@wular/coder 0.4.13 → 0.5.0

package/dist/apps-B6mUToTa.js

@@ -0,0 +1,18 @@
+import{A as e,Ea as t,O as n,P as r,T as i,_ as a,g as o,h as s,j as c,kn as l,pn as u,un as d,w as f,x as p}from"./args-CJsHYWbt.js";import{t as m}from"./errors-DK_trCff.js";import{$ as h,B as g,C as _,D as v,H as y,I as b,N as x,P as S,T as C,U as ee,V as w,Y as te,Z as T,_ as ne,bt as re,c as ie,dt as ae,f as oe,ft as se,g as ce,gt as le,j as ue,k as de,nt as fe,o as pe,ot as E,pt as me,s as he,tt as ge,w as _e}from"./state-Br-Fuaxg.js";import{n as ve,t as ye}from"./types-DHBqXFE2.js";import{B as be,C as xe,E as Se,H as Ce,K as we,P as Te,R as Ee,S as De,T as Oe,U as ke,W as Ae,X as je,_ as Me,j as Ne,k as Pe,l as Fe,r as Ie,w as Le,z as Re}from"./config-D_RuO6gX.js";import{C as ze,D as Be,E as Ve,O as He,S as Ue,T as We,a as Ge,d as Ke,h as qe,i as Je,l as Ye,p as Xe,r as Ze,s as Qe,t as $e,u as et,v as tt,w as nt,x as rt,y as it}from"./connections-Cswv7r8Z.js";import{v as at}from"./app-server-BTpa5GBV.js";import{a as D,c as ot,i as st,n as ct,r as lt,t as ut,u as dt}from"./load-PqaDHiHX.js";import{n as ft,t as pt}from"./integrations-BVmsk64f.js";import{i as mt,n as ht,r as gt,t as _t}from"./crypto-Ittsv-m4.js";import{a as vt,d as yt,f as bt,n as xt,o as St,r as Ct,s as wt,t as Tt,u as Et}from"./definition-4on4SG5J.js";import{M as Dt,S as Ot,d as kt,f as At,i as jt,l as Mt,o as Nt,p as Pt,r as Ft,s as It,y as Lt}from"./dispatch-BaW2X6Sc.js";import{C as Rt,_ as zt,b as Bt,d as Vt,l as Ht,n as Ut,p as Wt,s as Gt,t as Kt,w as qt,x as Jt,y as Yt}from"./approvals-CRwkc9vB.js";import{i as Xt,t as Zt}from"./discover-DvzAbQvU.js";import{a as Qt,c as $t,l as en,o as tn,r as nn,s as rn}from"./view-D-rbQ1Kz.js";import{c as an,d as on,g as sn,n as cn,s as ln,v as un}from"./actions-CkMAM1Km.js";import{S as dn,c as fn,s as pn}from"./executor-Chc0zawh.js";import{a as mn,i as hn,r as gn,t as _n}from"./mcp-BGx48pyR.js";import{i as vn,n as yn}from"./turn-Cc-v-eSy.js";import{c as bn,f as xn,n as Sn,o as Cn,r as wn,t as Tn,u as En}from"./exec-CAaYFJD1.js";import{i as Dn}from"./models-D1NXi6ni.js";import{a as O,c as On,d as k,f as A,h as kn,i as An,l as j,m as jn,n as Mn,p as M,r as Nn,u as Pn}from"./http-DRk8cDjf.js";import{i as Fn}from"./async-CNhQ4wyZ.js";import{n as In,r as Ln,t as Rn,u as zn}from"./task-N0qhnKpK.js";import{n as Bn,r as Vn,t as Hn}from"./local-BMGcCk8N.js";import{n as Un}from"./env-_AxrvBXP.js";import{a as Wn,c as Gn,d as Kn,o as qn,r as Jn,s as Yn,t as Xn,u as Zn}from"./github-actions-2RjyRseX.js";import{C as Qn,S as $n,T as er,_ as tr,a as nr,b as rr,c as ir,d as N,f as ar,g as or,h as sr,i as cr,m as lr,n as ur,o as dr,p as fr,t as pr,u as mr,w as hr,y as gr}from"./local-BzZuOwgI.js";import{n as _r,t as vr}from"./chat-Bfu9XKRa.js";import P from"node:path";import yr from"node:process";import{fileURLToPath as br,pathToFileURL as xr}from"node:url";import F,{accessSync as Sr,constants as Cr,existsSync as wr,readFileSync as Tr,statSync as Er}from"node:fs";import{execFile as Dr,spawn as Or}from"node:child_process";import kr,{isIP as Ar}from"node:net";import jr from"node:os";import{createCipheriv as Mr,createDecipheriv as Nr,createHash as Pr,createHmac as Fr,randomBytes as I,randomUUID as L}from"node:crypto";import{isDeepStrictEqual as Ir,promisify as Lr}from"node:util";import{brotliDecompressSync as Rr,constants as zr,createGzip as Br,gunzip as Vr,gunzipSync as Hr,gzip as Ur,gzipSync as Wr,inflateSync as Gr}from"node:zlib";import{lookup as Kr}from"node:dns/promises";import{request as qr}from"node:https";const Jr=e=>`nonce:${mt(e)}`;function Yr(e){let t=e.config.encryptionKey??e.config.adminToken;if(!t)throw Error(`A server secret is required to issue browser transactions.`);return t}function Xr(e,t){return Fr(`sha256`,Yr(e)).update(t).digest(`base64url`)}async function Zr(e,t,n,r,i=6e5){let a=(e.now??Date.now)(),o={kind:t,user:n,organization:e.organizationId,nonce:I(18).toString(`base64url`),exp:a+i},s=ht(o),c=`${s}.${Xr(e,s)}`;return await e.store.put(`delivery`,Jr(c),{at:a,target:r},{ttlMs:i}),c}function Qr(e,t){let[n,r,i]=t.split(`.`);if(!(!n||!r||i!==void 0)&&gt(Xr(e,n),r))try{return _t(n)}catch{return}}async function $r(e,t){let n=await e.store.get(`delivery`,Jr(t));return n&&`target`in n?n.target:void 0}function ei(e,t){return Qr(e,t)?.organization}function ti(e,t){return Qr(e,t)?.user}function ni(e,t,n,r,i=!0){let a=Qr(e,t);return a&&a.kind===n&&(a.user===r||i&&a.user===`*`)&&a.organization===e.organizationId&&a.exp>=(e.now??Date.now)()?a:void 0}async function ri(e,t,n,r,i){if(!ni(e,t,n,r,!1))return!1;let a=await e.store.take(`delivery`,Jr(t),{target:i});return!!a&&`target`in a&&a.target===i}async function ii(e,t,n,r){if(!ni(e,t,n,r))return;let i=await e.store.take(`delivery`,Jr(t));return i&&`target`in i?i.target:void 0}async function ai(e,t,n,r){return ni(e,t,n,r)?$r(e,t):void 0}const oi=f({env:n(c(),c().check(u(1)))}),si=`plain`;function ci(e,t=`SERVER_ENCRYPTION_KEY`){if(!e)return;let n=Buffer.from(e,`base64`);if(n.length!==32)throw Error(`${t} must be a base64-encoded 32-byte key`);return n}function li(e){return ci(e.encryptionKey)}function ui(e){let t=ci(e);return t?Pr(`sha256`).update(t).digest().readInt32BE(0):0}function di(e){return[[e.encryptionKey,`SERVER_ENCRYPTION_KEY`],[e.previousEncryptionKey,`SERVER_ENCRYPTION_KEY_PREVIOUS`]].filter(e=>!!e[0]).map(([e,t])=>({value:ci(e,t),version:ui(e)}))}function fi(e){let t=oi.safeParse(e);if(!t.success||!Object.keys(t.data.env).length)throw Error(`Invalid engine credential`);return t.data}function pi(e,t){let n=li(e);if(!n)return{iv:si,tag:``,ciphertext:Buffer.from(JSON.stringify(fi(t))).toString(`base64`)};let r=I(12),i=Mr(`aes-256-gcm`,n,r),a=Buffer.concat([i.update(JSON.stringify(fi(t)),`utf8`),i.final()]);return{iv:r.toString(`base64`),tag:i.getAuthTag().toString(`base64`),ciphertext:a.toString(`base64`)}}function mi(e,t){if(t.iv===si)return fi(JSON.parse(Buffer.from(t.ciphertext,`base64`).toString(`utf8`)));for(let n of di(e))try{let e=Nr(`aes-256-gcm`,n.value,Buffer.from(t.iv,`base64`));return e.setAuthTag(Buffer.from(t.tag,`base64`)),fi(JSON.parse(Buffer.concat([e.update(Buffer.from(t.ciphertext,`base64`)),e.final()]).toString(`utf8`)))}catch{}throw Error(`Stored credential was sealed with an unavailable encryption key`)}function R(e,t){let n=li(e);if(!n)return`${si}.${Buffer.from(JSON.stringify(t)).toString(`base64`)}`;let r=I(12),i=Mr(`aes-256-gcm`,n,r),a=Buffer.concat([i.update(JSON.stringify(t),`utf8`),i.final()]);return[r,i.getAuthTag(),a].map(e=>e.toString(`base64`)).join(`.`)}function z(e,t){if(t.startsWith(`${si}.`))return JSON.parse(Buffer.from(t.slice(6),`base64`).toString(`utf8`));let[n,r,i]=t.split(`.`).map(e=>Buffer.from(e,`base64`));for(let t of di(e))try{let e=Nr(`aes-256-gcm`,t.value,n);return e.setAuthTag(r),JSON.parse(Buffer.concat([e.update(i),e.final()]).toString(`utf8`))}catch{}throw Error(`Stored secret was sealed with an unavailable encryption key`)}function hi(e,t){if(t.startsWith(`${si}.`))return 0;let[n,r,i]=t.split(`.`).map(e=>Buffer.from(e,`base64`));for(let t of di(e))try{let e=Nr(`aes-256-gcm`,t.value,n);return e.setAuthTag(r),e.update(i),e.final(),t.version}catch{}throw Error(`Stored secret was sealed with an unavailable encryption key`)}const gi=[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`];function _i(e,t,n,r={}){return{method:e,pattern:t,handler:n,...r}}function vi(e,t,n){return t.map(t=>({...t,pattern:e+t.pattern,...n&&!t.guard?{guard:n}:{}}))}function yi(e,t,n){return[e,`${e}/*`].flatMap(e=>gi.map(r=>_i(r,e,t,{guard:n})))}function bi(e,t){let[n,r]=[e.split(`/`),t.split(`/`)],i=n.at(-1)===`*`;if(i?r.length<n.length:r.length!==n.length)return;let a={};for(let e=0;e<n.length;e++){let[t,o]=[n[e],r[e]];if(t===`*`&&i){a[`*`]=r.slice(e).join(`/`);break}if(t[0]===`:`){if(!o)return;a[t.slice(1)]=o}else if(t!==o)return}return a}async function xi(e,t,n,r){for(let i of e){let a=bi(i.pattern,r.pathname);if(!a)continue;for(let e of Object.keys(a))e!==`*`&&(a[e]=decodeURIComponent(a[e]));let o=e.filter(e=>e.pattern===i.pattern),s=o.find(e=>e.method===t.method),c=(s??i).guard;if(c){let e=await c(t,n,a,r);if(e instanceof Response)return e;n=e}if(s)return s.handler(t,n,a,r);let l=On();return l.headers.set(`allow`,[...new Set(o.map(e=>e.method))].join(`, `)),l}}const Si=[`default-src 'self'`,`style-src 'self' 'unsafe-inline'`,`img-src 'self' data:`,`connect-src 'self'`,`object-src 'none'`,`base-uri 'none'`,`frame-ancestors 'none'`,`form-action ${[`'self'`,...new Set(Object.values(pt).flatMap(e=>e.app.postOrigins??[]))].join(` `)}`];function Ci(e){let t=P.dirname(br(e));for(;;){let e=P.join(t,`package.json`);if(wr(e))try{if(JSON.parse(Tr(e,`utf8`)).name===`@wular/coder`)return t}catch{}let n=P.dirname(t);if(n===t)break;t=n}throw Error(`Cannot locate the Coder package root.`)}function wi(e=import.meta.url){let t=P.dirname(br(e)),n=Ci(e),r=br(new URL(`./dash/standalone/server/entry.js`,import.meta.url));return[P.resolve(r,`../../..`),P.join(n,`dist/dash`),P.join(t,`../dash`)].find(e=>wr(Ti(e)))}const Ti=e=>P.join(e,`standalone/server/manifest.json`);function Ei(e){let t=P.join(e,`standalone/server/entry.js`);if(!wr(t))throw Error(`The Coder dashboard server bundle is missing.`);return t}async function Di(e){let t=JSON.parse(Tr(Ti(e),`utf8`));return{handler:await(await import(xr(Ei(e)).href)).createRequestHandler({root:P.join(e,`standalone`)}),manifest:t}}var Oi=class{moduleUrl;root;loaded;constructor(e=import.meta.url){this.moduleUrl=e}host(){let e=Date.now(),t=this.loaded;if(t&&e-t.checked<1e3)return t.host;if(this.root??=wi(this.moduleUrl),!this.root)return;let n;try{n=Er(Ti(this.root)).mtimeMs}catch{}if(t&&(t.checked=e,n===void 0||n===t.build))return t.host;let r={build:n,checked:e,host:Di(this.root)};return r.host.catch(()=>{this.loaded===r&&(this.loaded=void 0)}),this.loaded=r,r.host}};const ki=e=>e.length>1&&e.endsWith(`/`)?e.slice(0,-1):e;function Ai(e,t){let n=ki(e);return!!(bi(`/assets/*`,n)||bi(`/dash/*`,n)||t.routes.some(e=>bi(e.route,n)))}async function ji(e,t=new Oi){return!!(await t.host()?.catch(()=>void 0))?.manifest.routes.some(t=>bi(t.route,ki(e)))}const Mi=/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi,Ni=e=>`'sha256-${Pr(`sha256`).update(e).digest(`base64`)}'`;function Pi(e){let t=[...e.matchAll(Mi)].map(e=>Ni(e[1]));return[...Si,`script-src 'self' ${t.join(` `)}`.trim()].join(`; `)}function Fi(e,t){return t===`gzip`?Hr(e).toString(`utf8`):t===`br`?Rr(e).toString(`utf8`):t===`deflate`?Gr(e).toString(`utf8`):e.toString(`utf8`)}const Ii=e=>(e.headers.get(`accept-encoding`)??``).split(`,`).some(e=>{let[t,...n]=e.split(`;`).map(e=>e.trim()),r=n.find(e=>e.startsWith(`q=`));return t===`gzip`&&(!r||Number(r.slice(2))>0)});function Li(e){e.set(`content-encoding`,`gzip`),/accept-encoding/i.test(e.get(`vary`)??``)||e.append(`vary`,`accept-encoding`)}function Ri(e){let t=Br(),n=e=>new Promise(n=>{t.write(e),t.flush(zr.Z_SYNC_FLUSH,()=>n())}),r=!1;return new ReadableStream({start(e){t.on(`data`,t=>e.enqueue(new Uint8Array(t))),t.on(`end`,()=>e.close()),t.on(`error`,t=>e.error(t))},async pull(){if(r)return;let{done:i,value:a}=await e.read();if(!i)return n(a);r=!0,t.end()},cancel(n){return t.destroy(),e.cancel(n)}})}function zi(e,t,n,r){n.set(`content-security-policy`,[...Si,`script-src 'self' 'nonce-${r}'`].join(`; `));let i=t.body;return Ii(e)&&(Li(n),i=Ri(i.getReader())),new Response(i,{status:t.status,statusText:t.statusText,headers:n})}async function Bi(e,t,n){let r=new Headers(t.headers);if(r.set(`x-content-type-options`,`nosniff`),!(r.get(`content-type`)??``).includes(`text/html`))return new Response(t.body,{status:t.status,statusText:t.statusText,headers:r});r.set(`cache-control`,`no-store`),r.delete(`content-length`);let i=r.get(`content-encoding`);if(!i&&t.body)return zi(e,t,r,n);let a=Buffer.from(await t.arrayBuffer()),o=Fi(a,i);r.set(`content-security-policy`,Pi(o));let s=i?new Uint8Array(a):o;return!i&&o.length>1024&&Ii(e)&&(s=new Uint8Array(Wr(o)),Li(r)),new Response(s,{status:t.status,statusText:t.statusText,headers:r})}async function Vi(e,t=new Oi){let n=await t.host();if(!n||!Ai(new URL(e.url).pathname,n.manifest))return;let r=I(16).toString(`base64`),i=new Headers(e.headers);return i.set(`content-security-policy`,`script-src 'nonce-${r}'`),Bi(e,await n.handler(new Request(e,{headers:i})),r)}const Hi=(e,t,n=!1)=>`coder_admin=${encodeURIComponent(t)}; HttpOnly; SameSite=Strict; Path=/${new URL(e.url).protocol===`https:`?`; Secure`:``}${n?`; Max-Age=0`:``}`;function Ui(e,t){let n=e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim();if(!n)return t.origin;let r=e.headers.get(`x-forwarded-proto`)?.split(`,`,1)[0]?.trim()??t.protocol.slice(0,-1);try{return new URL(`${r}://${n}`).origin}catch{return t.origin}}async function Wi(e,t,n,r){let i=await e.formData(),a=i.get(`token`),o=i.get(`return`),s=jn(typeof o==`string`&&o.startsWith(`/`)?o:null,new URL(e.url).origin);return typeof a==`string`?a?h_(a,t.config.adminToken)?new Response(null,{status:303,headers:{location:s,"set-cookie":Hi(e,a)}}):M(`/dash?token=rejected`,303):new Response(null,{status:303,headers:{location:s,"set-cookie":Hi(e,``,!0)}}):M(`/dash?token=rejected`,303)}async function Gi(e,t,n,r){return M(!t.auth||t.session?`/dash`:r.searchParams.has(`signed_out`)?`/login?signed_out=1`:`/login`)}async function Ki(e,t,n,r){let i=`/api/auth/sign-in?return=${encodeURIComponent(jn(r,n.origin))}`,a=t.config.publicUrl;return a&&new URL(Ui(e,n)).host!==new URL(a).host?M(new URL(i,a).href):t.auth.handler(new Request(`${n.origin}${i}`))}async function qi(e,t,n,r){return t.auth?!r.searchParams.has(`signed_out`)&&!r.searchParams.has(`error`)?Ki(e,t,r,r.searchParams.get(`return`)):Zi(e,t):M(`/dash`)}function Ji(e,t){let n=new Headers(e.headers);n.set(`x-coder-mode`,y_(t));let r=t.session?.organizations.find(e=>e.id===t.organizationId);return r?n.set(`x-coder-organization`,r.slug):n.delete(`x-coder-organization`),new Request(e,{headers:n})}const Yi=()=>new Response(`UI is not built`,{status:503}),Xi=e=>async(t,n)=>await Vi(Ji(t,n),n.dashboardHosts)??e(),Zi=Xi(Yi),Qi=Xi(j);var $i=t({appOwner:()=>na,chosenOrganization:()=>ea,forInstallation:()=>V,linkedOrganizations:()=>ta,scoped:()=>B});function ea(e,t){let n=e.organizations.find(e=>e.slug===t||e.id===t);return n?{...e,organizationId:n.id,role:n.role}:{...e,organizationId:void 0,role:void 0,organizationDenied:!0}}const ta=e=>({organizations:e.map(e=>e.id),roles:Object.fromEntries(e.map(e=>[e.id,e.role]))});function B(e,t){return t===e.organizationId||!e.scope?e:e.scope(t)}async function na(e,t){if(!e.appRecord){let n=await e.store.get(`app`,t);return n&&{ctx:e,app:n}}let n=await e.appRecord(t);return n&&{ctx:B(e,n.organizationId),app:n.app}}async function V(e,t){if(e.boundInstallation?.installation.id===t)return{...B(e,e.boundInstallation.organizationId),boundInstallation:e.boundInstallation};if(!e.installationOrganization)return e;let n=await e.installationOrganization(t);return n===void 0?void 0:B(e,n)}function ra(e,t,n={}){let r=`coder-${e.id.replace(/[^a-zA-Z0-9_.-]/g,`-`).slice(0,48)}-${Date.now()}`;t={...t,CODER_RUNNER_IMAGE:n.image??`ghcr.io/muzam1l/coder-runner:latest`,CODER_RUNNER_TARBALL_URL:Zn(t.CODER_SERVER)};let i=Object.keys(t).flatMap(e=>[`-e`,e]);return{args:[`run`,`-d`,`--name`,r,`--memory`,String(n.memory??`4g`),`--cpus`,String(n.cpus??2),`--pids-limit`,String(n.pidsLimit??512),`--network`,n.network??`bridge`,...i,n.image??`ghcr.io/muzam1l/coder-runner:latest`,`sh`,`-c`,Kn(``,`for binary in node bun git curl tar claude codex github-mcp-server; do command -v "$binary" >/dev/null 2>&1 || { printf "Docker image %s is missing required binary %s\\n" "$CODER_RUNNER_IMAGE" "$binary"; exit 127; }; done`),`coder-task`,e.id,Yn],env:t}}var ia=class{options;kind=`local-docker`;constructor(e={}){this.options=e}async start(e,t){let n=ra(e,{...t,CODER_INBOX_SOCKET:In},this.options),r=await Bn(`docker`,n.args,{PATH:yr.env.PATH??``,...n.env});if(r.code!==0)throw Error(r.stderr.trim()||`docker run failed`);return r.stdout.trim()}async status(e){let t=await Bn(`docker`,[`inspect`,`--format`,`{{.State.Running}} {{.State.ExitCode}}`,e],{PATH:yr.env.PATH??``});if(t.code!==0)return{state:`exited`};let[n,r]=t.stdout.trim().split(/\s+/);return n===`true`?{state:`running`}:{state:`exited`,code:Number(r)||0}}async stop(e){await Bn(`docker`,[`rm`,`-f`,e],{PATH:yr.env.PATH??``})}async push(e,t){let n=await Bn(`docker`,[`exec`,`-e`,`CODER_INBOX_MESSAGES`,e,`node`,`-e`,Rn],{PATH:yr.env.PATH??``,CODER_INBOX_MESSAGES:JSON.stringify(t)});if(n.code!==0)throw Error(`Docker inbox delivery failed`);return JSON.parse(n.stdout)}};async function aa(e,t){return await new Promise((n,r)=>{e(`docker`,[`info`],{timeout:5e3,signal:t},e=>e?r(new Pa(`Docker is unavailable`)):n())}),`Docker is available`}function oa(e){if(e.cpus&&!(Number(e.cpus)>0&&Number.isFinite(Number(e.cpus))))throw Error(`CPUs must be positive`)}function sa(e){if(!Ar(e))return!0;if(Ar(e)===6){let t=new URL(`https://[${e}]/`).hostname.slice(1,-1).split(`::`),n=t[0]?t[0].split(`:`):[],r=t[1]?t[1].split(`:`):[],i=[...n,...Array(8-n.length-r.length).fill(`0`),...r].map(e=>parseInt(e,16));if(i.every(e=>e===0)||i.slice(0,7).every(e=>e===0)&&i[7]===1||(i[0]&65024)==64512||(i[0]&65472)==65152||(i[0]&65280)==65280)return!0;let a;if(i.slice(0,5).every(e=>e===0)&&(i[5]===0||i[5]===65535))a=i.slice(6);else if(i.slice(0,4).every(e=>e===0)&&i[4]===65535&&i[5]===0)a=i.slice(6);else if((i[4]===0||i[4]===512)&&i[5]===24318)a=i.slice(6);else if(i[0]===100&&i[1]===65435&&i.slice(2,6).every(e=>e===0))a=i.slice(6);else if(i[0]===8194)a=i.slice(1,3);else if(i[0]===8193&&(i[1]===0||i[1]===3512)||i[0]===100&&i[1]===65435&&i[2]===1)return!0;if(!a)return!1;e=a.flatMap(e=>[e>>8,e&255]).join(`.`)}let t=e.split(`.`).map(Number);return t[0]===0||t[0]===10||t[0]===127||t[0]===169&&t[1]===254||t[0]===172&&t[1]>=16&&t[1]<=31||t[0]===192&&t[1]===168||t[0]===192&&t[1]===0&&(t[2]===0||t[2]===2)||t[0]===198&&t[1]>=18&&t[1]<=19||t[0]===198&&t[1]===51&&t[2]===100||t[0]===203&&t[1]===0&&t[2]===113||t[0]===100&&t[1]>=64&&t[1]<=127||t[0]>=224}async function ca(e,t=Kr){let n=e.replace(/^\[|\]$/g,``),r=Ar(n)?[{address:n,family:Ar(n)}]:await t(n,{all:!0});if(!r.length)throw Error(`${n} resolved no address`);if(r.some(e=>sa(e.address)))throw Error(`Coder refuses private and metadata addresses`);return r[0]}function la(e,t,n,r=qr,i=1/0){return new Promise((a,o)=>{let s=r(e,{method:t.method,headers:t.headers,signal:t.signal??void 0,agent:!1,lookup:(e,t,r)=>{t.all?r(null,[n]):r(null,n.address,n.family)}},e=>{let t=[],n=0;e.on(`data`,e=>{if(n+=e.length,n<=i)return t.push(Buffer.from(e));o(Error(`Response is over ${i} bytes`)),s.destroy()}),e.on(`error`,o),e.on(`end`,()=>a(new Response(e.statusCode===204?null:Buffer.concat(t),{status:e.statusCode})))});s.on(`error`,o),s.end(t.body)})}var ua=class{options;kind=`http`;base;fetcher;resolver;constructor(e){if(this.options=e,!e?.url)throw Error(`The http runner requires RUNNER_CONFIG.url`);if(this.base=new URL(`${e.url.replace(/\/+$/,``)}/`),this.base.protocol!==`https:`)throw Error(`The http runner requires an HTTPS URL`);if(this.base.username||this.base.password)throw Error(`The http runner URL cannot contain credentials`);if(!e.secret)throw Error(`RUNNER_CONFIG.secret is required for the http runner`);this.fetcher=e.fetch,this.resolver=e.lookup}send(e,t,n){return this.fetcher?this.fetcher(e,t):la(e,t,n,this.options.request)}async request(e,t=`GET`,n,r){let i=await ca(this.base.hostname,this.resolver),a=n===void 0?``:JSON.stringify(n),o=String(Date.now()),s=I(16).toString(`base64url`),c=Fr(`sha256`,this.options.secret).update(`${a}.${o}.${s}`).digest(`base64url`),l=await this.send(new URL(e.replace(/^\//,``),this.base),{method:t,redirect:`manual`,headers:{...this.options.headers,"content-type":`application/json`,"x-coder-timestamp":o,"x-coder-nonce":s,"x-coder-signature":c},...a?{body:a}:{},signal:r??AbortSignal.timeout(e===`/start`?3e4:1e4)},i);if(l.status>=300&&l.status<400)throw Error(`The http runner refuses redirects`);if(!l.ok)throw Error(`HTTP runner request failed: ${l.status}`);if(l.status===204)return;let u=await l.text();return u?JSON.parse(u):void 0}health(e){return this.request(`/health`,`GET`,void 0,e)}async start(e,t){let n=await this.request(`/start`,`POST`,{task:e.id,env:t});if(!n.handle)throw Error(`HTTP runner returned no handle`);return n.handle}status(e){return this.request(`/status/${encodeURIComponent(e)}`)}async stop(e){await this.request(`/stop/${encodeURIComponent(e)}`,`POST`,{})}push(e,t){return this.request(`/messages/${encodeURIComponent(e)}`,`POST`,{entries:t})}};async function da(e,t){if(!(e instanceof ua)||!(await e.health(t)).ok)throw new Pa(`Runner health check failed`);return`Runner is reachable`}function fa(e){if(e.secret.length<32)throw Error(`Secret must contain at least 32 characters`);new ua({url:e.url,secret:e.secret})}const pa=e=>_t(e),ma=18e5,ha=864e5;function ga(e,t=``){return{get:n=>e.get(`snapshot`,`${t}${n}`),put:(n,r)=>e.put(`snapshot`,`${t}${n}`,r,{ttlMs:ha}),withLock:(n,r)=>e.withAppLock(`snapshot:${t}${n}`,e=>r({get:n=>e.get(`snapshot`,`${t}${n}`),put:(n,r)=>e.put(`snapshot`,`${t}${n}`,r,{ttlMs:ha})}))}}const _a={"eu-north-1":`arn1`,"ap-south-1":`bom1`,"eu-west-3":`cdg1`,"us-east-2":`cle1`,"af-south-1":`cpt1`,"eu-west-1":`dub1`,"eu-central-1":`fra1`,"sa-east-1":`gru1`,"ap-east-1":`hkg1`,"ap-northeast-1":`hnd1`,"us-east-1":`iad1`,"ap-northeast-2":`icn1`,"ap-northeast-3":`kix1`,"eu-west-2":`lhr1`,"us-west-2":`pdx1`,"us-west-1":`sfo1`,"ap-southeast-1":`sin1`,"ap-southeast-2":`syd1`,"ca-central-1":`yul1`};function va(e){if(!e)return;let t=(()=>{try{return new URL(e).hostname}catch{return``}})();return Object.entries(_a).find(([e])=>t.includes(e))?.[1]}const ya=[{name:`ANTHROPIC_API_KEY`,host:`api.anthropic.com`,header:`x-api-key`,prefix:``},{name:`OPENAI_API_KEY`,host:`api.openai.com`,header:`authorization`,prefix:`Bearer `}],ba={claude:{api:`api.anthropic.com`,account:[`claude.ai`,`platform.claude.com`]},codex:{api:`api.openai.com`,account:[`auth.openai.com`,`chatgpt.com`]}};function xa(e,t){let n=ba[e],r=t.CLAUDE_CODE_OAUTH_TOKEN||t.CODEX_AUTH_JSON,i=[t.ANTHROPIC_BASE_URL,t.OPENAI_BASE_URL].filter(e=>e&&URL.canParse(e));return[...n?[n.api,...r?n.account:[]]:[],...i.map(e=>new URL(e).hostname)]}function Sa(e={},t,n=ya){let r={};for(let t of n)e[t.name]&&((r[t.host]??={})[t.header]=`${t.prefix}${e[t.name]}`);let i=Object.entries(r).map(([e,t])=>[e,[{transform:[{headers:t}]}]]);if(!t)return i.length?{allow:{...Object.fromEntries(i),"*":[]}}:void 0;let a=[...new Set(t.filter(e=>kr.isIP(e)))],o=t.filter(e=>!kr.isIP(e)).map(e=>[e,[]]);return{allow:{...Object.fromEntries(o),...Object.fromEntries(i)},...a.length?{subnets:{allow:a.map(e=>`${e}/${kr.isIPv6(e)?128:32}`)}}:{}}}function Ca(e){return[...[e.CODER_SERVER,e.CODER_RUNNER_TARBALL_URL].filter(e=>e&&URL.canParse(e)).map(e=>new URL(e).hostname),...Object.values(pt).flatMap(e=>e.tools.installHosts??[])]}function wa(e,t,n){return Sa(t,n.hosts&&[...Ca(e),...n.hosts],n.brokered)}async function Ta(){try{let{Sandbox:e,Snapshot:t}=await import(`@vercel/sandbox`);return{create:t=>e.create(t),get:t=>e.get(t),deleteSnapshot:async e=>(await t.get(e)).delete()}}catch{throw Error(`The vercel-sandbox runner requires @vercel/sandbox in the adapter app.`)}}function Ea(e){return e&&typeof e==`object`&&`response`in e&&e.response instanceof Response?e.response.status:void 0}function Da(e){if(Ea(e)!==410||!e||typeof e!=`object`||!(`json`in e))return!1;let t=e.json;if(!t||typeof t!=`object`||!(`error`in t))return!1;let n=t.error;return!!n&&typeof n==`object`&&`code`in n&&n.code===`snapshot_not_found`}var Oa=class extends Error{snapshotId;constructor(e,t,n){super(e,n),this.snapshotId=t}},ka=class{options;kind=`vercel-sandbox`;sandboxes=new Map;constructor(e={}){this.options=e}api(){return this.options.sandbox?Promise.resolve(this.options.sandbox):Ta()}async sandbox(e){for(let[e,t]of this.sandboxes)t.expiresAt<=this.now()&&this.sandboxes.delete(e);return this.sandboxes.get(e)?.sandbox??(await this.api()).get({...this.auth(),name:e})}now(){return(this.options.now??Date.now)()}auth(){return{...this.options.token?{token:this.options.token,projectId:this.options.projectId??process.env.VERCEL_PROJECT_ID,teamId:this.options.team??process.env.VERCEL_TEAM_ID}:{}}}base(e){return{...e?{source:{type:`snapshot`,snapshotId:e}}:this.options.image?{image:this.options.image}:{},...this.options.region?{region:this.options.region}:{},...this.auth(),resources:{vcpus:this.options.vcpus??1},persistent:!1}}snapshotKey(e){let t=e.event?.repo;if(!t)return;let n=[Gn(),this.options.image??null,e.event.appId,e.event.installationId,t.owner,t.name];return`repo:${this.options.region??``}:${mt(JSON.stringify(n))}`}async stopSandbox(e){try{await e.stop()}finally{this.sandboxes.delete(e.name)}}async withSandbox(e,t){let n;try{if(n=typeof e==`string`?await this.sandbox(e):e,n.status!==`running`&&n.status!==`pending`)throw new Oa(`Vercel Sandbox ${n.name} is ${n.status}`);return await t(n)}catch(t){let r=Ea(t);throw(r===404||r===410)&&typeof e==`string`&&this.sandboxes.delete(e),r===410||!n&&typeof e==`string`&&r===404?new Oa(t instanceof Error?t.message:`Vercel Sandbox expired`,void 0,{cause:t}):t}}withSnapshotLock(e,t){let n=this.options.snapshots;return n.withLock?n.withLock(e,t):t(n)}async finalizeSnapshot(e,t){let n=this.now(),r=L(),i=await this.withSnapshotLock(e,async i=>{let a=await i.get(e)??{};if(!a.build||a.lease&&a.lease.expiresAt>n||t?.build&&(a.build.sandbox!==t.build.sandbox||a.build.command!==t.build.command||a.build.startedAt!==t.build.startedAt))return a;let o={...a,lease:{owner:r,expiresAt:n+ma}};return await i.put(e,o),o});if(i.lease?.owner!==r||!i.build)return i;let{build:a,lease:o,...s}=i,c={...s,build:a};try{c=await this.withSandbox(a.sandbox,async e=>{let t=await e.getCommand(a.command);if(t.exitCode===null&&n-a.startedAt<ma)return c;if(t.exitCode===0){let r=/^coder-snapshot (\S+)$/m.exec(await t.stdout())?.[1];if(r&&r===i.sha)return await this.stopSandbox(e).catch(()=>{}),{...s,checkedAt:n};let a=await e.snapshot({expiration:ha});return this.sandboxes.delete(e.name),{...s,snapshotId:a.snapshotId,...r?{sha:r}:{},checkedAt:n}}return await this.stopSandbox(e).catch(()=>{}),{...s,failedAt:n}})}catch(t){if(t instanceof Oa){let{failedAt:e,...t}=s;c=t}else console.error(`coder server: snapshot ${e} failed; tasks start without a new one`,t),await this.withSandbox(a.sandbox,e=>this.stopSandbox(e)).catch(()=>{}),c={...s,failedAt:n}}let l=await this.withSnapshotLock(e,async t=>{let n=await t.get(e)??{};return n.lease?.owner===r?(await t.put(e,c),c):n});return l===c&&s.snapshotId&&c.snapshotId!==s.snapshotId&&await this.deleteSnapshot(s.snapshotId),l}async deleteSnapshot(e){try{await(await this.api()).deleteSnapshot({...this.auth(),snapshotId:e})}catch(t){[404,410].includes(Ea(t)??0)||console.error(`coder server: could not delete replaced snapshot ${e}`,t)}}async snapshot(e,t,n,r){if(!this.options.snapshots)return;let i=await this.finalizeSnapshot(e);if(i.build)return i.snapshotId;let a=this.now(),o=L(),s=await this.withSnapshotLock(e,async t=>{let r=await t.get(e)??{},i=!r.snapshotId||n&&a-(r.checkedAt??0)>=9e5,s=r.failedAt!==void 0&&a-r.failedAt<36e5;if(r.build||r.lease&&r.lease.expiresAt>a||!i||s)return r;let c={...r,lease:{owner:o,expiresAt:a+ma}};return await t.put(e,c),c});if(s.lease?.owner!==o)return s.snapshotId;let c,l;try{c=await t(s.snapshotId)}catch(t){t instanceof Oa?l=t:console.error(`coder server: snapshot ${e} failed; tasks start without a new one`,t)}let u=await this.withSnapshotLock(e,async t=>{let n=await t.get(e)??