@task-handoff/node-agent 0.0.14 → 0.0.16

package/dist/cli.js

@@ -1 +1 @@
-"use strict";var e=require("commander"),t=require("node:fs"),n=require("node:path"),r=require("node:crypto"),i=require("node:http"),o=require("node:net"),s=require("node:url"),a=require("node:child_process"),c=require("node:stream"),d=require("fastify"),l=require("@fastify/websocket"),u=require("ws"),m=require("zod"),p=require("node:os"),g=require("node-pty"),h=require("write-file-atomic"),f=require("semver"),y=require("node:fs/promises"),I=require("node:stream/promises"),A=require("tar"),b="undefined"!=typeof document?document.currentScript:null;function w(e,n){try{const r=JSON.parse(t.readFileSync(e,"utf8"));if(n&&r.name!==n)return;return"string"==typeof r.version&&r.version.trim()?r.version.trim():void 0}catch{return}}function N(e){if(e)try{return n.dirname(t.realpathSync(e))}catch{return}}function z(e,t=process.env,r=e){const i=t.TASK_HANDOFF_VERSION?.trim();if(i)return i;const o=r.split("/").at(-1),s=process.argv[1]?n.resolve(process.argv[1]):void 0,a=s?n.dirname(s):void 0,c=[N(s),a,process.cwd()].filter(e=>Boolean(e));for(const t of new Set(c)){let r=t;for(;;){const t=w(n.join(r,"package.json"),e);if(t)return t;const i=n.dirname(r);if(i===r)break;r=i}}let d;for(const e of new Set(c)){let t=e;for(;;){if(o){const e=w(n.join(t,"packages",o,"package.json"),r);if(e)return e}d||=w(n.join(t,"package.json"));const e=n.dirname(t);if(e===t)break;t=e}}return d||"unknown"}class v extends Error{code;lockPath;owner;constructor(e,t,n={}){const r=t?.pid?` pid ${t.pid}`:"";super(`${n.label||"Process"} is already running${r}. Lock: ${e}`),this.name="ProcessSingletonError",this.code=n.code||"PROCESS_ALREADY_RUNNING",this.lockPath=e,this.owner=t}}function E(e){return n.join(e,"owner.json")}function S(e){return n.join(e,"initializing.json")}function _(e){return n.join(e,"recovering.json")}function T(e){return Number.isInteger(e)&&Number(e)>0}function k(e,n=process.platform){if(T(e)){if("linux"===n)try{const n=t.readFileSync(`/proc/${e}/stat`,"utf8"),r=n.lastIndexOf(")");if(r<0)return;const i=n.slice(r+2).trim().split(/\s+/)[19];return i?`linux:${i}`:void 0}catch{return}if(["darwin","freebsd","openbsd","aix","sunos"].includes(n)){const t=a.spawnSync("ps",["-o","lstart=","-p",String(e)],{encoding:"utf8",timeout:1e3}),r=0===t.status?t.stdout.trim().replace(/\s+/g," "):"";return r?`${n}:${r}`:void 0}if("win32"===n){const t=`(Get-Process -Id ${e} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`,n=a.spawnSync("powershell.exe",["-NoProfile","-NonInteractive","-Command",t],{encoding:"utf8",timeout:2e3}),r=0===n.status?n.stdout.trim():"";return/^\d+$/.test(r)?`win32:${r}`:void 0}}}function C(e){try{const n=JSON.parse(t.readFileSync(E(e),"utf8"));if(T(n.pid)&&"string"==typeof n.startTime){const e=n;return{pid:e.pid,hostname:"string"==typeof e.hostname&&e.hostname?e.hostname:p.hostname(),component:e.component||"server-update",command:"string"==typeof e.command?e.command:"",acquiredAt:"string"==typeof e.createdAt&&Number.isFinite(Date.parse(e.createdAt))?e.createdAt:new Date(0).toISOString(),token:"string"==typeof e.token&&e.token?e.token:`legacy:${e.pid}:${e.startTime}`,startIdentity:e.startTime.startsWith("linux:")?e.startTime:`linux:${e.startTime}`}}if(!(T(n.pid)&&"string"==typeof n.hostname&&n.hostname&&"string"==typeof n.command&&"string"==typeof n.acquiredAt&&Number.isFinite(Date.parse(n.acquiredAt))&&"string"==typeof n.token&&n.token))return;return n}catch{return}}const O=C;function x(e){if(!T(e))return!1;try{return process.kill(Number(e),0),!0}catch(e){return"EPERM"===e.code}}function R(e){if(!e||!x(e.pid))return!1;if(!e.startIdentity)return!0;const t=k(e.pid);return void 0===t||t===e.startIdentity}function D(e,r){const i=n.join(e,`.owner-${r.token}.tmp`);t.writeFileSync(i,`${JSON.stringify(r,null,2)}\n`,{encoding:"utf8",mode:384,flag:"wx"});const o=P(e);if(o?.token!==r.token)throw M(i),new Error(`Process lock initialization was superseded: ${e}`);t.renameSync(i,E(e)),M(S(e))}function P(e){try{return JSON.parse(t.readFileSync(S(e),"utf8"))}catch{return}}function j(e){const t=P(e);return T(t?.pid)&&R({pid:t.pid,startIdentity:t.startIdentity})}function M(e){try{t.unlinkSync(e)}catch(e){if("ENOENT"!==e.code)throw e}}function L(){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,20)}function $(e){try{const n=P(e),r=Date.parse(n?.startedAt||"");return Number.isFinite(r)?Math.max(0,Date.now()-r):Math.max(0,Date.now()-t.statSync(e).mtimeMs)}catch{return 0}}function F(e,i){try{return t.writeFileSync(_(e),`${JSON.stringify({token:i,pid:process.pid,startedAt:(new Date).toISOString()})}\n`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(o){if("EEXIST"===o.code)return!!function(e){const i=_(e),o=U(i),s=Date.parse(o?.startedAt||"");if(x(o?.pid)||Number.isFinite(s)&&Date.now()-s<2e3)return!1;const a=n.join(e,`.recovering-${r.randomUUID()}.stale`);try{t.renameSync(i,a)}catch(e){if(["ENOENT","EEXIST"].includes(e.code||""))return!1;throw e}const c=U(a);if(c?.token===o?.token)return M(a),!0;try{t.linkSync(a,i)}catch(e){if("EEXIST"!==e.code)throw e}finally{M(a)}return!1}(e)&&F(e,i);if("ENOENT"===o.code)return!1;throw o}}function U(e){try{return JSON.parse(t.readFileSync(e,"utf8"))}catch{return}}function V(e,t){return U(_(e))?.token===t}const H=41943040,q="ai.sessions",B=m.z.string().trim().min(1).max(80),K=m.z.enum(["running","waiting","idle","failed"]);m.z.object({instanceId:m.z.string().trim().min(1).max(160),sessionId:m.z.string().trim().min(1).max(120),unread:m.z.boolean(),sessionUpdatedAt:m.z.string().datetime(),updatedAt:m.z.string().datetime()}).strict();const G=m.z.enum(["thinking","tool","editing","approval","responding","unknown"]),J=m.z.object({id:m.z.string().trim().min(1).max(240).optional(),kind:m.z.string().trim().min(1).max(80).optional(),name:m.z.string().trim().min(1).max(120),inputPreview:m.z.string().trim().max(500).optional(),startedAt:m.z.string().datetime().optional()}).strict(),W=m.z.enum(["pending-init","running","interrupted","completed","errored","shutdown","not-found"]),Y=m.z.enum(["started","interacted","interrupted"]),X=m.z.object({threadId:m.z.string().trim().min(1).max(240),path:m.z.string().trim().max(4096).optional(),status:W,activity:Y.optional(),message:m.z.string().trim().max(1e3).optional(),updatedAt:m.z.string().datetime()}).strict(),Q=m.z.object({toolCalls:m.z.number().int().min(0).default(0),edits:m.z.number().int().min(0).default(0),approvals:m.z.number().int().min(0).default(0)}).strict().default({toolCalls:0,edits:0,approvals:0}),Z=m.z.object({send:m.z.boolean().optional(),interrupt:m.z.boolean().optional(),approval:m.z.boolean().optional()}).strict(),ee=m.z.enum(["image","file"]),te=m.z.object({id:m.z.string().trim().min(1).max(120),kind:ee,name:m.z.string().trim().min(1).max(240),mime:m.z.string().trim().min(1).max(120),size:m.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)}),ne=m.z.union([te.extend({source:m.z.object({type:m.z.literal("inline"),encoding:m.z.literal("base64"),data:m.z.string().min(1).max(31457280)}).strict()}).strict().superRefine((e,t)=>{const n="image"===e.kind?20971520:512e3;(e.size<=0||("file"===e.kind?e.size>=n:e.size>n))&&t.addIssue({code:m.z.ZodIssueCode.custom,path:["size"],message:`Inline ${e.kind} must be between 1 byte and ${n} bytes.`})}),te.extend({source:m.z.object({type:m.z.literal("runtime-path"),path:m.z.string().trim().min(1).max(4096)}).strict()}).strict()]),re=te.extend({sourceType:m.z.enum(["inline","runtime-path"])}).strict(),ie=m.z.union([m.z.object({id:m.z.string().trim().min(1).max(120),kind:ee.optional(),source:m.z.object({type:m.z.literal("upload-ref")}).strict().default({type:"upload-ref"})}).strict(),m.z.object({id:m.z.string().trim().min(1).max(120),kind:ee,name:m.z.string().trim().min(1).max(240),mime:m.z.string().trim().min(1).max(120),size:m.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),source:m.z.object({type:m.z.literal("runtime-path"),path:m.z.string().trim().min(1).max(4096)}).strict()}).strict()]),oe=m.z.enum(["auto","queue","steer","immediate"]),se=m.z.enum(["ask","auto-review","full-access"]),ae=m.z.enum(["review","rename","goal","compact"]);m.z.object({command:ae,argument:m.z.string().trim().max(4e3).optional()}).strict().superRefine((e,t)=>{"rename"!==e.command||e.argument||t.addIssue({code:"custom",path:["argument"],message:"Rename requires a thread name."}),"review"!==e.command&&"compact"!==e.command||!e.argument||t.addIssue({code:"custom",path:["argument"],message:`${e.command} does not accept an argument.`})}),m.z.object({command:ae,value:m.z.string().max(4e3).optional(),turnId:m.z.string().trim().min(1).max(240).optional()}).strict(),m.z.enum(["skill","app","plugin"]);const ce=m.z.object({name:m.z.string().trim().min(1).max(240),path:m.z.string().trim().min(1).max(4096)}),de=m.z.discriminatedUnion("kind",[ce.extend({kind:m.z.literal("skill"),path:m.z.string().trim().min(1).max(4096).refine(e=>e.startsWith("/"),"Skill paths must be absolute.")}).strict(),ce.extend({kind:m.z.literal("app"),path:m.z.string().trim().min(7).max(4096).regex(/^app:\/\/[^\s/]+$/,"App paths must use app://<id>.")}).strict(),ce.extend({kind:m.z.literal("plugin"),path:m.z.string().trim().min(10).max(4096).regex(/^plugin:\/\/[^\s/]+$/,"Plugin paths must use plugin://<id>.")}).strict()]),le=m.z.array(de).max(20).default([]),ue=m.z.enum(["plugin","skill","file","directory","app"]),me=m.z.object({kind:ue,name:m.z.string().trim().min(1).max(240),description:m.z.string().trim().max(1e3).optional(),path:m.z.string().trim().min(1).max(4096),icon:m.z.string().trim().max(4096).optional()}).strict().superRefine((e,t)=>{"skill"!==e.kind||e.path.startsWith("/")||t.addIssue({code:"custom",path:["path"],message:"Skill paths must be absolute."}),"app"!==e.kind||/^app:\/\/[^\s/]+$/.test(e.path)||t.addIssue({code:"custom",path:["path"],message:"App paths must use app://<id>."}),"plugin"!==e.kind||/^plugin:\/\/[^\s/]+$/.test(e.path)||t.addIssue({code:"custom",path:["path"],message:"Plugin paths must use plugin://<id>."}),"file"!==e.kind&&"directory"!==e.kind||!e.path.startsWith("/")&&!e.path.split(/[\\/]+/).includes("..")||t.addIssue({code:"custom",path:["path"],message:"File and directory paths must be relative to the session cwd."})}),pe=m.z.object({category:m.z.enum(["skills","plugins","apps","files"]),code:m.z.string().trim().min(1).max(160),message:m.z.string().trim().min(1).max(2e3)}).strict();m.z.object({sessionId:m.z.string().trim().min(1).max(120),providerSessionId:m.z.string().trim().min(1).max(240),cwd:m.z.string().trim().min(1).max(4096),candidates:m.z.array(me).max(1e3).default([]),diagnostics:m.z.array(pe).max(20).default([])}).strict(),m.z.object({query:m.z.string().trim().max(240).default("")}).strict(),m.z.object({sessionId:m.z.string().trim().min(1).max(120),cwd:m.z.string().trim().min(1).max(4096),query:m.z.string().trim().max(240),requestId:m.z.string().trim().min(1).max(160),candidates:m.z.array(me.refine(e=>"file"===e.kind||"directory"===e.kind,"File search only returns files and directories.")).max(200).default([]),complete:m.z.boolean().default(!1)}).strict();const ge=m.z.object({message:m.z.string().trim().min(1).max(2e4),mode:oe.optional(),permissionMode:se.optional()});ge.extend({attachments:m.z.array(ne).max(6).default([]),references:le}).strict().superRefine((e,t)=>{e.attachments.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>H&&t.addIssue({code:m.z.ZodIssueCode.custom,path:["attachments"],message:"Inline attachments must be 41943040 bytes or less in total."})}),ge.extend({attachments:m.z.array(ie).max(6).default([]),references:le}).strict(),m.z.object({decision:m.z.enum(["allow","deny","skip"])}).strict(),m.z.object({queueIds:m.z.array(m.z.string().trim().min(1).max(120)).max(100)}).strict(),m.z.object({code:m.z.string().trim().min(1).max(160),message:m.z.string(),instanceId:m.z.string().trim().min(1).max(160).optional(),nodeId:m.z.string().trim().min(1).max(160).optional(),route:m.z.string().trim().min(1).max(4096).optional()}).strict();const he=m.z.object({id:m.z.string().trim().min(1).max(120),message:m.z.string().trim().min(1).max(2e4),attachments:m.z.array(re).max(6).default([]),references:le,permissionMode:se.optional(),status:m.z.enum(["queued","sending","failed"]).default("queued"),createdAt:m.z.string().datetime(),updatedAt:m.z.string().datetime(),error:m.z.string().trim().max(4e3).optional()}).strict(),fe=m.z.object({pendingCount:m.z.number().int().min(0).default(0),items:m.z.array(he).max(100).default([])}).strict().default({pendingCount:0,items:[]}),ye=m.z.enum(["control","realtime","adapter-snapshot","transcript-tail","transcript-scan","process-scan","app-session"]),Ie=m.z.object({id:m.z.string().trim().min(1).max(240),status:m.z.enum(["running","completed"]),startedAt:m.z.string().datetime().optional(),completedAt:m.z.string().datetime().optional()}).strict(),Ae=m.z.object({id:m.z.string().trim().min(1).max(240),providerTurnId:m.z.string().trim().max(240).optional(),source:ye.optional(),userPrompt:m.z.string().trim().optional(),status:m.z.enum(["queued","running","waiting","completed","failed"]).default("running"),phase:G.optional(),summary:m.z.string().trim().max(1e3).optional(),lastMessage:m.z.string().trim().optional(),lastMessageItemId:m.z.string().trim().max(240).optional(),contextCompactions:m.z.array(Ie).max(20).optional(),revision:m.z.number().int().min(0).default(0),sourcePriority:m.z.number().int().min(0).max(100).optional(),snapshotVersion:m.z.number().int().min(0).optional(),observedAt:m.z.string().datetime().optional(),startedAt:m.z.string().datetime().optional(),updatedAt:m.z.string().datetime().optional(),completedAt:m.z.string().datetime().optional()}).strict(),be=Ae.pick({id:!0,providerTurnId:!0,userPrompt:!0,status:!0,phase:!0,summary:!0,lastMessage:!0,contextCompactions:!0,startedAt:!0,updatedAt:!0,completedAt:!0}).strict(),we=m.z.object({id:m.z.string().trim().min(1).max(120),agent:B,appSessionId:m.z.string().trim().max(120).optional(),appId:m.z.string().trim().max(120).optional(),providerSessionId:m.z.string().trim().max(240).optional(),providerMeta:m.z.record(m.z.string(),m.z.unknown()).optional(),appBindingKeys:m.z.array(m.z.string().trim().min(1).max(240)).max(20).optional(),actions:Z.optional(),activeTurnId:m.z.string().trim().max(240).optional(),title:m.z.string().trim().max(240).optional(),cwd:m.z.string().trim().max(4096).optional(),userPrompt:m.z.string().trim().optional(),turns:m.z.array(Ae).max(50).optional(),status:K.default("running"),phase:G.default("unknown"),summary:m.z.string().trim().max(1e3).optional(),lastMessage:m.z.string().trim().optional(),lastMessageItemId:m.z.string().trim().max(240).optional(),currentTool:J.optional(),toolCallsSinceLastMessage:m.z.number().int().min(0).default(0),subAgents:m.z.array(X).max(50).default([]),transcriptPath:m.z.string().trim().max(4096).optional(),transcriptSize:m.z.number().int().min(0).optional(),startedAt:m.z.string().datetime(),updatedAt:m.z.string().datetime(),completedAt:m.z.string().datetime().optional(),error:m.z.string().trim().max(4e3).optional(),counters:Q,queue:fe}).strict();m.z.object({session:we,provider:m.z.string().trim().min(1).max(80),action:m.z.enum(["send","queue","steer","interrupt","approval"]),decision:m.z.enum(["allow","deny","skip"]).optional(),turnId:m.z.string().trim().min(1).max(240).optional(),providerTurnId:m.z.string().trim().min(1).max(240).optional(),queueId:m.z.string().trim().min(1).max(120).optional()}).strict();const Ne=m.z.object({id:m.z.string().trim().min(1).max(120),agent:m.z.enum(["codex","claude"]),providerSessionId:m.z.string().trim().min(1).max(240),title:m.z.string().trim().max(240).optional(),userPrompt:m.z.string().trim().optional(),lastMessage:m.z.string().trim().optional(),cwd:m.z.string().trim().min(1).max(4096),lastActiveAt:m.z.string().datetime(),archivedAt:m.z.string().datetime()}).strict();m.z.object({schemaVersion:m.z.literal(1).default(1),items:m.z.array(Ne).max(50).default([])}).strict(),m.z.object({items:m.z.array(Ne).max(50).default([])}).strict(),m.z.object({item:Ne,turns:m.z.array(be).max(50).default([])}).strict(),m.z.object({disposition:m.z.enum(["resumed","already-open"]),aiSessionId:m.z.string().trim().min(1).max(120),providerSessionId:m.z.string().trim().min(1).max(240),appSessionId:m.z.string().trim().min(1).max(120)}).strict();const ze=we.pick({id:!0,agent:!0,appSessionId:!0,appId:!0,providerSessionId:!0,providerMeta:!0,appBindingKeys:!0,actions:!0,activeTurnId:!0,title:!0,cwd:!0,userPrompt:!0,turns:!0,status:!0,phase:!0,summary:!0,lastMessage:!0,lastMessageItemId:!0,currentTool:!0,toolCallsSinceLastMessage:!0,subAgents:!0,queue:!0,startedAt:!0,updatedAt:!0,error:!0}),ve=m.z.object({runningCount:m.z.number().int().min(0).default(0),waitingCount:m.z.number().int().min(0).default(0),staleCount:m.z.number().int().min(0).default(0),sessions:m.z.array(ze).default([]),updatedAt:m.z.string().datetime()}).strict();m.z.object({streamId:m.z.string().trim().min(1).max(240),revision:m.z.number().int().min(0),lastEventAt:m.z.string().datetime(),snapshot:ve}).strict(),ve.pick({runningCount:!0,waitingCount:!0,staleCount:!0,updatedAt:!0}).extend({idleCount:m.z.number().int().min(0).default(0),problemCount:m.z.number().int().min(0).default(0),revision:m.z.number().int().min(0).optional()});const Ee=m.z.enum(["provider-event","app-session-created","app-session-updated","app-session-deleted","discovery-scan","control-action","heartbeat-sync","startup"]),Se=m.z.object({streamId:m.z.string().trim().min(1).max(240),instanceId:m.z.string().trim().min(1).max(160),nodeId:m.z.string().trim().min(1).max(160).optional(),revision:m.z.number().int().min(0),previousRevision:m.z.number().int().min(0).optional(),traceId:m.z.string().trim().min(1).max(160),generatedAt:m.z.string().datetime(),reason:Ee}).strict(),_e=m.z.object({meta:Se,snapshot:ve}).strict(),Te=m.z.object({meta:Se,upserted:m.z.array(ze).default([]),removed:m.z.array(m.z.string().trim().min(1).max(120)).default([])}).strict(),ke=m.z.object({meta:Se,sessionIds:m.z.array(m.z.string().trim().min(1).max(120)).default([]),expiresAt:m.z.string().datetime()}).strict();m.z.object({instanceId:m.z.string().trim().min(1).max(160),nodeId:m.z.string().trim().min(1).max(160).optional(),sessionId:m.z.string().trim().min(1).max(120),providerSessionId:m.z.string().trim().min(1).max(240),turnId:m.z.string().trim().min(1).max(240),itemId:m.z.string().trim().min(1).max(240),delta:m.z.string().min(1),generatedAt:m.z.string().datetime()}).strict(),m.z.object({streamId:m.z.string().trim().min(1).max(240),instanceId:m.z.string().trim().min(1).max(160),sinceRevision:m.z.number().int().min(0),latestRevision:m.z.number().int().min(0),earliestRetainedRevision:m.z.number().int().min(0),syncRequired:m.z.boolean().default(!1),events:m.z.array(m.z.discriminatedUnion("type",[m.z.object({type:m.z.literal("ai-session.snapshot"),payload:_e}).strict(),m.z.object({type:m.z.literal("ai-session.patch"),payload:Te}).strict(),m.z.object({type:m.z.literal("ai-session.removed"),payload:ke}).strict()])).default([])}).strict();const Ce=m.z.object({source:ye,sourcePriority:m.z.number().int().min(0).max(100).optional(),observedAt:m.z.string().datetime().optional(),snapshotVersion:m.z.number().int().min(0).optional()}).strict(),Oe=Ce.extend({type:m.z.literal("snapshot"),agent:m.z.string().trim().min(1).max(80),appSessionId:m.z.string().trim().max(120).optional(),appId:m.z.string().trim().max(120).optional(),providerSessionId:m.z.string().trim().max(240).optional(),providerMeta:m.z.record(m.z.string(),m.z.unknown()).optional(),appBindingKeys:m.z.array(m.z.string().trim().min(1).max(240)).max(20).optional(),actions:Z.optional(),title:m.z.string().trim().max(240).optional(),cwd:m.z.string().trim().max(4096).optional(),activeTurnId:m.z.string().trim().max(240).optional(),userPrompt:m.z.string().trim().optional(),turns:m.z.array(Ae).max(50).optional(),status:K.optional(),phase:G.optional(),summary:m.z.string().trim().max(1e3).optional(),lastMessage:m.z.string().trim().optional(),lastMessageItemId:m.z.string().trim().max(240).optional(),currentTool:J.optional(),toolCallsSinceLastMessage:m.z.number().int().min(0).optional(),subAgents:m.z.array(X).max(50).optional(),transcriptPath:m.z.string().trim().max(4096).optional(),transcriptSize:m.z.number().int().min(0).optional(),replaceActivity:m.z.boolean().optional()}).strict(),xe=Ce.extend({type:m.z.literal("event"),sessionId:m.z.string().trim().min(1).max(120),kind:m.z.enum(["lifecycle","send-ack","turn-started","user-message","assistant-message","approval-requested","turn-completed","tool-activity","sub-agent-activity","context-compaction"]),activeTurnId:m.z.string().trim().max(240).optional(),providerTurnId:m.z.string().trim().max(240).optional(),userPrompt:m.z.string().trim().optional(),text:m.z.string().optional(),itemId:m.z.string().trim().max(240).optional(),status:K.optional(),phase:G.optional(),summary:m.z.string().trim().max(1e3).optional(),error:m.z.string().trim().max(4e3).optional(),currentTool:J.nullable().optional(),toolCallsSinceLastMessage:m.z.number().int().min(0).optional(),subAgents:m.z.array(X).max(50).optional(),contextCompaction:Ie.optional(),counters:m.z.object({toolCalls:m.z.number().int().min(0).optional(),edits:m.z.number().int().min(0).optional(),approvals:m.z.number().int().min(0).optional()}).strict().optional()}).strict().superRefine((e,t)=>{if("context-compaction"===e.kind?e.contextCompaction||t.addIssue({code:"custom",path:["contextCompaction"],message:"context-compaction events require contextCompaction"}):void 0!==e.contextCompaction&&t.addIssue({code:"custom",path:["contextCompaction"],message:"contextCompaction is only valid for context-compaction events"}),"sub-agent-activity"===e.kind?e.subAgents||t.addIssue({code:"custom",path:["subAgents"],message:"sub-agent-activity events require subAgents"}):void 0!==e.subAgents&&t.addIssue({code:"custom",path:["subAgents"],message:"subAgents is only valid for sub-agent-activity events"}),"tool-activity"!==e.kind)return void 0!==e.currentTool&&t.addIssue({code:"custom",path:["currentTool"],message:"currentTool is only valid for tool-activity events"}),void(void 0!==e.toolCallsSinceLastMessage&&t.addIssue({code:"custom",path:["toolCallsSinceLastMessage"],message:"toolCallsSinceLastMessage is only valid for tool-activity events"}));"currentTool"in e||t.addIssue({code:"custom",path:["currentTool"],message:"tool-activity events require currentTool"}),void 0===e.toolCallsSinceLastMessage&&t.addIssue({code:"custom",path:["toolCallsSinceLastMessage"],message:"tool-activity events require toolCallsSinceLastMessage"})});m.z.discriminatedUnion("type",[Oe,xe]);const Re=m.z.union([m.z.object({type:m.z.literal("schedule"),scheduleKind:m.z.literal("interval").default("interval"),intervalMs:m.z.number().int().min(1e3)}).strict(),m.z.object({type:m.z.literal("schedule"),scheduleKind:m.z.literal("daily"),timeOfDay:m.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),timezone:m.z.string().trim().min(1).max(120)}).strict(),m.z.object({type:m.z.literal("schedule"),scheduleKind:m.z.literal("weekly"),weekdays:m.z.array(m.z.number().int().min(0).max(6)).min(1).max(7),timeOfDay:m.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),timezone:m.z.string().trim().min(1).max(120)}).strict()]),De=m.z.union([Re,m.z.object({type:m.z.literal("file-change"),roots:m.z.array(m.z.string().trim().min(1).max(4096)).min(1).max(50),globs:m.z.array(m.z.string().trim().min(1).max(500)).min(1).max(100),ignore:m.z.array(m.z.string().trim().min(1).max(500)).max(100).optional(),debounceMs:m.z.number().int().min(100).max(6e4).default(1500)}).strict(),m.z.object({type:m.z.literal("ai-session"),agent:m.z.string().trim().min(1).max(80).optional(),statuses:m.z.array(m.z.enum(["running","waiting","idle","failed"])).max(20).optional(),phases:m.z.array(m.z.enum(["thinking","tool","editing","approval","responding","unknown"])).max(20).optional()}).strict()]),Pe=m.z.object({promptTemplate:m.z.string().trim().min(1).max(2e4)}).strict(),je=m.z.object({cooldownMs:m.z.number().int().min(0).max(864e5).optional(),maxConcurrentRuns:m.z.number().int().min(1).max(20).default(1),whenBusy:m.z.enum(["skip","queue"]).default("skip")}).strict(),Me=m.z.object({configHash:m.z.string().trim().min(8).max(80),name:m.z.string().trim().min(1).max(160),description:m.z.string().trim().max(1e3).optional(),source:De,action:Pe,policy:je.default({maxConcurrentRuns:1,whenBusy:"skip"}),createdAt:m.z.string().datetime(),updatedAt:m.z.string().datetime()}).strict(),Le=m.z.object({type:m.z.literal("ai-session"),aiSessionId:m.z.string().trim().min(1).max(160)}).strict(),$e=m.z.object({configHash:m.z.string().trim().min(8).max(80),deploymentId:m.z.string().trim().min(1).max(240).optional(),instanceId:m.z.string().trim().min(1).max(160),origin:m.z.enum(["control-plane","controlled-instance"]).default("controlled-instance"),enabled:m.z.boolean().default(!0),target:Le,localName:m.z.string().trim().min(1).max(160).optional(),createdAt:m.z.string().datetime(),updatedAt:m.z.string().datetime()}).strict(),Fe=m.z.object({configHash:m.z.string().trim().min(8).max(80),deploymentId:m.z.string().trim().min(1).max(240).optional(),instanceId:m.z.string().trim().min(1).max(160),status:m.z.enum(["idle","running","disabled","error"]).default("idle"),lastTriggeredAt:m.z.string().datetime().optional(),lastCompletedAt:m.z.string().datetime().optional(),lastSkippedAt:m.z.string().datetime().optional(),lastError:m.z.string().trim().max(4e3).optional(),runCount:m.z.number().int().min(0).default(0),skippedCount:m.z.number().int().min(0).default(0)}).strict(),Ue=m.z.object({id:m.z.string().trim().min(1).max(160),configHash:m.z.string().trim().min(8).max(80),deploymentId:m.z.string().trim().min(1).max(240).optional(),instanceId:m.z.string().trim().min(1).max(160),eventType:m.z.enum(["manual","schedule","file-change","ai-session"]),status:m.z.enum(["started","completed","failed","skipped"]),target:Le,promptPreview:m.z.string().trim().max(500),eventSummary:m.z.string().trim().max(1e3).optional(),error:m.z.string().trim().max(4e3).optional(),startedAt:m.z.string().datetime(),completedAt:m.z.string().datetime().optional()}).strict();m.z.object({schemaVersion:m.z.literal(1).default(1),configs:m.z.array(Me).default([]),deployments:m.z.array($e).default([]),runtime:m.z.array(Fe).default([]),recentRuns:m.z.array(Ue).default([])}).strict();const Ve=m.z.string().regex(/^\d{4}-\d{2}-\d{2}$/,"Proxy protocol version must use YYYY-MM-DD format."),He=m.z.string().trim().min(1).max(160).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),qe=m.z.string().datetime(),Be=m.z.string().trim().min(32).max(4096),Ke=m.z.string().trim().max(2048).transform((e,t)=>{try{return function(e){const t=new URL(e.trim());if("https:"!==t.protocol||t.username||t.password||"/"!==t.pathname||t.search||t.hash)throw new Error("Proxy origin must be an HTTPS origin without credentials, path, query, or fragment.");return t.origin}(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),m.z.NEVER}});m.z.string().trim().min(1).max(4096).transform((e,t)=>{try{return function(e){const t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/%25/i.test(t))throw new Error("Proxy route must be a single-encoded node-agent relative route.");const n=t.split("?",1)[0];let r,i;try{r=n.split("/").map(e=>decodeURIComponent(e))}catch{throw new Error("Proxy route contains invalid percent encoding.")}if(r.some(e=>".."===e||"."===e))throw new Error("Proxy route cannot traverse outside the node-agent API.");try{i=new URL(t,"https://node-agent.invalid")}catch{throw new Error("Proxy route is invalid.")}if("https://node-agent.invalid"!==i.origin||i.username||i.password)throw new Error("Proxy route cannot select an absolute upstream URL.");return`${i.pathname}${i.search}`}(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),m.z.NEVER}});const Ge=m.z.enum(Object.values({ProtocolUnsupported:"CONTROL_PLANE_PROXY_PROTOCOL_UNSUPPORTED",InviteInvalid:"CONTROL_PLANE_PROXY_INVITE_INVALID",InviteExpired:"CONTROL_PLANE_PROXY_INVITE_EXPIRED",InviteConsumed:"CONTROL_PLANE_PROXY_INVITE_CONSUMED",InviteRevoked:"CONTROL_PLANE_PROXY_INVITE_REVOKED",TargetUnavailable:"CONTROL_PLANE_PROXY_TARGET_UNAVAILABLE",TargetMismatch:"CONTROL_PLANE_PROXY_TARGET_MISMATCH",BindingUnknown:"CONTROL_PLANE_PROXY_BINDING_UNKNOWN",BindingRevoked:"CONTROL_PLANE_PROXY_BINDING_REVOKED",BindingIdentityConflict:"CONTROL_PLANE_PROXY_BINDING_IDENTITY_CONFLICT",AuthenticationFailed:"CONTROL_PLANE_PROXY_AUTHENTICATION_FAILED",RouteInvalid:"CONTROL_PLANE_PROXY_ROUTE_INVALID",HeaderInvalid:"CONTROL_PLANE_PROXY_HEADER_INVALID",ResourceLimit:"CONTROL_PLANE_PROXY_RESOURCE_LIMIT",SnapshotRequired:"CONTROL_PLANE_PROXY_SNAPSHOT_REQUIRED",Unavailable:"CONTROL_PLANE_PROXY_UNAVAILABLE",TransportFailed:"CONTROL_PLANE_PROXY_TRANSPORT_FAILED"})),Je=m.z.object({code:Ge,message:m.z.string().trim().min(1).max(2048),retryable:m.z.boolean(),details:m.z.record(m.z.string(),m.z.unknown()).optional()}).strict(),We=m.z.enum(["active","consumed","revoked","expired"]),Ye=m.z.object({id:He,targetNodeId:He,tokenHash:m.z.string().trim().min(32).max(256),status:We,createdBy:He,expiresAt:qe,consumedByClaimId:He.optional(),consumedAt:qe.optional(),revokedAt:qe.optional(),createdAt:qe,updatedAt:qe}).strict().omit({tokenHash:!0});m.z.object({targetNodeId:He,expiresInSeconds:m.z.number().int().min(60).max(3600).default(600)}).strict(),m.z.object({invite:Ye,token:m.z.string().trim().min(24).max(512),proxyOrigin:Ke,protocolVersion:Ve}).strict();const Xe=m.z.enum(["active","revoked"]),Qe=m.z.object({id:He,claimId:He,sourceControlPlaneId:He,targetNodeId:He,bindingKeyId:He,credentialHash:m.z.string().trim().min(32).max(256),status:Xe,revision:m.z.number().int().positive(),lastError:Je.optional(),revokedAt:qe.optional(),createdAt:qe,updatedAt:qe}).strict().omit({credentialHash:!0});m.z.object({protocolVersion:Ve,inviteToken:m.z.string().trim().min(24).max(512).optional(),claimId:He,sourceControlPlaneId:He,targetNodeId:He.optional(),bindingKeyId:He,credential:Be}).strict(),m.z.object({sourceControlPlaneId:He,bindingKeyId:He,credential:Be}).strict();const Ze=m.z.object({id:He,name:m.z.string().trim().min(1).max(160),status:m.z.enum(["unknown","online","offline","degraded"]),health:m.z.enum(["unknown","ok","degraded","failed"]),lastSeenAt:qe.optional(),capabilities:m.z.record(m.z.string(),m.z.unknown()).default({})}).strict(),et=m.z.object({protocolVersion:Ve,binding:Qe,streamId:He,revision:m.z.number().int().nonnegative(),observedAt:qe,target:Ze}).strict(),tt=m.z.object({type:m.z.literal("control-plane-proxy.event"),protocolVersion:Ve,streamId:He,bindingId:He,sourceControlPlaneId:He,targetNodeId:He,revision:m.z.number().int().positive(),source:m.z.object({id:m.z.string().trim().min(1).max(512),seq:m.z.number().int().nonnegative()}).strict(),target:Ze,event:m.z.object({type:m.z.string().trim().min(1).max(240),topic:m.z.string().trim().min(1).max(240),createdAt:qe}).strict()}).strict(),nt=m.z.object({type:m.z.literal("control-plane-proxy.events.ready"),protocolVersion:Ve,streamId:He,bindingId:He,sourceControlPlaneId:He,targetNodeId:He,latestRevision:m.z.number().int().nonnegative(),earliestRetainedRevision:m.z.number().int().nonnegative()}).strict(),rt=m.z.object({type:m.z.literal("control-plane-proxy.snapshot-required"),protocolVersion:Ve,streamId:He,bindingId:He,sourceControlPlaneId:He,targetNodeId:He,sinceRevision:m.z.number().int().nonnegative(),latestRevision:m.z.number().int().nonnegative(),earliestRetainedRevision:m.z.number().int().nonnegative(),error:Je}).strict();m.z.discriminatedUnion("type",[tt,nt,rt]),m.z.object({protocolVersion:Ve,binding:Qe,target:et.shape.target}).strict(),m.z.object({id:He,claimId:He,proxyOrigin:Ke,requestedName:m.z.string().trim().min(1).max(160).optional(),sourceControlPlaneId:He,targetNodeId:He.optional(),bindingKeyId:He,credential:Be,status:m.z.enum(["pending","compensation-required"]),createdAt:qe,updatedAt:qe,expiresAt:qe}).strict().omit({credential:!0}),m.z.object({id:He,nodeId:He,proxyOrigin:Ke,proxyBindingId:He,targetNodeId:He,sourceControlPlaneId:He,bindingKeyId:He,credential:Be,createdAt:qe,updatedAt:qe}).strict();const it="2026-08-01",ot=m.z.string(),st=m.z.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),at=m.z.string().datetime(),ct=m.z.record(m.z.string(),m.z.string()).default({}),dt=m.z.record(m.z.string(),m.z.string()).default({}),lt=m.z.string().regex(/^\d{4}-\d{2}-\d{2}$/,"Protocol version must use YYYY-MM-DD format."),ut=m.z.object({encoding:m.z.enum(["utf8","base64"]),data:m.z.string()}).strict().superRefine((e,t)=>{"base64"===e.encoding&&Buffer.from(e.data,"base64").toString("base64")!==e.data&&t.addIssue({code:"custom",path:["data"],message:"Node tunnel binary body must use canonical base64 encoding."})});function mt(e){if(null==e)return;const t=ut.parse(e);return"utf8"===t.encoding?t.data:Buffer.from(t.data,"base64")}const pt=/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/,gt=/^sha256:([a-fA-F0-9]{64})$/,ht=/^(?:localhost|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::[1-9][0-9]{0,4})?$/,ft=/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*$/;function yt(e){const t=e.trim();if(!t||t.length>512||t.includes("://")||/\s/.test(t))throw new Error("Docker image reference must not contain a URL scheme or whitespace.");const n=t.indexOf("@");if(-1!==n&&n!==t.lastIndexOf("@"))throw new Error("Docker image reference contains more than one digest separator.");const r=-1===n?void 0:t.slice(n+1),i=-1===n?t:t.slice(0,n),o=r?gt.exec(r):void 0;if(r&&!o)throw new Error("Docker image digest must use sha256 followed by 64 hexadecimal characters.");const s=i.lastIndexOf("/"),a=i.lastIndexOf(":"),c=a>s,d=c?i.slice(a+1):void 0,l=c?i.slice(0,a):i;if(d&&!pt.test(d))throw new Error("Docker image tag is invalid.");if(!d&&!o)throw new Error("Docker image reference must include an explicit tag or sha256 digest.");const u=l.split("/");if(!u.length||u.some(e=>!e))throw new Error("Docker image repository path is invalid.");const m=u.length>1&&(u[0].includes(".")||u[0].includes(":")||"localhost"===u[0]),p=m?u.slice(1):u;if(m&&!ht.test(u[0].toLowerCase()))throw new Error("Docker image registry host or port is invalid.");if(!p.length||p.some(e=>!ft.test(e)))throw new Error("Docker image repository names must be lowercase and use valid separators.");const g=u.map((e,t)=>m&&0===t?e.toLowerCase():e).join("/"),h=o?`sha256:${o[1].toLowerCase()}`:void 0;return`${g}${d?`:${d}`:""}${h?`@${h}`:""}`}function It(e){const t=yt(e),n=t.indexOf("@"),r=-1===n?void 0:t.slice(n+1),i=-1===n?t:t.slice(0,n),o=i.lastIndexOf("/"),s=i.lastIndexOf(":"),a=s>o;return{reference:t,repository:a?i.slice(0,s):i,tag:a?i.slice(s+1):void 0,digest:r}}const At=m.z.string().trim().min(1).max(512).transform((e,t)=>{try{return yt(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),m.z.NEVER}}),bt=m.z.string().trim().transform((e,t)=>{const n=gt.exec(e);return n?`sha256:${n[1].toLowerCase()}`:(t.addIssue({code:"custom",message:"Docker image digest must use sha256 followed by 64 hexadecimal characters."}),m.z.NEVER)}),wt=m.z.object({codexModelHash:st.nullable().optional(),claudeModelHash:st.nullable().optional()}).strict().default({}),Nt=m.z.object({imageId:st,tag:m.z.string().trim().min(1).max(128).regex(pt).optional()}).strict(),zt={img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"};function vt(e,t){if(e&&"object"==typeof e&&!Array.isArray(e)){const t=e;return{imageId:"string"==typeof t.imageId&&zt[t.imageId]||t.imageId,..."string"==typeof t.tag?{tag:t.tag}:{}}}if("string"==typeof t)return{imageId:zt[t]||t}}function Et(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,{defaultImageId:n,...r}=t;return{...r,defaultImageSelection:vt(t.defaultImageSelection,n)}}const St=m.z.object({id:st,name:m.z.string().trim().min(1).max(120),kind:m.z.enum(["tty","gui","web"]),source:m.z.enum(["builtin","custom"]),availability:m.z.enum(["available","missing-dependency"]),capabilities:m.z.object({automation:m.z.enum(["cdp"]).optional(),supportsCwdSelection:m.z.boolean().default(!1)}).strict().default({supportsCwdSelection:!1}),diagnosticCode:m.z.enum(["APP_EXECUTABLE_NOT_FOUND"]).optional()}).strict(),_t=m.z.object({code:m.z.enum(["APP_CATALOG_INVALID"]),message:m.z.string().trim().min(1).max(500)}).strict(),Tt=m.z.object({items:m.z.array(St).max(256),observedAt:at,issues:m.z.array(_t).max(32).default([])}).strict(),kt=m.z.enum(["linux","darwin","win32","freebsd","openbsd","aix","sunos","unknown"]),Ct=m.z.enum(["x64","arm64","arm","ia32","ppc64","s390x","riscv64","unknown"]),Ot=m.z.enum(["apt","dnf","brew","npm"]),xt=m.z.enum(["user","passwordless-sudo","root"]),Rt=m.z.object({platform:kt,arch:Ct,installers:m.z.array(Ot).max(8),privilege:xt,installerAccess:m.z.object({npmGlobalWritable:m.z.boolean().optional()}).strict().optional()}).strict(),Dt=m.z.enum(["installed","not-installed","broken","unsupported"]),Pt=m.z.enum(["recipe","bundled","external","none"]),jt=m.z.object({code:m.z.enum(["BUNDLED","EXTERNALLY_MANAGED","ALREADY_INSTALLED","NOT_INSTALLED","UNSUPPORTED_PLATFORM","INSTALLER_UNAVAILABLE","INSTALLER_NOT_WRITABLE","INSUFFICIENT_PRIVILEGE","OPERATION_IN_PROGRESS"]),message:m.z.string().trim().min(1).max(500)}).strict(),Mt=m.z.object({id:st,name:m.z.string().trim().min(1).max(120),kind:m.z.enum(["tty","gui","web"]),description:m.z.string().trim().max(500).optional(),state:Dt,managementSource:Pt,version:m.z.string().trim().max(120).optional(),canInstall:m.z.boolean(),canUninstall:m.z.boolean(),installReason:jt.optional(),uninstallReason:jt.optional(),activeJobId:st.optional()}).strict(),Lt=m.z.enum(["install","uninstall"]),$t=m.z.enum(["queued","running","succeeded","failed","cancelled","interrupted"]),Ft=m.z.object({current:m.z.number().finite().nonnegative().optional(),total:m.z.number().finite().positive().optional(),unit:m.z.string().trim().min(1).max(40).optional()}).strict().refine(e=>void 0===e.total||void 0===e.current||e.current<=e.total,{message:"Progress current must not exceed total.",path:["current"]}),Ut=m.z.object({executable:m.z.string().trim().min(1).max(4096),args:m.z.array(m.z.string().max(4096)).max(128)}).strict(),Vt=m.z.object({code:m.z.string().trim().min(1).max(120).regex(/^[a-z0-9][a-z0-9._-]*$/),message:m.z.string().trim().min(1).max(4096),retryable:m.z.boolean(),sessionIds:m.z.array(st).max(64).optional()}).strict(),Ht=m.z.object({id:st,requestId:st.optional(),appId:st,operation:Lt,state:$t,phase:m.z.string().trim().min(1).max(120).optional(),progress:Ft.optional(),command:Ut.optional(),logTail:m.z.string().max(32768).optional(),logTruncated:m.z.boolean().optional(),error:Vt.optional(),requestedAt:at,startedAt:at.optional(),finishedAt:at.optional(),updatedAt:at}).strict(),qt=m.z.object({streamId:st,sequence:m.z.number().int().nonnegative(),capabilities:Rt,apps:m.z.array(Mt).max(256),activeJobs:m.z.array(Ht).max(256),recentJobs:m.z.array(Ht).max(256),observedAt:at}).strict();m.z.object({requestId:st.optional()}).strict(),m.z.object({job:Ht}).strict(),m.z.object({type:m.z.literal("app-management"),streamId:st,sequence:m.z.number().int().nonnegative(),observedAt:at,job:Ht.optional(),snapshot:qt.optional()}).strict().refine(e=>void 0!==e.job||void 0!==e.snapshot,{message:"An app management event requires a job or snapshot."});const Bt=m.z.object({component:m.z.enum(["control-plane","node-agent","controlled-instance"]),packageName:m.z.string().trim().max(160).optional(),packageVersion:m.z.string().trim().max(80).optional(),protocolVersion:ot.optional(),buildId:m.z.string().trim().max(160).optional(),builtAt:m.z.string().trim().max(120).optional(),gitCommit:m.z.string().trim().max(120).optional(),imageRef:m.z.string().trim().max(512).optional(),imageDigest:m.z.string().trim().max(240).optional()}).strict(),Kt=m.z.enum(["stable","beta","alpha"]),Gt=m.z.object({packageName:m.z.literal("@task-handoff/controlled-instance"),version:m.z.string().trim().min(1).max(80),platform:m.z.string().trim().min(1).max(40),arch:m.z.string().trim().min(1).max(40),formatVersion:m.z.number().int().positive(),launcherAbi:m.z.number().int().positive(),entrypoint:m.z.string().trim().min(1).max(512),sha256:m.z.string().regex(/^[a-f0-9]{64}$/)}).strict(),Jt=m.z.object({code:m.z.enum(["INSTANCE_RUNTIME_VERSION_MISMATCH","INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE","INSTANCE_RUNTIME_ARTIFACT_INVALID","INSTANCE_RUNTIME_INSTALL_FAILED","INSTANCE_RUNTIME_RESTART_FAILED","INSTANCE_RUNTIME_VERIFICATION_FAILED","INSTANCE_BASE_RUNTIME_INCOMPATIBLE","NODE_UPDATE_PREFLIGHT_FAILED","NODE_UPDATE_FAILED","LEGACY_INSTANCE_UPDATE_RETIRED"]),message:m.z.string().trim().min(1).max(4096),expectedVersion:m.z.string().trim().min(1).max(80).optional(),actualVersion:m.z.string().trim().min(1).max(80).optional(),retryable:m.z.boolean().default(!1)}).strict(),Wt=m.z.object({desiredVersion:m.z.string().trim().min(1).max(80),actualVersion:m.z.string().trim().min(1).max(80).optional(),phase:m.z.enum(["pending","draining","installing","restarting","verifying","matched","failed"]),attempt:m.z.number().int().nonnegative().default(0),lastAttemptAt:at.optional(),matchedAt:at.optional(),error:Jt.optional()}).strict(),Yt=m.z.object({runningInstanceCount:m.z.number().int().nonnegative(),stoppedInstanceCount:m.z.number().int().nonnegative(),activeInstanceCount:m.z.number().int().nonnegative(),restartInstanceCount:m.z.number().int().nonnegative(),runningInstanceIds:m.z.array(st).max(1024).default([]),stoppedInstanceIds:m.z.array(st).max(1024).default([]),activeInstanceIds:m.z.array(st).max(1024).default([])}).strict(),Xt=m.z.object({phase:m.z.enum(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),desiredVersion:m.z.string().trim().min(1).max(80),nodeVersion:m.z.string().trim().min(1).max(80).optional(),expectedInstanceIds:m.z.array(st).max(1024).default([]),expectedInstanceCount:m.z.number().int().nonnegative(),matchedInstanceCount:m.z.number().int().nonnegative(),pendingInstanceCount:m.z.number().int().nonnegative(),failedInstanceCount:m.z.number().int().nonnegative(),deferredInstanceCount:m.z.number().int().nonnegative().default(0)}).strict(),Qt=m.z.object({channel:Kt.default("stable")}).strict(),Zt=m.z.object({source:m.z.literal("npm"),channel:Kt,currentVersion:m.z.string().trim().max(240).optional(),availableVersion:m.z.string().trim().min(1).max(240),artifactRef:m.z.string().trim().min(1).max(512).optional(),runtimeArtifacts:m.z.array(Gt).default([]),impact:Yt,updateAvailable:m.z.boolean(),supported:m.z.boolean().default(!0),reason:m.z.string().trim().max(2048).optional(),checkedAt:at,preflightToken:m.z.string().trim().min(16).max(240).optional()}).strict(),en=m.z.object({id:st,nodeId:st,source:m.z.literal("npm"),channel:Kt,fromVersion:m.z.string().trim().max(240).optional(),toVersion:m.z.string().trim().min(1).max(240),artifactRef:m.z.string().trim().min(1).max(512).optional(),runtimeArtifacts:m.z.array(Gt).default([]),impact:Yt,rollout:Xt,status:m.z.enum(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),error:Jt.optional(),startedAt:at.optional(),completedAt:at.optional(),createdAt:at,updatedAt:at}).strict(),tn=m.z.object({channel:Kt,targetVersion:m.z.string().trim().min(1).max(240),preflightToken:m.z.string().trim().min(16).max(240)}).strict(),nn=m.z.object({type:m.z.enum(["branch","tag","commit"]),name:m.z.string().trim().min(1).max(240).optional(),commit:m.z.string().trim().max(80).optional()}).strict(),rn=m.z.object({type:m.z.enum(["none","ssh-key","https-token"]).default("none"),secretId:m.z.string().trim().min(1).max(120).optional()}).strict(),on=m.z.object({depth:m.z.number().int().positive().max(1e5).optional(),submodules:m.z.boolean().default(!1),lfs:m.z.boolean().default(!1),subdirectory:m.z.string().trim().max(240).default("")}).strict();m.z.object({id:st,name:m.z.string().trim().min(1).max(160),url:m.z.string().trim().min(1).max(2048),provider:m.z.string().trim().max(80).optional(),ref:nn.default({type:"branch",name:"main"}),auth:rn.default({type:"none"}),clone:on.default({submodules:!1,lfs:!1,subdirectory:""}),defaultImageSelection:Nt.optional(),labels:ct,createdAt:at,updatedAt:at}).strict();const sn=m.z.object({id:st,nodeId:st,name:m.z.string().trim().min(1).max(160),path:m.z.string().trim().min(1).max(4096),defaultImageSelection:Nt.optional(),labels:ct,createdAt:at,updatedAt:at}).strict(),an=m.z.discriminatedUnion("type",[m.z.object({type:m.z.literal("git-repository"),repositoryId:st.optional(),url:m.z.string().trim().min(1).max(2048),provider:m.z.string().trim().max(80).optional(),ref:nn.default({type:"branch",name:"main"}),auth:rn.default({type:"none"}),clone:on.default({submodules:!1,lfs:!1,subdirectory:""})}).strict(),m.z.object({type:m.z.literal("git-template"),url:m.z.string().trim().min(1).max(2048),templateId:m.z.string().trim().min(1).max(120).optional(),ref:nn.default({type:"branch",name:"main"}),auth:rn.default({type:"none"}),clone:on.default({submodules:!1,lfs:!1,subdirectory:""})}).strict(),m.z.object({type:m.z.literal("local-folder"),localFolderId:st.optional(),path:m.z.string().trim().min(1).max(4096),ownerNodeId:st.optional()}).strict()]),cn=m.z.object({mode:m.z.enum(["local-bind","git-clone","empty-volume","persistent-volume"]),path:m.z.string().trim().min(1).max(4096).default("/workspace"),volumeName:m.z.string().trim().max(240).optional(),readOnly:m.z.boolean().default(!1)}).strict(),dn=m.z.enum(["codex","claude"]),ln=m.z.object({id:st,name:m.z.string().trim().min(1).max(160),source:an,defaultImageSelection:Nt.optional(),defaultNodeId:st.optional(),defaultRuntimeId:st.optional(),workspacePolicy:cn,labels:ct,createdAt:at,updatedAt:at}).strict(),un=m.z.object({id:st,name:m.z.string().trim().min(1).max(160),endpoint:m.z.string().trim().min(1).max(2048),key:m.z.string().trim().min(1).max(4096),model:m.z.string().trim().min(1).max(240),app:dn,enabled:m.z.boolean().default(!0),order:m.z.number().int().min(0).max(1e6).default(0),labels:ct,createdAt:at,updatedAt:at}).strict(),mn=un,pn=un.omit({key:!0}).extend({keyPreview:m.z.string().trim().min(1).max(160),keySet:m.z.boolean()}).strict(),gn=pn.extend({referenceCount:m.z.number().int().min(0)}).strict(),hn=m.z.object({instanceId:st,codexModelHash:st.optional(),claudeModelHash:st.optional(),updatedAt:at}).strict(),fn=m.z.discriminatedUnion("type",[m.z.object({type:m.z.literal("control-plane"),name:un.shape.name,enabled:un.shape.enabled,order:un.shape.order}).strict(),m.z.object({type:m.z.literal("node"),nodeId:st,name:un.shape.name,enabled:un.shape.enabled,order:un.shape.order,referenceCount:m.z.number().int().min(0)}).strict()]),yn=m.z.object({id:st,model:pn,locations:m.z.array(fn).min(1),referenceCount:m.z.number().int().min(0).default(0)}).strict(),In=m.z.object({nodeId:st,code:m.z.string().trim().min(1).max(120),message:m.z.string().trim().min(1).max(2e3)}).strict();m.z.object({models:m.z.array(yn),nodeDiagnostics:m.z.array(In).default([]),updatedAt:at}).strict();const An=un.omit({id:!0,createdAt:!0,updatedAt:!0}).strict(),bn=An.partial().strict(),wn=un,Nn=m.z.object({modelSelection:wt,codexModelHash:st.optional(),claudeModelHash:st.optional()}).strict();function zn(e){const t={app:dn.parse(e.app),endpoint:un.shape.endpoint.parse(e.endpoint),key:un.shape.key.parse(e.key),model:un.shape.model.parse(e.model)};return`mdl_${r.createHash("sha256").update(JSON.stringify(t)).digest("hex")}`}const vn=m.z.enum(["market","custom"]),En=m.z.enum(["active","deprecated","yanked"]),Sn=m.z.discriminatedUnion("kind",[m.z.object({kind:m.z.literal("builtin"),key:m.z.string().trim().min(1).max(120)}).strict(),m.z.object({kind:m.z.literal("remote"),url:m.z.string().trim().url().max(2048),mediaType:m.z.enum(["image/png","image/jpeg","image/webp"]).optional(),digest:bt.optional()}).strict()]),_n=m.z.array(m.z.string().trim().min(1).max(80)).default([]),Tn=m.z.array(m.z.string().trim().min(1).max(120)).default([]),kn=m.z.record(m.z.string().trim().min(2).max(35),m.z.string().trim().min(1).max(4096)),Cn=m.z.object({os:m.z.string().trim().min(1).max(40),architecture:m.z.string().trim().min(1).max(40),digest:bt.optional(),downloadSizeBytes:m.z.number().int().positive().optional(),unpackedSizeBytes:m.z.number().int().positive().optional()}).strict(),On=m.z.object({name:m.z.string().trim().min(1).max(128).regex(pt),version:m.z.string().trim().min(1).max(160).optional(),reference:At,manifestDigest:bt.optional(),publishedAt:at.optional(),platforms:m.z.array(Cn).default([]),status:En.default("active")}).strict(),xn=m.z.object({id:st,publisher:m.z.string().trim().min(1).max(160),slug:m.z.string().trim().min(1).max(160),name:m.z.string().trim().min(1).max(160),description:m.z.string().trim().min(1).max(4096),localizedDescriptions:kn.optional(),cover:Sn.optional(),repository:m.z.string().trim().min(1).max(512),defaultTag:m.z.string().trim().min(1).max(128).regex(pt),tags:m.z.array(On).min(1),capabilities:_n,optionalApps:Tn,defaultEnv:dt,labels:ct,status:En.default("active")}).strict().superRefine((e,t)=>{e.tags.some(t=>t.name===e.defaultTag)||t.addIssue({code:"custom",path:["defaultTag"],message:"Market defaultTag must identify one of the image tags."})});m.z.object({protocolVersion:lt,catalogId:st,revision:m.z.string().trim().min(1).max(240),source:m.z.enum(["embedded","remote","cache"]),generatedAt:at,expiresAt:at.optional(),items:m.z.array(xn)}).strict(),m.z.object({source:m.z.enum(["embedded","remote","cache"]),state:m.z.enum(["ready","refreshing","stale","failed"]),revision:m.z.string().trim().min(1).max(240),updatedAt:at,error:m.z.string().trim().max(4096).optional()}).strict(),m.z.object({id:st,origin:m.z.literal("custom"),name:m.z.string().trim().min(1).max(160),description:m.z.string().trim().max(4096).optional(),localizedDescriptions:kn.optional(),cover:Sn.optional(),reference:At,repository:m.z.string().trim().min(1).max(512),tag:m.z.string().trim().min(1).max(128).regex(pt).optional(),pullPolicy:m.z.literal("if-not-present").default("if-not-present"),capabilities:_n,optionalApps:Tn,defaultEnv:dt,labels:ct,createdAt:at,updatedAt:at}).strict();const Rn=m.z.object({name:m.z.string().trim().min(1).max(128).regex(pt),version:m.z.string().trim().min(1).max(160).optional(),reference:At,manifestDigest:bt.optional(),status:En}).strict(),Dn=m.z.object({id:st,origin:vn,name:m.z.string().trim().min(1).max(160),description:m.z.string().trim().max(4096).optional(),localizedDescriptions:kn.optional(),cover:Sn,repository:m.z.string().trim().min(1).max(512),tag:m.z.string().trim().min(1).max(128).regex(pt).optional(),availableTags:m.z.array(Rn),reference:At,digest:bt.optional(),downloadSizeBytes:m.z.number().int().positive().optional(),unpackedSizeBytes:m.z.number().int().positive().optional(),capabilities:_n,optionalApps:Tn,defaultEnv:dt,labels:ct,readOnly:m.z.boolean(),lifecycleStatus:En.optional(),market:m.z.object({catalogId:st,catalogRevision:m.z.string().trim().min(1).max(240),publisher:m.z.string().trim().min(1).max(160),version:m.z.string().trim().min(1).max(160).optional()}).strict().optional()}).strict(),Pn=m.z.object({id:st,origin:vn,name:m.z.string().trim().min(1).max(160),description:m.z.string().trim().max(4096).optional(),localizedDescriptions:kn.optional(),cover:Sn.optional(),repository:m.z.string().trim().min(1).max(512),tag:m.z.string().trim().min(1).max(128).regex(pt).optional(),requestedReference:At,resolvedDigest:bt.optional(),resolvedReference:At.optional(),downloadSizeBytes:m.z.number().int().positive().optional(),pullPolicy:m.z.literal("if-not-present").default("if-not-present"),capabilities:_n,optionalApps:Tn,defaultEnv:dt,labels:ct,market:m.z.object({catalogId:st,catalogRevision:m.z.string().trim().min(1).max(240),publisher:m.z.string().trim().min(1).max(160),version:m.z.string().trim().min(1).max(160).optional()}).strict().optional(),createdAt:at,updatedAt:at}).strict(),jn=m.z.object({phase:m.z.enum(["checking-image","pulling-image","resolving-image","ready","failed"]),requestedReference:At,generation:m.z.number().int().nonnegative().default(0),error:m.z.string().trim().max(4096).optional(),startedAt:at,updatedAt:at}).strict(),Mn="image.pull.terminal.output",Ln="image.pull.terminal.finished",$n=m.z.object({instanceId:st,generation:m.z.number().int().nonnegative(),requestedReference:At,sequence:m.z.number().int().nonnegative(),observedAt:at}).strict(),Fn=$n.extend({data:m.z.string().min(1).max(65536),replay:m.z.boolean().optional()}).strict(),Un=$n.extend({outcome:m.z.enum(["succeeded","failed"])}).strict();$n.extend({status:m.z.enum(["connecting","pulling","extracting","complete","failed"]),layers:m.z.object({total:m.z.number().int().nonnegative(),completed:m.z.number().int().nonnegative(),downloaded:m.z.number().int().nonnegative(),downloading:m.z.number().int().nonnegative(),extracting:m.z.number().int().nonnegative()}).strict(),bytes:m.z.object({current:m.z.number().finite().nonnegative(),total:m.z.number().finite().positive()}).strict().optional(),percent:m.z.number().finite().min(0).max(100).optional(),message:m.z.string().trim().min(1).max(500),terminalTail:m.z.string().max(262144).optional(),terminalTruncated:m.z.boolean().optional()}).strict();const Vn=m.z.discriminatedUnion("kind",[m.z.object({kind:m.z.literal("direct")}).strict(),m.z.object({kind:m.z.literal("control-plane-proxy"),proxyId:st,proxyBindingId:st,targetNodeId:st}).strict()]),Hn=m.z.object({reachability:m.z.enum(["unknown","reachable","unreachable"]),bindingStatus:m.z.enum(["unknown","active","revoked"]),bindingRevision:m.z.number().int().positive().optional(),streamId:m.z.string().trim().min(1).max(160).optional(),revision:m.z.number().int().nonnegative().optional(),observedAt:at.optional(),target:Ze.optional(),lastError:Je.optional(),updatedAt:at}).strict(),qn=m.z.object({id:st,name:m.z.string().trim().min(1).max(160),connectionMode:m.z.enum(["local-ipc","local-loopback","direct-http","reverse-wss","control-plane-proxy"]).default("direct-http"),connectionPath:Vn.default({kind:"direct"}),connectionEnabled:m.z.boolean().default(!0),auth:m.z.object({mode:m.z.enum(["local-static-key","paired-hmac","proxy-binding"]).default("local-static-key"),keyId:st.optional(),secret:m.z.string().trim().max(4096).optional(),pairedAt:at.optional(),pairing:m.z.object({status:m.z.enum(["pending","paired","expired"]).default("pending"),joinToken:m.z.string().trim().max(4096).optional(),expiresAt:at.optional()}).strict().optional()}).strict().default({mode:"local-static-key"}),endpoint:m.z.string().trim().max(2048).optional(),controlEndpoint:m.z.string().trim().max(2048).optional(),containerEndpoint:m.z.string().trim().max(2048).optional(),publicWebBase:m.z.string().trim().max(2048).optional(),status:m.z.enum(["unknown","online","offline","degraded"]).default("unknown"),health:m.z.enum(["unknown","ok","degraded","failed"]).default("unknown"),capabilities:m.z.record(m.z.string(),m.z.unknown()).default({}),proxyState:Hn.optional(),appInventory:Tt.optional(),labels:ct,lastSeenAt:at.optional(),createdAt:at,updatedAt:at}).strict().superRefine((e,t)=>{"control-plane-proxy"===e.connectionPath.kind&&"control-plane-proxy"!==e.connectionMode&&t.addIssue({code:"custom",path:["connectionPath"],message:"Control-plane proxy paths require control-plane-proxy connection mode."}),"control-plane-proxy"===e.connectionMode&&"control-plane-proxy"!==e.connectionPath.kind&&t.addIssue({code:"custom",path:["connectionPath"],message:"Control-plane proxy nodes require a control-plane-proxy connection path."})}),Bn=m.z.object({id:st,nodeId:st,name:m.z.string().trim().min(1).max(160),type:m.z.enum(["docker","kubernetes","local"]),status:m.z.enum(["unknown","online","offline","degraded"]).default("unknown"),accessStrategy:m.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).default("node-proxy"),capabilities:m.z.record(m.z.string(),m.z.unknown()).default({}),labels:ct,createdAt:at,updatedAt:at}).strict(),Kn=m.z.object({instanceId:st,runtimeKind:m.z.literal("docker"),state:m.z.enum(["pending","available","stopped","unavailable"]),sampledAt:at,cpu:m.z.object({usagePercent:m.z.number().nonnegative()}).strict().optional(),memory:m.z.object({usageBytes:m.z.number().nonnegative(),limitBytes:m.z.number().nonnegative().optional(),usagePercent:m.z.number().nonnegative().optional()}).strict().optional(),network:m.z.object({rxBytes:m.z.number().nonnegative(),txBytes:m.z.number().nonnegative()}).strict().optional(),blockIo:m.z.object({readBytes:m.z.number().nonnegative(),writeBytes:m.z.number().nonnegative()}).strict().optional(),pids:m.z.number().int().nonnegative().optional(),error:m.z.string().trim().max(2048).optional()}).strict();m.z.object({ok:m.z.boolean().optional(),role:m.z.string().optional(),nodeId:st.optional(),platform:kt.optional()}).passthrough();const Gn=m.z.object({bindScope:m.z.enum(["loopback","all-ipv4"]),port:m.z.number().int().min(1).max(65535)}).strict(),Jn=Gn.extend({host:m.z.enum(["127.0.0.1","0.0.0.0"]),status:m.z.enum(["listening","error"]),source:m.z.enum(["bootstrap","persisted"]),error:m.z.string().trim().max(2048).optional()}).strict(),Wn=Gn;m.z.object({nodeId:st,joinToken:m.z.string().trim().min(1),expiresAt:at}).passthrough();const Yn=m.z.object({id:st,keyId:st,name:m.z.string().trim().min(1).max(160).optional(),pairedAt:at,updatedAt:at,current:m.z.boolean()}).passthrough();m.z.object({id:st,pairingKeyId:st,url:m.z.string().trim().min(1).max(2048),name:m.z.string().trim().min(1).max(160).optional(),enabled:m.z.boolean(),createdAt:at,updatedAt:at,status:m.z.enum(["disabled","connecting","connected","reconnecting","failed"]),lastConnectedAt:at.optional(),lastDisconnectedAt:at.optional(),error:m.z.string().optional()}).passthrough(),m.z.object({pairing:Yn,connection:m.z.object({id:st,pairingKeyId:st,url:m.z.string().trim().min(1).max(2048),name:m.z.string().trim().min(1).max(160).optional(),enabled:m.z.boolean(),createdAt:at,updatedAt:at}).passthrough(),tunnel:m.z.object({status:m.z.enum(["disabled","saved","connecting","connected","failed"]),error:m.z.string().trim().max(2048).optional()}).passthrough()}).passthrough(),m.z.object({deleted:m.z.boolean().optional()}).passthrough();const Xn=m.z.object({repository:m.z.string().trim().optional(),tag:m.z.string().trim().optional(),id:m.z.string().trim(),createdSince:m.z.string().trim().optional(),size:m.z.string().trim().optional(),sizeBytes:m.z.number().int().nonnegative().optional(),reference:m.z.string().trim().min(1),repoDigests:m.z.array(m.z.string().trim().min(1).max(512)).default([])}).passthrough();m.z.object({image:Dn,status:m.z.enum(["available","pull-required","unknown"]),localImage:Xn.optional(),localSizeBytes:m.z.number().int().nonnegative().optional(),downloadSizeBytes:m.z.number().int().positive().optional(),unpackedSizeBytes:m.z.number().int().positive().optional(),error:m.z.string().trim().max(2048).optional()}).strict();const Qn=m.z.lazy(()=>m.z.object({name:m.z.string().trim().min(1),path:m.z.string().trim().min(1).max(4096),children:m.z.array(Qn)}).passthrough());m.z.object({status:m.z.number().int().min(100).max(599).optional(),headers:m.z.record(m.z.string(),m.z.string()).optional(),bodyBase64:m.z.string().optional()}).passthrough();const Zn=m.z.object({strategy:m.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).default("node-proxy"),web:m.z.string().trim().max(2048).optional(),api:m.z.string().trim().max(2048).optional(),vnc:m.z.string().trim().max(2048).optional(),tty:m.z.string().trim().max(2048).optional(),logs:m.z.string().trim().max(2048).optional(),status:m.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown")}).strict(),er=m.z.object({strategy:m.z.enum(["control-plane-proxy","direct-port","node-proxy","kubernetes-ingress","kubernetes-port-forward"]).default("control-plane-proxy"),web:m.z.string().trim().max(2048).optional(),api:m.z.string().trim().max(2048).optional(),ws:m.z.string().trim().max(2048).optional(),status:m.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown")}).strict().default({strategy:"control-plane-proxy",status:"unknown"}),tr=m.z.object({mode:m.z.enum(["local-bind","git-clone","empty-volume","persistent-volume"]).optional(),status:m.z.enum(["unknown","pending","ready","failed"]).default("unknown"),path:m.z.string().trim().max(4096).optional(),resolvedCommit:m.z.string().trim().max(120).optional(),error:m.z.string().trim().max(2048).optional()}).passthrough(),nr=m.z.object({id:st,name:m.z.string().trim().min(1).max(160),projectId:st.optional(),source:an,sourceSnapshot:m.z.record(m.z.string(),m.z.unknown()).default({}),modelSelection:wt,nodeId:st,runtimeId:st,imageSelection:Nt.optional(),imageSnapshot:Pn.optional(),imageProvisioning:jn.optional(),stateRevision:m.z.number().int().min(0).default(0),processIncarnationId:m.z.string().trim().min(1).max(120).optional(),status:m.z.enum(["created","provisioning","starting","registering","registered","running","stopping","stopped","failed","unhealthy"]).default("created"),health:m.z.enum(["unknown","ok","degraded","failed"]).default("unknown"),connectionStatus:m.z.enum(["unknown","online","offline","endpoint-unreachable"]).default("unknown"),agentStatus:m.z.enum(["unknown","online","offline"]).default("unknown"),targetStatus:m.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown"),uiAccessStatus:m.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown"),controlMode:m.z.enum(["standalone","controlled"]).default("controlled"),protocolVersion:ot.optional(),instanceVersion:m.z.string().trim().max(80).optional(),build:Bt.optional(),runtimeVersion:Wt.optional(),ready:m.z.boolean().default(!1),capabilities:m.z.record(m.z.string(),m.z.unknown()).default({}),appInventory:Tt.optional(),config:m.z.object({autoImportAgentConfigs:m.z.boolean().default(!0),defaultCodexPermissionMode:se.default("ask")}).strict().default({autoImportAgentConfigs:!0,defaultCodexPermissionMode:"ask"}),workspace:tr.default({status:"unknown"}),target:Zn.default({strategy:"direct-port",status:"unknown"}),access:er,apps:m.z.object({runningCount:m.z.number().int().min(0).default(0),problemCount:m.z.number().int().min(0).default(0),updatedAt:at.optional(),revision:m.z.number().int().min(0).optional()}).strict().default({runningCount:0,problemCount:0}),aiSessions:ve.default(()=>({runningCount:0,waitingCount:0,staleCount:0,sessions:[],updatedAt:(new Date).toISOString()})),triggers:m.z.object({enabledCount:m.z.number().int().min(0).default(0),runningCount:m.z.number().int().min(0).default(0),errorCount:m.z.number().int().min(0).default(0),configs:m.z.array(m.z.object({configHash:m.z.string().trim().min(1),config:Me,deployments:m.z.array($e).default([]),runtime:m.z.array(Fe).default([])}).strict()).default([]),recentRuns:m.z.array(Ue).default([])}).strict().optional(),runtime:m.z.object({kind:m.z.string().trim().max(80).optional(),containerName:m.z.string().trim().max(240).optional(),containerId:m.z.string().trim().max(240).optional(),workspacePath:m.z.string().trim().max(4096).optional(),pid:m.z.number().int().positive().optional(),port:m.z.number().int().positive().max(65535).optional(),labels:m.z.record(m.z.string(),m.z.string()).default({})}).strict().default({labels:{}}),registrationToken:m.z.string().trim().min(1).max(240).optional(),lastHeartbeatAt:at.optional(),createdAt:at,updatedAt:at}).strict(),rr="instance.lifecycle.snapshot",ir=m.z.object({instanceId:nr.shape.id,revision:m.z.number().int().min(0),updatedAt:at,status:nr.shape.status.unwrap(),health:nr.shape.health.unwrap(),connectionStatus:nr.shape.connectionStatus.unwrap(),accessStatus:m.z.enum(["reachable","endpoint-unreachable"]),imageProvisioning:jn.optional(),workspace:tr,runtime:nr.shape.runtime.unwrap(),runtimeVersion:Wt.optional(),ready:m.z.boolean(),lastHeartbeatAt:at.optional()}).strict();function or(e,t){return nr.safeParse(sr(e,t))}function sr(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,r=new Set(Object.keys(nr.shape)),i={};for(const[e,o]of Object.entries(n))r.has(e)?i[e]=o:t?.({instanceId:"string"==typeof n.id?n.id:void 0,field:e});if(n.capabilities&&"object"==typeof n.capabilities&&!Array.isArray(n.capabilities)){const e={...n.capabilities};Object.prototype.hasOwnProperty.call(e,"apps")&&(t?.({instanceId:"string"==typeof n.id?n.id:void 0,field:"capabilities.apps"}),delete e.apps),i.capabilities=e}else i.capabilities={};i.appInventory=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return;const r=e;Object.keys(r).some(e=>!["observedAt","items","issues"].includes(e))&&t?.({instanceId:n,field:"appInventory"});const i={observedAt:r.observedAt,items:Array.isArray(r.items)?r.items.map(e=>{e&&"object"==typeof e&&!Array.isArray(e)&&Object.keys(e).some(e=>!["id","name","kind","source","availability","capabilities","diagnosticCode"].includes(e))&&t?.({instanceId:n,field:"appInventory.items"});const r=dr(e,["id","name","kind","source","availability","diagnosticCode"]);return!r||"object"!=typeof r||Array.isArray(r)?r:{...r,capabilities:dr(e.capabilities,["automation","supportsCwdSelection"])}}):r.items,issues:Array.isArray(r.issues)?r.issues.map(e=>dr(e,["code","message"])):r.issues},o=Tt.safeParse(i);return o.success?o.data:void 0}(n.appInventory,t,"string"==typeof n.id?n.id:void 0),i.source=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return e;const r=e,i=r.type,o=an.options.find(e=>e.shape.type.value===i);if(!o)return e;const s="local-folder"===i?["type","localFolderId","path","ownerNodeId"]:"git-template"===i?["type","url","templateId","ref","auth","clone"]:["type","repositoryId","url","provider","ref","auth","clone"],a=dr(r,s);if("local-folder"!==i){const e=ar(nn,dr(r.ref,["type","name","commit"]),"source.ref",t,n),i=ar(rn,dr(r.auth,["type","secretId"]),"source.auth",t,n),o=ar(on,dr(r.clone,["depth","submodules","lfs","subdirectory"]),"source.clone",t,n);e?a.ref=e:delete a.ref,i?a.auth=i:delete a.auth,o?a.clone=o:delete a.clone}const c=ar(o,a,"source",t,n);return c?(Object.keys(r).some(e=>!s.includes(e))&&t?.({instanceId:n,field:"source"}),c):a}(n.source,t,"string"==typeof n.id?n.id:void 0),i.sourceSnapshot=n.sourceSnapshot&&"object"==typeof n.sourceSnapshot&&!Array.isArray(n.sourceSnapshot)?n.sourceSnapshot:{},i.build=ar(Bt,n.build,"build",t,"string"==typeof n.id?n.id:void 0),i.aiSessions=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return;const r=e,i=Array.isArray(r.sessions)?r.sessions.flatMap((e,r)=>{const i=ar(ze,e,`aiSessions.sessions.${r}`,t,n);return i?[i]:[]}):[],o={runningCount:"number"==typeof r.runningCount&&Number.isInteger(r.runningCount)&&r.runningCount>=0?r.runningCount:0,waitingCount:"number"==typeof r.waitingCount&&Number.isInteger(r.waitingCount)&&r.waitingCount>=0?r.waitingCount:0,staleCount:"number"==typeof r.staleCount&&Number.isInteger(r.staleCount)&&r.staleCount>=0?r.staleCount:0,sessions:i,updatedAt:at.safeParse(r.updatedAt).success?r.updatedAt:(new Date).toISOString()};return Object.keys(r).some(e=>!["runningCount","waitingCount","staleCount","sessions","updatedAt"].includes(e))&&t?.({instanceId:n,field:"aiSessions"}),ve.parse(o)}(n.aiSessions,t,"string"==typeof n.id?n.id:void 0),i.triggers=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return;const r=e;Object.keys(r).some(e=>!["enabledCount","runningCount","errorCount","configs","recentRuns"].includes(e))&&t?.({instanceId:n,field:"triggers"});const i=(e,r,i)=>Array.isArray(e)?e.flatMap((e,o)=>{const s=ar(r,e,`${i}.${o}`,t,n);return s?[s]:[]}):[],o=Array.isArray(r.configs)?r.configs.flatMap((e,r)=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const o=e;Object.keys(o).some(e=>!["configHash","config","deployments","runtime"].includes(e))&&t?.({instanceId:n,field:`triggers.configs.${r}`});const s=function(e,t,n,r){if(!e||"object"!=typeof e||Array.isArray(e))return;const i=e,o=dr(i,["configHash","name","description","createdAt","updatedAt"]);if(i.source&&"object"==typeof i.source&&!Array.isArray(i.source)){const e=i.source,t="schedule"===e.type?"interval"===e.scheduleKind?["type","scheduleKind","intervalMs"]:"daily"===e.scheduleKind?["type","scheduleKind","timeOfDay","timezone"]:["type","scheduleKind","weekdays","timeOfDay","timezone"]:"file-change"===e.type?["type","roots","globs","ignore","debounceMs"]:["type","agent","statuses","phases"];o.source=dr(e,t)}return o.action=dr(i.action,["promptTemplate"]),o.policy=dr(i.policy,["cooldownMs","maxConcurrentRuns","whenBusy"]),ar(Me,o,t,n,r)}(o.config,`triggers.configs.${r}.config`,t,n);return"string"==typeof o.configHash&&s?[{configHash:o.configHash,config:s,deployments:i(o.deployments,$e,`triggers.configs.${r}.deployments`),runtime:i(o.runtime,Fe,`triggers.configs.