width,y:he(de,I,B.height)}:O.anchor==="right"?{x:R+ne,y:he(de,I,B.height)}:O.anchor==="top"?{x:he(ne,R,B.width),y:de-B.height}:{x:he(ne,R,B.width),y:I+de};x.push({name:O.name,image:B.image,...We,width:B.width,height:B.height})}let E={identifier:h.identifier,screen:{width:l.width,height:l.height},inset:v,padding:h.images.devicePadding??{top:0,left:0,bottom:0,right:0},pieces:w,buttons:x,...g?{screen_mask:g.image}:{}};return ml.set(a,E),{text:`Frame of ${ae(e)}.`,device:e,chrome:E}}var Qp=new Set(["simulator_command_failed","simulator_launch_failed","simulator_point_off_screen","simulator_build_no_scheme","simulator_element_not_found","simulator_path_outside_root","simulator_project_not_found"]);async function zt(e){try{return await Cl(e)}catch(a){if(a instanceof r&&Qp.has(a.code))return{text:a.message,error:a.code};throw a}}async function Cl(e){if(!Vt())Q("simulator_xcode_missing","Xcode's iOS Simulator is not available on this Mac.");let a=io.safeParse(e.payload);if(!a.success)Q("simulator_invalid_request",a.error.issues.map((u)=>u.message).join("; "));let l=a.data;switch(l.action){case"devices":{let u=await Uo(),p=u.filter((m)=>m.state==="booted");return{text:`${p.length} booted (${p.map(ae).join(", ")||"none"}), ${u.length} available.`,devices:u}}case"boot":{let u=await Pp(await be(l.device,{booted:!1}));return{text:`${ae(u)} is booted.`,device:u}}case"shutdown":{let u=await be(l.device,{booted:!1});Ye.get(u.udid)?.stop(),Ye.delete(u.udid);let p=await bt("xcrun",["simctl","shutdown",u.udid]);if(p.code!==0&&!/current state: Shutdown/i.test(p.stderr))Q("simulator_command_failed",p.stderr.trim().slice(-1000));return{text:`${ae(u)} is shut down.`,device:{...u,state:"shutdown"}}}case"build":{let u=await ll(l,e.root);return l.wait&&u.build?Ro(u.build.id):u}case"build_status":return l.wait?Ro(l.build_id):vl(l.build_id);case"run":{let u=await ll({...l,action:"build"},e.root),p=await Ro(u.build.id,Np);if(p.build?.status!=="succeeded"||!p.build.app_path)return p;let m=await Cl({root:e.root,payload:{action:"launch",app_path:p.build.app_path,...l.device?{device:l.device}:{},...l.steps?{steps:l.steps}:{},...l.observe?{observe:l.observe}:{},...l.wait_for?{wait_for:l.wait_for}:{},...l.timeout!==void 0?{timeout:l.timeout}:{}}});return{...m,text:`Built in ${Math.round(p.build.elapsed_ms/1000)} s. ${m.text}`,build:p.build}}case"launch":{let u=await $p(l,e.root);if(!u.device)return u;if(l.steps?.length)u.text+=` ${await _t(u.device,l.steps,l.timeout??8)}`;else if(!l.wait_for)await Bun.sleep(1000);return st(u.device,l,u)}case"steps":{let u=await be(l.device,{booted:!0});return st(u,l,{text:await _t(u,l.steps,l.timeout??5),device:u})}case"terminate":{let u=await be(l.device,{booted:!0});if(Ye.get(u.udid)?.bundleId===l.bundle_id)Ye.get(u.udid)?.stop();return await bt("xcrun",["simctl","terminate",u.udid,l.bundle_id]),{text:`Terminated ${l.bundle_id} on ${ae(u)}.`,device:u}}case"logs":return Fp(await be(l.device,{booted:!1}),l.after);case"screenshot":return qo(await be(l.device,{booted:!0}),l.scale,l.save_path?Ho(e.root,l.save_path):void 0);case"chrome":return Zp(await be(l.device,{booted:!1}));case"inspect":return Hp(await be(l.device,{booted:!0}));case"tap":{let u=await be(l.device,{booted:!0}),p=l.x!==void 0&&l.y!==void 0;if(p)cl(u,[l.x,l.y]);await _t(u,[p?{action:"tap",x:l.x,y:l.y,...l.duration&&l.duration>0?{duration:l.duration}:{}}:l.id?{action:"tap",id:l.id}:{action:"tap",label:l.label}],3);let m=p?`(${l.x}, ${l.y})`:l.id?`id ${l.id}`:`"${l.label}"`;return st(u,l,{text:`Tapped ${m} on ${ae(u)}.`,device:u})}case"swipe":{let u=await be(l.device,{booted:!0});return cl(u,[l.x,l.y],[l.x2,l.y2]),await _t(u,[{action:"swipe",x:l.x,y:l.y,x2:l.x2,y2:l.y2,...l.duration!==void 0?{duration:l.duration}:{}}],3),st(u,l,{text:`Swiped (${l.x}, ${l.y}) \u2192 (${l.x2}, ${l.y2}) on ${ae(u)}.`,device:u})}case"type":{let u=await be(l.device,{booted:!0});return await _t(u,[{action:"type",text:l.text}],3),st(u,l,{text:`Typed ${l.text.length} character(s) on ${ae(u)}.`,device:u})}case"button":{let u=await be(l.device,{booted:!0});return await _t(u,[{action:"button",name:l.name}],3),st(u,l,{text:`Pressed ${l.name} on ${ae(u)}.`,device:u})}case"open_url":{let u=await be(l.device,{booted:!0}),p;try{p=new URL(l.url)}catch{Q("simulator_invalid_request","open_url needs an absolute URL.")}if(xp.has(p.protocol))Q("simulator_invalid_request",`${p.protocol} URLs are not allowed.`);return await fe("xcrun",["simctl","openurl",u.udid,p.href],"Opening the URL"),st(u,l,{text:`Opened ${p.href} on ${ae(u)}.`,device:u})}case"appearance":{let u=await be(l.device,{booted:!0});return await fe("xcrun",["simctl","ui",u.udid,"appearance",l.mode],"Setting the appearance"),{text:`${ae(u)} is in ${l.mode} mode.`,device:u}}}}import{mkdtempSync as em,readFileSync as tm,rmSync as rm}from"fs";import{tmpdir as nm}from"os";import{join as Pl}from"path";import{spawn as Al}from"child_process";var om=/^[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}$/i,Gt=1,im=[{bit:8,dx:0,dy:1},{bit:16,dx:0,dy:-1},{bit:32,dx:1,dy:0},{bit:64,dx:-1,dy:0}],Ol=60,sm=8,Ll=Vt;var Il={65293:40,65421:40,65307:41,65288:42,65289:43,65535:76,65360:74,65367:77,65365:75,65366:78,65361:80,65362:82,65363:79,65364:81,65505:225,65506:229,65507:224,65508:228,65513:226,65514:230,65515:227,65516:231,65511:227,65512:231,65509:57},am=(()=>{let e={" ":44};"abcdefghijklmnopqrstuvwxyz".split("").forEach((l,u)=>{e[l]=4+u,e[l.toUpperCase()]=4+u}),"1234567890".split("").forEach((l,u)=>{e[l]=30+u}),"!