{};if(n.lease?.owner!==o)return n;let{lease:r,...i}=n,s={...i,...c?{build:{sandbox:c.sandbox,command:c.command,startedAt:a}}:l?{}:{failedAt:a}};return await t.put(e,s),s});if(c)if(u.build?.sandbox===c.sandbox&&u.build.command===c.command){let t=(async()=>{await c.wait(),await this.finalizeSnapshot(e,u)})().catch(()=>{});r?.(t)}else await this.withSandbox(c.sandbox,e=>this.stopSandbox(e)).catch(()=>{});if(l)throw l;return u.snapshotId}async detached(e,t,n={}){let r=await(await this.api()).create({...this.base(e),timeout:this.options.timeoutMs??18e5,...n}).catch(t=>{throw e&&Da(t)?new Oa(t.message,e,{cause:t}):t});if(!t.env?.CODER_PREPARE){for(let[e,t]of this.sandboxes)t.expiresAt<=this.now()&&this.sandboxes.delete(e);this.sandboxes.size>=1e3&&this.sandboxes.delete(this.sandboxes.keys().next().value),this.sandboxes.set(r.name,{sandbox:r,expiresAt:this.now()+Number(n.timeout??this.options.timeoutMs??ma)})}try{let e=await this.withSandbox(r,e=>e.runCommand({...t,detached:!0}));return{sandbox:r.name,command:e.cmdId,wait:()=>e.wait({signal:AbortSignal.timeout(ma)})}}catch(e){throw this.sandboxes.delete(r.name),await this.stopSandbox(r).catch(()=>{}),e}}async start(e,t,n,r={}){t={...t,[Fe]:`1`,CODER_RUNNER_TARBALL_URL:Zn(t.CODER_SERVER),CODER_RUNNER_HASH:Gn()};let i=wa(t,n,r),a=t=>({cmd:`sh`,args:[`-c`,Kn(Vn().map(e=>`sudo sh -c '${e.replaceAll(`'`,`'\\''`)}'`).join(` && `),``,`setpriv --inh-caps=-all --ambient-caps=-all bun`),`coder-task`,e.id,Yn],env:t});for(let n=0;;n++){let o;try{o=this.snapshotKey(e);let n=o?await this.snapshot(o,e=>this.detached(e,a({...t,CODER_PREPARE:`1`})),!0,r.waitUntil).catch(e=>{if(e instanceof Oa)throw e;console.error(`coder server: snapshot ${o} failed; starting without one`,e)}):void 0,s=e=>this.detached(e,a({...t,CODER_INBOX_SOCKET:In}),{...i?{networkPolicy:i}:{},...r.timeoutMs?{timeout:r.timeoutMs}:{}}),c=n?await s(n).catch(e=>{if(e instanceof Oa)throw e;return console.error(`coder server: starting from snapshot ${n} failed`,e),s()}):await s();return ht({sandbox:c.sandbox,command:c.command})}catch(e){if(!(e instanceof Oa))throw e;if(o&&e.snapshotId&&this.options.snapshots){let t=e.snapshotId;await this.withSnapshotLock(o,async e=>{let n=await e.get(o);if(n?.snapshotId!==t)return;let{snapshotId:r,sha:i,checkedAt:a,failedAt:s,...c}=n;await e.put(o,c)})}if(n===2)throw e}}}async status(e){let t=pa(e);try{let e=await this.sandbox(t.sandbox);if(e.status===`pending`)return{state:`running`};if(e.status!==`running`)return this.sandboxes.delete(t.sandbox),{state:`exited`,code:1};let n=await e.getCommand(t.command);return n.exitCode===null?{state:`running`}:{state:`exited`,code:n.exitCode}}catch(e){throw[404,410].includes(Ea(e)??0)&&this.sandboxes.delete(t.sandbox),e}}async push(e,t){return this.withSandbox(pa(e).sandbox,async e=>{let n=await e.runCommand({cmd:`node`,args:[`-e`,Rn],detached:!1,env:{CODER_INBOX_MESSAGES:JSON.stringify(t)}}),r=await n.stdout();if(n.exitCode!==0)throw Error(`Sandbox inbox delivery failed`);return JSON.parse(r)})}async stop(e){let t=pa(e).sandbox;try{await(await this.sandbox(t)).stop()}finally{this.sandboxes.delete(t)}}};async function Aa(e,t){let n=await(await t(`https://api.vercel.com/v2/teams?limit=100`)).json();if(!Array.isArray(n.teams))throw new Pa(`Invalid team response`);if(e.team&&!n.teams.some(t=>t.id===e.team||t.slug===e.team))throw new Pa(`Team is not accessible`);return`Teams are accessible`}const ja=[`local`,`local-docker`,`vercel-sandbox`,`github-actions`,`http`];function Ma(e){let t=e.kind;return e.local===!1&&(t===`local`||t===`local-docker`)?{}:{[t]:Na(t,e)}}function Na(e,t){let n=t.config??{};if(e===`local`)return new Hn(t.workDir);if(e===`local-docker`)return new ia(n);if(e===`vercel-sandbox`)return new ka({...t.sandbox,...n});if(e===`github-actions`)return new Xn({...n,...t.fetch?{fetch:t.fetch}:{}});if(typeof n.url!=`string`||typeof n.secret!=`string`)throw Error(`HTTP runner requires a URL and secret`);return new ua({url:n.url,secret:n.secret,...t.fetch?{fetch:t.fetch}:{}})}var Pa=class extends Error{};function Fa(e,t){return e.scope===`workspace`||!!(t&&e.owner===t)}function Ia(e){return e.local?`local`:`default`}async function La(e,t={}){let n=t.runner??t.agent;if(n===Ia(e))return{runner:e.config.runner};let r=(await e.store.list(`runner`,{visibleTo:t.requestedBy,...n?{runner:n}:{defaults:!0}})).filter(({value:n})=>Fa(n,t.requestedBy)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`)),i=n?r.find(({id:e,value:t})=>e===n||t.name===n):r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.scope===`workspace`&&e.default);if(n&&!i)throw Error(`Unknown runner "${n}".`);return i?{runner:i.value.kind,runnerId:i.id}:{runner:e.config.runner}}function Ra(e,t,n){let r={...t.config,...z(e.config,t.secret)};return Na(t.kind,{workDir:e.config.workDir,config:r,fetch:e.fetch,sandbox:{...n?{snapshots:ga(e.store,`runner:${n}:`)}:{}}})}async function za(e,t){if(!t.runnerId)return e.runners[t.runner];let n=await e.store.get(`runner`,t.runnerId);if(!n||n.kind!==t.runner||!e.local&&(n.kind===`local`||n.kind===`local-docker`)){e.settings?.runnerInstances?.delete(t.runnerId);return}z(e.config,n.secret);let r=(e.settings??={}).runnerInstances??=new Map,i=JSON.stringify([n.kind,n.config,n.secret]),a=r.get(t.runnerId);return a?.signature!==i&&(a={signature:i,runner:Ra(e,n,t.runnerId)},r.set(t.runnerId,a)),a.runner}function Ba(e){if(typeof e!=`string`||!e)return{ok:!1,detail:`A folder path is required`};let t=e===`~`?jr.homedir():e.startsWith(`~/`)?P.join(jr.homedir(),e.slice(2)):e;if(!P.isAbsolute(t))return{ok:!1,detail:`The folder path must be absolute`};let n=P.normalize(t);try{return F.statSync(n).isDirectory()?(F.accessSync(n,F.constants.R_OK),{ok:!0,folder:{path:n,name:P.basename(n)}}):{ok:!1,detail:`The path is not a directory`}}catch{return{ok:!1,detail:`The folder does not exist or is not readable`}}}function Va(e){let t=new Map,n=[..._e(e),..._(e,{migrate:!1})].sort((e,t)=>Date.parse(t.createdAt)-Date.parse(e.createdAt));for(let e of n){let n=Ba(e.cwd);if(!(!n.ok||t.has(n.folder.path))&&(t.set(n.folder.path,{...n.folder,recent:Date.parse(e.createdAt)}),t.size===8))break}return{current:{path:e,name:P.basename(e)},recent:[...t.values()],picker:!!Ua()}}const Ha=e=>(process.env.PATH??``).split(P.delimiter).some(t=>t&&F.existsSync(P.join(t,e)));function Ua(){let e=`Choose a folder for the task`;if(process.platform===`darwin`)return[`osascript`,[`-e`,`tell application "System Events"`,`-e`,`activate`,`-e`,`POSIX path of (choose folder with prompt "${e}")`,`-e`,`end tell`]];if(process.platform===`win32`)return[`powershell`,[`-NoProfile`,`-Command`,`Add-Type -AssemblyName System.Windows.Forms; $d = New-Object System.Windows.Forms.FolderBrowserDialog; $d.Description = '${e}'; if ($d.ShowDialog() -eq 'OK') { $d.SelectedPath }`]];if(Ha(`zenity`))return[`zenity`,[`--file-selection`,`--directory`,`--title=${e}`]];if(Ha(`kdialog`))return[`kdialog`,[`--getexistingdirectory`,jr.homedir(),`--title`,e]]}async function Wa(){let e=Ua();if(!e)return{ok:!1,detail:`This machine has no folder dialog; type a path instead`};try{let{stdout:t}=await Lr(Dr)(e[0],e[1],{timeout:6e5}),n=t.trim().replace(/(.)[\\/]+$/,`$1`);return n?Ba(n):{ok:!1,detail:``}}catch{return{ok:!1,detail:``}}}function Ga(e){let t=/^\w[\w.-]*@([\w.-]+):(?!\/)([^?#]+)$/.exec(e),n=t||!URL.canParse(e)?void 0:new URL(e);if(!t&&(!n||![`https:`,`ssh:`].includes(n.protocol)||n.password||n.search||n.hash))return;let[r,i]=t?[t[1],t[2]]:[n.port?`${n.hostname}_${n.port}`:n.hostname,n.pathname],a=i.replace(/(\.git)?\/?$/,``).split(`/`).filter(Boolean);if(!(!/^[a-z0-9][a-z0-9._-]*$/i.test(r)||a.length<2||!a.every(e=>/^[\w.-]+$/.test(e)&&!/^\.+$/.test(e))))return[r.toLowerCase(),...a]}async function Ka(e){let t=typeof e==`string`?e.trim():``,n=Ga(t);if(!n)return{ok:!1,detail:`Use an https or ssh git URL, like https://github.com/owner/repo`};let r=oe(`checkouts`,...n),i=AbortSignal.timeout(6e5),a={...process.env,GIT_TERMINAL_PROMPT:`0`,GIT_SSH_COMMAND:process.env.GIT_SSH_COMMAND??`ssh -o BatchMode=yes`},o=e=>Lr(Dr)(`git`,e,{env:a,signal:i,maxBuffer:67108864});try{await zn(r,async()=>{if(F.existsSync(P.join(r,`.git`))){await o([`-C`,r,`remote`,`set-url`,`origin`,t]),await o([`-C`,r,`fetch`,`origin`]);return}let e=await F.promises.mkdtemp(`${r}-clone-`);try{await o([`clone`,`--`,t,e]),await F.promises.rename(e,r)}finally{await F.promises.rm(e,{recursive:!0,force:!0})}})}catch(e){let t=e;if(i.aborted)return{ok:!1,detail:`The clone took longer than 10 minutes`};if(t.code===`ENOENT`&&!t.stderr)return{ok:!1,detail:`Git is not installed on this machine`};let n=String(t.stderr??t.message).split(`
+`).map(e=>e.trim()).filter(Boolean),r=(n.find(e=>e.startsWith(`fatal:`))??n.at(-1)??`The clone failed`).replace(/^fatal:\s*/,``);return{ok:!1,detail:r[0].toUpperCase()+r.slice(1)}}return{ok:!0,folder:{path:r,name:n.at(-1),url:t}}}const qa=`.coder/agents`,Ja=2592e6;function Ya(e){return e.repo?`${e.repo.owner}/${e.repo.name}`:void 0}const Xa=(e,t,n)=>`repo-file:${e}@${t}@${n}:`;function Za(e,t){let n=Ya(t);return n?[Xa(e.id,n,t.repo?.defaultBranch??``)]:[]}const Qa=(e,t,n)=>`repo-push:${e}@${t}@${n}`;function $a(e,t,n,r,i,a){let o=`${Xa(n.installation,r,a??``)}${i}`,s=e.fileReads??=new Map,c=s.get(o);if(!c){let l=AbortSignal.timeout(1e4),u=new Promise((e,t)=>l.addEventListener(`abort`,()=>t(l.reason),{once:!0}));c=Promise.race([eo(e.store,t,n,r,i,a,o,l),u]).catch(e=>{throw l.aborted&&console.error(`coder server: repository file read timed out for ${r}/${i}`,e),e}).finally(()=>s.delete(o)),s.set(o,c)}return c}async function eo(e,t,n,r,i,a,o,s){let c=await e.get(`snapshot`,o);s.throwIfAborted();let l=/^[0-9a-f]{40}$/i.test(a??``),u=Date.now();if(c&&!c.stale&&(l||u-(c.readAt??0)<6e5))return c.text;let d=Qa(n.installation,r,a??``),[f,p]=await Promise.all([n.token(),l?void 0:e.get(`snapshot`,d)]);if(s.throwIfAborted(),!f||!t.repos)return;let m=t.repos.revalidate?await t.repos.revalidate(r,i,f,{...a?{ref:a}:{},...c?.etag?{etag:c.etag}:{},fetch:((e,t)=>n.fetch(e,{...t,signal:s}))}):{text:await t.repos.readFile(r,i,f,a)};s.throwIfAborted();let{stale:h,...g}=c??{},_={...m===`unchanged`?g:m,...l?{}:{readAt:u}};return await e.put(`snapshot`,o,_,{ttlMs:Ja}),!l&&(await e.get(`snapshot`,d))?.push!==p?.push&&await e.put(`snapshot`,o,{..._,stale:!0},{ttlMs:Ja}),_.text}const to=e=>!!e.installation&&(e.partial===!0||e.paths.some(e=>e.startsWith(`.coder/`)));function no(e,t){let n=t.branch??e.defaultBranch,r=e.paths.filter(e=>e.startsWith(`.coder/agents/`));if(!(e.repo!==t.agentsRepo||e.branch!==n||!e.commit||!r.length))return{repo:e.repo,ref:e.commit,branch:n,paths:r}}async function ro(e,t){let n=[t.branch,...t.branch===t.defaultBranch?[``]:[]];for(let r of n){await e.put(`snapshot`,Qa(t.installation,t.repo,r),{push:L()},{ttlMs:36e5});for(let{id:n,value:i}of await e.list(`snapshot`,{prefix:Xa(t.installation,t.repo,r)}))i.stale||await e.put(`snapshot`,n,{...i,stale:!0},{ttlMs:Ja})}}async function io(e,t,n,r,i){let a=await $a(e,t,n,r,`.coder/config.json`,i);return a===void 0?void 0:JSON.parse(a).agents}async function ao(e,t,n,r,i=async()=>void 0){for(let t of Object.values(e)){if(!r.repo&&t.id===r.integration||!t.repos)continue;let e=await(await i(t.id))?.token();if(e)return{contents:t,token:e}}for(let{value:r}of await t.store.list(`app`)){if(r.agentsRepo!==n)continue;let i=e[r.integration];if(!i?.repos)continue;let a=(await t.store.list(`installation`,{prefix:`${r.id}:`})).find(e=>!e.value.deletedAt)?.value;if(a)try{let e=a.token?{...a,token:z(t.config,a.token)}:a;return{contents:i,token:await i.auth.token(e,z(t.config,r.credentials),{tools:i.tools.presets[`read-only`]}),app:r,installation:a}}catch(e){console.error(`coder server: repository access for ${a.id} failed`,e);continue}}}function oo(e,t){let n=t.cwd,r=t.now??Date.now;async function i(t,n,r){let i=Ya(n),a=e[n.integration],o=i&&a?.repos&&await r(n.integration);if(!(!i||!o))return io(t,a,o,i,n.repo?.defaultBranch)}async function a(n,a,o,s){let c={store:s?.store??t.store,fileReads:t.fileReads},l=s??await N(t.store,n.agent);l.record?.source===`builtin`&&!t.settings?.builtinAgents&&(await ar(t,r()),l=await N(t.store,n.agent));let{record:u,version:d}=l;if(!u)return;if(u.problems?.length)throw new ut(u.problems.join(`
+`));if(!d)throw Error(`No version ${u.currentVersion} for agent "${u.id}".`);let f=await i(c,a,o),p=f&&typeof f==`object`?f[n.agent]:void 0;if(p===!1||p?.disabled)throw Error(`Agent "${n.agent}" is disabled in ${Ya(a)??n.agentsRepo}.`);return rr(u,d,p&&typeof p==`object`?p:void 0,e)}return async(i,o,s,c,l)=>{let u=n?(await ot(n,e)).find(e=>e.id===i.agent&&!e.builtin):void 0;if(u)return u;let d=await a(i,s,c,l);if(d)return d;if(i.agentsRepo){let n=await ao(e,t,i.agentsRepo,s,c);if(n){await so(t.store,n.contents,i.agentsRepo,Ya(s)===i.agentsRepo?s.repo?.defaultBranch??`HEAD`:`HEAD`,n.token,r());let e=await a(i,s,c);if(e)return e;throw Error(`No agent "${i.agent}" in ${i.agentsRepo}.`)}}if(await tr(t.store,r(),i.agent,{})){let e=await a(i,s,c);if(e)return e}throw Error(i.agentsRepo?`No agent named "${i.agent}".`:`No built-in agent "${i.agent}".`)}}async function so(e,t,n,r,i,a,o={}){let s=o.path??`.coder/agents`,c=/^[0-9a-f]{40}$/i.test(r)?r:await t.repos.commit(n,r,i)??r,l={repo:n,ref:o.branch??r,commit:c};r=c;let u=await t.repos.tree(n,s,i,r),d=o.slugs??[...new Set(u.filter(e=>/^[^/]+\/agent\.json$/.test(e)).map(e=>e.split(`/`)[0]))];return lt(d),(await Promise.all(d.map(async o=>{let d=`${s}/${o}`,f=u.filter(e=>e.startsWith(`${o}/`)&&e.split(`/`).length<=22),p=Object.fromEntries(await Promise.all(f.map(async e=>[e.slice(o.length+1),await t.repos.readFile(n,`${s}/${e}`,i,r)]))),m=p[`agent.json`];if(m===void 0)return;let h;try{[h]=ct({definitions:{[o]:{json:JSON.parse(m),builtin:!1}},usage:void 0},{...pt,[t.id]:t})}catch(t){if(!(t instanceof ut||t instanceof SyntaxError))throw t;console.error(`coder server: could not load agent ${o}`,t);let r=await e.get(`agent`,o);await e.put(`agent`,o,{id:o,name:o,source:`repo`,repo:n,path:d,currentVersion:0,createdAt:a,...r,problems:[t.message],updatedAt:a});return}if(!h)return;let{"agent.json":g,"system.md":_,...v}=p;return or(e,{id:o,name:h.name,description:h.definition.description,source:`repo`,repo:n,path:d,definition:h.definition,systemPrompt:_??``,files:Object.fromEntries(Object.entries(v).filter(e=>e[1]!==void 0)),commit:c,origin:l,importedFrom:`repo:${n}@${l.ref}`},a)}))).filter(e=>!!e)}const co=e=>`app-sync:${e}`,lo=(e,t,n,r)=>e.manifest?.(t,{publicUrl:n,spec:Vv(r,t.agent,t.integration)})??r,uo=(e,t,n)=>!!(e&&!e.pending&&e.version>=t&&Ir(e.manifest,n));async function fo(e,t,n,r){let i=e.integrations[n.integration]?.app,a=e.config.publicUrl,o=await t.get(`delivery`,co(n.id));if(i?.values){let e=i.values(n,{publicUrl:a,spec:Vv(r.definition,n.agent,n.integration)}),s=o?.manifest??[],c=e.lines.map(e=>s.some(t=>t.text===e.text&&t.copy===e.copy)?e:{...e,changed:!0}),l=c.some(e=>`changed`in e);return l!==o?.changed&&await t.put(`delivery`,co(n.id),{...o,version:r.version,changed:l}),{...e,lines:c,changed:l,confirm:!0}}if(!i?.drift)return;let s=await i.drift(n,z(e.config,n.credentials),{publicUrl:a,spec:Vv(r.definition,n.agent,n.integration),fetch:e.fetch??fetch}),c=s.lines.length>0;return await t.put(`delivery`,co(n.id),{version:r.version,changed:c}),{...s,changed:c}}async function po(e,t,n){let r=e.config.publicUrl;if(!r||!t.length)return[];let i=new Map(t.map(e=>[e.agent,e])),a=await e.store.list(`app`);return(await Promise.all(a.filter(({id:e,value:t})=>i.has(t.agent)&&(!n||e===n)).map(async({id:t})=>e.store.withAppLock(t,async a=>{let o=await a.get(`app`,t);if(!o||!i.has(o.agent))return;let s=await lr(a,o.agent)??i.get(o.agent),c=e.integrations[o.integration]?.app;if(!c||!s.definition.integrations[o.integration]||!c.update&&(o.builtin||o.shared))return;if(!c.update)return fo(e,a,o,s).then(e=>e&&{app:o,check:e},e=>(console.error(`coder server: checking ${o.id} on its platform failed`,e),{app:o,error:e instanceof Error?e.message:String(e)}));let{update:l}=c,u=lo(c,o,r,s.definition),d=co(t),f=await a.get(`delivery`,d);if(!n&&uo(f,s.version,u)||f&&f.version>s.version)return;let p={version:s.version,manifest:u,pending:!0};await a.put(`delivery`,d,p);try{let t=await l(o,z(e.config,o.credentials),{publicUrl:r,spec:Vv(s.definition,o.agent,o.integration),fetch:e.fetch??fetch,tokens:Xv({...e,store:a},o.integration),saveCredentials:async t=>{await a.put(`app`,o.id,{...o,credentials:R(e.config,t)})}});return t&&await a.put(`app`,o.id,{...o,credentials:R(e.config,t)}),await a.put(`delivery`,d,{...p,pending:!1}),{app:o}}catch(e){let t=`Could not sync ${o.integration} app ${o.id}. ${e instanceof Error?e.message:String(e)}`;return await a.put(`delivery`,d,{...p,error:t}),{app:o,error:t}}})))).filter(e=>e!==void 0)}async function mo(e,t){let n=(await po(e,t)).flatMap(({app:t,error:n})=>n&&e.integrations[t.integration]?.app.update?[n]:[]);if(n.length)throw Error(n.join(`
+`))}function ho(){return{integration:`source`,type:`import`,appId:``,installationId:``,deliveryId:``,actor:{id:`admin`},text:``}}async function go(e,t,n,r=ho(),i){let a=await ao(e.integrations,{config:e.config,store:e.store},t,r);if(!a)return;let o=await so(e.store,a.contents,t,n,a.token,(e.now??Date.now)(),i?{branch:i}:{});return await mo(e,o),o}const _o=`default`;async function vo(e){if(!e.databaseUrl)throw Error(`DATABASE_URL is required for the Postgres store`);let{connect:t}=await import(`./client-nBo9Mhsr.js`).then(e=>e.n);return t(e.databaseUrl,e.databasePool)}function yo(e){let t=e?new pr:new dr;return{store:()=>t,queue:new Qh(t),chatState:new vr(e?P.join(g(``),`chat.json`):void 0),defaultOrganizationId:_o,webhookTarget:async(e,n)=>{let r=await t.get(`app`,e),i=n?await t.get(`installation`,n):void 0;if(r&&n&&(!i||i.deletedAt))for(let{value:r}of await t.list(`app`,{prefix:`${e}/`})){let i=await t.get(`installation`,`${r.id}${n.slice(e.length)}`);if(i&&!i.deletedAt)return{organizationId:_o,app:r,bound:{organizationId:_o,installation:i}}}return r&&{organizationId:_o,app:r,...i&&i.app===e&&!i.deletedAt?{bound:{organizationId:_o,installation:i}}:{}}},appRecord:async e=>{let n=await t.get(`app`,e);return n&&{organizationId:_o,app:n}},apps:async e=>(await t.list(`app`,{prefix:`${e}:`})).map(e=>({organizationId:_o,app:e.value})),installationOrganization:async e=>await t.get(`installation`,e)?_o:void 0,installations:async e=>(await t.list(`installation`,{prefix:`${e}:`})).filter(e=>!e.value.deletedAt).map(e=>({key:e.id,organizationId:_o})),taskOrganization:async(e,n)=>(await t.get(`task`,e))?.tokenHash===n?_o:void 0,sweep:async()=>{},close:async()=>{}}}async function bo(e){let t=await vo(e),[{DrizzleStore:n},{DrizzleQueue:r},{UNSCOPED_ORGANIZATION:i},{PgChatState:a}]=await Promise.all([import(`./store-CzQLgCzt.js`).then(e=>e.n),import(`./store-CzQLgCzt.js`).then(e=>e.r),import(`./shared--aE4olIO.js`).then(e=>e.g),import(`./chat-4AiZEqKh.js`)]);return{store:r=>new n(t.db,r,Date.now,e),queue:new r(t.db),chatState:new a(t.db),defaultOrganizationId:i,webhookTarget:(e,r)=>n.webhookTarget(t.db,e,r),appRecord:e=>n.appRecord(t.db,e),apps:e=>n.apps(t.db,e),installationOrganization:e=>n.installationOrganization(t.db,e),installations:e=>n.installations(t.db,e),taskOrganization:(e,r)=>n.taskOrganization(t.db,e,r),connection:t,sweep:e=>new n(t.db,i).sweep(e),close:()=>t.close()}}async function xo(e,t={}){return e.store===`postgres`?bo(e):yo(t.local)}async function So(e,t,n,r){return e.updateMetadata(t,n,r)}async function Co(e,t){return e.getApps([...new Set(t)])}const wo=e=>`audit:${String(9999999999999-e).padStart(13,`0`)}:${I(4).toString(`hex`)}`,To=e=>e.config.name??`Wular`,Eo=e=>B(e,e.serverOrganizationId??e.organizationId);async function Do(e,t,n){let r=(e.now??Date.now)(),i=e.session?.user,a={at:r,actor:i?{id:i.id,name:i.name,email:i.email}:{id:`admin-token`},action:t,target:n};await Eo(e).store.put(`snapshot`,wo(r),a)}async function Oo(e,t){return(await e.store.list(`app`)).find(({value:e})=>e.builtin&&e.integration===t)?.value?.id??O({error:`No built-in ${t} app on this server.`},404)}async function ko(e,t){let n=Eo(t),r=(await n.store.list(`app`)).map(({value:e})=>e).filter(e=>e.builtin),i=await Ro(n,r,!0),a=Object.values(t.integrations).filter(e=>e.app.shareable).map(e=>{let t=r.find(t=>t.integration===e.id);return{integration:e.id,name:e.name,brand:e.brand,organizationApps:e.organizationApps===!0,...Lo(e),...t?{app:{id:t.id,name:t.name,createdAt:t.createdAt,...i.has(t.id)?{changed:!0}:{}}}:{}}}),o=t.config.publicUrl,s=!!o&&__.has(new URL(o).hostname);return O({name:To(t),platforms:a,...s?{unreachable:!0}:{}})}async function Ao(e,t,n){let r=t.integrations[n.integration];if(!r)return O({error:`Unknown integration "${n.integration}".`},404);if(!r.app.shareable)return O({error:`Create ${r.name} apps in your workspace from the agent's Platforms tab.`},400);if(!t.config.publicUrl)return O({error:`Set PUBLIC_URL on this server first. Platforms call it.`},400);let i=await e.json().catch(()=>void 0),a=e=>typeof e==`string`&&e.trim()||void 0,o=a(i?.name)??To(t),s=r.organizationApps?a(i?.owner):void 0,c=await ey(Eo(t),r.id,{name:o,owner:s});return await Do(t,`Started setting up a shared app`,`${o} on ${r.name}`),O({url:c})}async function jo(e,t,n,r){let i=Eo(t),a=await Oo(i,n.integration);return typeof a==`string`?Uo(e,i,{id:a},r,!0):a}async function Mo(e,t,n,r){let i=Eo(t),a=await Oo(i,n.integration);if(typeof a!=`string`)return a;let o=await Wo(e,i,{id:a},r,!0);return o.ok&&await Do(t,`Updated a shared app`,t.integrations[n.integration]?.name??a),o}async function No(e,t){let n=await Eo(t).store.list(`snapshot`,{prefix:`audit:`,limit:100});return O(n.map(e=>e.value))}async function Po(e,t,n,r){let i=await t.store.get(`app`,n);if(!i)return O({error:`Unknown app`},404);let a=t.config.publicUrl;if(!a)return O({error:`PUBLIC_URL is not set on this server`},400);let o=await Zr(t,`install`,t.session?.user.id??`anonymous`,i.id),s=ht({tx:o,...r?{back:r}:{}});return O({url:`${a.replace(/\/$/,``)}/install/${i.integration}?app=${encodeURIComponent(i.id)}&state=${s}`})}async function Fo(e,t,n=e.store.list(`app`)){let r=e.serverOrganizationId,[i,a]=await Promise.all([n,r!==void 0&&r!==e.organizationId&&e.scope?e.scope(r).store.list(`app`).then(t=>t.filter(({value:t})=>t.builtin&&e.integrations[t.integration]?.app.shareable)):[]]);return[...i,...a].filter(({value:n})=>(!n.builtin||e.integrations[n.integration]?.app.shareable)&&(!t||n.agent===t))}function Io(e,t){let{credentials:n,...r}=t,i=t.builtin?void 0:e.integrations[t.integration]?.app.settingsUrl?.(t,z(e.config,n));return{...r,...i?{settingsUrl:i}:{}}}const Lo=e=>e.app.update?{appUpdate:`push`}:e.app.drift?{appUpdate:`drift`}:e.app.values?{appUpdate:`confirm`}:{};async function Ro(e,t,n=!1){let r=e.config.publicUrl,i=t.filter(t=>(n||!t.builtin&&!t.shared)&&e.integrations[t.integration]?.app);if(!r||!i.length)return new Set;let[a,o]=await Promise.all([e.store.list(`delivery`,{ids:i.map(e=>co(e.id))}),e.store.listAgentsWithVersions([...new Set(i.map(e=>e.agent))])]),s=e=>a.find(t=>t.id===co(e))?.value;return new Set(i.filter(t=>{let n=e.integrations[t.integration].app,i=o.find(e=>e.record.id===t.agent)?.version;return i?.definition.integrations[t.integration]?n.update?!uo(s(t.id),i.version,lo(n,t,r,i.definition)):s(t.id)?.changed===!0:!1}).map(e=>e.id))}async function zo(e,t,n,r){let i=await Fo(t,r.searchParams.get(`agent`)),a=await Ro(t,i.map(({value:e})=>e));return O(i.map(({id:e,value:n})=>({id:e,value:{...Io(t,n),...a.has(e)?{changed:!0}:{}}})))}async function Bo(e,t,n){let r=await t.store.get(`app`,n.id);if(!r)return O({error:`Unknown app`},404);if(r.builtin)return O({error:`Only whoever runs this server can remove its shared apps.`},403);let i=t.now?.()??Date.now();for(let{id:e,value:n}of await t.store.list(`installation`))n.app===r.id&&!n.deletedAt&&await So(t.store,`installation`,e,{deletedAt:i});return await t.store.delete(`app`,r.id),await Nf(t.store,r.id),O({ok:!0})}async function Vo(e,t,n){let r=await t.store.get(`installation`,n.id);if(!r||r.deletedAt)return O({error:`Unknown installation`},404);let i=await t.store.get(`app`,r.app),a=t.integrations[r.integration];if(!i||!a?.app.uninstall)return O({error:`Coder cannot uninstall ${a?.name??r.integration} apps.`},400);try{await a.app.uninstall(jf(t,r),z(t.config,i.credentials),{fetch:t.fetch??fetch})}catch(e){console.error(`coder server: uninstalling ${r.id} failed`,e);let t=a.app.installationUrl?.(r);return O({error:`${e instanceof Error?e.message:String(e)}. Uninstall ${i.name} on ${a.name} instead.`,...t?{hint:t}:{}},502)}return await Pf(t.store,r.id,(t.now??Date.now)()),await Do(t,`Uninstalled an app`,`${i.name} from ${r.account.login} on ${a.name}`),O({ok:!0})}async function Ho(e,t,n=!1){let r=await e.store.get(`app`,t);if(!r)return O({error:`Unknown app`},404);if((r.builtin||r.shared)&&!n)return O({error:`Only whoever runs this server can update its shared apps.`},403);if(!e.config.publicUrl)return O({error:`PUBLIC_URL is not set on this server`},400);let i=e.integrations[r.integration];if(!i||!(i.app.update||i.app.drift||i.app.values))return O({error:`Coder cannot update ${i?.name??r.integration} apps.`},400);n&&await tr(e.store,(e.now??Date.now)(),r.agent,await N(e.store,r.agent));let a=await lr(e.store,r.agent);return a?.definition.integrations[r.integration]?{app:r,version:a,integration:i}:O({error:`The agent no longer listens on ${i.name}.`},400)}async function Uo(e,t,n,r,i=!1){let a=await Ho(t,n.id,i);if(a instanceof Response)return a;if(a.integration.app.update)return O({error:`Coder updates ${a.integration.name} apps itself.`},400);try{return O(await fo(t,t.store,a.app,a.version))}catch(e){return console.error(`coder server: reading ${a.app.id} on ${a.integration.name} failed`,e),O({error:e instanceof Error?e.message:String(e)},502)}}async function Wo(e,t,n,r,i=!1){let a=await Ho(t,n.id,i);if(a instanceof Response)return a;let{app:o,version:s,integration:c}=a;if(c.app.values){let{lines:e}=c.app.values(o,{publicUrl:t.config.publicUrl,spec:Vv(s.definition,o.agent,o.integration)});return await t.store.put(`delivery`,co(o.id),{version:s.version,manifest:e,changed:!1}),O({updated:!0})}if(!c.app.update)return O({error:`Change the app on ${c.name}; Coder cannot.`},400);let[l]=await po(t,[s],o.id);return l?.error?O({error:l.error},502):O({updated:!0})}async function Go(e,t,n,r){let i=r.searchParams.get(`agent`),a=await t.store.list(`installation`,{...i?{agent:i}:{},...r.searchParams.get(`active`)===`1`?{active:!0,includeUninstalled:!0}:{},limit:k(r,200)});return O(a.map(({id:e,value:n})=>({id:e,value:Ko(t,n)})))}function Ko(e,t){let{token:n,...r}=t,i=e.integrations[t.integration]?.app,a=t.account.url??i?.accountUrl?.(t.account),o=i?.installationUrl?.(t);return{...r,account:{...r.account,...a?{url:a}:{}},...o?{installationUrl:o}:{}}}async function qo(e,t){let n=e.config.publicUrl,r=n?__.has(new URL(n).hostname):!1,i=r?`https://<public address>`:n,a=t.searchParams.get(`agent`),o=e.store.list(`app`),[s,c,l]=await Promise.all([a?N(e.store,a):void 0,Qv(e,o),o]),u=s?.record,d=new Set(c.map(e=>e.integration));return O(await Promise.all(Object.values(e.integrations).map(async n=>{let a=typeof n.use==`function`?n.use(Ct(s?.version?.definition.integrations[n.id])):n.use;return{id:n.id,name:n.name,brand:n.brand,description:n.description,installLabel:n.installLabel??`Connect ${n.id}`,...a?{use:a}:{},...n.covered?{covered:n.covered}:{},...n.featured?{featured:!0}:{},builtinApp:n.app.shareable?`shared`:`own`,...n.auth.user?