@reason-machines/cli-linux-x64 0.2.566 → 0.2.568

package/bin/vm-hands/{vm-hands-entry-lite-6adz91f3.js → vm-hands-entry-lite-mzw2vcah.js}

@@ -1,29 +1,29 @@
 // @bun
-import{R,Pn}from"./vm-hands-entry-lite-z65xva21.js";import{w,ye,W,Cn,An,Cr}from"./vm-hands-entry-lite-33at6g06.js";import{Q,ve}from"./vm-hands-entry-lite-2qfmabqn.js";import{Ca,be,Aa,C,no,me}from"./vm-hands-entry-lite-rz1ep81m.js";import{g}from"./vm-hands-entry-lite-72h3t64b.js";import{ut,Wn,ir}from"./vm-hands-entry-lite-a8z57vry.js";import{a,hn,Ht,vi,mt,fn,fr,mn,mr,Ut,ae,rt,Si,zt}from"./vm-hands-entry-lite-xfak34av.js";import{Nr,vs,Ss,pe,Xs,tr,jn}from"./vm-hands-entry-lite-fxptf351.js";import{Hr}from"./vm-hands-entry-lite-gxf2r5en.js";import{Ia,k,or,sr,ee,ar,lo,uo,Zr,dt,po,Qr,en,Gn,Kn,fo,mo,go,Jn}from"./vm-hands-entry-lite-72084j3g.js";import{ti,ri,K,za,qa,oe,x,p,bo,ge,se,O,$t,Qe,rn,vo,E,_e,Za,Qa,ec,si,nn,pt,tc,Mt,on,Pe,J,nc,xo,Co,ic,et}from"./vm-hands-entry-lite-fs6jbfp3.js";import{je}from"./vm-hands-entry-lite-s93f3pbv.js";import{cr,Ae,Da,tn,Oa,La}from"./vm-hands-entry-lite-ngry8nkq.js";import{ne}from"./vm-hands-entry-lite-997y1m1r.js";import{le,A,es,ts}from"./vm-hands-entry-lite-50kqbrb7.js";import{On,Nn,Hi,Fc}from"./vm-hands-entry-lite-bkhc5mt4.js";import{kr,ue}from"./vm-hands-entry-lite-cc8hwgxc.js";import{Lt,ie,N,ro}from"./vm-hands-entry-lite-9wp7ahwa.js";import{Oi,ke,de,j,ze,ns,En,is,qe,Ni,Li,os,kn,Ie,ss,xn}from"./vm-hands-entry-lite-ttfqxjms.js";import{F}from"./vm-hands-entry-lite-zp7chzcc.js";import{U,H,T}from"./vm-hands-entry-lite-qjrgvdbj.js";import{Zn,Ma,ja,wo,ei}from"./vm-hands-entry-lite-5qrft0nw.js";import{ya}from"./vm-hands-entry-lite-sh4mqy93.js";import{_i}from"./vm-hands-entry-lite-3q2ng4e9.js";import{Mo}from"./vm-hands-entry-lite-x6ybft9v.js";import{Jt}from"./vm-hands-entry-lite-2gxv7v1h.js";import{hr,Oo,No,Lo}from"./vm-hands-entry-lite-ezhfkjqr.js";import{to}from"./vm-hands-entry-lite-284z7ct8.js";import{mi,cc}from"./vm-hands-entry-lite-b1vanmtv.js";import{u,b,m,y}from"./vm-hands-entry-lite-yg4dk99m.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{De,wt,cs,Sc,Ec,bt}from"./vm-hands-entry-lite-88dxn9b5.js";import{s,Et}from"./vm-hands-entry-lite-12ck5swp.js";import{Jc,Ji,I,t,V,zr,o,_,Rt,d,n,h,P,ul,c,i,Xi}from"./vm-hands-entry-lite-zpvr7wc6.js";import{va,Y,B}from"./vm-hands-entry-lite-pg7nnyc6.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{spawn as Du,spawnSync as Xw}from"child_process";import{closeSync as Mu,existsSync as Zw,mkdirSync as Qw,openSync as Tu,readdirSync as ey,realpathSync as Yr,rmSync as Xn}from"fs";import{hostname as ty}from"os";import{dirname as Bs,join as Bt,resolve as ry}from"path";var Jo={ENOENT:"native_enoent",EACCES:"native_permission_denied",EPERM:"native_permission_denied",ETIMEDOUT:"native_timeout",ECONNREFUSED:"native_network",ECONNRESET:"native_network",ENOTFOUND:"native_network",EAI_AGAIN:"native_network",ENETUNREACH:"native_network",EHOSTUNREACH:"native_network",EPIPE:"native_pipe_closed",ENOSPC:"native_disk_full",EMFILE:"native_too_many_files",EBUSY:"native_busy",E2BIG:"native_args_too_large"};function oc(e){if(!(e instanceof Error))return e===void 0||e===null?"native_no_error":"native_non_error";let l=e.code;if(typeof l==="string"&&Jo[l])return Jo[l];let v=e.message;if(e.name==="TimeoutError"||e.name==="AbortError")return"native_timeout";if(/No handler registered for /.test(v))return"ipc_handler_missing";if(/could not be cloned/i.test(v))return"ipc_clone_failed";if(/Render frame was disposed|Object has been destroyed|WebContents was destroyed/i.test(v))return"ipc_window_closed";let D=/\b(E[A-Z0-9]{2,15})\b/.exec(v)?.[1];if(D&&Jo[D])return Jo[D];if(/timed? ?out|timeout/i.test(v))return"native_timeout";if(/fetch failed|failed to fetch|network|socket hang up|getaddrinfo/i.test(v))return"native_network";if(e.name==="TypeError"&&v==="Load failed")return"native_network";if(/unexpected token|is not valid JSON|JSON\.parse|Unexpected end of JSON/i.test(v))return"native_unreadable_output";if(/keychain|secitem|errSec/i.test(v))return"native_keychain_error";if(/Error invoking remote method/.test(v))return"ipc_remote_error";switch(e.name){case"TypeError":return"native_type_error";case"RangeError":return"native_range_error";case"SyntaxError":return"native_unreadable_output"}return"native_unexpected"}import{createHash as Gu}from"crypto";import{unlinkSync as Yu}from"fs";import{platform as Xu}from"os";import{join as Zu}from"path";var ac=P("store",[h({version:i(1),store:i("keychain")}),h({version:i(1),store:i("file"),api_key:t().min(1).max(4096)})]),ln=(e)=>Zu(e,"api-key.json");function Fr(e){let l=Gu("sha256").update(`reason-connect-api-key
-${e}`).digest("hex");return new mt(hn(),Xu(),l)}function ra(e,l,v=Fr(e)){try{v.deleteBinding(),v.createBinding(new TextEncoder().encode(l)),y(ln(e),{version:1,store:"keychain"});return}catch(D){if(!(D instanceof a))throw D}y(ln(e),{version:1,store:"file",api_key:l})}function lr(e,l=Fr(e)){if(!u(ln(e)))return null;let v=ac.parse(JSON.parse(m(ln(e))));if(v.store==="file")return v.api_key;try{let D=l.loadBinding();return D?new TextDecoder().decode(D):null}catch(D){if(!(D instanceof a))throw D;throw Error("worker_api_key_unreadable")}}function sc(e,l=Fr(e)){if(!u(ln(e)))return;if(ac.parse(JSON.parse(m(ln(e)))).store==="keychain")try{l.deleteBinding()}catch(v){if(!(v instanceof a))throw v}Yu(ln(e))}async function na(e,l){let v;try{v=await ir({env:{REASON_API_KEY:l,REASON_API_URL:e.apiOrigin},fetchImpl:oe(e.proxy)})}catch(D){if(D instanceof C&&(D.status===401||D.status===403))throw Error("worker_api_key_rejected");throw D}if(!v)throw Error("worker_api_key_rejected");if(!v.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return v}import{readdirSync as yf,renameSync as _f,rmSync as dn}from"fs";import{join as Pt}from"path";import{createHash as Qu}from"crypto";import{realpathSync as ef,statSync as tf,unlinkSync as Go}from"fs";import{platform as rf}from"os";import{join as Xt}from"path";function f(e){return{state:Xt(p(e),"device.json"),control:Xt(p(e),"control.json"),lock:Xt(p(e),"lifecycle.lock"),socket:Xt(p(e),"control.sock"),daemon:Xt(p(e),"daemon.json"),releaseCheck:Xt(p(e),"release-check.json"),updateDeferral:Xt(p(e),"update-deferral.json"),firstHeartbeat:Xt(p(e),"first-heartbeat.json")}}var nf=n({version:i(1),device_id:t().min(1).max(160),offer:Rt().optional(),enrollment_ms:o().int().nonnegative().max(tr).optional()});function lc(e,l,v){b(p(e),!0),y(f(e).firstHeartbeat,{version:1,device_id:l,...v.offer?{offer:v.offer}:{},...v.enrollmentMs!==void 0?{enrollment_ms:v.enrollmentMs}:{}})}function oa(e,l){let v=f(e).firstHeartbeat;try{if(!u(v))return null;let D=nf.safeParse(JSON.parse(m(v)));if(Go(v),!D.success||D.data.device_id!==l)return null;let M=jn(D.data.offer);return{...M?{offer:M}:{},...D.data.enrollment_ms!==void 0?{enrollmentMs:D.data.enrollment_ms}:{}}}catch{return null}}function xt(e,l=!1){b(p(e),l);let v=["local-device.key","local-device.binding","device.json"].filter((D)=>{let M=Xt(p(e),D);if(!u(M))return!1;return m(M),!0});return e.lifetime==="persistent"&&v.join()==="device.json"?ia(e):new fn(p(e))}function Yo(e,l){xt(e,!0),sf(e);let v=l??ia(e),D=new fn(p(e));try{v.deleteBinding(),v.deleteKey(),v.createFreshPublicKey()}catch(M){if(M instanceof a)return D;throw M}return D.deleteBinding(),D.deleteKey(),v}function ia(e){return new mt(hn(),rf(),of(e))}function of(e){let l=aa(e);return Qu("sha256").update(`reason-worker
-${l?.directory??p(e)}`).digest("hex")}function ao(e,l){y(Xt(p(e),so),{version:1,directory:aa(e)?.directory??p(e),devicePublicKey:l})}var so="keychain-scope.json";function dc(e){return u(Xt(p(e),so))}var af=h({version:i(1),directory:t().min(1),devicePublicKey:t().min(1)});function aa(e){let l=Xt(p(e),so);if(!u(l))return null;let v=af.safeParse(JSON.parse(m(l))),D=f(e).state;if(!v.success||!u(D))return null;return JSON.parse(m(D))?.devicePublicKey===v.data.devicePublicKey?v.data:null}function sf(e){let l=Xt(p(e),so);if(!u(l))return;if(aa(e))try{let v=ia(e);v.deleteBinding(),v.deleteKey()}catch(v){if(!(v instanceof a))throw v}Go(l)}function Or(e){let l=ef(e.workspaceRoot);if(l!==e.workspaceRoot||!tf(l).isDirectory()||!ge(l,e.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function S(e){if(!u(p(e)))return null;let l=Ut(f(e).state,{proofStore:xt(e),repair:!1}),v=l!==null&&Cn(e.apiOrigin,l.apiOrigin),D=v?[O(e),O({...e,apiOrigin:l.apiOrigin})]:[O(e)];if(l&&(!D.includes(l.worker?.configDigest??"")||l.worker.lifetime!==e.lifetime||l.apiOrigin!==e.apiOrigin&&!v||l.roots.length>32||l.roots[0]?.path!==e.workspaceRoot||l.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return l}var uc=h({version:i(1),drained:_(),revoked:_()});function ft(e){let l=f(e).control;return u(l)?uc.parse(JSON.parse(m(l))):{version:1,drained:!1,revoked:!1}}function qt(e,l){y(f(e).control,uc.parse(l))}function Zt(e){let l=xt(e);l.deleteBinding(),l.deleteKey();let v=Xt(p(e),so);if(u(v))Go(v);let D=f(e).state;if(u(D))Go(D)}var cf=h({read:_(),write:_(),execute:_(),discover_environment:_(),expose_mcp:i(!1)}),sa=h({version:i(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:cf,execution_mode:c(["confined","host"]).default("confined")}),folders:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),lf=n({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:i("p256"),protocol_version:i(2),roots:d(n({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:n({lifecycle:c(["persistent","ephemeral"]),expires_at:I.datetime({offset:!0})}),first_heartbeat:Rt().optional()}),ca=30000;class Rr extends Error{deviceRemoved;constructor(e){super("worker_enrollment_rejected");this.deviceRemoved=e}}async function df(e,l,v=fetch){let D=await v(`${e}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(l),redirect:"error",signal:AbortSignal.timeout(ca)});if(!D.ok){let M=D.status===409?await D.json().catch(()=>null):null;throw new Rr(M?.error==="device_revoked")}return D.json()}async function la(e,l,v,D){ne();let M=sa.parse(JSON.parse(m(l)));return Er(e,M,v,D)}async function Er(e,l,v,D=(L,z)=>df(L,z,oe(e.proxy)),M=performance.now()){let L=mc(e,l,v),z=await D(e.apiOrigin,{...L.request,enrollment_ticket:l.enrollment_ticket,code_verifier:l.code_verifier});return L.receipt(z,M)}async function fc(e,l,v,D,M=performance.now()){let L=mc(e,l,v),z=await D(L.request,l.code_verifier);return z===null?null:L.receipt(z,M)}function mc(e,l,v){if(ne(),l.root.execution_mode!==e.executionMode)throw Error("worker_enrollment_mode_mismatch");let D=zt([e.workspaceRoot],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(D.path!==e.workspaceRoot||D.pathFingerprint!==l.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let M=(e.folders??[]).map((G,ce)=>{let we=zt([G],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(we.path!==G||we.pathFingerprint!==l.folders?.[ce]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return we});if((l.folders?.length??0)!==M.length)throw Error("worker_enrollment_root_mismatch");let L=[{...D,label:"workspace"},...M],z;try{z=v.loadPublicKey()}catch{z=v.createFreshPublicKey()}return{request:{device_public_key:z,name:e.name,os:process.platform,architecture:process.arch,reason_runtime_version:g,bridge_version:g,protocol_version:2,capabilities:{supported_operations:[]},roots:L.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:l.root.permissions}))},receipt(G,ce){let we=lf.parse(G);if(we.organization_id!==l.organization_id||we.roots.length!==L.length||we.roots.some((X,he)=>X.path_fingerprint!==L[he].pathFingerprint)||we.headless.lifecycle!==e.lifetime||Date.parse(we.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let te=jn(we.first_heartbeat);try{lc(e,we.device_id,{...te?{offer:te}:{},enrollmentMs:Math.min(tr,Math.max(0,Math.round(performance.now()-ce)))})}catch{}return{version:4,apiOrigin:e.apiOrigin,orgId:we.organization_id,deviceId:we.device_id,devicePublicKey:z,displayName:e.name,registeredAt:new Date().toISOString(),handsSlots:e.slots,worker:{configDigest:O(e),lifetime:e.lifetime,expiresAt:we.headless.expires_at},roots:we.roots.map((X,he)=>({id:X.id,label:X.label,path:L[he].path,pathFingerprint:X.path_fingerprint,permissions:l.root.permissions}))}}}}import{randomBytes as uf,randomUUID as ff}from"crypto";import{unlinkSync as mf}from"fs";import{join as pf}from"path";var pc=h({version:i(1),install_id:V(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),hf=n({enrollment_ticket:t().min(1).max(4096),expires_at:I.datetime({offset:!0}),device_kind:i("headless"),lifecycle:c(["persistent","ephemeral"]),device_expires_at:I.datetime({offset:!0})});function da(e){return hf.parse(e)}var gf=n({credentialKind:c(["oauth","api_key"]).optional(),apiOrigin:zr(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:I.datetime({offset:!0}),scopes:d(t().max(128)).max(128),orgId:t().min(1).max(160)});function jr(e){return Q(Pn("REASON_CLI_CHANNEL",e.channel),s())}async function qr(e,l=jr(e)){if(!u(l))return null;let v=gf.parse(JSON.parse(m(l)));if(!W(v.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(v.credentialKind==="api_key")return Date.parse(v.expiresAt)>Date.now()?v:null;let D=oe(e.proxy),M=Object.assign((z,re)=>D(z,{...re,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),L=await be({path:l,fetchImpl:M});if(L&&!W(L.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");return L}async function hc(e,l,v){if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let D=Kr(e);return D.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(D.request))}async function gc(e,l,v,D,M){let L=performance.now();if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let z=Kr(e),re=M?void 0:v.enrollHeadlessDevice?.bind(v);if(re){let G=await fc(e,z.direct(l.orgId),D,(ce,we)=>re({approval:z.request,code_verifier:we,registration:ce}).catch((te)=>{throw wf(te)}),L);if(G)return G}return Er(e,z.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(z.request)),D,M,L)}function wf(e){if(!(e instanceof C))return e;if(e.status===409)return new Rr(e.code==="device_revoked");if(e.status===410||e.status===401&&e.code==="invalid_enrollment_ticket"||e.status===403&&e.code==="grant_exceeded"||e.status===400&&e.code==="invalid_device_enrollment")return new Rr(!1);return e}var co=(e)=>pf(p(e),"enrollment-install.json");function wc(e){if(u(co(e)))mf(co(e))}function Kr(e,{stored:l=!0}={}){ne();let v=co(e),D=l&&u(v)?pc.parse(JSON.parse(m(v))):{version:1,install_id:ff(),fingerprint_key:uf(32).toString("hex")};if(l&&!u(v))y(v,D);let M={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},L=Buffer.from(D.fingerprint_key,"hex"),z=zt([e.workspaceRoot],M,L)[0];if(z.path!==e.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let re=(e.folders??[]).map((te)=>{let X=zt([te],M,L)[0];if(X.path!==te)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:X.pathFingerprint}}),G=Ca(),ce={install_id:D.install_id,code_challenge:G.challenge,lifecycle:e.lifetime,roots:[z.pathFingerprint,...re.map((te)=>te.path_fingerprint)].map((te)=>({path_fingerprint:te,permissions:M,execution_mode:e.executionMode}))},we=(te)=>({version:1,organization_id:te,code_verifier:G.verifier,root_fingerprint_key:D.fingerprint_key,root:{path_fingerprint:z.pathFingerprint,permissions:M,execution_mode:e.executionMode},...re.length?{folders:re}:{}});return{request:ce,saveInstall(te){b(p(te),!0),y(co(te),D)},complete(te,X){let he=da(X);if(he.lifecycle!==e.lifetime||Date.parse(he.expires_at)<=Date.now()||Date.parse(he.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...we(te),enrollment_ticket:he.enrollment_ticket}},direct:we}}function yc(e,l,v){let D=co(e);if(!u(D))throw Error("worker_folders_unavailable");let M=pc.parse(JSON.parse(m(D)));return zt([l],v,Buffer.from(M.fingerprint_key,"hex"))[0]}var Xo=8,ma=600000,kc=15000,bf=3600000,kf=new Set(["device_not_eligible","sign_in_not_eligible"]),_c=new Set(["device_revoked","invalid_device_credential"]),Zo=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,Dr=(e)=>Pt(p(e),"workspaces"),vc="account.json",ua=(e)=>u(Pt(e,vc));function Qt(e){let l;try{l=yf(Dr(e))}catch{return[]}return l.filter((v)=>Zo.test(v)).sort().map((v)=>{let D=Pt(Dr(e),v),M=Pt(D,"worker.json"),L=null;try{let z=x.safeParse(JSON.parse(m(M)));if(z.success&&z.data.stateDirectory===D)L=z.data}catch{}return{organizationId:v,directory:D,configPath:M,config:L,account:ua(D)}})}function Qo(e,l){let v=l.toLowerCase();if(!Zo.test(v))throw Error("worker_workspace_id_invalid");let D=x.parse({...e,stateDirectory:Pt(Dr(e),v)});return b(D.stateDirectory,!0),y(Pt(D.stateDirectory,vc),{version:1}),{config:D,configPath:Pt(D.stateDirectory,"worker.json")}}function ni(e,l){try{let{config:v,configPath:D}=Qo(e,l);b(p(v),!0),qt(v,{version:1,drained:!0,revoked:!0}),y(D,v)}catch{}}function ho(e,l){let v=l.toLowerCase(),D=null;try{D=S(e)?.orgId.toLowerCase()??null}catch{}return D===v||Qt(e).some((M)=>!M.account&&M.config!==null&&M.organizationId===v)}var fa=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function bc(e,l){let v=S(e);if(!v?.worker)throw Error("worker_identity_missing");ao(e,v.devicePublicKey),b(p(l),!0);for(let L of fa)dn(Pt(p(l),L),{force:!0});for(let L of fa){let z=Pt(p(e),L);if(u(z))_f(z,Pt(p(l),L))}let D=xt(l),M=Ut(f(l).state,{proofStore:D,repair:!1});if(!M?.worker)throw Error("worker_identity_missing");ae({...M,worker:{...M.worker,configDigest:O(l)}},f(l).state,{proofStore:D})}function pa(e){for(let l of Qt(e)){if(l.account)continue;try{if(l.config&&u(f(l.config).state))Zt(l.config)}catch{}dn(l.directory,{recursive:!0,force:!0})}dn(ga(e),{force:!0})}function oi(e,{prefer:l,keep:v,live:D=!1}){let M=Date.now(),L=(te)=>Number(Date.parse(te.worker?.expiresAt??"")>M+60000),re=Qt(e).flatMap((te)=>{if(!te.account||!te.config)return[];try{if(ft(te.config).revoked)return[];let X=S(te.config);return X&&X.orgId.toLowerCase()===te.organizationId&&(!D||L(X))?[{...te,config:te.config,state:X}]:[]}catch{return[]}}).sort((te,X)=>Number(X.organizationId===l)-Number(te.organizationId===l)||L(X.state)-L(te.state))[0];if(!re)return null;let G=null;try{G=ft(e).revoked?null:S(e)}catch{}let ce=G?.orgId.toLowerCase()??"";if(v&&G&&Zo.test(ce)&&ce!==re.organizationId){let te=Qo(e,ce);bc(e,te.config),y(te.configPath,te.config)}else if(u(p(e))){try{if(u(f(e).state))Zt(e)}catch{}for(let te of fa)dn(Pt(p(e),te),{force:!0})}pa(e);let we=x.parse({...re.config,stateDirectory:e.stateDirectory});return bc(re.config,we),y(Pt(e.stateDirectory,"worker.json"),we),dn(re.directory,{recursive:!0,force:!0}),we}var ha={before(e){for(let{config:l}of Qt(e))try{let v=l?S(l):null;if(l&&v)ao(l,v.devicePublicKey)}catch{}},after(e,l){for(let{organizationId:v,directory:D,configPath:M,config:L}of Qt(l)){if(L)continue;try{let z=x.parse(JSON.parse(m(M)));if(z.stateDirectory!==Pt(Dr(e),v))continue;let re=x.parse({...z,stateDirectory:D}),G=xt(re),ce=Ut(f(re).state,{proofStore:G,repair:!1});if(ce?.worker?.configDigest===O(z))ae({...ce,worker:{...ce.worker,configDigest:O(re)}},f(re).state,{proofStore:G});y(M,re)}catch{}}}},ga=(e)=>Pt(Dr(e),"listed.json");function Rc(e){try{let l=JSON.parse(m(ga(e))),v=l.names&&typeof l.names==="object"&&!Array.isArray(l.names)?Object.fromEntries(Object.entries(l.names).filter((M)=>typeof M[1]==="string")):{},D=l.refused&&typeof l.refused==="object"?l.refused:null;return{listed:l.listed===!0,reason:l.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(l.blocked)?l.blocked.filter((M)=>typeof M==="string"):[],names:v,...D&&typeof D.device==="string"&&typeof D.roots==="string"&&typeof D.at==="number"&&Number.isFinite(D.at)&&typeof D.count==="number"&&Number.isInteger(D.count)&&D.count>=1?{refused:{device:D.device,roots:D.roots,at:D.at,count:D.count}}:{}}}catch{return null}}function Pc(e,l){let v=Qt(e),D=v.filter((G)=>G.account),M=v.filter((G)=>!G.account),L=Rc(e),z=L&&!L.listed?L.reason:null,re=z||M.length===0&&L&&!L.listed?[]:M;if(D.length===0&&re.length===0&&(z||L&&!L.listed))return{workspaces:null,off:z};return{off:z,workspaces:[...D,...re].map(({organizationId:G,config:ce,account:we})=>{let te=!1,X=null,he=!1,Se=null;try{te=ce?ft(ce).revoked:!1,X=ce&&!te?S(ce):null;let Re=ce?rt(f(ce).daemon):null;he=l&&!!X&&Re?.state==="connected",Se=he?mn(Re,X):null}catch{}return{...Se?{permission_recovery:Se}:{},organization_id:G,device_id:X?.deviceId??null,name:L?.names?.[G]??null,root:X?.roots[0]?{id:X.roots[0].id,permissions:X.roots[0].permissions}:null,state:te?"removed":he?"connected":"not_running",blocked:!we&&!te&&!he&&(L?.blocked.includes(G)??!1),...we?{account:!0}:{}}})}}function Cc(e){let{config:l,state:v,client:D,signal:M}=e,L=e.log??(()=>{return}),z=e.intervalMs??ma,re=new Map,G=null,ce=!1,we=Rc(l)??{listed:!1,reason:null,blocked:[]},te=()=>v.roots.map((Ne)=>Ne.id).join(","),X=(Ne)=>{if(!Ne||Ne.device!==v.deviceId||Ne.roots!==te())return!1;let xe=Date.now();return xe>=Ne.at&&xe<Ne.at+Math.min(bf,z*2**Math.min(Ne.count-1,10))},he=(Ne)=>{let{folders:xe,...Le}=l,Ge=v.roots.slice(1).map((Ve)=>Ve.path);return x.parse({...Le,...Ge.length?{folders:Ge}:{},stateDirectory:Pt(Dr(l),Ne)})},Se=async(Ne)=>{let xe=re.get(Ne);if(!xe)return;xe.controller.abort(),await xe.done},Re=(Ne,xe=!1)=>{let Le=new AbortController,Ge=()=>Le.abort();if(M.addEventListener("abort",Ge,{once:!0}),M.aborted)Le.abort();let Ve={...Ne,controller:Le,claims:0,done:Promise.resolve(),account:xe};Ve.done=e.serve(Ne,Le.signal,(Je)=>{Ve.claims=Je}).then(()=>{return},(Je)=>{if(xe&&Je instanceof k&&Je.status===401&&_c.has(Je.code)){try{qt(Ne.config,{version:1,drained:!0,revoked:!0})}catch{}L(`Reason worker: workspace ${Ne.organizationId} (another account's) no longer accepts this computer (${Je.code}); run \`reason connect\` signed in as that account to connect it again
+import{R,Rn}from"./vm-hands-entry-lite-ys4jhf7n.js";import{w,ye,W,An,Pn,Cr}from"./vm-hands-entry-lite-0xfme8gg.js";import{Q,ve}from"./vm-hands-entry-lite-4kb5rq3d.js";import{Aa,be,Pa,C,io,me}from"./vm-hands-entry-lite-dhn0fs5e.js";import{g}from"./vm-hands-entry-lite-n9277v11.js";import{ut,Vn,ir}from"./vm-hands-entry-lite-8s5n4wps.js";import{a,fn,Ht,Si,mt,mn,fr,gn,mr,Ut,ae,rt,Ei,zt}from"./vm-hands-entry-lite-1as6h9ed.js";import{Nr,Ss,Es,pe,Ys,tr,Hn}from"./vm-hands-entry-lite-vvhfaxpd.js";import{Hr}from"./vm-hands-entry-lite-1cdtev4n.js";import{Da,k,or,sr,ee,ar,uo,po,Zr,dt,ho,Qr,en,Kn,Jn,mo,go,_o,Xn}from"./vm-hands-entry-lite-rpf4t8r4.js";import{ri,ni,K,qa,Wa,oe,x,p,vo,ge,se,O,$t,Qe,rn,So,E,_e,Qa,ec,tc,ai,nn,pt,rc,Mt,on,Pe,J,ic,Co,Ao,an,et}from"./vm-hands-entry-lite-mktndd2r.js";import{je}from"./vm-hands-entry-lite-732hnx41.js";import{cr,Ae,Oa,tn,Na,$a}from"./vm-hands-entry-lite-bqs4pkyb.js";import{ne}from"./vm-hands-entry-lite-7aeqbfc8.js";import{le,A,ts,rs}from"./vm-hands-entry-lite-9meg54bs.js";import{Nn,Ln,Ui,Fc}from"./vm-hands-entry-lite-2qh3rat2.js";import{kr,ue}from"./vm-hands-entry-lite-t2rhwchw.js";import{Lt,ie,N,no}from"./vm-hands-entry-lite-h5x725z8.js";import{Ni,ke,de,j,ze,is,kn,os,qe,Li,$i,ss,xn,Ie,as,Cn}from"./vm-hands-entry-lite-ezkb7f6j.js";import{F}from"./vm-hands-entry-lite-bc9zq8gx.js";import{U,H,T}from"./vm-hands-entry-lite-bbjsnjct.js";import{Qn,Ba,Ha,bo,ti}from"./vm-hands-entry-lite-7jmt3q38.js";import{wa}from"./vm-hands-entry-lite-t3k90kdn.js";import{yi}from"./vm-hands-entry-lite-3594pdj0.js";import{Bo}from"./vm-hands-entry-lite-jm9jpj77.js";import{Jt}from"./vm-hands-entry-lite-ksfd234v.js";import{hr,No,Lo,$o}from"./vm-hands-entry-lite-kzygj0q8.js";import{ro}from"./vm-hands-entry-lite-kankyeep.js";import{gi,cc}from"./vm-hands-entry-lite-sxnvhzy5.js";import{u,b,m,y}from"./vm-hands-entry-lite-2927z566.js";import{q}from"./vm-hands-entry-lite-a6ss0ges.js";import{De,wt,ls,Sc,Ec,bt}from"./vm-hands-entry-lite-peyr9y6z.js";import{s,Et}from"./vm-hands-entry-lite-tzv8s0e7.js";import{Jc,Xi,I,t,V,zr,o,_,Rt,d,n,h,P,ul,c,i,Yi}from"./vm-hands-entry-lite-bt6skt4h.js";import{Sa,Y,B}from"./vm-hands-entry-lite-04nx5y4f.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{spawn as Du,spawnSync as Xw}from"child_process";import{closeSync as Mu,existsSync as Zw,mkdirSync as Qw,openSync as Tu,readdirSync as ey,realpathSync as Yr,rmSync as Zn}from"fs";import{hostname as ty}from"os";import{dirname as Bs,join as Bt,resolve as ry}from"path";var Yo={ENOENT:"native_enoent",EACCES:"native_permission_denied",EPERM:"native_permission_denied",ETIMEDOUT:"native_timeout",ECONNREFUSED:"native_network",ECONNRESET:"native_network",ENOTFOUND:"native_network",EAI_AGAIN:"native_network",ENETUNREACH:"native_network",EHOSTUNREACH:"native_network",EPIPE:"native_pipe_closed",ENOSPC:"native_disk_full",EMFILE:"native_too_many_files",EBUSY:"native_busy",E2BIG:"native_args_too_large"};function oc(e){if(!(e instanceof Error))return e===void 0||e===null?"native_no_error":"native_non_error";let l=e.code;if(typeof l==="string"&&Yo[l])return Yo[l];let v=e.message;if(e.name==="TimeoutError"||e.name==="AbortError")return"native_timeout";if(/No handler registered for /.test(v))return"ipc_handler_missing";if(/could not be cloned/i.test(v))return"ipc_clone_failed";if(/Render frame was disposed|Object has been destroyed|WebContents was destroyed/i.test(v))return"ipc_window_closed";let D=/\b(E[A-Z0-9]{2,15})\b/.exec(v)?.[1];if(D&&Yo[D])return Yo[D];if(/timed? ?out|timeout/i.test(v))return"native_timeout";if(/fetch failed|failed to fetch|network|socket hang up|getaddrinfo/i.test(v))return"native_network";if(e.name==="TypeError"&&v==="Load failed")return"native_network";if(/unexpected token|is not valid JSON|JSON\.parse|Unexpected end of JSON/i.test(v))return"native_unreadable_output";if(/keychain|secitem|errSec/i.test(v))return"native_keychain_error";if(/Error invoking remote method/.test(v))return"ipc_remote_error";switch(e.name){case"TypeError":return"native_type_error";case"RangeError":return"native_range_error";case"SyntaxError":return"native_unreadable_output"}return"native_unexpected"}import{createHash as Gu}from"crypto";import{unlinkSync as Yu}from"fs";import{platform as Xu}from"os";import{join as Zu}from"path";var ac=P("store",[h({version:i(1),store:i("keychain")}),h({version:i(1),store:i("file"),api_key:t().min(1).max(4096)})]),dn=(e)=>Zu(e,"api-key.json");function Fr(e){let l=Gu("sha256").update(`reason-connect-api-key
+${e}`).digest("hex");return new mt(fn(),Xu(),l)}function na(e,l,v=Fr(e)){try{v.deleteBinding(),v.createBinding(new TextEncoder().encode(l)),y(dn(e),{version:1,store:"keychain"});return}catch(D){if(!(D instanceof a))throw D}y(dn(e),{version:1,store:"file",api_key:l})}function lr(e,l=Fr(e)){if(!u(dn(e)))return null;let v=ac.parse(JSON.parse(m(dn(e))));if(v.store==="file")return v.api_key;try{let D=l.loadBinding();return D?new TextDecoder().decode(D):null}catch(D){if(!(D instanceof a))throw D;throw Error("worker_api_key_unreadable")}}function sc(e,l=Fr(e)){if(!u(dn(e)))return;if(ac.parse(JSON.parse(m(dn(e)))).store==="keychain")try{l.deleteBinding()}catch(v){if(!(v instanceof a))throw v}Yu(dn(e))}async function oa(e,l){let v;try{v=await ir({env:{REASON_API_KEY:l,REASON_API_URL:e.apiOrigin},fetchImpl:oe(e.proxy)})}catch(D){if(D instanceof C&&(D.status===401||D.status===403))throw Error("worker_api_key_rejected");throw D}if(!v)throw Error("worker_api_key_rejected");if(!v.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return v}import{readdirSync as yf,renameSync as _f,rmSync as un}from"fs";import{join as Pt}from"path";import{createHash as Qu}from"crypto";import{realpathSync as ef,statSync as tf,unlinkSync as Xo}from"fs";import{platform as rf}from"os";import{join as Xt}from"path";function f(e){return{state:Xt(p(e),"device.json"),control:Xt(p(e),"control.json"),lock:Xt(p(e),"lifecycle.lock"),socket:Xt(p(e),"control.sock"),daemon:Xt(p(e),"daemon.json"),releaseCheck:Xt(p(e),"release-check.json"),updateDeferral:Xt(p(e),"update-deferral.json"),firstHeartbeat:Xt(p(e),"first-heartbeat.json")}}var nf=n({version:i(1),device_id:t().min(1).max(160),offer:Rt().optional(),enrollment_ms:o().int().nonnegative().max(tr).optional()});function lc(e,l,v){b(p(e),!0),y(f(e).firstHeartbeat,{version:1,device_id:l,...v.offer?{offer:v.offer}:{},...v.enrollmentMs!==void 0?{enrollment_ms:v.enrollmentMs}:{}})}function ia(e,l){let v=f(e).firstHeartbeat;try{if(!u(v))return null;let D=nf.safeParse(JSON.parse(m(v)));if(Xo(v),!D.success||D.data.device_id!==l)return null;let M=Hn(D.data.offer);return{...M?{offer:M}:{},...D.data.enrollment_ms!==void 0?{enrollmentMs:D.data.enrollment_ms}:{}}}catch{return null}}function xt(e,l=!1){b(p(e),l);let v=["local-device.key","local-device.binding","device.json"].filter((D)=>{let M=Xt(p(e),D);if(!u(M))return!1;return m(M),!0});return e.lifetime==="persistent"&&v.join()==="device.json"?aa(e):new mn(p(e))}function Zo(e,l){xt(e,!0),sf(e);let v=l??aa(e),D=new mn(p(e));try{v.deleteBinding(),v.deleteKey(),v.createFreshPublicKey()}catch(M){if(M instanceof a)return D;throw M}return D.deleteBinding(),D.deleteKey(),v}function aa(e){return new mt(fn(),rf(),of(e))}function of(e){let l=sa(e);return Qu("sha256").update(`reason-worker
+${l?.directory??p(e)}`).digest("hex")}function co(e,l){y(Xt(p(e),lo),{version:1,directory:sa(e)?.directory??p(e),devicePublicKey:l})}var lo="keychain-scope.json";function dc(e){return u(Xt(p(e),lo))}var af=h({version:i(1),directory:t().min(1),devicePublicKey:t().min(1)});function sa(e){let l=Xt(p(e),lo);if(!u(l))return null;let v=af.safeParse(JSON.parse(m(l))),D=f(e).state;if(!v.success||!u(D))return null;return JSON.parse(m(D))?.devicePublicKey===v.data.devicePublicKey?v.data:null}function sf(e){let l=Xt(p(e),lo);if(!u(l))return;if(sa(e))try{let v=aa(e);v.deleteBinding(),v.deleteKey()}catch(v){if(!(v instanceof a))throw v}Xo(l)}function Or(e){let l=ef(e.workspaceRoot);if(l!==e.workspaceRoot||!tf(l).isDirectory()||!ge(l,e.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function S(e){if(!u(p(e)))return null;let l=Ut(f(e).state,{proofStore:xt(e),repair:!1}),v=l!==null&&An(e.apiOrigin,l.apiOrigin),D=v?[O(e),O({...e,apiOrigin:l.apiOrigin})]:[O(e)];if(l&&(!D.includes(l.worker?.configDigest??"")||l.worker.lifetime!==e.lifetime||l.apiOrigin!==e.apiOrigin&&!v||l.roots.length>32||l.roots[0]?.path!==e.workspaceRoot||l.handsSlots!==e.slots))throw Error("worker_config_binding_mismatch");return l}var uc=h({version:i(1),drained:_(),revoked:_()});function ft(e){let l=f(e).control;return u(l)?uc.parse(JSON.parse(m(l))):{version:1,drained:!1,revoked:!1}}function qt(e,l){y(f(e).control,uc.parse(l))}function Zt(e){let l=xt(e);l.deleteBinding(),l.deleteKey();let v=Xt(p(e),lo);if(u(v))Xo(v);let D=f(e).state;if(u(D))Xo(D)}var cf=h({read:_(),write:_(),execute:_(),discover_environment:_(),expose_mcp:i(!1)}),ca=h({version:i(1),organization_id:t().min(1).max(160),enrollment_ticket:t().min(1).max(4096),code_verifier:t().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:t().regex(/^[a-f0-9]{64}$/),root:h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),permissions:cf,execution_mode:c(["confined","host"]).default("confined")}),folders:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),lf=n({device_id:t().min(1).max(160),organization_id:t().min(1).max(160),auth_scheme:i("p256"),protocol_version:i(2),roots:d(n({id:t().min(1),label:t(),path_fingerprint:t()})).min(1).max(32),headless:n({lifecycle:c(["persistent","ephemeral"]),expires_at:I.datetime({offset:!0})}),first_heartbeat:Rt().optional()}),la=30000;class Rr extends Error{deviceRemoved;constructor(e){super("worker_enrollment_rejected");this.deviceRemoved=e}}async function df(e,l,v=fetch){let D=await v(`${e}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(l),redirect:"error",signal:AbortSignal.timeout(la)});if(!D.ok){let M=D.status===409?await D.json().catch(()=>null):null;throw new Rr(M?.error==="device_revoked")}return D.json()}async function da(e,l,v,D){ne();let M=ca.parse(JSON.parse(m(l)));return Er(e,M,v,D)}async function Er(e,l,v,D=(L,z)=>df(L,z,oe(e.proxy)),M=performance.now()){let L=mc(e,l,v),z=await D(e.apiOrigin,{...L.request,enrollment_ticket:l.enrollment_ticket,code_verifier:l.code_verifier});return L.receipt(z,M)}async function fc(e,l,v,D,M=performance.now()){let L=mc(e,l,v),z=await D(L.request,l.code_verifier);return z===null?null:L.receipt(z,M)}function mc(e,l,v){if(ne(),l.root.execution_mode!==e.executionMode)throw Error("worker_enrollment_mode_mismatch");let D=zt([e.workspaceRoot],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(D.path!==e.workspaceRoot||D.pathFingerprint!==l.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let M=(e.folders??[]).map((G,ce)=>{let we=zt([G],l.root.permissions,Buffer.from(l.root_fingerprint_key,"hex"))[0];if(we.path!==G||we.pathFingerprint!==l.folders?.[ce]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return we});if((l.folders?.length??0)!==M.length)throw Error("worker_enrollment_root_mismatch");let L=[{...D,label:"workspace"},...M],z;try{z=v.loadPublicKey()}catch{z=v.createFreshPublicKey()}return{request:{device_public_key:z,name:e.name,os:process.platform,architecture:process.arch,reason_runtime_version:g,bridge_version:g,protocol_version:2,capabilities:{supported_operations:[]},roots:L.map((G)=>({label:G.label,path_fingerprint:G.pathFingerprint,permissions:l.root.permissions}))},receipt(G,ce){let we=lf.parse(G);if(we.organization_id!==l.organization_id||we.roots.length!==L.length||we.roots.some((X,he)=>X.path_fingerprint!==L[he].pathFingerprint)||we.headless.lifecycle!==e.lifetime||Date.parse(we.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let te=Hn(we.first_heartbeat);try{lc(e,we.device_id,{...te?{offer:te}:{},enrollmentMs:Math.min(tr,Math.max(0,Math.round(performance.now()-ce)))})}catch{}return{version:4,apiOrigin:e.apiOrigin,orgId:we.organization_id,deviceId:we.device_id,devicePublicKey:z,displayName:e.name,registeredAt:new Date().toISOString(),handsSlots:e.slots,worker:{configDigest:O(e),lifetime:e.lifetime,expiresAt:we.headless.expires_at},roots:we.roots.map((X,he)=>({id:X.id,label:X.label,path:L[he].path,pathFingerprint:X.path_fingerprint,permissions:l.root.permissions}))}}}}import{randomBytes as uf,randomUUID as ff}from"crypto";import{unlinkSync as mf}from"fs";import{join as pf}from"path";var pc=h({version:i(1),install_id:V(),fingerprint_key:t().regex(/^[a-f0-9]{64}$/)}),hf=n({enrollment_ticket:t().min(1).max(4096),expires_at:I.datetime({offset:!0}),device_kind:i("headless"),lifecycle:c(["persistent","ephemeral"]),device_expires_at:I.datetime({offset:!0})});function ua(e){return hf.parse(e)}var gf=n({credentialKind:c(["oauth","api_key"]).optional(),apiOrigin:zr(),clientId:t(),accessToken:t().min(1).max(32768),refreshToken:t().max(32768),expiresAt:I.datetime({offset:!0}),scopes:d(t().max(128)).max(128),orgId:t().min(1).max(160)});function jr(e){return Q(Rn("REASON_CLI_CHANNEL",e.channel),s())}async function qr(e,l=jr(e)){if(!u(l))return null;let v=gf.parse(JSON.parse(m(l)));if(!W(v.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(v.credentialKind==="api_key")return Date.parse(v.expiresAt)>Date.now()?v:null;let D=oe(e.proxy),M=Object.assign((z,re)=>D(z,{...re,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),L=await be({path:l,fetchImpl:M});if(L&&!W(L.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");return L}async function hc(e,l,v){if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let D=Kr(e);return D.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(D.request))}async function gc(e,l,v,D,M){let L=performance.now();if(!W(l.apiOrigin,e.apiOrigin))throw Error("worker_session_origin_mismatch");if(!l.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let z=Kr(e),re=M?void 0:v.enrollHeadlessDevice?.bind(v);if(re){let G=await fc(e,z.direct(l.orgId),D,(ce,we)=>re({approval:z.request,code_verifier:we,registration:ce}).catch((te)=>{throw wf(te)}),L);if(G)return G}return Er(e,z.complete(l.orgId,await v.createHeadlessDeviceEnrollmentTicket(z.request)),D,M,L)}function wf(e){if(!(e instanceof C))return e;if(e.status===409)return new Rr(e.code==="device_revoked");if(e.status===410||e.status===401&&e.code==="invalid_enrollment_ticket"||e.status===403&&e.code==="grant_exceeded"||e.status===400&&e.code==="invalid_device_enrollment")return new Rr(!1);return e}var fo=(e)=>pf(p(e),"enrollment-install.json");function wc(e){if(u(fo(e)))mf(fo(e))}function Kr(e,{stored:l=!0}={}){ne();let v=fo(e),D=l&&u(v)?pc.parse(JSON.parse(m(v))):{version:1,install_id:ff(),fingerprint_key:uf(32).toString("hex")};if(l&&!u(v))y(v,D);let M={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},L=Buffer.from(D.fingerprint_key,"hex"),z=zt([e.workspaceRoot],M,L)[0];if(z.path!==e.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let re=(e.folders??[]).map((te)=>{let X=zt([te],M,L)[0];if(X.path!==te)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:X.pathFingerprint}}),G=Aa(),ce={install_id:D.install_id,code_challenge:G.challenge,lifecycle:e.lifetime,roots:[z.pathFingerprint,...re.map((te)=>te.path_fingerprint)].map((te)=>({path_fingerprint:te,permissions:M,execution_mode:e.executionMode}))},we=(te)=>({version:1,organization_id:te,code_verifier:G.verifier,root_fingerprint_key:D.fingerprint_key,root:{path_fingerprint:z.pathFingerprint,permissions:M,execution_mode:e.executionMode},...re.length?{folders:re}:{}});return{request:ce,saveInstall(te){b(p(te),!0),y(fo(te),D)},complete(te,X){let he=ua(X);if(he.lifecycle!==e.lifetime||Date.parse(he.expires_at)<=Date.now()||Date.parse(he.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...we(te),enrollment_ticket:he.enrollment_ticket}},direct:we}}function yc(e,l,v){let D=fo(e);if(!u(D))throw Error("worker_folders_unavailable");let M=pc.parse(JSON.parse(m(D)));return zt([l],v,Buffer.from(M.fingerprint_key,"hex"))[0]}var Qo=8,pa=600000,kc=15000,bf=3600000,kf=new Set(["device_not_eligible","sign_in_not_eligible"]),_c=new Set(["device_revoked","invalid_device_credential"]),ei=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,Dr=(e)=>Pt(p(e),"workspaces"),vc="account.json",fa=(e)=>u(Pt(e,vc));function Qt(e){let l;try{l=yf(Dr(e))}catch{return[]}return l.filter((v)=>ei.test(v)).sort().map((v)=>{let D=Pt(Dr(e),v),M=Pt(D,"worker.json"),L=null;try{let z=x.safeParse(JSON.parse(m(M)));if(z.success&&z.data.stateDirectory===D)L=z.data}catch{}return{organizationId:v,directory:D,configPath:M,config:L,account:fa(D)}})}function oi(e,l){let v=l.toLowerCase();if(!ei.test(v))throw Error("worker_workspace_id_invalid");let D=x.parse({...e,stateDirectory:Pt(Dr(e),v)});return b(D.stateDirectory,!0),y(Pt(D.stateDirectory,vc),{version:1}),{config:D,configPath:Pt(D.stateDirectory,"worker.json")}}function ii(e,l){try{let{config:v,configPath:D}=oi(e,l);b(p(v),!0),qt(v,{version:1,drained:!0,revoked:!0}),y(D,v)}catch{}}function wo(e,l){let v=l.toLowerCase(),D=null;try{D=S(e)?.orgId.toLowerCase()??null}catch{}return D===v||Qt(e).some((M)=>!M.account&&M.config!==null&&M.organizationId===v)}var ma=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function bc(e,l){let v=S(e);if(!v?.worker)throw Error("worker_identity_missing");co(e,v.devicePublicKey),b(p(l),!0);for(let L of ma)un(Pt(p(l),L),{force:!0});for(let L of ma){let z=Pt(p(e),L);if(u(z))_f(z,Pt(p(l),L))}let D=xt(l),M=Ut(f(l).state,{proofStore:D,repair:!1});if(!M?.worker)throw Error("worker_identity_missing");ae({...M,worker:{...M.worker,configDigest:O(l)}},f(l).state,{proofStore:D})}function ha(e){for(let l of Qt(e)){if(l.account)continue;try{if(l.config&&u(f(l.config).state))Zt(l.config)}catch{}un(l.directory,{recursive:!0,force:!0})}un(ya(e),{force:!0})}function si(e,{prefer:l,keep:v,live:D=!1}){let M=Date.now(),L=(te)=>Number(Date.parse(te.worker?.expiresAt??"")>M+60000),re=Qt(e).flatMap((te)=>{if(!te.account||!te.config)return[];try{if(ft(te.config).revoked)return[];let X=S(te.config);return X&&X.orgId.toLowerCase()===te.organizationId&&(!D||L(X))?[{...te,config:te.config,state:X}]:[]}catch{return[]}}).sort((te,X)=>Number(X.organizationId===l)-Number(te.organizationId===l)||L(X.state)-L(te.state))[0];if(!re)return null;let G=null;try{G=ft(e).revoked?null:S(e)}catch{}let ce=G?.orgId.toLowerCase()??"";if(v&&G&&ei.test(ce)&&ce!==re.organizationId){let te=oi(e,ce);bc(e,te.config),y(te.configPath,te.config)}else if(u(p(e))){try{if(u(f(e).state))Zt(e)}catch{}for(let te of ma)un(Pt(p(e),te),{force:!0})}ha(e);let we=x.parse({...re.config,stateDirectory:e.stateDirectory});return bc(re.config,we),y(Pt(e.stateDirectory,"worker.json"),we),un(re.directory,{recursive:!0,force:!0}),we}var ga={before(e){for(let{config:l}of Qt(e))try{let v=l?S(l):null;if(l&&v)co(l,v.devicePublicKey)}catch{}},after(e,l){for(let{organizationId:v,directory:D,configPath:M,config:L}of Qt(l)){if(L)continue;try{let z=x.parse(JSON.parse(m(M)));if(z.stateDirectory!==Pt(Dr(e),v))continue;let re=x.parse({...z,stateDirectory:D}),G=xt(re),ce=Ut(f(re).state,{proofStore:G,repair:!1});if(ce?.worker?.configDigest===O(z))ae({...ce,worker:{...ce.worker,configDigest:O(re)}},f(re).state,{proofStore:G});y(M,re)}catch{}}}},ya=(e)=>Pt(Dr(e),"listed.json");function Rc(e){try{let l=JSON.parse(m(ya(e))),v=l.names&&typeof l.names==="object"&&!Array.isArray(l.names)?Object.fromEntries(Object.entries(l.names).filter((M)=>typeof M[1]==="string")):{},D=l.refused&&typeof l.refused==="object"?l.refused:null;return{listed:l.listed===!0,reason:l.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(l.blocked)?l.blocked.filter((M)=>typeof M==="string"):[],names:v,...D&&typeof D.device==="string"&&typeof D.roots==="string"&&typeof D.at==="number"&&Number.isFinite(D.at)&&typeof D.count==="number"&&Number.isInteger(D.count)&&D.count>=1?{refused:{device:D.device,roots:D.roots,at:D.at,count:D.count}}:{}}}catch{return null}}function Pc(e,l){let v=Qt(e),D=v.filter((G)=>G.account),M=v.filter((G)=>!G.account),L=Rc(e),z=L&&!L.listed?L.reason:null,re=z||M.length===0&&L&&!L.listed?[]:M;if(D.length===0&&re.length===0&&(z||L&&!L.listed))return{workspaces:null,off:z};return{off:z,workspaces:[...D,...re].map(({organizationId:G,config:ce,account:we})=>{let te=!1,X=null,he=!1,Se=null;try{te=ce?ft(ce).revoked:!1,X=ce&&!te?S(ce):null;let Re=ce?rt(f(ce).daemon):null;he=l&&!!X&&Re?.state==="connected",Se=he?gn(Re,X):null}catch{}return{...Se?{permission_recovery:Se}:{},organization_id:G,device_id:X?.deviceId??null,name:L?.names?.[G]??null,root:X?.roots[0]?{id:X.roots[0].id,permissions:X.roots[0].permissions}:null,state:te?"removed":he?"connected":"not_running",blocked:!we&&!te&&!he&&(L?.blocked.includes(G)??!1),...we?{account:!0}:{}}})}}function Cc(e){let{config:l,state:v,client:D,signal:M}=e,L=e.log??(()=>{return}),z=e.intervalMs??pa,re=new Map,G=null,ce=!1,we=Rc(l)??{listed:!1,reason:null,blocked:[]},te=()=>v.roots.map((Ne)=>Ne.id).join(","),X=(Ne)=>{if(!Ne||Ne.device!==v.deviceId||Ne.roots!==te())return!1;let xe=Date.now();return xe>=Ne.at&&xe<Ne.at+Math.min(bf,z*2**Math.min(Ne.count-1,10))},he=(Ne)=>{let{folders:xe,...Le}=l,Ge=v.roots.slice(1).map((Ve)=>Ve.path);return x.parse({...Le,...Ge.length?{folders:Ge}:{},stateDirectory:Pt(Dr(l),Ne)})},Se=async(Ne)=>{let xe=re.get(Ne);if(!xe)return;xe.controller.abort(),await xe.done},Re=(Ne,xe=!1)=>{let Le=new AbortController,Ge=()=>Le.abort();if(M.addEventListener("abort",Ge,{once:!0}),M.aborted)Le.abort();let Ve={...Ne,controller:Le,claims:0,done:Promise.resolve(),account:xe};Ve.done=e.serve(Ne,Le.signal,(Je)=>{Ve.claims=Je}).then(()=>{return},(Je)=>{if(xe&&Je instanceof k&&Je.status===401&&_c.has(Je.code)){try{qt(Ne.config,{version:1,drained:!0,revoked:!0})}catch{}L(`Reason worker: workspace ${Ne.organizationId} (another account's) no longer accepts this computer (${Je.code}); run \`reason connect\` signed in as that account to connect it again
 `)}else if(Je instanceof k&&Je.status===401&&_c.has(Je.code)){try{Zt(Ne.config)}catch{}L(`Reason worker: workspace ${Ne.organizationId} no longer accepts this computer
 `)}else if(!Le.signal.aborted)L(`Reason worker: workspace ${Ne.organizationId} stopped (worker_workspace_failed); it starts again on the next check
-`)}).finally(()=>{if(Le.abort(),M.removeEventListener("abort",Ge),Ve.claims=0,re.get(Ne.organizationId)===Ve)re.delete(Ne.organizationId);let Je=Ne.config.stateDirectory;if(xe&&!ua(Je)&&!u(Pt(Je,"worker.json")))dn(Je,{recursive:!0,force:!0})}),re.set(Ne.organizationId,Ve)},Ee=(Ne,xe)=>{if(!xe)return null;try{let Le=he(Ne),Ge=S(xe);if(!Ge||Ge.orgId!==Ne||Date.parse(Ge.worker?.expiresAt??"")<=Date.now()+60000||xe.name!==Le.name||xe.executionMode!==Le.executionMode||!W(xe.apiOrigin,Le.apiOrigin)||Ge.roots.map((Ve)=>Ve.path).join(`
+`)}).finally(()=>{if(Le.abort(),M.removeEventListener("abort",Ge),Ve.claims=0,re.get(Ne.organizationId)===Ve)re.delete(Ne.organizationId);let Je=Ne.config.stateDirectory;if(xe&&!fa(Je)&&!u(Pt(Je,"worker.json")))un(Je,{recursive:!0,force:!0})}),re.set(Ne.organizationId,Ve)},Ee=(Ne,xe)=>{if(!xe)return null;try{let Le=he(Ne),Ge=S(xe);if(!Ge||Ge.orgId!==Ne||Date.parse(Ge.worker?.expiresAt??"")<=Date.now()+60000||xe.name!==Le.name||xe.executionMode!==Le.executionMode||!W(xe.apiOrigin,Le.apiOrigin)||Ge.roots.map((Ve)=>Ve.path).join(`
 `)!==v.roots.map((Ve)=>Ve.path).join(`
-`))return null;return{organizationId:Ne,config:xe,state:Ge,proofStore:xt(xe)}}catch{return null}},Oe=(Ne,xe)=>{if(!xe)return null;try{if(ft(xe).revoked)return null;let Le=S(xe);if(!Le||Le.orgId.toLowerCase()!==Ne||Date.parse(Le.worker?.expiresAt??"")<=Date.now()+60000||xe.executionMode!==l.executionMode||!W(xe.apiOrigin,l.apiOrigin))return null;return{organizationId:Ne,config:xe,state:Le,proofStore:xt(xe)}}catch{return null}},Me=(Ne,xe)=>Ne.deviceId===xe.deviceId&&Ne.devicePublicKey===xe.devicePublicKey&&JSON.stringify(Ne.roots.map((Le)=>[Le.id,Le.path]))===JSON.stringify(xe.roots.map((Le)=>[Le.id,Le.path])),Ce=async(Ne)=>{for(let[xe,Le]of Ne){if(M.aborted)return;let Ge=re.get(xe),Ve=Oe(xe,Le.config);if(Ge&&Ve&&Me(Ge.state,Ve.state))continue;if(Ge){if(Ge.claims>0)continue;await Se(xe)}if(Ve&&!M.aborted)Re(Ve,!0)}for(let[xe,Le]of re)if(Le.account&&!Ne.has(xe)&&Le.claims===0)await Se(xe)},Te=async(Ne)=>{let xe=he(Ne),Le=x.parse({...xe,stateDirectory:l.stateDirectory});if(!u(Pt(p(l),"enrollment-install.json")))return null;let Ge=Kr(Le),Ve=await D.ownerWorkspaceEnrollment(v,{organization_id:Ne,install_id:Ge.request.install_id,code_challenge:Ge.request.code_challenge},M),Je=Ge.complete(Ne,Ve);if(b(p(xe),!0),u(f(xe).state))Zt(xe);let it=Yo(xe);try{let Ye=await Er(xe,Je,it,e.enroll);return ae(Ye,f(xe).state,{proofStore:it}),qt(xe,{version:1,drained:!1,revoked:!1}),y(Pt(xe.stateDirectory,"worker.json"),xe),{organizationId:Ne,config:xe,state:Ye,proofStore:it}}catch(Ye){if(Ye instanceof Rr&&Ye.deviceRemoved)return qt(xe,{version:1,drained:!0,revoked:!0}),y(Pt(xe.stateDirectory,"worker.json"),xe),null;throw Ye}},We=async()=>{let Ne=Qt(l),xe=new Map(Ne.filter((He)=>He.account).map((He)=>[He.organizationId,He]));await Ce(xe);let Le=new Map(Ne.filter((He)=>!He.account).map((He)=>[He.organizationId,He])),Ge=(He)=>xe.has(He)||re.get(He)?.account===!0||ua(Pt(Dr(l),He)),Ve=(He)=>{let at=Le.get(He)?.config;try{return at?ft(at).revoked:!1}catch{return!1}};for(let[He,at]of Le){if(re.has(He)||Ve(He)||we.blocked.includes(He))continue;let lt=Ee(He,at.config);if(lt&&!M.aborted)Re(lt)}if(X(we.refused))return!0;let Je;try{Je=await D.ownerWorkspaces(v,M)}catch(He){let at=He instanceof k&&He.status===403&&kf.has(He.code),lt=we.refused,kt=te(),jt=at?{device:v.deviceId,roots:kt,at:Date.now(),count:lt?.device===v.deviceId&&lt.roots===kt?lt.count+1:1}:lt;return we={listed:!1,blocked:we.blocked,...we.names?{names:we.names}:{},reason:He instanceof k&&He.status===403&&He.code==="sign_in_not_eligible"?"sign_in":null,...jt?{refused:jt}:{}},at}let it=new Map(Je.map((He)=>[He.id.toLowerCase(),He.blocked]).filter(([He])=>Zo.test(He)&&He!==v.orgId.toLowerCase()&&!Ge(He))),Ye=[...it.keys()].filter((He)=>Le.has(He)?!Ve(He):!it.get(He)).slice(0,Xo),Be=[...re.values()].filter((He)=>!He.account&&He.claims>0&&!Ye.includes(He.organizationId)).length,Ke=Ye.filter((He)=>!Le.has(He)),Fe=Ke.slice(Ke.length-Math.min(Math.max(0,Ye.length+Be-Xo),Ke.length)),nt=Ye.filter((He)=>!Fe.includes(He)),Ze=Object.fromEntries(Je.flatMap((He)=>He.name&&nt.includes(He.id.toLowerCase())?[[He.id.toLowerCase(),He.name]]:[]));we={listed:!0,reason:null,blocked:nt.filter((He)=>it.get(He)),names:Ze};for(let He of new Set([...Le.keys(),...re.keys()])){if(nt.includes(He)||Ge(He))continue;if(it.has(He)&&Ve(He))continue;if((re.get(He)?.claims??0)>0)continue;await Se(He);let at=Le.get(He)?.config;try{if(at&&u(f(at).state))Zt(at)}catch{}dn(Pt(Dr(l),He),{recursive:!0,force:!0}),L(`Reason worker: left workspace ${He}
+`))return null;return{organizationId:Ne,config:xe,state:Ge,proofStore:xt(xe)}}catch{return null}},Oe=(Ne,xe)=>{if(!xe)return null;try{if(ft(xe).revoked)return null;let Le=S(xe);if(!Le||Le.orgId.toLowerCase()!==Ne||Date.parse(Le.worker?.expiresAt??"")<=Date.now()+60000||xe.executionMode!==l.executionMode||!W(xe.apiOrigin,l.apiOrigin))return null;return{organizationId:Ne,config:xe,state:Le,proofStore:xt(xe)}}catch{return null}},Me=(Ne,xe)=>Ne.deviceId===xe.deviceId&&Ne.devicePublicKey===xe.devicePublicKey&&JSON.stringify(Ne.roots.map((Le)=>[Le.id,Le.path]))===JSON.stringify(xe.roots.map((Le)=>[Le.id,Le.path])),Ce=async(Ne)=>{for(let[xe,Le]of Ne){if(M.aborted)return;let Ge=re.get(xe),Ve=Oe(xe,Le.config);if(Ge&&Ve&&Me(Ge.state,Ve.state))continue;if(Ge){if(Ge.claims>0)continue;await Se(xe)}if(Ve&&!M.aborted)Re(Ve,!0)}for(let[xe,Le]of re)if(Le.account&&!Ne.has(xe)&&Le.claims===0)await Se(xe)},Te=async(Ne)=>{let xe=he(Ne),Le=x.parse({...xe,stateDirectory:l.stateDirectory});if(!u(Pt(p(l),"enrollment-install.json")))return null;let Ge=Kr(Le),Ve=await D.ownerWorkspaceEnrollment(v,{organization_id:Ne,install_id:Ge.request.install_id,code_challenge:Ge.request.code_challenge},M),Je=Ge.complete(Ne,Ve);if(b(p(xe),!0),u(f(xe).state))Zt(xe);let it=Zo(xe);try{let Ye=await Er(xe,Je,it,e.enroll);return ae(Ye,f(xe).state,{proofStore:it}),qt(xe,{version:1,drained:!1,revoked:!1}),y(Pt(xe.stateDirectory,"worker.json"),xe),{organizationId:Ne,config:xe,state:Ye,proofStore:it}}catch(Ye){if(Ye instanceof Rr&&Ye.deviceRemoved)return qt(xe,{version:1,drained:!0,revoked:!0}),y(Pt(xe.stateDirectory,"worker.json"),xe),null;throw Ye}},We=async()=>{let Ne=Qt(l),xe=new Map(Ne.filter((He)=>He.account).map((He)=>[He.organizationId,He]));await Ce(xe);let Le=new Map(Ne.filter((He)=>!He.account).map((He)=>[He.organizationId,He])),Ge=(He)=>xe.has(He)||re.get(He)?.account===!0||fa(Pt(Dr(l),He)),Ve=(He)=>{let at=Le.get(He)?.config;try{return at?ft(at).revoked:!1}catch{return!1}};for(let[He,at]of Le){if(re.has(He)||Ve(He)||we.blocked.includes(He))continue;let lt=Ee(He,at.config);if(lt&&!M.aborted)Re(lt)}if(X(we.refused))return!0;let Je;try{Je=await D.ownerWorkspaces(v,M)}catch(He){let at=He instanceof k&&He.status===403&&kf.has(He.code),lt=we.refused,kt=te(),jt=at?{device:v.deviceId,roots:kt,at:Date.now(),count:lt?.device===v.deviceId&&lt.roots===kt?lt.count+1:1}:lt;return we={listed:!1,blocked:we.blocked,...we.names?{names:we.names}:{},reason:He instanceof k&&He.status===403&&He.code==="sign_in_not_eligible"?"sign_in":null,...jt?{refused:jt}:{}},at}let it=new Map(Je.map((He)=>[He.id.toLowerCase(),He.blocked]).filter(([He])=>ei.test(He)&&He!==v.orgId.toLowerCase()&&!Ge(He))),Ye=[...it.keys()].filter((He)=>Le.has(He)?!Ve(He):!it.get(He)).slice(0,Qo),Be=[...re.values()].filter((He)=>!He.account&&He.claims>0&&!Ye.includes(He.organizationId)).length,Ke=Ye.filter((He)=>!Le.has(He)),Fe=Ke.slice(Ke.length-Math.min(Math.max(0,Ye.length+Be-Qo),Ke.length)),nt=Ye.filter((He)=>!Fe.includes(He)),Ze=Object.fromEntries(Je.flatMap((He)=>He.name&&nt.includes(He.id.toLowerCase())?[[He.id.toLowerCase(),He.name]]:[]));we={listed:!0,reason:null,blocked:nt.filter((He)=>it.get(He)),names:Ze};for(let He of new Set([...Le.keys(),...re.keys()])){if(nt.includes(He)||Ge(He))continue;if(it.has(He)&&Ve(He))continue;if((re.get(He)?.claims??0)>0)continue;await Se(He);let at=Le.get(He)?.config;try{if(at&&u(f(at).state))Zt(at)}catch{}un(Pt(Dr(l),He),{recursive:!0,force:!0}),L(`Reason worker: left workspace ${He}
 `)}for(let He of nt){if(M.aborted)return!0;if(Ge(He))continue;try{let at=re.get(He);if(it.get(He)){if(at&&at.claims===0)await Se(He),L(`Reason worker: offline in workspace ${He} (outside its allowed networks)
 `);continue}let lt=Ee(He,Le.get(He)?.config??null);if(lt&&at)continue;if(!lt){if(at&&at.claims>0)continue;if(await Se(He),lt=await Te(He),lt)L(`Reason worker: connected in workspace ${He}
 `)}if(lt&&!M.aborted)Re(lt)}catch{L(`Reason worker: could not connect in workspace ${He} (worker_workspace_failed); it is tried again
-`)}}return!0},$e=null,Ue=async()=>{let Ne=!1;do ce=!1,Ne=await We().catch(()=>!1);while(ce&&!M.aborted);let xe=JSON.stringify({version:1,...we});if($e!==xe)try{b(Dr(l),!0),y(ga(l),JSON.parse(xe)),$e=xe}catch{}return Ne};return{check(){if(G)ce=!0;else G=Ue().finally(()=>{G=null});return G},claims:()=>[...re.values()].reduce((Ne,xe)=>Ne+xe.claims,0),async settled(){await G,await Promise.all([...re.values()].map((Ne)=>Ne.done))}}}import{dirname as vf}from"path";function Ic(e){let l={saved:e.saved,configPath:e.configPath};if(!e.saved||!Sf(e.saved))return l;let v=e.saved,D=(z,re)=>e.log(JSON.stringify({event:"worker.api_origin_move",outcome:z,...re?{code:`worker_api_origin_move_${z}:${re}`}:{},timestamp:new Date().toISOString()})),M=e.native===void 0?bt():e.native;if(!M)return l;let L=[];try{let z=M.lock(vf(e.configPath));if(!z)return l;if(L.push(z),u(p(v))){let we=ie({path:f(v).lock,runtimeVersion:g});if(!we.acquired)return l;L.push(()=>we.release())}let re=x.parse(JSON.parse(m(e.configPath)));if(re.stateDirectory!==v.stateDirectory)return l;let G=Oc(re),ce={saved:re,configPath:e.configPath};if(!ii(re)&&G.length===0)return D("unchanged"),ce;if(ii(re)){let we=Ac(re);y(e.configPath,we),ce={saved:we,configPath:e.configPath}}for(let we of G)try{y(we.configPath,Ac(we.config))}catch(te){D("failed",`workspace:${xc(te)}`)}return D("moved"),ce}catch(z){return D("failed",xc(z)),l}finally{for(let z of L.reverse())z()}}function ii(e){return ye(e.apiOrigin)!==e.apiOrigin}function Oc(e){return Qt(e).filter((l)=>l.config!==null&&ii(l.config))}function Sf(e){return ii(e)||Oc(e).length>0}function Ac(e){let l=x.parse({...e,apiOrigin:ye(e.apiOrigin)}),v=S(e);if(!v)return l;if(!v.worker)throw Error("worker_identity_missing");let D=O(l);if(v.apiOrigin!==l.apiOrigin||v.worker.configDigest!==D)ae({...v,apiOrigin:l.apiOrigin,worker:{...v.worker,configDigest:D}},f(l).state,{proofStore:xt(l)});return l}function xc(e){if(e instanceof a)return e.code;if(e instanceof Error&&/^worker_[a-z_]+$/.test(e.message))return e.message;return e instanceof Error&&"code"in e&&typeof e.code==="string"?e.code:"unexpected"}import{chmodSync as Rf,lstatSync as ba,readdirSync as Tc,readlinkSync as Ef,unlinkSync as Pf}from"fs";import{join as Wt,sep as Cf}from"path";var ai="rehome.json";class ci extends Error{code;constructor(e){super(e);this.code=e}}function Lc(e){let l={saved:e.saved,configPath:e.configPath},v=Wt(e.home,".config"),D=Wt(v,"ara"),M=e.channel==="production"?["connect"]:[e.channel,"connect"],L=Wt(D,...M),z=Wt(v,"reason",...M),re=(te,X)=>e.log(JSON.stringify({event:"worker.state_rehome",outcome:te,...X?{code:`worker_state_rehome_${te}:${X}`}:{},timestamp:new Date().toISOString()})),G=e.native===void 0?bt():e.native,ce=e.saved,we=[];try{if(ce&&Mc(D)&&ce.stateDirectory===L){let Oe={...ce,stateDirectory:z};if(!wa(G,z,Oe,we))return l;return Dc(ce,Oe,e.host,re)}if(ce&&Mc(D)&&ce.stateDirectory===z&&dc(ce)&&wa(G,z,ce,we))return Wc({...ce,stateDirectory:L},ce,e.host),l;if(!ce||ce.lifetime!=="persistent"||ce.stateDirectory!==L||!Dn(D)?.isDirectory())return l;if(Mf(L)===g)return l;let X=(Oe,Me=!0)=>{if(Me)y(Wt(L,ai),{version:g});return re("skipped",Oe),l},he=[L];for(let Oe of xf(D,L)){if(Oe.config?.lifetime!=="ephemeral")return X("several_connections");if(!Af(Oe.directory,Oe.config,we))return X("once_running",!1);he.push(Oe.directory)}if(!G)return X("config_rename_unavailable:no_native");if(!wa(G,L,ce,we))return l;let Se=S(ce);if(!Se||ft(ce).revoked)return l;if(Sc(v)!==null)return X("conflicting_identity");if(Ec(v)!==null)return X("conflicting_files");if(Dn(z)&&(!Dn(z).isDirectory()||Tc(z).length>0))return X("connection_folder_taken");ao(ce,Se.devicePublicKey),ha.before(ce);let Re=lr(L);if(Re&&_a(L))If(z,Re);let Ee=De(v,G,he);if(Ee.state!=="renamed"&&Ee.state!=="linked"){if(Re&&_a(L))Nc(z);return X(Ee.problem??"config_folder_kept")}return Dc(ce,{...ce,stateDirectory:z},e.host,re)}catch(te){try{if(Dn(L)?.isDirectory())y(Wt(L,ai),{version:g})}catch{}return re("failed",Tf(te)),Df(ce,L,z,l)}finally{for(let te of we.reverse())te()}}function Dc(e,l,v,D){let M=ba(l.stateDirectory);if(M.isDirectory()&&M.uid===process.getuid?.()&&(M.mode&63)!==0)Rf(l.stateDirectory,448);let L=xt(l),z=Ut(f(l).state,{proofStore:L,repair:!1});if(!z?.worker)throw new ci("identity_missing");let re=O(l);if(z.worker.configDigest===O(e))ae({...z,worker:{...z.worker,configDigest:re}},f(l).state,{proofStore:L});else if(z.worker.configDigest!==re)throw new ci("worker_config_binding_mismatch");y(Wt(l.stateDirectory,"worker.json"),l),ha.after(e,l),Wc(e,l,v);let G=Wt(l.stateDirectory,ai);if(u(G))Pf(G);return D("moved"),{saved:l,configPath:Wt(l.stateDirectory,"worker.json")}}function Wc(e,l,v){if(ss(e,l,v,"connect"),!_a(l.stateDirectory))return;let D=Of(Fr(e.stateDirectory));if(!D)return;let M=Fr(l.stateDirectory),L;try{L=M.loadBinding()}catch{return}if(!L)M.createBinding(D);Nc(e.stateDirectory)}function wa(e,l,v,D){if(e){let L=e.lock(l);if(!L)return!1;D.push(L)}if(!u(p(v)))return!0;let M=ie({path:f(v).lock,runtimeVersion:g});if(!M.acquired)return!1;return D.push(()=>M.release()),!0}function Af(e,l,v){if(u(p(l))){let M=ie({path:f(l).lock,runtimeVersion:g});if(!M.acquired)return!1;return v.push(()=>M.release()),!0}let D=Dn(Wt(e,"worker.json"));return D!==null&&Date.now()-D.mtimeMs>60000}function xf(e,l){let v=[e,...Tc(e,{withFileTypes:!0}).filter((M)=>M.isDirectory()&&!M.name.startsWith(".")).map((M)=>Wt(e,M.name))],D=[];for(let M of v)for(let L of["connect","connect-once"]){let z=Wt(M,L);if(z===l||!Dn(Wt(z,"worker.json")))continue;let re=Hc(z);if(!re||re.stateDirectory===e||re.stateDirectory.startsWith(e+Cf))D.push({directory:z,config:re})}return D}function _a(e){try{return JSON.parse(m(Wt(e,"api-key.json"))).store==="keychain"}catch{return!1}}function If(e,l){let v=Fr(e);v.deleteBinding(),v.createBinding(new TextEncoder().encode(l))}function Nc(e){try{Fr(e).deleteBinding()}catch(l){if(!(l instanceof a))throw l}}function Of(e){try{return e.loadBinding()}catch(l){if(l instanceof a)return null;throw l}}function Df(e,l,v,D){if(e?.stateDirectory!==l)return D;let M=Hc(v);return M?.stateDirectory===v?{saved:M,configPath:Wt(v,"worker.json")}:D}function Mc(e){try{return ba(e).isSymbolicLink()&&Ef(e)==="reason"}catch{return!1}}function Mf(e){try{let l=JSON.parse(m(Wt(e,ai)));return typeof l.version==="string"?l.version:null}catch{return null}}function Hc(e){try{let l=Wt(e,"worker.json");return u(l)?x.parse(JSON.parse(m(l))):null}catch{return null}}function Dn(e){try{return ba(e)}catch{return null}}function Tf(e){if(e instanceof ci)return e.code;if(e instanceof Error&&/^worker_[a-z_]+$/.test(e.message))return e.message;if(e instanceof a)return e.code;return e instanceof Error&&"code"in e&&typeof e.code==="string"?e.code:"unexpected"}import{readFileSync as Lf}from"fs";function nr(e){try{let l=JSON.parse(Lf(`${e}.keep-awake.json`,"utf8"));return l!==null&&typeof l==="object"&&"version"in l&&l.version===1&&"enabled"in l&&l.enabled===!0?"battery_and_ac":void 0}catch(l){return l.code==="ENOENT"?"battery_and_ac":void 0}}function $c(e,l){y(`${e}.keep-awake.json`,{version:1,enabled:l})}import{createHash as Aw}from"crypto";import{readdirSync as xw,realpathSync as Ts,statSync as Iw}from"fs";import{hostname as Ow}from"os";import{join as Sn,resolve as Dw}from"path";var li="cloud",Wf=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function yo(e){return Wf.test(e)&&!on.test(e)}var Nf={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings \u203A API keys) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_api_unreachable:"This computer could not reach Reason. Check its internet connection, and any VPN, proxy or firewall that lets the Reason app through but not the reason command, then try again.",worker_api_certificate_untrusted:"This computer did not trust Reason's certificate. A proxy, VPN or security software inspecting HTTPS, or a wrong clock, usually causes this: let Reason through it, then try again.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Mn(e){return Nf[e]}import{randomUUID as Hf}from"crypto";import{chmodSync as $f,lstatSync as di,mkdtempSync as Bf,realpathSync as qc,rmdirSync as Uf,rmSync as Ff,unlinkSync as jf}from"fs";import{createConnection as qf,createServer as zf}from"net";import{basename as Bc,dirname as Uc,join as un}from"path";var Kf=c(["status","drain","resume","stop","reload_roots"]),Vf=h({version:i(1),instanceId:t(),deviceId:t(),phase:c(["starting","running","reconnecting","stopping"]),drained:_(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:_(),supportedOperations:d(c(Nr)).max(Nr.length).optional(),capabilityReadiness:ul(c(Nr),_()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),Jf=h({nonce:t(),action:Kf}),Gf=n({nonce:V()}),zc=h({version:i(1),nonce:V(),socketPath:t().max(100)});function Kc(e){return un(f(e).lock,"control.json")}function ui(e){return b(f(e).lock),Gf.parse(JSON.parse(m(un(f(e).lock,"owner.json"))))}function jc(e){if(!u(e))return!1;let l=di(e);if(!l.isSocket()||l.uid!==process.getuid?.()||(l.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function Vc(e,l){let v=Kc(e);if(!u(v)){let L=f(e).socket;if(!u(L)||!di(L).isSocket())return null;return jc(L)?L:null}let D=zc.parse(JSON.parse(m(v)));if(D.nonce!==l)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!Yf.test(D.socketPath))throw Error("worker_control_endpoint_invalid");return D.socketPath}let M=Uc(D.socketPath);if(Uc(M)!==qc("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Bc(M))||Bc(D.socketPath)!=="control.sock"||Buffer.byteLength(D.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(M))return null;return b(M),jc(D.socketPath)?D.socketPath:null}var Yf=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;async function fi(e,l,v){if(ui(e).nonce!==l)throw Error("worker_instance_changed");let D=Kc(e);if(u(D))throw Error("worker_control_already_serving");let M=process.platform==="win32",L=M?null:Bf(un(qc("/tmp"),"ara-worker-")),z=L?un(L,"control.sock"):`\\\\.\\pipe\\reason-worker-${Hf()}`;if(L)b(L);if(Buffer.byteLength(z)>100)throw Error("worker_socket_path_too_long");let re=new Set,G=zf((X)=>{re.add(X),X.once("close",()=>re.delete(X)),X.setTimeout(2000,()=>X.destroy());let he="",Se=!1;X.on("error",()=>X.destroy()),X.on("data",(Re)=>{if(Se)return;if(he+=Re.toString(),Buffer.byteLength(he)>4096){X.destroy();return}if(!he.includes(`