@#$%^&*()".split("").forEach((l,u)=>{e[l]=30+u});let a=[["-","_",45],["=","+",46],["[","{",47],["]","}",48],["\\","|",49],[";",":",51],["'",'"',52],["`","~",53],[",","<",54],[".",">",55],["/","?",56]];for(let[l,u,p]of a)e[l]=p,e[u]=p;return e})();function lm(e){if(Il[e]!==void 0)return Il[e];return e>=32&&e<=126?am[String.fromCharCode(e)]??null:null}function kl(e,a){let l=Al("xcrun",["simctl","pbcopy",e],{stdio:["pipe","ignore","ignore"]});l.once("error",()=>{}),l.stdin.end(a)}function cm(e,a){let l=0,u={x:0,y:0},p=(m)=>{a.call(m).catch(()=>{})};return{pointer(m,f,g){let b=(g&Gt)!==0;if(b&&!(l&Gt))p({op:"touch",phase:"down",x:m,y:f});else if(b&&(m!==u.x||f!==u.y))p({op:"touch",phase:"move",x:m,y:f});else if(!b&&l&Gt)p({op:"touch",phase:"up",x:m,y:f});for(let y of im)if(g&y.bit&&!(l&y.bit))p({op:"swipe",x:m,y:f,x2:m+y.dx*Ol,y2:f+y.dy*Ol,duration:0.08});l=g,u={x:m,y:f}},key(m,f){let g=lm(f);if(g!==null)p({op:"key",usage:g,down:m})},clipboard(m){kl(e,m)},close(){if(l&Gt)p({op:"touch",phase:"up",...u});l=0}}}function um(e,a){let l=null,u="",p,m=(f)=>{zt({payload:{...f,device:e,observe:"none"},root:a}).catch(()=>{})};return{pointer(f,g,b){let y=(b&Gt)!==0;if(y&&!l)l={x:f,y:g,at:Date.now()};if(!y&&l){let h=(Date.now()-l.at)/1000;if(Math.hypot(f-l.x,g-l.y)>sm)m({action:"swipe",x:l.x,y:l.y,x2:f,y2:g,duration:Math.min(Math.max(h,0.05),1)});else m({action:"tap",x:l.x,y:l.y,...h>0.5?{duration:Math.min(h,10)}:{}});l=null}},key(f,g){if(!f)return;let b=g===65293?`
+`:g>=32&&g<=126?String.fromCharCode(g):null;if(b===null)return;u+=b,clearTimeout(p),p=setTimeout(()=>{let y=u;u="",m({action:"type",text:y})},250)},clipboard(f){kl(e,f)},close(){clearTimeout(p),l=null}}}function dm(e,a,l){return new Promise((u,p)=>{let m=Al(e,a,{stdio:"ignore",signal:l});m.once("error",p),m.once("exit",(f)=>u(f??-1))})}async function pm(e,a){let l=em(Pl(nm(),"reason-simulator-stream-"));try{let u=Pl(l,"screen.png");if(await dm("xcrun",["simctl","io",e,"screenshot","--type=png",u],a)!==0)throw new r("simulator_not_booted","That simulator is not booted.");let p=tm(u).subarray(16,24);return{width:p.readUInt32BE(0),height:p.readUInt32BE(4)}}finally{rm(l,{recursive:!0,force:!0})}}async function Tl(e,a={}){let{udid:l,...u}=e.payload;if(typeof l!=="string"||!om.test(l)||!u.video)throw new r("invalid_display_request","Reason simulator stream request is malformed.");let p=await yl().catch(()=>{throw new r("simulator_axe_missing","AXe could not be installed on this Mac.")}),m=await zt({payload:{action:"screenshot",device:l},root:e.root});if(m.error||!m.image)throw new r("simulator_not_booted","That simulator is not booted.");let f={width:m.image.width,height:m.image.height},g=await bo(p),b=g?await Tr(p,l,!0):null,y=g?null:await Yo();if(!g&&!y)throw new r("display_video_unsupported","This Mac can build neither the simulator host nor find an H.264 ffmpeg.");let h={kind:"simulator",udid:l,axe:p,points:f,sound:null,size:g?f:await pm(l,e.signal),stream:g?(w,S,v)=>sl(g,l,Math.min(w,60),v,S):null,input:b?cm(l,b):um(l,e.root)};return await pn({payload:u,signal:e.signal},{...a,video:{desktop:async()=>h,...y?{ffmpeg:()=>y}:{}}})}var Vl=131072,xm=131072,Em=128,zl=8192,Jo=30000,Zo=15000,Cm=/^[a-z][a-z0-9_]{0,63}$/,Qr=new Set(["jobs.control","fs.read","fs.write"]),Dl=new Set(["cancelled","run_finished","run_cancelled","driver_handoff","driver_stopped"]);function Vr(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(a)=>`[${a.toLowerCase()}${a.toUpperCase()}]`)}function Nl(e){return e.map(Vr).join("/")}function Wo(e,a){let l=[];for(let u=0;u<e.length;u+=a)l.push(e.slice(u,u+a));return l}var Pm=[...Wo(vt,4).map((e)=>`/(${e.map(Nl).join("|")})(/|$)`),...Wo(Tn,4).map((e)=>`/(${e.map(Nl).join("|")})$`),...Wo([...In],6).map((e)=>`/(${e.map(Vr).join("|")})$`),`/${Vr(".env")}\\.[^/]+$`,`/[^/]+(${Dn.map(Vr).join("|")})$`],Go=new Set(["add","am","apply","branch","checkout","cherry-pick","clean","commit","merge","mv","rebase","remote","reset","restore","revert","rm","stash","switch","tag"]),Gl=new Set(["blame","diff","for-each-ref","grep","log","ls-files","rev-list","rev-parse","shortlog","show","status"]);function Yl(e){return[e.requiredPermission,...e.additionalPermissions??[]]}function Om(e){return un(e)}function Ko(){if(G()==="darwin")return Ue("/usr/bin/sandbox-exec");if(G()==="linux"||G()==="win32")return Yn();return!1}function Ml(){if(G()==="linux")return Ue("/proc");if(G()==="win32")return tt()!==null;if(!Ko())return!1;if(G()==="darwin")return Ue("/usr/sbin/lsof");return!1}function en(){return G()==="darwin"?"/bin/zsh":Zn()}function Xo(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function Im(e,a){if(!Xo(e))throw new r("invalid_payload","Operation payload must be an object.");let l=a===rr?jr:Xe;if(Buffer.byteLength(JSON.stringify(e),"utf8")>l)throw new r("payload_too_large",`Operation payload exceeds ${l/1024} KB.`);return e}function Rt(e,a){let l=e[a];if(l===void 0||l===null)return;if(typeof l!