{personal:!0}:{},...await Km(e,n.id,void 0,[...c,...l.map(e=>e.value)])?{connectable:!0}:{},organizationApps:n.organizationApps===!0,publicApps:n.publicApps===!0,events:Object.fromEntries(Object.entries(n.events).map(([e,{description:t,noisy:n,addressed:r}])=>[e,{description:t,...n?{noisy:n}:{},...r?{addressed:r}:{}}])),repositories:!!n.repos,...n.app.createStep&&i?{create:n.app.createStep(i,{saved:await Yv(e,n.id),name:u?.name,shared:d.has(n.id),public:n.publicApps===!0&&t.searchParams.get(`public`)===`1`})}:{},...r?{unreachable:!0}:{},...Lo(n)}})))}async function Jo(e,t,n=!1,r){let i=t;if(i.deletedAt)return;if(!n&&i.repos!=null&&(!r||i.repos.includes(r.repo)))return i;let a=e.integrations[i.integration];if(!a?.repos)return i;let o=e.repositoryLists??=new Map,s=o.get(i.id);return s||(s=Yo(e,a,i,r).finally(()=>o.delete(i.id)),o.set(i.id,s)),s}async function Yo(e,t,n,r){let i=r?.app??await e.store.get(`app`,n.app);if(!i)throw Error(`Missing app for installation ${n.id}`);let a=r?.token??await Ff(e,t,n,z(e.config,i.credentials)),o=await t.repos.list(jf(e,n),a,e.fetch??fetch);return e.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!(!t||t.deletedAt))return JSON.stringify(t.repos)===JSON.stringify(n.repos)?(await So(e,`installation`,t.id,{repos:o}),{...t,repos:o}):{...t,repos:t.repos??o}})}async function Xo(e,t=!1){let n=new Map,r=(await e.store.list(`installation`,{active:!0})).filter(({value:t})=>e.integrations[t.integration]?.repos),i=Array(r.length),a=0;await Promise.all(Array.from({length:Math.min(4,r.length)},async()=>{for(let n=a++;n<r.length;n=a++){let a=r[n].value;i[n]=t||a.repos==null?await Jo(e,a,t).catch(e=>(console.error(`coder server: repositories for installation ${a.id} failed`,e),a)):a}}));for(let e of i)if(!(!e||e.deletedAt))for(let t of e.repos??[])n.has(t)||n.set(t,{repo:t,integration:e.integration});return O([...n.values()].sort((e,t)=>e.repo.localeCompare(t.repo)))}const Zo=mt;function Qo(e,t,n,r=I(32).toString(`base64url`)){let i=`${ht({task:e,organization:t,attempt:n})}.${r}`;return{token:i,hash:Zo(i)}}function $o(e){try{return _t(e.slice(0,e.indexOf(`.`)))}catch{return{}}}function es(e){let t=$o(e);return typeof t==`object`&&!!t&&typeof t.task==`string`&&typeof t.organization==`string`&&Number.isInteger(t.attempt)}async function ts(e,t){let n=$o(t);if(!es(t)||n.organization!==e.organizationId)return;let r=await e.queue.authorize(n.task,Zo(t),n.attempt,e.organizationId,(e.now??Date.now)());if(!r)return;let{task:i}=r.status,{audience:a,space:o}=ss(i);return{task:i.id,agent:i.agent,attempt:n.attempt,...i.requestedBy&&!cs(i)?{requestedBy:i.requestedBy}:{},...i.context?.asker?{asker:i.context.asker}:{},...i.context?.user?{user:i.context.user}:{},dm:i.event?.chat?.thread.isDM===!0,access:i.access??`auto`,connections:i.connections??[],audience:a,...o?{space:o}:{}}}function ns(e,t){let n=t.requestedBy?{user:{id:t.requestedBy,name:t.user?.name??``,email:t.user?.email??``},organizationId:e.organizationId,role:`member`,organizations:[]}:void 0;return{...e,taskPrincipal:t,...n?{session:n}:{}}}const rs=new Set([`engine`,`model`,`effort`]);function is(e,t){if(!t||typeof t!=`object`||Array.isArray(t))return`settings must be an object`;let n=new Set([...Object.keys(e??{}),...Object.keys(t)]);for(let r of n)if(!rs.has(r)&&JSON.stringify(e?.[r])!==JSON.stringify(t[r]))return`A task changes only its agent's engine, model and effort, not ${r}.`}const as=6e4,H=e=>`${e.integration}:${e.account??e.installationId}:${e.space?.id??``}`,os=e=>`space:${H(e)}`;function ss(e){if(e.audience!==void 0)return{audience:e.audience,...e.space?{space:e.space}:{}};let t=e.event;if(!t?.integration||e.source!==t.integration)return{audience:``};let n=H(t);return t.chat?.thread.isDM?{audience:`dm:${e.requestedBy??``}`,space:n}:{audience:t.space?.private===!1?``:os(t),space:n}}const cs=e=>!!(e.event&&e.source===e.event.integration&&!e.event.chat?.thread.isDM);function ls(e){let t=e.context?.asker??(cs(e)?void 0:e.requestedBy);return t&&t===e.requestedBy?t:void 0}const us=(e,t)=>e===void 0||t.audience===``||t.requestedBy===e.id||t.audience===`dm:${e.id}`||!!(t.audience&&e.spaces?.includes(t.audience));async function ds(e,t){if(d_(e)||e.taskPrincipal)return;let n=e.session?.user.id??``;if(!n)return{id:n,spaces:[]};if(!t)return{id:n};let r=[...new Set(t.filter(e=>!!e?.startsWith(`space:`)))];return{id:n,spaces:r.length?await e.queue.memberSpaces(e.organizationId,n,r):[]}}async function fs(e,t,n,r){let i=t.auth.space;if(n.space?.private!==void 0||!i||!(n.space?.id||n.chat?.thread.id))return n.space;try{return await i(n,await r(),e.fetch??fetch)??n.space}catch(e){return console.error(`coder server: space of ${H(n)} unknown`,e),n.space}}async function ps(e,t,n,r,i=!1){let a=t.auth.members;if(!a||!n.space?.id||!ss({source:n.integration,event:n}).audience.startsWith(`space:`))return;let o=(e.now??Date.now)();try{let s=await e.queue.spaceSynced(e.organizationId,n);if(!i&&s!==void 0&&o-s<864e5||!await e.queue.claimSpace(e.organizationId,n,o,i))return;let c;try{c=await a(n.space,await r(),e.fetch??fetch,()=>e.queue.linkedMembers(e.organizationId,t.id))}finally{await e.queue.saveSpaceMembers(e.organizationId,n,c,o)}}catch(e){console.error(`coder server: members of ${H(n)} not fetched`,e)}}async function ms(e,t,n,r,i){let a={integration:t.id,appId:n,installationId:i.installation,...i.account?{account:i.account}:{},space:i.space};await e.queue.spaceChanged(e.organizationId,a,{...i.joined?{joined:i.joined}:{},...i.left?{left:i.left}:{},...i.space.private===void 0?{}:{private:i.space.private}},(e.now??Date.now)()),i.space.private===!0&&await ps(e,t,a,()=>gs(e,t,a,r))}async function hs(e,t,n,r,i){let a={integration:t.id,appId:n,installationId:i.installation,...i.account?{account:i.account}:{}},o=t.auth.teamSpaces;if(i.team&&!o)return;let s=()=>gs(e,t,a,r);try{let n=await e.queue.listedSpaces(e.organizationId,a);if(!n.length)return;let c=i.team?await o(i.team,await gs(e,t,a,r,{}),e.fetch??fetch):i.spaces;for(let r of n)(!c||c.includes(r.space?.id??``))&&await ps(e,t,r,s,!0)}catch(e){console.error(`coder server: members of ${H(a)} not fetched again`,e)}}async function gs(e,t,n,r,i={tools:t.tools.presets[`read-only`]}){let a=await e.store.get(`installation`,`${n.appId}:${n.installationId}`);if(!a||a.deletedAt)throw Error(`No installation`);return Ff(e,t,a,r,i)}var _s=t({listHistory:()=>Es,readHistory:()=>Ds,readLog:()=>xs,saveHistory:()=>Os,storeLogs:()=>Cs,taskRedactor:()=>Ss,taskWarnings:()=>ys});const vs=(e,t)=>`${e}:${String(t).padStart(6,`0`)}`;async function ys(e,t,n){n.length&&await e.store.withAppLock(`task-warnings:${t}`,async r=>{let i=r.queue?.()??e.queue,a=[];for(let e of new Set(n))await r.get(`delivery`,`task-warning:${t}:${e}`)||a.push(e);if(a.length)for(let n=0;n<3;n++){let n=await r.get(`task`,t);if(!n)return;let o=n.logSeq??0,s=n.logCursor??-1,c=(e.now??Date.now)();if(await i.appendLogs(e.organizationId,t,a.map((e,t)=>({seq:o+t,at:c,level:`sys`,line:e})),{seq:o,cursor:s},{seq:o+a.length,cursor:s,bytes:(n.logBytes??0)+a.reduce((e,t)=>e+Buffer.byteLength(t),0)},c,{attempts:n.attempts,tokenHash:n.tokenHash??null,handle:n.handle,generation:n.generation??0})){for(let e of a)await r.put(`delivery`,`task-warning:${t}:${e}`,{at:c},{ttlMs:864e5});return}}})}function bs(e,t,n,r){let i=t,a=r,o=[];for(let t of e){let e=Buffer.byteLength(t.line);if(a+e>2097152)break;o.push({seq:i,at:t.at??n,level:t.level,line:t.line}),a+=e,i+=1}return{lines:o,seq:i,bytes:a}}async function xs(e,t,n=-1,r){return(await e.list(`tasklog`,{prefix:`${t}:`,...n>=0?{after:vs(t,n)}:{},...r?{limit:r}:{}})).map(e=>{let t=en(e.value.line);return{seq:Number(e.id.slice(e.id.lastIndexOf(`:`)+1)),...e.value,...t?{entry:t}:{}}})}async function Ss(e,t,n=!1){let r=e.settings??={},i=r.taskLogSecrets??=new Map,a=JSON.stringify([e.organizationId,t.task.id,t.attempts,t.generation,t.tokenHash]);n&&i.delete(a);let o=i.get(a);return o||(o=$f(e,t).then(e=>{let t=e.sort((e,t)=>t.length-e.length);return e=>t.reduce((e,t)=>t?e.replaceAll(t,`[REDACTED]`):e,e)}).catch(e=>{throw i.delete(a),e}),i.set(a,o),setTimeout(()=>{i.get(a)===o&&i.delete(a)},(e.config.taskTimeoutMs??18e5)+6e4).unref?.()),o}async function Cs(e,t,n){let r=await Ss(e,t),i=e=>typeof e==`string`?r(e):Array.isArray(e)?e.map(i):e&&typeof e==`object`?Object.fromEntries(Object.entries(e).map(([e,t])=>[r(e),i(t)])):e,a=e=>{try{return JSON.stringify(i(JSON.parse(e)))}catch{return r(e)}};for(let r=0;r<5;r++){let i=r===0&&e.callbackTask===t?t:await e.store.get(`task`,t.task.id);if(!i||i.attempts!==t.attempts||i.tokenHash!==t.tokenHash||i.generation!==t.generation)return`stale`;let o=i.logCursor??-1,s=n.filter(e=>e.seq>o);if(!s.length)return`ok`;if(i.logsComplete||s[0].seq!==o+1)return`gap`;let c=(e.now??Date.now)(),l=bs(s.map(e=>({...e,line:a(e.line)})),i.logSeq??0,c,i.logBytes??0);if(await e.queue.appendLogs(e.organizationId,t.task.id,l.lines,{seq:i.logSeq??0,cursor:o},{seq:l.seq,cursor:s.at(-1).seq,bytes:l.bytes},c,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0}))return`ok`}return`stale`}const ws=Lr(Vr),Ts=Lr(Ur);async function Es(e,t,n){return O(await t.store.listHistory(n.id))}async function Ds(e,t,n){let r=await t.store.get(`history`,`${n.id}:${n.conversation}`);if(!r)return O({error:`No saved history`},404);try{return O({engine:r.engine,conversation:r.conversation,data:z(t.config,r.data),...r.state?{state:z(t.config,r.state)}:{}})}catch(e){return console.error(`coder server: history ${n.id}/${n.conversation} could not be decrypted`,e),O({error:`The saved history cannot be read`},422)}}async function Os(e,t,n){let r=await e.json().catch(()=>void 0);if(r?.engine!==`claude`&&r?.engine!==`codex`||typeof r.conversation!=`string`||!Ot.test(r.conversation)||typeof r.data!=`string`||r.state!==void 0&&(!r.state||typeof r.state!=`object`||Array.isArray(r.state)))return O({error:`Invalid history`},400);let i;try{i=(await ws(Buffer.from(r.data,`base64`),{maxOutputLength:67108864})).toString(`utf8`)}catch{return O({error:`Invalid history`},400)}let a=await Ss(t,t.callbackTask,!0);return await t.store.put(`history`,`${n.id}:${r.conversation}`,{engine:r.engine,conversation:r.conversation,data:R(t.config,(await Ts(a(i))).toString(`base64`)),...r.state?{state:R(t.config,JSON.parse(a(JSON.stringify(r.state))))}:{},savedAt:(t.now??Date.now)()}),O({ok:!0})}var U=class extends Error{status;fix;constructor(e,t=400,n){super(e),this.status=t,this.fix=n}};function ks(e,t,n){if(n?.problems?.length)throw new U(n.problems.join(`
+`),409);if(n?.settings?.disabled)throw new U(`Agent "${t}" is disabled in this workspace. Enable it in its settings to start tasks.`,409,`${e.config.publicUrl?.replace(/\/$/,``)??``}${Lv(Fv(e),`/agents/${encodeURIComponent(t)}/settings`)}`)}function As(e,t){if(t.cwd===void 0)return;if(!e.local)throw new U(`cwd is available on a local server only`);let n=Ba(t.cwd);if(!n.ok)throw new U(n.detail);return n.folder.path}function js(e,t){if(t.agent&&t.agent!==e.agent)throw new U(`A task starts children of its own agent only.`,403);let n=[`cwd`,`flow`,`args`,`mcp`,`addDirs`].filter(e=>t[e]!==void 0);if(n.length)throw new U(`A child task takes no ${n.join(`, `)}; give it the text to work on.`,403);return{...t,agent:e.agent,access:Re(t.access,e.access),connections:it(e.connections,t.connections)}}const Ms=/^[a-z0-9][a-z0-9_-]*$/i;function Ns(e,t){let n=t.find(t=>e instanceof Object&&t in e);if(n)return`Unknown task option "${n}". Give model as <name>[/<effort>] or <engine>/<model>[/<effort>], and access as read-only or auto.`}function Ps(e){let t=Ns(e,[`engine`,`effort`,`permissions`,`background`]);if(t)throw new U(t);let n=e.flow??`default`;if(!Ms.test(n))throw new U(`Invalid flow "${n}"`);if(e.prompt!==void 0&&typeof e.prompt!=`string`)throw new U(`prompt must be text`);if(n==="default"&&!e.prompt?.trim())throw new U(`prompt is required`);if((e.prompt?.length??0)>65536)throw new U(`prompt is longer than 64 KB`);if(e.repo!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(e.repo))throw new U(`repo must be owner/name`);if(e.pr!==void 0&&(!Number.isInteger(e.pr)||e.pr<1||!e.repo))throw new U(`pr needs a repo and a pull request number`);if(e.access!==void 0&&!ye.includes(e.access))throw new U(`Unknown access "${e.access}". Use read-only or auto.`);if(e.mcp!==void 0&&(!Array.isArray(e.mcp)||!e.mcp.every(e=>Ms.test(e))))throw new U(`mcp must list server names`);if(e.connections!==void 0&&(!Array.isArray(e.connections)||!e.connections.every(e=>typeof e==`string`&&e.length>0)))throw new U(`connections must list connection ids`);if(e.outputSchema!==void 0&&(!e.outputSchema||typeof e.outputSchema!=`object`||Array.isArray(e.outputSchema)))throw new U(`outputSchema must be an object`);if(e.args!==void 0&&(typeof e.args!=`object`||Array.isArray(e.args)))throw new U(`args must be an object`);if(e.name!==void 0&&(typeof e.name!=`string`||e.name.length>200))throw new U(`name must be text of at most 200 characters`);if(e.appendSystem!==void 0&&(typeof e.appendSystem!=`string`||e.appendSystem.length>65536))throw new U(`appendSystem must be text of at most 64 KB`);if(e.addDirs!==void 0&&(!Array.isArray(e.addDirs)||!e.addDirs.every(e=>typeof e==`string`&&P.isAbsolute(e))))throw new U(`addDirs must list absolute paths`)}async function Fs(e,t){let n=(await e.store.list(`installation`)).filter(({value:t})=>!t.deletedAt&&e.integrations[t.integration]?.repos).sort((e,n)=>Number(n.value.repos?.includes(t)??!1)-Number(e.value.repos?.includes(t)??!1)),r=new Map((await Co(e.store,n.map(({value:e})=>e.app))).map(({id:e,value:t})=>[e,t])),i=e.taskPrincipal?.agent;for(let{value:a}of n){let n=e.integrations[a.integration];if(a.deletedAt||!n?.repos)continue;let o=r.get(a.app);if(!(!o||i&&o.agent!==i))try{let r=await Ff(e,n,a,z(e.config,o.credentials)),i=a.repos?.includes(t)?a:await Jo(e,a,!1,{app:o,token:r,repo:t});if(!i?.repos?.includes(t))continue;return{integration:n,installation:i,app:o,token:r}}catch(e){console.error(`coder server: repository token for ${a.id} failed`,e)}}throw i?new U(`No install of agent "${i}" reaches ${t}`,403):new U(`No install in this workspace reaches ${t}`,404)}async function Is(e,t,n,r){let i=n.repo,{integration:a,installation:o,app:s,token:c}=await Fs(e,i),l=await a.repos.get(i,c);return{event:{integration:a.id,type:n.pr?`pull_request`:`task`,appId:s.id,installationId:o.id.slice(s.id.length+1),deliveryId:t,actor:{id:r??``},text:n.prompt??``,...n.pr?{chat:{thread:a.repos.pullRequestThread(i,n.pr)}}:{},repo:l},author:a.author?.(s.name)??s.name}}async function Ls(e,t){if(t)try{let n=kt({model:t},J(e,await q(e)));return{engine:n.engine,model:n.model??void 0,...n.effort?{effort:n.effort}:{}}}catch(e){throw new U(e.message)}}async function Rs(e,t,n){let r=e.taskPrincipal,i=r&&(await e.store.get(`task`,r.task))?.task;r&&(n=js(r,n)),Ps(n);let a=As(e,n),o=(e.now??Date.now)(),s=i?ls(i):e.session?.user.id,c=n.agent||D();if(!c)throw new U(`Name an agent: this server has no default agent.`);c===D()&&await ar(e,o),e.local&&await cr(e.store,e.local.cwd,e.integrations);let{record:l,version:u}=await N(e.store,c),d=await La(e,{requestedBy:s,runner:n.runner,agent:u?.definition.runner}).catch(e=>{throw new U(e.message)});if(!l||!u)throw new U(`No agent "${c}"`,404);ks(e,c,l);let f=await Ls(e,n.model)??i?.usage?.pick,p=rr(l,u,f,e.integrations),{models:h,first:g}=await Xp(e,vt(p),s),_=$p(h,d.runner===`http`);if(!_.length)throw await Bs(e,h,g.engine);let v=`${o.toString(36)}-${I(4).toString(`hex`)}`,y=n.repo?await Is(e,v,n,s):void 0,b=n.addDirs?.length?jt(d.runner):void 0;if(e.local&&n.addDirs?.length&&!b)try{Mt(a??e.local.cwd,n.addDirs)}catch(e){throw e instanceof m?new U(e.message):e}let x={id:v,...n.name?{name:n.name}:{},source:t,agent:p.id,flow:n.flow??`default`,...d,access:Tt(p,n.access),...y?{event:y.event,author:y.author}:{},...a&&!y?{cwd:a}:{},...n.prompt?{prompt:n.prompt}:{},...n.args?{args:n.args}:{},...n.mcp?.length?{mcp:n.mcp}:{},...n.appendSystem?{appendSystem:n.appendSystem}:{},...n.addDirs?.length&&!b?{addDirs:n.addDirs}:{},definition:p.definition,models:_,...s?{requestedBy:s}:{},...r?{parent:r.task,audience:r.audience,...r.space?{space:r.space}:{}}:{},...p.files?{files:p.files}:{},usage:{...p.usage,...f?{pick:f}:{}},tools:r?xt(p,n.access):{},connections:await uh(e,s,it(p.usage?.connections,n.connections)),...e.session||n.outputSchema?{context:{...e.session?{user:{name:e.session.user.name,email:e.session.user.email}}:{},...n.outputSchema?{outputSchema:n.outputSchema}:{}}}:{}};return e.local&&d.runner===`local`&&!d.runnerId?gp(e,x):(await e.queue.enqueue(e.organizationId,x,o,void 0,e.config.maxQueued??1e3),b&&await ys(e,v,[b]),{task:x,status:`queued`,attempts:0,createdAt:o,updatedAt:o})}function zs(e){return e.turns?e.turns:[...e.task.context?.turns??[],{prompt:e.task.prompt??e.task.event?.text??e.task.name??``,result:e.result,error:e.error,finishedAt:e.finishedAt,...[`completed`,`failed`,`cancelled`].includes(e.status)?{logSeq:e.logSeq}:{}}]}async function Bs(e,t,n,r){let i=await gm(e,n),a=r?.event?.actor;if(r?.requestedBy&&a&&r.source===r.event?.integration){let e=`@${a.login??a.id}`;return new U(`This thread runs on ${e}'s subscription. Ask ${e}, or an admin can add a workspace key: [Add a key](${i})`,409,i)}return new U(`No credential runs ${t.map(e=>e.model).join(` or `)}`,409,i)}async function Vs(e,t,n){let r=t.runnerId?await e.store.get(`runner`,t.runnerId):void 0;return t.source!==t.event?.integration&&(!r||Fa(r,n))?{runner:t.runner,...t.runnerId?{runnerId:t.runnerId}:{}}:{runnerId:void 0,...await La(e,{requestedBy:n,agent:t.definition.runner})}}async function Hs(e,t){let n=t.usage?.pick,r=t.event,i;if(r){let[n,a]=await Promise.all([e.store.get(`app`,r.appId),e.store.get(`installation`,`${r.appId}:${r.installationId}`)]);if(!n||!a||a.deletedAt||!e.loadAgent)return{};ks(e,t.agent,await e.store.get(`agent`,t.agent));let o=e.integrations[r.integration],s=z(e.config,n.credentials);i=await e.loadAgent(n,a,r,If(e,o,a,r,s))}else{t.agent===D()&&await ar(e,(e.now??Date.now)());let{record:r,version:a}=await N(e.store,t.agent);if(ks(e,t.agent,r),!r||!a)return{};i=rr(r,a,n,e.integrations)}let a=r&&wt(r,i,t.access),o={...i.usage,...n},s=ls(t),c=r&&t.source===r.integration?r:void 0,[l,{models:u,first:d},f]=await Promise.all([Vs(e,t,s),Xp(e,vt({...i,usage:o}),s),c&&Iv(e)]),p=$p(u,l.runner===`http`),m=c?.chat?.message?.author.userId||c?.actor.id,h=c&&m&&!t.context?.asker?await Rm(e,e.integrations[c.integration],{task:t.id,actor:m,models:u,attempts:p,...f?{slug:f}:{}}):void 0;if(!p.length)throw h?new U(h.failure,409,h.url):await Bs(e,u,d.engine,t);return{definition:i.definition,usage:{...o,...n?{pick:n}:{}},models:p,...l,tools:a?.tools??xt(i,t.access),...i.files?{files:i.files}:{},access:Tt(i,t.access),...c?{failureReply:h?.failure??await vm(e,d.engine,f),notice:h?.notice}:{}}}async function Us(e,t,n,r,i={}){if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))throw new U(`outputSchema must be an object`);if(!n.trim())throw new U(`text is required`);if(n.length>65536)throw new U(`text is longer than 64 KB`);let{model:a,access:o}=i;if(a!==void 0&&(typeof a!=`string`||!a.trim()))throw new U(`model must be text`);if(o!==void 0&&!ye.includes(o))throw new U(`Unknown access "${o}". Use read-only or auto.`);let s=(e.now??Date.now)(),c=t.task.context?.messages??[],l=String(t.finishedAt??s),u=[...c,{user:`user`,text:t.task.prompt??t.task.event?.text??``,ts:String(t.createdAt)},{user:`agent`,text:t.result?.output??t.error??``,ts:l}].slice(-20),d=t.task.context??{},f=zs(t);f.at(-1).finishedAt??=s;let p=a?await Ls(e,a):t.task.usage?.pick,m=await Hs(e,{...t.task,usage:{...t.task.usage,pick:p}}),h={task:{...t.task,...m,prompt:n,access:Re(o,m.access??t.task.access),context:{...d,...r?{outputSchema:r}:{},messages:u,turns:f}},status:`queued`,attempts:0,generation:(t.generation??0)+1,...t.logSeq===void 0?{}:{logSeq:t.logSeq},...t.logBytes===void 0?{}:{logBytes:t.logBytes},createdAt:t.createdAt,updatedAt:s};if(!await e.queue.continueTask(e.organizationId,t.task.id,h.task,s,{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0}))throw new U(`Task is already active`,409);return h}const Ws={principalPerMinute:300,ipPerMinute:60,authPerMinute:20,registerPerMinute:10,pairingPerMinute:5,concurrentTasks:10};var Gs=class{buckets=new Map;sweptAt;requests=0;rejections=0;constructor(e=Date.now()){this.sweptAt=e}consume(e,t,n){if(n-this.sweptAt>=6e4){for(let[e,t]of this.buckets)n-t.at>=6e4&&this.buckets.delete(e);this.sweptAt=n}let r=this.buckets.get(e),i=r?Math.min(t,r.tokens+Math.max(0,n-r.at)*t/6e4):t,a=i<1;if(this.buckets.set(e,{tokens:a?i:i-1,at:n}),!a)return;this.rejections++;let o=Math.max(1,Math.ceil((1-i)*60/t));return O({error:`Too many requests. Try again in ${o} seconds.`},429,{"retry-after":String(o)})}};const Ks=[[e=>e===`/admin/runners/pair`,`pairing`],[e=>e===`/runners/register`,`register`],[e=>e.startsWith(`/admin/`)||e.startsWith(`/runners/`)],[e=>e.startsWith(`/api/auth`)||e===`/login`||e===`/dash/token`,`auth`]];async function qs(e,t,n){let r=new URL(e.url).pathname,i=Ks.find(([e])=>e(r));if(!i)return(r===`/dash`||r.startsWith(`/dash/`))&&t.auth&&!await t.auth.session(e.headers)?Js(t,void 0,n,`auth`)??{}:{};let a=r.startsWith(`/admin/`)?await E_(e,t):void 0;return Js(t,r===`/runners/register`?await M_(e,t):a&&!(a instanceof Response)?a.taskPrincipal?`task:${a.taskPrincipal.task}`:a.session?`user:${a.session.user.id}`:`admin`:void 0,n,i[1])??{scope:a}}function Js(e,t,n,r){let i=e.limits??=new Gs((e.now??Date.now)()),a={...Ws,...e.config.limits},o=(e.now??Date.now)(),s=t??`ip:${n}`,c=i.consume(s,t?a.principalPerMinute:a.ipPerMinute,o);return c||!r?c:r===`pairing`?i.consume(`pair:${s}`,a.pairingPerMinute,o):i.consume(`${r}:ip:${n}`,r===`auth`?a.authPerMinute:a.registerPerMinute,o)}const Ys=Symbol(`miss`);function Xs(e,t){return new Proxy(e,{get(e,n){let r=Reflect.get(e,n,e);if(typeof r!=`function`)return r;let i=r.bind(e),a=t[n];return a?async(...e)=>{let t=a(...e);return t===Ys?i(...e):t}:i}})}const Zs=(e,t)=>e.length===t.length&&e.every((e,n)=>e===t[n]);function Qs(e,t,n){let r=t.task,i=r.event,a=e=>e in n,o=`connections:${r.id}:${t.generation??0}:${t.attempts}:`;return Xs(e,{get:(e,t)=>e===`app`&&a(`app`)&&t===i?.appId?n.app:e===`installation`&&a(`installation`)&&t===`${i?.appId}:${i?.installationId}`?n.installation:e===`credential`&&a(`credential`)&&t===r.models?.[0]?.credential?n.credential:e===`config`&&a(`config`)&&t===`workspace`?n.config:e===`runner`&&a(`runner`)&&t===r.runnerId?n.runner:e===`snapshot`&&a(`secrets`)&&t===`connection-secrets:${r.id}`?void 0:e===`snapshot`&&a(`resolved`)&&t.startsWith(o)?n.resolved?.id===t?n.resolved.value:void 0:Ys,list:(e,t)=>e===`snapshot`&&a(`secrets`)&&t?.prefix===`connection-secrets:${r.id}:`?n.secrets.rows.map((e,n)=>({id:`${t.prefix}${n}`,value:{secret:e}})):Ys,listCredentials:e=>a(`credentials`)&&e.owner===r.requestedBy&&e.limit===void 0?n.credentials??[]:Ys,heldTokens:(e,t)=>a(`tokens`)&&n.installation&&Zs(e,[n.installation.id])&&Zs(t,[n.installation.app])?n.tokens:Ys})}function $s(e,t,n){let r=e=>e===void 0||e===t.member?.id,i=(e,t)=>!e.owner||e.owner===t;return Xs(e,{get:(e,r)=>e===`agent`&&r===n.agent?t.record:e===`snapshot`&&n.files.some(e=>r.startsWith(e))?t.files[r]:Ys,conversationState:e=>e===n.conversation?t.conversation:Ys,listCredentials:e=>r(e.owner)&&e.limit===void 0?t.credentials.filter(t=>i(t.value,e.owner)):Ys,list:(e,n)=>e===`runner`&&n?.defaults&&!n.runner&&r(n.visibleTo)?t.runners.filter(e=>i(e.value,n.visibleTo)):e===`connection`&&!n?.ids&&!n?.secrets&&r(n?.visibleTo)?t.connections.filter(e=>i(e,n?.visibleTo)).map(e=>({id:e.id,value:e})):Ys,heldTokens:(e,r)=>Zs(e,[n.installation.id])&&Zs(r,[n.installation.app])?t.tokens:Ys})}const ec=2592e6,tc=36e5;async function nc(e,t){return t.chat?rc(e,e.integrations[t.integration],t.appId,t.installationId,t.chat.thread.id):{}}async function rc(e,t,n,r,i){let a=Lc(n,r,ic(t,i)),o=await e.store.conversationState(a),s=Lc(n,r,i);if(o.record||s===a)return o;let c=await e.store.conversationState(s);return c.record?{...o,record:c.record,status:c.status}:o}const ic=(e,t)=>e?.item?.(t)??t,ac=(e,t)=>Lc(t.appId,t.installationId,ic(e.integrations[t.integration],t.chat.thread.id)),oc=(e,t)=>!e?.chat||e.chat.thread.id===t.chat?.thread.id,sc=e=>e.slice(0,e.indexOf(`:`)),cc=e=>e.channelId?.slice((e.adapterName?.length??-1)+1)??``;function lc(e,t,n,r){return`known:${e}:${t}:${n}:${r}`}async function uc(e,t){return(await nc(e,t)).status}function dc(e,t,n,r){let i=t.chat?.thread;if(!i)return;let a=i.id.slice((i.channelId?.length??-1)+1);return{key:ac(e,t),record:{at:r,taskId:n,...t.chat?.message?{seen:t.chat.message.id}:{}},root:lc(t.appId,t.installationId,cc(i),a),ttlMs:ec}}async function fc(e,t,n,r){let i=dc(e,t,n,r);i&&await e.store.putMany(`delivery`,[{id:i.key,value:i.record},{id:i.root,value:{at:r}}],{ttlMs:ec})}function pc(e,t){let n=e.chat?.thread;return n?[...new Set([t].flat().filter(Boolean))].map(t=>lc(e.appId,e.installationId,cc(n),t)):[]}async function mc(e,t,n,r){await e.store.putMany(`delivery`,pc(t,n).map(e=>({id:e,value:{at:r}})),{ttlMs:ec})}async function hc(e,t,n,r){if(t.chat?.message)return e.store.markConversation(ac(e,t),n,t.chat.message.id,r,ec)}function gc(e,t){let n=t.conversation?.unseen;return t.chat&&n!==void 0?{key:ac(e,t),version:n.version,...n.epoch?{epoch:n.epoch}:{}}:void 0}async function _c(e,t,n){await e.store.appendUnseen(ac(e,t),n,ec)}async function vc(e,t){let n=gc(e,t);n&&await e.store.acknowledgeUnseen(n.key,n.version,n.epoch)}function yc(e,t,n){let r=Ct(n.definition.integrations[e.id]);return!t.builtin&&Object.entries(e.events).some(([e,t])=>t.noisy&&r.includes(e))}function bc(e,t){let n=e.events[t.type]?.on;return n===`mention`||n===`command`||t.chat?.thread.isDM===!0||t.chat?.message?.isMention===!0||t.mentioned===!0}async function xc(e,t,n,r){let i=n.chat?.thread;if(!i)return n;let a=i.isDM===!0,o=bc(t,n),[s,c]=await Promise.all([r.loaded?r.unseen??{messages:[],more:0}:e.store.get(`delivery`,`since:${ac(e,n)}`).then(e=>e??{messages:[],more:0}),t.conversation?t.conversation(n,{token:r.token,fetch:e.fetch??fetch,delivered:r.delivered,...r.existing?.seen?{after:r.existing.seen}:{}}).catch(e=>(console.error(`coder server: ${t.id} conversation facts failed`,e),{})):{}]),l=new Set(s.messages.flatMap(e=>e.id??[])),u=(c.since??[]).map(e=>({thread:i.id,...e})),d=new Map(u.flatMap(e=>e.id?[[e.id,e]]:[])),f=[...s.messages.map(({sequence:e,...t})=>t.id&&d.get(t.id)||t),...u.filter(e=>!e.id||!l.has(e.id))],p=f.slice(0,50),m=(c.since?0:s.more)+f.length-p.length,h=r.existing||a?void 0:c.index??n.conversation?.index;return{...n,mustReply:o,conversation:{...h===void 0?{}:{index:h},...s.messages.length||s.more?{unseen:{version:s.version??s.messages.length+s.more,epoch:s.epoch}}:{},...p.length?{since:p}:{},...m?{more:m}:{}}}}async function Sc(e,t,n){for(;;){let r=await e.store.claimBatch(t,n);if(r!==null)return r;await new Promise(e=>setTimeout(e,500))}}async function Cc(e,t,n,r,i){return e.store.finishBatch(t,n,r,i)}async function wc(e,t,n,r){let i=await e.store.get(`task`,t.task.id)??t,a=sc(n),o=await Xh(e,t.task.id,-1,i.generation??0),s=new Set([i.task.context?.admissions?.[a],...o.map(e=>e.value?.admissions?.[a])]);return{fresh:i,through:r.reduce((e,t,n)=>s.has(t.admission)?n+1:e,0)}}async function Tc(e,t,n,r,i){if(!Z.includes(t.status))return!1;let a=t.status!==`queued`&&kc(e,t.task)?yp(e.local.cwd,t.task.id,!1):void 0;if(a&&!Z.includes(a.status))return!1;let o=!!await Yh(e,t,`steer`,i===void 0?{text:n}:{text:n,asker:i},r);return o&&t.task.notice&&await Dc(e,t),o}const Ec=e=>`notice:${e.task.id}:${e.generation??0}`;function Dc(e,t){return e.store.create(`delivery`,Ec(t),{at:(e.now??Date.now)()},{ttlMs:ec})}function Oc(e,t){return e.store.delete(`delivery`,Ec(t))}const kc=(e,t)=>!!e.local&&!t.event?.repo&&t.runner===`local`&&!t.runnerId;async function Ac(e,t,n,r,i,a,o){let{task:s}=t,c={mustReply:r,admissions:{...s.context?.admissions,...i},asker:a},l=s.event&&o?{...s.event,chat:o}:s.event;if(kc(e,s))return bp(e,e.local.cwd,s.id,n,void 0,{},c,l);try{await Us(e,{...t,task:{...s,event:l,context:{...s.context,...c}}},n)}catch(t){if(!(t instanceof U&&t.status===409))throw t;if(!t.fix||!l)return!1;let n=await e.store.get(`app`,l.appId),{eventReplies:r}=await Promise.resolve().then(()=>rd);n&&await(await r(e,n,l)).post(t.message)}return!0}function jc(e,t){let n=t.catch(e=>console.error(`coder server: conversation batch failed`,e));e.waitUntil&&e.waitUntil(n)}function Mc(e){let t=t=>yn(e.slice(0,t).map(e=>e.event),e[t-1].user),n=t(1);if(n.length>65536){let t=e[0].event,n=n=>yn([{...t,text:t.text.slice(0,n)+`