${r}.runtime`)}]:[]}):[];return{enabledCount:"number"==typeof r.enabledCount&&Number.isInteger(r.enabledCount)&&r.enabledCount>=0?r.enabledCount:0,runningCount:"number"==typeof r.runningCount&&Number.isInteger(r.runningCount)&&r.runningCount>=0?r.runningCount:0,errorCount:"number"==typeof r.errorCount&&Number.isInteger(r.errorCount)&&r.errorCount>=0?r.errorCount:0,configs:o,recentRuns:i(r.recentRuns,Ue,"triggers.recentRuns")}}(n.triggers,t,"string"==typeof n.id?n.id:void 0),i.apps=ar(nr.shape.apps.unwrap(),dr(n.apps,["runningCount","problemCount","updatedAt","revision"]),"apps",t,"string"==typeof n.id?n.id:void 0)||{runningCount:0,problemCount:0},i.config=ar(nr.shape.config.unwrap(),dr(n.config,["autoImportAgentConfigs","defaultCodexPermissionMode"]),"config",t,"string"==typeof n.id?n.id:void 0)||{autoImportAgentConfigs:!0,defaultCodexPermissionMode:"ask"},i.modelSelection=ar(wt.unwrap(),dr(n.modelSelection,["codexModelHash","claudeModelHash"]),"modelSelection",t,"string"==typeof n.id?n.id:void 0)||{},i.imageSnapshot=function(e,t,n,r){if(!e||"object"!=typeof e||Array.isArray(e))return e;const i=e,o=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n=new Set(["id","origin","name","description","localizedDescriptions","cover","reference","repository","tag","image","registry","pullPolicy","capabilities","optionalApps","defaultEnv","labels","createdAt","updatedAt"]);for(const e of Object.keys(t))n.has(e);"string"==typeof t.id&&t.id;const r="string"==typeof t.image?t.image:void 0;Object.prototype.hasOwnProperty.call(t,"registry");let i,o="string"==typeof t.reference?t.reference:r;if(o)try{o=yt(o)}catch{if(!o.includes("@")&&o.lastIndexOf(":")<=o.lastIndexOf("/"))try{o=yt(`${o}:latest`)}catch{}}try{i=o?It(o):void 0}catch{}return{id:t.id,origin:"custom",name:t.name,description:t.description,localizedDescriptions:t.localizedDescriptions,cover:dr(t.cover,["kind","key","url","mediaType","digest"]),reference:i?.reference??o,repository:i?.repository??t.repository,tag:i?.tag??t.tag,pullPolicy:t.pullPolicy??"if-not-present",capabilities:t.capabilities,optionalApps:t.optionalApps,defaultEnv:t.defaultEnv,labels:t.labels,createdAt:t.createdAt,updatedAt:t.updatedAt}}(i),{reference:s,...a}=o,c=i.requestedReference??s;let d;try{d="string"==typeof c?It(c):void 0}catch{}const l={img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"},u="string"==typeof i.id?i.id:"string"==typeof t?t:void 0,m="market"===i.origin||u&&l[u]?"market":"custom";return void 0===i.image&&void 0===i.reference||n?.({instanceId:r,field:"imageSnapshot.reference"}),{...a,id:u&&l[u]?l[u]:u,origin:m,repository:d?.repository??i.repository,tag:d?.tag??i.tag,requestedReference:d?.reference??c,resolvedDigest:i.resolvedDigest,resolvedReference:i.resolvedReference,downloadSizeBytes:i.downloadSizeBytes,market:"market"===m?dr(i.market,["catalogId","catalogRevision","publisher","version"])??{catalogId:"task_handoff_embedded",catalogRevision:"legacy",publisher:"task-handoff"}:void 0}}(n.imageSnapshot,n.imageId,t,"string"==typeof n.id?n.id:void 0);const o="string"==typeof n.imageId?{img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"}[n.imageId]||n.imageId:void 0,s=dr(n.imageSelection,["imageId","tag"]);i.imageSelection=s||(o?{imageId:o,tag:i.imageSnapshot?.tag}:void 0),i.imageProvisioning=ar(jn,dr(n.imageProvisioning,["phase","requestedReference","generation","error","startedAt","updatedAt"]),"imageProvisioning",t,"string"==typeof n.id?n.id:void 0),i.runtimeVersion=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return;const r=e,i=e=>{if("string"!=typeof e)return;const t=e.trim();return t&&t.length<=80?t:void 0},o=i(r.desiredVersion);if(!o)return void t?.({instanceId:n,field:"runtimeVersion.desiredVersion"});const s=new Set(Wt.shape.phase.options),a="string"==typeof r.phase?r.phase:"pending",c=s.has(a)?a:{idle:"pending",queued:"pending",checking:"pending",downloading:"installing",updating:"installing",completed:"matched",succeeded:"matched",ready:"matched",error:"failed"}[a]||"pending";let d;if(c!==a&&t?.({instanceId:n,field:"runtimeVersion.phase"}),r.error&&"object"==typeof r.error&&!Array.isArray(r.error)){const e=r.error,o="string"==typeof e.message?e.message.trim().slice(0,4096):"";if(o){const r=new Set(Jt.shape.code.options),s="string"==typeof e.code&&r.has(e.code)?e.code:"INSTANCE_RUNTIME_INSTALL_FAILED";s!==e.code&&t?.({instanceId:n,field:"runtimeVersion.error.code"});const a=i(e.expectedVersion),c=i(e.actualVersion);d={code:s,message:o,...a?{expectedVersion:a}:{},...c?{actualVersion:c}:{},retryable:!0===e.retryable}}else t?.({instanceId:n,field:"runtimeVersion.error"})}"string"==typeof r.error&&r.error.trim()&&(d={code:"INSTANCE_RUNTIME_INSTALL_FAILED",message:r.error.trim().slice(0,4096),expectedVersion:o,...i(r.actualVersion)?{actualVersion:i(r.actualVersion)}:{},retryable:!1});const l=i(r.actualVersion),u=at.safeParse(r.lastAttemptAt),m=at.safeParse(r.matchedAt);return void 0===r.lastAttemptAt||u.success||t?.({instanceId:n,field:"runtimeVersion.lastAttemptAt"}),void 0===r.matchedAt||m.success||t?.({instanceId:n,field:"runtimeVersion.matchedAt"}),{desiredVersion:o,...l?{actualVersion:l}:{},phase:c,attempt:"number"==typeof r.attempt&&Number.isInteger(r.attempt)&&r.attempt>=0?r.attempt:0,...u.success?{lastAttemptAt:u.data}:{},...m.success?{matchedAt:m.data}:{},...d?{error:d}:{}}}(n.runtimeVersion,t,"string"==typeof n.id?n.id:void 0),i.workspace=ar(tr,n.workspace,"workspace",t,"string"==typeof n.id?n.id:void 0)||{status:"unknown"},i.runtime=ar(nr.shape.runtime.unwrap(),dr(n.runtime,["kind","containerName","containerId","workspacePath","pid","port","labels"]),"runtime",t,"string"==typeof n.id?n.id:void 0)||{labels:{}},i.target=ar(Zn,dr(n.target??n.endpoints,["strategy","web","api","vnc","tty","logs","status"]),"target",t,"string"==typeof n.id?n.id:void 0)||{strategy:"direct-port",status:"unknown"},i.access=ar(er,dr(n.access,["strategy","web","api","ws","status"]),"access",t,"string"==typeof n.id?n.id:void 0)||{strategy:"control-plane-proxy",status:"unknown"};for(const[e,r]of Object.entries(nr.shape))Object.prototype.hasOwnProperty.call(i,e)&&!r.safeParse(i[e]).success&&r.safeParse(void 0).success&&(delete i[e],t?.({instanceId:"string"==typeof n.id?n.id:void 0,field:e}));return i}function ar(e,t,n,r,i){if(!t||"object"!=typeof t||Array.isArray(t))return;let o=structuredClone(t),s=!1;for(let t=0;t<20;t+=1){const t=e.safeParse(o);if(t.success)return s&&r?.({instanceId:i,field:n}),t.data;let a=!1;for(const e of t.error.issues){if("unrecognized_keys"!==e.code)continue;const t=cr(o,e.path);if(t&&"object"==typeof t&&!Array.isArray(t))for(const n of e.keys)Object.prototype.hasOwnProperty.call(t,n)&&(delete t[n],a=!0,s=!0)}if(!a){const s=structuredClone(o);let a=!1;for(const e of t.error.issues){if(!e.path.length||"string"!=typeof e.path.at(-1))continue;const t=cr(s,e.path.slice(0,-1)),n=e.path.at(-1);t&&"object"==typeof t&&!Array.isArray(t)&&Object.prototype.hasOwnProperty.call(t,n)&&(delete t[n],a=!0)}if(a){const t=e.safeParse(s);if(t.success)return r?.({instanceId:i,field:n}),t.data}break}}r?.({instanceId:i,field:n})}function cr(e,t){let n=e;for(const e of t){if(!n||"object"!=typeof n)return;n=n[e]}return n}function dr(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e;return Object.fromEntries(t.filter(e=>Object.prototype.hasOwnProperty.call(n,e)).map(e=>[e,n[e]]))}const lr=m.z.object({instanceId:st.optional(),projectId:st.optional(),source:an.optional(),nodeId:st.optional(),runtimeId:st.optional(),imageSelection:Nt.optional(),instanceVersion:m.z.string().trim().max(80).optional(),protocolVersion:ot,build:Bt.optional(),controlMode:m.z.enum(["standalone","controlled"]).default("controlled"),capabilities:m.z.record(m.z.string(),m.z.unknown()).default({}),appInventory:Tt.optional(),target:Zn.default({strategy:"direct-port",status:"unknown"}),workspace:tr.default({status:"unknown"}),registrationToken:m.z.string().trim().max(240).optional(),processIncarnationId:m.z.string().trim().min(1).max(120).optional()}).strict().superRefine((e,t)=>{e.protocolVersion!==it||e.appInventory||t.addIssue({code:"custom",path:["appInventory"],message:"Current protocol register payload requires appInventory."})}),ur=m.z.object({status:nr.shape.status.optional(),health:nr.shape.health.optional(),protocolVersion:ot,build:Bt.optional(),capabilities:nr.shape.capabilities.optional(),appInventory:Tt.optional(),apps:nr.shape.apps.optional(),aiSessions:nr.shape.aiSessions.optional(),triggers:nr.shape.triggers.optional(),workspace:tr.optional(),target:Zn.partial().optional(),processIncarnationId:m.z.string().trim().min(1).max(120).optional()}).strict().superRefine((e,t)=>{e.protocolVersion!==it||e.appInventory||t.addIssue({code:"custom",path:["appInventory"],message:"Current protocol heartbeat payload requires appInventory."})}),mr=m.z.enum(["web","telegram","wechat","dingding"]);function pr(e,t,n={}){return new Promise((r,i)=>{const o=a.spawn(e,t,{stdio:["ignore","pipe","pipe"]}),s=[],c=[];let d=!1;const l=n.timeoutMs?setTimeout(()=>{d=!0,o.kill("SIGKILL")},n.timeoutMs):void 0;l?.unref?.(),o.stdout.on("data",e=>s.push(Buffer.from(e))),o.stderr.on("data",e=>c.push(Buffer.from(e))),o.on("error",e=>{l&&clearTimeout(l),i(e)}),o.on("close",t=>{l&&clearTimeout(l);const o={stdout:Buffer.concat(s).toString("utf8").trim(),stderr:Buffer.concat(c).toString("utf8").trim()};if(d){const t=new Error(`${e} timed out after ${n.timeoutMs}ms`);return Object.assign(t,{statusCode:504,code:"RUNTIME_COMMAND_TIMEOUT",details:o}),void i(t)}if(0===t)return void r(o);const a=new Error(o.stderr||`${e} exited with code ${t}`);Object.assign(a,{statusCode:502,code:"RUNTIME_EXECUTOR_FAILED",details:o}),i(a)})})}m.z.object({id:st,channel:mr,name:m.z.string().trim().min(1).max(160),enabled:m.z.boolean().default(!1),token:m.z.string().trim().max(4096).optional(),defaultChatId:m.z.string().trim().max(240).optional(),allowedUserIds:m.z.array(m.z.string().trim().min(1).max(240)).default([]),pollIntervalMs:m.z.number().int().positive().max(6e4).default(3e3),settings:m.z.record(m.z.string(),m.z.unknown()).default({}),createdAt:at,updatedAt:at}).strict(),m.z.object({id:st,channel:mr,bridgeId:st.optional(),chatSessionId:m.z.string().trim().min(1).max(240),userId:m.z.string().trim().max(240).optional(),activeProjectId:st.optional(),activeInstanceId:st.optional(),activeAiSessionId:m.z.string().trim().min(1).max(120).optional(),lastUsedAt:at,createdAt:at,updatedAt:at}).strict(),m.z.object({source:m.z.object({type:m.z.literal("chat-gateway").default("chat-gateway"),channel:mr,bridgeId:st.optional(),chatSessionId:m.z.string().trim().min(1).max(240),userId:m.z.string().trim().max(240).optional()}).strict(),message:m.z.object({text:m.z.string().trim().max(2e4).default(""),attachments:m.z.array(ne).max(6).default([])}).strict().superRefine((e,t)=>{e.attachments.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>H&&t.addIssue({code:m.z.ZodIssueCode.custom,path:["attachments"],message:"Inline attachments must be 41943040 bytes or less in total."})}),target:m.z.object({instanceId:st,aiSessionId:m.z.string().trim().min(1).max(120)}).strict().optional()}).strict(),m.z.object({id:st,instanceId:st,projectId:st.optional(),aiSessionId:m.z.string().trim().min(1).max(120),providerSessionId:m.z.string().trim().max(240).optional(),result:m.z.string().default(""),timeoutMs:m.z.number().positive().optional(),source:m.z.string().trim().max(120).optional(),kind:m.z.enum(["task","approval"]).default("task"),status:m.z.enum(["pending","unreachable"]).default("pending"),error:m.z.string().trim().max(2048).optional(),lastSeenAt:at}).strict();const gr=(e,t,n={})=>new Promise((r,i)=>{const o=[];let s,a=!1;try{s=g.spawn(e,t,{name:"xterm-256color",cols:n.cols||120,rows:n.rows||40,cwd:process.cwd(),env:process.env})}catch(e){return void i(e)}const c=n.timeoutMs?setTimeout(()=>{a=!0,s.kill("SIGKILL")},n.timeoutMs):void 0;c?.unref?.(),s.onData(e=>{o.push(e),n.onData?.(e)}),s.onExit(({exitCode:t})=>{c&&clearTimeout(c);const s={stdout:o.join(""),stderr:""};a?i(Object.assign(new Error(`${e} timed out after ${n.timeoutMs}ms`),{statusCode:504,code:"RUNTIME_COMMAND_TIMEOUT",details:s})):0!==t?i(Object.assign(new Error(s.stdout.replace(/\u001b\[[0-?]*[ -/]*[@-~]/g,"").split(/\r?\n/).map(e=>e.trim()).filter(Boolean).at(-1)||`${e} exited with code ${t}`),{statusCode:502,code:"RUNTIME_EXECUTOR_FAILED",details:s})):r(s)})});class hr{inFlight=new Map;runCommand;runTerminalCommand;constructor(e=pr,t){this.runCommand=e,this.runTerminalCommand=t||function(e){return e===pr?gr:async(t,n,r={})=>{const i=await e(t,n,{timeoutMs:r.timeoutMs});return i.stdout&&r.onData?.(i.stdout),i.stderr&&r.onData?.(i.stderr),i}}(e)}ensure(e,t,n){const r=yt(e),i=this.inFlight.get(r);if(i)return t&&(i.phaseListeners.add(t),i.phase&&t(i.phase)),n&&(i.terminalListeners.add(n),i.terminalTail&&n({sequence:i.terminalSequence,data:i.terminalTail,replay:!0})),i.promise;const o=new Set,s=new Set;t&&o.add(t),n&&s.add(n);const a={promise:Promise.resolve(void 0),phaseListeners:o,terminalListeners:s,terminalSequence:0,terminalTail:""};return a.promise=this.ensureOnce(r,e=>{a.phase=e,o.forEach(t=>t(e))},e=>{a.terminalSequence+=1,a.terminalTail=`${a.terminalTail}${e}`.slice(-262144);const t={sequence:a.terminalSequence,data:e};s.forEach(e=>e(t))}).finally(()=>this.inFlight.delete(r)),this.inFlight.set(r,a),a.promise}async ensureOnce(e,t,n){t("checking-image");let r=await this.inspect(e).catch(()=>{}),i=!1;r||(t("pulling-image"),await this.runTerminalCommand("docker",["pull",e],{cols:120,rows:40,onData:n}),i=!0,r=await this.inspect(e)),t("resolving-image");const o=(s=r,Array.isArray(s.RepoDigests)?s.RepoDigests.filter(e=>"string"==typeof e):[]).find(e=>/@sha256:[a-fA-F0-9]{64}$/.test(e));var s;const a=o?.split("@").at(-1)?.toLowerCase();return{requestedReference:e,...a?{resolvedDigest:a}:{},resolvedReference:o||e,pulled:i}}async inspect(e){const t=await this.runCommand("docker",["image","inspect",e,"--format","{{json .}}"]);return JSON.parse(t.stdout.trim()||"{}")}}function fr(e){if(!e)return;const t=/^([0-9]+(?:\.[0-9]+)?)\s*(B|kB|MB|GB|TB)$/i.exec(e.trim());if(!t)return;const n=Number(t[1])*{b:1,kb:1e3,mb:1e6,gb:1e9,tb:1e12}[t[2].toLowerCase()];return Number.isSafeInteger(Math.round(n))?Math.round(n):void 0}class yr{runCommand;publishHost;images;launcherAssetsDir;portResolutionRetryDelaysMs;constructor(e=pr,r={}){this.runCommand=e,this.images=r.imageService||new hr(e),this.publishHost=r.publishHost||"127.0.0.1",this.launcherAssetsDir=r.launcherAssetsDir||function(){const e=("undefined"==typeof document?require("url").pathToFileURL(__filename).href:b&&"SCRIPT"===b.tagName.toUpperCase()&&b.src||new URL("cli.js",document.baseURI).href)?n.dirname(s.fileURLToPath("undefined"==typeof document?require("url").pathToFileURL(__filename).href:b&&"SCRIPT"===b.tagName.toUpperCase()&&b.src||new URL("cli.js",document.baseURI).href)):__dirname,r=[n.resolve(e,"../../../../../docker"),n.resolve(e,"../docker"),n.resolve(e,"../../docker")];return r.find(e=>t.existsSync(n.join(e,"runtime-installer.mjs")))||r[0]}(),this.portResolutionRetryDelaysMs=r.portResolutionRetryDelaysMs?.length?r.portResolutionRetryDelaysMs:[0,100,250,500,1e3]}async start(e){Tr(e);const t=e.instance.runtime.containerName||Sr(e.instance.id),n=await this.inspectContainerForStart(t);if(n){vr(t,n.id,e.instance.runtime.containerId,"before start","RUNTIME_EXECUTOR_FAILED");const r=n.labels["task-handoff.instance-id"];if(r!==e.instance.id)throw wr("RUNTIME_EXECUTOR_FAILED",`Docker container ${t} belongs to ${r||"an unknown instance"}, not ${e.instance.id}.`);try{await this.runCommand("docker",["start",t])}catch(e){throw wr("RUNTIME_EXECUTOR_FAILED",`Could not start Docker container ${t}.`,e)}return this.runningResult(e,t,n.id)}let r;await this.images.ensure(e.image.resolvedReference||e.image.requestedReference);try{r=await this.runCommand("docker",function(e,t,n={}){const r=n.publishHost||"127.0.0.1",i=e.node?.id||"node_unset",o=e.runtime?.id||"runtime_local_docker",s=["run","-d","--name",t,"--label",`task-handoff.instance-id=${e.instance.id}`,"--label",`task-handoff.project-id=${e.project.id}`,"--label",`task-handoff.node-id=${i}`,"--label",`task-handoff.runtime-id=${o}`,"--label",`task-handoff.image-id=${e.image.id}`,"--shm-size","1gb","--security-opt","seccomp=unconfined","--network","bridge","--add-host","host.docker.internal:host-gateway","--tmpfs","/tmp:rw,mode=1777","-v",`${t}-data:/data`,"-v",`${t}-agent-home:/home/agent`,"-p",`${r}::8080`],a={TASK_HANDOFF_CONTROL_MODE:"controlled",TASK_HANDOFF_NODE_AGENT_URL:e.nodeAgentUrl||e.node?.endpoint||"",TASK_HANDOFF_INSTANCE_ID:e.instance.id,TASK_HANDOFF_INSTANCE_NAME:e.instance.name,TASK_HANDOFF_REGISTRATION_TOKEN:e.instance.registrationToken||"",TASK_HANDOFF_PROJECT_ID:e.project.id,TASK_HANDOFF_NODE_ID:i,TASK_HANDOFF_RUNTIME_ID:o,TASK_HANDOFF_IMAGE_ID:e.image.id,...e.image.tag?{TASK_HANDOFF_IMAGE_TAG:e.image.tag}:{},TASK_HANDOFF_CHAT_BRIDGES:"none",TASK_HANDOFF_WORKSPACE:e.project.workspacePolicy.path||"/workspace",TASK_HANDOFF_WORKSPACE_MODE:e.project.workspacePolicy.mode};for(const[e,t]of Object.entries(a))_r(s,e,t);"local-folder"===e.project.source.type?s.push("-v",`${e.project.source.path}:${e.project.workspacePolicy.path||"/workspace"}:${e.project.workspacePolicy.readOnly?"ro":"rw"}`):(_r(s,"TASK_HANDOFF_PROJECT_SOURCE",JSON.stringify(e.project.source)),_r(s,"TASK_HANDOFF_WORKSPACE_POLICY",JSON.stringify(e.project.workspacePolicy)),_r(s,"TASK_HANDOFF_GIT_URL",e.project.source.url),e.project.source.ref?.commit?_r(s,"TASK_HANDOFF_GIT_COMMIT",e.project.source.ref.commit):e.project.source.ref?.name&&_r(s,"TASK_HANDOFF_GIT_REF",e.project.source.ref.name),e.project.source.clone?.depth&&_r(s,"TASK_HANDOFF_GIT_DEPTH",String(e.project.source.clone.depth)),_r(s,"TASK_HANDOFF_GIT_SUBMODULES",e.project.source.clone?.submodules?"true":"false"),_r(s,"TASK_HANDOFF_GIT_LFS",e.project.source.clone?.lfs?"true":"false"),e.project.source.clone?.subdirectory&&_r(s,"TASK_HANDOFF_WORKSPACE_SUBDIRECTORY",e.project.source.clone.subdirectory));for(const[t,n]of Object.entries(e.image.defaultEnv))_r(s,t,n);for(const[t,n]of Object.entries(e.modelEnv||{}))_r(s,t,n);return s.push(e.image.resolvedReference||e.image.requestedReference),s}(e,t,{publishHost:this.publishHost}))}catch(e){throw wr("RUNTIME_EXECUTOR_FAILED",`Could not create Docker container ${t}.`,e)}return this.runningResult(e,t,r.stdout||void 0)}async runningResult(e,t,n){const r=await this.containerPort(t,"8080/tcp"),i=r?`http://127.0.0.1:${r}`:void 0,o=e.node?.id||"node_unset",s=e.runtime?.id||"runtime_local_docker";return{status:"registering",health:"unknown",connectionStatus:i?"online":"unknown",agentStatus:"unknown",targetStatus:"unknown",uiAccessStatus:"unknown",target:{strategy:"direct-port",status:i?"reachable":"unknown",...i?{web:i,api:`${i}/api`}:{}},workspace:{mode:e.project.workspacePolicy.mode,status:"pending",path:e.project.workspacePolicy.path},runtime:{...e.instance.runtime,kind:"docker",containerName:t,...n?{containerId:n}:{},labels:{...e.instance.runtime.labels,"task-handoff.instance-id":e.instance.id,"task-handoff.project-id":e.project.id,"task-handoff.node-id":o,"task-handoff.runtime-id":s,"task-handoff.image-id":e.image.id}}}}async stop(e){const t=e.instance.runtime.containerName||Sr(e.instance.id);try{await this.runCommand("docker",["stop",t])}catch(e){if(!zr(e))throw wr("RUNTIME_EXECUTOR_FAILED",`Could not stop Docker container ${t}.`,e)}return{status:"stopped",health:"unknown",connectionStatus:"offline",target:{...e.instance.target,status:"unknown"},runtime:e.instance.runtime}}async restart(e,t){Tr(e);const n=e.instance.runtime.containerName||Sr(e.instance.id),r=await this.inspectContainerId(n);if(!r)throw wr("INSTANCE_RUNTIME_RESTART_FAILED",`Docker container ${n} does not exist.`);vr(n,r,t,"before restart","INSTANCE_RUNTIME_RESTART_FAILED"),await this.runCommand("docker",["restart",n]);const i=await this.inspectContainerId(n);if(!i||i!==r)throw wr("INSTANCE_RUNTIME_RESTART_FAILED",`Docker container identity changed while restarting ${n}.`);return vr(n,i,t,"after restart","INSTANCE_RUNTIME_RESTART_FAILED"),this.runningResult(e,n,i)}async delete(e){const t=e.instance.runtime.containerName||Sr(e.instance.id);try{await this.runCommand("docker",["rm","-f",t])}catch(e){if(!zr(e))throw wr("RUNTIME_EXECUTOR_FAILED",`Could not delete Docker container ${t}.`,e)}return{status:"stopped",health:"unknown",connectionStatus:"offline",target:{...e.instance.target,status:"unknown"},runtime:e.instance.runtime}}async installRuntime(e){const t=await this.installRuntimeRelease(e);vr(e.containerName,t,e.expectedContainerId,"before runtime restart","INSTANCE_RUNTIME_RESTART_FAILED");try{await this.runCommand("docker",["restart",e.containerName])}catch(t){throw wr("INSTANCE_RUNTIME_RESTART_FAILED",`Could not restart Docker container ${e.containerName}.`,t)}const n=await this.inspectContainerId(e.containerName);if(!n||n!==t)throw wr("INSTANCE_RUNTIME_RESTART_FAILED",`Docker container identity changed while updating ${e.containerName}.`);return vr(e.containerName,n,e.expectedContainerId,"after runtime restart","INSTANCE_RUNTIME_RESTART_FAILED"),this.inspectRuntimeVersion(e.containerName)}async installRuntimeRelease(e){const t=await this.inspectContainerId(e.containerName);if(!t)throw wr("INSTANCE_RUNTIME_INSTALL_FAILED",`Docker container ${e.containerName} does not exist.`);vr(e.containerName,t,e.expectedContainerId,"before runtime install","INSTANCE_RUNTIME_INSTALL_FAILED");const n=`/opt/task-handoff/instance-runtime/incoming/task-handoff-runtime-${r=e.identity.version,r.replace(/[^0-9A-Za-z.+_-]/g,"-")}-${e.identity.sha256.slice(0,12)}.tar.gz`;var r;await this.runCommand("docker",["exec","--user","0",e.containerName,"install","-d","-o","root","-g","root","-m","0755","/opt/task-handoff/instance-runtime/incoming"]),await this.runCommand("docker",["cp",e.artifactPath,`${e.containerName}:${n}`]);try{await this.runCommand("docker",["exec","--user","0",e.containerName,"task-handoff-runtime","install","--artifact",n,"--version",e.identity.version,"--sha256",e.identity.sha256,"--platform",e.identity.platform,"--arch",e.identity.arch,"--launcher-abi",String(e.identity.launcherAbi)])}catch(t){throw wr("INSTANCE_RUNTIME_INSTALL_FAILED",`Could not install controlled-instance ${e.identity.version} in ${e.containerName}.`,t)}finally{await this.runCommand("docker",["exec","--user","0",e.containerName,"rm","-f",n]).catch(()=>({stdout:"",stderr:""}))}const i=await this.inspectContainerId(e.containerName);if(!i||i!==t)throw wr("INSTANCE_RUNTIME_INSTALL_FAILED",`Docker container identity changed while installing ${e.containerName}.`);return vr(e.containerName,i,e.expectedContainerId,"after runtime install","INSTANCE_RUNTIME_INSTALL_FAILED"),t}async inspectRuntimeVersion(e){const t=await this.inspectContainerId(e);if(!t)return{};const n=await this.runCommand("docker",["exec","--user","agent",e,"task-handoff-runtime","verify-active"]).catch(()=>{});if(!n?.stdout)return{containerId:t};try{const e=Gt.safeParse(JSON.parse(n.stdout));return e.success?{containerId:t,...e.data}:{containerId:t}}catch{return{containerId:t}}}async inspectRuntimeTarget(e){let t,n;if(e){const r=await this.runCommand("docker",["inspect","--format","{{json .}}",e]).then(e=>JSON.parse(e.stdout.trim()||"{}")).catch(()=>{});if(t=r?.Platform,"string"==typeof r?.Image&&r.Image){const e=await this.runCommand("docker",["image","inspect","--format","{{json .}}",r.Image]).then(e=>JSON.parse(e.stdout.trim()||"{}")).catch(()=>{});t=e?.Os||t,n=e?.Architecture}}if(!t||!n){const e=await this.runCommand("docker",["info","--format","{{json .}}"]).then(e=>JSON.parse(e.stdout.trim()||"{}")).catch(e=>{throw wr("INSTANCE_BASE_RUNTIME_INCOMPATIBLE","Could not inspect the Docker runtime target.",e)});t||=e.OSType,n||=e.Architecture}const r="linux"===(i=t)||"darwin"===i?i:"windows"===i||"win32"===i?"win32":void 0;var i;const o=function(e){return"amd64"===e||"x86_64"===e||"x64"===e?"x64":"arm64"===e||"aarch64"===e?"arm64":void 0}(n);if(!r||!o)throw wr("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Docker reported an unsupported runtime target ${String(t||"unknown")}/${String(n||"unknown")}.`);return{platform:r,arch:o,launcherAbi:1}}async installRuntimeLauncher(e){const t=await this.inspectContainerId(e);if(!t)throw wr("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Docker container ${e} does not exist.`);const r=[[n.join(this.launcherAssetsDir,"entrypoint.sh"),"/root/.task-handoff-entrypoint.bootstrap"],[n.join(this.launcherAssetsDir,"instance-launcher.sh"),"/root/.task-handoff-instance-launcher.bootstrap"],[n.join(this.launcherAssetsDir,"runtime-installer.mjs"),"/root/.task-handoff-runtime-installer.bootstrap"]];for(const[t,n]of r)await this.runCommand("docker",["cp",t,`${e}:${n}`]);try{await this.runCommand("docker",["exec","--user","0",e,"bash","-ceu","install -d -o root -g root -m 0755 /opt/task-handoff/instance-runtime /opt/task-handoff/instance-runtime/releases /opt/task-handoff/instance-runtime/staging /opt/task-handoff/instance-runtime/incoming; chown -R root:root /opt/task-handoff/instance-runtime; chmod -R go-w /opt/task-handoff/instance-runtime; install -m 0755 /root/.task-handoff-entrypoint.bootstrap /usr/local/bin/task-handoff-entrypoint; install -m 0755 /root/.task-handoff-instance-launcher.bootstrap /usr/local/bin/task-handoff-instance-launcher; install -d /usr/local/lib/task-handoff; install -m 0755 /root/.task-handoff-runtime-installer.bootstrap /usr/local/lib/task-handoff/runtime-installer.mjs; ln -sfn /usr/local/lib/task-handoff/runtime-installer.mjs /usr/local/bin/task-handoff-runtime; rm -f /root/.task-handoff-entrypoint.bootstrap /root/.task-handoff-instance-launcher.bootstrap /root/.task-handoff-runtime-installer.bootstrap"])}catch(t){throw wr("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Could not install the runtime launcher in ${e}.`,t)}if(await this.inspectContainerId(e)!==t)throw wr("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Docker container identity changed while installing the runtime launcher in ${e}.`)}async inspectContainerId(e){try{return(await this.runCommand("docker",["inspect","--format","{{.Id}}",e])).stdout.trim()||void 0}catch(t){if(zr(t))return;throw wr("RUNTIME_EXECUTOR_FAILED",`Could not inspect Docker container ${e}.`,t)}}async inspectContainerForStart(e){let t;try{t=await this.runCommand("docker",["inspect","--format","{{json .}}",e])}catch(t){if(zr(t))return;throw wr("RUNTIME_EXECUTOR_FAILED",`Could not inspect Docker container ${e}.`,t)}try{const e=JSON.parse(t.stdout||"{}");if("string"!=typeof e.Id||!e.Id)throw new Error("Docker inspect did not return a container id.");const n=e.Config?.Labels&&"object"==typeof e.Config.Labels&&!Array.isArray(e.Config.Labels)?Object.fromEntries(Object.entries(e.Config.Labels).filter(e=>"string"==typeof e[1])):{};return{id:e.Id,labels:n}}catch(t){throw wr("RUNTIME_EXECUTOR_FAILED",`Docker returned invalid inspection data for ${e}.`,t)}}async containerPort(e,t){let n,r=!1;for(const i of this.portResolutionRetryDelaysMs){i>0&&await br(i);try{const n=Ir((await this.runCommand("docker",["port",e,t])).stdout);if(n)return n}catch(e){n=e}try{const n=Ar((await this.runCommand("docker",["inspect","--format","{{json .NetworkSettings.Ports}}",e])).stdout,t);if(r=!0,n)return n}catch(e){n=e}}if(r)throw wr("RUNTIME_EXECUTOR_FAILED",`Docker container ${e} does not publish ${t}.`);throw wr("RUNTIME_EXECUTOR_FAILED",`Could not resolve the published port for Docker container ${e}.`,n)}}function Ir(e){const t=e.split(/\r?\n/).find(Boolean);return t?.match(/:(\d+)$/)?.[1]}function Ar(e,t){const n=JSON.parse(e||"null");if(!n||"object"!=typeof n||Array.isArray(n))return;const r=n[t];if(Array.isArray(r))for(const e of r){if(!e||"object"!=typeof e||Array.isArray(e))continue;const t=e.HostPort;if("string"==typeof t&&/^\d+$/.test(t))return t}}function br(e){return new Promise(t=>setTimeout(t,e))}function wr(e,t,n){const r=Nr(n),i=new Error(r?`${t} Cause: ${r}`:t,void 0===n?void 0:{cause:n});return Object.assign(i,{statusCode:502,code:e}),i}function Nr(e){if(!e||"object"!=typeof e)return void 0===e?void 0:String(e);const t=e,n=t.details?.stderr||t.details?.stdout;return"string"==typeof n&&n.trim()?n.trim():"string"==typeof t.message&&t.message.trim()?t.message.trim():void 0}function zr(e){const t=Nr(e)?.toLowerCase()||"";return t.includes("no such container")||t.includes("no such object")}function vr(e,t,n,r,i){if(n&&t!==n)throw wr(i,`Docker container ${e} identity mismatch ${r}: expected ${n}, got ${t}.`)}async function Er(e=pr){return async function(e=pr){return(await e("docker",["images","--digests","--format","{{json .}}"])).stdout.split(/\r?\n/).map(e=>e.trim()).filter(Boolean).map(e=>{const t=JSON.parse(e),n=t.Repository||"<none>",r=t.Tag||"<none>",i=t.ID||t.IDShort||"",o="<none>"!==n&&"<none>"!==r?`${n}:${r}`:i,s="<none>"!==n&&t.Digest&&"<none>"!==t.Digest?[`${n}@${t.Digest}`]:[];return{repository:n,tag:r,id:i,createdSince:t.CreatedSince,size:t.Size,sizeBytes:fr(t.Size),reference:o,repoDigests:s}}).filter(e=>Boolean(e.reference))}(e)}function Sr(e){return`task-handoff-${e.replace(/[^a-zA-Z0-9_.-]/g,"-")}`}function _r(e,t,n){e.push("-e",`${t}=${n}`)}function Tr(e){if("local-folder"===e.project.source.type&&e.project.source.ownerNodeId&&e.project.source.ownerNodeId!==e.node.id){const e=new Error("Local folder projects can only start on the node that owns the folder.");throw Object.assign(e,{statusCode:400,code:"LOCAL_FOLDER_REQUIRES_OWNER_NODE"}),e}if(!e.image.requestedReference?.trim()){const e=new Error("Image profile must reference a registered image.");throw Object.assign(e,{statusCode:400,code:"IMAGE_PROFILE_INVALID"}),e}}const kr=m.z.enum(["created","starting","running","stopping","stopped","exited","failed","closed","terminated","unknown"]),Cr=m.z.object({type:m.z.enum(["app-session","provider-session","adapter-key"]),id:m.z.string().trim().min(1).max(240),agent:m.z.string().trim().min(1).max(80).optional(),adapter:m.z.string().trim().min(1).max(80).optional(),key:m.z.string().trim().min(1).max(240).optional()}).strict(),Or=m.z.record(m.z.string(),m.z.unknown()).and(m.z.object({id:m.z.string().trim().min(1).max(160),appId:m.z.string().trim().min(1).max(160).optional(),title:m.z.string().trim().max(240).optional(),kind:m.z.string().trim().max(80).optional(),status:kr.default("unknown"),bindings:m.z.array(Cr).max(40).default([]),workspace:m.z.object({cwd:m.z.string().trim().max(4096).optional()}).strict().optional(),createdAt:m.z.string().datetime().optional(),updatedAt:m.z.string().datetime().optional()})),xr=m.z.object({runningCount:m.z.number().int().min(0).default(0),problemCount:m.z.number().int().min(0).default(0),sessions:m.z.array(Or).default([]),updatedAt:m.z.string().datetime()}).strict();m.z.object({streamId:m.z.string().trim().min(1).max(240),revision:m.z.number().int().min(0),lastEventAt:m.z.string().datetime(),snapshot:xr}).strict(),xr.pick({runningCount:!0,problemCount:!0,updatedAt:!0}).extend({revision:m.z.number().int().min(0).optional()});const Rr=m.z.enum(["app-session-created","app-session-updated","app-session-deleted","app-session-recovered","control-action","heartbeat-sync","startup"]),Dr=m.z.object({streamId:m.z.string().trim().min(1).max(240),instanceId:m.z.string().trim().min(1).max(160),nodeId:m.z.string().trim().min(1).max(160).optional(),revision:m.z.number().int().min(0),previousRevision:m.z.number().int().min(0).optional(),traceId:m.z.string().trim().min(1).max(160),generatedAt:m.z.string().datetime(),reason:Rr}).strict(),Pr=m.z.object({meta:Dr,snapshot:xr}).strict(),jr=m.z.object({meta:Dr,session:Or}).strict(),Mr=m.z.object({meta:Dr,sessionId:m.z.string().trim().min(1).max(160),tombstone:Or.optional(),expiresAt:m.z.string().datetime().optional()}).strict();function Lr(e){return e.startsWith("ai-session.")||e.startsWith("ai.session.")?"ai.sessions":e.startsWith("app-session.")?"app.sessions":e.startsWith("app.management")?"apps":e.startsWith("trigger.")?"triggers":e.startsWith("instance.")?"instances":e.startsWith("node.")?"nodes":e.startsWith("project.")?"projects":e.startsWith("model.")?"models":e.startsWith("image.")?"images":e.startsWith("market.")?"market":"system"}m.z.object({streamId:m.z.string().trim().min(1).max(240),instanceId:m.z.string().trim().min(1).max(160),sinceRevision:m.z.number().int().min(0),latestRevision:m.z.number().int().min(0),earliestRetainedRevision:m.z.number().int().min(0),syncRequired:m.z.boolean().default(!1),events:m.z.array(m.z.discriminatedUnion("type",[m.z.object({type:m.z.literal("app-session.snapshot"),payload:Pr}).strict(),m.z.object({type:m.z.literal("app-session.patch"),payload:jr}).strict(),m.z.object({type:m.z.literal("app-session.removed"),payload:Mr}).strict()])).default([])}).strict();const $r=m.z.enum(["ai.sessions","app.sessions"]),Fr=m.z.object({topic:$r,instanceId:m.z.string().trim().min(1).max(160),streamId:m.z.string().trim().min(1).max(240),latestRevision:m.z.number().int().min(0),earliestRetainedRevision:m.z.number().int().min(0)}).strict(),Ur=m.z.object({protocolVersion:m.z.literal(1),streams:m.z.array(Fr)}).strict();class Vr{attempt=0;timer;get pending(){return Boolean(this.timer)}get attempts(){return this.attempt}schedule(e,t={}){if(this.timer)return;const n=function(e,t=Math.random){const n=Math.min(3e4,1e3*2**Math.max(0,e));return Math.min(3e4,Math.round(n*(.75+.5*t())))}(this.attempt,t.random);this.attempt+=1;const r=t.setTimeoutFn||setTimeout;return this.timer=r(()=>{this.timer=void 0,e()},n),{attempt:this.attempt,delay:n}}reset(e=clearTimeout){this.timer&&e(this.timer),this.timer=void 0,this.attempt=0}cancel(e=clearTimeout){this.timer&&e(this.timer),this.timer=void 0}}function Hr(e,t=6e4){const n=[];for(let r=0;r<e.length;r+=t)n.push(e.slice(r,r+t));return n}class qr{sockets=new Map;socketUrls=new Map;retries=new Map;outputs=new Set;imagePullTerminalByInstance=new Map;state;token;logger;safetyIntervalMs;lastAiSessionEventByInstance=new Map;lastAppSessionEventByInstance=new Map;timer;reconnectAttempts=0;safetyReconciliations=0;localSequence=0;createSocket;setIntervalFn;clearIntervalFn;constructor(e,t,n={}){var r;this.state=e,this.token=t,this.logger=n.logger,this.safetyIntervalMs=(r=n.safetyIntervalMs,Math.min(6e4,Math.max(3e4,r??45e3))),this.createSocket=n.createSocket||((e,t)=>new u(e,t)),this.setIntervalFn=n.setIntervalFn||setInterval,this.clearIntervalFn=n.clearIntervalFn||clearInterval}start(){this.sync(),this.timer=this.setIntervalFn(()=>{this.safetyReconciliations+=1,this.sync()},this.safetyIntervalMs)}stop(){this.timer&&(this.clearIntervalFn(this.timer),this.timer=void 0);for(const e of this.sockets.values())e.close();this.sockets.clear(),this.socketUrls.clear();for(const e of this.retries.values())e.timer.cancel();this.retries.clear(),this.outputs.clear()}addOutput(e){this.outputs.add(e),e.on("close",()=>this.outputs.delete(e)),e.on("error",()=>this.outputs.delete(e));for(const t of this.state.listInstances()){const n=Br(t);n?this.sendForwarded(e,this.createEvent(rr,n,{instanceId:t.id})):this.logger?.warn?.({instanceId:t.id},"instance.lifecycle.snapshot.invalid")}for(const[t,n]of this.imagePullTerminalByInstance)Hr(n.tail).forEach((r,i)=>this.sendForwarded(e,this.createEvent(Mn,{...n.output,sequence:n.output.sequence+i,data:r,...0===i?{replay:!0}:{}},{instanceId:t}))),n.finished&&this.sendForwarded(e,this.createEvent(Ln,n.finished,{instanceId:t}));return this.syncNow(),()=>{this.outputs.delete(e)}}publish(e,t,n={}){this.rememberImagePullTerminal(e,t);const r=this.createEvent(e,t,n);for(const e of this.outputs)this.sendForwarded(e,r)}rememberImagePullTerminal(e,t){if(e===Mn){const e=Fn.safeParse(t);if(!e.success)return;const n=e.data,r=this.imagePullTerminalByInstance.get(n.instanceId);if(r&&n.generation<r.output.generation)return;const i=r?.output.generation===n.generation,o=n.replay||!i?n.data:`${r.tail}${n.data}`.slice(-262144);return void this.imagePullTerminalByInstance.set(n.instanceId,{output:n,tail:o})}if(e===Ln){const e=Un.safeParse(t);if(!e.success)return;const n=e.data,r=this.imagePullTerminalByInstance.get(n.instanceId);r?.output.generation===n.generation&&(r.finished=n)}}publishInstanceLifecycle(e){this.publish(rr,function(e){return ir.parse(Kr(e))}(e),{instanceId:e.id});const t=this.imagePullTerminalByInstance.get(e.id);"ready"===e.imageProvisioning?.phase&&"succeeded"===t?.finished?.outcome&&this.imagePullTerminalByInstance.delete(e.id)}createEvent(e,t,n){const r=++this.localSequence;return{v:1,id:`node_evt_${Date.now().toString(36)}_${r.toString(36)}`,seq:r,type:e,topic:Lr(e),createdAt:(new Date).toISOString(),payload:t,scope:n}}sendForwarded(e,t){const n=JSON.stringify({type:"node-agent.event.forwarded",event:t});e.readyState===u.OPEN&&e.send(n)}syncNow(){this.sync()}diagnostics(){return{reconnectAttempts:this.reconnectAttempts,safetyReconciliations:this.safetyReconciliations,activeConnections:this.sockets.size,pendingRetries:[...this.retries.values()].filter(e=>e.timer.pending).length,safetyIntervalMs:this.safetyIntervalMs}}sync(){const e=new Set(this.state.listInstances().map(e=>e.id));for(const t of this.imagePullTerminalByInstance.keys())e.has(t)||this.imagePullTerminalByInstance.delete(t);if(!this.outputs.size){for(const e of this.sockets.values())e.close();this.sockets.clear(),this.socketUrls.clear();for(const e of this.retries.values())e.timer.cancel();return void this.retries.clear()}const t=new Set;for(const e of this.state.listInstances()){const n=Jr(e);if(!n)continue;t.add(e.id);const r=this.retries.get(e.id);r?.timer.pending&&r.url!==n&&(r.timer.cancel(),this.retries.delete(e.id)),this.socketUrls.get(e.id)!==n&&this.sockets.has(e.id)&&(this.sockets.get(e.id)?.close(),this.sockets.delete(e.id)),this.sockets.has(e.id)||this.retries.get(e.id)?.timer.pending||this.connect(e.id,n)}for(const[e,n]of this.sockets)if(!t.has(e)){n.close(),this.sockets.delete(e),this.socketUrls.delete(e);const t=this.retries.get(e);t?.timer.cancel(),this.retries.delete(e)}for(const[e,n]of this.retries)t.has(e)||(n.timer.cancel(),this.retries.delete(e),this.socketUrls.delete(e))}connect(e,t){const n=this.token?{authorization:`Bearer ${this.token}`}:void 0,r=this.createSocket(t,{headers:n});this.sockets.set(e,r),this.socketUrls.set(e,t),r.on("open",()=>{const n=this.retries.get(e);n?.timer.reset(),this.retries.set(e,{timer:n?.timer||new Vr,url:t}),r.readyState===u.OPEN&&(r.send(JSON.stringify({v:1,type:"subscribe",topics:[q,"app.sessions","apps","instances"]})),this.logger?.info?.({instanceId:e,url:t},"ai-session.event.forward.connect"),this.logger?.info?.({instanceId:e,url:t},"app-session.event.forward.connect"))}),r.on("message",t=>{const n=function(e,t){try{const n=JSON.parse(String(e));if(!n||"object"!=typeof n||Array.isArray(n))return;const r=n,i="string"==typeof r.type?r.type:"";if(!i||"events.connected"===i)return;const o=r.scope&&"object"==typeof r.scope&&!Array.isArray(r.scope)?r.scope:{};return{v:1,id:"string"==typeof r.id?r.id:`evt_${Date.now().toString(36)}`,seq:Number(r.seq)||0,type:i,topic:"string"==typeof r.topic?r.topic:Lr(i),createdAt:"string"==typeof r.createdAt?r.createdAt:(new Date).toISOString(),payload:"payload"in r?r.payload:{},scope:{...o,instanceId:t}}}catch{return}}(t,e);if(!n)return;if("streams.hello"===n.type){const t=Ur.safeParse(n.payload);if(!t.success)return this.logger?.warn?.({instanceId:e,issues:t.error.issues},"session-stream.handshake.invalid"),void r.close(1002,"Incompatible session stream handshake.");const i=JSON.stringify({type:"node-agent.streams.hello",instanceId:e,payload:t.data});for(const e of this.outputs)e.readyState===u.OPEN&&e.send(i);return}this.recordAiSessionEvent(e,n),this.recordAppSessionEvent(e,n);const i=JSON.stringify({type:"node-agent.event.forwarded",event:n});for(const e of this.outputs)e.readyState===u.OPEN&&e.send(i)}),r.on("close",()=>{this.sockets.get(e)===r&&(this.sockets.delete(e),this.socketUrls.delete(e),this.scheduleReconnect(e))}),r.on("error",()=>{this.logger?.warn?.({instanceId:e,url:t},"ai-session.event.forward.error"),this.logger?.warn?.({instanceId:e,url:t},"app-session.event.forward.error"),r.close()})}scheduleReconnect(e){const t=this.state.listInstances().find(t=>t.id===e),n=t&&Jr(t);if(!n||!this.outputs.size)return;const r=this.retries.get(e)??{timer:new Vr};if(r.timer.pending)return;r.url=n;const i=r.timer.schedule(()=>{this.sockets.has(e)||this.connect(e,n)});i&&(this.reconnectAttempts+=1,this.logger?.info?.({instanceId:e,url:n,attempt:i.attempt,delay:i.delay,reconnectAttempts:this.reconnectAttempts},"session-stream.connection.reconnect-scheduled")),this.retries.set(e,r)}recordAiSessionEvent(e,t){if(t.topic!==q)return;if("ai-session.message-delta"===t.type)return;const n=Gr(t.payload),r=this.lastAiSessionEventByInstance.get(e);r?.streamId===n.streamId&&void 0!==r.revision&&void 0!==n.revision&&n.revision>r.revision+1&&this.logger?.warn?.({instanceId:e,traceId:n.traceId,streamId:n.streamId,previousRevision:r.revision,revision:n.revision},"ai-session.event.forward.gap"),this.lastAiSessionEventByInstance.set(e,{streamId:n.streamId??r?.streamId,revision:n.revision??r?.revision}),this.logger?.info?.({instanceId:e,traceId:n.traceId,eventType:t.type,streamId:n.streamId,revision:n.revision},"ai-session.event.forward.message")}recordAppSessionEvent(e,t){if("app.sessions"!==t.topic)return;const n=Gr(t.payload),r=this.lastAppSessionEventByInstance.get(e);r?.streamId===n.streamId&&void 0!==r.revision&&void 0!==n.revision&&n.revision>r.revision+1&&this.logger?.warn?.({instanceId:e,traceId:n.traceId,streamId:n.streamId,previousRevision:r.revision,revision:n.revision},"app-session.event.forward.gap"),this.lastAppSessionEventByInstance.set(e,{streamId:n.streamId??r?.streamId,revision:n.revision??r?.revision}),this.logger?.info?.({instanceId:e,traceId:n.traceId,eventType:t.type,streamId:n.streamId,revision:n.revision},"app-session.event.forward.message")}}function Br(e){const t=ir.safeParse(Kr(e));return t.success?t.data:void 0}function Kr(e){return{instanceId:e.id,revision:e.stateRevision,updatedAt:e.updatedAt,status:e.status,health:e.health,connectionStatus:e.connectionStatus,accessStatus:"online"===e.connectionStatus||"online"===e.agentStatus?"reachable":"endpoint-unreachable",imageProvisioning:e.imageProvisioning,workspace:e.workspace,runtime:e.runtime,runtimeVersion:e.runtimeVersion,ready:e.ready,lastHeartbeatAt:e.lastHeartbeatAt}}function Gr(e){const t=e&&"object"==typeof e&&!Array.isArray(e)?e:{},n=t.meta&&"object"==typeof t.meta&&!Array.isArray(t.meta)?t.meta:{};return{streamId:"string"==typeof n.streamId?n.streamId:void 0,revision:"number"==typeof n.revision?n.revision:void 0,traceId:"string"==typeof n.traceId?n.traceId:void 0}}function Jr(e){if(!function(e){return!1!==e.ready&&(!e.runtimeVersion||["matched","failed"].includes(e.runtimeVersion.phase))}(e))return;const t=e.target?.api||e.target?.web;if(t)try{const e=new URL("/api/events",t);return e.protocol="https:"===e.protocol?"wss:":"ws:",e.toString()}catch{return}}const Wr=new Set(["provisioning","starting","registering","registered","running","unhealthy"]),Yr=JSON.stringify({id:"{{.ID}}",name:"{{.Name}}",cpu:"{{.CPUPerc}}",memory:"{{.MemUsage}}",memoryPercent:"{{.MemPerc}}",network:"{{.NetIO}}",blockIo:"{{.BlockIO}}",pids:"{{.PIDs}}"});class Xr{snapshots=new Map;runCommand;targets;publish;intervalMs;timer;inFlight;pendingTargets=new Map;collectingTargets=new Map;constructor(e,t,n,r=3e3){this.runCommand=e,this.targets=t,this.publish=n,this.intervalMs=r}start(){this.collect().catch(()=>{}),this.timer=setInterval(()=>{this.collect().catch(()=>{})},this.intervalMs)}stop(){this.timer&&clearInterval(this.timer),this.timer=void 0}async snapshot(e){const t=this.targets().find(t=>t.id===e);if(!t)return;if(!Wr.has(t.status))return ri(t.id);const n=this.snapshots.get(e);return n&&Date.now()-Date.parse(n.sampledAt)<=this.intervalMs?n:(await this.collect([t]),this.snapshots.get(e))}async collect(e){const t=e||this.targets();if(!e){const e=new Set(t.map(e=>e.id));for(const t of this.snapshots.keys())e.has(t)||this.snapshots.delete(t)}for(const e of t){const t=Qr(e);this.collectingTargets.get(e.id)!==t&&this.pendingTargets.set(e.id,e)}this.inFlight||(this.inFlight=this.drain().finally(()=>{this.inFlight=void 0})),await this.inFlight}async drain(){for(;this.pendingTargets.size;){const e=[...this.pendingTargets.values()];this.pendingTargets.clear();for(const t of e)this.collectingTargets.set(t.id,Qr(t));try{await this.collectOnce(e)}finally{for(const t of e)this.collectingTargets.delete(t.id)}}}async collectOnce(e){const t=e.filter(e=>Wr.has(e.status)&&(e.runtime.containerId||e.runtime.containerName));for(const t of e.filter(e=>Wr.has(e.status)&&!e.runtime.containerId&&!e.runtime.containerName))this.update(ii(t.id));for(const t of e.filter(e=>!Wr.has(e.status)))this.update(ri(t.id));if(!t.length)return;const n=t.map(e=>e.runtime.containerId||e.runtime.containerName),r=(new Date).toISOString();try{const e=await this.runCommand("docker",["stats","--no-stream","--format",Yr,...n],{timeoutMs:5e3});this.applyDockerOutput(t,e.stdout,r)}catch(e){if(1===t.length)return void this.update(oi(t[0].id,r,e instanceof Error?e.message:String(e)));await Promise.all(t.map(async e=>{const t=e.runtime.containerId||e.runtime.containerName;try{const n=await this.runCommand("docker",["stats","--no-stream","--format",Yr,t],{timeoutMs:5e3});this.applyDockerOutput([e],n.stdout,r)}catch(t){this.update(oi(e.id,r,t instanceof Error?t.message:String(t)))}}))}}applyDockerOutput(e,t,n){const r=function(e,t=(new Date).toISOString()){const n=new Map;for(const r of e.split(/\r?\n/).filter(Boolean)){let e;try{e=JSON.parse(r)}catch{continue}const i=ni(e.id),o=ni(e.name),s=i||o;if(!s)continue;const a=Zr(ni(e.memory)),c=Zr(ni(e.network)),d=Zr(ni(e.blockIo)),l=Kn.parse({instanceId:s,runtimeKind:"docker",state:"available",sampledAt:t,cpu:ei(e.cpu,"usagePercent"),memory:a?{usageBytes:a[0],...void 0!==a[1]?{limitBytes:a[1]}:{},...ei(e.memoryPercent,"usagePercent")}:void 0,network:c?{rxBytes:c[0],txBytes:c[1]||0}:void 0,blockIo:d?{readBytes:d[0],writeBytes:d[1]||0}:void 0,pids:ti(e.pids)});i&&n.set(i,l),o&&n.set(o,l)}return n}(t,n);for(const t of e){const e=[t.runtime.containerId,t.runtime.containerName].filter(Boolean),i=[...r.entries()].find(([t])=>e.some(e=>e===t||e.startsWith(t)||t.startsWith(e)))?.[1];this.update(i?{...i,instanceId:t.id}:oi(t.id,n,"Container metrics were not returned by Docker."))}}update(e){const t=Kn.parse(e);this.snapshots.set(t.instanceId,t),this.publish?.(t)}}function Qr(e){return[e.status,e.runtime.containerId||"",e.runtime.containerName||""].join("\0")}function Zr(e){if(!e)return;const[t,n]=e.split("/").map(e=>function(e){const t=e.trim().match(/^([0-9]+(?:\.[0-9]+)?)\s*([kmgtpe]?i?b)$/i);if(!t)return;const n=Number(t[1]),r=t[2].toLowerCase(),i=r.includes("i"),o="b"===r[0]?"":r[0],s=o?"kmgtpe".indexOf(o)+1:0;return Math.round(n*(i?1024:1e3)**s)}(e||""));return void 0===t?void 0:[t,n]}function ei(e,t){const n=Number(ni(e).replace(/%$/,""));return Number.isFinite(n)&&n>=0?{[t]:n}:void 0}function ti(e){const t=Number(ni(e));return Number.isFinite(t)&&t>=0?t:void 0}function ni(e){return"string"==typeof e||"number"==typeof e?String(e).trim():""}function ri(e){return{instanceId:e,runtimeKind:"docker",state:"stopped",sampledAt:(new Date).toISOString()}}function ii(e){return{instanceId:e,runtimeKind:"docker",state:"pending",sampledAt:(new Date).toISOString()}}function oi(e,t,n){return{instanceId:e,runtimeKind:"docker",state:"unavailable",sampledAt:t,error:n.slice(0,2048)}}function si(e){try{return t.statSync(e).isDirectory()}catch{return!1}}function ai(e,r){let i;try{i=t.statSync(e)}catch{return}if(!i.isDirectory())return;const o=n.resolve(e),s=n.basename(o)||o;let a=[];try{a=r>0?t.readdirSync(o,{withFileTypes:!0}):[]}catch{a=[]}const c=r>0?a.filter(e=>e.isDirectory()||e.isSymbolicLink()&&si(n.join(o,e.name))).sort((e,t)=>e.name.localeCompare(t.name)).slice(0,80).flatMap(e=>{const t=ai(n.join(o,e.name),r-1);return t?[t]:[]}):[];return{name:s,path:o,children:c}}function ci(e){return(e.path?[e.path]:function(){if("win32"!==process.platform)return[n.parse(n.resolve(process.cwd())).root];const e=n.parse(n.resolve(process.cwd())).root,t=Array.from({length:26},(e,t)=>`${String.fromCharCode(65+t)}:\\`);return[...new Set([e,...t])].filter(si)}()).flatMap(t=>{const n=ai(t,e.depth);return n?[n]:[]})}const di=m.z.object({path:m.z.string().trim().min(1).max(2048),method:m.z.string().trim().min(1).max(20).default("GET"),headers:m.z.record(m.z.string(),m.z.string()).default({}),body:m.z.string().optional(),bodyBase64:m.z.string().optional()}).strict(),li=m.z.object({id:m.z.string().trim().min(1).max(120).optional(),name:m.z.string().trim().min(1).max(160),path:m.z.string().trim().min(1).max(4096),defaultImageSelection:Nt.optional(),labels:m.z.record(m.z.string(),m.z.string()).default({})}).strict(),ui=m.z.object({path:m.z.string().trim().min(1).max(4096).optional(),depth:m.z.coerce.number().int().min(0).max(1).default(0)}).strict(),mi=m.z.object({id:m.z.string().trim().min(1).max(120).optional(),name:m.z.string().trim().min(1).max(160).optional(),runtimeId:m.z.string().trim().min(1).max(120),imageSelection:Nt.optional(),projectId:m.z.string().trim().min(1).max(120).optional(),image:Pn.optional(),source:an,sourceSnapshot:m.z.record(m.z.string(),m.z.unknown()).default({}),config:m.z.object({autoImportAgentConfigs:m.z.boolean().optional(),defaultCodexPermissionMode:se.optional()}).strict().optional(),modelSelection:nr.shape.modelSelection}).strict(),pi=m.z.object({name:m.z.string().trim().min(1).max(160).optional(),config:m.z.object({autoImportAgentConfigs:m.z.boolean().optional(),defaultCodexPermissionMode:se.optional()}).strict().optional(),modelSelection:nr.shape.modelSelection.optional()}).strict(),gi=m.z.object({id:m.z.string().trim().min(1).max(120).optional(),name:m.z.string().trim().min(1).max(160),type:m.z.enum(["docker","kubernetes","local"]),status:m.z.enum(["unknown","online","offline","degraded"]).default("unknown"),accessStrategy:m.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).optional(),capabilities:m.z.record(m.z.string(),m.z.unknown()).default({}),labels:m.z.record(m.z.string(),m.z.string()).default({})}).strict(),hi=gi.omit({id:!0}).partial().strict();function fi(){return process.env.TASK_HANDOFF_NODE_AGENT_DATA_DIR||n.join(p.homedir(),".config","task-handoff","node-agent")}function yi(e=fi()){const t=n.resolve(e);return{dataDir:t,identityPath:n.join(t,"identity.json"),settingsPath:n.join(t,"runtime-settings.json"),localFoldersDir:n.join(t,"local-folders"),nodeRuntimesDir:n.join(t,"node-runtimes"),controlledInstancesDir:n.join(t,"controlled-instances"),nodeModelsDir:n.join(t,"models"),modelAssignmentsDir:n.join(t,"model-assignments"),modelEnvironmentsDir:n.join(t,"model-environments"),updatesDir:n.join(t,"updates"),logsDir:n.join(t,"logs")}}function Ii(e,n){t.mkdirSync(e,{recursive:!0,...void 0===n?{}:{mode:n}}),void 0!==n&&t.chmodSync(e,n)}function Ai(e,r,i={}){Ii(n.dirname(e),i.directoryMode),h.sync(e,`${JSON.stringify(r,null,2)}\n`,{encoding:"utf8",...void 0===i.fileMode?{}:{mode:i.fileMode}}),void 0!==i.fileMode&&t.chmodSync(e,i.fileMode)}function bi(e,t){console.warn(JSON.stringify({message:e,...t}))}function wi(e){return e&&"object"==typeof e&&"issues"in e?{issues:e.issues}:{error:e instanceof Error?e.message:String(e)}}function Ni(e,n){const r=n.logger||bi;let i;try{i=JSON.parse(t.readFileSync(e,"utf8"))}catch(t){return void r("stored JSON could not be read",{filePath:e,...wi(t)})}if(!n.schema)return i;const o=n.sanitize?n.sanitize(i):i,s=n.schema.safeParse(o);if(s.success)return s.data;const a="strip"in n.schema&&"function"==typeof n.schema.strip?n.schema.strip().safeParse(o):void 0;if(a?.success)return r("unknown stored fields were ignored",{filePath:e,issues:s.error.issues}),a.data;r("stored record failed validation and was isolated",{filePath:e,issues:s.error.issues})}function zi(e){return`${e}_${r.randomUUID().replace(/-/g,"").slice(0,20)}`}function vi(){return r.randomBytes(24).toString("base64url")}class Ei{directory;options;constructor(e,t={}){this.directory=e,this.options=t}init(){if(Ii(this.directory,this.options.directoryMode),void 0!==this.options.fileMode)for(const e of t.readdirSync(this.directory).filter(e=>e.endsWith(".json")))t.chmodSync(n.join(this.directory,e),this.options.fileMode)}filePath(e){return n.join(this.directory,`${e}.json`)}list(){return this.init(),t.readdirSync(this.directory).filter(e=>e.endsWith(".json")).sort().flatMap(e=>{const t=Ni(n.join(this.directory,e),this.options);return t?[t]:[]})}get(e){this.init();const n=this.filePath(e);return t.existsSync(n)?Ni(n,this.options):void 0}put(e){const t=this.options.sanitize?this.options.sanitize(e):e,n=this.options.schema?this.options.schema.parse(t):t;return Ai(this.filePath(n.id),n,this.options),n}patch(e,t){const n=this.get(e);if(!n)return;const r={...n,...t,id:n.id,createdAt:n.createdAt,updatedAt:(new Date).toISOString()};return this.put(r)}delete(e){const n=this.filePath(e);return!!t.existsSync(n)&&(t.unlinkSync(n),!0)}}class Si{filePathValue;defaults;options;constructor(e,t,n={}){this.filePathValue=e,this.defaults=t,this.options=n}init(){Ii(n.dirname(this.filePathValue),this.options.directoryMode),t.existsSync(this.filePathValue)?void 0!==this.options.fileMode&&t.chmodSync(this.filePathValue,this.options.fileMode):this.put(this.defaults())}get(){return this.init(),t.existsSync(this.filePathValue)?Ni(this.filePathValue,this.options)??this.defaults():this.defaults()}put(e){const t=this.options.sanitize?this.options.sanitize(e):e,n=this.options.schema?this.options.schema.parse(t):t;return Ai(this.filePathValue,n,this.options),n}}function _i(e,t=process.platform){const i=n.resolve(e),o=r.createHash("sha256").update(i).digest("hex").slice(0,16);return"win32"===t?`\\\\.\\pipe\\task-handoff-node-agent-${o}`:n.join("/tmp",`task-handoff-node-agent-${process.getuid?.()??"user"}`,`${o}.sock`)}const Ti=new Set(["DELETE","GET","HEAD","PATCH","POST","PUT","OPTIONS"]);function ki(e){return"string"==typeof e&&Ti.has(e.toUpperCase())?e.toUpperCase():"GET"}function Ci(){return(new Date).toISOString()}function Oi(e,t){if(!e)return!0;const n=f.valid(e),r=f.valid(t);return n&&r?f.gt(r,n):e!==t}function xi(){return process.env.TASK_HANDOFF_NPM_COMMAND||"npm"}function Ri(e,r){const i=n.join(e,...r.split("/"),"package.json");try{const e=JSON.parse(t.readFileSync(i,"utf8"));if(e.name!==r||"string"!=typeof e.version||!e.version.trim())throw new Error(`Installed package manifest is invalid: ${i}`);return{name:r,version:e.version.trim()}}catch(e){if("ENOENT"===e.code)return;throw e}}async function Di(e){const t=(await e(xi(),["root","--global"])).stdout.trim();if(!t)throw new Error("npm did not return its global module root.");const n=Ri(t,"@task-handoff/server"),r=Ri(t,"@task-handoff/node-agent");return n?{packageName:"@task-handoff/server",currentVersion:n.version,relatedCurrentVersions:r?[r.version]:[]}:{packageName:"@task-handoff/node-agent",currentVersion:r?.version,relatedCurrentVersions:[]}}function Pi(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n="string"==typeof t.updatedAt?t.updatedAt:Ci(),r=t.target&&"object"==typeof t.target&&!Array.isArray(t.target)?t.target:void 0,i="controlled-instance"===r?.component,o={updating:"updating-node",downloading:"updating-node",installing:"updating-node",restarting:"restarting-node",completed:"succeeded",success:"succeeded",error:"failed"},s=new Set(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),a="string"==typeof t.status?t.status:"queued",c=i?"failed":s.has(a)?a:o[a]||"failed",d="string"==typeof t.toVersion&&t.toVersion?t.toVersion:"unknown",l=Yt.strip().safeParse(t.impact).success?Yt.strip().parse(t.impact):{runningInstanceCount:0,stoppedInstanceCount:0,activeInstanceCount:0,restartInstanceCount:0,runningInstanceIds:[],stoppedInstanceIds:[],activeInstanceIds:[]},u=i?{code:"LEGACY_INSTANCE_UPDATE_RETIRED",message:"Independent controlled-instance update jobs were retired in favor of Node reconciliation.",retryable:!1}:"failed"!==c||t.error||s.has(a)||a in o?"string"==typeof t.error?{code:"NODE_UPDATE_FAILED",message:t.error,retryable:!1}:Jt.strip().safeParse(t.error).success?Jt.strip().parse(t.error):t.error&&"object"==typeof t.error?{code:"NODE_UPDATE_FAILED",message:"string"==typeof t.error.message?t.error.message:"Stored update job contained an unknown error.",retryable:!1}:void 0:{code:"NODE_UPDATE_FAILED",message:`Stored update job used an unknown status: ${a}.`,retryable:!1},{target:m,error:p,...g}=t,h={phase:"succeeded"===c?"succeeded":"failed"===c?"failed":c||"queued",desiredVersion:d,expectedInstanceIds:[],expectedInstanceCount:0,matchedInstanceCount:0,pendingInstanceCount:0,failedInstanceCount:i||"failed"===c?1:0,deferredInstanceCount:0},f=Xt.strip().safeParse(t.rollout);return{...g,source:"npm",status:c,impact:l,runtimeArtifacts:Array.isArray(t.runtimeArtifacts)?t.runtimeArtifacts.flatMap(e=>{const t=Gt.strip().safeParse(e);return t.success?[t.data]:[]}):[],rollout:f.success?f.data:h,...u?{error:u}:{},...i?{completedAt:t.completedAt||n}:{}}}class ji{records;constructor(e){this.records=new Ei(e.updatesDir,{schema:en,sanitize:Pi})}init(){this.records.init()}list(){return this.records.list().sort((e,t)=>t.createdAt.localeCompare(e.createdAt))}create(e,t){const n=Ci();return this.records.put(en.parse({id:zi("update"),nodeId:e,source:t.source,channel:t.channel,fromVersion:t.currentVersion,toVersion:t.availableVersion,artifactRef:t.artifactRef,runtimeArtifacts:t.runtimeArtifacts,impact:t.impact,status:"queued",rollout:{phase:"queued",desiredVersion:t.availableVersion,expectedInstanceIds:t.impact.runningInstanceIds,expectedInstanceCount:t.impact.runningInstanceCount,matchedInstanceCount:0,pendingInstanceCount:t.impact.runningInstanceCount,failedInstanceCount:0,deferredInstanceCount:t.impact.stoppedInstanceCount},createdAt:n,updatedAt:n}))}patch(e,t){const n=this.records.get(e);if(!n)throw Object.assign(new Error(`Update job ${e} was not found.`),{statusCode:404,code:"UPDATE_JOB_NOT_FOUND"});return this.records.put(en.parse({...n,...t,id:e,createdAt:n.createdAt,updatedAt:Ci()}))}reconcileRollouts(e,t,n={}){const r=new Map(e.map(e=>[e.id,e]));for(const e of this.list().filter(e=>["updating-node","restarting-node","converging-instances"].includes(e.status))){if(n.processStarted&&"restarting-node"===e.status&&t!==e.toVersion){this.patch(e.id,{status:"failed",rollout:{...e.rollout,phase:"failed",nodeVersion:t},error:{code:"NODE_UPDATE_FAILED",message:`Node agent restarted with version ${t}, expected ${e.toVersion}.`,retryable:!1},completedAt:Ci()});continue}const i="converging-instances"!==e.status&&t===e.toVersion?this.patch(e.id,{status:"converging-instances",rollout:{...e.rollout,phase:"converging-instances",nodeVersion:t}}):e;if("converging-instances"!==i.status)continue;const o=i.rollout.expectedInstanceIds,s=o.map(e=>r.get(e)),a=s.filter(e=>e?.ready&&"matched"===e.runtimeVersion?.phase&&e.runtimeVersion.actualVersion===i.toVersion).length,c=s.filter(e=>e&&["created","stopped","failed"].includes(e.status||"")&&"failed"!==e.runtimeVersion?.phase).length,d=s.filter(e=>!e||"failed"===e.runtimeVersion?.phase).length,l=Math.max(0,o.length-a-d-c),u=d>0?"degraded":0===l?"succeeded":"converging-instances";this.patch(i.id,{status:u,rollout:{...i.rollout,phase:u,nodeVersion:t,expectedInstanceCount:o.length,matchedInstanceCount:a,pendingInstanceCount:l,failedInstanceCount:d,deferredInstanceCount:i.impact.stoppedInstanceCount+c},..."succeeded"===u||"degraded"===u?{completedAt:Ci()}:{}})}}run(e,t){(async()=>{this.patch(e.id,{status:"updating-node",rollout:{...e.rollout,phase:"updating-node"},startedAt:Ci(),error:void 0});try{await t(e),this.patch(e.id,{status:"succeeded",completedAt:Ci()})}catch(t){this.patch(e.id,{status:"failed",rollout:{...e.rollout,phase:"failed"},error:{code:"NODE_UPDATE_FAILED",message:t instanceof Error?t.message:String(t),retryable:!1},completedAt:Ci()})}})()}}const Mi="runtime-manifest.json";class Li extends Error{code;retryable;constructor(e,t,n){super(t,void 0===n?.cause?void 0:{cause:n.cause}),this.name="RuntimeArtifactError",this.code=e,this.retryable=n?.retryable??!1}}async function $i(e,t=""){const r=[],i=await y.readdir(n.join(e,t),{withFileTypes:!0});for(const o of i){const i=t?n.posix.join(t,o.name):o.name;if(!t&&i===Mi)continue;const s=n.join(e,...i.split("/"));if(o.isDirectory()){r.push(...await $i(e,i));continue}if(o.isSymbolicLink()){const t=await y.readlink(s);if(n.isAbsolute(t))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload symlink is absolute: ${i}`);const o=n.resolve(n.dirname(s),t),a=n.relative(n.resolve(e),o);if(!a||".."===a||a.startsWith(`..${n.sep}`)||n.isAbsolute(a))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload symlink escapes the artifact: ${i}`);if(!await y.lstat(o).catch(()=>{}))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload symlink is broken: ${i}`);r.push({absolutePath:s,relativePath:i,kind:"symlink",target:t,size:Buffer.byteLength(t)});continue}if(!o.isFile())throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload contains unsupported entry: ${i}`);const a=await y.lstat(s);r.push({absolutePath:s,relativePath:i,kind:"file",size:a.size})}return r}async function Fi(e){const n=(await $i(e)).sort((e,t)=>function(e,t){return Buffer.compare(Buffer.from(e,"utf8"),Buffer.from(t,"utf8"))}(e.relativePath,t.relativePath)),i=r.createHash("sha256");for(const e of n){if(i.update("file"===e.kind?"F":"L","ascii"),i.update(Buffer.from(e.relativePath,"utf8")),i.update(Buffer.from([0])),i.update(Buffer.from(String(e.size),"ascii")),i.update(Buffer.from([0])),"file"===e.kind)for await(const n of t.createReadStream(e.absolutePath))i.update(n);else i.update(Buffer.from(e.target,"utf8"));i.update(Buffer.from([0]))}return i.digest("hex")}function Ui(e){for(const[t,n]of[["version",e.version],["platform",e.platform],["arch",e.arch]])if(!/^[0-9A-Za-z._-]+$/.test(n))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Invalid runtime artifact ${t}: ${n}`);return`${e.version}-${e.platform}-${e.arch}`}function Vi(e,t){return`${Ui(e)}-${e.sha256}-${t}`}async function Hi(e){const n=r.createHash("sha256");for await(const r of t.createReadStream(e))n.update(r);return n.digest("hex")}class qi{#e;#t;#n=new Map;constructor(e){this.#e=e.cacheDir,this.#t=e.fetchImpl??fetch}resolve(e,t){const n=Gt.parse(e);if(!/^[a-f0-9]{64}$/.test(t.archiveSha256))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID","Runtime archive SHA-256 is invalid.");if((t.archiveUrl?1:0)+(t.archivePath?1:0)!=1)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID","Runtime artifact source must specify exactly one archive location.");const r=Vi(n,t.archiveSha256),i=this.#n.get(r);if(i)return i;const o=this.#r(n,t).finally(()=>this.#n.delete(r));return this.#n.set(r,o),o}async#r(e,i){if(!/^[a-f0-9]{64}$/.test(i.archiveSha256))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID","Runtime archive SHA-256 is invalid.");const o=Vi(e,i.archiveSha256),s=n.join(this.#e,"archives"),a=n.join(s,`${o}.tar.gz`);if(await y.mkdir(s,{recursive:!0}),await this.#i(a,e,i.archiveSha256))return{identity:e,archivePath:a,cacheHit:!0};await y.rm(a,{force:!0});const c=n.join(s,`.${o}.${r.randomUUID()}.part`);try{const n=await y.open(c,"wx");if(i.archivePath)await I.pipeline(t.createReadStream(i.archivePath),n.createWriteStream());else{const e=await this.#t(i.archiveUrl);if(!e.ok||!e.body)throw await n.close(),new Li("INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE",`Runtime artifact download failed with HTTP ${e.status}.`,{retryable:e.status>=500});await I.pipeline(e.body,n.createWriteStream())}if(await Hi(c)!==i.archiveSha256)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID","Downloaded runtime archive SHA-256 does not match release metadata.");return await this.#o(c,e),await y.rename(c,a),{identity:e,archivePath:a,cacheHit:!1}}catch(e){if(e instanceof Li)throw e;throw new Li("INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE","Could not download runtime artifact.",{cause:e,retryable:!0})}finally{await y.rm(c,{force:!0})}}async#i(e,t,n){try{return await Hi(e)===n&&(await this.#o(e,t),!0)}catch{return!1}}async#o(e,t){const i=n.join(this.#e,"validation",`${Ui(t)}-${r.randomUUID()}`);try{await async function(e,t){await y.mkdir(t,{recursive:!0});try{await A.extract({file:e,cwd:t,strict:!0,preservePaths:!1,filter:(e,t)=>{const r=n.posix.normalize(e.replace(/^\.\//,""));if(!r||".."===r||r.startsWith("../")||n.posix.isAbsolute(r))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime archive entry escapes the artifact root: ${e}`);const i=t.type;if("File"!==i&&"OldFile"!==i&&"Directory"!==i&&"SymbolicLink"!==i)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime archive contains unsupported entry type ${i??"unknown"}: ${e}`);return!0}})}catch(e){throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID","Could not extract runtime artifact safely.",{cause:e})}}(e,i),await async function(e,t,r){const i=await async function(e){let t;try{t=JSON.parse(await y.readFile(n.join(e,Mi),"utf8"))}catch(e){throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID","Runtime artifact manifest is missing or invalid JSON.",{cause:e})}const r=Gt.safeParse(t);if(!r.success)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime artifact manifest is invalid: ${r.error.message}`);return r.data}(e);if(function(e,t){for(const n of["packageName","version","platform","arch","formatVersion","launcherAbi","entrypoint","sha256"])if(e[n]!==t[n])throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime artifact ${"sha256"===n?"SHA-256":n} mismatch: expected ${t[n]}, got ${e[n]}.`)}(i,t),1!==i.formatVersion)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Unsupported runtime artifact format ${i.formatVersion}.`);if(r?.platform&&"universal"!==i.platform&&i.platform!==r.platform)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime artifact platform ${i.platform} does not match ${r.platform}.`);if(r?.arch&&"universal"!==i.arch&&i.arch!==r.arch)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime artifact architecture ${i.arch} does not match ${r.arch}.`);if(void 0!==r?.launcherAbi&&i.launcherAbi>r.launcherAbi)throw new Li("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Runtime requires launcher ABI ${i.launcherAbi}, but the base runtime provides ${r.launcherAbi}.`);const o=function(e,t){if(!e||e.includes("\\")||n.posix.isAbsolute(e))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`${t} must be a non-empty POSIX relative path.`);const r=n.posix.normalize(e);if("."===r||".."===r||r.startsWith("../"))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`${t} escapes the runtime root.`);return r}(i.entrypoint,"Runtime entrypoint"),s=await y.lstat(n.join(e,...o.split("/"))).catch(()=>{});if(!s?.isFile())throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime entrypoint is missing: ${o}`);const a=await Fi(e);if(a!==i.sha256)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload SHA-256 mismatch: expected ${i.sha256}, got ${a}.`);return i}(i,t,{platform:t.platform,arch:t.arch})}finally{await y.rm(i,{recursive:!0,force:!0})}}}async function Bi(e,t,r,i=fetch){if("linux"!==t||!["x64","arm64"].includes(r))throw new Li("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Managed controlled-instance updates require a Linux x64 or arm64 target, received ${t}/${r}.`);const o=await async function(e){const t=`controlled-instance-runtime-${e}-linux-universal`,r=function(){const e=process.env.TASK_HANDOFF_BUNDLED_RUNTIME_DIR?.trim();return n.resolve(e||n.join(n.dirname(process.argv[1]||process.cwd()),"..","runtime-artifacts"))}();try{const[i,o]=await Promise.all([y.readFile(n.join(r,`${t}.manifest.json`),"utf8"),y.readFile(n.join(r,`${t}.tar.gz.sha256`),"utf8")]),s=Gt.safeParse(JSON.parse(i));if(!s.success||s.data.version!==e||"linux"!==s.data.platform||"universal"!==s.data.arch)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Bundled controlled-instance ${e} has an invalid Linux manifest.`);const a=o.trim().split(/\s+/)[0]?.toLowerCase();if(!a||!/^[a-f0-9]{64}$/.test(a))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Bundled controlled-instance ${e} has an invalid archive checksum.`);return{identity:s.data,source:{archivePath:n.join(r,`${t}.tar.gz`),archiveSha256:a}}}catch(t){if("ENOENT"===t.code)return;if(t instanceof Li)throw t;throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Could not read bundled controlled-instance ${e}.