=="string")throw new r("invalid_payload",`${a} must be a string.`);return l}function zr(e,a,l=zl){let u=Rt(e,a);if(!u||Buffer.byteLength(u,"utf8")>l||u.includes("\x00"))throw new r("invalid_payload",`${a} is missing or too large.`);return u}function Am(e,a,l){let u=e[a];if(typeof u!=="string"||u.includes("\x00")||Buffer.byteLength(u,"utf8")>l)throw new r("invalid_payload",`${a} is missing or too large.`);return u}function Xt(e,a,l,u){if(e===void 0||e===null)return a;if(typeof e!=="number"||!Number.isInteger(e))throw new r("invalid_payload","Expected a bounded integer.");return Math.min(Math.max(e,l),u)}function lt(e,a){if(G()==="win32")[e,a]=[e.toLowerCase(),a.toLowerCase()];return a===e||a.startsWith(`${e}${vm}`)}function wt(e){if(xc(e))throw new r("protected_path","This path is on Reason's credential denylist. The Mac's owner can allow it with `reason permissions protected allow <path>` or Request permission in Files.")}function le(e){let a;try{a=Ne(e.path)}catch(l){if(process.platform==="darwin"&&Eo(l))throw ko(e.path);throw new r("root_unavailable","The granted root is unavailable.")}if(a!==e.path||!Jt(a).isDirectory())throw new r("root_changed","The granted root changed after registration.");return wt(a),a}function Qo(e,a="."){if(!a||a.includes("\x00")||wm(a))throw new r("path_outside_root","Paths must be relative to the granted root.");if(G()==="win32"&&a.split(/[\\/]/).some(Zi))throw new r("invalid_path","Windows reserves this file name.");let l=Sm(e,a);if(!lt(e,l))throw new r("path_outside_root","Path escapes the granted root.");return l}function St(e,a=".",l=!1){let u=Qo(e,a),p;try{p=Ne(u)}catch(m){if(Zl(m))throw Ql();throw new r("path_not_found","Path does not exist.")}if(!lt(e,p))throw new r("symlink_escape","Path resolves outside the granted root.");if(!l)wt(p);return p}function Lm(e,a){let l=Qo(e,a);if(wt(l),Ue(l)){let m=Ne(l);if(!lt(e,m))throw new r("symlink_escape","Write target resolves outside the granted root.");if(Vo(l).isSymbolicLink())throw new r("symlink_escape","Writing through a symlink is not allowed.");return wt(m),m}let u=Kt(l);while(!Ue(u)){let m=Kt(u);if(m===u)throw new r("path_outside_root","No safe write parent.");u=m}let p=Ne(u);if(!lt(e,p))throw new r("symlink_escape","Write parent resolves outside the granted root.");return wt(p),l}function Kl(e,a){return zo(e,a)||"."}function km(e,a=Vl){let l=Buffer.from(e,"utf8");if(l.byteLength<=a)return{value:e,truncated:!1};return{value:l.subarray(0,a).toString("utf8"),truncated:!0}}function Xl(e,a){return{...je({home:e,temporaryDirectory:a}),ZDOTDIR:a,BASH_ENV:"/dev/null",ENV:"/dev/null",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_OPTIONAL_LOCKS:"0"}}function Tm(e,a,l,u=!1){return["(version 1)","(deny default)",'(import "system.sb")',"(allow process*)",'(allow file-read* (subpath "/opt/homebrew") (subpath "/usr/local"))',...u?['(allow file-read* (subpath "/dev"))']:[],`(allow file-read* (subpath ${JSON.stringify(e)}))`,`(allow file-read* file-write* (subpath ${JSON.stringify(a)}))`,...l?[`(allow file-write* (subpath ${JSON.stringify(e)}))`]:[],...Pm.map((p)=>`(deny file-read* file-write* (regex #"${p}"))`),...Cc(e,l),"(deny network*)"].join(`
+`)}async function fo(e,a,l){return new Promise((u,p)=>{let m="",f="",g=!1,b=!1,y=!1,h;try{h=Rm(e,a,{cwd:l.cwd,env:l.env,shell:!1,stdio:["ignore","pipe","pipe"],...Me()}),Dt(h)}catch(I){p(I);return}let w=(I,x)=>{if(y)return;y=!0,clearTimeout(R),l.signal.removeEventListener("abort",v),u({exitCode:I,signal:x,stdout:m,stderr:f,timedOut:b,truncated:g})},S=(I,x)=>{let E=`${I}${String(x)}`,O=km(E);return g||=O.truncated,O.value};h.stdout.on("data",(I)=>{m=S(m,I)}),h.stderr.on("data",(I)=>{f=S(f,I)}),h.once("error",p),h.once("exit",w);let v=()=>{try{if(G()==="win32"&&h.pid)Be(h.pid);else h.kill("SIGTERM")}catch{}};l.signal.addEventListener("abort",v,{once:!0});let R=setTimeout(()=>{b=!0,v()},l.timeoutMs)})}var $l=null;function Dm(){return $l??=Ma({scrubEnvironment:Xl,spawnCaptured:fo,isProtectedPath:L}),$l}var Kn=async(e,a,l)=>{if(G()==="linux"||G()==="win32")return Dm()(e,a,l);if(G()!=="darwin"||!Ue("/usr/bin/sandbox-exec"))throw new r("sandbox_unavailable","Confined command execution is unavailable on this operating system.");let u=hm(Wl(bm(),"reason-device-"));try{return await fo("/usr/bin/sandbox-exec",["-p",Tm(l.root,u,l.allowWrite,l.allowProcessInspection===!0),e,...a],{cwd:l.cwd,timeoutMs:l.timeoutMs,signal:l.signal,env:Xl(l.root,u)})}finally{_m(u,{recursive:!0,force:!0})}};function Nm(e){let a=e.args;if(a===void 0)return[];if(!Array.isArray(a)||a.length>Em)throw new r("invalid_payload","args must be a bounded string array.");return a.map((l)=>{if(typeof l!=="string"||l.includes("\x00")||Buffer.byteLength(l,"utf8")>zl)throw new r("invalid_payload","Command argument is invalid or too large.");return l})}async function Jl(e,a,l,u={}){if(e.signal.aborted)throw new r("cancelled","Operation was cancelled.");let p=le(e.root),m=u.cwd??p,f=await e.runCommand(a,l,{cwd:m,root:p,allowWrite:u.allowWrite===!0,timeoutMs:u.timeoutMs??Zo,signal:e.signal});if(f.exitCode!