+`)}}return!0},$e=null,Ue=async()=>{let Ne=!1;do ce=!1,Ne=await We().catch(()=>!1);while(ce&&!M.aborted);let xe=JSON.stringify({version:1,...we});if($e!==xe)try{b(Dr(l),!0),y(ya(l),JSON.parse(xe)),$e=xe}catch{}return Ne};return{check(){if(G)ce=!0;else G=Ue().finally(()=>{G=null});return G},claims:()=>[...re.values()].reduce((Ne,xe)=>Ne+xe.claims,0),async settled(){await G,await Promise.all([...re.values()].map((Ne)=>Ne.done))}}}import{dirname as vf}from"path";function Ic(e){let l={saved:e.saved,configPath:e.configPath};if(!e.saved||!Sf(e.saved))return l;let v=e.saved,D=(z,re)=>e.log(JSON.stringify({event:"worker.api_origin_move",outcome:z,...re?{code:`worker_api_origin_move_${z}:${re}`}:{},timestamp:new Date().toISOString()})),M=e.native===void 0?bt():e.native;if(!M)return l;let L=[];try{let z=M.lock(vf(e.configPath));if(!z)return l;if(L.push(z),u(p(v))){let we=ie({path:f(v).lock,runtimeVersion:g});if(!we.acquired)return l;L.push(()=>we.release())}let re=x.parse(JSON.parse(m(e.configPath)));if(re.stateDirectory!==v.stateDirectory)return l;let G=Oc(re),ce={saved:re,configPath:e.configPath};if(!ci(re)&&G.length===0)return D("unchanged"),ce;if(ci(re)){let we=Ac(re);y(e.configPath,we),ce={saved:we,configPath:e.configPath}}for(let we of G)try{y(we.configPath,Ac(we.config))}catch(te){D("failed",`workspace:${xc(te)}`)}return D("moved"),ce}catch(z){return D("failed",xc(z)),l}finally{for(let z of L.reverse())z()}}function ci(e){return ye(e.apiOrigin)!==e.apiOrigin}function Oc(e){return Qt(e).filter((l)=>l.config!==null&&ci(l.config))}function Sf(e){return ci(e)||Oc(e).length>0}function Ac(e){let l=x.parse({...e,apiOrigin:ye(e.apiOrigin)}),v=S(e);if(!v)return l;if(!v.worker)throw Error("worker_identity_missing");let D=O(l);if(v.apiOrigin!==l.apiOrigin||v.worker.configDigest!==D)ae({...v,apiOrigin:l.apiOrigin,worker:{...v.worker,configDigest:D}},f(l).state,{proofStore:xt(l)});return l}function xc(e){if(e instanceof a)return e.code;if(e instanceof Error&&/^worker_[a-z_]+$/.test(e.message))return e.message;return e instanceof Error&&"code"in e&&typeof e.code==="string"?e.code:"unexpected"}import{chmodSync as Rf,lstatSync as ka,readdirSync as Tc,readlinkSync as Ef,unlinkSync as Pf}from"fs";import{join as Wt,sep as Cf}from"path";var li="rehome.json";class di extends Error{code;constructor(e){super(e);this.code=e}}function Lc(e){let l={saved:e.saved,configPath:e.configPath},v=Wt(e.home,".config"),D=Wt(v,"ara"),M=e.channel==="production"?["connect"]:[e.channel,"connect"],L=Wt(D,...M),z=Wt(v,"reason",...M),re=(te,X)=>e.log(JSON.stringify({event:"worker.state_rehome",outcome:te,...X?{code:`worker_state_rehome_${te}:${X}`}:{},timestamp:new Date().toISOString()})),G=e.native===void 0?bt():e.native,ce=e.saved,we=[];try{if(ce&&Mc(D)&&ce.stateDirectory===L){let Oe={...ce,stateDirectory:z};if(!_a(G,z,Oe,we))return l;return Dc(ce,Oe,e.host,re)}if(ce&&Mc(D)&&ce.stateDirectory===z&&dc(ce)&&_a(G,z,ce,we))return Wc({...ce,stateDirectory:L},ce,e.host),l;if(!ce||ce.lifetime!=="persistent"||ce.stateDirectory!==L||!Dn(D)?.isDirectory())return l;if(Mf(L)===g)return l;let X=(Oe,Me=!0)=>{if(Me)y(Wt(L,li),{version:g});return re("skipped",Oe),l},he=[L];for(let Oe of xf(D,L)){if(Oe.config?.lifetime!=="ephemeral")return X("several_connections");if(!Af(Oe.directory,Oe.config,we))return X("once_running",!1);he.push(Oe.directory)}if(!G)return X("config_rename_unavailable:no_native");if(!_a(G,L,ce,we))return l;let Se=S(ce);if(!Se||ft(ce).revoked)return l;if(Sc(v)!==null)return X("conflicting_identity");if(Ec(v)!==null)return X("conflicting_files");if(Dn(z)&&(!Dn(z).isDirectory()||Tc(z).length>0))return X("connection_folder_taken");co(ce,Se.devicePublicKey),ga.before(ce);let Re=lr(L);if(Re&&ba(L))If(z,Re);let Ee=De(v,G,he);if(Ee.state!=="renamed"&&Ee.state!=="linked"){if(Re&&ba(L))Nc(z);return X(Ee.problem??"config_folder_kept")}return Dc(ce,{...ce,stateDirectory:z},e.host,re)}catch(te){try{if(Dn(L)?.isDirectory())y(Wt(L,li),{version:g})}catch{}return re("failed",Tf(te)),Df(ce,L,z,l)}finally{for(let te of we.reverse())te()}}function Dc(e,l,v,D){let M=ka(l.stateDirectory);if(M.isDirectory()&&M.uid===process.getuid?.()&&(M.mode&63)!==0)Rf(l.stateDirectory,448);let L=xt(l),z=Ut(f(l).state,{proofStore:L,repair:!1});if(!z?.worker)throw new di("identity_missing");let re=O(l);if(z.worker.configDigest===O(e))ae({...z,worker:{...z.worker,configDigest:re}},f(l).state,{proofStore:L});else if(z.worker.configDigest!==re)throw new di("worker_config_binding_mismatch");y(Wt(l.stateDirectory,"worker.json"),l),ga.after(e,l),Wc(e,l,v);let G=Wt(l.stateDirectory,li);if(u(G))Pf(G);return D("moved"),{saved:l,configPath:Wt(l.stateDirectory,"worker.json")}}function Wc(e,l,v){if(as(e,l,v,"connect"),!ba(l.stateDirectory))return;let D=Of(Fr(e.stateDirectory));if(!D)return;let M=Fr(l.stateDirectory),L;try{L=M.loadBinding()}catch{return}if(!L)M.createBinding(D);Nc(e.stateDirectory)}function _a(e,l,v,D){if(e){let L=e.lock(l);if(!L)return!1;D.push(L)}if(!u(p(v)))return!0;let M=ie({path:f(v).lock,runtimeVersion:g});if(!M.acquired)return!1;return D.push(()=>M.release()),!0}function Af(e,l,v){if(u(p(l))){let M=ie({path:f(l).lock,runtimeVersion:g});if(!M.acquired)return!1;return v.push(()=>M.release()),!0}let D=Dn(Wt(e,"worker.json"));return D!==null&&Date.now()-D.mtimeMs>60000}function xf(e,l){let v=[e,...Tc(e,{withFileTypes:!0}).filter((M)=>M.isDirectory()&&!M.name.startsWith(".")).map((M)=>Wt(e,M.name))],D=[];for(let M of v)for(let L of["connect","connect-once"]){let z=Wt(M,L);if(z===l||!Dn(Wt(z,"worker.json")))continue;let re=Hc(z);if(!re||re.stateDirectory===e||re.stateDirectory.startsWith(e+Cf))D.push({directory:z,config:re})}return D}function ba(e){try{return JSON.parse(m(Wt(e,"api-key.json"))).store==="keychain"}catch{return!1}}function If(e,l){let v=Fr(e);v.deleteBinding(),v.createBinding(new TextEncoder().encode(l))}function Nc(e){try{Fr(e).deleteBinding()}catch(l){if(!(l instanceof a))throw l}}function Of(e){try{return e.loadBinding()}catch(l){if(l instanceof a)return null;throw l}}function Df(e,l,v,D){if(e?.stateDirectory!==l)return D;let M=Hc(v);return M?.stateDirectory===v?{saved:M,configPath:Wt(v,"worker.json")}:D}function Mc(e){try{return ka(e).isSymbolicLink()&&Ef(e)==="reason"}catch{return!1}}function Mf(e){try{let l=JSON.parse(m(Wt(e,li)));return typeof l.version==="string"?l.version:null}catch{return null}}function Hc(e){try{let l=Wt(e,"worker.json");return u(l)?x.parse(JSON.parse(m(l))):null}catch{return null}}function Dn(e){try{return ka(e)}catch{return null}}function Tf(e){if(e instanceof di)return e.code;if(e instanceof Error&&/^worker_[a-z_]+$/.test(e.message))return e.message;if(e instanceof a)return e.code;return e instanceof Error&&"code"in e&&typeof e.code==="string"?e.code:"unexpected"}import{readFileSync as Lf}from"fs";function nr(e){try{let l=JSON.parse(Lf(`${e}.keep-awake.json`,"utf8"));return l!==null&&typeof l==="object"&&"version"in l&&l.version===1&&"enabled"in l&&l.enabled===!0?"battery_and_ac":void 0}catch(l){return l.code==="ENOENT"?"battery_and_ac":void 0}}function $c(e,l){y(`${e}.keep-awake.json`,{version:1,enabled:l})}import{createHash as Aw}from"crypto";import{readdirSync as xw,realpathSync as Ts,statSync as Iw}from"fs";import{hostname as Ow}from"os";import{join as En,resolve as Dw}from"path";var ui="cloud",Wf=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;function yo(e){return Wf.test(e)&&!on.test(e)}var Nf={worker_session_login_required:"You're not signed in. Run `reason login` first.",worker_session_origin_mismatch:"Your login is for an older endpoint. Run `reason login` to refresh it.",worker_devices_write_scope_required:"Your login can't add machines. Run `reason logout`, then `reason login` again.",worker_already_running_or_lifecycle_busy:"A worker for this machine is already running or still stopping.",worker_ephemeral_enrollment_required:'An ephemeral worker adds a new Device on every start; a stopped one can\'t be resumed. Pass a new --enrollment-file or run `reason login`. Use "lifetime": "persistent" to keep one Device across restarts.',worker_ephemeral_requires_start_enrollment_file:"Ephemeral workers enroll when they start: pass --enrollment-file to `reason worker start`.",worker_start_never_reenrolls_persistent_identity:"A persistent worker enrolls once: run `reason worker enroll --enrollment-file PATH`, then `reason worker start` without it.",worker_already_enrolled:"This machine is already set up. Start it instead of enrolling again.",worker_not_enrolled:"This machine isn't set up yet. Enroll it first.",worker_config_binding_mismatch:"This machine was set up with different settings. Use the original settings, or revoke it and set it up again.",worker_credential_expired:"This machine's enrollment expired. Revoke it and set it up again.",worker_revoked:"This machine was removed from Reason. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_revoked_or_expired:"This machine was removed from Reason or its enrollment expired. Set it up again to use it. On your own computer, run `reason connect`; for a shared machine, an owner or admin runs `reason machines token NAME`.",worker_platform_unsupported:"Workers run on macOS and Linux only.",worker_workspace_not_canonical_or_overlaps_state:"The workspace folder must be a real directory (not a symlink) and must not contain the worker state folder.",worker_state_directory_not_private_or_canonical:"The worker state folder must be a real directory owned by you with mode 0700.",worker_file_not_private:"Worker files must be owned by you with mode 0600.",worker_enrollment_device_removed:"This machine was removed from Reason, and the enrollment was made for the removed one. Make a new enrollment and set it up again; on your own computer, run `reason connect`.",worker_enrollment_rejected:"Reason rejected the enrollment. Try again; if it keeps failing, run `reason logout` and `reason login`.",worker_machine_not_found:"That machine no longer exists. An owner or admin can add it again with `reason machines token NAME`.",worker_machine_admin_required:"Only workspace owners and admins can add machines or join them with a login. Ask one to run `reason machines token NAME` and give you the command it prints: curl -fsSL https://reasonmachines.com/install.sh | REASON_TOKEN=rmt_\u2026 bash (or, with Reason installed: reason serve --token rmt_\u2026)",worker_machine_token_invalid:"The machine token is invalid or revoked. Ask an owner or admin for a new one: reason machines token NAME",worker_machine_token_forbidden:"The machine token belongs to another machine or workspace.",worker_machine_token_owner_unauthorized:"Whoever created the machine token is no longer an owner or admin. Ask for a new token.",worker_api_key_rejected:"Reason rejected the API key. Check it (Settings \u203A API keys) and pass it with --api-key or REASON_API_KEY.",worker_api_key_devices_write_required:"The API key can't add computers. Create one with the devices:write scope.",worker_api_key_unreadable:"This computer's API key could not be read from the Keychain. Run reason connect --api-key KEY again.",worker_folders_unavailable:"This workspace can't add folders to a computer yet. Use a folder in your home folder.",worker_unsafe_environment:"Unset credential or proxy override variables in this shell before starting a worker.",worker_api_unreachable:"This computer could not reach Reason. Check its internet connection, and any VPN, proxy or firewall that lets the Reason app through but not the reason command, then try again.",worker_api_certificate_untrusted:"This computer did not trust Reason's certificate. A proxy, VPN or security software inspecting HTTPS, or a wrong clock, usually causes this: let Reason through it, then try again.",worker_ssh_version_mismatch:"The remote reason is another version than this one. Install this version there and attach with its new --artifact-sha256, or add the host as an SSH machine in Reason, which keeps its worker up to date."};function Mn(e){return Nf[e]}import{randomUUID as Hf}from"crypto";import{chmodSync as $f,lstatSync as fi,mkdtempSync as Bf,realpathSync as qc,rmdirSync as Uf,rmSync as Ff,unlinkSync as jf}from"fs";import{createConnection as qf,createServer as zf}from"net";import{basename as Bc,dirname as Uc,join as pn}from"path";var Kf=c(["status","drain","resume","stop","reload_roots"]),Vf=h({version:i(1),instanceId:t(),deviceId:t(),phase:c(["starting","running","reconnecting","stopping"]),drained:_(),activeClaims:o().int().nonnegative(),activeSessions:o().int().nonnegative().optional(),executionEligible:_(),supportedOperations:d(c(Nr)).max(Nr.length).optional(),capabilityReadiness:ul(c(Nr),_()).optional(),lastHeartbeat:t().nullable(),expiresAt:t()}),Jf=h({nonce:t(),action:Kf}),Gf=n({nonce:V()}),zc=h({version:i(1),nonce:V(),socketPath:t().max(100)});function Kc(e){return pn(f(e).lock,"control.json")}function mi(e){return b(f(e).lock),Gf.parse(JSON.parse(m(pn(f(e).lock,"owner.json"))))}function jc(e){if(!u(e))return!1;let l=fi(e);if(!l.isSocket()||l.uid!==process.getuid?.()||(l.mode&63)!==0)throw Error("worker_control_socket_not_private");return!0}function Vc(e,l){let v=Kc(e);if(!u(v)){let L=f(e).socket;if(!u(L)||!fi(L).isSocket())return null;return jc(L)?L:null}let D=zc.parse(JSON.parse(m(v)));if(D.nonce!==l)throw Error("worker_instance_changed");if(process.platform==="win32"){if(!Yf.test(D.socketPath))throw Error("worker_control_endpoint_invalid");return D.socketPath}let M=Uc(D.socketPath);if(Uc(M)!==qc("/tmp")||!/^(?:reason|ara)-worker-[A-Za-z0-9]{6}$/.test(Bc(M))||Bc(D.socketPath)!=="control.sock"||Buffer.byteLength(D.socketPath)>100)throw Error("worker_control_endpoint_invalid");if(!u(M))return null;return b(M),jc(D.socketPath)?D.socketPath:null}var Yf=/^\\\\\.\\pipe\\reason-worker-[0-9a-f-]{36}$/;async function pi(e,l,v){if(mi(e).nonce!==l)throw Error("worker_instance_changed");let D=Kc(e);if(u(D))throw Error("worker_control_already_serving");let M=process.platform==="win32",L=M?null:Bf(pn(qc("/tmp"),"ara-worker-")),z=L?pn(L,"control.sock"):`\\\\.\\pipe\\reason-worker-${Hf()}`;if(L)b(L);if(Buffer.byteLength(z)>100)throw Error("worker_socket_path_too_long");let re=new Set,G=zf((X)=>{re.add(X),X.once("close",()=>re.delete(X)),X.setTimeout(2000,()=>X.destroy());let he="",Se=!1;X.on("error",()=>X.destroy()),X.on("data",(Re)=>{if(Se)return;if(he+=Re.toString(),Buffer.byteLength(he)>4096){X.destroy();return}if(!he.includes(`
 `))return;Se=!0;try{let Ee=Jf.parse(JSON.parse(he));if(Ee.nonce!==l){X.destroy();return}X.end(JSON.stringify(v(Ee.action))+`
-`)}catch{X.destroy()}})});G.maxConnections=32;let ce,we=!1,te=async()=>{if(we)return;we=!0;for(let X of re)X.destroy();if(await new Promise((X)=>G.close(()=>X())),ce&&u(D)){let X=di(D);if(X.isFile()&&X.dev===ce.dev&&X.ino===ce.ino)try{let he=zc.parse(JSON.parse(m(D)));if(he.nonce===l&&he.socketPath===z)jf(D)}catch{}}try{if(L)Uf(L)}catch{}};try{if(await new Promise((X,he)=>{G.once("error",he),G.listen(z,()=>{if(!M)$f(z,384);X()})}),ui(e).nonce!==l)throw Error("worker_instance_changed");return y(D,{version:1,nonce:l,socketPath:z}),ce=di(D),te}catch(X){throw await te(),X}}function Gc(e,l){try{let v=JSON.parse(m(un(f(e).lock,"owner.json"))),D=v&&typeof v==="object"?v[l]:void 0;return typeof D==="string"?D:null}catch{return null}}function _o(e){return Gc(e,"runtime_version")}function Xf(e){return Gc(e,"nonce")}function Yc(e,l){if(l)return l.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(un(f(e).lock,"owner.json")))return"no_lock";return Vc(e,ui(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var Zf=21600000,Qf=h({instance:t().nullable(),since:o().int().nonnegative()});function em(e,l){let v=f(e).updateDeferral;try{if(!u(v))return null;let D=Qf.safeParse(JSON.parse(m(v)));if(D.success&&D.data.instance===l)return D.data.since;ka(e)}catch{}return null}function ka(e){try{Ff(f(e).updateDeferral,{force:!0})}catch{}}async function pi(e,l,v=()=>!1){let D=Xf(e),M=em(e,D);if(l!==void 0){let ce=_o(e);if(ce===null||ce===l&&M===null&&!v())return{state:"current"}}let L;try{let ce=await St(e,"status");L=ce?ce.activeSessions??ce.activeClaims:0}catch{L=null}if(L===0)return{state:"restarted"};let z=Date.now(),re=M;if(re===null){re=z;try{y(f(e).updateDeferral,{instance:D,since:re})}catch{}}let G=z-re;return{state:G<Zf?"busy":"drained",sessions:L,waitedMs:G}}async function St(e,l){let v=f(e);if(!u(un(v.lock,"owner.json")))return null;let D=ui(e),M=Vc(e,D.nonce);if(!M)return null;return new Promise((L,z)=>{let re=qf(M),G="",ce=!1,we=(te,X)=>{if(ce)return;if(ce=!0,re.destroy(),X)z(X);else L(te)};re.setTimeout(2000,()=>re.destroy(Error("worker_control_timeout"))),re.on("connect",()=>re.write(JSON.stringify({nonce:D.nonce,action:l})+`
-`)),re.on("data",(te)=>{if(G+=te.toString(),Buffer.byteLength(G)>16384)re.destroy(Error("worker_control_oversize"))}),re.on("error",(te)=>{if("code"in te&&["ECONNREFUSED","ENOENT"].includes(String(te.code)))we(null);else we(null,te.message==="worker_control_timeout"?te:Error("worker_control_unavailable"))}),re.on("end",()=>{try{let te=Vf.parse(JSON.parse(G));if(te.instanceId!==D.nonce)throw Error("worker_instance_changed");we(te)}catch{we(null,Error("worker_control_invalid_response"))}}),re.once("close",()=>we(null,Error("worker_control_unavailable")))})}import{randomUUID as Fd}from"crypto";import{homedir as jd}from"os";import{spawn as tm}from"child_process";import{createRequire as rm}from"module";var Xc=2147483648,nm=1;function om(){try{let e=rm(import.meta.url)("bun:ffi"),l=e.dlopen("kernel32.dll",{SetThreadExecutionState:{args:[e.FFIType.u32],returns:e.FFIType.u32}});return(v)=>l.symbols.SetThreadExecutionState(v)}catch{return null}}function im(e,l){if(e==="ac_only"||!l)return{status:"unsupported",release:async()=>"unsupported"};let v=l((Xc|nm)>>>0)===0?"failed":"held";return{get status(){return v},async release(){if(v==="held")l(Xc);return v="failed","released"}}}async function Zc(e,l={}){let v=l.platform??process.platform;if(v==="win32")return im(e,l.setExecutionState??om());if(v!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let D,M="failed",L=!1,z,re=Promise.resolve(),G=(X)=>{if(M===X)return;M=X,l.onStatusChange?.(X)},ce=()=>{if(L||z)return;z=setTimeout(()=>{z=void 0,re=we()},l.retryMs??5000),z.unref()},we=async()=>{try{let X=(l.spawn??tm)("/usr/bin/caffeinate",[e==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(D=X,X.once("exit",()=>{if(!L&&D===X)G("failed"),ce()}),await new Promise((he,Se)=>{X.once("spawn",he),X.once("error",Se)}),X.exitCode===null&&X.signalCode===null)G("held")}catch{G("failed"),ce()}};re=we(),await re;let te;return{get status(){return M},release(){return te??=(async()=>{L=!0,clearTimeout(z),await re;let X=D;if(!X||X.exitCode!==null||X.signalCode!==null||!X.pid)return M="failed","released";let he=await new Promise((Se)=>{let Re,Ee=setTimeout(()=>{try{X.kill("SIGKILL")}catch{}Re=setTimeout(()=>Se("failed"),1000)},1000);X.once("exit",()=>{clearTimeout(Ee),clearTimeout(Re),Se("released")});try{X.kill("SIGTERM")}catch{}});if(he==="released")M="failed";return he})()}}}class Tn extends Error{constructor(){super("Reason Device operation lease expired.")}}class hi{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor(e,l,v){this.now=l;this.onExpire=v;this.clockFloor=l(),this.install(e)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let e=new Tn;if(!this.closed)this.close(),this.onExpire(e);throw e}acknowledge(e){this.assertCurrent(),this.install(e)}close(){this.closed=!0,clearTimeout(this.timer)}install(e){let l=Date.parse(e);if(!Number.isFinite(l))throw Error("Reason returned an invalid operation lease deadline.");if(l-this.clockNow()<=0)throw new Tn;this.deadline=l,clearTimeout(this.timer),this.arm()}clockNow(){let e=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,e-this.clockTick)),this.clockTick=e,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new Tn)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as dm}from"fs";import{randomUUID as um}from"crypto";import{constants as Sa}from"fs";import{open as am}from"fs/promises";import{join as sm}from"path";var cm={platform:process.platform,home:s,async openFile(e){let l=await am(e,Sa.O_RDONLY|Sa.O_NOFOLLOW|Sa.O_NONBLOCK);return{isFile:async()=>(await l.stat()).isFile(),close:()=>l.close()}}};async function Qc(e=cm){if(e.platform!=="darwin")return"unknown";try{let l=await e.openFile(sm(e.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await l.isFile()?"granted":"unknown"}finally{await l.close()}}catch(l){return l instanceof Error&&"code"in l&&["EACCES","EPERM"].includes(String(l.code))?"not_granted":"unknown"}}class Ra extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function lm(e,l,v){l.throwIfAborted();let D=new AbortController,M=()=>{},L,z=new Promise((re,G)=>{M=()=>{D.abort(l.reason),G(l.reason)},l.addEventListener("abort",M,{once:!0}),L=setTimeout(()=>{let ce=new Ra;D.abort(ce),G(ce)},v)});try{return await Promise.race([e(D.signal),z])}finally{clearTimeout(L),l.removeEventListener("abort",M),D.abort()}}function el(e){let l=0,v=0;return async(D)=>{for(;;){D.throwIfAborted(),e.lease.assertCurrent();while(performance.now()<v)await e.sleep(Math.min(v-performance.now(),e.lease.remainingMs()),D),D.throwIfAborted(),e.lease.assertCurrent();try{let M=await lm(e.send,D,Math.min(8000,e.lease.remainingMs()));return D.throwIfAborted(),e.lease.assertCurrent(),M}catch(M){let L=M instanceof Ra||(M instanceof k?or(M.status):sr(M));if(L){let z=Math.max(Math.min(500*2**Math.min(l++,4),5000),e.retryAfterMs(M));v=performance.now()+z}if(D.throwIfAborted(),e.lease.assertCurrent(),!L)throw M}}}}function $a(e,l=process.env){return!e.proxied&&l.REASON_DEVICE_SESSION!=="0"}function cl(e,l,v){let D=e?.permissionRecovery;return fr(D,v)&&D.deviceId===l.deviceId&&D.organizationId===l.orgId?{permissionRecovery:D}:{}}var fm=1000,mm=250,pm=16,hm=5000,gm=Fc(dm(process.execPath)),tl=null,rl=null;function ll(e){if(process.platform!=="darwin")return{};return rl??=Qc().then((l)=>{tl={status:l,checkedAt:e().getTime()}}).finally(()=>{rl=null}),{fullDiskAccess:{...tl??{status:"unknown",checkedAt:e().getTime()},executablePath:gm}}}var wm=8,ym=64,_m=2000,bm=2000,Ba=8000,nl=3,km=250,ol=1000,il=30000,vm=0.2,Sm=30000,Rm=21600000,Em=300000,Pm=3600000,Cm=0.1,dl=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function Am(e){return Math.min(nl,Math.max(1,e??nl))}function xm(e){return typeof e.reason_code==="string"&&dl.has(e.reason_code)?e.reason_code:"cancelled"}function Ea(e){return e.reason instanceof r&&(e.reason.code==="cancelled"||dl.has(e.reason.code))?e.reason.code:"cancelled"}function al(e){return e instanceof r&&/^[A-Za-z0-9._:-]{1,160}$/.test(e.code)?e.code:"capability_failed"}function fl(e){return e.capability==="hands.connect"&&Za(e.payload)}function Pa(e,l=Math.random){let v=Math.min(Math.max(l(),0),1);return Math.max(0,Math.floor(e*(1+v*Cm)))}function Im(e,l=Math.random){let v=Math.min(il,ol*2**Math.max(0,e-1)),D=Math.min(Math.max(l(),0),1),M=v*vm*(D*2-1);return Math.min(il,Math.max(ol,Math.round(v+M)))}function Ua(e,l){return new Promise((v,D)=>{if(l.aborted){D(l.reason??new DOMException("Aborted","AbortError"));return}let M=()=>{clearTimeout(L),D(l.reason??new DOMException("Aborted","AbortError"))},L=setTimeout(()=>{l.removeEventListener("abort",M),v()},e);l.addEventListener("abort",M,{once:!0})})}class xa extends Error{updateError;constructor(e){super("Managed runtime update check failed.");this.updateError=e;this.name="RuntimeUpdateCheckError"}}async function Om(e,l,v,D){let M=new AbortController,L=()=>M.abort(v.reason);if(v.aborted)L();else v.addEventListener("abort",L,{once:!0});try{return await Promise.race([e,D(l,M.signal).then(()=>({kind:"heartbeat"}))])}finally{M.abort(),v.removeEventListener("abort",L)}}function Ta(e){return e instanceof Error?e.message:String(e)}function Wa(e,l){return l.aborted||e instanceof DOMException&&e.name==="AbortError"||e instanceof Error&&e.name==="AbortError"}function _r(e){return e instanceof k&&e.status===409&&e.code==="attempt_fenced"}function Na(e){return e.capability==="environment.install"}function Dm(e){if(e instanceof yi||e instanceof Tn||e instanceof So)return"timeout";if(!(e instanceof Error)||e instanceof k)return"transport_unknown";for(let l of[e,e.cause]){if(!(l instanceof Error)||l instanceof k||!("code"in l))continue;switch(l.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function ko(e,l,v){if(!e.state.worker&&!e.connectionDiagnostics)return;if(_r(v))return;let D=v instanceof k&&Number.isInteger(v.status)&&v.status>=100&&v.status<=599?{stage:l,category:"http",httpStatus:v.status}:{stage:l,category:Dm(v)};e.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:D})}async function Ln(e,l,v){try{return await v()}catch(D){if(!e.signal.aborted)ko(e,l,D);throw D}}class So extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function Ha(e,l,v,D){let M=l.capability==="inference.custom.v1"&&v.status!=="succeeded"?{status:v.status,error_code:v.status==="cancelled"?"operation_cancelled":Hr(v.error_code)?v.error_code:"custom_endpoint_unavailable"}:Na(l)&&v.status!=="succeeded"?{status:v.status,error_code:v.status==="cancelled"?"operation_cancelled":v.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:v,L=new AbortController,z=D?AbortSignal.any([D,L.signal]):L.signal,re=e.sleep??Ua,G=e.operationCompletionTimeoutMs??Ba,ce=performance.now()+G,we,te,X=new Promise((Re,Ee)=>{let Oe=()=>{let Ce=new So;L.abort(Ce),Ee(Ce)},Me=(Ce)=>{clearTimeout(we),we=setTimeout(Oe,Ce)};if(te=()=>Me(Math.max(0,Math.min(ce-performance.now(),_m))),Me(G),e.signal.addEventListener("abort",te,{once:!0}),e.signal.aborted)te()}),he,Se=0;try{while(!0)try{he=await Promise.race([e.client.completeOperation(e.state,l,M,z),X]);break}catch(Re){if(z.aborted||e.signal.aborted||ee(Re)||_r(Re)||!Mm(Re)||performance.now()>=ce)throw ko(e,"completion",Re),Re;Se+=1;let Ee=Math.min(500*2**Math.min(Se-1,4),Math.max(0,ce-performance.now()));if(Ee<=0)throw ko(e,"completion",Re),Re;try{await re(Ee,z)}catch{throw ko(e,"completion",Re),Re}}}finally{clearTimeout(we),e.signal.removeEventListener("abort",te),L.abort()}e.onEvent?.({type:"completed",operationId:l.operation_id,status:he.status})}function Mm(e){if(ee(e))return!1;if(_r(e))return!1;if(e instanceof k)return e.status===408||e.status===429||e.status>=500&&e.status<=504;if(e instanceof Error){if(e.name==="AbortError"||e instanceof So)return!1;return!0}return!1}class yi extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function gi(e){if(e instanceof yi)return!0;return e instanceof k?or(e.status):sr(e)}function Tm(e,l,v,D){let M=Math.min(v,l*2**Math.min(e-1,10));return e<=1?M:Math.round(M/2+M/2*D())}function wi(e,l){if(!(e instanceof k)||!e.retryAfter)return 0;let v=e.retryAfter.trim(),D=/^\d+(?:\.\d+)?$/.test(v)?Number(v)*1000:Date.parse(v)-l;return Number.isNaN(D)?0:Math.max(0,D)}async function Lm(e,l,v,D,M){let L=new AbortController,z,re=()=>{return},G=new Promise((we,te)=>{let X=()=>{let he=D.reason??new DOMException("Aborted","AbortError");L.abort(he),te(he)};if(re=()=>D.removeEventListener("abort",X),D.aborted)X();else D.addEventListener("abort",X,{once:!0})}),ce=new Promise((we,te)=>{z=setTimeout(()=>{let X=new yi;L.abort(X),te(X)},M)});try{return await Promise.race([e.client.operationHeartbeat(e.state,l,{transientRetryOwner:"caller",...v.controlAckSeq===void 0?{}:{controlAckSeq:v.controlAckSeq},clientRetryCount:v.clientRetryCount,...v.waitMs===void 0?{}:{waitMs:v.waitMs},signal:L.signal}),G,ce])}finally{if(z!==void 0)clearTimeout(z);re()}}async function sl(e,l,v,D,M,L){let z=Am(e.operationHeartbeatMaxAttempts),re=e.operationHeartbeatAttemptTimeoutMs??Ba,G=e.operationHeartbeatRetryDelayMs??km,ce=L.remainingMs(),we=Math.min(ce,z*re+G*z*(z-1)/2);for(let te=0;te<z;te+=1)try{D.throwIfAborted(),L.assertCurrent();let X=Math.min(re,L.remainingMs()),he=await Lm(e,l,{...v,waitMs:v.waitMs===void 0?void 0:Math.min(v.waitMs,Math.max(0,Math.floor(X-1000))),clientRetryCount:te},D,X);return D.throwIfAborted(),L.acknowledge(he.lease_until),he}catch(X){if(D.aborted||te+1>=z||_r(X)||ee(X)||!gi(X)){if(!D.aborted)ko(e,"operation_heartbeat",X);throw X}let he=ce-L.remainingMs(),Se=wi(X,(e.now?.()??new Date).getTime()),Re=Math.max(G*(te+1),we*(te+1)/z-he,Se);await M(Math.min(L.remainingMs(),Re),D),L.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function Wm(e,l,v,D,M){let L=fl(l),z=new AbortController,re=new AbortController,G=()=>{z.abort(e.signal.reason),re.abort(e.signal.reason)};if(e.signal.aborted)G();else e.signal.addEventListener("abort",G,{once:!0});let ce=null,we,te,X=-1,he=0,Se=Promise.resolve(),Re=[],Ee=new AbortController,Oe=!1,Me,Ce=null,Te=!1,We,$e,Ue={},Ne=(Ve)=>{Oe=!0,Ee.abort(Ve),z.abort(Ve),re.abort(Ve)},xe=(Ve)=>{if(Me)return Me;let Je=structuredClone(Ve),it=he;return Me=(async()=>{let Ye=new AbortController,Be=Ye.signal;Be.throwIfAborted();let Ke,Fe=()=>{},nt=new Promise((Ze,He)=>{if(Fe=()=>He(Be.reason),Be.addEventListener("abort",Fe,{once:!0}),Ke=setTimeout(()=>Ye.abort(Error("Hands stop receipt delivery timed out.")),4000),Be.aborted)Fe()});try{for(let Ze=0;Ze<3;Ze+=1){Be.throwIfAborted();try{let He=await Promise.race([Ln(e,"event",()=>e.client.operationEvents(e.state,l,{eventSeqStart:it,events:[Je],signal:Be,transientRetryOwner:"caller"})),nt]);if(Be.throwIfAborted(),He.next_event_seq!==it+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");he=He.next_event_seq;return}catch(He){if(ee(He))M(He);let at=He instanceof k?or(He.status):sr(He);if(Be.aborted||!at||Ze===2)throw He;let lt=Math.max(500*2**Ze,wi(He,(e.now?.()??new Date).getTime()));await Promise.race([v(lt,Be),nt])}}}finally{clearTimeout(Ke),Be.removeEventListener("abort",Fe),Ye.abort()}})(),Me},Le=(Ve,Je,it)=>{let Ye=(Ke)=>Ln(e,"event",()=>e.client.operationEvents(e.state,l,{eventSeqStart:Je,events:Ve,signal:Ke,...it?{transientRetryOwner:"caller"}:{}})).catch((Fe)=>{if(l.capability==="hands.connect"&&_r(Fe))Ne(Fe);if(it&&(ee(Fe)||_r(Fe))){if(ee(Fe))M(Fe);z.abort(Fe),re.abort(Fe),Ee.abort(Fe)}throw Fe});if(!it)return async(Ke)=>{if(l.capability!=="hands.connect"&&l.capability!=="inference.custom.v1"){he=(await Ye(Ke)).next_event_seq;return}Ke.throwIfAborted();let Fe=()=>{},nt=new Promise((Ze,He)=>{Fe=()=>He(Ke.reason),Ke.addEventListener("abort",Fe,{once:!0})});try{let Ze=await Promise.race([Ye(Ke),nt]);Ke.throwIfAborted(),he=Ze.next_event_seq}finally{Ke.removeEventListener("abort",Fe)}};let Be=el({send:Ye,lease:$e,sleep:v,retryAfterMs:(Ke)=>wi(Ke,(e.now?.()??new Date).getTime())});return async(Ke)=>{let Fe=await Be(Ke);if(Fe.next_event_seq!==Je+Ve.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");he=Fe.next_event_seq}},Ge=async(Ve,Je)=>{let it=Ve??await sl(e,l,{controlAckSeq:X,waitMs:Je},re.signal,v,$e),Ye=null,Be=!1;for(let Ke=0;Ke<10;Ke+=1){let Fe=X+1;for(let nt of it.controls){if(nt.seq!==Fe)throw Error("Reason returned an out-of-order Device operation control.");if(nt.kind==="cancel"||nt.kind==="operation.cancel")Ye??=xm(nt.payload),z.abort(new r(Ye,"Reason closed the Device operation."));if(nt.kind!=="cancel"&&nt.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(l.capability)){let Ze,He,at=new Promise((lt,kt)=>{Ze=lt,He=kt});at.catch(()=>{}),Ue.current={promise:at,resolve:Ze,reject:He}}try{Be||=!await e.onControl?.(l,nt)}catch(Ze){if(Ze instanceof r)we??=al(Ze);throw Ue.current?.reject(Ze),Ze}}X=nt.seq,Fe+=1}if(it.controls.length===0){if(it.next_control_seq!==X+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:Ye,unsupported:Be}}try{it=await sl(e,l,{controlAckSeq:X},re.signal,v,$e),Ue.current?.resolve()}catch(nt){if(Ue.current?.reject(nt),!Ye||_r(nt)||ee(nt))throw nt;return{cancellationReason:Ye,unsupported:Be}}}throw Error("Reason returned too many Device operation control batches.")};try{let Ve;try{if(!L)$e=new hi(l.lease_until,()=>(e.now?.()??new Date).getTime(),(Je)=>{if(!z.signal.aborted)ce=Je;z.abort(Je),re.abort(Je)});Ve=L||l.capability==="hands.connect"||l.capability==="display.stream.v1"||l.capability==="simulator.stream.v1"||Qr.has(l.capability)||l.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await Ge()}catch(Je){if(!Na(l)||_r(Je)||ee(Je))throw Je;await Ha(e,l,{status:e.signal.aborted?"cancelled":"failed"});return}if(Ve.cancellationReason||e.signal.aborted){let Je=Ve.cancellationReason??Ea(e.signal);z.abort(new r(Je,"Reason closed the Device operation.")),te={status:"cancelled",error_code:Je}}else if(Ve.unsupported)z.abort(),te={status:"failed",error_code:"control_unsupported"};else{let Je=L?Promise.resolve():(async()=>{let Ye=e.operationHeartbeatIntervalMs??e.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(l.capability)?bm:15000),Be=Math.min(Ye,Math.max(0,(e.operationHeartbeatAttemptTimeoutMs??Ba)-1000)),Ke=l.capability==="hands.connect"||l.capability==="pty.start"||l.capability==="display.stream.v1"||l.capability==="simulator.stream.v1"||l.capability==="browser.recording.v1"||l.capability==="browser.pr-proof.v1"||l.capability==="process.run.v1"||l.capability==="process.full.v1"||l.capability==="preview.serve.v1"||l.capability==="inference.custom.v1";while(!re.signal.aborted)try{if(!Ke){if(await v(Ye,re.signal),re.signal.aborted)return}let Fe=await Ge(void 0,Ke?Be:void 0);if(Fe.cancellationReason||Fe.unsupported){if(Fe.unsupported)ce=Error("Reason requested an unsupported Device operation control.");z.abort(Fe.cancellationReason?new r(Fe.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(Fe){if(ee(Fe))M(Fe);if(_r(Fe))ce=Fe,Ne(Fe);if(!re.signal.aborted)ce=Fe,z.abort();return}})();try{if($e?.assertCurrent(),z.signal.throwIfAborted(),D.authorized=()=>!z.signal.aborted&&(L||($e?.remainingMs()??0)>0),te=await e.onClaim(l,z.signal,async(Ye)=>{if(Na(l))return;if(Ye.kind==="permission.denied"){if(!D.authorized())return;let at=Ye.data,lt=(e.now??(()=>new Date))().getTime(),kt=e.statusPath??mr(),jt=(e.loadStatus??rt)(kt),Kt={id:um(),kind:"permission_denied",operation:at?.operation,provenance:at?.provenance,occurredAt:new Date(lt).toISOString(),expiresAt:new Date(lt+600000).toISOString(),sessionId:l.run_id,deviceId:e.state.deviceId,organizationId:e.state.orgId};if(jt&&fr(Kt,lt)){let pr=jt.permissionRecovery;if(!pr||!fr(pr,lt)||pr.sessionId!==Kt.sessionId||pr.operation!==Kt.operation||pr.provenance!==Kt.provenance)(e.saveStatus??Si)({...jt,permissionRecovery:Kt},kt)}return}let Be=l.capability==="hands.connect"&&Ye.capability==="hands.connect"&&Ye.kind==="hands.stopped",Ke=l.capability==="hands.connect"&&Ye.kind==="hands.reconnected",Fe=Ke||l.capability==="inference.custom.v1"?AbortSignal.any([z.signal,Ee.signal,...Ye.deliverySignal?[Ye.deliverySignal]:[]]):l.capability==="hands.connect"?AbortSignal.any([e.signal,Ee.signal]):e.signal,nt={kind:Ye.kind,payload:{sequence:Ye.sequence,capability:Ye.capability,...Ye.data?{data:Ke?structuredClone(Ye.data):Ye.data}:{}}};if(l.capability==="hands.connect"&&Ye.capability==="hands.connect"&&(Ye.kind==="started"||Ye.kind==="hands.started")||(Qr.has(l.capability)||l.capability==="pty.start")&&Ye.kind==="started")return new Promise((at,lt)=>{Re.push({wireEvent:nt,settle:(kt)=>kt===void 0?at():lt(kt)})});let Ze=Re;Re=[];let He=Se.then(async()=>{if((Oe||e.signal.aborted)&&l.capability==="hands.connect"&&!L){if(Be)await xe(nt);return}if(Ce!==null){if(Ye.kind!=="hands.stopped"||!Te||!We)throw Ce;let lt=new AbortController,kt=AbortSignal.any([e.signal,Ee.signal,lt.signal]),jt=setTimeout(()=>lt.abort(Error("Hands stop receipt reconciliation timed out.")),4000);Te=!1;try{await We(kt),We=void 0,await Le([nt],he,!0)(kt),Ce=null}catch(Kt){throw Ce=Kt??Error("Hands stop receipt could not be confirmed."),Kt}finally{clearTimeout(jt),lt.abort()}return}if(Ke&&!$e){let lt=Math.min(Date.parse(l.lease_until),Date.parse(String(l.payload.expires_at)));$e=new hi(new Date(lt).toISOString(),()=>(e.now?.()??new Date).getTime(),(kt)=>{z.abort(kt),re.abort(kt)})}let at=he;if(Ke)We=Le([...Ze.map((lt)=>lt.wireEvent),nt],at,!0),await We(Fe),We=void 0;else await Le([...Ze.map((lt)=>lt.wireEvent),nt],at,!1)(Fe)});He.then(()=>{for(let at of Ze)at.settle()},(at)=>{for(let lt of Ze)lt.settle(at??Error("Hands event delivery failed."))}),Se=He.catch((at)=>{if(ee(at))M(at);if(Ke){if(Ce===null)Te=Fe.aborted&&!Ee.signal.aborted,Ce=at??Error("Hands generation receipt delivery failed.");if(!Fe.aborted)z.abort(at),re.abort(at)}}),await He}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(l.capability))await Ue.current?.promise}catch(Ye){te=z.signal.aborted?{status:"cancelled",error_code:Ea(z.signal)}:{status:"failed",error_code:al(Ye)}}finally{D.authorized=()=>!1,Ee.abort();for(let Ye of Re.splice(0))Ye.settle();re.abort(),await Je}let it=Zn(l.capability)?Ma(te.result,l.operation_id):null;if(ce){if(ee(ce))throw ce;te={status:"failed",error_code:we??"control_or_heartbeat_failed",...it?{result:it}:{}}}else if(z.signal.aborted&&te.status==="succeeded")te={status:"cancelled",error_code:Ea(z.signal),...it?{result:it}:{}}}if($e?.close(),ee(e.signal.reason))throw e.signal.reason;await Ha(e,l,te)}finally{$e?.close(),Ee.abort(),re.abort(),e.signal.removeEventListener("abort",G)}}async function Fa(e){let l=e.now??(()=>new Date),v=e.sleep??Ua,D=e.saveStatus??Si,M=e.loadStatus??rt,L=e.statusPath??mr(),z=l().toISOString(),re=M(L)?.lastUsedAt,G=!1,ce=()=>({version:1,pid:process.pid,startedAt:z,...ll(l),...cl(M(L),e.state,l().getTime()),deviceId:e.state.deviceId,...e.idleSleepPolicy||e.readIdleSleepPolicy?{idleSleepHold:G}:{},...re?{lastUsedAt:re}:{}}),we=0,te,X=!1,he,Se,Re,Ee=Promise.resolve();D({...ce(),state:"starting"},L),e.onEvent?.({type:"started",deviceId:e.state.deviceId}),La();try{let Oe=async()=>{let Me=e.readIdleSleepPolicy?e.readIdleSleepPolicy():e.idleSleepPolicy;if(e.signal.aborted||Me===Se)return;if(he&&Se){let We=await he.release();if(e.onEvent?.({type:"idle_sleep",status:We,policy:Se}),We==="failed")return;he=void 0,Se=void 0,G=!1;let $e=M(L);if($e)D({...$e,idleSleepHold:G},L)}if(!Me)return;Se=Me;let Ce=!0;he=await(e.acquireAwakeHold??Zc)(Me,{onStatusChange:(We)=>{if(Ce)return;G=We==="held";let $e=M(L);if($e)D({...$e,idleSleepHold:G},L);e.onEvent?.({type:"idle_sleep",status:We,policy:Me})}}),Ce=!1,G=he.status==="held";let Te=M(L);if(Te)D({...Te,idleSleepHold:G},L);e.onEvent?.({type:"idle_sleep",status:he.status,policy:Me})};if(await Oe(),e.readIdleSleepPolicy)Re=setInterval(()=>{Ee=Ee.then(Oe).catch(()=>{e.onEvent?.({type:"idle_sleep",status:"failed",policy:Se??"battery_and_ac"})})},e.idleSleepPollMs??1000),Re.unref();while(!e.signal.aborted){let Me=!1;try{await Nm({...e,saveStatus:(Ce,Te)=>{if(Ce.state==="starting"||Ce.state==="error"||Ce.state==="stopped")return;re=Ce.lastUsedAt??re,D({...Ce,startedAt:z,...e.idleSleepPolicy||e.readIdleSleepPolicy?{idleSleepHold:G}:{}},Te)},onEvent:(Ce)=>{if(Ce.type==="error"&&Ce.diagnostic){e.onEvent?.(Ce);return}if(Ce.type==="started"||Ce.type==="error"||Ce.type==="stopped")return;if(Ce.type==="heartbeat"&&we>0&&!Me){Me=!0;let Te=we;we=0,te=void 0,e.onEvent?.({type:"reconnected",attempts:Te})}e.onEvent?.(Ce)}});return}catch(Ce){if(Wa(Ce,e.signal))return;if(ee(Ce)){X=!0;let We=e.state.worker?"worker_connection_failed":Ta(Ce);throw D({...ce(),state:"error",error:We},L),e.onEvent?.({type:"error",message:We}),Ce}we+=1;let Te=Im(we,e.reconnectRandom);te??=l().toISOString(),D({...ce(),state:"starting",reconnectingSince:te},L),e.onEvent?.({type:"reconnecting",message:e.state.worker?"worker_connection_failed":Ta(Ce),attempt:we,retryInMs:Te}),await v(Te,e.signal)}}}catch(Oe){if(!Wa(Oe,e.signal))throw Oe}finally{if(e.client.close?.(),clearInterval(Re),await Ee,he&&Se){let Oe=await he.release();G=Oe==="failed"&&he.status==="held",e.onEvent?.({type:"idle_sleep",status:Oe,policy:Se})}if(!X)D({...ce(),state:"stopped"},L);else{let Oe=M(L);if(Oe)D({...Oe,idleSleepHold:G},L)}e.onEvent?.({type:"stopped"})}}async function Nm(e){let l=e.now??(()=>new Date),v=e.sleep??Ua,D=e.statusPath??mr(),M=e.saveStatus??Si,L=e.loadStatus??rt,z=l().toISOString(),re=L(D)?.lastUsedAt,G=e.runtimeUpdate,ce=new AbortController,we=()=>ce.abort(e.signal.reason);if(e.signal.aborted)we();else e.signal.addEventListener("abort",we,{once:!0});let te=G?.random??Math.random,X=e.maxConcurrentClaims,he=typeof X==="number"&&Number.isSafeInteger(X)&&X>0?Math.min(ym,X):wm,Se=0,Re=!1,Ee=null,Oe=(tt)=>{Ee??=tt,ce.abort(tt)},Me=new Map,Ce=()=>{let tt=new Set,yt=0;for(let{claim:Wr}of Me.values()){let Xe=Wr.capability==="hands.connect"?Wr.payload[pe]:void 0;if(typeof Xe==="string"){if(tt.has(Xe))continue;tt.add(Xe)}yt+=1}return yt},Te=null,We=()=>[...Me.values()].some((tt)=>tt.authorized()),$e=()=>[...Me.values()].every((tt)=>tt.claim.capability==="preview.serve.v1"),Ue=G?new Date(z).getTime()+Pa(G.initialDelayMs??Sm,te):Number.POSITIVE_INFINITY,Ne=null,xe=!1,Le=e.firstHeartbeat,Ge=Le?.account_root_metadata_supported===!0,Ve=Le?.workspace_root_metadata_supported===!0,Je=Le?.account_root_path_supported===!0,it=Le?.home_contained_roots_supported===!0,Ye=Le?.root_paths_supported===!0,Be=Le?.startup_supported===!0,Ke=Le!==void 0,Fe=Le?{challenge:Le.challenge,expires_at:Le.expires_at}:void 0,nt,Ze=!e.startup,He=()=>({version:1,pid:process.pid,startedAt:z,...ll(l),...cl(L(D),e.state,l().getTime()),...re?{lastUsedAt:re}:{},deviceId:e.state.deviceId,...Ne?{organizationId:Ne.organization_id,organizationName:Ne.organization_name,organizationSlug:Ne.organization_slug}:{}}),at=()=>{let tt=(e.advertised??e.claimable)?.()!==!1;if(!Ze)nt??=e.startup?.();return{...e.deviceMetadata?.device_model!=null?{device_model:e.deviceMetadata.device_model}:{},...e.deviceMetadata?.device_chip!=null?{device_chip:e.deviceMetadata.device_chip}:{},...e.deviceMetadata?.device_location!=null?{device_location:e.deviceMetadata.device_location}:{},reason_runtime_version:e.runtimeVersion,bridge_version:e.bridgeVersion,protocol_version:e.protocolVersion,execution_eligible:tt,...Be&&!Ze&&nt?{startup:nt}:{},capabilities:tt?Ia(e.capabilities,{accountRootMetadataSupported:Ge,workspaceRootMetadataSupported:Ve,accountRootPathSupported:Je,homeContainedRootsSupported:it,rootPathsSupported:Ye}):{supported_operations:[]}}},lt=()=>{if(xe||!e.client.identity)return;xe=!0,e.client.identity(e.state,e.signal).then((tt)=>{if(tt.organization_id!==e.state.orgId)return;Ne=tt;let yt=L(D);if(!yt)return;M({...yt,organizationId:tt.organization_id,organizationName:tt.organization_name,organizationSlug:tt.organization_slug},D)}).catch(()=>{return})},kt=(tt)=>{Ge=tt.account_root_metadata_supported===!0,Ve=tt.workspace_root_metadata_supported===!0,Je=tt.account_root_path_supported===!0,it=tt.home_contained_roots_supported===!0,Ye=tt.root_paths_supported===!0,Be=tt.startup_supported===!0,Ke=!1},jt=(tt)=>{if(tt.startup)Ze=!0},Kt=(tt,yt)=>{if(!(yt instanceof k&&yt.status===400&&yt.code==="invalid_heartbeat")||!tt.startup&&!Ke)throw yt;if(Ze=!0,Ke)Ge=Ve=Je=!1,it=Ye=Be=Ke=!1;return null},pr=(tt)=>{kt(tt),M({...He(),state:"connected",lastHeartbeatAt:l().toISOString()},D),lt(),e.onEvent?.({type:"heartbeat",serverTime:tt.server_time,drain:tt.drain,...tt.latest_cli_versions?{latestCliVersions:tt.latest_cli_versions}:{},...tt.hands_prespawn?{handsPrespawn:!0}:{}})},Xr=!1,Rn=!1;e.registerHeartbeatNow?.(()=>{if(e.signal.aborted)return;if(Xr)Rn=!0;let tt=at();Ln(e,"heartbeat",()=>e.client.heartbeat(e.state,tt,ce.signal).catch((yt)=>Kt(tt,yt))).then((yt)=>{if(!yt)return;jt(tt),kt(yt),pr(yt)},()=>{return})});let Lr=(tt)=>v(tt,e.signal);M({...He(),state:"starting"},D),e.onEvent?.({type:"started",deviceId:e.state.deviceId});let xr=!1,an=e.maxConsecutiveHeartbeatFailures??3,Ir=0,er=0,In=0,jo=0,sn=null;try{while(!e.signal.aborted){if(Ee)throw Ee;if(Re&&$e())break;let tt,yt=er>0&&er<pm&&performance.now()-jo<hm&&sn!==null;if(!yt)er=0;e:{if(yt&&sn){tt=sn;break e}let vt=at(),rr=Fe;Fe=void 0,Xr=!0,Rn=!1;try{let At=await Ln(e,"heartbeat",()=>e.client.heartbeat(e.state,vt,ce.signal,...rr?[rr]:[]).catch((Sr)=>Kt(vt,Sr)));if(Xr=!1,!At)continue;tt=At,jt(vt),jo=performance.now(),Ir=0}catch(At){if(Xr=!1,e.signal.aborted)break;if(!gi(At))throw At;if(Ir+=1,Ir>=an&&!We())throw At;await v(Math.min(e.heartbeatRetryDelayMs??2000,e.heartbeatIntervalMs??15000),e.signal);continue}if(kt(tt),Object.keys(at().capabilities).length>Object.keys(vt.capabilities).length)continue;if(Rn)continue;if(pr(tt),Ee)throw Ee;if(e.signal.aborted)break;if(G&&["available","required"].includes(tt.update_policy??""))Ue=Math.min(Ue,l().getTime());if(G&&l().getTime()>=Ue)try{let At=new AbortController,Sr=()=>At.abort(e.signal.reason);if(e.signal.aborted)Sr();else e.signal.addEventListener("abort",Sr,{once:!0});let $r;try{$r=G.check(At.signal)}catch(Ft){$r=Promise.reject(Ft)}let cn=$r.then((Ft)=>({kind:"completed",result:Ft}),(Ft)=>({kind:"failed",error:Ft})),Br;try{while(!0){let Ft=await Om(cn,e.heartbeatIntervalMs??15000,e.signal,v);if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");if(Ft.kind==="failed")throw new xa(Ft.error);if(Ft.kind==="completed"){Br=Ft.result;break}try{let Gt=at(),Qn=await Ln(e,"heartbeat",()=>e.client.heartbeat(e.state,Gt,ce.signal).catch((qo)=>Kt(Gt,qo)));if(!Qn)continue;tt=Qn,jt(Gt),pr(tt),Ir=0}catch(Gt){if(e.signal.aborted)throw Gt;if(!gi(Gt))throw Gt;if(Ir+=1,Ir>=an&&!We())throw Gt}}}catch(Ft){At.abort(Ft);let Gt=await cn;if(Gt.kind==="completed"&&Gt.result==="activated")Br="activated";else throw Ft}finally{e.signal.removeEventListener("abort",Sr)}if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");if(Se=0,Br==="activated"){if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");e.onEvent?.({type:"runtime_updated"}),Re=!0}Ue=l().getTime()+Pa(G.intervalMs??Rm,te)}catch(At){if(!(At instanceof xa))throw At;Se+=1;let Sr=G.retryBaseMs??Em,$r=G.retryMaxMs??Pm,cn=Math.min($r,Sr*2**Math.min(Se-1,8));Ue=l().getTime()+Pa(cn,te)}}if(sn=tt,e.signal.aborted)break;if(Re&&$e())break;if(Re){await Lr(e.heartbeatIntervalMs??15000);continue}let Wr=e.client.sessionCadence?.(e.state)??null,Xe=Wr?.presenceIntervalMs??e.heartbeatIntervalMs??15000;if(tt.drain||e.claimable?.()===!1){er=0,await Lr(Xe);continue}if(Ce()>=he){er=0;let vt=new AbortController;Te=vt;try{await v(Xe,AbortSignal.any([e.signal,vt.signal]))}catch(rr){if(!vt.signal.aborted)throw rr}finally{if(Te===vt)Te=null}continue}let st,Ct=yt?0:Wr?.claimWaitMs??Math.min(e.heartbeatIntervalMs??15000,30000),Vt=performance.now();try{st=await Ln(e,"claim",()=>e.client.claimOperation(e.state,{waitMs:Ct,signal:ce.signal}))}catch(vt){if(er=0,e.signal.aborted||!gi(vt)||!We())throw vt;In+=1;let rr=Math.min(e.heartbeatRetryDelayMs??2000,e.heartbeatIntervalMs??15000);await Lr(Math.max(Tm(In,rr,Math.max(rr,Ct),te),wi(vt,(e.now?.()??new Date).getTime())));continue}if(In=0,Ee)throw Ee;if(!st){if(yt){er=0;continue}if(performance.now()-Vt<Ct-mm)await Lr(fm);continue}if(e.claimable?.()===!1){er=0,await Ha(e,st,{status:"cancelled",error_code:"execution_authority_withdrawn"},e.signal);continue}re=l().toISOString(),M({...He(),state:"connected",lastHeartbeatAt:l().toISOString()},D),e.onEvent?.({type:"claim",operationId:st.operation_id,runId:st.run_id,attemptId:st.attempt_id,capability:st.capability});let Tt,gr={authorized:()=>!1,claim:st};if(Tt=Wm({...e,signal:ce.signal},st,v,gr,Oe).catch((vt)=>{if(ee(vt))Oe(vt);else if(!_r(vt)&&[...Me].some(([rr,At])=>rr!==Tt&&At.authorized())){if(vt instanceof So)e.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!_r(vt)&&Ee===null)Ee=vt}).finally(()=>{Me.delete(Tt),Te?.abort(),e.onEvent?.({type:"claims_changed",activeClaims:Me.size})}),Me.set(Tt,gr),e.onEvent?.({type:"claims_changed",activeClaims:Me.size}),er+=1,fl(st)){if(er=0,await Tt,Ee)throw Ee}}}catch(tt){if(!Wa(tt,e.signal)){ce.abort(tt),xr=!0;let yt=e.state.worker?"worker_connection_failed":Ta(tt);throw M({...He(),state:"error",error:yt},D),e.onEvent?.({type:"error",message:yt}),tt}}finally{if(ce.abort(),await Promise.allSettled(Me.keys()),e.signal.removeEventListener("abort",we),!xr)M({...He(),state:"stopped"},D);e.onEvent?.({type:"stopped"})}}import{execFile as dp}from"child_process";import{constants as Al,existsSync as up,mkdtempSync as Ga,rmSync as Dl}from"fs";import{access as xl,open as fp,readFile as Il,readlink as mp,readdir as Ol,unlink as pp,rmdir as hp}from"fs/promises";import{tmpdir as gp}from"os";import{basename as Ya,join as Ri}from"path";import{randomUUID as pn}from"crypto";import{chmodSync as Hm,closeSync as $m,fsyncSync as Bm,openSync as Um,readFileSync as Fm,rmdirSync as ml,unlinkSync as pl,writeFileSync as jm}from"fs";import{createConnection as qm,createServer as zm}from"net";import{dirname as Km,join as Vm}from"path";var Jm=5000;async function hl(e,l,v){if(v.aborted)return!1;let D={generation:1,fenceId:pn()},M={runId:pn(),deviceId:pn(),rootId:pn(),apiOrigin:e.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>D},L=si(l,M),z={version:1,snapshot_id:pn(),revision:1,run_id:M.runId,device_id:M.deviceId,root_id:M.rootId,binding:{...M.binding,target_generation:D.generation,target_fence_id:D.fenceId},expires_at:new Date(M.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return L.install(z).installed&&L.current().snapshot_id===z.snapshot_id&&!v.aborted}catch{return!1}finally{try{pl(L.path)}catch{}}}async function bl(e,l,v=$t){if(l.aborted)return!1;let D,M,L=new Set,z=pn(),re=zm((X)=>{L.add(X),X.once("close",()=>L.delete(X)),X.on("error",()=>X.destroy()),X.end(z)});re.maxConnections=1;let G,ce,we=new Promise((X)=>{ce=()=>X(!1)}),te=setTimeout(ce,Jm);l.addEventListener("abort",ce,{once:!0});try{D=v({runtimeDirectory:p(e),root:e.workspaceRoot,runId:`readiness-${pn()}`}),M=Vm(D.journalDirectory,"readiness.json");let X=Um(M,"wx",384);try{jm(X,z),Bm(X)}finally{$m(X)}if(Fm(M,"utf8")!==z||l.aborted)return!1;let he=new Promise((Se)=>{re.once("error",()=>Se(!1)),re.listen(D.socketPath,()=>{try{if(process.platform!=="win32")Hm(D.socketPath,384)}catch{Se(!1);return}G=qm(D.socketPath);let Re="";G.setEncoding("utf8"),G.once("error",()=>Se(!1)),G.on("data",(Ee)=>{if(Re+=Ee,Re.length>z.length)G?.destroy(),Se(!1)}),G.once("end",()=>Se(Re===z)),G.once("close",()=>Se(!1))})});return await Promise.race([he,we])&&!l.aborted}catch{return!1}finally{clearTimeout(te),l.removeEventListener("abort",ce),G?.destroy();for(let X of L)X.destroy();if(await new Promise((X)=>re.close(()=>X())),D?.disposeSocket(),M)try{pl(M)}catch{}if(D){try{ml(D.journalDirectory)}catch{}try{ml(Km(D.journalDirectory))}catch{}}}}import{execFileSync as bi}from"child_process";import{randomUUID as dr}from"crypto";import{chmodSync as kl,chownSync as El,closeSync as Ka,constants as Mr,existsSync as Gm,fstatSync as Pl,mkdirSync as vl,mkdtempSync as Ym,openSync as Va,readFileSync as Xm,readSync as Zm,realpathSync as Qm,rmdirSync as ep,rmSync as tp}from"fs";import{join as gn}from"path";import{fileURLToPath as rp}from"url";var Sl=1e4,np=!1;function ki(){if(process.platform!=="linux")return!1;return np||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some((e)=>{try{let l=bi(e,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),v=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(l);return v!==null&&Number(v[1])*100+Number(v[2])>=302}catch{return!1}})}var op=Buffer.from([0,255,3,4]);function Rl(e){return`printf "%s\\n" ${e==="foreground"?"$$":"$!"} > ${e}.pid.tmp; /bin/mv ${e}.pid.tmp ${e}.pid`}function ip(e,l,v){if(!Number.isSafeInteger(l)||l<2||!Number.isSafeInteger(v)||v<2||e.length>4096||!e.startsWith(`${l} (`))return!1;let D=e.lastIndexOf(") ");if(D<0)return!1;let M=e.slice(D+2).trim().split(/\s+/);return M.length>=20&&/^[A-Za-z]$/.test(M[0])&&/^\d+$/.test(M[1])&&M[2]===String(l)&&M[3]===String(v)&&/^[1-9][0-9]*$/.test(M[19])}async function Ro(e,l={}){if(process.platform==="win32")return!e.aborted&&_i();if(e.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let v=J(),{directory:D,root:M,runtimeDirectory:L}=cp(v),z=new AbortController,re=()=>z.abort();e.addEventListener("abort",re,{once:!0});let G;z.signal.addEventListener("abort",()=>G?.close(),{once:!0});let ce=setTimeout(re,Sl),we={organization_id:dr(),user_id:dr(),device_id:dr()},te=dr(),X=dr(),he=dr(),Se=dr(),Re=Date.now()+Sl,Ee={kind:"workspace_source",target_revision:0,root_grant_revision:1},Oe=dr().replaceAll("-",""),Me,Ce=Buffer.alloc(0),Te,We=!1,$e=!1,Ue=!1,Ne=!1,xe,Le,Ge,Ve=async(it)=>{while(!it()){if(z.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((Ye)=>setTimeout(Ye,20))}if(z.signal.aborted)throw Error("pty_probe_cancelled")},Je=!1;try{G=ap(D,v),xe=Bun.serve({hostname:"127.0.0.1",port:0,fetch(Be,Ke){let Fe=new URL(Be.url).pathname,nt=Fe===`/device/hands/${Oe}`?"hands":Fe===`/device/pty/${Oe}`?"pty":null;if(nt&&Ke.upgrade(Be,{data:{lane:nt}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(Be){if(Be.data.lane==="pty")Me=Be},message(Be,Ke){if(Be.data.lane!=="pty")return;if(typeof Ke==="string"){try{if(JSON.parse(Ke).t==="open")We=!0}catch{re()}return}if(Ce.length+Ke.length>8192){re();return}Ce=Buffer.concat([Ce,Ke])}}});let it=`ws://127.0.0.1:${xe.port}`;if(Le=et({headless:!0,managedPty:{version:1},root:M,runtimeDirectory:L,runId:te,operationId:dr(),attemptId:dr(),claimOwner:we,deviceIdentity:{deviceId:we.device_id,rootId:X,apiOrigin:"https://worker-probe.invalid"},signal:z.signal,payload:{relay_url:`${it}/device/hands/${Oe}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(Re).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:F,hands_worker_version:U,hands_worker_artifact_sha256:T,hands_worker_entrypoint:H,target_generation:1,target_fence_id:he,environment_binding:Ee,[E]:_e},emitEvent:async(Be)=>{if(Be==="hands.started")Ne=!0;if(Be==="hands.ready")$e=!0;if(Be==="hands.stopped")Ue=!0}},{browserExecutablePath:null,slot:Co(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:rp(new URL("./worker-candidate-entry.ts",import.meta.url)),...l}).catch(()=>{if(!$e)re()}),await Ve(()=>$e),Qe({root:M,runId:te,payload:{version:1,snapshot_id:Se,revision:1,run_id:te,root_id:X,device_id:we.device_id,binding:{...Ee,target_generation:1,target_fence_id:he},expires_at:new Date(Re).toISOString(),variables:{PTY_PROBE_VALUE:Oe},git:null}}),Ge=rn({root:M,runId:te,rootId:X,deviceId:we.device_id,owner:we,workspace:{kind:"root"},authority:{device_id:we.device_id,binding:Ee.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:he},signal:z.signal,session:{jobId:`pty-${dr()}`,sessionId:"pty-readiness",operationId:dr(),cols:80,rows:24,leaseExpiresAtMs:Re,relayUrl:`${it}/device/pty/${Oe}`},emit:async(Be,Ke)=>{if(Be==="pty.ready")Te=Ke}}).catch(()=>{re()}),await Ve(()=>Boolean(Te&&Me&&We)),Me.send(JSON.stringify({t:"resize",cols:100,rows:30})),Me.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${Oe}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${G.wait("background")}) & ${Rl("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${Rl("foreground")}; ${G.wait("foreground")}'
-`)),await Ve(()=>Gm(gn(M,"foreground.pid"))&&Ce.includes(op)),!Ce.includes("30 100")||Te.job.environmentSnapshotId!==Se||Te.job.environmentRevision!==1)return!1;let Ye=["background.pid","foreground.pid"].map((Be)=>sp(gn(M,Be)));if(new Set(Ye).size!==2||Ye.some((Be)=>!Number.isSafeInteger(Be)||Be<2||Be===Te.job.process.pid))return!1;if(process.platform==="linux"){if(!Ye.every((Be)=>ip(Xm(`/proc/${Be}/stat`,"utf8"),Be,Te.job.process.pid)))return!1}else{let Ke=bi("/bin/ps",["-o","pid=,pgid=","-p",Ye.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
-`).map((Fe)=>Fe.trim().split(/\s+/).map(Number));if(Ke.length!==2||new Set(Ke.map(([Fe])=>Fe)).size!==2||Ke.some((Fe)=>Fe.length!==2||!Ye.includes(Fe[0])||Fe[0]!==Fe[1]))return!1}if(Me.send(JSON.stringify({t:"close"})),await Ge,z.signal.aborted)return!1;for(let Be of[Te.job.process.pid,...Ye])try{return process.kill(Be,0),!1}catch(Ke){if(!(Ke instanceof Error&&("code"in Ke)&&Ke.code==="ESRCH"))return!1}Je=!0}catch{Je=!1}finally{if(clearTimeout(ce),e.removeEventListener("abort",re),re(),G?.close(),await Ge,await Le,await xe?.stop(!0),!Ne||Ue)lp({directory:D,root:M},v)}return Je&&Ue&&!e.aborted}function ap(e,l){let v={foreground:gn(e,"foreground.lifeline"),background:gn(e,"background.lifeline")};if(!Object.values(v).every((L)=>/^\/[A-Za-z0-9/._-]+$/.test(L)))throw Error("pty_probe_path");bi("/usr/bin/mkfifo",["-m","0600",...Object.values(v)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let D=[],M=()=>{for(let L of D.splice(0))Ka(L)};try{for(let L of Object.values(v)){let z=Va(L,Mr.O_RDONLY|Mr.O_NONBLOCK|Mr.O_NOFOLLOW);try{if(D.push(Va(L,Mr.O_WRONLY|Mr.O_NONBLOCK|Mr.O_NOFOLLOW)),!Pl(D.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{Ka(z)}if(l)El(L,l.uid,l.gid)}}catch(L){throw M(),L}return{wait:(L)=>`exec 3<>${v[L]} <${v[L]} 3>&-; exec /bin/cat`,close:M}}function Cl(e=(l)=>Ro(l)){let l=new AbortController,v=JSON.stringify(J()),D=(async()=>{try{return await e(l.signal)===!0&&!l.signal.aborted}catch{return!1}})();return{result:D,matches:(M)=>M.executionMode==="host"&&JSON.stringify(J())===v,stop:async(M=1500)=>{l.abort();let L;await Promise.race([D,new Promise((z)=>{L=setTimeout(z,M)})]),clearTimeout(L)}}}function sp(e){let l;try{l=Va(e,Mr.O_RDONLY|Mr.O_NOFOLLOW|Mr.O_NONBLOCK)}catch{return Number.NaN}try{let v=Pl(l);if(!v.isFile()||v.size>32)return Number.NaN;let D=Buffer.alloc(32),M=Zm(l,D,0,D.length,0),L=D.subarray(0,M).toString("utf8").trim();return/^[0-9]{1,10}$/.test(L)?Number(L):Number.NaN}catch{return Number.NaN}finally{Ka(l)}}function cp(e,l=Qm("/tmp")){let v=Ym(gn(l,"reason-pty-probe-")),D=gn(v,"workspace"),M=gn(v,"private");if(vl(D,{mode:448}),vl(M,{mode:448}),e)kl(v,493),kl(D,493),El(D,e.uid,e.gid);return{directory:v,root:D,runtimeDirectory:M}}function lp(e,l){if(l)try{bi("/usr/bin/setpriv",[`--reuid=${l.uid}`,`--regid=${l.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",e.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),ep(e.root)}catch{return}tp(e.directory,{recursive:!0,force:!0})}var Ml=5000,wn="ARA_WORKER_PROBE_READY";function wp(e,l,v,D,M){if(M.aborted)return Promise.resolve(!1);return new Promise((L)=>{dp(e,l,{cwd:v,env:D,signal:M,timeout:Ml,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8",windowsHide:!0},(z,re)=>L(!z&&!M.aborted&&re===wn))})}function yp(e,l){let v=Ya(e).replace(/\.exe$/i,"");if(v==="bash")return["--noprofile","--norc","-c",l];if(v==="zsh"||v==="sh")return["-f","-c",l];return null}function _p(e,l){let v=je({home:l,temporaryDirectory:l}),D=(L,z,re)=>wp(L,z,e.workspaceRoot,v,re),M=async(L,z,re,G=(we)=>we===wn,ce=!1)=>{let we=process.platform==="win32"?Ga(Ri(gp(),"reason-device-probe-")):e.workspaceRoot;try{let te=await Gn(L,z,{cwd:we,root:we,allowWrite:!1,allowProcessInspection:ce,timeoutMs:Ml,signal:re,workerProbe:!0}),X=!re.aborted&&!te.timedOut&&!te.truncated&&te.exitCode===0&&G(te.stdout);if(!X&&process.platform==="win32")process.stderr.write(`Reason worker: confined ${Ya(L)} probe failed (exit ${te.exitCode}${te.timedOut?", timed out":""}): ${te.stderr.slice(-300).trim()}
-`);return X}catch(te){if(process.platform==="win32")process.stderr.write(`Reason worker: confined ${Ya(L)} probe failed: ${String(te)}
-`);throw te}finally{if(we!==e.workspaceRoot)Dl(we,{recursive:!0,force:!0})}};return{workspaceRead:async(L)=>(await xl(e.workspaceRoot,Al.R_OK),await Ol(e.workspaceRoot),!L.aborted),workspaceWrite:async(L)=>{if(await xl(e.workspaceRoot,Al.W_OK),L.aborted)return!1;let z=Ga(Ri(e.workspaceRoot,".ara-worker-probe-")),re=Ri(z,"receipt");try{let G=await fp(re,"wx",384);try{await G.writeFile(wn),await G.sync()}finally{await G.close()}return await Il(re,"utf8")===wn&&!L.aborted}finally{await pp(re).catch(()=>{}),await hp(z).catch(()=>{})}},confinedShell:(L)=>{if(process.platform==="win32"&&!tn())return process.stderr.write(`Reason worker: ${Da}
-`),Promise.resolve(!1);return M(en(),["-c",`printf ${wn}`],L)},confinedGit:(L)=>M("git",["--version"],L,(z)=>/^git version \S+/.test(z)),processInspection:async(L)=>{if(process.platform==="darwin")return M("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],L,(ce)=>ce.includes(`p${process.pid}
-`)&&/^n\//m.test(ce),!0);if(process.platform==="win32")return cc(L);if(process.platform!=="linux")return!1;let[z,re,G]=await Promise.all([mp("/proc/self/cwd"),Ol("/proc/self/fd"),Il("/proc/net/tcp","utf8")]);return!L.aborted&&z.length>0&&re.length>0&&G.includes("local_address")},bash:async(L)=>{let z=process.platform==="win32"?Y():"/bin/bash";if(!z)return process.stderr.write(`Reason worker: ${process.platform==="win32"?va:"bash is unavailable"}
-`),!1;return D(z,["--noprofile","--norc","-c",`printf ${wn}`],L)},jobs:(L)=>bl(e,L),environment:(L)=>hl(e,l,L),preview:(L)=>to(l,L),boundPty:(L)=>Ro(L),desktopDisplay:()=>Mo(),desktopAutomation:async()=>{let L=Xa();if(L)process.stderr.write(`Reason worker: computer and browser use need setup (${L})
-`);return hr()},desktopBrowser:async()=>A()?.features.browser===!0,fullControlShell:(L)=>{let z=dt(),re=yp(z,`printf ${wn}`);return re?D(z,re,L):Promise.resolve(!1)}}}function Xa(){return process.platform==="darwin"&&A()?.features.computer===!0?Nn():null}var rs=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function bp(e,l,v=new AbortController().signal,D={read:!0,write:!1},M=xo()){return Eo(e,l,v,D,M).final}function Eo(e,l,v=new AbortController().signal,D={read:!0,write:!1},M=xo(),L,z){let re,G;try{if(Or(e),ne(),!l)b(p(e),!0),re=Ga(Ri(p(e),"probe-")),l=_p(e,re);G=l}catch(Me){let Ce=Promise.reject(Me);return Ce.catch(()=>{}),{initial:Ce,final:Ce,pty:Ce}}let ce=async(Me,Ce)=>{if(v.aborted||!Ce&&!G[Me])return!1;let Te,We=new Promise(($e)=>{Te=()=>$e(!1)});v.addEventListener("abort",Te,{once:!0});try{return await Promise.race([Ce??G[Me](v),We])===!0&&!v.aborted}catch{return!1}finally{v.removeEventListener("abort",Te)}},we=e.executionMode==="host",te=we?ce("boundPty",L):Promise.resolve(!1),X=Promise.resolve(z).then(()=>Promise.all(we?[ce("preview"),te,ce("desktopDisplay"),ce("desktopAutomation"),ce("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),he=(async()=>{let[Me,Ce,Te,We,$e,Ue,Ne,xe,Le]=await Promise.all([Promise.resolve(D).then((Ge)=>Ge.read?ce("workspaceRead"):!1,()=>!1),Promise.resolve(D).then((Ge)=>Ge.write?ce("workspaceWrite"):!1,()=>!1),M?ce("confinedShell"):!1,M?ce("confinedGit"):!1,ce("processInspection"),...we?[ce("bash"),ce("jobs"),ce("environment"),ce("fullControlShell")]:[!1,!1,!1,!1]]);if(we&&(!Ue||!Ne||!xe)&&!z)await X;if(we){if(!Ue)Ue=await ce("bash");if(!Ne)Ne=await ce("jobs");if(!xe)xe=await ce("environment")}return{read:Me,write:Ce,shell:Te,git:We,processes:$e,bash:Ue,jobs:Ne,environment:xe,full:Le}})(),Se=(Me,Ce)=>{let{read:Te,write:We,shell:$e,git:Ue,processes:Ne,bash:xe,jobs:Le,environment:Ge,full:Ve}=Me,{preview:Je,boundPty:it,desktopDisplay:Ye,desktopAutomation:Be,desktopBrowser:Ke}=Ce,Fe=nc(),nt=we&&process.platform==="darwin"&&Ve&&up("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":Te,"fs.write":We,"inference.custom.v1":we&&Te,"fs.export":Te&&Fe,"fs.import":We&&Fe,"exec.run":$e&&M,"git.run":$e&&Ue&&M,"process.list":(process.platform==="linux"||process.platform==="win32"||$e)&&Ne,"ports.list":(process.platform==="linux"||process.platform==="win32"||$e)&&Ne,"exec.full":xe&&Ve&&M,"hands.connect":Te&&We&&xe&&Le,"jobs.control":Te&&We&&xe&&Le,"pty.start":Te&&We&&xe&&Le&&Ge&&it,"environment.install":Te&&We&&xe&&Le&&Ge,"github.local.v1":(process.platform==="darwin"||process.platform==="win32"||process.platform==="linux"&&process.geteuid?.()!==0)&&Te&&We&&xe&&Le&&Ge,"tunnel.open":Te&&We&&xe&&Le&&Ge&&Je,"tunnel.close":Te&&We&&xe&&Le&&Ge&&Je,"preview.serve.v1":Te&&xe&&Le&&Je&&Ve,"display.stream.v1":Ye,"automation.call.v1":Be,"simulator.call.v1":nt,"simulator.stream.v1":nt,"browser.pr-proof.v1":Be&&Ke&&ue()===null&&process.platform!=="win32","workspace.setup.v1":we&&Zr()})},Re=he.then(async(Me)=>Se(Me,{preview:!1,boundPty:await Promise.race([te,new Promise((Ce)=>setImmediate(()=>Ce(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),Ee=(async()=>{try{let Me=await he,[Ce,Te,We,$e,Ue]=await X;if(we&&!Te&&Me.read&&Me.write&&Me.bash&&Me.jobs&&Me.environment)Te=await ce("boundPty");return Se(Me,{preview:Ce,boundPty:Te,desktopDisplay:We,desktopAutomation:$e,desktopBrowser:Ue})}finally{if(re)Dl(re,{recursive:!0,force:!0})}})();Re.catch(()=>{});let Oe=(async()=>{let Me=await he;if(!(Me.read&&Me.write&&Me.bash&&Me.jobs&&Me.environment))return!1;return await te||(await Ee)["pty.start"]===!0})();return Oe.catch(()=>{}),{initial:Re,final:Ee,pty:Oe}}var kp=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],vp=[60000,300000,900000];function Ja(e,l){if(e.executionMode!=="host"||l["fs.read"]!==!0)return[];return kp.filter((v)=>l[v]!==!0)}function Tl(e){let l=e.log??((L)=>{process.stderr.write(L)}),v=e.resolve??((L)=>bp(e.config,void 0,L,e.permissions)),D=e.readiness,M=Ja(e.config,D);if(M.length===0)return Promise.resolve();return l(`Reason worker: withheld at start (${M.join(", ")}); probing them again while idle.