+[message truncated]`}],e[0].user);n(0).length>65536&&(t={...t,conversation:{...t.conversation,since:void 0,more:(t.conversation?.more??0)+(t.conversation?.since?.length??0)},chat:t.chat?{thread:t.chat.thread,message:t.chat.message?{...t.chat.message,attachments:[],links:[]}:void 0}:void 0});let r=0,i=t.text.length;for(;r<i;){let e=Math.ceil((r+i)/2);n(e).length<=65536?r=e:i=e-1}return{text:n(r),count:1}}let r=1;for(;r<e.length;){let e=t(r+1);if(e.length>65536)break;n=e,r++}return{text:n,count:r}}async function Nc(e,t,n,r,i,a,o){let s=`batch:${ac(e,n)}`;if(!(a?a.batch:await e.store.get(`delivery`,s))?.items.length&&oc(t.task.event,n)&&await Tc(e,t,yn([n],r),void 0,o??null)){await vc(e,n),await hc(e,n,t.task.id,i());return}let c=L(),l=n.chat?.message,u=l?{...n,chat:{thread:n.chat.thread,message:{...l,formatted:{type:`root`,children:[]},raw:null,attachments:l.attachments.map(({type:e,url:t,name:n})=>({type:e,...t?{url:t}:{},...n?{name:n}:{}}))}}}:n;await e.store.appendBatch(s,c,[{admission:c,event:u,user:r,...o?{asker:o}:{}}],i(),tc),await vc(e,n),jc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.steerBatchMs??5e3)),await Fc(e,t,s,c,i)})())}function Pc(e,t){let n=t.event;if(!n?.chat||t.source!==n.integration)return;let r=`batch:${ac(e,n)}`;jc(e,(async()=>{let n=await e.store.get(`delivery`,r),i=n?.items.length&&await e.store.get(`task`,t.id);i&&await Fc(e,i,r,n.owner,e.now??Date.now)})())}async function Fc(e,t,n,r,i){let a=await Sc(e,n,r);if(!a)return;let o=a.items.map((e,t)=>t===a.items.length-1?{...e,event:{...e.event,mustReply:e.event.mustReply||a.mustReply,conversation:{...e.event.conversation,more:(e.event.conversation?.more??0)+(a.more??0)}}}:e),s=!1,c=!1,l=!1;try{for(let a=0;a<o.length;){let{fresh:s,through:u}=await wc(e,t,n,o);if(u>a){if(c=!0,!await Cc(e,n,r,!0,o[u-1].admission))return;a=u;continue}let d=o[a].event,f=oc(s.task.event,d);if(!f&&Z.includes(s.status))return;let p=o.slice(a).findIndex(e=>!oc(e.event,d)),{text:m,count:h}=Mc(o.slice(a,p<0?void 0:a+p)),g=o.slice(a,a+h),_=g.at(-1).admission,v=g.every(e=>e.asker===g[0].asker)?g[0].asker:void 0,y=f&&await Tc(e,s,m,{key:n,owner:r,through:_},v??null),b=y||await Ac(e,s,m,g.some(e=>e.event.mustReply===!0),{[sc(n)]:_},g.at(-1).asker,d.chat);if(!b&&!l){l=!0;continue}if(!b)throw Error(`Conversation task did not accept the batch`);if(c=!0,!y&&!await Cc(e,n,r,!0,_))return;await hc(e,g.at(-1).event,t.task.id,i()),a+=h}s=!0}catch(e){if(!(e instanceof Fh))throw e}finally{s||await Cc(e,n,r,!1),c&&await Bl(e,!0,!1,!0)}}async function Ic(e,t,n,r){let i=await uc(e,t);if(!i||!Z.includes(i.status))return;let a=`reactions:${ac(e,t)}`,o=L();await e.store.appendBatch(a,o,[{...n,admission:o}],r(),tc),jc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.reactionBatchMs??3e4));let n=await Sc(e,a,o);if(!n)return;let r=!1;try{let{fresh:s,through:c}=await wc(e,i,a,n.items),l=n.items.slice(c);if(c&&!await Cc(e,a,o,!0,n.items[c-1].admission))return;if(!l.length){r=!0;return}let u=new Map;for(let{emoji:e,by:t,on:n}of l){let r=u.get(`${e}\n${n}`)??{emoji:e,by:[],on:n};r.by.includes(t)||r.by.push(t),u.set(`${e}\n${n}`,r)}r=await Tc(e,s,vn({...t,conversation:{...t.conversation,more:n.more}},[...u.values()]),{key:a,owner:o,through:l.at(-1).admission})}catch(e){if(!(e instanceof Fh))throw e}finally{r||await Cc(e,a,o,!1)}})())}function Lc(e,t,n){return`thread:${e}:${t}:${n}`}async function Rc(e,t,n,r){let i={},a=r===void 0&&e.auth&&n.actor.id?await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0):r;return a&&(i.user={name:a.name,email:a.email},i.asker=a.id),i}var zc=t({ACCESS_UNCHECKED:()=>Gc,DELIVERY_TTL_MS:()=>Vc,dispatchEvent:()=>Xc,dropped:()=>W,failedDeliveries:()=>tl,linkedMember:()=>Wc,recordFailure:()=>$c,reportTaskFailure:()=>el,writeCheck:()=>Kc});const Bc=6e4,Vc=864e5,Hc=262144;async function Uc(e,t,n){let r=`${t.id}:${n.installationId}`,i=e.boundInstallation?.installation.id===r?e.boundInstallation.installation:await e.store.get(`installation`,r);return i&&!i.deletedAt?i:void 0}function W(e,t,n=`info`){console[n](`coder server: ${e.appId} dropped ${e.type} event ${e.deliveryId}: ${t}`)}async function Wc(e,t,n){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);return r?.organizations?.includes(e.organizationId)?r:void 0}const Gc=`Coder could not check your access to this conversation.`;async function Kc(e,t,n,r){if(t.auth.canWrite)return t.auth.canWrite(n,await r(),e.fetch).catch(e=>(console.error(`coder server: ${t.id} write check failed for ${n.appId} event ${n.deliveryId}`,e),null))}async function qc(e,t,n){return`No model is configured yet. If you have access to it, [Add a model](${await gm(e,t,n)}).`}function Jc(e,t,n){let r=e.config.publicUrl?.replace(/\/$/,``);return r?`${r}${Lv(t,n)}`:void 0}async function Yc(e,t,n){let r=t.chat?.thread.id;if(!e.local||t.repo||!r)return;let i=e.integrations[t.integration],a=ic(i,r),o=(await e.store.list(`delivery`,{prefix:`delivery:`})).find(({value:e})=>{let r=e.pending?.task;return r?.agent===n&&r.event?.appId===t.appId&&r.event.installationId===t.installationId&&ic(i,r.event.chat?.thread.id??``)===a&&e.pending?.taskId})?.value.pending;if(!o?.task)return;let s=await gp(e,o.task,o.taskId);return await fc(e,o.task.event,s.task.id,(e.now??Date.now)()),await e.store.get(`task`,s.task.id)??s}async function Xc(e,t,n,r,i,a,o){let s=i.chat?ic(t,i.chat.thread.id):``,c=`delivery:${t.id}:${n.id}:${i.installationId}:${s}:${i.deliveryId}`,l=await Uc(e,n,i);if(!l)return W(i,`installation ${i.installationId} is not bound or was removed`,`error`),{};if(e.local&&await(e.syncAgent?.(n.agent)??cr(e.store,e.local.cwd,e.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e)),!e.local){let u=L(),d={delivery:{key:c,owner:u,at:a(),ttlMs:Bc},agent:n.agent,...i.chat?{conversation:Lc(i.appId,i.installationId,s)}:{},...i.actor.id?{actor:{platform:t.id,id:i.actor.id}}:{},installation:l,files:Za(l,i)},{claimed:f,loaded:p}=await e.store.dispatchState(d);if(!f)return W(i,`another request holds or finished its delivery`),{};let m=p?{...e,store:$s(e.store,p,d)}:e;if((await m.store.get(`agent`,n.agent))?.settings?.disabled)return await e.store.updateDelivery(c,u,void 0),W(i,`agent ${n.agent} is disabled`),{};try{let s=await Qc(m,t,n,r,i,l,a,o,c,{owner:u,loaded:p&&{...p,store:m.store}});if(!s.work&&!s.taskId&&!s.steered){let t=i.chat?.message?void 0:{at:a()};await e.store.updateDelivery(c,u,t,{ttlMs:Vc})}return await s.work,s.taskId?{taskId:s.taskId}:{}}catch(t){let n=await e.store.get(`delivery`,c).catch(()=>void 0),r=n?.pending?.task?n.pending:void 0;throw await e.store.updateDelivery(c,u,r?{at:a(),pending:r}:void 0).catch(()=>{}),t}}if((await e.store.get(`agent`,n.agent))?.settings?.disabled)return W(i,`agent ${n.agent} is disabled`),{};if(await e.store.get(`delivery`,c).then(e=>e&&!e.pending))return W(i,`its delivery is already done`),{};let u=JSON.stringify([i.appId,i.installationId,s]),d=e.store.handoffs??=new Map,f=(d.get(u)??Promise.resolve()).catch(()=>{}).then(async()=>{let s=await Qc(e,t,n,r,i,l,a,o,c);return await s.work,s});d.set(u,f);try{return await f}finally{d.get(u)===f&&d.delete(u)}}async function Zc(e,t,n,r,i,a,o,s){let c=s??L(),l=a&&ne(),u=l&&a?.taskUrl?Jc(e,await(o?.()??Iv(e)),`/tasks/${l}`):void 0,d={event:n,...a?{task:{...a,...u?{taskUrl:u}:{}},taskId:l}:{}};if(e.local&&!n.repo){let i=await e.store.get(`delivery`,t);if(i&&!i.pending)return W(n,`its delivery is already done`),{};if(d=i?.pending??d,d.task&&!d.taskId)throw Error(`Local delivery has no task binding`);await e.store.put(`delivery`,t,{at:r(),owner:c,pending:d})}else if(!s&&!await e.store.create(`delivery`,t,{at:r(),owner:c,pending:d},{ttlMs:Bc}))return W(n,`another request holds or finished its delivery`),{};return{work:(async()=>{let n=Promise.resolve(),a=e.local?void 0:setInterval(()=>{n=n.then(async()=>{await e.store.updateDelivery(t,c,{at:r(),owner:c,pending:d},{ttlMs:Bc})}).catch(()=>{})},Bc/3);try{await i(d),a&&clearInterval(a),await n,await e.store.updateDelivery(t,c,{at:r()},{ttlMs:Vc})}catch(r){throw a&&clearInterval(a),await n,(!e.local||!d.task)&&await e.store.updateDelivery(t,c,void 0).catch(()=>{}),r}})()}}async function Qc(e,t,n,r,i,a,o,s,c,l){let u,d=()=>u??=Iv(e,l?.loaded?.workspace),f=t=>Zc(e,c,i,o,t,void 0,d,l?.owner),p=If(e,t,a,i,r),m=async()=>(await p(i.integration)).token(),h=i.chat?sl(i.text):void 0,g=h&&(await nc(e,i)).status;if(h&&g&&(h.id||(await Dl(e,g.task.id)).length===1))return f(()=>kl(e,t,g,h,i,m,e=>s.whisper(e)));let[_,v]=await Promise.all([e.loadAgent(n,a,i,p,l?.loaded),e.auth&&i.actor.id?l?.loaded?l.loaded.member:Wc(e,t,i):void 0]),y=wt(i,_);if(!y){let t=i.chat?.message;return t&&await _c(e,i,{id:t.id,thread:i.chat.thread.id,author:t.author.userName||t.author.userId,text:i.text,sentAt:t.metadata.dateSent}),W(i,`agent ${_.id} is not wired for it`),{}}let b=await Kc(e,t,i,m);if(b===null)return f(async()=>{await s.post(Gc)});if(b===!1)return W(i,`${i.actor.login??i.actor.id} cannot write where it happened`),{};let x=t=>Zc(e,c,i,o,async t=>{let n=t.task,r=await gp(e,n,t.taskId);await Promise.all([fc(e,n.event,r.task.id,o()),vc(e,n.event)]),await kh(e,r.task.id,p.minted)},t,d);if(e.local&&!i.repo){let t=await e.store.get(`delivery`,c);if(t?.pending?.task){let e=t.pending.task;return e.agent===_.id?x(e):(W(i,`its interrupted handoff belongs to agent ${e.agent}`),await s.endTyping?.(),{})}}let S=!!i.chat,C=S?await nc(e,i):void 0,ee=C?.record,w=S?await xc(e,t,i,{token:async()=>(await p(i.integration))?.token(),delivered:yc(t,n,_),unseen:C?.unseen,loaded:!0,...ee?{existing:ee}:{}}):i,te=v?{name:v.name,email:v.email}:void 0,T=S?C?.status??await Yc(e,w,_.id):void 0,ne=T?await fs(e,t,i,m):void 0,re=!!(T?.task.space&&ne&&T.task.space!==H({...i,space:ne})),ie=T&&!re&&Z.includes(T.status)?T:void 0;if(bc(t,i)&&(!ie||(ie.task.context?.mustReply??ie.task.event?.mustReply)&&!ie.typingEnded)){let t=s.startTyping?.().catch(e=>console.error(`coder server: could not show ${i.deliveryId} is being worked on`,e));t&&e.waitUntil?.(t)}if(T&&!re)return f(async()=>{let n=T.task.event,r=v&&!T.task.requestedBy&&T.task.source===i.integration&&n?.integration===i.integration&&n.actor.id===i.actor.id&&await e.queue.setRequestedBy(e.organizationId,T.task.id,v.id,o()),a=ne?.private===!0&&T.task.event?.space?.private!==!0&&!!T.task.space&&await e.queue.spaceChanged(e.organizationId,{...i,space:ne},{private:!0},o()).then(()=>!0),s=(r||a)&&await e.store.get(`task`,T.task.id)||T;await Promise.all([Nc(e,s,w,te,o,C,v?.id),ps(e,t,s.task.event??i,m)])});let ae=v?.id,[oe,{models:se,first:ce},le,ue,de]=await Promise.all([La(e,{requestedBy:ae,agent:_.definition.runner}),Xp(e,vt(_),ae),Rc(e,t,i,v??null),uh(e,void 0,_.usage?.connections),ne??fs(e,t,i,m)]),fe=$p(se,oe.runner===`http`),pe=ce.engine,E=`${i.deliveryId}-${_.id}`,me=async()=>v||!i.actor.id?void 0:Rm(e,t,{task:E,actor:i.actor.id,models:se,attempts:fe,slug:await d()});if(!fe.length)return w.mustReply??bc(t,i)?f(async()=>{let r=`setup:${n.id}:${i.chat?ic(t,i.chat.thread.id):i.deliveryId}`,a=i.deliveryId;if(!await e.store.create(`delivery`,r,{at:o(),owner:a},{ttlMs:6048e5})&&(await e.store.get(`delivery`,r))?.owner!==a)return s.endTyping?.();try{await s.post((await me())?.failure??await qc(e,pe,await d()))}catch(t){throw await e.store.updateDelivery(r,a,void 0),t}}):(W(i,`no usable ${se.map(e=>e.model).join(` or `)} model${ae?``:` among the workspace credentials`}`,`error`),await s.endTyping?.(),{});if(Buffer.byteLength(JSON.stringify(i))>Hc)throw Error(`Event exceeds 256 KB`);if(Buffer.byteLength(JSON.stringify(le))>Hc)throw Error(`Task context exceeds 256 KB`);let he=Jc(e,await d(),`/tasks/${E}`),ge=Jc(e,await d(),`/agents/${encodeURIComponent(_.id)}/settings`),_e=await me(),ve={id:E,source:i.integration,agent:_.id,flow:`default`,...oe,event:de?{...w,space:de}:w,failureReply:_e?.failure??await vm(e,pe,await d()),..._e?.notice?{notice:_e.notice}:{},...he?{taskUrl:he}:{},...ge?{settingsUrl:ge}:{},author:t.author?.(n.name)??n.name,definition:_.definition,access:Tt(_),models:fe,...ae?{requestedBy:ae}:{},..._.files?{files:_.files}:{},..._.usage?{usage:_.usage}:{},tools:y.tools,connections:ue,...Object.keys(le).length?{context:le}:{}};if(e.local&&!i.repo&&oe.runner===`local`&&!oe.runnerId)return x(ve);let ye=o(),[be]=await Promise.all([e.queue.deliver(e.organizationId,ve,ye,{key:c,ttlMs:Vc,...l?{owner:l.owner}:{}},S?yn([w],te):void 0,e.config.maxQueued??1e3,!0,{conversation:dc(e,w,E,ye),unseen:gc(e,w),secrets:Oh(e,E,p.minted)}),ps(e,t,ve.event,m)]);return be}async function $c(e,t,n,r,i,a){let o=e.integrations[t.integration],s=i?.repo&&`${i.repo.owner}/${i.repo.name}`,c=i&&(o?.link?.(i)??(s&&o?.repos?.url(s))),l=!1;try{let a=r&&await V(e,`${t.id}:${r}`)||e,o={at:(e.now??Date.now)(),organization:a.organizationId,integration:t.integration,app:t.id,agent:t.agent,error:(n instanceof Error?n.message:String(n)).split(`
+`)[0].slice(0,500),...i?{type:i.type,delivery:i.deliveryId}:{},...i?.chat?{thread:i.chat.thread.id}:{},...s?{repo:s}:{},...c?{url:c}:{}},u=`failed:${t.agent}:${i?.deliveryId??L()}`;l=await a.store.create(`delivery`,u,o,{ttlMs:Vc})}catch(e){console.error(`coder server: could not record a failed delivery for ${t.id}`,e)}if(!(!l||!a||!o||!i||!bc(o,i)))try{await(await a()).post(n instanceof ut?n.message:`Coder could not handle this message. If you run this server, check its logs. Otherwise [report the problem](${e.config.issuesUrl}).`)}catch(e){console.error(`coder server: could not tell ${t.id}'s thread about a failed delivery`,e)}}async function el(e,t,n){let{task:r}=t,i=r.event;if(!i||r.source!==i.integration)return;let a=await e.store.get(`app`,i.appId).catch(e=>{console.error(`coder server: could not report the failure of task ${r.id}`,e)});if(!a)return;let{endTyping:o,eventReplies:s}=await Promise.resolve().then(()=>rd);await $c(e,a,n,i.installationId,i,()=>s(e,a,i,t)),await o(e,t).catch(e=>console.error(`coder server: could not clear the working indicator of task ${r.id}`,e))}async function tl(e,t){let n=(await e.list(`delivery`,{prefix:`failed:${t}:`})).map(e=>e.value).sort((e,t)=>t.at-e.at);return{failed:n.length,recent:n.slice(0,50)}}const nl=2592e6,rl=6e4,il=/^\s*\/(approve|deny|ask-admin)\s+(apr-[\w-]+)(?:\s+([\s\S]*?))?\s*$/i,al=/^\s*(approve|deny)\s*$/i,ol={approve:`accept`,deny:`decline`,"ask-admin":`ask`};function sl(e){let t=il.exec(e),n=(t?.[1]??al.exec(e)?.[1])?.toLowerCase();if(!n)return;let r=t?.[3]?.trim();return{...t?{id:t[2]}:{},decision:ol[n],...r&&n===`deny`?{reason:r}:{}}}function cl(e){let t="`".repeat(Math.max(3,...(e.match(/`+/g)??[]).map(e=>e.length+1)));return`${t}\n${e}\n${t}`}function ll(e){if(e.decision===`closed`)return`**Task stopped**.`;let t=`**${e.decision===`accept`?`Approved`:`Denied`}** ${e.by?`by ${e.by}`:`in Coder`}${e.reason?`: ${e.reason}`:``}`;return/[.!?]$/.test(t)?t:`${t}.`}function ul(e,t){let n=`${t+1}. `;return/[\n`]/.test(e)?n+cl(e).replaceAll(`
+`,`\n${` `.repeat(n.length)}`):`${n}\`${e}\``}function dl(e){return{summary:Gt(e),markdown:e.actions.map(ul).join(`
+`),items:e.actions}}function fl(e,t={}){let n=t.outcome?ll(t.outcome):[!t.separate&&e.taskUrl&&`[Approve in Coder](${e.taskUrl})`,t.commands&&`reply \`/approve ${e.id}\` or \`/deny ${e.id} <reason>\``].filter(Boolean).join(`, or `),r=dl(e);return[`**Approval needed**`,e.reason,!t.separate&&(t.collapsed?t.collapsed(r.summary,r.markdown):`**${r.summary}**\n\n${r.markdown}`),n&&`${n[0].toUpperCase()}${n.slice(1)}${t.outcome?``:`.`}`].filter(Boolean).join(`
+
+`)}function pl(e,t,n,r){let i=e.messages&&!n?[{label:`Approve`,value:`/approve ${t.id}`,style:`primary`,confirm:`Approve ${Gt(t)} for this task?`},{label:`Deny`,value:`/deny ${t.id}`,style:`danger`,ask:{label:`Why?`,placeholder:`The task reads it`}}]:void 0;return r?{markdown:[r.note,`Waiting for your answer on the approval above.`].filter(Boolean).join(`
+
+`),...i?{buttons:[...i,...r.buttons??[]]}:{}}:{markdown:fl(t,{outcome:n,commands:!i,separate:!!e.messages,collapsed:e.collapsed}),...e.messages?{card:{title:`Approval needed`,body:t.reason,...n?{status:ll(n),outcome:n.decision===`accept`?`success`:`failure`}:{}},collapsed:dl(t)}:{},...i?{buttons:i}:{},...i&&!e.messages?.asks?{hint:`Or reply \`/deny ${t.id} <why>\` to deny with a reason.`}:{},...i&&t.taskUrl?{link:{label:`Open in Coder`,url:t.taskUrl}}:{}}}const ml=`approval:`,hl=(e,t)=>`${ml}${e}:${t}`;function gl(e,t){let n=t.event,r=n?.chat&&t.source===n.integration?e.integrations[n.integration]:void 0;return r?{integration:r,event:n}:void 0}async function _l(e,t,n){let r=await e.store.get(`app`,n.appId);if(!r)throw Error(`The conversation's app ${n.appId} is gone`);let{adapterContext:i,eventThread:a}=await Promise.resolve().then(()=>rd),o={id:n.installationId,...n.repo?{repo:n.repo}:{},...n.account?{account:n.account}:{}};return{ctx:i(e,t,r,z(e.config,r.credentials),o),thread:await a(e,r,n)}}async function vl(e,t,n){return e.messages?e.messages.post(t,n):(await t.thread.post({markdown:n.markdown})).id}async function yl(e,t,n,r,i){if(e.messages?.edit)return n?e.messages.edit(t,n,r):void 0;if(e.messages)return void await e.messages.post(t,i);if(n)return t.thread.adapter.editMessage(t.thread.id,n,{markdown:r.markdown})}const bl=(e,t)=>({id:t.id,task:e.id,reason:t.reason,actions:t.actions,...e.taskUrl?{taskUrl:e.taskUrl}:{}}),xl=e=>({decision:e.decision,...e.reason?{reason:e.reason}:{},...e.by?{by:e.by}:{}});async function Sl(e,t){let n=(e.now??Date.now)();return e.store.withAppLock(t,async e=>{let r=await e.get(`delivery`,t);if(!r)return;let i=(r.lease??0)>n;return await e.put(`delivery`,t,i?{...r,again:!0}:{...r,lease:n+rl},{ttlMs:nl}),i?void 0:r})}async function Cl(e,t,n){return e.store.withAppLock(t,async e=>{let r=await e.get(`delivery`,t);if(!r)return!1;let{lease:i,again:a,retryAt:o,...s}={...r,...n};return await e.put(`delivery`,t,n.retryAt?{...s,retryAt:o}:s,{ttlMs:nl}),a===!0})}async function wl(e,t){let n=await e.store.get(`task`,t.id);return e.local&&n?.handle?.startsWith(`cli:`)?zt(w(t.cwd??e.local.cwd,t.id)):n?.task.context?.approvals??[]}async function Tl(e,t,n){let r=gl(e,t);if(!r||!n.length)return;let i=new Map((await e.store.list(`delivery`,{prefix:hl(t.id,``)})).map(e=>[e.id,e.value])),a,o=async()=>a??=await _l(e,r.integration,r.event);for(let a of n){let n=hl(t.id,a.id),s=i.get(n);if(s?.shownAt&&(!a.response||s.shown===a.response.answeredAt))continue;let c=(e.now??Date.now)(),l={at:c,notice:bl(t,a),lease:c+rl},u=!s&&await e.store.create(`delivery`,n,l,{ttlMs:nl});for(let i=0;i<3;i++){let s=i===0&&u?l:await Sl(e,n);if(!s)break;let c=bl(t,a),d=a.response?xl(a.response):void 0,f;if(s.shownAt&&(!a.response||s.shown===a.response.answeredAt))f=await Cl(e,n,{});else try{if(s.shownAt)await yl(r.integration,await o(),s.message,pl(r.integration,c,d),{markdown:ll(d)}),f=await Cl(e,n,{shown:a.response.answeredAt});else{let t=await vl(r.integration,await o(),pl(r.integration,c,d));f=await Cl(e,n,{shownAt:(e.now??Date.now)(),...t?{message:t}:{},...d?{shown:a.response.answeredAt}:{}})}}catch(r){console.error(`coder server: could not show approval ${a.id} of task ${t.id} in its conversation`,r),f=await Cl(e,n,{retryAt:(e.now??Date.now)()+6e4})}if(!f)break;a=(await wl(e,t)).find(e=>e.id===a.id)??a}}}async function El(e){let t=(e.now??Date.now)(),n=await e.store.approvalPostsDue(t,12e4),r=new Map;for(let t of n){let n=t.organizationId??e.organizationId,i=r.get(`${n}:${t.value.notice.task}`)??{organizationId:n,ids:new Set};i.ids.add(t.value.notice.id),r.set(`${n}:${t.value.notice.task}`,i)}for(let[t,{organizationId:n,ids:i}]of r){let r=t.slice(n.length+1),{scoped:a}=await Promise.resolve().then(()=>$i),o=a(e,n),s=await o.store.get(`task`,r);if(!s)continue;let c=(await wl(o,s.task)).filter(e=>i.has(e.id));await Tl(o,s.task,c)}}async function Dl(e,t){return(await e.store.list(`delivery`,{prefix:hl(t,``)})).filter(e=>!e.value.shown).map(e=>e.value.notice.id)}async function Ol(e,t,n,r,i){let a=sl(i);if(!a)return!1;let o=await V(e,`${t.id}:${n.id}`),s=o&&(await rc(o,e.integrations[t.integration],t.id,n.id,r)).status;return s?a.id?!!await o.store.get(`delivery`,hl(s.task.id,a.id)):(await Dl(o,s.task.id)).length===1:!1}async function kl(e,t,n,r,i,a,o){let s=r.id?[r.id]:await Dl(e,n.task.id);if(s.length!==1){await o("Name the approval: `/approve <id>` or `/deny <id> <reason>`.");return}let c=i.actor,l=await Kc(e,t,i,a);if(l===null){await o(Gc);return}if(l===!1){await Al(e,n.task,s[0],c);return}let{changeOf:u,decideChange:d}=await Promise.resolve().then(()=>Cu),f=n.task.context?.approvals?.find(e=>e.id===s[0]),p=u(f);if(p){let a=e.auth?await Wc(e,t,i):void 0,c=a&&{...a,role:a.roles?.[e.organizationId]},l=await d(e,n,s[0],{...r},c),u=gl(e,n.task),f=async(n,r=[])=>u?vl(t,await _l(e,t,u.event),{markdown:n,...r.length?{buttons:r}:{}}):o(n);if(l.ok){r.decision===`ask`&&await f(`Asked the workspace admins to approve it.`);return}let m=(await l.json()).error??`You need write access here to approve or deny this.`;if(l.status!==403||!c||p.scope!==`workspace`)return void await f(m);if(!t.messages)return void await f(`${m} Reply \`/ask-admin ${s[0]}\` to ask one.`);await f(m,[{label:`Ask an admin`,value:`/ask-admin ${s[0]}`}]);return}if(r.decision===`ask`){await o(`Only a change the task asked for goes to an admin.`);return}let{decideApproval:m}=await Promise.resolve().then(()=>Kd),h=await m(e,n.task.id,{approvalId:s[0],decision:r.decision,...r.reason?{reason:r.reason}:{}},c.login||c.id);h.ok||await o((await h.json()).error??`You need write access here to approve or deny this.`)}async function Al(e,t,n,r){let i=gl(e,t);if(!i)return;let a=hl(t.id,n),o=r.id||r.login||``;if(!await e.store.withAppLock(a,async e=>{let t=await e.get(`delivery`,a);if(!(!t||t.refused?.includes(o)))return await e.put(`delivery`,a,{...t,refused:[...t.refused??[],o]},{ttlMs:nl}),t}))return;let s=await _l(e,i.integration,i.event);await vl(i.integration,s,{markdown:`You need write access here to approve or deny this.`})}async function jl(e,t,n,r,i){let a=sl(i.text?`${i.value} ${i.text}`:i.value);if(!a){console.warn(`coder server: ${n.id} sent a click Coder does not read: ${i.value}`);return}let o=await V(e,`${n.id}:${r.id}`),s=o&&(await rc(o,t,n.id,r.id,i.thread)).status,c=s?.task.event;if(!o||!s||c?.appId!==n.id||c.installationId!==r.id){console.warn(`coder server: ${n.id} answered an approval of an unknown task`);return}let l=await _l(o,t,c),u=()=>l.ctx.token(c.installationId,{tools:t.tools.presets[`read-only`]});await kl(o,t,s,a,{...c,actor:i.actor},u,e=>l.thread.post({markdown:e}))}function Ml(e,t,n){let r;return Promise.race([e,new Promise((e,i)=>{r=setTimeout(()=>i(Error(`${n} timed out`)),t),r.unref?.()})]).finally(()=>clearTimeout(r))}async function Nl(e,t,n,r){try{await Ml(t.stop(n),e.runnerTimeoutMs??1e4,`runner stop`)}catch(e){return console.error(`coder server: runner stop ${r} failed`,e),!1}return!0}async function Pl(e,t,n,r={}){let i=t.handle?await za(e,t.task):void 0,a=await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0,...r});if(a){let{reportTaskFailure:r}=await Promise.resolve().then(()=>zc),a=await e.store.get(`task`,t.task.id);a&&await r(e,a,n),await Ll(e,t,!0,i),a&&Pc(e,a.task)}return a}async function Fl(e,t,n){if(e.local&&t.handle?.startsWith(`cli:`)){let r=await e.store.get(`task`,t.task.id);return r?up(e,r,n):!1}let r=t.handle?await za(e,t.task):void 0,i={handle:t.handle??null,lastSeenAt:t.lastSeenAt??null,updatedAt:t.updatedAt};if(t.cancelRequestedAt!==void 0&&n-t.cancelRequestedAt>=3e4){let i=await e.queue.finish(e.organizationId,t.task.id,{status:`cancelled`,error:`The runner did not acknowledge cancellation within 30 seconds`},n,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0});if(i){await Ll(e,t,!0,r);let n=await e.store.get(`task`,t.task.id);n&&Pc(e,n.task)}return i}if(!t.handle)return n-(t.lastSeenAt??t.startedAt??t.updatedAt)<(e.config.taskStallMs??3e5)?!1:t.attempts>=(e.config.taskAttempts??2)?Pl(e,t,`runner start was interrupted`,i):e.queue.requeue(e.organizationId,t.task.id,n,{generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,...i});if(t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)return Pl(e,t,`timeout`);if(!r||n-(t.lastSeenAt??t.startedAt??t.updatedAt)<Math.min(e.config.taskStallMs??6e4,6e4)||!await e.store.withAppLock(`runner-status:${e.organizationId}:${t.task.id}`,async e=>{let r=`runner-status:${t.task.id}:${t.generation??0}:${t.attempts}`,i=await e.get(`delivery`,r);return i&&`at`in i&&i.at!==void 0&&n-i.at<3e4?!1:(await e.put(`delivery`,r,{at:n},{ttlMs:6e4}),!0)}))return!1;let a=await Ml(r.status(t.handle),e.runnerTimeoutMs??1e4,`runner status`);return a.state===`exited`?Pl(e,t,`runner exited${a.code===void 0?``:` with code ${a.code}`}`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null}):Pl(e,t,`The runner stopped reporting heartbeats`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null})}async function Il(e,t){return[`running`,`waiting`].includes(t.status)&&await Fl(e,t,(e.now??Date.now)()).catch(()=>!1)?await e.store.get(`task`,t.task.id)??t:t}async function Ll(e,t,n=!1,r){let i=`${e.organizationId}:${t.task.id}:${t.attempts}`,a=e.settings?.cancelChecks?.get(i);if(a&&(clearTimeout(a.timer),a.finish(),e.settings.cancelChecks.delete(i)),!t.handle||t.logsComplete)return;let o=r??await za(e,t.task);o&&(n||o.kind===`vercel-sandbox`||o.kind===`local-docker`)&&!await Nl(e,o,t.handle,t.task.id)||await e.queue.patchTask(e.organizationId,t.task.id,{logsComplete:!0},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,handle:t.handle})}function Rl(e,t){let n=`${e.organizationId}:${t.task.id}:${t.attempts}`,r=(e.settings??={}).cancelChecks??=new Map;if(r.has(n))return;let i=new Promise(e=>{let t=setTimeout(e,3e4);r.set(n,{timer:t,finish:e})}).then(async()=>{r.delete(n);let i=await e.store.get(`task`,t.task.id);i&&i.attempts===t.attempts&&i.tokenHash===t.tokenHash&&await Il(e,i)}).catch(e=>console.error(`coder server: cancellation check failed`,e));e.waitUntil&&e.waitUntil(i)}async function zl(e,t,n){let r=e.now??Date.now,i=e.config.limits?.concurrentTasks??Ws.concurrentTasks,a=e.config.store===`postgres`?e.config.maxTasks:Math.min(i,e.config.maxTasks??i);{t&&e.local?await Promise.all([ip(e,e.local.cwd),ap(e)]):t&&await Promise.all([e.queue.archiveStopped(void 0,r()),El(e)]);let n=await e.queue.running(),i=0;for(let t of n)await Fl(B(e,t.organizationId),t.status,r()).catch(()=>!1)&&i++;if(a!==void 0&&n.length-i>=a)return}let o=[];for(;;){let t=e.local?rp(e.local.cwd,!1).filter(e=>e.status===`running`||e.status===`waiting`):[],s=t.length?new Set((await e.queue.running()).flatMap(e=>[e.status.task.id,...e.status.handle?.startsWith(`cli:`)?