==0&&/permission denied|operation not permitted|EACCES|EPERM/i.test(f.stderr))await e.emit("permission.denied",{operation:"bash",provenance:e.worker?.executionMode==="unsandboxed"?"os_permission_unknown":"sandbox_policy"});return{exit_code:f.exitCode,signal:f.signal,stdout:f.stdout,stderr:f.stderr,timed_out:f.timedOut,truncated:f.truncated}}function Zl(e){let a=e instanceof Error&&"code"in e?e.code:null;return a==="EACCES"||a==="EPERM"}var Ql=()=>new r("path_unreadable","The path is not readable.");function Mm(e){try{return ql(e,ke.O_RDONLY)}catch(a){throw Zl(a)?Ql():a}}function Bl(e,a){let l=J()?ue():null;return l?vr(l,{op:"fs",capability:e,root:a.root,payload:a.payload},a.signal).then((u)=>u.value):tl(e,a)}function tl(e,a){return e==="fs.read"?$m(a):Fm(a)}async function $m(e){let a=le(e.root),l=St(a,zr(e.payload,"path"));if(!Jt(l).isFile())throw new r("not_a_file","Read target is not a file.");let u=Xt(e.payload.offset,0,0,Number.MAX_SAFE_INTEGER),p=Xt(e.payload.max_bytes,65536,1,Vl),m=Rt(e.payload,"encoding");if(m!==void 0&&m!=="base64")throw new r("invalid_payload","encoding must be base64.");let f=Mm(l),g,b;try{g=jl(f).size;let h=Buffer.alloc(Math.max(0,Math.min(p,g-u)));b=h.subarray(0,h.byteLength?gm(f,h,0,h.byteLength,u):0)}finally{Hl(f)}let y=m==="base64"||b.includes(0);return{path:Kl(a,l),content:y?b.toString("base64"):b.toString("utf8"),encoding:y?"base64":"utf8",offset:u,bytes:b.byteLength,size:g,truncated:u+b.byteLength<g}}function Bm(e,a,l=G()){let u=e==="append"?ke.O_APPEND:ke.O_TRUNC;if(l==="win32")return a?ke.O_WRONLY|(e==="append"?ke.O_APPEND:0):ke.O_WRONLY|ke.O_CREAT|ke.O_EXCL;return ke.O_WRONLY|ke.O_NOFOLLOW|u|(a?0:ke.O_CREAT|ke.O_EXCL)}async function Fm(e){let a=le(e.root),l=zr(e.payload,"path"),u=Am(e.payload,"content",xm),p=Rt(e.payload,"mode")??"overwrite";if(!["create","overwrite","append"].includes(p))throw new r("invalid_payload","mode must be create, overwrite, or append.");let m=Lm(a,l);if(e.payload.create_parents===!0||e.payload.create_directories===!0){fm(Kt(m),{recursive:!0,mode:448});let y=Ne(Kt(m));if(!lt(a,y))throw new r("symlink_escape","Write parent escaped root.")}if(!Ue(Kt(m)))throw new r("path_not_found","Write parent does not exist.");if(p==="create"&&Ue(m))throw new r("path_exists","Create mode will not overwrite an existing file.");let f=Ue(m),g=f?Vo(m):null,b=ql(m,Bm(p,f),384);try{let y=jl(b),h=g??(G()==="win32"?Vo(m):null);if(h&&(y.ino!==h.ino||y.dev!==h.dev||G()==="win32"&&!lt(a,Ne(m))))throw new r("symlink_escape","The write target changed between validation and opening.");if(G()==="win32"&&g&&p!=="append")mm(b,0);ym(b,u,null,"utf8")}finally{Hl(b)}return{path:Kl(a,m),bytes_written:Buffer.byteLength(u,"utf8"),mode:p}}async function Um(e){let a=le(e.root),l=zr(e.payload,"command",65536),u=St(a,Rt(e.payload,"cwd")??".");if(!Jt(u).isDirectory())throw new r("invalid_cwd","cwd is not a directory.");let p=Xt(e.payload.timeout_ms,Zo,100,Jo);return Jl(e,en(),["-lc",l],{cwd:u,allowWrite:e.root.permissions.write,timeoutMs:p})}function ec(e,a){let l=Ge(e,a),u=l.boundary===e?e:St(l.anchor,zo(l.anchor,l.boundary)||".");return{boundary:u,checkout:St(u,zo(u,l.path)||".")}}async function Hm(e){let a=za.safeParse(e.payload),l=e.worker;if(!a.success||!e.claimOwner||(l?!l.runtimeDirectory:G()!=="darwin"))throw new r("preview_unavailable","Preview servers are unavailable on this computer.");let u=le(e.root),{boundary:p,checkout:m}=ec(u,a.data.workspace);if(!Jt(m).isDirectory())throw new r("invalid_cwd","The Session checkout is not a directory.");let f=Math.min(Date.parse(a.data.expires_at),Date.now()+ja);if(!(f>Date.now()))throw new r("process_authority_lost","The preview server lease is unavailable.");let g=(x)=>e.emit("progress",{process:x});if(!l?.runtimeDirectory){if(e.claim.local_github_authority)throw new r("local_device_gh_confinement_unavailable","Only a worker runs a local GitHub Session's dev server.");return{...await ei({claim:e.claim,root:p,cwd:m,command:a.data.command,mode:"host",shell:dt(),environment:process.env,expiresAtMs:f,signal:e.signal,emit:g})}}let b={directory:Wl(l.runtimeDirectory,"processes")},y={deniedPorts:ii([e.apiOrigin])},h=ci(),w=li(),S=J(),v=a.data.egress?sn(S):null;if(a.data.egress&&(v===null||!Pe(l.executionMode==="unsandboxed")))throw new r("preview_egress_unavailable","This computer cannot hold a dev server to the run's network allowlist; no command was dispatched.");let R=a.data.egress?await Mi(a.data.egress.allowed_domains):null,I=R?[`export ${["HTTP_PROXY","HTTPS_PROXY","http_proxy","https_proxy"].map((x)=>`${x}=${R.url}`).join(" ")}`,"export NO_PROXY=localhost,127.0.0.1,::1 no_proxy=localhost,127.0.0.1,::1 NODE_USE_ENV_PROXY=1",a.data.command].join(`