-`),(async()=>{for(let L of e.delaysMs??vp){if(await new Promise((G)=>{let ce=setTimeout(G,L);e.signal.addEventListener("abort",()=>{clearTimeout(ce),G()},{once:!0})}),e.signal.aborted)return;if(!e.idle())continue;let z;try{z=await v(AbortSignal.any([e.signal,AbortSignal.timeout(30000)]))}catch{continue}if(e.signal.aborted)return;let re=Ja(e.config,D).filter((G)=>z[G]===!0);if(re.length>0)D=Object.freeze({...D,...Object.fromEntries(re.map((G)=>[G,!0]))}),l(`Reason worker: ready after probing again (${re.join(", ")}).
-`),e.onReady(D,re);if(Ja(e.config,D).length===0)return}})()}import{execFile as vh}from"child_process";import{createHash as Sh,randomUUID as Es}from"crypto";import{lstat as Rh,readdir as bd,readFile as Sd,realpath as Eh,stat as Ph}from"fs/promises";import{basename as Ch,join as ks}from"path";import{promisify as Ah}from"util";import{createConnection as Sp}from"net";import{endianness as Nl}from"os";var Po=4,as=1e4;class Vr{socketPath;sessionId;turnId;timeoutMs;#t=null;#e=Buffer.alloc(0);#i=1;#r=new Map;#n=new Set;constructor(e){this.socketPath=e.socketPath,this.sessionId=e.sessionId??"open-browser-use-js",this.turnId=e.turnId??`turn-${Date.now()}`,this.timeoutMs=e.timeoutMs??1e4}async connect(){if(this.#t)return this;let e=Sp(this.socketPath);return this.#t=e,e.on("data",(l)=>this.#a(Buffer.from(l))),e.on("close",()=>this.#o(Error("Open Browser Use socket closed"))),e.on("error",(l)=>this.#o(l)),await new Promise((l,v)=>{e.once("connect",l),e.once("error",v)}),this}close(){this.#t?.end(),this.#t=null}onNotification(e){return this.#n.add(e),()=>{this.#n.delete(e)}}async request(e,l={}){await this.connect();let v=this.#t;if(!v)throw Error("Open Browser Use socket is not connected");let D=String(this.#i++),M={session_id:this.sessionId,turn_id:this.turnId,...l},z=Rp({jsonrpc:"2.0",id:D,method:e,params:M}),re=new Promise((G,ce)=>{let we=setTimeout(()=>{this.#r.delete(D),ce(Error(`Open Browser Use request timed out: ${e}`))},this.timeoutMs);this.#r.set(D,{resolve:G,reject:ce,timeout:we})});return v.write(z),await re}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory(e={}){return this.request("getUserHistory",e)}claimUserTab(e){return this.request("claimUserTab",{tabId:e})}finalizeTabs(e){return this.request("finalizeTabs",{keep:e})}nameSession(e){return this.request("nameSession",{name:e})}attach(e){return this.request("attach",{tabId:e})}detach(e){return this.request("detach",{tabId:e})}executeCdp(e,l,v={}){return this.request("executeCdp",{target:{tabId:e},method:l,commandParams:v})}moveMouse(e,l,v,D=!0){return this.request("moveMouse",{tabId:e,x:l,y:v,waitForArrival:D})}waitForFileChooser(e,l){return this.request("waitForFileChooser",{tabId:e,...l===void 0?{}:{timeoutMs:l}})}setFileChooserFiles(e,l){return this.request("setFileChooserFiles",{fileChooserId:e,files:l})}waitForDownload(e,l){return this.request("waitForDownload",{tabId:e,...l===void 0?{}:{timeoutMs:l}})}downloadPath(e,l){return this.request("downloadPath",{downloadId:e,...l===void 0?{}:{timeoutMs:l}})}browserUserHistory(e={}){return this.getUserHistory(e)}readClipboardText(e){return this.request("readClipboardText",{tabId:e})}writeClipboardText(e,l){return this.request("writeClipboardText",{tabId:e,text:l})}readClipboard(e){return this.request("readClipboard",{tabId:e})}writeClipboard(e,l){return this.request("writeClipboard",{tabId:e,items:l})}turnEnded(){return this.request("turnEnded")}#a(e){this.#e=Buffer.concat([this.#e,e]);while(this.#e.length>=Po){let l=Nl()==="LE"?this.#e.readUInt32LE(0):this.#e.readUInt32BE(0),v=Po+l;if(this.#e.length<v)return;let D=this.#e.subarray(Po,v);this.#e=this.#e.subarray(v),this.#s(JSON.parse(D.toString("utf8")))}}#s(e){if(!br(e))return;let l=typeof e.id==="string"||typeof e.id==="number"?String(e.id):null;if(!l&&typeof e.method==="string"){let D={method:e.method,params:e.params};for(let M of this.#n)M(D);return}if(!l)return;let v=this.#r.get(l);if(!v)return;if(this.#r.delete(l),clearTimeout(v.timeout),br(e.error)){v.reject(Error(String(e.error.message??"Open Browser Use request failed")));return}v.resolve(e.result??null)}#o(e){for(let[l,v]of this.#r)this.#r.delete(l),clearTimeout(v.timeout),v.reject(e)}}class Ei{client;cdp;constructor(e){this.client="client"in e?e.client:new Vr(e),this.cdp=new Bl(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab(e={}){let l=await this.client.createTab(),v=Ep(l,"createTab response"),D=this.tab(v);if(e.url)await D.goto(e.url,e);return D}tab(e){return new Hl(this,e)}getTabs(){return this.client.getTabs()}}class Hl{browser;id;playwright;constructor(e,l){this.browser=e,this.id=l,this.playwright=new $l(this)}goto(e,l={}){return this.browser.cdp.navigate(this.id,e,l)}waitForLoadState(e={}){return this.browser.cdp.waitForLoadState(this.id,e)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then((e)=>String(e??""))}evaluate(e,l={}){return this.browser.cdp.evaluate(this.id,e,l)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class $l{tab;constructor(e){this.tab=e}waitForLoadState(e={}){return this.tab.waitForLoadState(e)}domSnapshot(){return this.tab.domSnapshot()}}class Bl{client;#t=new Set;constructor(e){this.client=e}async call(e,l,v={},D={}){return await this.ensureAttached(e),this.client.request("executeCdp",{target:{tabId:e},method:l,commandParams:v,...D.timeoutMs===void 0?{}:{timeoutMs:D.timeoutMs}})}async evaluate(e,l,v={}){let D=await this.call(e,"Runtime.evaluate",{expression:l,returnByValue:!0,...v.awaitPromise===void 0?{}:{awaitPromise:v.awaitPromise}});if(br(D)&&br(D.exceptionDetails))throw Error(String(D.exceptionDetails.text??"Open Browser Use evaluation failed"));return br(D)&&br(D.result)?D.result.value??null:null}async navigate(e,l,v={}){if(!l)throw Error("goto requires a URL");let D=v.waitUntil??"load";Ll(D);let M=v.timeoutMs??as;await this.call(e,"Page.enable");let L=this.waitForLoadEvent(e,D,M),z=await this.call(e,"Page.navigate",{url:l},{timeoutMs:M});if(br(z)&&typeof z.errorText==="string"&&z.errorText)throw Error(`Browser failed to navigate tab ${e}: ${z.errorText}`);return await L.catch(async(re)=>{let G=await this.readDocumentState(e);if(Wl(G,D))return;throw re}),z}async waitForLoadState(e,l={}){let v=l.state??"load";Ll(v),await this.call(e,"Page.enable");let D=await this.readDocumentState(e);if(Wl(D,v))return;await this.waitForLoadEvent(e,v,l.timeoutMs??as)}async readDocumentState(e){try{let l=await this.evaluate(e,"({ href: window.location.href, readyState: document.readyState })");return br(l)?{href:ls(l.href),readyState:ls(l.readyState)}:void 0}catch{return}}waitForEvent(e,l,v={}){let D=v.timeoutMs??as;return new Promise((M,L)=>{let z=!1,re=null,G,ce=()=>{if(z)return!1;return z=!0,clearTimeout(G),re?.(),!0};G=setTimeout(()=>{if(ce())L(Error(v.timeoutMessage??`Timed out waiting for tab ${e} event`))},D),re=this.client.onNotification((we)=>{try{if(l(we)){if(ce())M(we)}}catch(te){if(ce())L(te instanceof Error?te:Error(String(te)))}})})}waitForLoadEvent(e,l,v){return this.waitForEvent(e,(D)=>{let M=Pp(D,e);if(!M)return!1;if(M.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${e}`);return l==="domcontentloaded"?M.method==="Page.domContentEventFired":M.method==="Page.loadEventFired"},{timeoutMs:v,timeoutMessage:`Timed out waiting for ${l} in tab ${e}`}).then(()=>{return})}async ensureAttached(e){if(this.#t.has(e))return;await this.client.attach(e),this.#t.add(e)}}function Rp(e){let l=Buffer.from(JSON.stringify(e),"utf8"),v=Buffer.alloc(Po+l.length);if(Nl()==="LE")v.writeUInt32LE(l.length,0);else v.writeUInt32BE(l.length,0);return l.copy(v,Po),v}function br(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Ep(e,l){if(!br(e))throw Error(`${l} did not include a tab object`);let v=e.id;if(typeof v==="number"&&Number.isInteger(v)&&v>0)return v;if(typeof v==="string"){let D=Number(v);if(Number.isInteger(D)&&D>0)return D}throw Error(`${l} did not include a numeric tab id`)}function Ll(e){if(e!=="domcontentloaded"&&e!=="load")throw Error(`Unsupported load state "${e}". Use "domcontentloaded" or "load".`)}function Wl(e,l){if(e?.readyState==="complete")return!0;return l==="domcontentloaded"&&e?.readyState==="interactive"}function Pp(e,l){if(e.method!=="onCDPEvent"||!br(e.params))return null;let v=e.params.source;if(!br(v)||v.tabId!==l)return null;return{method:ls(e.params.method)}}function ls(e){return typeof e==="string"?e:void 0}import{createHash as Cp}from"crypto";function Ul(e,l,v,D){let M=JSON.stringify([e.trim().toLowerCase(),l.trim().toLowerCase(),v,D]);return`reason-cloud-${Cp("sha256").update(M).digest("hex")}`}import{AsyncLocalStorage as _h}from"async_hooks";import{isDeepStrictEqual as yd}from"util";import{createHash as bh}from"crypto";var Ap=/#w=(\d{1,5})&h=(\d{1,5})$/;function Fl(e){return typeof e==="number"&&Number.isInteger(e)&&e>0&&e<=32768?e:void 0}function jl(e){let l=Ap.exec(e);if(!l)return;let v=Fl(Number(l[1])),D=Fl(Number(l[2]));return v&&D?{width:v,height:D}:void 0}var ql="[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}",xp=new RegExp(`^/media/pr-screenshots/(${ql})/(${ql})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$`,"i");var Ip=new Set(["png","jpg","jpeg","gif","webp"]),Op=new Set(["webm","mp4"]);function Dp(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function Mp(e){let l=jl(e);return Boolean(l&&e===`#w=${l.width}&h=${l.height}`)}function zl(e,l){let v;try{v=new URL(e)}catch{return null}let D=Dp(l),M=v.hostname==="ara.so"||v.hostname.endsWith(".ara.so")||v.hostname==="reasonmachines.ai"||v.hostname.endsWith(".reasonmachines.ai")||v.hostname==="reasonmachines.com"||v.hostname.endsWith(".reasonmachines.com");if(v.protocol!=="https:"||!M&&v.origin!==D||v.username||v.password||v.port||v.search||v.hash&&!Mp(v.hash))return null;let L=xp.exec(v.pathname);if(!L)return null;let z=L[1]?.toLowerCase(),re=L[2]?.toLowerCase(),G=L[3]?.toLowerCase(),ce=L[4]?.toLowerCase();if(!z||!re||!G||!ce)return null;let we=Ip.has(ce)?"image":Op.has(ce)?"video":null;if(!we)return null;let te=/^(before|after)[\s:_-]+/.exec(G),X=v.pathname.replace(/^\/media\//,"");return{url:v.toString(),storagePath:X,runId:z,artifactId:re,fileName:`${G}.${ce}`,kind:we,phase:te?.[1]==="before"||te?.[1]==="after"?te[1]:null}}var Tp=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Pi=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),yn=()=>{throw Error("cloud_browser_media_request_invalid")};function Ci(e){if(!Pi(e)||Object.keys(e).some((L)=>!["runId","configuredMediaOrigin","media"].includes(L))||typeof e.runId!=="string"||!Tp.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return yn();let l;try{l=new URL(e.configuredMediaOrigin)}catch{return yn()}if(l.protocol!=="https:"||l.username||l.password||l.port||!Mt(l.origin,{mode:"public_web"}).allowed)return yn();let v=e.runId.toLowerCase(),D=new Set,M=e.media.map((L)=>{if(!Pi(L)||Object.keys(L).some((re)=>!["url","sourceUrl","kind"].includes(re))||typeof L.url!=="string"||L.url.length>2048||typeof L.sourceUrl!=="string"||L.sourceUrl.length>8192||!["image","video"].includes(String(L.kind)))return yn();let z=zl(L.url,l.origin);if(!z||new URL(z.url).origin!==l.origin||z.runId!==v||z.kind!==L.kind||z.url!==L.url||D.has(L.url))return yn();if(D.add(L.url),L.sourceUrl!==L.url){let re;try{re=new URL(L.sourceUrl)}catch{return yn()}let G=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(re.pathname)?.[1];if(L.kind!=="image"||re.origin!=="https://camo.githubusercontent.com"||re.username||re.password||re.search||re.hash||!G||G.length%2!==0||Buffer.from(G,"hex").toString("utf8")!==L.url)return yn()}return{url:L.url,sourceUrl:L.sourceUrl,kind:L.kind}});return{runId:e.runId,configuredMediaOrigin:l.origin,media:M}}function Kl(e,l){let v=()=>{throw Error("cloud_browser_media_verification_failed")};if(!Pi(e)||e.verified!==!0||!Array.isArray(e.items)||e.items.length!==l.media.length)return v();return{verified:!0,items:e.items.map((M,L)=>{let z=l.media[L];if(!Pi(M)||M.url!==z.url||M.sourceUrl!==z.sourceUrl||M.kind!==z.kind||typeof M.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(M.sourceSha256)||!Number.isSafeInteger(M.width)||!Number.isSafeInteger(M.height)||Number(M.width)<1||Number(M.height)<1||Number(M.width)>16384||Number(M.height)>16384||z.kind==="video"&&(typeof M.advancedSeconds!=="number"||!Number.isFinite(M.advancedSeconds)||M.advancedSeconds<0.05||M.advancedSeconds>30))return v();return{...z,width:Number(M.width),height:Number(M.height),sourceSha256:M.sourceSha256,...z.kind==="video"?{advancedSeconds:M.advancedSeconds}:{}}})}}var us="browser.pr-proof.v1",Dt=t().uuid(),Hn=t().regex(/^[a-f0-9]{64}$/),bn=I.datetime({precision:3}),ds=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),Gl=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),ur=n({kind:i("primary_mac"),version:i(1),organizationId:ds,userId:ds,sessionId:ds,runId:Dt,deviceId:Dt,rootId:Dt,rootRevision:t().min(1).max(64),binding:c(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:Dt,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Lp=Xi().transform((e,l)=>{try{return po(e)}catch{return l.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),Jc}}),$n=n({version:i(1),owner:ur,contextId:Dt,preparedAt:bn,expiresAt:bn,prUrl:Gl,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:Hn,evidenceKind:c(["image","video"]),visualPlan:Lp.optional(),uploadOrigin:t().url().refine((e)=>{let l=new URL(e);return l.protocol==="https:"&&l.origin===e&&!l.username&&!l.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),fs=n({version:i(1),producer:i("primary_mac"),context:$n,captureId:Dt,operationId:Dt,attemptId:Dt,tabId:o().int().positive(),startedAt:bn,finishedAt:bn,sha256:Hn,media:P("contentType",[n({contentType:i("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),n({contentType:i("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,l)=>{let v=Date.parse(e.startedAt),D=Date.parse(e.finishedAt);if(v<Date.parse(e.context.preparedAt)||D<v||D>Date.parse(e.context.expiresAt)||D-v>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((D-v)/1000-e.media.durationSeconds)>0.1))l.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),ov=P("action",[n({action:i("screenshot"),context_id:Dt,tab_id:o().int().positive()}).strict(),n({action:i("start_video"),context_id:Dt,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("stop_video"),recording_operation_id:Dt}).strict()]),xi=n({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),Ai=t().regex(/^[1-9][0-9]{0,19}$/),Ao=n({version:i(1),owner:ur,expectedActorId:Ai.nullable(),repositoryId:Ai,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Wp=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],ms=P("status",[Ao.extend({status:i("ready"),observedActor:xi,checkedAt:bn}),Ao.extend({status:i("not_ready"),reason:c(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:c(Wp).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),_n=n({version:i(1),owner:ur,expectedActorId:Ai.nullable(),authenticatedActor:xi,attemptId:Dt,captureId:Dt,prUrl:Gl,repositoryId:Ai,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:Hn,sizeBytes:o().int().min(128).max(10485760),contentType:i("video/webm")}).strict(),Yl=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),Bn=P("status",[_n.extend({status:i("not_attempted"),reason:c(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),_n.extend({status:i("uncertain"),reason:i("upload_outcome_unknown")}),_n.extend({status:i("uploaded"),observedActor:xi,nativeUrl:Yl,uploadedAt:bn})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),Io=_n.extend({nativeUrl:Yl,observedActor:xi,bodySha256:Hn}),ps=P("status",[Io.extend({status:i("incomplete"),reason:c(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),Io.extend({status:i("verified"),sourceSha256:Hn,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:i(!0),verifiedAt:bn})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Np=Xi().transform((e,l)=>{try{let v=Ci(e);if(v.media.some((D)=>D.kind!=="image"))throw Error();return v}catch{return l.addIssue({code:"custom",message:"proof_media_request_invalid"}),Jc}}),Hp=P("action",[n({action:i("auth_check"),input:Ao}).strict(),n({action:i("prepare"),context:$n}).strict(),n({action:i("capture_png"),owner:ur,contextId:Dt,tabId:o().int().positive()}).strict(),n({action:i("start_video"),owner:ur,contextId:Dt,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("inspect_capture"),owner:ur,captureId:Dt}).strict(),n({action:i("publish_video"),input:_n}).strict(),n({action:i("verify_png_media"),owner:ur,media:Np}).strict().refine((e)=>e.media.runId===e.owner.runId),n({action:i("verify_saved_media"),input:Io}).strict(),n({action:i("publish_png"),owner:ur,attemptId:Dt,captureId:Dt,sha256:Hn,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var Xl="pr-proof.stop.v1",hs=n({requestId:Dt,command:Hp}).strict();var $p={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},Vl={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},Jl={type:"integer",minimum:1,description:"An already-owned tab's id."},iv={...$p,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:Vl,tab_id:Jl}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:Vl,tab_id:Jl,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};import{createHash as Bp,randomUUID as Up}from"crypto";import{isDeepStrictEqual as Un}from"util";var Zl=n({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict(),_t=()=>Error("mac_pr_proof_capture_unavailable"),gs=(e)=>Bp("sha256").update(e).digest("hex");function Ql(e){let l=ur.parse(e.owner),v=new Map,D=new Map,M=!1,L=async()=>{if(M)throw _t();if(await e.assertCurrent(),M)throw _t()},z=(X)=>{let he=v.get(X);if(!he||Date.parse(he.expiresAt)<=Date.now())throw _t();return he},re=(X)=>X.disposal??=(async()=>{X.controller.abort(),X.bytes?.fill(0),X.bytes=void 0,X.receipt=void 0;try{await X.host?.close()}catch{throw M=!0,_t()}})(),G=async()=>{for(let[X,he]of v){if(Date.parse(he.expiresAt)>Date.now())continue;let Se=[...D.entries()].filter(([,Ee])=>Ee.claim.contextId===X);if((await Promise.allSettled(Se.map(([,Ee])=>re(Ee)))).some((Ee)=>Ee.status==="rejected"))throw _t();for(let[Ee]of Se)D.delete(Ee);v.delete(X)}},ce=setInterval(()=>{G().catch(()=>{M=!0})},1000);ce.unref();let we=(X)=>{if(X.stopRequested=!0,X.started&&X.host&&!X.stop)X.stop=X.host.stop(),X.stop.catch(()=>X.controller.abort())};async function te(X,he){let Se=Zl.parse(X.claim);if(he==="video"&&(!Number.isInteger(X.seconds)||X.seconds<1||X.seconds>15))throw _t();await L(),X.signal.throwIfAborted(),await G();let Re=z(Se.contextId);if(he==="video"&&Re.evidenceKind!=="video")throw _t();let Ee=D.get(Se.operationId);if(Ee){if(!Un(Ee.claim,Se)||Ee.kind!==he||Ee.seconds!==X.seconds||Ee.controller.signal.aborted)throw _t();let Ne=await Ee.completion;if(await L(),z(Se.contextId),Ee.controller.signal.aborted)throw _t();return structuredClone(Ne)}if(D.size>=16||[...D.values()].some((Ne)=>!Ne.receipt&&!Ne.controller.signal.aborted&&Ne.claim.tabId===Se.tabId))throw _t();let Oe,Me,Ce=new Promise((Ne,xe)=>{Oe=Ne,Me=xe});Ce.catch(()=>{});let Te={claim:Se,kind:he,seconds:X.seconds,controller:new AbortController,completion:Ce,stopRequested:!1,started:!1};D.set(Se.operationId,Te);let We=()=>{re(Te).catch(()=>{})};X.signal.addEventListener("abort",We,{once:!0});let $e=async()=>{await L(),z(Se.contextId),X.signal.throwIfAborted(),Te.controller.signal.throwIfAborted()},Ue;try{await $e();let Ne;if(he==="image"){let xe=new Date().toISOString();Ue=await e.screenshot(structuredClone(Re),Se.tabId,Te.controller.signal);let Le=new Date().toISOString();if(await $e(),Ue.length<24||Ue.length>8388608||!Ue.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||Ue.readUInt32BE(8)!==13||Ue.toString("ascii",12,16)!=="IHDR")throw _t();Ne=fs.parse({version:1,producer:"primary_mac",context:Re,captureId:Up(),operationId:Se.operationId,attemptId:Se.attemptId,tabId:Se.tabId,startedAt:xe,finishedAt:Le,sha256:gs(Ue),media:{contentType:"image/png",sizeBytes:Ue.length,width:Ue.readUInt32BE(16),height:Ue.readUInt32BE(20)}})}else{if(Te.host=await e.createVideo(structuredClone(Re),Se.tabId,X.seconds,Te.controller.signal),Te.controller.signal.aborted||X.signal.aborted||M)throw await Te.host.close(),_t();await Te.host.start(),Te.started=!0;let xe=Te.host.completed();if(xe.catch(()=>{}),await $e(),await X.started?.(),Te.stopRequested)we(Te);let Le=await xe;if(Te.stop)await Te.stop;await $e();let Ge=await Te.host.read(Le.captureId);Ue=Ge.bytes;let Ve={runId:l.runId,deviceId:l.deviceId,rootId:l.rootId,rootRevision:l.rootRevision,generation:l.generation,profile:l.profile,extensionInstanceId:l.extensionInstanceId,browserScope:e.browserScope,tabId:Se.tabId};if(!Un(Le,Ge.capture)||!Un(Le.owner,Ve)||Ue.length!==Le.sizeBytes||gs(Ue)!==Le.sha256||Ue.length<128||Ue.readUInt32BE(0)!==440786851)throw _t();await Te.host.close(),await $e(),Ne=fs.parse({version:1,producer:"primary_mac",context:Re,captureId:Le.captureId,operationId:Se.operationId,attemptId:Se.attemptId,tabId:Se.tabId,startedAt:Le.startedAt,finishedAt:Le.finishedAt,sha256:Le.sha256,media:{contentType:"video/webm",sizeBytes:Le.sizeBytes,durationSeconds:Le.durationSeconds,frameCount:Le.frameCount,receivedFrameCount:Le.receivedFrameCount}})}if(await $e(),[...D.values()].reduce((xe,Le)=>xe+(Le.bytes?.length??0),Ue.length)>20971520)throw _t();return Te.bytes=Buffer.from(Ue),Te.receipt=Ne,Oe(Ne),structuredClone(Ne)}catch(Ne){let xe=he==="video"&&!X.signal.aborted&&!Te.controller.signal.aborted&&Ne instanceof Error&&Ne.message==="mac_recording_worker_failed:no_frames"?new r("proof_capture_no_frames","The owned tab emitted no recording frames."):_t();throw await re(Te).catch(()=>{}),Me(xe),xe}finally{Ue?.fill(0),X.signal.removeEventListener("abort",We)}}return{async prepare(X){let he=$n.parse(X);if(!Un(he.owner,l))throw _t();if(await L(),await G(),Date.parse(he.preparedAt)>Date.now()||Date.parse(he.expiresAt)<=Date.now())throw _t();let Se=v.get(he.contextId);if(Se){if(!Un(Se,he))throw _t();return structuredClone(Se)}if(v.size>=4)throw _t();return v.set(he.contextId,he),structuredClone(he)},screenshot:(X)=>te(X,"image"),record:(X)=>te(X,"video"),async stop(X){let he=Zl.parse(X);await L(),z(he.contextId);let Se=D.get(he.operationId);if(!Se||Se.kind!=="video"||!Un(he,Se.claim)||Se.controller.signal.aborted)throw _t();we(Se)},async publicationCapture(X){await L(),await G();let he=[...D.values()].find((Se)=>Se.receipt?.captureId===X);if(!he?.receipt||!he.bytes||he.controller.signal.aborted)throw _t();if(z(he.claim.contextId),he.bytes.length!==he.receipt.media.sizeBytes||gs(he.bytes)!==he.receipt.sha256)throw _t();return{capture:structuredClone(he.receipt),bytes:Buffer.from(he.bytes)}},async inspect(X){await L(),await G();let he=[...D.values()].find((Se)=>Se.receipt?.captureId===X);if(!he?.receipt||he.controller.signal.aborted)throw _t();return z(he.claim.contextId),structuredClone(he.receipt)},async close(){M=!0,clearInterval(ce);let X=await Promise.allSettled([...D.values()].map(re));if(D.clear(),v.clear(),X.some((he)=>he.status==="rejected"))throw _t()}}}import{createHash as nd,randomUUID as Yp}from"crypto";import{isDeepStrictEqual as Do}from"util";import{realpath as Xp}from"fs/promises";var ed=String.raw`async (media) => {
+`)}catch{X.destroy()}})});G.maxConnections=32;let ce,we=!1,te=async()=>{if(we)return;we=!0;for(let X of re)X.destroy();if(await new Promise((X)=>G.close(()=>X())),ce&&u(D)){let X=fi(D);if(X.isFile()&&X.dev===ce.dev&&X.ino===ce.ino)try{let he=zc.parse(JSON.parse(m(D)));if(he.nonce===l&&he.socketPath===z)jf(D)}catch{}}try{if(L)Uf(L)}catch{}};try{if(await new Promise((X,he)=>{G.once("error",he),G.listen(z,()=>{if(!M)$f(z,384);X()})}),mi(e).nonce!==l)throw Error("worker_instance_changed");return y(D,{version:1,nonce:l,socketPath:z}),ce=fi(D),te}catch(X){throw await te(),X}}function Gc(e,l){try{let v=JSON.parse(m(pn(f(e).lock,"owner.json"))),D=v&&typeof v==="object"?v[l]:void 0;return typeof D==="string"?D:null}catch{return null}}function ko(e){return Gc(e,"runtime_version")}function Xf(e){return Gc(e,"nonce")}function Yc(e,l){if(l)return l.message==="worker_control_timeout"?"socket_timeout":"bad_reply";try{if(!u(pn(f(e).lock,"owner.json")))return"no_lock";return Vc(e,mi(e).nonce)?"socket_refused":"no_socket"}catch{return"bad_reply"}}var Zf=21600000,Qf=h({instance:t().nullable(),since:o().int().nonnegative()});function em(e,l){let v=f(e).updateDeferral;try{if(!u(v))return null;let D=Qf.safeParse(JSON.parse(m(v)));if(D.success&&D.data.instance===l)return D.data.since;va(e)}catch{}return null}function va(e){try{Ff(f(e).updateDeferral,{force:!0})}catch{}}async function hi(e,l,v=()=>!1){let D=Xf(e),M=em(e,D);if(l!==void 0){let ce=ko(e);if(ce===null||ce===l&&M===null&&!v())return{state:"current"}}let L;try{let ce=await St(e,"status");L=ce?ce.activeSessions??ce.activeClaims:0}catch{L=null}if(L===0)return{state:"restarted"};let z=Date.now(),re=M;if(re===null){re=z;try{y(f(e).updateDeferral,{instance:D,since:re})}catch{}}let G=z-re;return{state:G<Zf?"busy":"drained",sessions:L,waitedMs:G}}async function St(e,l){let v=f(e);if(!u(pn(v.lock,"owner.json")))return null;let D=mi(e),M=Vc(e,D.nonce);if(!M)return null;return new Promise((L,z)=>{let re=qf(M),G="",ce=!1,we=(te,X)=>{if(ce)return;if(ce=!0,re.destroy(),X)z(X);else L(te)};re.setTimeout(2000,()=>re.destroy(Error("worker_control_timeout"))),re.on("connect",()=>re.write(JSON.stringify({nonce:D.nonce,action:l})+`
+`)),re.on("data",(te)=>{if(G+=te.toString(),Buffer.byteLength(G)>16384)re.destroy(Error("worker_control_oversize"))}),re.on("error",(te)=>{if("code"in te&&["ECONNREFUSED","ENOENT"].includes(String(te.code)))we(null);else we(null,te.message==="worker_control_timeout"?te:Error("worker_control_unavailable"))}),re.on("end",()=>{try{let te=Vf.parse(JSON.parse(G));if(te.instanceId!==D.nonce)throw Error("worker_instance_changed");we(te)}catch{we(null,Error("worker_control_invalid_response"))}}),re.once("close",()=>we(null,Error("worker_control_unavailable")))})}import{randomUUID as Fd}from"crypto";import{homedir as jd}from"os";import{spawn as tm}from"child_process";import{createRequire as rm}from"module";var Xc=2147483648,nm=1;function om(){try{let e=rm(import.meta.url)("bun:ffi"),l=e.dlopen("kernel32.dll",{SetThreadExecutionState:{args:[e.FFIType.u32],returns:e.FFIType.u32}});return(v)=>l.symbols.SetThreadExecutionState(v)}catch{return null}}function im(e,l){if(e==="ac_only"||!l)return{status:"unsupported",release:async()=>"unsupported"};let v=l((Xc|nm)>>>0)===0?"failed":"held";return{get status(){return v},async release(){if(v==="held")l(Xc);return v="failed","released"}}}async function Zc(e,l={}){let v=l.platform??process.platform;if(v==="win32")return im(e,l.setExecutionState??om());if(v!=="darwin")return{status:"unsupported",release:async()=>"unsupported"};let D,M="failed",L=!1,z,re=Promise.resolve(),G=(X)=>{if(M===X)return;M=X,l.onStatusChange?.(X)},ce=()=>{if(L||z)return;z=setTimeout(()=>{z=void 0,re=we()},l.retryMs??5000),z.unref()},we=async()=>{try{let X=(l.spawn??tm)("/usr/bin/caffeinate",[e==="ac_only"?"-s":"-i","-w",String(process.pid)],{stdio:"ignore",shell:!1});if(D=X,X.once("exit",()=>{if(!L&&D===X)G("failed"),ce()}),await new Promise((he,Se)=>{X.once("spawn",he),X.once("error",Se)}),X.exitCode===null&&X.signalCode===null)G("held")}catch{G("failed"),ce()}};re=we(),await re;let te;return{get status(){return M},release(){return te??=(async()=>{L=!0,clearTimeout(z),await re;let X=D;if(!X||X.exitCode!==null||X.signalCode!==null||!X.pid)return M="failed","released";let he=await new Promise((Se)=>{let Re,Ee=setTimeout(()=>{try{X.kill("SIGKILL")}catch{}Re=setTimeout(()=>Se("failed"),1000)},1000);X.once("exit",()=>{clearTimeout(Ee),clearTimeout(Re),Se("released")});try{X.kill("SIGTERM")}catch{}});if(he==="released")M="failed";return he})()}}}class Tn extends Error{constructor(){super("Reason Device operation lease expired.")}}class wi{now;onExpire;deadline=0;clockFloor;clockTick=performance.now();timer;closed=!1;constructor(e,l,v){this.now=l;this.onExpire=v;this.clockFloor=l(),this.install(e)}remainingMs(){if(this.closed)return 0;return Math.max(0,this.deadline-this.clockNow())}assertCurrent(){if(this.remainingMs()>0)return;let e=new Tn;if(!this.closed)this.close(),this.onExpire(e);throw e}acknowledge(e){this.assertCurrent(),this.install(e)}close(){this.closed=!0,clearTimeout(this.timer)}install(e){let l=Date.parse(e);if(!Number.isFinite(l))throw Error("Reason returned an invalid operation lease deadline.");if(l-this.clockNow()<=0)throw new Tn;this.deadline=l,clearTimeout(this.timer),this.arm()}clockNow(){let e=performance.now();return this.clockFloor=Math.max(this.now(),this.clockFloor+Math.max(0,e-this.clockTick)),this.clockTick=e,this.clockFloor}arm(){this.timer=setTimeout(()=>{if(this.remainingMs()>0){this.arm();return}this.close(),this.onExpire(new Tn)},Math.min(this.remainingMs(),2147483647))}}import{realpathSync as dm}from"fs";import{randomUUID as um}from"crypto";import{constants as Ra}from"fs";import{open as am}from"fs/promises";import{join as sm}from"path";var cm={platform:process.platform,home:s,async openFile(e){let l=await am(e,Ra.O_RDONLY|Ra.O_NOFOLLOW|Ra.O_NONBLOCK);return{isFile:async()=>(await l.stat()).isFile(),close:()=>l.close()}}};async function Qc(e=cm){if(e.platform!=="darwin")return"unknown";try{let l=await e.openFile(sm(e.home(),"Library/Application Support/com.apple.TCC/TCC.db"));try{return await l.isFile()?"granted":"unknown"}finally{await l.close()}}catch(l){return l instanceof Error&&"code"in l&&["EACCES","EPERM"].includes(String(l.code))?"not_granted":"unknown"}}class Ea extends Error{constructor(){super("Hands generation receipt attempt timed out.")}}async function lm(e,l,v){l.throwIfAborted();let D=new AbortController,M=()=>{},L,z=new Promise((re,G)=>{M=()=>{D.abort(l.reason),G(l.reason)},l.addEventListener("abort",M,{once:!0}),L=setTimeout(()=>{let ce=new Ea;D.abort(ce),G(ce)},v)});try{return await Promise.race([e(D.signal),z])}finally{clearTimeout(L),l.removeEventListener("abort",M),D.abort()}}function el(e){let l=0,v=0;return async(D)=>{for(;;){D.throwIfAborted(),e.lease.assertCurrent();while(performance.now()<v)await e.sleep(Math.min(v-performance.now(),e.lease.remainingMs()),D),D.throwIfAborted(),e.lease.assertCurrent();try{let M=await lm(e.send,D,Math.min(8000,e.lease.remainingMs()));return D.throwIfAborted(),e.lease.assertCurrent(),M}catch(M){let L=M instanceof Ea||(M instanceof k?or(M.status):sr(M));if(L){let z=Math.max(Math.min(500*2**Math.min(l++,4),5000),e.retryAfterMs(M));v=performance.now()+z}if(D.throwIfAborted(),e.lease.assertCurrent(),!L)throw M}}}}function Fa(e,l=process.env){return!e.proxied&&l.REASON_DEVICE_SESSION!=="0"}function cl(e,l,v){let D=e?.permissionRecovery;return fr(D,v)&&D.deviceId===l.deviceId&&D.organizationId===l.orgId?{permissionRecovery:D}:{}}var fm=1000,mm=250,pm=16,hm=5000,gm=Fc(dm(process.execPath)),tl=null,rl=null;function ll(e){if(process.platform!=="darwin")return{};return rl??=Qc().then((l)=>{tl={status:l,checkedAt:e().getTime()}}).finally(()=>{rl=null}),{fullDiskAccess:{...tl??{status:"unknown",checkedAt:e().getTime()},executablePath:gm}}}var wm=8,ym=64,_m=2000,bm=2000,ja=8000,nl=3,km=250,ol=1000,il=30000,vm=0.2,Sm=30000,Rm=21600000,Em=300000,Pm=3600000,Cm=0.1,dl=new Set(["run_finished","run_cancelled","driver_handoff","driver_stopped"]);function Am(e){return Math.min(nl,Math.max(1,e??nl))}function xm(e){return typeof e.reason_code==="string"&&dl.has(e.reason_code)?e.reason_code:"cancelled"}function Ca(e){return e.reason instanceof r&&(e.reason.code==="cancelled"||dl.has(e.reason.code))?e.reason.code:"cancelled"}function al(e){return e instanceof r&&/^[A-Za-z0-9._:-]{1,160}$/.test(e.code)?e.code:"capability_failed"}function fl(e){return e.capability==="hands.connect"&&Qa(e.payload)}function xa(e,l=Math.random){let v=Math.min(Math.max(l(),0),1);return Math.max(0,Math.floor(e*(1+v*Cm)))}function Im(e,l=Math.random){let v=Math.min(il,ol*2**Math.max(0,e-1)),D=Math.min(Math.max(l(),0),1),M=v*vm*(D*2-1);return Math.min(il,Math.max(ol,Math.round(v+M)))}function za(e,l){return new Promise((v,D)=>{if(l.aborted){D(l.reason??new DOMException("Aborted","AbortError"));return}let M=()=>{clearTimeout(L),D(l.reason??new DOMException("Aborted","AbortError"))},L=setTimeout(()=>{l.removeEventListener("abort",M),v()},e);l.addEventListener("abort",M,{once:!0})})}class Ia extends Error{updateError;constructor(e){super("Managed runtime update check failed.");this.updateError=e;this.name="RuntimeUpdateCheckError"}}async function Om(e,l,v,D){let M=new AbortController,L=()=>M.abort(v.reason);if(v.aborted)L();else v.addEventListener("abort",L,{once:!0});try{return await Promise.race([e,D(l,M.signal).then(()=>({kind:"heartbeat"}))])}finally{M.abort(),v.removeEventListener("abort",L)}}function Ma(e){return e instanceof Error?e.message:String(e)}function Ta(e,l){return l.aborted||e instanceof DOMException&&e.name==="AbortError"||e instanceof Error&&e.name==="AbortError"}function _r(e){return e instanceof k&&e.status===409&&e.code==="attempt_fenced"}function La(e){return e.capability==="environment.install"}function Dm(e){if(e instanceof ki||e instanceof Tn||e instanceof Eo)return"timeout";if(!(e instanceof Error)||e instanceof k)return"transport_unknown";for(let l of[e,e.cause]){if(!(l instanceof Error)||l instanceof k||!("code"in l))continue;switch(l.code){case"ConnectionClosed":case"ECONNRESET":return"connection_closed";case"ConnectionRefused":case"ECONNREFUSED":return"connection_refused";case"ETIMEDOUT":return"timeout"}}return"transport_unknown"}function Ro(e,l,v){if(!e.state.worker&&!e.connectionDiagnostics)return;if(_r(v))return;let D=v instanceof k&&Number.isInteger(v.status)&&v.status>=100&&v.status<=599?{stage:l,category:"http",httpStatus:v.status}:{stage:l,category:Dm(v)};e.onEvent?.({type:"error",message:"worker_connection_failed",diagnostic:D})}async function Wn(e,l,v){try{return await v()}catch(D){if(!e.signal.aborted)Ro(e,l,D);throw D}}class Eo extends Error{constructor(){super("Reason Device operation completion timed out.")}}async function Ua(e,l,v,D){let M=l.capability==="inference.custom.v1"&&v.status!=="succeeded"?{status:v.status,error_code:v.status==="cancelled"?"operation_cancelled":Hr(v.error_code)?v.error_code:"custom_endpoint_unavailable"}:La(l)&&v.status!=="succeeded"?{status:v.status,error_code:v.status==="cancelled"?"operation_cancelled":v.error_code==="environment_unavailable"?"environment_unavailable":"environment_install_failed"}:v,L=new AbortController,z=D?AbortSignal.any([D,L.signal]):L.signal,re=e.sleep??za,G=e.operationCompletionTimeoutMs??ja,ce=performance.now()+G,we,te,X=new Promise((Re,Ee)=>{let Oe=()=>{let Ce=new Eo;L.abort(Ce),Ee(Ce)},Me=(Ce)=>{clearTimeout(we),we=setTimeout(Oe,Ce)};if(te=()=>Me(Math.max(0,Math.min(ce-performance.now(),_m))),Me(G),e.signal.addEventListener("abort",te,{once:!0}),e.signal.aborted)te()}),he,Se=0;try{while(!0)try{he=await Promise.race([e.client.completeOperation(e.state,l,M,z),X]);break}catch(Re){if(z.aborted||e.signal.aborted||ee(Re)||_r(Re)||!Mm(Re)||performance.now()>=ce)throw Ro(e,"completion",Re),Re;Se+=1;let Ee=Math.min(500*2**Math.min(Se-1,4),Math.max(0,ce-performance.now()));if(Ee<=0)throw Ro(e,"completion",Re),Re;try{await re(Ee,z)}catch{throw Ro(e,"completion",Re),Re}}}finally{clearTimeout(we),e.signal.removeEventListener("abort",te),L.abort()}e.onEvent?.({type:"completed",operationId:l.operation_id,status:he.status})}function Mm(e){if(ee(e))return!1;if(_r(e))return!1;if(e instanceof k)return e.status===408||e.status===429||e.status>=500&&e.status<=504;if(e instanceof Error){if(e.name==="AbortError"||e instanceof Eo)return!1;return!0}return!1}class ki extends Error{constructor(){super("Reason Device operation heartbeat timed out.");this.name="OperationHeartbeatAttemptTimeoutError"}}function _i(e){if(e instanceof ki)return!0;return e instanceof k?or(e.status):sr(e)}function Tm(e,l,v,D){let M=Math.min(v,l*2**Math.min(e-1,10));return e<=1?M:Math.round(M/2+M/2*D())}function bi(e,l){if(!(e instanceof k)||!e.retryAfter)return 0;let v=e.retryAfter.trim(),D=/^\d+(?:\.\d+)?$/.test(v)?Number(v)*1000:Date.parse(v)-l;return Number.isNaN(D)?0:Math.max(0,D)}async function Lm(e,l,v,D,M){let L=new AbortController,z,re=()=>{return},G=new Promise((we,te)=>{let X=()=>{let he=D.reason??new DOMException("Aborted","AbortError");L.abort(he),te(he)};if(re=()=>D.removeEventListener("abort",X),D.aborted)X();else D.addEventListener("abort",X,{once:!0})}),ce=new Promise((we,te)=>{z=setTimeout(()=>{let X=new ki;L.abort(X),te(X)},M)});try{return await Promise.race([e.client.operationHeartbeat(e.state,l,{transientRetryOwner:"caller",...v.controlAckSeq===void 0?{}:{controlAckSeq:v.controlAckSeq},clientRetryCount:v.clientRetryCount,...v.waitMs===void 0?{}:{waitMs:v.waitMs},signal:L.signal}),G,ce])}finally{if(z!==void 0)clearTimeout(z);re()}}async function sl(e,l,v,D,M,L){let z=Am(e.operationHeartbeatMaxAttempts),re=e.operationHeartbeatAttemptTimeoutMs??ja,G=e.operationHeartbeatRetryDelayMs??km,ce=L.remainingMs(),we=Math.min(ce,z*re+G*z*(z-1)/2);for(let te=0;te<z;te+=1)try{D.throwIfAborted(),L.assertCurrent();let X=Math.min(re,L.remainingMs()),he=await Lm(e,l,{...v,waitMs:v.waitMs===void 0?void 0:Math.min(v.waitMs,Math.max(0,Math.floor(X-1000))),clientRetryCount:te},D,X);return D.throwIfAborted(),L.acknowledge(he.lease_until),he}catch(X){if(D.aborted||te+1>=z||_r(X)||ee(X)||!_i(X)){if(!D.aborted)Ro(e,"operation_heartbeat",X);throw X}let he=ce-L.remainingMs(),Se=bi(X,(e.now?.()??new Date).getTime()),Re=Math.max(G*(te+1),we*(te+1)/z-he,Se);await M(Math.min(L.remainingMs(),Re),D),L.assertCurrent()}throw Error("Reason Device operation heartbeat retries were exhausted.")}async function Wm(e,l,v,D,M){let L=fl(l),z=new AbortController,re=new AbortController,G=()=>{z.abort(e.signal.reason),re.abort(e.signal.reason)};if(e.signal.aborted)G();else e.signal.addEventListener("abort",G,{once:!0});let ce=null,we,te,X=-1,he=0,Se=Promise.resolve(),Re=[],Ee=new AbortController,Oe=!1,Me,Ce=null,Te=!1,We,$e,Ue={},Ne=(Ve)=>{Oe=!0,Ee.abort(Ve),z.abort(Ve),re.abort(Ve)},xe=(Ve)=>{if(Me)return Me;let Je=structuredClone(Ve),it=he;return Me=(async()=>{let Ye=new AbortController,Be=Ye.signal;Be.throwIfAborted();let Ke,Fe=()=>{},nt=new Promise((Ze,He)=>{if(Fe=()=>He(Be.reason),Be.addEventListener("abort",Fe,{once:!0}),Ke=setTimeout(()=>Ye.abort(Error("Hands stop receipt delivery timed out.")),4000),Be.aborted)Fe()});try{for(let Ze=0;Ze<3;Ze+=1){Be.throwIfAborted();try{let He=await Promise.race([Wn(e,"event",()=>e.client.operationEvents(e.state,l,{eventSeqStart:it,events:[Je],signal:Be,transientRetryOwner:"caller"})),nt]);if(Be.throwIfAborted(),He.next_event_seq!==it+1)throw Error("Hands stop receipt acknowledgement sequence mismatch.");he=He.next_event_seq;return}catch(He){if(ee(He))M(He);let at=He instanceof k?or(He.status):sr(He);if(Be.aborted||!at||Ze===2)throw He;let lt=Math.max(500*2**Ze,bi(He,(e.now?.()??new Date).getTime()));await Promise.race([v(lt,Be),nt])}}}finally{clearTimeout(Ke),Be.removeEventListener("abort",Fe),Ye.abort()}})(),Me},Le=(Ve,Je,it)=>{let Ye=(Ke)=>Wn(e,"event",()=>e.client.operationEvents(e.state,l,{eventSeqStart:Je,events:Ve,signal:Ke,...it?{transientRetryOwner:"caller"}:{}})).catch((Fe)=>{if(l.capability==="hands.connect"&&_r(Fe))Ne(Fe);if(it&&(ee(Fe)||_r(Fe))){if(ee(Fe))M(Fe);z.abort(Fe),re.abort(Fe),Ee.abort(Fe)}throw Fe});if(!it)return async(Ke)=>{if(l.capability!=="hands.connect"&&l.capability!=="inference.custom.v1"){he=(await Ye(Ke)).next_event_seq;return}Ke.throwIfAborted();let Fe=()=>{},nt=new Promise((Ze,He)=>{Fe=()=>He(Ke.reason),Ke.addEventListener("abort",Fe,{once:!0})});try{let Ze=await Promise.race([Ye(Ke),nt]);Ke.throwIfAborted(),he=Ze.next_event_seq}finally{Ke.removeEventListener("abort",Fe)}};let Be=el({send:Ye,lease:$e,sleep:v,retryAfterMs:(Ke)=>bi(Ke,(e.now?.()??new Date).getTime())});return async(Ke)=>{let Fe=await Be(Ke);if(Fe.next_event_seq!==Je+Ve.length)throw Error("Hands generation receipt acknowledgement sequence mismatch.");he=Fe.next_event_seq}},Ge=async(Ve,Je)=>{let it=Ve??await sl(e,l,{controlAckSeq:X,waitMs:Je},re.signal,v,$e),Ye=null,Be=!1;for(let Ke=0;Ke<10;Ke+=1){let Fe=X+1;for(let nt of it.controls){if(nt.seq!==Fe)throw Error("Reason returned an out-of-order Device operation control.");if(nt.kind==="cancel"||nt.kind==="operation.cancel")Ye??=xm(nt.payload),z.abort(new r(Ye,"Reason closed the Device operation."));if(nt.kind!=="cancel"&&nt.kind!=="operation.cancel"){if(["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(l.capability)){let Ze,He,at=new Promise((lt,kt)=>{Ze=lt,He=kt});at.catch(()=>{}),Ue.current={promise:at,resolve:Ze,reject:He}}try{Be||=!await e.onControl?.(l,nt)}catch(Ze){if(Ze instanceof r)we??=al(Ze);throw Ue.current?.reject(Ze),Ze}}X=nt.seq,Fe+=1}if(it.controls.length===0){if(it.next_control_seq!==X+1)throw Error("Reason returned a Device operation control sequence gap.");return{cancellationReason:Ye,unsupported:Be}}try{it=await sl(e,l,{controlAckSeq:X},re.signal,v,$e),Ue.current?.resolve()}catch(nt){if(Ue.current?.reject(nt),!Ye||_r(nt)||ee(nt))throw nt;return{cancellationReason:Ye,unsupported:Be}}}throw Error("Reason returned too many Device operation control batches.")};try{let Ve;try{if(!L)$e=new wi(l.lease_until,()=>(e.now?.()??new Date).getTime(),(Je)=>{if(!z.signal.aborted)ce=Je;z.abort(Je),re.abort(Je)});Ve=L||l.capability==="hands.connect"||l.capability==="display.stream.v1"||l.capability==="simulator.stream.v1"||Qr.has(l.capability)||l.capability==="pty.start"?{cancellationReason:null,unsupported:!1}:await Ge()}catch(Je){if(!La(l)||_r(Je)||ee(Je))throw Je;await Ua(e,l,{status:e.signal.aborted?"cancelled":"failed"});return}if(Ve.cancellationReason||e.signal.aborted){let Je=Ve.cancellationReason??Ca(e.signal);z.abort(new r(Je,"Reason closed the Device operation.")),te={status:"cancelled",error_code:Je}}else if(Ve.unsupported)z.abort(),te={status:"failed",error_code:"control_unsupported"};else{let Je=L?Promise.resolve():(async()=>{let Ye=e.operationHeartbeatIntervalMs??e.heartbeatIntervalMs??(["hands.connect","browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1","preview.serve.v1"].includes(l.capability)?bm:15000),Be=Math.min(Ye,Math.max(0,(e.operationHeartbeatAttemptTimeoutMs??ja)-1000)),Ke=l.capability==="hands.connect"||l.capability==="pty.start"||l.capability==="display.stream.v1"||l.capability==="simulator.stream.v1"||l.capability==="browser.recording.v1"||l.capability==="browser.pr-proof.v1"||l.capability==="process.run.v1"||l.capability==="process.full.v1"||l.capability==="preview.serve.v1"||l.capability==="inference.custom.v1";while(!re.signal.aborted)try{if(!Ke){if(await v(Ye,re.signal),re.signal.aborted)return}let Fe=await Ge(void 0,Ke?Be:void 0);if(Fe.cancellationReason||Fe.unsupported){if(Fe.unsupported)ce=Error("Reason requested an unsupported Device operation control.");z.abort(Fe.cancellationReason?new r(Fe.cancellationReason,"Reason closed the Device operation."):void 0);return}}catch(Fe){if(ee(Fe))M(Fe);if(_r(Fe))ce=Fe,Ne(Fe);if(!re.signal.aborted)ce=Fe,z.abort();return}})();try{if($e?.assertCurrent(),z.signal.throwIfAborted(),D.authorized=()=>!z.signal.aborted&&(L||($e?.remainingMs()??0)>0),te=await e.onClaim(l,z.signal,async(Ye)=>{if(La(l))return;if(Ye.kind==="permission.denied"){if(!D.authorized())return;let at=Ye.data,lt=(e.now??(()=>new Date))().getTime(),kt=e.statusPath??mr(),jt=(e.loadStatus??rt)(kt),Kt={id:um(),kind:"permission_denied",operation:at?.operation,provenance:at?.provenance,occurredAt:new Date(lt).toISOString(),expiresAt:new Date(lt+600000).toISOString(),sessionId:l.run_id,deviceId:e.state.deviceId,organizationId:e.state.orgId};if(jt&&fr(Kt,lt)){let pr=jt.permissionRecovery;if(!pr||!fr(pr,lt)||pr.sessionId!==Kt.sessionId||pr.operation!==Kt.operation||pr.provenance!==Kt.provenance)(e.saveStatus??Ei)({...jt,permissionRecovery:Kt},kt)}return}let Be=l.capability==="hands.connect"&&Ye.capability==="hands.connect"&&Ye.kind==="hands.stopped",Ke=l.capability==="hands.connect"&&Ye.kind==="hands.reconnected",Fe=Ke||l.capability==="inference.custom.v1"?AbortSignal.any([z.signal,Ee.signal,...Ye.deliverySignal?[Ye.deliverySignal]:[]]):l.capability==="hands.connect"?AbortSignal.any([e.signal,Ee.signal]):e.signal,nt={kind:Ye.kind,payload:{sequence:Ye.sequence,capability:Ye.capability,...Ye.data?{data:Ke?structuredClone(Ye.data):Ye.data}:{}}};if(l.capability==="hands.connect"&&Ye.capability==="hands.connect"&&(Ye.kind==="started"||Ye.kind==="hands.started")||(Qr.has(l.capability)||l.capability==="pty.start")&&Ye.kind==="started")return new Promise((at,lt)=>{Re.push({wireEvent:nt,settle:(kt)=>kt===void 0?at():lt(kt)})});let Ze=Re;Re=[];let He=Se.then(async()=>{if((Oe||e.signal.aborted)&&l.capability==="hands.connect"&&!L){if(Be)await xe(nt);return}if(Ce!==null){if(Ye.kind!=="hands.stopped"||!Te||!We)throw Ce;let lt=new AbortController,kt=AbortSignal.any([e.signal,Ee.signal,lt.signal]),jt=setTimeout(()=>lt.abort(Error("Hands stop receipt reconciliation timed out.")),4000);Te=!1;try{await We(kt),We=void 0,await Le([nt],he,!0)(kt),Ce=null}catch(Kt){throw Ce=Kt??Error("Hands stop receipt could not be confirmed."),Kt}finally{clearTimeout(jt),lt.abort()}return}if(Ke&&!$e){let lt=Math.min(Date.parse(l.lease_until),Date.parse(String(l.payload.expires_at)));$e=new wi(new Date(lt).toISOString(),()=>(e.now?.()??new Date).getTime(),(kt)=>{z.abort(kt),re.abort(kt)})}let at=he;if(Ke)We=Le([...Ze.map((lt)=>lt.wireEvent),nt],at,!0),await We(Fe),We=void 0;else await Le([...Ze.map((lt)=>lt.wireEvent),nt],at,!1)(Fe)});He.then(()=>{for(let at of Ze)at.settle()},(at)=>{for(let lt of Ze)lt.settle(at??Error("Hands event delivery failed."))}),Se=He.catch((at)=>{if(ee(at))M(at);if(Ke){if(Ce===null)Te=Fe.aborted&&!Ee.signal.aborted,Ce=at??Error("Hands generation receipt delivery failed.");if(!Fe.aborted)z.abort(at),re.abort(at)}}),await He}),["browser.recording.v1","browser.pr-proof.v1","process.run.v1","process.full.v1"].includes(l.capability))await Ue.current?.promise}catch(Ye){te=z.signal.aborted?{status:"cancelled",error_code:Ca(z.signal)}:{status:"failed",error_code:al(Ye)}}finally{D.authorized=()=>!1,Ee.abort();for(let Ye of Re.splice(0))Ye.settle();re.abort(),await Je}let it=Qn(l.capability)?Ba(te.result,l.operation_id):null;if(ce){if(ee(ce))throw ce;te={status:"failed",error_code:we??"control_or_heartbeat_failed",...it?{result:it}:{}}}else if(z.signal.aborted&&te.status==="succeeded")te={status:"cancelled",error_code:Ca(z.signal),...it?{result:it}:{}}}if($e?.close(),ee(e.signal.reason))throw e.signal.reason;await Ua(e,l,te)}finally{$e?.close(),Ee.abort(),re.abort(),e.signal.removeEventListener("abort",G)}}async function Ka(e){let l=e.now??(()=>new Date),v=e.sleep??za,D=e.saveStatus??Ei,M=e.loadStatus??rt,L=e.statusPath??mr(),z=l().toISOString(),re=M(L)?.lastUsedAt,G=!1,ce=()=>({version:1,pid:process.pid,startedAt:z,...ll(l),...cl(M(L),e.state,l().getTime()),deviceId:e.state.deviceId,...e.idleSleepPolicy||e.readIdleSleepPolicy?{idleSleepHold:G}:{},...re?{lastUsedAt:re}:{}}),we=0,te,X=!1,he,Se,Re,Ee=Promise.resolve();D({...ce(),state:"starting"},L),e.onEvent?.({type:"started",deviceId:e.state.deviceId}),$a();try{let Oe=async()=>{let Me=e.readIdleSleepPolicy?e.readIdleSleepPolicy():e.idleSleepPolicy;if(e.signal.aborted||Me===Se)return;if(he&&Se){let We=await he.release();if(e.onEvent?.({type:"idle_sleep",status:We,policy:Se}),We==="failed")return;he=void 0,Se=void 0,G=!1;let $e=M(L);if($e)D({...$e,idleSleepHold:G},L)}if(!Me)return;Se=Me;let Ce=!0;he=await(e.acquireAwakeHold??Zc)(Me,{onStatusChange:(We)=>{if(Ce)return;G=We==="held";let $e=M(L);if($e)D({...$e,idleSleepHold:G},L);e.onEvent?.({type:"idle_sleep",status:We,policy:Me})}}),Ce=!1,G=he.status==="held";let Te=M(L);if(Te)D({...Te,idleSleepHold:G},L);e.onEvent?.({type:"idle_sleep",status:he.status,policy:Me})};if(await Oe(),e.readIdleSleepPolicy)Re=setInterval(()=>{Ee=Ee.then(Oe).catch(()=>{e.onEvent?.({type:"idle_sleep",status:"failed",policy:Se??"battery_and_ac"})})},e.idleSleepPollMs??1000),Re.unref();while(!e.signal.aborted){let Me=!1;try{await Nm({...e,saveStatus:(Ce,Te)=>{if(Ce.state==="starting"||Ce.state==="error"||Ce.state==="stopped")return;re=Ce.lastUsedAt??re,D({...Ce,startedAt:z,...e.idleSleepPolicy||e.readIdleSleepPolicy?{idleSleepHold:G}:{}},Te)},onEvent:(Ce)=>{if(Ce.type==="error"&&Ce.diagnostic){e.onEvent?.(Ce);return}if(Ce.type==="started"||Ce.type==="error"||Ce.type==="stopped")return;if(Ce.type==="heartbeat"&&we>0&&!Me){Me=!0;let Te=we;we=0,te=void 0,e.onEvent?.({type:"reconnected",attempts:Te})}e.onEvent?.(Ce)}});return}catch(Ce){if(Ta(Ce,e.signal))return;if(ee(Ce)){X=!0;let We=e.state.worker?"worker_connection_failed":Ma(Ce);throw D({...ce(),state:"error",error:We},L),e.onEvent?.({type:"error",message:We}),Ce}we+=1;let Te=Im(we,e.reconnectRandom);te??=l().toISOString(),D({...ce(),state:"starting",reconnectingSince:te},L),e.onEvent?.({type:"reconnecting",message:e.state.worker?"worker_connection_failed":Ma(Ce),attempt:we,retryInMs:Te}),await v(Te,e.signal)}}}catch(Oe){if(!Ta(Oe,e.signal))throw Oe}finally{if(e.client.close?.(),clearInterval(Re),await Ee,he&&Se){let Oe=await he.release();G=Oe==="failed"&&he.status==="held",e.onEvent?.({type:"idle_sleep",status:Oe,policy:Se})}if(!X)D({...ce(),state:"stopped"},L);else{let Oe=M(L);if(Oe)D({...Oe,idleSleepHold:G},L)}e.onEvent?.({type:"stopped"})}}async function Nm(e){let l=e.now??(()=>new Date),v=e.sleep??za,D=e.statusPath??mr(),M=e.saveStatus??Ei,L=e.loadStatus??rt,z=l().toISOString(),re=L(D)?.lastUsedAt,G=e.runtimeUpdate,ce=new AbortController,we=()=>ce.abort(e.signal.reason);if(e.signal.aborted)we();else e.signal.addEventListener("abort",we,{once:!0});let te=G?.random??Math.random,X=e.maxConcurrentClaims,he=typeof X==="number"&&Number.isSafeInteger(X)&&X>0?Math.min(ym,X):wm,Se=0,Re=!1,Ee=null,Oe=(tt)=>{Ee??=tt,ce.abort(tt)},Me=new Map,Ce=()=>{let tt=new Set,yt=0;for(let{claim:Wr}of Me.values()){let Xe=Wr.capability==="hands.connect"?Wr.payload[pe]:void 0;if(typeof Xe==="string"){if(tt.has(Xe))continue;tt.add(Xe)}yt+=1}return yt},Te=null,We=()=>[...Me.values()].some((tt)=>tt.authorized()),$e=()=>[...Me.values()].every((tt)=>tt.claim.capability==="preview.serve.v1"),Ue=G?new Date(z).getTime()+xa(G.initialDelayMs??Sm,te):Number.POSITIVE_INFINITY,Ne=null,xe=!1,Le=e.firstHeartbeat,Ge=Le?.account_root_metadata_supported===!0,Ve=Le?.workspace_root_metadata_supported===!0,Je=Le?.account_root_path_supported===!0,it=Le?.home_contained_roots_supported===!0,Ye=Le?.root_paths_supported===!0,Be=Le?.startup_supported===!0,Ke=Le!==void 0,Fe=Le?{challenge:Le.challenge,expires_at:Le.expires_at}:void 0,nt,Ze=!e.startup,He=()=>({version:1,pid:process.pid,startedAt:z,...ll(l),...cl(L(D),e.state,l().getTime()),...re?{lastUsedAt:re}:{},deviceId:e.state.deviceId,...Ne?{organizationId:Ne.organization_id,organizationName:Ne.organization_name,organizationSlug:Ne.organization_slug}:{}}),at=()=>{let tt=(e.advertised??e.claimable)?.()!==!1;if(!Ze)nt??=e.startup?.();return{...e.deviceMetadata?.device_model!=null?{device_model:e.deviceMetadata.device_model}:{},...e.deviceMetadata?.device_chip!=null?{device_chip:e.deviceMetadata.device_chip}:{},...e.deviceMetadata?.device_location!=null?{device_location:e.deviceMetadata.device_location}:{},reason_runtime_version:e.runtimeVersion,bridge_version:e.bridgeVersion,protocol_version:e.protocolVersion,execution_eligible:tt,...Be&&!Ze&&nt?{startup:nt}:{},capabilities:tt?Da(e.capabilities,{accountRootMetadataSupported:Ge,workspaceRootMetadataSupported:Ve,accountRootPathSupported:Je,homeContainedRootsSupported:it,rootPathsSupported:Ye}):{supported_operations:[]}}},lt=()=>{if(xe||!e.client.identity)return;xe=!0,e.client.identity(e.state,e.signal).then((tt)=>{if(tt.organization_id!==e.state.orgId)return;Ne=tt;let yt=L(D);if(!yt)return;M({...yt,organizationId:tt.organization_id,organizationName:tt.organization_name,organizationSlug:tt.organization_slug},D)}).catch(()=>{return})},kt=(tt)=>{Ge=tt.account_root_metadata_supported===!0,Ve=tt.workspace_root_metadata_supported===!0,Je=tt.account_root_path_supported===!0,it=tt.home_contained_roots_supported===!0,Ye=tt.root_paths_supported===!0,Be=tt.startup_supported===!0,Ke=!1},jt=(tt)=>{if(tt.startup)Ze=!0},Kt=(tt,yt)=>{if(!(yt instanceof k&&yt.status===400&&yt.code==="invalid_heartbeat")||!tt.startup&&!Ke)throw yt;if(Ze=!0,Ke)Ge=Ve=Je=!1,it=Ye=Be=Ke=!1;return null},pr=(tt)=>{kt(tt),M({...He(),state:"connected",lastHeartbeatAt:l().toISOString()},D),lt(),e.onEvent?.({type:"heartbeat",serverTime:tt.server_time,drain:tt.drain,...tt.latest_cli_versions?{latestCliVersions:tt.latest_cli_versions}:{},...tt.hands_prespawn?{handsPrespawn:!0}:{}})},Xr=!1,In=!1;e.registerHeartbeatNow?.(()=>{if(e.signal.aborted)return;if(Xr)In=!0;let tt=at();Wn(e,"heartbeat",()=>e.client.heartbeat(e.state,tt,ce.signal).catch((yt)=>Kt(tt,yt))).then((yt)=>{if(!yt)return;jt(tt),kt(yt),pr(yt)},()=>{return})});let Lr=(tt)=>v(tt,e.signal);M({...He(),state:"starting"},D),e.onEvent?.({type:"started",deviceId:e.state.deviceId});let xr=!1,sn=e.maxConsecutiveHeartbeatFailures??3,Ir=0,er=0,On=0,zo=0,cn=null;try{while(!e.signal.aborted){if(Ee)throw Ee;if(Re&&$e())break;let tt,yt=er>0&&er<pm&&performance.now()-zo<hm&&cn!==null;if(!yt)er=0;e:{if(yt&&cn){tt=cn;break e}let vt=at(),rr=Fe;Fe=void 0,Xr=!0,In=!1;try{let At=await Wn(e,"heartbeat",()=>e.client.heartbeat(e.state,vt,ce.signal,...rr?[rr]:[]).catch((Sr)=>Kt(vt,Sr)));if(Xr=!1,!At)continue;tt=At,jt(vt),zo=performance.now(),Ir=0}catch(At){if(Xr=!1,e.signal.aborted)break;if(!_i(At))throw At;if(Ir+=1,Ir>=sn&&!We())throw At;await v(Math.min(e.heartbeatRetryDelayMs??2000,e.heartbeatIntervalMs??15000),e.signal);continue}if(kt(tt),Object.keys(at().capabilities).length>Object.keys(vt.capabilities).length)continue;if(In)continue;if(pr(tt),Ee)throw Ee;if(e.signal.aborted)break;if(G&&["available","required"].includes(tt.update_policy??""))Ue=Math.min(Ue,l().getTime());if(G&&l().getTime()>=Ue)try{let At=new AbortController,Sr=()=>At.abort(e.signal.reason);if(e.signal.aborted)Sr();else e.signal.addEventListener("abort",Sr,{once:!0});let $r;try{$r=G.check(At.signal)}catch(Ft){$r=Promise.reject(Ft)}let ln=$r.then((Ft)=>({kind:"completed",result:Ft}),(Ft)=>({kind:"failed",error:Ft})),Br;try{while(!0){let Ft=await Om(ln,e.heartbeatIntervalMs??15000,e.signal,v);if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");if(Ft.kind==="failed")throw new Ia(Ft.error);if(Ft.kind==="completed"){Br=Ft.result;break}try{let Gt=at(),oo=await Wn(e,"heartbeat",()=>e.client.heartbeat(e.state,Gt,ce.signal).catch((Ko)=>Kt(Gt,Ko)));if(!oo)continue;tt=oo,jt(Gt),pr(tt),Ir=0}catch(Gt){if(e.signal.aborted)throw Gt;if(!_i(Gt))throw Gt;if(Ir+=1,Ir>=sn&&!We())throw Gt}}}catch(Ft){At.abort(Ft);let Gt=await ln;if(Gt.kind==="completed"&&Gt.result==="activated")Br="activated";else throw Ft}finally{e.signal.removeEventListener("abort",Sr)}if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");if(Se=0,Br==="activated"){if(e.signal.aborted)throw e.signal.reason??new DOMException("Aborted","AbortError");e.onEvent?.({type:"runtime_updated"}),Re=!0}Ue=l().getTime()+xa(G.intervalMs??Rm,te)}catch(At){if(!(At instanceof Ia))throw At;Se+=1;let Sr=G.retryBaseMs??Em,$r=G.retryMaxMs??Pm,ln=Math.min($r,Sr*2**Math.min(Se-1,8));Ue=l().getTime()+xa(ln,te)}}if(cn=tt,e.signal.aborted)break;if(Re&&$e())break;if(Re){await Lr(e.heartbeatIntervalMs??15000);continue}let Wr=e.client.sessionCadence?.(e.state)??null,Xe=Wr?.presenceIntervalMs??e.heartbeatIntervalMs??15000;if(tt.drain||e.claimable?.()===!1){er=0,await Lr(Xe);continue}if(Ce()>=he){er=0;let vt=new AbortController;Te=vt;try{await v(Xe,AbortSignal.any([e.signal,vt.signal]))}catch(rr){if(!vt.signal.aborted)throw rr}finally{if(Te===vt)Te=null}continue}let st,Ct=yt?0:Wr?.claimWaitMs??Math.min(e.heartbeatIntervalMs??15000,30000),Vt=performance.now();try{st=await Wn(e,"claim",()=>e.client.claimOperation(e.state,{waitMs:Ct,signal:ce.signal}))}catch(vt){if(er=0,e.signal.aborted||!_i(vt)||!We())throw vt;On+=1;let rr=Math.min(e.heartbeatRetryDelayMs??2000,e.heartbeatIntervalMs??15000);await Lr(Math.max(Tm(On,rr,Math.max(rr,Ct),te),bi(vt,(e.now?.()??new Date).getTime())));continue}if(On=0,Ee)throw Ee;if(!st){if(yt){er=0;continue}if(performance.now()-Vt<Ct-mm)await Lr(fm);continue}if(e.claimable?.()===!1){er=0,await Ua(e,st,{status:"cancelled",error_code:"execution_authority_withdrawn"},e.signal);continue}re=l().toISOString(),M({...He(),state:"connected",lastHeartbeatAt:l().toISOString()},D),e.onEvent?.({type:"claim",operationId:st.operation_id,runId:st.run_id,attemptId:st.attempt_id,capability:st.capability});let Tt,gr={authorized:()=>!1,claim:st};if(Tt=Wm({...e,signal:ce.signal},st,v,gr,Oe).catch((vt)=>{if(ee(vt))Oe(vt);else if(!_r(vt)&&[...Me].some(([rr,At])=>rr!==Tt&&At.authorized())){if(vt instanceof Eo)e.onEvent?.({type:"error",message:"operation_completion_timeout",diagnostic:{stage:"completion",category:"timeout"}});return}if(!_r(vt)&&Ee===null)Ee=vt}).finally(()=>{Me.delete(Tt),Te?.abort(),e.onEvent?.({type:"claims_changed",activeClaims:Me.size})}),Me.set(Tt,gr),e.onEvent?.({type:"claims_changed",activeClaims:Me.size}),er+=1,fl(st)){if(er=0,await Tt,Ee)throw Ee}}}catch(tt){if(!Ta(tt,e.signal)){ce.abort(tt),xr=!0;let yt=e.state.worker?"worker_connection_failed":Ma(tt);throw M({...He(),state:"error",error:yt},D),e.onEvent?.({type:"error",message:yt}),tt}}finally{if(ce.abort(),await Promise.allSettled(Me.keys()),e.signal.removeEventListener("abort",we),!xr)M({...He(),state:"stopped"},D);e.onEvent?.({type:"stopped"})}}import{execFile as dp}from"child_process";import{constants as Al,existsSync as up,mkdtempSync as Ya,rmSync as Dl}from"fs";import{access as xl,open as fp,readFile as Il,readlink as mp,readdir as Ol,unlink as pp,rmdir as hp}from"fs/promises";import{tmpdir as gp}from"os";import{basename as Xa,join as Pi}from"path";import{randomUUID as hn}from"crypto";import{chmodSync as Hm,closeSync as $m,fsyncSync as Bm,openSync as Um,readFileSync as Fm,rmdirSync as ml,unlinkSync as pl,writeFileSync as jm}from"fs";import{createConnection as qm,createServer as zm}from"net";import{dirname as Km,join as Vm}from"path";var Jm=5000;async function hl(e,l,v){if(v.aborted)return!1;let D={generation:1,fenceId:hn()},M={runId:hn(),deviceId:hn(),rootId:hn(),apiOrigin:e.apiOrigin,binding:{kind:"workspace_source",target_revision:1,root_grant_revision:1},expiresAtMs:Date.now()+30000,identity:()=>D},L=ai(l,M),z={version:1,snapshot_id:hn(),revision:1,run_id:M.runId,device_id:M.deviceId,root_id:M.rootId,binding:{...M.binding,target_generation:D.generation,target_fence_id:D.fenceId},expires_at:new Date(M.expiresAtMs).toISOString(),variables:{WORKER_PROBE:"synthetic-readiness"},git:null};try{return L.install(z).installed&&L.current().snapshot_id===z.snapshot_id&&!v.aborted}catch{return!1}finally{try{pl(L.path)}catch{}}}async function bl(e,l,v=$t){if(l.aborted)return!1;let D,M,L=new Set,z=hn(),re=zm((X)=>{L.add(X),X.once("close",()=>L.delete(X)),X.on("error",()=>X.destroy()),X.end(z)});re.maxConnections=1;let G,ce,we=new Promise((X)=>{ce=()=>X(!1)}),te=setTimeout(ce,Jm);l.addEventListener("abort",ce,{once:!0});try{D=v({runtimeDirectory:p(e),root:e.workspaceRoot,runId:`readiness-${hn()}`}),M=Vm(D.journalDirectory,"readiness.json");let X=Um(M,"wx",384);try{jm(X,z),Bm(X)}finally{$m(X)}if(Fm(M,"utf8")!==z||l.aborted)return!1;let he=new Promise((Se)=>{re.once("error",()=>Se(!1)),re.listen(D.socketPath,()=>{try{if(process.platform!=="win32")Hm(D.socketPath,384)}catch{Se(!1);return}G=qm(D.socketPath);let Re="";G.setEncoding("utf8"),G.once("error",()=>Se(!1)),G.on("data",(Ee)=>{if(Re+=Ee,Re.length>z.length)G?.destroy(),Se(!1)}),G.once("end",()=>Se(Re===z)),G.once("close",()=>Se(!1))})});return await Promise.race([he,we])&&!l.aborted}catch{return!1}finally{clearTimeout(te),l.removeEventListener("abort",ce),G?.destroy();for(let X of L)X.destroy();if(await new Promise((X)=>re.close(()=>X())),D?.disposeSocket(),M)try{pl(M)}catch{}if(D){try{ml(D.journalDirectory)}catch{}try{ml(Km(D.journalDirectory))}catch{}}}}import{execFileSync as vi}from"child_process";import{randomUUID as dr}from"crypto";import{chmodSync as kl,chownSync as El,closeSync as Va,constants as Mr,existsSync as Gm,fstatSync as Pl,mkdirSync as vl,mkdtempSync as Ym,openSync as Ja,readFileSync as Xm,readSync as Zm,realpathSync as Qm,rmdirSync as ep,rmSync as tp}from"fs";import{join as wn}from"path";import{fileURLToPath as rp}from"url";var Sl=1e4,np=!1;function Ri(){if(process.platform!=="linux")return!1;return np||=["/usr/bin/tmux","/usr/local/bin/tmux","/bin/tmux"].some((e)=>{try{let l=vi(e,["-V"],{encoding:"utf8",timeout:2000,env:{PATH:"/usr/bin:/bin"},stdio:["ignore","pipe","ignore"]}),v=/^tmux (?:next-)?([0-9]+)\.([0-9]+)/.exec(l);return v!==null&&Number(v[1])*100+Number(v[2])>=302}catch{return!1}})}var op=Buffer.from([0,255,3,4]);function Rl(e){return`printf "%s\\n" ${e==="foreground"?"$$":"$!"} > ${e}.pid.tmp; /bin/mv ${e}.pid.tmp ${e}.pid`}function ip(e,l,v){if(!Number.isSafeInteger(l)||l<2||!Number.isSafeInteger(v)||v<2||e.length>4096||!e.startsWith(`${l} (`))return!1;let D=e.lastIndexOf(") ");if(D<0)return!1;let M=e.slice(D+2).trim().split(/\s+/);return M.length>=20&&/^[A-Za-z]$/.test(M[0])&&/^\d+$/.test(M[1])&&M[2]===String(l)&&M[3]===String(v)&&/^[1-9][0-9]*$/.test(M[19])}async function Po(e,l={}){if(process.platform==="win32")return!e.aborted&&yi();if(e.aborted||!["darwin","linux"].includes(process.platform)||typeof Bun>"u")return!1;let v=J(),{directory:D,root:M,runtimeDirectory:L}=cp(v),z=new AbortController,re=()=>z.abort();e.addEventListener("abort",re,{once:!0});let G;z.signal.addEventListener("abort",()=>G?.close(),{once:!0});let ce=setTimeout(re,Sl),we={organization_id:dr(),user_id:dr(),device_id:dr()},te=dr(),X=dr(),he=dr(),Se=dr(),Re=Date.now()+Sl,Ee={kind:"workspace_source",target_revision:0,root_grant_revision:1},Oe=dr().replaceAll("-",""),Me,Ce=Buffer.alloc(0),Te,We=!1,$e=!1,Ue=!1,Ne=!1,xe,Le,Ge,Ve=async(it)=>{while(!it()){if(z.signal.aborted)throw Error("pty_probe_cancelled");await new Promise((Ye)=>setTimeout(Ye,20))}if(z.signal.aborted)throw Error("pty_probe_cancelled")},Je=!1;try{G=ap(D,v),xe=Bun.serve({hostname:"127.0.0.1",port:0,fetch(Be,Ke){let Fe=new URL(Be.url).pathname,nt=Fe===`/device/hands/${Oe}`?"hands":Fe===`/device/pty/${Oe}`?"pty":null;if(nt&&Ke.upgrade(Be,{data:{lane:nt}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,open(Be){if(Be.data.lane==="pty")Me=Be},message(Be,Ke){if(Be.data.lane!=="pty")return;if(typeof Ke==="string"){try{if(JSON.parse(Ke).t==="open")We=!0}catch{re()}return}if(Ce.length+Ke.length>8192){re();return}Ce=Buffer.concat([Ce,Ke])}}});let it=`ws://127.0.0.1:${xe.port}`;if(Le=et({headless:!0,managedPty:{version:1},root:M,runtimeDirectory:L,runId:te,operationId:dr(),attemptId:dr(),claimOwner:we,deviceIdentity:{deviceId:we.device_id,rootId:X,apiOrigin:"https://worker-probe.invalid"},signal:z.signal,payload:{relay_url:`${it}/device/hands/${Oe}`,session_id:"pty-readiness",environment_id:"pty-readiness",expires_at:new Date(Re).toISOString(),policy_mode:"full_access",policy_version:1,hands_protocol_version:F,hands_worker_version:U,hands_worker_artifact_sha256:T,hands_worker_entrypoint:H,target_generation:1,target_fence_id:he,environment_binding:Ee,[E]:_e},emitEvent:async(Be)=>{if(Be==="hands.started")Ne=!0;if(Be==="hands.ready")$e=!0;if(Be==="hands.stopped")Ue=!0}},{browserExecutablePath:null,slot:Ao(),readyTimeoutMs:3000,logDiagnostic:()=>{return},resolvePathEnvironment:async()=>({path:"/usr/bin:/bin:/usr/sbin:/sbin",source:"fallback"}),sourceEntrypoint:rp(new URL("./worker-candidate-entry.ts",import.meta.url)),...l}).catch(()=>{if(!$e)re()}),await Ve(()=>$e),Qe({root:M,runId:te,payload:{version:1,snapshot_id:Se,revision:1,run_id:te,root_id:X,device_id:we.device_id,binding:{...Ee,target_generation:1,target_fence_id:he},expires_at:new Date(Re).toISOString(),variables:{PTY_PROBE_VALUE:Oe},git:null}}),Ge=rn({root:M,runId:te,rootId:X,deviceId:we.device_id,owner:we,workspace:{kind:"root"},authority:{device_id:we.device_id,binding:Ee.kind,target_revision:0,root_grant_revision:1,target_generation:1,target_fence_id:he},signal:z.signal,session:{jobId:`pty-${dr()}`,sessionId:"pty-readiness",operationId:dr(),cols:80,rows:24,leaseExpiresAtMs:Re,relayUrl:`${it}/device/pty/${Oe}`},emit:async(Be,Ke)=>{if(Be==="pty.ready")Te=Ke}}).catch(()=>{re()}),await Ve(()=>Boolean(Te&&Me&&We)),Me.send(JSON.stringify({t:"resize",cols:100,rows:30})),Me.send(Buffer.from(`stty -echo; test "$PTY_PROBE_VALUE" = '${Oe}' || exit 19; stty size; printf '\\000\\377\\003\\004'; (trap '' TERM HUP; ${G.wait("background")}) & ${Rl("background")}; /bin/bash --noprofile --norc -c 'trap "" TERM HUP; ${Rl("foreground")}; ${G.wait("foreground")}'
+`)),await Ve(()=>Gm(wn(M,"foreground.pid"))&&Ce.includes(op)),!Ce.includes("30 100")||Te.job.environmentSnapshotId!==Se||Te.job.environmentRevision!==1)return!1;let Ye=["background.pid","foreground.pid"].map((Be)=>sp(wn(M,Be)));if(new Set(Ye).size!==2||Ye.some((Be)=>!Number.isSafeInteger(Be)||Be<2||Be===Te.job.process.pid))return!1;if(process.platform==="linux"){if(!Ye.every((Be)=>ip(Xm(`/proc/${Be}/stat`,"utf8"),Be,Te.job.process.pid)))return!1}else{let Ke=vi("/bin/ps",["-o","pid=,pgid=","-p",Ye.join(",")],{env:{PATH:"/usr/bin:/bin"},encoding:"utf8",timeout:1000,maxBuffer:1024}).trim().split(`