`,{cause:t})}}(e);if(o)return o;const s=`controlled-instance-runtime-${e}-linux-universal`,a=function(e){const t=process.env.TASK_HANDOFF_RUNTIME_RELEASE_BASE_URL?.trim();return t?t.replaceAll("{version}",e).replace(/\/$/,""):`https://github.com/edgestorage/task-handoff/releases/download/v${e}`}(e),c=`${a}/${s}.manifest.json`,d=`${a}/${s}.tar.gz`,l=`${a}/${s}.tar.gz.sha256`,[u,m]=await Promise.all([i(c),i(l)]).catch(t=>{throw new Li("INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE",`Could not read release metadata for controlled-instance ${e}.`,{cause:t,retryable:!0})});if(!u.ok||!m.ok)throw new Li("INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE",`Release metadata for controlled-instance ${e} is unavailable (manifest HTTP ${u.status}, checksum HTTP ${m.status}).`,{retryable:u.status>=500||m.status>=500});let p;try{p=await u.json()}catch(t){throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Release manifest for controlled-instance ${e} is not valid JSON.`,{cause:t})}const g=Gt.safeParse(p);if(!g.success)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Release manifest for controlled-instance ${e} is invalid: ${g.error.message}`);if(g.data.version!==e||"linux"!==g.data.platform||"universal"!==g.data.arch)throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Release identity mismatch: requested ${e}-linux-universal, received ${g.data.version}-${g.data.platform}-${g.data.arch}.`);const h=(await m.text()).trim().split(/\s+/)[0]?.toLowerCase();if(!h||!/^[a-f0-9]{64}$/.test(h))throw new Li("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Release checksum for controlled-instance ${e} is invalid.`);return{identity:g.data,source:{archiveUrl:d,archiveSha256:h}}}class Ki{store;desiredVersion;hooks;inFlight=new Map;requests=new Map;cancelled=new Set;now;delay;drainTimeoutMs;verificationTimeoutMs;pollIntervalMs;maxAttempts;retryBaseDelayMs;retryMaxDelayMs;constructor(e,t,n,r={}){this.store=e,this.desiredVersion=t,this.hooks=n,this.now=r.now||(()=>new Date),this.delay=r.delay||(e=>new Promise(t=>setTimeout(t,e))),this.drainTimeoutMs=r.drainTimeoutMs??3e5,this.verificationTimeoutMs=r.verificationTimeoutMs??6e4,this.pollIntervalMs=r.pollIntervalMs??250,this.maxAttempts=function(e){if(!Number.isInteger(e)||e<=0)throw new TypeError("maxAttempts must be a positive integer.");return e}(r.maxAttempts??3),this.retryBaseDelayMs=eo(r.retryBaseDelayMs??1e3,"retryBaseDelayMs"),this.retryMaxDelayMs=eo(r.retryMaxDelayMs??3e4,"retryMaxDelayMs")}schedule(e,t={}){const n=this.requests.get(e)||{startRequested:!1,resumeCancelled:!1};n.startRequested||=!0===t.startRequested,n.resumeCancelled||=!0===t.resumeCancelled||!0===t.startRequested,n.resumeCancelled&&this.cancelled.delete(e),this.requests.set(e,n);const r=this.inFlight.get(e);if(r)return r;const i=Promise.resolve().then(()=>this.reconcile(e,n)).finally(()=>{this.inFlight.delete(e),this.requests.delete(e)});return this.inFlight.set(e,i),i}isRunning(e){return this.inFlight.has(e)}cancel(e){return this.cancelled.add(e),this.inFlight.get(e)}async reconcile(e,t){let n=this.requireInstance(e);const r=this.desiredVersion();if(this.cancelled.has(e)&&!t.resumeCancelled)return this.storePhase(n,"pending");const i=Gi(n),o=i===r&&(await(this.hooks.isInstalled?.(n,r))??!0);if(this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");if(i===r&&o)return this.storeState(n,{desiredVersion:r,actualVersion:i,phase:"matched",attempt:n.runtimeVersion?.attempt||0,matchedAt:this.timestamp()},!Wi(n)&&"failed"!==n.health);const s=n.runtimeVersion?.desiredVersion===r;if(s&&"failed"===n.runtimeVersion?.phase)return n;if(s&&(n.runtimeVersion?.attempt||0)>=this.maxAttempts)return"failed"===n.runtimeVersion?.phase&&n.runtimeVersion.error?n:this.storeBatchFailure(n,r,Zi(r,i,this.maxAttempts,n.runtimeVersion?.error));if(n=this.storeState(n,function(e,t,n,r=!1){const i=e.runtimeVersion,o=i?.desiredVersion===t&&"matched"!==i.phase;return{desiredVersion:t,...n?{actualVersion:n}:{},phase:"pending",attempt:o?i.attempt:0,error:(o?i.error:void 0)||(n!==t||r?Yi(t,n):Xi("INSTANCE_RUNTIME_VERIFICATION_FAILED",`Controlled-instance ${t} is running, but the active runtime artifact does not match the desired release identity.`,t,n,!0))}}(n,r,i,o)),Wi(n)&&!t.startRequested)return n;let a=!1;try{for(;(n.runtimeVersion?.attempt||0)<this.maxAttempts;){if(this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");let i;try{if(n=this.storePhase(n,"draining"),await(this.hooks.beginDrain?.(n)),a=!0,n=this.requireInstance(e),Ji(n)){const t=await this.waitUntil(e,this.drainTimeoutMs,e=>!Ji(e));if(n=this.requireInstance(e),!t){if(this.cancelled.has(e))return this.storePhase(n,"pending");await(this.hooks.onForcedDrain?.(n))}}if(n=this.storePhase(this.requireInstance(e),"installing",!0),await this.hooks.install(n,r),this.cancelled.has(e)||Wi(this.requireInstance(e))&&!t.startRequested)return this.storePhase(this.requireInstance(e),"pending");if(n=this.storePhase(this.requireInstance(e),"restarting"),await this.hooks.restart(n),this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");n=this.storePhase(this.requireInstance(e),"verifying");const i=await this.waitUntil(e,this.verificationTimeoutMs,e=>Gi(e)===r);if(this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");if(!i)throw Xi("INSTANCE_RUNTIME_VERIFICATION_FAILED",`Instance ${e} did not register controlled-instance ${r} after restart.`,r,Gi(this.requireInstance(e)),!0);const o=this.requireInstance(e);if(this.hooks.isInstalled&&!await this.hooks.isInstalled(o,r))throw Xi("INSTANCE_RUNTIME_VERIFICATION_FAILED",`Instance ${e} reported controlled-instance ${r}, but its active runtime release is missing.`,r,Gi(o),!0);return this.storeState(o,{desiredVersion:r,actualVersion:r,phase:"matched",attempt:o.runtimeVersion?.attempt||1,matchedAt:this.timestamp()},!Wi(o)&&"failed"!==o.health)}catch(t){if(this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");i=Qi(t,r,Gi(this.store.get(e)))}n=this.requireInstance(e);const o=n.runtimeVersion?.attempt||1;if(!i.retryable||o>=this.maxAttempts)return this.storeBatchFailure(n,r,o>=this.maxAttempts&&i.retryable?Zi(r,Gi(n),this.maxAttempts,i):i);n=this.storeState(n,{desiredVersion:r,...Gi(n)?{actualVersion:Gi(n)}:{},phase:"pending",attempt:o,lastAttemptAt:this.timestamp(),error:i}),await this.delay(this.retryDelayMs(o))}return this.storeBatchFailure(n,r,Zi(r,Gi(n),this.maxAttempts,n.runtimeVersion?.error))}finally{a&&await(this.hooks.endDrain?.(this.requireInstance(e)))}}storeBatchFailure(e,t,n){const r=Gi(e);return this.storeState(e,{desiredVersion:t,...r?{actualVersion:r}:{},phase:"failed",attempt:e.runtimeVersion?.attempt||0,lastAttemptAt:this.timestamp(),error:n})}retryDelayMs(e){return Math.min(this.retryMaxDelayMs,this.retryBaseDelayMs*2**Math.max(0,e-1))}storePhase(e,t,n=!1){const r=this.desiredVersion(),i=Gi(e),o=e.runtimeVersion?.desiredVersion===r?e.runtimeVersion.error:void 0;return this.storeState(e,{desiredVersion:r,...i?{actualVersion:i}:{},phase:t,attempt:(e.runtimeVersion?.attempt||0)+(n?1:0),lastAttemptAt:this.timestamp(),...o?{error:o}:"pending"===t?{error:Yi(r,i)}:{}},"restarting"!==t&&void 0)}storeState(e,t,n){const r=this.store.get(e.id)||e;return this.store.put(nr.parse({...r,runtimeVersion:t,...void 0===n?{}:{ready:n},updatedAt:this.timestamp()}))}async waitUntil(e,t,n){const r=this.now().getTime()+t;for(;;){const t=this.store.get(e);if(t&&n(t))return!0;if(this.cancelled.has(e))return!1;if(this.now().getTime()>=r)return!1;await this.delay(Math.min(this.pollIntervalMs,Math.max(0,r-this.now().getTime())))}}requireInstance(e){const t=this.store.get(e);if(!t)throw new Error(`Instance ${e} was removed during runtime reconciliation.`);return t}timestamp(){return this.now().toISOString()}}function Gi(e){return e?.build?.packageVersion||e?.instanceVersion}function Ji(e){return e.apps.runningCount>0||e.aiSessions.runningCount>0}function Wi(e){return["created","stopped","failed"].includes(e.status)}function Yi(e,t){return Xi("INSTANCE_RUNTIME_VERSION_MISMATCH",`Expected controlled-instance ${e}, received ${t||"an unknown version"}.`,e,t,!0)}function Xi(e,t,n,r,i){return{code:e,message:t,expectedVersion:n,...r?{actualVersion:r}:{},retryable:i}}function Qi(e,t,n){if(e&&"object"==typeof e&&"code"in e&&"message"in e){const r=e,i=Jt.shape.code.safeParse(r.code);if(i.success&&"string"==typeof r.message)return Xi(i.data,r.message,t,n,"boolean"!=typeof r.retryable||r.retryable)}return Xi("INSTANCE_RUNTIME_INSTALL_FAILED",e instanceof Error?e.message:String(e),t,n,!0)}function Zi(e,t,n,r){const i=r?.message?` Last error: ${r.message}`:"";return Xi(r?.code||"INSTANCE_RUNTIME_INSTALL_FAILED",`Runtime convergence stopped after ${n} attempts for this instance run.${i}`,e,t,!0)}function eo(e,t){if(!Number.isFinite(e)||e<0)throw new TypeError(`${t} must be a nonnegative finite number.`);return e}const to=m.z.record(m.z.string(),m.z.string()),no=new Set(["OPENAI_API_KEY","OPENAI_BASE_URL","CODEX_MODEL","TASK_HANDOFF_CODEX_BASE_URL","TASK_HANDOFF_CODEX_MODEL","TASK_HANDOFF_CODEX_MODEL_ID","ANTHROPIC_API_KEY","ANTHROPIC_BASE_URL","CLAUDE_MODEL","TASK_HANDOFF_CLAUDE_MODEL","TASK_HANDOFF_CLAUDE_MODEL_ID"]);class ro{directory;constructor(e){this.directory=e}get(e){try{return to.parse(JSON.parse(t.readFileSync(this.filePath(e),"utf8")))}catch(t){if(t&&"object"==typeof t&&"code"in t&&"ENOENT"===t.code)return{};throw new Error(`Stored model environment for instance ${e} is invalid: ${t instanceof Error?t.message:String(t)}`)}}has(e){return t.existsSync(this.filePath(e))}listInstanceIds(){return t.existsSync(this.directory)?t.readdirSync(this.directory).filter(e=>e.endsWith(".json")).map(e=>e.slice(0,-5)).sort():[]}put(e,n){const r=to.parse(n);t.mkdirSync(this.directory,{recursive:!0,mode:448});const i=this.filePath(e);return h.sync(i,`${JSON.stringify(r,null,2)}\n`,{encoding:"utf8",mode:384}),t.chmodSync(i,384),r}delete(e){t.rmSync(this.filePath(e),{force:!0})}filePath(e){return n.join(this.directory,`${e}.json`)}}class io{directory;nodeId;constructor(e,t){this.directory=e,this.nodeId=t}init(){t.mkdirSync(this.directory,{recursive:!0,mode:448}),t.chmodSync(this.directory,448)}list(){return this.init(),t.readdirSync(this.directory).filter(e=>e.endsWith(".json")).sort().flatMap(e=>{const t=this.read(n.join(this.directory,e));return t?[t]:[]})}get(e){const n=this.filePath(e);return t.existsSync(n)?this.read(n):void 0}put(e){const n=mn.parse(e);this.init();const r=this.filePath(n.id);return h.sync(r,`${JSON.stringify(n,null,2)}\n`,{encoding:"utf8",mode:384}),t.chmodSync(r,384),n}delete(e){const n=this.filePath(e);return!!t.existsSync(n)&&(t.unlinkSync(n),!0)}read(e){try{const r=JSON.parse(t.readFileSync(e,"utf8")),i=n.basename(e,".json"),o=mn.safeParse(r);if(o.success&&o.data.id===i&&zn(o.data)===o.data.id)return o.data;const s=mn.strip().safeParse(r);return s.success&&s.data.id===i&&zn(s.data)===s.data.id?(console.warn(JSON.stringify({message:"unknown stored node model fields were ignored",nodeId:this.nodeId,filePath:e})),s.data):void console.warn(JSON.stringify({message:"stored node model failed validation and was isolated",nodeId:this.nodeId,filePath:e}))}catch(t){return void console.warn(JSON.stringify({message:"stored node model could not be read",nodeId:this.nodeId,filePath:e,error:t instanceof Error?t.message:String(t)}))}}filePath(e){return n.join(this.directory,`${e}.json`)}}class oo{directory;constructor(e){this.directory=e}init(){t.mkdirSync(this.directory,{recursive:!0,mode:448}),t.chmodSync(this.directory,448)}get(e){const n=this.filePath(e);if(t.existsSync(n))try{const r=JSON.parse(t.readFileSync(n,"utf8")),i=hn.safeParse(r);if(i.success)return i.data;const o=hn.strip().safeParse(r);if(o.success)return console.warn(JSON.stringify({message:"unknown stored model assignment fields were ignored",instanceId:e,filePath:n})),o.data;throw i.error}catch(t){throw Object.assign(new Error(`Stored model assignment for instance ${e} is invalid.`),{statusCode:409,code:"NODE_MODEL_ASSIGNMENT_INVALID",cause:t})}}put(e){const n=hn.parse(e);this.init();const r=this.filePath(n.instanceId);return h.sync(r,`${JSON.stringify(n,null,2)}\n`,{encoding:"utf8",mode:384}),t.chmodSync(r,384),n}delete(e){t.rmSync(this.filePath(e),{force:!0})}filePath(e){return n.join(this.directory,`${e}.json`)}}const so="TASK_HANDOFF_NODE_AGENT_V1",ao="/api/node-tunnel";function co(e=""){return r.createHash("sha256").update(e).digest("hex")}function lo(e,t){return r.createHmac("sha256",e).update(function(e){return[so,e.keyId,e.method.toUpperCase(),e.pathWithQuery,e.timestamp,e.nonce,e.bodySha256].join("\n")}(t)).digest("hex")}function uo(e){const t=e.timestamp||(new Date).toISOString(),n=e.nonce||r.randomBytes(18).toString("base64url"),i=co(e.body||""),o=lo(e.secret,{keyId:e.keyId,method:e.method,pathWithQuery:e.pathWithQuery,timestamp:t,nonce:n,bodySha256:i});return{"x-taskhandoff-node-id":e.nodeId,"x-taskhandoff-key-id":e.keyId,"x-taskhandoff-timestamp":t,"x-taskhandoff-nonce":n,"x-taskhandoff-body-sha256":i,"x-taskhandoff-signature":o}}class mo{usedNonces=new Map;identity;nodeId;overrideSecret;overrideKeyId;nowMs;constructor(e,t,n,r,i=Date.now){this.identity=e,this.nodeId=t,this.overrideSecret=n,this.overrideKeyId=r,this.nowMs=i}hasRemoteSecrets(){return this.identity.remoteSecrets(this.overrideSecret,this.overrideKeyId).length>0}verify(e){const t=function(e){const t=new Map;for(const[n,r]of Object.entries(e)){const e=Array.isArray(r)?r.join(","):"string"==typeof r?r:void 0===r?"":String(r);t.set(n.toLowerCase(),e)}return{nodeId:t.get("x-taskhandoff-node-id")||"",keyId:t.get("x-taskhandoff-key-id")||"",timestamp:t.get("x-taskhandoff-timestamp")||"",nonce:t.get("x-taskhandoff-nonce")||"",bodySha256:t.get("x-taskhandoff-body-sha256")||"",signature:t.get("x-taskhandoff-signature")||""}}(e.headers);if(!t.nodeId&&!t.signature)return!1;const n=this.identity.remoteSecrets(this.overrideSecret,this.overrideKeyId);if(!n.length)return!1;if(t.nodeId!==this.nodeId)throw Object.assign(new Error("Invalid node agent HMAC node id."),{statusCode:401,code:"NODE_AGENT_HMAC_NODE_MISMATCH"});if(!t.keyId)throw Object.assign(new Error("Node agent HMAC key id is missing."),{statusCode:401,code:"NODE_AGENT_HMAC_KEY_MISSING"});const i=n.filter(e=>t.keyId===e.keyId);if(!i.length)throw Object.assign(new Error("Invalid node agent HMAC key id."),{statusCode:401,code:"NODE_AGENT_HMAC_KEY_INVALID"});const o=Date.parse(t.timestamp);if(!Number.isFinite(o)||Math.abs(this.nowMs()-o)>6e4)throw Object.assign(new Error("Node agent HMAC timestamp is outside the allowed window."),{statusCode:401,code:"NODE_AGENT_HMAC_TIMESTAMP_INVALID"});if(!t.nonce)throw Object.assign(new Error("Node agent HMAC nonce is missing."),{statusCode:401,code:"NODE_AGENT_HMAC_NONCE_MISSING"});this.pruneNonces();const s=`${t.nodeId}:${t.keyId}:${t.nonce}`;if(this.usedNonces.has(s))throw Object.assign(new Error("Node agent HMAC nonce was already used."),{statusCode:401,code:"NODE_AGENT_HMAC_NONCE_REPLAY"});const a=co(null==(c=e.body)?"":"string"==typeof c||Buffer.isBuffer(c)?c:JSON.stringify(c));var c;if(t.bodySha256!==a)throw Object.assign(new Error("Node agent HMAC body hash mismatch."),{statusCode:401,code:"NODE_AGENT_HMAC_BODY_HASH_INVALID"});if(!i.some(n=>function(e,t){const n=Buffer.from(e,"hex"),i=Buffer.from(t,"hex");return n.length===i.length&&r.timingSafeEqual(n,i)}(t.signature,lo(n.secret,{keyId:t.keyId,method:e.method,pathWithQuery:e.url,timestamp:t.timestamp,nonce:t.nonce,bodySha256:a}))))throw Object.assign(new Error("Invalid node agent HMAC signature."),{statusCode:401,code:"NODE_AGENT_HMAC_SIGNATURE_INVALID"});return this.usedNonces.set(s,o+6e4+1),t.keyId}pruneNonces(){const e=this.nowMs();for(const[t,n]of this.usedNonces)n<=e&&this.usedNonces.delete(t)}}const po=m.z.string().trim().min(1).max(160),go=m.z.string().datetime(),ho=m.z.string().min(1).max(4096),fo=m.z.string().trim().url().max(2048),yo=m.z.object({tokenHash:m.z.string().trim().min(1).max(256),expiresAt:go,createdAt:go,controlPlaneName:m.z.string().trim().min(1).max(160).optional()}).strip(),Io=m.z.object({id:po,keyId:po,name:m.z.string().trim().min(1).max(160).optional(),secret:ho,pairedAt:go,updatedAt:go}).strip(),Ao=m.z.object({id:po,pairingKeyId:po,name:m.z.string().trim().min(1).max(160).optional(),url:fo,enabled:m.z.boolean().default(!0),createdAt:go,updatedAt:go}).strip(),bo=m.z.object({controlPlaneName:m.z.string().trim().min(1).max(160).optional(),controlPlaneUrl:m.z.string().trim().max(2048).optional(),expiresInMs:m.z.number().int().positive().max(36e5).optional()}).strict(),wo=m.z.object({joinToken:m.z.string().trim().min(1).max(4096),controlPlaneId:m.z.string().trim().min(1).max(160).optional(),controlPlaneName:m.z.string().trim().min(1).max(160).optional()}).strict(),No=m.z.object({controlPlaneUrl:m.z.string().trim().url().max(2048),joinToken:m.z.string().trim().min(1).max(4096),controlPlaneName:m.z.string().trim().min(1).max(160).optional(),activate:m.z.boolean().optional()}).strict();function zo(){return(new Date).toISOString()}const vo=new Set(["nodeId","createdAt","updatedAt","pairingInvites","controlPlanePairings","controlPlaneConnections","remoteControlPlanes"]),Eo=new Set(["tokenHash","expiresAt","createdAt","controlPlaneName"]),So=new Set(["id","keyId","name","secret","pairedAt","updatedAt"]),_o=new Set(["id","pairingKeyId","name","url","enabled","createdAt","updatedAt"]),To=new Set(["id","keyId","name","url","secret","pairedAt","updatedAt","active"]);function ko(e,t){console.warn(JSON.stringify({message:e,...t}))}function Co(e,t){return Object.assign(new Error(e,void 0===t?void 0:{cause:t}),{code:"NODE_AGENT_IDENTITY_INVALID"})}function Oo(e,t){return Object.keys(e).filter(e=>!t.has(e))}function xo(e,t,n){const r=go.safeParse(e);return r.success?r.data:(n("invalid node agent identity timestamp was replaced",{field:t}),zo())}function Ro(e,t){if(!e||"object"!=typeof e||Array.isArray(e))throw Co("Node agent identity must be a JSON object.");const n=e,r=po.safeParse(n.nodeId);if(!r.success)throw Co("Node agent identity has an invalid nodeId.",r.error);const i=r.data,o=Oo(n,vo);o.length&&t("unknown node agent identity fields were ignored",{fields:o});const s=Array.isArray(n.remoteControlPlanes)?n.remoteControlPlanes.flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const n=e,r=Oo(n,To);r.length&&t("unknown legacy node agent remote control-plane fields were ignored",{fields:r});const i=Io.safeParse(n);if(!i.success)return t("invalid legacy node agent control-plane pairing was ignored",{issues:i.error.issues}),[];const o=n.url?Ao.safeParse({id:`connection_${i.data.keyId}`,pairingKeyId:i.data.keyId,name:n.name,url:n.url,enabled:!1!==n.active,createdAt:i.data.pairedAt,updatedAt:i.data.updatedAt}):void 0;return[{pairing:i.data,...o?.success?{connection:o.data}:{}}]}):[],a=(e,n,r,i)=>Array.isArray(e)?e.flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return t(`invalid node agent ${i} was ignored`,{}),[];const o=Oo(e,n);o.length&&t(`unknown node agent ${i} fields were ignored`,{fields:o});const s=r.safeParse(e);return s.success?[s.data]:(t(`invalid node agent ${i} was ignored`,{issues:s.error.issues}),[])}):[];return{nodeId:i,createdAt:xo(n.createdAt,"createdAt",t),updatedAt:xo(n.updatedAt,"updatedAt",t),pairingInvites:Array.isArray(n.pairingInvites)?n.pairingInvites.flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return t("invalid node agent pairing invite was ignored",{}),[];const n=Oo(e,Eo);n.length&&t("unknown node agent pairing invite fields were ignored",{fields:n});const r=yo.safeParse(e);return r.success?[r.data]:(t("invalid node agent pairing invite was ignored",{issues:r.error.issues}),[])}):[],controlPlanePairings:n.controlPlanePairings?a(n.controlPlanePairings,So,Io,"control-plane pairing"):s.map(e=>e.pairing),controlPlaneConnections:n.controlPlaneConnections?a(n.controlPlaneConnections,_o,Ao,"control-plane connection"):s.flatMap(e=>e.connection?[e.connection]:[])}}class Do{paths;logger;constructor(e,t={}){this.paths=e,this.logger=t.logger||ko}read(){let e,n;try{e=t.readFileSync(this.paths.identityPath,"utf8")}catch(e){if("ENOENT"===e.code)return;throw Object.assign(new Error(`Node agent identity could not be read: ${this.paths.identityPath}`,{cause:e}),{code:"NODE_AGENT_IDENTITY_READ_FAILED"})}try{n=JSON.parse(e)}catch(e){throw Co(`Node agent identity contains invalid JSON: ${this.paths.identityPath}`,e)}return Ro(n,this.logger)}write(e){t.mkdirSync(n.dirname(this.paths.identityPath),{recursive:!0});const r=Ro({...e,updatedAt:zo()},this.logger);h.sync(this.paths.identityPath,`${JSON.stringify(r,null,2)}\n`,{encoding:"utf8",mode:384})}}function Po(){return(new Date).toISOString()}class jo{store;controlPlaneConnectionOperations=new Map;constructor(e){this.store=new Do(e)}async runControlPlaneConnectionOperation(e,t){const n=e.replace(/\/$/,""),r=this.controlPlaneConnectionOperations.get(n)||Promise.resolve();let i;const o=new Promise(e=>{i=e});this.controlPlaneConnectionOperations.set(n,o),await r;try{return await t()}finally{i(),this.controlPlaneConnectionOperations.get(n)===o&&this.controlPlaneConnectionOperations.delete(n)}}resolveNodeId(e){if(e?.trim())return this.writeNodeId(e.trim()),e.trim();const t=this.store.read();if(t?.nodeId)return t.nodeId;const n=zi("node");return this.writeNodeId(n),n}createPairingInvite(e){const t=this.prunePairingInvites(this.store.read()||this.newIdentity()),n=Po(),r=new Date(Date.now()+(e.expiresInMs||6e5)).toISOString(),i=vi(),o={tokenHash:co(i),createdAt:n,expiresAt:r,...e.controlPlaneName?{controlPlaneName:e.controlPlaneName}:{}};return this.store.write({...t,pairingInvites:[...t.pairingInvites||[],o]}),{...o,token:i}}completePairingInvite(e){const t=this.prunePairingInvites(this.store.read()||this.newIdentity()),n=co(e.joinToken),r=(t.pairingInvites||[]).find(e=>e.tokenHash===n);if(!r){const e=new Error("Node agent pairing invite is invalid or expired.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_PAIRING_INVITE_INVALID"}),e}const i=Po(),o={id:e.controlPlaneId||zi("cp"),keyId:zi("key"),...e.controlPlaneName||r.controlPlaneName?{name:e.controlPlaneName||r.controlPlaneName}:{},secret:vi(),pairedAt:i,updatedAt:i};return this.store.write({...t,pairingInvites:(t.pairingInvites||[]).filter(e=>e.tokenHash!==n),controlPlanePairings:[...(t.controlPlanePairings||[]).filter(e=>e.id!==o.id),o]}),o}stageControlPlaneConnection(e){const{pairing:t,connection:n}=this.createControlPlaneConnection(e),r=this.store.read()||this.newIdentity(),i=n.url.replace(/\/$/,""),o=(r.controlPlaneConnections||[]).filter(e=>e.id===n.id||e.url.replace(/\/$/,"")===i);return this.store.write({...r,controlPlanePairings:[...(r.controlPlanePairings||[]).filter(e=>e.keyId!==t.keyId),t],controlPlaneConnections:[...(r.controlPlaneConnections||[]).filter(e=>e.id!==n.id&&e.url.replace(/\/$/,"")!==i),n]}),{pairing:t,connection:n,replacedConnections:o}}commitControlPlaneConnection(e,t={}){const n=this.store.read()||this.newIdentity(),r={...e.pairing,...t.name?{name:t.name}:{}},i={...e.connection,...t.name?{name:t.name}:{}},o=new Set((n.controlPlaneConnections||[]).map(e=>e.pairingKeyId)),s=new Set(e.replacedConnections.map(e=>e.pairingKeyId));return this.store.write({...n,controlPlanePairings:[...(n.controlPlanePairings||[]).filter(e=>e.keyId!==r.keyId&&(!s.has(e.keyId)||o.has(e.keyId))),r],controlPlaneConnections:[...(n.controlPlaneConnections||[]).filter(e=>e.id!==i.id),i]}),{pairing:r,connection:i}}rollbackControlPlaneConnection(e){const t=this.store.read();if(!t)return;const n=new Set(e.replacedConnections.map(e=>e.id));this.store.write({...t,controlPlanePairings:(t.controlPlanePairings||[]).filter(t=>t.keyId!==e.pairing.keyId),controlPlaneConnections:[...(t.controlPlaneConnections||[]).filter(t=>t.id!==e.connection.id&&!n.has(t.id)),...e.replacedConnections]})}createControlPlaneConnection(e){const t=Po(),n={id:zi("cp"),keyId:zi("key"),...e.name?{name:e.name}:{},secret:vi(),pairedAt:t,updatedAt:t};return{pairing:n,connection:{id:zi("connection"),pairingKeyId:n.keyId,...e.name?{name:e.name}:{},url:e.url,enabled:!1!==e.enabled,createdAt:t,updatedAt:t}}}resolvedControlPlaneAccess(){const e=this.store.read(),t=new Map((e?.controlPlanePairings||[]).map(e=>[e.keyId,e])),n=e?.controlPlaneConnections||[];return{hasPersistedAccess:n.length>0||t.size>0,connections:n.map(e=>({connection:e,pairing:t.get(e.pairingKeyId)}))}}listControlPlanePairings(e=""){return(this.store.read()?.controlPlanePairings||[]).map(({secret:t,...n})=>({...n,current:Boolean(e&&n.keyId===e)})).sort((e,t)=>Number(t.current)-Number(e.current)||t.updatedAt.localeCompare(e.updatedAt))}listControlPlaneConnections(){return[...this.store.read()?.controlPlaneConnections||[]].sort((e,t)=>t.updatedAt.localeCompare(e.updatedAt))}deleteControlPlanePairing(e,t=""){if(t&&e===t){const e=new Error("Cannot delete the pairing used to authenticate the current request.");throw Object.assign(e,{statusCode:409,code:"NODE_AGENT_PAIRING_CURRENT_REQUEST"}),e}const n=this.store.read();if(!n)return!1;if((n.controlPlaneConnections||[]).some(t=>t.pairingKeyId===e))throw Object.assign(new Error("Cannot delete a pairing used by a configured control-plane connection."),{statusCode:409,code:"NODE_AGENT_PAIRING_IN_USE"});const r=(n.controlPlanePairings||[]).filter(t=>t.keyId!==e);return r.length!==(n.controlPlanePairings||[]).length&&(this.store.write({...n,controlPlanePairings:r}),!0)}deleteControlPlaneConnection(e){const t=this.store.read();if(!t)return!1;const n=(t.controlPlaneConnections||[]).filter(t=>t.id!==e);return n.length!==(t.controlPlaneConnections||[]).length&&(this.store.write({...t,controlPlaneConnections:n}),!0)}remoteSecrets(e,t){return[...(this.store.read()?.controlPlanePairings||[]).map(e=>({keyId:e.keyId,secret:e.secret})),...e&&t?[{keyId:t,secret:e}]:[]]}reverseTunnelSecret(e,t,n){if(t&&n)return{keyId:n,secret:t};const r=this.store.read(),i=r?.controlPlanePairings||[];if(!i.length)return;if(e){const t=e.replace(/\/$/,""),n=(r?.controlPlaneConnections||[]).find(e=>e.url.replace(/\/$/,"")===t),o=n&&i.find(e=>e.keyId===n.pairingKeyId);if(o)return{keyId:o.keyId,secret:o.secret}}const o=[...i].sort((e,t)=>t.updatedAt.localeCompare(e.updatedAt))[0];return o?{keyId:o.keyId,secret:o.secret}:void 0}newIdentity(){return{nodeId:this.resolveNodeId(),createdAt:Po(),updatedAt:Po(),pairingInvites:[],controlPlanePairings:[],controlPlaneConnections:[]}}writeNodeId(e){const t=this.store.read();this.store.write({...t||{createdAt:Po()},nodeId:e,updatedAt:Po(),pairingInvites:t?.pairingInvites||[],controlPlanePairings:t?.controlPlanePairings||[],controlPlaneConnections:t?.controlPlaneConnections||[]})}prunePairingInvites(e){const t=Date.now();return{...e,pairingInvites:(e.pairingInvites||[]).filter(e=>Date.parse(e.expiresAt)>t)}}}function Mo(e){return e.readyState===(e.OPEN??1)}function Lo(e){const t=Buffer.isBuffer(e)?e.toString("utf8"):"string"==typeof e?e:"";if(Buffer.byteLength(t,"utf8")<=123)return t;let n="";for(const e of t){const t=`${n}${e}`;if(Buffer.byteLength(t,"utf8")>123)break;n=t}return n}function $o(e){if("number"==typeof e&&Number.isInteger(e))return e>=3e3&&e<=4999||e>=1e3&&e<=1014&&1004!==e&&1005!==e&&1006!==e?e:void 0}function Fo(e,t,n){e.close($o(t),Lo(n)||void 0)}function Uo(e,t,n,r){if(Mo(e))for(const e of t.splice(0))if(r(e),!n(e))return}function Vo(e,t){const n=new URL(t.tunnelUrl);n.searchParams.set("nodeId",t.nodeId);const r=t.secret?uo({nodeId:t.nodeId,keyId:t.keyId,secret:t.secret,method:"GET",pathWithQuery:`${n.pathname}${n.search}`}):{},i=new u(n,{headers:r}),o=new Map,s=new Map,a=new Map;let c;i.on("error",r=>{e.log.warn({nodeId:t.nodeId,tunnelUrl:`${n.origin}${n.pathname}`,error:r instanceof Error?r.message:String(r)},"node agent reverse tunnel connection failed")});const d=e=>{const n=e.startsWith("/")?e:`/${e}`,r="function"==typeof t.port?t.port():t.port,i=new URL(`/api/node-agent${n}`,`http://127.0.0.1:${r}`);return i.protocol="ws:",i},l=(e,n,r,i={})=>{const o=e.startsWith("/")?e:`/${e}`;return{...i,...t.secret&&t.keyId?uo({nodeId:t.nodeId,keyId:t.keyId,secret:t.secret,method:n,pathWithQuery:`/api/node-agent${o}`,body:r}):t.token?{authorization:`Bearer ${t.token}`}:{}}},m=e=>t.secret?uo({nodeId:t.nodeId,keyId:t.keyId,secret:t.secret,method:"GET",pathWithQuery:`${e.pathname}${e.search}`}):{},p=(e,t,n)=>{const r=o.get(e);o.delete(e),r?.upstream&&Fo(r.upstream,t,n),r?.tunnel&&Fo(r.tunnel,t,n)},g=(e,t,n=!1)=>new Promise((r,i)=>{e.send(t,{binary:n},e=>e?i(e):r())});i.on("open",()=>{i.send(JSON.stringify({type:"node-agent.identify",nodeId:t.nodeId,serverTime:(new Date).toISOString()})),c=e.nodeAgentEventForwarder?.addOutput(i)}),i.on("close",()=>{for(const e of o.keys())p(e,1001,"Reverse tunnel disconnected.");for(const[e,t]of s)s.delete(e),t.controller.abort(),Fo(t.tunnel,1001,"Reverse tunnel disconnected.");for(const[e,t]of a)a.delete(e),t.abort();c?.(),c=void 0});return i.on("message",r=>{(async r=>{let c;try{c=JSON.parse(String(r))}catch{return void i.send(JSON.stringify({type:"node-agent.error",code:"INVALID_JSON"}))}const h=c&&"object"==typeof c?c:{};if("control-plane.http.open"===h.type){const r="string"==typeof h.streamId?h.streamId:"",o="string"==typeof h.route&&h.route.startsWith("/")?h.route:"/health",a=h.init&&"object"==typeof h.init?h.init:{},c=a.headers&&"object"==typeof a.headers?a.headers:{},d=ki(a.method);let p;try{p=mt(a.body)}catch(n){return e.log.warn({nodeId:t.nodeId,messageType:h.type,streamId:r,error:n instanceof Error?n.message:String(n)},"node agent reverse tunnel request body rejected"),void i.send(JSON.stringify({type:"node-agent.error",code:"NODE_TUNNEL_REQUEST_BODY_INVALID",streamId:r}))}const f=new AbortController,y=(e=>{const t=new URL(n);return t.pathname=`${t.pathname.replace(/\/$/,"")}/http-streams/${encodeURIComponent(e)}`,t})(r),I=new u(y,{headers:m(y)});return s.set(r,{tunnel:I,controller:f}),I.on("open",async()=>{try{const e=await fetch((e=>{const n=e.startsWith("/")?e:`/${e}`,r="function"==typeof t.port?t.port():t.port;return new URL(`/api/node-agent${n}`,`http://127.0.0.1:${r}`)})(o),{method:d,headers:l(o,d,p,c),body:Buffer.isBuffer(p)?new Uint8Array(p):p,signal:f.signal});if(await g(I,JSON.stringify({type:"node-agent.http.head",streamId:r,status:e.status,headers:Object.fromEntries(e.headers.entries())})),e.body){const t=e.body.getReader();for(;;){const{done:e,value:n}=await t.read();if(e)break;await g(I,Buffer.from(n),!0)}}await g(I,JSON.stringify({type:"node-agent.http.end",streamId:r})),I.close(1e3,"HTTP stream completed.")}catch(e){I.readyState===u.OPEN&&(await g(I,JSON.stringify({type:"node-agent.http.error",streamId:r,message:e instanceof Error?e.message:String(e)})).catch(()=>{}),I.close(1011,"HTTP stream failed."))}finally{s.delete(r)}}),I.on("close",()=>{f.abort(),s.delete(r)}),void I.on("error",()=>f.abort())}if("control-plane.http.cancel"===h.type){const e="string"==typeof h.streamId?h.streamId:"",t=s.get(e);if(!t)return;return s.delete(e),t.controller.abort(),void Fo(t.tunnel,1e3,"string"==typeof h.reason?h.reason:"HTTP stream canceled.")}if("control-plane.websocket.open"===h.type){const e="string"==typeof h.streamId?h.streamId:"",t="string"==typeof h.route?h.route:"",r=Array.isArray(h.protocols)?h.protocols.filter(e=>"string"==typeof e):void 0;try{const s=l(t,"GET",void 0),a=r?.length?new u(d(t),r,{headers:s}):new u(d(t),{headers:s}),c=(e=>{const t=new URL(n);return t.pathname=`${t.pathname.replace(/\/$/,"")}/streams/${encodeURIComponent(e)}`,t})(e),p=new u(c,{headers:m(c)});o.set(e,{upstream:a,tunnel:p,close:(e=1e3,t="")=>{Fo(a,e,t),Fo(p,e,t)}}),a.on("open",()=>{i.send(JSON.stringify({type:"node-agent.websocket.open",streamId:e,protocol:a.protocol}))}),function(e,t,n={}){const r=n.pendingFrameLimit??256,i=n.maxFrameBytes??8388608,o=n.maxTotalBytes??1073741824,s=n.maxBufferedBytes??16777216;let a=!1,c=Mo(t);const d=[],l=[];let u,m=0,p=0,g=0;const h=e=>Buffer.isBuffer(e)||e instanceof ArrayBuffer||ArrayBuffer.isView(e)?e.byteLength:Buffer.byteLength("string"==typeof e?e:String(e),"utf8"),f=(r,s)=>{const a=h(s);return g+=a,n.onFrame?.(r,a),!(a>i||g>o)||(Fo(e,1009,"WebSocket bridge traffic limit exceeded."),Fo(t,1009,"WebSocket bridge traffic limit exceeded."),!1)},y=()=>{u&&(clearTimeout(u),u=void 0)},I=(n,r)=>{const i=r.bytes;if((n.bufferedAmount??0)+i>s)return Fo(e,1013,"WebSocket bridge consumer is too slow."),Fo(t,1013,"WebSocket bridge consumer is too slow."),!1;try{return function(e,t){e.send(t.data,{binary:t.isBinary})}(n,r),!0}catch{return Fo(e,1011,"WebSocket bridge send failed."),Fo(t,1011,"WebSocket bridge send failed."),!1}},A=(n,i,o)=>{if(i.length>=r)return Fo(e,1011,"WebSocket bridge pending frame limit exceeded."),void Fo(t,1011,"WebSocket bridge pending frame limit exceeded.");const a="upstream"===n?m:p;if((("upstream"===n?t:e).bufferedAmount??0)+a+o.bytes>s)return Fo(e,1013,"WebSocket bridge consumer is too slow."),void Fo(t,1013,"WebSocket bridge consumer is too slow.");i.push(o),"upstream"===n?m+=o.bytes:p+=o.bytes};n.upstreamOpenTimeoutMs&&!c&&(u=setTimeout(()=>{c||a||(Fo(e,1011,"Upstream websocket did not open."),Fo(t))},n.upstreamOpenTimeoutMs)),e.on("open",()=>Uo(e,l,t=>I(e,t),e=>{p-=e.bytes})),t.on("open",()=>{y(),c=!0,n.onUpstreamOpen?.(),Uo(t,d,e=>I(t,e),e=>{m-=e.bytes})}),e.on("message",(e,n=!1)=>{if(!f("client-to-upstream",e))return;const r={data:e,isBinary:Boolean(n),bytes:h(e)};Mo(t)?I(t,r):A("upstream",d,r)}),t.on("message",(t,n=!1)=>{if(!f("upstream-to-client",t))return;const r={data:t,isBinary:Boolean(n),bytes:h(t)};Mo(e)?I(e,r):A("client",l,r)}),t.on("close",(t,r)=>{y(),n.onUpstreamClose?.(t,r),(c||a||!n.onUpstreamCloseBeforeOpen?.())&&Fo(e,t,r)}),t.on("error",t=>{n.onUpstreamError?.(t),(c||a||!n.onUpstreamErrorBeforeOpen?.(t))&&Fo(e)}),e.on("close",(e,r)=>{y(),a=!0,n.onClientClose?.(e,r),Fo(t,e,r)}),e.on("error",e=>{y(),a=!0,n.onClientError?.(e),Fo(t,1011,"WebSocket bridge client failed.")})}(p,a,{pendingFrameLimit:256,upstreamOpenTimeoutMs:1e4,onClientClose:()=>{o.delete(e)},onClientError:t=>{o.delete(e),i.send(JSON.stringify({type:"node-agent.websocket.error",streamId:e,message:t instanceof Error?t.message:String(t)}))},onUpstreamClose:(t,n)=>{o.delete(e);const r=$o(t),s=Lo(n);i.send(JSON.stringify({type:"node-agent.websocket.close",streamId:e,...void 0===r?{}:{code:r},...s?{reason:s}:{}}))},onUpstreamError:t=>{o.delete(e),i.send(JSON.stringify({type:"node-agent.websocket.error",streamId:e,message:t instanceof Error?t.message:String(t)}))}})}catch(t){i.send(JSON.stringify({type:"node-agent.websocket.error",streamId:e,message:t instanceof Error?t.message:String(t)}))}return}if("control-plane.websocket.close"===h.type){const e="string"==typeof h.streamId?h.streamId:"";return void p(e,"number"==typeof h.code?h.code:1e3,"string"==typeof h.reason?h.reason:"")}if("control-plane.request.cancel"===h.type){const e="string"==typeof h.requestId?h.requestId:"";return a.get(e)?.abort(),void a.delete(e)}if("control-plane.request"===h.type){const n="string"==typeof h.requestId?h.requestId:"",r=h.init&&"object"==typeof h.init?h.init:{},o="string"==typeof h.route&&h.route.startsWith("/")?h.route:"/health",s=r.headers&&"object"==typeof r.headers?r.headers:{},c=ki(r.method);let d;try{d=mt(r.body)}catch(r){return e.log.warn({nodeId:t.nodeId,messageType:h.type,requestId:n,error:r instanceof Error?r.message:String(r)},"node agent reverse tunnel request body rejected"),void i.send(JSON.stringify({type:"node-agent.response",requestId:n,status:400,error:{code:"NODE_TUNNEL_REQUEST_BODY_INVALID",message:"Reverse tunnel request body does not match the negotiated protocol."}}))}const u=new AbortController;a.set(n,u);try{const t=await e.inject({method:c,url:`/api/node-agent${o}`,headers:l(o,c,d,s),payload:d,signal:u.signal});if(u.signal.aborted)return;i.send(JSON.stringify({type:"node-agent.response",requestId:n,status:t.statusCode,headers:t.headers,body:t.body}))}catch(e){if(u.signal.aborted)return;i.send(JSON.stringify({type:"node-agent.response",requestId:n,status:502,error:{code:"NODE_AGENT_REVERSE_INJECT_FAILED",message:e instanceof Error?e.message:String(e)}}))}finally{a.delete(n)}}})(r).catch(n=>{e.log.warn({nodeId:t.nodeId,error:n instanceof Error?n.message:String(n)},"node agent reverse tunnel message rejected");try{i.send(JSON.stringify({type:"node-agent.error",code:"INVALID_TUNNEL_MESSAGE"}))}catch{}})}),i}function Ho(e){const t=new URL(ao,e);return t.protocol="https:"===t.protocol?"wss:":"ws:",t.toString()}const qo=new Set(["content-encoding","content-length","transfer-encoding"]),Bo=["codex","claude"],Ko=5e3,Go="runtime_local_host",Jo="task-handoff.node-agent.builtin",Wo=new Set(["linux","darwin","win32","freebsd","openbsd","aix","sunos"]);function Yo(e){return Wo.has(e)?e:"unknown"}function Xo(e){const t={...e};return delete t[Jo],t}const Qo=m.z.object({version:m.z.literal(1),externalListener:Gn}).strict(),Zo=m.z.object({}).strict().default({}),es=tn.strict();function ts(e){const t=process.env[e]?.trim();return t||void 0}const ns=function(e,t=process.env,n=e){let r;return()=>{const i=t.TASK_HANDOFF_VERSION?.trim();return i||(r||=z(e,t,n),r)}}("@task-handoff/node-agent",process.env,"@task-handoff/control-plane");function rs(e){const t=ns();return e===t?{desiredVersion:t,actualVersion:e,phase:"matched",attempt:0,matchedAt:ms()}:{desiredVersion:t,...e?{actualVersion:e}:{},phase:"pending",attempt:0,error:{code:"INSTANCE_RUNTIME_VERSION_MISMATCH",message:`Expected controlled-instance ${t}, received ${e||"an unknown version"}.`,expectedVersion:t,...e?{actualVersion:e}:{},retryable:!0}}}function is(e,t,n=!0){if(!n)return rs(t);const r=ns(),i=e.runtimeVersion;if(!i||i.desiredVersion!==r)return rs(t);const o=()=>({code:"INSTANCE_RUNTIME_VERSION_MISMATCH",message:`Expected controlled-instance ${r}, received ${t||"an unknown version"}.`,expectedVersion:r,...t?{actualVersion:t}:{},retryable:!0}),s="INSTANCE_RUNTIME_VERSION_MISMATCH"!==i.error?.code?i.error:t===r?void 0:o();return Wt.parse({...i,desiredVersion:r,...t?{actualVersion:t}:{actualVersion:void 0},..."pending"===i.phase?{error:s||(t!==r?o():void 0)}:{}})}function os(e){return Object.fromEntries([...e.entries()].filter(([e])=>!qo.has(e.toLowerCase())))}function ss(e){return e.bodyBase64?Buffer.from(e.bodyBase64,"base64"):e.body}const as=67108864;function cs(){const e=Number(process.env.TASK_HANDOFF_INSTANCE_PROXY_MAX_RESPONSE_BYTES);return Number.isSafeInteger(e)&&e>0?e:67108864}function ds(e){const t=e.authorization;return"string"==typeof t&&t.startsWith("Bearer ")?t.slice(7).trim():void 0}function ls(e){if("string"!=typeof e)return!1;const t=e.trim().toLowerCase();return"localhost"===t||"127.0.0.1"===t||"::1"===t||"::ffff:127.0.0.1"===t}function us(e){return!e.ip&&!e.socket.remoteAddress&&!e.socket.remoteFamily}function ms(){return(new Date).toISOString()}function ps(e){return"all-ipv4"===e?"0.0.0.0":"127.0.0.1"}function gs(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n=t.externalListener&&"object"==typeof t.externalListener&&!Array.isArray(t.externalListener)?t.externalListener:{},r=Object.keys(t).filter(e=>"version"!==e&&"externalListener"!==e),i=Object.keys(n).filter(e=>"bindScope"!==e&&"port"!==e);return(r.length||i.length)&&console.warn(JSON.stringify({message:"unknown stored node agent runtime setting fields were ignored",filePath:"runtime-settings.json",fields:[...r,...i.map(e=>`externalListener.${e}`)]})),{version:t.version,externalListener:{bindScope:n.bindScope,port:n.port}}}function hs(e){return"local-folder"===e.type?cn.parse({mode:"local-bind",path:"/workspace",readOnly:!1}):cn.parse({mode:"git-clone",path:"/workspace",readOnly:!1})}function fs(e){const t=an.parse(e.source),n=e.projectId||("local-folder"===t.type?t.localFolderId:void 0)||("git-repository"===t.type?t.repositoryId:void 0)||("git-template"===t.type?t.templateId:void 0)||`project_${e.id}`;return ln.parse({id:n,name:"string"==typeof e.sourceSnapshot.name?e.sourceSnapshot.name:e.name,source:t,defaultImageSelection:e.imageSelection,defaultNodeId:e.nodeId,defaultRuntimeId:e.runtimeId,workspacePolicy:hs(t),labels:{},createdAt:e.createdAt,updatedAt:e.updatedAt})}async function ys(e,t){if(!t.target.web)return"unknown";const n=new AbortController,r=setTimeout(()=>n.abort(),2e3);try{return(await e(`${ws(t)}/api/health`,{signal:n.signal})).ok?"reachable":"endpoint-unreachable"}catch{return"endpoint-unreachable"}finally{clearTimeout(r)}}async function Is(e,t,n,r){const i=new AbortController,o=setTimeout(()=>i.abort(),r);try{return await e(t,{...n,signal:i.signal})}finally{clearTimeout(o)}}async function As(e,t,n,r){if(!t.config.autoImportAgentConfigs)return void r.diagnostic({instanceId:t.id,action:n},"node instance config auto-import skipped");if("reachable"!==t.targetStatus)return;const i=ws(t),o=Number(process.env.TASK_HANDOFF_CONFIG_AUTO_IMPORT_TIMEOUT_MS||Ko);for(const s of Bo)try{const a=await Is(e,`${i}/api/config-sync/import/${encodeURIComponent(s)}`,{method:"POST"},Number.isFinite(o)&&o>0?o:Ko);if(!a.ok){r.warn({instanceId:t.id,action:n,preset:s,statusCode:a.status},"node instance config auto-import failed");continue}r.diagnostic({instanceId:t.id,action:n,preset:s},"node instance config auto-import completed")}catch(e){r.warn({instanceId:t.id,action:n,preset:s,error:e instanceof Error?e.message:String(e)},"node instance config auto-import failed")}}async function bs(e,t,n){const r=t.requireInstance(n);if("reachable"!==r.targetStatus||!r.target.web)return!1;const i=await Is(e,`${ws(r)}/api/internal/model-environment`,{method:"PUT",headers:{"content-type":"application/json",authorization:`Bearer ${r.registrationToken}`},body:JSON.stringify(t.resolvedAssignedModelEnvironment(n))},Ko);if(!i.ok)throw Object.assign(new Error(`Instance ${n} rejected its managed model environment with HTTP ${i.status}.`),{statusCode:502,code:"INSTANCE_MODEL_ENVIRONMENT_APPLY_FAILED"});return!0}function ws(e){const t=e.target.web;if(!t){const t=new Error(`Instance ${e.id} does not have a web endpoint.`);throw Object.assign(t,{statusCode:409,code:"NODE_INSTANCE_WEB_ENDPOINT_MISSING"}),t}if("direct-port"!==e.target.strategy)return t.replace(/\/$/,"");try{const e=new URL(t);return e.port?(e.hostname=process.env.TASK_HANDOFF_NODE_AGENT_PROXY_HOST||"127.0.0.1",e.toString().replace(/\/$/,"")):t.replace(/\/$/,"")}catch{return t.replace(/\/$/,"")}}function Ns(e,t){const n=new Error(t);throw Object.assign(n,{statusCode:403,code:e}),n}function zs(e,t){e!==it&&console.warn(JSON.stringify({message:"protocol version mismatch",peer:t,expectedProtocolVersion:it,actualProtocolVersion:e||"missing",errorCode:"PROTOCOL_VERSION_MISMATCH"}))}function vs(e){return"none"!==e.capabilities.artifactKind}function Es(e={}){return{...e,requiresImage:!1,supportsControlledInstanceApi:!0,supportsContainerLifecycle:!1,supportsAppSessions:!0,supportsHostSessions:!0,artifactKind:"none",isolation:"none"}}function Ss(e){return new Promise(t=>{const n=o.createServer();n.once("error",()=>t(!1)),n.listen({host:"127.0.0.1",port:e},()=>{n.close(()=>t(!0))})})}function _s(e,t=3e3){return null!==e.exitCode||null!==e.signalCode?Promise.resolve():new Promise(n=>{const r=setTimeout(()=>{null===e.exitCode&&null===e.signalCode&&e.kill("SIGKILL"),n()},t);r.unref(),e.once("exit",()=>{clearTimeout(r),n()})})}const Ts="task-handoff.local-process-nonce",ks=1e3;function Cs(e){return e.runtime.port?`http://127.0.0.1:${e.runtime.port}`:e.target.web}async function Os(e,t){try{const n=await fetch(`${e}/api/internal/node-agent/process-identity`,{headers:{authorization:`Bearer ${t}`},signal:AbortSignal.timeout(ks)});if(!n.ok)return;const r=(await n.json()).data;if("string"!=typeof r?.instanceId||"number"!=typeof r.pid||"string"!=typeof r.processNonce)return;return{instanceId:r.instanceId,pid:r.pid,processNonce:r.processNonce,startIdentity:"string"==typeof r.startIdentity?r.startIdentity:void 0}}catch{return}}async function xs(e,t){if(k(e)!==t)return!1;try{process.kill(e,"SIGTERM")}catch{return!0}const n=Date.now()+3e3;for(;Date.now()<n;){try{process.kill(e,0)}catch{return!0}await new Promise(e=>setTimeout(e,50))}try{process.kill(e,"SIGKILL")}catch{}const r=Date.now()+1e3;for(;Date.now()<r;){try{process.kill(e,0)}catch{return!0}await new Promise(e=>setTimeout(e,50))}return!1}function Rs(e,t){return Object.assign(new Error(t),{statusCode:503,code:"LOCAL_INSTANCE_STOP_UNCONFIRMED",instanceId:e.id})}async function Ds(e,t,r){const i=t.get(e.id);if(i&&!i.killed)return i.kill("SIGTERM"),t.delete(e.id),void await _s(i);const o=await async function(e){const t=Cs(e),n=e.runtime.labels?.[Ts];if(!t||!n||!e.registrationToken)return;const r=await Os(t,e.registrationToken);if(r&&r.instanceId===e.id&&r.processNonce===n)try{return(await fetch(`${t}/api/internal/node-agent/shutdown`,{method:"POST",headers:{authorization:`Bearer ${e.registrationToken}`},signal:AbortSignal.timeout(ks)})).ok?r:void 0}catch{return}}(e);if(o){const t=Cs(e),n=Date.now()+3e3;for(;t&&Date.now()<n;){if(!await Os(t,e.registrationToken))return;await new Promise(e=>setTimeout(e,50))}const r=t?await Os(t,e.registrationToken):void 0;if(r&&r.instanceId===o.instanceId&&r.pid===o.pid&&r.processNonce===o.processNonce&&r.startIdentity===o.startIdentity&&r.startIdentity&&await xs(r.pid,r.startIdentity))return;throw Rs(e,`Controlled instance ${e.id} accepted shutdown but its exit could not be confirmed.`)}const s=function(e=function(){const e="win32"===process.platform?p.tmpdir():"/tmp";return n.join(e,`task-handoff-local-controlled-instance-${function(){const e=process.getuid?.();return void 0!==e?String(e):p.userInfo().username.replace(/[^a-zA-Z0-9_.-]/g,"_")}()}.lock`)}()){return C(e)}(r),a=await async function(e){const t=Cs(e);if(t)try{const[n,r]=await Promise.all([fetch(`${t}/api/instance/status`,{signal:AbortSignal.timeout(ks)}),fetch(`${t}/api/diagnostics`,{signal:AbortSignal.timeout(ks)})]);if(!n.ok||!r.ok)return;const i=await n.json(),o=await r.json(),s=o.data?.runtime?.pid;if(i.data?.id!==e.id||"controlled"!==i.data.controlMode||"number"!=typeof s||!Number.isInteger(s)||s<=0)return;const a=k(s);return a?{pid:s,startIdentity:a}:void 0}catch{return}}(e);if(a){if(await xs(a.pid,a.startIdentity))return;throw Rs(e,`Legacy controlled instance ${e.id} did not exit after termination.`)}if(s?.instanceId===e.id&&R(s))throw Rs(e,`Local controlled instance ${e.id} is still owned by pid ${s.pid}, but its process identity could not be verified.`)}const Ps=new Set(["provisioning","starting","registering","registered","running"]);async function js(e,t){try{const n=await e(t,["--version"]);return{available:!0,command:t,version:(n.stdout||n.stderr).split(/\r?\n/)[0]?.trim()||void 0}}catch{return{available:!1}}}function Ms(e){return!0===e.managedArtifacts}class Ls{managedArtifacts=!0;executor;platform;arch;runCommand;constructor(e,t,n,r){this.executor=e,this.runCommand=t,this.platform=n,this.arch=r}artifactTarget(e){return this.executor.inspectRuntimeTarget(e?.instance.runtime.containerName)}async installRuntime(e,t){const n=e.instance.runtime.containerName;if(!n)throw Object.assign(new Error(`Instance ${e.instance.id} does not have a Docker container.`),{code:"INSTANCE_RUNTIME_INSTALL_FAILED"});await this.executor.installRuntimeLauncher(n),await this.executor.installRuntimeRelease({containerName:n,expectedContainerId:e.instance.runtime.containerId,artifactPath:t.archivePath,identity:t.identity})}async inspectRuntime(e,t){const n=e.instance.runtime.containerName;return!!n&&function(e,t){return e.packageName===t.packageName&&e.version===t.version&&e.platform===t.platform&&e.arch===t.arch&&e.formatVersion===t.formatVersion&&e.launcherAbi===t.launcherAbi&&e.entrypoint===t.entrypoint&&e.sha256===t.sha256}(await this.executor.inspectRuntimeVersion(n),t)}start(e){return this.executor.start(e)}stop(e){return this.executor.stop(e)}restart(e){return this.executor.restart(e,e.instance.runtime.containerId)}delete(e){return this.executor.delete(e)}async check(e){try{const t=(await this.runCommand("docker",["version","--format","{{.Server.Version}}"],{timeoutMs:5e3})).stdout.trim();return{status:"online",capabilities:{...e.capabilities,daemon:{status:"online",hostPlatform:Yo(this.platform),...t?{serverVersion:t}:{}}}}}catch(t){return{status:"offline",capabilities:{...e.capabilities,daemon:{status:"offline",hostPlatform:Yo(this.platform),error:t instanceof Error?t.message:String(t)}}}}}}class $s{runCommand;paths;nodeAgentUrl;processByInstanceId=new Map;commandOverride;lockPath;constructor(e,t,n,r,i){this.runCommand=e,this.paths=t,this.nodeAgentUrl=n,this.commandOverride=r,this.lockPath=i}async start(e){await Ds(e.instance,this.processByInstanceId,this.lockPath);const i=function(e){if("local-folder"!==e.source.type){const e=new Error("Localhost runtime currently supports local folder sources only.");throw Object.assign(e,{statusCode:400,code:"LOCAL_RUNTIME_REQUIRES_LOCAL_FOLDER"}),e}return n.resolve(e.source.path)}(e.instance),o=e.instance.runtime.port||await async function(){const e=Number(process.env.TASK_HANDOFF_LOCAL_INSTANCE_PORT_START||19e3),t=Number.isInteger(e)&&e>0?e:19e3;for(let e=t;e<t+1e3&&e<=65535;e+=1)if(await Ss(e))return e;const n=new Error(`No free localhost port found in range ${t}-${Math.min(t+999,65535)}.`);throw Object.assign(n,{statusCode:503,code:"LOCAL_INSTANCE_PORT_UNAVAILABLE"}),n}(),s=n.join(this.paths.dataDir,"local-instances",e.instance.id),c=n.join(s,"logs");t.mkdirSync(c,{recursive:!0});const[d,...l]=function(e){if(e)return e;const r=n.resolve(process.cwd(),"bin","task-handoff.js");if(t.existsSync(r))return[process.execPath,r,"web"];throw Object.assign(new Error("The bundled controlled-instance command is unavailable."),{statusCode:500,code:"LOCAL_CONTROLLED_COMMAND_MISSING"})}(this.commandOverride),u=[...l,"--host","127.0.0.1","--port",String(o)],m=r.randomUUID(),p=t.openSync(n.join(c,"controlled-instance.out.log"),"a"),g=t.openSync(n.join(c,"controlled-instance.err.log"),"a"),h=a.spawn(d,u,{cwd:i,detached:!1,stdio:["ignore",p,g],env:{...process.env,TASK_HANDOFF_CONTROL_MODE:"controlled",TASK_HANDOFF_RUNTIME_KIND:"local",TASK_HANDOFF_CONTROLLED_INSTANCE_VERSION:ns(),...this.lockPath?{TASK_HANDOFF_LOCAL_CONTROLLED_INSTANCE_LOCK_PATH:this.lockPath}:{},TASK_HANDOFF_NODE_AGENT_URL:this.nodeAgentUrl(),TASK_HANDOFF_INSTANCE_ID:e.instance.id,TASK_HANDOFF_INSTANCE_NAME:e.instance.name,TASK_HANDOFF_REGISTRATION_TOKEN:e.instance.registrationToken||"",TASK_HANDOFF_PROJECT_ID:e.project.id,TASK_HANDOFF_NODE_ID:e.node.id,TASK_HANDOFF_RUNTIME_ID:e.runtime.id,TASK_HANDOFF_LOCAL_PROCESS_NONCE:m,TASK_HANDOFF_WORKSPACE:i,TASK_HANDOFF_WORKSPACE_MODE:"local-bind",TASK_HANDOFF_DATA_DIR:s,TASK_HANDOFF_LOG_DIR:c,TASK_HANDOFF_APP_SESSION_PERSIST:"1",TASK_HANDOFF_CODEX_APP_SERVER:process.env.TASK_HANDOFF_CODEX_APP_SERVER||"1",TASK_HANDOFF_WEB_PORT:String(o),TASK_HANDOFF_WEB_HOST:"127.0.0.1",...e.modelEnv||{}}});t.closeSync(p),t.closeSync(g);try{await function(e){return new Promise((t,n)=>{const r=()=>{e.off("error",i),t()},i=t=>{e.off("spawn",r),n(t)};e.once("spawn",r),e.once("error",i)})}(h)}catch(e){const r=e instanceof Error?e.message:String(e);try{t.appendFileSync(n.join(c,"controlled-instance.lifecycle.log"),`[${(new Date).toISOString()}] spawn failed command=${d} cwd=${i} error=${r}\n`)}catch{}throw Object.assign(new Error(`Controlled instance process could not start with command ${d} in ${i}: ${r}`),{statusCode:500,code:"LOCAL_INSTANCE_PROCESS_SPAWN_FAILED"})}this.processByInstanceId.set(e.instance.id,h),h.on("error",e=>{try{t.appendFileSync(n.join(c,"controlled-instance.lifecycle.log"),`[${(new Date).toISOString()}] process error pid=${h.pid??""} error=${e.message}\n`)}catch{}}),h.once("exit",(r,i)=>{this.processByInstanceId.delete(e.instance.id);try{t.appendFileSync(n.join(c,"controlled-instance.lifecycle.log"),`[${(new Date).toISOString()}] exited pid=${h.pid??""} code=${r??""} signal=${i??""}\n`)}catch{}});const f=`http://127.0.0.1:${o}`,y=h.pid?k(h.pid):void 0,I=!(!h.pid||!e.instance.registrationToken)&&await async function(e,t,n,r,i=3e3){const o=Date.now()+i;for(;Date.now()<o;){if(null!==n.exitCode||null!==n.signalCode)return!1;const i=await Os(e,r);if(i&&i.instanceId===t.instanceId&&i.pid===t.pid&&i.processNonce===t.processNonce&&i.startIdentity===t.startIdentity)return!0;await new Promise(e=>setTimeout(e,100))}return!1}(f,{instanceId:e.instance.id,pid:h.pid,processNonce:m,startIdentity:y},h,e.instance.registrationToken);if(!I)throw this.processByInstanceId.get(e.instance.id)===h&&this.processByInstanceId.delete(e.instance.id),null===h.exitCode&&null===h.signalCode&&h.kill("SIGTERM"),await _s(h),Object.assign(new Error(`Controlled instance process did not become ready for instance ${e.instance.id} on ${f}.`),{statusCode:503,code:"LOCAL_INSTANCE_PROCESS_NOT_READY"});return{status:"registering",health:"unknown",connectionStatus:"online",agentStatus:"unknown",targetStatus:"unknown",uiAccessStatus:"unknown",target:{strategy:"direct-port",status:"unknown",web:f,api:`${f}/api`},workspace:{mode:"local-bind",status:"pending",path:i},runtime:{kind:"local",workspacePath:i,pid:h.pid,port:o,labels:{...e.instance.runtime.labels,"task-handoff.runtime-kind":"local",[Ts]:m}}}}async stop(e){return await Ds(e.instance,this.processByInstanceId,this.lockPath),{status:"stopped",health:"unknown",connectionStatus:"offline",agentStatus:"offline",targetStatus:"unknown",uiAccessStatus:"unknown",target:{...e.instance.target,status:"unknown"},runtime:e.instance.runtime}}async restart(e){return await Ds(e.instance,this.processByInstanceId,this.lockPath),this.start(e)}async delete(e){return this.stop(e)}async check(e){const[t,n]=await Promise.all([js(this.runCommand,"codex"),js(this.runCommand,"claude")]);return{status:"online",capabilities:Es({...e.capabilities,apps:{terminal:!0,codex:t,claude:n}})}}async stopAll(){const e=Array.from(this.processByInstanceId.values());for(const e of this.processByInstanceId.values())e.killed||e.kill("SIGTERM");this.processByInstanceId.clear(),await Promise.all(e.map(e=>_s(e)))}}class Fs{docker;local;constructor(e,t){this.docker=e,this.local=t}forRuntime(e){if("docker"===e.type)return this.docker;if("local"===e.type)return this.local;const t=new Error(`Runtime type ${e.type} is not supported by this node agent.`);throw Object.assign(t,{statusCode:400,code:"NODE_RUNTIME_TYPE_UNSUPPORTED"}),t}managedAdapters(){return[this.docker,this.local].filter(Ms)}async stopAll(){this.local instanceof $s&&await this.local.stopAll()}}class Us extends Ei{onStored;setOnStored(e){this.onStored=e}put(e){const t=super.get(e.id)?.stateRevision||0,n=super.put(nr.parse({...e,stateRevision:Math.max(e.stateRevision||0,t)+1}));return this.onStored?.(n),n}}class Vs{nodeId;paths;localFolders;nodeRuntimes;controlledInstances;models;modelAssignments;modelEnvironments;updateJobs;node;listenerPort;containerUrlOverride;platform;constructor(e,t,n,r,i,o){this.paths=e,this.nodeId=t,this.localFolders=new Ei(e.localFoldersDir,{schema:sn,sanitize:Et}),this.nodeRuntimes=new Ei(e.nodeRuntimesDir,{schema:Bn}),this.controlledInstances=new Us(e.controlledInstancesDir,{schema:nr,sanitize:e=>sr(e,e=>{console.warn(JSON.stringify({message:"legacy controlled instance field was ignored",...e}))})}),this.models=new io(e.nodeModelsDir,t),this.modelAssignments=new oo(e.modelAssignmentsDir),this.modelEnvironments=new ro(e.modelEnvironmentsDir),this.updateJobs=new ji(e),this.listenerPort=i,this.platform=o,this.containerUrlOverride=r;const s=ms();this.node=qn.parse({id:t,name:t,connectionMode:"direct-http",endpoint:n,controlEndpoint:n,containerEndpoint:this.containerUrl,publicWebBase:n?n.replace(/:\d+$/,""):void 0,status:"online",health:"ok",capabilities:{},labels:{},createdAt:s,updatedAt:s})}init(){this.localFolders.init();for(const e of this.localFolders.list())this.localFolders.put(e);if(this.nodeRuntimes.init(),this.controlledInstances.init(),this.models.init(),this.modelAssignments.init(),this.migrateLegacyModelEnvironments(),this.updateJobs.init(),this.updateJobs.reconcileRollouts(this.controlledInstances.list(),ns(),{processStarted:!0}),!this.nodeRuntimes.get("runtime_local_docker")){const e=ms();this.nodeRuntimes.put(Bn.parse({id:"runtime_local_docker",nodeId:this.nodeId,name:"Local Docker",type:"docker",status:"unknown",accessStrategy:"direct-port",capabilities:{},labels:{},createdAt:e,updatedAt:e}))}if("win32"!==this.platform){const e=this.nodeRuntimes.get(Go),t=ms();this.nodeRuntimes.put(Bn.parse({id:Go,nodeId:this.nodeId,name:"Local Runtime",type:"local",status:e?.status||"unknown",accessStrategy:"node-proxy",capabilities:Es(e?.capabilities),labels:{...e?.labels,[Jo]:"true"},createdAt:e?.createdAt||t,updatedAt:e?.updatedAt||t}))}for(const e of this.nodeRuntimes.list())e.nodeId!==this.nodeId&&this.nodeRuntimes.put(Bn.parse({...e,nodeId:this.nodeId,updatedAt:ms()}));for(const e of this.localFolders.list())e.nodeId!==this.nodeId&&this.localFolders.put(sn.parse({...e,nodeId:this.nodeId,updatedAt:ms()}));this.normalizeInstanceRuntimeVersions()}normalizeInstanceRuntimeVersions(){for(const e of this.controlledInstances.list()){const t=rs(e.build?.packageVersion||e.instanceVersion),n=vs(this.requireRuntime(e.runtimeId)),r=["created","stopped","failed"].includes(e.status),i=n&&e.runtimeVersion?.desiredVersion===t.desiredVersion?e.runtimeVersion:void 0,o=n?"matched"===t.phase?r?t:{...t,phase:"verifying",matchedAt:void 0}:"failed"===i?.phase?{...t,phase:"failed",attempt:i.attempt,lastAttemptAt:i.lastAttemptAt,error:i.error}:{...t,attempt:i?.attempt||0,lastAttemptAt:i?.lastAttemptAt}:t;this.controlledInstances.put(nr.parse({...e,ready:!1,runtimeVersion:o,updatedAt:ms()}))}}get localNodeAgentUrl(){return`http://127.0.0.1:${this.listenerPort}`}get currentListenerPort(){return this.listenerPort}get containerUrl(){return this.containerUrlOverride||`http://host.docker.internal:${this.listenerPort}`}setListenerPort(e){this.listenerPort=e,this.node.containerEndpoint=this.containerUrl,this.node.updatedAt=ms()}runningInstanceCount(){const e=new Set(["created","stopped","failed"]);return this.listInstances().filter(t=>!e.has(t.status)).length}createLocalFolder(e){const t=ms(),n=sn.parse({...e,id:e.id||zi("folder"),nodeId:this.nodeId,labels:e.labels||{},createdAt:t,updatedAt:t});return this.localFolders.put(n)}createRuntime(e){if("local"===e.type){const e="win32"===this.platform,t=new Error(e?"Local Runtime is not supported on Windows.":"Local Runtime is built in and cannot be added manually.");throw Object.assign(t,{statusCode:e?400:409,code:e?"LOCAL_RUNTIME_UNSUPPORTED":"LOCAL_RUNTIME_BUILTIN"}),t}const t=ms(),n=Bn.parse({...e,id:e.id||zi("runtime"),nodeId:this.nodeId,accessStrategy:e.accessStrategy||(r=e.type,"docker"===r?"direct-port":"node-proxy"),capabilities:e.capabilities||{},labels:Xo(e.labels),createdAt:t,updatedAt:t});var r;return this.nodeRuntimes.put(n)}updateRuntime(e,t){const n=this.requireRuntime(e);if("true"===n.labels[Jo]){const t=new Error(`Built-in runtime ${e} cannot be modified.`);throw Object.assign(t,{statusCode:400,code:"NODE_RUNTIME_BUILTIN"}),t}if("local"===n.type||"local"===t.type){const e="win32"===this.platform,t=new Error(e?"Local Runtime is not supported on Windows.":"Local Runtime is built in and cannot be configured manually.");throw Object.assign(t,{statusCode:e?400:409,code:e?"LOCAL_RUNTIME_UNSUPPORTED":"LOCAL_RUNTIME_BUILTIN"}),t}const r=Bn.parse({...n,...t,id:n.id,nodeId:this.nodeId,accessStrategy:t.accessStrategy||n.accessStrategy,capabilities:t.capabilities||n.capabilities,labels:t.labels?Xo(t.labels):n.labels,createdAt:n.createdAt,updatedAt:ms()});return this.nodeRuntimes.put(r)}deleteRuntime(e){if("true"===this.requireRuntime(e).labels[Jo]){const t=new Error(`Built-in runtime ${e} cannot be deleted.`);throw Object.assign(t,{statusCode:400,code:"NODE_RUNTIME_BUILTIN"}),t}const t=this.listInstances().filter(t=>t.runtimeId===e);if(t.length){const n=new Error(`Runtime ${e} is used by ${t.length} instance${1===t.length?"":"s"}.`);throw Object.assign(n,{statusCode:409,code:"NODE_RUNTIME_IN_USE"}),n}return this.nodeRuntimes.delete(e)}checkRuntime(e,t){const n=this.requireRuntime(e);return t.check?t.check(n).then(e=>{const t=Bn.parse({...n,...e,id:n.id,nodeId:this.nodeId,createdAt:n.createdAt,updatedAt:ms()});return this.nodeRuntimes.put(t)}):this.nodeRuntimes.put(Bn.parse({...n,status:"unknown",updatedAt:ms()}))}requireRuntime(e){const t=this.nodeRuntimes.get(e);if(!t){const t=new Error(`Node runtime ${e} was not found.`);throw Object.assign(t,{statusCode:404,code:"NODE_RUNTIME_NOT_FOUND"}),t}return t}requireInstance(e){const t=this.controlledInstances.get(e);if(!t){const t=new Error(`Instance ${e} was not found on node ${this.nodeId}.`);throw Object.assign(t,{statusCode:404,code:"NODE_INSTANCE_NOT_FOUND"}),t}const n=or(t);if(!n.success)throw function(e,t){const n=t.map(e=>`${e.path.join(".")||"body"}: ${e.message}`).join("; "),r=new Error(`Stored instance ${e} is not compatible with protocol ${it}: ${n}`);return Object.assign(r,{statusCode:409,code:"NODE_INSTANCE_PAYLOAD_INVALID"}),r}(e,n.error.issues);return n.data}applyInstanceLifecycle(e,t){return this.controlledInstances.put(function(e,t,n=(new Date).toISOString()){switch(t.type){case"start-requested":return nr.parse({...e,status:"starting",ready:!1,updatedAt:n});case"convergence-restart-requested":return nr.parse({...e,build:void 0,instanceVersion:void 0,ready:!1,updatedAt:n});case"runtime-lifecycle-completed":return function(e,t,n,r){const i=t.stateRevision>e.stateRevision&&t.lastHeartbeatAt!==e.lastHeartbeatAt&&"online"===t.agentStatus;return nr.parse({...t,...n,...i?{status:t.status,health:t.health,connectionStatus:t.connectionStatus,agentStatus:t.agentStatus,targetStatus:t.targetStatus,uiAccessStatus:t.uiAccessStatus}:{},ready:!!i&&t.ready,target:n.target?i?{...n.target,...t.target}:{...t.target,...n.target}:t.target,workspace:n.workspace?i?{...n.workspace,...t.workspace}:{...t.workspace,...n.workspace}:t.workspace,runtime:n.runtime?{...t.runtime,...n.runtime}:t.runtime,updatedAt:r})}(t.baseline,e,t.observation,n);case"stop-completed":return nr.parse({...e,status:"stopped",health:"unknown",connectionStatus:"offline",ready:!1,agentStatus:"offline",targetStatus:"unknown",uiAccessStatus:"unknown",target:{...e.target,status:"unknown"},updatedAt:n});case"start-failed":return nr.parse({...e,status:"failed",ready:!1,health:"failed",connectionStatus:"offline",agentStatus:"offline",targetStatus:"unknown",uiAccessStatus:"unknown",workspace:{...e.workspace,error:(r=t.error,r instanceof Error?r.message:String(r))},updatedAt:n})}var r}(this.requireInstance(e),t))}listInstances(){return this.controlledInstances.list().flatMap(e=>{const t=or(e);return t.success?[t.data]:[]})}listModels(){const e=new Map;for(const t of this.listInstances()){const n=this.modelAssignments.get(t.id);for(const t of[n?.codexModelHash,n?.claudeModelHash])t&&e.set(t,(e.get(t)||0)+1)}return this.models.list().map(t=>this.publicModel(t,e.get(t.id)||0))}createModel(e){const t=ms(),n=zn(e),r=this.models.get(n),i=mn.parse({...e,id:n,enabled:e.enabled??!0,order:e.order??this.nextModelOrder(),labels:e.labels||{},createdAt:r?.createdAt||t,updatedAt:t});return this.publicModel(this.models.put(i),this.modelReferenceIds(n).length)}deployModel(e){const t=zn(e);if(e.id!==t)throw Object.assign(new Error(`Model content hash ${t} does not match ${e.id}.`),{statusCode:400,code:"NODE_MODEL_HASH_MISMATCH"});const n=this.models.get(e.id)||this.models.put(mn.parse(e));return this.publicModel(n,this.modelReferenceIds(n.id).length)}updateModel(e,t){const n=this.requireModel(e),r=mn.parse({...n,...t,key:t.key?.trim()?t.key:n.key,createdAt:n.createdAt,updatedAt:ms()}),i=zn(r),o=this.models.put(mn.parse({...r,id:i}));return this.publicModel(o,this.modelReferenceIds(i).length)}deleteModel(e){this.requireModel(e);const t=this.modelReferenceIds(e);if(t.length)throw Object.assign(new Error(`Model ${e} is assigned to ${t.length} instance${1===t.length?"":"s"}.`),{statusCode:409,code:"NODE_MODEL_IN_USE",instanceIds:t});return this.models.delete(e)}assignModels(e,t){const n=this.requireInstance(e);if(this.validateAssignmentRef("codex",t.codexModelHash),this.validateAssignmentRef("claude",t.claudeModelHash),void 0!==t.modelSelection.codexModelHash&&(t.modelSelection.codexModelHash??void 0)!==t.codexModelHash)throw Object.assign(new Error("Codex model selection does not match its node assignment."),{statusCode:400,code:"NODE_MODEL_SELECTION_MISMATCH"});if(void 0!==t.modelSelection.claudeModelHash&&(t.modelSelection.claudeModelHash??void 0)!==t.claudeModelHash)throw Object.assign(new Error("Claude model selection does not match its node assignment."),{statusCode:400,code:"NODE_MODEL_SELECTION_MISMATCH"});const r=this.modelAssignments.get(e),i=hn.parse({instanceId:e,codexModelHash:t.codexModelHash,claudeModelHash:t.claudeModelHash,updatedAt:ms()});this.modelAssignments.put(i);try{return{assignment:i,instance:this.controlledInstances.put(nr.parse({...n,modelSelection:t.modelSelection,updatedAt:ms()}))}}catch(t){throw r?this.modelAssignments.put(r):this.modelAssignments.delete(e),t}}resolvedAssignedModelEnvironment(e){const t=this.modelAssignments.get(e);if(!t){if(this.modelEnvironments.has(e))throw Object.assign(new Error(`Legacy model environment for instance ${e} requires manual migration.`),{statusCode:409,code:"NODE_MODEL_MIGRATION_REQUIRED"});return{}}return{...this.modelEnvironmentForRef("codex",t.codexModelHash),...this.modelEnvironmentForRef("claude",t.claudeModelHash)}}validateAssignmentRef(e,t){if(!t)return;const n=this.requireModel(t);if(n.app!==e)throw Object.assign(new Error(`Model ${n.id} belongs to ${n.app}, not ${e}.`),{statusCode:400,code:"NODE_MODEL_APP_MISMATCH"});if(!n.enabled)throw Object.assign(new Error(`Model ${n.id} is disabled.`),{statusCode:409,code:"NODE_MODEL_DISABLED"})}modelEnvironmentForRef(e,t){if(!t)return{};this.validateAssignmentRef(e,t);const n=this.requireModel(t);return"codex"===e?{OPENAI_API_KEY:n.key,OPENAI_BASE_URL:n.endpoint,TASK_HANDOFF_CODEX_BASE_URL:n.endpoint,TASK_HANDOFF_CODEX_MODEL:n.model}:{ANTHROPIC_API_KEY:n.key,ANTHROPIC_BASE_URL:n.endpoint,TASK_HANDOFF_CLAUDE_MODEL:n.model}}requireModel(e){const t=this.models.get(e);if(!t)throw Object.assign(new Error(`Model ${e} was not found on node ${this.nodeId}.`),{statusCode:404,code:"NODE_MODEL_NOT_FOUND"});if(zn(t)!==t.id)throw Object.assign(new Error(`Stored model ${e} does not match its content hash.`),{statusCode:409,code:"NODE_MODEL_HASH_INVALID"});return t}modelReferenceIds(e){return this.listInstances().filter(t=>{const n=this.modelAssignments.get(t.id);return n?.codexModelHash===e||n?.claudeModelHash===e}).map(e=>e.id)}publicModel(e,t){const{key:n,...r}=e;return gn.parse({...r,keyPreview:n.length<=8?"set":`${n.slice(0,4)}...${n.slice(-4)}`,keySet:!0,referenceCount:t})}nextModelOrder(){return this.models.list().reduce((e,t)=>Math.max(e,t.order),0)+100}migrateLegacyModelEnvironments(){for(const e of this.modelEnvironments.listInstanceIds()){if(!this.controlledInstances.get(e)){this.warnLegacyModelMigration(e,"instance-not-found");continue}if(this.modelAssignments.get(e)){try{this.resolvedAssignedModelEnvironment(e),this.modelEnvironments.delete(e)}catch{this.warnLegacyModelMigration(e,"existing-assignment-invalid")}continue}let t;try{t=this.modelEnvironments.get(e)}catch{this.warnLegacyModelMigration(e,"sidecar-invalid");continue}if(!Object.keys(t).length){this.modelEnvironments.delete(e);continue}if(Object.keys(t).some(e=>!no.has(e))){this.warnLegacyModelMigration(e,"unknown-fields");continue}const n=[];try{const r=this.migrateLegacyModelForApp(t,"codex",n),i=this.migrateLegacyModelForApp(t,"claude",n);if(!r&&!i)throw new Error("no complete model configuration");const o={...r?{codexModelHash:r}:{},...i?{claudeModelHash:i}:{}};this.assignModels(e,{modelSelection:o,codexModelHash:r,claudeModelHash:i}),this.resolvedAssignedModelEnvironment(e),this.modelEnvironments.delete(e)}catch{this.modelAssignments.delete(e);for(const e of n)this.models.delete(e);this.warnLegacyModelMigration(e,"mapping-failed")}}}migrateLegacyModelForApp(e,t,n){const r=e["codex"===t?"OPENAI_API_KEY":"ANTHROPIC_API_KEY"],i="codex"===t?e.TASK_HANDOFF_CODEX_BASE_URL||e.OPENAI_BASE_URL:e.ANTHROPIC_BASE_URL,o="codex"===t?e.TASK_HANDOFF_CODEX_MODEL||e.CODEX_MODEL:e.TASK_HANDOFF_CLAUDE_MODEL||e.CLAUDE_MODEL;if(!Boolean(r||i||o))return;if(!r||!i||!o)throw new Error("model configuration incomplete");const s=zn({app:t,endpoint:i,key:r,model:o}),a=this.models.get(s);if(a){if(a.app!==t||a.key!==r||a.endpoint!==i||a.model!==o||!a.enabled)throw new Error("existing model conflicts with legacy environment");return s}const c=ms();return this.models.put(mn.parse({id:s,name:`Migrated ${"codex"===t?"Codex":"Claude"} model`,endpoint:i,key:r,model:o,app:t,enabled:!0,order:this.nextModelOrder(),labels:{migratedFrom:"instance-model-environment"},createdAt:c,updatedAt:c})),n.push(s),s}warnLegacyModelMigration(e,t){console.warn(JSON.stringify({message:"legacy model environment was preserved because it could not be migrated",nodeId:this.nodeId,instanceId:e,reason:t}))}createInstance(e){const t=this.requireRuntime(e.runtimeId),r=ms(),i=e.id||zi("inst"),o=an.parse(e.source);if(function(e){return"boolean"==typeof e.capabilities.requiresImage?e.capabilities.requiresImage:"local"!