+`):a.data.command;try{return{...await ei({claim:e.claim,root:m,cwd:m,command:I,mode:"host",shell:w,expiresAtMs:f,signal:e.signal,emit:g,...S?{jobsUser:{...S,...v!==null?{modelGid:v}:{}}}:{},environment:{...h.variables,HOME:h.home,PATH:h.path,TMPDIR:h.temporaryDirectory,SHELL:w},journals:b,preview:y})}}finally{R?.close()}}async function jm(e){Hn();let a=le(e.root),l=qn(e.payload.command),u=St(a,Rt(e.payload,"cwd")??".");if(!Jt(u).isDirectory())throw new r("invalid_cwd","cwd is not a directory.");let p=Xt(e.payload.timeout_ms,bs,100,$n),{ignored:m}=Wn(e.payload.env);return await e.emit("progress",{shell:dt(),shell_flags:[...Ut],sandbox:"none",ignored_env:m}),Ss({command:l,cwd:u,timeoutMs:p,signal:e.signal,spawn:e.spawnFullControl,requestEnv:e.payload.env})}async function qm(e){let a=le(e.root),l=Nm(e.payload),u=l[0];if(!u||!Gl.has(u)&&!Go.has(u))throw new r("git_command_not_allowed","Git subcommand is not in the Device allowlist.");if(l.some((f)=>f==="-C"||f==="-c"||f.startsWith("--git-dir")||f.startsWith("--work-tree")||f.startsWith("--config-env")||f.startsWith("--exec-path")))throw new r("git_argument_not_allowed","Git path/config overrides are not allowed.");let p=Go.has(u);if(p&&!e.root.permissions.write)throw new r("permission_denied","Mutating Git commands require the write grant.");let m=St(a,Rt(e.payload,"cwd")??".");return Jl(e,"git",["-c","core.hooksPath=/dev/null","-c","credential.helper=",...l],{cwd:m,allowWrite:p||process.platform==="win32"&&e.root.permissions.write,timeoutMs:Xt(e.payload.timeout_ms,Zo,100,Jo)})}function tc(e,a){return async(l)=>{let u=await e.runCommand("/usr/sbin/lsof",l,{cwd:a,root:a,allowWrite:!1,allowProcessInspection:!0,timeoutMs:1e4,signal:e.signal});if(e.signal.aborted)throw new r("cancelled","Operation was cancelled.");return u}}async function Wm(e){let a=le(e.root);if(G()==="linux")return ba(a);if(G()==="win32")return sc(a);return xa(a,tc(e,a))}async function Vm(e){let a=le(e.root),l=a;if(e.payload.workspace!==void 0){let u=te(e.payload.workspace);if(!u)throw new r("invalid_workspace","The workspace is not a valid Device workspace.");l=ec(a,u).checkout}if(G()==="linux")return wa(l);if(G()==="win32")return ac(l);return Ea(l,tc(e,a))}async function zm(e){let a=e.worker?ka(e.worker):null,l=e.claim.environment;delete e.claim.environment;let u=e.worker&&l&&ti({deviceId:e.deviceId},e.root.id,e.runId,l.payload,l.authority)?l.payload:void 0;return e.runHandsRelay({...e.claimedAtMs===void 0?{}:{claimedAtMs:e.claimedAtMs},claimOwner:e.claimOwner,...u?{claimEnvironment:u}:{},localGithubConfinement:Boolean(e.claim.local_github_authority),...e.worker?{headless:!0,runtimeDirectory:e.worker.runtimeDirectory,...e.worker.handsSlots?{handsSlots:e.worker.handsSlots}:{},...e.worker.ownComputer?{ownComputer:!0}:{},hostExecution:e.worker.executionMode==="unsandboxed",...e.worker.executionMode==="unsandboxed"&&e.worker.readiness?.["pty.start"]===!0?{managedPty:{version:1,startupVerified:!0}}:{},deviceIdentity:{deviceId:e.deviceId,rootId:e.root.id,apiOrigin:e.apiOrigin},...a?{desktopRecording:a}:{}}:{},root:le(e.root),runId:e.runId,operationId:e.operationId,attemptId:e.attemptId,payload:e.payload,signal:e.signal,emitEvent:(p,m,f)=>e.emit(p,m,f)})}async function Gm(e){if(e.worker){if(!e.root.permissions.read||!e.root.permissions.write)throw new r("permission_denied","Bound Hands terminals require the workspace read/write grants.");let{workspace:a,session:l}=Va(e.payload,e.operationId);return rn({root:le(e.root),runId:e.runId,deviceId:e.deviceId,rootId:e.root.id,workspace:a,session:l,owner:e.claimOwner,authority:e.claimAuthority,signal:e.signal,emit:(u,p)=>e.emit(u,p)})}return e.runPtySession({root:le(e.root),runId:e.runId,operationId:e.operationId,payload:e.payload,signal:e.signal,emitEvent:(a,l)=>e.emit(a,l)})}function Fl(e,a){let l=J()?ue():null;return l?vr(l,{op:"transfer",direction:a,root:e.root,payload:e.payload,worker:Boolean(e.worker)},e.signal).then((u)=>u.value):rl(a,{root:e.root,payload:e.payload,signal:e.signal,worker:Boolean(e.worker),fetchImpl:e.fetchImpl,beforeCommit:()=>e.emit("progress",{phase:"file_transfer_verified"})})}async function rl(e,a){let l=le(a.root),u=$t in a.payload;if(u&&!a.worker)throw new r("cloud_copy_workspace_invalid","Only a worker resolves a Cloud copy workspace.");let p=u?us(l,a.payload[$t]):l;if("source"in a.payload||"source_version"in a.payload){if(e!=="export"||!u)throw new r("cloud_copy_source_unsupported","Explicit sources require the private Cloud exporter.");let g=Yi.safeParse(a.payload);if(!g.success)throw new r("invalid_payload","Invalid Cloud export request.");return ds({runtimeRoot:p,source:g.data.source,url:g.data.url,signal:a.signal,fetchImpl:a.fetchImpl})}let m=zr(a.payload,"path",4096),f=e==="import"&&u?An(p):p;return wt(Qo(f,m)),mt({direction:e,root:f,path:m,payload:a.payload,signal:a.signal,fetchImpl:a.fetchImpl,beforeCommit:a.beforeCommit})}var rc={"inference.custom.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],execute:(e)=>{if(!e.customEndpointCredential||!e.claimOwner)throw new r("custom_endpoint_credential_unavailable","Local model credentials require a signed Device claim.");return gi({payload:e.payload,signal:e.signal,credential:e.customEndpointCredential,emit:(a,l)=>e.emit(a,l,e.signal)})}},"fs.read":{requiredPermission:"read",execute:(e)=>Bl("fs.read",e)},"fs.write":{requiredPermission:"write",execute:(e)=>Bl("fs.write",e)},"fs.export":{requiredPermission:"read",execute:(e)=>Fl(e,"export")},"fs.import":{requiredPermission:"write",execute:(e)=>Fl(e,"import")},"preview.serve.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>G()==="darwin"&&Bn(),execute:Hm},"exec.run":{requiredPermission:"execute",available:Ko,execute:Um},"exec.full":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>Bn(),execute:jm},"git.run":{requiredPermission:"execute",available:()=>Ko()&&Om("git"),execute:qm},"process.