+`).map((Fe)=>Fe.trim().split(/\s+/).map(Number));if(Ke.length!==2||new Set(Ke.map(([Fe])=>Fe)).size!==2||Ke.some((Fe)=>Fe.length!==2||!Ye.includes(Fe[0])||Fe[0]!==Fe[1]))return!1}if(Me.send(JSON.stringify({t:"close"})),await Ge,z.signal.aborted)return!1;for(let Be of[Te.job.process.pid,...Ye])try{return process.kill(Be,0),!1}catch(Ke){if(!(Ke instanceof Error&&("code"in Ke)&&Ke.code==="ESRCH"))return!1}Je=!0}catch{Je=!1}finally{if(clearTimeout(ce),e.removeEventListener("abort",re),re(),G?.close(),await Ge,await Le,await xe?.stop(!0),!Ne||Ue)lp({directory:D,root:M},v)}return Je&&Ue&&!e.aborted}function ap(e,l){let v={foreground:wn(e,"foreground.lifeline"),background:wn(e,"background.lifeline")};if(!Object.values(v).every((L)=>/^\/[A-Za-z0-9/._-]+$/.test(L)))throw Error("pty_probe_path");vi("/usr/bin/mkfifo",["-m","0600",...Object.values(v)],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:1000});let D=[],M=()=>{for(let L of D.splice(0))Va(L)};try{for(let L of Object.values(v)){let z=Ja(L,Mr.O_RDONLY|Mr.O_NONBLOCK|Mr.O_NOFOLLOW);try{if(D.push(Ja(L,Mr.O_WRONLY|Mr.O_NONBLOCK|Mr.O_NOFOLLOW)),!Pl(D.at(-1)).isFIFO())throw Error("pty_probe_lifeline")}finally{Va(z)}if(l)El(L,l.uid,l.gid)}}catch(L){throw M(),L}return{wait:(L)=>`exec 3<>${v[L]} <${v[L]} 3>&-; exec /bin/cat`,close:M}}function Cl(e=(l)=>Po(l)){let l=new AbortController,v=JSON.stringify(J()),D=(async()=>{try{return await e(l.signal)===!0&&!l.signal.aborted}catch{return!1}})();return{result:D,matches:(M)=>M.executionMode==="host"&&JSON.stringify(J())===v,stop:async(M=1500)=>{l.abort();let L;await Promise.race([D,new Promise((z)=>{L=setTimeout(z,M)})]),clearTimeout(L)}}}function sp(e){let l;try{l=Ja(e,Mr.O_RDONLY|Mr.O_NOFOLLOW|Mr.O_NONBLOCK)}catch{return Number.NaN}try{let v=Pl(l);if(!v.isFile()||v.size>32)return Number.NaN;let D=Buffer.alloc(32),M=Zm(l,D,0,D.length,0),L=D.subarray(0,M).toString("utf8").trim();return/^[0-9]{1,10}$/.test(L)?Number(L):Number.NaN}catch{return Number.NaN}finally{Va(l)}}function cp(e,l=Qm("/tmp")){let v=Ym(wn(l,"reason-pty-probe-")),D=wn(v,"workspace"),M=wn(v,"private");if(vl(D,{mode:448}),vl(M,{mode:448}),e)kl(v,493),kl(D,493),El(D,e.uid,e.gid);return{directory:v,root:D,runtimeDirectory:M}}function lp(e,l){if(l)try{vi("/usr/bin/setpriv",[`--reuid=${l.uid}`,`--regid=${l.gid}`,"--clear-groups","--no-new-privs","--","/usr/bin/find",e.root,"-mindepth","1","-delete"],{env:{PATH:"/usr/bin:/bin"},stdio:"ignore",timeout:2000}),ep(e.root)}catch{return}tp(e.directory,{recursive:!0,force:!0})}var Ml=5000,yn="ARA_WORKER_PROBE_READY";function wp(e,l,v,D,M){if(M.aborted)return Promise.resolve(!1);return new Promise((L)=>{dp(e,l,{cwd:v,env:D,signal:M,timeout:Ml,killSignal:"SIGKILL",maxBuffer:4096,encoding:"utf8",windowsHide:!0},(z,re)=>L(!z&&!M.aborted&&re===yn))})}function yp(e,l){let v=Xa(e).replace(/\.exe$/i,"");if(v==="bash")return["--noprofile","--norc","-c",l];if(v==="zsh"||v==="sh")return["-f","-c",l];return null}function _p(e,l){let v=je({home:l,temporaryDirectory:l}),D=(L,z,re)=>wp(L,z,e.workspaceRoot,v,re),M=async(L,z,re,G=(we)=>we===yn,ce=!1)=>{let we=process.platform==="win32"?Ya(Pi(gp(),"reason-device-probe-")):e.workspaceRoot;try{let te=await Kn(L,z,{cwd:we,root:we,allowWrite:!1,allowProcessInspection:ce,timeoutMs:Ml,signal:re,workerProbe:!0}),X=!re.aborted&&!te.timedOut&&!te.truncated&&te.exitCode===0&&G(te.stdout);if(!X&&process.platform==="win32")process.stderr.write(`Reason worker: confined ${Xa(L)} probe failed (exit ${te.exitCode}${te.timedOut?", timed out":""}): ${te.stderr.slice(-300).trim()}
+`);return X}catch(te){if(process.platform==="win32")process.stderr.write(`Reason worker: confined ${Xa(L)} probe failed: ${String(te)}
+`);throw te}finally{if(we!==e.workspaceRoot)Dl(we,{recursive:!0,force:!0})}};return{workspaceRead:async(L)=>(await xl(e.workspaceRoot,Al.R_OK),await Ol(e.workspaceRoot),!L.aborted),workspaceWrite:async(L)=>{if(await xl(e.workspaceRoot,Al.W_OK),L.aborted)return!1;let z=Ya(Pi(e.workspaceRoot,".ara-worker-probe-")),re=Pi(z,"receipt");try{let G=await fp(re,"wx",384);try{await G.writeFile(yn),await G.sync()}finally{await G.close()}return await Il(re,"utf8")===yn&&!L.aborted}finally{await pp(re).catch(()=>{}),await hp(z).catch(()=>{})}},confinedShell:(L)=>{if(process.platform==="win32"&&!tn())return process.stderr.write(`Reason worker: ${Oa}
+`),Promise.resolve(!1);return M(en(),["-c",`printf ${yn}`],L)},confinedGit:(L)=>M("git",["--version"],L,(z)=>/^git version \S+/.test(z)),processInspection:async(L)=>{if(process.platform==="darwin")return M("/usr/sbin/lsof",["-a","-p",String(process.pid),"-d","cwd","-Fn"],L,(ce)=>ce.includes(`p${process.pid}
+`)&&/^n\//m.test(ce),!0);if(process.platform==="win32")return cc(L);if(process.platform!=="linux")return!1;let[z,re,G]=await Promise.all([mp("/proc/self/cwd"),Ol("/proc/self/fd"),Il("/proc/net/tcp","utf8")]);return!L.aborted&&z.length>0&&re.length>0&&G.includes("local_address")},bash:async(L)=>{let z=process.platform==="win32"?Y():"/bin/bash";if(!z)return process.stderr.write(`Reason worker: ${process.platform==="win32"?Sa:"bash is unavailable"}
+`),!1;return D(z,["--noprofile","--norc","-c",`printf ${yn}`],L)},jobs:(L)=>bl(e,L),environment:(L)=>hl(e,l,L),preview:(L)=>ro(l,L),boundPty:(L)=>Po(L),desktopDisplay:()=>Bo(),desktopAutomation:async()=>{let L=Za();if(L)process.stderr.write(`Reason worker: computer and browser use need setup (${L})
+`);return hr()},desktopBrowser:async()=>A()?.features.browser===!0,fullControlShell:(L)=>{let z=dt(),re=yp(z,`printf ${yn}`);return re?D(z,re,L):Promise.resolve(!1)}}}function Za(){return process.platform==="darwin"&&A()?.features.computer===!0?Ln():null}var es=["pty.start","tunnel.open","tunnel.close","preview.serve.v1","display.stream.v1","automation.call.v1","browser.pr-proof.v1"];async function bp(e,l,v=new AbortController().signal,D={read:!0,write:!1},M=Co()){return xo(e,l,v,D,M).final}function xo(e,l,v=new AbortController().signal,D={read:!0,write:!1},M=Co(),L,z){let re,G;try{if(Or(e),ne(),!l)b(p(e),!0),re=Ya(Pi(p(e),"probe-")),l=_p(e,re);G=l}catch(Me){let Ce=Promise.reject(Me);return Ce.catch(()=>{}),{initial:Ce,final:Ce,pty:Ce}}let ce=async(Me,Ce)=>{if(v.aborted||!Ce&&!G[Me])return!1;let Te,We=new Promise(($e)=>{Te=()=>$e(!1)});v.addEventListener("abort",Te,{once:!0});try{return await Promise.race([Ce??G[Me](v),We])===!0&&!v.aborted}catch{return!1}finally{v.removeEventListener("abort",Te)}},we=e.executionMode==="host",te=we?ce("boundPty",L):Promise.resolve(!1),X=Promise.resolve(z).then(()=>Promise.all(we?[ce("preview"),te,ce("desktopDisplay"),ce("desktopAutomation"),ce("desktopBrowser")]:[!1,!1,!1,!1,!1]),()=>[!1,!1,!1,!1,!1]),he=(async()=>{let[Me,Ce,Te,We,$e,Ue,Ne,xe,Le]=await Promise.all([Promise.resolve(D).then((Ge)=>Ge.read?ce("workspaceRead"):!1,()=>!1),Promise.resolve(D).then((Ge)=>Ge.write?ce("workspaceWrite"):!1,()=>!1),M?ce("confinedShell"):!1,M?ce("confinedGit"):!1,ce("processInspection"),...we?[ce("bash"),ce("jobs"),ce("environment"),ce("fullControlShell")]:[!1,!1,!1,!1]]);if(we&&(!Ue||!Ne||!xe)&&!z)await X;if(we){if(!Ue)Ue=await ce("bash");if(!Ne)Ne=await ce("jobs");if(!xe)xe=await ce("environment")}return{read:Me,write:Ce,shell:Te,git:We,processes:$e,bash:Ue,jobs:Ne,environment:xe,full:Le}})(),Se=(Me,Ce)=>{let{read:Te,write:We,shell:$e,git:Ue,processes:Ne,bash:xe,jobs:Le,environment:Ge,full:Ve}=Me,{preview:Je,boundPty:it,desktopDisplay:Ye,desktopAutomation:Be,desktopBrowser:Ke}=Ce,Fe=ic(),nt=we&&process.platform==="darwin"&&Ve&&up("/Library/Developer/PrivateFrameworks/CoreSimulator.framework");return Object.freeze({"fs.read":Te,"fs.write":We,"inference.custom.v1":we&&Te,"fs.export":Te&&Fe,"fs.import":We&&Fe,"exec.run":$e&&M,"git.run":$e&&Ue&&M,"process.list":(process.platform==="linux"||process.platform==="win32"||$e)&&Ne,"ports.list":(process.platform==="linux"||process.platform==="win32"||$e)&&Ne,"exec.full":xe&&Ve&&M,"hands.connect":Te&&We&&xe&&Le,"jobs.control":Te&&We&&xe&&Le,"pty.start":Te&&We&&xe&&Le&&Ge&&it,"environment.install":Te&&We&&xe&&Le&&Ge,"github.local.v1":(process.platform==="darwin"||process.platform==="win32"||process.platform==="linux"&&process.geteuid?.()!==0)&&Te&&We&&xe&&Le&&Ge,"tunnel.open":Te&&We&&xe&&Le&&Ge&&Je,"tunnel.close":Te&&We&&xe&&Le&&Ge&&Je,"preview.serve.v1":Te&&xe&&Le&&Je&&Ve,"display.stream.v1":Ye,"automation.call.v1":Be,"simulator.call.v1":nt,"simulator.stream.v1":nt,"browser.pr-proof.v1":Be&&Ke&&ue()===null&&process.platform!=="win32","workspace.setup.v1":we&&Zr()})},Re=he.then(async(Me)=>Se(Me,{preview:!1,boundPty:await Promise.race([te,new Promise((Ce)=>setImmediate(()=>Ce(!1)))]),desktopDisplay:!1,desktopAutomation:!1,desktopBrowser:!1})),Ee=(async()=>{try{let Me=await he,[Ce,Te,We,$e,Ue]=await X;if(we&&!Te&&Me.read&&Me.write&&Me.bash&&Me.jobs&&Me.environment)Te=await ce("boundPty");return Se(Me,{preview:Ce,boundPty:Te,desktopDisplay:We,desktopAutomation:$e,desktopBrowser:Ue})}finally{if(re)Dl(re,{recursive:!0,force:!0})}})();Re.catch(()=>{});let Oe=(async()=>{let Me=await he;if(!(Me.read&&Me.write&&Me.bash&&Me.jobs&&Me.environment))return!1;return await te||(await Ee)["pty.start"]===!0})();return Oe.catch(()=>{}),{initial:Re,final:Ee,pty:Oe}}var kp=["hands.connect","jobs.control","pty.start","environment.install","tunnel.open","tunnel.close","preview.serve.v1"],vp=[60000,300000,900000];function Ga(e,l){if(e.executionMode!=="host"||l["fs.read"]!==!0)return[];return kp.filter((v)=>l[v]!==!0)}function Tl(e){let l=e.log??((L)=>{process.stderr.write(L)}),v=e.resolve??((L)=>bp(e.config,void 0,L,e.permissions)),D=e.readiness,M=Ga(e.config,D);if(M.length===0)return Promise.resolve();return l(`Reason worker: withheld at start (${M.join(", ")}); probing them again while idle.
+`),(async()=>{for(let L of e.delaysMs??vp){if(await new Promise((G)=>{let ce=setTimeout(G,L);e.signal.addEventListener("abort",()=>{clearTimeout(ce),G()},{once:!0})}),e.signal.aborted)return;if(!e.idle())continue;let z;try{z=await v(AbortSignal.any([e.signal,AbortSignal.timeout(30000)]))}catch{continue}if(e.signal.aborted)return;let re=Ga(e.config,D).filter((G)=>z[G]===!0);if(re.length>0)D=Object.freeze({...D,...Object.fromEntries(re.map((G)=>[G,!0]))}),l(`Reason worker: ready after probing again (${re.join(", ")}).
+`),e.onReady(D,re);if(Ga(e.config,D).length===0)return}})()}import{execFile as vh}from"child_process";import{createHash as Sh,randomUUID as Rs}from"crypto";import{lstat as Rh,readdir as bd,readFile as Sd,realpath as Eh,stat as Ph}from"fs/promises";import{basename as Ch,join as ks}from"path";import{promisify as Ah}from"util";import{createConnection as Sp}from"net";import{endianness as Nl}from"os";var Io=4,ns=1e4;class Vr{socketPath;sessionId;turnId;timeoutMs;#t=null;#e=Buffer.alloc(0);#i=1;#r=new Map;#n=new Set;constructor(e){this.socketPath=e.socketPath,this.sessionId=e.sessionId??"open-browser-use-js",this.turnId=e.turnId??`turn-${Date.now()}`,this.timeoutMs=e.timeoutMs??1e4}async connect(){if(this.#t)return this;let e=Sp(this.socketPath);return this.#t=e,e.on("data",(l)=>this.#a(Buffer.from(l))),e.on("close",()=>this.#o(Error("Open Browser Use socket closed"))),e.on("error",(l)=>this.#o(l)),await new Promise((l,v)=>{e.once("connect",l),e.once("error",v)}),this}close(){this.#t?.end(),this.#t=null}onNotification(e){return this.#n.add(e),()=>{this.#n.delete(e)}}async request(e,l={}){await this.connect();let v=this.#t;if(!v)throw Error("Open Browser Use socket is not connected");let D=String(this.#i++),M={session_id:this.sessionId,turn_id:this.turnId,...l},z=Rp({jsonrpc:"2.0",id:D,method:e,params:M}),re=new Promise((G,ce)=>{let we=setTimeout(()=>{this.#r.delete(D),ce(Error(`Open Browser Use request timed out: ${e}`))},this.timeoutMs);this.#r.set(D,{resolve:G,reject:ce,timeout:we})});return v.write(z),await re}getInfo(){return this.request("getInfo")}createTab(){return this.request("createTab")}getTabs(){return this.request("getTabs")}getUserTabs(){return this.request("getUserTabs")}getUserHistory(e={}){return this.request("getUserHistory",e)}claimUserTab(e){return this.request("claimUserTab",{tabId:e})}finalizeTabs(e){return this.request("finalizeTabs",{keep:e})}nameSession(e){return this.request("nameSession",{name:e})}attach(e){return this.request("attach",{tabId:e})}detach(e){return this.request("detach",{tabId:e})}executeCdp(e,l,v={}){return this.request("executeCdp",{target:{tabId:e},method:l,commandParams:v})}moveMouse(e,l,v,D=!0){return this.request("moveMouse",{tabId:e,x:l,y:v,waitForArrival:D})}waitForFileChooser(e,l){return this.request("waitForFileChooser",{tabId:e,...l===void 0?{}:{timeoutMs:l}})}setFileChooserFiles(e,l){return this.request("setFileChooserFiles",{fileChooserId:e,files:l})}waitForDownload(e,l){return this.request("waitForDownload",{tabId:e,...l===void 0?{}:{timeoutMs:l}})}downloadPath(e,l){return this.request("downloadPath",{downloadId:e,...l===void 0?{}:{timeoutMs:l}})}browserUserHistory(e={}){return this.getUserHistory(e)}readClipboardText(e){return this.request("readClipboardText",{tabId:e})}writeClipboardText(e,l){return this.request("writeClipboardText",{tabId:e,text:l})}readClipboard(e){return this.request("readClipboard",{tabId:e})}writeClipboard(e,l){return this.request("writeClipboard",{tabId:e,items:l})}turnEnded(){return this.request("turnEnded")}#a(e){this.#e=Buffer.concat([this.#e,e]);while(this.#e.length>=Io){let l=Nl()==="LE"?this.#e.readUInt32LE(0):this.#e.readUInt32BE(0),v=Io+l;if(this.#e.length<v)return;let D=this.#e.subarray(Io,v);this.#e=this.#e.subarray(v),this.#s(JSON.parse(D.toString("utf8")))}}#s(e){if(!br(e))return;let l=typeof e.id==="string"||typeof e.id==="number"?String(e.id):null;if(!l&&typeof e.method==="string"){let D={method:e.method,params:e.params};for(let M of this.#n)M(D);return}if(!l)return;let v=this.#r.get(l);if(!v)return;if(this.#r.delete(l),clearTimeout(v.timeout),br(e.error)){v.reject(Error(String(e.error.message??"Open Browser Use request failed")));return}v.resolve(e.result??null)}#o(e){for(let[l,v]of this.#r)this.#r.delete(l),clearTimeout(v.timeout),v.reject(e)}}class Ci{client;cdp;constructor(e){this.client="client"in e?e.client:new Vr(e),this.cdp=new Bl(this.client)}async connect(){return await this.client.connect(),this}close(){this.client.close()}async newTab(e={}){let l=await this.client.createTab(),v=Ep(l,"createTab response"),D=this.tab(v);if(e.url)await D.goto(e.url,e);return D}tab(e){return new Hl(this,e)}getTabs(){return this.client.getTabs()}}class Hl{browser;id;playwright;constructor(e,l){this.browser=e,this.id=l,this.playwright=new $l(this)}goto(e,l={}){return this.browser.cdp.navigate(this.id,e,l)}waitForLoadState(e={}){return this.browser.cdp.waitForLoadState(this.id,e)}domSnapshot(){return this.browser.cdp.evaluate(this.id,"document.body?.innerText ?? ''").then((e)=>String(e??""))}evaluate(e,l={}){return this.browser.cdp.evaluate(this.id,e,l)}close(){return this.browser.cdp.call(this.id,"Page.close")}}class $l{tab;constructor(e){this.tab=e}waitForLoadState(e={}){return this.tab.waitForLoadState(e)}domSnapshot(){return this.tab.domSnapshot()}}class Bl{client;#t=new Set;constructor(e){this.client=e}async call(e,l,v={},D={}){return await this.ensureAttached(e),this.client.request("executeCdp",{target:{tabId:e},method:l,commandParams:v,...D.timeoutMs===void 0?{}:{timeoutMs:D.timeoutMs}})}async evaluate(e,l,v={}){let D=await this.call(e,"Runtime.evaluate",{expression:l,returnByValue:!0,...v.awaitPromise===void 0?{}:{awaitPromise:v.awaitPromise}});if(br(D)&&br(D.exceptionDetails))throw Error(String(D.exceptionDetails.text??"Open Browser Use evaluation failed"));return br(D)&&br(D.result)?D.result.value??null:null}async navigate(e,l,v={}){if(!l)throw Error("goto requires a URL");let D=v.waitUntil??"load";Ll(D);let M=v.timeoutMs??ns;await this.call(e,"Page.enable");let L=this.waitForLoadEvent(e,D,M),z=await this.call(e,"Page.navigate",{url:l},{timeoutMs:M});if(br(z)&&typeof z.errorText==="string"&&z.errorText)throw Error(`Browser failed to navigate tab ${e}: ${z.errorText}`);return await L.catch(async(re)=>{let G=await this.readDocumentState(e);if(Wl(G,D))return;throw re}),z}async waitForLoadState(e,l={}){let v=l.state??"load";Ll(v),await this.call(e,"Page.enable");let D=await this.readDocumentState(e);if(Wl(D,v))return;await this.waitForLoadEvent(e,v,l.timeoutMs??ns)}async readDocumentState(e){try{let l=await this.evaluate(e,"({ href: window.location.href, readyState: document.readyState })");return br(l)?{href:cs(l.href),readyState:cs(l.readyState)}:void 0}catch{return}}waitForEvent(e,l,v={}){let D=v.timeoutMs??ns;return new Promise((M,L)=>{let z=!1,re=null,G,ce=()=>{if(z)return!1;return z=!0,clearTimeout(G),re?.(),!0};G=setTimeout(()=>{if(ce())L(Error(v.timeoutMessage??`Timed out waiting for tab ${e} event`))},D),re=this.client.onNotification((we)=>{try{if(l(we)){if(ce())M(we)}}catch(te){if(ce())L(te instanceof Error?te:Error(String(te)))}})})}waitForLoadEvent(e,l,v){return this.waitForEvent(e,(D)=>{let M=Pp(D,e);if(!M)return!1;if(M.method==="Page.navigationBlocked")throw Error(`Navigation was blocked in tab ${e}`);return l==="domcontentloaded"?M.method==="Page.domContentEventFired":M.method==="Page.loadEventFired"},{timeoutMs:v,timeoutMessage:`Timed out waiting for ${l} in tab ${e}`}).then(()=>{return})}async ensureAttached(e){if(this.#t.has(e))return;await this.client.attach(e),this.#t.add(e)}}function Rp(e){let l=Buffer.from(JSON.stringify(e),"utf8"),v=Buffer.alloc(Io+l.length);if(Nl()==="LE")v.writeUInt32LE(l.length,0);else v.writeUInt32BE(l.length,0);return l.copy(v,Io),v}function br(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Ep(e,l){if(!br(e))throw Error(`${l} did not include a tab object`);let v=e.id;if(typeof v==="number"&&Number.isInteger(v)&&v>0)return v;if(typeof v==="string"){let D=Number(v);if(Number.isInteger(D)&&D>0)return D}throw Error(`${l} did not include a numeric tab id`)}function Ll(e){if(e!=="domcontentloaded"&&e!=="load")throw Error(`Unsupported load state "${e}". Use "domcontentloaded" or "load".`)}function Wl(e,l){if(e?.readyState==="complete")return!0;return l==="domcontentloaded"&&e?.readyState==="interactive"}function Pp(e,l){if(e.method!=="onCDPEvent"||!br(e.params))return null;let v=e.params.source;if(!br(v)||v.tabId!==l)return null;return{method:cs(e.params.method)}}function cs(e){return typeof e==="string"?e:void 0}import{createHash as Cp}from"crypto";function Ul(e,l,v,D){let M=JSON.stringify([e.trim().toLowerCase(),l.trim().toLowerCase(),v,D]);return`reason-cloud-${Cp("sha256").update(M).digest("hex")}`}import{AsyncLocalStorage as _h}from"async_hooks";import{isDeepStrictEqual as yd}from"util";import{createHash as bh}from"crypto";var Ap=/#w=(\d{1,5})&h=(\d{1,5})$/;function Fl(e){return typeof e==="number"&&Number.isInteger(e)&&e>0&&e<=32768?e:void 0}function jl(e){let l=Ap.exec(e);if(!l)return;let v=Fl(Number(l[1])),D=Fl(Number(l[2]));return v&&D?{width:v,height:D}:void 0}var ql="[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}",xp=new RegExp(`^/media/pr-screenshots/(${ql})/(${ql})/([a-z0-9][a-z0-9._-]*)\\.(png|jpe?g|gif|webp|webm|mp4)$`,"i");var Ip=new Set(["png","jpg","jpeg","gif","webp"]),Op=new Set(["webm","mp4"]);function Dp(e){if(!e)return null;try{return new URL(e).origin}catch{return null}}function Mp(e){let l=jl(e);return Boolean(l&&e===`#w=${l.width}&h=${l.height}`)}function zl(e,l){let v;try{v=new URL(e)}catch{return null}let D=Dp(l),M=v.hostname==="ara.so"||v.hostname.endsWith(".ara.so")||v.hostname==="reasonmachines.ai"||v.hostname.endsWith(".reasonmachines.ai")||v.hostname==="reasonmachines.com"||v.hostname.endsWith(".reasonmachines.com");if(v.protocol!=="https:"||!M&&v.origin!==D||v.username||v.password||v.port||v.search||v.hash&&!Mp(v.hash))return null;let L=xp.exec(v.pathname);if(!L)return null;let z=L[1]?.toLowerCase(),re=L[2]?.toLowerCase(),G=L[3]?.toLowerCase(),ce=L[4]?.toLowerCase();if(!z||!re||!G||!ce)return null;let we=Ip.has(ce)?"image":Op.has(ce)?"video":null;if(!we)return null;let te=/^(before|after)[\s:_-]+/.exec(G),X=v.pathname.replace(/^\/media\//,"");return{url:v.toString(),storagePath:X,runId:z,artifactId:re,fileName:`${G}.${ce}`,kind:we,phase:te?.[1]==="before"||te?.[1]==="after"?te[1]:null}}var Tp=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Ai=(e)=>Boolean(e&&typeof e==="object"&&!Array.isArray(e)),_n=()=>{throw Error("cloud_browser_media_request_invalid")};function xi(e){if(!Ai(e)||Object.keys(e).some((L)=>!["runId","configuredMediaOrigin","media"].includes(L))||typeof e.runId!=="string"||!Tp.test(e.runId)||typeof e.configuredMediaOrigin!=="string"||e.configuredMediaOrigin.length>2048||!Array.isArray(e.media)||e.media.length<1||e.media.length>8)return _n();let l;try{l=new URL(e.configuredMediaOrigin)}catch{return _n()}if(l.protocol!=="https:"||l.username||l.password||l.port||!Mt(l.origin,{mode:"public_web"}).allowed)return _n();let v=e.runId.toLowerCase(),D=new Set,M=e.media.map((L)=>{if(!Ai(L)||Object.keys(L).some((re)=>!["url","sourceUrl","kind"].includes(re))||typeof L.url!=="string"||L.url.length>2048||typeof L.sourceUrl!=="string"||L.sourceUrl.length>8192||!["image","video"].includes(String(L.kind)))return _n();let z=zl(L.url,l.origin);if(!z||new URL(z.url).origin!==l.origin||z.runId!==v||z.kind!==L.kind||z.url!==L.url||D.has(L.url))return _n();if(D.add(L.url),L.sourceUrl!==L.url){let re;try{re=new URL(L.sourceUrl)}catch{return _n()}let G=/^\/(?:[a-f0-9]{40}|[a-f0-9]{64})\/([a-f0-9]+)$/.exec(re.pathname)?.[1];if(L.kind!=="image"||re.origin!=="https://camo.githubusercontent.com"||re.username||re.password||re.search||re.hash||!G||G.length%2!==0||Buffer.from(G,"hex").toString("utf8")!==L.url)return _n()}return{url:L.url,sourceUrl:L.sourceUrl,kind:L.kind}});return{runId:e.runId,configuredMediaOrigin:l.origin,media:M}}function Kl(e,l){let v=()=>{throw Error("cloud_browser_media_verification_failed")};if(!Ai(e)||e.verified!==!0||!Array.isArray(e.items)||e.items.length!==l.media.length)return v();return{verified:!0,items:e.items.map((M,L)=>{let z=l.media[L];if(!Ai(M)||M.url!==z.url||M.sourceUrl!==z.sourceUrl||M.kind!==z.kind||typeof M.sourceSha256!=="string"||!/^[a-f0-9]{64}$/.test(M.sourceSha256)||!Number.isSafeInteger(M.width)||!Number.isSafeInteger(M.height)||Number(M.width)<1||Number(M.height)<1||Number(M.width)>16384||Number(M.height)>16384||z.kind==="video"&&(typeof M.advancedSeconds!=="number"||!Number.isFinite(M.advancedSeconds)||M.advancedSeconds<0.05||M.advancedSeconds>30))return v();return{...z,width:Number(M.width),height:Number(M.height),sourceSha256:M.sourceSha256,...z.kind==="video"?{advancedSeconds:M.advancedSeconds}:{}}})}}var us="browser.pr-proof.v1",Dt=t().uuid(),$n=t().regex(/^[a-f0-9]{64}$/),vn=I.datetime({precision:3}),ds=t().regex(/^[a-zA-Z0-9_-]{1,160}$/),Gl=t().max(2048).regex(/^https:\/\/github\.com\/[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/).refine((e)=>![".",".."].includes(e.split("/")[4])),ur=n({kind:i("primary_mac"),version:i(1),organizationId:ds,userId:ds,sessionId:ds,runId:Dt,deviceId:Dt,rootId:Dt,rootRevision:t().min(1).max(64),binding:c(["workspace_source","mcp_control"]),targetRevision:o().int().nonnegative(),generation:Dt,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024)}).strict().refine((e)=>e.binding!=="workspace_source"||e.targetRevision===0),Lp=Yi().transform((e,l)=>{try{return ho(e)}catch{return l.addIssue({code:"custom",message:"proof_visual_contract_invalid"}),Jc}}),Bn=n({version:i(1),owner:ur,contextId:Dt,preparedAt:vn,expiresAt:vn,prUrl:Gl,headSha:t().regex(/^[a-f0-9]{40}$/),skillDigest:$n,evidenceKind:c(["image","video"]),visualPlan:Lp.optional(),uploadOrigin:t().url().refine((e)=>{let l=new URL(e);return l.protocol==="https:"&&l.origin===e&&!l.username&&!l.password}).optional()}).strict().refine((e)=>Date.parse(e.expiresAt)>Date.parse(e.preparedAt)&&Date.parse(e.expiresAt)-Date.parse(e.preparedAt)<=300000),fs=n({version:i(1),producer:i("primary_mac"),context:Bn,captureId:Dt,operationId:Dt,attemptId:Dt,tabId:o().int().positive(),startedAt:vn,finishedAt:vn,sha256:$n,media:P("contentType",[n({contentType:i("image/png"),sizeBytes:o().int().min(24).max(8388608),width:o().int().min(1).max(4096),height:o().int().min(1).max(4096)}).strict(),n({contentType:i("video/webm"),sizeBytes:o().int().min(128).max(10485760),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000)}).strict()])}).strict().superRefine((e,l)=>{let v=Date.parse(e.startedAt),D=Date.parse(e.finishedAt);if(v<Date.parse(e.context.preparedAt)||D<v||D>Date.parse(e.context.expiresAt)||D-v>30000||e.media.contentType==="video/webm"&&(e.media.receivedFrameCount<e.media.frameCount||Math.abs((D-v)/1000-e.media.durationSeconds)>0.1))l.addIssue({code:"custom",message:"mac_pr_proof_capture_chronology_invalid"})}),ov=P("action",[n({action:i("screenshot"),context_id:Dt,tab_id:o().int().positive()}).strict(),n({action:i("start_video"),context_id:Dt,tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("stop_video"),recording_operation_id:Dt}).strict()]),Oi=n({login:t().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/),id:t().regex(/^[1-9][0-9]{0,19}$/).nullable()}).strict(),Ii=t().regex(/^[1-9][0-9]{0,19}$/),Oo=n({version:i(1),owner:ur,expectedActorId:Ii.nullable(),repositoryId:Ii,repositoryFullName:t().max(200).regex(/^[A-Za-z0-9_-]+\/[A-Za-z0-9_.-]+$/).refine((e)=>![".",".."].includes(e.split("/")[1]))}).strict(),Wp=["browser_unavailable","github_page_unavailable","identity_check_failed","operation_incomplete","attachment_unavailable"],ms=P("status",[Oo.extend({status:i("ready"),observedActor:Oi,checkedAt:vn}),Oo.extend({status:i("not_ready"),reason:c(["authentication_required","identity_mismatch","authority_lost","unavailable"]),cause:c(Wp).optional()})]).refine((e)=>e.status!=="ready"||e.expectedActorId===null||e.observedActor.id===e.expectedActorId),bn=n({version:i(1),owner:ur,expectedActorId:Ii.nullable(),authenticatedActor:Oi,attemptId:Dt,captureId:Dt,prUrl:Gl,repositoryId:Ii,headSha:t().regex(/^[a-f0-9]{40}$/),sha256:$n,sizeBytes:o().int().min(128).max(10485760),contentType:i("video/webm")}).strict(),Yl=t().regex(/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),Un=P("status",[bn.extend({status:i("not_attempted"),reason:c(["authentication_required","attachment_unavailable","identity_mismatch","capture_invalid","authority_lost"])}),bn.extend({status:i("uncertain"),reason:i("upload_outcome_unknown")}),bn.extend({status:i("uploaded"),observedActor:Oi,nativeUrl:Yl,uploadedAt:vn})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&(e.status!=="uploaded"||e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login)),Do=bn.extend({nativeUrl:Yl,observedActor:Oi,bodySha256:$n}),ps=P("status",[Do.extend({status:i("incomplete"),reason:c(["authentication_required","identity_mismatch","playback_unverified","authority_lost"])}),Do.extend({status:i("verified"),sourceSha256:$n,width:o().int().min(1).max(4096),height:o().int().min(1).max(4096),durationSeconds:o().positive().max(30),advancedSeconds:o().min(0.05).max(10),advancedFrames:o().int().positive(),playbackRestored:i(!0),verifiedAt:vn})]).refine((e)=>(e.expectedActorId===null||e.authenticatedActor.id===e.expectedActorId)&&e.observedActor.id===e.authenticatedActor.id&&e.observedActor.login===e.authenticatedActor.login&&(e.status!=="verified"||e.sourceSha256===e.sha256)),Np=Yi().transform((e,l)=>{try{let v=xi(e);if(v.media.some((D)=>D.kind!=="image"))throw Error();return v}catch{return l.addIssue({code:"custom",message:"proof_media_request_invalid"}),Jc}}),Hp=P("action",[n({action:i("auth_check"),input:Oo}).strict(),n({action:i("prepare"),context:Bn}).strict(),n({action:i("capture_png"),owner:ur,contextId:Dt,tabId:o().int().positive()}).strict(),n({action:i("start_video"),owner:ur,contextId:Dt,tabId:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),n({action:i("inspect_capture"),owner:ur,captureId:Dt}).strict(),n({action:i("publish_video"),input:bn}).strict(),n({action:i("verify_png_media"),owner:ur,media:Np}).strict().refine((e)=>e.media.runId===e.owner.runId),n({action:i("verify_saved_media"),input:Do}).strict(),n({action:i("publish_png"),owner:ur,attemptId:Dt,captureId:Dt,sha256:$n,sizeBytes:o().int().min(24).max(8388608),storagePath:t().max(512),uploadUrl:t().url().max(8192)}).strict()]);var Xl="pr-proof.stop.v1",hs=n({requestId:Dt,command:Hp}).strict();var $p={type:"object",required:["action"],properties:{action:{type:"string",enum:["screenshot","start_video","stop_video"]},context_id:{type:"string",format:"uuid"},tab_id:{type:"integer",minimum:1},seconds:{type:"integer",minimum:1,maximum:15},recording_operation_id:{type:"string",format:"uuid"}},additionalProperties:!1},Vl={type:"string",format:"uuid",description:"capture_context_id from tools.pr.prepareProof."},Jl={type:"integer",minimum:1,description:"An already-owned tab's id."},iv={...$p,oneOf:[{type:"object",required:["action","context_id","tab_id"],additionalProperties:!1,properties:{action:{type:"string",const:"screenshot"},context_id:Vl,tab_id:Jl}},{type:"object",required:["action","context_id","tab_id","seconds"],additionalProperties:!1,properties:{action:{type:"string",const:"start_video"},context_id:Vl,tab_id:Jl,seconds:{type:"integer",minimum:1,maximum:15}}},{type:"object",required:["action","recording_operation_id"],additionalProperties:!1,properties:{action:{type:"string",const:"stop_video"},recording_operation_id:{type:"string",format:"uuid",description:"The recording_operation_id start_video returned."}}}]};import{createHash as Bp,randomUUID as Up}from"crypto";import{isDeepStrictEqual as Fn}from"util";var Zl=n({operationId:t().uuid(),attemptId:t().uuid(),contextId:t().uuid(),tabId:o().int().positive()}).strict(),_t=()=>Error("mac_pr_proof_capture_unavailable"),gs=(e)=>Bp("sha256").update(e).digest("hex");function Ql(e){let l=ur.parse(e.owner),v=new Map,D=new Map,M=!1,L=async()=>{if(M)throw _t();if(await e.assertCurrent(),M)throw _t()},z=(X)=>{let he=v.get(X);if(!he||Date.parse(he.expiresAt)<=Date.now())throw _t();return he},re=(X)=>X.disposal??=(async()=>{X.controller.abort(),X.bytes?.fill(0),X.bytes=void 0,X.receipt=void 0;try{await X.host?.close()}catch{throw M=!0,_t()}})(),G=async()=>{for(let[X,he]of v){if(Date.parse(he.expiresAt)>Date.now())continue;let Se=[...D.entries()].filter(([,Ee])=>Ee.claim.contextId===X);if((await Promise.allSettled(Se.map(([,Ee])=>re(Ee)))).some((Ee)=>Ee.status==="rejected"))throw _t();for(let[Ee]of Se)D.delete(Ee);v.delete(X)}},ce=setInterval(()=>{G().catch(()=>{M=!0})},1000);ce.unref();let we=(X)=>{if(X.stopRequested=!0,X.started&&X.host&&!X.stop)X.stop=X.host.stop(),X.stop.catch(()=>X.controller.abort())};async function te(X,he){let Se=Zl.parse(X.claim);if(he==="video"&&(!Number.isInteger(X.seconds)||X.seconds<1||X.seconds>15))throw _t();await L(),X.signal.throwIfAborted(),await G();let Re=z(Se.contextId);if(he==="video"&&Re.evidenceKind!=="video")throw _t();let Ee=D.get(Se.operationId);if(Ee){if(!Fn(Ee.claim,Se)||Ee.kind!==he||Ee.seconds!==X.seconds||Ee.controller.signal.aborted)throw _t();let Ne=await Ee.completion;if(await L(),z(Se.contextId),Ee.controller.signal.aborted)throw _t();return structuredClone(Ne)}if(D.size>=16||[...D.values()].some((Ne)=>!Ne.receipt&&!Ne.controller.signal.aborted&&Ne.claim.tabId===Se.tabId))throw _t();let Oe,Me,Ce=new Promise((Ne,xe)=>{Oe=Ne,Me=xe});Ce.catch(()=>{});let Te={claim:Se,kind:he,seconds:X.seconds,controller:new AbortController,completion:Ce,stopRequested:!1,started:!1};D.set(Se.operationId,Te);let We=()=>{re(Te).catch(()=>{})};X.signal.addEventListener("abort",We,{once:!0});let $e=async()=>{await L(),z(Se.contextId),X.signal.throwIfAborted(),Te.controller.signal.throwIfAborted()},Ue;try{await $e();let Ne;if(he==="image"){let xe=new Date().toISOString();Ue=await e.screenshot(structuredClone(Re),Se.tabId,Te.controller.signal);let Le=new Date().toISOString();if(await $e(),Ue.length<24||Ue.length>8388608||!Ue.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10]))||Ue.readUInt32BE(8)!==13||Ue.toString("ascii",12,16)!=="IHDR")throw _t();Ne=fs.parse({version:1,producer:"primary_mac",context:Re,captureId:Up(),operationId:Se.operationId,attemptId:Se.attemptId,tabId:Se.tabId,startedAt:xe,finishedAt:Le,sha256:gs(Ue),media:{contentType:"image/png",sizeBytes:Ue.length,width:Ue.readUInt32BE(16),height:Ue.readUInt32BE(20)}})}else{if(Te.host=await e.createVideo(structuredClone(Re),Se.tabId,X.seconds,Te.controller.signal),Te.controller.signal.aborted||X.signal.aborted||M)throw await Te.host.close(),_t();await Te.host.start(),Te.started=!0;let xe=Te.host.completed();if(xe.catch(()=>{}),await $e(),await X.started?.(),Te.stopRequested)we(Te);let Le=await xe;if(Te.stop)await Te.stop;await $e();let Ge=await Te.host.read(Le.captureId);Ue=Ge.bytes;let Ve={runId:l.runId,deviceId:l.deviceId,rootId:l.rootId,rootRevision:l.rootRevision,generation:l.generation,profile:l.profile,extensionInstanceId:l.extensionInstanceId,browserScope:e.browserScope,tabId:Se.tabId};if(!Fn(Le,Ge.capture)||!Fn(Le.owner,Ve)||Ue.length!==Le.sizeBytes||gs(Ue)!==Le.sha256||Ue.length<128||Ue.readUInt32BE(0)!==440786851)throw _t();await Te.host.close(),await $e(),Ne=fs.parse({version:1,producer:"primary_mac",context:Re,captureId:Le.captureId,operationId:Se.operationId,attemptId:Se.attemptId,tabId:Se.tabId,startedAt:Le.startedAt,finishedAt:Le.finishedAt,sha256:Le.sha256,media:{contentType:"video/webm",sizeBytes:Le.sizeBytes,durationSeconds:Le.durationSeconds,frameCount:Le.frameCount,receivedFrameCount:Le.receivedFrameCount}})}if(await $e(),[...D.values()].reduce((xe,Le)=>xe+(Le.bytes?.length??0),Ue.length)>20971520)throw _t();return Te.bytes=Buffer.from(Ue),Te.receipt=Ne,Oe(Ne),structuredClone(Ne)}catch(Ne){let xe=he==="video"&&!X.signal.aborted&&!Te.controller.signal.aborted&&Ne instanceof Error&&Ne.message==="mac_recording_worker_failed:no_frames"?new r("proof_capture_no_frames","The owned tab emitted no recording frames."):_t();throw await re(Te).catch(()=>{}),Me(xe),xe}finally{Ue?.fill(0),X.signal.removeEventListener("abort",We)}}return{async prepare(X){let he=Bn.parse(X);if(!Fn(he.owner,l))throw _t();if(await L(),await G(),Date.parse(he.preparedAt)>Date.now()||Date.parse(he.expiresAt)<=Date.now())throw _t();let Se=v.get(he.contextId);if(Se){if(!Fn(Se,he))throw _t();return structuredClone(Se)}if(v.size>=4)throw _t();return v.set(he.contextId,he),structuredClone(he)},screenshot:(X)=>te(X,"image"),record:(X)=>te(X,"video"),async stop(X){let he=Zl.parse(X);await L(),z(he.contextId);let Se=D.get(he.operationId);if(!Se||Se.kind!=="video"||!Fn(he,Se.claim)||Se.controller.signal.aborted)throw _t();we(Se)},async publicationCapture(X){await L(),await G();let he=[...D.values()].find((Se)=>Se.receipt?.captureId===X);if(!he?.receipt||!he.bytes||he.controller.signal.aborted)throw _t();if(z(he.claim.contextId),he.bytes.length!==he.receipt.media.sizeBytes||gs(he.bytes)!==he.receipt.sha256)throw _t();return{capture:structuredClone(he.receipt),bytes:Buffer.from(he.bytes)}},async inspect(X){await L(),await G();let he=[...D.values()].find((Se)=>Se.receipt?.captureId===X);if(!he?.receipt||he.controller.signal.aborted)throw _t();return z(he.claim.contextId),structuredClone(he.receipt)},async close(){M=!0,clearInterval(ce);let X=await Promise.allSettled([...D.values()].map(re));if(D.clear(),v.clear(),X.some((he)=>he.status==="rejected"))throw _t()}}}import{createHash as nd,randomUUID as Yp}from"crypto";import{isDeepStrictEqual as Mo}from"util";import{realpath as Xp}from"fs/promises";var ed=String.raw`async (media) => {
   const deadline = (promise) => {
     let timer;
     return Promise.race([promise, new Promise((_, reject) => {
@@ -70,25 +70,25 @@ ${l?.directory??p(e)}`).digest("hex")}function ao(e,l){y(Xt(p(e),so),{version:1,
     }
   }));
   return { verified: true, items };
-}`;var td=function(e){let l=this??globalThis,v=10485760,D=(z,re)=>{if(l.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let G=l.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!G&&(l.location.href===z.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(l.location.pathname)))return{ok:!1,reason:"authentication_required"};if(l.location.href!==z.prUrl||!G)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(G))return{ok:!1,reason:"identity_mismatch"};let ce=l.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),we=/^[1-9][0-9]{0,19}$/.test(ce||"")?ce:null,te={login:G,id:we};if(z.expectedActorId!==null&&we!==z.expectedActorId||z.authenticatedActor&&(G!==z.authenticatedActor.login||we!==z.authenticatedActor.id)||z.observedActor&&(G!==z.observedActor.login||we!==z.observedActor.id)||l.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==z.repositoryId)return{ok:!1,reason:"identity_mismatch"};let X=l.document.querySelector('link[rel="canonical"]');if(X&&X.href!==z.prUrl)return{ok:!1,reason:"identity_mismatch"};if(re){let he=l.document.querySelector("#new_comment_field"),Se=l.document.querySelector("#fc-new_comment_field"),Re=he?.closest("file-attachment"),Ee=he?.closest("form"),Oe=new l.URL(z.prUrl).pathname+"/comment";if(!he||he.value!==""||!Se||Se.type!=="file"||Se.disabled||!Re||Re.getAttribute("input")!==Se.id||Re.getAttribute("data-upload-repository-id")!==z.repositoryId||!Ee||new l.URL(Ee.action,l.location.href).origin!=="https://github.com"||new l.URL(Ee.action,l.location.href).pathname!==Oe)return{ok:!1,reason:"attachment_unavailable"};let Me=Re.getAttribute("data-upload-policy-url");if(!Me||new l.URL(Me,l.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:te}};if(e.operation==="preflight")return D(e.expected,!1);if(e.operation==="identity")return D(e.expected,!0);if(e.operation==="upload"){let z=e.expected,re=D(z,!0);if(!re.ok)return{dispatched:!1,reason:re.reason};let G=l.Uint8Array.from(l.atob(e.base64||""),(X)=>X.charCodeAt(0));if(G.length!==z.sizeBytes||G.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let ce=new l.File([G],z.captureId+".webm",{type:"video/webm"}),we=new l.DataTransfer;we.items.add(ce);let te=l.document.querySelector("#fc-new_comment_field");if(!te)return{dispatched:!1,reason:"attachment_unavailable"};return te.files=we.files,te.dispatchEvent(new l.Event("change",{bubbles:!0})),{dispatched:!0,actor:re.actor}}if(e.operation==="upload_result"){let z=D(e.expected,!1);if(!z.ok)throw Error("github_video_identity_changed");let re=l.document.querySelector("#new_comment_field")?.value?.trim(),G="["+e.expected.captureId+".webm](",ce=re?.startsWith(G)&&re.endsWith(")")?re.slice(G.length,-1):re;if(!ce||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(ce))return null;return{nativeUrl:ce,actor:z.actor}}let M=e.expected,L=D(M,!1);if(!L.ok)return{status:"incomplete",reason:L.reason};return(async()=>{let z=M.nativeUrl.split("/").pop(),re=(Oe)=>{try{let Me=new l.URL(Oe,l.location.href);if(Me.protocol!=="https:"||Me.username||Me.password||Me.port||Me.hash)return!1;if(Me.origin==="https://github.com")return Me.href===M.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(Me.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+z+"\\.(webm|mp4)$").test(Me.pathname)}catch{return!1}},G=[...l.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((Oe)=>/^issue-[1-9][0-9]*$/.test(Oe.closest('[id^="issue-"]')?.id||"")&&!Oe.closest("form")&&!Oe.closest(".preview-content"));if(G.length!==1)throw Error("saved_body_missing");let ce=G[0],we=[...ce.querySelectorAll("video")].filter((Oe)=>[Oe.currentSrc,Oe.src,...[...Oe.querySelectorAll("source")].map((Me)=>Me.src)].some(re));if(we.length!==1)throw Error("saved_player_missing");let te=we[0],X={muted:te.muted,volume:te.volume,rate:te.playbackRate,preload:te.preload},he=new l.AbortController,Se=l.setTimeout(()=>he.abort(),12000),Re=(Oe)=>l.Promise.race([Oe,new l.Promise((Me,Ce)=>{if(he.signal.aborted)Ce(Error("playback_timeout"));else he.signal.addEventListener("abort",()=>Ce(Error("playback_timeout")),{once:!0})})]),Ee=async(Oe)=>{while(!Oe()){if(te.error||he.signal.aborted)throw Error("playback_unverified");await new l.Promise((Me)=>l.setTimeout(Me,25))}};try{if(te.muted=!0,te.playbackRate=1,te.currentTime=0,te.readyState<2)te.preload="auto",te.load();await Ee(()=>te.readyState>=2&&te.videoWidth>0&&te.videoHeight>0);let Oe=te.currentSrc;if(!re(Oe))throw Error("source_unbound");let Me=await Re(l.fetch(Oe,{credentials:"same-origin",redirect:"error",signal:he.signal}));if(Me.status!==200||!re(Me.url)||Me.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(Me.headers.get("content-type")||"")||!Me.body)throw Error("source_unverifiable");let Ce=Me.headers.get("content-length");if(Ce!==null&&(!/^[1-9][0-9]*$/.test(Ce)||Number(Ce)!==M.sizeBytes))throw Error("source_size_mismatch");let Te=Me.body.getReader(),We=[],$e=0;try{for(;;){let Je=await Re(Te.read());if(Je.done)break;if($e+=Je.value.length,$e>10485760||$e>M.sizeBytes)throw Error("source_too_large");We.push(Je.value)}}finally{await Te.cancel().catch(()=>{}),Te.releaseLock()}if($e!==M.sizeBytes)throw Error("source_size_mismatch");let Ue=new l.Uint8Array($e),Ne=0;for(let Je of We)Ue.set(Je,Ne),Ne+=Je.length;let xe=[...new l.Uint8Array(await Re(l.crypto.subtle.digest("SHA-256",Ue)))].map((Je)=>Je.toString(16).padStart(2,"0")).join("");if(xe!==M.sha256||te.currentSrc!==Oe||!ce.contains(te))throw Error("source_changed");let Le=te.currentTime,Ge=te.getVideoPlaybackQuality().totalVideoFrames;if(await Re(te.play()),await Ee(()=>te.currentTime-Le>=0.05&&te.getVideoPlaybackQuality().totalVideoFrames>Ge),!D(M,!1).ok||te.currentSrc!==Oe||!ce.contains(te)||te.error)throw Error("player_changed");return{status:"verified",sourceSha256:xe,width:te.videoWidth,height:te.videoHeight,durationSeconds:te.duration,advancedSeconds:te.currentTime-Le,advancedFrames:te.getVideoPlaybackQuality().totalVideoFrames-Ge,playbackRestored:!0}}finally{if(l.clearTimeout(Se),he.abort(),te.pause(),te.currentTime=0,te.muted=X.muted,te.volume=X.volume,te.playbackRate=X.rate,te.preload=X.preload,!te.paused||te.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as Fp}from"child_process";import{lstat as jp,realpath as qp}from"fs/promises";import{join as rd,resolve as zp}from"path";import{promisify as Kp}from"util";var Vp=Kp(Fp);async function Jp(e,l){let v=await qp(e),{stdout:D}=await Vp(rd(v,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:l});return d(n({browser:t(),directory:t(),connected:_().optional(),source:t(),socketPath:t().optional(),instanceId:t().optional(),extensionId:t().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(D)).filter((L)=>L.browser==="chrome"&&L.connected===!0&&/^(Default|Profile [0-9]+)$/.test(L.directory)&&zp(L.source)===rd(v,"Reason Browser Use","manifest.json"))}async function Ii(e,l,v){if(!/^(Default|Profile [0-9]+)$/.test(l))throw Error("mac_recording_profile_unavailable");let D=(await Jp(e,v)).filter((z)=>z.directory===l),M=D[0];if(D.length!==1||!M?.socketPath||!M.instanceId)throw Error("mac_recording_profile_unavailable");let L=await jp(M.socketPath);if(!L.isSocket()||L.uid!==process.getuid?.()||L.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:M.socketPath,instanceId:M.instanceId,extensionId:M.extensionId}}import{createHash as Gp}from"crypto";function Fn(e){return`reason-browser-${Gp("sha256").update(`reason:mac-browser:v1:${e}`).digest("hex")}`}var od=P("ok",[n({ok:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({ok:i(!1),reason:c(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),id=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})}),ht=()=>Error("mac_pr_proof_browser_unavailable");async function ws(e){let l=ur.parse(e.owner),v="endpoint"in e?e.endpoint(l):await Zp(e.automationDirectory,l),D=new Map,M=`reason-pr-proof-${Yp()}`,L=!1,z=async()=>{if(L)throw ht();if(await e.assertCurrent(),L)throw ht()},re=async(we)=>{if(!Do(l,we.owner))throw ht();await z()},G=async(we)=>{await re(we);let te=await e.readVideo(we.captureId);try{await z();let X=te.capture;if(!Do(X.context.owner,l)||X.captureId!==we.captureId||X.context.prUrl!==we.prUrl||X.context.headSha!==we.headSha||X.media.contentType!=="video/webm"||X.media.sizeBytes!==we.sizeBytes||X.sha256!==we.sha256||te.bytes.length!==we.sizeBytes||te.bytes.length<128||te.bytes.length>10485760||te.bytes.readUInt32BE(0)!==440786851||nd("sha256").update(te.bytes).digest("hex")!==we.sha256)throw ht();return te}catch(X){throw te.bytes.fill(0),X}};async function ce(we,te,X){await z();let he=await v.discover(AbortSignal.timeout(5000)),Se=new Ei({socketPath:he.socketPath,sessionId:M,timeoutMs:5000}),Re,Ee=!1,Oe,Me=new Promise((We,$e)=>{Oe=setTimeout(()=>{Ee=!0,$e(ht())},60000)});Me.catch(()=>{});let Ce=(We)=>Promise.race([We,Me]),Te=async()=>{if(Ee)throw ht();if(await z(),Ee)throw ht()};try{await Ce(Se.connect());let We=id.parse(await Ce(Se.client.getInfo()));if(We.metadata.extensionId!==he.extensionId||We.metadata.extensionInstanceId!==he.instanceId||!We.metadata.nativeHostName)throw ht();await Te(),X?.("connected");let $e=Se.newTab();$e.then((xe)=>{if(Ee)xe.close().catch(()=>{L=!0})},()=>{}),Re=await Ce($e),await Te(),await Ce(Re.goto(we,{waitUntil:"domcontentloaded",timeoutMs:15000})),await Te(),X?.("loaded");let Ne=await Ce(te(Re,async(xe)=>{await Te();let Le=await Ce(Re.evaluate(`(${td.toString()})(${JSON.stringify(xe)})`,{awaitPromise:!0}));return await Te(),Le},Te));return await Te(),Ne}finally{Ee=!0,clearTimeout(Oe);try{if(Re){let We;try{await Promise.race([Re.close(),new Promise(($e,Ue)=>{We=setTimeout(()=>Ue(ht()),5000)})])}finally{clearTimeout(We)}}}catch{throw L=!0,ht()}finally{Se.close()}await z()}}return{async screenshot(we,te,X){let he=$n.parse(we);if(await re(he),!Number.isSafeInteger(te)||te<1||Date.parse(he.expiresAt)<=Date.now())throw ht();X.throwIfAborted();let Se=await v.discover(X),Re=new Ei({socketPath:Se.socketPath,sessionId:v.tabScope,timeoutMs:5000}),Ee;try{await Re.connect();let Oe=id.parse(await Re.client.getInfo());if(Oe.metadata.extensionId!==Se.extensionId||Oe.metadata.extensionInstanceId!==Se.instanceId)throw ht();if(!d(n({id:o()})).max(256).parse(await Re.getTabs()).some((Te)=>Te.id===te))throw ht();await z(),X.throwIfAborted();let Ce=n({data:t().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await Re.cdp.call(te,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(Ce.data)||Ce.data.length%4)throw ht();if(Ee=Buffer.from(Ce.data,"base64"),Ee.toString("base64")!==Ce.data||Ee.length>8388608)throw ht();if(await z(),X.throwIfAborted(),Date.parse(he.expiresAt)<=Date.now())throw ht();return Ee}catch{throw Ee?.fill(0),ht()}finally{Re.close()}},async verifyImages(we){let te=Ci(we);if(te.runId!==l.runId||te.media.some((X)=>X.kind!=="image"))throw ht();return ce("about:blank",async(X,he,Se)=>{let Re=X.browser.client,Ee=new Set(te.media.map((xe)=>xe.sourceUrl)),Oe=new Map,Me=new Set,Ce=!1,Te=0,We=!1,$e=new Set,Ue=(xe,Le)=>{if($e.size>=32){Ce=!0;return}let Ge=Re.executeCdp(X.id,xe,Le);$e.add(Ge),Ge.catch(()=>{Ce=!0}).finally(()=>$e.delete(Ge))},Ne=Re.onNotification((xe)=>{if(xe.method!=="onCDPEvent"||!q(xe.params)||!q(xe.params.source)||xe.params.source.tabId!==X.id||!q(xe.params.params))return;let Le=xe.params.params;if(++Te>512){Ce=!0;return}if(xe.params.method==="Fetch.requestPaused"){let Je=typeof Le.requestId==="string"&&q(Le.request)&&Le.request.method==="GET"&&typeof Le.request.url==="string"&&Ee.has(Le.request.url)&&Le.resourceType==="Image";if(typeof Le.requestId!=="string"){Ce=!0;return}if(!Je)Ce=!0;Ue(Je?"Fetch.continueRequest":"Fetch.failRequest",{requestId:Le.requestId,...Je?{}:{errorReason:"BlockedByClient"}})}if(xe.params.method==="Network.requestWillBeSent"&&Le.redirectResponse)Ce=!0;if(xe.params.method==="Network.loadingFailed")Ce=!0;if(xe.params.method==="Network.loadingFinished"&&typeof Le.requestId==="string")Me.add(Le.requestId);if(xe.params.method!=="Network.responseReceived")return;if(!q(Le.response)||typeof Le.response.url!=="string"||!Ee.has(Le.response.url)||typeof Le.requestId!=="string"||!q(Le.response.headers)||Le.type!=="Image"){Ce=!0;return}let Ge=Object.fromEntries(Object.entries(Le.response.headers).map(([Je,it])=>[Je.toLowerCase(),it])),Ve=Number(Ge["content-length"]);if(Oe.has(Le.response.url)||Le.response.status!==200||Le.response.fromServiceWorker===!0||typeof Ge["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(Ge["content-length"])||!Number.isSafeInteger(Ve)||Ve>8388608||Ge["content-range"]||Ge["content-encoding"]&&Ge["content-encoding"]!=="identity"){Ce=!0;return}Oe.set(Le.response.url,{id:Le.requestId,length:Ve})});try{await Re.executeCdp(X.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await Re.executeCdp(X.id,"Network.setBypassServiceWorker",{bypass:!0}),await Re.executeCdp(X.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await Re.executeCdp(X.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let xe=n({frameTree:n({frame:n({id:t().min(1).max(256)})})}).parse(await Re.executeCdp(X.id,"Page.getFrameTree",{})),Le=[...new Set(te.media.map((Je)=>new URL(Je.sourceUrl).origin))].join(" ");await Re.executeCdp(X.id,"Page.setDocumentContent",{frameId:xe.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${Le}; style-src 'none'"><body></body>`}),await Se(),We=!0;try{await Re.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new r("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await Se();let Ge;try{Ge=await X.evaluate(`(${ed})(${JSON.stringify(te.media)})`,{awaitPromise:!0})}catch{throw new r("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await Se(),!q(Ge)||!Array.isArray(Ge.items)||Ge.items.length!==te.media.length)throw ht();await Promise.all($e);let Ve=[];for(let Je=0;Je<te.media.length;Je++){await z();let it=Oe.get(te.media[Je].sourceUrl);if(Ce||!it||!Me.has(it.id))throw ht();let Ye=n({base64Encoded:i(!0),body:t().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await Re.executeCdp(X.id,"Network.getResponseBody",{requestId:it.id})),Be=Buffer.from(Ye.body,"base64");try{let Ke=Ge.items[Je];if(Be.length!==it.length||Be.toString("base64")!==Ye.body||!q(Ke))throw ht();Ve.push({...Ke,sourceSha256:nd("sha256").update(Be).digest("hex")})}finally{Be.fill(0)}}if(Ce)throw ht();return Kl({verified:!0,items:Ve},te)}finally{if(Ne(),await Promise.allSettled($e),We)try{await Re.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new r("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(we){let te=Ao.parse(we);await re(te);let X="browser_unavailable";try{return await ce(`https://github.com/${te.repositoryFullName}`,async(he,Se)=>{let Re=od.parse(await Se({operation:"preflight",expected:{...te,prUrl:`https://github.com/${te.repositoryFullName}`}}));return ms.parse(Re.ok?{...te,status:"ready",observedActor:Re.actor,checkedAt:new Date().toISOString()}:Re.reason==="attachment_unavailable"?{...te,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...te,status:"not_ready",reason:Re.reason})},(he)=>{X=he==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return ms.parse({...te,status:"not_ready",reason:"unavailable",cause:X})}},async publish(we){let te=_n.parse(we);if(await re(te),te.expectedActorId!==null&&te.authenticatedActor.id!==te.expectedActorId)throw ht();let X=D.get(te.attemptId);if(X){if(!Do(X.binding,te))throw ht();return structuredClone(X.result)}if(D.size>=3)throw Error("proof_native_publication_limit");let he={binding:structuredClone(te),result:Bn.parse({...te,status:"uncertain",reason:"upload_outcome_unknown"})};D.set(te.attemptId,he);let Se=!1,Re="dispatch";try{(await G(te)).bytes.fill(0),he.result=await ce(te.prUrl,async(Ee,Oe)=>{let Me=od.parse(await Oe({operation:"identity",expected:te}));if(!Me.ok)return Bn.parse({...te,status:"not_attempted",reason:Me.reason});let Ce=await G(te),Te;try{Se=!0,Te=P("dispatched",[n({dispatched:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({dispatched:i(!1),reason:c(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await Oe({operation:"upload",expected:te,base64:Ce.bytes.toString("base64")}))}finally{Ce.bytes.fill(0)}if(!Te.dispatched)return Se=!1,Bn.parse({...te,status:"not_attempted",reason:Te.reason});if(!Do(Te.actor,Me.actor))throw Re="actor_changed",ht();Re="result";let We=performance.now();while(performance.now()-We<30000){let $e=await Oe({operation:"upload_result",expected:{...te,observedActor:Me.actor}});if($e!==null){let Ue=n({nativeUrl:t(),actor:n({login:t(),id:t().nullable()}).strict()}).strict().parse($e);return Re="finalize",await z(),Bn.parse({...te,status:"uploaded",nativeUrl:Ue.nativeUrl,observedActor:Ue.actor,uploadedAt:new Date().toISOString()})}await new Promise((Ue)=>setTimeout(Ue,100))}throw Re="result_timeout",ht()})}catch{if(Se)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${Re})
-`);he.result=Bn.parse({...te,...Se?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(he.result)},async verify(we){let te=Io.parse(we);await re(te);try{return(await G(te)).bytes.fill(0),await ce(te.prUrl,async(X,he)=>{await X.browser.client.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let Se=await he({operation:"saved_player",expected:te});if(!Se||typeof Se!=="object"||Array.isArray(Se))throw ht();let Re=ps.parse({...te,...Se,..."status"in Se&&Se.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(te).some(([Ee,Oe])=>!Do(Oe,Re[Ee])))throw ht();return Re}finally{await X.browser.client.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return ps.parse({...te,status:"incomplete",reason:"playback_unverified"})}},close(){L=!0}}}async function Zp(e,l){let v=await Xp(e);return{async discover(D){let M=await Ii(v,l.profile,D);if(M.instanceId!==l.extensionInstanceId)throw ht();return M},tabScope:Fn(l.runId)}}import{realpath as yh}from"fs/promises";var Hv=n({version:i(1),recording_operation_id:t().uuid(),proof_ready:i(!1),acknowledged_at:I.datetime()}).strict(),Di=n({action:i("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),ad=n({action:i("inspect"),recording_operation_id:t().uuid()}).strict(),$v=P("action",[Di,ad]),sd=n({recording_operation_id:t().uuid()}).strict(),ys={device_id:t().uuid(),root_id:t().uuid()},Qp=P("action",[Di.extend(ys),ad.extend(ys),sd.extend({...ys,action:i("stop")})]),Bv=Ji(Qp),Uv=n({version:i(1),recordingId:t().uuid(),proofReady:i(!1),capture:n({captureId:t().uuid(),contentType:i("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:I.datetime(),finishedAt:I.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:n({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var Xv=Di.extend({action:c(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{createHash as lh,randomUUID as dh}from"crypto";import{mkdtemp as uh,realpath as fh,rm as hd}from"fs/promises";import{tmpdir as mh}from"os";import{join as ph}from"path";import{spawn as hh}from"child_process";import{isDeepStrictEqual as gh}from"util";import{createHash as eh}from"crypto";import{execFile as th}from"child_process";import{chmod as rh,lstat as ld,mkdtemp as nh,readFile as dd,realpath as ud,rm as oh,writeFile as cd}from"fs/promises";import{tmpdir as ih}from"os";import{isAbsolute as ah,join as Mi}from"path";import{promisify as sh}from"util";var _s=sh(th),ch=(e)=>eh("sha256").update(e).digest("hex");async function Pr(e){if(!ah(e.path)||!/^[a-f0-9]{64}$/.test(e.sha256)||await ud(e.path)!==e.path)throw Error("mac_recording_encoder_unqualified");let l=await ld(e.path);if(!l.isFile()||!(l.mode&73)||l.mode&18||l.size>134217728||ch(await dd(e.path))!==e.sha256)throw Error("mac_recording_encoder_unqualified")}async function To(e,l){if(!e)return null;let v=structuredClone(e);try{await Promise.all([Pr(v.ffmpeg),Pr(v.ffprobe)])}catch{return null}return{async encode(D,M,L){if(L.aborted||!D.length||!Number.isFinite(M)||M<0.05||M>15)throw Error("mac_recording_encoding_invalid");await Promise.all([Pr(v.ffmpeg),Pr(v.ffprobe)]);let z=await ud(await nh(Mi(l??ih(),"reason-owned-recording-")));await rh(z,448);let re=Mi(z,"capture.webm"),G="frames";try{let ce=["ffconcat version 1.0"];for(let[Ee,Oe]of D.entries()){let Me=`${Ee}.jpg`;await cd(Mi(z,Me),Oe.jpeg,{mode:384,flag:"wx"});let Ce=D[Ee+1]?.timestamp??D[0].timestamp+M;ce.push(`file '${Me}'`,`duration ${Math.max(0.001,Ce-Oe.timestamp).toFixed(6)}`)}ce.push(`file '${D.length-1}.jpg'`),await cd(Mi(z,"frames.ffconcat"),ce.join(`
+}`;var td=function(e){let l=this??globalThis,v=10485760,D=(z,re)=>{if(l.location.origin!=="https://github.com")return{ok:!1,reason:"identity_mismatch"};let G=l.document.querySelector('meta[name="user-login"]')?.getAttribute("content");if(!G&&(l.location.href===z.prUrl||/^\/(?:login|session)(?:[/?]|$)/.test(l.location.pathname)))return{ok:!1,reason:"authentication_required"};if(l.location.href!==z.prUrl||!G)return{ok:!1,reason:"identity_mismatch"};if(!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(G))return{ok:!1,reason:"identity_mismatch"};let ce=l.document.querySelector('meta[name="octolytics-actor-id"]')?.getAttribute("content"),we=/^[1-9][0-9]{0,19}$/.test(ce||"")?ce:null,te={login:G,id:we};if(z.expectedActorId!==null&&we!==z.expectedActorId||z.authenticatedActor&&(G!==z.authenticatedActor.login||we!==z.authenticatedActor.id)||z.observedActor&&(G!==z.observedActor.login||we!==z.observedActor.id)||l.document.querySelector('meta[name="octolytics-dimension-repository_id"]')?.getAttribute("content")!==z.repositoryId)return{ok:!1,reason:"identity_mismatch"};let X=l.document.querySelector('link[rel="canonical"]');if(X&&X.href!==z.prUrl)return{ok:!1,reason:"identity_mismatch"};if(re){let he=l.document.querySelector("#new_comment_field"),Se=l.document.querySelector("#fc-new_comment_field"),Re=he?.closest("file-attachment"),Ee=he?.closest("form"),Oe=new l.URL(z.prUrl).pathname+"/comment";if(!he||he.value!==""||!Se||Se.type!=="file"||Se.disabled||!Re||Re.getAttribute("input")!==Se.id||Re.getAttribute("data-upload-repository-id")!==z.repositoryId||!Ee||new l.URL(Ee.action,l.location.href).origin!=="https://github.com"||new l.URL(Ee.action,l.location.href).pathname!==Oe)return{ok:!1,reason:"attachment_unavailable"};let Me=Re.getAttribute("data-upload-policy-url");if(!Me||new l.URL(Me,l.location.href).href!=="https://github.com/upload/policies/assets")return{ok:!1,reason:"attachment_unavailable"}}return{ok:!0,actor:te}};if(e.operation==="preflight")return D(e.expected,!1);if(e.operation==="identity")return D(e.expected,!0);if(e.operation==="upload"){let z=e.expected,re=D(z,!0);if(!re.ok)return{dispatched:!1,reason:re.reason};let G=l.Uint8Array.from(l.atob(e.base64||""),(X)=>X.charCodeAt(0));if(G.length!==z.sizeBytes||G.length>10485760)return{dispatched:!1,reason:"capture_invalid"};let ce=new l.File([G],z.captureId+".webm",{type:"video/webm"}),we=new l.DataTransfer;we.items.add(ce);let te=l.document.querySelector("#fc-new_comment_field");if(!te)return{dispatched:!1,reason:"attachment_unavailable"};return te.files=we.files,te.dispatchEvent(new l.Event("change",{bubbles:!0})),{dispatched:!0,actor:re.actor}}if(e.operation==="upload_result"){let z=D(e.expected,!1);if(!z.ok)throw Error("github_video_identity_changed");let re=l.document.querySelector("#new_comment_field")?.value?.trim(),G="["+e.expected.captureId+".webm](",ce=re?.startsWith(G)&&re.endsWith(")")?re.slice(G.length,-1):re;if(!ce||!/^https:\/\/github\.com\/user-attachments\/assets\/[0-9a-f-]{36}$/.test(ce))return null;return{nativeUrl:ce,actor:z.actor}}let M=e.expected,L=D(M,!1);if(!L.ok)return{status:"incomplete",reason:L.reason};return(async()=>{let z=M.nativeUrl.split("/").pop(),re=(Oe)=>{try{let Me=new l.URL(Oe,l.location.href);if(Me.protocol!=="https:"||Me.username||Me.password||Me.port||Me.hash)return!1;if(Me.origin==="https://github.com")return Me.href===M.nativeUrl;return["private-user-images.githubusercontent.com","user-images.githubusercontent.com"].includes(Me.hostname)&&new RegExp("/[0-9]+/[0-9]+-"+z+"\\.(webm|mp4)$").test(Me.pathname)}catch{return!1}},G=[...l.document.querySelectorAll('[id^="issue-"] .js-comment-body')].filter((Oe)=>/^issue-[1-9][0-9]*$/.test(Oe.closest('[id^="issue-"]')?.id||"")&&!Oe.closest("form")&&!Oe.closest(".preview-content"));if(G.length!==1)throw Error("saved_body_missing");let ce=G[0],we=[...ce.querySelectorAll("video")].filter((Oe)=>[Oe.currentSrc,Oe.src,...[...Oe.querySelectorAll("source")].map((Me)=>Me.src)].some(re));if(we.length!==1)throw Error("saved_player_missing");let te=we[0],X={muted:te.muted,volume:te.volume,rate:te.playbackRate,preload:te.preload},he=new l.AbortController,Se=l.setTimeout(()=>he.abort(),12000),Re=(Oe)=>l.Promise.race([Oe,new l.Promise((Me,Ce)=>{if(he.signal.aborted)Ce(Error("playback_timeout"));else he.signal.addEventListener("abort",()=>Ce(Error("playback_timeout")),{once:!0})})]),Ee=async(Oe)=>{while(!Oe()){if(te.error||he.signal.aborted)throw Error("playback_unverified");await new l.Promise((Me)=>l.setTimeout(Me,25))}};try{if(te.muted=!0,te.playbackRate=1,te.currentTime=0,te.readyState<2)te.preload="auto",te.load();await Ee(()=>te.readyState>=2&&te.videoWidth>0&&te.videoHeight>0);let Oe=te.currentSrc;if(!re(Oe))throw Error("source_unbound");let Me=await Re(l.fetch(Oe,{credentials:"same-origin",redirect:"error",signal:he.signal}));if(Me.status!==200||!re(Me.url)||Me.headers.get("content-range")||!/^video\/webm(?:;|$)/i.test(Me.headers.get("content-type")||"")||!Me.body)throw Error("source_unverifiable");let Ce=Me.headers.get("content-length");if(Ce!==null&&(!/^[1-9][0-9]*$/.test(Ce)||Number(Ce)!==M.sizeBytes))throw Error("source_size_mismatch");let Te=Me.body.getReader(),We=[],$e=0;try{for(;;){let Je=await Re(Te.read());if(Je.done)break;if($e+=Je.value.length,$e>10485760||$e>M.sizeBytes)throw Error("source_too_large");We.push(Je.value)}}finally{await Te.cancel().catch(()=>{}),Te.releaseLock()}if($e!==M.sizeBytes)throw Error("source_size_mismatch");let Ue=new l.Uint8Array($e),Ne=0;for(let Je of We)Ue.set(Je,Ne),Ne+=Je.length;let xe=[...new l.Uint8Array(await Re(l.crypto.subtle.digest("SHA-256",Ue)))].map((Je)=>Je.toString(16).padStart(2,"0")).join("");if(xe!==M.sha256||te.currentSrc!==Oe||!ce.contains(te))throw Error("source_changed");let Le=te.currentTime,Ge=te.getVideoPlaybackQuality().totalVideoFrames;if(await Re(te.play()),await Ee(()=>te.currentTime-Le>=0.05&&te.getVideoPlaybackQuality().totalVideoFrames>Ge),!D(M,!1).ok||te.currentSrc!==Oe||!ce.contains(te)||te.error)throw Error("player_changed");return{status:"verified",sourceSha256:xe,width:te.videoWidth,height:te.videoHeight,durationSeconds:te.duration,advancedSeconds:te.currentTime-Le,advancedFrames:te.getVideoPlaybackQuality().totalVideoFrames-Ge,playbackRestored:!0}}finally{if(l.clearTimeout(Se),he.abort(),te.pause(),te.currentTime=0,te.muted=X.muted,te.volume=X.volume,te.playbackRate=X.rate,te.preload=X.preload,!te.paused||te.currentTime!==0)throw Error("playback_restore_failed")}})()};import{execFile as Fp}from"child_process";import{lstat as jp,realpath as qp}from"fs/promises";import{join as rd,resolve as zp}from"path";import{promisify as Kp}from"util";var Vp=Kp(Fp);async function Jp(e,l){let v=await qp(e),{stdout:D}=await Vp(rd(v,"reason-browser-use"),["profiles","--connected","--json"],{timeout:5000,maxBuffer:65536,signal:l});return d(n({browser:t(),directory:t(),connected:_().optional(),source:t(),socketPath:t().optional(),instanceId:t().optional(),extensionId:t().regex(/^[a-p]{32}$/)})).max(256).parse(JSON.parse(D)).filter((L)=>L.browser==="chrome"&&L.connected===!0&&/^(Default|Profile [0-9]+)$/.test(L.directory)&&zp(L.source)===rd(v,"Reason Browser Use","manifest.json"))}async function Di(e,l,v){if(!/^(Default|Profile [0-9]+)$/.test(l))throw Error("mac_recording_profile_unavailable");let D=(await Jp(e,v)).filter((z)=>z.directory===l),M=D[0];if(D.length!==1||!M?.socketPath||!M.instanceId)throw Error("mac_recording_profile_unavailable");let L=await jp(M.socketPath);if(!L.isSocket()||L.uid!==process.getuid?.()||L.mode&63)throw Error("mac_recording_socket_invalid");return{socketPath:M.socketPath,instanceId:M.instanceId,extensionId:M.extensionId}}import{createHash as Gp}from"crypto";function jn(e){return`reason-browser-${Gp("sha256").update(`reason:mac-browser:v1:${e}`).digest("hex")}`}var od=P("ok",[n({ok:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({ok:i(!1),reason:c(["authentication_required","identity_mismatch","attachment_unavailable"])}).strict()]),id=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})}),ht=()=>Error("mac_pr_proof_browser_unavailable");async function ws(e){let l=ur.parse(e.owner),v="endpoint"in e?e.endpoint(l):await Zp(e.automationDirectory,l),D=new Map,M=`reason-pr-proof-${Yp()}`,L=!1,z=async()=>{if(L)throw ht();if(await e.assertCurrent(),L)throw ht()},re=async(we)=>{if(!Mo(l,we.owner))throw ht();await z()},G=async(we)=>{await re(we);let te=await e.readVideo(we.captureId);try{await z();let X=te.capture;if(!Mo(X.context.owner,l)||X.captureId!==we.captureId||X.context.prUrl!==we.prUrl||X.context.headSha!==we.headSha||X.media.contentType!=="video/webm"||X.media.sizeBytes!==we.sizeBytes||X.sha256!==we.sha256||te.bytes.length!==we.sizeBytes||te.bytes.length<128||te.bytes.length>10485760||te.bytes.readUInt32BE(0)!==440786851||nd("sha256").update(te.bytes).digest("hex")!==we.sha256)throw ht();return te}catch(X){throw te.bytes.fill(0),X}};async function ce(we,te,X){await z();let he=await v.discover(AbortSignal.timeout(5000)),Se=new Ci({socketPath:he.socketPath,sessionId:M,timeoutMs:5000}),Re,Ee=!1,Oe,Me=new Promise((We,$e)=>{Oe=setTimeout(()=>{Ee=!0,$e(ht())},60000)});Me.catch(()=>{});let Ce=(We)=>Promise.race([We,Me]),Te=async()=>{if(Ee)throw ht();if(await z(),Ee)throw ht()};try{await Ce(Se.connect());let We=id.parse(await Ce(Se.client.getInfo()));if(We.metadata.extensionId!==he.extensionId||We.metadata.extensionInstanceId!==he.instanceId||!We.metadata.nativeHostName)throw ht();await Te(),X?.("connected");let $e=Se.newTab();$e.then((xe)=>{if(Ee)xe.close().catch(()=>{L=!0})},()=>{}),Re=await Ce($e),await Te(),await Ce(Re.goto(we,{waitUntil:"domcontentloaded",timeoutMs:15000})),await Te(),X?.("loaded");let Ne=await Ce(te(Re,async(xe)=>{await Te();let Le=await Ce(Re.evaluate(`(${td.toString()})(${JSON.stringify(xe)})`,{awaitPromise:!0}));return await Te(),Le},Te));return await Te(),Ne}finally{Ee=!0,clearTimeout(Oe);try{if(Re){let We;try{await Promise.race([Re.close(),new Promise(($e,Ue)=>{We=setTimeout(()=>Ue(ht()),5000)})])}finally{clearTimeout(We)}}}catch{throw L=!0,ht()}finally{Se.close()}await z()}}return{async screenshot(we,te,X){let he=Bn.parse(we);if(await re(he),!Number.isSafeInteger(te)||te<1||Date.parse(he.expiresAt)<=Date.now())throw ht();X.throwIfAborted();let Se=await v.discover(X),Re=new Ci({socketPath:Se.socketPath,sessionId:v.tabScope,timeoutMs:5000}),Ee;try{await Re.connect();let Oe=id.parse(await Re.client.getInfo());if(Oe.metadata.extensionId!==Se.extensionId||Oe.metadata.extensionInstanceId!==Se.instanceId)throw ht();if(!d(n({id:o()})).max(256).parse(await Re.getTabs()).some((Te)=>Te.id===te))throw ht();await z(),X.throwIfAborted();let Ce=n({data:t().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await Re.cdp.call(te,"Page.captureScreenshot",{format:"png",fromSurface:!0,captureBeyondViewport:!1}));if(!/^[A-Za-z0-9+/]+={0,2}$/.test(Ce.data)||Ce.data.length%4)throw ht();if(Ee=Buffer.from(Ce.data,"base64"),Ee.toString("base64")!==Ce.data||Ee.length>8388608)throw ht();if(await z(),X.throwIfAborted(),Date.parse(he.expiresAt)<=Date.now())throw ht();return Ee}catch{throw Ee?.fill(0),ht()}finally{Re.close()}},async verifyImages(we){let te=xi(we);if(te.runId!==l.runId||te.media.some((X)=>X.kind!=="image"))throw ht();return ce("about:blank",async(X,he,Se)=>{let Re=X.browser.client,Ee=new Set(te.media.map((xe)=>xe.sourceUrl)),Oe=new Map,Me=new Set,Ce=!1,Te=0,We=!1,$e=new Set,Ue=(xe,Le)=>{if($e.size>=32){Ce=!0;return}let Ge=Re.executeCdp(X.id,xe,Le);$e.add(Ge),Ge.catch(()=>{Ce=!0}).finally(()=>$e.delete(Ge))},Ne=Re.onNotification((xe)=>{if(xe.method!=="onCDPEvent"||!q(xe.params)||!q(xe.params.source)||xe.params.source.tabId!==X.id||!q(xe.params.params))return;let Le=xe.params.params;if(++Te>512){Ce=!0;return}if(xe.params.method==="Fetch.requestPaused"){let Je=typeof Le.requestId==="string"&&q(Le.request)&&Le.request.method==="GET"&&typeof Le.request.url==="string"&&Ee.has(Le.request.url)&&Le.resourceType==="Image";if(typeof Le.requestId!=="string"){Ce=!0;return}if(!Je)Ce=!0;Ue(Je?"Fetch.continueRequest":"Fetch.failRequest",{requestId:Le.requestId,...Je?{}:{errorReason:"BlockedByClient"}})}if(xe.params.method==="Network.requestWillBeSent"&&Le.redirectResponse)Ce=!0;if(xe.params.method==="Network.loadingFailed")Ce=!0;if(xe.params.method==="Network.loadingFinished"&&typeof Le.requestId==="string")Me.add(Le.requestId);if(xe.params.method!=="Network.responseReceived")return;if(!q(Le.response)||typeof Le.response.url!=="string"||!Ee.has(Le.response.url)||typeof Le.requestId!=="string"||!q(Le.response.headers)||Le.type!=="Image"){Ce=!0;return}let Ge=Object.fromEntries(Object.entries(Le.response.headers).map(([Je,it])=>[Je.toLowerCase(),it])),Ve=Number(Ge["content-length"]);if(Oe.has(Le.response.url)||Le.response.status!==200||Le.response.fromServiceWorker===!0||typeof Ge["content-length"]!=="string"||!/^[1-9][0-9]*$/.test(Ge["content-length"])||!Number.isSafeInteger(Ve)||Ve>8388608||Ge["content-range"]||Ge["content-encoding"]&&Ge["content-encoding"]!=="identity"){Ce=!0;return}Oe.set(Le.response.url,{id:Le.requestId,length:Ve})});try{await Re.executeCdp(X.id,"Network.enable",{maxTotalBufferSize:67108864,maxResourceBufferSize:8388608}),await Re.executeCdp(X.id,"Network.setBypassServiceWorker",{bypass:!0}),await Re.executeCdp(X.id,"Network.setCacheDisabled",{cacheDisabled:!0}),await Re.executeCdp(X.id,"Fetch.enable",{patterns:[{urlPattern:"*",requestStage:"Request"}]});let xe=n({frameTree:n({frame:n({id:t().min(1).max(256)})})}).parse(await Re.executeCdp(X.id,"Page.getFrameTree",{})),Le=[...new Set(te.media.map((Je)=>new URL(Je.sourceUrl).origin))].join(" ");await Re.executeCdp(X.id,"Page.setDocumentContent",{frameId:xe.frameTree.frame.id,html:`<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${Le}; style-src 'none'"><body></body>`}),await Se(),We=!0;try{await Re.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!0})}catch{throw new r("mac_pr_proof_png_render_failed","mac_pr_proof_png_render_failed")}await Se();let Ge;try{Ge=await X.evaluate(`(${ed})(${JSON.stringify(te.media)})`,{awaitPromise:!0})}catch{throw new r("mac_pr_proof_png_decode_failed","mac_pr_proof_png_decode_failed")}if(await Se(),!q(Ge)||!Array.isArray(Ge.items)||Ge.items.length!==te.media.length)throw ht();await Promise.all($e);let Ve=[];for(let Je=0;Je<te.media.length;Je++){await z();let it=Oe.get(te.media[Je].sourceUrl);if(Ce||!it||!Me.has(it.id))throw ht();let Ye=n({base64Encoded:i(!0),body:t().max(Math.ceil(2796202.6666666665)*4)}).strict().parse(await Re.executeCdp(X.id,"Network.getResponseBody",{requestId:it.id})),Be=Buffer.from(Ye.body,"base64");try{let Ke=Ge.items[Je];if(Be.length!==it.length||Be.toString("base64")!==Ye.body||!q(Ke))throw ht();Ve.push({...Ke,sourceSha256:nd("sha256").update(Be).digest("hex")})}finally{Be.fill(0)}}if(Ce)throw ht();return Kl({verified:!0,items:Ve},te)}finally{if(Ne(),await Promise.allSettled($e),We)try{await Re.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}catch{throw new r("mac_pr_proof_png_render_cleanup_failed","mac_pr_proof_png_render_cleanup_failed")}}})},async preflight(we){let te=Oo.parse(we);await re(te);let X="browser_unavailable";try{return await ce(`https://github.com/${te.repositoryFullName}`,async(he,Se)=>{let Re=od.parse(await Se({operation:"preflight",expected:{...te,prUrl:`https://github.com/${te.repositoryFullName}`}}));return ms.parse(Re.ok?{...te,status:"ready",observedActor:Re.actor,checkedAt:new Date().toISOString()}:Re.reason==="attachment_unavailable"?{...te,status:"not_ready",reason:"unavailable",cause:"attachment_unavailable"}:{...te,status:"not_ready",reason:Re.reason})},(he)=>{X=he==="connected"?"github_page_unavailable":"identity_check_failed"})}catch{return ms.parse({...te,status:"not_ready",reason:"unavailable",cause:X})}},async publish(we){let te=bn.parse(we);if(await re(te),te.expectedActorId!==null&&te.authenticatedActor.id!==te.expectedActorId)throw ht();let X=D.get(te.attemptId);if(X){if(!Mo(X.binding,te))throw ht();return structuredClone(X.result)}if(D.size>=3)throw Error("proof_native_publication_limit");let he={binding:structuredClone(te),result:Un.parse({...te,status:"uncertain",reason:"upload_outcome_unknown"})};D.set(te.attemptId,he);let Se=!1,Re="dispatch";try{(await G(te)).bytes.fill(0),he.result=await ce(te.prUrl,async(Ee,Oe)=>{let Me=od.parse(await Oe({operation:"identity",expected:te}));if(!Me.ok)return Un.parse({...te,status:"not_attempted",reason:Me.reason});let Ce=await G(te),Te;try{Se=!0,Te=P("dispatched",[n({dispatched:i(!0),actor:n({login:t(),id:t().nullable()}).strict()}).strict(),n({dispatched:i(!1),reason:c(["authentication_required","identity_mismatch","attachment_unavailable","capture_invalid"])}).strict()]).parse(await Oe({operation:"upload",expected:te,base64:Ce.bytes.toString("base64")}))}finally{Ce.bytes.fill(0)}if(!Te.dispatched)return Se=!1,Un.parse({...te,status:"not_attempted",reason:Te.reason});if(!Mo(Te.actor,Me.actor))throw Re="actor_changed",ht();Re="result";let We=performance.now();while(performance.now()-We<30000){let $e=await Oe({operation:"upload_result",expected:{...te,observedActor:Me.actor}});if($e!==null){let Ue=n({nativeUrl:t(),actor:n({login:t(),id:t().nullable()}).strict()}).strict().parse($e);return Re="finalize",await z(),Un.parse({...te,status:"uploaded",nativeUrl:Ue.nativeUrl,observedActor:Ue.actor,uploadedAt:new Date().toISOString()})}await new Promise((Ue)=>setTimeout(Ue,100))}throw Re="result_timeout",ht()})}catch{if(Se)process.stderr.write(`Reason PR proof: video upload outcome unknown (stage=${Re})