[e.status.handle.slice(4)]:[]])):new Set,c=t.filter(t=>!s.has(t.task.id)&&!s.has(C(t.task.cwd??e.local.cwd,t.task.id)?.flowRunId??``)).length,l=a===void 0?void 0:a-c;if(l!==void 0&&l<=0)break;let u=await e.queue.claim(r(),l,n,i);if(n=!1,!u)break;let d=u.status,f=B(e,u.organizationId),p=u.loaded&&f.store?{...f,store:Qs(f.store,d,u.loaded)}:f;if(await lp(p,d,u.token)){if(n=u.more,!u.more)break;continue}let m=await za(p,d.task);if(!m){await Pl(p,d,`No runner available: ${d.task.runner}`);continue}let h=d,g={generation:d.generation??0,attempts:d.attempts,tokenHash:d.tokenHash??null,statuses:[`running`,`waiting`]},_;try{let e=m.kind===`vercel-sandbox`?await Xf(p,d.task):void 0,t=m.start(d.task,{CODER_SERVER:p.local&&m.kind===`local`?`http://localhost:${p.local.port}`:p.config.publicUrl??``,CODER_TASK_TOKEN:u.token,CODER_INBOX_MODE:m.push?`push`:`poll`},e?.credential,{timeoutMs:p.config.taskTimeoutMs+6e4,waitUntil:p.waitUntil,...e?{hosts:e.hosts,brokered:e.brokered}:{}});_=await Ml(t,p.runnerTimeoutMs??3e4,`runner start`).catch(e=>{throw t.then(e=>Nl(p,m,e,d.task.id),()=>{}),e});let i=Hf(d.task);if(await p.queue.patchTask(u.organizationId,d.task.id,{handle:_,...i&&i!==d.task.usage?.resolvedModel?{resolvedModel:i}:{}},r(),g)||await Nl(p,m,_,d.task.id),n=u.more,!u.more)break}catch(e){_!==void 0&&await Nl(p,m,_,d.task.id);let t=e instanceof Error?e.message:String(e);if(d.attempts<(p.config.taskAttempts??2)){o.push({...u,status:h});continue}await Pl(p,h,t)}}for(let t of o)await B(e,t.organizationId).queue.requeue(t.organizationId,t.status.task.id,r(),{attempts:t.status.attempts,tokenHash:t.status.tokenHash})}function Bl(e,t=!1,n=!1,r=!1){let i=e.queue.scheduler??={},a=t?i.waiting:void 0;if(a)return a;let o=i.running??Promise.resolve(),s=()=>(i.waiting===c&&delete i.waiting,zl(e,n,r)),c=o.then(s,s);return i.waiting=c,i.running=c.catch(()=>{}),c}function Vl(e,t=!1){let n=Bl(e,!0,!1,t).catch(()=>{});e.waitUntil&&e.waitUntil(n)}async function Hl(e,t,n,r){if(t.source!==`repo`||!t.repo)return;let i=(await(r??e.store.list(`app`))).find(({value:e})=>e.agent===t.id&&e.agentsRepo===t.repo)?.value;return((i&&e.integrations[i.integration])??Object.values(e.integrations).find(e=>e.repos))?.repos?.url(t.repo,t.path,i?.branch??n?.commit)}async function Ul(e,t,n){return st()[t]&&await ar(e,n),N(e.store,t)}async function Wl(e,t){let n=(e.now??Date.now)();(!t||st()[t])&&await ar(e,n);let r=e.local?await cr(e.store,e.local.cwd,e.integrations,t).catch(()=>void 0):void 0;return{now:n,local:r,loadCurrent:()=>r?Promise.resolve(r.find(({record:e})=>e.id===t)??{}):Ul(e,t,n)}}async function Gl(e,t,{after:n,q:r,source:i,platform:a,limit:o}){return t?(t??[]).filter(({version:e})=>!a||!!e?.definition?.integrations?.[a]).map(({record:e})=>e).filter(e=>(!n||Qn(e)>n)&&(!i||e.source===i)&&(!r||[e.id,e.name,e.description,e.repo].some(e=>e?.toLowerCase().includes(r)))).sort((e,t)=>Qn(e)<Qn(t)?-1:1).slice(0,o):(await e.store.listAgentSummaries({after:n,q:r,source:i,platform:a,limit:o})).map(({record:e})=>e)}async function Kl(e,t,n,r){let i=r.searchParams.get(`fields`);if(i&&![`id`,`id,name`].includes(i))return O({error:`Invalid fields`},400);let{local:a}=await Wl(t);if(!a&&A(r)&&!i)return O(await Zl(t,r));let o=k(r,200);if(i){let e=await Gl(t,a,{after:Mn(r),q:r.searchParams.get(`q`)?.trim().toLowerCase(),source:Xl[r.searchParams.get(`type`)??``],platform:r.searchParams.get(`platform`)??void 0,limit:o+ +!!A(r)}),n=e=>i===`id`?{id:e.id}:{id:e.id,name:e.name},s=Pn(e,o,Qn);return O(A(r)?{...s,items:s.items.map(n)}:e.map(n))}let s=a??await t.store.listAgentSummaries({limit:o});if(A(r))return O(await Zl(t,r,s));let c,l=D();return O(await Promise.all(s.slice(0,o).map(async({record:e,version:n})=>{e.source===`repo`&&e.repo&&(c??=t.store.list(`app`));let r=await Hl(t,e,n,c);return{...e,problems:mr(e,n,t.integrations),...e.id===l?{default:!0}:{},definition:n?.definition,...r?{sourceUrl:r}:{}}})))}async function ql(e,t,n,r){let i=n.slug,{local:a,loadCurrent:o}=await Wl(t,i),s=k(r,10,50),c=Mn(r),[l,u]=await Promise.all([a?o().then(e=>e.record):fr(t.store,i),a?Promise.resolve(a.flatMap(({version:e})=>e?[{value:e}]:[])):t.store.listVersions(i,s+1,c)]);return l?O(await Ql(t,l,s,c??l.currentVersion+1,u)):O({error:`No agent named "${i}"`},404)}async function Jl(e,t,n,r){let i=n.slug,a=n.version?Number(n.version):void 0;if(n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return j();let{local:o}=await Wl(t,i),s=o?o.find(({version:e})=>e?.version===a)?.version:await lr(t.store,i,a);return s?O(s):O({error:`No version ${a} for agent "${i}"`},404)}async function Yl(e,t,n,r){let i=n.slug,{local:a,loadCurrent:o}=await Wl(t,i),s=r.searchParams.get(`versions`)!==`0`,c=r.searchParams.get(`content`)!==`0`,l=r.searchParams.get(`handles`)===`1`,u=r.searchParams.get(`installations`)===`1`,d=t.session?.user.id,[{record:f,version:p},m,h,g,_]=await Promise.all([!c&&!a?t.store.listAgentSummaries({slug:i}).then(e=>e[0]??{}):o(),s?a?a.flatMap(({version:e})=>e?[{value:e}]:[]):t.store.listVersions(i):[],l||u?Fo(t,i):[],l?tl(t.store,i):void 0,u?t.store.list(`installation`,{agent:i,active:!0}):[]]);if(!f)return O({error:`No agent named "${i}"`},404);let{models:v,unrunnable:y}=l?await Qp(t,vt({definition:p?.definition,usage:f.settings}),d):{},b=p?.definition.integrations??{},x=e=>{let t=b[e]?.events;return Array.isArray(t)?t.includes(`mention`):!!(t&&`mention`in t)},S=[],C=Object.keys(t.integrations),ee=(e,t)=>C.indexOf(e.value.integration)-C.indexOf(t.value.integration);for(let{value:e}of l?[...h].sort(ee):[])x(e.integration)&&!S.some(t=>t.integration===e.integration&&t.name.toLowerCase()===e.name.toLowerCase())&&S.push({name:e.name,integration:e.integration,platform:t.integrations[e.integration]?.name??e.integration});let w=_.flatMap(({value:e})=>{let t=h.find(({id:t})=>t===e.app);return t&&!e.uninstalled?[{integration:e.integration,account:e.account.login,app:t.value.name}]:[]}),te=m.map(({value:e})=>{let{systemPrompt:t,files:n,...r}=e;return r}),T=await Hl(t,f,p);return O({...f,problems:mr(f,p,t.integrations),...p?{stale:yt(p.definition),definition:p.definition,...c&&`systemPrompt`in p?{systemPrompt:p.systemPrompt,...p.files?{files:p.files}:{}}:{}}:{},...T?{sourceUrl:T}:{},...s?{versions:te}:{},...S.length?{handles:S}:{},...u?{installations:w}:{},...g?.failed?{deliveries:{failed:g.failed,recent:g.recent.map(e=>({at:e.at,platform:t.integrations[e.integration]?.name??e.integration,...e.type?{type:e.type}:{},error:e.error,...e.url?{url:e.url}:{}}))}}:{},...v?{model:Se(v[0].option),runsOn:rm(v,d),...$p(v).length?{}:{needsModel:!0}}:{},...y?.length?{unrunnable:y}:{}})}const Xl={builtin:`builtin`,dashboard:`upload`,repository:`repo`};async function Zl(e,t,n){let r=k(t,24,100),i=Mn(t),a=t.searchParams.get(`q`)?.trim().toLowerCase(),o=Xl[t.searchParams.get(`type`)??``],s=t.searchParams.get(`platform`),c=t.searchParams.get(`apps`)===`1`,l=e.store.list(`app`),[u,d,f,p]=await Promise.all([l,e.store.list(`installation`),c?Fo(e,void 0,l):[],n?n.filter(({record:e})=>(!i||Qn(e)>i)&&(!o||e.source===o)&&(!a||[e.id,e.name,e.description,e.repo].some(e=>e?.toLowerCase().includes(a)))).sort((e,t)=>Qn(e.record)<Qn(t.record)?-1:1):e.store.listAgentSummaries({after:i,source:o,q:a,platform:s??void 0,limit:r+1})]),m=new Set(d.filter(({value:e})=>!e.deletedAt&&!e.uninstalled).map(({value:e})=>e.app)),h=(e,t)=>{let n=u.filter(({value:n})=>n.agent===e&&n.integration===t);return n.length?n.some(({value:e})=>m.has(e.id))?`installed`:`created`:`none`},g=[];for(let{record:e,version:t}of p){let n=Object.keys(t?.definition?.integrations??{}).sort();if(!(s&&!n.includes(s))&&(g.push({record:e,version:t,ids:n}),g.length>r))break}let _=Pn(g,r,e=>Qn(e.record)),v=D(),y=new Set(_.items.map(({record:e})=>e.id)),b=f.filter(({value:e})=>y.has(e.agent)),x=new Set(b.map(({value:e})=>e.id));return{..._,...c?{apps:b.map(({value:t})=>Io(e,t)),installations:d.filter(({value:e})=>x.has(e.app)&&(!e.deletedAt||e.uninstalled)).map(({value:t})=>Ko(e,t))}:{},items:await Promise.all(_.items.map(async({record:t,version:n,ids:r})=>{let i=await Hl(e,t,n,l);return{...t,problems:mr(t,n,e.integrations),...t.id===v?{default:!0}:{},definition:n?.definition,...i?{sourceUrl:i}:{},platforms:r.map(e=>({id:e,state:h(t.id,e)}))}}))}}async function Ql(e,t,n,r,i){let a=(i??await e.store.listVersions(t.id,n+1,r)).map(({value:e})=>{let{systemPrompt:t,files:n,definition:r,...i}=e;return i}).filter(e=>e.version<r).reverse();return Pn(a,n,e=>e.version)}function $l(e){if(!e||Array.isArray(e)||typeof e!=`object`)return!1;let t=Object.entries(e);if(t.length>100)return!1;let n=0;for(let[e,r]of t){if(typeof r!=`string`||e.startsWith(`/`)||e.includes(`\\`)||e.includes(`\0`)||e.split(`/`).includes(`..`)||e===`agent.json`||e===`system.md`)return!1;n+=Buffer.byteLength(e)+Buffer.byteLength(r)}return n<=262144}async function eu(e,t){return(await po(e,[t])).flatMap(({app:e,error:t,check:n})=>{let r={id:e.id,integration:e.integration,name:e.name};return t?[{...r,error:t}]:n?n.changed?[{...r,drift:!0}]:[]:[{...r,updated:!0}]})}async function tu(e,t,n){let r=n&&typeof n==`object`?bt(n):n,i=Et({[t]:r})[t];if(!i||typeof i!=`object`)throw Error(`settings must be an object`);if(i.model){let t=Ee(i.model);i.engine=kt({engine:i.engine,model:i.model,effort:i.effort},J(e,await q(e))).engine,i.model=t.model,i.effort=t.effort??i.effort}let a=await im(e,i,!!e.taskPrincipal);if(a)throw Error(a);return i}async function nu(e,t,n){let{loadCurrent:r}=await Wl(e,t),{disabled:i,...a}=await tu(e,t,n),o=i?{...a,disabled:i}:a,{record:s,version:c}=await r();if(!s||!c)throw Error(`No agent named "${t}".`);if(rr({...s,settings:void 0},c,a,e.integrations),!e.local)return gr(e.store,t,o,(e.now??Date.now)());let l=dt(e.local.cwd,t,!!i);if(l)throw new m(`server`,`Agent "${t}" is ${i?`enabled`:`disabled`} by agents.${t} in ${l}. Change it there.`,{status:409});return await Cf(e,e=>{e.agents={...e.agents,[t]:bt(o)}}),await cr(e.store,e.local.cwd,e.integrations),await fr(e.store,t)}async function ru(e,t,n,r){let i=await e.json().catch(()=>void 0);return nu(t,n.slug,i).then(O,e=>O({error:e.message},e instanceof m?e.status??400:400))}async function iu(e,t,n,r){let i=n.slug,{loadCurrent:a}=await Wl(t,i),{record:o}=await a();return o?o.source===`builtin`?O({error:`Built-in agents cannot be deleted.`},400):t.local&&!await ur(t.local.cwd,t.integrations,i)?O({error:`Delete .coder/agents/${i} in the repo`},409):(await t.store.delete(`agent`,i),O({ok:!0})):O({error:`No agent named "${i}"`},404)}async function au(e,t,n,r){if(await Wl(e,t),!n||typeof n.systemPrompt!=`string`||n.files!==void 0&&!$l(n.files)||n.name!==void 0&&typeof n.name!=`string`||n.description!==void 0&&typeof n.description!=`string`)throw Error(`definition and systemPrompt are required; files must contain strings`);lt([t]);let[i]=ct({definitions:{[t]:{json:n.definition,builtin:!1}},usage:void 0},e.integrations);if(!i)throw Error(`No agent named "${t}".`);let a=e.local?await fr(e.store,t):void 0,o=e.local&&a?await lr(e.store,t):void 0,s=n.files;e.local&&(await nr(e.local.cwd,e.integrations,t,{definition:{...n.definition,...n.name===void 0?{}:{name:n.name},...n.description===void 0?{}:{description:n.description}},systemPrompt:n.systemPrompt,...s?{files:s}:{}}),await cr(e.store,e.local.cwd,e.integrations));let c=e.local?void 0:await sr(e.store,{id:t,name:n.name??i.name,description:n.description??i.definition.description,source:`upload`,definition:i.definition,systemPrompt:n.systemPrompt,files:s,importedFrom:`upload`},(e.now??Date.now)(),r);if(!e.local&&!c)return;let l=c?.version??await lr(e.store,t),u=c?.unchanged??Ir(o&&{...o,createdAt:0},{...l,createdAt:0}),d=await eu(e,l);return{...c?.record??await fr(e.store,t),definition:l.definition,version:l.version,unchanged:u,apps:d}}async function ou(e,t,n,r){let i=await e.json().catch(()=>void 0);return au(t,n.slug,i).then(O,e=>O({error:e.message},400))}const su=/^[a-z0-9][a-z0-9-]*$/,cu=new Set([`openrouter.ai`,`ai-gateway.vercel.sh`,`api.groq.com`,`api.together.xyz`]);function lu(e){return{builtin:Ie,models:e.models??{}}}var uu=class{options;entries=new Map;pending=new Map;constructor(e){this.options=e}async get(e,t){let n=this.options.now??Date.now,r=n(),i=this.entries.get(e);if(i&&r-i.at<this.options.ttlMs)return i.value;let a=this.pending.get(e);return a||(a=Promise.resolve().then(t).then(t=>{if(t===void 0)return i?.value;if(this.options.accept&&!this.options.accept(t))return i?.value??t;this.entries.set(e,{value:t,at:n()});let r=this.entries.keys().next().value;return this.entries.size>this.options.max&&r!==void 0&&this.entries.delete(r),t}).catch(t=>(console.error(`coder server: model probe failed for ${e}`,t),i?.value)).finally(()=>this.pending.delete(e)),this.pending.set(e,a)),a}};async function du(e,t){let{baseUrl:n,envKey:r,key:i}=await Tf(e);if(!n||!/^https?:\/\//.test(n)||!URL.canParse(n))return O({error:`An http or https base URL is required`},400);let a=!i&&r&&await fu(t,n,r)?await om(t,r):void 0,o=i||a,s=t.settings??={},c=s.probes??=new uu({ttlMs:6e5,max:100,now:t.now,accept:e=>e.reachable}),l=`${new URL(n).host}|${r??``}|${mt(String(o??``))}`;return O(await c.get(l,()=>Dn({baseUrl:n},{key:o,fetch:t.fetch})))}async function fu(e,t,n){let r=new URL(t).host;if(cu.has(r))return!0;let i=(await q(e)).models??{};return Object.values(i).some(e=>xe(e)&&e.envKey===n&&new URL(e.baseUrl).host===r)}async function pu(e,t,n,r){let i=await q(t);return O({...lu(i),runsOn:await nm(t,i)})}async function mu(e,t,n,r){let{name:i=``,...a}=await Tf(e);return!su.test(i)||De(i)?O({error:`Invalid model name "${i}"`},400):Ef(t,e=>{if(e.models?.[i])throw new K(`"${i}" already exists`);e.models={...e.models,[i]:a}})}async function hu(e,t,n,r){let i=n.name;return Ef(t,e=>{if(!e.models?.[i])throw new K(`No model "${i}"`);Ne(e,i)})}async function gu(e,t,n,r){let i=await Tf(e);return Ef(t,e=>_u(e,n.name,i))}function _u(e,t,n){let r=e.models?.[t];if(!r||!xe(r))throw new K(`No custom model "${t}"`);e.models={...e.models,[t]:{...r,...n}}}async function vu(e,t,n,r){let{spec:i}=await Tf(e);return Ef(t,e=>yu(e,n.name,i))}function yu(e,t,n){if(!su.test(t))throw new K(`Invalid alias name "${t}"`);let r=e.models?.[t];if(r&&xe(r))throw new K(`"${t}" is a custom model name`);let i=Pe(n,Ae(e)),a=t===`codex`||t===`claude`||t===`custom`?t:void 0;if(a&&i?.engine!==a)throw new K(`The ${a} alias names a ${a} model`);if(!i?.model||i.engine===`custom`&&a!==`custom`)throw new K(`"${n}" does not name a codex or claude model`);let o=Ee(n);e.models={...e.models,[t]:[i.engine,o.model??i.model,o.effort].filter(Boolean).join(`/`)}}async function bu(e,t,n,r){return Ef(t,e=>Su(e,n.name,!0))}async function xu(e,t,n,r){return Ef(t,e=>Su(e,n.name,!1))}function Su(e,t,n){try{be(e.models??={},t,n)}catch(e){throw new K(e.message)}}var Cu=t({actAsRefusal:()=>Hu,adminApprovals:()=>Zu,changeOf:()=>Ou,decideChange:()=>Yu,decideRequest:()=>Xu,listPendingApprovals:()=>Qu,requestChange:()=>Bu,sessionApprover:()=>wu});async function wu(e){if(!e.session)return;let{user:t,role:n}=e.session,r=t.name?[]:await e.auth?.linkedAccounts?.(t.id).catch(()=>[]);return{...t,name:t.name||r?.find(e=>e.name)?.name||``,role:n}}const Tu=(e,t)=>`admin-ask:${e}:${t}`,Eu={"agent-settings":[`agent`],"agent-version":[`agent`],"model-update":[`workspace`],"model-alias":[`workspace`],"model-enable":[`workspace`],"model-disable":[`workspace`],"runner-default":[`workspace`,`personal`],"act-as":[`personal`]},Du=[`baseUrl`,`model`,`envKey`,`wireApi`,`contextWindow`],Ou=e=>e?.change;function ku(e={},t={}){let[n,r]=[e,t];return[...new Set([...Object.keys(n),...Object.keys(r)])].filter(e=>JSON.stringify(n[e])!==JSON.stringify(r[e]))}function Au(e={},t={}){let[n,r]=[e,t];return ku(n,r).flatMap(e=>{let[t,i]=[JSON.stringify(n[e]),JSON.stringify(r[e])];return t===void 0?[`+ ${e}: ${i}`]:i===void 0?[`- ${e}: ${t}`]:[`${e}: ${t} → ${i}`]})}function ju(e,t,n){if(t===n)return[];let r=e=>e?e.split(`
+`):[],[i,a]=[r(t),r(n)],o=0;for(;o<i.length&&o<a.length&&i[o]===a[o];)o++;let s=0;for(;s<i.length-o&&s<a.length-o&&i[i.length-1-s]===a[a.length-1-s];)s++;let c=i.slice(o,i.length-s),l=a.slice(o,a.length-s);if(c.length*l.length>1e6)return[[e,...c.map(e=>`- ${e}`),...l.map(e=>`+ ${e}`)].join(`
+`)];let u=c.map(()=>Array(l.length+1).fill(0));u.push(Array(l.length+1).fill(0));for(let e=c.length-1;e>=0;e--)for(let t=l.length-1;t>=0;t--)u[e][t]=c[e]===l[t]?u[e+1][t+1]+1:Math.max(u[e+1][t],u[e][t+1]);let d=[e],[f,p]=[0,0];for(;f<c.length||p<l.length;)f<c.length&&p<l.length&&c[f]===l[p]?[f,p]=[f+1,p+1]:f<c.length&&(p===l.length||u[f+1][p]>=u[f][p+1])?d.push(`- ${c[f++]}`):d.push(`+ ${l[p++]}`);return[d.join(`
+`)]}function Mu(e={},t={}){return[...new Set([...Object.keys(e),...Object.keys(t)])].sort().flatMap(n=>e[n]===void 0&&!t[n]?[`file ${n}\n+ (empty file)`]:t[n]===void 0&&!e[n]?[`file ${n}\n- (empty file)`]:ju(`file ${n}`,e[n]??``,t[n]??``))}async function Nu(e,t){let n=(await e.store.get(`agent`,t))?.settings;return n&&await tu(e,t,n).catch(()=>n)}const Pu=e=>`Agent ${e} has a newer version since this request, so it was not applied. Ask again.`;async function Fu(e,t){if(t.kind===`agent-version`)return(await lr(e.store,t.agent))?.version===t.version?t:Pu(t.agent);if(t.kind!==`agent-settings`)return t;let n={...await Nu(e,t.agent)},r={...t.before},i={...t.settings},a=ku(r,i),o=a.filter(e=>JSON.stringify(n[e])!==JSON.stringify(r[e]));if(o.length)return`Agent ${t.agent}'s ${o.join(`, `)} changed since this request, so it was not applied. Ask again.`;for(let e of a)i[e]===void 0?delete n[e]:n[e]=i[e];return{...t,settings:n}}function Iu(e,t,n){if(e===`agent-settings`)return{kind:e,agent:t.slug,settings:n};if(e===`agent-version`)return{kind:e,agent:t.slug,upload:n};if(e===`model-update`){let r=Object.fromEntries(Du.filter(e=>n[e]!==void 0).map(e=>[e,n[e]]));return{kind:e,name:t.name,fields:r}}return e===`model-alias`?typeof n.spec==`string`?{kind:e,name:t.name,spec:n.spec}:`An alias needs a spec.`:e===`model-enable`||e===`model-disable`?{kind:e,name:t.name}:n.default===!0&&Object.keys(n).length===1?{kind:e,runner:t.id}:`A task changes only a runner's default.`}function Lu(e){return t=>e.kind===`model-update`?_u(t,e.name,e.fields):e.kind===`model-alias`?yu(t,e.name,e.spec):Su(t,e.name,e.kind===`model-disable`)}async function Ru(e,t,n){if(t.kind===`act-as`)return`A task asks to act as a person only by using their connection.`;if(t.kind===`agent-settings`||t.kind===`agent-version`){if(t.agent!==n.agent)return`A task changes only its own agent.`;if(t.kind===`agent-settings`)return{reason:`Change agent ${t.agent}'s settings.`,actions:Au(t.before,t.settings),scopes:Eu[t.kind]};let[r,i]=await Promise.all([e.store.get(`agent`,t.agent),lr(e.store,t.agent)]),{definition:a,systemPrompt:o,files:s,name:c,description:l}=t.upload,u=[...Au({name:r?.name,description:r?.description},{name:c,description:l}),...Au(i?.definition,a),...ju(`instructions`,i?.systemPrompt??``,String(o??``)),...Mu(i?.files,s)];return u.length?{reason:`Publish a new version of agent ${t.agent}.`,actions:u,scopes:Eu[t.kind]}:`This publishes nothing new.`}if(t.kind!==`runner-default`){let n=await q(e),r=structuredClone(n);try{Lu(t)(r)}catch(e){return e.message}let i={"model-update":`Update`,"model-alias":`Alias`,"model-enable":`Enable`,"model-disable":`Disable`}[t.kind],a=e=>e&&typeof e==`object`?e:e===void 0?{}:{model:e},o=Au(a(n.models?.[t.name]),a(r.models?.[t.name]));return{reason:`${i} model ${t.name} for the workspace.`,actions:o.length?o:[`${i.toLowerCase()} ${t.name}`],scopes:Eu[t.kind]}}let r=t.runner===Ia(e)?{name:`Default runner`,default:!1,scope:`workspace`,owner:void 0}:await e.store.get(`runner`,t.runner);return!r||r.scope===`personal`&&r.owner!==n.asker?`Unknown runner`:{reason:`Make runner ${r.name} the default.`,actions:Au({default:r.default??!1},{default:!0}),scopes:[r.scope===`personal`?`personal`:`workspace`]}}async function zu(e,t){let n=g_(e),r=$o(n);return(await t.queue.authorize(r.task,Zo(n),r.attempt,t.organizationId,(t.now??Date.now)()))?.status}async function Bu(e,t,n,r){let i=t.taskPrincipal,a=Iu(n,r,await e.json().catch(()=>void 0)??{});if(typeof a==`string`)return O({error:a},400);if(a.kind===`agent-settings`){try{a.settings=await tu(t,a.agent,a.settings)}catch(e){return O({error:e.message},400)}a.before=await Nu(t,a.agent)}if(a.kind===`agent-version`){let[e,n]=await Promise.all([t.store.get(`agent`,a.agent),lr(t.store,a.agent)]);a.version=n?.version;let{name:r,description:i}=a.upload.definition??{};a.upload={...a.upload,name:a.upload.name??r??e?.name,description:a.upload.description??i??e?.description}}let o=await Ru(t,a,i);if(typeof o==`string`)return O({error:o},403);let s=await zu(e,t);if(!s)return O({error:`The task has ended.`},401);let{reason:c,actions:l}=o,u=o.scopes.filter(e=>e!==`personal`||i.asker);if(!u.length)return O({error:`Only the member who owns this can ask for it.`},403);let d=i.dm&&i.asker?`personal`:`workspace`,f=(t.now??Date.now)(),p={id:Vu(f),reason:c,actions:l,createdAt:new Date(f).toISOString(),change:{operation:a,scope:u.includes(d)?d:u[0],scopes:u,...i.asker?{asker:i.asker}:{}}};return await t.queue.patchTask(t.organizationId,s.task.id,{approvals:[p]},f),(t.waitUntil??(()=>{}))(Tl(t,s.task,[p]).catch(e=>console.error(`coder server: could not post request ${p.id}`,e))),O({pending:!0,approval:p.id,reason:c,changes:l,scope:Ou(p).scope,...s.task.taskUrl?{url:s.task.taskUrl}:{}},202)}const Vu=e=>`apr-${e.toString(36)}-${Math.random().toString(36).slice(2,6)}`;async function Hu(e,t,n,r){let i=n.owner,a=t.task,o=(a.context?.approvals??[]).filter(e=>{let t=Ou(e)?.operation;return t?.kind===`act-as`&&t.connection.id===n.id}),s=o.find(e=>e.response?.decision!==`closed`),c=(await Xh(e,a.id,-1,t.generation??0)).some(e=>e.kind===`steer`&&typeof e.value==`object`&&e.value!==null&&`asker`in e.value&&e.value.asker!==i);if(s?.response?.decision===`accept`&&!c)return;let l=(r??await e.auth?.linkedAccounts?.(i).catch(()=>[]))?.find(e=>e.name)?.name||(i===a.requestedBy?a.context?.user?.name:void 0)||`its owner`,u=`Waiting for ${l} to approve acting as them on ${n.name}`;if(c)return`${u}.`;if(s?.response)return`${l} declined acting as them on ${n.name} for this task.`;let d=(e.now??Date.now)();if(!s&&await e.store.create(`delivery`,`act-as:${a.id}:${n.id}:${o.length}`,{at:d},{ttlMs:e.config.taskTimeoutMs??36e5})){let t={id:Vu(d),reason:`Act as you on ${n.name} for this task?`,actions:[`Act as ${l} on ${n.name} until this task ends.`],createdAt:new Date(d).toISOString(),change:{operation:{kind:`act-as`,connection:{id:n.id,name:n.name},user:{name:l}},scope:`personal`,scopes:[`personal`],asker:i}};await e.queue.patchTask(e.organizationId,a.id,{approvals:[t]},d),(e.waitUntil??(()=>{}))(Tl(e,a,[t]).catch(e=>console.error(`coder server: could not post request ${t.id}`,e)))}return`${u}; this task continues once they answer.`}function Uu(e,t,n,r){if(!t.scopes.includes(n)||!Eu[t.operation.kind].includes(n))return`This change cannot apply to ${n}.`;if(!(!e.auth||r&&(n===`agent`||(n===`personal`?r.id===t.asker:u_(r.role)))))return t.operation.kind===`act-as`?`Only ${t.operation.user.name} answers this.`:`Only ${Kt[n]} approves this.`}async function Wu(e,t,n,r){if(t.kind===`act-as`)return;if(t.kind===`agent-settings`)return nu(e,t.agent,t.settings);if(t.kind===`agent-version`)return au(e,t.agent,t.upload,{currentVersion:t.version??0});if(t.kind!==`runner-default`)return Cf(e,Lu(t));let i=(e.now??Date.now)();return e.store.withAppLock(`runners:${e.organizationId}`,async a=>{let o=t.runner===Ia(e),s=o?void 0:await a.get(`runner`,t.runner),c=n===`personal`?r?.id:void 0;if(!o&&(s?.scope!==n||s.owner!==c))throw new m(`server`,`Unknown runner`,{status:404});await _g(a,t.runner,s,i),s&&await a.put(`runner`,t.runner,{...s,default:!0,updatedAt:i})})}async function Gu(e,t,n,r){let i=async e=>{let i=await Fu(e,t);if(typeof i==`string`)return i;let a=await Wu(e,i,n,r);if(i.kind===`agent-version`&&!a)return Pu(i.agent)};return t.kind===`agent-settings`?e.store.withAppLock(`agent-settings:${e.organizationId}:${t.agent}`,t=>i({...e,store:t})):i(e)}const Ku=e=>O({error:`Request "${e}" is already answered`},409),qu=(e,t,n)=>e.queue.patchTask(e.organizationId,t.task.id,{approvals:[n]},(e.now??Date.now)(),{unanswered:n.id});async function Ju(e,t,n,r){await e.store.delete(`delivery`,Tu(t.task.id,n.id)),(e.waitUntil??(()=>{}))(Tl(e,t.task,[n]).catch(e=>console.error(`coder server: could not show the decision on ${n.id}`,e)));let i=await e.store.get(`task`,t.task.id),a=Ou(n).operation,o=a.kind===`act-as`?n.response.decision===`accept`?`${a.user.name} approved acting as them on ${a.connection.name} for this task. Use it now.`:`${a.user.name} declined acting as them on ${a.connection.name} for this task.`:Vt(n);if(i&&!Z.includes(i.status)){let a=i.task.context?.mustReply===!0;if(await Ac(e,i,o,a,{},r?.id))return Vl(e,!0),n;i=await e.store.get(`task`,t.task.id)}return i&&Z.includes(i.status)&&await Yh(e,i,`steer`,{text:o}),n}async function Yu(e,t,n,r,i){if(e.taskPrincipal)return O({error:`A person answers this, not a task.`},403);let a=(t.task.context?.approvals??[]).find(e=>e.id===n),o=Ou(a);if(!a||!o)return O({error:`Task "${t.task.id}" has no request "${n}"`},409);if(a.response)return Ku(n);let s=typeof r.scope==`string`?r.scope:o.scope,c=r.decision,l=i?.name||void 0;if(o.operation.kind===`act-as`){let t=Uu(e,o,s,i);if(t||c===`ask`)return O({error:t??`Only the person it acts as answers this.`},403)}if(c===`ask`){if(!i)return O({error:`Asking an admin needs a member linked to Coder.`},403);let r={...o,scope:s,askedAdmin:l??i.id};return await qu(e,t,{...a,change:r})?(await e.store.put(`delivery`,Tu(t.task.id,a.id),{task:t.task.id,approval:a.id,reason:a.reason,by:r.askedAdmin,at:(e.now??Date.now)()},{ttlMs:2592e6}),O({asked:!0})):Ku(n)}let u=new Date((e.now??Date.now)()).toISOString();if(c===`deny`||c===`decline`){let s=typeof r.reason==`string`&&r.reason?r.reason:void 0,c={...a,change:o,response:{decision:`decline`,answeredAt:u,...s?{reason:s}:{},...l?{by:l}:{}}};return await qu(e,t,c)?O(await Ju(e,t,c,i)):Ku(n)}if(c!==`accept`)return O({error:`Give a decision: accept, decline or ask.`},400);let d=Uu(e,o,s,i);if(d)return O({error:d},403);let f={...a,change:{...o,scope:s},response:{decision:`accept`,answeredAt:u,...l?{by:l}:{}}};if(!await qu(e,t,f))return Ku(n);let p;try{p=await Gu(e,o.operation,s,i)}catch(n){await e.queue.patchTask(e.organizationId,t.task.id,{approvals:[{...a,change:o,response:null}]},(e.now??Date.now)());let r=n instanceof m?n.status??400:400;return O({error:n.message},r)}if(p){let n={...a,change:o,response:{decision:`decline`,answeredAt:u,reason:p}};return await e.queue.patchTask(e.organizationId,t.task.id,{approvals:[n]},(e.now??Date.now)()),await Ju(e,t,n,i),O({error:p},409)}return O(await Ju(e,t,f,i))}async function Xu(e,t,n){let r=t.routeTask??await t.store.get(`task`,n.id);if(!r)return O({error:`No task "${n.id}"`},404);let i=await e.json().catch(()=>void 0)??{};return Yu(t,r,n.approval,i,await wu(t))}async function Zu(e){return(await e.store.list(`delivery`,{prefix:`admin-ask:`})).map(e=>e.value).sort((e,t)=>t.at-e.at)}async function Qu(e){return O(await Zu(e))}function $u(e,t,n){return(typeof e.use==`function`?e.use(n,!0):e.use)?.replaceAll(`{handle}`,t)}const ed=(e,t)=>t?.listens.find(t=>t.integration===e.id)?.events??[];function td(e,t,n,r,i){let a=r?.slug??n,o=ed(e,r),s=$u(e,n,o),c=o.map(t=>e.events[t]?.description??t),l=i?.linked?.login,u=i&&{title:`${e.name} account`,...i.linked?{text:l?`Connected as @${l}.`:`Connected.`}:{text:`Not connected.`,link:{id:`connect`,label:`Connect ${e.name}`,url:`${t.dash}/settings/connections?connect=${encodeURIComponent(e.id)}`}}};return{title:r?.name??n,...r?.description?{text:r.description}:{},sections:[...s?[{title:`Use it here`,text:s}]:[],...c.length?[{title:`Listens to`,text:c.join(`