==e.type}(t)&&(!e.imageSelection||!e.image)){const e=new Error(`Runtime ${t.name} requires an image.`);throw Object.assign(e,{statusCode:400,code:"NODE_RUNTIME_IMAGE_REQUIRED"}),e}if("local"===t.type&&"local-folder"!==o.type){const e=new Error("Localhost runtime currently supports local folder sources only.");throw Object.assign(e,{statusCode:400,code:"LOCAL_RUNTIME_REQUIRES_LOCAL_FOLDER"}),e}if("local"===t.type&&this.listInstances().some(e=>"local"===this.requireRuntime(e.runtimeId).type)){const e=new Error("A localhost instance already exists on this node.");throw Object.assign(e,{statusCode:409,code:"LOCAL_RUNTIME_INSTANCE_EXISTS"}),e}const s=e.image?Pn.parse(e.image):void 0,a="local"===t.type&&"local-folder"===o.type?n.resolve(o.path):void 0,c=nr.parse({id:i,name:e.name||`instance-${i.replace(/^inst_?/,"").slice(0,6)}`,source:o,sourceSnapshot:e.sourceSnapshot||{},modelSelection:e.modelSelection,projectId:e.projectId,nodeId:this.nodeId,runtimeId:t.id,imageSelection:e.imageSelection,imageSnapshot:s,imageProvisioning:s&&"docker"===t.type?{phase:"checking-image",requestedReference:s.requestedReference,generation:0,startedAt:r,updatedAt:r}:void 0,status:s&&"docker"===t.type?"provisioning":"created",health:"unknown",connectionStatus:"unknown",agentStatus:"unknown",targetStatus:"unknown",uiAccessStatus:"unknown",controlMode:"controlled",ready:!1,runtimeVersion:rs(),capabilities:{},config:{autoImportAgentConfigs:e.config?.autoImportAgentConfigs??!0,defaultCodexPermissionMode:e.config?.defaultCodexPermissionMode??("docker"===t.type?"full-access":"ask")},workspace:"local"===t.type?{mode:"local-bind",status:"unknown",path:a}:{status:"unknown"},target:{strategy:"node-proxy",status:"unknown"},runtime:"local"===t.type?{kind:"local",workspacePath:a,labels:{"task-handoff.runtime-kind":"local"}}:{labels:{}},registrationToken:vi(),createdAt:r,updatedAt:r});return this.controlledInstances.put(c)}registerInstance(e,t,n){const r=lr.parse(t),i=ms(),o=this.controlledInstances.get(e);if(!o){const t=new Error(`Instance ${e} was not found on node ${this.nodeId}.`);throw Object.assign(t,{statusCode:404,code:"NODE_INSTANCE_NOT_FOUND"}),t}if(this.validateInstanceReport(o,r,n),r.processIncarnationId&&r.processIncarnationId===o.processIncarnationId)return o;zs(r.protocolVersion,`Instance ${e}`);const s=r.build?.packageVersion||r.instanceVersion,a=vs(this.requireRuntime(o.runtimeId)),c=is(o,s,a),d=nr.parse({...o,status:"registered",health:s===ns()?"ok":"degraded",ready:!a&&s===ns(),connectionStatus:"online",agentStatus:"online",targetStatus:"endpoint-unreachable"===r.target.status?"endpoint-unreachable":"reachable"===r.target.status?"reachable":o.targetStatus,uiAccessStatus:"endpoint-unreachable"===r.target.status?"endpoint-unreachable":o.uiAccessStatus,controlMode:r.controlMode,protocolVersion:r.protocolVersion,instanceVersion:r.instanceVersion,build:r.build,runtimeVersion:c,processIncarnationId:r.processIncarnationId||o.processIncarnationId,capabilities:r.capabilities,appInventory:r.appInventory,workspace:r.workspace,target:{...o.target,...r.target},registrationToken:o.registrationToken||r.registrationToken,lastHeartbeatAt:i,updatedAt:i});return this.controlledInstances.put(d)}heartbeatInstance(e,t,n){const r=this.requireInstance(e);this.validateInstanceToken(r,n);const i=ur.parse(t);r.processIncarnationId&&i.processIncarnationId&&i.processIncarnationId!==r.processIncarnationId&&function(e,t){const n=new Error(t);throw Object.assign(n,{statusCode:409,code:"INSTANCE_PROCESS_INCARNATION_MISMATCH"}),n}(0,`Instance ${e} report belongs to an obsolete controlled-instance process.`),zs(i.protocolVersion,`Instance ${e}`);const o=ms(),s=i.target?{...r.target,...i.target}:r.target,a={...s,status:"unknown"===s.status&&(s.web||s.api)?"reachable":s.status},c="endpoint-unreachable"===a.status?"endpoint-unreachable":"reachable"===a.status?"reachable":r.targetStatus,d=is(r,i.build?.packageVersion||r.build?.packageVersion||r.instanceVersion,vs(this.requireRuntime(r.runtimeId))),l=i.health||r.health,u="running"===(i.status||r.status)&&"failed"!==l,m=nr.parse({...r,...i,target:a,ready:u,health:l,runtimeVersion:d,processIncarnationId:i.processIncarnationId||r.processIncarnationId,agentStatus:"online",targetStatus:c,uiAccessStatus:c,connectionStatus:"online",build:i.build||r.build,lastHeartbeatAt:o,updatedAt:o});return this.controlledInstances.put(m)}validateInstanceReport(e,t,n){this.validateInstanceToken(e,n||t.registrationToken),t.instanceId&&t.instanceId!==e.id&&Ns("INSTANCE_ID_MISMATCH",`Instance ${t.instanceId} cannot register as ${e.id}.`),t.nodeId&&t.nodeId!==this.nodeId&&Ns("INSTANCE_NODE_MISMATCH",`Instance ${e.id} belongs to node ${this.nodeId}.`),t.runtimeId&&t.runtimeId!==e.runtimeId&&Ns("INSTANCE_RUNTIME_MISMATCH",`Instance ${e.id} belongs to runtime ${e.runtimeId}.`),t.imageSelection&&t.imageSelection.imageId!==e.imageSelection?.imageId&&Ns("INSTANCE_IMAGE_MISMATCH",`Instance ${e.id} belongs to image ${e.imageSelection?.imageId}.`)}validateInstanceToken(e,t){e.registrationToken&&t===e.registrationToken||Ns("INSTANCE_REGISTRATION_TOKEN_INVALID",`Invalid registration token for instance ${e.id}.`)}context(e,t=this.resolvedAssignedModelEnvironment(e.id)){const n=e.imageSnapshot||Pn.parse({id:"img_localhost",origin:"custom",name:"Localhost",repository:"localhost",tag:"local",requestedReference:"localhost:local",pullPolicy:"if-not-present",capabilities:[],optionalApps:[],defaultEnv:{},labels:{},createdAt:e.createdAt,updatedAt:e.updatedAt});return{project:fs(e),image:n,node:this.node,runtime:this.requireRuntime(e.runtimeId),instance:e,nodeAgentUrl:this.containerUrl,modelEnv:t}}}class Hs{app;state;settings;sockets=new Set;config;source;status="error";error;constructor(e){this.app=e.app,this.state=e.state,this.settings=e.settings,this.config=e.config,this.source=e.source,this.app.server.on("connection",e=>{this.sockets.add(e),e.once("close",()=>this.sockets.delete(e))})}current(){return Jn.parse({...this.config,host:ps(this.config.bindScope),status:this.status,source:this.source,...this.error?{error:this.error}:{}})}async start(){try{await this.listen(this.config),this.status="listening",this.error=void 0,this.state.setListenerPort(this.config.port)}catch(e){this.status="error",this.error=e instanceof Error?e.message:String(e),this.app.log.error({host:ps(this.config.bindScope),port:this.config.port,error:this.error},"node agent TCP listener failed to start; Unix IPC remains available")}return this.current()}async update(e){const t=Wn.parse(e);if(t.bindScope===this.config.bindScope&&t.port===this.config.port)return this.current();if(t.port!==this.config.port){const e=this.state.runningInstanceCount();if(e>0){const t=new Error(`Cannot change the node agent port while ${e} controlled instance(s) are running.`);throw Object.assign(t,{statusCode:409,code:"NODE_AGENT_LISTENER_PORT_IN_USE_BY_INSTANCES",blockingInstanceCount:e}),t}}const n={config:this.config,source:this.source,status:this.status,error:this.error};await this.stop();try{await this.listen(t)}catch(e){await this.restore(n);const r=new Error(`Failed to bind node agent TCP listener at ${ps(t.bindScope)}:${t.port}: ${e instanceof Error?e.message:String(e)}`);throw Object.assign(r,{statusCode:409,code:"NODE_AGENT_LISTENER_BIND_FAILED"}),r}try{this.settings.put({version:1,externalListener:t})}catch(e){await this.stop(),await this.restore(n);const t=new Error(`Failed to persist node agent TCP listener: ${e instanceof Error?e.message:String(e)}`);throw Object.assign(t,{statusCode:500,code:"NODE_AGENT_LISTENER_PERSIST_FAILED"}),t}return this.config=t,this.source="persisted",this.status="listening",this.error=void 0,this.state.setListenerPort(t.port),this.current()}async shutdown(){await this.stop()}async restore(e){if(this.config=e.config,this.source=e.source,this.status=e.status,this.error=e.error,"listening"===e.status)try{await this.listen(e.config)}catch(e){this.status="error",this.error=`Failed to restore previous listener: ${e instanceof Error?e.message:String(e)}`,this.app.log.error({error:this.error},"node agent TCP listener rollback failed")}this.state.setListenerPort(e.config.port)}async listen(e){await new Promise((t,n)=>{const r=e=>{this.app.server.off("listening",i),n(e)},i=()=>{this.app.server.off("error",r),t()};this.app.server.once("error",r),this.app.server.once("listening",i),this.app.server.listen({host:ps(e.bindScope),port:e.port})})}async stop(){this.app.server.listening&&await new Promise((e,t)=>{this.app.server.close(n=>n?t(n):e());for(const e of this.sockets)e.destroy()})}}async function qs(e,t,n,r,i,o="request"){const s=e.requireInstance(r);if(s.imageProvisioning&&"ready"!==s.imageProvisioning.phase&&"docker"===e.requireRuntime(s.runtimeId).type)return i.diagnostic({instanceId:r,action:"start",reason:o,runtimeId:s.runtimeId,imageId:s.imageSelection?.imageId,imagePhase:s.imageProvisioning.phase},"node instance start queued until image provisioning completes"),e.controlledInstances.put(nr.parse({...s,status:"starting",updatedAt:ms()}));i.diagnostic({instanceId:r,action:"start",reason:o,runtimeId:s.runtimeId,imageId:s.imageSelection?.imageId},"node instance start requested");const a=e.applyInstanceLifecycle(r,{type:"start-requested"}),c=t.forRuntime(e.requireRuntime(a.runtimeId)),d=await c.start(e.context(a)),l=await ys(n,nr.parse({...a,...d,target:d.target?{...a.target,...d.target}:a.target,workspace:d.workspace?{...a.workspace,error:void 0,...d.workspace}:a.workspace,runtime:d.runtime?{...a.runtime,...d.runtime}:a.runtime,updatedAt:ms()})),u=e.applyInstanceLifecycle(r,{type:"runtime-lifecycle-completed",baseline:a,observation:{...d,target:d.target?{...d.target,status:l}:void 0,workspace:d.workspace?{error:void 0,...d.workspace}:void 0,targetStatus:l,uiAccessStatus:l}});return i.diagnostic({instanceId:r,action:"start",reason:o,status:u.status,connectionStatus:u.connectionStatus,targetStatus:u.targetStatus,targetWeb:u.target.web,containerName:u.runtime.containerName},"node instance start completed"),u}function Bs(e){return nr.parse({...e,health:"unknown",connectionStatus:"offline",agentStatus:"offline",targetStatus:"unknown",uiAccessStatus:"unknown",target:{...e.target,status:"unknown"},updatedAt:ms()})}async function Ks(e={}){const r=e.token||process.env.TASK_HANDOFF_NODE_AGENT_TOKEN,i=Number(e.port||process.env.TASK_HANDOFF_NODE_AGENT_PORT||"8091"),o=`http://127.0.0.1:${i}`,a=e.containerUrl||process.env.TASK_HANDOFF_NODE_AGENT_CONTAINER_URL,p=yi(e.dataDir),g=e.remoteSecret||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_SECRET,h=e.remoteKeyId||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_KEY_ID,f=new jo(p),y=f.resolveNodeId(e.nodeId||process.env.TASK_HANDOFF_NODE_ID),I=e.connectionMode||("local-ipc"===process.env.TASK_HANDOFF_NODE_AGENT_CONNECTION_MODE?"local-ipc":"local-loopback"),A=e.ipcPath||process.env.TASK_HANDOFF_NODE_AGENT_IPC_PATH||_i(p.dataDir),w="local-ipc"===I?`ipc://${encodeURIComponent(A)}`:o,N=e.platform||process.platform,z=e.arch||process.arch,v=new Vs(p,y,o,a,i,N);v.node.connectionMode=I,v.node.controlEndpoint=w,v.node.endpoint=w,v.init();const E=e.dockerCommandRunner||pr,S=new hr(E,e.dockerTerminalCommandRunner),_=new yr(E,{publishHost:"127.0.0.1",imageService:S}),T=new Fs(new Ls(_,E,N,z),new $s(e.dockerCommandRunner||pr,p,()=>v.localNodeAgentUrl,function(){const e=process.env.TASK_HANDOFF_LOCAL_CONTROLLED_COMMAND_ARGV?.trim();if(!e){const e=process.env.TASK_HANDOFF_LOCAL_CONTROLLED_COMMAND?.trim();return e?e.split(/\s+/):void 0}let t;try{t=JSON.parse(e)}catch{throw Object.assign(new Error("TASK_HANDOFF_LOCAL_CONTROLLED_COMMAND_ARGV must be valid JSON."),{code:"LOCAL_CONTROLLED_COMMAND_INVALID"})}if(!Array.isArray(t)||!t.length||t.some(e=>"string"!=typeof e||!e))throw Object.assign(new Error("TASK_HANDOFF_LOCAL_CONTROLLED_COMMAND_ARGV must be a non-empty string array."),{code:"LOCAL_CONTROLLED_COMMAND_INVALID"});return t}(),e.localControlledInstanceLockPath)),k=e.updateCommandRunner||e.dockerCommandRunner||pr,C=e.fetchImpl||fetch,O=new qi({cacheDir:n.join(p.dataDir,"runtime-artifacts"),fetchImpl:C}),x=e.resolveRuntimeArtifactRelease||((e,t,n)=>Bi(e,t,n,C)),R=async(t,n,r)=>{const i=await n.artifactTarget(r);if(e.resolveRuntimeArtifact)return e.resolveRuntimeArtifact(t,i.platform,i.arch);const o=await x(t,i.platform,i.arch);if(o.identity.launcherAbi>i.launcherAbi)throw Object.assign(new Error(`Runtime requires launcher ABI ${o.identity.launcherAbi}, but ${i.platform}-${i.arch} provides ABI ${i.launcherAbi}.`),{code:"INSTANCE_BASE_RUNTIME_INCOMPATIBLE",retryable:!1});return O.resolve(o.identity,o.source)},D=e=>T.forRuntime(v.requireRuntime(e.runtimeId)),P=e=>{const t=D(e);return Ms(t)?t:void 0},j=e=>{const t=P(e);if(t)return t;throw Object.assign(new Error(`Runtime for instance ${e.id} does not use managed artifacts.`),{code:"INSTANCE_RUNTIME_ARTIFACT_UNMANAGED",retryable:!1})},M=e=>Boolean(P(e)),L=(e,t)=>{const n=v.context(e);return R(t,j(e),n)},$=d({logger:e.logger??!0}),F={requests:0,active:0,completed:0,aborted:0,limitRejected:0,responseBytes:0,totalDurationMs:0,maxResponseBytes:cs()};$.decorate("nodeAgentState",v),await $.register(l);const U=new qr(v,r,{logger:$.log,safetyIntervalMs:Number(process.env.TASK_HANDOFF_EVENT_CONNECTION_SAFETY_INTERVAL_MS)||void 0}),V=new Ki(v.controlledInstances,ns,{isInstalled:async(e,t)=>{const n=await L(e,t);return j(e).inspectRuntime(v.context(e),n.identity)},beginDrain:async e=>{try{const t=await async function(e,t){const n=ws(t);if(t.registrationToken&&(await Is(e,`${n}/api/internal/node-agent/drain`,{method:"POST",headers:{authorization:`Bearer ${t.registrationToken}`}},1e4)).ok)return{requested:t.apps.runningCount,failures:[]};const r=await Is(e,`${n}/api/apps/sessions`,{method:"GET",headers:{"cache-control":"no-cache"}},5e3);if(!r.ok)throw new Error(`Could not list app sessions for runtime drain (HTTP ${r.status}).`);const i=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return[];const t=e.data;if(Array.isArray(t))return t;if(!t||"object"!=typeof t||Array.isArray(t))return[];const n=t.snapshot,r=(n&&"object"==typeof n&&!Array.isArray(n)?n:t).sessions;return Array.isArray(r)?r:[]}(await r.json()).flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const t=e;return"running"===t.status&&"string"==typeof t.id&&t.id?[t.id]:[]}),o=await Promise.all(i.map(async t=>{try{const r=await Is(e,`${n}/api/apps/sessions/${encodeURIComponent(t)}/stop`,{method:"POST"},5e3);return r.ok?void 0:{sessionId:t,error:`HTTP ${r.status}`}}catch(e){return{sessionId:t,error:e instanceof Error?e.message:String(e)}}}));return{requested:i.length,failures:o.filter(e=>Boolean(e))}}(C,e);t.failures.length?$.log.warn({instanceId:e.id,requested:t.requested,failures:t.failures},"runtime convergence could not stop every app session"):$.log.info({instanceId:e.id,requested:t.requested},"runtime convergence requested app session drain")}catch(t){$.log.warn({instanceId:e.id,error:t instanceof Error?t.message:String(t)},"runtime convergence could not request app session drain")}},endDrain:async e=>{try{await async function(e,t){return!!t.registrationToken&&(await Is(e,`${ws(t)}/api/internal/node-agent/resume`,{method:"POST",headers:{authorization:`Bearer ${t.registrationToken}`}},5e3)).ok}(C,e)&&$.log.info({instanceId:e.id},"runtime convergence released app session drain")}catch(t){$.log.warn({instanceId:e.id,error:t instanceof Error?t.message:String(t)},"runtime convergence could not release app session drain")}},install:async(e,t)=>{const n=j(e);await n.installRuntime(v.context(e),await L(e,t))},restart:async e=>{const t=D(e),n=v.applyInstanceLifecycle(e.id,{type:"convergence-restart-requested"}),r=await t.restart(v.context(n));v.applyInstanceLifecycle(e.id,{type:"runtime-lifecycle-completed",baseline:n,observation:r})},onForcedDrain:e=>$.log.warn({instanceId:e.id},"runtime convergence drain deadline reached; restarting instance")},{drainTimeoutMs:Number(process.env.TASK_HANDOFF_RUNTIME_DRAIN_TIMEOUT_MS)||void 0,verificationTimeoutMs:Number(process.env.TASK_HANDOFF_RUNTIME_VERIFY_TIMEOUT_MS)||void 0,maxAttempts:Number(process.env.TASK_HANDOFF_RUNTIME_MAX_ATTEMPTS)||void 0});v.controlledInstances.setOnStored(e=>{U.publishInstanceLifecycle(e),v.updateJobs.reconcileRollouts(v.listInstances(),ns())}),U.start(),$.decorate("nodeAgentEventForwarder",U);const H=new Xr(E,()=>v.listInstances().filter(e=>"docker"===v.requireRuntime(e.runtimeId).type),e=>U.publish("instance.metrics.snapshot",e,{instanceId:e.instanceId}));H.start(),$.decorate("nodeAgentRuntimeMetrics",H);const q=(re=process.env.TASK_HANDOFF_DIAGNOSTIC_LOGS,["1","true","yes","on"].includes(String(re||"").trim().toLowerCase())),B=new mo(f,y,g,h),K=(e,t)=>{q&&$.log.info(e,t)},G={diagnostic:K,warn:(e,t)=>$.log.warn(e,t)},J=new Set,W=new Map,Y=(e,t,n)=>{const r=n&&"object"==typeof n&&!Array.isArray(n)?n.protocolVersion:void 0;if("string"!=typeof r||r===it)return n;const i=({field:n,action:i})=>$.log.warn({instanceId:e,report:t,protocolVersion:r,expectedProtocolVersion:it,field:n,action:i},"cross-version controlled instance report sanitized");return"register"===t?function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,r=["instanceId","projectId","source","nodeId","runtimeId","imageSelection","instanceVersion","protocolVersion","build","controlMode","capabilities","appInventory","target","workspace","registrationToken","processIncarnationId"],i=new Set([...r,"imageId"]);for(const e of Object.keys(n))i.has(e)||t?.({field:e,action:"ignored"});return Object.prototype.hasOwnProperty.call(n,"imageId")&&t?.({field:"imageId",action:"migrated"}),{...dr(n,r),imageSelection:vt(n.imageSelection,n.imageId)}}(n,i):function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=["status","health","protocolVersion","build","capabilities","appInventory","apps","aiSessions","triggers","workspace","target","processIncarnationId"],r=new Set(n);for(const n of Object.keys(e))r.has(n)||t?.({field:n,action:"ignored"});return dr(e,n)}(n,i)},X=async(e,t)=>{try{let n=v.requireInstance(e);"failed"===n.runtimeVersion?.phase&&M(n)&&(n=v.controlledInstances.put(nr.parse({...n,ready:!1,runtimeVersion:rs(Gi(n)),updatedAt:ms()})));const r=v.requireRuntime(n.runtimeId);await qs(v,T,C,e,G);const i=v.requireInstance(e);if("docker"===r.type&&"ready"!==i.imageProvisioning?.phase)return U.syncNow(),i;J.add(e),W.delete(e);let o=v.requireInstance(e);if(M(o)){try{o=await V.schedule(e,{startRequested:!0})}catch(n){o=v.requireInstance(e),G.warn({instanceId:e,action:"runtime.converge",reason:t,error:n instanceof Error?n.message:String(n)},"node instance runtime convergence failed after start")}"failed"===o.runtimeVersion?.phase&&G.warn({instanceId:e,action:"runtime.converge",reason:t,error:o.runtimeVersion.error},"node instance started with failed runtime convergence")}return await As(C,o,"start",G),U.syncNow(),o}catch(n){throw v.applyInstanceLifecycle(e,{type:"start-failed",error:n}),U.syncNow(),G.warn({instanceId:e,action:"start",reason:t,error:n instanceof Error?n.message:String(n)},"node instance start failed"),n}},Q=e=>{e.imageProvisioning&&async function(t,n,r,i,o,s,a){const c=e=>{const n=t.controlledInstances.get(r);n&&n.imageProvisioning?.generation===i&&n.imageSnapshot&&(t.controlledInstances.put(nr.parse({...n,status:"starting"===n.status?"starting":"provisioning",imageProvisioning:{...n.imageProvisioning,phase:e,error:void 0,updatedAt:ms()},updatedAt:ms()})),o())},d=t.controlledInstances.get(r);if(!d?.imageSnapshot||d.imageProvisioning?.generation!==i)return;let l=0,u=!1;try{const m=await n.ensure(d.imageSnapshot.requestedReference,c,e=>{u=!0,l=e.sequence,a?.(e)});u&&a?.({sequence:l+1,outcome:"succeeded"});const p=t.controlledInstances.get(r);if(!p?.imageSnapshot||p.imageProvisioning?.generation!==i)return;t.controlledInstances.put(nr.parse({...p,status:"starting"===p.status?"starting":"created",health:"unknown",imageSnapshot:{...p.imageSnapshot,requestedReference:m.requestedReference,resolvedDigest:m.resolvedDigest,resolvedReference:m.resolvedReference},imageProvisioning:{...p.imageProvisioning,phase:"ready",error:void 0,updatedAt:ms()},updatedAt:ms()})),o(),s.diagnostic({instanceId:r,action:"image.provision",reference:m.requestedReference,digest:m.resolvedDigest,pulled:m.pulled},"node instance image provisioning completed"),"starting"===p.status&&await((async e=>{await X(e,"image-ready").catch(()=>{})})(e.id))}catch(e){u&&a?.({sequence:l+1,outcome:"failed"});const n=t.controlledInstances.get(r);if(!n?.imageProvisioning||n.imageProvisioning.generation!==i)return;const c=e instanceof Error?e.message:String(e);t.controlledInstances.put(nr.parse({...n,status:"failed",health:"failed",imageProvisioning:{...n.imageProvisioning,phase:"failed",error:c,updatedAt:ms()},updatedAt:ms()})),o(),s.warn({instanceId:r,action:"image.provision",reference:n.imageProvisioning.requestedReference,error:c},"node instance image provisioning failed")}}(v,S,e.id,e.imageProvisioning.generation,()=>U.syncNow(),G,t=>{const n={instanceId:e.id,generation:e.imageProvisioning.generation,requestedReference:e.imageProvisioning.requestedReference,observedAt:ms()};if("outcome"in t)U.publish(Ln,{...n,sequence:1e3*t.sequence,outcome:t.outcome},{instanceId:e.id});else for(const[r,i]of function(e,t=6e4){const n=[];for(let r=0;r<e.length;r+=t)n.push(e.slice(r,r+t));return n}(t.data).entries())U.publish(Mn,{...n,sequence:1e3*t.sequence+r,data:i,...t.replay?{replay:!0}:{}},{instanceId:e.id})})},Z=async e=>{const t=new Map;for(const e of T.managedAdapters()){const n=await e.artifactTarget();t.set(`${n.platform}-${n.arch}`,{adapter:e})}for(const e of v.listInstances()){const n=P(e);if(!n)continue;const r=v.context(e),i=await n.artifactTarget(r);t.set(`${i.platform}-${i.arch}`,{adapter:n,context:r})}return(await Promise.all([...t.values()].map(({adapter:t,context:n})=>R(e,t,n)))).sort((e,t)=>`${e.identity.platform}/${e.identity.arch}`.localeCompare(`${t.identity.platform}/${t.identity.arch}`))},ee=async e=>{const t=te(),n=await Di(k),r="@task-handoff/server"===n.packageName?[...new Set([...n.relatedCurrentVersions,ns()])]:n.relatedCurrentVersions,i=await async function(e){const t=e.packageName||"@task-handoff/node-agent",n=await async function(e,t,n){const r=function(e){return"stable"===e?"latest":e}(n),i=await e(xi(),["view",`${t}@${r}`,"version","--json"]).catch(e=>{if(!function(e){if(!e||"object"!=typeof e)return!1;const t=e,n=[t.message,t.details?.stdout,t.details?.stderr].filter(e=>"string"==typeof e).join("\n");return/\bE404\b/i.test(n)}(e))throw e});if(!i)return;const o=JSON.parse(i.stdout);if("string"!=typeof o)throw new Error(`npm did not resolve ${t}@${r} to one version.`);return o}(e.runCommand,t,e.channel);if(!n)return function(e){return Zt.parse({source:"npm",channel:e.channel,currentVersion:e.currentVersion,availableVersion:e.currentVersion||"unavailable",impact:e.impact||{runningInstanceCount:0,stoppedInstanceCount:0,activeInstanceCount:0,restartInstanceCount:0,runningInstanceIds:[],stoppedInstanceIds:[],activeInstanceIds:[]},updateAvailable:!1,reason:`No ${e.channel} release is currently published.`,checkedAt:Ci()})}({channel:e.channel,currentVersion:e.currentVersion,impact:e.impact});const r=Oi(e.currentVersion,n)||(e.relatedCurrentVersions||[]).some(e=>Oi(e,n)),i=r?await async function(e,t,n){const r=await e(xi(),["view",`${t}@${n}`,"dist.integrity","--json"]),i=JSON.parse(r.stdout);if("string"!=typeof i||!/^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(i))throw Object.assign(new Error(`npm did not return immutable integrity metadata for ${t}@${n}.`),{statusCode:502,code:"NODE_UPDATE_PREFLIGHT_FAILED",retryable:!0});return i}(e.runCommand,t,n):void 0;return Zt.parse({source:"npm",channel:e.channel,currentVersion:e.currentVersion,availableVersion:n,...i?{artifactRef:`npm:${t}@${n}#${i}`}:{},runtimeArtifacts:e.runtimeArtifacts||[],impact:e.impact||{runningInstanceCount:0,stoppedInstanceCount:0,activeInstanceCount:0,restartInstanceCount:0,runningInstanceIds:[],stoppedInstanceIds:[],activeInstanceIds:[]},updateAvailable:r,checkedAt:Ci()})}({channel:e.channel,currentVersion:n.currentVersion||ns(),runCommand:k,packageName:n.packageName,relatedCurrentVersions:r,impact:t});if(!i.updateAvailable)return i;const o=await Z(i.availableVersion),s={...i,runtimeArtifacts:o.map(e=>e.identity),preflightToken:vi()};return ne.set(s.preflightToken,{result:s,expiresAt:Date.now()+6e5}),s},te=()=>{const e=v.listInstances(),t=e.filter(e=>!["created","stopped","failed"].includes(e.status)),n=t.filter(e=>e.apps.runningCount>0||e.aiSessions.runningCount>0);return{runningInstanceCount:t.length,stoppedInstanceCount:e.length-t.length,activeInstanceCount:n.length,restartInstanceCount:t.length,runningInstanceIds:t.map(e=>e.id).sort(),stoppedInstanceIds:e.filter(e=>!t.includes(e)).map(e=>e.id).sort(),activeInstanceIds:n.map(e=>e.id).sort()}},ne=new Map;var re;let ie;$.setErrorHandler((e,t,n)=>{const r=function(e){if(e instanceof m.z.ZodError)return{statusCode:400,code:"VALIDATION_ERROR",message:e.issues.map(e=>`${e.path.join(".")||"body"}: ${e.message}`).join("; "),details:{issues:e.issues.map(e=>({path:e.path.map(String),code:e.code,message:e.message}))}};const t=e&&"object"==typeof e?e:{};return{statusCode:"number"==typeof t.statusCode?t.statusCode:500,code:"string"==typeof t.code?t.code:"NODE_AGENT_ERROR",message:e instanceof Error?e.message:String(e),...t.details&&"object"==typeof t.details&&!Array.isArray(t.details)?{details:t.details}:{},..."boolean"==typeof t.retryable?{retryable:t.retryable}:{}}}(e);(q||r.statusCode>=500)&&(r.statusCode>=500?$.log.error.bind($.log):$.log.warn.bind($.log))({method:t.method,url:t.url,statusCode:r.statusCode,errorCode:r.code,error:r.message},"node agent request failed"),n.code(r.statusCode).send({error:{code:r.code,message:r.message,...e&&"object"==typeof e&&"string"==typeof e.expectedVersion?{expectedVersion:e.expectedVersion}:{},...e&&"object"==typeof e&&"string"==typeof e.actualVersion?{actualVersion:e.actualVersion}:{},...e&&"object"==typeof e&&"string"==typeof e.phase?{phase:e.phase}:{},...e&&"object"==typeof e&&"boolean"==typeof e.retryable?{retryable:e.retryable}:{},...e&&"object"==typeof e&&"number"==typeof e.blockingInstanceCount?{blockingInstanceCount:e.blockingInstanceCount}:{}}})}),$.addHook("preHandler",async e=>{const t=B.verify(e);if(t)e.nodeAgentAuthKeyId=t;else if(us(e)){if(r&&ds(e.headers)!==r){const e=new Error("Invalid node agent token.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_UNAUTHORIZED"}),e}}else if("/api/node-agent/pairing/complete"!==e.url.split("?")[0]&&!function(e){const t=e.split("?")[0];return/^\/api\/node-agent\/instances\/[^/]+\/(register|heartbeat)$/.test(t)}(e.url)){if(B.hasRemoteSecrets()){const e=new Error("Node agent HMAC signature is required.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_HMAC_SIGNATURE_REQUIRED"}),e}if(!function(e){return ls(e.ip)||ls(e.socket.remoteAddress)||!e.ip&&!e.socket.remoteAddress&&!e.socket.remoteFamily}(e)){const e=new Error("Local node agent access is only accepted from loopback or local IPC connections.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_LOCAL_TOKEN_REQUIRES_LOOPBACK"}),e}if(r&&ds(e.headers)!==r){const e=new Error("Invalid node agent token.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_UNAUTHORIZED"}),e}}});let oe=!1,se=!1;$.addHook("onClose",async()=>{se=!0,ie&&clearTimeout(ie),H.stop(),U.stop();for(const e of v.listInstances())V.cancel(e.id);await async function(e,t){await t.stopAll();for(const t of e.listInstances())"local"===e.requireRuntime(t.runtimeId).type&&e.controlledInstances.put(Bs(t))}(v,T)});const ae=async()=>{for(const e of v.listInstances().filter(e=>["provisioning","starting"].includes(e.status)&&"ready"!==e.imageProvisioning?.phase&&"docker"===v.requireRuntime(e.runtimeId).type))Q(e);const e=v.listInstances().filter(e=>{if(J.has(e.id))return!1;const t=v.requireRuntime(e.runtimeId);return"local"===t.type?Ps.has(e.status):"docker"===t.type&&(Ps.has(e.status)||"provisioning"===e.status&&"ready"===e.imageProvisioning?.phase)});for(const t of e)try{await qs(v,T,C,t.id,G,"restore"),await As(C,v.requireInstance(t.id),"start",G),J.add(t.id),W.delete(t.id)}catch(e){"local"===v.requireRuntime(t.runtimeId).type&&v.applyInstanceLifecycle(t.id,{type:"start-failed",error:e});const n=e instanceof Error?e.message:String(e);W.get(t.id)!==n&&(W.set(t.id,n),G.warn({instanceId:t.id,action:"restore",runtimeId:t.runtimeId,error:n},"node instance restore failed; recovery will retry"))}},ce=async()=>{const e=v.listInstances().filter(e=>M(e)&&!V.isRunning(e.id)&&(J.has(e.id)||"unknown"!==e.target.status)&&(!e.ready||"matched"!==e.runtimeVersion?.phase)&&!["created","stopped","failed","provisioning","stopping"].includes(e.status));await Promise.all(e.map(async e=>{try{await V.schedule(e.id)}catch(t){$.log.error({instanceId:e.id,error:t},"runtime convergence recovery failed")}}))};$.decorate("nodeAgentRestoreManagedInstances",ae),$.decorate("nodeAgentRecoverManagedInstances",ce),$.decorate("nodeAgentStartRecoverySupervisor",()=>{if(oe)return;oe=!0;const e=()=>{(async()=>{await ae(),await ce()})().catch(e=>$.log.error({error:e},"node agent startup recovery cycle failed")).finally(t)},t=()=>{se||(ie=setTimeout(()=>{ie=void 0,e()},1e4),ie.unref?.())};e()}),$.get("/api/node-agent/health",async()=>{return{data:{ok:!0,role:"node-agent",nodeId:y,platform:Yo(N),arch:process.arch,protocolVersion:it,build:(e="node-agent",{component:e,packageName:"@task-handoff/node-agent",packageVersion:ns(),protocolVersion:it,buildId:ts("TASK_HANDOFF_BUILD_ID"),builtAt:ts("TASK_HANDOFF_BUILT_AT"),gitCommit:ts("TASK_HANDOFF_GIT_COMMIT"),imageRef:ts("TASK_HANDOFF_IMAGE_REF"),imageDigest:ts("TASK_HANDOFF_IMAGE_DIGEST")}),instanceProxy:{...F},serverTime:(new Date).toISOString()}};var e});const de=e=>{if(!us(e)){const e=new Error("Node agent TCP listener settings are available only over local Unix IPC.");throw Object.assign(e,{statusCode:403,code:"NODE_AGENT_LISTENER_LOCAL_IPC_ONLY"}),e}if(!$.nodeAgentListenerManager){const e=new Error("Node agent TCP listener manager is not initialized.");throw Object.assign(e,{statusCode:503,code:"NODE_AGENT_LISTENER_UNAVAILABLE"}),e}return $.nodeAgentListenerManager};return $.get("/api/node-agent/settings/external-listener",async e=>({data:de(e).current()})),$.patch("/api/node-agent/settings/external-listener",async e=>({data:await de(e).update(e.body)})),$.get("/api/node-agent/updates/jobs",async()=>({data:v.updateJobs.list()})),$.post("/api/node-agent/updates/check",async e=>({data:await ee(Qt.parse(e.body))})),$.post("/api/node-agent/updates/apply",async(e,r)=>{const i=es.parse(e.body),o=await(async e=>{const t=ne.get(e.preflightToken);if(ne.delete(e.preflightToken),!t||t.expiresAt<=Date.now()){const e=new Error("The update preflight is missing or expired. Check for updates again.");throw Object.assign(e,{statusCode:409,code:"UPDATE_PREFLIGHT_EXPIRED"}),e}const n=t.result,r=await Di(k);if(n.channel!==e.channel||n.availableVersion!==e.targetVersion||n.currentVersion!==(r.currentVersion||ns())||!0!==n.artifactRef?.startsWith(`npm:${r.packageName}@`)||JSON.stringify(n.impact)!==JSON.stringify(te())){const e=new Error("The update target or affected instances changed after preflight. Check for updates again.");throw Object.assign(e,{statusCode:409,code:"UPDATE_PREFLIGHT_STALE"}),e}const i=await Z(n.availableVersion);if(JSON.stringify(n.runtimeArtifacts)!==JSON.stringify(i.map(e=>e.identity))){const e=new Error("The runtime artifacts changed after preflight. Check for updates again.");throw Object.assign(e,{statusCode:409,code:"UPDATE_PREFLIGHT_STALE"}),e}return n})(i);if(!o.supported){const e=new Error(o.reason||"The requested update is not supported.");throw Object.assign(e,{statusCode:400,code:"UPDATE_UNSUPPORTED"}),e}if(!o.updateAvailable){const e=new Error(o.reason||"No update is available for the selected channel.");throw Object.assign(e,{statusCode:409,code:"UPDATE_NOT_AVAILABLE"}),e}const a=v.updateJobs.create(y,o),c=("undefined"==typeof document?require("url").pathToFileURL(__filename).href:b&&"SCRIPT"===b.tagName.toUpperCase()&&b.src||new URL("cli.js",document.baseURI).href)?n.dirname(s.fileURLToPath("undefined"==typeof document?require("url").pathToFileURL(__filename).href:b&&"SCRIPT"===b.tagName.toUpperCase()&&b.src||new URL("cli.js",document.baseURI).href)):__dirname,{worker:d,packaged:l,expectedWorker:u}=function(e,r=t.existsSync){const i=[n.resolve(e,"..","bin","task-handoff-node-update-worker"),n.resolve(e,"..","..","bin","task-handoff-node-update-worker")],o=i.find(r),s=n.resolve(e,"..","..","..","..","scripts","node-update-worker.cjs");return o?{worker:o,packaged:!0,expectedWorker:i[0]}:r(s)?{worker:s,packaged:!1,expectedWorker:i[0]}:{worker:void 0,packaged:!1,expectedWorker:i[0]}}(c);if(!d){v.updateJobs.patch(a.id,{status:"failed",rollout:{...a.rollout,phase:"failed"},error:{code:"NODE_UPDATE_FAILED",message:`Update worker was not found: ${u}`,retryable:!1},completedAt:ms()});const e=new Error(`Node agent update worker was not found: ${u}`);throw Object.assign(e,{statusCode:500,code:"UPDATE_WORKER_NOT_FOUND"}),e}return await k("systemd-run",["--unit",`task-handoff-update-${a.id}`,"--collect","--property=Type=exec",...l?[d]:[process.execPath,d],"--job-file",v.updateJobs.records.filePath(a.id),"--target-version",a.toVersion,"--npm-command",xi(),...ts("TASK_HANDOFF_CONTROL_PLANE_HEALTH_URL")?["--control-plane-health-url",ts("TASK_HANDOFF_CONTROL_PLANE_HEALTH_URL")]:[]]),r.code(202).send({data:a})}),$.post("/api/node-agent/pairing/invites",async(e,t)=>{const n=f.createPairingInvite(bo.parse(e.body||{}));return t.code(201).send({data:{nodeId:y,joinToken:n.token,expiresAt:n.expiresAt}})}),$.post("/api/node-agent/pairing/complete",async(e,t)=>{const n=f.completePairingInvite(wo.parse(e.body));return t.code(201).send({data:{nodeId:y,keyId:n.keyId,secret:n.secret,pairedAt:n.pairedAt}})}),$.get("/api/node-agent/control-plane-pairings",async e=>({data:f.listControlPlanePairings(e.nodeAgentAuthKeyId)})),$.delete("/api/node-agent/control-plane-pairings/:keyId",async e=>{const t=m.z.string().trim().min(1).max(160).parse(e.params.keyId);return{data:{deleted:f.deleteControlPlanePairing(t,e.nodeAgentAuthKeyId)}}}),$.get("/api/node-agent/control-plane-connections",async()=>({data:f.listControlPlaneConnections().map(e=>({...e,...$.nodeAgentReverseTunnels?.state(e.id)||{status:e.enabled?"connecting":"disabled"}}))})),$.delete("/api/node-agent/control-plane-connections/:connectionId",async e=>{const t=m.z.string().trim().min(1).max(160).parse(e.params.connectionId),n=f.deleteControlPlaneConnection(t);return n&&$.nodeAgentReverseTunnels?.connectConfigured(),{data:{deleted:n}}}),$.post("/api/node-agent/control-plane-connections",async(e,t)=>{const n=No.parse(e.body),r=function(e){const t=new URL(e);if("http:"!==t.protocol&&"https:"!==t.protocol){const e=new Error("Control-plane URL must use http or https.");throw Object.assign(e,{statusCode:400,code:"NODE_AGENT_REMOTE_CONTROL_PLANE_URL_INVALID"}),e}return t.toString().replace(/\/$/,"")}(n.controlPlaneUrl);return f.runControlPlaneConnectionOperation(r,async()=>{const e=f.stageControlPlaneConnection({url:r,...n.controlPlaneName?{name:n.controlPlaneName}:{},enabled:!1!==n.activate});let i;try{i=await async function(e,t,n){const r=await e(new URL("/api/node-join/complete",t).toString(),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)}),i=await r.json().catch(()=>({}));if(!r.ok){const e=new Error(i.error?.message||`Control-plane node join failed with HTTP ${r.status}.`);throw Object.assign(e,{statusCode:r.status,code:i.error?.code||"NODE_AGENT_REMOTE_JOIN_FAILED"}),e}return i.data||{}}(C,r,{joinToken:n.joinToken,nodeId:y,nodeName:v.node.name,keyId:e.pairing.keyId,secret:e.pairing.secret,pairedAt:e.pairing.pairedAt})}catch(t){throw f.rollbackControlPlaneConnection(e),t}const o=f.commitControlPlaneConnection(e,{name:n.controlPlaneName||("string"==typeof i.name&&i.name?i.name:void 0)});let s,a=o.connection.enabled?"saved":"disabled";if($.nodeAgentReverseTunnels)try{$.nodeAgentReverseTunnels.connectConfigured(),o.connection.enabled&&(a="connecting")}catch(e){a="failed",s=e instanceof Error?e.message:String(e)}return t.code(201).send({data:{pairing:f.listControlPlanePairings().find(e=>e.keyId===o.pairing.keyId),connection:o.connection,tunnel:{status:a,...s?{error:s}:{}}}})})}),$.get("/api/node-agent/runtimes",async()=>({data:v.nodeRuntimes.list()})),$.post("/api/node-agent/runtimes",async(e,t)=>t.code(201).send({data:v.createRuntime(gi.parse(e.body))})),$.patch("/api/node-agent/runtimes/:id",async e=>({data:v.updateRuntime(e.params.id,hi.parse(e.body))})),$.delete("/api/node-agent/runtimes/:id",async e=>({data:{deleted:v.deleteRuntime(e.params.id)}})),$.post("/api/node-agent/runtimes/:id/check",async e=>{const t=v.requireRuntime(e.params.id);return{data:await v.checkRuntime(t.id,T.forRuntime(t))}}),$.get("/api/node-agent/local-folders",async()=>({data:v.localFolders.list()})),$.get("/api/node-agent/folders/tree",async e=>({data:ci(ui.parse(e.query))})),$.post("/api/node-agent/local-folders",async(e,t)=>t.code(201).send({data:v.createLocalFolder(li.parse(e.body))})),$.delete("/api/node-agent/local-folders/:id",async e=>({data:{deleted:v.localFolders.delete(e.params.id)}})),$.get("/api/node-agent/models",async()=>({data:v.listModels()})),$.post("/api/node-agent/models",async(e,t)=>t.code(201).send({data:v.createModel(An.parse(e.body))})),$.put("/api/node-agent/models/:id/deploy",async e=>{const t=e.params.id,n=wn.parse(e.body);if(n.id!==t)throw Object.assign(new Error(`Model payload id ${n.id} does not match route id ${t}.`),{statusCode:400,code:"NODE_MODEL_ID_MISMATCH"});return{data:v.deployModel(n)}}),$.patch("/api/node-agent/models/:id",async e=>({data:v.updateModel(e.params.id,bn.parse(e.body))})),$.delete("/api/node-agent/models/:id",async e=>({data:{deleted:v.deleteModel(e.params.id)}})),$.get("/api/node-agent/instances",async()=>({data:v.listInstances()})),$.post("/api/node-agent/instances",async(e,t)=>{const n=v.createInstance(mi.parse(e.body));return U.syncNow(),n.imageProvisioning&&Q(n),t.code(201).send({data:n})}),$.post("/api/node-agent/instances/:id/image-provisioning/retry",async e=>{const t=function(e,t){const n=e.requireInstance(t);if("docker"!==e.requireRuntime(n.runtimeId).type||!n.imageSnapshot){const e=new Error(`Instance ${t} does not use a Docker image.`);throw Object.assign(e,{statusCode:400,code:"INSTANCE_IMAGE_PROVISIONING_UNSUPPORTED"}),e}if("failed"!==n.status||"failed"!==n.imageProvisioning?.phase){const e=new Error(`Instance ${t} does not have failed image provisioning to retry.`);throw Object.assign(e,{statusCode:409,code:"INSTANCE_IMAGE_PROVISIONING_NOT_FAILED"}),e}const r=ms();return e.controlledInstances.put(nr.parse({...n,status:"provisioning",health:"unknown",imageProvisioning:{phase:"checking-image",requestedReference:n.imageSnapshot.requestedReference,generation:(n.imageProvisioning?.generation||0)+1,startedAt:r,updatedAt:r},updatedAt:r}))}(v,e.params.id);return U.syncNow(),Q(t),{data:t}}),$.patch("/api/node-agent/instances/:id",async e=>{const t=e.params.id,n=v.requireInstance(t),r=pi.parse(e.body),i=nr.parse({...n,...r,...r.config?{config:{...n.config,...r.config}}:{},updatedAt:ms()}),o=v.controlledInstances.put(i);return U.syncNow(),{data:o}}),$.put("/api/node-agent/instances/:id/model-assignment",async e=>{const t=e.params.id,n=v.assignModels(t,Nn.parse(e.body));return await bs(C,v,t),{data:n}}),$.post("/api/node-agent/instances/:id/register",async(e,t)=>{const n=e.params.id,r=Y(n,"register",e.body),i=v.registerInstance(n,lr.parse(r),ds(e.headers));return U.syncNow(),K({instanceId:n,action:"register",protocolVersion:i.protocolVersion,build:i.build,targetStatus:i.targetStatus,targetStrategy:i.target.strategy},"node instance registered"),!M(i)||i.ready&&"matched"===i.runtimeVersion?.phase||V.schedule(n).catch(e=>$.log.error({instanceId:n,error:e},"runtime convergence after registration failed")),t.code(201).send({data:i})}),$.post("/api/node-agent/instances/:id/heartbeat",async e=>{const t=e.params.id,n=Y(t,"heartbeat",e.body),r=v.heartbeatInstance(t,ur.parse(n),ds(e.headers));return U.syncNow(),K({instanceId:t,action:"heartbeat",status:r.status,health:r.health,protocolVersion:r.protocolVersion,build:r.build,targetStatus:r.targetStatus,apps:r.apps.runningCount},"node instance heartbeat accepted"),!M(r)||r.ready&&"matched"===r.runtimeVersion?.phase||V.schedule(t).catch(e=>$.log.error({instanceId:t,error:e},"runtime convergence after heartbeat failed")),{data:r}}),$.get("/api/node-agent/events",{websocket:!0},e=>{const t=e;t.send(JSON.stringify({type:"node-agent.events.connected",nodeId:y,serverTime:(new Date).toISOString()}));const n=U.addOutput(t);t.on("close",n),t.on("error",n)}),$.get("/api/node-agent/docker/images",async()=>({data:await Er(e.dockerCommandRunner)})),$.get("/api/node-agent/instances/:id/metrics",async e=>{const t=e.params.id,n=v.requireInstance(t);if("docker"!==v.requireRuntime(n.runtimeId).type){const e=new Error(`Runtime type ${v.requireRuntime(n.runtimeId).type} does not provide resource metrics.`);throw Object.assign(e,{statusCode:409,code:"INSTANCE_METRICS_UNSUPPORTED"}),e}return{data:await H.snapshot(t)}}),$.post("/api/node-agent/instances/:id/start",async e=>{const t=e.params.id;return Zo.parse(e.body),{data:await X(t,"request")}}),$.post("/api/node-agent/instances/:id/runtime/reconcile",async e=>{const t=e.params.id;Zo.parse(e.body);const n=v.requireInstance(t);v.controlledInstances.put(nr.parse({...n,ready:!1,runtimeVersion:rs(Gi(n)),updatedAt:ms()}));const r=await V.schedule(t,{startRequested:!["created","stopped"].includes(n.status),resumeCancelled:!0});return U.syncNow(),{data:r}}),$.post("/api/node-agent/instances/:id/stop",async e=>{const t=e.params.id;await V.cancel(t);const n=v.requireInstance(t);K({instanceId:n.id,action:"stop",runtimeId:n.runtimeId,containerName:n.runtime.containerName},"node instance stop requested");const r=T.forRuntime(v.requireRuntime(n.runtimeId));await r.stop(v.context(n));const i=v.applyInstanceLifecycle(t,{type:"stop-completed"});return U.syncNow(),K({instanceId:n.id,action:"stop",status:i.status,connectionStatus:i.connectionStatus,containerName:i.runtime.containerName},"node instance stop completed"),{data:i}}),$.post("/api/node-agent/instances/:id/restart",async e=>{const t=e.params.id;let n=v.requireInstance(t);if(Zo.parse(e.body),M(n)&&(!n.ready||"matched"!==n.runtimeVersion?.phase)){"failed"===n.runtimeVersion?.phase&&(n=v.controlledInstances.put(nr.parse({...n,runtimeVersion:rs(Gi(n)),updatedAt:ms()})));const e=await V.schedule(t,{startRequested:!0});return U.syncNow(),{data:e}}K({instanceId:t,action:"restart",runtimeId:n.runtimeId,imageId:n.imageSelection?.imageId,containerName:n.runtime.containerName},"node instance restart requested");const r=T.forRuntime(v.requireRuntime(n.runtimeId)),i=await r.restart(v.context(n)),o=nr.parse({...n,...i,target:i.target?{...n.target,...i.target}:n.target,updatedAt:ms()}),s=await ys(C,o),a=v.applyInstanceLifecycle(t,{type:"runtime-lifecycle-completed",baseline:n,observation:{...i,target:i.target?{...i.target,status:s}:void 0,targetStatus:s,uiAccessStatus:s}});return J.add(t),W.delete(t),await As(C,a,"restart",G),U.syncNow(),K({instanceId:t,action:"restart",status:a.status,connectionStatus:a.connectionStatus,targetStatus:a.targetStatus,targetWeb:a.target.web,containerName:a.runtime.containerName},"node instance restart completed"),{data:a}}),$.post("/api/node-agent/instances/:id/delete",async e=>{const t=e.params.id,n=v.requireInstance(t);await V.cancel(t),K({instanceId:t,action:"delete",runtimeId:n.runtimeId,containerName:n.runtime.containerName},"node instance delete requested");const r=T.forRuntime(v.requireRuntime(n.runtimeId));await r.delete(v.context(n,{})),K({instanceId:t,action:"delete"},"node instance delete completed");const i=v.controlledInstances.delete(t);return v.modelAssignments.delete(t),v.modelEnvironments.delete(t),U.syncNow(),{data:{deleted:i}}}),$.post("/api/node-agent/instances/:id/proxy",async(e,t)=>{const n=e.params.id,r=di.parse(e.body),i=ws(v.requireInstance(n)),o=r.path.startsWith("/")?r.path:`/${r.path}`;"POST"===r.method&&"/api/apps/sessions"===o&&await bs(C,v,n),K({instanceId:n,action:"proxy",method:r.method,path:o,instanceBase:i},"node instance proxy requested");const s=await C(`${i}${o}`,{method:r.method,headers:{...r.headers},body:ss(r)}),a=s.headers.get("content-type")||"application/octet-stream",c=await s.text();K({instanceId:n,action:"proxy",method:r.method,path:o,statusCode:s.status,contentType:a},"node instance proxy completed"),t.code(s.status).type(a).send(c)}),$.post("/api/node-agent/instances/:id/proxy/stream",{bodyLimit:as},async(e,t)=>{const n=Date.now();F.requests+=1,F.active+=1;const r=new AbortController;let i=0,o=!1,s=!1;const a=e=>{s||(s=!0,F.active-=1,F.totalDurationMs+=Date.now()-n,F.responseBytes+=i,F[e]+=1)},d=()=>{r.abort(),o&&a("aborted")};e.raw.once("aborted",d),t.raw.once("close",d);try{const n=e.params.id,s=di.parse(e.body),d=ws(v.requireInstance(n)),l=s.path.startsWith("/")?s.path:`/${s.path}`;K({instanceId:n,action:"proxy.stream",method:s.method,path:l,instanceBase:d},"node instance streaming proxy requested");const u=await C(`${d}${l}`,{method:s.method,headers:{...s.headers},body:ss(s),signal:r.signal}),m=Number(u.headers.get("content-length"));if(Number.isFinite(m)&&m>F.maxResponseBytes)return F.limitRejected+=1,r.abort(),t.code(502).send({error:{code:"INSTANCE_PROXY_RESPONSE_TOO_LARGE",message:`Instance response exceeds ${F.maxResponseBytes} bytes.`}});t.code(u.status);for(const[e,n]of Object.entries(os(u.headers)))t.header(e,n);if(!u.body||"HEAD"===s.method)return a("completed"),t.send();const p=new c.Transform({transform(e,t,n){if(i+=e.length,i>F.maxResponseBytes)return F.limitRejected+=1,r.abort(),void n(Object.assign(new Error("Instance proxy response limit exceeded."),{code:"INSTANCE_PROXY_RESPONSE_TOO_LARGE"}));n(null,e)}});return o=!0,p.once("end",()=>a("completed")),p.once("error",()=>a("aborted")),t.send(c.Readable.fromWeb(u.body).pipe(p))}catch(e){throw a("aborted"),e}finally{e.raw.off("aborted",d),o||a("completed")}}),$.post("/api/node-agent/instances/:id/proxy/raw",{bodyLimit:as},async(e,t)=>{const n=e.params.id,r=di.parse(e.body),i=ws(v.requireInstance(n)),o=r.path.startsWith("/")?r.path:`/${r.path}`;K({instanceId:n,action:"proxy.raw",method:r.method,path:o,instanceBase:i},"node instance raw proxy requested");const s=await C(`${i}${o}`,{method:r.method,headers:{...r.headers},body:ss(r)}),a=Number(s.headers.get("content-length"));if(Number.isFinite(a)&&a>F.maxResponseBytes)return F.limitRejected+=1,t.code(502).send({error:{code:"INSTANCE_PROXY_RESPONSE_TOO_LARGE",message:`Instance response exceeds ${F.maxResponseBytes} bytes.`}});let c;try{c=await async function(e,t){if(!e.body)return Buffer.alloc(0);const n=[];let r=0;const i=e.body.getReader();for(;;){const{done:e,value:o}=await i.read();if(e)break;if(r+=o.byteLength,r>t)throw await i.cancel("Instance proxy response limit exceeded.").catch(()=>{}),Object.assign(new Error("Instance proxy response limit exceeded."),{code:"INSTANCE_PROXY_RESPONSE_TOO_LARGE"});n.push(Buffer.from(o))}return Buffer.concat(n,r)}(s,F.maxResponseBytes)}catch(e){if(!(e instanceof Error)||"INSTANCE_PROXY_RESPONSE_TOO_LARGE"!==e.code)throw e;return F.limitRejected+=1,t.code(502).send({error:{code:"INSTANCE_PROXY_RESPONSE_TOO_LARGE",message:`Instance response exceeds ${F.maxResponseBytes} bytes.`}})}return K({instanceId:n,action:"proxy.raw",method:r.method,path:o,statusCode:s.status,byteLength:c.length},"node instance raw proxy completed"),{data:{status:s.status,headers:os(s.headers),bodyBase64:c.toString("base64")}}}),$.get("/api/node-agent/instances/:id/proxy/ws/*",{websocket:!0},(e,t)=>{const n=t.params.id,r=t.params["*"]||"",i=t.url.indexOf("?"),o=i>=0?t.url.slice(i):"";let s;try{const i=ws(v.requireInstance(n)),a=new URL(`/${r}${o}`,`${i}/`);a.protocol="https:"===a.protocol?"wss:":"ws:";const c=function(e){const t=e["sec-websocket-protocol"],n=(Array.isArray(t)?t.join(","):"string"==typeof t?t:"").split(",").map(e=>e.trim()).filter(Boolean);return n.length?n:void 0}(t.headers);K({instanceId:n,action:"proxy.ws",path:`/${r}${o}`,upstreamUrl:a.toString(),protocols:c||[]},"node instance websocket proxy opening"),s=c?new u(a,c):new u(a),s.on("open",()=>{K({instanceId:n,action:"proxy.ws",path:`/${r}${o}`},"node instance websocket proxy opened"),e.on("message",(e,t)=>s?.readyState===u.OPEN&&s.send(function(e,t){return t?e:e.toString()}(e,t))),e.on("close",()=>s?.close()),e.on("error",()=>s?.close())}),s.on("message",(t,n)=>{e.readyState===u.OPEN&&e.send(n?t:t.toString())}),s.on("close",()=>{K({instanceId:n,action:"proxy.ws",path:`/${r}${o}`},"node instance websocket proxy closed"),e.close()}),s.on("error",t=>{K({instanceId:n,action:"proxy.ws",path:`/${r}${o}`,error:t instanceof Error?t.message:String(t)},"node instance websocket proxy failed"),e.close(1011,"Instance websocket proxy failed.")})}catch(t){K({instanceId:n,action:"proxy.ws",path:`/${r}${o}`,error:t instanceof Error?t.message:String(t)},"node instance websocket endpoint unavailable"),s?.close(),e.close(1011,"Instance websocket endpoint is not reachable.")}}),$}async function Gs(e){const o=yi(e.dataDir),s=(a=e.host,c=e.port,Gn.parse({bindScope:"0.0.0.0"===a.trim()?"all-ipv4":"loopback",port:c}));var a,c;const d=t.existsSync(o.settingsPath),l=function(e,t){return new Si(e.settingsPath,()=>({version:1,externalListener:t}),{schema:Qo,sanitize:gs})}(o,s),u=l.get().externalListener,m=function(e,i={}){return function(e,i={}){t.mkdirSync(n.dirname(e),{recursive:!0});const o={pid:process.pid,hostname:p.hostname(),component:i.component,command:process.argv.join(" "),acquiredAt:(new Date).toISOString(),token:r.randomUUID(),startIdentity:k(process.pid),dataDir:i.dataDir,host:i.host,port:i.port,instanceId:i.instanceId};for(let n=0;n<5;n+=1)try{return t.mkdirSync(e),t.writeFileSync(S(e),`${JSON.stringify({token:o.token,pid:o.pid,startIdentity:o.startIdentity,startedAt:(new Date).toISOString()})}\n`,{encoding:"utf8",mode:384,flag:"wx"}),D(e,o),{lockPath:e,owner:o,release(){const n=O(e);n?.token===o.token&&t.rmSync(e,{recursive:!0,force:!0})}}}catch(o){if("EEXIST"!==o.code)throw o;const s=O(e);if(R(s))throw new v(e,s,i.error);if(!s&&(j(e)||$(e)<(i.incompleteLockStaleMs??2e3))){if(n+1<5){L();continue}throw new v(e,void 0,i.error)}const a=r.randomUUID();if(!F(e,a)){if(n+1<5){L();continue}throw new v(e,O(e),i.error)}const c=O(e);if(R(c))throw M(_(e)),new v(e,c,i.error);if(s?.token&&c?.token!==s.token){M(_(e));continue}if(!V(e,a))continue;t.rmSync(e,{recursive:!0,force:!0})}const s=O(e);throw new v(e,s,i.error)}(e,{...i,component:"node-agent",error:{label:"Node agent",code:"NODE_AGENT_ALREADY_RUNNING"}})}(n.join(p.tmpdir(),`task-handoff-node-agent-${process.getuid?.()??"user"}.lock`),{dataDir:o.dataDir,host:ps(u.bindScope),port:u.port});try{const r={...e,port:u.port},s=await Ks(r),a=s.nodeAgentState;if(!a)throw new Error("Node agent state was not initialized.");const c=new jo(o).resolveNodeId(e.nodeId||process.env.TASK_HANDOFF_NODE_ID),p=function(e,t,n,r){const i=t.token||process.env.TASK_HANDOFF_NODE_AGENT_TOKEN,o=new jo(n),s=new Map;let a=!1;const c=(t,n)=>{n.status=n.lastDisconnectedAt?"reconnecting":"connecting",n.error=void 0;const o=Vo(e,{...n.config,nodeId:r,port:()=>e.nodeAgentState.currentListenerPort,token:i});return n.socket=o,o.on("open",()=>{s.get(t)===n&&n.socket===o&&(n.retry.reset(),n.status="connected",n.lastConnectedAt=(new Date).toISOString(),n.error=void 0,e.log.info({nodeId:r,tunnelUrl:new URL(n.config.tunnelUrl).origin},"node agent reverse tunnel connected"))}),o.on("close",(i,d)=>{s.get(t)===n&&n.socket===o&&(n.socket=void 0,n.lastDisconnectedAt=(new Date).toISOString(),n.error=`WebSocket closed${i?` (${i})`:""}${d?`: ${Buffer.isBuffer(d)?d.toString("utf8"):String(d)}`:""}`,a||(e.log.warn({nodeId:r,tunnelUrl:new URL(n.config.tunnelUrl).origin,code:i,reason:Buffer.isBuffer(d)?d.toString("utf8"):String(d||"")},"node agent reverse tunnel disconnected"),((t,n)=>{if(a||n.retry.pending||s.get(t)!==n)return;const i=n.retry.schedule(()=>{a||s.get(t)!==n||n.socket||c(t,n)});i&&(n.status="reconnecting",e.log.info({nodeId:r,tunnelUrl:new URL(n.config.tunnelUrl).origin,attempt:i.attempt,delay:i.delay},"node agent reverse tunnel reconnect scheduled"))})(t,n)))}),o.on("error",e=>{s.get(t)===n&&n.socket===o&&(n.status="failed",n.error=e instanceof Error?e.message:String(e))}),o},d=(e,t)=>{const n=s.get(e);n?.retry.cancel();const r={config:t,retry:new Vr,status:"connecting"};return s.set(e,r),n?.socket?.close(1e3,"Reverse tunnel reconnecting."),c(e,r)},l=(e,t)=>e.tunnelUrl===t.tunnelUrl&&e.keyId===t.keyId&&e.secret===t.secret;return{connectConfigured:()=>{a=!1;const n=new Map,i=o.resolvedControlPlaneAccess(),c=new Set;for(const{connection:t,pairing:o}of i.connections){if(!t.enabled)continue;if(!o){e.log.warn({nodeId:r,connectionId:t.id,pairingKeyId:t.pairingKeyId},"node agent control-plane connection has no pairing");continue}const i=Ho(t.url);n.set(t.id,{tunnelUrl:i,keyId:o.keyId,secret:o.secret}),c.add(i)}const u=function(e){const t=e.controlPlaneTunnelUrl||process.env.TASK_HANDOFF_CONTROL_PLANE_TUNNEL_URL;return t?new URL(t).toString():void 0}(t);if(u&&!c.has(u)){const e=o.reverseTunnelSecret(process.env.TASK_HANDOFF_CONTROL_PLANE_URL,t.remoteSecret||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_SECRET,t.remoteKeyId||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_KEY_ID);n.set(`explicit:${u}`,{tunnelUrl:u,keyId:e?.keyId,secret:e?.secret}),c.add(u)}const m=i.hasPersistedAccess?void 0:function(){const e=process.env.TASK_HANDOFF_CONTROL_PLANE_URL;if(!e)return;const t=new URL(ao,e);return t.protocol="https:"===t.protocol?"wss:":"ws:",t.toString()}();if(m&&!c.has(m)){const e=o.reverseTunnelSecret(process.env.TASK_HANDOFF_CONTROL_PLANE_URL,t.remoteSecret||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_SECRET,t.remoteKeyId||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_KEY_ID);n.set(`bootstrap:${m}`,{tunnelUrl:m,keyId:e?.keyId,secret:e?.secret})}(e=>{for(const[t,n]of s)e.has(t)||(n.retry.cancel(),s.delete(t),n.socket?.close(1e3,"Reverse tunnel configuration removed."));for(const[t,n]of e){const e=s.get(t);e&&l(e.config,n)||d(t,n)}})(n)},state:e=>{const t=s.get(e);if(t)return{status:t.status,...t.lastConnectedAt?{lastConnectedAt:t.lastConnectedAt}:{},...t.lastDisconnectedAt?{lastDisconnectedAt:t.lastDisconnectedAt}:{},...t.error?{error:t.error}:{}}},closeAll:()=>{a=!0;for(const e of s.values())e.retry.cancel(),e.socket?.close(1001,"Node agent shutting down.");s.clear()}}}({log:s.log,inject:e=>s.inject(e),nodeAgentEventForwarder:s.nodeAgentEventForwarder,nodeAgentState:a},r,o,c);s.decorate("nodeAgentReverseTunnels",p);const g=new Hs({app:s,state:a,settings:l,config:u,source:d?"persisted":"bootstrap"});let h;s.decorate("nodeAgentListenerManager",g),function(e){let t=!1;const n=async n=>{if(!t){t=!0,p.closeAll(),h?.close();try{await e.close()}finally{process.exitCode=n?0:process.exitCode}}},r=()=>{n("SIGINT")},i=()=>{n("SIGTERM")};process.once("SIGINT",r),process.once("SIGTERM",i),e.addHook("onClose",async()=>{process.off("SIGINT",r),process.off("SIGTERM",i)})}(s),s.addHook("onClose",async()=>{h?.close(),m.release()});try{await s.ready();const r=e.ipcPath||process.env.TASK_HANDOFF_NODE_AGENT_IPC_PATH||_i(o.dataDir);h=await async function(e,r){!function(e,r=process.platform){if("win32"!==r){t.mkdirSync(n.dirname(e),{recursive:!0,mode:448});try{t.chmodSync(n.dirname(e),448)}catch{}try{t.unlinkSync(e)}catch(e){if("ENOENT"!==e.code)throw e}}}(r);const o=i.createServer((t,n)=>{e.server.emit("request",t,n)});return o.on("upgrade",(t,n,r)=>{e.server.emit("upgrade",t,n,r)}),await new Promise((e,t)=>{o.once("error",t),o.listen(r,()=>{o.off("error",t),e()})}),o}(s,r),await g.start(),p.connectConfigured(),s.nodeAgentStartRecoverySupervisor?.()}catch(e){throw await s.close(),e}}catch(e){throw m.release(),e}}function Js(e){const t=Number(e);if(!Number.isInteger(t)||t<=0||t>65535)throw new Error("Port must be a valid TCP port.");return t}function Ws(e){if("local-ipc"!==e&&"local-loopback"!==e)throw new Error("Connection mode must be local-ipc or local-loopback.");return e}function Ys(e){const t=Number(e);if(!Number.isInteger(t)||t<=0)throw new Error("Expiry must be a positive integer.");return t}(async function(){const t=new e.Command;t.name("task-handoff-node-agent").description("Run a TaskHandoff node agent.").version(z("@task-handoff/cli")).option("--host <host>","Node agent host",process.env.TASK_HANDOFF_NODE_AGENT_HOST||"127.0.0.1").option("-p, --port <port>","Node agent port",Js,Number(process.env.TASK_HANDOFF_NODE_AGENT_PORT)||8091).option("--data-dir <path>","Node agent data directory").option("--token <token>","Bearer token required by the control plane").option("--connection-mode <mode>","Local control connection mode",Ws).option("--ipc-path <path>","Unix socket path used by local-ipc mode").option("--control-plane-tunnel-url <url>","Control plane reverse WebSocket tunnel URL").action(async e=>{await Gs({host:e.host,port:e.port,dataDir:e.dataDir,token:e.token,connectionMode:e.connectionMode,ipcPath:e.ipcPath,controlPlaneTunnelUrl:e.controlPlaneTunnelUrl})}),t.command("invite").description("Create a one-time token for pairing this node agent with a control plane.").option("--endpoint <url>","Use the node-agent HTTP endpoint instead of its local IPC socket").option("--ipc-path <path>","Local node-agent IPC socket path").option("--data-dir <path>","Node-agent data directory used to locate its IPC socket").option("--token <token>","Bearer token for local node-agent access",process.env.TASK_HANDOFF_NODE_AGENT_TOKEN).option("--expires-in-ms <ms>","Invite expiry in milliseconds",Ys).option("--json","Print raw JSON output").action(async e=>{const n=t.opts(),r=e.ipcPath||n.ipcPath||process.env.TASK_HANDOFF_NODE_AGENT_IPC_PATH,o=e.dataDir||n.dataDir||process.env.TASK_HANDOFF_NODE_AGENT_DATA_DIR,s=e.endpoint?void 0:r||_i(o||fi()),a=await async function(e){const t={"content-type":"application/json",...e.token?{authorization:`Bearer ${e.token}`}:{}},n=JSON.stringify({...e.expiresInMs?{expiresInMs:e.expiresInMs}:{}}),r=e.endpoint?await fetch(`${e.endpoint.replace(/\/$/,"")}/api/node-agent/pairing/invites`,{method:"POST",headers:t,body:n}):await async function(e,t,n={}){const r=n.method||"GET",o="string"==typeof n.body||n.body instanceof Buffer?n.body:void 0===n.body||null===n.body?void 0:String(n.body),s=new Headers(n.headers||{});return void 0===o||s.has("content-length")||s.set("content-length",String(Buffer.byteLength(o))),new Promise((a,d)=>{const l=i.request({socketPath:e,method:r,path:`/api/node-agent${t}`,headers:Object.fromEntries(s.entries())},e=>{const t=e.statusCode||500;a(new Response("HEAD"!==r&&204!==t&&205!==t&&304!==t?c.Readable.toWeb(e):null,{status:t,headers:e.headers}))});l.on("error",d);const u=()=>l.destroy(new DOMException("The operation was aborted.","AbortError"));n.signal?.aborted?u():n.signal?.addEventListener("abort",u,{once:!0}),l.once("close",()=>n.signal?.removeEventListener("abort",u)),void 0!==o&&l.write(o),l.end()})}(e.ipcPath,"/pairing/invites",{method:"POST",headers:t,body:n}),o=await r.json().catch(()=>({}));if(!r.ok)throw new Error(o.error?.message||`Node agent pairing invite failed with HTTP ${r.status}`);const s="string"==typeof o.data?.joinToken?o.data.joinToken:"";if(!s)throw new Error("Node agent pairing invite response did not include a join token.");return{nodeId:"string"==typeof o.data?.nodeId?o.data.nodeId:"",joinToken:s,expiresAt:"string"==typeof o.data?.expiresAt?o.data.expiresAt:""}}({endpoint:e.endpoint,ipcPath:s,token:e.token,expiresInMs:e.expiresInMs});e.json?console.log(JSON.stringify(a,null,2)):(a.nodeId&&console.log(`Node: ${a.nodeId}`),console.log(`Join token: ${a.joinToken}`),a.expiresAt&&console.log(`Expires: ${a.expiresAt}`))}),await t.parseAsync(process.argv)})().catch(e=>{console.error(e instanceof Error?e.message:String(e)),process.exitCode=1});