+`);he.result=Un.parse({...te,...Se?{status:"uncertain",reason:"upload_outcome_unknown"}:{status:"not_attempted",reason:"capture_invalid"}})}return structuredClone(he.result)},async verify(we){let te=Do.parse(we);await re(te);try{return(await G(te)).bytes.fill(0),await ce(te.prUrl,async(X,he)=>{await X.browser.client.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!0});try{let Se=await he({operation:"saved_player",expected:te});if(!Se||typeof Se!=="object"||Array.isArray(Se))throw ht();let Re=ps.parse({...te,...Se,..."status"in Se&&Se.status==="verified"?{verifiedAt:new Date().toISOString()}:{}});if(Object.entries(te).some(([Ee,Oe])=>!Mo(Oe,Re[Ee])))throw ht();return Re}finally{await X.browser.client.executeCdp(X.id,"Emulation.setFocusEmulationEnabled",{enabled:!1})}})}catch{return ps.parse({...te,status:"incomplete",reason:"playback_unverified"})}},close(){L=!0}}}async function Zp(e,l){let v=await Xp(e);return{async discover(D){let M=await Di(v,l.profile,D);if(M.instanceId!==l.extensionInstanceId)throw ht();return M},tabScope:jn(l.runId)}}import{realpath as yh}from"fs/promises";var Hv=n({version:i(1),recording_operation_id:t().uuid(),proof_ready:i(!1),acknowledged_at:I.datetime()}).strict(),Mi=n({action:i("start"),request_id:t().uuid(),profile:t().regex(/^(Default|Profile [0-9]+)$/),tab_id:o().int().positive(),seconds:o().int().min(1).max(15)}).strict(),ad=n({action:i("inspect"),recording_operation_id:t().uuid()}).strict(),$v=P("action",[Mi,ad]),sd=n({recording_operation_id:t().uuid()}).strict(),ys={device_id:t().uuid(),root_id:t().uuid()},Qp=P("action",[Mi.extend(ys),ad.extend(ys),sd.extend({...ys,action:i("stop")})]),Bv=Xi(Qp),Uv=n({version:i(1),recordingId:t().uuid(),proofReady:i(!1),capture:n({captureId:t().uuid(),contentType:i("video/webm"),sha256:t().regex(/^[a-f0-9]{64}$/),sizeBytes:o().int().min(128).max(10485760),startedAt:I.datetime(),finishedAt:I.datetime(),durationSeconds:o().min(0.05).max(15),frameCount:o().int().min(1).max(450),receivedFrameCount:o().int().min(1).max(2000),owner:n({runId:t().uuid(),deviceId:t().uuid(),rootId:t().uuid(),rootRevision:t().max(64),profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:t().min(1).max(1024),generation:t().uuid(),browserScope:t().max(128),tabId:o().int().positive()}).strict()}).strict().refine((e)=>e.receivedFrameCount>=e.frameCount&&Math.abs((Date.parse(e.finishedAt)-Date.parse(e.startedAt))/1000-e.durationSeconds)<=0.1)}).strict();var Xv=Mi.extend({action:c(["start","inspect"]),recording_boot_generation:t().uuid(),recording_operation_id:t().uuid().optional(),recording_attempt_id:t().uuid().optional()}).strict();import{createHash as lh,randomUUID as dh}from"crypto";import{mkdtemp as uh,realpath as fh,rm as hd}from"fs/promises";import{tmpdir as mh}from"os";import{join as ph}from"path";import{spawn as hh}from"child_process";import{isDeepStrictEqual as gh}from"util";import{createHash as eh}from"crypto";import{execFile as th}from"child_process";import{chmod as rh,lstat as ld,mkdtemp as nh,readFile as dd,realpath as ud,rm as oh,writeFile as cd}from"fs/promises";import{tmpdir as ih}from"os";import{isAbsolute as ah,join as Ti}from"path";import{promisify as sh}from"util";var _s=sh(th),ch=(e)=>eh("sha256").update(e).digest("hex");async function Pr(e){if(!ah(e.path)||!/^[a-f0-9]{64}$/.test(e.sha256)||await ud(e.path)!==e.path)throw Error("mac_recording_encoder_unqualified");let l=await ld(e.path);if(!l.isFile()||!(l.mode&73)||l.mode&18||l.size>134217728||ch(await dd(e.path))!==e.sha256)throw Error("mac_recording_encoder_unqualified")}async function To(e,l){if(!e)return null;let v=structuredClone(e);try{await Promise.all([Pr(v.ffmpeg),Pr(v.ffprobe)])}catch{return null}return{async encode(D,M,L){if(L.aborted||!D.length||!Number.isFinite(M)||M<0.05||M>15)throw Error("mac_recording_encoding_invalid");await Promise.all([Pr(v.ffmpeg),Pr(v.ffprobe)]);let z=await ud(await nh(Ti(l??ih(),"reason-owned-recording-")));await rh(z,448);let re=Ti(z,"capture.webm"),G="frames";try{let ce=["ffconcat version 1.0"];for(let[Ee,Oe]of D.entries()){let Me=`${Ee}.jpg`;await cd(Ti(z,Me),Oe.jpeg,{mode:384,flag:"wx"});let Ce=D[Ee+1]?.timestamp??D[0].timestamp+M;ce.push(`file '${Me}'`,`duration ${Math.max(0.001,Ce-Oe.timestamp).toFixed(6)}`)}ce.push(`file '${D.length-1}.jpg'`),await cd(Ti(z,"frames.ffconcat"),ce.join(`
 `)+`
 `,{mode:384,flag:"wx"});let we={cwd:z,signal:L,timeout:15000,maxBuffer:16384,env:{PATH:"/usr/bin:/bin"}};G="encode",await _s(v.ffmpeg.path,["-nostdin","-hide_banner","-loglevel","error","-protocol_whitelist","file,pipe","-max_pixels","1600000","-threads","1","-f","concat","-safe","1","-i","frames.ffconcat","-t",String(M),"-an","-map_metadata","-1","-vf",`scale=trunc(iw/2)*2:trunc(ih/2)*2,tpad=stop_mode=clone:stop_duration=${M},fps=12`,"-c:v","libvpx","-deadline","realtime","-cpu-used","6","-threads","1","-b:v","1000k","-r","12","-fps_mode","cfr","-fs",String(10485760),"-f","webm",re],we),G="output";let te=await ld(re);if(!te.isFile()||te.isSymbolicLink()||te.nlink!==1||te.size<128||te.size>10485760)throw Error();G="probe";let{stdout:X}=await _s(v.ffprobe.path,["-v","error","-count_frames","-show_entries","stream=codec_type,codec_name,width,height,nb_read_frames:format=format_name,duration","-of","json",re],we),he=JSON.parse(X),Se=he.streams,Re=Number(he.format?.duration);if(G="probe_streams",!Array.isArray(Se)||Se.length!==1||Se[0]?.codec_type!=="video"||Se[0]?.codec_name!=="vp8")throw Error();if(G="probe_dimensions",!Number.isSafeInteger(Se[0].width)||Se[0].width<2||Se[0].width>1600||!Number.isSafeInteger(Se[0].height)||Se[0].height<2||Se[0].height>1000)throw Error();if(G="probe_duration",!Number.isFinite(Re)||Math.abs(Re-M)>0.25)throw Error();if(G="probe_frames",!Number.isSafeInteger(Number(Se[0].nb_read_frames))||Number(Se[0].nb_read_frames)<1)throw Error();if(G="probe_format",he.format?.format_name!=="matroska,webm")throw Error();return G="decode",await _s(v.ffmpeg.path,["-nostdin","-v","error","-xerror","-max_pixels","1600000","-threads","1","-i",re,"-f","null","-"],we),G="pin",await Promise.all([Pr(v.ffmpeg),Pr(v.ffprobe)]),await dd(re)}catch{throw Error(L.aborted?"mac_recording_cancelled":`mac_recording_encoding_${G}_failed`)}finally{await oh(z,{recursive:!0,force:!0})}}}}var md=c(["recording_failed","authority_lost","browser_timeout","cleanup_failed","no_frames","encoding_invalid","frame_invalid","timestamp_invalid","capture_bound","ack_failed","cancelled","detached","browser_changed","tab_not_owned","encoding_frames_failed","encoding_encode_failed","encoding_output_failed","encoding_probe_failed","encoding_probe_streams_failed","encoding_probe_dimensions_failed","encoding_probe_duration_failed","encoding_probe_frames_failed","encoding_probe_format_failed","encoding_decode_failed","encoding_pin_failed"]);var Ar=t().min(1).max(1024),fd=n({path:Ar,sha256:t().regex(/^[a-f0-9]{64}$/)}).strict(),pd=n({owner:n({runId:Ar,deviceId:Ar,rootId:Ar,rootRevision:Ar,profile:t().regex(/^(Default|Profile [0-9]+)$/),extensionInstanceId:Ar,generation:Ar,browserScope:Ar,tabId:o().int().positive()}).strict(),socketPath:Ar,extensionId:t().regex(/^[a-p]{32}$/),nativeHostName:Ar,seconds:o().int().min(1).max(15),encoder:n({ffmpeg:fd,ffprobe:fd}).strict()}).strict();var wh=15728640,Jr=()=>Error("mac_recording_worker_failed");function gd(e){let l=pd.parse(e.configuration),v={...e.worker},D=new Map,M=!1,L=!1,z=null,re=async()=>{},G=async(X,he=3000)=>{let Se;try{return await Promise.race([X,new Promise((Re,Ee)=>{Se=setTimeout(()=>Ee(Jr()),he)})])}finally{clearTimeout(Se)}},ce=()=>z??=G((async()=>{let he=(await Promise.allSettled([re(),e.cleanup()])).find((Se)=>Se.status==="rejected");if(he?.status==="rejected")throw he.reason})(),5000).catch((X)=>{M=!0;let he=X&&typeof X==="object"&&"code"in X?X.code:null,Se=typeof he==="string"&&["ESRCH","EPERM","EACCES","ENOTEMPTY","ENOENT","EBUSY"].includes(he)?he:"unknown";throw Error(`mac_recording_cleanup_failed:${Se}`)}),we=null,te=async()=>{if(M)throw Jr();if(await G(e.assertCurrent()),M)throw Jr()};return{async start(){if(L||we)throw Error("mac_recording_already_active");L=!0;try{await te(),await Pr({path:v.path,sha256:v.sha256}),await te(),z=null;let X=await fh(await uh(ph(mh(),"reason-recording-host-")));try{await te()}catch(Be){throw await hd(X,{recursive:!0,force:!0}),Be}let he=hh(v.path,[...v.args??[]],{detached:!0,stdio:["pipe","pipe","ignore"],env:{PATH:"/usr/bin:/bin"}}),Se=new Promise((Be)=>he.once("close",()=>Be())),Re=()=>{if(he.pid)try{process.kill(-he.pid,"SIGKILL")}catch(Be){if(Be.code!=="ESRCH")throw Be}},Ee=null;re=()=>Ee??=(async()=>{try{Re()}catch(Be){if(Be.code!=="EPERM")throw Be}await Se;try{for(let Be=0;;Be++)try{Re();break}catch(Ke){if(Ke.code!=="EPERM"||Be>=20)throw Ke;await new Promise((Fe)=>setTimeout(Fe,25))}}finally{await hd(X,{recursive:!0,force:!0})}})();let Oe="",Me=0,Ce=!1,Te=!1,We=null,$e,Ue,Ne=new Promise((Be,Ke)=>{$e=Be,Ue=Ke}),xe,Le,Ge=new Promise((Be,Ke)=>{xe=Be,Le=Ke});Ge.catch(()=>{});let Ve=(Be=Jr())=>{if(Ce)return;Ce=!0,clearTimeout(Je),clearInterval(Ye),ce().then(()=>{Ue(Be),Le(Be)},(Ke)=>{Ue(Ke),Le(Ke)})},Je=setTimeout(()=>Ve(),(l.seconds+25)*1000),it=!1,Ye=setInterval(()=>{if(it||Ce)return;it=!0,te().catch(()=>Ve()).finally(()=>{it=!1})},250);we={completion:Ge,stop:()=>{if(!Ce)he.stdin.write(`{"type":"stop"}
 `)},cancel:()=>Ve()},he.on("error",()=>Ve()),he.stdin.on("error",()=>Ve()),he.stdout.on("data",(Be)=>{if(Ce)return;if(Me+=Be.length,Me>wh){Ve();return}Oe+=Be.toString("utf8");let Ke;while((Ke=Oe.indexOf(`
 `))!==-1){let Fe=Oe.slice(0,Ke);Oe=Oe.slice(Ke+1);try{let nt=JSON.parse(Fe);if(nt.type==="failed"&&Object.keys(nt).sort().join(",")==="reason,type"){let at=md.safeParse(nt.reason);Ve(at.success?Error(`mac_recording_worker_failed:${at.data}`):Jr());return}if(nt.type==="unsupported"&&!Te){Ve(Error("mac_recording_encoder_unavailable"));return}if(nt.type==="started"&&!Te&&Object.keys(nt).length===1){Te=!0,$e({recording:!0});continue}if(!Te||nt.type!=="capture"||We||Object.keys(nt).sort().join(",")!=="bytes,capture,type")throw Jr();let Ze=nt.capture;if(!Ze||Object.keys(Ze).sort().join(",")!=="captureId,contentType,durationSeconds,finishedAt,frameCount,owner,receivedFrameCount,sha256,sizeBytes,startedAt"||typeof Ze.sha256!=="string"||typeof Ze.startedAt!=="string"||typeof Ze.finishedAt!=="string"||!gh(Ze.owner,l.owner)||Ze.contentType!=="video/webm"||!/^[a-f0-9]{64}$/.test(Ze.sha256)||!Number.isSafeInteger(Ze.sizeBytes)||Ze.sizeBytes<128||Ze.sizeBytes>10485760||!Number.isSafeInteger(Ze.frameCount)||Ze.frameCount<1||Ze.frameCount>450||!Number.isSafeInteger(Ze.receivedFrameCount)||Ze.receivedFrameCount<Ze.frameCount||Ze.receivedFrameCount>2000||!Number.isFinite(Ze.durationSeconds)||Ze.durationSeconds<0.05||Ze.durationSeconds>l.seconds||!Number.isFinite(Date.parse(Ze.startedAt))||!Number.isFinite(Date.parse(Ze.finishedAt))||Math.abs((Date.parse(Ze.finishedAt)-Date.parse(Ze.startedAt))/1000-Ze.durationSeconds)>0.1||typeof nt.bytes!=="string"||nt.bytes.length%4!==0||!/^[A-Za-z0-9+/]+={0,2}$/.test(nt.bytes))throw Jr();let He=Buffer.from(nt.bytes,"base64");if(He.length!==Ze.sizeBytes||lh("sha256").update(He).digest("hex")!==Ze.sha256||!He.subarray(0,4).equals(Buffer.from([26,69,223,163])))throw Jr();We={capture:Object.freeze({...Ze,captureId:dh(),owner:Object.freeze({...l.owner})}),bytes:He}}catch{Ve();return}}}),he.once("close",(Be)=>{if(Ce)return;if(Be!==0||!We||Oe.trim()){Ve();return}let Ke=We;te().then(async()=>{if(await re(),Ce)return;Ce=!0,clearTimeout(Je),clearInterval(Ye),D.set(Ke.capture.captureId,Ke);while(D.size>2)D.delete(D.keys().next().value);xe(Ke.capture)}).catch(()=>Ve())}),he.stdin.write(JSON.stringify({...l,scratchDirectory:X})+`
-`);try{return await Ne}catch(Be){throw we=null,Be}}finally{L=!1}},async completed(){if(await te(),!we)throw Error("mac_recording_not_active");return we.completion},async stop(){await te();let X=we;if(!X)throw Error("mac_recording_not_started");X.stop();try{return await X.completion}finally{if(we===X)we=null}},async read(X){await te();let he=D.get(X);if(!he)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(he.capture),bytes:Buffer.from(he.bytes)}},async close(){if(M)return;M=!0;let X=we;X?.cancel(),D.clear();try{await ce(),await X?.completion.catch(()=>{})}finally{we=null}}}}var wd=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});async function bs(e){await e.assertCurrent();let l;if("discover"in e)l=e.discover;else{let v=await yh(e.automationDirectory);l=(D,M)=>Ii(v,D,M)}if(await Pr({path:e.worker.path,sha256:e.worker.sha256}),!await To(e.encoder))throw Error("mac_recording_encoder_unavailable");return async(v,D,M,L)=>{L.throwIfAborted(),await e.assertCurrent();let z=await l(v,L),re=new Vr({socketPath:z.socketPath,sessionId:M,timeoutMs:2000}),G;try{if(await re.connect(),G=wd.parse(await re.getInfo()),G.metadata.extensionId!==z.extensionId||G.metadata.extensionInstanceId!==z.instanceId)throw Error("mac_recording_profile_changed");if(!d(n({id:o()})).parse(await re.getTabs()).some((we)=>we.id===D))throw Error("mac_recording_tab_not_owned");await e.assertCurrent(),L.throwIfAborted()}finally{re.close()}return{extensionInstanceId:z.instanceId,async createHost(ce,we,te){let X=new Vr({socketPath:z.socketPath,sessionId:ce.browser.browserScope,timeoutMs:2000});return gd({worker:e.worker,configuration:{owner:ce.browser,seconds:we,encoder:e.encoder,socketPath:z.socketPath,extensionId:z.extensionId,nativeHostName:G.metadata.nativeHostName},async assertCurrent(){te.throwIfAborted(),L.throwIfAborted(),await e.assertCurrent()},async cleanup(){try{await X.connect();let Se=wd.parse(await X.getInfo());if(Se.metadata.extensionInstanceId!==ce.browser.extensionInstanceId||Se.metadata.extensionId!==z.extensionId||Se.metadata.nativeHostName!==G.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await X.executeCdp(D,"Page.stopScreencast",{})}finally{X.close()}}})}}}}var Nt=()=>Error("mac_pr_proof_unavailable"),kh=n({operationId:t().uuid()}).strict();function _d(e){let l=e.qualifiedProfiles??[{profile:e.profile,extension_instance_id:e.extensionInstanceId}],v=d(n({profile:t().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:t().min(1).max(1024)}).strict()).min(1).max(16).parse(l);if(!t().uuid().safeParse(e.generation).success||new Set(v.map((X)=>X.profile)).size!==v.length)throw Nt();if(!e.qualifiedProfiles){let X=new URL(e.uploadOrigin);if(!e.resolveBrowser||X.protocol!=="https:"||X.origin!==e.uploadOrigin||X.username||X.password)throw Nt()}let D=new Map,M=new Map,L=new Map,z=!1,re=new _h,G=async(X)=>{let he=re.getStore();if(z||!X&&!he)throw Nt();if(he?.signal.throwIfAborted(),await e.assertCurrent(X??he.claim),z)throw Nt();he?.signal.throwIfAborted()},ce=(X,he)=>{let Se="owner"in he?he.owner:("context"in he)?he.context.owner:he.input.owner;if(X.capability!==us||!X.owner||Se.generation!==e.generation||!v.some((Re)=>Re.profile===Se.profile&&Re.extension_instance_id===Se.extensionInstanceId)||Se.organizationId!==X.owner.organization_id||Se.userId!==X.owner.user_id||Se.deviceId!==X.owner.device_id||Se.rootId!==X.root_id||Se.runId!==X.run_id)throw Nt();return Se},we=async(X)=>{await G();let he=JSON.stringify([X.runId,X.profile]),Se=D.get(he);if(!Se){if(D.size>=4)throw Nt();Se=(async()=>{let Ee,Oe=e.browserScope?.(X)??Fn(X.runId),Me=await e.createBrowser({owner:X,assertCurrent:()=>G(),readVideo:(Ce)=>Ee.publicationCapture(Ce)});if(Ee=Ql({owner:X,browserScope:Oe,assertCurrent:()=>G(),screenshot:Me.screenshot,async createVideo(Ce,Te,We,$e){if(!e.resolveBrowser)throw Nt();let Ue=await e.resolveBrowser(X.profile,Te,Oe,$e);if(Ue.extensionInstanceId!==X.extensionInstanceId)throw Nt();return Ue.createHost({organizationId:X.organizationId,userId:X.userId,operationId:Ce.contextId,attemptId:Ce.contextId,recordingId:Ce.contextId,browser:{runId:X.runId,deviceId:X.deviceId,rootId:X.rootId,rootRevision:X.rootRevision,generation:X.generation,profile:X.profile,extensionInstanceId:X.extensionInstanceId,browserScope:Oe,tabId:Te}},We,$e)}}),z)throw Me.close(),await Ee.close(),Nt();return{owner:structuredClone(X),browser:Me,capture:Ee,expiresAt:Date.now()+300000}})(),D.set(he,Se)}let Re=await Se;if(!yd(Re.owner,X)||Re.expiresAt<=Date.now())throw Nt();return Re},te=setInterval(()=>{for(let[X,he]of D)he.then(async(Se)=>{if(Se.expiresAt>Date.now()||[...M.values()].some((Re)=>Re.runtime===Se))return;if(Se.browser.close(),await Se.capture.close(),D.get(X)===he)D.delete(X)}).catch(()=>{z=!0})},1000);return te.unref(),{generation:e.generation,async execute(X,he,Se){return re.run({claim:X,signal:he},async()=>{let Re=hs.parse(X.payload).command,Ee=ce(X,Re);if(await G(X),he.throwIfAborted(),e.qualifiedProfiles&&!e.resolveBrowser&&(Re.action==="prepare"?Re.context.evidenceKind!=="image"||Boolean(Re.context.visualPlan)||!Re.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(Re.action)))throw Error("proof_png_only");let Oe=await we(Ee),Me=async()=>{await G(X),he.throwIfAborted()},Ce;switch(Re.action){case"auth_check":Ce=await Oe.browser.preflight(Re.input);break;case"prepare":if(Re.context.visualPlan)throw Error("proof_source_unavailable");if(e.qualifiedProfiles&&!Re.context.uploadOrigin)throw Nt();Ce=await Oe.capture.prepare(Re.context);break;case"capture_png":Ce=await Oe.capture.screenshot({claim:{operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId},signal:he});break;case"start_video":{let Te={runtime:Oe,contextId:Re.contextId,attemptId:X.attempt_id,tabId:Re.tabId,signal:he};if(M.has(X.operation_id))throw Nt();M.set(X.operation_id,Te);try{Ce=await Oe.capture.record({claim:{operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId},signal:he,seconds:Re.seconds,started:async()=>{await Me(),await Se({version:1,operationId:X.operation_id,contextId:Re.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{M.delete(X.operation_id)}break}case"inspect_capture":Ce=await Oe.capture.inspect(Re.captureId);break;case"publish_video":Ce=await Oe.browser.publish(Re.input);break;case"verify_saved_media":Ce=await Oe.browser.verify(Re.input);break;case"verify_png_media":Ce=await Oe.browser.verifyImages(Re.media);break;case"publish_png":{let Te=`${Ee.runId}:${Re.attemptId}`,We=L.get(Te);if(We){if(!yd(We.request,Re))throw Nt();Ce=We.result;break}if(L.size>=16)throw Nt();let $e=new URL(Re.uploadUrl);if($e.protocol!=="https:"||$e.username||$e.password||$e.hash||$e.pathname!==`/${Re.storagePath}`||!Re.storagePath.startsWith(`pr-screenshots/${Ee.runId}/${Re.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(Re.storagePath.split("/").at(-1))||Re.storagePath.split("/").length!==4)throw Nt();let Ue=await Oe.capture.publicationCapture(Re.captureId);try{if($e.origin!==(e.qualifiedProfiles?Ue.capture.context.uploadOrigin:e.uploadOrigin)||Ue.capture.media.contentType!=="image/png"||Ue.capture.sha256!==Re.sha256||Ue.bytes.length!==Re.sizeBytes||bh("sha256").update(Ue.bytes).digest("hex")!==Re.sha256)throw Nt();await Me();let Ne={request:structuredClone(Re),result:{status:"uncertain",sha256:Re.sha256,sizeBytes:Re.sizeBytes}};L.set(Te,Ne);try{let xe=await fetch($e,{method:"PUT",body:Ue.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([he,AbortSignal.timeout(20000)])});if(await xe.body?.cancel(),await Me(),xe.ok)Ne.result={...Ne.result,status:"uploaded"}}catch{}Ce=Ne.result}finally{Ue.bytes.fill(0)}break}}return await Me(),structuredClone(Ce)})},async control(X,he){if(X.capability!==us||he.kind!==Xl)return!1;let Se=kh.safeParse(he.payload),Re=M.get(X.operation_id);if(!Se.success||Se.data.operationId!==X.operation_id||!Re||Re.attemptId!==X.attempt_id)return!1;let Ee=hs.parse(X.payload).command;return ce(X,Ee),await G(X),await re.run({claim:X,signal:Re.signal},()=>Re.runtime.capture.stop({operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId})),!0},async close(){z=!0,clearInterval(te);let X=await Promise.allSettled([...D.values()].map(async(he)=>{let Se=await he;Se.browser.close(),await Se.capture.close()}));if(D.clear(),M.clear(),L.clear(),X.some((he)=>he.status==="rejected"))throw Nt()}}}var xh="__browser-recorder",Ih=Ah(vh),Oh="/tmp/open-browser-use",Dh=33554432,Mh=n({version:i("0.1.42"),metadata:n({extensionId:i(le),extensionInstanceId:t().min(1).max(1024)})}),kd=()=>Error("worker_pr_proof_browser_unavailable"),Ps={components:A,ensureBrowser:No,socketDirectory:Oh,async identity(e){let l=new Vr({socketPath:e,sessionId:`reason-proof-qualification-${Es()}`,timeoutMs:2000});try{return await l.connect(),await l.getInfo()}finally{l.close()}}};async function vd(e,l=Ps){let v=l.components();if(!v?.features.browser)throw kd();await l.ensureBrowser(v),e.throwIfAborted();let D=ks(Lo(v),"Default","Local Extension Settings",le),M=(await bd(D)).filter((L)=>L.endsWith(".log")||L.endsWith(".ldb")).map((L)=>ks(D,L));for(let L of(await bd(l.socketDirectory)).filter((z)=>z.endsWith(".sock"))){e.throwIfAborted();let z=ks(l.socketDirectory,L);try{let re=await Rh(z);if(!re.isSocket()||re.uid!==process.getuid?.())continue;let G=Mh.parse(await l.identity(z)).metadata.extensionInstanceId;for(let ce of M)if((await Ph(ce)).size<=Dh&&(await Sd(ce)).includes(G))return{socketPath:z,instanceId:G,extensionId:le}}catch{}}throw kd()}async function Rs(e){let l=await Eh(e);return{path:l,sha256:Sh("sha256").update(await Sd(l)).digest("hex")}}async function Rd(e={}){let l={...Ps,...e};try{let v=l.components();if(!v?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!v.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let D=await Rs(v.ffmpeg),{stdout:M}=await Ih(D.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(M))return{error:"worker_recording_libvpx_unavailable"};let L={ffmpeg:D,ffprobe:await Rs(v.ffprobe)};if(!await To(L))return{error:"worker_recording_encoder_unqualified"};let z=e.recorder??{path:process.execPath,args:[...Ch(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],xh]};return{worker:{...await Rs(z.path),args:z.args},encoder:L}}catch{return{error:"worker_recording_unqualified"}}}function Ed(e,l={}){let v={...Ps,...l},D=Es(),M=Es(),L=lo.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:D,profiles:["Default"],extension_instance_ids:[M],image:!0,video:!1,source_bound:!1}),z=e.recording?uo.parse({...L,version:3,video:!0,max_seconds:15}):L,re=(te)=>Ul(te.organizationId,te.sessionId,te.deviceId,1),G=e.recording,ce,we=_d({generation:D,qualifiedProfiles:[{profile:"Default",extension_instance_id:M}],assertCurrent:e.assertCurrent,browserScope:re,...G?{resolveBrowser:async(te,X,he,Se)=>{ce??=bs({...G,assertCurrent:()=>e.assertCurrent(),discover:(Ee,Oe)=>vd(Oe,v)}),ce.catch(()=>{ce=void 0});let Re=await(await ce)(te,X,he,Se);return{extensionInstanceId:M,createHost:async(Ee,Oe,Me)=>Th(await Re.createHost({...Ee,browser:{...Ee.browser,extensionInstanceId:Re.extensionInstanceId}},Oe,Me),M)}}}:{},createBrowser:(te)=>ws({...te,endpoint:(X)=>({discover:(he)=>vd(he,v),tabScope:re(X)})})});return{capability:z,broker:we}}function Th(e,l){let v=(D)=>({...D,owner:{...D.owner,extensionInstanceId:l}});return{start:()=>e.start(),close:()=>e.close(),completed:async()=>v(await e.completed()),stop:async()=>v(await e.stop()),read:async(D)=>{let M=await e.read(D);return{capture:v(M.capture),bytes:M.bytes}}}}import{execFile as Xh}from"child_process";import{execFile as Lh}from"child_process";import{readFile as Wh}from"fs/promises";import{join as vr}from"path";var Nh="Claude Code-credentials",Hh="/usr/bin/security",$h=120000,Bh=8192,Ti={exec:(e,l,v)=>new Promise((D)=>{Lh(e,l,{timeout:v,maxBuffer:8388608},(M,L)=>{let z=M?typeof M.code==="number"?M.code:1:0;D({code:z,stdout:String(L??"")})})}),readText:async(e)=>{try{return await Wh(e,"utf8")}catch{return null}}};function qn(e){return typeof e==="string"&&e.length>0&&e.length<=Bh?e:null}function Uh(e,l){return e.CLAUDE_CONFIG_DIR||vr(l,".claude")}function Fh(e,l){return e.CODEX_HOME||vr(l,".codex")}function Pd(e){if(!e)return null;try{let l=JSON.parse(e).claudeAiOauth,v=qn(l?.accessToken),D=qn(l?.refreshToken),M=typeof l?.expiresAt==="number"&&Number.isFinite(l.expiresAt)?l.expiresAt:null;return v&&D&&M!==null?{provider:"anthropic",access:v,refresh:D,expires:M}:null}catch{return null}}function jh(e){try{let l=JSON.parse(Buffer.from(e.split(".")[1]??"","base64url").toString("utf8"));return typeof l.exp==="number"?l.exp*1000:null}catch{return null}}function qh(e){if(!e)return null;try{let l=JSON.parse(e);if(l.auth_mode!==void 0&&l.auth_mode!=="chatgpt")return null;let v=qn(l.tokens?.access_token),D=qn(l.tokens?.refresh_token);if(!v||!D)return null;return{provider:"openai-codex",access:v,refresh:D,expires:jh(v)??Date.now()}}catch{return null}}function zh(e,l){return vr(e.XDG_DATA_HOME||vr(l,".local","share"),"opencode","auth.json")}var Kh={anthropic:"anthropic",openai:"openai-codex"};function Vh(e){return Id(e,Kh)}function Id(e,l){if(!e)return[];try{let v=JSON.parse(e),D=[];for(let[M,L]of Object.entries(l)){let z=v[M];if(z?.type!=="oauth")continue;let re=qn(z.access),G=qn(z.refresh),ce=typeof z.expires==="number"&&Number.isFinite(z.expires)?z.expires:null;if(re&&G&&ce!==null)D.push({provider:L,access:re,refresh:G,expires:ce})}return D}catch{return[]}}function Jh(e){return Id(e,{anthropic:"anthropic","openai-codex":"openai-codex"})}function Gh(e,l){let v=e.PI_CODING_AGENT_DIR;return v==="~"?l:v?.startsWith("~/")?vr(l,v.slice(2)):v||vr(l,".pi","agent")}async function Od(e,l,v=Ti){let D=[],M=await v.exec(Hh,["find-generic-password","-s",Nh,"-w"],$h),L=Date.now()+300000,z=(G)=>{if(!G)return;let ce=D.findIndex((we)=>we.provider===G.provider);if(ce<0)D.push(G);else if(D[ce].expires<=L&&G.expires>L)D[ce]=G};if(z(M.code===0?Pd(M.stdout.trim()):null),!D.some((G)=>G.provider==="anthropic"&&G.expires>L))z(Pd(await v.readText(vr(Uh(e,l),".credentials.json"))));let re=qh(await v.readText(vr(Fh(e,l),"auth.json")));z(re),z(Yh(await v.readText(vr(e.GROK_HOME||vr(l,".grok"),"auth.json"))));for(let G of Vh(await v.readText(zh(e,l))))z(G);for(let G of Jh(await v.readText(vr(Gh(e,l),"auth.json"))))z(G);return D}function Dd(e){return e.map(({provider:l,access:v,expires:D})=>({provider:l,access:v,expires:D}))}var Cd="https://auth.x.ai",Ad="b1a00492-073a-47ea-816f-4c329264a828",xd=(e)=>typeof e==="string"&&e.length>0&&e.length<=8192&&e.trim()===e;function Yh(e){if(!e)return null;try{let l=JSON.parse(e);if(!l||typeof l!=="object"||Array.isArray(l))return null;let v=l[`${Cd}::${Ad}`];if(!v||typeof v!=="object"||Array.isArray(v))return null;let D=v;if(D.auth_mode!=="oidc"||D.oidc_issuer!==Cd||D.oidc_client_id!==Ad||!xd(D.key)||!xd(D.refresh_token)||typeof D.expires_at!=="string")return null;let M=Date.parse(D.expires_at);if(!Number.isFinite(M)||M<=0)return null;return{provider:"xai",access:D.key,refresh:D.refresh_token,expires:M}}catch{return null}}var Md=330000,Zh=300000,Qh=60000;function eg(e,l,v=Date.now()){return e.filter((D)=>{if(!Number.isFinite(D.expires)||D.expires<=v+Md)return!1;let M=l.get(D.provider);return!M||M.access!==D.access||M.expires!==D.expires})}function tg(e,l=Date.now()){return[...e.values()].some((D)=>D.expires<=l+2*Md)?Qh:Zh}var rg=(e,l)=>new Promise((v)=>{if(l.aborted)return v();let D=setTimeout(M,e);function M(){clearTimeout(D),l.removeEventListener("abort",M),v()}l.addEventListener("abort",M,{once:!0})});async function Td(e){let l=new Map,v=e.wait??rg,D=e.stores??(process.platform==="darwin"?Ti:{...Ti,exec:async()=>({code:1,stdout:""})});while(!e.signal.aborted){try{let M=Dd(await Od(e.environment??process.env,e.home,D));for(let L of eg(M,l)){if(e.signal.aborted)return;let z=await e.client.localSubscription(e.state,L,AbortSignal.any([e.signal,AbortSignal.timeout(30000)]));l.set(L.provider,{access:L.access,expires:L.expires}),e.onOutcome?.({provider:L.provider,ok:z.ok,...z.ok?{}:{error:z.error}})}}catch{}await v(tg(l),e.signal)}}function Ld(e=process.env){return new Promise((l)=>{Xh("gh",["auth","status","--hostname","github.com"],{env:e,timeout:8000,maxBuffer:65536},(v)=>l(!v))})}import{execFile as ng,spawn as PR,spawnSync as CR}from"child_process";import{chmodSync as xR,existsSync as og,mkdirSync as IR,readFileSync as OR,renameSync as DR,rmSync as MR,statSync as TR,writeFileSync as LR}from"fs";import{dirname as NR,isAbsolute as HR,join as Wi}from"path";var Wd=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function Nd(e,l){if(!Wd.test(e)||!Wd.test(l))throw Error("Invalid CLI version");let v=e.split(".").map(BigInt),D=l.split(".").map(BigInt);for(let M=0;M<3;M++){if(v[M]<D[M])return-1;if(v[M]>D[M])return 1}return 0}var ig="com.reasonmachines.updater",ag=["so.ara.updater","so.reason.updater"];function sg(e){let l=e==="staging"?".staging":"";return{label:`${ig}${l}`,legacyLabels:[...ag].reverse().map((v)=>`${v}${l}`)}}function cg(e,l){return l==="darwin"?e.launchAgent:l==="win32"?e.scheduledTask:e.systemdService}function lg(e,l,v){return{launchAgent:Wi(l,"Library","LaunchAgents",`${e}.plist`),systemdService:Wi(v,"systemd","user",`${e}.service`),systemdTimer:Wi(v,"systemd","user",`${e}.timer`),scheduledTask:Wi(Oi(l),`${e}.xml`)}}function dg(e,l){return new Promise((v)=>{ng(B(e),[...l],{timeout:1e4},(D)=>{v(D?typeof D.code==="number"?D.code:1:0)})})}async function $d(e){let l=e.runtimePlatform??process.platform;if(l!=="darwin"&&l!=="linux"&&l!=="win32")return"absent";let v=e.uid??process.getuid?.();if(l!=="win32"&&(typeof v!=="number"||!Number.isSafeInteger(v)||v<=0))return"absent";let D=e.home??s(),{label:M,legacyLabels:L}=sg(e.channel),z=e.configHome??Et(D),re=[M,...L].filter((te)=>og(cg(lg(te,D,z),l)));if(re.length===0)return"absent";let G=e.command??dg,ce=re[0];if(re.length>1){for(let te of re)if((l==="darwin"?await G("/bin/launchctl",["print",`gui/${v}/${te}`]):l==="win32"?await G("schtasks",["/Query","/TN",te]):await G("systemctl",["--user","is-enabled",`${te}.timer`]))===0){ce=te;break}}return(l==="darwin"?await G("/bin/launchctl",["kickstart",`gui/${v}/${ce}`]):l==="win32"?await G("schtasks",["/Run","/TN",ce]):await G("systemctl",["--user","start","--no-block",`${ce}.service`]))===0?"started":"failed"}var Hd=60000;function Bd(e){let l=(M,L)=>{try{return Nd(M,L)>0}catch{return!1}},v=e.actedOn&&l(e.actedOn,"0.0.0")?e.actedOn:null,D=e.schedule??((M,L)=>{let z=setTimeout(M,L);z.unref?.(),e.signal.addEventListener("abort",()=>clearTimeout(z),{once:!0})});return(M)=>{if(e.signal.aborted||M===void 0||!l(M,e.currentVersion))return;if(v!==null&&!l(M,v))return;v=M;let L=(e.random??Math.random)(),z=Number.isFinite(L)?Math.min(Math.max(L,0),1):0;D(()=>{if(!e.signal.aborted)e.check(M).catch(()=>{return})},Math.min(Hd-1,Math.floor(z*Hd)))}}var ug=30000;async function Ud(e){return(e.flush??ro)(e.paths,async(l)=>{let{schema_version:v,...D}=l,M=AbortSignal.timeout(ug);try{await e.client.deviceLifecycle(e.device,D,e.signal?AbortSignal.any([e.signal,M]):M)}catch(L){if(L instanceof k&&L.status===400&&L.code==="invalid_device_lifecycle_event")return;throw L}},e.accept)}var qd=25000,fg=5000,mg=600000,pg=["display.stream.v1","pty.start"],hg=64;function Cs(e,l,v=bo(e),D){return ne(),fo(l.roots,{...v,...D?{productionProof:D}:{}})}var As=5000,gg=600000;function wg(e,l){if(e.lifetime!=="persistent"||l!=="darwin"||!process.env[ke])return null;try{return Lt({platform:l})}catch{return null}}function yg(e){return e.event.startsWith("update.")||e.event.startsWith("executor.update.")||e.event.startsWith("identity.")||e.event.startsWith("worker.")}function _g(e,l){let v=Object.keys(l).filter((D)=>l[D]!==!0).sort();try{let D=Xa();if(v.length>0)N(e,{event:"worker.capabilities_withheld",runtime_version:g,capabilities:v});if(D)N(e,{event:"identity.computer_use_unavailable",runtime_version:g,reason_code:D})}catch{}}async function Wo(e,l,v,D,M={}){if(ne(),e.executionMode==="host")kr();let L=l.worker?.expiresAt;if(!L||Date.parse(L)<=Date.now())throw Error("worker_credential_expired");let z=ft(e);if(z.revoked)throw Error("worker_revoked");let re=AbortSignal.any([...M.signal?[M.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(L)-Date.now())))]);if(!M.prestartedReadiness)M.onStartup?.("readiness_started");let G,ce=()=>G??=e.executionMode==="host"?Jt():Promise.resolve(!1),we=tc(),te=M.prestartedReadiness??Eo(e,M.readinessProbes,re,l.roots[0].permissions),X=M.deferOptionalLanes===!0,he=await(X?te.initial:te.final);if(M.signal?.aborted)throw Error("worker_start_cancelled");if(M.onStartup?.("readiness_completed"),Date.parse(L)<=Date.now())throw Error("worker_credential_expired");let Se,Re=he["github.local.v1"]===!0?(M.probeGithubSignedIn??Ld)().catch(()=>!1):null,Ee=new AbortController,Oe=null,Me=async(Xe,st)=>{let Vt=(e.userChrome??M.ownComputer===!0)&&Xe["automation.call.v1"]===!0?Oo():null;if(Vt&&"code"in Vt)process.stderr.write(`Reason worker: your own Chrome unavailable (${Vt.code})
-`);let Tt=bo(e,Xe,{displayVideo:Xe["display.stream.v1"]===!0&&await ce(),handsBrowser:Xe["hands.connect"]===!0&&we,userChrome:Vt&&"host"in Vt?Vt.host:null,...Se===void 0?{}:{githubSignedIn:Se},persistentTerminals:Xe["pty.start"]===!0&&ki(),probing:st,ownComputer:M.ownComputer===!0});if(!Oe&&Tt.worker.readiness?.["browser.pr-proof.v1"]===!0){let gr=await Rd();if(Oe||Ee.signal.aborted)return Tt;process.stderr.write("error"in gr?`Reason worker: PR video proof unavailable (${gr.error})
+`);try{return await Ne}catch(Be){throw we=null,Be}}finally{L=!1}},async completed(){if(await te(),!we)throw Error("mac_recording_not_active");return we.completion},async stop(){await te();let X=we;if(!X)throw Error("mac_recording_not_started");X.stop();try{return await X.completion}finally{if(we===X)we=null}},async read(X){await te();let he=D.get(X);if(!he)throw Error("mac_recording_capture_unavailable");return{capture:structuredClone(he.capture),bytes:Buffer.from(he.bytes)}},async close(){if(M)return;M=!0;let X=we;X?.cancel(),D.clear();try{await ce(),await X?.completion.catch(()=>{})}finally{we=null}}}}var wd=n({version:i("0.1.42"),metadata:n({extensionId:t(),extensionInstanceId:t(),nativeHostName:t()})});async function bs(e){await e.assertCurrent();let l;if("discover"in e)l=e.discover;else{let v=await yh(e.automationDirectory);l=(D,M)=>Di(v,D,M)}if(await Pr({path:e.worker.path,sha256:e.worker.sha256}),!await To(e.encoder))throw Error("mac_recording_encoder_unavailable");return async(v,D,M,L)=>{L.throwIfAborted(),await e.assertCurrent();let z=await l(v,L),re=new Vr({socketPath:z.socketPath,sessionId:M,timeoutMs:2000}),G;try{if(await re.connect(),G=wd.parse(await re.getInfo()),G.metadata.extensionId!==z.extensionId||G.metadata.extensionInstanceId!==z.instanceId)throw Error("mac_recording_profile_changed");if(!d(n({id:o()})).parse(await re.getTabs()).some((we)=>we.id===D))throw Error("mac_recording_tab_not_owned");await e.assertCurrent(),L.throwIfAborted()}finally{re.close()}return{extensionInstanceId:z.instanceId,async createHost(ce,we,te){let X=new Vr({socketPath:z.socketPath,sessionId:ce.browser.browserScope,timeoutMs:2000});return gd({worker:e.worker,configuration:{owner:ce.browser,seconds:we,encoder:e.encoder,socketPath:z.socketPath,extensionId:z.extensionId,nativeHostName:G.metadata.nativeHostName},async assertCurrent(){te.throwIfAborted(),L.throwIfAborted(),await e.assertCurrent()},async cleanup(){try{await X.connect();let Se=wd.parse(await X.getInfo());if(Se.metadata.extensionInstanceId!==ce.browser.extensionInstanceId||Se.metadata.extensionId!==z.extensionId||Se.metadata.nativeHostName!==G.metadata.nativeHostName)throw Error("mac_recording_profile_changed");await X.executeCdp(D,"Page.stopScreencast",{})}finally{X.close()}}})}}}}var Nt=()=>Error("mac_pr_proof_unavailable"),kh=n({operationId:t().uuid()}).strict();function _d(e){let l=e.qualifiedProfiles??[{profile:e.profile,extension_instance_id:e.extensionInstanceId}],v=d(n({profile:t().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:t().min(1).max(1024)}).strict()).min(1).max(16).parse(l);if(!t().uuid().safeParse(e.generation).success||new Set(v.map((X)=>X.profile)).size!==v.length)throw Nt();if(!e.qualifiedProfiles){let X=new URL(e.uploadOrigin);if(!e.resolveBrowser||X.protocol!=="https:"||X.origin!==e.uploadOrigin||X.username||X.password)throw Nt()}let D=new Map,M=new Map,L=new Map,z=!1,re=new _h,G=async(X)=>{let he=re.getStore();if(z||!X&&!he)throw Nt();if(he?.signal.throwIfAborted(),await e.assertCurrent(X??he.claim),z)throw Nt();he?.signal.throwIfAborted()},ce=(X,he)=>{let Se="owner"in he?he.owner:("context"in he)?he.context.owner:he.input.owner;if(X.capability!==us||!X.owner||Se.generation!==e.generation||!v.some((Re)=>Re.profile===Se.profile&&Re.extension_instance_id===Se.extensionInstanceId)||Se.organizationId!==X.owner.organization_id||Se.userId!==X.owner.user_id||Se.deviceId!==X.owner.device_id||Se.rootId!==X.root_id||Se.runId!==X.run_id)throw Nt();return Se},we=async(X)=>{await G();let he=JSON.stringify([X.runId,X.profile]),Se=D.get(he);if(!Se){if(D.size>=4)throw Nt();Se=(async()=>{let Ee,Oe=e.browserScope?.(X)??jn(X.runId),Me=await e.createBrowser({owner:X,assertCurrent:()=>G(),readVideo:(Ce)=>Ee.publicationCapture(Ce)});if(Ee=Ql({owner:X,browserScope:Oe,assertCurrent:()=>G(),screenshot:Me.screenshot,async createVideo(Ce,Te,We,$e){if(!e.resolveBrowser)throw Nt();let Ue=await e.resolveBrowser(X.profile,Te,Oe,$e);if(Ue.extensionInstanceId!==X.extensionInstanceId)throw Nt();return Ue.createHost({organizationId:X.organizationId,userId:X.userId,operationId:Ce.contextId,attemptId:Ce.contextId,recordingId:Ce.contextId,browser:{runId:X.runId,deviceId:X.deviceId,rootId:X.rootId,rootRevision:X.rootRevision,generation:X.generation,profile:X.profile,extensionInstanceId:X.extensionInstanceId,browserScope:Oe,tabId:Te}},We,$e)}}),z)throw Me.close(),await Ee.close(),Nt();return{owner:structuredClone(X),browser:Me,capture:Ee,expiresAt:Date.now()+300000}})(),D.set(he,Se)}let Re=await Se;if(!yd(Re.owner,X)||Re.expiresAt<=Date.now())throw Nt();return Re},te=setInterval(()=>{for(let[X,he]of D)he.then(async(Se)=>{if(Se.expiresAt>Date.now()||[...M.values()].some((Re)=>Re.runtime===Se))return;if(Se.browser.close(),await Se.capture.close(),D.get(X)===he)D.delete(X)}).catch(()=>{z=!0})},1000);return te.unref(),{generation:e.generation,async execute(X,he,Se){return re.run({claim:X,signal:he},async()=>{let Re=hs.parse(X.payload).command,Ee=ce(X,Re);if(await G(X),he.throwIfAborted(),e.qualifiedProfiles&&!e.resolveBrowser&&(Re.action==="prepare"?Re.context.evidenceKind!=="image"||Boolean(Re.context.visualPlan)||!Re.context.uploadOrigin:!["capture_png","inspect_capture","verify_png_media","publish_png"].includes(Re.action)))throw Error("proof_png_only");let Oe=await we(Ee),Me=async()=>{await G(X),he.throwIfAborted()},Ce;switch(Re.action){case"auth_check":Ce=await Oe.browser.preflight(Re.input);break;case"prepare":if(Re.context.visualPlan)throw Error("proof_source_unavailable");if(e.qualifiedProfiles&&!Re.context.uploadOrigin)throw Nt();Ce=await Oe.capture.prepare(Re.context);break;case"capture_png":Ce=await Oe.capture.screenshot({claim:{operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId},signal:he});break;case"start_video":{let Te={runtime:Oe,contextId:Re.contextId,attemptId:X.attempt_id,tabId:Re.tabId,signal:he};if(M.has(X.operation_id))throw Nt();M.set(X.operation_id,Te);try{Ce=await Oe.capture.record({claim:{operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId},signal:he,seconds:Re.seconds,started:async()=>{await Me(),await Se({version:1,operationId:X.operation_id,contextId:Re.contextId,acknowledgedAt:new Date().toISOString()})}})}finally{M.delete(X.operation_id)}break}case"inspect_capture":Ce=await Oe.capture.inspect(Re.captureId);break;case"publish_video":Ce=await Oe.browser.publish(Re.input);break;case"verify_saved_media":Ce=await Oe.browser.verify(Re.input);break;case"verify_png_media":Ce=await Oe.browser.verifyImages(Re.media);break;case"publish_png":{let Te=`${Ee.runId}:${Re.attemptId}`,We=L.get(Te);if(We){if(!yd(We.request,Re))throw Nt();Ce=We.result;break}if(L.size>=16)throw Nt();let $e=new URL(Re.uploadUrl);if($e.protocol!=="https:"||$e.username||$e.password||$e.hash||$e.pathname!==`/${Re.storagePath}`||!Re.storagePath.startsWith(`pr-screenshots/${Ee.runId}/${Re.captureId}/`)||!/^[a-zA-Z0-9._-]+\.png$/.test(Re.storagePath.split("/").at(-1))||Re.storagePath.split("/").length!==4)throw Nt();let Ue=await Oe.capture.publicationCapture(Re.captureId);try{if($e.origin!==(e.qualifiedProfiles?Ue.capture.context.uploadOrigin:e.uploadOrigin)||Ue.capture.media.contentType!=="image/png"||Ue.capture.sha256!==Re.sha256||Ue.bytes.length!==Re.sizeBytes||bh("sha256").update(Ue.bytes).digest("hex")!==Re.sha256)throw Nt();await Me();let Ne={request:structuredClone(Re),result:{status:"uncertain",sha256:Re.sha256,sizeBytes:Re.sizeBytes}};L.set(Te,Ne);try{let xe=await fetch($e,{method:"PUT",body:Ue.bytes,headers:{"Content-Type":"image/png"},redirect:"error",signal:AbortSignal.any([he,AbortSignal.timeout(20000)])});if(await xe.body?.cancel(),await Me(),xe.ok)Ne.result={...Ne.result,status:"uploaded"}}catch{}Ce=Ne.result}finally{Ue.bytes.fill(0)}break}}return await Me(),structuredClone(Ce)})},async control(X,he){if(X.capability!==us||he.kind!==Xl)return!1;let Se=kh.safeParse(he.payload),Re=M.get(X.operation_id);if(!Se.success||Se.data.operationId!==X.operation_id||!Re||Re.attemptId!==X.attempt_id)return!1;let Ee=hs.parse(X.payload).command;return ce(X,Ee),await G(X),await re.run({claim:X,signal:Re.signal},()=>Re.runtime.capture.stop({operationId:X.operation_id,attemptId:X.attempt_id,contextId:Re.contextId,tabId:Re.tabId})),!0},async close(){z=!0,clearInterval(te);let X=await Promise.allSettled([...D.values()].map(async(he)=>{let Se=await he;Se.browser.close(),await Se.capture.close()}));if(D.clear(),M.clear(),L.clear(),X.some((he)=>he.status==="rejected"))throw Nt()}}}var xh="__browser-recorder",Ih=Ah(vh),Oh="/tmp/open-browser-use",Dh=33554432,Mh=n({version:i("0.1.42"),metadata:n({extensionId:i(le),extensionInstanceId:t().min(1).max(1024)})}),kd=()=>Error("worker_pr_proof_browser_unavailable"),Ps={components:A,ensureBrowser:Lo,socketDirectory:Oh,async identity(e){let l=new Vr({socketPath:e,sessionId:`reason-proof-qualification-${Rs()}`,timeoutMs:2000});try{return await l.connect(),await l.getInfo()}finally{l.close()}}};async function vd(e,l=Ps){let v=l.components();if(!v?.features.browser)throw kd();await l.ensureBrowser(v),e.throwIfAborted();let D=ks($o(v),"Default","Local Extension Settings",le),M=(await bd(D)).filter((L)=>L.endsWith(".log")||L.endsWith(".ldb")).map((L)=>ks(D,L));for(let L of(await bd(l.socketDirectory)).filter((z)=>z.endsWith(".sock"))){e.throwIfAborted();let z=ks(l.socketDirectory,L);try{let re=await Rh(z);if(!re.isSocket()||re.uid!==process.getuid?.())continue;let G=Mh.parse(await l.identity(z)).metadata.extensionInstanceId;for(let ce of M)if((await Ph(ce)).size<=Dh&&(await Sd(ce)).includes(G))return{socketPath:z,instanceId:G,extensionId:le}}catch{}}throw kd()}async function vs(e){let l=await Eh(e);return{path:l,sha256:Sh("sha256").update(await Sd(l)).digest("hex")}}async function Rd(e={}){let l={...Ps,...e};try{let v=l.components();if(!v?.ffmpeg)return{error:"worker_recording_ffmpeg_unavailable"};if(!v.ffprobe)return{error:"worker_recording_ffprobe_unavailable"};let D=await vs(v.ffmpeg),{stdout:M}=await Ih(D.path,["-hide_banner","-encoders"],{timeout:1e4,maxBuffer:1048576,env:{PATH:"/usr/bin:/bin"}});if(!/^\s*V\S*\s+libvpx\s/m.test(M))return{error:"worker_recording_libvpx_unavailable"};let L={ffmpeg:D,ffprobe:await vs(v.ffprobe)};if(!await To(L))return{error:"worker_recording_encoder_unqualified"};let z=e.recorder??{path:process.execPath,args:[...Ch(process.execPath).startsWith("bun")&&process.argv[1]?[process.argv[1]]:[],xh]};return{worker:{...await vs(z.path),args:z.args},encoder:L}}catch{return{error:"worker_recording_unqualified"}}}function Ed(e,l={}){let v={...Ps,...l},D=Rs(),M=Rs(),L=uo.parse({version:2,ready:!0,development_only:!1,proof_ready:!1,result:"metadata_only",boot_generation:D,profiles:["Default"],extension_instance_ids:[M],image:!0,video:!1,source_bound:!1}),z=e.recording?po.parse({...L,version:3,video:!0,max_seconds:15}):L,re=(te)=>Ul(te.organizationId,te.sessionId,te.deviceId,1),G=e.recording,ce,we=_d({generation:D,qualifiedProfiles:[{profile:"Default",extension_instance_id:M}],assertCurrent:e.assertCurrent,browserScope:re,...G?{resolveBrowser:async(te,X,he,Se)=>{ce??=bs({...G,assertCurrent:()=>e.assertCurrent(),discover:(Ee,Oe)=>vd(Oe,v)}),ce.catch(()=>{ce=void 0});let Re=await(await ce)(te,X,he,Se);return{extensionInstanceId:M,createHost:async(Ee,Oe,Me)=>Th(await Re.createHost({...Ee,browser:{...Ee.browser,extensionInstanceId:Re.extensionInstanceId}},Oe,Me),M)}}}:{},createBrowser:(te)=>ws({...te,endpoint:(X)=>({discover:(he)=>vd(he,v),tabScope:re(X)})})});return{capability:z,broker:we}}function Th(e,l){let v=(D)=>({...D,owner:{...D.owner,extensionInstanceId:l}});return{start:()=>e.start(),close:()=>e.close(),completed:async()=>v(await e.completed()),stop:async()=>v(await e.stop()),read:async(D)=>{let M=await e.read(D);return{capture:v(M.capture),bytes:M.bytes}}}}import{execFile as Xh}from"child_process";import{execFile as Lh}from"child_process";import{readFile as Wh}from"fs/promises";import{join as vr}from"path";var Nh="Claude Code-credentials",Hh="/usr/bin/security",$h=120000,Bh=8192,Wi={exec:(e,l,v)=>new Promise((D)=>{Lh(e,l,{timeout:v,maxBuffer:8388608},(M,L)=>{let z=M?typeof M.code==="number"?M.code:1:0;D({code:z,stdout:String(L??"")})})}),readText:async(e)=>{try{return await Wh(e,"utf8")}catch{return null}}};function qn(e){return typeof e==="string"&&e.length>0&&e.length<=Bh?e:null}function Uh(e,l){return e.CLAUDE_CONFIG_DIR||vr(l,".claude")}function Fh(e,l){return e.CODEX_HOME||vr(l,".codex")}function Pd(e){if(!e)return null;try{let l=JSON.parse(e).claudeAiOauth,v=qn(l?.accessToken),D=qn(l?.refreshToken),M=typeof l?.expiresAt==="number"&&Number.isFinite(l.expiresAt)?l.expiresAt:null;return v&&D&&M!==null?{provider:"anthropic",access:v,refresh:D,expires:M}:null}catch{return null}}function jh(e){try{let l=JSON.parse(Buffer.from(e.split(".")[1]??"","base64url").toString("utf8"));return typeof l.exp==="number"?l.exp*1000:null}catch{return null}}function qh(e){if(!e)return null;try{let l=JSON.parse(e);if(l.auth_mode!==void 0&&l.auth_mode!=="chatgpt")return null;let v=qn(l.tokens?.access_token),D=qn(l.tokens?.refresh_token);if(!v||!D)return null;return{provider:"openai-codex",access:v,refresh:D,expires:jh(v)??Date.now()}}catch{return null}}function zh(e,l){return vr(e.XDG_DATA_HOME||vr(l,".local","share"),"opencode","auth.json")}var Kh={anthropic:"anthropic",openai:"openai-codex"};function Vh(e){return Id(e,Kh)}function Id(e,l){if(!e)return[];try{let v=JSON.parse(e),D=[];for(let[M,L]of Object.entries(l)){let z=v[M];if(z?.type!=="oauth")continue;let re=qn(z.access),G=qn(z.refresh),ce=typeof z.expires==="number"&&Number.isFinite(z.expires)?z.expires:null;if(re&&G&&ce!==null)D.push({provider:L,access:re,refresh:G,expires:ce})}return D}catch{return[]}}function Jh(e){return Id(e,{anthropic:"anthropic","openai-codex":"openai-codex"})}function Gh(e,l){let v=e.PI_CODING_AGENT_DIR;return v==="~"?l:v?.startsWith("~/")?vr(l,v.slice(2)):v||vr(l,".pi","agent")}async function Od(e,l,v=Wi){let D=[],M=await v.exec(Hh,["find-generic-password","-s",Nh,"-w"],$h),L=Date.now()+300000,z=(G)=>{if(!G)return;let ce=D.findIndex((we)=>we.provider===G.provider);if(ce<0)D.push(G);else if(D[ce].expires<=L&&G.expires>L)D[ce]=G};if(z(M.code===0?Pd(M.stdout.trim()):null),!D.some((G)=>G.provider==="anthropic"&&G.expires>L))z(Pd(await v.readText(vr(Uh(e,l),".credentials.json"))));let re=qh(await v.readText(vr(Fh(e,l),"auth.json")));z(re),z(Yh(await v.readText(vr(e.GROK_HOME||vr(l,".grok"),"auth.json"))));for(let G of Vh(await v.readText(zh(e,l))))z(G);for(let G of Jh(await v.readText(vr(Gh(e,l),"auth.json"))))z(G);return D}function Dd(e){return e.map(({provider:l,access:v,expires:D})=>({provider:l,access:v,expires:D}))}var Cd="https://auth.x.ai",Ad="b1a00492-073a-47ea-816f-4c329264a828",xd=(e)=>typeof e==="string"&&e.length>0&&e.length<=8192&&e.trim()===e;function Yh(e){if(!e)return null;try{let l=JSON.parse(e);if(!l||typeof l!=="object"||Array.isArray(l))return null;let v=l[`${Cd}::${Ad}`];if(!v||typeof v!=="object"||Array.isArray(v))return null;let D=v;if(D.auth_mode!=="oidc"||D.oidc_issuer!==Cd||D.oidc_client_id!==Ad||!xd(D.key)||!xd(D.refresh_token)||typeof D.expires_at!=="string")return null;let M=Date.parse(D.expires_at);if(!Number.isFinite(M)||M<=0)return null;return{provider:"xai",access:D.key,refresh:D.refresh_token,expires:M}}catch{return null}}var Md=330000,Zh=300000,Qh=60000;function eg(e,l,v=Date.now()){return e.filter((D)=>{if(!Number.isFinite(D.expires)||D.expires<=v+Md)return!1;let M=l.get(D.provider);return!M||M.access!==D.access||M.expires!==D.expires})}function tg(e,l=Date.now()){return[...e.values()].some((D)=>D.expires<=l+2*Md)?Qh:Zh}var rg=(e,l)=>new Promise((v)=>{if(l.aborted)return v();let D=setTimeout(M,e);function M(){clearTimeout(D),l.removeEventListener("abort",M),v()}l.addEventListener("abort",M,{once:!0})});async function Td(e){let l=new Map,v=e.wait??rg,D=e.stores??(process.platform==="darwin"?Wi:{...Wi,exec:async()=>({code:1,stdout:""})});while(!e.signal.aborted){try{let M=Dd(await Od(e.environment??process.env,e.home,D));for(let L of eg(M,l)){if(e.signal.aborted)return;let z=await e.client.localSubscription(e.state,L,AbortSignal.any([e.signal,AbortSignal.timeout(30000)]));l.set(L.provider,{access:L.access,expires:L.expires}),e.onOutcome?.({provider:L.provider,ok:z.ok,...z.ok?{}:{error:z.error}})}}catch{}await v(tg(l),e.signal)}}function Ld(e=process.env){return new Promise((l)=>{Xh("gh",["auth","status","--hostname","github.com"],{env:e,timeout:8000,maxBuffer:65536},(v)=>l(!v))})}import{execFile as ng,spawn as PR,spawnSync as CR}from"child_process";import{chmodSync as xR,existsSync as og,mkdirSync as IR,readFileSync as OR,renameSync as DR,rmSync as MR,statSync as TR,writeFileSync as LR}from"fs";import{dirname as NR,isAbsolute as HR,join as Hi}from"path";var Wd=/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;function Nd(e,l){if(!Wd.test(e)||!Wd.test(l))throw Error("Invalid CLI version");let v=e.split(".").map(BigInt),D=l.split(".").map(BigInt);for(let M=0;M<3;M++){if(v[M]<D[M])return-1;if(v[M]>D[M])return 1}return 0}var ig="com.reasonmachines.updater",ag=["so.ara.updater","so.reason.updater"];function sg(e){let l=e==="staging"?".staging":"";return{label:`${ig}${l}`,legacyLabels:[...ag].reverse().map((v)=>`${v}${l}`)}}function cg(e,l){return l==="darwin"?e.launchAgent:l==="win32"?e.scheduledTask:e.systemdService}function lg(e,l,v){return{launchAgent:Hi(l,"Library","LaunchAgents",`${e}.plist`),systemdService:Hi(v,"systemd","user",`${e}.service`),systemdTimer:Hi(v,"systemd","user",`${e}.timer`),scheduledTask:Hi(Ni(l),`${e}.xml`)}}function dg(e,l){return new Promise((v)=>{ng(B(e),[...l],{timeout:1e4},(D)=>{v(D?typeof D.code==="number"?D.code:1:0)})})}async function $d(e){let l=e.runtimePlatform??process.platform;if(l!=="darwin"&&l!=="linux"&&l!=="win32")return"absent";let v=e.uid??process.getuid?.();if(l!=="win32"&&(typeof v!=="number"||!Number.isSafeInteger(v)||v<=0))return"absent";let D=e.home??s(),{label:M,legacyLabels:L}=sg(e.channel),z=e.configHome??Et(D),re=[M,...L].filter((te)=>og(cg(lg(te,D,z),l)));if(re.length===0)return"absent";let G=e.command??dg,ce=re[0];if(re.length>1){for(let te of re)if((l==="darwin"?await G("/bin/launchctl",["print",`gui/${v}/${te}`]):l==="win32"?await G("schtasks",["/Query","/TN",te]):await G("systemctl",["--user","is-enabled",`${te}.timer`]))===0){ce=te;break}}return(l==="darwin"?await G("/bin/launchctl",["kickstart",`gui/${v}/${ce}`]):l==="win32"?await G("schtasks",["/Run","/TN",ce]):await G("systemctl",["--user","start","--no-block",`${ce}.service`]))===0?"started":"failed"}var Hd=60000;function Bd(e){let l=(M,L)=>{try{return Nd(M,L)>0}catch{return!1}},v=e.actedOn&&l(e.actedOn,"0.0.0")?e.actedOn:null,D=e.schedule??((M,L)=>{let z=setTimeout(M,L);z.unref?.(),e.signal.addEventListener("abort",()=>clearTimeout(z),{once:!0})});return(M)=>{if(e.signal.aborted||M===void 0||!l(M,e.currentVersion))return;if(v!==null&&!l(M,v))return;v=M;let L=(e.random??Math.random)(),z=Number.isFinite(L)?Math.min(Math.max(L,0),1):0;D(()=>{if(!e.signal.aborted)e.check(M).catch(()=>{return})},Math.min(Hd-1,Math.floor(z*Hd)))}}var ug=30000;async function Ud(e){return(e.flush??no)(e.paths,async(l)=>{let{schema_version:v,...D}=l,M=AbortSignal.timeout(ug);try{await e.client.deviceLifecycle(e.device,D,e.signal?AbortSignal.any([e.signal,M]):M)}catch(L){if(L instanceof k&&L.status===400&&L.code==="invalid_device_lifecycle_event")return;throw L}},e.accept)}var qd=25000,fg=5000,mg=600000,pg=["display.stream.v1","pty.start"],hg=64;function Cs(e,l,v=vo(e),D){return ne(),mo(l.roots,{...v,...D?{productionProof:D}:{}})}var As=5000,gg=600000;function wg(e,l){if(e.lifetime!=="persistent"||l!=="darwin"||!process.env[ke])return null;try{return Lt({platform:l})}catch{return null}}function yg(e){return e.event.startsWith("update.")||e.event.startsWith("executor.update.")||e.event.startsWith("identity.")||e.event.startsWith("worker.")}function _g(e,l){let v=Object.keys(l).filter((D)=>l[D]!==!0).sort();try{let D=Za();if(v.length>0)N(e,{event:"worker.capabilities_withheld",runtime_version:g,capabilities:v});if(D)N(e,{event:"identity.computer_use_unavailable",runtime_version:g,reason_code:D})}catch{}}async function Wo(e,l,v,D,M={}){if(ne(),e.executionMode==="host")kr();let L=l.worker?.expiresAt;if(!L||Date.parse(L)<=Date.now())throw Error("worker_credential_expired");let z=ft(e);if(z.revoked)throw Error("worker_revoked");let re=AbortSignal.any([...M.signal?[M.signal]:[],AbortSignal.timeout(Math.max(1,Math.min(15000,Date.parse(L)-Date.now())))]);if(!M.prestartedReadiness)M.onStartup?.("readiness_started");let G,ce=()=>G??=e.executionMode==="host"?Jt():Promise.resolve(!1),we=rc(),te=M.prestartedReadiness??xo(e,M.readinessProbes,re,l.roots[0].permissions),X=M.deferOptionalLanes===!0,he=await(X?te.initial:te.final);if(M.signal?.aborted)throw Error("worker_start_cancelled");if(M.onStartup?.("readiness_completed"),Date.parse(L)<=Date.now())throw Error("worker_credential_expired");let Se,Re=he["github.local.v1"]===!0?(M.probeGithubSignedIn??Ld)().catch(()=>!1):null,Ee=new AbortController,Oe=null,Me=async(Xe,st)=>{let Vt=(e.userChrome??M.ownComputer===!0)&&Xe["automation.call.v1"]===!0?No():null;if(Vt&&"code"in Vt)process.stderr.write(`Reason worker: your own Chrome unavailable (${Vt.code})
+`);let Tt=vo(e,Xe,{displayVideo:Xe["display.stream.v1"]===!0&&await ce(),handsBrowser:Xe["hands.connect"]===!0&&we,userChrome:Vt&&"host"in Vt?Vt.host:null,...Se===void 0?{}:{githubSignedIn:Se},persistentTerminals:Xe["pty.start"]===!0&&Ri(),probing:st,ownComputer:M.ownComputer===!0});if(!Oe&&Tt.worker.readiness?.["browser.pr-proof.v1"]===!0){let gr=await Rd();if(Oe||Ee.signal.aborted)return Tt;process.stderr.write("error"in gr?`Reason worker: PR video proof unavailable (${gr.error})
 `:`Reason worker: PR video proof ready (ffmpeg ${gr.encoder.ffmpeg.path})
-`),Oe=Ed({assertCurrent:async()=>{if(!Ye())throw Error("proof_authority_lost")},...!("error"in gr)?{recording:gr}:{}})}return Tt},Ce=await Me(he,X?rs.filter((Xe)=>he[Xe]!==!0):[]),Te=Cs(e,l,Ce,Oe?.capability);M.onStartup?.("inventory_completed");let We=!1,$e=0,Ue=0,Ne="starting",xe=null,Le=!1,Ge=!1,Ve=null,Je,it=()=>!z.drained&&Date.parse(L)>Date.now()&&Te.supported_operations.some((Xe)=>Ce.worker.readiness?.[Xe]===!0),Ye=()=>!We&&it(),Be=null,Ke=()=>$e+(Be?.claims()??0),Fe=null,nt=new Set,Ze=(Xe)=>{let st=Xe.capabilities.root_paths;if(Object.assign(Xe.capabilities,Cs(Xe.config,Xe.state,Ce,Oe?.capability)),st)Xe.capabilities.root_paths=st},He=(Xe)=>{Ce=Xe,Ze({config:e,state:l,capabilities:Te}),Fe?.();for(let st of nt)Ze(st),st.heartbeatNow?.()},at=new Set,lt=new Set,kt=setInterval(()=>{let Xe=new Set;for(let st of[{state:l,capabilities:Te},...nt])for(let Ct of pg){if(st.capabilities.operation_constraints?.[Ct]?.probing!==!0)continue;let Tt=`${st.state.deviceId} ${Ct}`;if(Xe.add(Tt),!at.has(Tt)||lt.has(Tt))continue;lt.add(Tt),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:st.state.deviceId,lane:Ct,login_device:st.state===l,timestamp:new Date().toISOString()})}
-`)}at.clear();for(let st of Xe)at.add(st)},mg);kt.unref();let jt=(Xe)=>{if(!M.readinessProbes)Tl({config:e,readiness:Xe,signal:Ee.signal,idle:()=>Ke()===0,permissions:l.roots[0].permissions,onReady:(st)=>{Me(st,[]).then(He)}})},Kt=X?te.final.then(async(Xe)=>{if(Ee.signal.aborted)return;He(await Me(Xe,[]));let st=rs.filter((Ct)=>Xe[Ct]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${st.length?`ready: ${st.join(", ")}`:"none ready"}).