+`)}]:[],...u?[u]:[]],links:[{id:`agent`,label:`Open in Coder`,url:`${t.dash}/agents/${encodeURIComponent(a)}/platforms`,primary:!0},{id:`coder`,label:`Make your own agent`,url:t.home.replace(/\/$/,``)}]}}function nd(e,t,n,{open:r,setup:i}){let a=n?.name??t,o=$u(e,t,n?ed(e,n):[`mention`]);return{title:`${a} is in your workspace`,...n?.description?{text:n.description}:{},sections:[...o?[{title:`Use it`,text:o}]:[],...i?[{title:`One step left`,text:`Add a model so ${a} can start working.`}]:[]],links:[...i?[{id:`model`,label:`Add a model`,url:i,primary:!0}]:[],{id:`agent`,label:`Open in Coder`,url:r,...i?{}:{primary:!0}}]}}var rd=t({adapterContext:()=>Td,addressedTo:()=>fd,agentSummary:()=>Dd,chatFor:()=>Od,dashUrl:()=>wd,deliver:()=>hd,endTyping:()=>yd,eventReplies:()=>vd,eventThread:()=>_d,later:()=>md});async function id(e,t,n){let r=`${t.id}:${n}`,i=await V(e,r),a=i?.boundInstallation?.installation.id===r?i.boundInstallation.installation:await i?.store.get(`installation`,r);return{tenant:i,installation:a?.deletedAt?void 0:a}}async function ad(e,t,n,r,i){let{tenant:a,installation:o}=await id(e,t,r);if(!a||!o)throw Error(`${t.integration} installation ${r} is not bound to this server`);return Ff(a,e.integrations[t.integration],o,n,i)}function od(e){if(e._type===`chat:Thread`)return{...e,currentMessage:void 0};let{raw:t,replyTo:n,...r}=e;return{...r,raw:null,id:r.id.startsWith(`ephemeral:`)?``:r.id}}const sd=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),cd=(e,t)=>Object.keys(e.events).find(n=>e.events[n].on===t),ld=`(?![\\w-]|\\.\\w)`,ud=e=>e.replace(/[ \t]{2,}/g,` `).trim();function dd(e,t){let n=t.reduce((e,t)=>e.replace(RegExp(`(^|[^\\w-])@${sd(t)}${ld}`,`gi`),`$1`),e);return n===e?void 0:ud(n)}function fd(e,t){let n=dd(e,[t]);if(n!==void 0)return n;let r=RegExp(`^\\s*${sd(t)}${ld}[\\s,:;!.?-]*`,`i`);return r.test(e)?ud(e.replace(r,``)):void 0}async function pd(e,t,n,r,i,a){if(n.builtin)return fd(a,n.agent)!==void 0;let o=await V(e,`${n.id}:${r.id}`);if(t.events[i]?.on!==`message`||!o)return!1;o.local&&await(o.syncAgent?.(n.agent)??cr(o.store,o.local.cwd,o.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e));let{record:s,version:c}=await N(o.store,n.agent);return!s||!c||!s.settings?.disabled&&St(c.definition.integrations[t.id],i)!==void 0}function md(e,t,n,r,i){let a=r.catch(r=>(console.error(`coder server: dispatch failed for ${t.id} event ${n.deliveryId}`,r),$c(e,t,r,n.installationId,n,()=>i??vd(e,t,n))));e.waitUntil&&e.waitUntil(a)}async function hd(e,t,n,r,i,a){if(n.builtin&&!t.app.shareable){W(i,`the built-in app does not serve ${t.name}`,`error`);return}let o=`${n.id}:${i.installationId}`,s=await V(e,o);if(!s||!n.builtin&&s.organizationId!==e.organizationId){W(i,`installation ${o} is not bound to the app's workspace`,`error`);return}let c=s.boundInstallation?.installation.id===o?s.boundInstallation.installation:await s.store.get(`installation`,o);if(c?.covers&&!c.covers.includes(i.account??``)){W(i,`installation ${o} is not granted ${i.account??`its account`}`);return}let l;try{l=await Xc(s,t,n,r,i,e.now??Date.now,a),await l.work}catch(e){throw await a.endTyping?.().catch(()=>{}),e}if(l.taskId)return await Bl(s,!0,!1,!0),l.taskId}function gd(e,t,n,r,i,a=async()=>e.adapter.endTyping?.(e.id)){let o=typeof n==`string`?n:n?.id,s=typeof t==`string`?t:t?.userId,c,l=!1,u=async()=>{l||(l=!0,await c?.catch(()=>{}),await a())},d=async t=>(await u().catch(t=>console.error(`coder server: could not clear the working indicator in ${e.id}`,t)),t);return{post:async(t,a)=>{let o=await xn(e,t,a,s,t=>Cn(e,t,r,n)).catch(async e=>{throw await i?.(e),e});return d({id:o.at(-1)?.id,ids:o.map(e=>e.id)})},react:(t,n)=>bn(e,t,n??o),whisper:n=>t?e.postEphemeral(t,n,{fallbackToDM:!1}):Promise.resolve(null),startTyping:()=>{let t=o?{messageId:o}:{};return c=e.adapter.startTyping(e.id,void 0,t),c},endTyping:async()=>{c&&await u()}}}async function _d(e,t,n){if(!n.chat)throw Error(`The event has no conversation`);let r=await Od(e,t,{id:n.installationId,...n.repo?{repo:n.repo}:{}});return await r.initialize(),r.thread(n.chat.thread.id)}async function vd(e,t,n,r){if(!n.chat)return{post:async()=>{},whisper:async()=>{}};let i=await _d(e,t,n);return gd(i,n.chat.message?.author.userId||n.actor.id||void 0,n.chat.message?.id||void 0,e.integrations[t.integration]?.replyLimit,r=>bd(e,t,n.installationId,r),r&&(()=>yd(e,r,i)))}async function yd(e,t,n){let{task:r}=t,i=r.event;if(t.typingEnded||!i?.chat||r.source!==i.integration||!(r.context?.mustReply??i.mustReply))return;let a={generation:t.generation??0},o=(e.now??Date.now)();if(!await e.queue.patchTask(e.organizationId,r.id,{typingEnded:!0},o,a))return;let s=n?void 0:await e.store.get(`app`,i.appId),c=n??(s&&await _d(e,s,i));await c?.adapter.endTyping?.(c.id)}async function bd(e,t,n,r){if(!e.integrations[t.integration]?.isUninstalled?.(r))return;let i=`${t.id}:${n}`,a=await V(e,i);a&&await Pf(a.store,i,(e.now??Date.now)())}function xd(e,t,n,r,i,a,o=!1){let s=r===`message`?o?a.text:t.builtin?fd(a.text,t.agent):void 0:void 0;if(r===`message`&&t.builtin&&s===void 0)return;let c=cd(e,s===void 0?r:`mention`);if(!c||a.author.isBot===!0)return;let l=e.event?e.event(c,i,a,t):{};if(!l)return;let u=(l.type??c)===cd(e,`mention`)?s??dd(a.text,[t.name,...n.self?[n.self]:[]])??a.text:a.text;return{integration:e.id,type:c,appId:t.id,installationId:n.id,deliveryId:Pr(`sha256`).update(`${t.id}\n${n.id}\n${i.id}\n${a.id}`).digest(`base64url`).slice(0,22),actor:{id:a.author.userId,...a.author.userName?{login:a.author.userName}:{}},text:u,chat:{thread:od(i.toJSON()),message:od(a.toJSON())},...n.space?{space:n.space}:{},...n.index===void 0?{}:{conversation:{index:n.index}},...n.account?{account:n.account}:{},...n.repo?{repo:n.repo}:{},...l}}async function Sd(e,t,n,r,i){let a=await Cd(e,t,n).catch(e=>{console.error(`coder server: conversation workspace lookup failed`,e)});a&&await _c(a,{integration:t.integration,appId:t.id,installationId:n.id,chat:{thread:od(r.toJSON())}},{id:i.id,thread:r.id,author:i.author.userName||i.author.userId,text:i.text,sentAt:i.metadata.dateSent.toISOString()}).catch(e=>console.error(`coder server: could not keep a message for ${t.id}`,e))}async function Cd(e,t,n){let{tenant:r,installation:i}=await id(e,t,n.id),a=(t.builtin||r?.organizationId===e.organizationId)&&(!i?.covers||i.covers.includes(n.account??``));return i&&a?r:void 0}async function wd(e){let t=e.config.publicUrl?.replace(/\/$/,``);return t&&`${t}${Lv(await Iv(e))}`}function Td(e,t,n,r,i,a){return{fetch:e.fetch??fetch,appId:n.id.slice(t.id.length+1),name:n.name,credentials:r,...i?{installationId:i.id,...i.self?{self:i.self}:{}}:{},token:(t,a)=>ad(e,n,r,t,{...i?.repo?{repo:{owner:i.repo.owner,name:i.repo.name}}:{},...a}),installedSelf:async t=>(await id(e,n,t)).installation?.self,saveSelf:async(t,r)=>{let{tenant:i,installation:a}=await id(e,n,t);!i||!a||a.self||await So(i.store,`installation`,a.id,{self:r}).catch(e=>console.error(`coder server: could not save ${a.id}'s app user`,e))},...i?{hears:(r,a)=>pd(e,t,n,i,r,a).catch(e=>(console.error(`coder server: could not read ${n.id}'s agent for a message`,e),!0)),active:async r=>{let a=await V(e,`${n.id}:${i.id}`),o=Lc(n.id,i.id,ic(t,r));return!!await a?.store.get(`delivery`,o)},knows:async(t,r)=>{let a=await V(e,`${n.id}:${i.id}`),o=lc(n.id,i.id,t,r);return!!await a?.store.get(`delivery`,o)},home:async r=>{let o=e.config.publicUrl;if(!o||!a)return;let[s,c]=await Promise.all([Dd(e,n,i),r?Ed(e,t,n,i,r):void 0]);return td(t,{home:o,dash:a},n.name,s,c)}}:{},privateState:()=>new vr}}async function Ed(e,t,n,r,i){let a=await Cd(e,n,r);if(!a?.auth)return;let o=await Wc(a,t,{actor:{id:i}});return o?{linked:{id:i,...o.login?{login:o.login}:{}}}:{}}async function Dd(e,t,n){let r=await Cd(e,t,n),{record:i,version:a}=r?await N(r.store,t.agent):{};if(!i||!a)return;let{definition:o}=a,s=i.description??o.description;return{slug:i.id,name:i.name,...s?{description:s}:{},listens:Object.entries(o.integrations).flatMap(([t,n])=>{let r=Ct(n),i=e.integrations[t];return i&&r.length?[{integration:t,name:i.name,events:r}]:[]})}}async function Od(e,t,n){let r=e.integrations[t.integration];if(!r)throw Error(`Unknown integration "${t.integration}"`);let i=new Map;e={...e,fetch:r.requestFetch?.(e.fetch??fetch,n?.account??n?.id)??e.fetch,syncAgent:t=>(i.has(t)||i.set(t,cr(e.store,e.local.cwd,e.integrations,t)),i.get(t))};let a=z(e.config,t.credentials),o=await r.adapter(Td(e,r,t,a,n)),s=_r(e.chatState??new vr,t.id),{Chat:c}=await import(`./dist-B5qUdWUG.js`),l=new c({userName:t.name,adapters:{[r.id]:o},state:{...s,isSubscribed:async()=>!1},concurrency:`concurrent`,dedupeTtlMs:Vc,logger:`error`});if(!n)return l;let u=async(i,o,s)=>{let c=i===`message`&&await Ol(e,t,n,o.id,s.text),l=xd(r,t,n,i,o,s,c);if(!l){s.author.isBot!==!0&&await Sd(e,t,n,o,s);return}let u=gd(o,s.author,s,r.replyLimit,r=>bd(e,t,n.id,r));md(e,t,l,hd(e,r,t,a,l,u),u)};return l.onNewMention((e,t)=>u(`mention`,e,t)),l.onNewMessage(/[\s\S]*/,(e,t)=>u(`message`,e,t)),l.onMessageUpdated((r,i)=>{if((e.now??Date.now)()-i.metadata.dateSent.getTime()>864e5)return;let a=[t.name,...n.self?[n.self]:[]],o=i.isMention||r.isDM||dd(i.text,a)!==void 0;return u(o?`mention`:`message`,r,i)}),l.onReaction(async i=>{if(!i.added||i.user.isBot===!0)return;let a=i.thread,o=await Cd(e,t,n);if(!o)return;let s={integration:r.id,type:`reactions`,appId:t.id,installationId:n.id,deliveryId:`reaction-${i.messageId}-${i.user.userId}-${i.rawEmoji}`,actor:{id:i.user.userId,login:i.user.userName},text:``,chat:{thread:od(a.toJSON())},...n.account?{account:n.account}:{}},c=Ic(o,s,{emoji:`:${i.emoji.name}:`,by:i.user.userName||i.user.userId,on:i.message?.text??i.messageId},e.now??Date.now);md(e,t,s,c)}),l}function kd(e,t,n,r){return e.withAppLock(`installation:${t}`,async e=>{let i=n(await e.get(`installation`,t));if(!i)return;let a=await e.list(`installation`),o=a.filter(e=>e.id!==t&&e.value.app===i.app&&!e.value.deletedAt&&i.covers?.includes(e.id.slice(i.app.length+1))),s=new Set(o.map(e=>e.id));ir(a.map(e=>[e.id,s.has(e.id)?{...e.value,deletedAt:r}:e.value]),t,i);for(let t of o)await e.put(`installation`,t.id,{...t.value,deletedAt:r});return await e.put(`installation`,t,i),i})}async function Ad(e,t,n,r){let i=n.id,a=t.operatorApp??!1?`*`:t.session?.user.id??`anonymous`,o=Nn(r.searchParams.get(`state`)),s=Gv(o?.back),c=t.integrations[i];if(!c)return $(t,`unknown-integration`,{platform:i},s);let l=t.config.publicUrl;if(!l)return $(t,`no-public-url`,{},s);let u=r.searchParams.get(`app`),d=o?.tx?await ai(t,o.tx,`install`,a):void 0;if(!d||u&&u!==d)return $(t,`install-expired`,{platform:i,appId:u??void 0},s);let f=await t.store.get(`app`,u??d);if(!f)return $(t,`unknown-app`,{platform:i},s);let p=z(t.config,f.credentials);return M(c.app.installUrl(f,p,{publicUrl:l,state:r.searchParams.get(`state`)??ht({})}))}async function jd(e,t,n,r){let i=n.id,a=t.apps?await t.apps(i):(await t.store.list(`app`,{prefix:`${i}:`})).map(e=>({organizationId:t.organizationId,app:e.value})),o=await n.app.installedApp(e,{apps:a.map(({app:e})=>({app:e,credentials:z(t.config,e.credentials)})),fetch:r}).catch(e=>(console.error(`coder server: finding the ${i} app of an install failed`,e),e instanceof Error?e:Error(String(e))));if(o instanceof Error)return $(t,`failed`,{platform:i});if(!o)return $(t,`unknown-app`,{platform:i});let{app:s,installation:c}=o,l=a.find(e=>e.app.id===s.id).organizationId,u=s.builtin||!t.session?t:Rv(t,t.session,l);if(!u)return $(t,`other-workspace`,{platform:i});let d=await Zr(u,`install`,t.session?.user.id??`anonymous`,s.id);return M(n.app.installUrl(s,z(t.config,s.credentials),{publicUrl:t.config.publicUrl,state:ht({tx:d,installation:c}),installation:c}))}async function Md(e,t,n,r){let i=n.id,a=t.operatorApp??!1,o=a?`*`:t.session?.user.id??`anonymous`,s=Nn(r.searchParams.get(`state`)),c=s?.tx&&t.session?Rv(t,t.session,ei(t,s.tx)):void 0,l=c?{...t,...c}:t,u=Gv(s?.back),d=l.integrations[i];if(!d)return $(l,`unknown-integration`,{platform:i},u);if(!l.config.publicUrl)return $(l,`no-public-url`,{},u);let f=l.fetch??fetch,p=r.searchParams.get(`app`),m=s?.tx?await ai(l,s.tx,`install`,o):void 0,h={platform:i,appId:p??m},g=r.searchParams.get(`error`);if(g)return g===`access_denied`?$(l,`cancelled`,h,u):$(l,`platform-error`,{...h,error:g},u);if(!r.searchParams.has(`state`)&&d.app.installedApp&&!a)return jd(e,l,d,f);if(!m||p&&p!==m||!await ri(l,s.tx,`install`,o,m))return $(l,`install-expired`,h,u);let _=await l.store.get(`app`,p??m);return _?Nd(e,l,d,_,u,s?.installation):$(l,`connected`,{platform:i},u)}async function Nd(e,t,n,r,i,a){let o=n.id,s=t.fetch??fetch,c=t.now?.()??Date.now(),l=t.config.publicUrl;if(r.builtin&&!n.app.shareable)return $(t,`unknown-app`,{platform:o},i);let u=i??(r.builtin?void 0:Uv(t,r.agent)),d=z(t.config,r.credentials),f=await n.app.installCallback(e,{app:r,credentials:d,publicUrl:l,fetch:s,tokens:Xv(t,n.id),...a?{installation:a}:{}}).catch(e=>e instanceof ve?$(t,e.code,{platform:o,appId:r.id,error:e.error},u):(console.error(`coder server: installing ${r.id} failed`,e),$(t,`failed`,{platform:o,appId:r.id},u)));if(f instanceof Response)return f;let p=`${r.id}:${f.platformInstallId}`,m=t.session;f.user&&m&&t.auth&&await t.auth.link(m.user,o,f.user.id,{...ta(m.organizations),...f.user.token?{token:R(t.config,f.user.token),organizationId:t.organizationId}:{},...f.user.login?{login:f.user.login}:{}});let h=await t.store.get(`installation`,p),g={...h,id:p,app:r.id,integration:o,account:f.account??h?.account??{login:`unknown`},...f.token?{token:R(t.config,f.token)}:{},...f.installer?{installer:f.installer}:{},...f.self?{self:f.self}:{},...f.covers?{covers:f.covers}:{},createdAt:h?.createdAt??c};if(delete g.deletedAt,delete g.uninstalled,n.repos){let e=await n.auth.token(f.token?{...g,token:f.token}:g,d,void 0,{fetch:s});g.repos=await n.repos.list(g,e,s)}try{g=await kd(t.store,p,e=>f.covers===null?{...g,covers:e?.covers??[]}:g,c)}catch(e){return e instanceof $n?$(t,`installation-bound`,{platform:o,account:g.account.login},u):$(t,`installation-taken`,{platform:o},u)}return g.installer&&n.messages?.direct&&await Pd(t,n,r,d,f.platformInstallId,g.installer),$(t,`connected`,{platform:o,account:g.account.login},u)}async function Pd(e,t,n,r,i,a){try{let[{adapterContext:o,agentSummary:s},{record:c,version:l}]=await Promise.all([Promise.resolve().then(()=>rd),N(e.store,n.agent)]),{models:u,first:d}=await Xp(e,vt({definition:l?.definition,usage:c?.settings}),e.session?.user.id),f=$p(u).length>0,p={id:i},m=o(e,t,n,r,p),h=`${e.config.publicUrl.replace(/\/$/,``)}${Uv(e,n.agent)}`,g=nd(t,n.name,await s(e,n,p),{open:h,...f?{}:{setup:await gm(e,d.engine)}});await t.messages.direct(m,a,g)}catch(e){console.error(`coder server: could not greet the installer of ${n.id}`,e)}}const Fd=/^[a-z0-9][a-z0-9_-]*$/i;async function Id(e,t){let n=Xt(Zt(),`builtin`).map(({name:e})=>({name:e,scope:`builtin`}));if(!t)return O(n);try{let{integration:r,token:i}=await Fs(e,t),a=(r.repos?await r.repos.listDir(t,`.coder/flows`,i):[]).map(e=>e.replace(/\.(ts|mjs|js)$/,``)).filter(e=>Fd.test(e));return O([...a.map(e=>({name:e,scope:`workspace`})),...n.filter(e=>!a.includes(e.name))])}catch(e){return G(e)}}async function Ld(e,t){if(!t)throw new U(`repo is required`);let{integration:n,token:r}=await Fs(e,t);return O(await n.repos?.pullRequests(t,r)??[])}async function Rd(e,t){try{return O(Xd(await Rs(e,`dashboard`,t)),201)}catch(e){return G(e)}}async function zd(e,t,n,r){return Id(t,r.searchParams.get(`repo`)).catch(G)}async function Bd(e,t,n,r){return Ld(t,r.searchParams.get(`repo`)).catch(G)}async function Vd(e,t,n,r){return Tf(e).then(e=>Rd(t,{...e,flow:n.name})).catch(G)}async function Hd(e,t,n,r){return Tf(e).then(({post:e,...n})=>{if(!n.repo||!n.pr)throw new U(`repo and pr are required`);return Rd(t,{...n,flow:`review`,args:{post:e===!0}})}).catch(G)}function Ud(e,t,n){return(e.waitUntil??(e=>void e.catch(()=>{})))(t),Promise.resolve(O({tasks:n},202))}async function Wd(e,t,n,r,i,a,o){if(`ack`in i)return new Response(null,{status:200});if(`uninstalled`in i){let t=await V(e,i.uninstalled);return t&&await Pf(t.store,i.uninstalled,a),O({ok:!0})}if(`click`in i)return o?(e.waitUntil??(()=>{}))(jl(e,t,n,o,i.click).catch(e=>console.error(`coder server: a click failed for ${n.id}`,e))):console.error(`coder server: ${n.id} sent a click for no installation; dropped`),new Response(null,{status:200});if(`unhandled`in i)return console.warn(`coder server: ${n.id} sent ${i.unhandled}, which Coder does not handle yet`),new Response(null,{status:200});if(`work`in i){if(o){let a=wd(e).then(a=>i.work(Td(e,t,n,r,o,a))).catch(t=>(console.error(`coder server: webhook work failed for ${n.id}`,t),$c(e,n,t,o.id)));(e.waitUntil??(()=>{}))(a)}else console.error(`coder server: ${n.id} sent work for no installation; dropped`);return O({ok:!0})}if(`installation`in i){let t=await V(e,i.installation.installation.id),n=await t?.store.get(`installation`,i.installation.installation.id);return!t||!n?O({ok:!0}):(await t.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!t||i.installation.repos&&t.deletedAt)return;let r=i.installation.repos,o=r?r.refresh||t.repos==null?void 0:[...new Set([...t.repos,...r.add])].filter(e=>!r.remove.includes(e)):i.installation.installation.repos;await So(e,`installation`,n.id,{account:i.installation.op===`delete`?t.account:i.installation.installation.account,...r||o?{repos:o}:{},deletedAt:i.installation.op===`delete`?a:void 0,uninstalled:i.installation.installation.uninstalled})}),await Nf(t.store,n.id),O({ok:!0}))}if(`space`in i){let a=await V(e,`${n.id}:${i.space.installation}`);return a&&await ms(a,t,n.id,r,i.space),O({ok:!0})}if(`members`in i){let a=await V(e,`${n.id}:${i.members.installation}`);return a&&(e.waitUntil??(()=>{}))(hs(a,t,n.id,r,i.members)),O({ok:!0})}if(`covers`in i){let{installation:t,add:n=[],remove:r=[]}=i.covers,o=await V(e,t),s=!1;try{o&&await kd(o.store,t,e=>{if(s=!!e,!e||e.deletedAt)return;let t=[...new Set([...e.covers??[],...n])];return{...e,covers:t.filter(e=>!r.includes(e))}},a)}catch(e){if(!(e instanceof $n))throw e;console.error(`coder server: ${t} covers an account bound elsewhere; grant ignored`)}return s?O({ok:!0}):new Response(`Installation not stored yet`,{status:503})}if(`push`in i){let{push:r}=i;if(to(r)){let t=await V(e,r.installation);t&&await ro(t.store,r)}let a=no(r,n);if(!a)return to(r)?O({ok:!0}):O({accepted:0},202);try{n.branch||await So(e.store,`app`,n.id,{branch:a.branch});let r=await go(e,a.repo,a.ref,{...ho(),integration:t.id,appId:n.id},a.branch);return r?O({imported:r.map(e=>e.agent)}):O({error:`No installed app can read ${a.repo}`},400)}catch(e){return O({error:e instanceof Error?e.message:String(e)},400)}}for(let a of i.events)md(e,n,a,vd(e,n,a).then(i=>hd(e,t,n,r,a,i)));return O({accepted:i.events.length},202)}async function Gd(e,t,n){let r=t.integrations[n],i=await e.text(),a=r.target(e,i);if(a instanceof Response)return a;if(!a)return new Response(`Not addressed to an app`,{status:400});let o=`${r.id}:${a.app}`,s=t.webhookTarget?await t.webhookTarget(o,a.installation?`${o}:${a.installation}`:void 0):void 0,c=t.webhookTarget?s&&{ctx:{...B(t,s.organizationId),...s.bound?{boundInstallation:s.bound}:{}},app:s.app}:await na(t,o);if(!c)return new Response(`Unknown app`,{status:404});let{ctx:l,app:u}=c,d=z(l.config,u.credentials),f=a.installation?{...a,id:a.installation}:void 0,p=r.ownEvents?.(e,i,u,d);if(p&&`invalid`in p)return new Response(`Invalid signature`,{status:401});if(p)return Wd(l,r,u,d,p,(l.now??Date.now)(),f);let m=(await Od(l,u,f)).webhooks[r.id];return m(new Request(e.url,{method:`POST`,headers:e.headers,body:i}),{deduplicate:!1,propagateHandlerErrors:!0,waitUntil:e=>{let t=e.catch(e=>(console.error(`coder server: webhook work failed for ${u.id}`,e),$c(l,u,e,a.installation)));l.waitUntil&&l.waitUntil(t)}})}var Kd=t({DONE:()=>qd,adminCreate:()=>pf,approveTask:()=>sf,archiveTask:()=>lf,askTask:()=>of,cancelTask:()=>cf,composerOptions:()=>gf,decideApproval:()=>rf,eventTarget:()=>uf,listTasks:()=>hf,localRows:()=>mf,readTask:()=>Qd,redactTask:()=>Xd,removeTask:()=>$d,steerTask:()=>tf,taskError:()=>G,taskLogs:()=>ef});const qd=new Set([`completed`,`failed`,`cancelled`]);function G(e){if(e instanceof K)return O({error:e.message},400);if(e instanceof U)return O({error:e.message,...e.fix?{fix:e.fix}:{}},e.status);throw e}function Jd(e){let t=e.task.usage?.resolvedModel??Hf(e.task)??e.task.usage?.model??e.task.definition?.model;return t?{model:t}:{}}function Yd(e){let{id:t,name:n,source:r,agent:i,flow:a,event:o,cwd:s,access:c,context:l,requestedBy:u}=e.task,{engine:d,model:f,effort:p}=vt(e.task),m=e.task.context?.turns?.[0]?.prompt??e.task.prompt;return{task:{id:t,...n?{name:n}:{},source:r,agent:i,flow:a,...s?{cwd:s}:{},...c?{access:c}:{},...m?{prompt:m}:{},...o?{event:{integration:o.integration,type:o.type,text:o.text,actor:o.actor}}:{},...l?.user?{context:{user:l.user}}:{},...u?{requestedBy:u}:{},...d?{usage:{engine:d,...f?{model:f}:{},...p?{effort:p}:{}}}:{}},...Jd(e),status:e.status,...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},attempts:e.attempts,...e.approval===void 0?{}:{approval:e.approval},...e.approvals??e.task.context?.approvals?{approvals:e.approvals??e.task.context?.approvals}:{},...e.archivedAt===void 0?{}:{archivedAt:e.archivedAt},createdAt:e.createdAt,startedAt:e.startedAt,finishedAt:e.finishedAt,updatedAt:e.updatedAt,...Nh(e)}}function Xd(e){let{tokenHash:t,handle:n,...r}=e;return{...r,...Nh(e),...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},...e.task.context?.approvals?{approvals:e.task.context.approvals}:{},turns:qt(zs(e),e.approvals??e.task.context?.approvals),...e.task.models?.[0]?.credential?{credential:Up(e.task.models[0].credential).name}:{}}}async function Zd(e,t){let n=e.routeTask?.task.id===t?e.routeTask:await e.store.get(`task`,t);if(n&&!(e.local&&n.handle?.startsWith(`cli:`)&&n.task.flow==="default"))return{status:n};if(!n&&e.taskPrincipal)return O({error:`No task "${t}"`},404);let r=n?.task.cwd??e.local?.cwd;return r?{cwd:r,answer:n?.answer}:O({error:`No task "${t}"`},404)}async function Qd(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?k(r,500,2e3):void 0,c=xs(t.store,i,o,s??500);c?.catch(()=>{});let l=await Zd(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;if(!u){let e=yp(d,i,!0);return e?O({...e,...l.answer?{answer:l.answer}:{},logs:vp(d,i,-1,s??500)}):O({error:`No task "${i}"`},404)}let f=await Il(t,u);return O({...Xd(f),...Jd(f),logs:await c})}async function $d(e,t,n,r){let i=n.id,a=await Zd({...t,routeTask:void 0},i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o){let n=await xp(e,s,i,void 0,t);return n.ok&&t.queue instanceof Qh&&t.queue.tombstone(i),n}if(t.local&&o.handle?.startsWith(`cli:`)){let e=(t.now??Date.now)();await t.queue.cancel(t.organizationId,i,e,{attempts:o.attempts,tokenHash:o.tokenHash,generation:o.generation??0});let n=await t.store.get(`task`,i);if(n&&Z.includes(n.status)){await up(t,n,e);let r=await t.store.get(`task`,i);if(r&&Z.includes(r.status))return O({error:`Task is still stopping. Try again.`},409)}}else if([`running`,`waiting`].includes(o.status)&&o.handle)try{let e=await za(t,o.task);if(!e)return O({error:`Task runner is unavailable. Try again.`},409);await e.stop(o.handle)}catch{return O({error:`Task is still stopping. Try again.`},409)}return await Kh(t,o)?(o.handle?.startsWith(`cli:`)||await Eg(t,o.task,o.handle).catch(e=>console.error(`coder server: work folder of ${i} not removed`,e)),t.local&&(await t.store.delete(`snapshot`,`local-start:${i}`),await t.store.delete(`snapshot`,`completion:${i}`)),Vl(t,!0),O({ok:!0})):O({error:`Task changed while deleting. Try again.`},409)}async function ef(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?k(r,500,2e3):void 0,c=xs(t.store,i,o,s??void 0);c?.catch(()=>{});let l=await Zd(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;return u?(await Il(t,u),O(await c)):yp(d,i,!1)?O(vp(d,i,o,s)):O({error:`No task "${i}"`},404)}async function tf(e,t,n,r){let i=n.id,a=await Zd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return xp(e,s,i,`steer`,t);if(o.task.flow!=="default")return O({error:`steer is available only for default-flow tasks`},409);let c=await e.json().catch(()=>void 0),l=Ns(c,[`engine`,`effort`]);if(l)return O({error:l},400);if(qd.has(o.status)){let{text:e,outputSchema:n,model:r,access:i}=c??{},a={...o.task.context,asker:t.session?.user.id};try{let s=await Us(t,{...o,task:{...o.task,context:a}},String(e??``),n,{model:r,access:i});return Vl(t,!0),O(Xd(s))}catch(e){return G(e)}}let u=await Yh(t,o,`steer`,{...c,asker:t.session?.user.id??null});return u?O(u):O({error:`Task "${i}" is no longer active`},409)}function nf(e){return async(t,n,r)=>{let i=r.id;if(e===`approve`)return rf(n,i,await t.json().catch(()=>void 0)??{},(await wu(n))?.name);let a=await Zd(n,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return xp(t,s,i,e,n);if(o.task.flow!=="default")return O({error:`${e} is available only for default-flow tasks`},409);if(!Z.includes(o.status))return O({error:`Task "${i}" is not active`},409);let c=await t.json().catch(()=>void 0),l=Ns(c,[`engine`,`effort`]);if(l)return O({error:l},400);let u=await Yh(n,o,e,c);return u?O(u):O({error:`Task "${i}" is no longer active`},409)}}async function rf(e,t,n,r){let i=await Zd(e,t);if(i instanceof Response)return i;let{status:a,cwd:o}=i;if(a&&a.task.flow!=="default")return O({error:`approve is available only for default-flow tasks`},409);let s=String(n.approvalId??n.id??(a?a.approval?.id:Bt(w(o,t))[0]?.id)??``),c=a?.task.context?.approvals?.find(e=>e.id===s);if(a&&Ou(c))return Yu(e,a,s,n,await wu(e));let l=n.decision===`deny`||n.decision===`decline`?`decline`:`accept`,u={...n,approvalId:s,decision:l,...r?{by:r}:{}},{response:d,task:f}=a?await af(e,a,u):{response:await Sp(o,t,u,e),task:(await e.store.get(`task`,t))?.task};if(!d.ok)return d;let p=a?f?.context?.approvals??[]:zt(w(o,t));return f&&(e.waitUntil??(()=>{}))(Tl(e,f,p).catch(e=>console.error(`coder server: could not show the decision on approval ${s}`,e))),d}async function af(e,t,n){let r=t.task.id,i=t.task.context?.approvals??[],a=t.approval,o=String(n.approvalId),s=i.find(e=>e.id===o)??(a?.id===o?a:void 0);if(!s)return{response:O({error:`Task "${r}" has no approval "${o}"`},409)};if(s.response?.decision===`accept`)return{response:O({error:`Approval "${o}" is already approved`},409)};if(s.response?.decision===`closed`)return{response:O({error:Rt(o)},409)};let c=n.decision,l={...s,response:{decision:c,...typeof n.reason==`string`&&n.reason?{reason:n.reason}:{},answeredAt:new Date((e.now??Date.now)()).toISOString(),...typeof n.by==`string`&&n.by?{by:n.by}:{}}};if(qd.has(t.status))try{let n=await Us(e,{...t,task:qh(t.task,[l])},Ht(l));return Vl(e,!0),{response:O(Xd(n)),task:n.task}}catch(e){return{response:G(e)}}if(!Z.includes(t.status))return{response:O({error:`Task "${r}" is not active`},409)};let u;try{u=await Yh(e,t,`approve`,n,void 0,[l])}catch(e){if(e instanceof Ut)return{response:O({error:e.message},409)};throw e}return u?{response:O(u),task:qh(t.task,[l])}:{response:O({error:`Task "${r}" is no longer active`},409)}}const of=nf(`ask`),sf=nf(`approve`);async function cf(e,t,n,r){let i=n.id,a=await Zd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return xp(e,s,i,`cancel`,t);let c=(t.now??Date.now)(),l=await t.queue.cancel(t.organizationId,i,c,{attempts:o.attempts,tokenHash:o.tokenHash??null,generation:o.generation??0}),u=(o.task.context?.approvals??