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:Ml,execute:Wm},"ports.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:Ml,execute:Vm},"hands.connect":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>G()==="darwin"||Boolean(xo()),execute:zm},"pty.start":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:Fo,execute:Gm},"display.stream.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:dn,execute:(e)=>{let a=ue();return a?vr(a,{op:"display",payload:e.payload,proxy:(e.relay.loadProxy??Se)()},e.signal):pn({payload:e.payload,signal:e.signal},e.relay)}},"automation.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:()=>hr(),execute:(e)=>Mo({runId:e.runId,payload:e.payload,signal:e.signal,...e.worker?.userChrome?{userChrome:e.worker.userChrome}:{}})},"simulator.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:Vt,execute:(e)=>zt({payload:e.payload,root:le(e.root)})},"simulator.stream.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:Ll,execute:(e)=>Tl({payload:e.payload,root:le(e.root),signal:e.signal},e.relay)},"jobs.control":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>!0,execute:(e)=>Xa({root:le(e.root),runId:e.runId,payload:e.payload,signal:e.signal})},"github.local.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],available:()=>G()==="darwin"?Ue("/usr/bin/sandbox-exec"):G()==="linux"||G()==="win32",execute:async(e)=>{let a=Ct.parse(e.payload),l=Je.parse(e.claim.local_github_authority);if(l.userId!==e.claimOwner?.user_id||l.deviceId!==e.deviceId||l.rootId!==e.root.id||l.runId!==e.runId||l.repoFullName!==a.repoFullName||!l.readOnly&&!e.root.permissions.write||!Qt(a)&&(l.readOnly||l.generation===null&&!(a.kind==="pr_merge"&&l.merge?.source==="human")&&!(a.kind==="pr_mutation"&&l.contributorRefresh)))throw Error("local_device_gh_authority_changed");return Ya({root:le(e.root),runId:e.runId,request:a,authority:l,signal:e.signal,leaseUntil:e.claim.lease_until},(u)=>Li(a,u))}},"environment.install":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:async(e)=>Qe({root:le(e.root),runId:e.runId,payload:e.payload})},"browser.pr-proof.v1":{requiredPermission:"read",additionalPermissions:["execute"],available:()=>!1,execute:async(e)=>{if(!e.proveMac)throw new r("capability_unsupported","PR proof host is not installed.");return e.proveMac()}},"tunnel.open":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:(e)=>Ka({root:le(e.root),runId:e.runId,owner:e.claimOwner,payload:e.payload,signal:e.signal})},"tunnel.close":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:(e)=>Ja({root:le(e.root),runId:e.runId,owner:e.claimOwner,payload:e.payload,signal:e.signal})},"workspace.setup.v1":{requiredPermission:"execute",additionalPermissions:["read","write"],available:Zr,execute:(e)=>ls(e.payload,e.signal)}};function Ym(e,a){try{let l=yi(e,Ne(a)),u=l?e.find((p)=>p.path===l):void 0;return u&&/^[a-f0-9]{64}$/.test(u.pathFingerprint)?u.pathFingerprint:void 0}catch{return}}function Km(e,a){try{let l=Ne(a);return e.some((u)=>u.path===l)?nr(l,G()):void 0}catch{return}}function Xm(e,a){try{let l=Ne(a),u=e.find((p)=>p.path===l);return u&&/^[a-f0-9]{64}$/.test(u.pathFingerprint)?u.pathFingerprint:void 0}catch{return}}function Jm(e,a){try{let l=Ne(a);if(!e.some((u)=>u.path===l))return;return e.filter((u)=>u.path!==l&&lt(l,u.path)&&/^[a-f0-9]{64}$/.test(u.pathFingerprint)).map((u)=>u.pathFingerprint)}catch{return}}function Jn(e,a,l=G()){try{return ir({home:nr(Ne(a),l),roots:e.map((u)=>({path_fingerprint:u.pathFingerprint,path:nr(u.path,l)})).filter((u)=>/^[a-f0-9]{64}$/.test(u.path_fingerprint)&&tr(u.path)).slice(0,Yr)})}catch{return}}function mo(e,a={}){let l=a.worker?a.worker.handsSlots??1:a.handsSlots===1?1:void 0,u=Boolean(a.worker)||G()==="darwin",p=u?Xm(e,Yt()):void 0,m=!a.worker&&G()==="darwin"?Ym(e,Yt()):void 0,f=u?Km(e,Yt()):void 0,g=!a.worker&&G()==="darwin"?Jm(e,Yt()):void 0,b=u?Jn(e,Yt()):void 0,y=Mn.filter((h)=>{if(Ft.has(h)&&!a.worker)return!1;if(a.worker&&!Rr(h,a.worker))return!1;let w=rc[h];if(!w)return!1;return(h==="hands.connect"&&(a.terminalOnlyHands===!0||Boolean(a.worker))||(h==="pty.start"||h==="preview.serve.v1")&&Boolean(a.worker)||h==="browser.pr-proof.v1"&&Boolean(a.productionProof)?!0:w.available?.()??!0)&&e.some((v)=>(!a.worker||h!=="pty.start"||v.permissions.read&&v.permissions.write)&&Yl(w).every((R)=>v.permissions[R]))});return{supported_operations:y,...p?{account_root_fingerprint:p}:{},...m?{workspace_root_fingerprint:m}:{},...f?{account_root_path:f}:{},...g?{home_contained_root_fingerprints:g}:{},...b?{root_paths:b}:{},...y.includes("hands.connect")?{hands_worker_artifact_sha256:T,hands_worker_entrypoint:H,...l?{hands_slots:l}:{}}:{},max_payload_bytes:Xe,max_result_bytes:Xe,operation_constraints:{...y.includes("browser.pr-proof.v1")&&a.productionProof?{"browser.pr-proof.v1":an.parse(a.productionProof)}:{},...y.includes("exec.run")?{"exec.run":{transport:"shell",shell:en(),sandbox:G()==="linux"?"linux_sandbox_runtime":G()==="win32"?"windows_srt":"macos_seatbelt",network:!1,max_timeout_ms:Jo}}:{},...y.includes("exec.full")?