-`),jt(Xe)},()=>{}):Promise.resolve();if(!X)jt(he);Re?.then(async(Xe)=>{Se=Xe;for(;;){let st=Ce,Ct=await Me(st.worker.readiness??{},st.worker.probing??[]);if(Ee.signal.aborted)return;if(Ce!==st)continue;He(Ct);return}});let pr=X&&Ce.worker.probing?.includes("pty.start")?te.pty.then(async(Xe)=>{let st=()=>Ce.worker.probing?.includes("pty.start")===!0;if(Ee.signal.aborted||!st())return;let Ct=await Me({...Ce.worker.readiness,"pty.start":Xe},(Ce.worker.probing??[]).filter((Vt)=>Vt!=="pty.start"));if(Ee.signal.aborted||!st())return;He(Ct)},()=>{}):Promise.resolve(),Xr=()=>({version:1,instanceId:D,deviceId:l.deviceId,phase:Ne,drained:z.drained||We||Le,activeClaims:Ke(),activeSessions:Ue,lastHeartbeat:xe,expiresAt:L,supportedOperations:[...Te.supported_operations],capabilityReadiness:Ce.worker.readiness,executionEligible:Ye()&&!Le&&Ne==="running"}),Rn=!1,Lr=()=>{Rn=!0,xr()},xr=()=>{if(We)return;if(We=!0,Ne="stopping",Ve?.close(),Ke()===0)Ee.abort();else Je=setTimeout(()=>Ee.abort(),e.shutdownGraceMs)},an=e.channel==="production"||e.channel==="staging"?e.channel:null,Ir=f(e).releaseCheck,er=M.publishedRelease??(an&&e.lifetime==="persistent"?Bd({currentVersion:g,signal:Ee.signal,actedOn:(()=>{try{let Xe=JSON.parse(m(Ir));return typeof Xe==="string"?Xe:null}catch{return null}})(),check:async(Xe)=>{try{y(Ir,Xe)}catch{}let st=await $d({channel:an});process.stderr.write(st==="started"?`Reason worker: CLI ${Xe} is published; the updater is checking now.
+`),Oe=Ed({assertCurrent:async()=>{if(!Ye())throw Error("proof_authority_lost")},...!("error"in gr)?{recording:gr}:{}})}return Tt},Ce=await Me(he,X?es.filter((Xe)=>he[Xe]!==!0):[]),Te=Cs(e,l,Ce,Oe?.capability);M.onStartup?.("inventory_completed");let We=!1,$e=0,Ue=0,Ne="starting",xe=null,Le=!1,Ge=!1,Ve=null,Je,it=()=>!z.drained&&Date.parse(L)>Date.now()&&Te.supported_operations.some((Xe)=>Ce.worker.readiness?.[Xe]===!0),Ye=()=>!We&&it(),Be=null,Ke=()=>$e+(Be?.claims()??0),Fe=null,nt=new Set,Ze=(Xe)=>{let st=Xe.capabilities.root_paths;if(Object.assign(Xe.capabilities,Cs(Xe.config,Xe.state,Ce,Oe?.capability)),st)Xe.capabilities.root_paths=st},He=(Xe)=>{Ce=Xe,Ze({config:e,state:l,capabilities:Te}),Fe?.();for(let st of nt)Ze(st),st.heartbeatNow?.()},at=new Set,lt=new Set,kt=setInterval(()=>{let Xe=new Set;for(let st of[{state:l,capabilities:Te},...nt])for(let Ct of pg){if(st.capabilities.operation_constraints?.[Ct]?.probing!==!0)continue;let Tt=`${st.state.deviceId} ${Ct}`;if(Xe.add(Tt),!at.has(Tt)||lt.has(Tt))continue;lt.add(Tt),process.stderr.write(`${JSON.stringify({event:"worker.readiness_probing_stale",device_id:st.state.deviceId,lane:Ct,login_device:st.state===l,timestamp:new Date().toISOString()})}
+`)}at.clear();for(let st of Xe)at.add(st)},mg);kt.unref();let jt=(Xe)=>{if(!M.readinessProbes)Tl({config:e,readiness:Xe,signal:Ee.signal,idle:()=>Ke()===0,permissions:l.roots[0].permissions,onReady:(st)=>{Me(st,[]).then(He)}})},Kt=X?te.final.then(async(Xe)=>{if(Ee.signal.aborted)return;He(await Me(Xe,[]));let st=es.filter((Ct)=>Xe[Ct]===!0);process.stderr.write(`Reason worker: deferred lanes decided (${st.length?`ready: ${st.join(", ")}`:"none ready"}).
+`),jt(Xe)},()=>{}):Promise.resolve();if(!X)jt(he);Re?.then(async(Xe)=>{Se=Xe;for(;;){let st=Ce,Ct=await Me(st.worker.readiness??{},st.worker.probing??[]);if(Ee.signal.aborted)return;if(Ce!==st)continue;He(Ct);return}});let pr=X&&Ce.worker.probing?.includes("pty.start")?te.pty.then(async(Xe)=>{let st=()=>Ce.worker.probing?.includes("pty.start")===!0;if(Ee.signal.aborted||!st())return;let Ct=await Me({...Ce.worker.readiness,"pty.start":Xe},(Ce.worker.probing??[]).filter((Vt)=>Vt!=="pty.start"));if(Ee.signal.aborted||!st())return;He(Ct)},()=>{}):Promise.resolve(),Xr=()=>({version:1,instanceId:D,deviceId:l.deviceId,phase:Ne,drained:z.drained||We||Le,activeClaims:Ke(),activeSessions:Ue,lastHeartbeat:xe,expiresAt:L,supportedOperations:[...Te.supported_operations],capabilityReadiness:Ce.worker.readiness,executionEligible:Ye()&&!Le&&Ne==="running"}),In=!1,Lr=()=>{In=!0,xr()},xr=()=>{if(We)return;if(We=!0,Ne="stopping",Ve?.close(),Ke()===0)Ee.abort();else Je=setTimeout(()=>Ee.abort(),e.shutdownGraceMs)},sn=e.channel==="production"||e.channel==="staging"?e.channel:null,Ir=f(e).releaseCheck,er=M.publishedRelease??(sn&&e.lifetime==="persistent"?Bd({currentVersion:g,signal:Ee.signal,actedOn:(()=>{try{let Xe=JSON.parse(m(Ir));return typeof Xe==="string"?Xe:null}catch{return null}})(),check:async(Xe)=>{try{y(Ir,Xe)}catch{}let st=await $d({channel:sn});process.stderr.write(st==="started"?`Reason worker: CLI ${Xe} is published; the updater is checking now.
 `:st==="absent"?`Reason worker: CLI ${Xe} is published; no updater is installed for it here.
 `:`Reason worker: CLI ${Xe} is published; the updater did not start, so its next scheduled check takes it.
-`)}}):void 0),In=(Xe)=>{if(Xe==="stop")Lr();if(Xe==="reload_roots"){let st=S(e);if(!st||st.deviceId!==l.deviceId)throw Error("worker_identity_changed");l.roots=st.roots;let Ct=Kn(l.roots,jd());if(Ct)Te.root_paths=Ct;else delete Te.root_paths;Be?.check()}if(Xe==="drain"||Xe==="resume"){if(We||Date.parse(L)<=Date.now())throw Error("worker_stopping_or_expired");z={...z,drained:Xe==="drain"},qt(e,z)}return Xr()};M.prestartedControl?.handle(In);let jo=M.prestartedControl?await M.prestartedControl.closed:await fi(e,D,In),sn,tt=!1,yt=()=>{let Xe=Date.parse(L)-Date.now();if(Xe>0){sn=setTimeout(yt,Math.min(Xe,2147483647));return}We=!0,Ve?.close(),tt=!0,Ne="stopping",Ee.abort(Error("worker_credential_expired"))};yt(),M.signal?.addEventListener("abort",xr,{once:!0});let Wr=M.processSignals!==!1;if(Wr)process.once("SIGTERM",xr),process.once("SIGINT",Lr);if(M.signal?.aborted)xr();try{M.onStartup?.("control_ready");let Xe=M.client??new ar(ye(e.apiOrigin),oe(e.proxy,zd()),v,{deviceSession:$a({proxied:Boolean(e.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),st=!Pe(e.executionMode==="host")?"not_root_host":!J()?"no_jobs_user":vo(),Ct={event_id:Fd(),event:"worker.model_jobs_egress",occurred_at:new Date().toISOString(),runtime_version:g,reason_code:st==="active"?"gid_v1":st};process.stderr.write(`${JSON.stringify({...Ct,device_id:l.deviceId})}
-`);let Vt=!0,Tt=!1,gr=0,vt=()=>{if(!Xe.deviceLifecycle||!Vt||Tt||Ee.signal.aborted||Date.now()<gr)return;Tt=!0,gr=Date.now()+30000,Xe.deviceLifecycle(l,Ct,AbortSignal.any([Ee.signal,AbortSignal.timeout(As)])).then(()=>{Vt=!1},()=>{}).finally(()=>{Tt=!1})};vt();let rr=f(e).daemon,At=oa(e,l.deviceId),Sr=M.startupTiming,$r=Sr?()=>({...Sr(),...At?.enrollmentMs!==void 0?{enrollment_ms:At.enrollmentMs}:{}}):void 0,cn=(ot)=>{let wr=ot.client.localSubscription?.bind(ot.client);if(e.localLogins===!0&&wr)(M.handOverLocalLogins??Td)({state:ot.state,client:{localSubscription:wr},signal:ot.signal,home:s()}).catch(()=>{return});let It=jd(),Yt=ot.client.liveSessionWorktrees?.bind(ot.client);if(Yt)ec(()=>Qa({home:It,deviceId:ot.state.deviceId,liveIds:(Ur)=>Yt(ot.state,Ur,ot.signal)}),ot.signal)};cn({state:l,client:Xe,signal:Ee.signal});let Br=wg(e,M.platform??process.platform),Ft=Xe.deviceLifecycle?.bind(Xe),Gt=Promise.resolve(),Qn=0,qo=()=>{if(!Br||!Ft||We||Date.now()<Qn)return;Qn=Date.now()+gg,Gt=Gt.then(()=>Ud({paths:Br,device:l,client:{deviceLifecycle:Ft},accept:yg,signal:Ee.signal})).catch(()=>{return})};if(qo(),Br)te.final.then((ot)=>_g(Br,ot),()=>{});let Js=(ot,wr)=>({state:ot.state,client:ot.client,...ot.firstHeartbeat?{firstHeartbeat:ot.firstHeartbeat}:{},runtimeVersion:g,bridgeVersion:g,protocolVersion:2,capabilities:ot.capabilities,signal:ot.signal,statusPath:ot.statusPath,maxConcurrentClaims:M.ownComputer===!0?hg:4*e.slots+ja,heartbeatIntervalMs:M.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:qd,operationCompletionTimeoutMs:qd,maxConsecutiveHeartbeatFailures:3,claimable:Ye,advertised:it,onClaim:async(It,Yt,Ur)=>{let io=Date.now();if(!ot.capabilities.supported_operations.includes(It.capability))return{status:"failed",error_code:"unsupported_capability"};let yr=Ce.worker.probing??[],Qs=yr.includes(It.capability)?Kt:It.capability==="hands.connect"&&e.executionMode==="host"&&yr.includes("pty.start")?pr:null;if(Qs){let Vo,ta=()=>{};await Promise.race([Qs,new Promise((rc)=>{Vo=setTimeout(rc,fg),ta=()=>rc(),Yt.addEventListener("abort",ta,{once:!0})})]),clearTimeout(Vo),Yt.removeEventListener("abort",ta)}let Ko=It.capability==="hands.connect",ea=Ko?Ve:null,Ju={signal:Yt,emit:Ur,...Ce,...Oe?{proveMac:Oe.broker.execute}:{},...It.capability==="inference.custom.v1"&&ot.client.operationCustomEndpointCredential?{customEndpointCredential:(Vo)=>ot.client.operationCustomEndpointCredential(ot.state,It,Vo)}:{},...Ko?{handsLaunch:{claimedAtMs:io,...ea?{takePrespawnedWorker:ea.take,adoptSpawnedWorker:ea.adopt}:{}}}:{}};if(Ko)Ue+=1;try{return await(M.execute??Jn)(ot.state,It,Ju)}finally{if(Ko)Ue-=1}},onControl:async(It,Yt)=>await mo(ot.state,It,Yt,ot.client)||await go(ot.state,It,Yt)||await wo(It,Yt)||await Oe?.broker.control(It,Yt)||!1,onEvent:wr}),Gs=async(ot)=>{await ot.client.deviceLifecycle?.(ot.state,{event_id:Fd(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:g,reason_code:"worker_stopped"},AbortSignal.timeout(As)).catch(()=>{return})},oo=e.lifetime==="persistent"?M.ownerWorkspaces:void 0,zo=oo?.intervalMs??ma,Ys=Xe.ownerWorkspaces?.bind(Xe),Zs=Xe.ownerWorkspaceEnrollment?.bind(Xe);if(oo&&Ys&&Zs)Be=Cc({config:e,state:l,signal:Ee.signal,client:{ownerWorkspaces:Ys,ownerWorkspaceEnrollment:Zs},...oo.enroll?{enroll:oo.enroll}:{},intervalMs:zo,log:(ot)=>{process.stderr.write(ot)},serve:async(ot,wr,It)=>{let Yt=oa(ot.config,ot.state.deviceId),Ur={config:ot.config,state:ot.state,signal:wr,statusPath:f(ot.config).daemon,...Yt?.offer?{firstHeartbeat:Yt.offer}:{},capabilities:Cs(ot.config,ot.state,Ce,Oe?.capability),client:oo.client?.(ot)??new ar(ye(e.apiOrigin),oe(e.proxy,zd()),ot.proofStore,{deviceSession:$a({proxied:Boolean(e.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};cn(Ur);let io={...Ur,heartbeatNow:null};nt.add(io);try{await Fa({registerHeartbeatNow:(yr)=>{io.heartbeatNow=yr},...Js(Ur,(yr)=>{if(yr.type==="completed")ei(yr.operationId,yr.status);if(yr.type==="claims_changed"){if(It(yr.activeClaims),We&&Ke()===0)Ee.abort()}if(yr.type==="stopped")It(0)})})}finally{nt.delete(io)}if(We&&!tt)await Gs(Ur)}});let Yi=0,Zi=0;if(await Fa({...(M.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>Ke()>0?nr(rr):void 0,...M.acquireAwakeHold?{acquireAwakeHold:M.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(ot)=>{Fe=ot},...$r?{startup:$r}:{},...Js({state:l,client:Xe,capabilities:Te,signal:Ee.signal,statusPath:rr,...At?.offer?{firstHeartbeat:At.offer}:{}},(ot)=>{if(ot.type==="completed")ei(ot.operationId,ot.status);if(ot.type==="claims_changed"){if($e=ot.activeClaims,We&&Ke()===0)Ee.abort()}if(ot.type==="heartbeat"&&!We){if(ot.handsPrespawn&&e.lifetime==="ephemeral"&&!Ve)Ve=nn({log:(wr,It)=>{process.stderr.write(`${JSON.stringify({event:wr,...It})}
-`)}}),Ve.arm(),setTimeout(ic,0);else if(!ot.handsPrespawn&&Ve)Ve.close(),Ve=null}if(ot.type==="heartbeat"){if(Be&&!We&&Date.now()>=Yi)Yi=Date.now()+zo,Be.check().then((wr)=>{Zi=wr?0:Zi+1,Yi=Date.now()+(wr?zo:Math.min(zo,kc*2**Math.min(Zi-1,10)))});if(xe=ot.serverTime,Le=ot.drain,vt(),qo(),!We&&an)er?.(ot.latestCliVersions?.[an]);if(!We)Ne="running";if(!We&&!Ge&&Xr().executionEligible){if(Ge=!0,M.onStartup?.("ready"),(M.platform??process.platform)==="darwin")setTimeout(()=>{try{Hi({skipWhenSettled:!0})}catch{}},0)}}if(ot.type==="reconnecting"&&!We)Ne="reconnecting";if(ot.type==="stopped")$e=0;M.onEvent?.(ot)})}),await Be?.settled(),We&&!tt&&e.lifetime==="ephemeral")await Xe.disconnect?.(l,AbortSignal.timeout(As)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
-`)});else if(We&&!tt)await Gs({state:l,client:Xe});if(Rn)await ya().catch(()=>{return})}catch(Xe){if(!(Xe instanceof k&&Xe.status===401)||Xe.code==="invalid_device_proof"||Xe.code==="device_proof_replayed")throw Xe;if(qt(e,{...z,revoked:!0}),Xe.code==="device_revoked")M.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(sn),clearInterval(kt),Je)clearTimeout(Je);if(Wr)process.removeListener("SIGTERM",xr),process.removeListener("SIGINT",Lr);M.signal?.removeEventListener("abort",xr),Ee.abort(),Ve?.close(),await Be?.settled().catch(()=>{return}),await Oe?.broker.close().catch(()=>{return}),await jo()}}function zd(e=process.env){if(e.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((v,D)=>{let M=new Headers(D?.headers);return M.set(vs,Ss),fetch(v,{...D,headers:M})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as bg,sign as kg}from"crypto";var Kd=65536,vg=65536;function Sg(e){let l=e.export({format:"jwk"});if(l.crv!=="P-256"||typeof l.x!=="string"||typeof l.y!=="string")throw new a("invalid_public_key");let v=Buffer.from(l.x,"base64url"),D=Buffer.from(l.y,"base64url");if(v.byteLength!==32||D.byteLength!==32)throw new a("invalid_public_key");let M=Buffer.concat([Buffer.of(4),v,D]).toString("base64url");if(!Ht(M))throw new a("invalid_public_key");return M}function Vd(){try{let{privateKey:e,publicKey:l}=bg("ec",{namedCurve:"P-256"});return{privateKey:e,publicPoint:Sg(l)}}catch(e){if(e instanceof a)throw e;throw new a("proof_key_generation_failed")}}class Ho{keyPair=Vd();binding=null;loadPublicKey(){if(!this.keyPair)throw new a("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=Vd(),this.keyPair.publicPoint}sign(e){if(!this.keyPair||e.byteLength<1||e.byteLength>vg)throw new a("proof_sign_failed");let l;try{l=kg("sha256",e,this.keyPair.privateKey)}catch{throw new a("proof_sign_failed")}if(!vi(l))throw new a("invalid_signature");return l.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding(e){if(e.byteLength<1||e.byteLength>Kd)throw new a("invalid_binding");if(this.binding)throw new a("binding_create_failed");this.binding=Uint8Array.from(e)}updateBinding(e){if(e.byteLength<1||e.byteLength>Kd)throw new a("invalid_binding");if(!this.binding)throw new a("binding_update_failed");this.binding=Uint8Array.from(e)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as Ig,spawn as Og}from"child_process";import{isAbsolute as Dg}from"path";import{promisify as Mg}from"util";var $o={now:()=>Date.now(),after(e,l){let v=setTimeout(l,e);return()=>clearTimeout(v)},every(e,l){let v=setInterval(l,e);return()=>clearInterval(v)}};class Bo{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=(e)=>{let l=Buffer.isBuffer(e)?e:Buffer.from(e),v=0;while(v<l.length&&!this.failure){let D=l.indexOf(10,v),M=D<0?l.length:D;if(this.buffer.length+M-v+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,l.subarray(v,M)]),D<0)return;try{let L=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let z=this.waiter;this.waiter=void 0,z.resolve(L)}else if(this.queue.length<4)this.queue.push(L);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}v=M+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor(e,l,v=$o){this.input=e;this.output=l;this.clock=v;e.on("data",this.onData),e.on("end",this.onEnd),e.on("close",this.onEnd),e.on("error",this.onError),l.on("error",this.onError)}fail(e,l=!1){if(this.failure??=e,this.buffer=Buffer.alloc(0),!l)this.queue=[];this.lifetime.abort();let v=this.waiter;this.waiter=void 0,v?.reject(this.failure)}async send(e,l=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let v=JSON.stringify(e)+`
-`;if(Buffer.byteLength(v)>65536)throw Error("worker_ssh_frame_too_large");let D;try{await new Promise((M,L)=>{D=this.clock.after(l,()=>L(Error("worker_ssh_write_timeout"))),this.output.write(v,(z)=>z?L(Error("worker_ssh_connection_failed")):M())})}finally{D?.()}}async receive(e=30000,l){if(l?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let v,D;try{return await new Promise((M,L)=>{this.waiter={resolve:M,reject:L},D=()=>{this.waiter=void 0,L(Error("worker_ssh_cancelled"))},v=this.clock.after(e,()=>{this.waiter=void 0,L(Error("worker_ssh_handshake_timeout"))}),l?.addEventListener("abort",D,{once:!0})})}finally{v?.(),l?.removeEventListener("abort",D)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as Rg}from"crypto";import{unlinkSync as Eg}from"fs";import{join as Pg}from"path";var Uo=1,$i=45000,Cg=h({type:i("configure"),protocol:i(Uo),version:t(),config:x}),Ag=h({type:i("ticket"),organizationId:t().min(1).max(160),receipt:Rt()}),xg=h({type:c(["ping","stop"])});async function Jd(e={}){let l=e.clock??$o,v=new Bo(e.input??process.stdin,e.output??process.stdout,l),D=new AbortController,M=new AbortController,L=()=>D.abort(),z,re,G,ce,we=!1;process.once("SIGHUP",L),v.signal.addEventListener("abort",L,{once:!0}),e.signal?.addEventListener("abort",L,{once:!0});try{if(e.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:te,version:X}=Cg.parse(await v.receive(30000,D.signal));if(X!==g)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(Or(te),b(p(te),!0),re=ie({path:f(te).lock,runtimeVersion:g}),!re.acquired)throw Error("worker_already_running_or_lifecycle_busy");let he=Pg(p(te),`ssh-preflight-${Rg()}.json`);try{y(he,{version:1}),m(he)}finally{try{Eg(he)}catch{}}let Se=S(te),Re=ft(te);if(Re.revoked||Re.drained)throw Error("worker_ssh_revoked_or_drained");if(Se&&Date.parse(Se.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(Se&&te.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await v.send({type:"hello",protocol:Uo,version:g,platform:process.platform,architecture:process.arch,enrolled:!!Se});let Ee=te.lifetime==="ephemeral"?G=new Ho:xt(te,!0);if(!Se){let We=Kr(te);await v.send({type:"ticket-request",request:We.request});let $e=Ag.parse(await v.receive(70000,D.signal)),Ue=We.complete($e.organizationId,$e.receipt);if(Se=await Er(te,Ue,Ee,e.enroll),te.lifetime==="persistent")ae(Se,f(te).state,{proofStore:Ee});qt(te,{version:1,drained:!1,revoked:!1})}if(D.signal.aborted)throw Error("worker_ssh_cancelled");z=(async()=>{try{while(!M.signal.aborted){if(xg.parse(await v.receive(35000,M.signal)).type==="stop"){L();return}await v.send({type:"pong"})}}catch{if(!M.signal.aborted)L()}})();let Oe=!1,Me,Ce=!1;ce=l.after(Math.max(1,Math.min($i,e.startupTimeoutMs??$i)),()=>{Ce=!0,L()});let Te=re.owner.nonce;if(await Wo(te,Se,Ee,Te,{...e,signal:D.signal,onEvent(We){if(e.onEvent?.(We),We.type==="heartbeat"&&!Oe&&!Me)Me=(async()=>{let $e=await St(te,"status");if(!$e?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await v.send({type:"running",deviceId:$e.deviceId,expiresAt:$e.expiresAt,lifetime:te.lifetime,supervision:"ssh-foreground"}),Oe=!0,ce?.()})().catch(()=>{Ce=!0,L()})}}),await Me,Ce||!Oe)throw Error("worker_ssh_outbound_or_readiness_failed");return we=!0,0}catch(te){let X=te instanceof Error&&/^worker_[a-z_]+$/.test(te.message)?te.message:"worker_ssh_bootstrap_failed";try{await v.send({type:"error",code:X})}catch{}return 1}finally{if(ce?.(),L(),M.abort(),await z,G?.deleteBinding(),G?.deleteKey(),re?.acquired)re.release();if(process.removeListener("SIGHUP",L),e.signal?.removeEventListener("abort",L),v.signal.removeEventListener("abort",L),we)try{await v.send({type:"stopped"})}catch{}v.dispose()}}var Is=(e)=>Dg(e)&&e.length<=4096&&!/[\x00-\x1f\x7f]/.test(e),xs=(e)=>`'${e.replaceAll("'","'\\''")}'`,Tg=h({type:i("hello"),protocol:i(Uo),version:t(),platform:c(["linux","darwin"]),architecture:c(["arm64","x64"]),enrolled:_()}),Lg=h({type:i("ticket-request"),request:h({install_id:V(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:c(["persistent","ephemeral"]),roots:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:c(["confined","host"]),permissions:h({read:i(!0),write:i(!0),execute:i(!0),discover_environment:i(!0),expose_mcp:i(!1)})})).length(1)})}),Gd=P("type",[h({type:i("running"),deviceId:t().min(1).max(160),expiresAt:I.datetime({offset:!0}),lifetime:c(["persistent","ephemeral"]),supervision:i("ssh-foreground")}),h({type:i("pong")}),h({type:i("stopped")})]),Wg=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function Bi(e){if(e&&typeof e==="object"&&"type"in e&&e.type==="error"){let l="code"in e&&typeof e.code==="string"&&Wg.has(e.code)?e.code:"worker_ssh_remote_failed";throw Error(l)}return e}function Yd(e){if(!Is(e.remoteCli)||!/^[a-f0-9]{64}$/.test(e.sha256))throw Error("worker_ssh_invalid_target");let l=`set -eu
+`)}}):void 0),On=(Xe)=>{if(Xe==="stop")Lr();if(Xe==="reload_roots"){let st=S(e);if(!st||st.deviceId!==l.deviceId)throw Error("worker_identity_changed");l.roots=st.roots;let Ct=Jn(l.roots,jd());if(Ct)Te.root_paths=Ct;else delete Te.root_paths;Be?.check()}if(Xe==="drain"||Xe==="resume"){if(We||Date.parse(L)<=Date.now())throw Error("worker_stopping_or_expired");z={...z,drained:Xe==="drain"},qt(e,z)}return Xr()};M.prestartedControl?.handle(On);let zo=M.prestartedControl?await M.prestartedControl.closed:await pi(e,D,On),cn,tt=!1,yt=()=>{let Xe=Date.parse(L)-Date.now();if(Xe>0){cn=setTimeout(yt,Math.min(Xe,2147483647));return}We=!0,Ve?.close(),tt=!0,Ne="stopping",Ee.abort(Error("worker_credential_expired"))};yt(),M.signal?.addEventListener("abort",xr,{once:!0});let Wr=M.processSignals!==!1;if(Wr)process.once("SIGTERM",xr),process.once("SIGINT",Lr);if(M.signal?.aborted)xr();try{M.onStartup?.("control_ready");let Xe=M.client??new ar(ye(e.apiOrigin),oe(e.proxy,zd()),v,{deviceSession:Fa({proxied:Boolean(e.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0}),st=!Pe(e.executionMode==="host")?"not_root_host":!J()?"no_jobs_user":So(),Ct={event_id:Fd(),event:"worker.model_jobs_egress",occurred_at:new Date().toISOString(),runtime_version:g,reason_code:st==="active"?"gid_v1":st};process.stderr.write(`${JSON.stringify({...Ct,device_id:l.deviceId})}
+`);let Vt=!0,Tt=!1,gr=0,vt=()=>{if(!Xe.deviceLifecycle||!Vt||Tt||Ee.signal.aborted||Date.now()<gr)return;Tt=!0,gr=Date.now()+30000,Xe.deviceLifecycle(l,Ct,AbortSignal.any([Ee.signal,AbortSignal.timeout(As)])).then(()=>{Vt=!1},()=>{}).finally(()=>{Tt=!1})};vt();let rr=f(e).daemon,At=ia(e,l.deviceId),Sr=M.startupTiming,$r=Sr?()=>({...Sr(),...At?.enrollmentMs!==void 0?{enrollment_ms:At.enrollmentMs}:{}}):void 0,ln=(ot)=>{let wr=ot.client.localSubscription?.bind(ot.client);if(e.localLogins===!0&&wr)(M.handOverLocalLogins??Td)({state:ot.state,client:{localSubscription:wr},signal:ot.signal,home:s()}).catch(()=>{return});let It=jd(),Yt=ot.client.liveSessionWorktrees?.bind(ot.client);if(Yt)tc(()=>ec({home:It,deviceId:ot.state.deviceId,liveIds:(Ur)=>Yt(ot.state,Ur,ot.signal)}),ot.signal)};ln({state:l,client:Xe,signal:Ee.signal});let Br=wg(e,M.platform??process.platform),Ft=Xe.deviceLifecycle?.bind(Xe),Gt=Promise.resolve(),oo=0,Ko=()=>{if(!Br||!Ft||We||Date.now()<oo)return;oo=Date.now()+gg,Gt=Gt.then(()=>Ud({paths:Br,device:l,client:{deviceLifecycle:Ft},accept:yg,signal:Ee.signal})).catch(()=>{return})};if(Ko(),Br)te.final.then((ot)=>_g(Br,ot),()=>{});let Js=(ot,wr)=>({state:ot.state,client:ot.client,...ot.firstHeartbeat?{firstHeartbeat:ot.firstHeartbeat}:{},runtimeVersion:g,bridgeVersion:g,protocolVersion:2,capabilities:ot.capabilities,signal:ot.signal,statusPath:ot.statusPath,maxConcurrentClaims:M.ownComputer===!0?hg:4*e.slots+Ha,heartbeatIntervalMs:M.heartbeatIntervalMs,operationHeartbeatAttemptTimeoutMs:qd,operationCompletionTimeoutMs:qd,maxConsecutiveHeartbeatFailures:3,claimable:Ye,advertised:it,onClaim:async(It,Yt,Ur)=>{let so=Date.now();if(!ot.capabilities.supported_operations.includes(It.capability))return{status:"failed",error_code:"unsupported_capability"};let yr=Ce.worker.probing??[],Qs=yr.includes(It.capability)?Kt:It.capability==="hands.connect"&&e.executionMode==="host"&&yr.includes("pty.start")?pr:null;if(Qs){let Go,ra=()=>{};await Promise.race([Qs,new Promise((nc)=>{Go=setTimeout(nc,fg),ra=()=>nc(),Yt.addEventListener("abort",ra,{once:!0})})]),clearTimeout(Go),Yt.removeEventListener("abort",ra)}let Jo=It.capability==="hands.connect",ta=Jo?Ve:null,Ju={signal:Yt,emit:Ur,...Ce,...Oe?{proveMac:Oe.broker.execute}:{},...It.capability==="inference.custom.v1"&&ot.client.operationCustomEndpointCredential?{customEndpointCredential:(Go)=>ot.client.operationCustomEndpointCredential(ot.state,It,Go)}:{},...Jo?{handsLaunch:{claimedAtMs:so,...ta?{takePrespawnedWorker:ta.take,adoptSpawnedWorker:ta.adopt}:{}}}:{}};if(Jo)Ue+=1;try{return await(M.execute??Xn)(ot.state,It,Ju)}finally{if(Jo)Ue-=1}},onControl:async(It,Yt)=>await go(ot.state,It,Yt,ot.client)||await _o(ot.state,It,Yt)||await bo(It,Yt)||await Oe?.broker.control(It,Yt)||!1,onEvent:wr}),Gs=async(ot)=>{await ot.client.deviceLifecycle?.(ot.state,{event_id:Fd(),event:"service.stopped",occurred_at:new Date().toISOString(),runtime_version:g,reason_code:"worker_stopped"},AbortSignal.timeout(As)).catch(()=>{return})},ao=e.lifetime==="persistent"?M.ownerWorkspaces:void 0,Vo=ao?.intervalMs??pa,Xs=Xe.ownerWorkspaces?.bind(Xe),Zs=Xe.ownerWorkspaceEnrollment?.bind(Xe);if(ao&&Xs&&Zs)Be=Cc({config:e,state:l,signal:Ee.signal,client:{ownerWorkspaces:Xs,ownerWorkspaceEnrollment:Zs},...ao.enroll?{enroll:ao.enroll}:{},intervalMs:Vo,log:(ot)=>{process.stderr.write(ot)},serve:async(ot,wr,It)=>{let Yt=ia(ot.config,ot.state.deviceId),Ur={config:ot.config,state:ot.state,signal:wr,statusPath:f(ot.config).daemon,...Yt?.offer?{firstHeartbeat:Yt.offer}:{},capabilities:Cs(ot.config,ot.state,Ce,Oe?.capability),client:ao.client?.(ot)??new ar(ye(e.apiOrigin),oe(e.proxy,zd()),ot.proofStore,{deviceSession:Fa({proxied:Boolean(e.proxy)||process.env.REASON_RELAY_CUSTOM_DOMAIN==="1"}),prefetchEventChallenges:!0})};ln(Ur);let so={...Ur,heartbeatNow:null};nt.add(so);try{await Ka({registerHeartbeatNow:(yr)=>{so.heartbeatNow=yr},...Js(Ur,(yr)=>{if(yr.type==="completed")ti(yr.operationId,yr.status);if(yr.type==="claims_changed"){if(It(yr.activeClaims),We&&Ke()===0)Ee.abort()}if(yr.type==="stopped")It(0)})})}finally{nt.delete(so)}if(We&&!tt)await Gs(Ur)}});let Qi=0,ea=0;if(await Ka({...(M.platform??process.platform)==="darwin"?{readIdleSleepPolicy:()=>Ke()>0?nr(rr):void 0,...M.acquireAwakeHold?{acquireAwakeHold:M.acquireAwakeHold}:{}}:{},registerHeartbeatNow:(ot)=>{Fe=ot},...$r?{startup:$r}:{},...Js({state:l,client:Xe,capabilities:Te,signal:Ee.signal,statusPath:rr,...At?.offer?{firstHeartbeat:At.offer}:{}},(ot)=>{if(ot.type==="completed")ti(ot.operationId,ot.status);if(ot.type==="claims_changed"){if($e=ot.activeClaims,We&&Ke()===0)Ee.abort()}if(ot.type==="heartbeat"&&!We){if(ot.handsPrespawn&&e.lifetime==="ephemeral"&&!Ve)Ve=nn({log:(wr,It)=>{process.stderr.write(`${JSON.stringify({event:wr,...It})}
+`)}}),Ve.arm(),setTimeout(an,0);else if(!ot.handsPrespawn&&Ve)Ve.close(),Ve=null}if(ot.type==="heartbeat"){if(Be&&!We&&Date.now()>=Qi)Qi=Date.now()+Vo,Be.check().then((wr)=>{ea=wr?0:ea+1,Qi=Date.now()+(wr?Vo:Math.min(Vo,kc*2**Math.min(ea-1,10)))});if(xe=ot.serverTime,Le=ot.drain,vt(),Ko(),!We&&sn)er?.(ot.latestCliVersions?.[sn]);if(!We)Ne="running";if(!We&&!Ge&&Xr().executionEligible){if(Ge=!0,M.onStartup?.("ready"),(M.platform??process.platform)==="darwin")setTimeout(()=>{try{Ui({skipWhenSettled:!0})}catch{}},0)}}if(ot.type==="reconnecting"&&!We)Ne="reconnecting";if(ot.type==="stopped")$e=0;M.onEvent?.(ot)})}),await Be?.settled(),We&&!tt&&e.lifetime==="ephemeral")await Xe.disconnect?.(l,AbortSignal.timeout(As)).catch(()=>{process.stderr.write(`Reason worker: could not remove this computer from Reason (worker_disconnect_failed); it expires on its own.