+"use strict";var e=require("commander"),t=require("node:fs"),n=require("node:path"),i=require("node:http"),r=require("node:url"),s=require("fastify"),o=require("@fastify/websocket"),a=require("zod"),c=require("node:crypto"),d=require("node:child_process"),l=require("node-pty"),u=require("ws"),p=require("node:os"),m=require("node:net"),g=require("node:stream"),h=require("node:fs/promises"),f=require("node:stream/promises"),y=require("tar"),I=require("write-file-atomic"),A=require("semver"),b="undefined"!=typeof document?document.currentScript:null;function w(e,n){try{const i=JSON.parse(t.readFileSync(e,"utf8"));if(n&&i.name!==n)return;return"string"==typeof i.version&&i.version.trim()?i.version.trim():void 0}catch{return}}function v(e){if(e)try{return n.dirname(t.realpathSync(e))}catch{return}}function E(e,t=process.env,i=e){const r=t.TASK_HANDOFF_VERSION?.trim();if(r)return r;const s=i.split("/").at(-1),o=process.argv[1]?n.resolve(process.argv[1]):void 0,a=o?n.dirname(o):void 0,c=[v(o),a,process.cwd()].filter(e=>Boolean(e));for(const t of new Set(c)){let i=t;for(;;){const t=w(n.join(i,"package.json"),e);if(t)return t;const r=n.dirname(i);if(r===i)break;i=r}}let d;for(const e of new Set(c)){let t=e;for(;;){if(s){const e=w(n.join(t,"packages",s,"package.json"),i);if(e)return e}d||=w(n.join(t,"package.json"));const e=n.dirname(t);if(e===t)break;t=e}}return d||"unknown"}const N=41943040,z="ai.sessions",S=a.z.string().trim().min(1).max(80),_=a.z.enum(["running","waiting","idle","failed"]);a.z.object({instanceId:a.z.string().trim().min(1).max(160),sessionId:a.z.string().trim().min(1).max(120),unread:a.z.boolean(),sessionUpdatedAt:a.z.string().datetime(),updatedAt:a.z.string().datetime()}).strict();const T=a.z.enum(["thinking","tool","editing","approval","responding","unknown"]),k=a.z.object({id:a.z.string().trim().min(1).max(240).optional(),kind:a.z.string().trim().min(1).max(80).optional(),name:a.z.string().trim().min(1).max(120),inputPreview:a.z.string().trim().max(500).optional(),startedAt:a.z.string().datetime().optional()}).strict(),C=a.z.enum(["pending-init","running","interrupted","completed","errored","shutdown","not-found"]),x=a.z.enum(["started","interacted","interrupted"]),O=a.z.object({threadId:a.z.string().trim().min(1).max(240),path:a.z.string().trim().max(4096).optional(),status:C,activity:x.optional(),message:a.z.string().trim().max(1e3).optional(),updatedAt:a.z.string().datetime()}).strict(),R=a.z.object({toolCalls:a.z.number().int().min(0).default(0),edits:a.z.number().int().min(0).default(0),approvals:a.z.number().int().min(0).default(0)}).strict().default({toolCalls:0,edits:0,approvals:0}),D=a.z.object({send:a.z.boolean().optional(),interrupt:a.z.boolean().optional(),approval:a.z.boolean().optional()}).strict(),P=a.z.enum(["image","file"]),j=a.z.object({id:a.z.string().trim().min(1).max(120),kind:P,name:a.z.string().trim().min(1).max(240),mime:a.z.string().trim().min(1).max(120),size:a.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)}),M=a.z.union([j.extend({source:a.z.object({type:a.z.literal("inline"),encoding:a.z.literal("base64"),data:a.z.string().min(1).max(31457280)}).strict()}).strict().superRefine((e,t)=>{const n="image"===e.kind?20971520:512e3;(e.size<=0||("file"===e.kind?e.size>=n:e.size>n))&&t.addIssue({code:a.z.ZodIssueCode.custom,path:["size"],message:`Inline ${e.kind} must be between 1 byte and ${n} bytes.`})}),j.extend({source:a.z.object({type:a.z.literal("runtime-path"),path:a.z.string().trim().min(1).max(4096)}).strict()}).strict()]),L=j.extend({sourceType:a.z.enum(["inline","runtime-path"])}).strict(),$=a.z.union([a.z.object({id:a.z.string().trim().min(1).max(120),kind:P.optional(),source:a.z.object({type:a.z.literal("upload-ref")}).strict().default({type:"upload-ref"})}).strict(),a.z.object({id:a.z.string().trim().min(1).max(120),kind:P,name:a.z.string().trim().min(1).max(240),mime:a.z.string().trim().min(1).max(120),size:a.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),source:a.z.object({type:a.z.literal("runtime-path"),path:a.z.string().trim().min(1).max(4096)}).strict()}).strict()]),F=a.z.enum(["auto","queue","steer","immediate"]),U=a.z.enum(["ask","auto-review","full-access"]),V=a.z.enum(["review","rename","goal","compact"]);a.z.object({command:V,argument:a.z.string().trim().max(4e3).optional()}).strict().superRefine((e,t)=>{"rename"!==e.command||e.argument||t.addIssue({code:"custom",path:["argument"],message:"Rename requires a thread name."}),"review"!==e.command&&"compact"!==e.command||!e.argument||t.addIssue({code:"custom",path:["argument"],message:`${e.command} does not accept an argument.`})}),a.z.object({command:V,value:a.z.string().max(4e3).optional(),turnId:a.z.string().trim().min(1).max(240).optional()}).strict(),a.z.enum(["skill","app","plugin"]);const q=a.z.object({name:a.z.string().trim().min(1).max(240),path:a.z.string().trim().min(1).max(4096)}),H=a.z.discriminatedUnion("kind",[q.extend({kind:a.z.literal("skill"),path:a.z.string().trim().min(1).max(4096).refine(e=>e.startsWith("/"),"Skill paths must be absolute.")}).strict(),q.extend({kind:a.z.literal("app"),path:a.z.string().trim().min(7).max(4096).regex(/^app:\/\/[^\s/]+$/,"App paths must use app://<id>.")}).strict(),q.extend({kind:a.z.literal("plugin"),path:a.z.string().trim().min(10).max(4096).regex(/^plugin:\/\/[^\s/]+$/,"Plugin paths must use plugin://<id>.")}).strict()]),B=a.z.array(H).max(20).default([]),K=a.z.enum(["plugin","skill","file","directory","app"]),G=a.z.object({kind:K,name:a.z.string().trim().min(1).max(240),description:a.z.string().trim().max(1e3).optional(),path:a.z.string().trim().min(1).max(4096),icon:a.z.string().trim().max(4096).optional()}).strict().superRefine((e,t)=>{"skill"!==e.kind||e.path.startsWith("/")||t.addIssue({code:"custom",path:["path"],message:"Skill paths must be absolute."}),"app"!==e.kind||/^app:\/\/[^\s/]+$/.test(e.path)||t.addIssue({code:"custom",path:["path"],message:"App paths must use app://<id>."}),"plugin"!==e.kind||/^plugin:\/\/[^\s/]+$/.test(e.path)||t.addIssue({code:"custom",path:["path"],message:"Plugin paths must use plugin://<id>."}),"file"!==e.kind&&"directory"!==e.kind||!e.path.startsWith("/")&&!e.path.split(/[\\/]+/).includes("..")||t.addIssue({code:"custom",path:["path"],message:"File and directory paths must be relative to the session cwd."})}),J=a.z.object({category:a.z.enum(["skills","plugins","apps","files"]),code:a.z.string().trim().min(1).max(160),message:a.z.string().trim().min(1).max(2e3)}).strict();a.z.object({sessionId:a.z.string().trim().min(1).max(120),providerSessionId:a.z.string().trim().min(1).max(240),cwd:a.z.string().trim().min(1).max(4096),candidates:a.z.array(G).max(1e3).default([]),diagnostics:a.z.array(J).max(20).default([])}).strict(),a.z.object({query:a.z.string().trim().max(240).default("")}).strict(),a.z.object({sessionId:a.z.string().trim().min(1).max(120),cwd:a.z.string().trim().min(1).max(4096),query:a.z.string().trim().max(240),requestId:a.z.string().trim().min(1).max(160),candidates:a.z.array(G.refine(e=>"file"===e.kind||"directory"===e.kind,"File search only returns files and directories.")).max(200).default([]),complete:a.z.boolean().default(!1)}).strict();const W=a.z.object({message:a.z.string().trim().min(1).max(2e4),mode:F.optional(),permissionMode:U.optional()});W.extend({attachments:a.z.array(M).max(6).default([]),references:B}).strict().superRefine((e,t)=>{e.attachments.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>N&&t.addIssue({code:a.z.ZodIssueCode.custom,path:["attachments"],message:"Inline attachments must be 41943040 bytes or less in total."})}),W.extend({attachments:a.z.array($).max(6).default([]),references:B}).strict(),a.z.object({decision:a.z.enum(["allow","deny","skip"])}).strict(),a.z.object({queueIds:a.z.array(a.z.string().trim().min(1).max(120)).max(100)}).strict(),a.z.object({code:a.z.string().trim().min(1).max(160),message:a.z.string(),instanceId:a.z.string().trim().min(1).max(160).optional(),nodeId:a.z.string().trim().min(1).max(160).optional(),route:a.z.string().trim().min(1).max(4096).optional()}).strict();const Y=a.z.object({id:a.z.string().trim().min(1).max(120),message:a.z.string().trim().min(1).max(2e4),attachments:a.z.array(L).max(6).default([]),references:B,permissionMode:U.optional(),status:a.z.enum(["queued","sending","failed"]).default("queued"),createdAt:a.z.string().datetime(),updatedAt:a.z.string().datetime(),error:a.z.string().trim().max(4e3).optional()}).strict(),X=a.z.object({pendingCount:a.z.number().int().min(0).default(0),items:a.z.array(Y).max(100).default([])}).strict().default({pendingCount:0,items:[]}),Q=a.z.enum(["control","realtime","adapter-snapshot","transcript-tail","transcript-scan","process-scan","app-session"]),Z=a.z.object({id:a.z.string().trim().min(1).max(240),status:a.z.enum(["running","completed"]),startedAt:a.z.string().datetime().optional(),completedAt:a.z.string().datetime().optional()}).strict(),ee=a.z.object({id:a.z.string().trim().min(1).max(240),providerTurnId:a.z.string().trim().max(240).optional(),source:Q.optional(),userPrompt:a.z.string().trim().optional(),status:a.z.enum(["queued","running","waiting","completed","failed"]).default("running"),phase:T.optional(),summary:a.z.string().trim().max(1e3).optional(),lastMessage:a.z.string().trim().optional(),lastMessageItemId:a.z.string().trim().max(240).optional(),contextCompactions:a.z.array(Z).max(20).optional(),revision:a.z.number().int().min(0).default(0),sourcePriority:a.z.number().int().min(0).max(100).optional(),snapshotVersion:a.z.number().int().min(0).optional(),observedAt:a.z.string().datetime().optional(),startedAt:a.z.string().datetime().optional(),updatedAt:a.z.string().datetime().optional(),completedAt:a.z.string().datetime().optional()}).strict(),te=ee.pick({id:!0,providerTurnId:!0,userPrompt:!0,status:!0,phase:!0,summary:!0,lastMessage:!0,contextCompactions:!0,startedAt:!0,updatedAt:!0,completedAt:!0}).strict(),ne=a.z.object({id:a.z.string().trim().min(1).max(120),agent:S,appSessionId:a.z.string().trim().max(120).optional(),appId:a.z.string().trim().max(120).optional(),providerSessionId:a.z.string().trim().max(240).optional(),providerMeta:a.z.record(a.z.string(),a.z.unknown()).optional(),appBindingKeys:a.z.array(a.z.string().trim().min(1).max(240)).max(20).optional(),actions:D.optional(),activeTurnId:a.z.string().trim().max(240).optional(),title:a.z.string().trim().max(240).optional(),cwd:a.z.string().trim().max(4096).optional(),userPrompt:a.z.string().trim().optional(),turns:a.z.array(ee).max(50).optional(),status:_.default("running"),phase:T.default("unknown"),summary:a.z.string().trim().max(1e3).optional(),lastMessage:a.z.string().trim().optional(),lastMessageItemId:a.z.string().trim().max(240).optional(),currentTool:k.optional(),toolCallsSinceLastMessage:a.z.number().int().min(0).default(0),subAgents:a.z.array(O).max(50).default([]),transcriptPath:a.z.string().trim().max(4096).optional(),transcriptSize:a.z.number().int().min(0).optional(),startedAt:a.z.string().datetime(),updatedAt:a.z.string().datetime(),completedAt:a.z.string().datetime().optional(),error:a.z.string().trim().max(4e3).optional(),counters:R,queue:X}).strict();a.z.object({session:ne,provider:a.z.string().trim().min(1).max(80),action:a.z.enum(["send","queue","steer","interrupt","approval"]),decision:a.z.enum(["allow","deny","skip"]).optional(),turnId:a.z.string().trim().min(1).max(240).optional(),providerTurnId:a.z.string().trim().min(1).max(240).optional(),queueId:a.z.string().trim().min(1).max(120).optional()}).strict();const ie=a.z.object({id:a.z.string().trim().min(1).max(120),agent:a.z.enum(["codex","claude"]),providerSessionId:a.z.string().trim().min(1).max(240),title:a.z.string().trim().max(240).optional(),userPrompt:a.z.string().trim().optional(),lastMessage:a.z.string().trim().optional(),cwd:a.z.string().trim().min(1).max(4096),lastActiveAt:a.z.string().datetime(),archivedAt:a.z.string().datetime()}).strict();a.z.object({schemaVersion:a.z.literal(1).default(1),items:a.z.array(ie).max(50).default([])}).strict(),a.z.object({items:a.z.array(ie).max(50).default([])}).strict(),a.z.object({item:ie,turns:a.z.array(te).max(50).default([])}).strict(),a.z.object({disposition:a.z.enum(["resumed","already-open"]),aiSessionId:a.z.string().trim().min(1).max(120),providerSessionId:a.z.string().trim().min(1).max(240),appSessionId:a.z.string().trim().min(1).max(120)}).strict();const re=ne.pick({id:!0,agent:!0,appSessionId:!0,appId:!0,providerSessionId:!0,providerMeta:!0,appBindingKeys:!0,actions:!0,activeTurnId:!0,title:!0,cwd:!0,userPrompt:!0,turns:!0,status:!0,phase:!0,summary:!0,lastMessage:!0,lastMessageItemId:!0,currentTool:!0,toolCallsSinceLastMessage:!0,subAgents:!0,queue:!0,startedAt:!0,updatedAt:!0,error:!0}),se=a.z.object({runningCount:a.z.number().int().min(0).default(0),waitingCount:a.z.number().int().min(0).default(0),staleCount:a.z.number().int().min(0).default(0),sessions:a.z.array(re).default([]),updatedAt:a.z.string().datetime()}).strict();a.z.object({streamId:a.z.string().trim().min(1).max(240),revision:a.z.number().int().min(0),lastEventAt:a.z.string().datetime(),snapshot:se}).strict(),se.pick({runningCount:!0,waitingCount:!0,staleCount:!0,updatedAt:!0}).extend({idleCount:a.z.number().int().min(0).default(0),problemCount:a.z.number().int().min(0).default(0),revision:a.z.number().int().min(0).optional()});const oe=a.z.enum(["provider-event","app-session-created","app-session-updated","app-session-deleted","discovery-scan","control-action","heartbeat-sync","startup"]),ae=a.z.object({streamId:a.z.string().trim().min(1).max(240),instanceId:a.z.string().trim().min(1).max(160),nodeId:a.z.string().trim().min(1).max(160).optional(),revision:a.z.number().int().min(0),previousRevision:a.z.number().int().min(0).optional(),traceId:a.z.string().trim().min(1).max(160),generatedAt:a.z.string().datetime(),reason:oe}).strict(),ce=a.z.object({meta:ae,snapshot:se}).strict(),de=a.z.object({meta:ae,upserted:a.z.array(re).default([]),removed:a.z.array(a.z.string().trim().min(1).max(120)).default([])}).strict(),le=a.z.object({meta:ae,sessionIds:a.z.array(a.z.string().trim().min(1).max(120)).default([]),expiresAt:a.z.string().datetime()}).strict();a.z.object({instanceId:a.z.string().trim().min(1).max(160),nodeId:a.z.string().trim().min(1).max(160).optional(),sessionId:a.z.string().trim().min(1).max(120),providerSessionId:a.z.string().trim().min(1).max(240),turnId:a.z.string().trim().min(1).max(240),itemId:a.z.string().trim().min(1).max(240),delta:a.z.string().min(1),generatedAt:a.z.string().datetime()}).strict(),a.z.object({streamId:a.z.string().trim().min(1).max(240),instanceId:a.z.string().trim().min(1).max(160),sinceRevision:a.z.number().int().min(0),latestRevision:a.z.number().int().min(0),earliestRetainedRevision:a.z.number().int().min(0),syncRequired:a.z.boolean().default(!1),events:a.z.array(a.z.discriminatedUnion("type",[a.z.object({type:a.z.literal("ai-session.snapshot"),payload:ce}).strict(),a.z.object({type:a.z.literal("ai-session.patch"),payload:de}).strict(),a.z.object({type:a.z.literal("ai-session.removed"),payload:le}).strict()])).default([])}).strict();const ue=a.z.object({source:Q,sourcePriority:a.z.number().int().min(0).max(100).optional(),observedAt:a.z.string().datetime().optional(),snapshotVersion:a.z.number().int().min(0).optional()}).strict(),pe=ue.extend({type:a.z.literal("snapshot"),agent:a.z.string().trim().min(1).max(80),appSessionId:a.z.string().trim().max(120).optional(),appId:a.z.string().trim().max(120).optional(),providerSessionId:a.z.string().trim().max(240).optional(),providerMeta:a.z.record(a.z.string(),a.z.unknown()).optional(),appBindingKeys:a.z.array(a.z.string().trim().min(1).max(240)).max(20).optional(),actions:D.optional(),title:a.z.string().trim().max(240).optional(),cwd:a.z.string().trim().max(4096).optional(),activeTurnId:a.z.string().trim().max(240).optional(),userPrompt:a.z.string().trim().optional(),turns:a.z.array(ee).max(50).optional(),status:_.optional(),phase:T.optional(),summary:a.z.string().trim().max(1e3).optional(),lastMessage:a.z.string().trim().optional(),lastMessageItemId:a.z.string().trim().max(240).optional(),currentTool:k.optional(),toolCallsSinceLastMessage:a.z.number().int().min(0).optional(),subAgents:a.z.array(O).max(50).optional(),transcriptPath:a.z.string().trim().max(4096).optional(),transcriptSize:a.z.number().int().min(0).optional(),replaceActivity:a.z.boolean().optional()}).strict(),me=ue.extend({type:a.z.literal("event"),sessionId:a.z.string().trim().min(1).max(120),kind:a.z.enum(["lifecycle","send-ack","turn-started","user-message","assistant-message","approval-requested","turn-completed","tool-activity","sub-agent-activity","context-compaction"]),activeTurnId:a.z.string().trim().max(240).optional(),providerTurnId:a.z.string().trim().max(240).optional(),userPrompt:a.z.string().trim().optional(),text:a.z.string().optional(),itemId:a.z.string().trim().max(240).optional(),status:_.optional(),phase:T.optional(),summary:a.z.string().trim().max(1e3).optional(),error:a.z.string().trim().max(4e3).optional(),currentTool:k.nullable().optional(),toolCallsSinceLastMessage:a.z.number().int().min(0).optional(),subAgents:a.z.array(O).max(50).optional(),contextCompaction:Z.optional(),counters:a.z.object({toolCalls:a.z.number().int().min(0).optional(),edits:a.z.number().int().min(0).optional(),approvals:a.z.number().int().min(0).optional()}).strict().optional()}).strict().superRefine((e,t)=>{if("context-compaction"===e.kind?e.contextCompaction||t.addIssue({code:"custom",path:["contextCompaction"],message:"context-compaction events require contextCompaction"}):void 0!==e.contextCompaction&&t.addIssue({code:"custom",path:["contextCompaction"],message:"contextCompaction is only valid for context-compaction events"}),"sub-agent-activity"===e.kind?e.subAgents||t.addIssue({code:"custom",path:["subAgents"],message:"sub-agent-activity events require subAgents"}):void 0!==e.subAgents&&t.addIssue({code:"custom",path:["subAgents"],message:"subAgents is only valid for sub-agent-activity events"}),"tool-activity"!==e.kind)return void 0!==e.currentTool&&t.addIssue({code:"custom",path:["currentTool"],message:"currentTool is only valid for tool-activity events"}),void(void 0!==e.toolCallsSinceLastMessage&&t.addIssue({code:"custom",path:["toolCallsSinceLastMessage"],message:"toolCallsSinceLastMessage is only valid for tool-activity events"}));"currentTool"in e||t.addIssue({code:"custom",path:["currentTool"],message:"tool-activity events require currentTool"}),void 0===e.toolCallsSinceLastMessage&&t.addIssue({code:"custom",path:["toolCallsSinceLastMessage"],message:"tool-activity events require toolCallsSinceLastMessage"})});a.z.discriminatedUnion("type",[pe,me]);const ge=a.z.union([a.z.object({type:a.z.literal("schedule"),scheduleKind:a.z.literal("interval").default("interval"),intervalMs:a.z.number().int().min(1e3)}).strict(),a.z.object({type:a.z.literal("schedule"),scheduleKind:a.z.literal("daily"),timeOfDay:a.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),timezone:a.z.string().trim().min(1).max(120)}).strict(),a.z.object({type:a.z.literal("schedule"),scheduleKind:a.z.literal("weekly"),weekdays:a.z.array(a.z.number().int().min(0).max(6)).min(1).max(7),timeOfDay:a.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),timezone:a.z.string().trim().min(1).max(120)}).strict()]),he=a.z.union([ge,a.z.object({type:a.z.literal("file-change"),roots:a.z.array(a.z.string().trim().min(1).max(4096)).min(1).max(50),globs:a.z.array(a.z.string().trim().min(1).max(500)).min(1).max(100),ignore:a.z.array(a.z.string().trim().min(1).max(500)).max(100).optional(),debounceMs:a.z.number().int().min(100).max(6e4).default(1500)}).strict(),a.z.object({type:a.z.literal("ai-session"),agent:a.z.string().trim().min(1).max(80).optional(),statuses:a.z.array(a.z.enum(["running","waiting","idle","failed"])).max(20).optional(),phases:a.z.array(a.z.enum(["thinking","tool","editing","approval","responding","unknown"])).max(20).optional()}).strict()]),fe=a.z.object({promptTemplate:a.z.string().trim().min(1).max(2e4)}).strict(),ye=a.z.object({cooldownMs:a.z.number().int().min(0).max(864e5).optional(),maxConcurrentRuns:a.z.number().int().min(1).max(20).default(1),whenBusy:a.z.enum(["skip","queue"]).default("skip")}).strict(),Ie=a.z.object({configHash:a.z.string().trim().min(8).max(80),name:a.z.string().trim().min(1).max(160),description:a.z.string().trim().max(1e3).optional(),source:he,action:fe,policy:ye.default({maxConcurrentRuns:1,whenBusy:"skip"}),createdAt:a.z.string().datetime(),updatedAt:a.z.string().datetime()}).strict(),Ae=a.z.object({type:a.z.literal("ai-session"),aiSessionId:a.z.string().trim().min(1).max(160)}).strict(),be=a.z.object({configHash:a.z.string().trim().min(8).max(80),deploymentId:a.z.string().trim().min(1).max(240).optional(),instanceId:a.z.string().trim().min(1).max(160),origin:a.z.enum(["control-plane","controlled-instance"]).default("controlled-instance"),enabled:a.z.boolean().default(!0),target:Ae,localName:a.z.string().trim().min(1).max(160).optional(),createdAt:a.z.string().datetime(),updatedAt:a.z.string().datetime()}).strict(),we=a.z.object({configHash:a.z.string().trim().min(8).max(80),deploymentId:a.z.string().trim().min(1).max(240).optional(),instanceId:a.z.string().trim().min(1).max(160),status:a.z.enum(["idle","running","disabled","error"]).default("idle"),lastTriggeredAt:a.z.string().datetime().optional(),lastCompletedAt:a.z.string().datetime().optional(),lastSkippedAt:a.z.string().datetime().optional(),lastError:a.z.string().trim().max(4e3).optional(),runCount:a.z.number().int().min(0).default(0),skippedCount:a.z.number().int().min(0).default(0)}).strict(),ve=a.z.object({id:a.z.string().trim().min(1).max(160),configHash:a.z.string().trim().min(8).max(80),deploymentId:a.z.string().trim().min(1).max(240).optional(),instanceId:a.z.string().trim().min(1).max(160),eventType:a.z.enum(["manual","schedule","file-change","ai-session"]),status:a.z.enum(["started","completed","failed","skipped"]),target:Ae,promptPreview:a.z.string().trim().max(500),eventSummary:a.z.string().trim().max(1e3).optional(),error:a.z.string().trim().max(4e3).optional(),startedAt:a.z.string().datetime(),completedAt:a.z.string().datetime().optional()}).strict();a.z.object({schemaVersion:a.z.literal(1).default(1),configs:a.z.array(Ie).default([]),deployments:a.z.array(be).default([]),runtime:a.z.array(we).default([]),recentRuns:a.z.array(ve).default([])}).strict();const Ee=a.z.string().regex(/^\d{4}-\d{2}-\d{2}$/,"Proxy protocol version must use YYYY-MM-DD format."),Ne=a.z.string().trim().min(1).max(160).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),ze=a.z.string().datetime(),Se=a.z.string().trim().min(32).max(4096),_e=a.z.string().trim().max(2048).transform((e,t)=>{try{return function(e){const t=new URL(e.trim());if("https:"!==t.protocol||t.username||t.password||"/"!==t.pathname||t.search||t.hash)throw new Error("Proxy origin must be an HTTPS origin without credentials, path, query, or fragment.");return t.origin}(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),a.z.NEVER}});a.z.string().trim().min(1).max(4096).transform((e,t)=>{try{return function(e){const t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/%25/i.test(t))throw new Error("Proxy route must be a single-encoded node-agent relative route.");const n=t.split("?",1)[0];let i,r;try{i=n.split("/").map(e=>decodeURIComponent(e))}catch{throw new Error("Proxy route contains invalid percent encoding.")}if(i.some(e=>".."===e||"."===e))throw new Error("Proxy route cannot traverse outside the node-agent API.");try{r=new URL(t,"https://node-agent.invalid")}catch{throw new Error("Proxy route is invalid.")}if("https://node-agent.invalid"!==r.origin||r.username||r.password)throw new Error("Proxy route cannot select an absolute upstream URL.");return`${r.pathname}${r.search}`}(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),a.z.NEVER}});const Te=a.z.enum(Object.values({ProtocolUnsupported:"CONTROL_PLANE_PROXY_PROTOCOL_UNSUPPORTED",InviteInvalid:"CONTROL_PLANE_PROXY_INVITE_INVALID",InviteExpired:"CONTROL_PLANE_PROXY_INVITE_EXPIRED",InviteConsumed:"CONTROL_PLANE_PROXY_INVITE_CONSUMED",InviteRevoked:"CONTROL_PLANE_PROXY_INVITE_REVOKED",TargetUnavailable:"CONTROL_PLANE_PROXY_TARGET_UNAVAILABLE",TargetMismatch:"CONTROL_PLANE_PROXY_TARGET_MISMATCH",BindingUnknown:"CONTROL_PLANE_PROXY_BINDING_UNKNOWN",BindingRevoked:"CONTROL_PLANE_PROXY_BINDING_REVOKED",BindingIdentityConflict:"CONTROL_PLANE_PROXY_BINDING_IDENTITY_CONFLICT",AuthenticationFailed:"CONTROL_PLANE_PROXY_AUTHENTICATION_FAILED",RouteInvalid:"CONTROL_PLANE_PROXY_ROUTE_INVALID",HeaderInvalid:"CONTROL_PLANE_PROXY_HEADER_INVALID",ResourceLimit:"CONTROL_PLANE_PROXY_RESOURCE_LIMIT",SnapshotRequired:"CONTROL_PLANE_PROXY_SNAPSHOT_REQUIRED",Unavailable:"CONTROL_PLANE_PROXY_UNAVAILABLE",TransportFailed:"CONTROL_PLANE_PROXY_TRANSPORT_FAILED"})),ke=a.z.object({code:Te,message:a.z.string().trim().min(1).max(2048),retryable:a.z.boolean(),details:a.z.record(a.z.string(),a.z.unknown()).optional()}).strict(),Ce=a.z.enum(["active","consumed","revoked","expired"]),xe=a.z.object({id:Ne,targetNodeId:Ne,tokenHash:a.z.string().trim().min(32).max(256),status:Ce,createdBy:Ne,expiresAt:ze,consumedByClaimId:Ne.optional(),consumedAt:ze.optional(),revokedAt:ze.optional(),createdAt:ze,updatedAt:ze}).strict().omit({tokenHash:!0});a.z.object({targetNodeId:Ne,expiresInSeconds:a.z.number().int().min(60).max(3600).default(600)}).strict(),a.z.object({invite:xe,token:a.z.string().trim().min(24).max(512),proxyOrigin:_e,protocolVersion:Ee}).strict();const Oe=a.z.enum(["active","revoked"]),Re=a.z.object({id:Ne,claimId:Ne,sourceControlPlaneId:Ne,targetNodeId:Ne,bindingKeyId:Ne,credentialHash:a.z.string().trim().min(32).max(256),status:Oe,revision:a.z.number().int().positive(),lastError:ke.optional(),revokedAt:ze.optional(),createdAt:ze,updatedAt:ze}).strict().omit({credentialHash:!0});a.z.object({protocolVersion:Ee,inviteToken:a.z.string().trim().min(24).max(512).optional(),claimId:Ne,sourceControlPlaneId:Ne,targetNodeId:Ne.optional(),bindingKeyId:Ne,credential:Se}).strict(),a.z.object({sourceControlPlaneId:Ne,bindingKeyId:Ne,credential:Se}).strict();const De=a.z.object({id:Ne,name:a.z.string().trim().min(1).max(160),status:a.z.enum(["unknown","online","offline","degraded"]),health:a.z.enum(["unknown","ok","degraded","failed"]),lastSeenAt:ze.optional(),capabilities:a.z.record(a.z.string(),a.z.unknown()).default({})}).strict(),Pe=a.z.object({protocolVersion:Ee,binding:Re,streamId:Ne,revision:a.z.number().int().nonnegative(),observedAt:ze,target:De}).strict(),je=a.z.object({type:a.z.literal("control-plane-proxy.event"),protocolVersion:Ee,streamId:Ne,bindingId:Ne,sourceControlPlaneId:Ne,targetNodeId:Ne,revision:a.z.number().int().positive(),source:a.z.object({id:a.z.string().trim().min(1).max(512),seq:a.z.number().int().nonnegative()}).strict(),target:De,event:a.z.object({type:a.z.string().trim().min(1).max(240),topic:a.z.string().trim().min(1).max(240),createdAt:ze}).strict()}).strict(),Me=a.z.object({type:a.z.literal("control-plane-proxy.events.ready"),protocolVersion:Ee,streamId:Ne,bindingId:Ne,sourceControlPlaneId:Ne,targetNodeId:Ne,latestRevision:a.z.number().int().nonnegative(),earliestRetainedRevision:a.z.number().int().nonnegative()}).strict(),Le=a.z.object({type:a.z.literal("control-plane-proxy.snapshot-required"),protocolVersion:Ee,streamId:Ne,bindingId:Ne,sourceControlPlaneId:Ne,targetNodeId:Ne,sinceRevision:a.z.number().int().nonnegative(),latestRevision:a.z.number().int().nonnegative(),earliestRetainedRevision:a.z.number().int().nonnegative(),error:ke}).strict();a.z.discriminatedUnion("type",[je,Me,Le]),a.z.object({protocolVersion:Ee,binding:Re,target:Pe.shape.target}).strict(),a.z.object({id:Ne,claimId:Ne,proxyOrigin:_e,requestedName:a.z.string().trim().min(1).max(160).optional(),sourceControlPlaneId:Ne,targetNodeId:Ne.optional(),bindingKeyId:Ne,credential:Se,status:a.z.enum(["pending","compensation-required"]),createdAt:ze,updatedAt:ze,expiresAt:ze}).strict().omit({credential:!0}),a.z.object({id:Ne,nodeId:Ne,proxyOrigin:_e,proxyBindingId:Ne,targetNodeId:Ne,sourceControlPlaneId:Ne,bindingKeyId:Ne,credential:Se,createdAt:ze,updatedAt:ze}).strict();const $e="2026-08-01",Fe=a.z.string(),Ue=a.z.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),Ve=a.z.string().datetime(),qe=a.z.record(a.z.string(),a.z.string()).default({}),He=a.z.record(a.z.string(),a.z.string()).default({}),Be=a.z.string().regex(/^\d{4}-\d{2}-\d{2}$/,"Protocol version must use YYYY-MM-DD format."),Ke=a.z.object({encoding:a.z.enum(["utf8","base64"]),data:a.z.string()}).strict().superRefine((e,t)=>{"base64"===e.encoding&&Buffer.from(e.data,"base64").toString("base64")!==e.data&&t.addIssue({code:"custom",path:["data"],message:"Node tunnel binary body must use canonical base64 encoding."})});function Ge(e){if(null==e)return;const t=Ke.parse(e);return"utf8"===t.encoding?t.data:Buffer.from(t.data,"base64")}const Je=/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/,We=/^sha256:([a-fA-F0-9]{64})$/,Ye=/^(?:localhost|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::[1-9][0-9]{0,4})?$/,Xe=/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*$/;function Qe(e){const t=e.trim();if(!t||t.length>512||t.includes("://")||/\s/.test(t))throw new Error("Docker image reference must not contain a URL scheme or whitespace.");const n=t.indexOf("@");if(-1!==n&&n!==t.lastIndexOf("@"))throw new Error("Docker image reference contains more than one digest separator.");const i=-1===n?void 0:t.slice(n+1),r=-1===n?t:t.slice(0,n),s=i?We.exec(i):void 0;if(i&&!s)throw new Error("Docker image digest must use sha256 followed by 64 hexadecimal characters.");const o=r.lastIndexOf("/"),a=r.lastIndexOf(":"),c=a>o,d=c?r.slice(a+1):void 0,l=c?r.slice(0,a):r;if(d&&!Je.test(d))throw new Error("Docker image tag is invalid.");if(!d&&!s)throw new Error("Docker image reference must include an explicit tag or sha256 digest.");const u=l.split("/");if(!u.length||u.some(e=>!e))throw new Error("Docker image repository path is invalid.");const p=u.length>1&&(u[0].includes(".")||u[0].includes(":")||"localhost"===u[0]),m=p?u.slice(1):u;if(p&&!Ye.test(u[0].toLowerCase()))throw new Error("Docker image registry host or port is invalid.");if(!m.length||m.some(e=>!Xe.test(e)))throw new Error("Docker image repository names must be lowercase and use valid separators.");const g=u.map((e,t)=>p&&0===t?e.toLowerCase():e).join("/"),h=s?`sha256:${s[1].toLowerCase()}`:void 0;return`${g}${d?`:${d}`:""}${h?`@${h}`:""}`}function Ze(e){const t=Qe(e),n=t.indexOf("@"),i=-1===n?void 0:t.slice(n+1),r=-1===n?t:t.slice(0,n),s=r.lastIndexOf("/"),o=r.lastIndexOf(":"),a=o>s;return{reference:t,repository:a?r.slice(0,o):r,tag:a?r.slice(o+1):void 0,digest:i}}const et=a.z.string().trim().min(1).max(512).transform((e,t)=>{try{return Qe(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),a.z.NEVER}}),tt=a.z.string().trim().transform((e,t)=>{const n=We.exec(e);return n?`sha256:${n[1].toLowerCase()}`:(t.addIssue({code:"custom",message:"Docker image digest must use sha256 followed by 64 hexadecimal characters."}),a.z.NEVER)}),nt=a.z.object({codexModelHash:Ue.nullable().optional(),claudeModelHash:Ue.nullable().optional()}).strict().default({}),it=a.z.object({imageId:Ue,tag:a.z.string().trim().min(1).max(128).regex(Je).optional()}).strict(),rt={img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"};function st(e,t){if(e&&"object"==typeof e&&!Array.isArray(e)){const t=e;return{imageId:"string"==typeof t.imageId&&rt[t.imageId]||t.imageId,..."string"==typeof t.tag?{tag:t.tag}:{}}}if("string"==typeof t)return{imageId:rt[t]||t}}function ot(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,{defaultImageId:n,...i}=t;return{...i,defaultImageSelection:st(t.defaultImageSelection,n)}}const at=a.z.object({id:Ue,name:a.z.string().trim().min(1).max(120),kind:a.z.enum(["tty","gui","web"]),source:a.z.enum(["builtin","custom"]),availability:a.z.enum(["available","missing-dependency"]),capabilities:a.z.object({automation:a.z.enum(["cdp"]).optional(),supportsCwdSelection:a.z.boolean().default(!1)}).strict().default({supportsCwdSelection:!1}),diagnosticCode:a.z.enum(["APP_EXECUTABLE_NOT_FOUND"]).optional()}).strict(),ct=a.z.object({code:a.z.enum(["APP_CATALOG_INVALID"]),message:a.z.string().trim().min(1).max(500)}).strict(),dt=a.z.object({items:a.z.array(at).max(256),observedAt:Ve,issues:a.z.array(ct).max(32).default([])}).strict(),lt=a.z.enum(["linux","darwin","win32","freebsd","openbsd","aix","sunos","unknown"]),ut=a.z.enum(["x64","arm64","arm","ia32","ppc64","s390x","riscv64","unknown"]),pt=a.z.enum(["apt","dnf","brew","npm"]),mt=a.z.enum(["user","passwordless-sudo","root"]),gt=a.z.object({platform:lt,arch:ut,installers:a.z.array(pt).max(8),privilege:mt,installerAccess:a.z.object({npmGlobalWritable:a.z.boolean().optional()}).strict().optional()}).strict(),ht=a.z.enum(["installed","not-installed","broken","unsupported"]),ft=a.z.enum(["recipe","bundled","external","none"]),yt=a.z.object({code:a.z.enum(["BUNDLED","EXTERNALLY_MANAGED","ALREADY_INSTALLED","NOT_INSTALLED","UNSUPPORTED_PLATFORM","INSTALLER_UNAVAILABLE","INSTALLER_NOT_WRITABLE","INSUFFICIENT_PRIVILEGE","OPERATION_IN_PROGRESS"]),message:a.z.string().trim().min(1).max(500)}).strict(),It=a.z.object({id:Ue,name:a.z.string().trim().min(1).max(120),kind:a.z.enum(["tty","gui","web"]),description:a.z.string().trim().max(500).optional(),state:ht,managementSource:ft,version:a.z.string().trim().max(120).optional(),canInstall:a.z.boolean(),canUninstall:a.z.boolean(),installReason:yt.optional(),uninstallReason:yt.optional(),activeJobId:Ue.optional()}).strict(),At=a.z.enum(["install","uninstall"]),bt=a.z.enum(["queued","running","succeeded","failed","cancelled","interrupted"]),wt=a.z.object({current:a.z.number().finite().nonnegative().optional(),total:a.z.number().finite().positive().optional(),unit:a.z.string().trim().min(1).max(40).optional()}).strict().refine(e=>void 0===e.total||void 0===e.current||e.current<=e.total,{message:"Progress current must not exceed total.",path:["current"]}),vt=a.z.object({executable:a.z.string().trim().min(1).max(4096),args:a.z.array(a.z.string().max(4096)).max(128)}).strict(),Et=a.z.object({code:a.z.string().trim().min(1).max(120).regex(/^[a-z0-9][a-z0-9._-]*$/),message:a.z.string().trim().min(1).max(4096),retryable:a.z.boolean(),sessionIds:a.z.array(Ue).max(64).optional()}).strict(),Nt=a.z.object({id:Ue,requestId:Ue.optional(),appId:Ue,operation:At,state:bt,phase:a.z.string().trim().min(1).max(120).optional(),progress:wt.optional(),command:vt.optional(),logTail:a.z.string().max(32768).optional(),logTruncated:a.z.boolean().optional(),error:Et.optional(),requestedAt:Ve,startedAt:Ve.optional(),finishedAt:Ve.optional(),updatedAt:Ve}).strict(),zt=a.z.object({streamId:Ue,sequence:a.z.number().int().nonnegative(),capabilities:gt,apps:a.z.array(It).max(256),activeJobs:a.z.array(Nt).max(256),recentJobs:a.z.array(Nt).max(256),observedAt:Ve}).strict();a.z.object({requestId:Ue.optional()}).strict(),a.z.object({job:Nt}).strict(),a.z.object({type:a.z.literal("app-management"),streamId:Ue,sequence:a.z.number().int().nonnegative(),observedAt:Ve,job:Nt.optional(),snapshot:zt.optional()}).strict().refine(e=>void 0!==e.job||void 0!==e.snapshot,{message:"An app management event requires a job or snapshot."});const St=a.z.object({component:a.z.enum(["control-plane","node-agent","controlled-instance"]),packageName:a.z.string().trim().max(160).optional(),packageVersion:a.z.string().trim().max(80).optional(),protocolVersion:Fe.optional(),buildId:a.z.string().trim().max(160).optional(),builtAt:a.z.string().trim().max(120).optional(),gitCommit:a.z.string().trim().max(120).optional(),imageRef:a.z.string().trim().max(512).optional(),imageDigest:a.z.string().trim().max(240).optional()}).strict(),_t=a.z.enum(["stable","beta","alpha"]),Tt=a.z.object({packageName:a.z.literal("@task-handoff/controlled-instance"),version:a.z.string().trim().min(1).max(80),platform:a.z.string().trim().min(1).max(40),arch:a.z.string().trim().min(1).max(40),formatVersion:a.z.number().int().positive(),launcherAbi:a.z.number().int().positive(),entrypoint:a.z.string().trim().min(1).max(512),sha256:a.z.string().regex(/^[a-f0-9]{64}$/)}).strict(),kt=a.z.object({code:a.z.enum(["INSTANCE_RUNTIME_VERSION_MISMATCH","INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE","INSTANCE_RUNTIME_ARTIFACT_INVALID","INSTANCE_RUNTIME_INSTALL_FAILED","INSTANCE_RUNTIME_RESTART_FAILED","INSTANCE_RUNTIME_VERIFICATION_FAILED","INSTANCE_BASE_RUNTIME_INCOMPATIBLE","NODE_UPDATE_PREFLIGHT_FAILED","NODE_UPDATE_FAILED","LEGACY_INSTANCE_UPDATE_RETIRED"]),message:a.z.string().trim().min(1).max(4096),expectedVersion:a.z.string().trim().min(1).max(80).optional(),actualVersion:a.z.string().trim().min(1).max(80).optional(),retryable:a.z.boolean().default(!1)}).strict(),Ct=a.z.object({desiredVersion:a.z.string().trim().min(1).max(80),actualVersion:a.z.string().trim().min(1).max(80).optional(),phase:a.z.enum(["pending","draining","installing","restarting","verifying","matched","failed"]),attempt:a.z.number().int().nonnegative().default(0),lastAttemptAt:Ve.optional(),matchedAt:Ve.optional(),error:kt.optional()}).strict(),xt=a.z.object({runningInstanceCount:a.z.number().int().nonnegative(),stoppedInstanceCount:a.z.number().int().nonnegative(),activeInstanceCount:a.z.number().int().nonnegative(),restartInstanceCount:a.z.number().int().nonnegative(),runningInstanceIds:a.z.array(Ue).max(1024).default([]),stoppedInstanceIds:a.z.array(Ue).max(1024).default([]),activeInstanceIds:a.z.array(Ue).max(1024).default([])}).strict(),Ot=a.z.object({phase:a.z.enum(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),desiredVersion:a.z.string().trim().min(1).max(80),nodeVersion:a.z.string().trim().min(1).max(80).optional(),expectedInstanceIds:a.z.array(Ue).max(1024).default([]),expectedInstanceCount:a.z.number().int().nonnegative(),matchedInstanceCount:a.z.number().int().nonnegative(),pendingInstanceCount:a.z.number().int().nonnegative(),failedInstanceCount:a.z.number().int().nonnegative(),deferredInstanceCount:a.z.number().int().nonnegative().default(0)}).strict(),Rt=a.z.object({channel:_t.default("stable")}).strict(),Dt=a.z.object({source:a.z.literal("npm"),channel:_t,currentVersion:a.z.string().trim().max(240).optional(),availableVersion:a.z.string().trim().min(1).max(240),artifactRef:a.z.string().trim().min(1).max(512).optional(),runtimeArtifacts:a.z.array(Tt).default([]),impact:xt,updateAvailable:a.z.boolean(),supported:a.z.boolean().default(!0),reason:a.z.string().trim().max(2048).optional(),checkedAt:Ve,preflightToken:a.z.string().trim().min(16).max(240).optional()}).strict(),Pt=a.z.object({id:Ue,nodeId:Ue,source:a.z.literal("npm"),channel:_t,fromVersion:a.z.string().trim().max(240).optional(),toVersion:a.z.string().trim().min(1).max(240),artifactRef:a.z.string().trim().min(1).max(512).optional(),runtimeArtifacts:a.z.array(Tt).default([]),impact:xt,rollout:Ot,status:a.z.enum(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),error:kt.optional(),startedAt:Ve.optional(),completedAt:Ve.optional(),createdAt:Ve,updatedAt:Ve}).strict(),jt=a.z.object({channel:_t,targetVersion:a.z.string().trim().min(1).max(240),preflightToken:a.z.string().trim().min(16).max(240)}).strict(),Mt=a.z.object({type:a.z.enum(["branch","tag","commit"]),name:a.z.string().trim().min(1).max(240).optional(),commit:a.z.string().trim().max(80).optional()}).strict(),Lt=a.z.object({type:a.z.enum(["none","ssh-key","https-token"]).default("none"),secretId:a.z.string().trim().min(1).max(120).optional()}).strict(),$t=a.z.object({depth:a.z.number().int().positive().max(1e5).optional(),submodules:a.z.boolean().default(!1),lfs:a.z.boolean().default(!1),subdirectory:a.z.string().trim().max(240).default("")}).strict();a.z.object({id:Ue,name:a.z.string().trim().min(1).max(160),url:a.z.string().trim().min(1).max(2048),provider:a.z.string().trim().max(80).optional(),ref:Mt.default({type:"branch",name:"main"}),auth:Lt.default({type:"none"}),clone:$t.default({submodules:!1,lfs:!1,subdirectory:""}),defaultImageSelection:it.optional(),labels:qe,createdAt:Ve,updatedAt:Ve}).strict();const Ft=a.z.object({id:Ue,nodeId:Ue,name:a.z.string().trim().min(1).max(160),path:a.z.string().trim().min(1).max(4096),defaultImageSelection:it.optional(),labels:qe,createdAt:Ve,updatedAt:Ve}).strict(),Ut=a.z.discriminatedUnion("type",[a.z.object({type:a.z.literal("git-repository"),repositoryId:Ue.optional(),url:a.z.string().trim().min(1).max(2048),provider:a.z.string().trim().max(80).optional(),ref:Mt.default({type:"branch",name:"main"}),auth:Lt.default({type:"none"}),clone:$t.default({submodules:!1,lfs:!1,subdirectory:""})}).strict(),a.z.object({type:a.z.literal("git-template"),url:a.z.string().trim().min(1).max(2048),templateId:a.z.string().trim().min(1).max(120).optional(),ref:Mt.default({type:"branch",name:"main"}),auth:Lt.default({type:"none"}),clone:$t.default({submodules:!1,lfs:!1,subdirectory:""})}).strict(),a.z.object({type:a.z.literal("local-folder"),localFolderId:Ue.optional(),path:a.z.string().trim().min(1).max(4096),ownerNodeId:Ue.optional()}).strict()]),Vt=a.z.object({mode:a.z.enum(["local-bind","git-clone","empty-volume","persistent-volume"]),path:a.z.string().trim().min(1).max(4096).default("/workspace"),volumeName:a.z.string().trim().max(240).optional(),readOnly:a.z.boolean().default(!1)}).strict(),qt=a.z.enum(["codex","claude"]),Ht=a.z.object({id:Ue,name:a.z.string().trim().min(1).max(160),source:Ut,defaultImageSelection:it.optional(),defaultNodeId:Ue.optional(),defaultRuntimeId:Ue.optional(),workspacePolicy:Vt,labels:qe,createdAt:Ve,updatedAt:Ve}).strict(),Bt=a.z.object({id:Ue,name:a.z.string().trim().min(1).max(160),endpoint:a.z.string().trim().min(1).max(2048),key:a.z.string().trim().min(1).max(4096),model:a.z.string().trim().min(1).max(240),app:qt,enabled:a.z.boolean().default(!0),order:a.z.number().int().min(0).max(1e6).default(0),labels:qe,createdAt:Ve,updatedAt:Ve}).strict(),Kt=Bt,Gt=Bt.omit({key:!0}).extend({keyPreview:a.z.string().trim().min(1).max(160),keySet:a.z.boolean()}).strict(),Jt=Gt.extend({referenceCount:a.z.number().int().min(0)}).strict(),Wt=a.z.object({instanceId:Ue,codexModelHash:Ue.optional(),claudeModelHash:Ue.optional(),updatedAt:Ve}).strict(),Yt=a.z.discriminatedUnion("type",[a.z.object({type:a.z.literal("control-plane"),name:Bt.shape.name,enabled:Bt.shape.enabled,order:Bt.shape.order}).strict(),a.z.object({type:a.z.literal("node"),nodeId:Ue,name:Bt.shape.name,enabled:Bt.shape.enabled,order:Bt.shape.order,referenceCount:a.z.number().int().min(0)}).strict()]),Xt=a.z.object({id:Ue,model:Gt,locations:a.z.array(Yt).min(1),referenceCount:a.z.number().int().min(0).default(0)}).strict(),Qt=a.z.object({nodeId:Ue,code:a.z.string().trim().min(1).max(120),message:a.z.string().trim().min(1).max(2e3)}).strict();a.z.object({models:a.z.array(Xt),nodeDiagnostics:a.z.array(Qt).default([]),updatedAt:Ve}).strict();const Zt=Bt.omit({id:!0,createdAt:!0,updatedAt:!0}).strict(),en=Zt.partial().strict(),tn=Bt,nn=a.z.object({modelSelection:nt,codexModelHash:Ue.optional(),claudeModelHash:Ue.optional()}).strict();function rn(e){const t={app:qt.parse(e.app),endpoint:Bt.shape.endpoint.parse(e.endpoint),key:Bt.shape.key.parse(e.key),model:Bt.shape.model.parse(e.model)};return`mdl_${c.createHash("sha256").update(JSON.stringify(t)).digest("hex")}`}const sn=a.z.enum(["market","custom"]),on=a.z.enum(["active","deprecated","yanked"]),an=a.z.discriminatedUnion("kind",[a.z.object({kind:a.z.literal("builtin"),key:a.z.string().trim().min(1).max(120)}).strict(),a.z.object({kind:a.z.literal("remote"),url:a.z.string().trim().url().max(2048),mediaType:a.z.enum(["image/png","image/jpeg","image/webp"]).optional(),digest:tt.optional()}).strict()]),cn=a.z.array(a.z.string().trim().min(1).max(80)).default([]),dn=a.z.array(a.z.string().trim().min(1).max(120)).default([]),ln=a.z.record(a.z.string().trim().min(2).max(35),a.z.string().trim().min(1).max(4096)),un=a.z.object({os:a.z.string().trim().min(1).max(40),architecture:a.z.string().trim().min(1).max(40),digest:tt.optional(),downloadSizeBytes:a.z.number().int().positive().optional(),unpackedSizeBytes:a.z.number().int().positive().optional()}).strict(),pn=a.z.object({name:a.z.string().trim().min(1).max(128).regex(Je),version:a.z.string().trim().min(1).max(160).optional(),reference:et,manifestDigest:tt.optional(),publishedAt:Ve.optional(),platforms:a.z.array(un).default([]),status:on.default("active")}).strict(),mn=a.z.object({id:Ue,publisher:a.z.string().trim().min(1).max(160),slug:a.z.string().trim().min(1).max(160),name:a.z.string().trim().min(1).max(160),description:a.z.string().trim().min(1).max(4096),localizedDescriptions:ln.optional(),cover:an.optional(),repository:a.z.string().trim().min(1).max(512),defaultTag:a.z.string().trim().min(1).max(128).regex(Je),tags:a.z.array(pn).min(1),capabilities:cn,optionalApps:dn,defaultEnv:He,labels:qe,status:on.default("active")}).strict().superRefine((e,t)=>{e.tags.some(t=>t.name===e.defaultTag)||t.addIssue({code:"custom",path:["defaultTag"],message:"Market defaultTag must identify one of the image tags."})});a.z.object({protocolVersion:Be,catalogId:Ue,revision:a.z.string().trim().min(1).max(240),source:a.z.enum(["embedded","remote","cache"]),generatedAt:Ve,expiresAt:Ve.optional(),items:a.z.array(mn)}).strict(),a.z.object({source:a.z.enum(["embedded","remote","cache"]),state:a.z.enum(["ready","refreshing","stale","failed"]),revision:a.z.string().trim().min(1).max(240),updatedAt:Ve,error:a.z.string().trim().max(4096).optional()}).strict(),a.z.object({id:Ue,origin:a.z.literal("custom"),name:a.z.string().trim().min(1).max(160),description:a.z.string().trim().max(4096).optional(),localizedDescriptions:ln.optional(),cover:an.optional(),reference:et,repository:a.z.string().trim().min(1).max(512),tag:a.z.string().trim().min(1).max(128).regex(Je).optional(),pullPolicy:a.z.literal("if-not-present").default("if-not-present"),capabilities:cn,optionalApps:dn,defaultEnv:He,labels:qe,createdAt:Ve,updatedAt:Ve}).strict();const gn=a.z.object({name:a.z.string().trim().min(1).max(128).regex(Je),version:a.z.string().trim().min(1).max(160).optional(),reference:et,manifestDigest:tt.optional(),status:on}).strict(),hn=a.z.object({id:Ue,origin:sn,name:a.z.string().trim().min(1).max(160),description:a.z.string().trim().max(4096).optional(),localizedDescriptions:ln.optional(),cover:an,repository:a.z.string().trim().min(1).max(512),tag:a.z.string().trim().min(1).max(128).regex(Je).optional(),availableTags:a.z.array(gn),reference:et,digest:tt.optional(),downloadSizeBytes:a.z.number().int().positive().optional(),unpackedSizeBytes:a.z.number().int().positive().optional(),capabilities:cn,optionalApps:dn,defaultEnv:He,labels:qe,readOnly:a.z.boolean(),lifecycleStatus:on.optional(),market:a.z.object({catalogId:Ue,catalogRevision:a.z.string().trim().min(1).max(240),publisher:a.z.string().trim().min(1).max(160),version:a.z.string().trim().min(1).max(160).optional()}).strict().optional()}).strict(),fn=a.z.object({id:Ue,origin:sn,name:a.z.string().trim().min(1).max(160),description:a.z.string().trim().max(4096).optional(),localizedDescriptions:ln.optional(),cover:an.optional(),repository:a.z.string().trim().min(1).max(512),tag:a.z.string().trim().min(1).max(128).regex(Je).optional(),requestedReference:et,resolvedDigest:tt.optional(),resolvedReference:et.optional(),downloadSizeBytes:a.z.number().int().positive().optional(),pullPolicy:a.z.literal("if-not-present").default("if-not-present"),capabilities:cn,optionalApps:dn,defaultEnv:He,labels:qe,market:a.z.object({catalogId:Ue,catalogRevision:a.z.string().trim().min(1).max(240),publisher:a.z.string().trim().min(1).max(160),version:a.z.string().trim().min(1).max(160).optional()}).strict().optional(),createdAt:Ve,updatedAt:Ve}).strict(),yn=a.z.object({phase:a.z.enum(["checking-image","pulling-image","resolving-image","ready","failed"]),requestedReference:et,generation:a.z.number().int().nonnegative().default(0),error:a.z.string().trim().max(4096).optional(),startedAt:Ve,updatedAt:Ve}).strict(),In="image.pull.terminal.output",An="image.pull.terminal.finished",bn=a.z.object({instanceId:Ue,generation:a.z.number().int().nonnegative(),requestedReference:et,sequence:a.z.number().int().nonnegative(),observedAt:Ve}).strict(),wn=bn.extend({data:a.z.string().min(1).max(65536),replay:a.z.boolean().optional()}).strict(),vn=bn.extend({outcome:a.z.enum(["succeeded","failed"])}).strict();bn.extend({status:a.z.enum(["connecting","pulling","extracting","complete","failed"]),layers:a.z.object({total:a.z.number().int().nonnegative(),completed:a.z.number().int().nonnegative(),downloaded:a.z.number().int().nonnegative(),downloading:a.z.number().int().nonnegative(),extracting:a.z.number().int().nonnegative()}).strict(),bytes:a.z.object({current:a.z.number().finite().nonnegative(),total:a.z.number().finite().positive()}).strict().optional(),percent:a.z.number().finite().min(0).max(100).optional(),message:a.z.string().trim().min(1).max(500),terminalTail:a.z.string().max(262144).optional(),terminalTruncated:a.z.boolean().optional()}).strict();const En=a.z.discriminatedUnion("kind",[a.z.object({kind:a.z.literal("direct")}).strict(),a.z.object({kind:a.z.literal("control-plane-proxy"),proxyId:Ue,proxyBindingId:Ue,targetNodeId:Ue}).strict()]),Nn=a.z.object({reachability:a.z.enum(["unknown","reachable","unreachable"]),bindingStatus:a.z.enum(["unknown","active","revoked"]),bindingRevision:a.z.number().int().positive().optional(),streamId:a.z.string().trim().min(1).max(160).optional(),revision:a.z.number().int().nonnegative().optional(),observedAt:Ve.optional(),target:De.optional(),lastError:ke.optional(),updatedAt:Ve}).strict(),zn=a.z.object({id:Ue,name:a.z.string().trim().min(1).max(160),connectionMode:a.z.enum(["local-ipc","local-loopback","direct-http","reverse-wss","control-plane-proxy"]).default("direct-http"),connectionPath:En.default({kind:"direct"}),connectionEnabled:a.z.boolean().default(!0),auth:a.z.object({mode:a.z.enum(["local-static-key","paired-hmac","proxy-binding"]).default("local-static-key"),keyId:Ue.optional(),secret:a.z.string().trim().max(4096).optional(),pairedAt:Ve.optional(),pairing:a.z.object({status:a.z.enum(["pending","paired","expired"]).default("pending"),joinToken:a.z.string().trim().max(4096).optional(),expiresAt:Ve.optional()}).strict().optional()}).strict().default({mode:"local-static-key"}),endpoint:a.z.string().trim().max(2048).optional(),controlEndpoint:a.z.string().trim().max(2048).optional(),containerEndpoint:a.z.string().trim().max(2048).optional(),publicWebBase:a.z.string().trim().max(2048).optional(),status:a.z.enum(["unknown","online","offline","degraded"]).default("unknown"),health:a.z.enum(["unknown","ok","degraded","failed"]).default("unknown"),capabilities:a.z.record(a.z.string(),a.z.unknown()).default({}),proxyState:Nn.optional(),appInventory:dt.optional(),labels:qe,lastSeenAt:Ve.optional(),createdAt:Ve,updatedAt:Ve}).strict().superRefine((e,t)=>{"control-plane-proxy"===e.connectionPath.kind&&"control-plane-proxy"!==e.connectionMode&&t.addIssue({code:"custom",path:["connectionPath"],message:"Control-plane proxy paths require control-plane-proxy connection mode."}),"control-plane-proxy"===e.connectionMode&&"control-plane-proxy"!==e.connectionPath.kind&&t.addIssue({code:"custom",path:["connectionPath"],message:"Control-plane proxy nodes require a control-plane-proxy connection path."})}),Sn=a.z.object({id:Ue,nodeId:Ue,name:a.z.string().trim().min(1).max(160),type:a.z.enum(["docker","kubernetes","local"]),status:a.z.enum(["unknown","online","offline","degraded"]).default("unknown"),accessStrategy:a.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).default("node-proxy"),capabilities:a.z.record(a.z.string(),a.z.unknown()).default({}),labels:qe,createdAt:Ve,updatedAt:Ve}).strict(),_n=a.z.object({instanceId:Ue,runtimeKind:a.z.literal("docker"),state:a.z.enum(["pending","available","stopped","unavailable"]),sampledAt:Ve,cpu:a.z.object({usagePercent:a.z.number().nonnegative()}).strict().optional(),memory:a.z.object({usageBytes:a.z.number().nonnegative(),limitBytes:a.z.number().nonnegative().optional(),usagePercent:a.z.number().nonnegative().optional()}).strict().optional(),network:a.z.object({rxBytes:a.z.number().nonnegative(),txBytes:a.z.number().nonnegative()}).strict().optional(),blockIo:a.z.object({readBytes:a.z.number().nonnegative(),writeBytes:a.z.number().nonnegative()}).strict().optional(),pids:a.z.number().int().nonnegative().optional(),error:a.z.string().trim().max(2048).optional()}).strict();a.z.object({ok:a.z.boolean().optional(),role:a.z.string().optional(),nodeId:Ue.optional(),platform:lt.optional()}).passthrough();const Tn=a.z.object({bindScope:a.z.enum(["loopback","all-ipv4"]),port:a.z.number().int().min(1).max(65535)}).strict(),kn=Tn.extend({host:a.z.enum(["127.0.0.1","0.0.0.0"]),status:a.z.enum(["listening","error"]),source:a.z.enum(["bootstrap","persisted"]),error:a.z.string().trim().max(2048).optional()}).strict(),Cn=Tn;a.z.object({nodeId:Ue,joinToken:a.z.string().trim().min(1),expiresAt:Ve}).passthrough(),a.z.object({nodeId:Ue,keyId:Ue,secret:a.z.string().regex(/^[A-Za-z0-9_-]{32,128}$/),pairedAt:Ve}).strict();const xn=a.z.object({id:Ue,keyId:Ue,name:a.z.string().trim().min(1).max(160).optional(),pairedAt:Ve,updatedAt:Ve,current:a.z.boolean()}).passthrough();a.z.object({keyId:Ue,revoked:a.z.literal(!0),revokedAt:Ve}).strict(),a.z.object({id:Ue,pairingKeyId:Ue,url:a.z.string().trim().min(1).max(2048),name:a.z.string().trim().min(1).max(160).optional(),enabled:a.z.boolean(),createdAt:Ve,updatedAt:Ve,status:a.z.enum(["disabled","connecting","connected","reconnecting","failed"]),lastConnectedAt:Ve.optional(),lastDisconnectedAt:Ve.optional(),error:a.z.string().optional()}).passthrough(),a.z.object({pairing:xn,connection:a.z.object({id:Ue,pairingKeyId:Ue,url:a.z.string().trim().min(1).max(2048),name:a.z.string().trim().min(1).max(160).optional(),enabled:a.z.boolean(),createdAt:Ve,updatedAt:Ve}).passthrough(),tunnel:a.z.object({status:a.z.enum(["disabled","saved","connecting","connected","failed"]),error:a.z.string().trim().max(2048).optional()}).passthrough()}).passthrough(),a.z.object({deleted:a.z.boolean().optional()}).passthrough();const On=a.z.object({repository:a.z.string().trim().optional(),tag:a.z.string().trim().optional(),id:a.z.string().trim(),createdSince:a.z.string().trim().optional(),size:a.z.string().trim().optional(),sizeBytes:a.z.number().int().nonnegative().optional(),reference:a.z.string().trim().min(1),repoDigests:a.z.array(a.z.string().trim().min(1).max(512)).default([])}).passthrough();a.z.object({image:hn,status:a.z.enum(["available","pull-required","unknown"]),localImage:On.optional(),localSizeBytes:a.z.number().int().nonnegative().optional(),downloadSizeBytes:a.z.number().int().positive().optional(),unpackedSizeBytes:a.z.number().int().positive().optional(),error:a.z.string().trim().max(2048).optional()}).strict();const Rn=a.z.lazy(()=>a.z.object({name:a.z.string().trim().min(1),path:a.z.string().trim().min(1).max(4096),children:a.z.array(Rn)}).passthrough());a.z.object({status:a.z.number().int().min(100).max(599).optional(),headers:a.z.record(a.z.string(),a.z.string()).optional(),bodyBase64:a.z.string().optional()}).passthrough();const Dn=a.z.object({strategy:a.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).default("node-proxy"),web:a.z.string().trim().max(2048).optional(),api:a.z.string().trim().max(2048).optional(),vnc:a.z.string().trim().max(2048).optional(),tty:a.z.string().trim().max(2048).optional(),logs:a.z.string().trim().max(2048).optional(),status:a.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown")}).strict(),Pn=a.z.object({strategy:a.z.enum(["control-plane-proxy","direct-port","node-proxy","kubernetes-ingress","kubernetes-port-forward"]).default("control-plane-proxy"),web:a.z.string().trim().max(2048).optional(),api:a.z.string().trim().max(2048).optional(),ws:a.z.string().trim().max(2048).optional(),status:a.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown")}).strict().default({strategy:"control-plane-proxy",status:"unknown"}),jn=a.z.object({mode:a.z.enum(["local-bind","git-clone","empty-volume","persistent-volume"]).optional(),status:a.z.enum(["unknown","pending","ready","failed"]).default("unknown"),path:a.z.string().trim().max(4096).optional(),resolvedCommit:a.z.string().trim().max(120).optional(),error:a.z.string().trim().max(2048).optional()}).passthrough(),Mn=a.z.object({id:Ue,name:a.z.string().trim().min(1).max(160),projectId:Ue.optional(),source:Ut,sourceSnapshot:a.z.record(a.z.string(),a.z.unknown()).default({}),modelSelection:nt,nodeId:Ue,runtimeId:Ue,imageSelection:it.optional(),imageSnapshot:fn.optional(),imageProvisioning:yn.optional(),stateRevision:a.z.number().int().min(0).default(0),processIncarnationId:a.z.string().trim().min(1).max(120).optional(),status:a.z.enum(["created","provisioning","starting","registering","registered","running","stopping","stopped","failed","unhealthy"]).default("created"),health:a.z.enum(["unknown","ok","degraded","failed"]).default("unknown"),connectionStatus:a.z.enum(["unknown","online","offline","endpoint-unreachable"]).default("unknown"),agentStatus:a.z.enum(["unknown","online","offline"]).default("unknown"),targetStatus:a.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown"),uiAccessStatus:a.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown"),controlMode:a.z.enum(["standalone","controlled"]).default("controlled"),protocolVersion:Fe.optional(),instanceVersion:a.z.string().trim().max(80).optional(),build:St.optional(),runtimeVersion:Ct.optional(),ready:a.z.boolean().default(!1),capabilities:a.z.record(a.z.string(),a.z.unknown()).default({}),appInventory:dt.optional(),config:a.z.object({autoImportAgentConfigs:a.z.boolean().default(!0),defaultCodexPermissionMode:U.default("ask")}).strict().default({autoImportAgentConfigs:!0,defaultCodexPermissionMode:"ask"}),workspace:jn.default({status:"unknown"}),target:Dn.default({strategy:"direct-port",status:"unknown"}),access:Pn,apps:a.z.object({runningCount:a.z.number().int().min(0).default(0),problemCount:a.z.number().int().min(0).default(0),updatedAt:Ve.optional(),revision:a.z.number().int().min(0).optional()}).strict().default({runningCount:0,problemCount:0}),aiSessions:se.default(()=>({runningCount:0,waitingCount:0,staleCount:0,sessions:[],updatedAt:(new Date).toISOString()})),triggers:a.z.object({enabledCount:a.z.number().int().min(0).default(0),runningCount:a.z.number().int().min(0).default(0),errorCount:a.z.number().int().min(0).default(0),configs:a.z.array(a.z.object({configHash:a.z.string().trim().min(1),config:Ie,deployments:a.z.array(be).default([]),runtime:a.z.array(we).default([])}).strict()).default([]),recentRuns:a.z.array(ve).default([])}).strict().optional(),runtime:a.z.object({kind:a.z.string().trim().max(80).optional(),containerName:a.z.string().trim().max(240).optional(),containerId:a.z.string().trim().max(240).optional(),workspacePath:a.z.string().trim().max(4096).optional(),pid:a.z.number().int().positive().optional(),port:a.z.number().int().positive().max(65535).optional(),labels:a.z.record(a.z.string(),a.z.string()).default({})}).strict().default({labels:{}}),registrationToken:a.z.string().trim().min(1).max(240).optional(),lastHeartbeatAt:Ve.optional(),createdAt:Ve,updatedAt:Ve}).strict(),Ln="instance.lifecycle.snapshot",$n=a.z.object({instanceId:Mn.shape.id,revision:a.z.number().int().min(0),updatedAt:Ve,status:Mn.shape.status.unwrap(),health:Mn.shape.health.unwrap(),connectionStatus:Mn.shape.connectionStatus.unwrap(),accessStatus:a.z.enum(["reachable","endpoint-unreachable"]),imageProvisioning:yn.optional(),workspace:jn,runtime:Mn.shape.runtime.unwrap(),runtimeVersion:Ct.optional(),ready:a.z.boolean(),lastHeartbeatAt:Ve.optional()}).strict();function Fn(e,t){return Mn.safeParse(Un(e,t))}function Un(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,i=new Set(Object.keys(Mn.shape)),r={};for(const[e,s]of Object.entries(n))i.has(e)?r[e]=s:t?.({instanceId:"string"==typeof n.id?n.id:void 0,field:e});if(n.capabilities&&"object"==typeof n.capabilities&&!Array.isArray(n.capabilities)){const e={...n.capabilities};Object.prototype.hasOwnProperty.call(e,"apps")&&(t?.({instanceId:"string"==typeof n.id?n.id:void 0,field:"capabilities.apps"}),delete e.apps),r.capabilities=e}else r.capabilities={};r.appInventory=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return;const i=e;Object.keys(i).some(e=>!["observedAt","items","issues"].includes(e))&&t?.({instanceId:n,field:"appInventory"});const r={observedAt:i.observedAt,items:Array.isArray(i.items)?i.items.map(e=>{e&&"object"==typeof e&&!Array.isArray(e)&&Object.keys(e).some(e=>!["id","name","kind","source","availability","capabilities","diagnosticCode"].includes(e))&&t?.({instanceId:n,field:"appInventory.items"});const i=Hn(e,["id","name","kind","source","availability","diagnosticCode"]);return!i||"object"!=typeof i||Array.isArray(i)?i:{...i,capabilities:Hn(e.capabilities,["automation","supportsCwdSelection"])}}):i.items,issues:Array.isArray(i.issues)?i.issues.map(e=>Hn(e,["code","message"])):i.issues},s=dt.safeParse(r);return s.success?s.data:void 0}(n.appInventory,t,"string"==typeof n.id?n.id:void 0),r.source=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return e;const i=e,r=i.type,s=Ut.options.find(e=>e.shape.type.value===r);if(!s)return e;const o="local-folder"===r?["type","localFolderId","path","ownerNodeId"]:"git-template"===r?["type","url","templateId","ref","auth","clone"]:["type","repositoryId","url","provider","ref","auth","clone"],a=Hn(i,o);if("local-folder"!==r){const e=Vn(Mt,Hn(i.ref,["type","name","commit"]),"source.ref",t,n),r=Vn(Lt,Hn(i.auth,["type","secretId"]),"source.auth",t,n),s=Vn($t,Hn(i.clone,["depth","submodules","lfs","subdirectory"]),"source.clone",t,n);e?a.ref=e:delete a.ref,r?a.auth=r:delete a.auth,s?a.clone=s:delete a.clone}const c=Vn(s,a,"source",t,n);return c?(Object.keys(i).some(e=>!o.includes(e))&&t?.({instanceId:n,field:"source"}),c):a}(n.source,t,"string"==typeof n.id?n.id:void 0),r.sourceSnapshot=n.sourceSnapshot&&"object"==typeof n.sourceSnapshot&&!Array.isArray(n.sourceSnapshot)?n.sourceSnapshot:{},r.build=Vn(St,n.build,"build",t,"string"==typeof n.id?n.id:void 0),r.aiSessions=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return;const i=e,r=Array.isArray(i.sessions)?i.sessions.flatMap((e,i)=>{const r=Vn(re,e,`aiSessions.sessions.${i}`,t,n);return r?[r]:[]}):[],s={runningCount:"number"==typeof i.runningCount&&Number.isInteger(i.runningCount)&&i.runningCount>=0?i.runningCount:0,waitingCount:"number"==typeof i.waitingCount&&Number.isInteger(i.waitingCount)&&i.waitingCount>=0?i.waitingCount:0,staleCount:"number"==typeof i.staleCount&&Number.isInteger(i.staleCount)&&i.staleCount>=0?i.staleCount:0,sessions:r,updatedAt:Ve.safeParse(i.updatedAt).success?i.updatedAt:(new Date).toISOString()};return Object.keys(i).some(e=>!["runningCount","waitingCount","staleCount","sessions","updatedAt"].includes(e))&&t?.({instanceId:n,field:"aiSessions"}),se.parse(s)}(n.aiSessions,t,"string"==typeof n.id?n.id:void 0),r.triggers=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return;const i=e;Object.keys(i).some(e=>!["enabledCount","runningCount","errorCount","configs","recentRuns"].includes(e))&&t?.({instanceId:n,field:"triggers"});const r=(e,i,r)=>Array.isArray(e)?e.flatMap((e,s)=>{const o=Vn(i,e,`${r}.${s}`,t,n);return o?[o]:[]}):[],s=Array.isArray(i.configs)?i.configs.flatMap((e,i)=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const s=e;Object.keys(s).some(e=>!["configHash","config","deployments","runtime"].includes(e))&&t?.({instanceId:n,field:`triggers.configs.${i}`});const o=function(e,t,n,i){if(!e||"object"!=typeof e||Array.isArray(e))return;const r=e,s=Hn(r,["configHash","name","description","createdAt","updatedAt"]);if(r.source&&"object"==typeof r.source&&!Array.isArray(r.source)){const e=r.source,t="schedule"===e.type?"interval"===e.scheduleKind?["type","scheduleKind","intervalMs"]:"daily"===e.scheduleKind?["type","scheduleKind","timeOfDay","timezone"]:["type","scheduleKind","weekdays","timeOfDay","timezone"]:"file-change"===e.type?["type","roots","globs","ignore","debounceMs"]:["type","agent","statuses","phases"];s.source=Hn(e,t)}return s.action=Hn(r.action,["promptTemplate"]),s.policy=Hn(r.policy,["cooldownMs","maxConcurrentRuns","whenBusy"]),Vn(Ie,s,t,n,i)}(s.config,`triggers.configs.${i}.config`,t,n);return"string"==typeof s.configHash&&o?[{configHash:s.configHash,config:o,deployments:r(s.deployments,be,`triggers.configs.${i}.deployments`),runtime:r(s.runtime,we,`triggers.configs.${i}.runtime`)}]:[]}):[];return{enabledCount:"number"==typeof i.enabledCount&&Number.isInteger(i.enabledCount)&&i.enabledCount>=0?i.enabledCount:0,runningCount:"number"==typeof i.runningCount&&Number.isInteger(i.runningCount)&&i.runningCount>=0?i.runningCount:0,errorCount:"number"==typeof i.errorCount&&Number.isInteger(i.errorCount)&&i.errorCount>=0?i.errorCount:0,configs:s,recentRuns:r(i.recentRuns,ve,"triggers.recentRuns")}}(n.triggers,t,"string"==typeof n.id?n.id:void 0),r.apps=Vn(Mn.shape.apps.unwrap(),Hn(n.apps,["runningCount","problemCount","updatedAt","revision"]),"apps",t,"string"==typeof n.id?n.id:void 0)||{runningCount:0,problemCount:0},r.config=Vn(Mn.shape.config.unwrap(),Hn(n.config,["autoImportAgentConfigs","defaultCodexPermissionMode"]),"config",t,"string"==typeof n.id?n.id:void 0)||{autoImportAgentConfigs:!0,defaultCodexPermissionMode:"ask"},r.modelSelection=Vn(nt.unwrap(),Hn(n.modelSelection,["codexModelHash","claudeModelHash"]),"modelSelection",t,"string"==typeof n.id?n.id:void 0)||{},r.imageSnapshot=function(e,t,n,i){if(!e||"object"!=typeof e||Array.isArray(e))return e;const r=e,s=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n=new Set(["id","origin","name","description","localizedDescriptions","cover","reference","repository","tag","image","registry","pullPolicy","capabilities","optionalApps","defaultEnv","labels","createdAt","updatedAt"]);for(const e of Object.keys(t))n.has(e);"string"==typeof t.id&&t.id;const i="string"==typeof t.image?t.image:void 0;Object.prototype.hasOwnProperty.call(t,"registry");let r,s="string"==typeof t.reference?t.reference:i;if(s)try{s=Qe(s)}catch{if(!s.includes("@")&&s.lastIndexOf(":")<=s.lastIndexOf("/"))try{s=Qe(`${s}:latest`)}catch{}}try{r=s?Ze(s):void 0}catch{}return{id:t.id,origin:"custom",name:t.name,description:t.description,localizedDescriptions:t.localizedDescriptions,cover:Hn(t.cover,["kind","key","url","mediaType","digest"]),reference:r?.reference??s,repository:r?.repository??t.repository,tag:r?.tag??t.tag,pullPolicy:t.pullPolicy??"if-not-present",capabilities:t.capabilities,optionalApps:t.optionalApps,defaultEnv:t.defaultEnv,labels:t.labels,createdAt:t.createdAt,updatedAt:t.updatedAt}}(r),{reference:o,...a}=s,c=r.requestedReference??o;let d;try{d="string"==typeof c?Ze(c):void 0}catch{}const l={img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"},u="string"==typeof r.id?r.id:"string"==typeof t?t:void 0,p="market"===r.origin||u&&l[u]?"market":"custom";return void 0===r.image&&void 0===r.reference||n?.({instanceId:i,field:"imageSnapshot.reference"}),{...a,id:u&&l[u]?l[u]:u,origin:p,repository:d?.repository??r.repository,tag:d?.tag??r.tag,requestedReference:d?.reference??c,resolvedDigest:r.resolvedDigest,resolvedReference:r.resolvedReference,downloadSizeBytes:r.downloadSizeBytes,market:"market"===p?Hn(r.market,["catalogId","catalogRevision","publisher","version"])??{catalogId:"task_handoff_embedded",catalogRevision:"legacy",publisher:"task-handoff"}:void 0}}(n.imageSnapshot,n.imageId,t,"string"==typeof n.id?n.id:void 0);const s="string"==typeof n.imageId?{img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"}[n.imageId]||n.imageId:void 0,o=Hn(n.imageSelection,["imageId","tag"]);r.imageSelection=o||(s?{imageId:s,tag:r.imageSnapshot?.tag}:void 0),r.imageProvisioning=Vn(yn,Hn(n.imageProvisioning,["phase","requestedReference","generation","error","startedAt","updatedAt"]),"imageProvisioning",t,"string"==typeof n.id?n.id:void 0),r.runtimeVersion=function(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return;const i=e,r=e=>{if("string"!=typeof e)return;const t=e.trim();return t&&t.length<=80?t:void 0},s=r(i.desiredVersion);if(!s)return void t?.({instanceId:n,field:"runtimeVersion.desiredVersion"});const o=new Set(Ct.shape.phase.options),a="string"==typeof i.phase?i.phase:"pending",c=o.has(a)?a:{idle:"pending",queued:"pending",checking:"pending",downloading:"installing",updating:"installing",completed:"matched",succeeded:"matched",ready:"matched",error:"failed"}[a]||"pending";let d;if(c!==a&&t?.({instanceId:n,field:"runtimeVersion.phase"}),i.error&&"object"==typeof i.error&&!Array.isArray(i.error)){const e=i.error,s="string"==typeof e.message?e.message.trim().slice(0,4096):"";if(s){const i=new Set(kt.shape.code.options),o="string"==typeof e.code&&i.has(e.code)?e.code:"INSTANCE_RUNTIME_INSTALL_FAILED";o!==e.code&&t?.({instanceId:n,field:"runtimeVersion.error.code"});const a=r(e.expectedVersion),c=r(e.actualVersion);d={code:o,message:s,...a?{expectedVersion:a}:{},...c?{actualVersion:c}:{},retryable:!0===e.retryable}}else t?.({instanceId:n,field:"runtimeVersion.error"})}"string"==typeof i.error&&i.error.trim()&&(d={code:"INSTANCE_RUNTIME_INSTALL_FAILED",message:i.error.trim().slice(0,4096),expectedVersion:s,...r(i.actualVersion)?{actualVersion:r(i.actualVersion)}:{},retryable:!1});const l=r(i.actualVersion),u=Ve.safeParse(i.lastAttemptAt),p=Ve.safeParse(i.matchedAt);return void 0===i.lastAttemptAt||u.success||t?.({instanceId:n,field:"runtimeVersion.lastAttemptAt"}),void 0===i.matchedAt||p.success||t?.({instanceId:n,field:"runtimeVersion.matchedAt"}),{desiredVersion:s,...l?{actualVersion:l}:{},phase:c,attempt:"number"==typeof i.attempt&&Number.isInteger(i.attempt)&&i.attempt>=0?i.attempt:0,...u.success?{lastAttemptAt:u.data}:{},...p.success?{matchedAt:p.data}:{},...d?{error:d}:{}}}(n.runtimeVersion,t,"string"==typeof n.id?n.id:void 0),r.workspace=Vn(jn,n.workspace,"workspace",t,"string"==typeof n.id?n.id:void 0)||{status:"unknown"},r.runtime=Vn(Mn.shape.runtime.unwrap(),Hn(n.runtime,["kind","containerName","containerId","workspacePath","pid","port","labels"]),"runtime",t,"string"==typeof n.id?n.id:void 0)||{labels:{}},r.target=Vn(Dn,Hn(n.target??n.endpoints,["strategy","web","api","vnc","tty","logs","status"]),"target",t,"string"==typeof n.id?n.id:void 0)||{strategy:"direct-port",status:"unknown"},r.access=Vn(Pn,Hn(n.access,["strategy","web","api","ws","status"]),"access",t,"string"==typeof n.id?n.id:void 0)||{strategy:"control-plane-proxy",status:"unknown"};for(const[e,i]of Object.entries(Mn.shape))Object.prototype.hasOwnProperty.call(r,e)&&!i.safeParse(r[e]).success&&i.safeParse(void 0).success&&(delete r[e],t?.({instanceId:"string"==typeof n.id?n.id:void 0,field:e}));return r}function Vn(e,t,n,i,r){if(!t||"object"!=typeof t||Array.isArray(t))return;let s=structuredClone(t),o=!1;for(let t=0;t<20;t+=1){const t=e.safeParse(s);if(t.success)return o&&i?.({instanceId:r,field:n}),t.data;let a=!1;for(const e of t.error.issues){if("unrecognized_keys"!==e.code)continue;const t=qn(s,e.path);if(t&&"object"==typeof t&&!Array.isArray(t))for(const n of e.keys)Object.prototype.hasOwnProperty.call(t,n)&&(delete t[n],a=!0,o=!0)}if(!a){const o=structuredClone(s);let a=!1;for(const e of t.error.issues){if(!e.path.length||"string"!=typeof e.path.at(-1))continue;const t=qn(o,e.path.slice(0,-1)),n=e.path.at(-1);t&&"object"==typeof t&&!Array.isArray(t)&&Object.prototype.hasOwnProperty.call(t,n)&&(delete t[n],a=!0)}if(a){const t=e.safeParse(o);if(t.success)return i?.({instanceId:r,field:n}),t.data}break}}i?.({instanceId:r,field:n})}function qn(e,t){let n=e;for(const e of t){if(!n||"object"!=typeof n)return;n=n[e]}return n}function Hn(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e;return Object.fromEntries(t.filter(e=>Object.prototype.hasOwnProperty.call(n,e)).map(e=>[e,n[e]]))}const Bn=a.z.object({instanceId:Ue.optional(),projectId:Ue.optional(),source:Ut.optional(),nodeId:Ue.optional(),runtimeId:Ue.optional(),imageSelection:it.optional(),instanceVersion:a.z.string().trim().max(80).optional(),protocolVersion:Fe,build:St.optional(),controlMode:a.z.enum(["standalone","controlled"]).default("controlled"),capabilities:a.z.record(a.z.string(),a.z.unknown()).default({}),appInventory:dt.optional(),target:Dn.default({strategy:"direct-port",status:"unknown"}),workspace:jn.default({status:"unknown"}),registrationToken:a.z.string().trim().max(240).optional(),processIncarnationId:a.z.string().trim().min(1).max(120).optional()}).strict().superRefine((e,t)=>{e.protocolVersion!==$e||e.appInventory||t.addIssue({code:"custom",path:["appInventory"],message:"Current protocol register payload requires appInventory."})}),Kn=a.z.object({status:Mn.shape.status.optional(),health:Mn.shape.health.optional(),protocolVersion:Fe,build:St.optional(),capabilities:Mn.shape.capabilities.optional(),appInventory:dt.optional(),apps:Mn.shape.apps.optional(),aiSessions:Mn.shape.aiSessions.optional(),triggers:Mn.shape.triggers.optional(),workspace:jn.optional(),target:Dn.partial().optional(),processIncarnationId:a.z.string().trim().min(1).max(120).optional()}).strict().superRefine((e,t)=>{e.protocolVersion!==$e||e.appInventory||t.addIssue({code:"custom",path:["appInventory"],message:"Current protocol heartbeat payload requires appInventory."})}),Gn=a.z.enum(["web","telegram","wechat","dingding"]);function Jn(e,t,n={}){return new Promise((i,r)=>{if(n.signal?.aborted)return void r(Object.assign(new Error(`${e} was aborted.`),{code:"RUNTIME_COMMAND_ABORTED"}));const s=d.spawn(e,t,{stdio:["ignore","pipe","pipe"]}),o=[],a=[];let c=!1;const l=n.timeoutMs?setTimeout(()=>{c=!0,s.kill("SIGKILL")},n.timeoutMs):void 0;let u=!1;const p=()=>{u=!0,s.kill("SIGKILL")},m=()=>{l&&clearTimeout(l),n.signal?.removeEventListener("abort",p)};n.signal?.addEventListener("abort",p,{once:!0}),l?.unref?.(),s.stdout.on("data",e=>o.push(Buffer.from(e))),s.stderr.on("data",e=>a.push(Buffer.from(e))),s.on("error",e=>{m(),r(e)}),s.on("close",t=>{m();const s={stdout:Buffer.concat(o).toString("utf8").trim(),stderr:Buffer.concat(a).toString("utf8").trim()};if(c){const t=new Error(`${e} timed out after ${n.timeoutMs}ms`);return Object.assign(t,{statusCode:504,code:"RUNTIME_COMMAND_TIMEOUT",details:s}),void r(t)}if(u)return void r(Object.assign(new Error(`${e} was aborted.`),{code:"RUNTIME_COMMAND_ABORTED",details:s}));if(0===t)return void i(s);const d=new Error(s.stderr||`${e} exited with code ${t}`);Object.assign(d,{statusCode:502,code:"RUNTIME_EXECUTOR_FAILED",details:s}),r(d)})})}a.z.object({id:Ue,channel:Gn,name:a.z.string().trim().min(1).max(160),enabled:a.z.boolean().default(!1),token:a.z.string().trim().max(4096).optional(),defaultChatId:a.z.string().trim().max(240).optional(),allowedUserIds:a.z.array(a.z.string().trim().min(1).max(240)).default([]),pollIntervalMs:a.z.number().int().positive().max(6e4).default(3e3),settings:a.z.record(a.z.string(),a.z.unknown()).default({}),createdAt:Ve,updatedAt:Ve}).strict(),a.z.object({id:Ue,channel:Gn,bridgeId:Ue.optional(),chatSessionId:a.z.string().trim().min(1).max(240),userId:a.z.string().trim().max(240).optional(),activeProjectId:Ue.optional(),activeInstanceId:Ue.optional(),activeAiSessionId:a.z.string().trim().min(1).max(120).optional(),lastUsedAt:Ve,createdAt:Ve,updatedAt:Ve}).strict(),a.z.object({source:a.z.object({type:a.z.literal("chat-gateway").default("chat-gateway"),channel:Gn,bridgeId:Ue.optional(),chatSessionId:a.z.string().trim().min(1).max(240),userId:a.z.string().trim().max(240).optional()}).strict(),message:a.z.object({text:a.z.string().trim().max(2e4).default(""),attachments:a.z.array(M).max(6).default([])}).strict().superRefine((e,t)=>{e.attachments.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>N&&t.addIssue({code:a.z.ZodIssueCode.custom,path:["attachments"],message:"Inline attachments must be 41943040 bytes or less in total."})}),target:a.z.object({instanceId:Ue,aiSessionId:a.z.string().trim().min(1).max(120)}).strict().optional()}).strict(),a.z.object({id:Ue,instanceId:Ue,projectId:Ue.optional(),aiSessionId:a.z.string().trim().min(1).max(120),providerSessionId:a.z.string().trim().max(240).optional(),result:a.z.string().default(""),timeoutMs:a.z.number().positive().optional(),source:a.z.string().trim().max(120).optional(),kind:a.z.enum(["task","approval"]).default("task"),status:a.z.enum(["pending","unreachable"]).default("pending"),error:a.z.string().trim().max(2048).optional(),lastSeenAt:Ve}).strict();const Wn=(e,t,n={})=>new Promise((i,r)=>{if(n.signal?.aborted)return void r(Object.assign(new Error(`${e} was aborted.