{"exec.full":Es()}:{},"git.run":{read_only_subcommands:[...Gl].sort(),mutating_subcommands:[...Go].sort(),push:!1,credential_helpers:!1},"fs.export":{transport:"https_signed_url",max_bytes:qe,max_timeout_ms:Mt,result:"sha256_and_size"},"fs.import":{transport:"https_signed_url",max_bytes:qe,max_timeout_ms:Mt,atomic:!0,overwrite:!1},"hands.connect":{transport:"wss_relay",worker:"ara_hands",worker_version:U,protocol_version:F,worker_artifact_sha256:T,worker_entrypoint:H,policy_mode:"full_access",policy_version:1,workspace_base:at,workspace_layout:Oe,...l?{slots:l}:{},browser_state:a.worker?"optional_headless":a.terminalOnlyHands===!0?"disabled_terminal_only":G()==="darwin"?"optional_isolated_per_session":"isolated_per_session",max_session_ms:43200000},...y.includes("pty.start")?{"pty.start":{transport:"wss_relay",shell:"login_shell",resize:!0,slots:bi,max_session_ms:wi,max_buffered_output_bytes:hn}}:{},...a.worker?Object.fromEntries(y.filter((h)=>h!=="browser.pr-proof.v1").map((h)=>[h,{ready:a.worker?.readiness?.[h]===!0,...a.worker?.readiness?.[h]!==!0&&a.worker?.probing?.includes(h)?{probing:!0}:{},execution_mode:Rr(h,{...a.worker,executionMode:"sandboxed"})?"confined":"host",...h==="pty.start"?{transport:"wss_relay",worker:"ara_hands",shell:"bound_job",protocol_version:yn,environment:"private_snapshot",receipt:"metadata_only",...a.worker?.persistentTerminals&&!J()?{persistent_terminals:!0}:{}}:{},...h===rr?{max_body_bytes:Fr}:{},...h==="github.local.v1"?{contributor_attribution:2,prepare_diagnostics:1,...a.worker?.githubSignedIn!==void 0?{gh_authenticated:a.worker.githubSignedIn}:{}}:{},...h==="hands.connect"?{transport:"wss_relay",worker:"ara_hands",slots:l,session_group:qs,...a.worker?.ownComputer?{[Ws]:Vs}:{},workspace_base:at,workspace_layout:Oe,browser_state:"optional_headless",desktop:!1,worker_version:U,protocol_version:F,...a.worker?.readiness?.["environment.install"]===!0&&y.includes("environment.install")?{environment_delivery:xs,[Ts]:Rs}:{},...a.worker?{[Ns]:Os}:{},...a.worker?{[Ds]:Is}:{},...a.worker?.handsBrowser?{[Fs]:Bs}:{},[Ms]:$s,[Hs]:js,...Pe(a.worker?.executionMode==="unsandboxed")?{[Le]:ct}:{},...Pe(a.worker?.executionMode==="unsandboxed")&&sn()!==null?{[xe]:Pt}:{},...Pe(a.worker?.executionMode==="unsandboxed")&&J()?{[zs]:Us}:{}}:{},...h==="fs.export"?{cloud_source_version:fr,source_kinds:["workspace","attachment"],[gn]:_n}:{},...h==="fs.import"?{[gn]:_n}:{},...h===Fa&&sn()!==null&&Pe(a.worker?.executionMode==="unsandboxed")?{[Ua]:yo}:{},...h==="tunnel.open"?{carried_jobs:Gs}:{},...h==="jobs.control"?{[Js]:Ks}:{},...h==="display.stream.v1"&&a.worker?.displayVideo?{[Rc]:Pc,[Tc]:Ar.join(","),[Ic]:Dc,[Oc]:Nc,[Lc]:$c}:{},...h==="automation.call.v1"&&a.worker?.userChrome?{[$r]:!0}:{},...h==="automation.call.v1"&&a.worker?.cloudSessions?{[Xs]:!0}:{}}])):{}}}}function ti(e,a,l,u,p){let m=si.safeParse(u);return m.success&&p!==void 0&&p.device_id===e.deviceId&&m.data.device_id===e.deviceId&&m.data.root_id===a&&m.data.run_id===l&&m.data.binding.kind===p.binding&&m.data.binding.target_revision===p.target_revision&&m.data.binding.root_grant_revision===p.root_grant_revision&&m.data.binding.target_generation===p.target_generation&&m.data.binding.target_fence_id===p.target_fence_id}async function go(e,a,l,u,p){if(a.capability!=="hands.connect"||l.kind!==Lr||!u.operationEnvironment||!u.acknowledgeOperationEnvironment)return!1;let m=l.payload.snapshot_id;if(l.payload.version!==1||typeof m!=="string"||Object.keys(l.payload).length!==2)throw new r("environment_unavailable","Reason sent an invalid environment delivery.");let f=e.roots.find((y)=>y.id===a.root_id);if(!f)throw new r("root_not_granted","The Hands root is no longer granted.");let g=await u.operationEnvironment(e,a,m,p);if(!ti(e,f.id,a.run_id,g.payload,g.authority)||g.payload.snapshot_id!==m)throw new r("environment_unavailable","The delivered environment does not match this Hands.");let b=Qe({root:le(f),operationId:a.operation_id,payload:g.payload});return await u.acknowledgeOperationEnvironment(e,a,{snapshot_id:b.snapshot_id,installed_revision:b.installed_revision,installed:!0},p),!0}async function _o(e,a,l,u){if(a.capability!=="hands.connect"||l.kind!==Ls)return!1;let{version:p,run_id:m,target_generation:f,target_fence_id:g}=l.payload;if(p!==1||Object.keys(l.payload).length!==4||typeof m!=="string"||typeof f!=="number"||typeof g!=="string")throw new r("hands_rebind_unavailable","Reason sent an invalid Hands rebind.");let b=e.roots.find((y)=>y.id===a.root_id);if(!b)throw new r("root_not_granted","The Hands root is no longer granted.");return await Ga({operationId:a.operation_id,root:le(b),runId:m,targetGeneration:f,fenceId:g,...u?{signal:u}:{}}),!0}async function Xn(e,a,l){if(a.capability!=="github.local.v1")return Ul(e,a,l);try{let u=await Ul(e,a,l);if(u.status==="succeeded"||vs(a.payload,u.status,u.error_code))return u;return{status:u.status,error_code:u.status==="cancelled"?"operation_cancelled":"local_github_unavailable"}}catch{return{status:l.signal.aborted?"cancelled":"failed",error_code:l.signal.aborted?"operation_cancelled":"local_github_unavailable"}}}async function Ul(e,a,l){if(Ft.has(a.capability)&&!l.worker)return{status:"failed",error_code:"capability_not_granted"};if(l.worker&&!Rr(a.capability,l.worker))return{status:"failed",error_code:"capability_not_granted"};if(l.worker&&l.worker.readiness?.