[]).filter(e=>!e.response);if(l&&u.length){let e=Wt(new Date(c).toISOString()),n=u.map(t=>({...t,response:e}));await t.queue.patchTask(t.organizationId,i,{approvals:n},c);let r=qh(o.task,n);(t.waitUntil??(()=>{}))(Tl(t,r,r.context?.approvals??[]).catch(e=>console.error(`coder server: could not show the stop on ${i}`,e)))}if(l&&o.status!==`queued`){await eg(t,i);let e=await t.store.get(`task`,i);e&&!qd.has(e.status)&&Rl(t,o)}return l?O({ok:!0}):O({error:`No running or queued task "${i}"`},404)}async function lf(e,t,n,r){let i=n.id,a=await Zd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return xp(e,s,i,`archive`,t);let c=(t.now??Date.now)();return await t.queue.patchTask(t.organizationId,i,{archivedAt:c,autoArchived:void 0},c),O({ok:!0})}async function uf(e,t){if(!t.agent||!t.event?.integration)return O({error:`agent and event are required`},400);let n=e.integrations[t.event.integration];if(!n)return O({error:`Unknown integration "${t.event.integration}"`},400);let r=(await e.store.list(`app`)).map(e=>e.value).find(e=>e.agent===t.agent&&e.integration===n.id);if(!r)return O({error:`No ${n.id} app for agent "${t.agent}" on this server.`},404);let i=(await e.store.list(`installation`)).map(e=>e.value).filter(e=>e.app===r.id&&!e.deletedAt),a=i.find(e=>e.id===`${r.id}:${t.event.installationId}`)??i[0];return a?{integration:n,app:r,event:{...t.event,appId:r.id,installationId:a.id.slice(r.id.length+1),deliveryId:`admin-${(e.now??Date.now)()}-${L()}`}}:O({error:`The ${n.id} app for "${t.agent}" is not installed anywhere yet`},404)}async function df(e,t){let n=await uf(t,e);if(n instanceof Response)return n;let{integration:r,app:i,event:a}=n,o=t.now??Date.now,s=await Xc(t,r,i,z(t.config,i.credentials),a,o,await vd(t,i,a));return Ud(t,s.work??Promise.resolve(),s.taskId?[s.taskId]:[])}const ff=new Set([`queued`,`running`,`waiting`,`completed`,`failed`,`cancelled`]);async function pf(e,t,n,r){let i=await e.json().catch(()=>void 0);if(!i||typeof i!=`object`)return O({error:`A JSON body is required`},400);try{if(As(t,i),i.event)return df(i,t);let e=(i.source!==`cli`&&!t.taskPrincipal?await sp(t,i):void 0)??await Rs(t,i.source===`cli`?`cli`:`dashboard`,i);return O(Xd(e),201)}catch(e){return G(e)}}function mf(e,t,n){let r=new Map(t.map(e=>[e.task.id,e]));for(let t of n)ue(e,t,r.has(t.task.id))&&r.set(t.task.id,t);return[...r.values()]}async function hf(e,t,n,r){let i=r.searchParams.get(`status`);if(i&&i!==`active`&&!ff.has(i))return O({error:`Unknown status "${i}"`},400);let a=r.searchParams.get(`source`);if(a&&![`dashboard`,`cli`,`schedule`,...Object.keys(t.integrations)].includes(a))return O({error:`Unknown source "${a}"`},400);let o=r.searchParams.has(`since`)?Number(r.searchParams.get(`since`)):void 0;if(o!==void 0&&(!Number.isFinite(o)||o<0))return O({error:`Invalid since`},400);let s=r.searchParams.get(`agent`),c=r.searchParams.get(`q`)?.trim(),l={...s?{agent:s}:{},...a?{source:a}:{},...c?{q:c}:{},viewer:await ds(t),...t.taskPrincipal?{parent:t.taskPrincipal.task}:{},archived:o===void 0?r.searchParams.get(`archived`)===`1`:void 0,...o===void 0?{}:{since:o,...r.searchParams.get(`sinceId`)?{sinceId:r.searchParams.get(`sinceId`)}:{}}},u=i===`active`?{statuses:Z}:i?{status:i}:{},d=r.searchParams.get(`summary`)===`1`||o!==void 0&&!r.searchParams.has(`summary`),f=e=>d?e.map(Yd):e.map(Xd);if(t.local){let e=o===void 0?rp(t.local.cwd,l.archived):[...rp(t.local.cwd,!0).map(e=>({...e,updatedAt:Math.max(e.updatedAt,e.archivedAt)})),...rp(t.local.cwd,!1)],n=await t.queue.list(t.organizationId,{...t.taskPrincipal?{parent:t.taskPrincipal.task}:{}}),i=new Set(n.map(e=>e.task.id)),a=mf(t.local.cwd,t.taskPrincipal?e.filter(e=>i.has(e.task.id)):e,n),s=a.filter(e=>Ih(e,{...l,...u})).sort(o===void 0?Bh:zh),c=k(r,A(r)?void 0:20);if(!A(r))return O(f(s.slice(0,c)));let p=Mn(r),m=s.filter(e=>Vh(e,p)),h=Pn(m.slice(0,c+1),c,o===void 0?Lh:Rh),g=r.searchParams.get(`approvals`)===`1`&&!p&&d?a.filter(e=>Ih(e,{viewer:l.viewer,archived:!1,status:`waiting`})).sort(Bh).slice(0,50):[];return O({...h,items:f(h.items),...r.searchParams.get(`counts`)===`1`?{counts:{all:s.length,active:s.filter(e=>Z.includes(e.status)).length,waiting:s.filter(e=>Qt(e.status,e.approvals??e.task.context?.approvals)).length}}:{},...g.length?{pendingApprovals:f(g)}:{}})}if(!A(r)){let e=k(r,20),n=await t.queue.list(t.organizationId,{...l,...u,limit:e,summary:d});return O(f(n))}let p=k(r),m=Mn(r),h=r.searchParams.get(`counts`)===`1`&&!i&&!m&&t.queue.listWithCounts?await t.queue.listWithCounts(t.organizationId,{...l,limit:p+1,summary:d}):void 0,g=r.searchParams.get(`approvals`)===`1`&&!m&&d,[_,v,y]=await Promise.all([h?h.items:t.queue.list(t.organizationId,{...l,...u,summary:d,...m?{before:m}:{},limit:p+1}),h?h.counts:r.searchParams.get(`counts`)===`1`?t.queue.counts(t.organizationId,{...l,...u}):void 0,g?t.queue.list(t.organizationId,{viewer:l.viewer,...l.parent?{parent:l.parent}:{},archived:!1,status:`waiting`,summary:!0,limit:50}):void 0]),b=Pn(_,p,o===void 0?Lh:Rh);return O({...b,items:f(b.items),...v?{counts:v}:{},...y?.length?{pendingApprovals:f(y)}:{}})}async function gf(e,t){let{now:n,local:r}=await Wl(t),[i,a,o]=await Promise.all([Gl(t,r,{limit:200}),q(t),t.store.list(`runner`)]),s=D(),c=i.filter(e=>!e.settings?.disabled).sort((e,t)=>Number(t.id===s)-Number(e.id===s)).map(({id:e,name:t})=>({id:e,name:t,...e===s?{default:!0}:{}})),l=J(t,a),u=Object.values(t.integrations).find(e=>e.repos);return O({agents:c,chain:l.chain,models:lu(a),runners:mg(t,o,n).map(({id:e,name:t,default:n})=>({id:e,name:t,default:n})),flows:Xt(Zt(),`builtin`).map(e=>e.name),...t.local?{folders:Va(t.local.cwd)}:{},...u?{connectLabel:u.installLabel??`Connect ${u.id}`}:{}})}var K=class extends Error{};async function _f(e){let t=await e.get(`config`,`workspace`);if(t&&t.version!==1)throw new K(`The workspace config is config version ${t.version??0}; this Coder reads version 1.`);return t??{}}function vf(){let e=Te();if(!F.existsSync(e))return{};try{return Ce(JSON.parse(F.readFileSync(e,`utf8`))).config}catch(t){throw new K(`Invalid config in ${e}: ${t.message}`)}}function yf(e){let{mcp:t,...n}=e;return n}async function q(e){return e.local?yf(vf()):_f(e.store)}const J=(e,t)=>e.local?yf(Le(e.local.cwd)):Ae(t);async function bf(e,t){let n=e.settings??={},r=(n.configUpdate??Promise.resolve()).catch(()=>{}).then(()=>e.local?t(e):e.store.withConfigLock(n=>t({...e,store:n})));n.configUpdate=r;try{return await r}finally{n.configUpdate===r&&delete n.configUpdate}}function xf(e){let t=ke(e);if(t.length)throw new K(t.join(`; `))}async function Sf(e,t){let n=t&&typeof t==`object`&&!Array.isArray(t)?{...t,version:1}:t;if(xf(n),n.mcp)throw new K(`Add a connection in Settings to attach an MCP server`);if(e.local){let{mcp:t}=vf();return we({...n,...t?{mcp:t}:{}}),q(e)}return await e.store.put(`config`,`workspace`,n),yf(n)}async function Cf(e,t){return bf(e,async e=>{let n=structuredClone(await q(e));return t(n),Sf(e,n)})}function wf(e,t){return bf(e,async e=>Sf(e,me(await q(e),t)))}async function Tf(e){let t=await e.json().catch(()=>void 0);if(!t||typeof t!=`object`)throw new K(`A JSON body is required`);return t}async function Ef(e,t){return Cf(e,t).then(t=>Df(e,t)).then(O).catch(G)}const Df=async(e,t)=>({...t,runsOn:await nm(e,t)}),Of=()=>O(Me());async function kf(e,t,n,r){return q(t).then(e=>O({config:e,effective:J(t,e)})).catch(G)}async function Af(e,t,n,r){return e.json().catch(()=>{throw new K(`A JSON body is required`)}).then(async e=>{let n=await wf(t,e);return[`chain`,`reviewModel`,`models`].some(t=>t in e)?Df(t,n):n}).then(O).catch(G)}function jf(e,t){return t.token?{...t,token:z(e.config,t.token)}:t}const Mf=3e5;async function Nf(e,t){await e.put(`snapshot`,hr(t),{drop:L()},{ttlMs:36e5});for(let n of await e.list(`snapshot`,{prefix:er(t)}))await e.delete(`snapshot`,n.id)}async function Pf(e,t,n){await e.withAppLock(`installation:${t}`,async e=>{let r=await e.get(`installation`,t);!r||r.deletedAt||(await So(e,`installation`,t,{deletedAt:n,uninstalled:!0}),await Nf(e,t))})}async function Ff(e,t,n,r,i,a=0){let o=n.token,s=jf(e,n);return t.auth.token(s,r,i,{fetch:e.fetch,async hold(t,r){let i=er(n.id,t),o=await e.store.heldTokens([n.id],[n.app]),s=o.held.get(i),c=(e.now??Date.now)(),l=s?s.expiresAt-s.mintedAt:0,u=a+(a+Mf<=l?Mf:0);if(s&&s.expiresAt-c>Math.max(u,Mf))try{return z(e.config,s.token)}catch(e){console.error(`coder server: held token unreadable, minting again`,e)}let d=await r();return await e.store.holdToken({key:i,value:{token:R(e.config,d.token),expiresAt:d.expiresAt,mintedAt:c},ttlMs:Math.max(d.expiresAt-c-Mf,0),drops:[n.id,n.app].map(e=>({key:hr(e),drop:o.drops.get(hr(e))}))}),d.token},async save(t){let r=R(e.config,t),i;return await e.store.withCredential(`installation`,n.id,async t=>{if(t){if(!(t.token===o||t.token&&z(e.config,t.token)===s.token)){i=t.token;return}return[{id:n.id,value:{...t,token:r}}]}}),n.token=i??r,i&&z(e.config,i)}})}function If(e,t,n,r,i){let a=[],o,s={installation:n.id,record:n,fetch:e.fetch??fetch,token:()=>o??=Ff(e,t,n,i,{tools:t.tools.presets[`read-only`]}).then(e=>(a.push(e),e))};return Object.assign(async e=>e===r.integration?s:void 0,{minted:a})}function Lf(e,t){let n=(e.settings??={}).agentInstallations??=new Map,r=`${e.organizationId}:${t.id}`,i=n.get(r);return i||(i=e.store.list(`installation`,{agent:t.agent,active:!0}).then(e=>e.map(e=>e.value)),n.set(r,i),setTimeout(()=>n.delete(r),6e4).unref()),i}const Rf=e=>t=>{console.error(`coder server: could not mint a token for ${e}`,t)};async function zf(e,t){let n={},r=t.event;if(!r&&!t.parent)return n;let i;if(r){let a=e.integrations[r.integration];if(!a)throw Error(`Unknown integration "${r.integration}"`);let[o,s]=await Promise.all([e.store.get(`app`,r.appId),e.store.get(`installation`,`${r.appId}:${r.installationId}`)]);if(!o)throw Error(`Unknown app "${r.appId}"`);if(!s||s.deletedAt)throw Error(`Installation is gone`);i=s;let c=t.flow===`review`&&t.args?.post===!0;n[r.integration]=await Ff(e,a,i,z(e.config,o.credentials),{tools:t.tools[r.integration]??(c?a.tools.presets[`read-only`]:[])},e.config.taskTimeoutMs)}let a=(await Lf(e,t)).filter(e=>e.id!==i?.id&&e.integration in t.tools),o=new Map((await e.store.getApps([...new Set(a.map(e=>e.app))])).map(e=>[e.id,e.value]));return await Promise.all(a.map(async r=>{let i=e.integrations[r.integration],a=o.get(r.app);if(!i||!a)return;let s=await Ff(e,i,r,z(e.config,a.credentials),{tools:t.tools[r.integration]??[]},e.config.taskTimeoutMs).catch(Rf(r.id));s&&(n[gn(r.integration,r.account.login)]=s)})),n}async function Bf(e,t){let n=e.config.publicUrl?.replace(/\/$/,``);return n?`${n}${Lv(await Iv(e,t))}`:void 0}async function Vf(e,t,n){let r=await Wf(e,t.task),[i,a,o]=await Promise.all([zf(e,t.task),e.local?{}:_f(e.store),Gf(e,r)]),s,c=r.event;if(c?.chat&&r.source===c.integration){let t=e.integrations[c.integration],n=t.tools.presets[`read-only`],a=r.tools[c.integration]??[];if(a.length===n.length&&n.every(e=>a.includes(e)))s=i[c.integration];else{let[r,i]=await Promise.all([e.store.get(`app`,c.appId),e.store.get(`installation`,`${c.appId}:${c.installationId}`)]);if(!r||!i||i.deletedAt)throw Error(`Conversation installation is gone`);s=await Ff(e,t,i,z(e.config,r.credentials),{tools:n},e.config.taskTimeoutMs)}}let{actAsRefusal:l}=await Promise.resolve().then(()=>Cu),u=await Dh(e,t,i,n=>l(e,t,n)),d=await Bf(e,n),f=await Kf(e,r,J(e,a)),p={...u.env},m=[...u.warnings];for(let e of Object.keys(p))o.env[e]===void 0&&!f?.some(t=>t.credential.env[e]!==void 0)||(delete p[e],m.push(`${e} is temporarily unavailable; skipped for this task.`));let h=u.saved?[]:await Ah(e,r),g={...r,...!r.settingsUrl&&d?{settingsUrl:`${d}/agents/${encodeURIComponent(r.agent)}/settings`}:{}},_=await kh(e,r.id,[...u.secrets,...h,...Object.values(u.tokens),...Object.values(i),...s?[s]:[],...Zf(o.env),...f?.flatMap(e=>Zf(e.credential.env))??[]]);await ys(e,r.id,m);let v={task:g,tokens:{...u.tokens,...i},...d?{dashboard:d}:{},...s?{postToken:s}:{},credential:o,...f?{engineCredentials:f}:{},config:a,connections:u.mcp,connectionEnv:p,connectionSecrets:_};if(r.runner!==`vercel-sandbox`)return v;let y=e=>{let t=new Set(Jf(a,r,e).map(e=>e.name));return{...e,env:Object.fromEntries(Object.entries(e.env).map(([e,n])=>[e,t.has(e)?`brokered`:n]))}};return{...v,credential:y(o),...f?{engineCredentials:f.map(e=>({...e,credential:y(e.credential)}))}:{}}}function Hf(e){let t=e.models?.[0]?.model;return t?Ee(t).model:void 0}function Uf(e){let{name:t}=Up(e);return t===`claude`||t===`ANTHROPIC_API_KEY`||t===`CLAUDE_CODE_OAUTH_TOKEN`?`claude`:t===`codex`||t===`OPENAI_API_KEY`?`codex`:`custom`}async function Wf(e,t){if(t.models)return t;let{models:n}=await Xp(e,vt(t),ls(t));return{...t,models:$p(n,!!(t.runnerId||e.local))}}async function Gf(e,t){let[n]=(await Wf(e,t)).models??[],r=n?Ee(n.model).engine:`claude`,i=n?.credential&&await e.store.get(`credential`,n.credential);if(i)return{engine:r,...mi(e.config,i)};if(!t.runnerId&&!e.local)throw Error(`no-credential`);return{engine:r,env:{}}}async function Kf(e,t,n){let r=e=>{try{return[kt({model:e},n)]}catch{return[]}},{models:i}=await Wf(e,t),a=[...(i??[]).flatMap(e=>r(e.model)),...r(n.reviewModel).flatMap(e=>Nt(n,e)),...r().flatMap(e=>Nt(n,e))],o=[...new Set(a.flatMap(e=>Jp(e,n)))],s=ls(t),c=await e.store.listCredentials({owner:t.requestedBy}),l=new Set(i?.flatMap(e=>e.credential??[])),u=Yp(c,o,s);return[...c.filter(e=>l.has(e.id)&&!u.includes(e)&&(!e.value.owner||e.value.owner===s)),...u].map(t=>({id:t.id,credential:{engine:Uf(t.id),...mi(e.config,t.value)}}))}const qf=e=>e&&URL.canParse(e)?[new URL(e).hostname]:[];function Jf(e,t,n){if(n.engine!==`custom`)return ya;let r=e.models??{},i=t.usage?.model?r[t.usage.model]:void 0,a=(xe(i)?[i]:Object.values(r)).flatMap(e=>xe(e)&&e.envKey&&URL.canParse(e.baseUrl)?[{name:e.envKey,host:new URL(e.baseUrl).hostname,header:`authorization`,prefix:`Bearer `}]:[]);return[...ya,...a]}async function Yf(e,t,n){if(t.access===`auto`)return;let r=e.local?{}:await _f(e.store),i=new Set([...t.event?[t.event.integration]:[],...Object.keys(t.tools)]),a=xa(n.engine,n.env);if(n.engine===`custom`)for(let e of Object.values(r.models??{}))xe(e)&&a.push(...qf(e.baseUrl));let o=await _h(e,t);for(let n of o.ids){let r=await Um(e,n,gh(t),o.accounts);r?.provider===`mcp`?a.push(...qf(r.endpoint?.url)):r&&i.add(r.provider)}for(let t of i)a.push(...e.integrations[t]?.hosts??[]);for(let e of Object.values(t.definition.mcp??{}))a.push(...qf(e.url));for(let e of t.mcp??[])a.push(...qf(r.mcp?.[e]?.url));for(let e of r.network?.allowedHosts??[]){let t=e.replace(/^\[(.*)\](?::\d+)?$/,`$1`).replace(/^([^:]+):\d+$/,`$1`);a.push(t,...kr.isIP(t)?[]:[`*.${t}`])}return[...new Set(a)]}async function Xf(e,t){let n=await Gf(e,t);if(!n)return;let r=await _f(e.store),i=[n,...(await Kf(e,t,J(e,r))).map(e=>e.credential)],a=await Promise.all(i.map(n=>Yf(e,t,n)));return{credential:Object.assign({},...i.map(e=>e.env).reverse()),hosts:a.some(e=>e===void 0)?void 0:[...new Set(a.flatMap(e=>e??[]))],brokered:i.flatMap(e=>Jf(r,t,e))}}function Zf(e){let t=[];for(let[n,r]of Object.entries(e))if(!(!/(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)/i.test(n)&&!je(r))&&(t.push(r),n.endsWith(`_AUTH_JSON`))){let e=JSON.parse(r);t.push(...[e.OPENAI_API_KEY,...Object.entries(e.tokens??{}).filter(([e])=>/TOKEN|KEY|SECRET/i.test(e)).map(([,e])=>e)].filter(e=>typeof e==`string`))}return t}async function Qf(e,t){return t.event?(await Lf(e,t)).flatMap(t=>t.token?[z(e.config,t.token)]:[]):[]}async function $f(e,t){let[n,r,i]=await Promise.all([jh(e,t.task),_f(e.store).then(n=>Kf(e,t.task,J(e,n))),Qf(e,t.task)]),a=e.store instanceof pr&&t.task.event&&!(await e.store.list(`snapshot`,{prefix:`connection-secrets:${t.task.id}:`,limit:1})).length?Object.values(await zf(e,t.task)):[];return a.length&&await kh(e,t.task.id,[...n,...i,...a]),[...n,...i,...a,...r.flatMap(e=>Zf(e.credential.env))].filter(e=>e.length>=8)}var ep=t({LOCAL_LOGINS:()=>Ap,answerLocalApproval:()=>Sp,engineSignIn:()=>Np,engineSignOut:()=>Pp,engineStatus:()=>Ip,inspectLocalTask:()=>up,isLoginEngine:()=>Mp,localLog:()=>vp,localTask:()=>yp,localTaskAction:()=>xp,localTasks:()=>rp,localUsage:()=>Cp,machineSignedIn:()=>Rp,pushLocalInbox:()=>_p,recoverLocalTasks:()=>fp,resumeLocalTask:()=>bp,runLocalTask:()=>gp,startLocalTask:()=>sp,startQueuedLocalTask:()=>lp,stopLocalTasks:()=>pp,sweepLocalQueue:()=>ip,syncLocalApprovals:()=>ap,syncLocalUsage:()=>Ep});const tp=e=>!e.name?.startsWith(Tn),Y=e=>e?Date.parse(e):void 0;function np(e,t,n=!1){let r=Y(t.createdAt)??0,i=le(P.join(w(e,t.id),`answers.json`)),a=zt(w(e,t.id)),o=a.find(e=>!e.response),s=n?It(e,t.id,t):null,c=n?x(e,t.id).filter(e=>!E.includes(t.status)||(Y(e.at)??0)<(Y(t.resumedAt)??r)).map(e=>{let n=e.error&&typeof e.error==`object`?e.error.message:void 0;return{prompt:e.prompt??t.prompt??``,result:{ok:e.status===0,output:e.finalMessage??n??``},...n?{error:n}:{},finishedAt:Y(e.at)}}):[];n&&(E.includes(t.status)||!c.length||(c.at(-1)?.finishedAt??0)<(Y(t.resumedAt)??r))&&c.push({prompt:t.currentPrompt??t.prompt??``,...s?{result:{ok:s.status===0,output:s.finalMessage??s.error?.message??``}}:{},...t.error?{error:t.error}:{},...E.includes(t.status)?{}:{finishedAt:Y(t.completedAt)}});let l=t.flowRunId?dn(t.flowRunId)?.name:void 0,u={task:{id:t.id,source:t.source??`cli`,agent:t.agentId??D()??``,flow:l??`default`,...t.name?{name:t.name}:l?{name:l===`review`?`Review`:l}:{},runner:`local`,...t.cwd?{cwd:t.cwd}:{},...t.access?{access:t.access}:{},...t.prompt?{prompt:t.prompt}:{},definition:{integrations:{}},...t.engine?{usage:{engine:t.engine,...t.model?{model:t.model}:{},...t.effort?{effort:t.effort}:{}}}:{},tools:{}},status:o&&t.status===`running`?`waiting`:T(e,t)?`running`:t.status,attempts:1,...o?{approval:o}:{},...a.length?{approvals:a}:{},...i?{answer:i}:{},...s?{result:{ok:s.status===0,exitCode:null,output:s.finalMessage??s.error?.message??``},...s.tokens?{tokens:s.tokens}:{}}:{},...t.error?{error:t.error}:{},...t.fallbacks?.length?{fallbacks:t.fallbacks}:{},...t.archivedAt?{archivedAt:Y(t.archivedAt)}:{},...t.autoArchived?{autoArchived:!0}:{},createdAt:r,startedAt:Y(t.resumedAt)??r,...t.completedAt&&!E.includes(t.status)?{finishedAt:Y(t.completedAt)}:{},updatedAt:Y(t.updatedAt)??r,local:!0,...n?{turns:qt(c,a)}:{}};return{...u,...Nh(u)}}function rp(e,t){let n=on(e);return(t?_(e,{migrate:!1}):n).filter(tp).map(n=>{let r=np(e,n);return t?{...r,archivedAt:r.archivedAt??r.updatedAt}:r})}async function ip(e,t){let n=(e.now??Date.now)(),r=(await e.queue.list(e.organizationId,{archived:!1,statuses:[...se]})).filter(e=>he(e.finishedAt??e.updatedAt,n)&&ue(t,e)).map(e=>e.task.id);r.length&&await e.queue.archiveStopped(e.organizationId,n,r)}async function ap(e){let t=await e.store.list(`delivery`,{prefix:`approval:`});for(let n of new Set(t.map(e=>e.value.notice.task))){let t=await e.store.get(`task`,n);if(!t)continue;let r=t.task.cwd??e.local.cwd,i=zt(w(r,n));await op(e,r,n,i),await Tl(e,t.task,i)}}async function op(e,t,n,r){let i=(e.now??Date.now)();for(let a of r){if(!a.response||a.response.deliveredAt||a.response.decision===`closed`||i-Date.parse(a.response.answeredAt??``)<6e4)continue;let r=C(t,n);if(!r)return;await cn(t,r,a.id,a.response.decision,{...a.response.reason?{reason:a.response.reason}:{},resume:r=>bp(e,t,n,r)}).catch(e=>console.error(`coder server: could not deliver the answer to approval ${a.id}`,e))}}async function sp(e,t,n){if(!e.local||t.repo||(t.flow??`default`)!=="default"||t.runner&&t.runner!==`local`)return;let r=As(e,t)??e.local.cwd;await cr(e.store,r,e.integrations);let i=D(),a=t.agent??i;if(!a)throw new U(`Name an agent: this server has no default agent.`);let{record:o,version:s}=await N(e.store,a);ks(e,a,o);let c=await La(e,{requestedBy:e.session?.user.id,runner:t.runner,agent:s?.definition.runner}).catch(e=>{throw new U(e.message)});if(!(c.runner!==`local`||c.runnerId)){if(Ps(t),!n)return cp(e,{id:ne(),source:`dashboard`,agent:a,flow:`default`,runner:`local`,cwd:r,...t.name?{name:t.name}:{},...t.access?{access:t.access}:{},prompt:t.prompt,definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{},connections:await uh(e,void 0,it(o?.settings?.connections,t.connections)),tools:{}},{input:t,cwd:r});try{let c=n?await e.store.get(`task`,n):void 0,l=c?.task.connections??await uh(e,void 0,it(o?.settings?.connections,t.connections)),u=await vh(e,c?.task??{connections:l,access:t.access,tools:{},definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{}}),d=Ge(u.mcp,u.env),f=a===i?void 0:await Sn(r,a,t.mcp?.join(`,`),d.mcp,void 0,t.access),p=f??At(t.mcp?.join(`,`),Le(r).mcp,{},d.mcp),m=[],h=await Ft({taskId:n,prompt:t.prompt??``,outputSchema:t.outputSchema,cwd:r,name:t.name,appendSystem:t.appendSystem,addDirs:t.addDirs,engine:t.model?void 0:f?.engine,model:t.model??f?.model,effort:t.model?void 0:f?.effort,access:f?.access??t.access,...f?{agentPrompt:{developer:f.developer,access:Tt({definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{}},c?.task.access)}}:{},mcp:p.mcp,mcpBindings:p.mcpBindings,mcpWarnings:[...p.warnings??[],...u.warnings],connectionEnv:d.env,connections:l,nativeMcp:p.nativeMcp,...f?{agentId:t.agent}:{},source:`dashboard`,onFallback:e=>m.push(e)},{waitForStartup:!1});return np(r,m.length?ge(r,h.taskId,{fallbacks:m}):h.task)}catch(e){throw e instanceof m?new U(e.message,409):e}}}async function cp(e,t,n){let r=(e.now??Date.now)();await e.store.put(`snapshot`,`local-start:${t.id}`,n),await e.queue.enqueue(e.organizationId,t,r,void 0,e.config.maxQueued??1e3),await Bl(e,!1,!0,!0);let i=await e.store.get(`task`,t.id);return i?.status===`queued`?i:yp(n.cwd,t.id)??i}async function lp(e,t,n){if(!e.local||t.task.runner!==`local`||t.task.runnerId||t.task.event?.repo)return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;try{let i=t.task.id,a,o=r.resume?x(r.cwd,t.task.id).length:0,s=t.task.flow==="default"?C(r.cwd,t.task.id):void 0,c=n?mp(e,t.task.id,n,await Bf(e)):void 0;if(s&&!r.resume)i=s.id;else if(r.resume){let n=C(r.cwd,t.task.id);if(!n)throw Error(`Local task is missing`);await sn(r.cwd,n,t.task.prompt??``,{onWorker:e=>{a=e},outputSchema:t.task.context?.outputSchema,...r.overrides,resolveConnections:n=>hp(e,t.task,n,c)})}else r.input?await sp(e,{...r.input,prompt:t.task.prompt,outputSchema:t.task.context?.outputSchema??r.input.outputSchema},t.task.id):i=(await gp(e,t.task,t.task.id,!0,c)).task.id;await e.store.put(`snapshot`,`local-start:${t.task.id}`,{...r,startedId:i});let l={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(!await e.queue.patchTask(e.organizationId,t.task.id,{handle:`cli:${i}`},(e.now??Date.now)(),l)){let e=C(r.cwd,i);return e&&await un(r.cwd,e),!0}if(t.task.flow==="default"){let n={task:t.task,cwd:r.cwd,fence:l,turns:o};await e.store.put(`snapshot`,`completion:${i}`,n),dp(e,i,n,a);let s=eg(e,t.task.id);e.waitUntil&&e.waitUntil(s)}}catch(n){if(await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n instanceof Error?n.message:String(n)},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash})){let{reportTaskFailure:r}=await Promise.resolve().then(()=>zc);await r(e,t,n)}}return!0}async function up(e,t,n){if(t.status!==`running`&&t.status!==`waiting`||t.task.flow==="default"&&e.store.localFlows?.has(t.task.id)&&t.cancelRequestedAt===void 0&&(t.startedAt===void 0||n-t.startedAt<e.config.taskTimeoutMs))return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;let i={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(t.task.flow!=="default"){let r=dn(t.task.id);if(r?.status===`running`&&(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)){let n=e.store.localFlows?.get(t.task.id);n?(await n.stop(),await n.work.catch(()=>{})):r.pid!==process.pid&&await fn(t.task.id),r=dn(t.task.id)}return!r||r.status===`running`?!1:e.queue.finish(e.organizationId,t.task.id,{status:t.cancelRequestedAt===void 0?r.status===`completed`?`completed`:`failed`:`cancelled`,error:r.error},n,i)}let a=yp(r.cwd,r.startedId??t.task.id);if(!a)return!1;if([`queued`,`running`,`waiting`].includes(a.status))if(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs){let e=C(r.cwd,r.startedId??t.task.id);e&&await un(r.cwd,e),a=yp(r.cwd,t.task.id)}else return!1;let o=a.status;if(o!==`completed`&&o!==`failed`&&o!==`cancelled`)return!1;let s=await e.queue.finish(e.organizationId,t.task.id,{status:o,result:a.result,error:a.error},n,i);return s&&Pc(e,t.task),s}function dp(e,t,n,r){let i=e.store.completionWatches??=new Map;if(i.has(t))return;let a={stopped:!1,work:Promise.resolve()};i.set(t,a),a.work=(async()=>{let i=`completion:${t}:${n.fence?.generation??0}`,o=await e.store.get(`delivery`,i);if(o&&!o.owner)return;if(o?.posting!==void 0){console.error(`coder server: local completion ${t} has an interrupted post for turn ${o.posting+1}; retained for reconciliation`);return}if(o?.pid)try{process.kill(o.pid,0);return}catch(e){if(e.code!==`ESRCH`)return}let s=L(),c={owner:s,pid:process.pid,pending:!0,turns:o?.turns??n.turns??0};if(o?.owner){if(!await e.store.updateDelivery(i,o.owner,c))return}else if(!await e.store.create(`delivery`,i,c))return;let l=async()=>{if(!n.fence)return!0;let t=await e.store.get(`task`,n.task.id);return t&&(t.generation??0)===n.fence.generation&&t.attempts===n.fence.attempts&&t.tokenHash===n.fence.tokenHash&&t.status!==`queued`},u,d=async()=>{let t=n.task.event;if(!t||n.task.source!==t.integration)throw Error(`The task has no conversation`);if(!await l())throw Error(`The conversation task is no longer running`);if(!u){let r=await e.store.get(`app`,t.appId);if(!r)throw Error(`Local completion has no app`);let{eventReplies:i}=await Promise.resolve().then(()=>rd);u=await i(e,r,t,await e.store.get(`task`,n.task.id))}return u},f=async(t,r)=>{let i=await(await d()).post(t,r);c.posting!==void 0&&(c={...c,turns:c.posting+1,posting:void 0}),i&&await mc(e,n.task.event,i.ids??(i.id?[i.id]:[]),Date.now())},p=de(),m=h(n.cwd,t,r),g=100,_=new Map;try{for(let r=0;r<5;r++)try{let r=async(e,r,i)=>{if(n.task.source!==n.task.event?.integration)return;at(`completion.reply`,{id:t});let a=En(n.task,e,r,i);a.skipped&&pe(n.cwd,t,{kind:`status`,message:nn});let o=c.turns===(n.turns??0)?a.notice:void 0;a.text&&!a.duplicate&&await f(a.text,o)};for(;;){if(a.stopped||!await l())return;let o=C(n.cwd,t);if(!o)return;let u=x(n.cwd,t);for(let t of u.slice(c.turns)){t.status!==0&&e.local&&(e.local.engineChecks=void 0);let a={finalMessage:t.finalMessage,error:t.error},o=En(n.task,a,!1,t),l=n.task.source===n.task.event?.integration&&o.text&&!o.duplicate;l&&await d();let u=c.turns+1;if(c={...c,posting:l?c.turns:void 0},!await e.store.updateDelivery(i,s,c)||(await r(a,!1,t),c={...c,turns:u,posting:void 0},!await e.store.updateDelivery(i,s,c)))return}let f=zt(w(n.cwd,t)).filter(e=>_.get(e.id)!==`${e.response?.answeredAt??``}:${e.response?.deliveredAt??``}`);if(f.length){await Tl(e,{...n.task,id:t},f);for(let e of zt(w(n.cwd,t)))_.set(e.id,`${e.response?.answeredAt??``}:${e.response?.deliveredAt??``}`)}let h=S(n.cwd,o,p);if(!E.includes(h.status)&&!(h.pid&&v(h.pid,h,p))&&!Fn(w(n.cwd,t))&&(h.status!==`completed`||u.length>(n.turns??0))){let a=await e.store.get(`task`,n.task.id);n.fence&&a&&(a.generation??0)===n.fence.generation&&a.attempts===n.fence.attempts&&a.tokenHash===n.fence.tokenHash&&await up(e,a,(e.now??Date.now)())&&Vl(e,!0);let o=h.status===`cancelled`;if((o||h.error)&&u.at(-1)?.prompt!