`),{code:"RUNTIME_COMMAND_ABORTED"}));const s=[];let o,a=!1,c=!1;try{o=l.spawn(e,t,{name:"xterm-256color",cols:n.cols||120,rows:n.rows||40,cwd:process.cwd(),env:process.env})}catch(e){return void r(e)}const d=n.timeoutMs?setTimeout(()=>{a=!0,o.kill("SIGKILL")},n.timeoutMs):void 0,u=()=>{c=!0;try{o.kill("SIGKILL")}catch{}};n.signal?.addEventListener("abort",u,{once:!0}),d?.unref?.(),o.onData(e=>{s.push(e),n.onData?.(e)}),o.onExit(({exitCode:t})=>{d&&clearTimeout(d),n.signal?.removeEventListener("abort",u);const o={stdout:s.join(""),stderr:""};a?r(Object.assign(new Error(`${e} timed out after ${n.timeoutMs}ms`),{statusCode:504,code:"RUNTIME_COMMAND_TIMEOUT",details:o})):c?r(Object.assign(new Error(`${e} was aborted.`),{code:"RUNTIME_COMMAND_ABORTED",details:o})):0!==t?r(Object.assign(new Error(o.stdout.replace(/\u001b\[[0-?]*[ -/]*[@-~]/g,"").split(/\r?\n/).map(e=>e.trim()).filter(Boolean).at(-1)||`${e} exited with code ${t}`),{statusCode:502,code:"RUNTIME_EXECUTOR_FAILED",details:o})):i(o)})});class Yn{inFlight=new Map;runCommand;runTerminalCommand;constructor(e=Jn,t){this.runCommand=e,this.runTerminalCommand=t||function(e){return e===Jn?Wn:async(t,n,i={})=>{const r=await e(t,n,{timeoutMs:i.timeoutMs,signal:i.signal});return r.stdout&&i.onData?.(r.stdout),r.stderr&&i.onData?.(r.stderr),r}}(e)}ensure(e,t,n,i){const r=Qe(e),s=this.inFlight.get(r);if(s)return t&&(s.phaseListeners.add(t),s.phase&&t(s.phase)),n&&(s.terminalListeners.add(n),s.terminalTail&&n({sequence:s.terminalSequence,data:s.terminalTail,replay:!0})),this.bindAbort(s,i),s.promise;const o=new Set,a=new Set;t&&o.add(t),n&&a.add(n);const c={promise:Promise.resolve(void 0),controller:new AbortController,abortDisposers:new Set,phaseListeners:o,terminalListeners:a,terminalSequence:0,terminalTail:""};return this.bindAbort(c,i),c.promise=this.ensureOnce(r,e=>{c.phase=e,o.forEach(t=>t(e))},e=>{c.terminalSequence+=1,c.terminalTail=`${c.terminalTail}${e}`.slice(-262144);const t={sequence:c.terminalSequence,data:e};a.forEach(e=>e(t))},c.controller.signal).finally(()=>{this.inFlight.delete(r);for(const e of c.abortDisposers)e();c.abortDisposers.clear()}),this.inFlight.set(r,c),c.promise}bindAbort(e,t){if(!t)return;if(t.aborted)return void e.controller.abort();const n=()=>e.controller.abort();t.addEventListener("abort",n,{once:!0}),e.abortDisposers.add(()=>t.removeEventListener("abort",n))}async ensureOnce(e,t,n,i){t("checking-image");let r=await this.inspect(e,i).catch(e=>{if(i.aborted)throw e}),s=!1;r||(t("pulling-image"),await this.runTerminalCommand("docker",["pull",e],{cols:120,rows:40,signal:i,onData:n}),s=!0,r=await this.inspect(e,i)),t("resolving-image");const o=(a=r,Array.isArray(a.RepoDigests)?a.RepoDigests.filter(e=>"string"==typeof e):[]).find(e=>/@sha256:[a-fA-F0-9]{64}$/.test(e));var a;const c=o?.split("@").at(-1)?.toLowerCase();return{requestedReference:e,...c?{resolvedDigest:c}:{},resolvedReference:o||e,pulled:s}}async inspect(e,t){const n=await this.runCommand("docker",["image","inspect",e,"--format","{{json .}}"],{signal:t});return JSON.parse(n.stdout.trim()||"{}")}}function Xn(e){if(!e)return;const t=/^([0-9]+(?:\.[0-9]+)?)\s*(B|kB|MB|GB|TB)$/i.exec(e.trim());if(!t)return;const n=Number(t[1])*{b:1,kb:1e3,mb:1e6,gb:1e9,tb:1e12}[t[2].toLowerCase()];return Number.isSafeInteger(Math.round(n))?Math.round(n):void 0}class Qn{runCommand;publishHost;images;launcherAssetsDir;portResolutionRetryDelaysMs;constructor(e=Jn,i={}){this.runCommand=e,this.images=i.imageService||new Yn(e),this.publishHost=i.publishHost||"127.0.0.1",this.launcherAssetsDir=i.launcherAssetsDir||function(){const e=("undefined"==typeof document?require("url").pathToFileURL(__filename).href:b&&"SCRIPT"===b.tagName.toUpperCase()&&b.src||new URL("cli.js",document.baseURI).href)?n.dirname(r.fileURLToPath("undefined"==typeof document?require("url").pathToFileURL(__filename).href:b&&"SCRIPT"===b.tagName.toUpperCase()&&b.src||new URL("cli.js",document.baseURI).href)):__dirname,i=[n.resolve(e,"../../../../../docker"),n.resolve(e,"../docker"),n.resolve(e,"../../docker")];return i.find(e=>t.existsSync(n.join(e,"runtime-installer.mjs")))||i[0]}(),this.portResolutionRetryDelaysMs=i.portResolutionRetryDelaysMs?.length?i.portResolutionRetryDelaysMs:[0,100,250,500,1e3]}async start(e){di(e);const t=e.instance.runtime.containerName||ai(e.instance.id),n=await this.inspectContainerForStart(t);if(n){si(t,n.id,e.instance.runtime.containerId,"before start","RUNTIME_EXECUTOR_FAILED");const i=n.labels["task-handoff.instance-id"];if(i!==e.instance.id)throw ni("RUNTIME_EXECUTOR_FAILED",`Docker container ${t} belongs to ${i||"an unknown instance"}, not ${e.instance.id}.`);try{await this.runCommand("docker",["start",t])}catch(e){throw ni("RUNTIME_EXECUTOR_FAILED",`Could not start Docker container ${t}.`,e)}return this.runningResult(e,t,n.id)}let i;await this.images.ensure(e.image.resolvedReference||e.image.requestedReference);try{i=await this.runCommand("docker",function(e,t,n={}){const i=n.publishHost||"127.0.0.1",r=e.node?.id||"node_unset",s=e.runtime?.id||"runtime_local_docker",o=["run","-d","--name",t,"--label",`task-handoff.instance-id=${e.instance.id}`,"--label",`task-handoff.project-id=${e.project.id}`,"--label",`task-handoff.node-id=${r}`,"--label",`task-handoff.runtime-id=${s}`,"--label",`task-handoff.image-id=${e.image.id}`,"--shm-size","1gb","--security-opt","seccomp=unconfined","--network","bridge","--add-host","host.docker.internal:host-gateway","--tmpfs","/tmp:rw,mode=1777","-v",`${t}-data:/data`,"-v",`${t}-agent-home:/home/agent`,"-p",`${i}::8080`],a={TASK_HANDOFF_CONTROL_MODE:"controlled",TASK_HANDOFF_NODE_AGENT_URL:e.nodeAgentUrl||e.node?.endpoint||"",TASK_HANDOFF_INSTANCE_ID:e.instance.id,TASK_HANDOFF_INSTANCE_NAME:e.instance.name,TASK_HANDOFF_REGISTRATION_TOKEN:e.instance.registrationToken||"",TASK_HANDOFF_PROJECT_ID:e.project.id,TASK_HANDOFF_NODE_ID:r,TASK_HANDOFF_RUNTIME_ID:s,TASK_HANDOFF_IMAGE_ID:e.image.id,...e.image.tag?{TASK_HANDOFF_IMAGE_TAG:e.image.tag}:{},TASK_HANDOFF_CHAT_BRIDGES:"none",TASK_HANDOFF_WORKSPACE:e.project.workspacePolicy.path||"/workspace",TASK_HANDOFF_WORKSPACE_MODE:e.project.workspacePolicy.mode};for(const[e,t]of Object.entries(a))ci(o,e,t);"local-folder"===e.project.source.type?o.push("-v",`${e.project.source.path}:${e.project.workspacePolicy.path||"/workspace"}:${e.project.workspacePolicy.readOnly?"ro":"rw"}`):(ci(o,"TASK_HANDOFF_PROJECT_SOURCE",JSON.stringify(e.project.source)),ci(o,"TASK_HANDOFF_WORKSPACE_POLICY",JSON.stringify(e.project.workspacePolicy)),ci(o,"TASK_HANDOFF_GIT_URL",e.project.source.url),e.project.source.ref?.commit?ci(o,"TASK_HANDOFF_GIT_COMMIT",e.project.source.ref.commit):e.project.source.ref?.name&&ci(o,"TASK_HANDOFF_GIT_REF",e.project.source.ref.name),e.project.source.clone?.depth&&ci(o,"TASK_HANDOFF_GIT_DEPTH",String(e.project.source.clone.depth)),ci(o,"TASK_HANDOFF_GIT_SUBMODULES",e.project.source.clone?.submodules?"true":"false"),ci(o,"TASK_HANDOFF_GIT_LFS",e.project.source.clone?.lfs?"true":"false"),e.project.source.clone?.subdirectory&&ci(o,"TASK_HANDOFF_WORKSPACE_SUBDIRECTORY",e.project.source.clone.subdirectory));for(const[t,n]of Object.entries(e.image.defaultEnv))ci(o,t,n);for(const[t,n]of Object.entries(e.modelEnv||{}))ci(o,t,n);return o.push(e.image.resolvedReference||e.image.requestedReference),o}(e,t,{publishHost:this.publishHost}))}catch(e){throw ni("RUNTIME_EXECUTOR_FAILED",`Could not create Docker container ${t}.`,e)}return this.runningResult(e,t,i.stdout||void 0)}async runningResult(e,t,n){const i=await this.containerPort(t,"8080/tcp"),r=i?`http://127.0.0.1:${i}`:void 0,s=e.node?.id||"node_unset",o=e.runtime?.id||"runtime_local_docker";return{status:"registering",health:"unknown",connectionStatus:r?"online":"unknown",agentStatus:"unknown",targetStatus:"unknown",uiAccessStatus:"unknown",target:{strategy:"direct-port",status:r?"reachable":"unknown",...r?{web:r,api:`${r}/api`}:{}},workspace:{mode:e.project.workspacePolicy.mode,status:"pending",path:e.project.workspacePolicy.path},runtime:{...e.instance.runtime,kind:"docker",containerName:t,...n?{containerId:n}:{},labels:{...e.instance.runtime.labels,"task-handoff.instance-id":e.instance.id,"task-handoff.project-id":e.project.id,"task-handoff.node-id":s,"task-handoff.runtime-id":o,"task-handoff.image-id":e.image.id}}}}async stop(e){const t=e.instance.runtime.containerName||ai(e.instance.id);try{await this.runCommand("docker",["stop",t])}catch(e){if(!ri(e))throw ni("RUNTIME_EXECUTOR_FAILED",`Could not stop Docker container ${t}.`,e)}return{status:"stopped",health:"unknown",connectionStatus:"offline",target:{...e.instance.target,status:"unknown"},runtime:e.instance.runtime}}async restart(e,t){di(e);const n=e.instance.runtime.containerName||ai(e.instance.id),i=await this.inspectContainerId(n);if(!i)throw ni("INSTANCE_RUNTIME_RESTART_FAILED",`Docker container ${n} does not exist.`);si(n,i,t,"before restart","INSTANCE_RUNTIME_RESTART_FAILED"),await this.runCommand("docker",["restart",n]);const r=await this.inspectContainerId(n);if(!r||r!==i)throw ni("INSTANCE_RUNTIME_RESTART_FAILED",`Docker container identity changed while restarting ${n}.`);return si(n,r,t,"after restart","INSTANCE_RUNTIME_RESTART_FAILED"),this.runningResult(e,n,r)}async delete(e){const t=e.instance.runtime.containerName||ai(e.instance.id);try{await this.runCommand("docker",["rm","-f",t])}catch(e){if(!ri(e))throw ni("RUNTIME_EXECUTOR_FAILED",`Could not delete Docker container ${t}.`,e)}return{status:"stopped",health:"unknown",connectionStatus:"offline",target:{...e.instance.target,status:"unknown"},runtime:e.instance.runtime}}async installRuntime(e){const t=await this.installRuntimeRelease(e);si(e.containerName,t,e.expectedContainerId,"before runtime restart","INSTANCE_RUNTIME_RESTART_FAILED");try{await this.runCommand("docker",["restart",e.containerName])}catch(t){throw ni("INSTANCE_RUNTIME_RESTART_FAILED",`Could not restart Docker container ${e.containerName}.`,t)}const n=await this.inspectContainerId(e.containerName);if(!n||n!==t)throw ni("INSTANCE_RUNTIME_RESTART_FAILED",`Docker container identity changed while updating ${e.containerName}.`);return si(e.containerName,n,e.expectedContainerId,"after runtime restart","INSTANCE_RUNTIME_RESTART_FAILED"),this.inspectRuntimeVersion(e.containerName)}async installRuntimeRelease(e){const t=await this.inspectContainerId(e.containerName);if(!t)throw ni("INSTANCE_RUNTIME_INSTALL_FAILED",`Docker container ${e.containerName} does not exist.`);si(e.containerName,t,e.expectedContainerId,"before runtime install","INSTANCE_RUNTIME_INSTALL_FAILED");const n=`/opt/task-handoff/instance-runtime/incoming/task-handoff-runtime-${i=e.identity.version,i.replace(/[^0-9A-Za-z.+_-]/g,"-")}-${e.identity.sha256.slice(0,12)}.tar.gz`;var i;await this.runCommand("docker",["exec","--user","0",e.containerName,"install","-d","-o","root","-g","root","-m","0755","/opt/task-handoff/instance-runtime/incoming"]),await this.runCommand("docker",["cp",e.artifactPath,`${e.containerName}:${n}`]);try{await this.runCommand("docker",["exec","--user","0",e.containerName,"task-handoff-runtime","install","--artifact",n,"--version",e.identity.version,"--sha256",e.identity.sha256,"--platform",e.identity.platform,"--arch",e.identity.arch,"--launcher-abi",String(e.identity.launcherAbi)])}catch(t){throw ni("INSTANCE_RUNTIME_INSTALL_FAILED",`Could not install controlled-instance ${e.identity.version} in ${e.containerName}.`,t)}finally{await this.runCommand("docker",["exec","--user","0",e.containerName,"rm","-f",n]).catch(()=>({stdout:"",stderr:""}))}const r=await this.inspectContainerId(e.containerName);if(!r||r!==t)throw ni("INSTANCE_RUNTIME_INSTALL_FAILED",`Docker container identity changed while installing ${e.containerName}.`);return si(e.containerName,r,e.expectedContainerId,"after runtime install","INSTANCE_RUNTIME_INSTALL_FAILED"),t}async inspectRuntimeVersion(e){const t=await this.inspectContainerId(e);if(!t)return{};const n=await this.runCommand("docker",["exec","--user","agent",e,"task-handoff-runtime","verify-active"]).catch(()=>{});if(!n?.stdout)return{containerId:t};try{const e=Tt.safeParse(JSON.parse(n.stdout));return e.success?{containerId:t,...e.data}:{containerId:t}}catch{return{containerId:t}}}async inspectRuntimeTarget(e){let t,n;if(e){const i=await this.runCommand("docker",["inspect","--format","{{json .}}",e]).then(e=>JSON.parse(e.stdout.trim()||"{}")).catch(()=>{});if(t=i?.Platform,"string"==typeof i?.Image&&i.Image){const e=await this.runCommand("docker",["image","inspect","--format","{{json .}}",i.Image]).then(e=>JSON.parse(e.stdout.trim()||"{}")).catch(()=>{});t=e?.Os||t,n=e?.Architecture}}if(!t||!n){const e=await this.runCommand("docker",["info","--format","{{json .}}"]).then(e=>JSON.parse(e.stdout.trim()||"{}")).catch(e=>{throw ni("INSTANCE_BASE_RUNTIME_INCOMPATIBLE","Could not inspect the Docker runtime target.",e)});t||=e.OSType,n||=e.Architecture}const i="linux"===(r=t)||"darwin"===r?r:"windows"===r||"win32"===r?"win32":void 0;var r;const s=function(e){return"amd64"===e||"x86_64"===e||"x64"===e?"x64":"arm64"===e||"aarch64"===e?"arm64":void 0}(n);if(!i||!s)throw ni("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Docker reported an unsupported runtime target ${String(t||"unknown")}/${String(n||"unknown")}.`);return{platform:i,arch:s,launcherAbi:1}}async installRuntimeLauncher(e){const t=await this.inspectContainerId(e);if(!t)throw ni("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Docker container ${e} does not exist.`);const i=[[n.join(this.launcherAssetsDir,"entrypoint.sh"),"/root/.task-handoff-entrypoint.bootstrap"],[n.join(this.launcherAssetsDir,"instance-launcher.sh"),"/root/.task-handoff-instance-launcher.bootstrap"],[n.join(this.launcherAssetsDir,"runtime-installer.mjs"),"/root/.task-handoff-runtime-installer.bootstrap"]];for(const[t,n]of i)await this.runCommand("docker",["cp",t,`${e}:${n}`]);try{await this.runCommand("docker",["exec","--user","0",e,"bash","-ceu","install -d -o root -g root -m 0755 /opt/task-handoff/instance-runtime /opt/task-handoff/instance-runtime/releases /opt/task-handoff/instance-runtime/staging /opt/task-handoff/instance-runtime/incoming; chown -R root:root /opt/task-handoff/instance-runtime; chmod -R go-w /opt/task-handoff/instance-runtime; install -m 0755 /root/.task-handoff-entrypoint.bootstrap /usr/local/bin/task-handoff-entrypoint; install -m 0755 /root/.task-handoff-instance-launcher.bootstrap /usr/local/bin/task-handoff-instance-launcher; install -d /usr/local/lib/task-handoff; install -m 0755 /root/.task-handoff-runtime-installer.bootstrap /usr/local/lib/task-handoff/runtime-installer.mjs; ln -sfn /usr/local/lib/task-handoff/runtime-installer.mjs /usr/local/bin/task-handoff-runtime; rm -f /root/.task-handoff-entrypoint.bootstrap /root/.task-handoff-instance-launcher.bootstrap /root/.task-handoff-runtime-installer.bootstrap"])}catch(t){throw ni("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Could not install the runtime launcher in ${e}.`,t)}if(await this.inspectContainerId(e)!==t)throw ni("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Docker container identity changed while installing the runtime launcher in ${e}.`)}async inspectContainerId(e){try{return(await this.runCommand("docker",["inspect","--format","{{.Id}}",e])).stdout.trim()||void 0}catch(t){if(ri(t))return;throw ni("RUNTIME_EXECUTOR_FAILED",`Could not inspect Docker container ${e}.`,t)}}async inspectContainerForStart(e){let t;try{t=await this.runCommand("docker",["inspect","--format","{{json .}}",e])}catch(t){if(ri(t))return;throw ni("RUNTIME_EXECUTOR_FAILED",`Could not inspect Docker container ${e}.`,t)}try{const e=JSON.parse(t.stdout||"{}");if("string"!=typeof e.Id||!e.Id)throw new Error("Docker inspect did not return a container id.");const n=e.Config?.Labels&&"object"==typeof e.Config.Labels&&!Array.isArray(e.Config.Labels)?Object.fromEntries(Object.entries(e.Config.Labels).filter(e=>"string"==typeof e[1])):{};return{id:e.Id,labels:n}}catch(t){throw ni("RUNTIME_EXECUTOR_FAILED",`Docker returned invalid inspection data for ${e}.`,t)}}async containerPort(e,t){let n,i=!1;for(const r of this.portResolutionRetryDelaysMs){r>0&&await ti(r);try{const n=Zn((await this.runCommand("docker",["port",e,t])).stdout);if(n)return n}catch(e){n=e}try{const n=ei((await this.runCommand("docker",["inspect","--format","{{json .NetworkSettings.Ports}}",e])).stdout,t);if(i=!0,n)return n}catch(e){n=e}}if(i)throw ni("RUNTIME_EXECUTOR_FAILED",`Docker container ${e} does not publish ${t}.`);throw ni("RUNTIME_EXECUTOR_FAILED",`Could not resolve the published port for Docker container ${e}.`,n)}}function Zn(e){const t=e.split(/\r?\n/).find(Boolean);return t?.match(/:(\d+)$/)?.[1]}function ei(e,t){const n=JSON.parse(e||"null");if(!n||"object"!=typeof n||Array.isArray(n))return;const i=n[t];if(Array.isArray(i))for(const e of i){if(!e||"object"!=typeof e||Array.isArray(e))continue;const t=e.HostPort;if("string"==typeof t&&/^\d+$/.test(t))return t}}function ti(e){return new Promise(t=>setTimeout(t,e))}function ni(e,t,n){const i=ii(n),r=new Error(i?`${t} Cause: ${i}`:t,void 0===n?void 0:{cause:n});return Object.assign(r,{statusCode:502,code:e}),r}function ii(e){if(!e||"object"!=typeof e)return void 0===e?void 0:String(e);const t=e,n=t.details?.stderr||t.details?.stdout;return"string"==typeof n&&n.trim()?n.trim():"string"==typeof t.message&&t.message.trim()?t.message.trim():void 0}function ri(e){const t=ii(e)?.toLowerCase()||"";return t.includes("no such container")||t.includes("no such object")}function si(e,t,n,i,r){if(n&&t!==n)throw ni(r,`Docker container ${e} identity mismatch ${i}: expected ${n}, got ${t}.`)}async function oi(e=Jn){return async function(e=Jn){return(await e("docker",["images","--digests","--format","{{json .}}"])).stdout.split(/\r?\n/).map(e=>e.trim()).filter(Boolean).map(e=>{const t=JSON.parse(e),n=t.Repository||"<none>",i=t.Tag||"<none>",r=t.ID||t.IDShort||"",s="<none>"!==n&&"<none>"!==i?`${n}:${i}`:r,o="<none>"!==n&&t.Digest&&"<none>"!==t.Digest?[`${n}@${t.Digest}`]:[];return{repository:n,tag:i,id:r,createdSince:t.CreatedSince,size:t.Size,sizeBytes:Xn(t.Size),reference:s,repoDigests:o}}).filter(e=>Boolean(e.reference))}(e)}function ai(e){return`task-handoff-${e.replace(/[^a-zA-Z0-9_.-]/g,"-")}`}function ci(e,t,n){e.push("-e",`${t}=${n}`)}function di(e){if("local-folder"===e.project.source.type&&e.project.source.ownerNodeId&&e.project.source.ownerNodeId!==e.node.id){const e=new Error("Local folder projects can only start on the node that owns the folder.");throw Object.assign(e,{statusCode:400,code:"LOCAL_FOLDER_REQUIRES_OWNER_NODE"}),e}if(!e.image.requestedReference?.trim()){const e=new Error("Image profile must reference a registered image.");throw Object.assign(e,{statusCode:400,code:"IMAGE_PROFILE_INVALID"}),e}}const li=a.z.enum(["created","starting","running","stopping","stopped","exited","failed","closed","terminated","unknown"]),ui=a.z.object({type:a.z.enum(["app-session","provider-session","adapter-key"]),id:a.z.string().trim().min(1).max(240),agent:a.z.string().trim().min(1).max(80).optional(),adapter:a.z.string().trim().min(1).max(80).optional(),key:a.z.string().trim().min(1).max(240).optional()}).strict(),pi=a.z.record(a.z.string(),a.z.unknown()).and(a.z.object({id:a.z.string().trim().min(1).max(160),appId:a.z.string().trim().min(1).max(160).optional(),title:a.z.string().trim().max(240).optional(),kind:a.z.string().trim().max(80).optional(),status:li.default("unknown"),bindings:a.z.array(ui).max(40).default([]),workspace:a.z.object({cwd:a.z.string().trim().max(4096).optional()}).strict().optional(),createdAt:a.z.string().datetime().optional(),updatedAt:a.z.string().datetime().optional()})),mi=a.z.object({runningCount:a.z.number().int().min(0).default(0),problemCount:a.z.number().int().min(0).default(0),sessions:a.z.array(pi).default([]),updatedAt:a.z.string().datetime()}).strict();a.z.object({streamId:a.z.string().trim().min(1).max(240),revision:a.z.number().int().min(0),lastEventAt:a.z.string().datetime(),snapshot:mi}).strict(),mi.pick({runningCount:!0,problemCount:!0,updatedAt:!0}).extend({revision:a.z.number().int().min(0).optional()});const gi=a.z.enum(["app-session-created","app-session-updated","app-session-deleted","app-session-recovered","control-action","heartbeat-sync","startup"]),hi=a.z.object({streamId:a.z.string().trim().min(1).max(240),instanceId:a.z.string().trim().min(1).max(160),nodeId:a.z.string().trim().min(1).max(160).optional(),revision:a.z.number().int().min(0),previousRevision:a.z.number().int().min(0).optional(),traceId:a.z.string().trim().min(1).max(160),generatedAt:a.z.string().datetime(),reason:gi}).strict(),fi=a.z.object({meta:hi,snapshot:mi}).strict(),yi=a.z.object({meta:hi,session:pi}).strict(),Ii=a.z.object({meta:hi,sessionId:a.z.string().trim().min(1).max(160),tombstone:pi.optional(),expiresAt:a.z.string().datetime().optional()}).strict();function Ai(e){return e.startsWith("ai-session.")||e.startsWith("ai.session.")?"ai.sessions":e.startsWith("app-session.")?"app.sessions":e.startsWith("app.management")?"apps":e.startsWith("trigger.")?"triggers":e.startsWith("instance.")?"instances":e.startsWith("node.")?"nodes":e.startsWith("project.")?"projects":e.startsWith("model.")?"models":e.startsWith("image.")?"images":e.startsWith("market.")?"market":"system"}a.z.object({streamId:a.z.string().trim().min(1).max(240),instanceId:a.z.string().trim().min(1).max(160),sinceRevision:a.z.number().int().min(0),latestRevision:a.z.number().int().min(0),earliestRetainedRevision:a.z.number().int().min(0),syncRequired:a.z.boolean().default(!1),events:a.z.array(a.z.discriminatedUnion("type",[a.z.object({type:a.z.literal("app-session.snapshot"),payload:fi}).strict(),a.z.object({type:a.z.literal("app-session.patch"),payload:yi}).strict(),a.z.object({type:a.z.literal("app-session.removed"),payload:Ii}).strict()])).default([])}).strict();const bi=a.z.enum(["ai.sessions","app.sessions"]),wi=a.z.object({topic:bi,instanceId:a.z.string().trim().min(1).max(160),streamId:a.z.string().trim().min(1).max(240),latestRevision:a.z.number().int().min(0),earliestRetainedRevision:a.z.number().int().min(0)}).strict(),vi=a.z.object({protocolVersion:a.z.literal(1),streams:a.z.array(wi)}).strict();class Ei{attempt=0;timer;get pending(){return Boolean(this.timer)}get attempts(){return this.attempt}schedule(e,t={}){if(this.timer)return;const n=function(e,t=Math.random){const n=Math.min(3e4,1e3*2**Math.max(0,e));return Math.min(3e4,Math.round(n*(.75+.5*t())))}(this.attempt,t.random);this.attempt+=1;const i=t.setTimeoutFn||setTimeout;return this.timer=i(()=>{this.timer=void 0,e()},n),{attempt:this.attempt,delay:n}}reset(e=clearTimeout){this.timer&&e(this.timer),this.timer=void 0,this.attempt=0}cancel(e=clearTimeout){this.timer&&e(this.timer),this.timer=void 0}}function Ni(e,t=6e4){const n=[];for(let i=0;i<e.length;i+=t)n.push(e.slice(i,i+t));return n}class zi{sockets=new Map;socketUrls=new Map;retries=new Map;outputs=new Set;imagePullTerminalByInstance=new Map;state;token;logger;safetyIntervalMs;lastAiSessionEventByInstance=new Map;lastAppSessionEventByInstance=new Map;timer;reconnectAttempts=0;safetyReconciliations=0;localSequence=0;createSocket;setIntervalFn;clearIntervalFn;constructor(e,t,n={}){var i;this.state=e,this.token=t,this.logger=n.logger,this.safetyIntervalMs=(i=n.safetyIntervalMs,Math.min(6e4,Math.max(3e4,i??45e3))),this.createSocket=n.createSocket||((e,t)=>new u(e,t)),this.setIntervalFn=n.setIntervalFn||setInterval,this.clearIntervalFn=n.clearIntervalFn||clearInterval}start(){this.sync(),this.timer=this.setIntervalFn(()=>{this.safetyReconciliations+=1,this.sync()},this.safetyIntervalMs)}stop(){this.timer&&(this.clearIntervalFn(this.timer),this.timer=void 0);for(const e of this.sockets.values())e.close();this.sockets.clear(),this.socketUrls.clear();for(const e of this.retries.values())e.timer.cancel();this.retries.clear(),this.outputs.clear()}addOutput(e){this.outputs.add(e),e.on("close",()=>this.outputs.delete(e)),e.on("error",()=>this.outputs.delete(e));for(const t of this.state.listInstances()){const n=Si(t);n?this.sendForwarded(e,this.createEvent(Ln,n,{instanceId:t.id})):this.logger?.warn?.({instanceId:t.id},"instance.lifecycle.snapshot.invalid")}for(const[t,n]of this.imagePullTerminalByInstance)Ni(n.tail).forEach((i,r)=>this.sendForwarded(e,this.createEvent(In,{...n.output,sequence:n.output.sequence+r,data:i,...0===r?{replay:!0}:{}},{instanceId:t}))),n.finished&&this.sendForwarded(e,this.createEvent(An,n.finished,{instanceId:t}));return this.syncNow(),()=>{this.outputs.delete(e)}}publish(e,t,n={}){this.rememberImagePullTerminal(e,t);const i=this.createEvent(e,t,n);for(const e of this.outputs)this.sendForwarded(e,i)}rememberImagePullTerminal(e,t){if(e===In){const e=wn.safeParse(t);if(!e.success)return;const n=e.data,i=this.imagePullTerminalByInstance.get(n.instanceId);if(i&&n.generation<i.output.generation)return;const r=i?.output.generation===n.generation,s=n.replay||!r?n.data:`${i.tail}${n.data}`.slice(-262144);return void this.imagePullTerminalByInstance.set(n.instanceId,{output:n,tail:s})}if(e===An){const e=vn.safeParse(t);if(!e.success)return;const n=e.data,i=this.imagePullTerminalByInstance.get(n.instanceId);i?.output.generation===n.generation&&(i.finished=n)}}publishInstanceLifecycle(e){this.publish(Ln,function(e){return $n.parse(_i(e))}(e),{instanceId:e.id});const t=this.imagePullTerminalByInstance.get(e.id);"ready"===e.imageProvisioning?.phase&&"succeeded"===t?.finished?.outcome&&this.imagePullTerminalByInstance.delete(e.id)}createEvent(e,t,n){const i=++this.localSequence;return{v:1,id:`node_evt_${Date.now().toString(36)}_${i.toString(36)}`,seq:i,type:e,topic:Ai(e),createdAt:(new Date).toISOString(),payload:t,scope:n}}sendForwarded(e,t){const n=JSON.stringify({type:"node-agent.event.forwarded",event:t});e.readyState===u.OPEN&&e.send(n)}syncNow(){this.sync()}diagnostics(){return{reconnectAttempts:this.reconnectAttempts,safetyReconciliations:this.safetyReconciliations,activeConnections:this.sockets.size,pendingRetries:[...this.retries.values()].filter(e=>e.timer.pending).length,safetyIntervalMs:this.safetyIntervalMs}}sync(){const e=new Set(this.state.listInstances().map(e=>e.id));for(const t of this.imagePullTerminalByInstance.keys())e.has(t)||this.imagePullTerminalByInstance.delete(t);if(!this.outputs.size){for(const e of this.sockets.values())e.close();this.sockets.clear(),this.socketUrls.clear();for(const e of this.retries.values())e.timer.cancel();return void this.retries.clear()}const t=new Set;for(const e of this.state.listInstances()){const n=ki(e);if(!n)continue;t.add(e.id);const i=this.retries.get(e.id);i?.timer.pending&&i.url!==n&&(i.timer.cancel(),this.retries.delete(e.id)),this.socketUrls.get(e.id)!==n&&this.sockets.has(e.id)&&(this.sockets.get(e.id)?.close(),this.sockets.delete(e.id)),this.sockets.has(e.id)||this.retries.get(e.id)?.timer.pending||this.connect(e.id,n)}for(const[e,n]of this.sockets)if(!t.has(e)){n.close(),this.sockets.delete(e),this.socketUrls.delete(e);const t=this.retries.get(e);t?.timer.cancel(),this.retries.delete(e)}for(const[e,n]of this.retries)t.has(e)||(n.timer.cancel(),this.retries.delete(e),this.socketUrls.delete(e))}connect(e,t){const n=this.token?{authorization:`Bearer ${this.token}`}:void 0,i=this.createSocket(t,{headers:n});this.sockets.set(e,i),this.socketUrls.set(e,t),i.on("open",()=>{const n=this.retries.get(e);n?.timer.reset(),this.retries.set(e,{timer:n?.timer||new Ei,url:t}),i.readyState===u.OPEN&&(i.send(JSON.stringify({v:1,type:"subscribe",topics:[z,"app.sessions","apps","instances"]})),this.logger?.info?.({instanceId:e,url:t},"ai-session.event.forward.connect"),this.logger?.info?.({instanceId:e,url:t},"app-session.event.forward.connect"))}),i.on("message",t=>{const n=function(e,t){try{const n=JSON.parse(String(e));if(!n||"object"!=typeof n||Array.isArray(n))return;const i=n,r="string"==typeof i.type?i.type:"";if(!r||"events.connected"===r)return;const s=i.scope&&"object"==typeof i.scope&&!Array.isArray(i.scope)?i.scope:{};return{v:1,id:"string"==typeof i.id?i.id:`evt_${Date.now().toString(36)}`,seq:Number(i.seq)||0,type:r,topic:"string"==typeof i.topic?i.topic:Ai(r),createdAt:"string"==typeof i.createdAt?i.createdAt:(new Date).toISOString(),payload:"payload"in i?i.payload:{},scope:{...s,instanceId:t}}}catch{return}}(t,e);if(!n)return;if("streams.hello"===n.type){const t=vi.safeParse(n.payload);if(!t.success)return this.logger?.warn?.({instanceId:e,issues:t.error.issues},"session-stream.handshake.invalid"),void i.close(1002,"Incompatible session stream handshake.");const r=JSON.stringify({type:"node-agent.streams.hello",instanceId:e,payload:t.data});for(const e of this.outputs)e.readyState===u.OPEN&&e.send(r);return}this.recordAiSessionEvent(e,n),this.recordAppSessionEvent(e,n);const r=JSON.stringify({type:"node-agent.event.forwarded",event:n});for(const e of this.outputs)e.readyState===u.OPEN&&e.send(r)}),i.on("close",()=>{this.sockets.get(e)===i&&(this.sockets.delete(e),this.socketUrls.delete(e),this.scheduleReconnect(e))}),i.on("error",()=>{this.logger?.warn?.({instanceId:e,url:t},"ai-session.event.forward.error"),this.logger?.warn?.({instanceId:e,url:t},"app-session.event.forward.error"),i.close()})}scheduleReconnect(e){const t=this.state.listInstances().find(t=>t.id===e),n=t&&ki(t);if(!n||!this.outputs.size)return;const i=this.retries.get(e)??{timer:new Ei};if(i.timer.pending)return;i.url=n;const r=i.timer.schedule(()=>{this.sockets.has(e)||this.connect(e,n)});r&&(this.reconnectAttempts+=1,this.logger?.info?.({instanceId:e,url:n,attempt:r.attempt,delay:r.delay,reconnectAttempts:this.reconnectAttempts},"session-stream.connection.reconnect-scheduled")),this.retries.set(e,i)}recordAiSessionEvent(e,t){if(t.topic!==z)return;if("ai-session.message-delta"===t.type)return;const n=Ti(t.payload),i=this.lastAiSessionEventByInstance.get(e);i?.streamId===n.streamId&&void 0!==i.revision&&void 0!==n.revision&&n.revision>i.revision+1&&this.logger?.warn?.({instanceId:e,traceId:n.traceId,streamId:n.streamId,previousRevision:i.revision,revision:n.revision},"ai-session.event.forward.gap"),this.lastAiSessionEventByInstance.set(e,{streamId:n.streamId??i?.streamId,revision:n.revision??i?.revision}),this.logger?.info?.({instanceId:e,traceId:n.traceId,eventType:t.type,streamId:n.streamId,revision:n.revision},"ai-session.event.forward.message")}recordAppSessionEvent(e,t){if("app.sessions"!==t.topic)return;const n=Ti(t.payload),i=this.lastAppSessionEventByInstance.get(e);i?.streamId===n.streamId&&void 0!==i.revision&&void 0!==n.revision&&n.revision>i.revision+1&&this.logger?.warn?.({instanceId:e,traceId:n.traceId,streamId:n.streamId,previousRevision:i.revision,revision:n.revision},"app-session.event.forward.gap"),this.lastAppSessionEventByInstance.set(e,{streamId:n.streamId??i?.streamId,revision:n.revision??i?.revision}),this.logger?.info?.({instanceId:e,traceId:n.traceId,eventType:t.type,streamId:n.streamId,revision:n.revision},"app-session.event.forward.message")}}function Si(e){const t=$n.safeParse(_i(e));return t.success?t.data:void 0}function _i(e){return{instanceId:e.id,revision:e.stateRevision,updatedAt:e.updatedAt,status:e.status,health:e.health,connectionStatus:e.connectionStatus,accessStatus:"online"===e.connectionStatus||"online"===e.agentStatus?"reachable":"endpoint-unreachable",imageProvisioning:e.imageProvisioning,workspace:e.workspace,runtime:e.runtime,runtimeVersion:e.runtimeVersion,ready:e.ready,lastHeartbeatAt:e.lastHeartbeatAt}}function Ti(e){const t=e&&"object"==typeof e&&!Array.isArray(e)?e:{},n=t.meta&&"object"==typeof t.meta&&!Array.isArray(t.meta)?t.meta:{};return{streamId:"string"==typeof n.streamId?n.streamId:void 0,revision:"number"==typeof n.revision?n.revision:void 0,traceId:"string"==typeof n.traceId?n.traceId:void 0}}function ki(e){if(!function(e){return!1!==e.ready&&(!e.runtimeVersion||["matched","failed"].includes(e.runtimeVersion.phase))}(e))return;const t=e.target?.api||e.target?.web;if(t)try{const e=new URL("/api/events",t);return e.protocol="https:"===e.protocol?"wss:":"ws:",e.toString()}catch{return}}const Ci=new Set(["provisioning","starting","registering","registered","running","unhealthy"]),xi=JSON.stringify({id:"{{.ID}}",name:"{{.Name}}",cpu:"{{.CPUPerc}}",memory:"{{.MemUsage}}",memoryPercent:"{{.MemPerc}}",network:"{{.NetIO}}",blockIo:"{{.BlockIO}}",pids:"{{.PIDs}}"});class Oi{snapshots=new Map;runCommand;targets;publish;intervalMs;timer;inFlight;pendingTargets=new Map;collectingTargets=new Map;constructor(e,t,n,i=3e3){this.runCommand=e,this.targets=t,this.publish=n,this.intervalMs=i}start(){this.collect().catch(()=>{}),this.timer=setInterval(()=>{this.collect().catch(()=>{})},this.intervalMs)}stop(){this.timer&&clearInterval(this.timer),this.timer=void 0}async snapshot(e){const t=this.targets().find(t=>t.id===e);if(!t)return;if(!Ci.has(t.status))return Li(t.id);const n=this.snapshots.get(e);return n&&Date.now()-Date.parse(n.sampledAt)<=this.intervalMs?n:(await this.collect([t]),this.snapshots.get(e))}async collect(e){const t=e||this.targets();if(!e){const e=new Set(t.map(e=>e.id));for(const t of this.snapshots.keys())e.has(t)||this.snapshots.delete(t)}for(const e of t){const t=Ri(e);this.collectingTargets.get(e.id)!==t&&this.pendingTargets.set(e.id,e)}this.inFlight||(this.inFlight=this.drain().finally(()=>{this.inFlight=void 0})),await this.inFlight}async drain(){for(;this.pendingTargets.size;){const e=[...this.pendingTargets.values()];this.pendingTargets.clear();for(const t of e)this.collectingTargets.set(t.id,Ri(t));try{await this.collectOnce(e)}finally{for(const t of e)this.collectingTargets.delete(t.id)}}}async collectOnce(e){const t=e.filter(e=>Ci.has(e.status)&&(e.runtime.containerId||e.runtime.containerName));for(const t of e.filter(e=>Ci.has(e.status)&&!e.runtime.containerId&&!e.runtime.containerName))this.update($i(t.id));for(const t of e.filter(e=>!Ci.has(e.status)))this.update(Li(t.id));if(!t.length)return;const n=t.map(e=>e.runtime.containerId||e.runtime.containerName),i=(new Date).toISOString();try{const e=await this.runCommand("docker",["stats","--no-stream","--format",xi,...n],{timeoutMs:5e3});this.applyDockerOutput(t,e.stdout,i)}catch(e){if(1===t.length)return void this.update(Fi(t[0].id,i,e instanceof Error?e.message:String(e)));await Promise.all(t.map(async e=>{const t=e.runtime.containerId||e.runtime.containerName;try{const n=await this.runCommand("docker",["stats","--no-stream","--format",xi,t],{timeoutMs:5e3});this.applyDockerOutput([e],n.stdout,i)}catch(t){this.update(Fi(e.id,i,t instanceof Error?t.message:String(t)))}}))}}applyDockerOutput(e,t,n){const i=function(e,t=(new Date).toISOString()){const n=new Map;for(const i of e.split(/\r?\n/).filter(Boolean)){let e;try{e=JSON.parse(i)}catch{continue}const r=Mi(e.id),s=Mi(e.name),o=r||s;if(!o)continue;const a=Di(Mi(e.memory)),c=Di(Mi(e.network)),d=Di(Mi(e.blockIo)),l=_n.parse({instanceId:o,runtimeKind:"docker",state:"available",sampledAt:t,cpu:Pi(e.cpu,"usagePercent"),memory:a?{usageBytes:a[0],...void 0!==a[1]?{limitBytes:a[1]}:{},...Pi(e.memoryPercent,"usagePercent")}:void 0,network:c?{rxBytes:c[0],txBytes:c[1]||0}:void 0,blockIo:d?{readBytes:d[0],writeBytes:d[1]||0}:void 0,pids:ji(e.pids)});r&&n.set(r,l),s&&n.set(s,l)}return n}(t,n);for(const t of e){const e=[t.runtime.containerId,t.runtime.containerName].filter(Boolean),r=[...i.entries()].find(([t])=>e.some(e=>e===t||e.startsWith(t)||t.startsWith(e)))?.[1];this.update(r?{...r,instanceId:t.id}:Fi(t.id,n,"Container metrics were not returned by Docker."))}}update(e){const t=_n.parse(e);this.snapshots.set(t.instanceId,t),this.publish?.(t)}}function Ri(e){return[e.status,e.runtime.containerId||"",e.runtime.containerName||""].join("\0")}function Di(e){if(!e)return;const[t,n]=e.split("/").map(e=>function(e){const t=e.trim().match(/^([0-9]+(?:\.[0-9]+)?)\s*([kmgtpe]?i?b)$/i);if(!t)return;const n=Number(t[1]),i=t[2].toLowerCase(),r=i.includes("i"),s="b"===i[0]?"":i[0],o=s?"kmgtpe".indexOf(s)+1:0;return Math.round(n*(r?1024:1e3)**o)}(e||""));return void 0===t?void 0:[t,n]}function Pi(e,t){const n=Number(Mi(e).replace(/%$/,""));return Number.isFinite(n)&&n>=0?{[t]:n}:void 0}function ji(e){const t=Number(Mi(e));return Number.isFinite(t)&&t>=0?t:void 0}function Mi(e){return"string"==typeof e||"number"==typeof e?String(e).trim():""}function Li(e){return{instanceId:e,runtimeKind:"docker",state:"stopped",sampledAt:(new Date).toISOString()}}function $i(e){return{instanceId:e,runtimeKind:"docker",state:"pending",sampledAt:(new Date).toISOString()}}function Fi(e,t,n){return{instanceId:e,runtimeKind:"docker",state:"unavailable",sampledAt:t,error:n.slice(0,2048)}}function Ui(e){try{return t.statSync(e).isDirectory()}catch{return!1}}function Vi(e,i){let r;try{r=t.statSync(e)}catch{return}if(!r.isDirectory())return;const s=n.resolve(e),o=n.basename(s)||s;let a=[];try{a=i>0?t.readdirSync(s,{withFileTypes:!0}):[]}catch{a=[]}const c=i>0?a.filter(e=>e.isDirectory()||e.isSymbolicLink()&&Ui(n.join(s,e.name))).sort((e,t)=>e.name.localeCompare(t.name)).slice(0,80).flatMap(e=>{const t=Vi(n.join(s,e.name),i-1);return t?[t]:[]}):[];return{name:o,path:s,children:c}}function qi(e){return(e.path?[e.path]:function(){if("win32"!==process.platform)return[n.parse(n.resolve(process.cwd())).root];const e=n.parse(n.resolve(process.cwd())).root,t=Array.from({length:26},(e,t)=>`${String.fromCharCode(65+t)}:\\`);return[...new Set([e,...t])].filter(Ui)}()).flatMap(t=>{const n=Vi(t,e.depth);return n?[n]:[]})}function Hi(){return process.env.TASK_HANDOFF_NODE_AGENT_DATA_DIR||n.join(p.homedir(),".config","task-handoff","node-agent")}function Bi(e=Hi()){const t=n.resolve(e);return{dataDir:t,identityPath:n.join(t,"identity.json"),settingsPath:n.join(t,"runtime-settings.json"),localFoldersDir:n.join(t,"local-folders"),nodeRuntimesDir:n.join(t,"node-runtimes"),controlledInstancesDir:n.join(t,"controlled-instances"),nodeModelsDir:n.join(t,"models"),modelAssignmentsDir:n.join(t,"model-assignments"),modelEnvironmentsDir:n.join(t,"model-environments"),updatesDir:n.join(t,"updates"),logsDir:n.join(t,"logs")}}class Ki extends Error{code;lockPath;owner;constructor(e,t,n={}){const i=t?.pid?` pid ${t.pid}`:"";super(`${n.label||"Process"} is already running${i}. Lock: ${e}`),this.name="ProcessSingletonError",this.code=n.code||"PROCESS_ALREADY_RUNNING",this.lockPath=e,this.owner=t}}function Gi(e){return n.join(e,"owner.json")}function Ji(e){return n.join(e,"initializing.json")}function Wi(e){return n.join(e,"recovering.json")}function Yi(e){return Number.isInteger(e)&&Number(e)>0}function Xi(e,n=process.platform){if(Yi(e)){if("linux"===n)try{const n=t.readFileSync(`/proc/${e}/stat`,"utf8"),i=n.lastIndexOf(")");if(i<0)return;const r=n.slice(i+2).trim().split(/\s+/)[19];return r?`linux:${r}`:void 0}catch{return}if(["darwin","freebsd","openbsd","aix","sunos"].includes(n)){const t=d.spawnSync("ps",["-o","lstart=","-p",String(e)],{encoding:"utf8",timeout:1e3}),i=0===t.status?t.stdout.trim().replace(/\s+/g," "):"";return i?`${n}:${i}`:void 0}if("win32"===n){const t=`(Get-Process -Id ${e} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`,n=d.spawnSync("powershell.exe",["-NoProfile","-NonInteractive","-Command",t],{encoding:"utf8",timeout:2e3}),i=0===n.status?n.stdout.trim():"";return/^\d+$/.test(i)?`win32:${i}`:void 0}}}function Qi(e){try{const n=JSON.parse(t.readFileSync(Gi(e),"utf8"));if(Yi(n.pid)&&"string"==typeof n.startTime){const e=n;return{pid:e.pid,hostname:"string"==typeof e.hostname&&e.hostname?e.hostname:p.hostname(),component:e.component||"server-update",command:"string"==typeof e.command?e.command:"",acquiredAt:"string"==typeof e.createdAt&&Number.isFinite(Date.parse(e.createdAt))?e.createdAt:new Date(0).toISOString(),token:"string"==typeof e.token&&e.token?e.token:`legacy:${e.pid}:${e.startTime}`,startIdentity:e.startTime.startsWith("linux:")?e.startTime:`linux:${e.startTime}`}}if(!(Yi(n.pid)&&"string"==typeof n.hostname&&n.hostname&&"string"==typeof n.command&&"string"==typeof n.acquiredAt&&Number.isFinite(Date.parse(n.acquiredAt))&&"string"==typeof n.token&&n.token))return;return n}catch{return}}const Zi=Qi;function er(e){if(!Yi(e))return!1;try{return process.kill(Number(e),0),!0}catch(e){return"EPERM"===e.code}}function tr(e){if(!e||!er(e.pid))return!1;if(!e.startIdentity)return!0;const t=Xi(e.pid);return void 0===t||t===e.startIdentity}function nr(e,i){const r=n.join(e,`.owner-${i.token}.tmp`);t.writeFileSync(r,`${JSON.stringify(i,null,2)}\n`,{encoding:"utf8",mode:384,flag:"wx"});const s=ir(e);if(s?.token!==i.token)throw sr(r),new Error(`Process lock initialization was superseded: ${e}`);t.renameSync(r,Gi(e)),sr(Ji(e))}function ir(e){try{return JSON.parse(t.readFileSync(Ji(e),"utf8"))}catch{return}}function rr(e){const t=ir(e);return Yi(t?.pid)&&tr({pid:t.pid,startIdentity:t.startIdentity})}function sr(e){try{t.unlinkSync(e)}catch(e){if("ENOENT"!==e.code)throw e}}function or(){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,20)}function ar(e){try{const n=ir(e),i=Date.parse(n?.startedAt||"");return Number.isFinite(i)?Math.max(0,Date.now()-i):Math.max(0,Date.now()-t.statSync(e).mtimeMs)}catch{return 0}}function cr(e,i){try{return t.writeFileSync(Wi(e),`${JSON.stringify({token:i,pid:process.pid,startedAt:(new Date).toISOString()})}\n`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(r){if("EEXIST"===r.code)return!!function(e){const i=Wi(e),r=dr(i),s=Date.parse(r?.startedAt||"");if(er(r?.pid)||Number.isFinite(s)&&Date.now()-s<2e3)return!1;const o=n.join(e,`.recovering-${c.randomUUID()}.stale`);try{t.renameSync(i,o)}catch(e){if(["ENOENT","EEXIST"].includes(e.code||""))return!1;throw e}const a=dr(o);if(a?.token===r?.token)return sr(o),!0;try{t.linkSync(o,i)}catch(e){if("EEXIST"!==e.code)throw e}finally{sr(o)}return!1}(e)&&cr(e,i);if("ENOENT"===r.code)return!1;throw r}}function dr(e){try{return JSON.parse(t.readFileSync(e,"utf8"))}catch{return}}function lr(e,t){return dr(Wi(e))?.token===t}function ur(e,t=process.platform){const i=n.resolve(e),r=c.createHash("sha256").update(i).digest("hex").slice(0,16);return"win32"===t?`\\\\.\\pipe\\task-handoff-node-agent-${r}`:n.join("/tmp",`task-handoff-node-agent-${process.getuid?.()??"user"}`,`${r}.sock`)}const pr="runtime-manifest.json";class mr extends Error{code;retryable;constructor(e,t,n){super(t,void 0===n?.cause?void 0:{cause:n.cause}),this.name="RuntimeArtifactError",this.code=e,this.retryable=n?.retryable??!1}}async function gr(e,t=""){const i=[],r=await h.readdir(n.join(e,t),{withFileTypes:!0});for(const s of r){const r=t?n.posix.join(t,s.name):s.name;if(!t&&r===pr)continue;const o=n.join(e,...r.split("/"));if(s.isDirectory()){i.push(...await gr(e,r));continue}if(s.isSymbolicLink()){const t=await h.readlink(o);if(n.isAbsolute(t))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload symlink is absolute: ${r}`);const s=n.resolve(n.dirname(o),t),a=n.relative(n.resolve(e),s);if(!a||".."===a||a.startsWith(`..${n.sep}`)||n.isAbsolute(a))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload symlink escapes the artifact: ${r}`);if(!await h.lstat(s).catch(()=>{}))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload symlink is broken: ${r}`);i.push({absolutePath:o,relativePath:r,kind:"symlink",target:t,size:Buffer.byteLength(t)});continue}if(!s.isFile())throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload contains unsupported entry: ${r}`);const a=await h.lstat(o);i.push({absolutePath:o,relativePath:r,kind:"file",size:a.size})}return i}async function hr(e){const n=(await gr(e)).sort((e,t)=>function(e,t){return Buffer.compare(Buffer.from(e,"utf8"),Buffer.from(t,"utf8"))}(e.relativePath,t.relativePath)),i=c.createHash("sha256");for(const e of n){if(i.update("file"===e.kind?"F":"L","ascii"),i.update(Buffer.from(e.relativePath,"utf8")),i.update(Buffer.from([0])),i.update(Buffer.from(String(e.size),"ascii")),i.update(Buffer.from([0])),"file"===e.kind)for await(const n of t.createReadStream(e.absolutePath))i.update(n);else i.update(Buffer.from(e.target,"utf8"));i.update(Buffer.from([0]))}return i.digest("hex")}function fr(e){for(const[t,n]of[["version",e.version],["platform",e.platform],["arch",e.arch]])if(!/^[0-9A-Za-z._-]+$/.test(n))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Invalid runtime artifact ${t}: ${n}`);return`${e.version}-${e.platform}-${e.arch}`}function yr(e,t){return`${fr(e)}-${e.sha256}-${t}`}async function Ir(e){const n=c.createHash("sha256");for await(const i of t.createReadStream(e))n.update(i);return n.digest("hex")}class Ar{#e;#t;#n=new Map;constructor(e){this.#e=e.cacheDir,this.#t=e.fetchImpl??fetch}resolve(e,t){const n=Tt.parse(e);if(!/^[a-f0-9]{64}$/.test(t.archiveSha256))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID","Runtime archive SHA-256 is invalid.");if((t.archiveUrl?1:0)+(t.archivePath?1:0)!=1)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID","Runtime artifact source must specify exactly one archive location.");const i=yr(n,t.archiveSha256),r=this.#n.get(i);if(r)return r;const s=this.#i(n,t).finally(()=>this.#n.delete(i));return this.#n.set(i,s),s}async#i(e,i){if(!/^[a-f0-9]{64}$/.test(i.archiveSha256))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID","Runtime archive SHA-256 is invalid.");const r=yr(e,i.archiveSha256),s=n.join(this.#e,"archives"),o=n.join(s,`${r}.tar.gz`);if(await h.mkdir(s,{recursive:!0}),await this.#r(o,e,i.archiveSha256))return{identity:e,archivePath:o,cacheHit:!0};await h.rm(o,{force:!0});const a=n.join(s,`.${r}.${c.randomUUID()}.part`);try{const n=await h.open(a,"wx");if(i.archivePath)await f.pipeline(t.createReadStream(i.archivePath),n.createWriteStream());else{const e=await this.#t(i.archiveUrl);if(!e.ok||!e.body)throw await n.close(),new mr("INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE",`Runtime artifact download failed with HTTP ${e.status}.`,{retryable:e.status>=500});await f.pipeline(e.body,n.createWriteStream())}if(await Ir(a)!==i.archiveSha256)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID","Downloaded runtime archive SHA-256 does not match release metadata.");return await this.#s(a,e),await h.rename(a,o),{identity:e,archivePath:o,cacheHit:!1}}catch(e){if(e instanceof mr)throw e;throw new mr("INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE","Could not download runtime artifact.",{cause:e,retryable:!0})}finally{await h.rm(a,{force:!0})}}async#r(e,t,n){try{return await Ir(e)===n&&(await this.#s(e,t),!0)}catch{return!1}}async#s(e,t){const i=n.join(this.#e,"validation",`${fr(t)}-${c.randomUUID()}`);try{await async function(e,t){await h.mkdir(t,{recursive:!0});try{await y.extract({file:e,cwd:t,strict:!0,preservePaths:!1,filter:(e,t)=>{const i=n.posix.normalize(e.replace(/^\.\//,""));if(!i||".."===i||i.startsWith("../")||n.posix.isAbsolute(i))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime archive entry escapes the artifact root: ${e}`);const r=t.type;if("File"!==r&&"OldFile"!==r&&"Directory"!==r&&"SymbolicLink"!==r)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime archive contains unsupported entry type ${r??"unknown"}: ${e}`);return!0}})}catch(e){throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID","Could not extract runtime artifact safely.",{cause:e})}}(e,i),await async function(e,t,i){const r=await async function(e){let t;try{t=JSON.parse(await h.readFile(n.join(e,pr),"utf8"))}catch(e){throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID","Runtime artifact manifest is missing or invalid JSON.",{cause:e})}const i=Tt.safeParse(t);if(!i.success)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime artifact manifest is invalid: ${i.error.message}`);return i.data}(e);if(function(e,t){for(const n of["packageName","version","platform","arch","formatVersion","launcherAbi","entrypoint","sha256"])if(e[n]!==t[n])throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime artifact ${"sha256"===n?"SHA-256":n} mismatch: expected ${t[n]}, got ${e[n]}.`)}(r,t),1!==r.formatVersion)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Unsupported runtime artifact format ${r.formatVersion}.`);if(i?.platform&&"universal"!==r.platform&&r.platform!==i.platform)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime artifact platform ${r.platform} does not match ${i.platform}.`);if(i?.arch&&"universal"!==r.arch&&r.arch!==i.arch)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime artifact architecture ${r.arch} does not match ${i.arch}.`);if(void 0!==i?.launcherAbi&&r.launcherAbi>i.launcherAbi)throw new mr("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Runtime requires launcher ABI ${r.launcherAbi}, but the base runtime provides ${i.launcherAbi}.`);const s=function(e,t){if(!e||e.includes("\\")||n.posix.isAbsolute(e))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`${t} must be a non-empty POSIX relative path.`);const i=n.posix.normalize(e);if("."===i||".."===i||i.startsWith("../"))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`${t} escapes the runtime root.`);return i}(r.entrypoint,"Runtime entrypoint"),o=await h.lstat(n.join(e,...s.split("/"))).catch(()=>{});if(!o?.isFile())throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime entrypoint is missing: ${s}`);const a=await hr(e);if(a!==r.sha256)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Runtime payload SHA-256 mismatch: expected ${r.sha256}, got ${a}.`);return r}(i,t,{platform:t.platform,arch:t.arch})}finally{await h.rm(i,{recursive:!0,force:!0})}}}async function br(e,t,i,r=fetch){if("linux"!==t||!["x64","arm64"].includes(i))throw new mr("INSTANCE_BASE_RUNTIME_INCOMPATIBLE",`Managed controlled-instance updates require a Linux x64 or arm64 target, received ${t}/${i}.`);const s=await async function(e){const t=`controlled-instance-runtime-${e}-linux-universal`,i=function(){const e=process.env.TASK_HANDOFF_BUNDLED_RUNTIME_DIR?.trim();return n.resolve(e||n.join(n.dirname(process.argv[1]||process.cwd()),"..","runtime-artifacts"))}();try{const[r,s]=await Promise.all([h.readFile(n.join(i,`${t}.manifest.json`),"utf8"),h.readFile(n.join(i,`${t}.tar.gz.sha256`),"utf8")]),o=Tt.safeParse(JSON.parse(r));if(!o.success||o.data.version!==e||"linux"!==o.data.platform||"universal"!==o.data.arch)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Bundled controlled-instance ${e} has an invalid Linux manifest.`);const a=s.trim().split(/\s+/)[0]?.toLowerCase();if(!a||!/^[a-f0-9]{64}$/.test(a))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Bundled controlled-instance ${e} has an invalid archive checksum.`);return{identity:o.data,source:{archivePath:n.join(i,`${t}.tar.gz`),archiveSha256:a}}}catch(t){if("ENOENT"===t.code)return;if(t instanceof mr)throw t;throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Could not read bundled controlled-instance ${e}.`,{cause:t})}}(e);if(s)return s;const o=`controlled-instance-runtime-${e}-linux-universal`,a=function(e){const t=process.env.TASK_HANDOFF_RUNTIME_RELEASE_BASE_URL?.trim();return t?t.replaceAll("{version}",e).replace(/\/$/,""):`https://github.com/edgestorage/task-handoff/releases/download/v${e}`}(e),c=`${a}/${o}.manifest.json`,d=`${a}/${o}.tar.gz`,l=`${a}/${o}.tar.gz.sha256`,[u,p]=await Promise.all([r(c),r(l)]).catch(t=>{throw new mr("INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE",`Could not read release metadata for controlled-instance ${e}.`,{cause:t,retryable:!0})});if(!u.ok||!p.ok)throw new mr("INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE",`Release metadata for controlled-instance ${e} is unavailable (manifest HTTP ${u.status}, checksum HTTP ${p.status}).`,{retryable:u.status>=500||p.status>=500});let m;try{m=await u.json()}catch(t){throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Release manifest for controlled-instance ${e} is not valid JSON.`,{cause:t})}const g=Tt.safeParse(m);if(!g.success)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Release manifest for controlled-instance ${e} is invalid: ${g.error.message}`);if(g.data.version!==e||"linux"!==g.data.platform||"universal"!==g.data.arch)throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Release identity mismatch: requested ${e}-linux-universal, received ${g.data.version}-${g.data.platform}-${g.data.arch}.`);const f=(await p.text()).trim().split(/\s+/)[0]?.toLowerCase();if(!f||!/^[a-f0-9]{64}$/.test(f))throw new mr("INSTANCE_RUNTIME_ARTIFACT_INVALID",`Release checksum for controlled-instance ${e} is invalid.`);return{identity:g.data,source:{archiveUrl:d,archiveSha256:f}}}class wr{store;desiredVersion;hooks;inFlight=new Map;requests=new Map;cancelled=new Set;now;delay;drainTimeoutMs;verificationTimeoutMs;pollIntervalMs;maxAttempts;retryBaseDelayMs;retryMaxDelayMs;constructor(e,t,n,i={}){this.store=e,this.desiredVersion=t,this.hooks=n,this.now=i.now||(()=>new Date),this.delay=i.delay||(e=>new Promise(t=>setTimeout(t,e))),this.drainTimeoutMs=i.drainTimeoutMs??3e5,this.verificationTimeoutMs=i.verificationTimeoutMs??6e4,this.pollIntervalMs=i.pollIntervalMs??250,this.maxAttempts=function(e){if(!Number.isInteger(e)||e<=0)throw new TypeError("maxAttempts must be a positive integer.");return e}(i.maxAttempts??3),this.retryBaseDelayMs=kr(i.retryBaseDelayMs??1e3,"retryBaseDelayMs"),this.retryMaxDelayMs=kr(i.retryMaxDelayMs??3e4,"retryMaxDelayMs")}schedule(e,t={}){const n=this.requests.get(e)||{startRequested:!1,resumeCancelled:!1};n.startRequested||=!0===t.startRequested,n.resumeCancelled||=!0===t.resumeCancelled||!0===t.startRequested,n.resumeCancelled&&this.cancelled.delete(e),this.requests.set(e,n);const i=this.inFlight.get(e);if(i)return i;const r=Promise.resolve().then(()=>this.reconcile(e,n)).finally(()=>{this.inFlight.delete(e),this.requests.delete(e)});return this.inFlight.set(e,r),r}isRunning(e){return this.inFlight.has(e)}cancel(e){return this.cancelled.add(e),this.inFlight.get(e)}async reconcile(e,t){let n=this.requireInstance(e);const i=this.desiredVersion();if(this.cancelled.has(e)&&!t.resumeCancelled)return this.storePhase(n,"pending");const r=vr(n),s=r===i&&(await(this.hooks.isInstalled?.(n,i))??!0);if(this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");if(r===i&&s)return this.storeState(n,{desiredVersion:i,actualVersion:r,phase:"matched",attempt:n.runtimeVersion?.attempt||0,matchedAt:this.timestamp()},!Nr(n)&&"failed"!==n.health);const o=n.runtimeVersion?.desiredVersion===i;if(o&&"failed"===n.runtimeVersion?.phase)return n;if(o&&(n.runtimeVersion?.attempt||0)>=this.maxAttempts)return"failed"===n.runtimeVersion?.phase&&n.runtimeVersion.error?n:this.storeBatchFailure(n,i,Tr(i,r,this.maxAttempts,n.runtimeVersion?.error));if(n=this.storeState(n,function(e,t,n,i=!1){const r=e.runtimeVersion,s=r?.desiredVersion===t&&"matched"!==r.phase;return{desiredVersion:t,...n?{actualVersion:n}:{},phase:"pending",attempt:s?r.attempt:0,error:(s?r.error:void 0)||(n!==t||i?zr(t,n):Sr("INSTANCE_RUNTIME_VERIFICATION_FAILED",`Controlled-instance ${t} is running, but the active runtime artifact does not match the desired release identity.`,t,n,!0))}}(n,i,r,s)),Nr(n)&&!t.startRequested)return n;let a=!1;try{for(;(n.runtimeVersion?.attempt||0)<this.maxAttempts;){if(this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");let r;try{if(n=this.storePhase(n,"draining"),await(this.hooks.beginDrain?.(n)),a=!0,n=this.requireInstance(e),Er(n)){const t=await this.waitUntil(e,this.drainTimeoutMs,e=>!Er(e));if(n=this.requireInstance(e),!t){if(this.cancelled.has(e))return this.storePhase(n,"pending");await(this.hooks.onForcedDrain?.(n))}}if(n=this.storePhase(this.requireInstance(e),"installing",!0),await this.hooks.install(n,i),this.cancelled.has(e)||Nr(this.requireInstance(e))&&!t.startRequested)return this.storePhase(this.requireInstance(e),"pending");if(n=this.storePhase(this.requireInstance(e),"restarting"),await this.hooks.restart(n),this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");n=this.storePhase(this.requireInstance(e),"verifying");const r=await this.waitUntil(e,this.verificationTimeoutMs,e=>vr(e)===i);if(this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");if(!r)throw Sr("INSTANCE_RUNTIME_VERIFICATION_FAILED",`Instance ${e} did not register controlled-instance ${i} after restart.`,i,vr(this.requireInstance(e)),!0);const s=this.requireInstance(e);if(this.hooks.isInstalled&&!await this.hooks.isInstalled(s,i))throw Sr("INSTANCE_RUNTIME_VERIFICATION_FAILED",`Instance ${e} reported controlled-instance ${i}, but its active runtime release is missing.`,i,vr(s),!0);return this.storeState(s,{desiredVersion:i,actualVersion:i,phase:"matched",attempt:s.runtimeVersion?.attempt||1,matchedAt:this.timestamp()},!Nr(s)&&"failed"!==s.health)}catch(t){if(this.cancelled.has(e))return this.storePhase(this.requireInstance(e),"pending");r=_r(t,i,vr(this.store.get(e)))}n=this.requireInstance(e);const s=n.runtimeVersion?.attempt||1;if(!r.retryable||s>=this.maxAttempts)return this.storeBatchFailure(n,i,s>=this.maxAttempts&&r.retryable?Tr(i,vr(n),this.maxAttempts,r):r);n=this.storeState(n,{desiredVersion:i,...vr(n)?{actualVersion:vr(n)}:{},phase:"pending",attempt:s,lastAttemptAt:this.timestamp(),error:r}),await this.delay(this.retryDelayMs(s))}return this.storeBatchFailure(n,i,Tr(i,vr(n),this.maxAttempts,n.runtimeVersion?.error))}finally{a&&await(this.hooks.endDrain?.(this.requireInstance(e)))}}storeBatchFailure(e,t,n){const i=vr(e);return this.storeState(e,{desiredVersion:t,...i?{actualVersion:i}:{},phase:"failed",attempt:e.runtimeVersion?.attempt||0,lastAttemptAt:this.timestamp(),error:n})}retryDelayMs(e){return Math.min(this.retryMaxDelayMs,this.retryBaseDelayMs*2**Math.max(0,e-1))}storePhase(e,t,n=!1){const i=this.desiredVersion(),r=vr(e),s=e.runtimeVersion?.desiredVersion===i?e.runtimeVersion.error:void 0;return this.storeState(e,{desiredVersion:i,...r?{actualVersion:r}:{},phase:t,attempt:(e.runtimeVersion?.attempt||0)+(n?1:0),lastAttemptAt:this.timestamp(),...s?{error:s}:"pending"===t?{error:zr(i,r)}:{}},"restarting"!==t&&void 0)}storeState(e,t,n){const i=this.store.get(e.id)||e;return this.store.put(Mn.parse({...i,runtimeVersion:t,...void 0===n?{}:{ready:n},updatedAt:this.timestamp()}))}async waitUntil(e,t,n){const i=this.now().getTime()+t;for(;;){const t=this.store.get(e);if(t&&n(t))return!0;if(this.cancelled.has(e))return!1;if(this.now().getTime()>=i)return!1;await this.delay(Math.min(this.pollIntervalMs,Math.max(0,i-this.now().getTime())))}}requireInstance(e){const t=this.store.get(e);if(!t)throw new Error(`Instance ${e} was removed during runtime reconciliation.`);return t}timestamp(){return this.now().toISOString()}}function vr(e){return e?.build?.packageVersion||e?.instanceVersion}function Er(e){return e.apps.runningCount>0||e.aiSessions.runningCount>0}function Nr(e){return["created","stopped","failed"].includes(e.status)}function zr(e,t){return Sr("INSTANCE_RUNTIME_VERSION_MISMATCH",`Expected controlled-instance ${e}, received ${t||"an unknown version"}.`,e,t,!0)}function Sr(e,t,n,i,r){return{code:e,message:t,expectedVersion:n,...i?{actualVersion:i}:{},retryable:r}}function _r(e,t,n){if(e&&"object"==typeof e&&"code"in e&&"message"in e){const i=e,r=kt.shape.code.safeParse(i.code);if(r.success&&"string"==typeof i.message)return Sr(r.data,i.message,t,n,"boolean"!=typeof i.retryable||i.retryable)}return Sr("INSTANCE_RUNTIME_INSTALL_FAILED",e instanceof Error?e.message:String(e),t,n,!0)}function Tr(e,t,n,i){const r=i?.message?` Last error: ${i.message}`:"";return Sr(i?.code||"INSTANCE_RUNTIME_INSTALL_FAILED",`Runtime convergence stopped after ${n} attempts for this instance run.${r}`,e,t,!0)}function kr(e,t){if(!Number.isFinite(e)||e<0)throw new TypeError(`${t} must be a nonnegative finite number.`);return e}function Cr(e,n=448){t.mkdirSync(e,{recursive:!0,mode:n}),t.chmodSync(e,n)}function xr(e,i,r={}){const s=r.directoryMode??448,o=r.fileMode??384;Cr(n.dirname(e),s),I.sync(e,`${JSON.stringify(i,null,2)}\n`,{encoding:"utf8",mode:o}),t.chmodSync(e,o)}function Or(e,t){console.warn(JSON.stringify({message:e,...t}))}function Rr(e){return e&&"object"==typeof e&&"issues"in e?{issues:e.issues}:{error:e instanceof Error?e.message:String(e)}}function Dr(e,n){const i=n.logger||Or;let r;try{r=JSON.parse(t.readFileSync(e,"utf8"))}catch(t){return void i("stored JSON could not be read",{filePath:e,...Rr(t)})}if(!n.schema)return r;const s=n.sanitize?n.sanitize(r):r,o=n.schema.safeParse(s);if(o.success)return o.data;const a="strip"in n.schema&&"function"==typeof n.schema.strip?n.schema.strip().safeParse(s):void 0;if(a?.success)return i("unknown stored fields were ignored",{filePath:e,issues:o.error.issues}),a.data;i("stored record failed validation and was isolated",{filePath:e,issues:o.error.issues})}function Pr(e){return`${e}_${c.randomUUID().replace(/-/g,"").slice(0,20)}`}function jr(){return c.randomBytes(24).toString("base64url")}class Mr{directory;options;permissionsInitialized=!1;constructor(e,t={}){this.directory=e,this.options=t}init(){if(this.permissionsInitialized&&t.existsSync(this.directory))return;Cr(this.directory,this.options.directoryMode??448);const e=this.options.fileMode??384;for(const i of t.readdirSync(this.directory).filter(e=>e.endsWith(".json")))t.chmodSync(n.join(this.directory,i),e);this.permissionsInitialized=!0}filePath(e){return n.join(this.directory,`${e}.json`)}list(){return this.init(),t.readdirSync(this.directory).filter(e=>e.endsWith(".json")).sort().flatMap(e=>{const t=Dr(n.join(this.directory,e),this.options);return t?[t]:[]})}get(e){this.init();const n=this.filePath(e);return t.existsSync(n)?Dr(n,this.options):void 0}put(e){const t=this.options.sanitize?this.options.sanitize(e):e,n=this.options.schema?this.options.schema.parse(t):t;return xr(this.filePath(n.id),n,this.options),n}patch(e,t){const n=this.get(e);if(!n)return;const i={...n,...t,id:n.id,createdAt:n.createdAt,updatedAt:(new Date).toISOString()};return this.put(i)}delete(e){const n=this.filePath(e);return!!t.existsSync(n)&&(t.unlinkSync(n),!0)}}class Lr{filePathValue;defaults;options;constructor(e,t,n={}){this.filePathValue=e,this.defaults=t,this.options=n}init(){Cr(n.dirname(this.filePathValue),this.options.directoryMode??448),t.existsSync(this.filePathValue)?t.chmodSync(this.filePathValue,this.options.fileMode??384):this.put(this.defaults())}get(){return this.init(),t.existsSync(this.filePathValue)?Dr(this.filePathValue,this.options)??this.defaults():this.defaults()}put(e){const t=this.options.sanitize?this.options.sanitize(e):e,n=this.options.schema?this.options.schema.parse(t):t;return xr(this.filePathValue,n,this.options),n}}const $r=a.z.record(a.z.string(),a.z.string()),Fr=new Set(["OPENAI_API_KEY","OPENAI_BASE_URL","CODEX_MODEL","TASK_HANDOFF_CODEX_BASE_URL","TASK_HANDOFF_CODEX_MODEL","TASK_HANDOFF_CODEX_MODEL_ID","ANTHROPIC_API_KEY","ANTHROPIC_BASE_URL","CLAUDE_MODEL","TASK_HANDOFF_CLAUDE_MODEL","TASK_HANDOFF_CLAUDE_MODEL_ID"]);class Ur{directory;constructor(e){this.directory=e}get(e){try{return $r.parse(JSON.parse(t.readFileSync(this.filePath(e),"utf8")))}catch(t){if(t&&"object"==typeof t&&"code"in t&&"ENOENT"===t.code)return{};throw new Error(`Stored model environment for instance ${e} is invalid: ${t instanceof Error?t.message:String(t)}`)}}has(e){return t.existsSync(this.filePath(e))}listInstanceIds(){return t.existsSync(this.directory)?t.readdirSync(this.directory).filter(e=>e.endsWith(".json")).map(e=>e.slice(0,-5)).sort():[]}put(e,n){const i=$r.parse(n);t.mkdirSync(this.directory,{recursive:!0,mode:448});const r=this.filePath(e);return I.sync(r,`${JSON.stringify(i,null,2)}\n`,{encoding:"utf8",mode:384}),t.chmodSync(r,384),i}delete(e){t.rmSync(this.filePath(e),{force:!0})}filePath(e){return n.join(this.directory,`${e}.json`)}}class Vr{directory;nodeId;constructor(e,t){this.directory=e,this.nodeId=t}init(){t.mkdirSync(this.directory,{recursive:!0,mode:448}),t.chmodSync(this.directory,448)}list(){return this.init(),t.readdirSync(this.directory).filter(e=>e.endsWith(".json")).sort().flatMap(e=>{const t=this.read(n.join(this.directory,e));return t?[t]:[]})}get(e){const n=this.filePath(e);return t.existsSync(n)?this.read(n):void 0}put(e){const n=Kt.parse(e);this.init();const i=this.filePath(n.id);return I.sync(i,`${JSON.stringify(n,null,2)}\n`,{encoding:"utf8",mode:384}),t.chmodSync(i,384),n}delete(e){const n=this.filePath(e);return!!t.existsSync(n)&&(t.unlinkSync(n),!0)}read(e){try{const i=JSON.parse(t.readFileSync(e,"utf8")),r=n.basename(e,".json"),s=Kt.safeParse(i);if(s.success&&s.data.id===r&&rn(s.data)===s.data.id)return s.data;const o=Kt.strip().safeParse(i);return o.success&&o.data.id===r&&rn(o.data)===o.data.id?(console.warn(JSON.stringify({message:"unknown stored node model fields were ignored",nodeId:this.nodeId,filePath:e})),o.data):void console.warn(JSON.stringify({message:"stored node model failed validation and was isolated",nodeId:this.nodeId,filePath:e}))}catch(t){return void console.warn(JSON.stringify({message:"stored node model could not be read",nodeId:this.nodeId,filePath:e,error:t instanceof Error?t.message:String(t)}))}}filePath(e){return n.join(this.directory,`${e}.json`)}}class qr{directory;constructor(e){this.directory=e}init(){t.mkdirSync(this.directory,{recursive:!0,mode:448}),t.chmodSync(this.directory,448)}get(e){const n=this.filePath(e);if(t.existsSync(n))try{const i=JSON.parse(t.readFileSync(n,"utf8")),r=Wt.safeParse(i);if(r.success)return r.data;const s=Wt.strip().safeParse(i);if(s.success)return console.warn(JSON.stringify({message:"unknown stored model assignment fields were ignored",instanceId:e,filePath:n})),s.data;throw r.error}catch(t){throw Object.assign(new Error(`Stored model assignment for instance ${e} is invalid.`),{statusCode:409,code:"NODE_MODEL_ASSIGNMENT_INVALID",cause:t})}}put(e){const n=Wt.parse(e);this.init();const i=this.filePath(n.instanceId);return I.sync(i,`${JSON.stringify(n,null,2)}\n`,{encoding:"utf8",mode:384}),t.chmodSync(i,384),n}delete(e){t.rmSync(this.filePath(e),{force:!0})}filePath(e){return n.join(this.directory,`${e}.json`)}}function Hr(){return(new Date).toISOString()}class Br{models;assignments;legacyEnvironments;nodeId;instances;constructor(e,t,n){this.nodeId=t,this.instances=n,this.models=new Vr(e.nodeModelsDir,t),this.assignments=new qr(e.modelAssignmentsDir),this.legacyEnvironments=new Ur(e.modelEnvironmentsDir)}init(){this.models.init(),this.assignments.init(),this.migrateLegacyEnvironments()}list(){const e=new Map;for(const t of this.instances.list()){const n=this.assignments.get(t.id);for(const t of[n?.codexModelHash,n?.claudeModelHash])t&&e.set(t,(e.get(t)||0)+1)}return this.models.list().map(t=>this.toPublic(t,e.get(t.id)||0))}create(e){const t=Hr(),n=rn(e),i=this.models.get(n),r=Kt.parse({...e,id:n,enabled:e.enabled??!0,order:e.order??this.nextOrder(),labels:e.labels||{},createdAt:i?.createdAt||t,updatedAt:t});return this.toPublic(this.models.put(r),this.referenceIds(n).length)}deploy(e){const t=rn(e);if(e.id!==t)throw Object.assign(new Error(`Model content hash ${t} does not match ${e.id}.`),{statusCode:400,code:"NODE_MODEL_HASH_MISMATCH"});const n=this.models.get(e.id)||this.models.put(Kt.parse(e));return this.toPublic(n,this.referenceIds(n.id).length)}update(e,t){const n=this.requireModel(e),i=Kt.parse({...n,...t,key:t.key?.trim()?t.key:n.key,createdAt:n.createdAt,updatedAt:Hr()}),r=rn(i),s=this.models.put(Kt.parse({...i,id:r}));return this.toPublic(s,this.referenceIds(r).length)}delete(e){this.requireModel(e);const t=this.referenceIds(e);if(t.length)throw Object.assign(new Error(`Model ${e} is assigned to ${t.length} instance${1===t.length?"":"s"}.`),{statusCode:409,code:"NODE_MODEL_IN_USE",instanceIds:t});return this.models.delete(e)}assign(e,t){const n=this.instances.require(e);if(this.validateRef("codex",t.codexModelHash),this.validateRef("claude",t.claudeModelHash),void 0!==t.modelSelection.codexModelHash&&(t.modelSelection.codexModelHash??void 0)!==t.codexModelHash)throw Object.assign(new Error("Codex model selection does not match its node assignment."),{statusCode:400,code:"NODE_MODEL_SELECTION_MISMATCH"});if(void 0!==t.modelSelection.claudeModelHash&&(t.modelSelection.claudeModelHash??void 0)!==t.claudeModelHash)throw Object.assign(new Error("Claude model selection does not match its node assignment."),{statusCode:400,code:"NODE_MODEL_SELECTION_MISMATCH"});const i=this.assignments.get(e),r=Wt.parse({instanceId:e,codexModelHash:t.codexModelHash,claudeModelHash:t.claudeModelHash,updatedAt:Hr()});this.assignments.put(r);try{return{assignment:r,instance:this.instances.put(Mn.parse({...n,modelSelection:t.modelSelection,updatedAt:Hr()}))}}catch(t){throw i?this.assignments.put(i):this.assignments.delete(e),t}}resolvedEnvironment(e){const t=this.assignments.get(e);if(!t){if(this.legacyEnvironments.has(e))throw Object.assign(new Error(`Legacy model environment for instance ${e} requires manual migration.