[a.capability]!==!0)return{status:"failed",error_code:"capability_unavailable"};if(a.local_github_authority){let h=Je.safeParse(a.local_github_authority);if(!h.success||h.data.deviceId!==e.deviceId||h.data.rootId!==a.root_id||h.data.runId!==a.run_id||h.data.userId!==a.owner?.user_id||!["github.local.v1","hands.connect","environment.install","jobs.control","preview.serve.v1"].includes(a.capability))return{status:"failed",error_code:"local_device_gh_capability_denied"}}let u=rc[a.capability];if(!u)return{status:"failed",error_code:"capability_unsupported"};if(u.available&&!u.available()&&!(["hands.connect","pty.start","preview.serve.v1"].includes(a.capability)&&l.worker)&&!l.runCommand&&!l.runHandsRelay&&!l.spawnFullControl&&!l.runPtySession&&!(a.capability==="browser.pr-proof.v1"&&l.proveMac))return{status:"failed",error_code:"capability_unavailable"};if(a.protocol_version!==2)return{status:"failed",error_code:"protocol_unsupported"};let p=e.roots.find((h)=>h.id===a.root_id);if(!p)return{status:"failed",error_code:"root_not_granted"};if((a.capability==="fs.export"||a.capability==="fs.import")&&Xo(a.payload)&&(("source"in a.payload)||("source_version"in a.payload))){let h=Boolean(l.worker||e.worker)&&$t in a.payload;if(a.capability!=="fs.export"||!h)return{status:"failed",error_code:"cloud_copy_source_unsupported"}}if(a.owner&&(a.owner.device_id!==e.deviceId||a.owner.organization_id!==e.orgId))return{status:"failed",error_code:"capability_not_granted"};if((a.capability==="tunnel.open"||a.capability==="tunnel.close")&&!a.owner)return{status:"failed",error_code:"preview_unavailable"};if(a.capability==="environment.install"&&!ti(e,p.id,a.run_id,a.payload,a.authority))return{status:"failed",error_code:"environment_unavailable"};if(Yl(u).some((h)=>!p.permissions[h]))return{status:"failed",error_code:"permission_denied"};let m=0,f=async(h,w,S)=>{if(["environment.install","github.local.v1"].includes(a.capability)||a.capability==="inference.custom.v1"&&(h==="started"||h==="completed"))return;await l.emit?.({sequence:m++,kind:h,capability:a.capability,data:w,...(h==="hands.reconnected"||a.capability==="inference.custom.v1")&&S?{deliverySignal:S}:{}})},g=a.capability==="hands.connect"||a.capability==="display.stream.v1"||a.capability==="simulator.stream.v1"||Qr.has(a.capability)||a.capability==="pty.start",b,y=async(h,w,S)=>{let v=b;b=void 0,await Promise.all([v,f(h,w,S)])};try{if(g)b=f("started"),b.catch(()=>{return});else await f("started");let h={...l.proxy===void 0?{}:{loadProxy:()=>l.proxy??null},...l.handsLaunch?.takePrespawnedWorker?{takePrespawnedWorker:l.handsLaunch.takePrespawnedWorker}:{},...l.handsLaunch?.adoptSpawnedWorker?{adoptSpawnedWorker:l.handsLaunch.adoptSpawnedWorker}:{}},w=await u.execute({...l.proveMac?{proveMac:()=>l.proveMac(a,l.signal,(S)=>f("pr-proof.started.v1",S))}:{},claim:a,worker:l.worker,claimOwner:a.owner,claimAuthority:a.authority,organizationId:e.orgId,deviceId:e.deviceId,apiOrigin:e.apiOrigin,root:p,payload:Im(a.payload,a.capability),runId:a.run_id,operationId:a.operation_id,attemptId:a.attempt_id,...l.handsLaunch?{claimedAtMs:l.handsLaunch.claimedAtMs}:{},signal:l.signal,...l.customEndpointCredential?{customEndpointCredential:l.customEndpointCredential}:{},fetchImpl:l.fetchImpl??fetch,relay:h,runCommand:l.runCommand??Kn,spawnFullControl:l.spawnFullControl??fo,emit:g?y:f,runHandsRelay:l.runHandsRelay??((S)=>et(S,h)),runPtySession:l.runPtySession??jo});if(a.capability==="github.local.v1")Vc.parse(w);if(!Xo(w))throw new r("invalid_result","Operation result must be a JSON object.");if(Buffer.byteLength(JSON.stringify(w)??"null","utf8")>Xe)throw new r("result_too_large","Operation result exceeds 256 KB.");return await(g?y:f)("completed",{ok:!0}),{status:"succeeded",result:w,error_code:null}}catch(h){let w=l.signal.reason instanceof r&&Dl.has(l.signal.reason.code)?l.signal.reason.code:h instanceof r&&Dl.has(h.code)?h.code:null;if(l.signal.aborted||w)return{status:"cancelled",...h instanceof lr?{result:{process_terminal_observation:h.observation}}:{},error_code:["environment.install","github.local.v1","inference.custom.v1"].includes(a.capability)?"operation_cancelled":w??"cancelled"};if(["fs.read","fs.write"].includes(a.capability)&&h instanceof Error&&"code"in h&&["EACCES","EPERM"].includes(String(h.code)))await f("permission.denied",{operation:a.capability==="fs.read"?"read":"write",provenance:"os_permission_unknown"});let S=a.capability==="inference.custom.v1"?h instanceof r&&Hr(h.code)?h.code:"custom_endpoint_unavailable":a.capability==="github.local.v1"?h instanceof Fn&&vs(a.payload,"failed",h.code)?h.code:"local_github_unavailable":a.capability==="environment.install"?"environment_install_failed":h instanceof r&&Cm.test(h.code)?h.code:"capability_failed",v=a.capability==="hands.connect"&&h instanceof pi?Za(h.expiryDiagnostic):null;return await f("completed",{ok:!1,error_code:S,...v?{expiry_diagnostic:v}:{}}),{status:"failed",error_code:S}}}
+export{Da,k,or,sr,ee,ar,uo,po,Zr,dt,ho,Qr,en,fo,Kn,tl,rl,Jn,mo,go,_o,Xn};