+`)});else if(We&&!tt)await Gs({state:l,client:Xe});if(In)await wa().catch(()=>{return})}catch(Xe){if(!(Xe instanceof k&&Xe.status===401)||Xe.code==="invalid_device_proof"||Xe.code==="device_proof_replayed")throw Xe;if(qt(e,{...z,revoked:!0}),Xe.code==="device_revoked")M.onDeviceRevoked?.();throw Error("worker_revoked")}finally{if(clearTimeout(cn),clearInterval(kt),Je)clearTimeout(Je);if(Wr)process.removeListener("SIGTERM",xr),process.removeListener("SIGINT",Lr);M.signal?.removeEventListener("abort",xr),Ee.abort(),Ve?.close(),await Be?.settled().catch(()=>{return}),await Oe?.broker.close().catch(()=>{return}),await zo()}}function zd(e=process.env){if(e.REASON_RELAY_CUSTOM_DOMAIN!=="1")return fetch;return Object.assign((v,D)=>{let M=new Headers(D?.headers);return M.set(Ss,Es),fetch(v,{...D,headers:M})},{preconnect:fetch.preconnect})}import{generateKeyPairSync as bg,sign as kg}from"crypto";var Kd=65536,vg=65536;function Sg(e){let l=e.export({format:"jwk"});if(l.crv!=="P-256"||typeof l.x!=="string"||typeof l.y!=="string")throw new a("invalid_public_key");let v=Buffer.from(l.x,"base64url"),D=Buffer.from(l.y,"base64url");if(v.byteLength!==32||D.byteLength!==32)throw new a("invalid_public_key");let M=Buffer.concat([Buffer.of(4),v,D]).toString("base64url");if(!Ht(M))throw new a("invalid_public_key");return M}function Vd(){try{let{privateKey:e,publicKey:l}=bg("ec",{namedCurve:"P-256"});return{privateKey:e,publicPoint:Sg(l)}}catch(e){if(e instanceof a)throw e;throw new a("proof_key_generation_failed")}}class Ho{keyPair=Vd();binding=null;loadPublicKey(){if(!this.keyPair)throw new a("proof_key_read_failed");return this.keyPair.publicPoint}createFreshPublicKey(){return this.keyPair=Vd(),this.keyPair.publicPoint}sign(e){if(!this.keyPair||e.byteLength<1||e.byteLength>vg)throw new a("proof_sign_failed");let l;try{l=kg("sha256",e,this.keyPair.privateKey)}catch{throw new a("proof_sign_failed")}if(!Si(l))throw new a("invalid_signature");return l.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){if(!this.keyPair)return!1;return this.keyPair=null,!0}loadBinding(){return this.binding?Uint8Array.from(this.binding):null}createBinding(e){if(e.byteLength<1||e.byteLength>Kd)throw new a("invalid_binding");if(this.binding)throw new a("binding_create_failed");this.binding=Uint8Array.from(e)}updateBinding(e){if(e.byteLength<1||e.byteLength>Kd)throw new a("invalid_binding");if(!this.binding)throw new a("binding_update_failed");this.binding=Uint8Array.from(e)}deleteBinding(){if(!this.binding)return!1;return this.binding=null,!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}import{execFile as Ig,spawn as Og}from"child_process";import{isAbsolute as Dg}from"path";import{promisify as Mg}from"util";var Uo={now:()=>Date.now(),after(e,l){let v=setTimeout(l,e);return()=>clearTimeout(v)},every(e,l){let v=setInterval(l,e);return()=>clearInterval(v)}};class Fo{input;output;clock;lifetime=new AbortController;signal=this.lifetime.signal;buffer=Buffer.alloc(0);queue=[];failure;waiter;onData=(e)=>{let l=Buffer.isBuffer(e)?e:Buffer.from(e),v=0;while(v<l.length&&!this.failure){let D=l.indexOf(10,v),M=D<0?l.length:D;if(this.buffer.length+M-v+1>65536){this.fail(Error("worker_ssh_frame_too_large"));return}if(this.buffer=Buffer.concat([this.buffer,l.subarray(v,M)]),D<0)return;try{let L=JSON.parse(this.buffer.toString("utf8"));if(this.buffer=Buffer.alloc(0),this.waiter){let z=this.waiter;this.waiter=void 0,z.resolve(L)}else if(this.queue.length<4)this.queue.push(L);else{this.fail(Error("worker_ssh_protocol_flood"));return}}catch{this.fail(Error("worker_ssh_invalid_frame"));return}v=M+1}};onEnd=()=>this.fail(Error("worker_ssh_connection_closed"),!0);onError=()=>this.fail(Error("worker_ssh_connection_failed"));constructor(e,l,v=Uo){this.input=e;this.output=l;this.clock=v;e.on("data",this.onData),e.on("end",this.onEnd),e.on("close",this.onEnd),e.on("error",this.onError),l.on("error",this.onError)}fail(e,l=!1){if(this.failure??=e,this.buffer=Buffer.alloc(0),!l)this.queue=[];this.lifetime.abort();let v=this.waiter;this.waiter=void 0,v?.reject(this.failure)}async send(e,l=1e4){if(this.failure||this.output.destroyed)throw this.failure??Error("worker_ssh_connection_closed");let v=JSON.stringify(e)+`
+`;if(Buffer.byteLength(v)>65536)throw Error("worker_ssh_frame_too_large");let D;try{await new Promise((M,L)=>{D=this.clock.after(l,()=>L(Error("worker_ssh_write_timeout"))),this.output.write(v,(z)=>z?L(Error("worker_ssh_connection_failed")):M())})}finally{D?.()}}async receive(e=30000,l){if(l?.aborted)throw Error("worker_ssh_cancelled");if(this.queue.length)return this.queue.shift();if(this.failure)throw this.failure;if(this.waiter)throw Error("worker_ssh_concurrent_read");let v,D;try{return await new Promise((M,L)=>{this.waiter={resolve:M,reject:L},D=()=>{this.waiter=void 0,L(Error("worker_ssh_cancelled"))},v=this.clock.after(e,()=>{this.waiter=void 0,L(Error("worker_ssh_handshake_timeout"))}),l?.addEventListener("abort",D,{once:!0})})}finally{v?.(),l?.removeEventListener("abort",D)}}dispose(){this.input.pause(),this.input.removeListener("data",this.onData),this.input.removeListener("end",this.onEnd),this.input.removeListener("close",this.onEnd),this.input.removeListener("error",this.onError),this.output.removeListener("error",this.onError),this.fail(Error("worker_ssh_connection_closed")),this.queue=[]}}import{randomUUID as Rg}from"crypto";import{unlinkSync as Eg}from"fs";import{join as Pg}from"path";var jo=1,Bi=45000,Cg=h({type:i("configure"),protocol:i(jo),version:t(),config:x}),Ag=h({type:i("ticket"),organizationId:t().min(1).max(160),receipt:Rt()}),xg=h({type:c(["ping","stop"])});async function Jd(e={}){let l=e.clock??Uo,v=new Fo(e.input??process.stdin,e.output??process.stdout,l),D=new AbortController,M=new AbortController,L=()=>D.abort(),z,re,G,ce,we=!1;process.once("SIGHUP",L),v.signal.addEventListener("abort",L,{once:!0}),e.signal?.addEventListener("abort",L,{once:!0});try{if(e.signal?.aborted)throw Error("worker_ssh_cancelled");let{config:te,version:X}=Cg.parse(await v.receive(30000,D.signal));if(X!==g)throw Error("worker_ssh_version_mismatch");if(!["darwin","linux"].includes(process.platform)||!["arm64","x64"].includes(process.arch))throw Error("worker_ssh_platform_unsupported");if(Or(te),b(p(te),!0),re=ie({path:f(te).lock,runtimeVersion:g}),!re.acquired)throw Error("worker_already_running_or_lifecycle_busy");let he=Pg(p(te),`ssh-preflight-${Rg()}.json`);try{y(he,{version:1}),m(he)}finally{try{Eg(he)}catch{}}let Se=S(te),Re=ft(te);if(Re.revoked||Re.drained)throw Error("worker_ssh_revoked_or_drained");if(Se&&Date.parse(Se.worker.expiresAt)<=Date.now())throw Error("worker_credential_expired");if(Se&&te.lifetime==="ephemeral")throw Error("worker_ephemeral_requires_fresh_enrollment");await v.send({type:"hello",protocol:jo,version:g,platform:process.platform,architecture:process.arch,enrolled:!!Se});let Ee=te.lifetime==="ephemeral"?G=new Ho:xt(te,!0);if(!Se){let We=Kr(te);await v.send({type:"ticket-request",request:We.request});let $e=Ag.parse(await v.receive(70000,D.signal)),Ue=We.complete($e.organizationId,$e.receipt);if(Se=await Er(te,Ue,Ee,e.enroll),te.lifetime==="persistent")ae(Se,f(te).state,{proofStore:Ee});qt(te,{version:1,drained:!1,revoked:!1})}if(D.signal.aborted)throw Error("worker_ssh_cancelled");z=(async()=>{try{while(!M.signal.aborted){if(xg.parse(await v.receive(35000,M.signal)).type==="stop"){L();return}await v.send({type:"pong"})}}catch{if(!M.signal.aborted)L()}})();let Oe=!1,Me,Ce=!1;ce=l.after(Math.max(1,Math.min(Bi,e.startupTimeoutMs??Bi)),()=>{Ce=!0,L()});let Te=re.owner.nonce;if(await Wo(te,Se,Ee,Te,{...e,signal:D.signal,onEvent(We){if(e.onEvent?.(We),We.type==="heartbeat"&&!Oe&&!Me)Me=(async()=>{let $e=await St(te,"status");if(!$e?.executionEligible)throw Error("worker_ssh_no_ready_capabilities");await v.send({type:"running",deviceId:$e.deviceId,expiresAt:$e.expiresAt,lifetime:te.lifetime,supervision:"ssh-foreground"}),Oe=!0,ce?.()})().catch(()=>{Ce=!0,L()})}}),await Me,Ce||!Oe)throw Error("worker_ssh_outbound_or_readiness_failed");return we=!0,0}catch(te){let X=te instanceof Error&&/^worker_[a-z_]+$/.test(te.message)?te.message:"worker_ssh_bootstrap_failed";try{await v.send({type:"error",code:X})}catch{}return 1}finally{if(ce?.(),L(),M.abort(),await z,G?.deleteBinding(),G?.deleteKey(),re?.acquired)re.release();if(process.removeListener("SIGHUP",L),e.signal?.removeEventListener("abort",L),v.signal.removeEventListener("abort",L),we)try{await v.send({type:"stopped"})}catch{}v.dispose()}}var Is=(e)=>Dg(e)&&e.length<=4096&&!/[\x00-\x1f\x7f]/.test(e),xs=(e)=>`'${e.replaceAll("'","'\\''")}'`,Tg=h({type:i("hello"),protocol:i(jo),version:t(),platform:c(["linux","darwin"]),architecture:c(["arm64","x64"]),enrolled:_()}),Lg=h({type:i("ticket-request"),request:h({install_id:V(),code_challenge:t().regex(/^[A-Za-z0-9_-]{43}$/),lifecycle:c(["persistent","ephemeral"]),roots:d(h({path_fingerprint:t().regex(/^[a-f0-9]{64}$/),execution_mode:c(["confined","host"]),permissions:h({read:i(!0),write:i(!0),execute:i(!0),discover_environment:i(!0),expose_mcp:i(!1)})})).length(1)})}),Gd=P("type",[h({type:i("running"),deviceId:t().min(1).max(160),expiresAt:I.datetime({offset:!0}),lifetime:c(["persistent","ephemeral"]),supervision:i("ssh-foreground")}),h({type:i("pong")}),h({type:i("stopped")})]),Wg=new Set(["worker_already_running_or_lifecycle_busy","worker_ssh_revoked_or_drained","worker_credential_expired","worker_config_binding_mismatch","worker_workspace_not_canonical_or_overlaps_state","worker_state_directory_not_private_or_canonical","worker_parent_not_canonical","worker_file_not_private","worker_ssh_platform_unsupported","worker_ssh_outbound_or_readiness_failed","worker_enrollment_rejected","worker_enrollment_receipt_mismatch","worker_ticket_receipt_mismatch","worker_ssh_version_mismatch"]);function Fi(e){if(e&&typeof e==="object"&&"type"in e&&e.type==="error"){let l="code"in e&&typeof e.code==="string"&&Wg.has(e.code)?e.code:"worker_ssh_remote_failed";throw Error(l)}return e}function Yd(e){if(!Is(e.remoteCli)||!/^[a-f0-9]{64}$/.test(e.sha256))throw Error("worker_ssh_invalid_target");let l=`set -eu
 a=${xs(e.remoteCli)}
 [ -f "$a" ] && [ ! -L "$a" ] && [ -x "$a" ] || { echo worker_ssh_artifact_unavailable >&2; exit 72; }
 p=\${a%/*}; f=\${a##*/}; p=\${p:-/}
@@ -100,10 +100,10 @@ else echo worker_ssh_hash_tool_unavailable >&2; exit 72; fi
 h=\${h%% *}
 [ "$h" = ${xs(e.sha256)} ] || { echo worker_ssh_artifact_mismatch >&2; exit 72; }
 exec "$a" worker __ssh-bootstrap`;return`exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin /bin/sh -c ${xs(l)}`}function Xd(e,l){if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(e.alias)||!Is(e.sshConfig))throw Error("worker_ssh_invalid_target");return["-T","-a","-F",e.sshConfig,"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","UpdateHostKeys=no","-o","ForwardAgent=no","-o","ClearAllForwardings=yes","-o","PermitLocalCommand=no","-o","GSSAPIDelegateCredentials=no","-o","SessionType=default","-o","StdinNull=no","-o","ForkAfterAuthentication=no","-o","ControlMaster=no","-o","ControlPath=none","-o","ControlPersist=no",...l?[]:["-o","ProxyJump=none","-o","ProxyCommand=none"],"-o","ConnectTimeout=10","-o","ConnectionAttempts=1","-o","ServerAliveInterval=10","-o","ServerAliveCountMax=3","-o","LogLevel=ERROR","--",e.alias,Yd(e)]}function Ng(e){return Xd(e,!1)}function Zd(){return{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:s(),...process.env.SSH_AUTH_SOCK?{SSH_AUTH_SOCK:process.env.SSH_AUTH_SOCK}:{}}}async function Hg(e){let l;try{({stdout:l}=await Mg(Ig)("/usr/bin/ssh",["-G",...Xd(e,!0)],{env:Zd(),timeout:5000,maxBuffer:65536,encoding:"utf8"}))}catch{throw Error("worker_ssh_config_invalid")}for(let v of l.split(`
-`)){let[D,...M]=v.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(D??"")&&M.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function $g(e){let l=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((v)=>e.includes(`worker_ssh_${v}`));return l?`worker_ssh_${l}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test(e)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test(e)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function Bg(e){await Hg(e);let l=Og("/usr/bin/ssh",Ng(e),{stdio:["pipe","pipe","pipe"],env:Zd()}),v="";l.stderr.on("data",(M)=>{if(Buffer.byteLength(v)+M.length<=65536)v+=M.toString("utf8");else l.kill("SIGKILL")});let D=new Promise((M)=>{l.once("error",()=>M({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),l.once("close",(L)=>{let z=$g(v);v="",M({exitCode:L??1,errorCode:z})})});return{input:l.stdin,output:l.stdout,result:D,close(){if(l.stdin.destroy(),l.exitCode===null&&l.signalCode===null){l.kill("SIGTERM");let M=setTimeout(()=>l.kill("SIGKILL"),2000);M.unref(),D.finally(()=>clearTimeout(M))}}}}function Ug(e){let l=new Map,v=!1;for(let z=0;z<e.length;z++){let re=e[z];if(re==="--foreground"&&!v){v=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(re)||l.has(re))throw Error("worker_unknown_or_duplicate_flag");let G=e[++z];if(!G||G.startsWith("--"))throw Error("worker_missing_flag_value");l.set(re,G)}if(!v)throw Error("worker_ssh_foreground_required");let D=(z)=>{let re=l.get(z);if(!re)throw Error("worker_required_input_missing");return re},M={alias:D("--ssh"),sshConfig:D("--ssh-config"),remoteCli:D("--remote-cli"),sha256:D("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(M.alias)||!Is(M.sshConfig))throw Error("worker_ssh_invalid_target");Yd(M),m(M.sshConfig);let L=x.parse(JSON.parse(m(D("--config"))));if(se(L.workspaceRoot,M.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:M,config:L,credentialPath:l.get("--credential-file")}}async function Fg(e,l,v,D,M){let{request:L}=Lg.parse(Bi(await e.receive(30000,M)));if(L.lifecycle!==l.lifetime||L.roots[0].execution_mode!==l.executionMode)throw Error("worker_ticket_receipt_mismatch");let z=()=>{if(M.aborted)throw Error("worker_ssh_cancelled")},re=(async()=>{z();let ce=v??jr(l),we=await(D.enrollmentCredentials??qr)(l,ce);if(z(),!we)throw Error("worker_session_login_required");if(!W(we.apiOrigin,l.apiOrigin))throw Error("worker_session_origin_mismatch");if(!we.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let te=D.createTicketClient?.(we)??new me(we,{credentialsPath:ce}),X=da(await te.createHeadlessDeviceEnrollmentTicket(L));return z(),{type:"ticket",organizationId:we.orgId,receipt:X}})(),G;try{let ce=await Promise.race([re,new Promise((we,te)=>{if(G=()=>te(Error("worker_ssh_cancelled")),M.aborted)G();else M.addEventListener("abort",G,{once:!0})})]);z(),await e.send(ce)}finally{M.removeEventListener("abort",G)}}async function Qd(e,l={}){let{config:v,target:D,credentialPath:M}=Ug(e);if(l.signal?.aborted)throw Error("worker_ssh_cancelled");let L=l.clock??$o,z=await(l.sshTransport??Bg)(D),re=new Bo(z.output,z.input,L),G=new AbortController,ce=()=>G.abort(),we,te;if(z.result.then((X)=>{te=X}),process.once("SIGINT",ce),process.once("SIGTERM",ce),l.signal?.addEventListener("abort",ce,{once:!0}),l.signal?.aborted)ce();try{if(G.signal.aborted)throw Error("worker_ssh_cancelled");await re.send({type:"configure",protocol:Uo,version:g,config:v});let X=Tg.parse(Bi(await re.receive(30000,G.signal)));if(X.version!==g)throw Error("worker_ssh_version_mismatch");if(!X.enrolled)await Fg(re,v,M,l,AbortSignal.any([G.signal,re.signal]));we=L.every(1e4,()=>{re.send({type:"ping"}).catch(ce)});let he=!1,Se=L.now()+(X.enrolled?0:ca)+$i+5000;while(!0){let Re=he?35000:Math.max(1,Se-L.now()),Ee=Gd.parse(Bi(await re.receive(Re,G.signal)));if(Ee.type==="running"){if(he||Ee.lifetime!==v.lifetime||Date.parse(Ee.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");he=!0,(l.io??process).stdout.write(JSON.stringify(Ee)+`
-`)}if(Ee.type==="stopped"){if(!he)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(X){if(G.signal.aborted){we?.();try{await re.send({type:"stop"});let he=L.now()+v.shutdownGraceMs+1e4;while(L.now()<he)if(Gd.parse(Bi(await re.receive(Math.max(1,he-L.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(X instanceof Error&&X.message==="worker_ssh_connection_closed"){let he=te??await Promise.race([z.result,new Promise((Se)=>setTimeout(Se,100))]);if(he?.exitCode)throw Error(he.errorCode)}throw X}finally{we?.(),process.removeListener("SIGINT",ce),process.removeListener("SIGTERM",ce),l.signal?.removeEventListener("abort",ce),z.close(),re.dispose()}}import{createConnection as Vg}from"net";import{WebSocket as Ui}from"ws";var jg=1,Vn=65536,eu=4096,tu=67108864,ru=4194304,zn=V(),qg=h({kind:i("install_only"),authorityId:zn,organizationId:zn,userId:zn,connectionId:zn,attemptId:zn,purpose:i("install"),generation:o().int().positive(),transport:i("reverse_ssh"),expiresAt:I.datetime({offset:!0}),maxDurationMs:i(300000),maxChannels:i(1),allowTcpForwarding:i(!1),allowPty:i(!1)}),zg=t().max(2048).superRefine((e,l)=>{let v;try{v=new URL(e)}catch{l.addIssue({code:"custom",message:"invalid relay url"});return}if(v.protocol!=="ws:"&&v.protocol!=="wss:"){l.addIssue({code:"custom",message:"invalid relay protocol"});return}if(v.username||v.password||v.search||v.hash){l.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let D=v.pathname.split("/");if(D.length!==4||D[1]!=="device"||!zn.safeParse(D[2]).success||!/^[a-f0-9]{64}$/.test(D[3]??""))l.addIssue({code:"custom",message:"invalid device relay path"});if(v.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(v.hostname))l.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var Kg=h({protocol:i(jg),type:i("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:qg,relayUrl:zg,endpoint:h({host:i("127.0.0.1"),port:i(22)})});function Os(e,l=Date.now()){let v=Kg.parse(e),D=Date.parse(v.authority.expiresAt);if(!Number.isFinite(D)||D<=l)throw Error("ssh_install_relay_expired");if(D>l+v.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return v}function nu(e){let l=JSON.stringify(e);if(Buffer.byteLength(l)>Vn)throw Error("ssh_install_relay_frame_too_large");return l}function ou(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("ssh_install_relay_control_invalid");let l=e;if(l.type==="ssh_install_relay_receipt")return{type:l.type,receipt:Os(l.receipt)};if(l.type==="ssh_install_relay_ready"&&typeof l.authorityId==="string")return{type:l.type,authorityId:l.authorityId};throw Error("ssh_install_relay_control_invalid")}var iu="ssh_install_relay_closed";function Jg(e){if(typeof e==="string")return Buffer.byteLength(e,"utf8");if(Buffer.isBuffer(e))return e.length;if(e instanceof ArrayBuffer)return e.byteLength;if(ArrayBuffer.isView(e))return e.byteLength;return Number.POSITIVE_INFINITY}function Gg(e){if(Buffer.isBuffer(e))return e;if(e instanceof ArrayBuffer)return Buffer.from(e);if(ArrayBuffer.isView(e))return Buffer.from(e.buffer,e.byteOffset,e.byteLength);return null}function Yg(e,l=iu){try{e.close(1000,l)}catch{e.terminate()}}async function Xg(e){let l=e.now??(()=>Date.now()),v=Os(e.receipt,l()),M=(e.createWebSocket??((We)=>new Ui(We,{followRedirects:!1,perMessageDeflate:!1,maxPayload:Vn})))(v.relayUrl),L=e.connectLocal??(()=>Vg({host:"127.0.0.1",port:22})),z,re=!1,G=!1,ce=0,we=0,te,X=(We)=>{if(te)clearTimeout(te);te=setTimeout(()=>Re("ssh_install_relay_expired"),Math.max(1,We)),te.unref?.()},he,Se=new Promise((We)=>{he=We}),Re=(We=iu)=>{if(G)return;if(G=!0,te)clearTimeout(te);if(e.signal?.removeEventListener("abort",Ee),z?.destroy(),M.readyState===Ui.OPEN)Yg(M,We);else if(M.readyState!==Ui.CLOSED)M.terminate();he()},Ee=()=>Re("ssh_install_relay_aborted"),Oe=()=>Re("ssh_install_relay_protocol_error"),Me=(We)=>(ce+=1,we+=We,We<=Vn&&ce<=eu&&we<=tu),Ce=(We)=>{if(G||!re||M.readyState!==Ui.OPEN||M.bufferedAmount>ru||!Me(We.length)){Oe();return}M.send(We,{binary:!0},($e)=>{if($e)Oe()})};M.on("open",()=>{if(G)return;try{let We=nu({type:"ssh_install_relay_receipt",receipt:v});M.send(We,{binary:!1},($e)=>{if($e)Oe()})}catch{Oe()}}),M.on("message",(We,$e)=>{if(G)return;let Ue=Jg(We);if(Ue>Vn||!Me(Ue))return Oe();if(!re){if($e)return Oe();try{let xe=ou(JSON.parse(String(We)));if(xe.type!=="ssh_install_relay_ready"||xe.authorityId!==v.authority.authorityId)return Oe();re=!0,X(v.authority.maxDurationMs),z=L(),z.setNoDelay(!0),z.on("data",Ce),z.on("error",Oe),z.on("close",()=>Re("ssh_install_relay_peer_closed")),z.on("drain",()=>M._socket?.resume()),z.on("connect",()=>{})}catch{Oe()}return}if(!$e)return Oe();let Ne=Gg(We);if(!Ne||!z||z.destroyed||!z.write(Ne))M._socket?.pause()}),M.on("error",Oe),M.on("close",()=>Re("ssh_install_relay_peer_closed"));let Te=Math.max(1,Math.min(v.authority.maxDurationMs,Date.parse(v.authority.expiresAt)-l()));if(X(Te),e.signal?.addEventListener("abort",Ee,{once:!0}),e.signal?.aborted)Ee();return{receipt:v,closed:Se,close:()=>Re()}}async function au(e=process.stdin){let l=[],v=0;for await(let D of e){let M=Buffer.isBuffer(D)?D:Buffer.from(D);if(v+=M.length,v>Vn)return 1;l.push(M)}try{let D=JSON.parse(Buffer.concat(l).toString("utf8"));return await(await Xg({receipt:D})).closed,0}catch{return 1}}import{randomBytes as Zg}from"crypto";var vn="ARA_WORKER_PREVIEW_PROBE";async function su(){if(typeof Bun>"u")return 1;let e=Zg(32).toString("base64url"),l,v=new Promise((z)=>{l=z}),D=setTimeout(()=>l(1),5000),M=()=>l(0);process.stdin.once("end",M),process.stdin.resume();let L=Bun.serve({hostname:"127.0.0.1",port:0,fetch(z,re){let G=new URL(z.url).pathname;if(z.method!=="GET")return new Response(null,{status:405});if(G==="/readiness")return new Response(vn);if((G==="/readiness-ws"||G===`/device/readiness/${e}`)&&re.upgrade(z,{data:{relay:G.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(z,re){if(typeof re!=="string"||re.length>8192){z.close();return}if(!z.data.relay){if(re===vn)z.send(vn);else z.close();return}try{let G=mi(re),ce=(we)=>z.send(JSON.stringify(we));if(G.type==="hello")ce(G),ce({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(G.type==="head"&&G.id==="http"&&G.status===200)ce({type:"credit",id:"http"});else if(G.type==="data"&&G.id==="http"){if(z.data.http+=Buffer.from(G.data,"base64").toString(),z.data.http.length>vn.length)throw Error("probe_overflow");ce({type:"credit",id:"http"})}else if(G.type==="end"&&G.id==="http"&&z.data.http===vn)ce({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(G.type==="ws"&&G.id==="ws")ce({type:"data",id:"ws",data:Buffer.from(vn).toString("base64"),binary:!1});else if(G.type==="data"&&G.id==="ws"&&!G.binary&&Buffer.from(G.data,"base64").toString()===vn&&!z.data.reported)z.data.reported=!0,process.stdout.write(`ready
+`)){let[D,...M]=v.trim().split(/\s+/);if(["proxyjump","proxycommand"].includes(D??"")&&M.join(" ").toLowerCase()!=="none")throw Error("worker_ssh_proxy_unsupported")}}function $g(e){let l=["artifact_unavailable","hash_tool_unavailable","artifact_mismatch"].find((v)=>e.includes(`worker_ssh_${v}`));return l?`worker_ssh_${l}`:/HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .*host key is known/i.test(e)?"worker_ssh_host_key_rejected":/Permission denied|authentication failed|expired/i.test(e)?"worker_ssh_authentication_failed":"worker_ssh_connection_failed"}async function Bg(e){await Hg(e);let l=Og("/usr/bin/ssh",Ng(e),{stdio:["pipe","pipe","pipe"],env:Zd()}),v="";l.stderr.on("data",(M)=>{if(Buffer.byteLength(v)+M.length<=65536)v+=M.toString("utf8");else l.kill("SIGKILL")});let D=new Promise((M)=>{l.once("error",()=>M({exitCode:1,errorCode:"worker_ssh_client_unavailable"})),l.once("close",(L)=>{let z=$g(v);v="",M({exitCode:L??1,errorCode:z})})});return{input:l.stdin,output:l.stdout,result:D,close(){if(l.stdin.destroy(),l.exitCode===null&&l.signalCode===null){l.kill("SIGTERM");let M=setTimeout(()=>l.kill("SIGKILL"),2000);M.unref(),D.finally(()=>clearTimeout(M))}}}}function Ug(e){let l=new Map,v=!1;for(let z=0;z<e.length;z++){let re=e[z];if(re==="--foreground"&&!v){v=!0;continue}if(!["--ssh","--ssh-config","--remote-cli","--artifact-sha256","--config","--credential-file"].includes(re)||l.has(re))throw Error("worker_unknown_or_duplicate_flag");let G=e[++z];if(!G||G.startsWith("--"))throw Error("worker_missing_flag_value");l.set(re,G)}if(!v)throw Error("worker_ssh_foreground_required");let D=(z)=>{let re=l.get(z);if(!re)throw Error("worker_required_input_missing");return re},M={alias:D("--ssh"),sshConfig:D("--ssh-config"),remoteCli:D("--remote-cli"),sha256:D("--artifact-sha256")};if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(M.alias)||!Is(M.sshConfig))throw Error("worker_ssh_invalid_target");Yd(M),m(M.sshConfig);let L=x.parse(JSON.parse(m(D("--config"))));if(se(L.workspaceRoot,M.remoteCli))throw Error("worker_ssh_artifact_inside_workspace");return{target:M,config:L,credentialPath:l.get("--credential-file")}}async function Fg(e,l,v,D,M){let{request:L}=Lg.parse(Fi(await e.receive(30000,M)));if(L.lifecycle!==l.lifetime||L.roots[0].execution_mode!==l.executionMode)throw Error("worker_ticket_receipt_mismatch");let z=()=>{if(M.aborted)throw Error("worker_ssh_cancelled")},re=(async()=>{z();let ce=v??jr(l),we=await(D.enrollmentCredentials??qr)(l,ce);if(z(),!we)throw Error("worker_session_login_required");if(!W(we.apiOrigin,l.apiOrigin))throw Error("worker_session_origin_mismatch");if(!we.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let te=D.createTicketClient?.(we)??new me(we,{credentialsPath:ce}),X=ua(await te.createHeadlessDeviceEnrollmentTicket(L));return z(),{type:"ticket",organizationId:we.orgId,receipt:X}})(),G;try{let ce=await Promise.race([re,new Promise((we,te)=>{if(G=()=>te(Error("worker_ssh_cancelled")),M.aborted)G();else M.addEventListener("abort",G,{once:!0})})]);z(),await e.send(ce)}finally{M.removeEventListener("abort",G)}}async function Qd(e,l={}){let{config:v,target:D,credentialPath:M}=Ug(e);if(l.signal?.aborted)throw Error("worker_ssh_cancelled");let L=l.clock??Uo,z=await(l.sshTransport??Bg)(D),re=new Fo(z.output,z.input,L),G=new AbortController,ce=()=>G.abort(),we,te;if(z.result.then((X)=>{te=X}),process.once("SIGINT",ce),process.once("SIGTERM",ce),l.signal?.addEventListener("abort",ce,{once:!0}),l.signal?.aborted)ce();try{if(G.signal.aborted)throw Error("worker_ssh_cancelled");await re.send({type:"configure",protocol:jo,version:g,config:v});let X=Tg.parse(Fi(await re.receive(30000,G.signal)));if(X.version!==g)throw Error("worker_ssh_version_mismatch");if(!X.enrolled)await Fg(re,v,M,l,AbortSignal.any([G.signal,re.signal]));we=L.every(1e4,()=>{re.send({type:"ping"}).catch(ce)});let he=!1,Se=L.now()+(X.enrolled?0:la)+Bi+5000;while(!0){let Re=he?35000:Math.max(1,Se-L.now()),Ee=Gd.parse(Fi(await re.receive(Re,G.signal)));if(Ee.type==="running"){if(he||Ee.lifetime!==v.lifetime||Date.parse(Ee.expiresAt)<=Date.now())throw Error("worker_ssh_invalid_readiness");he=!0,(l.io??process).stdout.write(JSON.stringify(Ee)+`
+`)}if(Ee.type==="stopped"){if(!he)throw Error("worker_ssh_invalid_readiness");return 0}}}catch(X){if(G.signal.aborted){we?.();try{await re.send({type:"stop"});let he=L.now()+v.shutdownGraceMs+1e4;while(L.now()<he)if(Gd.parse(Fi(await re.receive(Math.max(1,he-L.now())))).type==="stopped")return 0}catch{}throw Error("worker_ssh_stop_unconfirmed")}if(X instanceof Error&&X.message==="worker_ssh_connection_closed"){let he=te??await Promise.race([z.result,new Promise((Se)=>setTimeout(Se,100))]);if(he?.exitCode)throw Error(he.errorCode)}throw X}finally{we?.(),process.removeListener("SIGINT",ce),process.removeListener("SIGTERM",ce),l.signal?.removeEventListener("abort",ce),z.close(),re.dispose()}}import{createConnection as Vg}from"net";import{WebSocket as ji}from"ws";var jg=1,Gn=65536,eu=4096,tu=67108864,ru=4194304,zn=V(),qg=h({kind:i("install_only"),authorityId:zn,organizationId:zn,userId:zn,connectionId:zn,attemptId:zn,purpose:i("install"),generation:o().int().positive(),transport:i("reverse_ssh"),expiresAt:I.datetime({offset:!0}),maxDurationMs:i(300000),maxChannels:i(1),allowTcpForwarding:i(!1),allowPty:i(!1)}),zg=t().max(2048).superRefine((e,l)=>{let v;try{v=new URL(e)}catch{l.addIssue({code:"custom",message:"invalid relay url"});return}if(v.protocol!=="ws:"&&v.protocol!=="wss:"){l.addIssue({code:"custom",message:"invalid relay protocol"});return}if(v.username||v.password||v.search||v.hash){l.addIssue({code:"custom",message:"relay credentials or modifiers are not allowed"});return}let D=v.pathname.split("/");if(D.length!==4||D[1]!=="device"||!zn.safeParse(D[2]).success||!/^[a-f0-9]{64}$/.test(D[3]??""))l.addIssue({code:"custom",message:"invalid device relay path"});if(v.protocol==="ws:"&&!["127.0.0.1","[::1]"].includes(v.hostname))l.addIssue({code:"custom",message:"plaintext relay must be loopback"})});var Kg=h({protocol:i(jg),type:i("ssh_install_relay"),authorityToken:t().regex(/^(?:reason|ara)_ssh_install_[A-Za-z0-9_-]{43}$/),authority:qg,relayUrl:zg,endpoint:h({host:i("127.0.0.1"),port:i(22)})});function Os(e,l=Date.now()){let v=Kg.parse(e),D=Date.parse(v.authority.expiresAt);if(!Number.isFinite(D)||D<=l)throw Error("ssh_install_relay_expired");if(D>l+v.authority.maxDurationMs)throw Error("ssh_install_relay_expiry_invalid");return v}function nu(e){let l=JSON.stringify(e);if(Buffer.byteLength(l)>Gn)throw Error("ssh_install_relay_frame_too_large");return l}function ou(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("ssh_install_relay_control_invalid");let l=e;if(l.type==="ssh_install_relay_receipt")return{type:l.type,receipt:Os(l.receipt)};if(l.type==="ssh_install_relay_ready"&&typeof l.authorityId==="string")return{type:l.type,authorityId:l.authorityId};throw Error("ssh_install_relay_control_invalid")}var iu="ssh_install_relay_closed";function Jg(e){if(typeof e==="string")return Buffer.byteLength(e,"utf8");if(Buffer.isBuffer(e))return e.length;if(e instanceof ArrayBuffer)return e.byteLength;if(ArrayBuffer.isView(e))return e.byteLength;return Number.POSITIVE_INFINITY}function Gg(e){if(Buffer.isBuffer(e))return e;if(e instanceof ArrayBuffer)return Buffer.from(e);if(ArrayBuffer.isView(e))return Buffer.from(e.buffer,e.byteOffset,e.byteLength);return null}function Yg(e,l=iu){try{e.close(1000,l)}catch{e.terminate()}}async function Xg(e){let l=e.now??(()=>Date.now()),v=Os(e.receipt,l()),M=(e.createWebSocket??((We)=>new ji(We,{followRedirects:!1,perMessageDeflate:!1,maxPayload:Gn})))(v.relayUrl),L=e.connectLocal??(()=>Vg({host:"127.0.0.1",port:22})),z,re=!1,G=!1,ce=0,we=0,te,X=(We)=>{if(te)clearTimeout(te);te=setTimeout(()=>Re("ssh_install_relay_expired"),Math.max(1,We)),te.unref?.()},he,Se=new Promise((We)=>{he=We}),Re=(We=iu)=>{if(G)return;if(G=!0,te)clearTimeout(te);if(e.signal?.removeEventListener("abort",Ee),z?.destroy(),M.readyState===ji.OPEN)Yg(M,We);else if(M.readyState!==ji.CLOSED)M.terminate();he()},Ee=()=>Re("ssh_install_relay_aborted"),Oe=()=>Re("ssh_install_relay_protocol_error"),Me=(We)=>(ce+=1,we+=We,We<=Gn&&ce<=eu&&we<=tu),Ce=(We)=>{if(G||!re||M.readyState!==ji.OPEN||M.bufferedAmount>ru||!Me(We.length)){Oe();return}M.send(We,{binary:!0},($e)=>{if($e)Oe()})};M.on("open",()=>{if(G)return;try{let We=nu({type:"ssh_install_relay_receipt",receipt:v});M.send(We,{binary:!1},($e)=>{if($e)Oe()})}catch{Oe()}}),M.on("message",(We,$e)=>{if(G)return;let Ue=Jg(We);if(Ue>Gn||!Me(Ue))return Oe();if(!re){if($e)return Oe();try{let xe=ou(JSON.parse(String(We)));if(xe.type!=="ssh_install_relay_ready"||xe.authorityId!==v.authority.authorityId)return Oe();re=!0,X(v.authority.maxDurationMs),z=L(),z.setNoDelay(!0),z.on("data",Ce),z.on("error",Oe),z.on("close",()=>Re("ssh_install_relay_peer_closed")),z.on("drain",()=>M._socket?.resume()),z.on("connect",()=>{})}catch{Oe()}return}if(!$e)return Oe();let Ne=Gg(We);if(!Ne||!z||z.destroyed||!z.write(Ne))M._socket?.pause()}),M.on("error",Oe),M.on("close",()=>Re("ssh_install_relay_peer_closed"));let Te=Math.max(1,Math.min(v.authority.maxDurationMs,Date.parse(v.authority.expiresAt)-l()));if(X(Te),e.signal?.addEventListener("abort",Ee,{once:!0}),e.signal?.aborted)Ee();return{receipt:v,closed:Se,close:()=>Re()}}async function au(e=process.stdin){let l=[],v=0;for await(let D of e){let M=Buffer.isBuffer(D)?D:Buffer.from(D);if(v+=M.length,v>Gn)return 1;l.push(M)}try{let D=JSON.parse(Buffer.concat(l).toString("utf8"));return await(await Xg({receipt:D})).closed,0}catch{return 1}}import{randomBytes as Zg}from"crypto";var Sn="ARA_WORKER_PREVIEW_PROBE";async function su(){if(typeof Bun>"u")return 1;let e=Zg(32).toString("base64url"),l,v=new Promise((z)=>{l=z}),D=setTimeout(()=>l(1),5000),M=()=>l(0);process.stdin.once("end",M),process.stdin.resume();let L=Bun.serve({hostname:"127.0.0.1",port:0,fetch(z,re){let G=new URL(z.url).pathname;if(z.method!=="GET")return new Response(null,{status:405});if(G==="/readiness")return new Response(Sn);if((G==="/readiness-ws"||G===`/device/readiness/${e}`)&&re.upgrade(z,{data:{relay:G.startsWith("/device/"),http:"",reported:!1}}))return;return new Response(null,{status:404})},websocket:{maxPayloadLength:8192,message(z,re){if(typeof re!=="string"||re.length>8192){z.close();return}if(!z.data.relay){if(re===Sn)z.send(Sn);else z.close();return}try{let G=gi(re),ce=(we)=>z.send(JSON.stringify(we));if(G.type==="hello")ce(G),ce({type:"request",id:"http",method:"GET",path:"/readiness",headers:[],body:"",upgrade:!1});else if(G.type==="head"&&G.id==="http"&&G.status===200)ce({type:"credit",id:"http"});else if(G.type==="data"&&G.id==="http"){if(z.data.http+=Buffer.from(G.data,"base64").toString(),z.data.http.length>Sn.length)throw Error("probe_overflow");ce({type:"credit",id:"http"})}else if(G.type==="end"&&G.id==="http"&&z.data.http===Sn)ce({type:"request",id:"ws",method:"GET",path:"/readiness-ws",headers:[],body:"",upgrade:!0});else if(G.type==="ws"&&G.id==="ws")ce({type:"data",id:"ws",data:Buffer.from(Sn).toString("base64"),binary:!1});else if(G.type==="data"&&G.id==="ws"&&!G.binary&&Buffer.from(G.data,"base64").toString()===Sn&&!z.data.reported)z.data.reported=!0,process.stdout.write(`ready
 `);else throw Error("probe_protocol_failed")}catch{z.close(),l(1)}}}});try{return process.stdout.write(JSON.stringify({port:L.port,token:e})+`
-`),await v}finally{clearTimeout(D),L.stop(!0),process.stdin.removeListener("end",M),process.stdin.pause()}}import{closeSync as tw,createReadStream as rw,fstatSync as nw,readFileSync as ow}from"fs";var cu="/run/sc/instance-generation";var Qg=/^[1-9][0-9]{0,15}\n?$/;function ew(e){return typeof e==="number"&&Number.isSafeInteger(e)&&e>0}function lu(e){if(typeof e!=="string"||!Qg.test(e))return null;let l=Number(e.trim());return ew(l)?l:null}var du=3,iw=600000,aw=65536,sw=500;function uu(e){if(e.length!==3||e[0]!=="standby"||e[1]!=="--handoff-fd"||e[2]!==String(du))throw Error("worker_standby_invalid_invocation");return{handoffFd:du}}function cw(e=(l)=>ow(l,"utf8")){try{return lu(e(cu))}catch{return null}}function lw(e){let l;try{l=JSON.parse(e)}catch{throw Error("worker_standby_handoff_invalid")}if(!l||typeof l!=="object"||Array.isArray(l))throw Error("worker_standby_handoff_invalid");let v=Object.keys(l).sort();if(v.length!==2||v[0]!=="config"||v[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let D=l,M=x.safeParse(D.config),L=sa.safeParse(D.enrollment);if(!M.success||!L.success)throw Error("worker_standby_handoff_invalid");if(M.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:M.data,enrollment:L.data}}var fu={isPipe:(e)=>nw(e).isFIFO(),stream:(e)=>{let l=rw("",{fd:e,autoClose:!0,highWaterMark:16384});return{chunks:l,close:()=>l.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:(e,l)=>{let v=setInterval(l,e);return v.unref?.(),()=>clearInterval(v)}};async function dw(e,l=fu){if(!l.isPipe(e.fd)){try{tw(e.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let v=l.now()+(e.armMs??iw),D=l.stream(e.fd),M=null,L=()=>{},z=new Promise((G,ce)=>{L=(we)=>{M??=we,ce(we)}});z.catch(()=>{});let re=l.every(sw,()=>{if(l.parentPid()!==e.parentPid)L(Error("worker_standby_parent_changed"));else if(l.now()>=v)L(Error("worker_standby_arm_expired"))});try{let G=(async()=>{let we=[],te=0;for await(let X of D.chunks){if(M)throw M;if(te===0)e.onArriving?.();if(te+=X.length,te>aw)throw Error("worker_standby_handoff_too_large");we.push(X)}return Buffer.concat(we).toString("utf8")})(),ce=await Promise.race([G,z]);if(l.parentPid()!==e.parentPid)throw Error("worker_standby_parent_changed");return ce}finally{re(),D.close()}}async function mu(e,l=fu){let v=e.readGeneration??(()=>cw()),D=l.parentPid(),M=v();if(M===null)throw Error("worker_standby_no_instance_generation");e.onBooted?.();let L=await dw({fd:e.fd,parentPid:D,armMs:e.armMs,onArriving:e.onArriving},l);if(v()!==M)throw Error("worker_standby_generation_changed");return lw(L)}var uw=`Usage: reason worker <command> --config PATH [--json]
+`),await v}finally{clearTimeout(D),L.stop(!0),process.stdin.removeListener("end",M),process.stdin.pause()}}import{closeSync as tw,createReadStream as rw,fstatSync as nw,readFileSync as ow}from"fs";var cu="/run/sc/instance-generation";var Qg=/^[1-9][0-9]{0,15}\n?$/;function ew(e){return typeof e==="number"&&Number.isSafeInteger(e)&&e>0}function lu(e){if(typeof e!=="string"||!Qg.test(e))return null;let l=Number(e.trim());return ew(l)?l:null}var du=3,iw=600000,aw=65536,sw=500;function uu(e){if(e.length!==3||e[0]!=="standby"||e[1]!=="--handoff-fd"||e[2]!==String(du))throw Error("worker_standby_invalid_invocation");return{handoffFd:du}}function cw(e=(l)=>ow(l,"utf8")){try{return lu(e(cu))}catch{return null}}function lw(e){let l;try{l=JSON.parse(e)}catch{throw Error("worker_standby_handoff_invalid")}if(!l||typeof l!=="object"||Array.isArray(l))throw Error("worker_standby_handoff_invalid");let v=Object.keys(l).sort();if(v.length!==2||v[0]!=="config"||v[1]!=="enrollment")throw Error("worker_standby_handoff_invalid");let D=l,M=x.safeParse(D.config),L=ca.safeParse(D.enrollment);if(!M.success||!L.success)throw Error("worker_standby_handoff_invalid");if(M.data.lifetime!=="ephemeral")throw Error("worker_standby_handoff_invalid");return{config:M.data,enrollment:L.data}}var fu={isPipe:(e)=>nw(e).isFIFO(),stream:(e)=>{let l=rw("",{fd:e,autoClose:!0,highWaterMark:16384});return{chunks:l,close:()=>l.destroy()}},parentPid:()=>process.ppid,now:()=>Date.now(),every:(e,l)=>{let v=setInterval(l,e);return v.unref?.(),()=>clearInterval(v)}};async function dw(e,l=fu){if(!l.isPipe(e.fd)){try{tw(e.fd)}catch{}throw Error("worker_standby_handoff_not_pipe")}let v=l.now()+(e.armMs??iw),D=l.stream(e.fd),M=null,L=()=>{},z=new Promise((G,ce)=>{L=(we)=>{M??=we,ce(we)}});z.catch(()=>{});let re=l.every(sw,()=>{if(l.parentPid()!==e.parentPid)L(Error("worker_standby_parent_changed"));else if(l.now()>=v)L(Error("worker_standby_arm_expired"))});try{let G=(async()=>{let we=[],te=0;for await(let X of D.chunks){if(M)throw M;if(te===0)e.onArriving?.();if(te+=X.length,te>aw)throw Error("worker_standby_handoff_too_large");we.push(X)}return Buffer.concat(we).toString("utf8")})(),ce=await Promise.race([G,z]);if(l.parentPid()!==e.parentPid)throw Error("worker_standby_parent_changed");return ce}finally{re(),D.close()}}async function mu(e,l=fu){let v=e.readGeneration??(()=>cw()),D=l.parentPid(),M=v();if(M===null)throw Error("worker_standby_no_instance_generation");e.onBooted?.();let L=await dw({fd:e.fd,parentPid:D,armMs:e.armMs,onArriving:e.onArriving},l);if(v()!==M)throw Error("worker_standby_generation_changed");return lw(L)}var uw=`Usage: reason worker <command> --config PATH [--json]
 
   enroll                        Obtain/redeem a ticket using the current Reason login
   start                         Run the existing Device daemon in the foreground
@@ -144,15 +144,15 @@ Pretrust known_hosts. No agent forwarding, automatic installation or detached se
 SSH starts with a clean environment. Custom PLAYWRIGHT_BROWSERS_PATH locations
 are not forwarded/supported; running is not a browser-readiness receipt.
 Closing SSH stops foreground work; persistent enrollment remains for restart/revoke.
-`;function fw(e){let[l,...v]=e;if(!l||l==="help"||l==="--help"||l==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(l))throw Error("worker_unknown_command");let D,M,L,z=!1;for(let re=0;re<v.length;re++){let G=v[re];if(G==="--json"&&!z){z=!0;continue}if(G!=="--config"&&G!=="--enrollment-file"&&G!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let ce=v[++re];if(!ce||ce.startsWith("--"))throw Error("worker_missing_flag_value");if(G==="--config"&&!D)D=ce;else if(G==="--enrollment-file"&&!M&&["enroll","start"].includes(l))M=ce;else if(G==="--credential-file"&&!L&&l==="enroll")L=ce;else throw Error("worker_unknown_or_duplicate_flag")}if(!D)throw Error("worker_required_input_missing");if(L&&M)throw Error("worker_enrollment_inputs_conflict");return{action:l,configPath:D,enrollmentPath:M,credentialPath:L,json:z}}var mw=1e4,pw=2000,pu=15000,hw=50;async function gu(e,l,v,D,M,L){let z=new Ho,re=new AbortController,G,ce,we=new Promise((Ne,xe)=>{G=Ne,ce=xe});if(we.catch(()=>{}),ne(),e.executionMode==="host")kr();v("enrollment_started");let te=M(z);te.catch(()=>{});let X=null,he=fi(e,l,(Ne)=>{if(!X)throw Error("worker_starting");return X(Ne)});he.catch(()=>{}),v("readiness_started");let Se=new AbortController,Re,Ee=AbortSignal.any([re.signal,Se.signal,...D.signal?[D.signal]:[]]),Oe=L?.matches(e)?L.result:void 0;if(L&&!Oe)await L.stop();if(Oe)Ee.addEventListener("abort",()=>void L.stop(),{once:!0});let Me,Ce=new Promise((Ne)=>{Me=Ne}),Te=setTimeout(()=>Me(),mw);Ee.addEventListener("abort",()=>Me(),{once:!0});let We,$e=(Ne)=>{if(Ne==="ready")We=setTimeout(()=>Me(),pw);D.onStartup?.(Ne)},Ue=Eo(e,D.readinessProbes,Ee,we,void 0,Oe,Ce);Ue.final.catch(()=>{});try{let Ne;try{Ne=await te}catch(xe){throw re.abort(),ce(Error("worker_enrollment_failed")),await Ue.final.catch(()=>{}),await he.then((Le)=>Le(),()=>{}),xe}v("enrollment_completed"),Re=setTimeout(()=>Se.abort(),Math.max(1,Math.min(pu,Date.parse(Ne.worker?.expiresAt??"")-Date.now()||pu))),G(Ne.roots[0].permissions),qt(e,{version:1,drained:!1,revoked:!1}),await Wo(e,Ne,z,l,{...D,onStartup:$e,prestartedReadiness:Ue,prestartedControl:{closed:he,handle:(xe)=>{X=xe}},deferOptionalLanes:!0})}finally{clearTimeout(Re),clearTimeout(Te),clearTimeout(We),re.abort(),z.deleteBinding(),z.deleteKey(),await he.then((Ne)=>Ne(),()=>{})}}async function gw(e,l,v,D){let{handoffFd:M}=uu(e);if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((l.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let L,z,re=()=>{let he=v.readinessProbes?v.readinessProbes.boundPty:(Se)=>Ro(Se);if(G||!he)return;try{ne(),kr()}catch{return}if(L=Cl(he),!v.readinessProbes)setImmediate(()=>{if(G)return;try{ki()}catch{}})},G=!1,ce=()=>{G=!0,clearTimeout(z),(L?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",ce),process.once("SIGINT",ce);let we;try{we=await(l.receiveStandbyHandoff??mu)({fd:M,onBooted:()=>{D("standby_booted"),z=setTimeout(re,hw)},onArriving:()=>clearTimeout(z)})}catch(he){clearTimeout(z);let Se=he instanceof Error&&/^worker_standby_[a-z_]+$/.test(he.message)?he.message:"worker_standby_failed";return(l.io??process).stderr.write(`Reason worker: ${Se}.
+`;function fw(e){let[l,...v]=e;if(!l||l==="help"||l==="--help"||l==="-h")return null;if(!["enroll","start","status","doctor","drain","resume","stop","revoke"].includes(l))throw Error("worker_unknown_command");let D,M,L,z=!1;for(let re=0;re<v.length;re++){let G=v[re];if(G==="--json"&&!z){z=!0;continue}if(G!=="--config"&&G!=="--enrollment-file"&&G!=="--credential-file")throw Error("worker_unknown_or_duplicate_flag");let ce=v[++re];if(!ce||ce.startsWith("--"))throw Error("worker_missing_flag_value");if(G==="--config"&&!D)D=ce;else if(G==="--enrollment-file"&&!M&&["enroll","start"].includes(l))M=ce;else if(G==="--credential-file"&&!L&&l==="enroll")L=ce;else throw Error("worker_unknown_or_duplicate_flag")}if(!D)throw Error("worker_required_input_missing");if(L&&M)throw Error("worker_enrollment_inputs_conflict");return{action:l,configPath:D,enrollmentPath:M,credentialPath:L,json:z}}var mw=1e4,pw=2000,pu=15000,hw=50;async function gu(e,l,v,D,M,L){let z=new Ho,re=new AbortController,G,ce,we=new Promise((Ne,xe)=>{G=Ne,ce=xe});if(we.catch(()=>{}),ne(),e.executionMode==="host")kr();v("enrollment_started");let te=M(z);te.catch(()=>{});let X=null,he=pi(e,l,(Ne)=>{if(!X)throw Error("worker_starting");return X(Ne)});he.catch(()=>{}),v("readiness_started");let Se=new AbortController,Re,Ee=AbortSignal.any([re.signal,Se.signal,...D.signal?[D.signal]:[]]),Oe=L?.matches(e)?L.result:void 0;if(L&&!Oe)await L.stop();if(Oe)Ee.addEventListener("abort",()=>void L.stop(),{once:!0});let Me,Ce=new Promise((Ne)=>{Me=Ne}),Te=setTimeout(()=>Me(),mw);Ee.addEventListener("abort",()=>Me(),{once:!0});let We,$e=(Ne)=>{if(Ne==="ready")We=setTimeout(()=>Me(),pw);D.onStartup?.(Ne)},Ue=xo(e,D.readinessProbes,Ee,we,void 0,Oe,Ce);Ue.final.catch(()=>{});try{let Ne;try{Ne=await te}catch(xe){throw re.abort(),ce(Error("worker_enrollment_failed")),await Ue.final.catch(()=>{}),await he.then((Le)=>Le(),()=>{}),xe}v("enrollment_completed"),Re=setTimeout(()=>Se.abort(),Math.max(1,Math.min(pu,Date.parse(Ne.worker?.expiresAt??"")-Date.now()||pu))),G(Ne.roots[0].permissions),qt(e,{version:1,drained:!1,revoked:!1}),await Wo(e,Ne,z,l,{...D,onStartup:$e,prestartedReadiness:Ue,prestartedControl:{closed:he,handle:(xe)=>{X=xe}},deferOptionalLanes:!0})}finally{clearTimeout(Re),clearTimeout(Te),clearTimeout(We),re.abort(),z.deleteBinding(),z.deleteKey(),await he.then((Ne)=>Ne(),()=>{})}}async function gw(e,l,v,D){let{handoffFd:M}=uu(e);if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if((l.platform??process.platform)!=="linux")throw Error("worker_platform_unsupported");let L,z,re=()=>{let he=v.readinessProbes?v.readinessProbes.boundPty:(Se)=>Po(Se);if(G||!he)return;try{ne(),kr()}catch{return}if(L=Cl(he),!v.readinessProbes)setImmediate(()=>{if(G)return;try{Ri()}catch{}})},G=!1,ce=()=>{G=!0,clearTimeout(z),(L?.stop()??Promise.resolve()).finally(()=>process.exit(0))};process.once("SIGTERM",ce),process.once("SIGINT",ce);let we;try{we=await(l.receiveStandbyHandoff??mu)({fd:M,onBooted:()=>{D("standby_booted"),z=setTimeout(re,hw)},onArriving:()=>clearTimeout(z)})}catch(he){clearTimeout(z);let Se=he instanceof Error&&/^worker_standby_[a-z_]+$/.test(he.message)?he.message:"worker_standby_failed";return(l.io??process).stderr.write(`Reason worker: ${Se}.
 `),await L?.stop(),(l.exitProcess??((Re)=>process.exit(Re)))(1),1}finally{clearTimeout(z),process.off("SIGTERM",ce),process.off("SIGINT",ce)}if(G)return 0;D("handoff_received");let{config:te,enrollment:X}=we;try{b(p(te),!0);let he=await wu(te,()=>{});try{if(D("lock_acquired"),S(te))throw Error("worker_ephemeral_requires_fresh_enrollment");return Or(te),await gu(te,he.owner.nonce,D,v,(Se)=>Er(te,X,Se,l.enroll),L),0}finally{he.release()}}finally{await L?.stop()}}async function Tr(e,l={}){let v=l.io??process,D=!1,M=!1,L=new Map,z=(G)=>{L.set(G,performance.now()),v.stderr.write(JSON.stringify({event:"worker.startup",stage:G,pid:process.pid,timestamp:new Date().toISOString()})+`
-`),l.onStartup?.(G)},re={...l,onStartup:z,onDeviceRevoked:()=>{M=!0,l.onDeviceRevoked?.()},startupTiming:()=>{let G=(he)=>Math.min(tr,Math.max(0,Math.round(he))),ce=L.get("readiness_started"),we=L.get("readiness_completed"),te=L.get("handoff_received")??0,X=Object.fromEntries(Xs.flatMap((he)=>{let Se=L.get(he);return Se===void 0?[]:[[he,G(Se-te)]]}));return{service_start_to_heartbeat_ms:G(performance.now()-te),stage_ms:X,...ce!==void 0&&we!==void 0?{readiness_ms:G(we-ce)}:{}}},onEvent:(G)=>{if(G.type==="error"&&G.diagnostic){D=!0;let ce=G.diagnostic;v.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:ce.stage,category:ce.category,httpStatus:ce.category==="http"?ce.httpStatus:void 0})+`
-`)}l.onEvent?.(G)}};try{if(e[0]==="__preview-probe"){if(e.length!==1||pt(l.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await su()}if(e[0]==="attach"||e[0]==="__ssh-bootstrap"||e[0]==="__ssh-reverse"){if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(e[0]==="attach")return await Qd(e.slice(1),l);if(e.length!==1)throw Error("worker_unknown_or_duplicate_flag");if(e[0]==="__ssh-reverse")return await au();return await Jd(l)}if(e[0]==="__update-restart"){let he=e.length===4&&e[3]==="--changed";if(e[1]!=="--config"||!e[2]||e.length!==3&&!he)throw Error("worker_unknown_or_duplicate_flag");if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");let Se=x.parse(JSON.parse(m(e[2]))),Re=await pi(Se,he?void 0:g);return v.stdout.write(JSON.stringify(Re)+`
+`),l.onStartup?.(G)},re={...l,onStartup:z,onDeviceRevoked:()=>{M=!0,l.onDeviceRevoked?.()},startupTiming:()=>{let G=(he)=>Math.min(tr,Math.max(0,Math.round(he))),ce=L.get("readiness_started"),we=L.get("readiness_completed"),te=L.get("handoff_received")??0,X=Object.fromEntries(Ys.flatMap((he)=>{let Se=L.get(he);return Se===void 0?[]:[[he,G(Se-te)]]}));return{service_start_to_heartbeat_ms:G(performance.now()-te),stage_ms:X,...ce!==void 0&&we!==void 0?{readiness_ms:G(we-ce)}:{}}},onEvent:(G)=>{if(G.type==="error"&&G.diagnostic){D=!0;let ce=G.diagnostic;v.stderr.write(JSON.stringify({event:"worker.connection_failed",timestamp:new Date().toISOString(),stage:ce.stage,category:ce.category,httpStatus:ce.category==="http"?ce.httpStatus:void 0})+`
+`)}l.onEvent?.(G)}};try{if(e[0]==="__preview-probe"){if(e.length!==1||pt(l.environment??process.env).length>0)throw Error("worker_invalid_probe_invocation");return await su()}if(e[0]==="attach"||e[0]==="__ssh-bootstrap"||e[0]==="__ssh-reverse"){if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(e[0]==="attach")return await Qd(e.slice(1),l);if(e.length!==1)throw Error("worker_unknown_or_duplicate_flag");if(e[0]==="__ssh-reverse")return await au();return await Jd(l)}if(e[0]==="__update-restart"){let he=e.length===4&&e[3]==="--changed";if(e[1]!=="--config"||!e[2]||e.length!==3&&!he)throw Error("worker_unknown_or_duplicate_flag");if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");let Se=x.parse(JSON.parse(m(e[2]))),Re=await hi(Se,he?void 0:g);return v.stdout.write(JSON.stringify(Re)+`
 `),Re.state==="current"?3:Re.state==="busy"?75:0}if(e[0]==="standby")return await gw(e,l,re,z);let G=fw(e);if(!G)return v.stdout.write(uw),0;if(pt(l.environment??process.env).length>0)throw Error("worker_unsafe_environment");if(!["darwin","linux","win32"].includes(process.platform))throw Error("worker_platform_unsupported");let ce=x.parse(JSON.parse(m(G.configPath))),we=(he)=>v.stdout.write(JSON.stringify(he)+`
 `),te=S(ce);if(G.action==="status"||G.action==="doctor"){let he=await St(ce,"status"),Se=ft(ce),Re={enrolled:!!te||!!he,deviceId:te?.deviceId??he?.deviceId??null,lifetime:ce.lifetime,expired:te||he?Date.parse(te?.worker?.expiresAt??he.expiresAt)<=Date.now():null,drained:Se.drained,revoked:Se.revoked,live:he};if(G.action==="status")return we(Re),0;let Ee=!0;try{Or(ce)}catch{Ee=!1}return we({...Re,workspace:Ee,platform:process.platform,executionMode:ce.executionMode,proofStorage:ce.lifetime==="ephemeral"?"process-memory":te&&xt(ce)instanceof mt?"login-keychain":"owner-only-file",confinement:ce.executionMode==="host"?"explicitly-disabled":"verified-on-start-not-by-doctor",capabilitySource:he?.supportedOperations?"live-worker":"unavailable",reportedOperations:he?.supportedOperations??null,capabilityReadiness:he?.capabilityReadiness??null,ready:he?.executionEligible===!0&&!Re.expired}),Ee&&(te||he)&&!Re.revoked&&!Re.expired?0:1}if(["drain","resume","stop"].includes(G.action)){let he=G.action==="drain"?"drain":G.action==="resume"?"resume":"stop",Se=await St(ce,he);if(Se){if(we(Se),he==="stop"&&ce.lifetime==="ephemeral"&&!G.json)v.stderr.write(yw);return 0}}b(p(ce),!0);let X=await wu(ce,()=>{if(!G.json)v.stderr.write(`Waiting for the previous worker to stop\u2026
-`)});try{if(G.action==="start")z("lock_acquired");let he=S(ce);if(["drain","resume","stop"].includes(G.action)){if(!he)throw Error("worker_not_enrolled");let Se=ft(ce);if(Se.revoked||Date.parse(he.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(G.action!=="stop")qt(ce,{...Se,drained:G.action==="drain"});return we({running:!1,drained:G.action==="stop"?Se.drained:G.action==="drain"}),0}if(G.action==="enroll"){if(ce.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let Se=G.enrollmentPath,Re=!Se&&ft(ce).revoked;if(he&&!Re)throw Error("worker_already_enrolled");Or(ce);let Ee=()=>{Zt(ce),wc(ce)};if(Re)Ee();let Oe=async()=>{let Te=Yo(ce),We=Se?await la(ce,Se,Te,l.enroll):await hu(ce,G.credentialPath,l,Te);return{proof:Te,enrolled:We}},{proof:Me,enrolled:Ce}=await Oe().catch((Te)=>{if(Se||!(Te instanceof Rr)||!Te.deviceRemoved)throw Te;return Ee(),Oe()});return ae(Ce,f(ce).state,{proofStore:Me}),qt(ce,{version:1,drained:!1,revoked:!1}),we({enrolled:!0,deviceId:Ce.deviceId,lifetime:ce.lifetime}),0}if(G.action==="revoke"){if(!he)throw Error("worker_not_enrolled");let Se=xt(ce),Re=new ar(ye(ce.apiOrigin),oe(ce.proxy),Se);if(qt(ce,{version:1,drained:!0,revoked:!0}),l.revoke)await l.revoke(he,Re);else await Re.disconnect(he,AbortSignal.timeout(30000));return Zt(ce),we({revoked:!0,localKeyRemoved:!0}),0}if(Or(ce),ce.lifetime==="ephemeral"){if(he)throw Error("worker_ephemeral_requires_fresh_enrollment");await gu(ce,X.owner.nonce,z,re,async(Se)=>G.enrollmentPath?la(ce,G.enrollmentPath,Se,l.enroll):hu(ce,void 0,l,Se,"worker_ephemeral_enrollment_required"))}else{if(G.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!he)throw Error("worker_not_enrolled");if(ft(ce).revoked)M=!0;await Wo(ce,he,xt(ce),X.owner.nonce,re)}return 0}finally{X.release()}}catch(G){let ce=G instanceof Error&&(G.message==="worker_revoked"||!D&&/^worker_[a-z_]+$/.test(G.message))?G.message:"worker_command_failed";v.stderr.write(`Reason worker: ${ce}.
+`)});try{if(G.action==="start")z("lock_acquired");let he=S(ce);if(["drain","resume","stop"].includes(G.action)){if(!he)throw Error("worker_not_enrolled");let Se=ft(ce);if(Se.revoked||Date.parse(he.worker.expiresAt)<=Date.now())throw Error("worker_revoked_or_expired");if(G.action!=="stop")qt(ce,{...Se,drained:G.action==="drain"});return we({running:!1,drained:G.action==="stop"?Se.drained:G.action==="drain"}),0}if(G.action==="enroll"){if(ce.lifetime!=="persistent")throw Error("worker_ephemeral_requires_start_enrollment_file");let Se=G.enrollmentPath,Re=!Se&&ft(ce).revoked;if(he&&!Re)throw Error("worker_already_enrolled");Or(ce);let Ee=()=>{Zt(ce),wc(ce)};if(Re)Ee();let Oe=async()=>{let Te=Zo(ce),We=Se?await da(ce,Se,Te,l.enroll):await hu(ce,G.credentialPath,l,Te);return{proof:Te,enrolled:We}},{proof:Me,enrolled:Ce}=await Oe().catch((Te)=>{if(Se||!(Te instanceof Rr)||!Te.deviceRemoved)throw Te;return Ee(),Oe()});return ae(Ce,f(ce).state,{proofStore:Me}),qt(ce,{version:1,drained:!1,revoked:!1}),we({enrolled:!0,deviceId:Ce.deviceId,lifetime:ce.lifetime}),0}if(G.action==="revoke"){if(!he)throw Error("worker_not_enrolled");let Se=xt(ce),Re=new ar(ye(ce.apiOrigin),oe(ce.proxy),Se);if(qt(ce,{version:1,drained:!0,revoked:!0}),l.revoke)await l.revoke(he,Re);else await Re.disconnect(he,AbortSignal.timeout(30000));return Zt(ce),we({revoked:!0,localKeyRemoved:!0}),0}if(Or(ce),ce.lifetime==="ephemeral"){if(he)throw Error("worker_ephemeral_requires_fresh_enrollment");await gu(ce,X.owner.nonce,z,re,async(Se)=>G.enrollmentPath?da(ce,G.enrollmentPath,Se,l.enroll):hu(ce,void 0,l,Se,"worker_ephemeral_enrollment_required"))}else{if(G.enrollmentPath)throw Error("worker_start_never_reenrolls_persistent_identity");if(!he)throw Error("worker_not_enrolled");if(ft(ce).revoked)M=!0;await Wo(ce,he,xt(ce),X.owner.nonce,re)}return 0}finally{X.release()}}catch(G){let ce=G instanceof Error&&(G.message==="worker_revoked"||!D&&/^worker_[a-z_]+$/.test(G.message))?G.message:"worker_command_failed";v.stderr.write(`Reason worker: ${ce}.
 `);let we=e.includes("--json")?void 0:Mn(G instanceof Rr&&G.deviceRemoved?"worker_enrollment_device_removed":ce);if(we)v.stderr.write(`${we}
-`);return ce==="worker_revoked"&&M?0:1}}var ww=60000;async function wu(e,l){let v=Date.now()+e.shutdownGraceMs+ww,D=!1;for(;;){let M=ie({path:f(e).lock,runtimeVersion:g});if(M.acquired)return M;let L=await St(e,"status").catch(()=>null);if(!(L?L.phase==="stopping":D)||Date.now()>=v)throw Error("worker_already_running_or_lifecycle_busy");if(!D)D=!0,l();await new Promise((re)=>setTimeout(re,250))}}var yw='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function hu(e,l,v,D,M="worker_session_login_required"){if(v.enrollmentInput&&!l){let G=performance.now();return Er(e,await v.enrollmentInput(e),D,v.enroll,G)}let L=l??jr(e),z=await(v.enrollmentCredentials??qr)(e,L);if(!z)throw Error(M);let re=v.createTicketClient?.(z)??new me(z,{credentialsPath:L,fetchImpl:oe(e.proxy)});return gc(e,z,re,D,v.enroll)}import{spawn as _w}from"child_process";import{readFileSync as bw,unlinkSync as kw}from"fs";import{join as vw}from"path";var Sw=120,Rw=15,Ew=5000;function Fi(e={}){let l=e.stateDirectory?vw(e.stateDirectory,Pw):null;if(l)Cw(l);let v=Y();if(!v)return null;let D=process.platform==="win32",M=Math.max(1,Math.floor(e.limitSeconds??Sw)),L=e.pid??process.pid,z=Math.min(Rw,M),re=l?`printf '%s %s %s\\n' "$(date +%s)" ${M+z} ${yu(g)} > ${yu(l)} 2>/dev/null
+`);return ce==="worker_revoked"&&M?0:1}}var ww=60000;async function wu(e,l){let v=Date.now()+e.shutdownGraceMs+ww,D=!1;for(;;){let M=ie({path:f(e).lock,runtimeVersion:g});if(M.acquired)return M;let L=await St(e,"status").catch(()=>null);if(!(L?L.phase==="stopping":D)||Date.now()>=v)throw Error("worker_already_running_or_lifecycle_busy");if(!D)D=!0,l();await new Promise((re)=>setTimeout(re,250))}}var yw='This ephemeral worker\'s Device ends when it exits; starting it again needs a new --enrollment-file (or `reason login`) and adds a new Device. Use "lifetime": "persistent" to keep one Device across restarts.\n';async function hu(e,l,v,D,M="worker_session_login_required"){if(v.enrollmentInput&&!l){let G=performance.now();return Er(e,await v.enrollmentInput(e),D,v.enroll,G)}let L=l??jr(e),z=await(v.enrollmentCredentials??qr)(e,L);if(!z)throw Error(M);let re=v.createTicketClient?.(z)??new me(z,{credentialsPath:L,fetchImpl:oe(e.proxy)});return gc(e,z,re,D,v.enroll)}import{spawn as _w}from"child_process";import{readFileSync as bw,unlinkSync as kw}from"fs";import{join as vw}from"path";var Sw=120,Rw=15,Ew=5000;function qi(e={}){let l=e.stateDirectory?vw(e.stateDirectory,Pw):null;if(l)Cw(l);let v=Y();if(!v)return null;let D=process.platform==="win32",M=Math.max(1,Math.floor(e.limitSeconds??Sw)),L=e.pid??process.pid,z=Math.min(Rw,M),re=l?`printf '%s %s %s\\n' "$(date +%s)" ${M+z} ${yu(g)} > ${yu(l)} 2>/dev/null
 `:"",G=(Se)=>`[ $((SECONDS - started)) -ge ${Math.max(1,Se-1)} ]`,ce=D?":":`[ "$(ps -o ppid= -p $$ | tr -d ' ')" = "${L}" ]`,we=D?`"$SYSTEMROOT/System32/taskkill.exe" /PID ${L} /F >/dev/null`:`kill -KILL ${L}`,te=`parent_is_worker() { ${ce}; }
 while :; do started=$SECONDS
 IFS= read -r -t ${M} pulse && continue
@@ -208,12 +208,12 @@ the worker unless --sandbox is set. Settings live in
 ~/.reason/workers/NAME@<folder hash>/worker.json, one per folder, so every
 folder served for NAME is its own worker. Use
 \`reason worker status|revoke --config <that file>\` for advanced control.
-`,Tw=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,Lw=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,bu="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",_u=["REASON_TOKEN","REASON_MACHINE_TOKEN"],ku="my-computer";function Ls(e){let l=(e.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return l&&yo(l)&&l!==li?l:ku}class gt extends Error{}function Ww(e,l){let v,D=new Map,M=new Set;for(let ce=0;ce<e.length;ce+=1){let we=e[ce];if(we==="--help"||we==="-h"||we==="help")return null;if(we==="--dir"||we==="--token"||we==="--org"){let te=e[ce+1];if(!te||te.startsWith("-"))throw new gt(`Missing value after ${we}.`);if(D.has(we))throw new gt(`${we} may be specified only once.`);D.set(we,te),ce+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(we)){M.add(we==="-y"?"--yes":we);continue}if(we.startsWith("-"))throw new gt(`Unknown option: ${we}. Run \`reason serve --help\`.`);if(v!==void 0)throw new gt("Expected one machine NAME.");v=we}let L=M.has("--stop");if(v===void 0&&L)throw new gt("Missing machine NAME. Usage: reason stop NAME");if(v!==void 0){if(!yo(v)&&!Tw.test(v))throw new gt(bu);if(v.toLowerCase()===li)throw new gt(`"${li}" is reserved for Reason's cloud. Choose another NAME.`)}if(L&&(D.size>0||[...M].some((ce)=>ce!=="--stop"&&ce!=="--json")))throw new gt("--stop takes only NAME and --json.");if(!L&&M.has("--json"))throw new gt("--json is only used with --stop.");if(M.has("--service")&&M.has("--once"))throw new gt("--service keeps the worker running; it cannot be combined with --once.");let z=L?void 0:D.get("--token")??l,re=D.get("--org");if(z!==void 0){if(!z.startsWith("rmt_"))throw new gt("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(re!==void 0&&!Lw.test(re))throw new gt("--org must be a workspace id.")}else if(re!==void 0)throw new gt("--org is only used with --token.");let G=D.get("--dir");return{...v===void 0?{}:{name:v},...G===void 0?{}:{dir:G},once:M.has("--once"),sandbox:M.has("--sandbox"),yes:M.has("--yes"),stop:L,json:M.has("--json"),service:M.has("--service"),...z===void 0?{}:{token:z},...re===void 0?{}:{org:re.toLowerCase()}}}function qi(e,l){let v=Dw(e,l??"."),D;try{D=process.platform==="win32"?Ts.native(v):Ts(v)}catch{throw new gt(`Folder not found: ${v}`)}if(!Iw(D).isDirectory())throw new gt(`Not a folder: ${D}`);return D}var ji=(e)=>Sn(e,".reason","workers"),Ds=(e)=>u(f(e).state);function Nw(e,l,v){let D=Sn(ji(e),l);if(Z(Sn(D,"worker.json"))?.workspaceRoot===v)return D;return Sn(ji(e),`${l}@${Aw("sha256").update(v).digest("hex").slice(0,8)}`)}function vu(e){let{stateDirectory:l}=e;if(se(e.workspaceRoot,l)||se(l,e.workspaceRoot))throw new gt(`${e.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return x.parse({version:1,apiOrigin:e.apiOrigin,channel:e.channel,stateDirectory:l,workspaceRoot:e.workspaceRoot,lifetime:e.once?"ephemeral":"persistent",executionMode:e.sandbox?"confined":"host",name:e.name})}function Z(e){if(!u(e))return null;let l=new gt(`${e} is not a valid worker config. Remove it to start over.`),v;try{v=JSON.parse(m(e))}catch(M){if(M instanceof SyntaxError)throw l;throw M}let D=x.safeParse(v);if(!D.success)throw l;return D.data}function Ms(e){return[`--dir ${e.workspaceRoot}`,...e.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function Hw(e,l){e.stdout.write(`${l} [y/N] `);let v=await Aa(e.stdin,new AbortController().signal);return/^(y|yes)$/i.test(v?.trim()??"")}function zi(e){return{write(l){if(l.startsWith('{"event":"worker.startup"'))return!0;return e.write(l)}}}var $w={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function Su(e){try{return await e()}catch(l){let v=l instanceof C?$w[l.code]:void 0;throw v?Error(v):l}}async function Bw(e,l,v,D){let M=vu({...l,name:e.name??ku,stateDirectory:Sn(ji(v),".token-enrollment")}),L=Kr(M,{stored:!1}),z=await Su(()=>no({apiOrigin:M.apiOrigin,token:e.token,body:L.request,...D.fetchImpl?{fetchImpl:D.fetchImpl}:{}}));if(!yo(z.machine_name))throw Error("worker_ticket_receipt_mismatch");if(e.name!==void 0&&e.name.toLowerCase()!==z.machine_name.toLowerCase())throw new gt(`This token is for machine "${z.machine_name}", not "${e.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if(e.org!==void 0&&e.org!==z.organization_id.toLowerCase())throw new gt(`This token is for workspace ${z.organization_id}, not ${e.org}. Drop --org; the token names its workspace.`);let re=!1;return{name:e.name??z.machine_name,input:(G)=>{if(re)throw Error("worker_ticket_receipt_mismatch");return re=!0,L.saveInstall(G),L.complete(z.organization_id,z)}}}function Uw(e,l,v,D){return async(M)=>{if(l)return l.input(M);let L=await(v.worker?.enrollmentCredentials??qr)(M);if(!L)throw Error("worker_session_login_required");let z=(v.createApi??((re)=>new me(re)))(L);return hc(M,L,{createHeadlessDeviceEnrollmentTicket:(re)=>Su(async()=>{try{return await z.createMachineEnrollmentTicket(e,re)}catch(G){if(!(G instanceof C)||G.code!=="machine_not_found")throw G}try{await z.createMachine({name:e}),D.stdout.write(`Created machine "${e}".
-`)}catch(G){if(!(G instanceof C)||G.status!==409)throw G}return z.createMachineEnrollmentTicket(e,re)})})}}async function Ru(e,l,v,D){let M=await pi(e,D,()=>ns(e,l,v));if(M.state==="current"||M.state==="busy")return M;if(!Ie(e,l,v))return null;return ka(e),M}function Ws(e,l){let v=ji(e);if(!u(v))return[];let D=l.toLowerCase();return xw(v).sort().flatMap((M)=>{let L=M.toLowerCase();if(L!==D&&!L.startsWith(`${D}@`))return[];let z=Sn(v,M,"worker.json"),re=Z(z);return re?[{path:z,config:re}]:[]})}async function Fw(e,l,v,D,M){let L=Ws(l,e.name);if(L.length===0)throw new gt(`No worker for machine "${e.name}" on this computer.`);let z=D.controlWorker??St,re=[];for(let G of L){let ce=await z(G.config,"stop")!==null,we=xn(G.config,M),te=ce||we!==null;if(re.push({config:G.path,folder:G.config.workspaceRoot,running:te,service:we?.label??null}),!e.json&&we)v.stdout.write(`Removed background service ${we.label} (${G.config.workspaceRoot}); it won't start again.
+`,Tw=/^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/,Lw=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,bu="Machine NAME must start with a letter or digit and use only letters, digits or hyphens (max 63).",_u=["REASON_TOKEN","REASON_MACHINE_TOKEN"],ku="my-computer";function Ls(e){let l=(e.trim().split(".")[0]??"").toLowerCase().replace(/[^a-z0-9-]+/g,"-").replace(/-{2,}/g,"-").slice(0,63).replace(/^-+|-+$/g,"");return l&&yo(l)&&l!==ui?l:ku}class gt extends Error{}function Ww(e,l){let v,D=new Map,M=new Set;for(let ce=0;ce<e.length;ce+=1){let we=e[ce];if(we==="--help"||we==="-h"||we==="help")return null;if(we==="--dir"||we==="--token"||we==="--org"){let te=e[ce+1];if(!te||te.startsWith("-"))throw new gt(`Missing value after ${we}.`);if(D.has(we))throw new gt(`${we} may be specified only once.`);D.set(we,te),ce+=1;continue}if(["--once","--sandbox","--yes","-y","--stop","--json","--service"].includes(we)){M.add(we==="-y"?"--yes":we);continue}if(we.startsWith("-"))throw new gt(`Unknown option: ${we}. Run \`reason serve --help\`.`);if(v!==void 0)throw new gt("Expected one machine NAME.");v=we}let L=M.has("--stop");if(v===void 0&&L)throw new gt("Missing machine NAME. Usage: reason stop NAME");if(v!==void 0){if(!yo(v)&&!Tw.test(v))throw new gt(bu);if(v.toLowerCase()===ui)throw new gt(`"${ui}" is reserved for Reason's cloud. Choose another NAME.`)}if(L&&(D.size>0||[...M].some((ce)=>ce!=="--stop"&&ce!=="--json")))throw new gt("--stop takes only NAME and --json.");if(!L&&M.has("--json"))throw new gt("--json is only used with --stop.");if(M.has("--service")&&M.has("--once"))throw new gt("--service keeps the worker running; it cannot be combined with --once.");let z=L?void 0:D.get("--token")??l,re=D.get("--org");if(z!==void 0){if(!z.startsWith("rmt_"))throw new gt("That is not a machine token (they start with rmt_). Create one with: reason machines token NAME");if(re!==void 0&&!Lw.test(re))throw new gt("--org must be a workspace id.")}else if(re!==void 0)throw new gt("--org is only used with --token.");let G=D.get("--dir");return{...v===void 0?{}:{name:v},...G===void 0?{}:{dir:G},once:M.has("--once"),sandbox:M.has("--sandbox"),yes:M.has("--yes"),stop:L,json:M.has("--json"),service:M.has("--service"),...z===void 0?{}:{token:z},...re===void 0?{}:{org:re.toLowerCase()}}}function Ki(e,l){let v=Dw(e,l??"."),D;try{D=process.platform==="win32"?Ts.native(v):Ts(v)}catch{throw new gt(`Folder not found: ${v}`)}if(!Iw(D).isDirectory())throw new gt(`Not a folder: ${D}`);return D}var zi=(e)=>En(e,".reason","workers"),Ds=(e)=>u(f(e).state);function Nw(e,l,v){let D=En(zi(e),l);if(Z(En(D,"worker.json"))?.workspaceRoot===v)return D;return En(zi(e),`${l}@${Aw("sha256").update(v).digest("hex").slice(0,8)}`)}function vu(e){let{stateDirectory:l}=e;if(se(e.workspaceRoot,l)||se(l,e.workspaceRoot))throw new gt(`${e.workspaceRoot} contains Reason's machine settings (~/.reason). Pick a project folder with --dir.`);return x.parse({version:1,apiOrigin:e.apiOrigin,channel:e.channel,stateDirectory:l,workspaceRoot:e.workspaceRoot,lifetime:e.once?"ephemeral":"persistent",executionMode:e.sandbox?"confined":"host",name:e.name})}function Z(e){if(!u(e))return null;let l=new gt(`${e} is not a valid worker config. Remove it to start over.`),v;try{v=JSON.parse(m(e))}catch(M){if(M instanceof SyntaxError)throw l;throw M}let D=x.safeParse(v);if(!D.success)throw l;return D.data}function Ms(e){return[`--dir ${e.workspaceRoot}`,...e.executionMode==="confined"?["--sandbox"]:[]].join(" ")}async function Hw(e,l){e.stdout.write(`${l} [y/N] `);let v=await Pa(e.stdin,new AbortController().signal);return/^(y|yes)$/i.test(v?.trim()??"")}function Vi(e){return{write(l){if(l.startsWith('{"event":"worker.startup"'))return!0;return e.write(l)}}}var $w={machine_not_found:"worker_machine_not_found",machine_admin_required:"worker_machine_admin_required",invalid_token:"worker_machine_token_invalid",machine_token_forbidden:"worker_machine_token_forbidden",machine_token_owner_unauthorized:"worker_machine_token_owner_unauthorized"};async function Su(e){try{return await e()}catch(l){let v=l instanceof C?$w[l.code]:void 0;throw v?Error(v):l}}async function Bw(e,l,v,D){let M=vu({...l,name:e.name??ku,stateDirectory:En(zi(v),".token-enrollment")}),L=Kr(M,{stored:!1}),z=await Su(()=>io({apiOrigin:M.apiOrigin,token:e.token,body:L.request,...D.fetchImpl?{fetchImpl:D.fetchImpl}:{}}));if(!yo(z.machine_name))throw Error("worker_ticket_receipt_mismatch");if(e.name!==void 0&&e.name.toLowerCase()!==z.machine_name.toLowerCase())throw new gt(`This token is for machine "${z.machine_name}", not "${e.name}". `+"Run `reason serve --token \u2026` without a NAME, or ask for a token for that machine.");if(e.org!==void 0&&e.org!==z.organization_id.toLowerCase())throw new gt(`This token is for workspace ${z.organization_id}, not ${e.org}. Drop --org; the token names its workspace.`);let re=!1;return{name:e.name??z.machine_name,input:(G)=>{if(re)throw Error("worker_ticket_receipt_mismatch");return re=!0,L.saveInstall(G),L.complete(z.organization_id,z)}}}function Uw(e,l,v,D){return async(M)=>{if(l)return l.input(M);let L=await(v.worker?.enrollmentCredentials??qr)(M);if(!L)throw Error("worker_session_login_required");let z=(v.createApi??((re)=>new me(re)))(L);return hc(M,L,{createHeadlessDeviceEnrollmentTicket:(re)=>Su(async()=>{try{return await z.createMachineEnrollmentTicket(e,re)}catch(G){if(!(G instanceof C)||G.code!=="machine_not_found")throw G}try{await z.createMachine({name:e}),D.stdout.write(`Created machine "${e}".
+`)}catch(G){if(!(G instanceof C)||G.status!==409)throw G}return z.createMachineEnrollmentTicket(e,re)})})}}async function Ru(e,l,v,D){let M=await hi(e,D,()=>is(e,l,v));if(M.state==="current"||M.state==="busy")return M;if(!Ie(e,l,v))return null;return va(e),M}function Ws(e,l){let v=zi(e);if(!u(v))return[];let D=l.toLowerCase();return xw(v).sort().flatMap((M)=>{let L=M.toLowerCase();if(L!==D&&!L.startsWith(`${D}@`))return[];let z=En(v,M,"worker.json"),re=Z(z);return re?[{path:z,config:re}]:[]})}async function Fw(e,l,v,D,M){let L=Ws(l,e.name);if(L.length===0)throw new gt(`No worker for machine "${e.name}" on this computer.`);let z=D.controlWorker??St,re=[];for(let G of L){let ce=await z(G.config,"stop")!==null,we=Cn(G.config,M),te=ce||we!==null;if(re.push({config:G.path,folder:G.config.workspaceRoot,running:te,service:we?.label??null}),!e.json&&we)v.stdout.write(`Removed background service ${we.label} (${G.config.workspaceRoot}); it won't start again.
 `);if(!e.json)v.stdout.write(te?`Stopping machine "${e.name}" in ${G.config.workspaceRoot}; current work finishes first.
 `:`Machine "${e.name}" in ${G.config.workspaceRoot} is not running.
 `)}if(e.json)v.stdout.write(`${JSON.stringify({machine:e.name,workers:re})}
-`);return 0}async function Eu(e,l={}){let v=l.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},D=l.runWorker??Tr,M=l.env??process.env,L=_u.map((z)=>M[z]?.trim()).find(Boolean)||void 0;if(!l.env)for(let z of _u)delete process.env[z];try{let z=Ww(e,L);if(!z)return v.stdout.write(Mw),0;let re=Ts(l.home??s()),G=l.serviceHost??de(re);if(z.stop)return await Fw({...z,name:z.name},re,v,l,G);let ce=l.channel??w(),we=qi(l.cwd??process.cwd(),z.dir),te=z.service?ze(G,M):void 0,X={channel:ce,apiOrigin:ut(M,ce),workspaceRoot:we,once:z.once,sandbox:z.sandbox},he=z.token?await Bw({...z,token:z.token},X,re,l):void 0,Se=he?.name??z.name??Ls((l.hostname??Ow)()),Re=Nw(re,Se,we),Ee=Sn(Re,"worker.json"),Oe=Z(Ee);if(he&&Oe&&Ds(Oe)&&ft(Oe).revoked)Zt(Oe);let Me=!he&&Oe!==null&&Ds(Oe)&&(!R(M,"REASON_API_URL")?.trim()||W(X.apiOrigin,Oe.apiOrigin))?Oe.apiOrigin:void 0,Ce=vu({...X,...Me?{apiOrigin:Me}:{},name:Se,stateDirectory:Re}),Te=Oe!==null&&Ds(Oe);if(Te&&O(Oe)!==O(Ce)){if(Ce.lifetime==="ephemeral")throw new gt(`Machine "${Se}" is already saved for this folder; --once needs another folder or NAME.`);throw new gt(`Machine "${Se}" is already set up with different settings (${Oe.workspaceRoot}, ${Oe.executionMode==="host"?"your user permissions":"sandboxed"}).
+`);return 0}async function Eu(e,l={}){let v=l.io??{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)},D=l.runWorker??Tr,M=l.env??process.env,L=_u.map((z)=>M[z]?.trim()).find(Boolean)||void 0;if(!l.env)for(let z of _u)delete process.env[z];try{let z=Ww(e,L);if(!z)return v.stdout.write(Mw),0;let re=Ts(l.home??s()),G=l.serviceHost??de(re);if(z.stop)return await Fw({...z,name:z.name},re,v,l,G);let ce=l.channel??w(),we=Ki(l.cwd??process.cwd(),z.dir),te=z.service?ze(G,M):void 0,X={channel:ce,apiOrigin:ut(M,ce),workspaceRoot:we,once:z.once,sandbox:z.sandbox},he=z.token?await Bw({...z,token:z.token},X,re,l):void 0,Se=he?.name??z.name??Ls((l.hostname??Ow)()),Re=Nw(re,Se,we),Ee=En(Re,"worker.json"),Oe=Z(Ee);if(he&&Oe&&Ds(Oe)&&ft(Oe).revoked)Zt(Oe);let Me=!he&&Oe!==null&&Ds(Oe)&&(!R(M,"REASON_API_URL")?.trim()||W(X.apiOrigin,Oe.apiOrigin))?Oe.apiOrigin:void 0,Ce=vu({...X,...Me?{apiOrigin:Me}:{},name:Se,stateDirectory:Re}),Te=Oe!==null&&Ds(Oe);if(Te&&O(Oe)!==O(Ce)){if(Ce.lifetime==="ephemeral")throw new gt(`Machine "${Se}" is already saved for this folder; --once needs another folder or NAME.`);throw new gt(`Machine "${Se}" is already set up with different settings (${Oe.workspaceRoot}, ${Oe.executionMode==="host"?"your user permissions":"sandboxed"}).
 Run it with: reason serve ${Se} ${Ms(Oe)}
 Or remove it first: reason worker revoke --config ${Ee}`)}let We=Ce.lifetime==="persistent"?qe(Ce,G):null;if(We&&!z.service&&M[ke]!==We.label)return v.stdout.write(`Machine "${Se}" in ${we} already runs as a background service (${We.label}).
   Logs: ${We.logs}
@@ -222,15 +222,15 @@ Or remove it first: reason worker revoke --config ${Ee}`)}let We=Ce.lifetime==="
 `);else if($e&&!z.yes&&!he){let xe=`Sessions on "${Se}" will run commands in ${we} with your user permissions (no sandbox). Continue?`,Le=Boolean(v.stdin&&v.stdinIsTty);if(!l.confirm&&!Le)throw new gt(`${xe.replace(/ Continue\?$/,"")}
 Re-run with --yes to confirm.`);if(!await(l.confirm??((Ge)=>Hw(v,Ge)))(xe))return v.stderr.write(`Cancelled. Nothing was added.