`),{statusCode:409,code:"NODE_MODEL_MIGRATION_REQUIRED"});return{}}return{...this.environmentForRef("codex",t.codexModelHash),...this.environmentForRef("claude",t.claudeModelHash)}}deleteInstanceMetadata(e){this.assignments.delete(e),this.legacyEnvironments.delete(e)}validateRef(e,t){if(!t)return;const n=this.requireModel(t);if(n.app!==e)throw Object.assign(new Error(`Model ${n.id} belongs to ${n.app}, not ${e}.`),{statusCode:400,code:"NODE_MODEL_APP_MISMATCH"});if(!n.enabled)throw Object.assign(new Error(`Model ${n.id} is disabled.`),{statusCode:409,code:"NODE_MODEL_DISABLED"})}environmentForRef(e,t){if(!t)return{};this.validateRef(e,t);const n=this.requireModel(t);return"codex"===e?{OPENAI_API_KEY:n.key,OPENAI_BASE_URL:n.endpoint,TASK_HANDOFF_CODEX_BASE_URL:n.endpoint,TASK_HANDOFF_CODEX_MODEL:n.model}:{ANTHROPIC_API_KEY:n.key,ANTHROPIC_BASE_URL:n.endpoint,TASK_HANDOFF_CLAUDE_MODEL:n.model}}requireModel(e){const t=this.models.get(e);if(!t)throw Object.assign(new Error(`Model ${e} was not found on node ${this.nodeId}.`),{statusCode:404,code:"NODE_MODEL_NOT_FOUND"});if(rn(t)!==t.id)throw Object.assign(new Error(`Stored model ${e} does not match its content hash.`),{statusCode:409,code:"NODE_MODEL_HASH_INVALID"});return t}referenceIds(e){return this.instances.list().filter(t=>{const n=this.assignments.get(t.id);return n?.codexModelHash===e||n?.claudeModelHash===e}).map(e=>e.id)}toPublic(e,t){const{key:n,...i}=e;return Jt.parse({...i,keyPreview:n.length<=8?"set":`${n.slice(0,4)}...${n.slice(-4)}`,keySet:!0,referenceCount:t})}nextOrder(){return this.models.list().reduce((e,t)=>Math.max(e,t.order),0)+100}migrateLegacyEnvironments(){for(const e of this.legacyEnvironments.listInstanceIds()){if(!this.instances.has(e)){this.warnMigration(e,"instance-not-found");continue}if(this.assignments.get(e)){try{this.resolvedEnvironment(e),this.legacyEnvironments.delete(e)}catch{this.warnMigration(e,"existing-assignment-invalid")}continue}let t;try{t=this.legacyEnvironments.get(e)}catch{this.warnMigration(e,"sidecar-invalid");continue}if(!Object.keys(t).length){this.legacyEnvironments.delete(e);continue}if(Object.keys(t).some(e=>!Fr.has(e))){this.warnMigration(e,"unknown-fields");continue}const n=[];try{const i=this.migrateApp(t,"codex",n),r=this.migrateApp(t,"claude",n);if(!i&&!r)throw new Error("no complete model configuration");const s={...i?{codexModelHash:i}:{},...r?{claudeModelHash:r}:{}};this.assign(e,{modelSelection:s,codexModelHash:i,claudeModelHash:r}),this.resolvedEnvironment(e),this.legacyEnvironments.delete(e)}catch{this.assignments.delete(e);for(const e of n)this.models.delete(e);this.warnMigration(e,"mapping-failed")}}}migrateApp(e,t,n){const i=e["codex"===t?"OPENAI_API_KEY":"ANTHROPIC_API_KEY"],r="codex"===t?e.TASK_HANDOFF_CODEX_BASE_URL||e.OPENAI_BASE_URL:e.ANTHROPIC_BASE_URL,s="codex"===t?e.TASK_HANDOFF_CODEX_MODEL||e.CODEX_MODEL:e.TASK_HANDOFF_CLAUDE_MODEL||e.CLAUDE_MODEL;if(!i&&!r&&!s)return;if(!i||!r||!s)throw new Error("model configuration incomplete");const o=rn({app:t,endpoint:r,key:i,model:s}),a=this.models.get(o);if(a){if(a.app!==t||a.key!==i||a.endpoint!==r||a.model!==s||!a.enabled)throw new Error("existing model conflicts with legacy environment");return o}const c=Hr();return this.models.put(Kt.parse({id:o,name:`Migrated ${"codex"===t?"Codex":"Claude"} model`,endpoint:r,key:i,model:s,app:t,enabled:!0,order:this.nextOrder(),labels:{migratedFrom:"instance-model-environment"},createdAt:c,updatedAt:c})),n.push(o),o}warnMigration(e,t){console.warn(JSON.stringify({message:"legacy model environment was preserved because it could not be migrated",nodeId:this.nodeId,instanceId:e,reason:t}))}}function Kr(){return(new Date).toISOString()}function Gr(e,t){if(!e)return!0;const n=A.valid(e),i=A.valid(t);return n&&i?A.gt(i,n):e!==t}function Jr(){return process.env.TASK_HANDOFF_NPM_COMMAND||"npm"}function Wr(e,i){const r=n.join(e,...i.split("/"),"package.json");try{const e=JSON.parse(t.readFileSync(r,"utf8"));if(e.name!==i||"string"!=typeof e.version||!e.version.trim())throw new Error(`Installed package manifest is invalid: ${r}`);return{name:i,version:e.version.trim()}}catch(e){if("ENOENT"===e.code)return;throw e}}async function Yr(e){const t=(await e(Jr(),["root","--global"])).stdout.trim();if(!t)throw new Error("npm did not return its global module root.");const n=Wr(t,"@task-handoff/server"),i=Wr(t,"@task-handoff/node-agent");return n?{packageName:"@task-handoff/server",currentVersion:n.version,relatedCurrentVersions:i?[i.version]:[]}:{packageName:"@task-handoff/node-agent",currentVersion:i?.version,relatedCurrentVersions:[]}}function Xr(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n="string"==typeof t.updatedAt?t.updatedAt:Kr(),i=t.target&&"object"==typeof t.target&&!Array.isArray(t.target)?t.target:void 0,r="controlled-instance"===i?.component,s={updating:"updating-node",downloading:"updating-node",installing:"updating-node",restarting:"restarting-node",completed:"succeeded",success:"succeeded",error:"failed"},o=new Set(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),a="string"==typeof t.status?t.status:"queued",c=r?"failed":o.has(a)?a:s[a]||"failed",d="string"==typeof t.toVersion&&t.toVersion?t.toVersion:"unknown",l=xt.strip().safeParse(t.impact).success?xt.strip().parse(t.impact):{runningInstanceCount:0,stoppedInstanceCount:0,activeInstanceCount:0,restartInstanceCount:0,runningInstanceIds:[],stoppedInstanceIds:[],activeInstanceIds:[]},u=r?{code:"LEGACY_INSTANCE_UPDATE_RETIRED",message:"Independent controlled-instance update jobs were retired in favor of Node reconciliation.",retryable:!1}:"failed"!==c||t.error||o.has(a)||a in s?"string"==typeof t.error?{code:"NODE_UPDATE_FAILED",message:t.error,retryable:!1}:kt.strip().safeParse(t.error).success?kt.strip().parse(t.error):t.error&&"object"==typeof t.error?{code:"NODE_UPDATE_FAILED",message:"string"==typeof t.error.message?t.error.message:"Stored update job contained an unknown error.",retryable:!1}:void 0:{code:"NODE_UPDATE_FAILED",message:`Stored update job used an unknown status: ${a}.`,retryable:!1},{target:p,error:m,...g}=t,h={phase:"succeeded"===c?"succeeded":"failed"===c?"failed":c||"queued",desiredVersion:d,expectedInstanceIds:[],expectedInstanceCount:0,matchedInstanceCount:0,pendingInstanceCount:0,failedInstanceCount:r||"failed"===c?1:0,deferredInstanceCount:0},f=Ot.strip().safeParse(t.rollout);return{...g,source:"npm",status:c,impact:l,runtimeArtifacts:Array.isArray(t.runtimeArtifacts)?t.runtimeArtifacts.flatMap(e=>{const t=Tt.strip().safeParse(e);return t.success?[t.data]:[]}):[],rollout:f.success?f.data:h,...u?{error:u}:{},...r?{completedAt:t.completedAt||n}:{}}}class Qr{records;constructor(e){this.records=new Mr(e.updatesDir,{schema:Pt,sanitize:Xr})}init(){this.records.init()}list(){return this.records.list().sort((e,t)=>t.createdAt.localeCompare(e.createdAt))}create(e,t){const n=Kr();return this.records.put(Pt.parse({id:Pr("update"),nodeId:e,source:t.source,channel:t.channel,fromVersion:t.currentVersion,toVersion:t.availableVersion,artifactRef:t.artifactRef,runtimeArtifacts:t.runtimeArtifacts,impact:t.impact,status:"queued",rollout:{phase:"queued",desiredVersion:t.availableVersion,expectedInstanceIds:t.impact.runningInstanceIds,expectedInstanceCount:t.impact.runningInstanceCount,matchedInstanceCount:0,pendingInstanceCount:t.impact.runningInstanceCount,failedInstanceCount:0,deferredInstanceCount:t.impact.stoppedInstanceCount},createdAt:n,updatedAt:n}))}patch(e,t){const n=this.records.get(e);if(!n)throw Object.assign(new Error(`Update job ${e} was not found.`),{statusCode:404,code:"UPDATE_JOB_NOT_FOUND"});return this.records.put(Pt.parse({...n,...t,id:e,createdAt:n.createdAt,updatedAt:Kr()}))}reconcileRollouts(e,t,n={}){const i=new Map(e.map(e=>[e.id,e]));for(const e of this.list().filter(e=>["updating-node","restarting-node","converging-instances"].includes(e.status))){if(n.processStarted&&"restarting-node"===e.status&&t!==e.toVersion){this.patch(e.id,{status:"failed",rollout:{...e.rollout,phase:"failed",nodeVersion:t},error:{code:"NODE_UPDATE_FAILED",message:`Node agent restarted with version ${t}, expected ${e.toVersion}.`,retryable:!1},completedAt:Kr()});continue}const r="converging-instances"!==e.status&&t===e.toVersion?this.patch(e.id,{status:"converging-instances",rollout:{...e.rollout,phase:"converging-instances",nodeVersion:t}}):e;if("converging-instances"!==r.status)continue;const s=r.rollout.expectedInstanceIds,o=s.map(e=>i.get(e)),a=o.filter(e=>e?.ready&&"matched"===e.runtimeVersion?.phase&&e.runtimeVersion.actualVersion===r.toVersion).length,c=o.filter(e=>e&&["created","stopped","failed"].includes(e.status||"")&&"failed"!==e.runtimeVersion?.phase).length,d=o.filter(e=>!e||"failed"===e.runtimeVersion?.phase).length,l=Math.max(0,s.length-a-d-c),u=d>0?"degraded":0===l?"succeeded":"converging-instances";this.patch(r.id,{status:u,rollout:{...r.rollout,phase:u,nodeVersion:t,expectedInstanceCount:s.length,matchedInstanceCount:a,pendingInstanceCount:l,failedInstanceCount:d,deferredInstanceCount:r.impact.stoppedInstanceCount+c},..."succeeded"===u||"degraded"===u?{completedAt:Kr()}:{}})}}run(e,t){(async()=>{this.patch(e.id,{status:"updating-node",rollout:{...e.rollout,phase:"updating-node"},startedAt:Kr(),error:void 0});try{await t(e),this.patch(e.id,{status:"succeeded",completedAt:Kr()})}catch(t){this.patch(e.id,{status:"failed",rollout:{...e.rollout,phase:"failed"},error:{code:"NODE_UPDATE_FAILED",message:t instanceof Error?t.message:String(t),retryable:!1},completedAt:Kr()})}})()}}const Zr=function(e,t=process.env,n=e){let i;return()=>{const r=t.TASK_HANDOFF_VERSION?.trim();return r||(i||=E(e,t,n),i)}}("@task-handoff/node-agent",process.env,"@task-handoff/control-plane");function es(){return Zr()}function ts(e,t){return{code:"INSTANCE_RUNTIME_VERSION_MISMATCH",message:`Expected controlled-instance ${e}, received ${t||"an unknown version"}.`,expectedVersion:e,...t?{actualVersion:t}:{},retryable:!0}}function ns(e){const t=es();return e===t?{desiredVersion:t,actualVersion:e,phase:"matched",attempt:0,matchedAt:(new Date).toISOString()}:{desiredVersion:t,...e?{actualVersion:e}:{},phase:"pending",attempt:0,error:ts(t,e)}}function is(e,t,n=!0){if(!n)return ns(t);const i=es(),r=e.runtimeVersion;if(!r||r.desiredVersion!==i)return ns(t);const s="INSTANCE_RUNTIME_VERSION_MISMATCH"!==r.error?.code?r.error:t===i?void 0:ts(i,t);return Ct.parse({...r,desiredVersion:i,...t?{actualVersion:t}:{actualVersion:void 0},..."pending"===r.phase?{error:s||(t!==i?ts(i,t):void 0)}:{}})}const rs="runtime_local_host",ss="task-handoff.node-agent.builtin";function os(){return(new Date).toISOString()}function as(e){const t={...e};return delete t[ss],t}function cs(e){return"local-folder"===e.type?Vt.parse({mode:"local-bind",path:"/workspace",readOnly:!1}):Vt.parse({mode:"git-clone",path:"/workspace",readOnly:!1})}function ds(e){const t=Ut.parse(e.source),n=e.projectId||("local-folder"===t.type?t.localFolderId:void 0)||("git-repository"===t.type?t.repositoryId:void 0)||("git-template"===t.type?t.templateId:void 0)||`project_${e.id}`;return Ht.parse({id:n,name:"string"==typeof e.sourceSnapshot.name?e.sourceSnapshot.name:e.name,source:t,defaultImageSelection:e.imageSelection,defaultNodeId:e.nodeId,defaultRuntimeId:e.runtimeId,workspacePolicy:cs(t),labels:{},createdAt:e.createdAt,updatedAt:e.updatedAt})}function ls(e,t){throw Object.assign(new Error(t),{statusCode:403,code:e})}function us(e,t){e!==$e&&console.warn(JSON.stringify({message:"protocol version mismatch",peer:t,expectedProtocolVersion:$e,actualProtocolVersion:e||"missing",errorCode:"PROTOCOL_VERSION_MISMATCH"}))}function ps(e){return"none"!==e.capabilities.artifactKind}function ms(e={}){return{...e,requiresImage:!1,supportsControlledInstanceApi:!0,supportsContainerLifecycle:!1,supportsAppSessions:!0,supportsHostSessions:!0,artifactKind:"none",isolation:"none"}}class gs extends Mr{onStored;setOnStored(e){this.onStored=e}put(e){const t=super.get(e.id)?.stateRevision||0,n=super.put(Mn.parse({...e,stateRevision:Math.max(e.stateRevision||0,t)+1}));return this.onStored?.(n),n}}class hs{nodeId;paths;localFolders;nodeRuntimes;controlledInstances;modelRegistry;updateJobs;node;listenerPort;containerUrlOverride;platform;constructor(e,t,n,i,r,s){this.paths=e,this.nodeId=t,this.localFolders=new Mr(e.localFoldersDir,{schema:Ft,sanitize:ot}),this.nodeRuntimes=new Mr(e.nodeRuntimesDir,{schema:Sn}),this.controlledInstances=new gs(e.controlledInstancesDir,{schema:Mn,sanitize:e=>Un(e,e=>{console.warn(JSON.stringify({message:"legacy controlled instance field was ignored",...e}))})}),this.modelRegistry=new Br(e,t,{has:e=>Boolean(this.controlledInstances.get(e)),list:()=>this.listInstances(),require:e=>this.requireInstance(e),put:e=>this.controlledInstances.put(e)}),this.updateJobs=new Qr(e),this.listenerPort=r,this.platform=s,this.containerUrlOverride=i;const o=os();this.node=zn.parse({id:t,name:t,connectionMode:"direct-http",endpoint:n,controlEndpoint:n,containerEndpoint:this.containerUrl,publicWebBase:n?n.replace(/:\d+$/,""):void 0,status:"online",health:"ok",capabilities:{},labels:{},createdAt:o,updatedAt:o})}init(){this.localFolders.init();for(const e of this.localFolders.list())this.localFolders.put(e);if(this.nodeRuntimes.init(),this.controlledInstances.init(),this.modelRegistry.init(),this.updateJobs.init(),this.updateJobs.reconcileRollouts(this.controlledInstances.list(),es(),{processStarted:!0}),!this.nodeRuntimes.get("runtime_local_docker")){const e=os();this.nodeRuntimes.put(Sn.parse({id:"runtime_local_docker",nodeId:this.nodeId,name:"Local Docker",type:"docker",status:"unknown",accessStrategy:"direct-port",capabilities:{},labels:{},createdAt:e,updatedAt:e}))}if("win32"!==this.platform){const e=this.nodeRuntimes.get(rs),t=os();this.nodeRuntimes.put(Sn.parse({id:rs,nodeId:this.nodeId,name:"Local Runtime",type:"local",status:e?.status||"unknown",accessStrategy:"node-proxy",capabilities:ms(e?.capabilities),labels:{...e?.labels,[ss]:"true"},createdAt:e?.createdAt||t,updatedAt:e?.updatedAt||t}))}for(const e of this.nodeRuntimes.list())e.nodeId!==this.nodeId&&this.nodeRuntimes.put(Sn.parse({...e,nodeId:this.nodeId,updatedAt:os()}));for(const e of this.localFolders.list())e.nodeId!==this.nodeId&&this.localFolders.put(Ft.parse({...e,nodeId:this.nodeId,updatedAt:os()}));this.normalizeInstanceRuntimeVersions()}normalizeInstanceRuntimeVersions(){for(const e of this.controlledInstances.list()){const t=ns(e.build?.packageVersion||e.instanceVersion),n=ps(this.requireRuntime(e.runtimeId)),i=["created","stopped","failed"].includes(e.status),r=n&&e.runtimeVersion?.desiredVersion===t.desiredVersion?e.runtimeVersion:void 0,s=n?"matched"===t.phase?i?t:{...t,phase:"verifying",matchedAt:void 0}:"failed"===r?.phase?{...t,phase:"failed",attempt:r.attempt,lastAttemptAt:r.lastAttemptAt,error:r.error}:{...t,attempt:r?.attempt||0,lastAttemptAt:r?.lastAttemptAt}:t;this.controlledInstances.put(Mn.parse({...e,ready:!1,runtimeVersion:s,updatedAt:os()}))}}get localNodeAgentUrl(){return`http://127.0.0.1:${this.listenerPort}`}get currentListenerPort(){return this.listenerPort}get containerUrl(){return this.containerUrlOverride||`http://host.docker.internal:${this.listenerPort}`}setListenerPort(e){this.listenerPort=e,this.node.containerEndpoint=this.containerUrl,this.node.updatedAt=os()}runningInstanceCount(){const e=new Set(["created","stopped","failed"]);return this.listInstances().filter(t=>!e.has(t.status)).length}createLocalFolder(e){const t=os(),n=Ft.parse({...e,id:e.id||Pr("folder"),nodeId:this.nodeId,labels:e.labels||{},createdAt:t,updatedAt:t});return this.localFolders.put(n)}createRuntime(e){if("local"===e.type){const e="win32"===this.platform,t=new Error(e?"Local Runtime is not supported on Windows.":"Local Runtime is built in and cannot be added manually.");throw Object.assign(t,{statusCode:e?400:409,code:e?"LOCAL_RUNTIME_UNSUPPORTED":"LOCAL_RUNTIME_BUILTIN"}),t}const t=os(),n=Sn.parse({...e,id:e.id||Pr("runtime"),nodeId:this.nodeId,accessStrategy:e.accessStrategy||(i=e.type,"docker"===i?"direct-port":"node-proxy"),capabilities:e.capabilities||{},labels:as(e.labels),createdAt:t,updatedAt:t});var i;return this.nodeRuntimes.put(n)}updateRuntime(e,t){const n=this.requireRuntime(e);if("true"===n.labels[ss]){const t=new Error(`Built-in runtime ${e} cannot be modified.`);throw Object.assign(t,{statusCode:400,code:"NODE_RUNTIME_BUILTIN"}),t}if("local"===n.type||"local"===t.type){const e="win32"===this.platform,t=new Error(e?"Local Runtime is not supported on Windows.":"Local Runtime is built in and cannot be configured manually.");throw Object.assign(t,{statusCode:e?400:409,code:e?"LOCAL_RUNTIME_UNSUPPORTED":"LOCAL_RUNTIME_BUILTIN"}),t}const i=Sn.parse({...n,...t,id:n.id,nodeId:this.nodeId,accessStrategy:t.accessStrategy||n.accessStrategy,capabilities:t.capabilities||n.capabilities,labels:t.labels?as(t.labels):n.labels,createdAt:n.createdAt,updatedAt:os()});return this.nodeRuntimes.put(i)}deleteRuntime(e){if("true"===this.requireRuntime(e).labels[ss]){const t=new Error(`Built-in runtime ${e} cannot be deleted.`);throw Object.assign(t,{statusCode:400,code:"NODE_RUNTIME_BUILTIN"}),t}const t=this.listInstances().filter(t=>t.runtimeId===e);if(t.length){const n=new Error(`Runtime ${e} is used by ${t.length} instance${1===t.length?"":"s"}.`);throw Object.assign(n,{statusCode:409,code:"NODE_RUNTIME_IN_USE"}),n}return this.nodeRuntimes.delete(e)}checkRuntime(e,t){const n=this.requireRuntime(e);return t.check?t.check(n).then(e=>{const t=Sn.parse({...n,...e,id:n.id,nodeId:this.nodeId,createdAt:n.createdAt,updatedAt:os()});return this.nodeRuntimes.put(t)}):this.nodeRuntimes.put(Sn.parse({...n,status:"unknown",updatedAt:os()}))}requireRuntime(e){const t=this.nodeRuntimes.get(e);if(!t){const t=new Error(`Node runtime ${e} was not found.`);throw Object.assign(t,{statusCode:404,code:"NODE_RUNTIME_NOT_FOUND"}),t}return t}requireInstance(e){const t=this.controlledInstances.get(e);if(!t){const t=new Error(`Instance ${e} was not found on node ${this.nodeId}.`);throw Object.assign(t,{statusCode:404,code:"NODE_INSTANCE_NOT_FOUND"}),t}const n=Fn(t);if(!n.success)throw function(e,t){const n=t.map(e=>`${e.path.join(".")||"body"}: ${e.message}`).join("; ");return Object.assign(new Error(`Stored instance ${e} is not compatible with protocol ${$e}: ${n}`),{statusCode:409,code:"NODE_INSTANCE_PAYLOAD_INVALID"})}(e,n.error.issues);return n.data}applyInstanceLifecycle(e,t){return this.controlledInstances.put(function(e,t,n=(new Date).toISOString()){switch(t.type){case"start-requested":return Mn.parse({...e,status:"starting",ready:!1,updatedAt:n});case"stop-requested":return Mn.parse({...e,status:"stopping",ready:!1,updatedAt:n});case"stop-failed":return"stopping"!==e.status?e:Mn.parse({...e,status:t.baseline.status,health:t.baseline.health,connectionStatus:t.baseline.connectionStatus,agentStatus:t.baseline.agentStatus,targetStatus:t.baseline.targetStatus,uiAccessStatus:t.baseline.uiAccessStatus,ready:t.baseline.ready,target:{...e.target,status:t.baseline.target.status},updatedAt:n});case"convergence-restart-requested":return Mn.parse({...e,build:void 0,instanceVersion:void 0,ready:!1,updatedAt:n});case"runtime-lifecycle-completed":return function(e,t,n,i){if(t.stateRevision>e.stateRevision&&["failed","stopping","stopped"].includes(t.status))return t;const r=t.stateRevision>e.stateRevision&&t.lastHeartbeatAt!==e.lastHeartbeatAt&&"online"===t.agentStatus;return Mn.parse({...t,...n,...r?{status:t.status,health:t.health,connectionStatus:t.connectionStatus,agentStatus:t.agentStatus,targetStatus:t.targetStatus,uiAccessStatus:t.uiAccessStatus}:{},ready:!!r&&t.ready,target:n.target?r?{...n.target,...t.target}:{...t.target,...n.target}:t.target,workspace:n.workspace?r?{...n.workspace,...t.workspace}:{...t.workspace,...n.workspace}:t.workspace,runtime:n.runtime?{...t.runtime,...n.runtime}:t.runtime,updatedAt:i})}(t.baseline,e,t.observation,n);case"stop-completed":return Mn.parse({...e,status:"stopped",health:"unknown",connectionStatus:"offline",ready:!1,agentStatus:"offline",targetStatus:"unknown",uiAccessStatus:"unknown",target:{...e.target,status:"unknown"},updatedAt:n});case"runtime-exited":case"start-failed":return Mn.parse({...e,status:"failed",ready:!1,health:"failed",connectionStatus:"offline",agentStatus:"offline",targetStatus:"unknown",uiAccessStatus:"unknown",workspace:{...e.workspace,error:(i=t.error,i instanceof Error?i.message:String(i))},updatedAt:n})}var i}(this.requireInstance(e),t))}listInstances(){return this.controlledInstances.list().flatMap(e=>{const t=Fn(e);return t.success?[t.data]:[]})}resolvedAssignedModelEnvironment(e){return this.modelRegistry.resolvedEnvironment(e)}createInstance(e){const t=this.requireRuntime(e.runtimeId),i=os(),r=e.id||Pr("inst"),s=Ut.parse(e.source);if(function(e){return"boolean"==typeof e.capabilities.requiresImage?e.capabilities.requiresImage:"local"!==e.type}(t)&&(!e.imageSelection||!e.image)){const e=new Error(`Runtime ${t.name} requires an image.`);throw Object.assign(e,{statusCode:400,code:"NODE_RUNTIME_IMAGE_REQUIRED"}),e}if("local"===t.type&&"local-folder"!==s.type){const e=new Error("Localhost runtime currently supports local folder sources only.");throw Object.assign(e,{statusCode:400,code:"LOCAL_RUNTIME_REQUIRES_LOCAL_FOLDER"}),e}if("local"===t.type&&this.listInstances().some(e=>"local"===this.requireRuntime(e.runtimeId).type)){const e=new Error("A localhost instance already exists on this node.");throw Object.assign(e,{statusCode:409,code:"LOCAL_RUNTIME_INSTANCE_EXISTS"}),e}const o=e.image?fn.parse(e.image):void 0,a="local"===t.type&&"local-folder"===s.type?n.resolve(s.path):void 0,c=Mn.parse({id:r,name:e.name||`instance-${r.replace(/^inst_?/,"").slice(0,6)}`,source:s,sourceSnapshot:e.sourceSnapshot||{},modelSelection:e.modelSelection,projectId:e.projectId,nodeId:this.nodeId,runtimeId:t.id,imageSelection:e.imageSelection,imageSnapshot:o,imageProvisioning:o&&"docker"===t.type?{phase:"checking-image",requestedReference:o.requestedReference,generation:0,startedAt:i,updatedAt:i}:void 0,status:o&&"docker"===t.type?"provisioning":"created",health:"unknown",connectionStatus:"unknown",agentStatus:"unknown",targetStatus:"unknown",uiAccessStatus:"unknown",controlMode:"controlled",ready:!1,runtimeVersion:ns(),capabilities:{},config:{autoImportAgentConfigs:e.config?.autoImportAgentConfigs??!0,defaultCodexPermissionMode:e.config?.defaultCodexPermissionMode??("docker"===t.type?"full-access":"ask")},workspace:"local"===t.type?{mode:"local-bind",status:"unknown",path:a}:{status:"unknown"},target:{strategy:"node-proxy",status:"unknown"},runtime:"local"===t.type?{kind:"local",workspacePath:a,labels:{"task-handoff.runtime-kind":"local"}}:{labels:{}},registrationToken:jr(),createdAt:i,updatedAt:i});return this.controlledInstances.put(c)}registerInstance(e,t,n){const i=Bn.parse(t),r=os(),s=this.controlledInstances.get(e);if(!s){const t=new Error(`Instance ${e} was not found on node ${this.nodeId}.`);throw Object.assign(t,{statusCode:404,code:"NODE_INSTANCE_NOT_FOUND"}),t}if(this.validateInstanceReport(s,i,n),i.processIncarnationId&&i.processIncarnationId===s.processIncarnationId)return s;us(i.protocolVersion,`Instance ${e}`);const o=i.build?.packageVersion||i.instanceVersion,a=ps(this.requireRuntime(s.runtimeId)),c=is(s,o,a),d=Mn.parse({...s,status:"registered",health:o===es()?"ok":"degraded",ready:!a&&o===es(),connectionStatus:"online",agentStatus:"online",targetStatus:"endpoint-unreachable"===i.target.status?"endpoint-unreachable":"reachable"===i.target.status?"reachable":s.targetStatus,uiAccessStatus:"endpoint-unreachable"===i.target.status?"endpoint-unreachable":s.uiAccessStatus,controlMode:i.controlMode,protocolVersion:i.protocolVersion,instanceVersion:i.instanceVersion,build:i.build,runtimeVersion:c,processIncarnationId:i.processIncarnationId||s.processIncarnationId,capabilities:i.capabilities,appInventory:i.appInventory,workspace:i.workspace,target:{...s.target,...i.target},registrationToken:s.registrationToken||i.registrationToken,lastHeartbeatAt:r,updatedAt:r});return this.controlledInstances.put(d)}heartbeatInstance(e,t,n){const i=this.requireInstance(e);this.validateInstanceToken(i,n);const r=Kn.parse(t);i.processIncarnationId&&r.processIncarnationId&&r.processIncarnationId!==i.processIncarnationId&&function(e,t){throw Object.assign(new Error(t),{statusCode:409,code:"INSTANCE_PROCESS_INCARNATION_MISMATCH"})}(0,`Instance ${e} report belongs to an obsolete controlled-instance process.`),us(r.protocolVersion,`Instance ${e}`);const s=os(),o=r.target?{...i.target,...r.target}:i.target,a={...o,status:"unknown"===o.status&&(o.web||o.api)?"reachable":o.status},c="endpoint-unreachable"===a.status?"endpoint-unreachable":"reachable"===a.status?"reachable":i.targetStatus,d=is(i,r.build?.packageVersion||i.build?.packageVersion||i.instanceVersion,ps(this.requireRuntime(i.runtimeId))),l=r.health||i.health,u="running"===(r.status||i.status)&&"failed"!==l,p=Mn.parse({...i,...r,target:a,ready:u,health:l,runtimeVersion:d,processIncarnationId:r.processIncarnationId||i.processIncarnationId,agentStatus:"online",targetStatus:c,uiAccessStatus:c,connectionStatus:"online",build:r.build||i.build,lastHeartbeatAt:s,updatedAt:s});return this.controlledInstances.put(p)}validateInstanceReport(e,t,n){this.validateInstanceToken(e,n||t.registrationToken),t.instanceId&&t.instanceId!==e.id&&ls("INSTANCE_ID_MISMATCH",`Instance ${t.instanceId} cannot register as ${e.id}.`),t.nodeId&&t.nodeId!==this.nodeId&&ls("INSTANCE_NODE_MISMATCH",`Instance ${e.id} belongs to node ${this.nodeId}.`),t.runtimeId&&t.runtimeId!==e.runtimeId&&ls("INSTANCE_RUNTIME_MISMATCH",`Instance ${e.id} belongs to runtime ${e.runtimeId}.`),t.imageSelection&&t.imageSelection.imageId!==e.imageSelection?.imageId&&ls("INSTANCE_IMAGE_MISMATCH",`Instance ${e.id} belongs to image ${e.imageSelection?.imageId}.`)}validateInstanceToken(e,t){e.registrationToken&&t===e.registrationToken||ls("INSTANCE_REGISTRATION_TOKEN_INVALID",`Invalid registration token for instance ${e.id}.`)}context(e,t=this.resolvedAssignedModelEnvironment(e.id)){const n=e.imageSnapshot||fn.parse({id:"img_localhost",origin:"custom",name:"Localhost",repository:"localhost",tag:"local",requestedReference:"localhost:local",pullPolicy:"if-not-present",capabilities:[],optionalApps:[],defaultEnv:{},labels:{},createdAt:e.createdAt,updatedAt:e.updatedAt});return{project:ds(e),image:n,node:this.node,runtime:this.requireRuntime(e.runtimeId),instance:e,nodeAgentUrl:this.containerUrl,modelEnv:t}}}const fs=a.z.object({path:a.z.string().trim().min(1).max(2048),method:a.z.string().trim().min(1).max(20).default("GET"),headers:a.z.record(a.z.string(),a.z.string()).default({}),body:a.z.string().optional(),bodyBase64:a.z.string().optional()}).strict(),ys=a.z.object({id:a.z.string().trim().min(1).max(120).optional(),name:a.z.string().trim().min(1).max(160),path:a.z.string().trim().min(1).max(4096),defaultImageSelection:it.optional(),labels:a.z.record(a.z.string(),a.z.string()).default({})}).strict(),Is=a.z.object({path:a.z.string().trim().min(1).max(4096).optional(),depth:a.z.coerce.number().int().min(0).max(1).default(0)}).strict(),As=a.z.object({id:a.z.string().trim().min(1).max(120).optional(),name:a.z.string().trim().min(1).max(160).optional(),runtimeId:a.z.string().trim().min(1).max(120),imageSelection:it.optional(),projectId:a.z.string().trim().min(1).max(120).optional(),image:fn.optional(),source:Ut,sourceSnapshot:a.z.record(a.z.string(),a.z.unknown()).default({}),config:a.z.object({autoImportAgentConfigs:a.z.boolean().optional(),defaultCodexPermissionMode:U.optional()}).strict().optional(),modelSelection:Mn.shape.modelSelection}).strict(),bs=a.z.object({name:a.z.string().trim().min(1).max(160).optional(),config:a.z.object({autoImportAgentConfigs:a.z.boolean().optional(),defaultCodexPermissionMode:U.optional()}).strict().optional(),modelSelection:Mn.shape.modelSelection.optional()}).strict(),ws=a.z.object({id:a.z.string().trim().min(1).max(120).optional(),name:a.z.string().trim().min(1).max(160),type:a.z.enum(["docker","kubernetes","local"]),status:a.z.enum(["unknown","online","offline","degraded"]).default("unknown"),accessStrategy:a.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).optional(),capabilities:a.z.record(a.z.string(),a.z.unknown()).default({}),labels:a.z.record(a.z.string(),a.z.string()).default({})}).strict(),vs=ws.omit({id:!0}).partial().strict();function Es(e){const t=e.authorization;return"string"==typeof t&&t.startsWith("Bearer ")?t.slice(7).trim():void 0}class Ns{operations=new Map;intents=new Map;intent(e){const t=this.intents.get(e);if(t)return t;const n={};return this.intents.set(e,n),n}invalidate(e){const t={};return this.intents.set(e,t),t}isIntentCurrent(e,t){return this.intents.get(e)===t}clearIntent(e){this.intents.delete(e)}async run(e,t){const n=this.operations.get(e)||Promise.resolve();let i;const r=new Promise(e=>{i=e});this.operations.set(e,r),await n;try{return await t()}finally{i(),this.operations.get(e)===r&&this.operations.delete(e)}}}const zs=a.z.object({}).strict().default({});function Ss(){return(new Date).toISOString()}function _s(){return(new Date).toISOString()}class Ts{state;images;options;inFlight=new Map;abortController=new AbortController;stopped=!1;constructor(e,t,n){this.state=e,this.images=t,this.options=n}retry(e){const t=this.state.requireInstance(e);if("docker"!==this.state.requireRuntime(t.runtimeId).type||!t.imageSnapshot)throw Object.assign(new Error(`Instance ${e} does not use a Docker image.`),{statusCode:400,code:"INSTANCE_IMAGE_PROVISIONING_UNSUPPORTED"});if("failed"!==t.status||"failed"!==t.imageProvisioning?.phase)throw Object.assign(new Error(`Instance ${e} does not have failed image provisioning to retry.`),{statusCode:409,code:"INSTANCE_IMAGE_PROVISIONING_NOT_FAILED"});const n=_s();return this.state.controlledInstances.put(Mn.parse({...t,status:"provisioning",health:"unknown",imageProvisioning:{phase:"checking-image",requestedReference:t.imageSnapshot.requestedReference,generation:(t.imageProvisioning?.generation||0)+1,startedAt:n,updatedAt:n},updatedAt:n}))}provision(e,t){if(this.stopped)return Promise.resolve();const n=e.imageProvisioning?.generation;if(void 0===n)return Promise.resolve();const i=`${e.id}:${n}`,r=this.inFlight.get(i);if(r)return r;const s=this.provisionGeneration(e,n,t).finally(()=>{this.inFlight.get(i)===s&&this.inFlight.delete(i)});return this.inFlight.set(i,s),s}async stop(){this.stopped=!0,this.abortController.abort(),await Promise.allSettled([...this.inFlight.values()])}async provisionGeneration(e,t,n){const i=this.currentGeneration(e.id,t,!0,e.createdAt);if(!i)return;let r,s=0,o=!1,a=Promise.resolve();try{const c=await this.images.ensure(i.imageSnapshot.requestedReference,n=>{a=a.then(async()=>{if(!r)try{await this.updatePhase(e.id,t,n,e.createdAt)}catch(e){r={error:e}}})},n=>{this.stopped||(o=!0,s=n.sequence,this.publishTerminalOutput(e,t,n))},this.abortController.signal);if(await a,r)throw r.error;if(this.stopped)return;o&&this.publishFinished(e,t,s+1,"succeeded");const d=async()=>{if(this.stopped)return;const i=this.currentGeneration(e.id,t,!0,e.createdAt);if(!i)return;const r=this.state.controlledInstances.put(Mn.parse({...i,status:"provisioning"===i.status?"created":i.status,health:"unknown",imageSnapshot:{...i.imageSnapshot,requestedReference:c.requestedReference,resolvedDigest:c.resolvedDigest,resolvedReference:c.resolvedReference},imageProvisioning:{...i.imageProvisioning,phase:"ready",error:void 0,updatedAt:_s()},updatedAt:_s()}));this.options.sync(),this.options.diagnostic({instanceId:e.id,action:"image.provision",reference:c.requestedReference,digest:c.resolvedDigest,pulled:c.pulled},"node instance image provisioning completed"),"starting"===r.status&&await(n?.())};await(this.options.runInstanceOperation?.(e.id,d)??d())}catch(n){if(await a,r&&(n=r.error),this.stopped)return;o&&this.publishFinished(e,t,s+1,"failed");const i=n instanceof Error?n.message:String(n),c=async()=>{if(this.stopped)return;const n=this.currentGeneration(e.id,t,!1,e.createdAt);n?.imageProvisioning&&["provisioning","starting"].includes(n.status)&&(this.state.controlledInstances.put(Mn.parse({...n,status:"failed",health:"failed",imageProvisioning:{...n.imageProvisioning,phase:"failed",error:i,updatedAt:_s()},updatedAt:_s()})),this.options.sync(),this.options.warn({instanceId:e.id,action:"image.provision",reference:n.imageProvisioning.requestedReference,error:i},"node instance image provisioning failed"))};await(this.options.runInstanceOperation?.(e.id,c)??c())}}currentGeneration(e,t,n=!0,i){const r=this.state.controlledInstances.get(e);if(!(!r||i&&r.createdAt!==i||r.imageProvisioning?.generation!==t||n&&!r.imageSnapshot))return r}async updatePhase(e,t,n,i){if(this.stopped)return;const r=async()=>{if(this.stopped)return;const r=this.currentGeneration(e,t,!0,i);r&&["provisioning","starting"].includes(r.status)&&(this.state.controlledInstances.put(Mn.parse({...r,status:"starting"===r.status?"starting":"provisioning",imageProvisioning:{...r.imageProvisioning,phase:n,error:void 0,updatedAt:_s()},updatedAt:_s()})),this.options.sync())};await(this.options.runInstanceOperation?.(e,r)??r())}eventBase(e,t){return{instanceId:e.id,generation:t,requestedReference:e.imageProvisioning.requestedReference,observedAt:_s()}}publishTerminalOutput(e,t,n){for(const[i,r]of function(e,t=6e4){const n=[];for(let i=0;i<e.length;i+=t)n.push(e.slice(i,i+t));return n}(n.data).entries())this.options.publish(In,{...this.eventBase(e,t),sequence:1e3*n.sequence+i,data:r,...n.replay?{replay:!0}:{}},e.id)}publishFinished(e,t,n,i){this.options.publish(An,{...this.eventBase(e,t),sequence:1e3*n,outcome:i},e.id)}}const ks=new Set(["DELETE","GET","HEAD","PATCH","POST","PUT","OPTIONS"]);function Cs(e){return"string"==typeof e&&ks.has(e.toUpperCase())?e.toUpperCase():"GET"}const xs=new Set(["content-encoding","content-length","transfer-encoding"]),Os=67108864;function Rs(e){return Object.fromEntries([...e.entries()].filter(([e])=>!xs.has(e.toLowerCase())))}function Ds(e){return e.bodyBase64?Buffer.from(e.bodyBase64,"base64"):e.body}function Ps(){const e=Number(process.env.TASK_HANDOFF_INSTANCE_PROXY_MAX_RESPONSE_BYTES);return Number.isSafeInteger(e)&&e>0?e:67108864}function js(e){return e.startsWith("/")?e:`/${e}`}function Ms(e,t){return e.code(502).send({error:{code:"INSTANCE_PROXY_RESPONSE_TOO_LARGE",message:`Instance response exceeds ${t} bytes.`}})}const Ls=a.z.object({version:a.z.literal(1),externalListener:Tn}).strict();function $s(e){return"all-ipv4"===e?"0.0.0.0":"127.0.0.1"}function Fs(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n=t.externalListener&&"object"==typeof t.externalListener&&!Array.isArray(t.externalListener)?t.externalListener:{},i=Object.keys(t).filter(e=>"version"!==e&&"externalListener"!==e),r=Object.keys(n).filter(e=>"bindScope"!==e&&"port"!==e);return(i.length||r.length)&&console.warn(JSON.stringify({message:"unknown stored node agent runtime setting fields were ignored",filePath:"runtime-settings.json",fields:[...i,...r.map(e=>`externalListener.${e}`)]})),{version:t.version,externalListener:{bindScope:n.bindScope,port:n.port}}}class Us{app;state;settings;sockets=new Set;config;source;status="error";error;updateQueue=Promise.resolve();constructor(e){this.app=e.app,this.state=e.state,this.settings=e.settings,this.config=e.config,this.source=e.source,this.app.server.on("connection",e=>{this.sockets.add(e),e.once("close",()=>this.sockets.delete(e))})}current(){return kn.parse({...this.config,host:$s(this.config.bindScope),status:this.status,source:this.source,...this.error?{error:this.error}:{}})}async start(){try{await this.listen(this.config),this.status="listening",this.error=void 0,this.state.setListenerPort(this.config.port)}catch(e){this.status="error",this.error=e instanceof Error?e.message:String(e),this.app.log.error({host:$s(this.config.bindScope),port:this.config.port,error:this.error},"node agent TCP listener failed to start; Unix IPC remains available")}return this.current()}update(e){const t=this.updateQueue.then(()=>this.updateOnce(e));return this.updateQueue=t.then(()=>{},()=>{}),t}async updateOnce(e){const t=Cn.parse(e);if(t.bindScope===this.config.bindScope&&t.port===this.config.port)return this.current();if(t.port!==this.config.port){const e=this.state.runningInstanceCount();if(e>0)throw Object.assign(new Error(`Cannot change the node agent port while ${e} controlled instance(s) are running.`),{statusCode:409,code:"NODE_AGENT_LISTENER_PORT_IN_USE_BY_INSTANCES",blockingInstanceCount:e})}const n=this.snapshot();await this.stop();try{await this.listen(t)}catch(e){throw await this.restore(n),Object.assign(new Error(`Failed to bind node agent TCP listener at ${$s(t.bindScope)}:${t.port}: ${e instanceof Error?e.message:String(e)}`),{statusCode:409,code:"NODE_AGENT_LISTENER_BIND_FAILED"})}try{this.settings.put({version:1,externalListener:t})}catch(e){throw await this.stop(),await this.restore(n),Object.assign(new Error(`Failed to persist node agent TCP listener: ${e instanceof Error?e.message:String(e)}`),{statusCode:500,code:"NODE_AGENT_LISTENER_PERSIST_FAILED"})}return this.config=t,this.source="persisted",this.status="listening",this.error=void 0,this.state.setListenerPort(t.port),this.current()}async shutdown(){await this.updateQueue,await this.stop()}snapshot(){return{config:this.config,source:this.source,status:this.status,error:this.error}}async restore(e){if(this.config=e.config,this.source=e.source,this.status=e.status,this.error=e.error,"listening"===e.status)try{await this.listen(e.config)}catch(e){this.status="error",this.error=`Failed to restore previous listener: ${e instanceof Error?e.message:String(e)}`,this.app.log.error({error:this.error},"node agent TCP listener rollback failed")}this.state.setListenerPort(e.config.port)}async listen(e){await new Promise((t,n)=>{const i=e=>{this.app.server.off("listening",r),n(e)},r=()=>{this.app.server.off("error",i),t()};this.app.server.once("error",i),this.app.server.once("listening",r),this.app.server.listen({host:$s(e.bindScope),port:e.port})})}async stop(){this.app.server.listening&&await new Promise((e,t)=>{this.app.server.close(n=>n?t(n):e());for(const e of this.sockets)e.destroy()})}}const Vs="TASK_HANDOFF_NODE_AGENT_V1",qs="/api/node-tunnel";function Hs(e=""){return c.createHash("sha256").update(e).digest("hex")}function Bs(e,t){return c.createHmac("sha256",e).update(function(e){return[Vs,e.keyId,e.method.toUpperCase(),e.pathWithQuery,e.timestamp,e.nonce,e.bodySha256].join("\n")}(t)).digest("hex")}function Ks(e){const t=e.timestamp||(new Date).toISOString(),n=e.nonce||c.randomBytes(18).toString("base64url"),i=Hs(e.body||""),r=Bs(e.secret,{keyId:e.keyId,method:e.method,pathWithQuery:e.pathWithQuery,timestamp:t,nonce:n,bodySha256:i});return{"x-taskhandoff-node-id":e.nodeId,"x-taskhandoff-key-id":e.keyId,"x-taskhandoff-timestamp":t,"x-taskhandoff-nonce":n,"x-taskhandoff-body-sha256":i,"x-taskhandoff-signature":r}}class Gs{usedNonces=new Map;identity;nodeId;overrideSecret;overrideKeyId;nowMs;constructor(e,t,n,i,r=Date.now){this.identity=e,this.nodeId=t,this.overrideSecret=n,this.overrideKeyId=i,this.nowMs=r}hasRemoteSecrets(){return this.identity.remoteSecrets(this.overrideSecret,this.overrideKeyId).length>0}verify(e){const t=function(e){const t=new Map;for(const[n,i]of Object.entries(e)){const e=Array.isArray(i)?i.join(","):"string"==typeof i?i:void 0===i?"":String(i);t.set(n.toLowerCase(),e)}return{nodeId:t.get("x-taskhandoff-node-id")||"",keyId:t.get("x-taskhandoff-key-id")||"",timestamp:t.get("x-taskhandoff-timestamp")||"",nonce:t.get("x-taskhandoff-nonce")||"",bodySha256:t.get("x-taskhandoff-body-sha256")||"",signature:t.get("x-taskhandoff-signature")||""}}(e.headers);if(!t.nodeId&&!t.signature)return!1;const n="DELETE"===e.method&&"/api/node-agent/pairing/current"===e.url.split("?")[0],i=this.identity.remoteSecrets(this.overrideSecret,this.overrideKeyId,n);if(!i.length)return!1;if(t.nodeId!==this.nodeId)throw Object.assign(new Error("Invalid node agent HMAC node id."),{statusCode:401,code:"NODE_AGENT_HMAC_NODE_MISMATCH"});if(!t.keyId)throw Object.assign(new Error("Node agent HMAC key id is missing."),{statusCode:401,code:"NODE_AGENT_HMAC_KEY_MISSING"});const r=i.filter(e=>t.keyId===e.keyId);if(!r.length)throw Object.assign(new Error("Invalid node agent HMAC key id."),{statusCode:401,code:"NODE_AGENT_HMAC_KEY_INVALID"});const s=Date.parse(t.timestamp);if(!Number.isFinite(s)||Math.abs(this.nowMs()-s)>6e4)throw Object.assign(new Error("Node agent HMAC timestamp is outside the allowed window."),{statusCode:401,code:"NODE_AGENT_HMAC_TIMESTAMP_INVALID"});if(!t.nonce)throw Object.assign(new Error("Node agent HMAC nonce is missing."),{statusCode:401,code:"NODE_AGENT_HMAC_NONCE_MISSING"});this.pruneNonces();const o=`${t.nodeId}:${t.keyId}:${t.nonce}`;if(this.usedNonces.has(o))throw Object.assign(new Error("Node agent HMAC nonce was already used."),{statusCode:401,code:"NODE_AGENT_HMAC_NONCE_REPLAY"});const a=Hs(null==(d=e.body)?"":"string"==typeof d||Buffer.isBuffer(d)?d:JSON.stringify(d));var d;if(t.bodySha256!==a)throw Object.assign(new Error("Node agent HMAC body hash mismatch."),{statusCode:401,code:"NODE_AGENT_HMAC_BODY_HASH_INVALID"});if(!r.some(n=>function(e,t){const n=Buffer.from(e,"hex"),i=Buffer.from(t,"hex");return n.length===i.length&&c.timingSafeEqual(n,i)}(t.signature,Bs(n.secret,{keyId:t.keyId,method:e.method,pathWithQuery:e.url,timestamp:t.timestamp,nonce:t.nonce,bodySha256:a}))))throw Object.assign(new Error("Invalid node agent HMAC signature."),{statusCode:401,code:"NODE_AGENT_HMAC_SIGNATURE_INVALID"});return this.usedNonces.set(o,s+6e4+1),t.keyId}pruneNonces(){const e=this.nowMs();for(const[t,n]of this.usedNonces)n<=e&&this.usedNonces.delete(t)}}const Js=a.z.string().trim().min(1).max(160),Ws=a.z.string().datetime(),Ys=a.z.string().min(1).max(4096),Xs=a.z.string().trim().url().max(2048),Qs=a.z.object({tokenHash:a.z.string().trim().min(1).max(256),expiresAt:Ws,createdAt:Ws,controlPlaneName:a.z.string().trim().min(1).max(160).optional()}).strip(),Zs=a.z.object({id:Js,keyId:Js,name:a.z.string().trim().min(1).max(160).optional(),secret:Ys,pairedAt:Ws,revokedAt:Ws.optional(),updatedAt:Ws}).strip(),eo=a.z.object({id:Js,pairingKeyId:Js,name:a.z.string().trim().min(1).max(160).optional(),url:Xs,enabled:a.z.boolean().default(!0),createdAt:Ws,updatedAt:Ws}).strip(),to=a.z.object({controlPlaneName:a.z.string().trim().min(1).max(160).optional(),controlPlaneUrl:a.z.string().trim().max(2048).optional(),expiresInMs:a.z.number().int().positive().max(36e5).optional()}).strict(),no=a.z.object({joinToken:a.z.string().trim().min(1).max(4096),controlPlaneId:a.z.string().trim().min(1).max(160).optional(),controlPlaneName:a.z.string().trim().min(1).max(160).optional()}).strict(),io=a.z.object({controlPlaneUrl:a.z.string().trim().url().max(2048),joinToken:a.z.string().trim().min(1).max(4096),controlPlaneName:a.z.string().trim().min(1).max(160).optional(),activate:a.z.boolean().optional()}).strict();function ro(){return(new Date).toISOString()}const so=new Set(["nodeId","createdAt","updatedAt","pairingInvites","controlPlanePairings","controlPlaneConnections","remoteControlPlanes"]),oo=new Set(["tokenHash","expiresAt","createdAt","controlPlaneName"]),ao=new Set(["id","keyId","name","secret","pairedAt","revokedAt","updatedAt"]),co=new Set(["id","pairingKeyId","name","url","enabled","createdAt","updatedAt"]),lo=new Set(["id","keyId","name","url","secret","pairedAt","updatedAt","active"]);function uo(e,t){console.warn(JSON.stringify({message:e,...t}))}function po(e,t){return Object.assign(new Error(e,void 0===t?void 0:{cause:t}),{code:"NODE_AGENT_IDENTITY_INVALID"})}function mo(e,t){return Object.keys(e).filter(e=>!t.has(e))}function go(e,t,n){const i=Ws.safeParse(e);return i.success?i.data:(n("invalid node agent identity timestamp was replaced",{field:t}),ro())}function ho(e,t){if(!e||"object"!=typeof e||Array.isArray(e))throw po("Node agent identity must be a JSON object.");const n=e,i=Js.safeParse(n.nodeId);if(!i.success)throw po("Node agent identity has an invalid nodeId.",i.error);const r=i.data,s=mo(n,so);s.length&&t("unknown node agent identity fields were ignored",{fields:s});const o=Array.isArray(n.remoteControlPlanes)?n.remoteControlPlanes.flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const n=e,i=mo(n,lo);i.length&&t("unknown legacy node agent remote control-plane fields were ignored",{fields:i});const r=Zs.safeParse(n);if(!r.success)return t("invalid legacy node agent control-plane pairing was ignored",{issues:r.error.issues}),[];const s=n.url?eo.safeParse({id:`connection_${r.data.keyId}`,pairingKeyId:r.data.keyId,name:n.name,url:n.url,enabled:!1!==n.active,createdAt:r.data.pairedAt,updatedAt:r.data.updatedAt}):void 0;return[{pairing:r.data,...s?.success?{connection:s.data}:{}}]}):[],a=(e,n,i,r)=>Array.isArray(e)?e.flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return t(`invalid node agent ${r} was ignored`,{}),[];const s=mo(e,n);s.length&&t(`unknown node agent ${r} fields were ignored`,{fields:s});const o=i.safeParse(e);return o.success?[o.data]:(t(`invalid node agent ${r} was ignored`,{issues:o.error.issues}),[])}):[];return{nodeId:r,createdAt:go(n.createdAt,"createdAt",t),updatedAt:go(n.updatedAt,"updatedAt",t),pairingInvites:Array.isArray(n.pairingInvites)?n.pairingInvites.flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return t("invalid node agent pairing invite was ignored",{}),[];const n=mo(e,oo);n.length&&t("unknown node agent pairing invite fields were ignored",{fields:n});const i=Qs.safeParse(e);return i.success?[i.data]:(t("invalid node agent pairing invite was ignored",{issues:i.error.issues}),[])}):[],controlPlanePairings:n.controlPlanePairings?a(n.controlPlanePairings,ao,Zs,"control-plane pairing"):o.map(e=>e.pairing),controlPlaneConnections:n.controlPlaneConnections?a(n.controlPlaneConnections,co,eo,"control-plane connection"):o.flatMap(e=>e.connection?[e.connection]:[])}}class fo{paths;logger;constructor(e,t={}){this.paths=e,this.logger=t.logger||uo}read(){let e,n;try{e=t.readFileSync(this.paths.identityPath,"utf8")}catch(e){if("ENOENT"===e.code)return;throw Object.assign(new Error(`Node agent identity could not be read: ${this.paths.identityPath}`,{cause:e}),{code:"NODE_AGENT_IDENTITY_READ_FAILED"})}try{n=JSON.parse(e)}catch(e){throw po(`Node agent identity contains invalid JSON: ${this.paths.identityPath}`,e)}return ho(n,this.logger)}write(e){t.mkdirSync(n.dirname(this.paths.identityPath),{recursive:!0});const i=ho({...e,updatedAt:ro()},this.logger);I.sync(this.paths.identityPath,`${JSON.stringify(i,null,2)}\n`,{encoding:"utf8",mode:384})}}function yo(){return(new Date).toISOString()}class Io{store;controlPlaneConnectionOperations=new Map;constructor(e){this.store=new fo(e)}async runControlPlaneConnectionOperation(e,t){const n=e.replace(/\/$/,""),i=this.controlPlaneConnectionOperations.get(n)||Promise.resolve();let r;const s=new Promise(e=>{r=e});this.controlPlaneConnectionOperations.set(n,s),await i;try{return await t()}finally{r(),this.controlPlaneConnectionOperations.get(n)===s&&this.controlPlaneConnectionOperations.delete(n)}}resolveNodeId(e){if(e?.trim())return this.writeNodeId(e.trim()),e.trim();const t=this.store.read();if(t?.nodeId)return t.nodeId;const n=Pr("node");return this.writeNodeId(n),n}createPairingInvite(e){const t=this.prunePairingInvites(this.store.read()||this.newIdentity()),n=yo(),i=new Date(Date.now()+(e.expiresInMs||6e5)).toISOString(),r=jr(),s={tokenHash:Hs(r),createdAt:n,expiresAt:i,...e.controlPlaneName?{controlPlaneName:e.controlPlaneName}:{}};return this.store.write({...t,pairingInvites:[...t.pairingInvites||[],s]}),{...s,token:r}}completePairingInvite(e){const t=this.prunePairingInvites(this.store.read()||this.newIdentity()),n=Hs(e.joinToken),i=(t.pairingInvites||[]).find(e=>e.tokenHash===n);if(!i){const e=new Error("Node agent pairing invite is invalid or expired.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_PAIRING_INVITE_INVALID"}),e}const r=yo(),s={id:e.controlPlaneId||Pr("cp"),keyId:Pr("key"),...e.controlPlaneName||i.controlPlaneName?{name:e.controlPlaneName||i.controlPlaneName}:{},secret:jr(),pairedAt:r,updatedAt:r};return this.store.write({...t,pairingInvites:(t.pairingInvites||[]).filter(e=>e.tokenHash!==n),controlPlanePairings:[...(t.controlPlanePairings||[]).filter(e=>e.id!==s.id),s]}),s}stageControlPlaneConnection(e){const{pairing:t,connection:n}=this.createControlPlaneConnection(e),i=this.store.read()||this.newIdentity(),r=n.url.replace(/\/$/,""),s=(i.controlPlaneConnections||[]).filter(e=>e.id===n.id||e.url.replace(/\/$/,"")===r);return this.store.write({...i,controlPlanePairings:[...(i.controlPlanePairings||[]).filter(e=>e.keyId!==t.keyId),t],controlPlaneConnections:[...(i.controlPlaneConnections||[]).filter(e=>e.id!==n.id&&e.url.replace(/\/$/,"")!==r),n]}),{pairing:t,connection:n,replacedConnections:s}}commitControlPlaneConnection(e,t={}){const n=this.store.read()||this.newIdentity(),i={...e.pairing,...t.name?{name:t.name}:{}},r={...e.connection,...t.name?{name:t.name}:{}},s=new Set((n.controlPlaneConnections||[]).map(e=>e.pairingKeyId)),o=new Set(e.replacedConnections.map(e=>e.pairingKeyId));return this.store.write({...n,controlPlanePairings:[...(n.controlPlanePairings||[]).filter(e=>e.keyId!==i.keyId&&(!o.has(e.keyId)||s.has(e.keyId))),i],controlPlaneConnections:[...(n.controlPlaneConnections||[]).filter(e=>e.id!==r.id),r]}),{pairing:i,connection:r}}rollbackControlPlaneConnection(e){const t=this.store.read();if(!t)return;const n=new Set(e.replacedConnections.map(e=>e.id));this.store.write({...t,controlPlanePairings:(t.controlPlanePairings||[]).filter(t=>t.keyId!==e.pairing.keyId),controlPlaneConnections:[...(t.controlPlaneConnections||[]).filter(t=>t.id!==e.connection.id&&!n.has(t.id)),...e.replacedConnections]})}createControlPlaneConnection(e){const t=yo(),n={id:Pr("cp"),keyId:Pr("key"),...e.name?{name:e.name}:{},secret:jr(),pairedAt:t,updatedAt:t};return{pairing:n,connection:{id:Pr("connection"),pairingKeyId:n.keyId,...e.name?{name:e.name}:{},url:e.url,enabled:!1!==e.enabled,createdAt:t,updatedAt:t}}}resolvedControlPlaneAccess(){const e=this.store.read(),t=new Map((e?.controlPlanePairings||[]).filter(e=>!e.revokedAt).map(e=>[e.keyId,e])),n=e?.controlPlaneConnections||[];return{hasPersistedAccess:n.length>0||t.size>0,connections:n.map(e=>({connection:e,pairing:t.get(e.pairingKeyId)}))}}listControlPlanePairings(e=""){return(this.store.read()?.controlPlanePairings||[]).filter(e=>!e.revokedAt).map(({secret:t,...n})=>({...n,current:Boolean(e&&n.keyId===e)})).sort((e,t)=>Number(t.current)-Number(e.current)||t.updatedAt.localeCompare(e.updatedAt))}listControlPlaneConnections(){return[...this.store.read()?.controlPlaneConnections||[]].sort((e,t)=>t.updatedAt.localeCompare(e.updatedAt))}deleteControlPlanePairing(e,t=""){if(t&&e===t){const e=new Error("Cannot delete the pairing used to authenticate the current request.");throw Object.assign(e,{statusCode:409,code:"NODE_AGENT_PAIRING_CURRENT_REQUEST"}),e}const n=this.store.read();if(!n)return!1;if((n.controlPlaneConnections||[]).some(t=>t.pairingKeyId===e))throw Object.assign(new Error("Cannot delete a pairing used by a configured control-plane connection."),{statusCode:409,code:"NODE_AGENT_PAIRING_IN_USE"});const i=(n.controlPlanePairings||[]).filter(t=>t.keyId!==e);return i.length!==(n.controlPlanePairings||[]).length&&(this.store.write({...n,controlPlanePairings:i}),!0)}revokeCurrentControlPlanePairing(e){if(!e)throw Object.assign(new Error("Current paired-HMAC authentication is required to revoke this pairing."),{statusCode:403,code:"NODE_AGENT_PAIRING_SELF_REVOKE_HMAC_REQUIRED"});const t=this.store.read(),n=t?.controlPlanePairings?.find(t=>t.keyId===e);if(!t||!n)throw Object.assign(new Error("The current control-plane pairing no longer exists."),{statusCode:404,code:"NODE_AGENT_PAIRING_NOT_FOUND"});if(n.revokedAt)return{keyId:e,revoked:!0,revokedAt:n.revokedAt};if((t.controlPlaneConnections||[]).some(t=>t.pairingKeyId===e))throw Object.assign(new Error("Cannot revoke a pairing used by a configured control-plane connection."),{statusCode:409,code:"NODE_AGENT_PAIRING_IN_USE"});const i=yo();return this.store.write({...t,controlPlanePairings:t.controlPlanePairings.map(t=>t.keyId===e?{...t,revokedAt:i,updatedAt:i}:t)}),{keyId:e,revoked:!0,revokedAt:i}}deleteControlPlaneConnection(e){const t=this.store.read();if(!t)return!1;const n=(t.controlPlaneConnections||[]).filter(t=>t.id!==e);return n.length!==(t.controlPlaneConnections||[]).length&&(this.store.write({...t,controlPlaneConnections:n}),!0)}remoteSecrets(e,t,n=!1){return[...(this.store.read()?.controlPlanePairings||[]).filter(e=>n||!e.revokedAt).map(e=>({keyId:e.keyId,secret:e.secret})),...e&&t?[{keyId:t,secret:e}]:[]]}isRevokedPairing(e){return Boolean(this.store.read()?.controlPlanePairings?.some(t=>t.keyId===e&&t.revokedAt))}reverseTunnelSecret(e,t,n){if(t&&n)return{keyId:n,secret:t};const i=this.store.read(),r=(i?.controlPlanePairings||[]).filter(e=>!e.revokedAt);if(!r.length)return;if(e){const t=e.replace(/\/$/,""),n=(i?.controlPlaneConnections||[]).find(e=>e.url.replace(/\/$/,"")===t),s=n&&r.find(e=>e.keyId===n.pairingKeyId);if(s)return{keyId:s.keyId,secret:s.secret}}const s=[...r].sort((e,t)=>t.updatedAt.localeCompare(e.updatedAt))[0];return s?{keyId:s.keyId,secret:s.secret}:void 0}newIdentity(){return{nodeId:this.resolveNodeId(),createdAt:yo(),updatedAt:yo(),pairingInvites:[],controlPlanePairings:[],controlPlaneConnections:[]}}writeNodeId(e){const t=this.store.read();this.store.write({...t||{createdAt:yo()},nodeId:e,updatedAt:yo(),pairingInvites:t?.pairingInvites||[],controlPlanePairings:t?.controlPlanePairings||[],controlPlaneConnections:t?.controlPlaneConnections||[]})}prunePairingInvites(e){const t=Date.now();return{...e,pairingInvites:(e.pairingInvites||[]).filter(e=>Date.parse(e.expiresAt)>t)}}}const Ao=a.z.string().trim().min(1).max(160);const bo=jt.strict();function wo(e){const t=e.filter(e=>!["created","stopped","failed"].includes(e.status)),n=new Set(t.map(e=>e.id)),i=t.filter(e=>e.apps.runningCount>0||e.aiSessions.runningCount>0);return{runningInstanceCount:t.length,stoppedInstanceCount:e.length-t.length,activeInstanceCount:i.length,restartInstanceCount:t.length,runningInstanceIds:t.map(e=>e.id).sort(),stoppedInstanceIds:e.filter(e=>!n.has(e.id)).map(e=>e.id).sort(),activeInstanceIds:i.map(e=>e.id).sort()}}class vo{preflights=new Map;options;constructor(e){this.options=e}async check(e){const t=Rt.parse(e),n=wo(this.options.listInstances()),i=await Yr(this.options.runCommand),r=this.options.currentRuntimeVersion(),s="@task-handoff/server"===i.packageName?[...new Set([...i.relatedCurrentVersions,r])]:i.relatedCurrentVersions,o=await async function(e){const t=e.packageName||"@task-handoff/node-agent",n=await async function(e,t,n){const i=function(e){return"stable"===e?"latest":e}(n),r=await e(Jr(),["view",`${t}@${i}`,"version","--json"]).catch(e=>{if(!function(e){if(!e||"object"!=typeof e)return!1;const t=e,n=[t.message,t.details?.stdout,t.details?.stderr].filter(e=>"string"==typeof e).join("\n");return/\bE404\b/i.test(n)}(e))throw e});if(!r)return;const s=JSON.parse(r.stdout);if("string"!=typeof s)throw new Error(`npm did not resolve ${t}@${i} to one version.`);return s}(e.runCommand,t,e.channel);if(!n)return function(e){return Dt.parse({source:"npm",channel:e.channel,currentVersion:e.currentVersion,availableVersion:e.currentVersion||"unavailable",impact:e.impact||{runningInstanceCount:0,stoppedInstanceCount:0,activeInstanceCount:0,restartInstanceCount:0,runningInstanceIds:[],stoppedInstanceIds:[],activeInstanceIds:[]},updateAvailable:!1,reason:`No ${e.channel} release is currently published.`,checkedAt:Kr()})}({channel:e.channel,currentVersion:e.currentVersion,impact:e.impact});const i=Gr(e.currentVersion,n)||(e.relatedCurrentVersions||[]).some(e=>Gr(e,n)),r=i?await async function(e,t,n){const i=await e(Jr(),["view",`${t}@${n}`,"dist.integrity","--json"]),r=JSON.parse(i.stdout);if("string"!=typeof r||!/^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(r))throw Object.assign(new Error(`npm did not return immutable integrity metadata for ${t}@${n}.`),{statusCode:502,code:"NODE_UPDATE_PREFLIGHT_FAILED",retryable:!0});return r}(e.runCommand,t,n):void 0;return Dt.parse({source:"npm",channel:e.channel,currentVersion:e.currentVersion,availableVersion:n,...r?{artifactRef:`npm:${t}@${n}#${r}`}:{},runtimeArtifacts:e.runtimeArtifacts||[],impact:e.impact||{runningInstanceCount:0,stoppedInstanceCount:0,activeInstanceCount:0,restartInstanceCount:0,runningInstanceIds:[],stoppedInstanceIds:[],activeInstanceIds:[]},updateAvailable:i,checkedAt:Kr()})}({channel:t.channel,currentVersion:i.currentVersion||r,runCommand:this.options.runCommand,packageName:i.packageName,relatedCurrentVersions:s,impact:n});if(!o.updateAvailable)return o;const a={...o,runtimeArtifacts:await this.options.resolveRuntimeArtifacts(o.availableVersion),preflightToken:jr()};return this.preflights.set(a.preflightToken,{result:a,expiresAt:Date.now()+6e5}),a}async apply(e){const i=bo.parse(e),r=await this.consumePreflight(i);if(!r.supported)throw Object.assign(new Error(r.reason||"The requested update is not supported."),{statusCode:400,code:"UPDATE_UNSUPPORTED"});if(!r.updateAvailable)throw Object.assign(new Error(r.reason||"No update is available for the selected channel."),{statusCode:409,code:"UPDATE_NOT_AVAILABLE"});const s=this.options.jobs.create(this.options.nodeId,r),{worker:o,packaged:a,expectedWorker:c}=function(e,i=t.existsSync){const r=[n.resolve(e,"..","bin","task-handoff-node-update-worker"),n.resolve(e,"..","..","bin","task-handoff-node-update-worker")],s=r.find(i),o=n.resolve(e,"..","..","..","..","scripts","node-update-worker.cjs");return s?{worker:s,packaged:!0,expectedWorker:r[0]}:i(o)?{worker:o,packaged:!1,expectedWorker:r[0]}:{worker:void 0,packaged:!1,expectedWorker:r[0]}}(this.options.moduleDir);if(!o)throw this.options.jobs.patch(s.id,{status:"failed",rollout:{...s.rollout,phase:"failed"},error:{code:"NODE_UPDATE_FAILED",message:`Update worker was not found: ${c}`,retryable:!1},completedAt:(new Date).toISOString()}),Object.assign(new Error(`Node agent update worker was not found: ${c}`),{statusCode:500,code:"UPDATE_WORKER_NOT_FOUND"});const d=process.env.TASK_HANDOFF_CONTROL_PLANE_HEALTH_URL?.trim();try{await this.options.runCommand("systemd-run",["--unit",`task-handoff-update-${s.id}`,"--collect","--property=Type=exec",...a?[o]:[process.execPath,o],"--job-file",this.options.jobs.records.filePath(s.id),"--target-version",s.toVersion,"--npm-command",Jr(),...d?["--control-plane-health-url",d]:[]])}catch(e){const t=e instanceof Error?e.message:String(e);throw this.options.jobs.patch(s.id,{status:"failed",rollout:{...s.rollout,phase:"failed"},error:{code:"NODE_UPDATE_FAILED",message:`Failed to launch the node update worker: ${t}`,retryable:!0},completedAt:(new Date).toISOString()}),Object.assign(new Error(`Failed to launch the node update worker: ${t}`),{statusCode:500,code:"NODE_UPDATE_WORKER_LAUNCH_FAILED",cause:e})}return s}async consumePreflight(e){const t=this.preflights.get(e.preflightToken);if(this.preflights.delete(e.preflightToken),!t||t.expiresAt<=Date.now())throw Object.assign(new Error("The update preflight is missing or expired. Check for updates again."),{statusCode:409,code:"UPDATE_PREFLIGHT_EXPIRED"});const n=t.result,i=await Yr(this.options.runCommand);n.channel===e.channel&&n.availableVersion===e.targetVersion&&n.currentVersion===(i.currentVersion||this.options.currentRuntimeVersion())&&!0===n.artifactRef?.startsWith(`npm:${i.packageName}@`)&&JSON.stringify(n.impact)===JSON.stringify(wo(this.options.listInstances()))||this.throwStale();const r=await this.options.resolveRuntimeArtifacts(n.availableVersion);return JSON.stringify(n.runtimeArtifacts)!==JSON.stringify(r)&&this.throwStale(),n}throwStale(){throw Object.assign(new Error("The update target or affected instances changed after preflight. Check for updates again."),{statusCode:409,code:"UPDATE_PREFLIGHT_STALE"})}}const Eo=new Set(["provisioning","starting","registering","registered","running"]);function No(e){return Mn.parse({...e,health:"unknown",connectionStatus:"offline",agentStatus:"offline",targetStatus:"unknown",uiAccessStatus:"unknown",target:{...e.target,status:"unknown"},updatedAt:(new Date).toISOString()})}class zo{options;restoredInstances=new Set;restoreErrors=new Map;unexpectedExitRetries=new Map;suppressedInstances=new Set;pendingUnexpectedExits=new Map;activeRestores=new Map;timer;activeCycle;cycleRequested=!1;cycleRequestDelayMs;started=!1;stopped=!1;constructor(e){this.options=e}markRestored(e){const t=this.options.state.requireInstance(e).status;return!["failed","stopping","stopped"].includes(t)&&(this.restoredInstances.add(e),this.restoreErrors.delete(e),!0)}allowRecovery(e){this.suppressedInstances.delete(e);const t=this.pendingUnexpectedExits.get(e);void 0!==t&&(this.pendingUnexpectedExits.delete(e),this.applyUnexpectedLocalExit(e,t))}completeSuppressedOperation(e){this.pendingUnexpectedExits.delete(e),this.restoredInstances.delete(e),this.restoreErrors.delete(e),this.unexpectedExitRetries.delete(e)}forgetInstance(e){this.restoredInstances.delete(e),this.restoreErrors.delete(e),this.unexpectedExitRetries.delete(e),this.suppressedInstances.delete(e),this.activeRestores.delete(e),this.pendingUnexpectedExits.delete(e)}async suppressRecovery(e){this.suppressedInstances.add(e),await(this.activeRestores.get(e)?.catch(()=>{}))}handleUnexpectedLocalExit(e,t){this.stopped||(this.suppressedInstances.has(e)?this.pendingUnexpectedExits.set(e,t):this.applyUnexpectedLocalExit(e,t))}applyUnexpectedLocalExit(e,t){const n=this.options.state.requireInstance(e);if("local"!==this.options.state.requireRuntime(n.runtimeId).type)return;this.restoredInstances.delete(e);const i=this.options.nowMs?.()??Date.now(),r=this.unexpectedExitRetries.get(e),s=this.options.crashStableWindowMs??3e4,o=r&&i-r.lastExitAt<s?r.attempt+1:1;this.unexpectedExitRetries.set(e,{attempt:o,lastExitAt:i});const a=this.options.retryBaseDelayMs??1e3,c=1===o?0:Math.min(this.options.retryMaxDelayMs??3e4,a*2**Math.min(o-2,10)),d=t instanceof Error?t.message:String(t);this.restoreErrors.set(e,{message:d,attempt:o,nextAttemptAt:i+c}),this.options.state.applyInstanceLifecycle(e,{type:"runtime-exited",error:t}),this.requestCycle(c)}async restoreManagedInstances(){if(this.stopped)return;const{state:e}=this.options;for(const t of e.listInstances()){if(this.stopped)return;"docker"===e.requireRuntime(t.runtimeId).type&&["provisioning","starting"].includes(t.status)&&"ready"!==t.imageProvisioning?.phase&&this.options.provisionImage(t)}const t=e.listInstances().filter(t=>{if(this.restoredInstances.has(t.id))return!1;if(this.suppressedInstances.has(t.id))return!1;const n=e.requireRuntime(t.runtimeId);if("local"===n.type){const e=this.restoreErrors.get(t.id);return(Eo.has(t.status)||"failed"===t.status)&&(!e||e.nextAttemptAt<=(this.options.nowMs?.()??Date.now()))}return"docker"===n.type&&(Eo.has(t.status)||"provisioning"===t.status&&"ready"===t.imageProvisioning?.phase)});await Promise.all(t.map(async t=>{if(this.stopped)return;const n=async()=>{if(this.stopped)return;const n=e.listInstances().find(e=>e.id===t.id);if(!n)return;if(!this.isRestoreCandidate(n))return;const i=this.restoreErrors.get(n.id);try{const t=this.options.restoreInstance(n.id);this.activeRestores.set(n.id,t);try{await t}finally{this.activeRestores.get(n.id)===t&&this.activeRestores.delete(n.id)}if(this.stopped||this.suppressedInstances.has(n.id))return;if(await this.options.autoImport(e.requireInstance(n.id)),this.stopped||this.suppressedInstances.has(n.id))return;if(this.restoreErrors.get(n.id)!==i)return;if(!this.markRestored(n.id))throw new Error(`Restored instance ${n.id} did not reach a recoverable running state.`)}catch(t){if(this.stopped||this.suppressedInstances.has(n.id))return;"local"===e.requireRuntime(n.runtimeId).type&&e.applyInstanceLifecycle(n.id,{type:"start-failed",error:t});const i=t instanceof Error?t.message:String(t),r=this.restoreErrors.get(n.id),s=(r?.attempt??0)+1,o=this.options.retryBaseDelayMs??1e3,a=Math.min(this.options.retryMaxDelayMs??3e4,o*2**Math.min(s-1,10)),c=(this.options.nowMs?.()??Date.now())+a;this.restoreErrors.set(n.id,{message:i,attempt:s,nextAttemptAt:c}),r?.message===i&&r.attempt===s||this.options.warn({instanceId:n.id,action:"restore",runtimeId:n.runtimeId,error:i,attempt:s,nextAttemptAt:new Date(c).toISOString()},"node instance restore failed; recovery will retry")}};await(this.options.runInstanceOperation?.(t.id,n)??n())}))}isRestoreCandidate(e){if(this.restoredInstances.has(e.id)||this.suppressedInstances.has(e.id))return!1;const t=this.options.state.requireRuntime(e.runtimeId);if("local"===t.type){const t=this.restoreErrors.get(e.id);return(Eo.has(e.status)||"failed"===e.status)&&(!t||t.nextAttemptAt<=(this.options.nowMs?.()??Date.now()))}return"docker"===t.type&&(Eo.has(e.status)||"provisioning"===e.status&&"ready"===e.imageProvisioning?.phase)}async recoverManagedInstances(){if(this.stopped)return;const{state:e,convergence:t}=this.options,n=e.listInstances().filter(e=>this.options.usesManagedArtifact(e)&&!t.isRunning(e.id)&&(this.restoredInstances.has(e.id)||"unknown"!==e.target.status)&&(!e.ready||"matched"!==e.runtimeVersion?.phase)&&!["created","stopped","failed","provisioning","stopping"].includes(e.status));await Promise.all(n.map(async e=>{if(!this.stopped)try{await t.schedule(e.id)}catch(t){this.options.error({instanceId:e.id,error:t},"runtime convergence recovery failed")}}))}start(){this.started||this.stopped||(this.started=!0,this.runAndContinue())}async stop(){this.stopped=!0,this.timer&&clearTimeout(this.timer),this.timer=void 0;const e=this.options.stopImageProvisioning(),t=this.options.state.listInstances().map(e=>this.options.convergence.cancel(e.id));await Promise.all(t),await this.activeCycle,await e,await this.options.runtimeAdapters.stopAll();for(const e of this.options.state.listInstances())"local"===this.options.state.requireRuntime(e.runtimeId).type&&this.options.state.controlledInstances.put(No(e))}async runCycle(){await this.restoreManagedInstances(),this.stopped||await this.recoverManagedInstances()}runAndContinue(){if(this.stopped)return;const e=this.runCycle().catch(e=>this.options.error({error:e},"node agent startup recovery cycle failed"));this.activeCycle=e,e.finally(()=>{this.activeCycle===e&&(this.activeCycle=void 0),this.cycleRequested?(this.cycleRequested=!1,this.cycleRequestDelayMs=void 0,this.scheduleNext()):this.scheduleNext()})}scheduleNext(){if(this.stopped)return;const e=this.options.nowMs?.()??Date.now(),t=new Map(this.options.state.listInstances().map(e=>[e.id,e])),n=[...this.restoreErrors.entries()].reduce((e,[n,i])=>{const r=t.get(n);return!r||this.restoredInstances.has(n)||this.suppressedInstances.has(n)||"local"!==this.options.state.requireRuntime(r.runtimeId).type?e:Eo.has(r.status)||"failed"===r.status?Math.min(e,i.nextAttemptAt):e},Number.POSITIVE_INFINITY),i=Math.min(this.options.intervalMs??1e4,Math.max(0,n-e));this.timer=setTimeout(()=>{this.timer=void 0,this.runAndContinue()},i),this.timer.unref?.()}requestCycle(e=0){if(this.started&&!this.stopped){if(this.activeCycle)return this.cycleRequested=!0,void(this.cycleRequestDelayMs=void 0===this.cycleRequestDelayMs?e:Math.min(this.cycleRequestDelayMs,e));this.timer&&clearTimeout(this.timer),this.timer=setTimeout(()=>{this.timer=void 0,this.runAndContinue()},e),this.timer.unref?.()}}}function So(e){return e.readyState===(e.OPEN??1)}function _o(e){const t=Buffer.isBuffer(e)?e.toString("utf8"):"string"==typeof e?e:"";if(Buffer.byteLength(t,"utf8")<=123)return t;let n="";for(const e of t){const t=`${n}${e}`;if(Buffer.byteLength(t,"utf8")>123)break;n=t}return n}function To(e){if("number"==typeof e&&Number.isInteger(e))return e>=3e3&&e<=4999||e>=1e3&&e<=1014&&1004!==e&&1005!==e&&1006!==e?e:void 0}function ko(e,t,n){e.close(To(t),_o(n)||void 0)}function Co(e,t,n,i){if(So(e))for(const e of t.splice(0))if(i(e),!n(e))return}function xo(e,t){const n=new URL(t.tunnelUrl);n.searchParams.set("nodeId",t.nodeId);const i=t.secret?Ks({nodeId:t.nodeId,keyId:t.keyId,secret:t.secret,method:"GET",pathWithQuery:`${n.pathname}${n.search}`}):{},r=new u(n,{headers:i}),s=new Map,o=new Map,a=new Map;let c;r.on("error",i=>{e.log.warn({nodeId:t.nodeId,tunnelUrl:`${n.origin}${n.pathname}`,error:i instanceof Error?i.message:String(i)},"node agent reverse tunnel connection failed")});const d=e=>{const n=e.startsWith("/")?e:`/${e}`,i="function"==typeof t.port?t.port():t.port,r=new URL(`/api/node-agent${n}`,`http://127.0.0.1:${i}`);return r.protocol="ws:",r},l=(e,n,i,r={})=>{const s=e.startsWith("/")?e:`/${e}`;return{...r,...t.secret&&t.keyId?Ks({nodeId:t.nodeId,keyId:t.keyId,secret:t.secret,method:n,pathWithQuery:`/api/node-agent${s}`,body:i}):t.token?{authorization:`Bearer ${t.token}`}:{}}},p=e=>t.secret?Ks({nodeId:t.nodeId,keyId:t.keyId,secret:t.secret,method:"GET",pathWithQuery:`${e.pathname}${e.search}`}):{},m=(e,t,n)=>{const i=s.get(e);s.delete(e),i?.upstream&&ko(i.upstream,t,n),i?.tunnel&&ko(i.tunnel,t,n)},g=(e,t,n=!1)=>new Promise((i,r)=>{e.send(t,{binary:n},e=>e?r(e):i())});r.on("open",()=>{r.send(JSON.stringify({type:"node-agent.identify",nodeId:t.nodeId,serverTime:(new Date).toISOString()})),c=e.nodeAgentEventForwarder?.addOutput(r)}),r.on("close",()=>{for(const e of s.keys())m(e,1001,"Reverse tunnel disconnected.");for(const[e,t]of o)o.delete(e),t.controller.abort(),ko(t.tunnel,1001,"Reverse tunnel disconnected.");for(const[e,t]of a)a.delete(e),t.abort();c?.(),c=void 0});return r.on("message",i=>{(async i=>{let c;try{c=JSON.parse(String(i))}catch{return void r.send(JSON.stringify({type:"node-agent.error",code:"INVALID_JSON"}))}const h=c&&"object"==typeof c?c:{};if("control-plane.http.open"===h.type){const i="string"==typeof h.streamId?h.streamId:"",s="string"==typeof h.route&&h.route.startsWith("/")?h.route:"/health",a=h.init&&"object"==typeof h.init?h.init:{},c=a.headers&&"object"==typeof a.headers?a.headers:{},d=Cs(a.method);let m;try{m=Ge(a.body)}catch(n){return e.log.warn({nodeId:t.nodeId,messageType:h.type,streamId:i,error:n instanceof Error?n.message:String(n)},"node agent reverse tunnel request body rejected"),void r.send(JSON.stringify({type:"node-agent.error",code:"NODE_TUNNEL_REQUEST_BODY_INVALID",streamId:i}))}const f=new AbortController,y=(e=>{const t=new URL(n);return t.pathname=`${t.pathname.replace(/\/$/,"")}/http-streams/${encodeURIComponent(e)}`,t})(i),I=new u(y,{headers:p(y)});return o.set(i,{tunnel:I,controller:f}),I.on("open",async()=>{try{const e=await fetch((e=>{const n=e.startsWith("/")?e:`/${e}`,i="function"==typeof t.port?t.port():t.port;return new URL(`/api/node-agent${n}`,`http://127.0.0.1:${i}`)})(s),{method:d,headers:l(s,d,m,c),body:Buffer.isBuffer(m)?new Uint8Array(m):m,signal:f.signal});if(await g(I,JSON.stringify({type:"node-agent.http.head",streamId:i,status:e.status,headers:Object.fromEntries(e.headers.entries())})),e.body){const t=e.body.getReader();for(;;){const{done:e,value:n}=await t.read();if(e)break;await g(I,Buffer.from(n),!0)}}await g(I,JSON.stringify({type:"node-agent.http.end",streamId:i})),I.close(1e3,"HTTP stream completed.")}catch(e){I.readyState===u.OPEN&&(await g(I,JSON.stringify({type:"node-agent.http.error",streamId:i,message:e instanceof Error?e.message:String(e)})).catch(()=>{}),I.close(1011,"HTTP stream failed."))}finally{o.delete(i)}}),I.on("close",()=>{f.abort(),o.delete(i)}),void I.on("error",()=>f.abort())}if("control-plane.http.cancel"===h.type){const e="string"==typeof h.streamId?h.streamId:"",t=o.get(e);if(!t)return;return o.delete(e),t.controller.abort(),void ko(t.tunnel,1e3,"string"==typeof h.reason?h.reason:"HTTP stream canceled.")}if("control-plane.websocket.open"===h.type){const e="string"==typeof h.streamId?h.streamId:"",t="string"==typeof h.route?h.route:"",i=Array.isArray(h.protocols)?h.protocols.filter(e=>"string"==typeof e):void 0;try{const o=l(t,"GET",void 0),a=i?.length?new u(d(t),i,{headers:o}):new u(d(t),{headers:o}),c=(e=>{const t=new URL(n);return t.pathname=`${t.pathname.replace(/\/$/,"")}/streams/${encodeURIComponent(e)}`,t})(e),m=new u(c,{headers:p(c)});s.set(e,{upstream:a,tunnel:m,close:(e=1e3,t="")=>{ko(a,e,t),ko(m,e,t)}}),a.on("open",()=>{r.send(JSON.stringify({type:"node-agent.websocket.open",streamId:e,protocol:a.protocol}))}),function(e,t,n={}){const i=n.pendingFrameLimit??256,r=n.maxFrameBytes??8388608,s=n.maxTotalBytes??1073741824,o=n.maxBufferedBytes??16777216;let a=!1,c=So(t);const d=[],l=[];let u,p=0,m=0,g=0;const h=e=>Buffer.isBuffer(e)||e instanceof ArrayBuffer||ArrayBuffer.isView(e)?e.byteLength:Buffer.byteLength("string"==typeof e?e:String(e),"utf8"),f=(i,o)=>{const a=h(o);return g+=a,n.onFrame?.(i,a),!(a>r||g>s)||(ko(e,1009,"WebSocket bridge traffic limit exceeded."),ko(t,1009,"WebSocket bridge traffic limit exceeded."),!1)},y=()=>{u&&(clearTimeout(u),u=void 0)},I=(n,i)=>{const r=i.bytes;if((n.bufferedAmount??0)+r>o)return ko(e,1013,"WebSocket bridge consumer is too slow."),ko(t,1013,"WebSocket bridge consumer is too slow."),!1;try{return function(e,t){e.send(t.data,{binary:t.isBinary})}(n,i),!0}catch{return ko(e,1011,"WebSocket bridge send failed."),ko(t,1011,"WebSocket bridge send failed."),!1}},A=(n,r,s)=>{if(r.length>=i)return ko(e,1011,"WebSocket bridge pending frame limit exceeded."),void ko(t,1011,"WebSocket bridge pending frame limit exceeded.");const a="upstream"===n?p:m;if((("upstream"===n?t:e).bufferedAmount??0)+a+s.bytes>o)return ko(e,1013,"WebSocket bridge consumer is too slow."),void ko(t,1013,"WebSocket bridge consumer is too slow.");r.push(s),"upstream"===n?p+=s.bytes:m+=s.bytes};n.upstreamOpenTimeoutMs&&!c&&(u=setTimeout(()=>{c||a||(ko(e,1011,"Upstream websocket did not open."),ko(t))},n.upstreamOpenTimeoutMs)),e.on("open",()=>Co(e,l,t=>I(e,t),e=>{m-=e.bytes})),t.on("open",()=>{y(),c=!0,n.onUpstreamOpen?.(),Co(t,d,e=>I(t,e),e=>{p-=e.bytes})}),e.on("message",(e,n=!1)=>{if(!f("client-to-upstream",e))return;const i={data:e,isBinary:Boolean(n),bytes:h(e)};So(t)?I(t,i):A("upstream",d,i)}),t.on("message",(t,n=!1)=>{if(!f("upstream-to-client",t))return;const i={data:t,isBinary:Boolean(n),bytes:h(t)};So(e)?I(e,i):A("client",l,i)}),t.on("close",(t,i)=>{y(),n.onUpstreamClose?.(t,i),(c||a||!n.onUpstreamCloseBeforeOpen?.())&&ko(e,t,i)}),t.on("error",t=>{n.onUpstreamError?.(t),(c||a||!n.onUpstreamErrorBeforeOpen?.(t))&&ko(e)}),e.on("close",(e,i)=>{y(),a=!0,n.onClientClose?.(e,i),ko(t,e,i)}),e.on("error",e=>{y(),a=!0,n.onClientError?.(e),ko(t,1011,"WebSocket bridge client failed.")})}(m,a,{pendingFrameLimit:256,upstreamOpenTimeoutMs:1e4,onClientClose:()=>{s.delete(e)},onClientError:t=>{s.delete(e),r.send(JSON.stringify({type:"node-agent.websocket.error",streamId:e,message:t instanceof Error?t.message:String(t)}))},onUpstreamClose:(t,n)=>{s.delete(e);const i=To(t),o=_o(n);r.send(JSON.stringify({type:"node-agent.websocket.close",streamId:e,...void 0===i?{}:{code:i},...o?{reason:o}:{}}))},onUpstreamError:t=>{s.delete(e),r.send(JSON.stringify({type:"node-agent.websocket.error",streamId:e,message:t instanceof Error?t.message:String(t)}))}})}catch(t){r.send(JSON.stringify({type:"node-agent.websocket.error",streamId:e,message:t instanceof Error?t.message:String(t)}))}return}if("control-plane.websocket.close"===h.type){const e="string"==typeof h.streamId?h.streamId:"";return void m(e,"number"==typeof h.code?h.code:1e3,"string"==typeof h.reason?h.reason:"")}if("control-plane.request.cancel"===h.type){const e="string"==typeof h.requestId?h.requestId:"";return a.get(e)?.abort(),void a.delete(e)}if("control-plane.request"===h.type){const n="string"==typeof h.requestId?h.requestId:"",i=h.init&&"object"==typeof h.init?h.init:{},s="string"==typeof h.route&&h.route.startsWith("/")?h.route:"/health",o=i.headers&&"object"==typeof i.headers?i.headers:{},c=Cs(i.method);let d;try{d=Ge(i.body)}catch(i){return e.log.warn({nodeId:t.nodeId,messageType:h.type,requestId:n,error:i instanceof Error?i.message:String(i)},"node agent reverse tunnel request body rejected"),void r.send(JSON.stringify({type:"node-agent.response",requestId:n,status:400,error:{code:"NODE_TUNNEL_REQUEST_BODY_INVALID",message:"Reverse tunnel request body does not match the negotiated protocol."}}))}const u=new AbortController;a.set(n,u);try{const t=await e.inject({method:c,url:`/api/node-agent${s}`,headers:l(s,c,d,o),payload:d,signal:u.signal});if(u.signal.aborted)return;r.send(JSON.stringify({type:"node-agent.response",requestId:n,status:t.statusCode,headers:t.headers,body:t.body}))}catch(e){if(u.signal.aborted)return;r.send(JSON.stringify({type:"node-agent.response",requestId:n,status:502,error:{code:"NODE_AGENT_REVERSE_INJECT_FAILED",message:e instanceof Error?e.message:String(e)}}))}finally{a.delete(n)}}})(i).catch(n=>{e.log.warn({nodeId:t.nodeId,error:n instanceof Error?n.message:String(n)},"node agent reverse tunnel message rejected");try{r.send(JSON.stringify({type:"node-agent.error",code:"INVALID_TUNNEL_MESSAGE"}))}catch{}})}),r}function Oo(e){const t=new URL(qs,e);return t.protocol="https:"===t.protocol?"wss:":"ws:",t.toString()}const Ro=new Set(["linux","darwin","win32","freebsd","openbsd","aix","sunos"]);function Do(e){return Ro.has(e)?e:"unknown"}function Po(e){return!0===e.managedArtifacts}class jo{managedArtifacts=!0;executor;runCommand;platform;arch;constructor(e,t,n,i){this.executor=e,this.runCommand=t,this.platform=n,this.arch=i}artifactTarget(e){return this.executor.inspectRuntimeTarget(e?.instance.runtime.containerName)}async installRuntime(e,t){const n=e.instance.runtime.containerName;if(!n)throw Object.assign(new Error(`Instance ${e.instance.id} does not have a Docker container.`),{code:"INSTANCE_RUNTIME_INSTALL_FAILED"});await this.executor.installRuntimeLauncher(n),await this.executor.installRuntimeRelease({containerName:n,expectedContainerId:e.instance.runtime.containerId,artifactPath:t.archivePath,identity:t.identity})}async inspectRuntime(e,t){const n=e.instance.runtime.containerName;return!!n&&function(e,t){return e.packageName===t.packageName&&e.version===t.version&&e.platform===t.platform&&e.arch===t.arch&&e.formatVersion===t.formatVersion&&e.launcherAbi===t.launcherAbi&&e.entrypoint===t.entrypoint&&e.sha256===t.sha256}(await this.executor.inspectRuntimeVersion(n),t)}start(e){return this.executor.start(e)}stop(e){return this.executor.stop(e)}restart(e){return this.executor.restart(e,e.instance.runtime.containerId)}delete(e){return this.executor.delete(e)}async check(e){try{const t=(await this.runCommand("docker",["version","--format","{{.Server.Version}}"],{timeoutMs:5e3})).stdout.trim();return{status:"online",capabilities:{...e.capabilities,daemon:{status:"online",hostPlatform:Do(this.platform),...t?{serverVersion:t}:{}}}}}catch(t){return{status:"offline",capabilities:{...e.capabilities,daemon:{status:"offline",hostPlatform:Do(this.platform),error:t instanceof Error?t.message:String(t)}}}}}}class Mo{docker;local;constructor(e,t){this.docker=e,this.local=t}forRuntime(e){if("docker"===e.type)return this.docker;if("local"===e.type)return this.local;throw Object.assign(new Error(`Runtime type ${e.type} is not supported by this node agent.`),{statusCode:400,code:"NODE_RUNTIME_TYPE_UNSUPPORTED"})}managedAdapters(){return[this.docker,this.local].filter(Po)}async stopAll(){await(this.local.stopAll?.())}}const Lo="task-handoff.local-process-nonce",$o=1e3;function Fo(e){return e.runtime.port?`http://127.0.0.1:${e.runtime.port}`:e.target.web}async function Uo(e,t){try{const n=await fetch(`${e}/api/internal/node-agent/process-identity`,{headers:{authorization:`Bearer ${t}`},signal:AbortSignal.timeout($o)});if(!n.ok)return;const i=(await n.json()).data;if("string"!=typeof i?.instanceId||"number"!=typeof i.pid||"string"!=typeof i.processNonce)return;return{instanceId:i.instanceId,pid:i.pid,processNonce:i.processNonce,startIdentity:"string"==typeof i.startIdentity?i.startIdentity:void 0}}catch{return}}async function Vo(e,t){if(Xi(e)!==t)return!1;try{process.kill(e,"SIGTERM")}catch{return!0}const n=Date.now()+3e3;for(;Date.now()<n;){try{process.kill(e,0)}catch{return!0}await new Promise(e=>setTimeout(e,50))}try{process.kill(e,"SIGKILL")}catch{}const i=Date.now()+1e3;for(;Date.now()<i;){try{process.kill(e,0)}catch{return!0}await new Promise(e=>setTimeout(e,50))}return!1}function qo(e,t){return Object.assign(new Error(t),{statusCode:503,code:"LOCAL_INSTANCE_STOP_UNCONFIRMED",instanceId:e.id})}function Ho(e){return new Promise(t=>{const n=m.createServer();n.once("error",()=>t(!1)),n.listen({host:"127.0.0.1",port:e},()=>n.close(()=>t(!0)))})}function Bo(e,t=3e3){return null!==e.exitCode||null!==e.signalCode?Promise.resolve():new Promise(n=>{const i=setTimeout(()=>{null===e.exitCode&&null===e.signalCode&&e.kill("SIGKILL"),n()},t);i.unref(),e.once("exit",()=>{clearTimeout(i),n()})})}class Ko{children=new Map;readyChildren=new WeakSet;expectedExits=new WeakSet;lockPath;onUnexpectedExit;onUnexpectedExitError;constructor(e,t,n){this.lockPath=e,this.onUnexpectedExit=t,this.onUnexpectedExitError=n}track(e,t){this.children.set(e,t),t.once("exit",(n,i)=>{if(this.release(e,t),this.readyChildren.has(t)&&!this.expectedExits.has(t)){const r={instanceId:e,pid:t.pid,code:n,signal:i},s=e=>{try{this.onUnexpectedExitError?.(e,r)}catch{}};try{Promise.resolve(this.onUnexpectedExit?.(r)).catch(s)}catch(e){s(e)}}})}markReady(e,t){return this.children.get(e)===t&&null===t.exitCode&&null===t.signalCode&&(this.readyChildren.add(t),!0)}release(e,t){this.children.get(e)===t&&this.children.delete(e)}async stop(e){const t=this.children.get(e.id);if(t)return this.expectedExits.add(t),t.killed||t.kill("SIGTERM"),this.children.delete(e.id),void await Bo(t);const i=await async function(e){const t=Fo(e),n=e.runtime.labels?.[Lo];if(!t||!n||!e.registrationToken)return;const i=await Uo(t,e.registrationToken);if(i&&i.instanceId===e.id&&i.processNonce===n)try{return(await fetch(`${t}/api/internal/node-agent/shutdown`,{method:"POST",headers:{authorization:`Bearer ${e.registrationToken}`},signal:AbortSignal.timeout($o)})).ok?i:void 0}catch{return}}(e);if(i){const t=Fo(e),n=Date.now()+3e3;for(;t&&Date.now()<n;){if(!await Uo(t,e.registrationToken))return;await new Promise(e=>setTimeout(e,50))}const r=t?await Uo(t,e.registrationToken):void 0;if(r&&r.instanceId===i.instanceId&&r.pid===i.pid&&r.processNonce===i.processNonce&&r.startIdentity===i.startIdentity&&r.startIdentity&&await Vo(r.pid,r.startIdentity))return;throw qo(e,`Controlled instance ${e.id} accepted shutdown but its exit could not be confirmed.`)}const r=function(e=function(){const e="win32"===process.platform?p.tmpdir():"/tmp";return n.join(e,`task-handoff-local-controlled-instance-${function(){const e=process.getuid?.();return void 0!==e?String(e):p.userInfo().username.replace(/[^a-zA-Z0-9_.-]/g,"_")}()}.lock`)}()){return Qi(e)}(this.lockPath),s=await async function(e){const t=Fo(e);if(t)try{const[n,i]=await Promise.all([fetch(`${t}/api/instance/status`,{signal:AbortSignal.timeout($o)}),fetch(`${t}/api/diagnostics`,{signal:AbortSignal.timeout($o)})]);if(!n.ok||!i.ok)return;const r=await n.json(),s=await i.json(),o=s.data?.runtime?.pid;if(r.data?.id!==e.id||"controlled"!==r.data.controlMode||"number"!=typeof o||!Number.isInteger(o)||o<=0)return;const a=Xi(o);return a?{pid:o,startIdentity:a}:void 0}catch{return}}(e);if(s){if(await Vo(s.pid,s.startIdentity))return;throw qo(e,`Legacy controlled instance ${e.id} did not exit after termination.`)}if(r?.instanceId===e.id&&tr(r))throw qo(e,`Local controlled instance ${e.id} is still owned by pid ${r.pid}, but its process identity could not be verified.`)}async waitUntilHealthy(e,t,n,i,r=3e3){const s=Date.now()+r;for(;Date.now()<s;){if(null!==n.exitCode||null!==n.signalCode)return!1;const r=await Uo(e,i);if(r&&r.instanceId===t.instanceId&&r.pid===t.pid&&r.processNonce===t.processNonce&&r.startIdentity===t.startIdentity)return!0;await new Promise(e=>setTimeout(e,100))}return!1}async stopAll(){const e=Array.from(this.children.values());for(const t of e)this.expectedExits.add(t),t.killed||t.kill("SIGTERM");this.children.clear(),await Promise.all(e.map(e=>Bo(e)))}}async function Go(e,t){try{const n=await e(t,["--version"]);return{available:!0,command:t,version:(n.stdout||n.stderr).split(/\r?\n/)[0]?.trim()||void 0}}catch{return{available:!1}}}class Jo{runCommand;paths;nodeAgentUrl;processSupervisor;commandOverride;lockPath;constructor(e,t,n,i,r,s,o){this.runCommand=e,this.paths=t,this.nodeAgentUrl=n,this.commandOverride=i,this.lockPath=r,this.processSupervisor=new Ko(r,s,o)}async start(e){await this.processSupervisor.stop(e.instance);const i=function(e){if("local-folder"!==e.source.type){const e=new Error("Localhost runtime currently supports local folder sources only.");throw Object.assign(e,{statusCode:400,code:"LOCAL_RUNTIME_REQUIRES_LOCAL_FOLDER"}),e}return n.resolve(e.source.path)}(e.instance),r=e.instance.runtime.port||await async function(){const e=Number(process.env.TASK_HANDOFF_LOCAL_INSTANCE_PORT_START||19e3),t=Number.isInteger(e)&&e>0?e:19e3;for(let e=t;e<t+1e3&&e<=65535;e+=1)if(await Ho(e))return e;throw Object.assign(new Error(`No free localhost port found in range ${t}-${Math.min(t+999,65535)}.`),{statusCode:503,code:"LOCAL_INSTANCE_PORT_UNAVAILABLE"})}(),s=n.join(this.paths.dataDir,"local-instances",e.instance.id),o=n.join(s,"logs");t.mkdirSync(o,{recursive:!0});const[a,...l]=function(e){if(e)return e;const i=n.resolve(process.cwd(),"bin","task-handoff.js");if(t.existsSync(i))return[process.execPath,i,"web"];throw Object.assign(new Error("The bundled controlled-instance command is unavailable."),{statusCode:500,code:"LOCAL_CONTROLLED_COMMAND_MISSING"})}(this.commandOverride),u=[...l,"--host","127.0.0.1","--port",String(r)],p=c.randomUUID(),m=t.openSync(n.join(o,"controlled-instance.out.log"),"a"),g=t.openSync(n.join(o,"controlled-instance.err.log"),"a"),h=d.spawn(a,u,{cwd:i,detached:!1,stdio:["ignore",m,g],env:{...process.env,TASK_HANDOFF_CONTROL_MODE:"controlled",TASK_HANDOFF_RUNTIME_KIND:"local",TASK_HANDOFF_CONTROLLED_INSTANCE_VERSION:es(),...this.lockPath?{TASK_HANDOFF_LOCAL_CONTROLLED_INSTANCE_LOCK_PATH:this.lockPath}:{},TASK_HANDOFF_NODE_AGENT_URL:this.nodeAgentUrl(),TASK_HANDOFF_INSTANCE_ID:e.instance.id,TASK_HANDOFF_INSTANCE_NAME:e.instance.name,TASK_HANDOFF_REGISTRATION_TOKEN:e.instance.registrationToken||"",TASK_HANDOFF_PROJECT_ID:e.project.id,TASK_HANDOFF_NODE_ID:e.node.id,TASK_HANDOFF_RUNTIME_ID:e.runtime.id,TASK_HANDOFF_LOCAL_PROCESS_NONCE:p,TASK_HANDOFF_WORKSPACE:i,TASK_HANDOFF_WORKSPACE_MODE:"local-bind",TASK_HANDOFF_DATA_DIR:s,TASK_HANDOFF_LOG_DIR:o,TASK_HANDOFF_APP_SESSION_PERSIST:"1",TASK_HANDOFF_CODEX_APP_SERVER:process.env.TASK_HANDOFF_CODEX_APP_SERVER||"1",TASK_HANDOFF_WEB_PORT:String(r),TASK_HANDOFF_WEB_HOST:"127.0.0.1",...e.modelEnv||{}}});t.closeSync(m),t.closeSync(g);try{await function(e){return new Promise((t,n)=>{const i=()=>{e.off("error",r),t()},r=t=>{e.off("spawn",i),n(t)};e.once("spawn",i),e.once("error",r)})}(h)}catch(e){const r=e instanceof Error?e.message:String(e);try{t.appendFileSync(n.join(o,"controlled-instance.lifecycle.log"),`[${(new Date).toISOString()}] spawn failed command=${a} cwd=${i} error=${r}\n`)}catch{}throw Object.assign(new Error(`Controlled instance process could not start with command ${a} in ${i}: ${r}`),{statusCode:500,code:"LOCAL_INSTANCE_PROCESS_SPAWN_FAILED"})}this.processSupervisor.track(e.instance.id,h),h.on("error",e=>{try{t.appendFileSync(n.join(o,"controlled-instance.lifecycle.log"),`[${(new Date).toISOString()}] process error pid=${h.pid??""} error=${e.message}\n`)}catch{}}),h.once("exit",(e,i)=>{try{t.appendFileSync(n.join(o,"controlled-instance.lifecycle.log"),`[${(new Date).toISOString()}] exited pid=${h.pid??""} code=${e??""} signal=${i??""}\n`)}catch{}});const f=`http://127.0.0.1:${r}`,y=h.pid?Xi(h.pid):void 0;if(!(h.pid&&e.instance.registrationToken&&await this.processSupervisor.waitUntilHealthy(f,{instanceId:e.instance.id,pid:h.pid,processNonce:p,startIdentity:y},h,e.instance.registrationToken)&&this.processSupervisor.markReady(e.instance.id,h)))throw this.processSupervisor.release(e.instance.id,h),null===h.exitCode&&null===h.signalCode&&h.kill("SIGTERM"),await Bo(h),Object.assign(new Error(`Controlled instance process did not become ready for instance ${e.instance.id} on ${f}.`),{statusCode:503,code:"LOCAL_INSTANCE_PROCESS_NOT_READY"});return{status:"registering",health:"unknown",connectionStatus:"online",agentStatus:"unknown",targetStatus:"unknown",uiAccessStatus:"unknown",target:{strategy:"direct-port",status:"unknown",web:f,api:`${f}/api`},workspace:{mode:"local-bind",status:"pending",path:i},runtime:{kind:"local",workspacePath:i,pid:h.pid,port:r,labels:{...e.instance.runtime.labels,"task-handoff.runtime-kind":"local",[Lo]:p}}}}async stop(e){return await this.processSupervisor.stop(e.instance),{status:"stopped",health:"unknown",connectionStatus:"offline",agentStatus:"offline",targetStatus:"unknown",uiAccessStatus:"unknown",target:{...e.instance.target,status:"unknown"},runtime:e.instance.runtime}}async restart(e){return await this.processSupervisor.stop(e.instance),this.start(e)}async delete(e){return this.stop(e)}async check(e){const[t,n]=await Promise.all([Go(this.runCommand,"codex"),Go(this.runCommand,"claude")]);return{status:"online",capabilities:ms({...e.capabilities,apps:{terminal:!0,codex:t,claude:n}})}}async stopAll(){await this.processSupervisor.stopAll()}}const Wo=["codex","claude"],Yo=5e3;function Xo(e){const t=process.env[e]?.trim();return t||void 0}function Qo(e){const t=e.authorization;return"string"==typeof t&&t.startsWith("Bearer ")?t.slice(7).trim():void 0}function Zo(e){if("string"!=typeof e)return!1;const t=e.trim().toLowerCase();return"localhost"===t||"127.0.0.1"===t||"::1"===t||"::ffff:127.0.0.1"===t}function ea(e){return!e.ip&&!e.socket.remoteAddress&&!e.socket.remoteFamily}function ta(){return(new Date).toISOString()}async function na(e,t){if(!t.target.web)return"unknown";const n=new AbortController,i=setTimeout(()=>n.abort(),2e3);try{return(await e(`${oa(t)}/api/health`,{signal:n.signal})).ok?"reachable":"endpoint-unreachable"}catch{return"endpoint-unreachable"}finally{clearTimeout(i)}}async function ia(e,t,n,i){const r=new AbortController,s=setTimeout(()=>r.abort(),i);try{return await e(t,{...n,signal:r.signal})}finally{clearTimeout(s)}}async function ra(e,t,n,i){if(!t.config.autoImportAgentConfigs)return void i.diagnostic({instanceId:t.id,action:n},"node instance config auto-import skipped");if("reachable"!==t.targetStatus)return;const r=oa(t),s=Number(process.env.TASK_HANDOFF_CONFIG_AUTO_IMPORT_TIMEOUT_MS||Yo);for(const o of Wo)try{const a=await ia(e,`${r}/api/config-sync/import/${encodeURIComponent(o)}`,{method:"POST"},Number.isFinite(s)&&s>0?s:Yo);if(!a.ok){i.warn({instanceId:t.id,action:n,preset:o,statusCode:a.status},"node instance config auto-import failed");continue}i.diagnostic({instanceId:t.id,action:n,preset:o},"node instance config auto-import completed")}catch(e){i.warn({instanceId:t.id,action:n,preset:o,error:e instanceof Error?e.message:String(e)},"node instance config auto-import failed")}}async function sa(e,t,n){const i=t.requireInstance(n);if("reachable"!==i.targetStatus||!i.target.web)return!1;const r=await ia(e,`${oa(i)}/api/internal/model-environment`,{method:"PUT",headers:{"content-type":"application/json",authorization:`Bearer ${i.registrationToken}`},body:JSON.stringify(t.resolvedAssignedModelEnvironment(n))},Yo);if(!r.ok)throw Object.assign(new Error(`Instance ${n} rejected its managed model environment with HTTP ${r.status}.`),{statusCode:502,code:"INSTANCE_MODEL_ENVIRONMENT_APPLY_FAILED"});return!0}function oa(e){const t=e.target.web;if(!t){const t=new Error(`Instance ${e.id} does not have a web endpoint.`);throw Object.assign(t,{statusCode:409,code:"NODE_INSTANCE_WEB_ENDPOINT_MISSING"}),t}if("direct-port"!==e.target.strategy)return t.replace(/\/$/,"");try{const e=new URL(t);return e.port?(e.hostname=process.env.TASK_HANDOFF_NODE_AGENT_PROXY_HOST||"127.0.0.1",e.toString().replace(/\/$/,"")):t.replace(/\/$/,"")}catch{return t.replace(/\/$/,"")}}async function aa(e,t,n,i,r,s="request"){const o=e.requireInstance(i);if(o.imageProvisioning&&"ready"!==o.imageProvisioning.phase&&"docker"===e.requireRuntime(o.runtimeId).type)return r.diagnostic({instanceId:i,action:"start",reason:s,runtimeId:o.runtimeId,imageId:o.imageSelection?.imageId,imagePhase:o.imageProvisioning.phase},"node instance start queued until image provisioning completes"),e.controlledInstances.put(Mn.parse({...o,status:"starting",updatedAt:ta()}));r.diagnostic({instanceId:i,action:"start",reason:s,runtimeId:o.runtimeId,imageId:o.imageSelection?.imageId},"node instance start requested");const a=e.applyInstanceLifecycle(i,{type:"start-requested"}),c=t.forRuntime(e.requireRuntime(a.runtimeId)),d=await c.start(e.context(a)),l=await na(n,Mn.parse({...a,...d,target:d.target?{...a.target,...d.target}:a.target,workspace:d.workspace?{...a.workspace,error:void 0,...d.workspace}:a.workspace,runtime:d.runtime?{...a.runtime,...d.runtime}:a.runtime,updatedAt:ta()})),u=e.applyInstanceLifecycle(i,{type:"runtime-lifecycle-completed",baseline:a,observation:{...d,target:d.target?{...d.target,status:l}:void 0,workspace:d.workspace?{error:void 0,...d.workspace}:void 0,targetStatus:l,uiAccessStatus:l}});return r.diagnostic({instanceId:i,action:"start",reason:s,status:u.status,connectionStatus:u.connectionStatus,targetStatus:u.targetStatus,targetWeb:u.target.web,containerName:u.runtime.containerName},"node instance start completed"),u}async function ca(e={}){const t=e.token||process.env.TASK_HANDOFF_NODE_AGENT_TOKEN,i=Number(e.port||process.env.TASK_HANDOFF_NODE_AGENT_PORT||"8091"),c=`http://127.0.0.1:${i}`,d=e.containerUrl||process.env.TASK_HANDOFF_NODE_AGENT_CONTAINER_URL,l=Bi(e.dataDir),p=e.remoteSecret||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_SECRET,m=e.remoteKeyId||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_KEY_ID,h=new Io(l),f=h.resolveNodeId(e.nodeId||process.env.TASK_HANDOFF_NODE_ID),y=e.connectionMode||("local-ipc"===process.env.TASK_HANDOFF_NODE_AGENT_CONNECTION_MODE?"local-ipc":"local-loopback"),I=e.ipcPath||process.env.TASK_HANDOFF_NODE_AGENT_IPC_PATH||ur(l.dataDir),A="local-ipc"===y?`ipc://${encodeURIComponent(I)}`:c,w=e.platform||process.platform,v=e.arch||process.arch,E=new hs(l,f,c,d,i,w);E.node.connectionMode=y,E.node.controlEndpoint=A,E.node.endpoint=A,E.init();const N=e.dockerCommandRunner||Jn,z=new Yn(N,e.dockerTerminalCommandRunner),S=new Qn(N,{publishHost:"127.0.0.1",imageService:z});let _;const T=new Mo(new jo(S,N,w,v),new Jo(e.dockerCommandRunner||Jn,l,()=>E.localNodeAgentUrl,function(){const e=process.env.TASK_HANDOFF_LOCAL_CONTROLLED_COMMAND_ARGV?.trim();if(!e){const e=process.env.TASK_HANDOFF_LOCAL_CONTROLLED_COMMAND?.trim();return e?e.split(/\s+/):void 0}let t;try{t=JSON.parse(e)}catch{throw Object.assign(new Error("TASK_HANDOFF_LOCAL_CONTROLLED_COMMAND_ARGV must be valid JSON."),{code:"LOCAL_CONTROLLED_COMMAND_INVALID"})}if(!Array.isArray(t)||!t.length||t.some(e=>"string"!=typeof e||!e))throw Object.assign(new Error("TASK_HANDOFF_LOCAL_CONTROLLED_COMMAND_ARGV must be a non-empty string array."),{code:"LOCAL_CONTROLLED_COMMAND_INVALID"});return t}(),e.localControlledInstanceLockPath,e=>_.handleUnexpectedLocalExit(e.instanceId,new Error(`Local controlled instance exited unexpectedly (pid=${e.pid??"unknown"}, code=${e.code??"none"}, signal=${e.signal??"none"}).`)),(e,t)=>$.log.error({error:e,instanceId:t.instanceId,pid:t.pid},"local controlled instance exit recovery failed"))),k=e.updateCommandRunner||e.dockerCommandRunner||Jn,C=e.fetchImpl||fetch,x=new Ar({cacheDir:n.join(l.dataDir,"runtime-artifacts"),fetchImpl:C}),O=e.resolveRuntimeArtifactRelease||((e,t,n)=>br(e,t,n,C)),R=async(t,n,i)=>{const r=await n.artifactTarget(i);if(e.resolveRuntimeArtifact)return e.resolveRuntimeArtifact(t,r.platform,r.arch);const s=await O(t,r.platform,r.arch);if(s.identity.launcherAbi>r.launcherAbi)throw Object.assign(new Error(`Runtime requires launcher ABI ${s.identity.launcherAbi}, but ${r.platform}-${r.arch} provides ABI ${r.launcherAbi}.`),{code:"INSTANCE_BASE_RUNTIME_INCOMPATIBLE",retryable:!1});return x.resolve(s.identity,s.source)},D=e=>T.forRuntime(E.requireRuntime(e.runtimeId)),P=e=>{const t=D(e);return Po(t)?t:void 0},j=e=>{const t=P(e);if(t)return t;throw Object.assign(new Error(`Runtime for instance ${e.id} does not use managed artifacts.`),{code:"INSTANCE_RUNTIME_ARTIFACT_UNMANAGED",retryable:!1})},M=e=>Boolean(P(e)),L=(e,t)=>{const n=E.context(e);return R(t,j(e),n)},$=s({logger:e.logger??!0}),F={requests:0,active:0,completed:0,aborted:0,limitRejected:0,responseBytes:0,totalDurationMs:0,maxResponseBytes:Ps()};$.decorate("nodeAgentState",E),await $.register(o);const U=new zi(E,t,{logger:$.log,safetyIntervalMs:Number(process.env.TASK_HANDOFF_EVENT_CONNECTION_SAFETY_INTERVAL_MS)||void 0}),V=new wr(E.controlledInstances,es,{isInstalled:async(e,t)=>{const n=await L(e,t);return j(e).inspectRuntime(E.context(e),n.identity)},beginDrain:async e=>{try{const t=await async function(e,t){const n=oa(t);if(t.registrationToken&&(await ia(e,`${n}/api/internal/node-agent/drain`,{method:"POST",headers:{authorization:`Bearer ${t.registrationToken}`}},1e4)).ok)return{requested:t.apps.runningCount,failures:[]};const i=await ia(e,`${n}/api/apps/sessions`,{method:"GET",headers:{"cache-control":"no-cache"}},5e3);if(!i.ok)throw new Error(`Could not list app sessions for runtime drain (HTTP ${i.status}).`);const r=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return[];const t=e.data;if(Array.isArray(t))return t;if(!t||"object"!=typeof t||Array.isArray(t))return[];const n=t.snapshot,i=(n&&"object"==typeof n&&!Array.isArray(n)?n:t).sessions;return Array.isArray(i)?i:[]}(await i.json()).flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const t=e;return"running"===t.status&&"string"==typeof t.id&&t.id?[t.id]:[]}),s=await Promise.all(r.map(async t=>{try{const i=await ia(e,`${n}/api/apps/sessions/${encodeURIComponent(t)}/stop`,{method:"POST"},5e3);return i.ok?void 0:{sessionId:t,error:`HTTP ${i.status}`}}catch(e){return{sessionId:t,error:e instanceof Error?e.message:String(e)}}}));return{requested:r.length,failures:s.filter(e=>Boolean(e))}}(C,e);t.failures.length?$.log.warn({instanceId:e.id,requested:t.requested,failures:t.failures},"runtime convergence could not stop every app session"):$.log.info({instanceId:e.id,requested:t.requested},"runtime convergence requested app session drain")}catch(t){$.log.warn({instanceId:e.id,error:t instanceof Error?t.message:String(t)},"runtime convergence could not request app session drain")}},endDrain:async e=>{try{await async function(e,t){return!!t.registrationToken&&(await ia(e,`${oa(t)}/api/internal/node-agent/resume`,{method:"POST",headers:{authorization:`Bearer ${t.registrationToken}`}},5e3)).ok}(C,e)&&$.log.info({instanceId:e.id},"runtime convergence released app session drain")}catch(t){$.log.warn({instanceId:e.id,error:t instanceof Error?t.message:String(t)},"runtime convergence could not release app session drain")}},install:async(e,t)=>{const n=j(e);await n.installRuntime(E.context(e),await L(e,t))},restart:async e=>{const t=D(e),n=E.applyInstanceLifecycle(e.id,{type:"convergence-restart-requested"}),i=await t.restart(E.context(n));E.applyInstanceLifecycle(e.id,{type:"runtime-lifecycle-completed",baseline:n,observation:i})},onForcedDrain:e=>$.log.warn({instanceId:e.id},"runtime convergence drain deadline reached; restarting instance")},{drainTimeoutMs:Number(process.env.TASK_HANDOFF_RUNTIME_DRAIN_TIMEOUT_MS)||void 0,verificationTimeoutMs:Number(process.env.TASK_HANDOFF_RUNTIME_VERIFY_TIMEOUT_MS)||void 0,maxAttempts:Number(process.env.TASK_HANDOFF_RUNTIME_MAX_ATTEMPTS)||void 0});E.controlledInstances.setOnStored(e=>{U.publishInstanceLifecycle(e),E.updateJobs.reconcileRollouts(E.listInstances(),es())}),U.start(),$.decorate("nodeAgentEventForwarder",U);const q=new Oi(N,()=>E.listInstances().filter(e=>"docker"===E.requireRuntime(e.runtimeId).type),e=>U.publish("instance.metrics.snapshot",e,{instanceId:e.instanceId}));q.start(),$.decorate("nodeAgentRuntimeMetrics",q);const H=(Q=process.env.TASK_HANDOFF_DIAGNOSTIC_LOGS,["1","true","yes","on"].includes(String(Q||"").trim().toLowerCase())),B=new Gs(h,f,p,m),K=(e,t)=>{H&&$.log.info(e,t)},G={diagnostic:K,warn:(e,t)=>$.log.warn(e,t)},J=new Ns,W=async(e,t,n=()=>!0)=>{try{if(!n())return E.requireInstance(e);let i=E.requireInstance(e);"failed"===i.runtimeVersion?.phase&&M(i)&&(i=E.controlledInstances.put(Mn.parse({...i,ready:!1,runtimeVersion:ns(vr(i)),updatedAt:ta()})));const r=E.requireRuntime(i.runtimeId);await aa(E,T,C,e,G);const s=E.requireInstance(e);if("docker"===r.type&&"ready"!==s.imageProvisioning?.phase)return U.syncNow(),s;if(!n())return E.requireInstance(e);_.markRestored(e);let o=E.requireInstance(e);if(M(o)){try{o=await V.schedule(e,{startRequested:!0})}catch(n){o=E.requireInstance(e),G.warn({instanceId:e,action:"runtime.converge",reason:t,error:n instanceof Error?n.message:String(n)},"node instance runtime convergence failed after start")}"failed"===o.runtimeVersion?.phase&&G.warn({instanceId:e,action:"runtime.converge",reason:t,error:o.runtimeVersion.error},"node instance started with failed runtime convergence")}return n()?(await ra(C,o,"start",G),U.syncNow(),o):E.requireInstance(e)}catch(n){throw E.applyInstanceLifecycle(e,{type:"start-failed",error:n}),U.syncNow(),G.warn({instanceId:e,action:"start",reason:t,error:n instanceof Error?n.message:String(n)},"node instance start failed"),n}},Y=new Ts(E,z,{sync:()=>U.syncNow(),diagnostic:G.diagnostic,warn:G.warn,publish:(e,t,n)=>U.publish(e,t,{instanceId:n}),runInstanceOperation:(e,t)=>J.run(e,t)}),X=e=>{const t=J.intent(e.id);Y.provision(e,async()=>{await W(e.id,"image-ready",()=>J.isIntentCurrent(e.id,t)).catch(()=>{})})};var Q;_=new zo({state:E,runtimeAdapters:T,convergence:V,restoreInstance:e=>aa(E,T,C,e,G,"restore"),autoImport:e=>ra(C,e,"start",G),provisionImage:X,stopImageProvisioning:()=>Y.stop(),usesManagedArtifact:M,warn:G.warn,error:(e,t)=>$.log.error(e,t),runInstanceOperation:(e,t)=>J.run(e,t)});const Z=new vo({nodeId:f,jobs:E.updateJobs,runCommand:k,currentRuntimeVersion:es,listInstances:()=>E.listInstances(),resolveRuntimeArtifacts:async e=>(await(async e=>{const t=new Map;for(const e of T.managedAdapters()){const n=await e.artifactTarget();t.set(`${n.platform}-${n.arch}`,{adapter:e})}for(const e of E.listInstances()){const n=P(e);if(!n)continue;const i=E.context(e),r=await n.artifactTarget(i);t.set(`${r.platform}-${r.arch}`,{adapter:n,context:i})}return(await Promise.all([...t.values()].map(({adapter:t,context:n})=>R(e,t,n)))).sort((e,t)=>`${e.identity.platform}/${e.identity.arch}`.localeCompare(`${t.identity.platform}/${t.identity.arch}`))})(e)).map(e=>e.identity),moduleDir:("undefined"==typeof document?require("url").pathToFileURL(__filename).href:b&&"SCRIPT"===b.tagName.toUpperCase()&&b.src||new URL("cli.js",document.baseURI).href)?n.dirname(r.fileURLToPath("undefined"==typeof document?require("url").pathToFileURL(__filename).href:b&&"SCRIPT"===b.tagName.toUpperCase()&&b.src||new URL("cli.js",document.baseURI).href)):__dirname});return $.setErrorHandler((e,t,n)=>{const i=function(e){if(e instanceof a.z.ZodError)return{statusCode:400,code:"VALIDATION_ERROR",message:e.issues.map(e=>`${e.path.join(".")||"body"}: ${e.message}`).join("; "),details:{issues:e.issues.map(e=>({path:e.path.map(String),code:e.code,message:e.message}))}};const t=e&&"object"==typeof e?e:{};return{statusCode:"number"==typeof t.statusCode?t.statusCode:500,code:"string"==typeof t.code?t.code:"NODE_AGENT_ERROR",message:e instanceof Error?e.message:String(e),...t.details&&"object"==typeof t.details&&!Array.isArray(t.details)?{details:t.details}:{},..."boolean"==typeof t.retryable?{retryable:t.retryable}:{}}}(e);(H||i.statusCode>=500)&&(i.statusCode>=500?$.log.error.bind($.log):$.log.warn.bind($.log))({method:t.method,url:t.url,statusCode:i.statusCode,errorCode:i.code,error:i.message},"node agent request failed"),n.code(i.statusCode).send({error:{code:i.code,message:i.message,...e&&"object"==typeof e&&"string"==typeof e.expectedVersion?{expectedVersion:e.expectedVersion}:{},...e&&"object"==typeof e&&"string"==typeof e.actualVersion?{actualVersion:e.actualVersion}:{},...e&&"object"==typeof e&&"string"==typeof e.phase?{phase:e.phase}:{},...e&&"object"==typeof e&&"boolean"==typeof e.retryable?{retryable:e.retryable}:{},...e&&"object"==typeof e&&"number"==typeof e.blockingInstanceCount?{blockingInstanceCount:e.blockingInstanceCount}:{}}})}),$.addHook("preHandler",async e=>{const n=B.verify(e);if(n){if(h.isRevokedPairing(n)&&"/api/node-agent/pairing/current"!==e.url.split("?")[0]){const e=new Error("The node agent pairing used for this request has been revoked.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_HMAC_KEY_REVOKED"}),e}e.nodeAgentAuthKeyId=n}else if(ea(e)){if(t&&Qo(e.headers)!==t){const e=new Error("Invalid node agent token.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_UNAUTHORIZED"}),e}}else if("/api/node-agent/pairing/complete"!==e.url.split("?")[0]&&!function(e){const t=e.split("?")[0];return/^\/api\/node-agent\/instances\/[^/]+\/(register|heartbeat)$/.test(t)}(e.url)){if(B.hasRemoteSecrets()){const e=new Error("Node agent HMAC signature is required.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_HMAC_SIGNATURE_REQUIRED"}),e}if(!function(e){return Zo(e.ip)||Zo(e.socket.remoteAddress)||!e.ip&&!e.socket.remoteAddress&&!e.socket.remoteFamily}(e)){const e=new Error("Local node agent access is only accepted from loopback or local IPC connections.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_LOCAL_TOKEN_REQUIRES_LOOPBACK"}),e}if(t&&Qo(e.headers)!==t){const e=new Error("Invalid node agent token.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_UNAUTHORIZED"}),e}}}),$.addHook("onClose",async()=>{q.stop(),U.stop(),await _.stop()}),$.decorate("nodeAgentRestoreManagedInstances",()=>_.restoreManagedInstances()),$.decorate("nodeAgentRecoverManagedInstances",()=>_.recoverManagedInstances()),$.decorate("nodeAgentStartRecoverySupervisor",()=>_.start()),$.get("/api/node-agent/health",async()=>{return{data:{ok:!0,role:"node-agent",nodeId:f,platform:Do(w),arch:process.arch,protocolVersion:$e,build:(e="node-agent",{component:e,packageName:"@task-handoff/node-agent",packageVersion:es(),protocolVersion:$e,buildId:Xo("TASK_HANDOFF_BUILD_ID"),builtAt:Xo("TASK_HANDOFF_BUILT_AT"),gitCommit:Xo("TASK_HANDOFF_GIT_COMMIT"),imageRef:Xo("TASK_HANDOFF_IMAGE_REF"),imageDigest:Xo("TASK_HANDOFF_IMAGE_DIGEST")}),instanceProxy:{...F},serverTime:(new Date).toISOString()}};var e}),function(e,t){e.get("/api/node-agent/settings/external-listener",async e=>({data:t(e).current()})),e.patch("/api/node-agent/settings/external-listener",async e=>({data:await t(e).update(e.body)}))}($,e=>{if(!ea(e)){const e=new Error("Node agent TCP listener settings are available only over local Unix IPC.");throw Object.assign(e,{statusCode:403,code:"NODE_AGENT_LISTENER_LOCAL_IPC_ONLY"}),e}if(!$.nodeAgentListenerManager){const e=new Error("Node agent TCP listener manager is not initialized.");throw Object.assign(e,{statusCode:503,code:"NODE_AGENT_LISTENER_UNAVAILABLE"}),e}return $.nodeAgentListenerManager}),function(e,t,n){e.get("/api/node-agent/updates/jobs",async()=>({data:n.list()})),e.post("/api/node-agent/updates/check",async e=>({data:await t.check(e.body)})),e.post("/api/node-agent/updates/apply",async(e,n)=>n.code(202).send({data:await t.apply(e.body)}))}($,Z,E.updateJobs),function(e,t){const{identity:n,nodeId:i,fetchImpl:r}=t;e.post("/api/node-agent/pairing/invites",async(e,t)=>{const r=n.createPairingInvite(to.parse(e.body||{}));return t.code(201).send({data:{nodeId:i,joinToken:r.token,expiresAt:r.expiresAt}})}),e.post("/api/node-agent/pairing/complete",async(e,t)=>{const r=n.completePairingInvite(no.parse(e.body));return t.code(201).send({data:{nodeId:i,keyId:r.keyId,secret:r.secret,pairedAt:r.pairedAt}})}),e.get("/api/node-agent/control-plane-pairings",async e=>({data:n.listControlPlanePairings(e.nodeAgentAuthKeyId)})),e.delete("/api/node-agent/control-plane-pairings/:keyId",async e=>{const t=Ao.parse(e.params.keyId);return{data:{deleted:n.deleteControlPlanePairing(t,e.nodeAgentAuthKeyId)}}}),e.delete("/api/node-agent/pairing/current",async e=>({data:n.revokeCurrentControlPlanePairing(e.nodeAgentAuthKeyId||"")})),e.get("/api/node-agent/control-plane-connections",async()=>({data:n.listControlPlaneConnections().map(e=>({...e,...t.reverseTunnels()?.state(e.id)||{status:e.enabled?"connecting":"disabled"}}))})),e.delete("/api/node-agent/control-plane-connections/:connectionId",async e=>{const i=Ao.parse(e.params.connectionId),r=n.deleteControlPlaneConnection(i);return r&&t.reverseTunnels()?.connectConfigured(),{data:{deleted:r}}}),e.post("/api/node-agent/control-plane-connections",async(e,s)=>{const o=io.parse(e.body),a=function(e){const t=new URL(e);if("http:"!==t.protocol&&"https:"!==t.protocol){const e=new Error("Control-plane URL must use http or https.");throw Object.assign(e,{statusCode:400,code:"NODE_AGENT_REMOTE_CONTROL_PLANE_URL_INVALID"}),e}return t.toString().replace(/\/$/,"")}(o.controlPlaneUrl);return n.runControlPlaneConnectionOperation(a,async()=>{const e=n.stageControlPlaneConnection({url:a,...o.controlPlaneName?{name:o.controlPlaneName}:{},enabled:!1!==o.activate});let c;try{c=await async function(e,t,n){const i=await e(new URL("/api/node-join/complete",t).toString(),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)}),r=await i.json().catch(()=>({}));if(!i.ok){const e=new Error(r.error?.message||`Control-plane node join failed with HTTP ${i.status}.`);throw Object.assign(e,{statusCode:i.status,code:r.error?.code||"NODE_AGENT_REMOTE_JOIN_FAILED"}),e}return r.data||{}}(r,a,{joinToken:o.joinToken,nodeId:i,nodeName:t.nodeName(),keyId:e.pairing.keyId,secret:e.pairing.secret,pairedAt:e.pairing.pairedAt})}catch(t){throw n.rollbackControlPlaneConnection(e),t}const d=n.commitControlPlaneConnection(e,{name:o.controlPlaneName||("string"==typeof c.name&&c.name?c.name:void 0)});let l,u=d.connection.enabled?"saved":"disabled";const p=t.reverseTunnels();if(p)try{p.connectConfigured(),d.connection.enabled&&(u="connecting")}catch(e){u="failed",l=e instanceof Error?e.message:String(e)}return s.code(201).send({data:{pairing:n.listControlPlanePairings().find(e=>e.keyId===d.pairing.keyId),connection:d.connection,tunnel:{status:u,...l?{error:l}:{}}}})})})}($,{identity:h,nodeId:f,nodeName:()=>E.node.name,fetchImpl:C,reverseTunnels:()=>$.nodeAgentReverseTunnels}),function(e,t){e.get("/api/node-agent/runtimes",async()=>({data:t.listRuntimes()})),e.post("/api/node-agent/runtimes",async(e,n)=>n.code(201).send({data:t.createRuntime(ws.parse(e.body))})),e.patch("/api/node-agent/runtimes/:id",async e=>({data:t.updateRuntime(e.params.id,vs.parse(e.body))})),e.delete("/api/node-agent/runtimes/:id",async e=>({data:{deleted:t.deleteRuntime(e.params.id)}})),e.post("/api/node-agent/runtimes/:id/check",async e=>({data:await t.checkRuntime(e.params.id)})),e.get("/api/node-agent/local-folders",async()=>({data:t.listLocalFolders()})),e.get("/api/node-agent/folders/tree",async e=>({data:t.listFolderTree(Is.parse(e.query))})),e.post("/api/node-agent/local-folders",async(e,n)=>n.code(201).send({data:t.createLocalFolder(ys.parse(e.body))})),e.delete("/api/node-agent/local-folders/:id",async e=>({data:{deleted:t.deleteLocalFolder(e.params.id)}}))}($,{listRuntimes:()=>E.nodeRuntimes.list(),createRuntime:e=>E.createRuntime(e),updateRuntime:(e,t)=>E.updateRuntime(e,t),deleteRuntime:e=>E.deleteRuntime(e),checkRuntime:async e=>{const t=E.requireRuntime(e);return E.checkRuntime(e,T.forRuntime(t))},listLocalFolders:()=>E.localFolders.list(),listFolderTree:qi,createLocalFolder:e=>E.createLocalFolder(e),deleteLocalFolder:e=>E.localFolders.delete(e)}),function(e,t){e.get("/api/node-agent/models",async()=>({data:t.list()})),e.post("/api/node-agent/models",async(e,n)=>n.code(201).send({data:t.create(Zt.parse(e.body))})),e.put("/api/node-agent/models/:id/deploy",async e=>{const n=e.params.id,i=tn.parse(e.body);if(i.id!==n)throw Object.assign(new Error(`Model payload id ${i.id} does not match route id ${n}.`),{statusCode:400,code:"NODE_MODEL_ID_MISMATCH"});return{data:t.deploy(i)}}),e.patch("/api/node-agent/models/:id",async e=>({data:t.update(e.params.id,en.parse(e.body))})),e.delete("/api/node-agent/models/:id",async e=>({data:{deleted:t.delete(e.params.id)}})),e.put("/api/node-agent/instances/:id/model-assignment",async e=>{const n=e.params.id,i=t.assign(n,nn.parse(e.body));return await(e=>sa(C,E,e))(n),{data:i}})}($,E.modelRegistry),function(e,t){e.get("/api/node-agent/instances",async()=>({data:t.list()})),e.post("/api/node-agent/instances",async(e,n)=>{const i=t.create(As.parse(e.body));return t.afterCreate(i),n.code(201).send({data:i})}),e.post("/api/node-agent/instances/:id/image-provisioning/retry",async e=>{const n=t.retryImageProvisioning(e.params.id);return t.afterImageRetry(n),{data:n}}),e.patch("/api/node-agent/instances/:id",async e=>{const n=t.update(e.params.id,bs.parse(e.body));return t.afterUpdate(n),{data:n}}),e.post("/api/node-agent/instances/:id/register",async(e,n)=>{const i=e.params.id,r=t.sanitizeReport(i,"register",e.body),s=t.register(i,Bn.parse(r),Es(e.headers));return t.afterReport(s,"register"),n.code(201).send({data:s})}),e.post("/api/node-agent/instances/:id/heartbeat",async e=>{const n=e.params.id,i=t.sanitizeReport(n,"heartbeat",e.body),r=t.heartbeat(n,Kn.parse(i),Es(e.headers));return t.afterReport(r,"heartbeat"),{data:r}})}($,{list:()=>E.listInstances(),create:e=>E.createInstance(e),retryImageProvisioning:e=>Y.retry(e),update:(e,t)=>{const n=E.requireInstance(e);return E.controlledInstances.put(Mn.parse({...n,...t,...t.config?{config:{...n.config,...t.config}}:{},updatedAt:ta()}))},register:(e,t,n)=>E.registerInstance(e,t,n),heartbeat:(e,t,n)=>E.heartbeatInstance(e,t,n),sanitizeReport:(e,t,n)=>{const i=n&&"object"==typeof n&&!Array.isArray(n)?n.protocolVersion:void 0;if("string"!=typeof i||i===$e)return n;const r=({field:n,action:r})=>$.log.warn({instanceId:e,report:t,protocolVersion:i,expectedProtocolVersion:$e,field:n,action:r},"cross-version controlled instance report sanitized");return"register"===t?function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,i=["instanceId","projectId","source","nodeId","runtimeId","imageSelection","instanceVersion","protocolVersion","build","controlMode","capabilities","appInventory","target","workspace","registrationToken","processIncarnationId"],r=new Set([...i,"imageId"]);for(const e of Object.keys(n))r.has(e)||t?.({field:e,action:"ignored"});return Object.prototype.hasOwnProperty.call(n,"imageId")&&t?.({field:"imageId",action:"migrated"}),{...Hn(n,i),imageSelection:st(n.imageSelection,n.imageId)}}(n,r):function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=["status","health","protocolVersion","build","capabilities","appInventory","apps","aiSessions","triggers","workspace","target","processIncarnationId"],i=new Set(n);for(const n of Object.keys(e))i.has(n)||t?.({field:n,action:"ignored"});return Hn(e,n)}(n,r)},afterCreate:e=>{U.syncNow(),e.imageProvisioning&&X(e)},afterImageRetry:e=>{U.syncNow(),X(e)},afterUpdate:()=>U.syncNow(),afterReport:(e,t)=>{U.syncNow(),"register"===t?K({instanceId:e.id,action:t,protocolVersion:e.protocolVersion,build:e.build,targetStatus:e.targetStatus,targetStrategy:e.target.strategy},"node instance registered"):K({instanceId:e.id,action:t,status:e.status,health:e.health,protocolVersion:e.protocolVersion,build:e.build,targetStatus:e.targetStatus,apps:e.apps.runningCount},"node instance heartbeat accepted"),!M(e)||e.ready&&"matched"===e.runtimeVersion?.phase||V.schedule(e.id).catch(n=>$.log.error({instanceId:e.id,error:n},`runtime convergence after ${t} failed`))}}),$.get("/api/node-agent/events",{websocket:!0},e=>{const t=e;t.send(JSON.stringify({type:"node-agent.events.connected",nodeId:f,serverTime:(new Date).toISOString()}));const n=U.addOutput(t);t.on("close",n),t.on("error",n)}),$.get("/api/node-agent/docker/images",async()=>({data:await oi(e.dockerCommandRunner)})),$.get("/api/node-agent/instances/:id/metrics",async e=>{const t=e.params.id,n=E.requireInstance(t);if("docker"!==E.requireRuntime(n.runtimeId).type){const e=new Error(`Runtime type ${E.requireRuntime(n.runtimeId).type} does not provide resource metrics.`);throw Object.assign(e,{statusCode:409,code:"INSTANCE_METRICS_UNSUPPORTED"}),e}return{data:await q.snapshot(t)}}),function(e,t,n,i,r,s=new Ns){const o=e=>s.intent(e),a=e=>Promise.resolve(i.cancel(e)).then(()=>({ok:!0}),e=>({ok:!1,error:e})),c=(e,t)=>{if(!s.isIntentCurrent(e,t))throw Object.assign(new Error(`Instance operation for ${e} was superseded by stop or delete.`),{statusCode:409,code:"INSTANCE_OPERATION_SUPERSEDED"})};e.post("/api/node-agent/instances/:id/start",async e=>{zs.parse(e.body);const t=e.params.id,n=o(t);return s.run(t,async()=>(c(t,n),r.allowRecovery(t),{data:await r.start(t,()=>s.isIntentCurrent(t,n))}))}),e.post("/api/node-agent/instances/:id/runtime/reconcile",async e=>{const n=e.params.id;zs.parse(e.body);const a=o(n);return s.run(n,async()=>{c(n,a);const e=t.requireInstance(n);t.putInstance(Mn.parse({...e,ready:!1,runtimeVersion:ns(vr(e)),updatedAt:Ss()})),c(n,a);const s=await i.schedule(n,{startRequested:!["created","stopped"].includes(e.status),resumeCancelled:!0});return c(n,a),r.sync(),{data:s}})}),e.post("/api/node-agent/instances/:id/stop",async e=>{const i=e.params.id;t.requireInstance(i),s.invalidate(i);const o=a(i);return s.run(i,async()=>{const e=t.requireInstance(i);t.applyLifecycle(i,{type:"stop-requested"});try{await r.suppressRecovery(i);const e=await o;if("error"in e)throw e.error;const s=t.requireInstance(i);r.diagnostic({instanceId:i,action:"stop",runtimeId:s.runtimeId,containerName:s.runtime.containerName},"node instance stop requested"),await n.forRuntime(t.requireRuntime(s.runtimeId)).stop(t.context(s))}catch(n){try{t.applyLifecycle(i,{type:"stop-failed",baseline:e}),r.sync()}finally{r.allowRecovery(i)}throw n}const s=t.applyLifecycle(i,{type:"stop-completed"});return r.completeSuppressedRecovery(i),r.sync(),r.diagnostic({instanceId:i,action:"stop",status:s.status,connectionStatus:s.connectionStatus,containerName:s.runtime.containerName},"node instance stop completed"),{data:s}})}),e.post("/api/node-agent/instances/:id/restart",async e=>{const a=e.params.id;zs.parse(e.body);const d=o(a);return s.run(a,async()=>{c(a,d),r.allowRecovery(a);let e=t.requireInstance(a);if(r.isManaged(e)&&(!e.ready||"matched"!==e.runtimeVersion?.phase)){"failed"===e.runtimeVersion?.phase&&(e=t.putInstance(Mn.parse({...e,runtimeVersion:ns(vr(e)),updatedAt:Ss()}))),c(a,d);const n=await i.schedule(a,{startRequested:!0});return c(a,d),r.sync(),{data:n}}r.diagnostic({instanceId:a,action:"restart",runtimeId:e.runtimeId,imageId:e.imageSelection?.imageId,containerName:e.runtime.containerName},"node instance restart requested");const s=await n.forRuntime(t.requireRuntime(e.runtimeId)).restart(t.context(e));let o=t.applyLifecycle(a,{type:"runtime-lifecycle-completed",baseline:e,observation:{...s,target:s.target?{...e.target,...s.target}:void 0}});r.markRestarted(a),c(a,d);const l=Mn.parse({...o,updatedAt:Ss()}),u=await r.probe(l);return c(a,d),o=t.applyLifecycle(a,{type:"runtime-lifecycle-completed",baseline:o,observation:{target:{...o.target,status:u},targetStatus:u,uiAccessStatus:u}}),await r.autoImport(o),r.sync(),r.diagnostic({instanceId:a,action:"restart",status:o.status,connectionStatus:o.connectionStatus,targetStatus:o.targetStatus,targetWeb:o.target.web,containerName:o.runtime.containerName},"node instance restart completed"),{data:o}})}),e.post("/api/node-agent/instances/:id/delete",async e=>{const i=e.params.id;t.requireInstance(i),s.invalidate(i);const o=a(i);return s.run(i,async()=>{const e=t.requireInstance(i);t.applyLifecycle(i,{type:"stop-requested"});try{await r.suppressRecovery(i);const e=await o;if("error"in e)throw e.error;const s=t.requireInstance(i);r.diagnostic({instanceId:i,action:"delete",runtimeId:s.runtimeId,containerName:s.runtime.containerName},"node instance delete requested"),await n.forRuntime(t.requireRuntime(s.runtimeId)).delete(t.context(s,{}))}catch(n){try{t.applyLifecycle(i,{type:"stop-failed",baseline:e}),r.sync()}finally{r.allowRecovery(i)}throw n}r.diagnostic({instanceId:i,action:"delete"},"node instance delete completed");const a=t.deleteInstance(i);return a&&(r.forgetRecovery(i),s.clearIntent(i)),r.deleteMetadata(i),r.sync(),{data:{deleted:a}}})})}($,{requireInstance:e=>E.requireInstance(e),requireRuntime:e=>E.requireRuntime(e),putInstance:e=>E.controlledInstances.put(e),deleteInstance:e=>E.controlledInstances.delete(e),applyLifecycle:(e,t)=>E.applyInstanceLifecycle(e,t),context:(e,t)=>E.context(e,t)},T,V,{start:(e,t)=>W(e,"request",t),sync:()=>U.syncNow(),isManaged:M,probe:e=>na(C,e),autoImport:e=>ra(C,e,"restart",G),markRestarted:e=>_.markRestored(e),allowRecovery:e=>_.allowRecovery(e),suppressRecovery:e=>_.suppressRecovery(e),forgetRecovery:e=>_.forgetInstance(e),completeSuppressedRecovery:e=>_.completeSuppressedOperation(e),deleteMetadata:e=>E.modelRegistry.deleteInstanceMetadata(e),diagnostic:K},J),function(e,t){const{fetchImpl:n,metrics:i,diagnostic:r}=t;e.post("/api/node-agent/instances/:id/proxy",async(e,i)=>{const s=e.params.id,o=fs.parse(e.body),a=t.instanceBase(s),c=js(o.path);"POST"===o.method&&"/api/apps/sessions"===c&&await t.syncModelEnvironment(s),r({instanceId:s,action:"proxy",method:o.method,path:c,instanceBase:a},"node instance proxy requested");const d=await n(`${a}${c}`,{method:o.method,headers:{...o.headers},body:Ds(o)}),l=d.headers.get("content-type")||"application/octet-stream",u=await d.text();r({instanceId:s,action:"proxy",method:o.method,path:c,statusCode:d.status,contentType:l},"node instance proxy completed"),i.code(d.status).type(l).send(u)}),e.post("/api/node-agent/instances/:id/proxy/stream",{bodyLimit:Os},async(e,s)=>{const o=Date.now();i.requests+=1,i.active+=1;const a=new AbortController;let c=0,d=!1,l=!1;const u=e=>{l||(l=!0,i.active-=1,i.totalDurationMs+=Date.now()-o,i.responseBytes+=c,i[e]+=1)},p=()=>{a.abort(),d&&u("aborted")};e.raw.once("aborted",p),s.raw.once("close",p);try{const o=e.params.id,l=fs.parse(e.body),p=t.instanceBase(o),m=js(l.path);r({instanceId:o,action:"proxy.stream",method:l.method,path:m,instanceBase:p},"node instance streaming proxy requested");const h=await n(`${p}${m}`,{method:l.method,headers:{...l.headers},body:Ds(l),signal:a.signal}),f=Number(h.headers.get("content-length"));if(Number.isFinite(f)&&f>i.maxResponseBytes)return i.limitRejected+=1,a.abort(),Ms(s,i.maxResponseBytes);s.code(h.status);for(const[e,t]of Object.entries(Rs(h.headers)))s.header(e,t);if(!h.body||"HEAD"===l.method)return u("completed"),s.send();const y=new g.Transform({transform(e,t,n){if(c+=e.length,c>i.maxResponseBytes)return i.limitRejected+=1,a.abort(),void n(Object.assign(new Error("Instance proxy response limit exceeded."),{code:"INSTANCE_PROXY_RESPONSE_TOO_LARGE"}));n(null,e)}});return d=!0,y.once("end",()=>u("completed")),y.once("error",()=>u("aborted")),s.send(g.Readable.fromWeb(h.body).pipe(y))}catch(e){throw u("aborted"),e}finally{e.raw.off("aborted",p),d||u("completed")}}),e.post("/api/node-agent/instances/:id/proxy/raw",{bodyLimit:Os},async(e,s)=>{const o=e.params.id,a=fs.parse(e.body),c=t.instanceBase(o),d=js(a.path);r({instanceId:o,action:"proxy.raw",method:a.method,path:d,instanceBase:c},"node instance raw proxy requested");const l=await n(`${c}${d}`,{method:a.method,headers:{...a.headers},body:Ds(a)}),u=Number(l.headers.get("content-length"));if(Number.isFinite(u)&&u>i.maxResponseBytes)return i.limitRejected+=1,await(l.body?.cancel("Instance proxy response limit exceeded.").catch(()=>{})),Ms(s,i.maxResponseBytes);let p;try{p=await async function(e,t){if(!e.body)return Buffer.alloc(0);const n=[];let i=0;const r=e.body.getReader();for(;;){const{done:e,value:s}=await r.read();if(e)break;if(i+=s.byteLength,i>t)throw await r.cancel("Instance proxy response limit exceeded.").catch(()=>{}),Object.assign(new Error("Instance proxy response limit exceeded."),{code:"INSTANCE_PROXY_RESPONSE_TOO_LARGE"});n.push(Buffer.from(s))}return Buffer.concat(n,i)}(l,i.maxResponseBytes)}catch(e){if(!(e instanceof Error)||"INSTANCE_PROXY_RESPONSE_TOO_LARGE"!==e.code)throw e;return i.limitRejected+=1,Ms(s,i.maxResponseBytes)}return r({instanceId:o,action:"proxy.raw",method:a.method,path:d,statusCode:l.status,byteLength:p.length},"node instance raw proxy completed"),{data:{status:l.status,headers:Rs(l.headers),bodyBase64:p.toString("base64")}}}),e.get("/api/node-agent/instances/:id/proxy/ws/*",{websocket:!0},(e,n)=>{const i=n.params.id,s=n.params["*"]||"",o=n.url.indexOf("?"),a=o>=0?n.url.slice(o):"";let c;try{const o=t.instanceBase(i),d=new URL(`/${s}${a}`,`${o}/`);d.protocol="https:"===d.protocol?"wss:":"ws:";const l=function(e){const t=e["sec-websocket-protocol"],n=(Array.isArray(t)?t.join(","):"string"==typeof t?t:"").split(",").map(e=>e.trim()).filter(Boolean);return n.length?n:void 0}(n.headers);r({instanceId:i,action:"proxy.ws",path:`/${s}${a}`,upstreamUrl:d.toString(),protocols:l||[]},"node instance websocket proxy opening"),c=l?new u(d,l):new u(d),c.on("open",()=>{r({instanceId:i,action:"proxy.ws",path:`/${s}${a}`},"node instance websocket proxy opened"),e.on("message",(e,t)=>c?.readyState===u.OPEN&&c.send(function(e,t){return t?e:e.toString()}(e,t))),e.on("close",()=>c?.close()),e.on("error",()=>c?.close())}),c.on("message",(t,n)=>e.readyState===u.OPEN&&e.send(n?t:t.toString())),c.on("close",()=>{r({instanceId:i,action:"proxy.ws",path:`/${s}${a}`},"node instance websocket proxy closed"),e.close()}),c.on("error",t=>{r({instanceId:i,action:"proxy.ws",path:`/${s}${a}`,error:t instanceof Error?t.message:String(t)},"node instance websocket proxy failed"),e.close(1011,"Instance websocket proxy failed.")})}catch(t){r({instanceId:i,action:"proxy.ws",path:`/${s}${a}`,error:t instanceof Error?t.message:String(t)},"node instance websocket endpoint unavailable"),c?.close(),e.close(1011,"Instance websocket endpoint is not reachable.")}})}($,{fetchImpl:C,metrics:F,instanceBase:e=>oa(E.requireInstance(e)),syncModelEnvironment:e=>sa(C,E,e),diagnostic:K}),$}async function da(e){const r=Bi(e.dataDir),s=(o=e.host,a=e.port,Tn.parse({bindScope:"0.0.0.0"===o.trim()?"all-ipv4":"loopback",port:a}));var o,a;const d=t.existsSync(r.settingsPath),l=function(e,t){return new Lr(e.settingsPath,()=>({version:1,externalListener:t}),{schema:Ls,sanitize:Fs})}(r,s),u=l.get().externalListener,m=function(e,i={}){return function(e,i={}){t.mkdirSync(n.dirname(e),{recursive:!0});const r={pid:process.pid,hostname:p.hostname(),component:i.component,command:process.argv.join(" "),acquiredAt:(new Date).toISOString(),token:c.randomUUID(),startIdentity:Xi(process.pid),dataDir:i.dataDir,host:i.host,port:i.port,instanceId:i.instanceId};for(let n=0;n<5;n+=1)try{return t.mkdirSync(e),t.writeFileSync(Ji(e),`${JSON.stringify({token:r.token,pid:r.pid,startIdentity:r.startIdentity,startedAt:(new Date).toISOString()})}\n`,{encoding:"utf8",mode:384,flag:"wx"}),nr(e,r),{lockPath:e,owner:r,release(){const n=Zi(e);n?.token===r.token&&t.rmSync(e,{recursive:!0,force:!0})}}}catch(r){if("EEXIST"!==r.code)throw r;const s=Zi(e);if(tr(s))throw new Ki(e,s,i.error);if(!s&&(rr(e)||ar(e)<(i.incompleteLockStaleMs??2e3))){if(n+1<5){or();continue}throw new Ki(e,void 0,i.error)}const o=c.randomUUID();if(!cr(e,o)){if(n+1<5){or();continue}throw new Ki(e,Zi(e),i.error)}const a=Zi(e);if(tr(a))throw sr(Wi(e)),new Ki(e,a,i.error);if(s?.token&&a?.token!==s.token){sr(Wi(e));continue}if(!lr(e,o))continue;t.rmSync(e,{recursive:!0,force:!0})}const s=Zi(e);throw new Ki(e,s,i.error)}(e,{...i,component:"node-agent",error:{label:"Node agent",code:"NODE_AGENT_ALREADY_RUNNING"}})}(n.join(p.tmpdir(),`task-handoff-node-agent-${process.getuid?.()??"user"}.lock`),{dataDir:r.dataDir,host:$s(u.bindScope),port:u.port});try{const s={...e,port:u.port},o=await ca(s),a=o.nodeAgentState;if(!a)throw new Error("Node agent state was not initialized.");const c=new Io(r).resolveNodeId(e.nodeId||process.env.TASK_HANDOFF_NODE_ID),p=function(e,t,n,i){const r=t.token||process.env.TASK_HANDOFF_NODE_AGENT_TOKEN,s=new Io(n),o=new Map;let a=!1;const c=(t,n)=>{n.status=n.lastDisconnectedAt?"reconnecting":"connecting",n.error=void 0;const s=xo(e,{...n.config,nodeId:i,port:()=>e.nodeAgentState.currentListenerPort,token:r});return n.socket=s,s.on("open",()=>{o.get(t)===n&&n.socket===s&&(n.retry.reset(),n.status="connected",n.lastConnectedAt=(new Date).toISOString(),n.error=void 0,e.log.info({nodeId:i,tunnelUrl:new URL(n.config.tunnelUrl).origin},"node agent reverse tunnel connected"))}),s.on("close",(r,d)=>{o.get(t)===n&&n.socket===s&&(n.socket=void 0,n.lastDisconnectedAt=(new Date).toISOString(),n.error=`WebSocket closed${r?` (${r})`:""}${d?`: ${Buffer.isBuffer(d)?d.toString("utf8"):String(d)}`:""}`,a||(e.log.warn({nodeId:i,tunnelUrl:new URL(n.config.tunnelUrl).origin,code:r,reason:Buffer.isBuffer(d)?d.toString("utf8"):String(d||"")},"node agent reverse tunnel disconnected"),((t,n)=>{if(a||n.retry.pending||o.get(t)!==n)return;const r=n.retry.schedule(()=>{a||o.get(t)!==n||n.socket||c(t,n)});r&&(n.status="reconnecting",e.log.info({nodeId:i,tunnelUrl:new URL(n.config.tunnelUrl).origin,attempt:r.attempt,delay:r.delay},"node agent reverse tunnel reconnect scheduled"))})(t,n)))}),s.on("error",e=>{o.get(t)===n&&n.socket===s&&(n.status="failed",n.error=e instanceof Error?e.message:String(e))}),s},d=(e,t)=>{const n=o.get(e);n?.retry.cancel();const i={config:t,retry:new Ei,status:"connecting"};return o.set(e,i),n?.socket?.close(1e3,"Reverse tunnel reconnecting."),c(e,i)},l=(e,t)=>e.tunnelUrl===t.tunnelUrl&&e.keyId===t.keyId&&e.secret===t.secret;return{connectConfigured:()=>{a=!1;const n=new Map,r=s.resolvedControlPlaneAccess(),c=new Set;for(const{connection:t,pairing:s}of r.connections){if(!t.enabled)continue;if(!s){e.log.warn({nodeId:i,connectionId:t.id,pairingKeyId:t.pairingKeyId},"node agent control-plane connection has no pairing");continue}const r=Oo(t.url);n.set(t.id,{tunnelUrl:r,keyId:s.keyId,secret:s.secret}),c.add(r)}const u=function(e){const t=e.controlPlaneTunnelUrl||process.env.TASK_HANDOFF_CONTROL_PLANE_TUNNEL_URL;return t?new URL(t).toString():void 0}(t);if(u&&!c.has(u)){const e=s.reverseTunnelSecret(process.env.TASK_HANDOFF_CONTROL_PLANE_URL,t.remoteSecret||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_SECRET,t.remoteKeyId||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_KEY_ID);n.set(`explicit:${u}`,{tunnelUrl:u,keyId:e?.keyId,secret:e?.secret}),c.add(u)}const p=r.hasPersistedAccess?void 0:function(){const e=process.env.TASK_HANDOFF_CONTROL_PLANE_URL;if(!e)return;const t=new URL(qs,e);return t.protocol="https:"===t.protocol?"wss:":"ws:",t.toString()}();if(p&&!c.has(p)){const e=s.reverseTunnelSecret(process.env.TASK_HANDOFF_CONTROL_PLANE_URL,t.remoteSecret||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_SECRET,t.remoteKeyId||process.env.TASK_HANDOFF_NODE_AGENT_REMOTE_KEY_ID);n.set(`bootstrap:${p}`,{tunnelUrl:p,keyId:e?.keyId,secret:e?.secret})}(e=>{for(const[t,n]of o)e.has(t)||(n.retry.cancel(),o.delete(t),n.socket?.close(1e3,"Reverse tunnel configuration removed."));for(const[t,n]of e){const e=o.get(t);e&&l(e.config,n)||d(t,n)}})(n)},state:e=>{const t=o.get(e);if(t)return{status:t.status,...t.lastConnectedAt?{lastConnectedAt:t.lastConnectedAt}:{},...t.lastDisconnectedAt?{lastDisconnectedAt:t.lastDisconnectedAt}:{},...t.error?{error:t.error}:{}}},closeAll:()=>{a=!0;for(const e of o.values())e.retry.cancel(),e.socket?.close(1001,"Node agent shutting down.");o.clear()}}}({log:o.log,inject:e=>o.inject(e),nodeAgentEventForwarder:o.nodeAgentEventForwarder,nodeAgentState:a},s,r,c);o.decorate("nodeAgentReverseTunnels",p);const g=new Us({app:o,state:a,settings:l,config:u,source:d?"persisted":"bootstrap"});let h;o.decorate("nodeAgentListenerManager",g),function(e){let t=!1;const n=async n=>{if(!t){t=!0,p.closeAll(),h?.close();try{await e.close()}finally{process.exitCode=n?0:process.exitCode}}},i=()=>{n("SIGINT")},r=()=>{n("SIGTERM")};process.once("SIGINT",i),process.once("SIGTERM",r),e.addHook("onClose",async()=>{process.off("SIGINT",i),process.off("SIGTERM",r)})}(o),o.addHook("onClose",async()=>{h?.close(),m.release()});try{await o.ready();const s=e.ipcPath||process.env.TASK_HANDOFF_NODE_AGENT_IPC_PATH||ur(r.dataDir);h=await async function(e,r){!function(e,i=process.platform){if("win32"!==i){t.mkdirSync(n.dirname(e),{recursive:!0,mode:448});try{t.chmodSync(n.dirname(e),448)}catch{}try{t.unlinkSync(e)}catch(e){if("ENOENT"!==e.code)throw e}}}(r);const s=i.createServer((t,n)=>{e.server.emit("request",t,n)});return s.on("upgrade",(t,n,i)=>{e.server.emit("upgrade",t,n,i)}),await new Promise((e,t)=>{s.once("error",t),s.listen(r,()=>{s.off("error",t),e()})}),s}(o,s),await g.start(),p.connectConfigured(),o.nodeAgentStartRecoverySupervisor?.()}catch(e){throw await o.close(),e}}catch(e){throw m.release(),e}}function la(e){const t=Number(e);if(!Number.isInteger(t)||t<=0||t>65535)throw new Error("Port must be a valid TCP port.");return t}function ua(e){if("local-ipc"!==e&&"local-loopback"!==e)throw new Error("Connection mode must be local-ipc or local-loopback.");return e}function pa(e){const t=Number(e);if(!Number.isInteger(t)||t<=0)throw new Error("Expiry must be a positive integer.");return t}(async function(){const t=new e.Command;t.name("task-handoff-node-agent").description("Run a TaskHandoff node agent.").version(E("@task-handoff/cli")).option("--host <host>","Node agent host",process.env.TASK_HANDOFF_NODE_AGENT_HOST||"127.0.0.1").option("-p, --port <port>","Node agent port",la,Number(process.env.TASK_HANDOFF_NODE_AGENT_PORT)||8091).option("--data-dir <path>","Node agent data directory").option("--token <token>","Bearer token required by the control plane").option("--connection-mode <mode>","Local control connection mode",ua).option("--ipc-path <path>","Unix socket path used by local-ipc mode").option("--control-plane-tunnel-url <url>","Control plane reverse WebSocket tunnel URL").action(async e=>{await da({host:e.host,port:e.port,dataDir:e.dataDir,token:e.token,connectionMode:e.connectionMode,ipcPath:e.ipcPath,controlPlaneTunnelUrl:e.controlPlaneTunnelUrl})}),t.command("invite").description("Create a one-time token for pairing this node agent with a control plane.").option("--endpoint <url>","Use the node-agent HTTP endpoint instead of its local IPC socket").option("--ipc-path <path>","Local node-agent IPC socket path").option("--data-dir <path>","Node-agent data directory used to locate its IPC socket").option("--token <token>","Bearer token for local node-agent access",process.env.TASK_HANDOFF_NODE_AGENT_TOKEN).option("--expires-in-ms <ms>","Invite expiry in milliseconds",pa).option("--json","Print raw JSON output").action(async e=>{const n=t.opts(),r=e.ipcPath||n.ipcPath||process.env.TASK_HANDOFF_NODE_AGENT_IPC_PATH,s=e.dataDir||n.dataDir||process.env.TASK_HANDOFF_NODE_AGENT_DATA_DIR,o=e.endpoint?void 0:r||ur(s||Hi()),a=await async function(e){const t={"content-type":"application/json",...e.token?{authorization:`Bearer ${e.token}`}:{}},n=JSON.stringify({...e.expiresInMs?{expiresInMs:e.expiresInMs}:{}}),r=e.endpoint?await fetch(`${e.endpoint.replace(/\/$/,"")}/api/node-agent/pairing/invites`,{method:"POST",headers:t,body:n}):await async function(e,t,n={}){const r=n.method||"GET",s="string"==typeof n.body||n.body instanceof Buffer?n.body:void 0===n.body||null===n.body?void 0:String(n.body),o=new Headers(n.headers||{});return void 0===s||o.has("content-length")||o.set("content-length",String(Buffer.byteLength(s))),new Promise((a,c)=>{const d=i.request({socketPath:e,method:r,path:`/api/node-agent${t}`,headers:Object.fromEntries(o.entries())},e=>{const t=e.statusCode||500;a(new Response("HEAD"!==r&&204!==t&&205!==t&&304!==t?g.Readable.toWeb(e):null,{status:t,headers:e.headers}))});d.on("error",c);const l=()=>d.destroy(new DOMException("The operation was aborted.","AbortError"));n.signal?.aborted?l():n.signal?.addEventListener("abort",l,{once:!0}),d.once("close",()=>n.signal?.removeEventListener("abort",l)),void 0!==s&&d.write(s),d.end()})}(e.ipcPath,"/pairing/invites",{method:"POST",headers:t,body:n}),s=await r.json().catch(()=>({}));if(!r.ok)throw new Error(s.error?.message||`Node agent pairing invite failed with HTTP ${r.status}`);const o="string"==typeof s.data?.joinToken?s.data.joinToken:"";if(!o)throw new Error("Node agent pairing invite response did not include a join token.");return{nodeId:"string"==typeof s.data?.nodeId?s.data.nodeId:"",joinToken:o,expiresAt:"string"==typeof s.data?.expiresAt?s.data.expiresAt:""}}({endpoint:e.endpoint,ipcPath:o,token:e.token,expiresInMs:e.expiresInMs});e.json?console.log(JSON.stringify(a,null,2)):(a.nodeId&&console.log(`Node: ${a.nodeId}`),console.log(`Join token: ${a.joinToken}`),a.expiresAt&&console.log(`Expires: ${a.expiresAt}`))}),await t.parseAsync(process.argv)})().catch(e=>{console.error(e instanceof Error?e.message:String(e)),process.exitCode=1});