 `),1}if(!Te)b(Ce.stateDirectory,!0),y(Ee,Ce);let Ue={...l.worker,enrollmentInput:Uw(Se,he,l,v)};if(Ce.lifetime==="persistent"&&!Te){v.stdout.write(`Adding this computer to machine "${Se}"\u2026
-`);let Le=await D(["enroll","--config",Ee],{...Ue,io:{stdout:{write:()=>!0},stderr:v.stderr}});if(Le!==0)return Le}if(te){let xe;try{xe=kn({config:Ce,launcher:te,path:M.PATH||"/usr/local/bin:/usr/bin:/bin",host:G})}catch(Le){if(!(Le instanceof j))throw Le;throw new gt(`${Le.message}
+`);let Le=await D(["enroll","--config",Ee],{...Ue,io:{stdout:{write:()=>!0},stderr:v.stderr}});if(Le!==0)return Le}if(te){let xe;try{xe=xn({config:Ce,launcher:te,path:M.PATH||"/usr/local/bin:/usr/bin:/bin",host:G})}catch(Le){if(!(Le instanceof j))throw Le;throw new gt(`${Le.message}
 This computer is added to machine "${Se}". Run it in this terminal with: reason serve ${Se} ${Ms(Ce)}
 Or try the background service again with: reason serve ${Se} ${Ms(Ce)} --service`)}return v.stdout.write([`Reason machine "${Se}" runs in the background`,`  Folder:   ${we}`,`  Mode:     ${Ce.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Service:  ${xe.label} (starts at ${xe.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:     ${xe.logs}`,`Start a session with: reason "\u2026" --on ${Se}`,`Stop it with: reason stop ${Se}`,...xe.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],""].join(`
 `)),0}v.stdout.write([`Reason machine "${Se}"`,`  Folder:   ${we}`,`  Mode:     ${Ce.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host sessions yet)"}`,`  Lifetime: ${Ce.lifetime==="persistent"?`saved; run \`reason serve ${Se}\` again to reconnect`:"this run only (--once)"}`,"Connecting\u2026",""].join(`
-`));let Ne=We&&M[ke]===We.label&&!l.runWorker?Fi({stateDirectory:Ce.stateDirectory}):null;try{return await D(["start","--config",Ee],{...Ue,io:{stdout:v.stdout,stderr:zi(v.stderr)},onStartup:(xe)=>{if(xe==="ready")v.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${Se}
+`));let Ne=We&&M[ke]===We.label&&!l.runWorker?qi({stateDirectory:Ce.stateDirectory}):null;try{return await D(["start","--config",Ee],{...Ue,io:{stdout:v.stdout,stderr:Vi(v.stderr)},onStartup:(xe)=>{if(xe==="ready")v.stdout.write(`Waiting for sessions\u2026 start one with: reason "\u2026" --on ${Se}
 `);l.worker?.onStartup?.(xe)}})}finally{Ne?.stop()}}catch(z){if(z instanceof gt||z instanceof j){let ce=z instanceof j&&z.code?` (${z.code})`:"";return v.stderr.write(`Reason: ${z.message}${ce}
 `),2}let re=z instanceof Error&&/^worker_[a-z_]+$/.test(z.message)?z.message:null,G=re?Mn(re):void 0;return v.stderr.write(`Reason: ${re?G?`${G} (${re})`:re:"could not prepare this machine."}
 `),1}}var jw=200;var YC=h({version:i(1),session_ids:d(t().min(1).max(200)).max(jw)});function Yn(e){let l=S(e);return l!==null&&Date.parse(l.worker?.expiresAt??"")>Date.now()&&!ft(e).revoked}import{spawnSync as Pu}from"child_process";import{readFileSync as qw,rmdirSync as zw,rmSync as Kw}from"fs";import{join as Ns}from"path";var Vw=["Reason.app","Ara Sidecar.app","Ara Device.app"],Jw="sidecar_retire_failed";function Gw(e){return Ns(e,"Library","Application Support","Ara","Sidecar")}function Yw(e){try{let l=qw(Ns(e,"Contents","Info.plist"),"utf8");return/<key>CFBundleIdentifier<\/key>\s*<string>so\.ara\.sidecar<\/string>/.test(l)}catch{return!1}}function Cu(e,l={}){let v=Gw(e),D=Vw.map((re)=>Ns(v,re)).filter(Yw);if(D.length===0)return{status:"absent"};let M=l.processTable??(()=>Pu("/bin/ps",["-xo","pid=,command="],{encoding:"utf8",timeout:5000}).stdout??""),L=l.signal??((re)=>process.kill(re,"SIGTERM")),z=l.command??((re,G)=>Pu(re,[...G],{stdio:"ignore",timeout:1e4}).status??1);try{for(let re of M().split(`
-`)){let G=re.trim().match(/^(\d+)\s+(.+)$/);if(!G)continue;if(!D.some((ce)=>G[2].startsWith(`${ce}/Contents/MacOS/`)))continue;try{L(Number(G[1]))}catch{}}for(let re of D)z(On,["-u",re]),Kw(re,{recursive:!0,force:!0});try{zw(v)}catch{}}catch{return{status:"failed",code:Jw}}return{status:"removed",bundles:D}}var ny=`Connect this computer to Reason
+`)){let G=re.trim().match(/^(\d+)\s+(.+)$/);if(!G)continue;if(!D.some((ce)=>G[2].startsWith(`${ce}/Contents/MacOS/`)))continue;try{L(Number(G[1]))}catch{}}for(let re of D)z(Nn,["-u",re]),Kw(re,{recursive:!0,force:!0});try{zw(v)}catch{}}catch{return{status:"failed",code:Jw}}return{status:"removed",bundles:D}}var ny=`Connect this computer to Reason
 
 Usage:
   reason connect                 Your computer, kept connected in the background
@@ -301,45 +301,45 @@ Usage:
                                  Reason (all of it when it is the only account here), and it is not kept
                                  disconnected: the next reason "\u2026" connects it again
   --yes, -y                      Accepted for scripts; disconnect never asks
-`;class ct extends Error{code;constructor(e,l="worker_connect_refused"){super(e);this.code=l}}var iy=4,Ki={write:()=>!0};function fe(e,l,v=!1){let D=Wu(e,l,v);return D.length===1?D[0]:Bt(wt(Bt(e,".config")),...Lu(l,v))}var Lu=(e,l)=>[...e==="production"?[]:[e],l?"connect-once":"connect"];function Wu(e,l,v=!1){let D=e;try{D=Yr(e)}catch{}return["ara","reason"].map((M)=>Bt(D,".config",M,...Lu(l,v))).filter(ay)}function ay(e){try{if(Yr(e)!==e)return!1;return Z(Bt(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var Nu="disconnected.json";function Qi(e,l){return u(Bt(fe(e,l),Nu))}function Vi(e,l,v){let D=Bt(fe(e,l),Nu);if(!v){Xn(D,{force:!0});return}b(Bs(D),!0),y(D,{version:1,disconnected_at:new Date().toISOString()})}function sy(e){let l=new Map,v=new Set;for(let te=0;te<e.length;te+=1){let X=e[te];if(X==="--help"||X==="-h"||X==="help")return null;if(["--to","--token","--folder","--sessions",ti,ri,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(X)){let he=e[te+1];if(!he||he.startsWith("-"))throw new ct(`Missing value after ${X}.`);if(l.has(X))throw new ct(`${X} may be specified only once.`);l.set(X,he),te+=1;continue}if(["--once","--yes","-y","--minimal"].includes(X)){v.add(X==="-y"?"--yes":X);continue}if(X.startsWith("-"))throw new ct(`Unknown option: ${X}. Run \`reason connect --help\`.`);throw new ct(`Unexpected argument: ${X}. To add this computer to a team machine, use --to ${X}.`)}let D=l.get("--sessions");if(D!==void 0&&!/^[1-4]$/.test(D))throw new ct("--sessions takes a number from 1 to 4.");if(l.has(ri)&&!l.has(ti))throw new ct("--proxy-ca-file requires --proxy.");let M=l.get("--keep-awake");if(M!==void 0&&!["on","off"].includes(M))throw new ct("--keep-awake takes on or off.");if(M!==void 0&&(l.size>1||[...v].some((te)=>te!=="--yes")))throw new ct("Run reason connect --keep-awake on|off on its own.");let L=["--add-folder","--remove-folder"].filter((te)=>l.has(te));if(L.length>0&&(l.size>1||[...v].some((te)=>te!=="--yes")))throw new ct(`Run reason connect ${L[0]} PATH on its own.`);let z=l.get("--user-chrome");if(z!==void 0&&z!=="on"&&z!=="off")throw new ct("--user-chrome takes on or off.");let re=l.get("--cloud-sessions");if(re!==void 0&&re!=="on"&&re!=="off")throw new ct("--cloud-sessions takes on or off.");let G=l.get("--local-logins");if(G!==void 0&&G!=="on"&&G!=="off")throw new ct("--local-logins takes on or off.");let ce=l.get("--name")?.trim();if(ce!==void 0&&(ce.length===0||ce.length>160))throw new ct("--name takes a name of 1 to 160 characters.");let we=(te,X)=>X===void 0?{}:{[te]:X};return{...we("to",l.get("--to")),...we("token",l.get("--token")),...we("folder",l.get("--folder")),...we("sessions",D===void 0?void 0:Number(D)),...we("keepAwake",M===void 0?void 0:M==="on"),...we("userChrome",z===void 0?void 0:z==="on"),...we("cloudSessions",re===void 0?void 0:re==="on"),...we("localLogins",G===void 0?void 0:G==="on"),once:v.has("--once"),yes:v.has("--yes"),minimal:v.has("--minimal"),...we("proxy",l.get(ti)),...we("proxyCaFile",l.get(ri)),...we("apiKey",l.get("--api-key")),...we("name",ce),...we("apiUrl",l.get("--api-url")),...we("addFolder",l.get("--add-folder")),...we("removeFolder",l.get("--remove-folder"))}}var Gr=(e)=>u(f(e).state),Hu=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
-`;function $u(e){return e.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function Bu(e){let{parsed:l,saved:v}=e,D=v?.workspaceRoot??e.home;if(l.folder!==void 0)try{D=qi(e.options.cwd??process.cwd(),l.folder)}catch(re){throw new ct(re instanceof Error?re.message:String(re))}if(!ge(D,e.stateDirectory))throw new ct(`${D} holds Reason's own settings. Pick another folder with --folder.`);let M;try{M=l.apiUrl!==void 0?ut({REASON_API_URL:l.apiUrl},e.channel):v&&!R(e.environment,"REASON_API_URL")?.trim()?v.apiOrigin:ut(e.environment,e.channel)}catch(re){throw new ct(`${l.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${re instanceof Error?re.message:String(re)}`)}if(v&&M!==v.apiOrigin&&W(M,v.apiOrigin))M=v.apiOrigin;if(!Cr(M)&&!An(e.channel,M))throw new ct(`${M} is not the ${e.channel} Reason API this CLI connects to.`+(e.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let L=v?.proxy;if(l.proxy!==void 0)try{L=qa({proxyUrl:l.proxy,caFile:l.proxyCaFile},{home:e.home,statePath:e.stateDirectory})}catch(re){if(!(re instanceof K))throw re;throw new ct(re.message)}let z=(v?.folders??[]).filter((re)=>re!==D);return x.parse({...z.length?{folders:z}:{},version:1,apiOrigin:M,channel:e.channel,stateDirectory:e.stateDirectory,workspaceRoot:D,lifetime:e.lifetime,executionMode:"host",name:l.name??v?.name??Ls((e.options.hostname??ty)()),slots:l.sessions??v?.slots??iy,...L?{proxy:L}:{},...(l.userChrome??v?.userChrome)===void 0?{}:{userChrome:l.userChrome??v?.userChrome},...l.cloudSessions??v?.cloudSessions?{cloudSessions:!0}:{},...(l.localLogins??v?.localLogins)===void 0?{}:{localLogins:l.localLogins??v?.localLogins}})}function Uu(e,l){if(e.localLogins!==void 0||l)return e;return x.parse({...e,localLogins:!0})}async function Us(e,l,v,D,M){if(ft(e).revoked){if(Gr(e))try{Zt(e)}catch{}pa(e);let re=[];try{re=ey(p(e))}catch{}for(let G of re)if(G!=="workspaces")Xn(Bt(p(e),G),{recursive:!0,force:!0})}else if(Gr(e))Zt(e);b(e.stateDirectory,!0),y(l,e);let L=cy(v.stderr),z=await(D.runWorker??Tr)(["enroll","--config",l],{...Fs(D.worker,M),io:{stdout:Ki,stderr:L}});if(z!==0)v.stderr.write(`Reason: this computer was not connected. (${L.code()??"worker_command_failed"})
-`);return z}function cy(e){let l=null;return{write:(v)=>{for(let D of v.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))l=D[1];return e.write(v)},code:()=>l}}function Fo(e,l,v){let D=ve(Q(Pn("REASON_CLI_CHANNEL",l),e));return D&&W(D.apiOrigin,v.apiOrigin)?D.orgId.toLowerCase():null}async function ly(e,l,v,D){let{config:M,configPath:L}=Qo(e,l),z=(ce)=>{try{return ce!==null&&Yn(ce)&&S(ce)?.orgId.toLowerCase()===l}catch{return!1}},re=null;try{re=Z(L)}catch{}if(z(re))return 0;v.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
-`);let G=await Us(M,L,v,D,void 0);if(G===0&&z(M))return 0;if(G===0&&Gr(M))await Gi(M,L,v,D);if(Xn(M.stateDirectory,{recursive:!0,force:!0}),G!==0)return G;throw new ct("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function Fs(e,l){return l?{...e,enrollmentCredentials:(v)=>na(v,l)}:{...e}}async function js(e,l,v,D,M,L="connect"){if(await qs(e,D,M,L),L==="connect"&&!await Ku(e,v,D))return!1;if(!await Gi(e,l,v,D))return!1;return sc(e.stateDirectory),Xn(e.stateDirectory,{recursive:!0,force:!0}),!0}async function Gi(e,l,v,D){if(!Gr(e)||ft(e).revoked)return!0;for(let M=1;;M+=1){let L=M===3;if(await(D.runWorker??Tr)(["revoke","--config",l],{...D.worker,io:{stdout:Ki,stderr:L?v.stderr:Ki}})===0)return!0;if(L)return!1;await new Promise((re)=>setTimeout(re,1000))}}async function qs(e,l,v,D="connect",M=!1){let L=l.controlWorker??St,z=async()=>L(e,"status").catch(()=>null),re=await L(e,"stop").catch(()=>null)!==null,G=!M&&xn(e,v,D);if(re||G){let ce=Date.now()+e.shutdownGraceMs+60000;while(Date.now()<ce&&await z()!==null)await new Promise((we)=>setTimeout(we,250))}}function zs(e,l){return l==="darwin"&&e.userChrome!==!1}function Hs(e,l,v){let D=[...zs(e,l)?["your own Chrome profiles"]:[],...e.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${e.name}" \xB7 Sessions run here, ${$u(e).replace(/^runs /,"")}`,...D.length>0?[`  Uses ${D.join(" and ")} (reason connect --help to change)`]:[],...v,""].join(`
-`)}function $s(e,l,v,D){return[e,`  Name:      ${l.name}`,`  Folder:    ${l.workspaceRoot}`,...(l.folders??[]).map((M)=>`             ${M}`),"  Sessions:  every Session you start",`  Mode:      ${$u(l)}`,...l.proxy?[`  Proxy:     ${za(l.proxy)}`]:[],...zs(l,v)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...l.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...l.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...D,""].join(`
+`;class ct extends Error{code;constructor(e,l="worker_connect_refused"){super(e);this.code=l}}var iy=4,Ji={write:()=>!0};function fe(e,l,v=!1){let D=Wu(e,l,v);return D.length===1?D[0]:Bt(wt(Bt(e,".config")),...Lu(l,v))}var Lu=(e,l)=>[...e==="production"?[]:[e],l?"connect-once":"connect"];function Wu(e,l,v=!1){let D=e;try{D=Yr(e)}catch{}return["ara","reason"].map((M)=>Bt(D,".config",M,...Lu(l,v))).filter(ay)}function ay(e){try{if(Yr(e)!==e)return!1;return Z(Bt(e,"worker.json"))?.stateDirectory===e}catch{return!1}}var Nu="disconnected.json";function eo(e,l){return u(Bt(fe(e,l),Nu))}function Gi(e,l,v){let D=Bt(fe(e,l),Nu);if(!v){Zn(D,{force:!0});return}b(Bs(D),!0),y(D,{version:1,disconnected_at:new Date().toISOString()})}function sy(e){let l=new Map,v=new Set;for(let te=0;te<e.length;te+=1){let X=e[te];if(X==="--help"||X==="-h"||X==="help")return null;if(["--to","--token","--folder","--sessions",ri,ni,"--keep-awake","--user-chrome","--cloud-sessions","--local-logins","--api-key","--name","--api-url","--add-folder","--remove-folder"].includes(X)){let he=e[te+1];if(!he||he.startsWith("-"))throw new ct(`Missing value after ${X}.`);if(l.has(X))throw new ct(`${X} may be specified only once.`);l.set(X,he),te+=1;continue}if(["--once","--yes","-y","--minimal"].includes(X)){v.add(X==="-y"?"--yes":X);continue}if(X.startsWith("-"))throw new ct(`Unknown option: ${X}. Run \`reason connect --help\`.`);throw new ct(`Unexpected argument: ${X}. To add this computer to a team machine, use --to ${X}.`)}let D=l.get("--sessions");if(D!==void 0&&!/^[1-4]$/.test(D))throw new ct("--sessions takes a number from 1 to 4.");if(l.has(ni)&&!l.has(ri))throw new ct("--proxy-ca-file requires --proxy.");let M=l.get("--keep-awake");if(M!==void 0&&!["on","off"].includes(M))throw new ct("--keep-awake takes on or off.");if(M!==void 0&&(l.size>1||[...v].some((te)=>te!=="--yes")))throw new ct("Run reason connect --keep-awake on|off on its own.");let L=["--add-folder","--remove-folder"].filter((te)=>l.has(te));if(L.length>0&&(l.size>1||[...v].some((te)=>te!=="--yes")))throw new ct(`Run reason connect ${L[0]} PATH on its own.`);let z=l.get("--user-chrome");if(z!==void 0&&z!=="on"&&z!=="off")throw new ct("--user-chrome takes on or off.");let re=l.get("--cloud-sessions");if(re!==void 0&&re!=="on"&&re!=="off")throw new ct("--cloud-sessions takes on or off.");let G=l.get("--local-logins");if(G!==void 0&&G!=="on"&&G!=="off")throw new ct("--local-logins takes on or off.");let ce=l.get("--name")?.trim();if(ce!==void 0&&(ce.length===0||ce.length>160))throw new ct("--name takes a name of 1 to 160 characters.");let we=(te,X)=>X===void 0?{}:{[te]:X};return{...we("to",l.get("--to")),...we("token",l.get("--token")),...we("folder",l.get("--folder")),...we("sessions",D===void 0?void 0:Number(D)),...we("keepAwake",M===void 0?void 0:M==="on"),...we("userChrome",z===void 0?void 0:z==="on"),...we("cloudSessions",re===void 0?void 0:re==="on"),...we("localLogins",G===void 0?void 0:G==="on"),once:v.has("--once"),yes:v.has("--yes"),minimal:v.has("--minimal"),...we("proxy",l.get(ri)),...we("proxyCaFile",l.get(ni)),...we("apiKey",l.get("--api-key")),...we("name",ce),...we("apiUrl",l.get("--api-url")),...we("addFolder",l.get("--add-folder")),...we("removeFolder",l.get("--remove-folder"))}}var Gr=(e)=>u(f(e).state),Hu=`Reason: this computer now runs Sessions with your user permissions (its sandbox is gone).
+`;function $u(e){return e.executionMode==="host"?"runs with your user permissions":"sandboxed (can't host Sessions yet)"}function Bu(e){let{parsed:l,saved:v}=e,D=v?.workspaceRoot??e.home;if(l.folder!==void 0)try{D=Ki(e.options.cwd??process.cwd(),l.folder)}catch(re){throw new ct(re instanceof Error?re.message:String(re))}if(!ge(D,e.stateDirectory))throw new ct(`${D} holds Reason's own settings. Pick another folder with --folder.`);let M;try{M=l.apiUrl!==void 0?ut({REASON_API_URL:l.apiUrl},e.channel):v&&!R(e.environment,"REASON_API_URL")?.trim()?v.apiOrigin:ut(e.environment,e.channel)}catch(re){throw new ct(`${l.apiUrl===void 0?"REASON_API_URL":"--api-url"} must be an HTTPS URL (HTTP only on this computer): ${re instanceof Error?re.message:String(re)}`)}if(v&&M!==v.apiOrigin&&W(M,v.apiOrigin))M=v.apiOrigin;if(!Cr(M)&&!Pn(e.channel,M))throw new ct(`${M} is not the ${e.channel} Reason API this CLI connects to.`+(e.channel==="production"?" For staging, use the staging CLI (REASON_CLI_CHANNEL=staging).":""));let L=v?.proxy;if(l.proxy!==void 0)try{L=Wa({proxyUrl:l.proxy,caFile:l.proxyCaFile},{home:e.home,statePath:e.stateDirectory})}catch(re){if(!(re instanceof K))throw re;throw new ct(re.message)}let z=(v?.folders??[]).filter((re)=>re!==D);return x.parse({...z.length?{folders:z}:{},version:1,apiOrigin:M,channel:e.channel,stateDirectory:e.stateDirectory,workspaceRoot:D,lifetime:e.lifetime,executionMode:"host",name:l.name??v?.name??Ls((e.options.hostname??ty)()),slots:l.sessions??v?.slots??iy,...L?{proxy:L}:{},...(l.userChrome??v?.userChrome)===void 0?{}:{userChrome:l.userChrome??v?.userChrome},...l.cloudSessions??v?.cloudSessions?{cloudSessions:!0}:{},...(l.localLogins??v?.localLogins)===void 0?{}:{localLogins:l.localLogins??v?.localLogins}})}function Uu(e,l){if(e.localLogins!==void 0||l)return e;return x.parse({...e,localLogins:!0})}async function Us(e,l,v,D,M){if(ft(e).revoked){if(Gr(e))try{Zt(e)}catch{}ha(e);let re=[];try{re=ey(p(e))}catch{}for(let G of re)if(G!=="workspaces")Zn(Bt(p(e),G),{recursive:!0,force:!0})}else if(Gr(e))Zt(e);b(e.stateDirectory,!0),y(l,e);let L=cy(v.stderr),z=await(D.runWorker??Tr)(["enroll","--config",l],{...Fs(D.worker,M),io:{stdout:Ji,stderr:L}});if(z!==0)v.stderr.write(`Reason: this computer was not connected. (${L.code()??"worker_command_failed"})
+`);return z}function cy(e){let l=null;return{write:(v)=>{for(let D of v.matchAll(/^Reason worker: (worker_[a-z_]{1,70})\.$/gm))l=D[1];return e.write(v)},code:()=>l}}function qo(e,l,v){let D=ve(Q(Rn("REASON_CLI_CHANNEL",l),e));return D&&W(D.apiOrigin,v.apiOrigin)?D.orgId.toLowerCase():null}async function ly(e,l,v,D){let{config:M,configPath:L}=oi(e,l),z=(ce)=>{try{return ce!==null&&Yn(ce)&&S(ce)?.orgId.toLowerCase()===l}catch{return!1}},re=null;try{re=Z(L)}catch{}if(z(re))return 0;v.stdout.write(`Connecting this computer for your account too, beside the account it is already connected for\u2026
+`);let G=await Us(M,L,v,D,void 0);if(G===0&&z(M))return 0;if(G===0&&Gr(M))await Zi(M,L,v,D);if(Zn(M.stateDirectory,{recursive:!0,force:!0}),G!==0)return G;throw new ct("Your sign-in changed while this computer was connecting for it. Run reason connect again.","worker_sign_in_changed")}function Fs(e,l){return l?{...e,enrollmentCredentials:(v)=>oa(v,l)}:{...e}}async function js(e,l,v,D,M,L="connect"){if(await qs(e,D,M,L),L==="connect"&&!await Ku(e,v,D))return!1;if(!await Zi(e,l,v,D))return!1;return sc(e.stateDirectory),Zn(e.stateDirectory,{recursive:!0,force:!0}),!0}async function Zi(e,l,v,D){if(!Gr(e)||ft(e).revoked)return!0;for(let M=1;;M+=1){let L=M===3;if(await(D.runWorker??Tr)(["revoke","--config",l],{...D.worker,io:{stdout:Ji,stderr:L?v.stderr:Ji}})===0)return!0;if(L)return!1;await new Promise((re)=>setTimeout(re,1000))}}async function qs(e,l,v,D="connect",M=!1){let L=l.controlWorker??St,z=async()=>L(e,"status").catch(()=>null),re=await L(e,"stop").catch(()=>null)!==null,G=!M&&Cn(e,v,D);if(re||G){let ce=Date.now()+e.shutdownGraceMs+60000;while(Date.now()<ce&&await z()!==null)await new Promise((we)=>setTimeout(we,250))}}function zs(e,l){return l==="darwin"&&e.userChrome!==!1}function Hs(e,l,v){let D=[...zs(e,l)?["your own Chrome profiles"]:[],...e.localLogins?["your Claude Code, Codex and Grok logins"]:[]];return[`\u2713 Connected "${e.name}" \xB7 Sessions run here, ${$u(e).replace(/^runs /,"")}`,...D.length>0?[`  Uses ${D.join(" and ")} (reason connect --help to change)`]:[],...v,""].join(`
+`)}function $s(e,l,v,D){return[e,`  Name:      ${l.name}`,`  Folder:    ${l.workspaceRoot}`,...(l.folders??[]).map((M)=>`             ${M}`),"  Sessions:  every Session you start",`  Mode:      ${$u(l)}`,...l.proxy?[`  Proxy:     ${qa(l.proxy)}`]:[],...zs(l,v)?["  Chrome:    your own Chrome profiles (--user-chrome off to stop)"]:[],...l.cloudSessions?["  Cloud:     your own turns in cloud Sessions may use it (--cloud-sessions on)"]:[],...l.localLogins?["  Logins:    your Claude Code, Codex and Grok logins here serve your Sessions (--local-logins off to stop)"]:[],...D,""].join(`
 `)}async function Au(e,l,v){let{io:D,options:M}=v;if(Wu(v.home,v.channel).length===2)D.stderr.write(`${JSON.stringify({event:"worker.connection_bound_twice",chosen:Bs(l),timestamp:new Date().toISOString()})}
 `);let L=De(Bt(v.home,".config"));if(L.problem)D.stderr.write(`${JSON.stringify({event:"worker.config_rename",code:L.problem,timestamp:new Date().toISOString()})}
-`);cs(v.home,v.host.platform);let z=Lc({home:v.home,channel:v.channel,saved:e,configPath:l,log:(he)=>D.stderr.write(`${he}
+`);ls(v.home,v.host.platform);let z=Lc({home:v.home,channel:v.channel,saved:e,configPath:l,log:(he)=>D.stderr.write(`${he}
 `),host:v.host}),re=Ic({...z,log:(he)=>D.stderr.write(`${he}
-`)}),{configPath:G}=re,ce=re.saved;if(!ce)return D.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let we=(he,Se)=>{let Re=Vs(v.home,v.channel),Ee;try{let Me=null;try{Me=Se.keep?null:S(ce)?.orgId.toLowerCase()??null}catch{}if(Ee=oi(ce,{prefer:Fo(v.home,v.channel,ce),...Se}),Ee&&Me)ni(Ee,Me)}finally{Re()}if(!Ee)return!1;ce=Ee;let Oe="";try{Oe=` (workspace ${S(Ee)?.orgId??"unknown"})`}catch{}return D.stderr.write(`Reason: ${he}; this computer goes on running Sessions for its other Reason account${Oe}.
-`),!0};if(ft(ce).revoked&&!we("this computer's connection was removed from Reason",{keep:!1}))return D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(ce.executionMode==="confined"||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0,Se=he?null:Fo(v.home,v.channel,ce);if(!he&&!(Se&&ho(ce,Se)))we("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let te=ce.executionMode==="confined";if(te||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0;if(D.stderr.write(te?Hu:`Reason: this computer's connection expired; renewing it with ${he?"its API key":"your login"}\u2026
-`),await Us(x.parse({...ce,executionMode:"host"}),G,D,M,he)!==0)return D.stderr.write(he?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let X=new AbortController;if(!M.runWorker)import("./ask-relay-gk4ks8mg.js").then(({runBackgroundAskRelay:he})=>he(X.signal,(Se)=>D.stderr.write(`${Se}
-`))).catch(()=>{});try{for(;;){let he=lr(ce.stateDirectory)===null?{ownerWorkspaces:M.worker?.ownerWorkspaces??{}}:{},Se=M.runWorker?null:Fi({stateDirectory:ce.stateDirectory}),Re=!1,Ee;try{Ee=await(M.runWorker??Tr)(["start","--config",G],{deferOptionalLanes:!0,...M.worker,...he,ownComputer:!0,io:{stdout:D.stdout,stderr:D.stderr},onDeviceRevoked:()=>{Re=!0}})}finally{Se?.stop()}if(!Re)return Ee;if(!we("this computer's connection was removed from Reason",{keep:!1}))break}return Vi(v.home,v.channel,!0),D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{X.abort()}}async function dy(e,l,v){let{io:D,options:M,home:L,channel:z,environment:re}=v;if(l&&await(M.controlWorker??St)(l,"status").catch(()=>null))throw new ct("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=fe(L,z,!0),ce=Bu({parsed:e,saved:l,stateDirectory:G,lifetime:"ephemeral",home:L,channel:z,options:M,environment:re}),we=Uu(ce,v.apiKey??(l?lr(l.stateDirectory)??void 0:void 0)),te=Bt(G,"worker.json");return b(G,!0),y(te,we),D.stdout.write($s(`Reason: connecting "${we.name}" while this command runs`,we,v.host.platform,["Connecting\u2026"])),(M.runWorker??Tr)(["start","--config",te],{...Fs(M.worker,v.apiKey),ownComputer:!0,io:{stdout:D.stdout,stderr:zi(D.stderr)},onStartup:(X)=>{if(X==="ready")D.stdout.write(`Connected. Start Sessions on "${we.name}" from Reason. Press Ctrl-C to stop.
+`)}),{configPath:G}=re,ce=re.saved;if(!ce)return D.stderr.write("Reason: this computer has no saved connection. Run `reason connect`.\n"),0;let we=(he,Se)=>{let Re=Vs(v.home,v.channel),Ee;try{let Me=null;try{Me=Se.keep?null:S(ce)?.orgId.toLowerCase()??null}catch{}if(Ee=si(ce,{prefer:qo(v.home,v.channel,ce),...Se}),Ee&&Me)ii(Ee,Me)}finally{Re()}if(!Ee)return!1;ce=Ee;let Oe="";try{Oe=` (workspace ${S(Ee)?.orgId??"unknown"})`}catch{}return D.stderr.write(`Reason: ${he}; this computer goes on running Sessions for its other Reason account${Oe}.
+`),!0};if(ft(ce).revoked&&!we("this computer's connection was removed from Reason",{keep:!1}))return D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0;if(ce.executionMode==="confined"||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0,Se=he?null:qo(v.home,v.channel,ce);if(!he&&!(Se&&wo(ce,Se)))we("this computer's connection expired and its account is not signed in here",{keep:!0,live:!0})}let te=ce.executionMode==="confined";if(te||!Yn(ce)){let he=lr(ce.stateDirectory)??void 0;if(D.stderr.write(te?Hu:`Reason: this computer's connection expired; renewing it with ${he?"its API key":"your login"}\u2026
+`),await Us(x.parse({...ce,executionMode:"host"}),G,D,M,he)!==0)return D.stderr.write(he?"Reason: could not renew this computer's connection. Run `reason connect --api-key KEY` with a valid key.\n":"Reason: could not renew this computer's connection. Run `reason login`, then `reason connect`.\n"),0}let X=new AbortController;if(!M.runWorker)import("./ask-relay-hfa5kzxn.js").then(({runBackgroundAskRelay:he})=>he(X.signal,(Se)=>D.stderr.write(`${Se}
+`))).catch(()=>{});try{for(;;){let he=lr(ce.stateDirectory)===null?{ownerWorkspaces:M.worker?.ownerWorkspaces??{}}:{},Se=M.runWorker?null:qi({stateDirectory:ce.stateDirectory}),Re=!1,Ee;try{Ee=await(M.runWorker??Tr)(["start","--config",G],{deferOptionalLanes:!0,...M.worker,...he,ownComputer:!0,io:{stdout:D.stdout,stderr:D.stderr},onDeviceRevoked:()=>{Re=!0}})}finally{Se?.stop()}if(!Re)return Ee;if(!we("this computer's connection was removed from Reason",{keep:!1}))break}return Gi(v.home,v.channel,!0),D.stderr.write("Reason: this computer was removed from Reason. Run `reason connect` to connect it again.\n"),0}finally{X.abort()}}async function dy(e,l,v){let{io:D,options:M,home:L,channel:z,environment:re}=v;if(l&&await(M.controlWorker??St)(l,"status").catch(()=>null))throw new ct("This computer is already connected in the background (see `reason status`). Run `reason disconnect` first to connect it only while a command runs.");let G=fe(L,z,!0),ce=Bu({parsed:e,saved:l,stateDirectory:G,lifetime:"ephemeral",home:L,channel:z,options:M,environment:re}),we=Uu(ce,v.apiKey??(l?lr(l.stateDirectory)??void 0:void 0)),te=Bt(G,"worker.json");return b(G,!0),y(te,we),D.stdout.write($s(`Reason: connecting "${we.name}" while this command runs`,we,v.host.platform,["Connecting\u2026"])),(M.runWorker??Tr)(["start","--config",te],{...Fs(M.worker,v.apiKey),ownComputer:!0,io:{stdout:D.stdout,stderr:Vi(D.stderr)},onStartup:(X)=>{if(X==="ready")D.stdout.write(`Connected. Start Sessions on "${we.name}" from Reason. Press Ctrl-C to stop.
 `);M.worker?.onStartup?.(X)}})}function uy(e,l,v,D){if(v.platform!=="darwin")throw new ct("--keep-awake is for macOS.");if(!l)throw new ct("This computer is not connected to Reason. Run reason connect first.");b(p(l),!0),$c(f(l).daemon,e);let M=nr(f(l).daemon)==="battery_and_ac";return D.stdout.write(`Keep awake: ${M?"on (this Mac stays awake while it runs Sessions)":"off"}
-`),0}var fy=n({root:n({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});async function Fu(e,l,v,D){let M=await(Fs(D.worker,v).enrollmentCredentials??qr)(e,jr(e));if(!M)throw Error("worker_session_login_required");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let L=D.folderApi?.(M)??new me(M,{credentialsPath:jr(e),fetchImpl:oe(e.proxy)}),z=(re)=>re instanceof C&&re.status===404&&!["device_not_found","root_not_found"].includes(re.code);return{add:async(re)=>{let G=yc(e,re,{...l.roots[0].permissions,expose_mcp:!1}),ce=await L.addDeviceRoot(l.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((te)=>{if(z(te))throw Error("worker_folders_unavailable");if(te instanceof C&&te.code==="root_limit_reached")throw new ct("This computer already has the most folders Reason allows (32).");throw te}),we=fy.parse(ce).root;if(we.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:we.id,label:we.label}},remove:async(re)=>{await L.removeDeviceRoot(l.deviceId,re).catch((G)=>{if(z(G))throw Error("worker_folders_unavailable");if(!(G instanceof C&&G.code==="root_not_found"))throw G})}}}function ju(e,l,v){ae({...l,roots:v,handsSlots:e.slots,worker:{...l.worker,configDigest:O(e)}},f(e).state,{proofStore:xt(e)})}async function my(e,l,v,D){let{io:M,options:L,host:z}=D,re=l&&!D.apiKey&&lr(l.stateDirectory)===null?Fo(D.home,D.channel,l):null,G=l&&re&&Gr(l)&&!ho(l,re)?Qt(l).find((xe)=>xe.account&&xe.organizationId===re)??null:void 0;if(G===null)throw new ct("This computer is not connected for your account. Run reason connect first.");let ce=G?G.config:l,we=G?G.configPath:v,te=ce&&Gr(ce)&&!ft(ce).revoked?S(ce):null;if(!l||!ce||!te||ce.lifetime!=="persistent")throw new ct("This computer is not connected to Reason. Run reason connect first.");let X=e.addFolder!==void 0,he=X?e.addFolder:e.removeFolder,Se=L.cwd??process.cwd(),Re;try{Re=qi(Se,he)}catch(xe){if(X)throw new ct(xe instanceof Error?xe.message:String(xe));Re=ry(Se,he)}if(Re===ce.workspaceRoot)throw new ct(`${Re} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let Ee=ce.folders??[],Oe=te.roots.slice(1).find((xe)=>xe.path===Re);if(!X&&!Oe&&!Ee.includes(Re))throw new ct(`${Re} is not one of this computer's folders.`);if(X&&!ge(Re,ce.stateDirectory))throw new ct(`${Re} holds Reason's own settings.`);if(X&&!Oe&&Ee.length>=31)throw new ct("This computer already has the most folders Reason allows (32).");let Me=D.apiKey??lr(ce.stateDirectory)??void 0,Ce=await Fu(ce,te,Me,L),Te=te.roots.filter((xe)=>xe.path!==Re);if(X)Te=[...Te,await Ce.add(Re)];else if(Oe)await Ce.remove(Oe.id);ju(ce,te,Te);let We=X?[...Ee.filter((xe)=>xe!==Re),Re]:Ee.filter((xe)=>xe!==Re),{folders:$e,...Ue}=ce;if(y(we,x.parse({...Ue,...We.length?{folders:We}:{}})),!await(L.controlWorker??St)(l,"reload_roots").then(()=>!0,()=>!1))Ie(l,z,"connect");return M.stdout.write(X?`Added ${Re}. Sessions on "${ce.name}" may run in it.
+`),0}var fy=n({root:n({id:t().min(1).max(160),label:t().max(160),path_fingerprint:t()})});async function Fu(e,l,v,D){let M=await(Fs(D.worker,v).enrollmentCredentials??qr)(e,jr(e));if(!M)throw Error("worker_session_login_required");if(!M.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let L=D.folderApi?.(M)??new me(M,{credentialsPath:jr(e),fetchImpl:oe(e.proxy)}),z=(re)=>re instanceof C&&re.status===404&&!["device_not_found","root_not_found"].includes(re.code);return{add:async(re)=>{let G=yc(e,re,{...l.roots[0].permissions,expose_mcp:!1}),ce=await L.addDeviceRoot(l.deviceId,{path_fingerprint:G.pathFingerprint,label:G.label,permissions:{...G.permissions,expose_mcp:!1}}).catch((te)=>{if(z(te))throw Error("worker_folders_unavailable");if(te instanceof C&&te.code==="root_limit_reached")throw new ct("This computer already has the most folders Reason allows (32).");throw te}),we=fy.parse(ce).root;if(we.path_fingerprint!==G.pathFingerprint)throw Error("worker_enrollment_receipt_mismatch");return{...G,id:we.id,label:we.label}},remove:async(re)=>{await L.removeDeviceRoot(l.deviceId,re).catch((G)=>{if(z(G))throw Error("worker_folders_unavailable");if(!(G instanceof C&&G.code==="root_not_found"))throw G})}}}function ju(e,l,v){ae({...l,roots:v,handsSlots:e.slots,worker:{...l.worker,configDigest:O(e)}},f(e).state,{proofStore:xt(e)})}async function my(e,l,v,D){let{io:M,options:L,host:z}=D,re=l&&!D.apiKey&&lr(l.stateDirectory)===null?qo(D.home,D.channel,l):null,G=l&&re&&Gr(l)&&!wo(l,re)?Qt(l).find((xe)=>xe.account&&xe.organizationId===re)??null:void 0;if(G===null)throw new ct("This computer is not connected for your account. Run reason connect first.");let ce=G?G.config:l,we=G?G.configPath:v,te=ce&&Gr(ce)&&!ft(ce).revoked?S(ce):null;if(!l||!ce||!te||ce.lifetime!=="persistent")throw new ct("This computer is not connected to Reason. Run reason connect first.");let X=e.addFolder!==void 0,he=X?e.addFolder:e.removeFolder,Se=L.cwd??process.cwd(),Re;try{Re=Ki(Se,he)}catch(xe){if(X)throw new ct(xe instanceof Error?xe.message:String(xe));Re=ry(Se,he)}if(Re===ce.workspaceRoot)throw new ct(`${Re} is this computer's main folder. To use another one, run reason connect --folder PATH.`);let Ee=ce.folders??[],Oe=te.roots.slice(1).find((xe)=>xe.path===Re);if(!X&&!Oe&&!Ee.includes(Re))throw new ct(`${Re} is not one of this computer's folders.`);if(X&&!ge(Re,ce.stateDirectory))throw new ct(`${Re} holds Reason's own settings.`);if(X&&!Oe&&Ee.length>=31)throw new ct("This computer already has the most folders Reason allows (32).");let Me=D.apiKey??lr(ce.stateDirectory)??void 0,Ce=await Fu(ce,te,Me,L),Te=te.roots.filter((xe)=>xe.path!==Re);if(X)Te=[...Te,await Ce.add(Re)];else if(Oe)await Ce.remove(Oe.id);ju(ce,te,Te);let We=X?[...Ee.filter((xe)=>xe!==Re),Re]:Ee.filter((xe)=>xe!==Re),{folders:$e,...Ue}=ce;if(y(we,x.parse({...Ue,...We.length?{folders:We}:{}})),!await(L.controlWorker??St)(l,"reload_roots").then(()=>!0,()=>!1))Ie(l,z,"connect");return M.stdout.write(X?`Added ${Re}. Sessions on "${ce.name}" may run in it.
 `:`Removed ${Re}. Sessions on "${ce.name}" no longer run in it.
-`),0}function xu(e,l){let v=Yr(e.home??s()),D=e.env??process.env;return{io:e.io??Ks(),options:e,home:v,channel:e.channel??w(),environment:D,apiKey:l??Wn(D),host:e.serviceHost??de(v)}}async function py(e,l,v,D){let M=S(e),L=M.roots;if(l.workspaceRoot!==e.workspaceRoot){let z=await Fu(e,M,v,D),re=L.find((G)=>G.path===l.workspaceRoot)??await z.add(l.workspaceRoot);await z.remove(L[0].id),L=[re,...L.slice(1).filter((G)=>G.id!==re.id)]}ju(l,M,L)}var qu=Symbol("serve here");async function hy(e,l,v,D){let{io:M,options:L,home:z,channel:re,environment:G,host:ce}=D;if(ce.platform==="darwin"){let Fe=Cu(z);if(Fe.status==="failed")M.stderr.write(`Reason: could not remove the retired Reason Device helper (${Fe.code}).
-`)}let we=l&&!D.apiKey&&lr(l.stateDirectory)===null?Fo(z,re,l):null,te=l&&we&&ft(l).revoked&&Qt(l).some((Fe)=>Fe.account&&Fe.organizationId===we)?oi(l,{prefer:we,keep:!1})??l:l,X=Bu({parsed:e,saved:te,stateDirectory:fe(z,re),lifetime:"persistent",home:z,channel:re,options:L,environment:G});if(Vi(z,re,!1),te?.executionMode==="confined")M.stdout.write(Hu);let he=te?lr(te.stateDirectory):null,Se=Uu(X,D.apiKey??he??void 0),Re=ze(ce,G),Ee=te!==null&&Gr(te),Oe=Ee&&O(te)===O(Se),Me=Oe&&Yn(Se),Ce=te?.userChrome!==!1===(Se.userChrome!==!1)&&te?.cloudSessions===Se.cloudSessions&&te?.localLogins===Se.localLogins,Te=D.apiKey??he??void 0,We=we!==null&&Ee&&!ft(te).revoked&&!ho(te,we);if(We){if(!Oe||!Ce||JSON.stringify(te.proxy)!==JSON.stringify(Se.proxy))throw new ct("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let Fe=await ly(te,we,M,L);if(Fe!==0)return Fe}let $e=We?[`  Account:   yours too, in workspace ${we}, beside this computer's other Reason account`]:[],Ue=async()=>{if(e.apiKey===void 0||e.apiKey===he)return;await na(Se,e.apiKey),ra(Se.stateDirectory,e.apiKey)},Ne=G.PATH||"/usr/local/bin:/usr/bin:/bin",xe=Me&&JSON.stringify(te?.proxy)===JSON.stringify(Se.proxy)&&Ce?qe(Se,ce,"connect"):null,Le=xe?.label===En(Se.channel),Ge=Le?await(L.controlWorker??St)(Se,"status").catch(()=>null):null,Ve=Ge!==null,Je=Le&&!Ve&&Li(xe,ce)&&os({config:Se,launcher:Re,path:Ne,host:ce,kind:"connect"}),it=Ge!==null&&(Ge.activeSessions??Ge.activeClaims)>0;if((Ve||Je)&&(it||[null,g].includes(_o(Se)))){await Ue();let Fe=Ni(Se,ce,"connect");if(Fe==="retired"){let nt=Je?null:await(L.controlWorker??St)(Se,"status").catch(()=>null);if(!Je&&(!nt||nt.phase==="stopping"))Ie(Se,ce,"connect")}else if(Fe==="current_not_running")Ie(Se,ce,"connect");else if(ce.platform==="win32"&&Ge&&(Ge.capabilityReadiness?.["exec.run"]===!1||Ge.supportedOperations?.includes("exec.run")===!1)&&ky())Ie(Se,ce,"connect");return await(L.controlWorker??St)(Se,"reload_roots").catch(()=>null),M.stdout.write(G.REASON_INSTALLER==="1"?Hs(Se,ce.platform,$e):$s("This computer is connected to Reason",Se,ce.platform,[...$e,...Je?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let Ye=!Me&&!We;if(Ee&&!Oe)if(te.apiOrigin!==Se.apiOrigin||te.name!==Se.name){if(M.stdout.write(`Reconnecting this computer with its new settings\u2026
+`),0}function xu(e,l){let v=Yr(e.home??s()),D=e.env??process.env;return{io:e.io??Ks(),options:e,home:v,channel:e.channel??w(),environment:D,apiKey:l??Vn(D),host:e.serviceHost??de(v)}}async function py(e,l,v,D){let M=S(e),L=M.roots;if(l.workspaceRoot!==e.workspaceRoot){let z=await Fu(e,M,v,D),re=L.find((G)=>G.path===l.workspaceRoot)??await z.add(l.workspaceRoot);await z.remove(L[0].id),L=[re,...L.slice(1).filter((G)=>G.id!==re.id)]}ju(l,M,L)}var qu=Symbol("serve here");async function hy(e,l,v,D){let{io:M,options:L,home:z,channel:re,environment:G,host:ce}=D;if(ce.platform==="darwin"){let Fe=Cu(z);if(Fe.status==="failed")M.stderr.write(`Reason: could not remove the retired Reason Device helper (${Fe.code}).
+`)}let we=l&&!D.apiKey&&lr(l.stateDirectory)===null?qo(z,re,l):null,te=l&&we&&ft(l).revoked&&Qt(l).some((Fe)=>Fe.account&&Fe.organizationId===we)?si(l,{prefer:we,keep:!1})??l:l,X=Bu({parsed:e,saved:te,stateDirectory:fe(z,re),lifetime:"persistent",home:z,channel:re,options:L,environment:G});if(Gi(z,re,!1),te?.executionMode==="confined")M.stdout.write(Hu);let he=te?lr(te.stateDirectory):null,Se=Uu(X,D.apiKey??he??void 0),Re=ze(ce,G),Ee=te!==null&&Gr(te),Oe=Ee&&O(te)===O(Se),Me=Oe&&Yn(Se),Ce=te?.userChrome!==!1===(Se.userChrome!==!1)&&te?.cloudSessions===Se.cloudSessions&&te?.localLogins===Se.localLogins,Te=D.apiKey??he??void 0,We=we!==null&&Ee&&!ft(te).revoked&&!wo(te,we);if(We){if(!Oe||!Ce||JSON.stringify(te.proxy)!==JSON.stringify(Se.proxy))throw new ct("This computer is also connected for another Reason account, whose settings it keeps. Run reason connect without settings to connect it for your account with them, or change them signed in as that account.","worker_other_account_settings");let Fe=await ly(te,we,M,L);if(Fe!==0)return Fe}let $e=We?[`  Account:   yours too, in workspace ${we}, beside this computer's other Reason account`]:[],Ue=async()=>{if(e.apiKey===void 0||e.apiKey===he)return;await oa(Se,e.apiKey),na(Se.stateDirectory,e.apiKey)},Ne=G.PATH||"/usr/local/bin:/usr/bin:/bin",xe=Me&&JSON.stringify(te?.proxy)===JSON.stringify(Se.proxy)&&Ce?qe(Se,ce,"connect"):null,Le=xe?.label===kn(Se.channel),Ge=Le?await(L.controlWorker??St)(Se,"status").catch(()=>null):null,Ve=Ge!==null,Je=Le&&!Ve&&$i(xe,ce)&&ss({config:Se,launcher:Re,path:Ne,host:ce,kind:"connect"}),it=Ge!==null&&(Ge.activeSessions??Ge.activeClaims)>0;if((Ve||Je)&&(it||[null,g].includes(ko(Se)))){await Ue();let Fe=Li(Se,ce,"connect");if(Fe==="retired"){let nt=Je?null:await(L.controlWorker??St)(Se,"status").catch(()=>null);if(!Je&&(!nt||nt.phase==="stopping"))Ie(Se,ce,"connect")}else if(Fe==="current_not_running")Ie(Se,ce,"connect");else if(ce.platform==="win32"&&Ge&&(Ge.capabilityReadiness?.["exec.run"]===!1||Ge.supportedOperations?.includes("exec.run")===!1)&&ky())Ie(Se,ce,"connect");return await(L.controlWorker??St)(Se,"reload_roots").catch(()=>null),M.stdout.write(G.REASON_INSTALLER==="1"?Hs(Se,ce.platform,$e):$s("This computer is connected to Reason",Se,ce.platform,[...$e,...Je?["  Worker:    running, not answering yet (starting or busy); reason status shows when it is online"]:[],"Change a setting with reason connect --folder; remove it with reason disconnect."])),0}let Ye=!Me&&!We;if(Ee&&!Oe)if(te.apiOrigin!==Se.apiOrigin||te.name!==Se.name){if(M.stdout.write(`Reconnecting this computer with its new settings\u2026
 `),!await js(te,v,M,L,ce))throw new ct("Could not remove this computer's previous connection from Reason. Check your network and try again.","worker_previous_connection_not_removed")}else if(te.executionMode==="host"&&Yn(te))M.stdout.write(`Applying the new settings to this computer\u2026
 `),await py(te,Se,Te,L),Ye=!1;else await qs(te,L,ce);if(Ye){if(G.REASON_INSTALLER!=="1")M.stdout.write(`Connecting this computer to Reason\u2026
-`);let Fe=await Us(Se,v,M,L,Te);if(Fe!==0)return Fe;if(Te)ra(Se.stateDirectory,Te)}else y(v,Se),await Ue();let Be;try{Be=kn({config:Se,launcher:Re,path:Ne,host:ce,kind:"connect"})}catch(Fe){if(!(Fe instanceof j))throw Fe;if(Fe.code!=="worker_service_manager_missing")throw new ct(`${Fe.message}
+`);let Fe=await Us(Se,v,M,L,Te);if(Fe!==0)return Fe;if(Te)na(Se.stateDirectory,Te)}else y(v,Se),await Ue();let Be;try{Be=xn({config:Se,launcher:Re,path:Ne,host:ce,kind:"connect"})}catch(Fe){if(!(Fe instanceof j))throw Fe;if(Fe.code!=="worker_service_manager_missing")throw new ct(`${Fe.message}
 This computer is set up; run reason connect again to start it.`,Fe.code??"worker_service_start_failed");if(L.serveHere&&G.REASON_INSTALLER!=="1")return M.stdout.write(`No background service here; running in this terminal (Ctrl-C stops it).
 `),qu;if(L.serveHere&&G.REASON_INSTALLER==="1"&&await gy(Se,Re,G,L))return M.stdout.write(Hs(Se,ce.platform,[`  No service manager here: it runs until this computer restarts (keep it with ${Re} connect under a process manager)`])),0;throw new j(`${Fe.message}
-This computer is set up. Keep it connected by running ${Re} connect in a terminal or under this box's process manager.`,Fe.code)}let Ke=[...$e,...Be.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...Be.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${Be.identityProblem}).`]:[]];return M.stdout.write(G.REASON_INSTALLER==="1"?Hs(Se,ce.platform,Ke):$s("This computer is connected to Reason",Se,ce.platform,[`  Service:   ${Be.label} (starts at ${Be.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${Be.logs}`,`Start Sessions on "${Se.name}" from Reason. Remove it with: reason disconnect`,...Ke])),0}async function gy(e,l,v,D){let{REASON_INSTALLER:M,...L}=v;(D.startConnection??zu)(l,L,Bt(e.stateDirectory,"connect.log"));for(let z=0;z<60;z+=1)if(await new Promise((re)=>setTimeout(re,500)),await(D.controlWorker??St)(e,"status").catch(()=>null))return!0;return!1}function zu(e,l,v){let D=Tu(v,"a",384);try{let M=Du(e,["connect"],{detached:!0,stdio:["ignore",D,D],env:l});M.on("error",()=>{return}),M.unref()}finally{Mu(D)}}async function Ku(e,l,v,D=!1){let M=!0;for(let L of Qt(e)){if(D&&L.account)continue;if(L.config&&Gr(L.config)&&!ft(L.config).revoked){if(await(v.runWorker??Tr)(["revoke","--config",L.configPath],{...v.worker,io:{stdout:Ki,stderr:l.stderr}})!==0){M=!1;continue}}Xn(L.directory,{recursive:!0,force:!0})}return M}function Ks(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function Vu(e,l){if(e instanceof ct||e instanceof j)return l.stderr.write(`Reason: ${e.message} (${e.code??"worker_service_failed"})
+This computer is set up. Keep it connected by running ${Re} connect in a terminal or under this box's process manager.`,Fe.code)}let Ke=[...$e,...Be.lingering===!1?["Note: it stops when you log out. To keep it running and start it at boot, run: sudo loginctl enable-linger $USER"]:[],...Be.identityProblem?[`Note: Full Disk Access you grant it lasts until the next update (${Be.identityProblem}).`]:[]];return M.stdout.write(G.REASON_INSTALLER==="1"?Hs(Se,ce.platform,Ke):$s("This computer is connected to Reason",Se,ce.platform,[`  Service:   ${Be.label} (starts at ${Be.lingering?"boot":"login"}, restarts if it fails)`,`  Logs:      ${Be.logs}`,`Start Sessions on "${Se.name}" from Reason. Remove it with: reason disconnect`,...Ke])),0}async function gy(e,l,v,D){let{REASON_INSTALLER:M,...L}=v;(D.startConnection??zu)(l,L,Bt(e.stateDirectory,"connect.log"));for(let z=0;z<60;z+=1)if(await new Promise((re)=>setTimeout(re,500)),await(D.controlWorker??St)(e,"status").catch(()=>null))return!0;return!1}function zu(e,l,v){let D=Tu(v,"a",384);try{let M=Du(e,["connect"],{detached:!0,stdio:["ignore",D,D],env:l});M.on("error",()=>{return}),M.unref()}finally{Mu(D)}}async function Ku(e,l,v,D=!1){let M=!0;for(let L of Qt(e)){if(D&&L.account)continue;if(L.config&&Gr(L.config)&&!ft(L.config).revoked){if(await(v.runWorker??Tr)(["revoke","--config",L.configPath],{...v.worker,io:{stdout:Ji,stderr:l.stderr}})!==0){M=!1;continue}}Zn(L.directory,{recursive:!0,force:!0})}return M}function Ks(){return{stdout:process.stdout,stderr:process.stderr,stdin:process.stdin,stdinIsTty:Boolean(process.stdin.isTTY),stdoutIsTty:Boolean(process.stdout.isTTY)}}function Vu(e,l){if(e instanceof ct||e instanceof j)return l.stderr.write(`Reason: ${e.message} (${e.code??"worker_service_failed"})
 `),2;let v=e instanceof Error&&/^worker_[a-z_]+$/.test(e.message)?e.message:_y(e);return l.stderr.write(`Reason: ${Mn(v)??"could not connect this computer."} (${v})
-`),1}var wy=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]),yy=new Set(["ConnectionRefused","ConnectionClosed","FailedToOpenSocket","ECONNREFUSED","ECONNRESET","ENOTFOUND","EAI_AGAIN","ENETUNREACH","EHOSTUNREACH"]);function _y(e){if(e instanceof C)return e.status>=500?"worker_api_unavailable":"worker_api_refused";let l=e?.code;if(typeof l==="string"&&wy.has(l))return`worker_file_${l.toLowerCase()}`;if(typeof l==="string"&&yy.has(l))return"worker_api_unreachable";if(typeof l==="string"&&(/CERT|SSL|TLS/.test(l)||l==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"))return"worker_api_certificate_untrusted";if(e instanceof Error&&e.message.startsWith("Command failed"))return"worker_connect_command_failed";let v=oc(e);if(v==="native_network")return"worker_api_unreachable";return/^native_[a-z_]+$/.test(v)?`worker_connect_${v.slice(7)}`:"worker_connect_unexpected"}function Iu(e,l){if(e.minimal){es({home:l.home});return}if(e.once||l.options.desktop===!1||!l.io.stdinIsTty||ts({home:l.home})!=="install")return;let v;try{v=ze(l.host,l.environment)}catch{return}if(l.host.platform==="darwin"){let M=Bt(l.home,".local","share","reason","desktop-install.log");(l.options.installDesktop??Ou)(v,l.environment,{log:M}),l.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${M}).
+`),1}var wy=new Set(["EACCES","EPERM","ENOENT","ENOSPC","EROFS","ENOTDIR","EEXIST","ELOOP"]),yy=new Set(["ConnectionRefused","ConnectionClosed","FailedToOpenSocket","ECONNREFUSED","ECONNRESET","ENOTFOUND","EAI_AGAIN","ENETUNREACH","EHOSTUNREACH"]);function _y(e){if(e instanceof C)return e.status>=500?"worker_api_unavailable":"worker_api_refused";let l=e?.code;if(typeof l==="string"&&wy.has(l))return`worker_file_${l.toLowerCase()}`;if(typeof l==="string"&&yy.has(l))return"worker_api_unreachable";if(typeof l==="string"&&(/CERT|SSL|TLS/.test(l)||l==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"))return"worker_api_certificate_untrusted";if(e instanceof Error&&e.message.startsWith("Command failed"))return"worker_connect_command_failed";let v=oc(e);if(v==="native_network")return"worker_api_unreachable";return/^native_[a-z_]+$/.test(v)?`worker_connect_${v.slice(7)}`:"worker_connect_unexpected"}function Iu(e,l){if(e.minimal){ts({home:l.home});return}if(e.once||l.options.desktop===!1||!l.io.stdinIsTty||rs({home:l.home})!=="install")return;let v;try{v=ze(l.host,l.environment)}catch{return}if(l.host.platform==="darwin"){let M=Bt(l.home,".local","share","reason","desktop-install.log");(l.options.installDesktop??Ou)(v,l.environment,{log:M}),l.io.stdout.write(`Desktop and browser use install in the background (reason desktop status; log ${M}).
 `);return}l.io.stdout.write(`Installing desktop components first (reason connect --minimal skips them)\u2026
 `);let D=(l.options.installDesktop??Ou)(v,l.environment,null);if(D!==0&&D!==3)l.io.stderr.write(`Reason: desktop components did not install; connecting without them. Retry with reason desktop install. (desktop_install_failed)
 `)}function by(e){if(e.host.platform!=="win32"||!e.io.stdinIsTty)return;cr();let l=Ae();if(!Zw(l)||tn(l))return;e.io.stdout.write(`Setting up the Windows sandbox for confined commands; approve the Windows prompt\u2026
-`);let v=Oa(l);if(v!=="installed")e.io.stderr.write(`Reason: the Windows sandbox was not set up (${v==="cancelled"?"prompt declined":"install failed"}); connecting without confined commands. Run reason connect again to retry. (windows_sandbox_unavailable)
-`)}function ky(){if(Y()===null)return!1;return cr(),tn(Ae())}function Ou(e,l,v){if(!v){let M=()=>Xw(e,["desktop","install"],{env:l,stdio:"inherit"}).status??1,L=M();return L===3221225477?M():L}Qw(Bs(v.log),{recursive:!0,mode:448});let D=Tu(v.log,"w",384);try{let M=Du(e,["desktop","install"],{detached:!0,stdio:["ignore",D,D],env:{...l,REASON_DESKTOP_BACKGROUND:"1"}});M.on("error",()=>{return}),M.unref()}finally{Mu(D)}return 0}async function gl(e,l={}){let v=l.io??Ks();try{let D=sy(e);if(!D)return v.stdout.write(ny),0;if(D.to!==void 0||D.token!==void 0){if(D.sessions!==void 0)throw new ct("A machine's workers run one Session at a time; --sessions does not apply to them.");if(D.proxy!==void 0)throw new ct("--proxy is for your own computer; a machine's workers don't take it yet.");if(D.userChrome!==void 0)throw new ct("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(D.cloudSessions!==void 0)throw new ct("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(D.localLogins!==void 0)throw new ct("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[ce,we]of[["--api-key",D.apiKey],["--name",D.name],["--api-url",D.apiUrl]])if(we!==void 0)throw new ct(`${ce} is for your own computer; reason serve sets up a machine's workers.`);return Iu(D,xu(l)),await(l.runServe??Eu)([...D.to===void 0?[]:[D.to],...D.token===void 0?[]:["--token",D.token],...D.folder===void 0?[]:["--dir",D.folder],...D.yes?["--yes"]:[],D.once?"--once":"--service"],{io:v,...l.cwd?{cwd:l.cwd}:{},...l.home?{home:l.home}:{},...l.channel?{channel:l.channel}:{},...l.env?{env:l.env}:{},...l.serviceHost?{serviceHost:l.serviceHost}:{},...l.worker?{worker:l.worker}:{}})}let M=xu(l,D.apiKey),{channel:L,environment:z}=M;if(!l.env)for(let ce of["REASON_API_KEY","ARA_API_KEY"])delete process.env[ce];if(D.userChrome&&M.host.platform!=="darwin")throw new ct("--user-chrome is for a Mac.");let re=is(z[ke],L),G=re||D.once?()=>{return}:Vs(M.home,L);try{let ce=Bt(fe(M.home,L),"worker.json"),we=Z(ce);if(re)return await Au(we,ce,M);if(D.keepAwake!==void 0)return uy(D.keepAwake,we,M.host,v);if(D.addFolder!==void 0||D.removeFolder!==void 0)return await my(D,we,ce,M);if(Iu(D,M),by(M),D.once)return await dy(D,we,M);let te=await hy(D,we,ce,M);if(te!==qu)return te;return G(),G=()=>{return},await Au(Z(ce),ce,M)}finally{G()}}catch(D){return Vu(D,v)}}async function _l(e,l={}){let v=l.io??Ks();try{if(e.some((z)=>["--help","-h","help"].includes(z)))return v.stdout.write(oy),0;let D=e.filter((z)=>!["--yes","-y","--temporary","--account"].includes(z)),M=e.includes("--temporary"),L=e.includes("--account");if(D.length>1||D[0]?.startsWith("-")||(M||L)&&D.length>0||M&&L)throw new ct("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(D[0]!==void 0)return await Ey(D[0],v,l);return await vy(v,l,M?"temporary":L?"account":"disconnect")}catch(D){return Vu(D,v)}}async function vy(e,l,v){let D=Yr(l.home??s()),M=l.channel??w(),L=Vs(D,M);try{return await Sy(e,l,v,D,M)}finally{L()}}function Vs(e,l){let v=fe(e,l),D=u(v)?bt():null;if(!D)return()=>{return};for(let M=0;M<300;M+=1){let L=D.lock(v);if(L)return L;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new ct("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function Sy(e,l,v,D,M){let L=Bt(fe(D,M),"worker.json"),z=Z(L);if(!z){if(v==="disconnect")Vi(D,M,!0);if(v!=="logout")e.stdout.write(`This computer is not connected to Reason.
-`);return 0}if(v!=="disconnect"){let G=await Ry(z,L,e,l,v,D,M);if(G!==null)return G}let re=!1;try{re=await js(z,L,e,l,l.serviceHost??de(D))}finally{if(v!=="temporary")Vi(D,M,!0)}if(!re)return e.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
+`);let v=Na(l);if(v!=="installed")e.io.stderr.write(`Reason: the Windows sandbox was not set up (${v==="cancelled"?"prompt declined":"install failed"}); connecting without confined commands. Run reason connect again to retry. (windows_sandbox_unavailable)
+`)}function ky(){if(Y()===null)return!1;return cr(),tn(Ae())}function Ou(e,l,v){if(!v){let M=()=>Xw(e,["desktop","install"],{env:l,stdio:"inherit"}).status??1,L=M();return L===3221225477?M():L}Qw(Bs(v.log),{recursive:!0,mode:448});let D=Tu(v.log,"w",384);try{let M=Du(e,["desktop","install"],{detached:!0,stdio:["ignore",D,D],env:{...l,REASON_DESKTOP_BACKGROUND:"1"}});M.on("error",()=>{return}),M.unref()}finally{Mu(D)}return 0}async function gl(e,l={}){let v=l.io??Ks();try{let D=sy(e);if(!D)return v.stdout.write(ny),0;if(D.to!==void 0||D.token!==void 0){if(D.sessions!==void 0)throw new ct("A machine's workers run one Session at a time; --sessions does not apply to them.");if(D.proxy!==void 0)throw new ct("--proxy is for your own computer; a machine's workers don't take it yet.");if(D.userChrome!==void 0)throw new ct("A machine serves every member of the workspace; --user-chrome is for your own computer.");if(D.cloudSessions!==void 0)throw new ct("A machine serves every member of the workspace; --cloud-sessions is for your own computer.");if(D.localLogins!==void 0)throw new ct("A machine serves every member of the workspace; --local-logins is for your own computer.");for(let[ce,we]of[["--api-key",D.apiKey],["--name",D.name],["--api-url",D.apiUrl]])if(we!==void 0)throw new ct(`${ce} is for your own computer; reason serve sets up a machine's workers.`);return Iu(D,xu(l)),await(l.runServe??Eu)([...D.to===void 0?[]:[D.to],...D.token===void 0?[]:["--token",D.token],...D.folder===void 0?[]:["--dir",D.folder],...D.yes?["--yes"]:[],D.once?"--once":"--service"],{io:v,...l.cwd?{cwd:l.cwd}:{},...l.home?{home:l.home}:{},...l.channel?{channel:l.channel}:{},...l.env?{env:l.env}:{},...l.serviceHost?{serviceHost:l.serviceHost}:{},...l.worker?{worker:l.worker}:{}})}let M=xu(l,D.apiKey),{channel:L,environment:z}=M;if(!l.env)for(let ce of["REASON_API_KEY","ARA_API_KEY"])delete process.env[ce];if(D.userChrome&&M.host.platform!=="darwin")throw new ct("--user-chrome is for a Mac.");let re=os(z[ke],L),G=re||D.once?()=>{return}:Vs(M.home,L);try{let ce=Bt(fe(M.home,L),"worker.json"),we=Z(ce);if(re)return await Au(we,ce,M);if(D.keepAwake!==void 0)return uy(D.keepAwake,we,M.host,v);if(D.addFolder!==void 0||D.removeFolder!==void 0)return await my(D,we,ce,M);if(Iu(D,M),by(M),D.once)return await dy(D,we,M);let te=await hy(D,we,ce,M);if(te!==qu)return te;return G(),G=()=>{return},await Au(Z(ce),ce,M)}finally{G()}}catch(D){return Vu(D,v)}}async function _l(e,l={}){let v=l.io??Ks();try{if(e.some((z)=>["--help","-h","help"].includes(z)))return v.stdout.write(oy),0;let D=e.filter((z)=>!["--yes","-y","--temporary","--account"].includes(z)),M=e.includes("--temporary"),L=e.includes("--account");if(D.length>1||D[0]?.startsWith("-")||(M||L)&&D.length>0||M&&L)throw new ct("Usage: reason disconnect [NAME] [--yes] (--temporary or --account only without NAME)");if(D[0]!==void 0)return await Ey(D[0],v,l);return await vy(v,l,M?"temporary":L?"account":"disconnect")}catch(D){return Vu(D,v)}}async function vy(e,l,v){let D=Yr(l.home??s()),M=l.channel??w(),L=Vs(D,M);try{return await Sy(e,l,v,D,M)}finally{L()}}function Vs(e,l){let v=fe(e,l),D=u(v)?bt():null;if(!D)return()=>{return};for(let M=0;M<300;M+=1){let L=D.lock(v);if(L)return L;Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,50)}throw new ct("This computer's connection is busy; try again in a moment.","worker_connection_busy")}async function Sy(e,l,v,D,M){let L=Bt(fe(D,M),"worker.json"),z=Z(L);if(!z){if(v==="disconnect")Gi(D,M,!0);if(v!=="logout")e.stdout.write(`This computer is not connected to Reason.
+`);return 0}if(v!=="disconnect"){let G=await Ry(z,L,e,l,v,D,M);if(G!==null)return G}let re=!1;try{re=await js(z,L,e,l,l.serviceHost??de(D))}finally{if(v!=="temporary")Gi(D,M,!0)}if(!re)return e.stderr.write(`Reason: this computer stopped, but Reason could not be reached to remove it. Run reason disconnect again.
 `),1;return e.stdout.write(`Disconnected "${z.name}". It no longer runs Sessions; run reason connect to connect it again.
-`),0}async function Ry(e,l,v,D,M,L,z){let re=Qt(e).filter((Ee)=>Ee.account);if(re.length===0)return null;let G=Fo(L,z,e),ce=D.controlWorker??St,we=re.find((Ee)=>Ee.organizationId===G);if(we){if(we.config&&!await Gi(we.config,we.configPath,v,D))return v.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
-`),1;if(M!=="account"||!we.config)Xn(we.directory,{recursive:!0,force:!0});return await ce(e,"reload_roots").catch(()=>null),v.stdout.write(`Disconnected this computer from workspace ${G} for your account. It stays connected for its other Reason accounts.
-`),0}if(!G&&M==="account")throw new ct("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!G||!ho(e,G)){if(M==="account"&&G)ni(e,G);if(M!=="logout")v.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
-`);return 0}let te=D.serviceHost??de(L),X=null;try{X=S(e)?.orgId.toLowerCase()??null}catch{}if(await qs(e,D,te,"connect",!0),!await Ku(e,v,D,!0)||!await Gi(e,l,v,D))return Ie(e,te,"connect"),v.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
-`),1;let he=oi(e,{prefer:null,keep:!1});if(!he)return null;if(M==="account"&&X)ni(he,X);let Se=Ie(he,te,"connect")!==null,Re="";try{Re=` in workspace ${S(he)?.orgId??""}`}catch{}return v.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${Re}${Se?"":"; run reason connect to start it again"}.
+`),0}async function Ry(e,l,v,D,M,L,z){let re=Qt(e).filter((Ee)=>Ee.account);if(re.length===0)return null;let G=qo(L,z,e),ce=D.controlWorker??St,we=re.find((Ee)=>Ee.organizationId===G);if(we){if(we.config&&!await Zi(we.config,we.configPath,v,D))return v.stderr.write(`Reason: Reason could not be reached to remove your account's Device from this computer. Try again.
+`),1;if(M!=="account"||!we.config)Zn(we.directory,{recursive:!0,force:!0});return await ce(e,"reload_roots").catch(()=>null),v.stdout.write(`Disconnected this computer from workspace ${G} for your account. It stays connected for its other Reason accounts.
+`),0}if(!G&&M==="account")throw new ct("Reason is signed out here, so which account to disconnect is unknown. Sign in as it, or run reason disconnect to disconnect every account.");if(!G||!wo(e,G)){if(M==="account"&&G)ii(e,G);if(M!=="logout")v.stdout.write(`This computer stays connected for its other Reason accounts; it was not connected for yours.
+`);return 0}let te=D.serviceHost??de(L),X=null;try{X=S(e)?.orgId.toLowerCase()??null}catch{}if(await qs(e,D,te,"connect",!0),!await Ku(e,v,D,!0)||!await Zi(e,l,v,D))return Ie(e,te,"connect"),v.stderr.write(`Reason: Reason could not be reached to remove your account's Devices from this computer. Try again.
+`),1;let he=si(e,{prefer:null,keep:!1});if(!he)return null;if(M==="account"&&X)ii(he,X);let Se=Ie(he,te,"connect")!==null,Re="";try{Re=` in workspace ${S(he)?.orgId??""}`}catch{}return v.stdout.write(`Disconnected this computer for your account. It stays connected for its other Reason account${Re}${Se?"":"; run reason connect to start it again"}.
 `),0}async function Ey(e,l,v){let D=Yr(v.home??s()),M=v.serviceHost??de(D),L=Ws(D,e);if(L.length===0)throw new ct(`No worker for machine "${e}" on this computer.`);let z=!1;for(let re of L)if(await js(re.config,re.path,l,v,M,"serve"))l.stdout.write(`Disconnected machine "${e}" in ${re.config.workspaceRoot}.
 `);else z=!0,l.stderr.write(`Reason: machine "${e}" in ${re.config.workspaceRoot} stopped, but Reason could not be reached to remove it. Run reason disconnect ${e} again.
-`);return z?1:0}async function eo(e={}){let l=Yr(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;let D,M=await(e.controlWorker??St)(v,"status").catch((he)=>(D=he instanceof Error?he:Error(String(he)),null)),L=M?_o(v):null,z=e.serviceHost??de(l),re=qe(v,z,"connect"),G=ft(v).revoked,ce=!G&&!M,we=(()=>{try{return S(v)}catch{return null}})(),{workspaces:te,off:X}=G||lr(v.stateDirectory)!==null?{workspaces:null,off:null}:Pc(v,M?.phase==="running");return{workspaces:te,workspaces_off:X,workspaces_max:Xo+(te?.filter((he)=>he.account).length??0),name:v.name,device_id:we?.deviceId??null,organization_id:we?.orgId??null,folder:v.workspaceRoot,mode:v.executionMode,sessions_max:null,user_chrome:zs(v,z.platform),cloud_sessions:v.cloudSessions===!0,root:we?.roots[0]?{id:we.roots[0].id,permissions:we.roots[0].permissions}:null,roots:we?.roots.map((he)=>({id:he.id,folder:he.path,permissions:he.permissions}))??[],state:G?"removed":M?M.phase==="running"?"connected":M.phase:"not_running",not_running_reason:ce?Yc(v,D):null,worker_alive:ce&&re?Li(re,z):null,sessions_running:M?.activeSessions??null,version:L,service:re?{label:re.label,logs:re.logs}:null}}function yl(e={}){let l=Yr(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;return Ie(v,e.serviceHost??de(l),"connect")?.label??null}async function wl(e={}){let l=Yr(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;let D=e.serviceHost??de(l),M=await Ru(v,D,"connect",e.current);if(M!==null||qe(v,D,"connect"))return M;return Py(v,D,e)}async function Py(e,l,v){let D=v.controlWorker??St,M=await D(e,"status").catch(()=>null);if(!M)return null;if(v.current!==void 0&&_o(e)===v.current)return{state:"current"};let L=M.activeSessions??M.activeClaims;if(L!==0)return{state:"busy",sessions:L,waitedMs:0};let z;try{z=ze(l,v.env??process.env)}catch{return null}await D(e,"stop").catch(()=>null);let re=Date.now()+e.shutdownGraceMs+60000;while(Date.now()<re&&await D(e,"status").catch(()=>null)!==null)await new Promise((te)=>setTimeout(te,250));let{REASON_INSTALLER:G,REASON_DESKTOP_BACKGROUND:ce,...we}=v.env??process.env;return(v.startConnection??zu)(z,we,Bt(e.stateDirectory,"connect.log")),{state:"restarted"}}
-export{f,S,nr,Z,fe,Qi,gl,_l,eo,yl,wl};
+`);return z?1:0}async function to(e={}){let l=Yr(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;let D,M=await(e.controlWorker??St)(v,"status").catch((he)=>(D=he instanceof Error?he:Error(String(he)),null)),L=M?ko(v):null,z=e.serviceHost??de(l),re=qe(v,z,"connect"),G=ft(v).revoked,ce=!G&&!M,we=(()=>{try{return S(v)}catch{return null}})(),{workspaces:te,off:X}=G||lr(v.stateDirectory)!==null?{workspaces:null,off:null}:Pc(v,M?.phase==="running");return{workspaces:te,workspaces_off:X,workspaces_max:Qo+(te?.filter((he)=>he.account).length??0),name:v.name,device_id:we?.deviceId??null,organization_id:we?.orgId??null,folder:v.workspaceRoot,mode:v.executionMode,sessions_max:null,user_chrome:zs(v,z.platform),cloud_sessions:v.cloudSessions===!0,root:we?.roots[0]?{id:we.roots[0].id,permissions:we.roots[0].permissions}:null,roots:we?.roots.map((he)=>({id:he.id,folder:he.path,permissions:he.permissions}))??[],state:G?"removed":M?M.phase==="running"?"connected":M.phase:"not_running",not_running_reason:ce?Yc(v,D):null,worker_alive:ce&&re?$i(re,z):null,sessions_running:M?.activeSessions??null,version:L,service:re?{label:re.label,logs:re.logs}:null}}function yl(e={}){let l=Yr(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;return Ie(v,e.serviceHost??de(l),"connect")?.label??null}async function wl(e={}){let l=Yr(e.home??s()),v=Z(Bt(fe(l,e.channel??w()),"worker.json"));if(!v)return null;let D=e.serviceHost??de(l),M=await Ru(v,D,"connect",e.current);if(M!==null||qe(v,D,"connect"))return M;return Py(v,D,e)}async function Py(e,l,v){let D=v.controlWorker??St,M=await D(e,"status").catch(()=>null);if(!M)return null;if(v.current!==void 0&&ko(e)===v.current)return{state:"current"};let L=M.activeSessions??M.activeClaims;if(L!==0)return{state:"busy",sessions:L,waitedMs:0};let z;try{z=ze(l,v.env??process.env)}catch{return null}await D(e,"stop").catch(()=>null);let re=Date.now()+e.shutdownGraceMs+60000;while(Date.now()<re&&await D(e,"status").catch(()=>null)!==null)await new Promise((te)=>setTimeout(te,250));let{REASON_INSTALLER:G,REASON_DESKTOP_BACKGROUND:ce,...we}=v.env??process.env;return(v.startConnection??zu)(z,we,Bt(e.stateDirectory,"connect.log")),{state:"restarted"}}
+export{f,S,nr,Z,fe,eo,gl,_l,to,yl,wl};