==(h.currentPrompt??h.prompt??null)){if(!await e.store.updateDelivery(i,s,c))return;await r({error:{message:h.error??`Task cancelled`}},o)}let l=await e.store.get(`task`,n.task.id),{endTyping:d}=await Promise.resolve().then(()=>rd);l&&await d(e,l).catch(e=>console.error(`coder server: could not clear the working indicator of ${t}`,e));break}await m.wait(g),g=Math.min(1e3,g*2)}await e.store.updateDelivery(i,s,{posted:!0,turns:c.turns,at:Date.now()})&&(await e.store.get(`snapshot`,`completion:${t}`))?.fence?.generation===n.fence?.generation&&await e.store.delete(`snapshot`,`completion:${t}`);return}catch(n){if(r===4)throw n;console.error(`coder server: local completion ${t} attempt ${r+1} failed, retrying`,n);let i=e.now??Date.now,o=i()+5e3*2**r;for(;!a.stopped&&i()<o;)await new Promise(e=>setTimeout(e,Math.min(100,o-i())))}}finally{m.close(),await e.store.updateDelivery(i,s,{...c,pid:void 0})}})().catch(e=>{console.error(`coder server: local completion ${t} failed`,e)}).finally(()=>{i.delete(t)})}async function fp(e){if(e.local)for(let{id:t,value:n}of await e.store.list(`snapshot`,{prefix:`completion:`}))C(n.cwd,t.slice(11))&&dp(e,t.slice(11),n)}async function pp(e){await Promise.all([...e.store.localFlows?.values()??[]].map(async e=>{await e.stop(),await e.work.catch(()=>{})}));let t=e.store.completionWatches;if(t){for(let e of t.values())e.stopped=!0;await Promise.all([...t.values()].map(e=>e.work))}}function mp(e,t,n,r){return{url:`http://127.0.0.1:${e.local.port}/tasks/${encodeURIComponent(t)}`,token:n,...r?{dashboard:r}:{}}}async function hp(e,t,n,r){let i=await zf(e,t),a=await vh(e,{...t,connections:n},i);await kh(e,t.id,[...a.secrets,...Object.values(a.tokens)]);let o=Ge(a.mcp,a.env),s=hn(t,a.tokens,r);return{mcp:o.mcp,env:{...o.env,...s.env},warnings:a.warnings}}async function gp(e,t,n,r=!1,i){if(t.event?.repo){let r=(e.now??Date.now)(),i=n??t.id;return await e.store.get(`task`,i)||await e.queue.enqueue(e.organizationId,{...t,id:i},r,void 0,e.config.maxQueued??1e3),await Bl(e,!1,!1,!0),await e.store.get(`task`,i)}if(!r){let r=As(e,t)??e.local.cwd;return cp(e,{...t,id:n??ne(),cwd:r},{cwd:r})}let a=await zf(e,t),o=await vh(e,t,a);await ys(e,n??t.id,o.warnings),await kh(e,n??t.id,[...o.secrets,...Object.values(o.tokens)]);let s=o.tokens,c=t.event&&a[t.event.integration],l=As(e,t)??e.local.cwd,u=await e.store.get(`task`,n??t.id),d={task:t,cwd:l,...u?{fence:{generation:u.generation??0,attempts:u.attempts,tokenHash:u.tokenHash,statuses:[`running`,`waiting`]}}:{}},f=t.flow!=="default"&&n?dn(n):void 0;if(f){let r=_e(l).find(e=>e.flowRunId===n),i=(e.now??Date.now)();return r?np(l,r):{task:t,status:f.status===`running`?`running`:f.status===`completed`?`completed`:`failed`,attempts:1,createdAt:i,updatedAt:i,local:!0}}if(t.flow==="default"){n??=ne();let r=`completion:${n}`,i=await e.store.get(`snapshot`,r);if(i&&Hh(i.task)!==Hh(t))throw Error(`Local completion belongs to another session`);i||await e.store.create(`snapshot`,r,d)}let p=t.flow==="default"&&n?C(l,n):void 0;if(p){let n;return p.status===`queued`&&!p.pid&&(n=Pt(l,p.id,{...Ge(o.mcp,o.env).env,...hn(t,s,i).env})),dp(e,p.id,d,n),np(l,p)}let m,h=new Promise(e=>m=e),g,_;g=wn({cwd:l,agent:t.agent,flow:t.flow,task:t,taskId:n,toolEnvironment:{tokens:s},...i?{replyEndpoint:i}:{},connections:o.mcp,connectionEnv:o.env,availability:e.local?.engineChecks&&e.local.engineChecks.expiresAt>Date.now()?e.local.engineChecks.availability:void 0,onModel:Lp(e),post:!1,...c?{postToken:c}:{},source:t.source,onStart:n=>{(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{n.requestStop(),await pn(n.runId,n.runningIds())},work:g}),m(t.id)},onWorker:(e,t)=>{_=t},onTask:e=>{m(e)}}).then(async n=>(t.flow==="default"&&n.taskId&&(d.turns=n.turn??d.turns,await e.store.put(`snapshot`,`completion:${n.taskId}`,d),dp(e,n.taskId,d,_)),n)).finally(async()=>{if(e.store.localFlows?.delete(t.id),t.flow!=="default"){let n=await e.store.get(`task`,t.id);n&&n.attempts===d.fence?.attempts&&n.tokenHash===d.fence?.tokenHash&&(n.generation??0)===d.fence?.generation&&await up(e,n,(e.now??Date.now)()),Vl(e,!0)}}),t.flow==="default"&&(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{let e=C(l,n??t.id);e&&await un(l,e)},work:g}),g.catch(()=>{e.local&&(e.local.engineChecks=void 0)});let v=await Promise.race([h,g.then(()=>void 0)]),y=v?C(l,v):void 0,b=(e.now??Date.now)();return y&&np(l,y)||{task:t,status:t.flow!=="default"&&dn(t.id)?.status===`running`?`running`:`completed`,attempts:1,createdAt:b,updatedAt:b,local:!0}}async function _p(e,t,n){let r=t.handle.slice(4),i=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!i)throw Error(`Local task launch is missing`);let a={generation:t.generation??0,seq:-1,answers:[]};for(let o of n){let n=await e.store.get(`task`,t.task.id);if(!n||n.attempts!==t.attempts||n.tokenHash!==t.tokenHash||(n.generation??0)!==o.generation||![`running`,`waiting`].includes(n.status))break;let s=C(i.cwd,r);if(!s)throw Error(`Local task is missing`);let c=o.kind===`cancel`?await un(i.cwd,s):await Ln(i.cwd,{...s,name:void 0},o,n=>hp(e,t.task,n));o.kind===`ask`&&a.answers.push({seq:o.seq,value:c}),a.seq=o.seq}return a}function vp(e,t,n=-1,r){let i=``;try{i=F.readFileSync(P.join(w(e,t),`log.jsonl`),`utf8`)}catch{}let a=i.split(`
+`).flatMap((e,t)=>{if(!e||t<=n)return[];let r=en(e);if(!r)return[{seq:t,at:0,level:`out`,line:e}];let i=r.kind===`error`?`err`:[`status`,`info`,`steer`].includes(r.kind??``)?`sys`:`out`;return[{seq:t,at:Y(r.at)??0,level:i,line:r.message??``,entry:r}]});return r===void 0?a:a.slice(0,r)}function yp(e,t,n=!0){let r=C(e,t);return r&&tp(r)?np(e,S(e,r),n):void 0}async function bp(e,t,n,r,i,a={},o={},s){let c=e.store.completionWatches?.get(n);c&&await c.work;let l=(e.now??Date.now)(),u=await e.store.get(`task`,n);u&&[`running`,`waiting`].includes(u.status)&&(await up(e,u,l),u=await e.store.get(`task`,n));let d={...u?await Hs(e,u.task):{},prompt:r,context:{...u?.task.context,...o,...i?{outputSchema:i}:{}},...s?{event:s}:{}};if(await e.store.put(`snapshot`,`local-start:${n}`,{cwd:t,resume:!0,...Object.keys(a).length?{overrides:a}:{}}),u){if(!await e.queue.continueTask(e.organizationId,n,d,l,{attempts:u.attempts,generation:u.generation??0}))return!1}else{let r=C(t,n);if(!r)throw Error(`No task "${n}"`);await e.queue.enqueue(e.organizationId,{...np(t,r).task,...d},l,void 0,e.config.maxQueued??1e3)}return await Bl(e,!1,!0,!0),!0}async function xp(e,t,n,r,i){let a=C(t,n);if(!a||!tp(a))return Response.json({error:`No task "${n}"`},{status:404});let o=S(t,a),s=E.includes(o.status),c=e.method===`POST`?await e.json().catch(()=>({})):{},l=(e,t=409)=>Response.json({error:e},{status:t}),u=Ns(c,[`engine`,`effort`]);if(u)return l(u,400);if(e.method===`DELETE`&&!r){if(s&&await un(t,o),an(t,o),i){let e=i.store.completionWatches?.get(n);e&&(e.stopped=!0,await e.work),await i.store.delete(`task`,n),await i.store.delete(`snapshot`,`local-start:${n}`),await i.store.delete(`snapshot`,`completion:${n}`),Vl(i,!0)}return Response.json({ok:!0})}if(e.method!==`POST`)return new Response(`Method not allowed`,{status:405});if(r===`cancel`)return s?(await un(t,o),Response.json({ok:!0})):l(`No running or queued task "${n}"`,404);if(r===`archive`)return ie(t,o),i&&await i.queue.patchTask(i.organizationId,n,{archivedAt:(i.now??Date.now)(),autoArchived:void 0},(i.now??Date.now)()),Response.json({ok:!0});if(r===`steer`){let e=String(c.text??``);if(!e.trim())return l(`text is required`,400);let r=s?void 0:c.outputSchema,a=Object.fromEntries([`model`,`access`].flatMap(e=>typeof c[e]==`string`&&c[e]?[[e,c[e]]]:[]));if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))return l(`outputSchema must be an object`,400);try{if(!s&&i){if(!await bp(i,t,n,e,r,a))return l(`Task is already active`);let o=await i.store.get(`task`,n);return Response.json(o?.status===`queued`?{...o,statusReason:`Waiting for a task slot`}:yp(t,n))}let c=await sn(t,o,e,{...typeof r==`object`&&r?{outputSchema:r}:{},...a});return Response.json(s?c:yp(t,n))}catch(e){return l(e.message)}}if(r===`ask`){let e=String(c.question??c.text??``);if(!e.trim())return l(`question is required`,400);let r=await ln(t,o,e,{...typeof c.model==`string`&&c.model?{model:c.model}:{}}),i=r.finalMessage??r.error?.message??``,a=P.join(w(t,n),`answers.json`);return re(a,[...le(a)??[],i]),Response.json({ok:!0,answer:i})}return r===`approve`?Sp(t,n,c,i):new Response(`Not found`,{status:404})}async function Sp(e,t,n,r){let i=C(e,t);if(!i||!tp(i))return Response.json({error:`No task "${t}"`},{status:404});let a=S(e,i),o=zt(w(e,t)),s=o.filter(e=>e.response?.decision!==`accept`&&e.response?.decision!==`closed`),c=String(n.approvalId??n.id??Bt(w(e,t))[0]?.id??``);if(o.some(e=>e.id===c&&e.response?.decision===`closed`))return Response.json({error:Rt(c)},{status:409});if(!s.some(e=>e.id===c))return Response.json({error:`Task "${t}" has no approval "${c}" to answer`},{status:409});try{await cn(e,a,c,n.decision===`deny`||n.decision===`decline`?`decline`:`accept`,{...typeof n.reason==`string`?{reason:n.reason}:{},...typeof n.by==`string`&&n.by?{by:n.by}:{},...r?{resume:n=>bp(r,e,t,n)}:{}})}catch(e){if(e instanceof m)return Response.json({error:e.message},{status:400});throw e}return Response.json({ok:!0})}function Cp(e,t=new Set,n=!0){let r=wp(t);return[..._e(e),...n?_(e,{migrate:!1}):[]].filter(tp).flatMap(e=>Tp(e,r))}function wp(e){let t=new Map;for(let n of e){let e=n.lastIndexOf(`:`),r=n.slice(4,e),i=t.get(r)??[];i.push(Number(n.slice(e+1))),t.set(r,i)}return t}function Tp(e,t){let n=e.turnUsage??[],r=t.get(e.id)??[];t.set(e.id,r);let i=Y(e.createdAt)??0;return n.flatMap(t=>{let n=Y(t.at);if(n===void 0||!Number.isFinite(n))return[];let a=Y(e.resumedAt),o=a!==void 0&&a>=i&&a<=n?a:i,s=r.includes(n);return i=n,s?[]:(r.push(n),[[`cli:${e.id}:${n}`,{taskId:e.id,agent:e.agentId??D()??``,target:e.source??`cli`,...e.engine?{engine:e.engine}:{},...t.model??e.model?{model:t.model??e.model}:{},credential:`local`,runnerElapsedMs:Math.max(0,n-o),...t.tokens?{tokens:t.tokens}:{},at:n}]])})}function Ep(e){let t=e.local;return t.usageSync??=kp(e).finally(()=>t.usageSync=void 0)}async function Dp(e){try{return JSON.parse(await F.promises.readFile(e,`utf8`))}catch{return null}}async function Op(e){return(await Promise.all([`job.json`,`results.jsonl`,`result.json`].map(async t=>{let n=await F.promises.stat(P.join(e,t)).catch(()=>void 0);return n?`${n.mtimeMs}:${n.ctimeMs}:${n.size}`:``}))).join(`|`)}async function kp(e){let t=e.local;await t.cacheMaintenance;let n=y(),r=await Dp(n),i=await e.store.list(`usage`,{prefix:`cli:`}),a=new Set(i.map(e=>e.id)),o=0,s=async()=>{++o%4==0&&await new Promise(e=>setImmediate(e))};if(t.archiveScan===void 0)for(let[t,n]of Object.entries(r?.rows??{}))a.has(t)||(await e.store.put(`usage`,t,n),a.add(t)),await s();let c=wp(a),l=(await F.promises.stat(b(t.cwd)).catch(()=>void 0))?.mtimeMs??0,u={},d=new Set,f=!1;for await(let{id:n,dir:i,archived:a}of te(t.cwd)){if(await s(),d.has(n))continue;let t=a?await Op(i):void 0;if(a&&r?.counted?.[n]===t){u[n]=t,d.add(n);continue}let o=await Dp(P.join(i,`job.json`));if(o){if(o.agent&&(o.engine=o.agent),d.add(n),tp(o))for(let[t,n]of Tp(o,c))await e.store.put(`usage`,t,n),f=!0,await s();a&&(u[n]=t)}}if(f||r?.archive!==l||JSON.stringify(r?.counted)!==JSON.stringify(u)){let t=await e.store.list(`usage`,{prefix:`cli:`});await F.promises.mkdir(P.dirname(n),{recursive:!0});let r=ee(n);try{await F.promises.writeFile(r,`${JSON.stringify({archive:l,counted:u,rows:Object.fromEntries(t.map(e=>[e.id,e.value]))})}\n`),await F.promises.rename(r,n)}finally{await F.promises.rm(r,{force:!0})}}t.archiveScan=l}const Ap=`A local server stores no engine credentials. Tasks use this machine's own claude and codex sign-in.`,jp={claude:{file:`claude`,args:[`auth`,`status`,`--json`],command:`claude auth login`,login:[`auth`,`login`],logout:[`auth`,`logout`],ok:e=>JSON.parse(e).loggedIn===!0},codex:{file:`codex`,args:[`login`,`status`],command:`codex login`,login:[`login`],logout:[`logout`],ok:()=>!0}},Mp=e=>e in jp;function Np(e){let t=jp[e];Or(t.file,t.login,{detached:!0,stdio:`ignore`}).on(`error`,()=>{}).unref()}function Pp(e){let t=jp[e];return new Promise(e=>Dr(t.file,t.logout,{timeout:15e3},()=>e()))}function Fp(e){return new Promise(t=>Dr(e.file,e.args,{timeout:15e3},(n,r)=>{try{t(!n&&e.ok(r))}catch{t(!1)}}))}async function Ip(e){let t=e?.local;if(t?.engineChecks&&t.engineChecks.expiresAt>Date.now())return t.engineChecks.work;let n={},r=Promise.all([Fp(jp.claude),Fp(jp.codex)]).then(([e,r])=>(t&&(n.claude=Lt(`claude`,process.env,t.cwd),n.codex=Dt(t.cwd)),{claude:{signedIn:e,command:jp.claude.command},codex:{signedIn:r,command:jp.codex.command}})).catch(e=>{throw t?.engineChecks?.work===r&&(t.engineChecks=void 0),e});return t&&(t.engineChecks={expiresAt:Date.now()+3e4,availability:n,work:r}),r}function Lp(e){let t;return async n=>n.model!==t&&(t=n.model,Rp(e,Ee(n.model)))}async function Rp(e,t){if(!e.local)return!1;if(t.engine!==`custom`)return(await Ip(e))[t.engine]?.signedIn===!0;let n=t.model?Le(e.local.cwd).models?.[t.model]:void 0;return!!(n&&xe(n)&&process.env[n.envKey??`OPENAI_API_KEY`])}var zp=t({addCredential:()=>sm,agentModels:()=>Qp,checkCredential:()=>qp,completeLogin:()=>lm,connectionFix:()=>_m,createCredential:()=>Sm,credentialEnv:()=>om,credentialFix:()=>gm,credentialId:()=>Hp,credentialNames:()=>Jp,credentialSummary:()=>dm,deleteCredential:()=>Cm,failureText:()=>vm,listCredentials:()=>xm,listRunsOn:()=>rm,modelAttempts:()=>$p,modelProblem:()=>im,parseCredentialId:()=>Up,pickCredentials:()=>Yp,removeCredential:()=>cm,reseal:()=>hm,resolveModels:()=>Xp,runsOn:()=>tm,runsOnEach:()=>nm,signInEngine:()=>wm,signOutEngine:()=>Tm,visibleCredentials:()=>am,writeBackCodexAuth:()=>pm});const Bp={claude:`ANTHROPIC_API_KEY`,codex:`OPENAI_API_KEY`},Vp={claude:`CLAUDE_CODE_OAUTH_TOKEN`,codex:`CODEX_AUTH_JSON`};function Hp(e,t){return e?`${e}/${t}`:t}function Up(e){let t=e.lastIndexOf(`/`);return t<0?{name:e}:{owner:e.slice(0,t),name:e.slice(t+1)}}function Wp(e){let[t=``]=Object.keys(e);return Object.keys(Vp).find(e=>Vp[e]===t)??t}var Gp=class extends Error{status;constructor(e,t){super(`Credential check failed: ${e}${t?` ${t}`:``}`),this.status=e}};function Kp(e){if(e.OPENAI_API_KEY)return e.OPENAI_API_KEY;if(e.CODEX_AUTH_JSON)try{let t=JSON.parse(e.CODEX_AUTH_JSON);return t.OPENAI_API_KEY??t.tokens?.access_token??t.access_token}catch{throw Error(`CODEX_AUTH_JSON is not valid JSON`)}}async function qp(e,t=fetch){if(e.engine===`custom`)return;let n,r;if(e.engine===`claude`){let t=e.env.ANTHROPIC_API_KEY,i=e.env.CLAUDE_CODE_OAUTH_TOKEN;if(!t&&!i)throw Error(`Claude credentials need ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN`);n=`https://api.anthropic.com/v1/models`,r={"anthropic-version":`2023-06-01`,...t?{"x-api-key":t}:{authorization:`Bearer ${i}`,"anthropic-beta":`oauth-2025-04-20`}}}else{let t=Kp(e.env);if(!t)throw Error(`Codex credentials need OPENAI_API_KEY or CODEX_AUTH_JSON`);n=`https://api.openai.com/v1/models`,r={authorization:`Bearer ${t}`}}let i=await t(n,{method:`GET`,headers:r});if(!i.ok)throw new Gp(i.status,i.statusText)}function Jp(e,t){if(e.engine===`claude`||e.engine===`codex`)return[e.engine,Bp[e.engine]];let n=e.model?t.models?.[e.model]:void 0;return[n&&xe(n)&&n.envKey||Bp.codex]}function Yp(e,t,n){return(n?[n,void 0]:[void 0]).flatMap(n=>t.flatMap(t=>e.filter(e=>e.id===Hp(n,t))))}async function Xp(e,t,n){let[r,i]=await Promise.all([q(e),e.store.listCredentials({owner:n})]),a=J(e,r),o=Nt(a,kt(t,a)),s=await Zp(e,a,i,o,n);return{models:s,attempts:$p(s),first:o[0]}}async function Zp(e,t,n,r,i){return Promise.all(r.map(async r=>{let a=Yp(n,Jp(r,t),i).map(e=>e.id);return{model:ce(r),option:r,credentials:a,...!a.length&&await Rp(e,r)?{machine:!0}:{}}}))}async function Qp(e,t,n){let[r,i]=await Promise.all([q(e),e.store.listCredentials({owner:n})]),a=J(e,r),o=[`claude`,`codex`,...Object.entries(a.models??{}).flatMap(([e,t])=>xe(t)?[`custom/${e}`]:[])],[s,c]=await Promise.all([Zp(e,a,i,Nt(a,kt(t,a)),n),Zp(e,a,i,o.map(e=>kt({model:e},a)))]);return{models:s,unrunnable:o.filter((e,t)=>!c[t].credentials.length&&!c[t].machine)}}function $p(e,t=!1){return e.flatMap(e=>e.credentials.length?e.credentials.map(t=>({model:e.model,credential:t})):e.machine||t?[{model:e.model}]:[])}const em={claude:`Claude`,codex:`Codex`,custom:`Custom`};function tm(e,t){let n=Se(e.option),r=em[e.option.engine]??e.option.engine;return e.machine?`${n} on this machine's ${r} sign-in`:e.credentials.length?`${n} on ${e.credentials.map(e=>{let{owner:n,name:i}=Up(e),a=n?n===t?`the personal`:`the starter's`:`the workspace's`;return Object.hasOwn(Vp,i)?`${a} ${r} subscription`:`${a} ${Object.values(Bp).includes(i)?`${r} key`:i}`}).join(`, then `)}`:`${n}: no credential, skipped`}async function nm(e,t,n=e.session?.user.id){let r=await e.store.listCredentials({owner:n}),i=J(e,t),a=await Promise.all([...i.chain,i.reviewModel].map(async t=>{try{let a=kt({model:t},i),[o]=await Zp(e,i,r,[a],n);return[t,tm(o,n)]}catch(e){return[t,`${t}: ${e.message}`]}}));return Object.fromEntries(a)}function rm(e,t){let n=e.filter(e=>e.credentials.length||e.machine);return n.length?n.map(e=>tm(e,t)).join(`, then `):`No credential runs any listed model`}async function im(e,t,n=!1){if(!t.engine&&!t.model)return;let[r]=(await Xp(e,t)).models;if(r.credentials.length||r.machine)return;let i=r.option.engine,a=em[i]??i,o=`Add one in Settings → ${i===`custom`?`Models`:`Credentials`}`;return`No workspace credential runs ${t.model?`${t.model} (${a})`:a}. ${n?`[${o}](${await gm(e,i)})`:o}, or pick another model.`}async function am(e,t,n){return(await e.listCredentials({owner:t,limit:n})).filter(e=>!e.value.owner||e.value.owner===t)}async function om(e,t){let n=e.session?.user.id,[r]=Yp(await am(e.store,n),[t],n);return(r?mi(e.config,r.value).env[t]:void 0)??(e.local?yr.env[t]:void 0)}async function sm(e,t,n,r=Date.now){let i=n.owner||void 0,a=Hp(i,Wp(n.env)),o=!1;return await e.withCredential(`credential`,a,async e=>{o=!!e;let s={...pi(t,{env:n.env}),...i?{owner:i}:{},...n.account?{account:n.account}:{},createdAt:r()};return[{id:a,value:s}]}),{id:a,replaced:o}}function cm(e,t){return e.withCredential(`credential`,t,async e=>e&&[{id:t,value:null}])}async function lm(e,t,n,r){let i=await e.get(`login`,t);if(!i)return!1;let a=Hp(i.owner,i.engine);return e.withCredential(`credential`,a,async(e,o,s)=>{if(await s.patchLogin(t,{state:`done`},{state:[`starting`,`open`,`verifying`],tokenHash:n,owner:i.owner}))return[{id:a,value:{...r,owner:i.owner}}]})}function um(e){if(e.CODEX_AUTH_JSON)return`••••`;let t=Object.values(e)[0]??``;return t.length>16?`${t.slice(0,5)}••••`:`••••`}function dm(e,t,n){let{name:r}=Up(t);return{name:r,scope:n.owner?`personal`:`workspace`,subscription:Object.hasOwn(Vp,r),createdAt:n.createdAt??0,masked:um(mi(e,n).env),...n.account?{account:n.account}:{}}}const fm=e=>{try{return Date.parse(JSON.parse(e??``).last_refresh??``)}catch{return NaN}};function pm(e,t,n,r){return e.withCredential(`credential`,n,async e=>{if(!e)return;let{env:i}=mi(t,e);if(!(!i.CODEX_AUTH_JSON||!(fm(r)>(fm(i.CODEX_AUTH_JSON)||0))))return[{id:n,value:{...e,...pi(t,{env:{...i,CODEX_AUTH_JSON:r}})}}]})}function mm(e,t){return hi(e,t.iv===`plain`?`plain.${t.ciphertext}`:`${t.iv}.${t.tag}.${t.ciphertext}`)}async function hm(e,t,n=Date.now){if(!t.encryptionKey)throw Error(`SERVER_ENCRYPTION_KEY is required to rotate keys`);let r=ui(t.encryptionKey),i=e=>hi(t,e)!==r,a=e=>i(e)?R(t,z(t,e)):e,o=e=>{let t=e.token&&a(e.token);if(t!==e.token)return{...e,token:t}},s=0;for(let{id:t}of await e.list(`app`))await e.withAppLock(t,async e=>{let n=await e.get(`app`,t);return!n||!i(n.credentials)?!1:(await e.put(`app`,t,{...n,credentials:a(n.credentials)}),!0)})&&s++;for(let{id:t}of await e.list(`installation`))await e.withCredential(`installation`,t,async e=>{let n=e&&o(e);return n&&[{id:t,value:n}]})&&s++;for(let{id:t}of await e.list(`connection`))await e.withAppLock(`connection:${t}`,async e=>{let n=await e.get(`connection`,t);return!n?.secret||!i(n.secret)?!1:(await e.put(`connection`,t,{...n,secret:a(n.secret)}),!0)})&&s++;for(let{id:t}of await e.list(`snapshot`)){let r=t.startsWith(`connection-secrets:`)?t.slice(19).replace(/:[a-f0-9]{24}$/,``):t.startsWith(`connections:`)?t.slice(12).replace(/:\d+:\d+:[a-f0-9]{12}$/,``):void 0;await e.withAppLock(r?`connections:${r}`:t,async e=>{let o=await e.get(`snapshot`,t);if(!o)return!1;let s=`resolvedConnections`in o?`resolvedConnections`:`secret`in o?`secret`:void 0;if(!s)return!1;let c=r?await e.get(`task`,r):void 0;if(!c||[`completed`,`failed`,`cancelled`].includes(c.status))return await e.delete(`snapshot`,t),!1;let l=o[s];return i(l)?(await e.put(`snapshot`,t,{...o,[s]:a(l)},{ttlMs:`expiresAt`in o&&typeof o.expiresAt==`number`?Math.max(1,o.expiresAt-n()):36e5}),!0):!1})&&s++}for(let{id:t}of await e.list(`runner`))await e.withCredential(`runner`,t,async e=>{if(!(!e||!i(e.secret)))return[{id:t,value:{...e,secret:a(e.secret)}}]})&&s++;for(let{id:n}of await e.list(`credential`))await e.withCredential(`credential`,n,async e=>{if(!(!e||mm(t,e)===r))return[{id:n,value:{...e,...pi(t,mi(t,e))}}]})&&s++;return s}async function gm(e,t,n){let r=Lv(n??await Iv(e),t===`custom`?`/settings/models`:`/settings/credentials`);return`${e.config.publicUrl?.replace(/\/$/,``)??``}${r}${t===`custom`?``:`?engine=${encodeURIComponent(t)}`}`}async function _m(e,t,n){let r=Lv(n??await Iv(e),`/settings/connections`);return`${e.config.publicUrl?.replace(/\/$/,``)??``}${r}?connect=${encodeURIComponent(t)}`}async function vm(e,t,n){return`There was a problem with your connected model. If you have access to it, [Check the model](${await gm(e,t,n)}).`}const ym=f({env:n(c().check(l(/^[A-Z_][A-Z0-9_]*$/)),c().check(u(1))),workspace:i(a()),noCheck:i(a())}),bm=`Only an owner or admin of this workspace can change workspace credentials.`;async function xm(e,t,n,r){let i=t.session?.user.id,a=e=>`${e.scope}/${e.name}`,o=(e,t)=>e.localeCompare(t)||(e<t?-1:+(e>t)),s=r.searchParams.get(`fields`);if(s&&s!==`id`)return O({error:`Invalid fields`},400);if(s===`id`){let e=Mn(r),n=k(r,200),a=(await t.store.list(`credential`,{visibleTo:i,...e?{after:e}:{},limit:A(r)?n+1:n})).map(({id:e})=>({id:e}));return O(A(r)?Pn(a,n,e=>e.id):a)}let c=(await am(t.store,i,A(r)?void 0:k(r,200))).map(e=>dm(t.config,e.id,e.value)).sort((e,t)=>o(a(e),a(t)));if(!A(r))return O(c.slice(0,k(r,200)));let l=Mn(r),u=r.searchParams.get(`q`)?.trim().toLowerCase(),d=c.filter(e=>!u||[e.name,e.account?.email??``].some(e=>e.toLowerCase().includes(u))).filter(e=>!l||o(a(e),l)>0);return O(Pn(d,k(r),a))}async function Sm(e,t,n,r){let i=t.session?.user.id,a=await e.json().catch(()=>void 0),o=ym.safeParse(a);if(!o.success||Object.keys(o.data.env).length!==1)return O({error:`Invalid credential`},400);let{env:s}=o.data,c=!!o.data.workspace||!i;if(c&&!d_(t))return O({error:bm},403);if(s.CODEX_AUTH_JSON)return O({error:`Sign in with Codex on the Credentials page instead.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&!t.config.subscriptions?.claude)return O({error:`Claude subscriptions are off on this server; add an API key.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&c&&t.auth)return O({error:`A Claude subscription is personal; add it without --workspace.`},400);let l=c?void 0:i,u=s.CLAUDE_CODE_OAUTH_TOKEN?`claude`:Object.keys(Bp).find(e=>Bp[e]in s)??`custom`;try{o.data.noCheck||await qp({engine:u,env:s},t.fetch??fetch);let{id:e,replaced:n}=await sm(t.store,t.config,{...l?{owner:l}:{},env:s},t.now??Date.now);return O({ok:!0,name:Up(e).name,replaced:n})}catch(e){return e instanceof Gp?O({error:e.message},e.status):(console.error(`coder server: could not save credential`,e),O({error:`Could not save credential. Please try again.`},500))}}async function Cm(e,t,n,r){let i=t.session?.user.id,a=r.searchParams.has(`workspace`)||!i;if(a&&!d_(t))return O({error:bm},403);let o=Hp(a?void 0:i,n.name);return await cm(t.store,o)?O({ok:!0}):O({error:`Unknown credential`},404)}async function wm(e,t,n,r){let i=n.engine;return Np(i),t.local&&(t.local.engineChecks=void 0),O(await Ip())}async function Tm(e,t,n,r){let i=n.engine;return await Pp(i),t.local&&(t.local.engineChecks=void 0),O(await Ip())}var Em=t({ConnectionError:()=>Jm,addConnection:()=>th,authorizeConnection:()=>lh,changeConnection:()=>nh,connectNotice:()=>Rm,connectionAllowed:()=>Wm,connectionAuthorization:()=>ih,connectionGrants:()=>uh,connectionRow:()=>Mm,connectionRows:()=>Zm,createConnection:()=>oh,deleteConnection:()=>ch,findConnection:()=>Um,listConnections:()=>ah,nativeApp:()=>Km,nativeConnectionId:()=>Pm,nativeConnections:()=>Fm,nativeCredential:()=>Nm,needsReconnect:()=>Vm,personalGrants:()=>dh,removeConnection:()=>rh,updateConnection:()=>sh});const Dm=c().check(l(/^[a-z0-9][a-z0-9_-]*$/i)),Om=r([e({header:c().check(l(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/))}),e({env:c().check(l(/^[A-Za-z_][A-Za-z0-9_]*$/))})]),km=e({name:c().check(u(1)),id:i(Dm),provider:i(Dm),scope:i(s([`personal`,`workspace`])),access:i(s(ye)),endpoint:i(Oe),auth:i(s([`none`,`key`,`oauth`])),key:i(c().check(u(1))),keyIn:i(Om),credential:i(c().check(u(1)))}),Am=e({name:i(c().check(u(1))),access:i(s(ye)),key:i(c().check(u(1)))});function jm(e,t){let n=t.endpoint;if(t.provider===`env`)return!n&&t.auth===`key`&&t.access===`auto`&&!!t.keyIn&&`env`in t.keyIn&&fe(t.keyIn.env);if(t.provider!==`mcp`)return!n;if(!n||n.command&&t.access===`read-only`&&!n.tools?.length||n.tools?.some(e=>!et(e)))return!1;if(n.url){let r=URL.parse(n.url);if(!r||!Ke(r,!!e.local)||t.keyIn&&`env`in t.keyIn)return!1}else if(t.auth!==`none`&&(!t.keyIn||!(`env`in t.keyIn)))return!1;return t.auth===`oauth`&&!n.url?!1:![...Object.values(n.headers??{}),...Object.values(n.env??{})].some(je)}function Mm(e,t,n,r){let i=!!e.secret;if(e.auth===`oauth`&&e.provider===`mcp`&&e.secret&&n)try{i=!!z(n,e.secret).accessToken}catch{i=!1}return{id:e.id,name:e.name,provider:e.provider,scope:e.owner?`personal`:`workspace`,auth:e.auth,...e.access?{access:e.access}:{},...e.owner?{owner:{id:e.owner,...r?{name:r}:{}},...t===e.owner?{asker:!0}:{}}:{},...e.endpoint?.url?{url:e.endpoint.url}:{},...e.endpoint?.command?{command:e.endpoint.command}:{},...e.provider===`env`&&e.keyIn&&`env`in e.keyIn?{env:e.keyIn.env}:{},...e.account?{account:e.login??e.account}:{},status:e.broken||e.auth===`oauth`&&!i?`needs-auth`:`connected`,createdAt:e.createdAt}}function Nm(e,t){let n=z(e,t);return typeof n==`string`?{token:n,app:void 0}:n}const Pm=(e,t,n)=>`${e}:${t}-${Pr(`sha256`).update(n).digest(`hex`).slice(0,12)}`;async function Fm(e,t,n){return!t||!e.auth?.linkedAccounts?[]:Im(e,t,n??await e.auth.linkedAccounts(t,e.store))}function Im(e,t,n){return n.filter(t=>t.token&&t.organizationId===e.organizationId&&t.organizations?.includes(e.organizationId)&&e.integrations[t.platform]?.auth.user).map(n=>({id:Pm(t,n.platform,n.platformUserId),name:e.integrations[n.platform].name??n.platform,provider:n.platform,owner:t,auth:`oauth`,secret:n.token,account:n.platformUserId,...n.login?{login:n.login}:{},oauthApp:Nm(e.config,n.token).app,...n.refusedAt?{broken:{at:n.refusedAt,reason:`Needs reconnecting`}}:{},createdAt:0}))}async function Lm(e,t){return e.auth?.organizationAccounts?e.auth.organizationAccounts(e.organizationId,e.store):e.auth?.linkedAccounts?(await Promise.all(t.map(async t=>(await e.auth.linkedAccounts(t,e.store)).map(e=>({...e,userId:t}))))).flat():[]}async function Rm(e,t,n){let{models:r,attempts:i}=n,a=r.filter(e=>(e.option.engine===`claude`||e.option.engine===`codex`)&&!i.some(t=>t.model===e.model)).map(e=>e.option.engine);if(!a.length)return;let o=[...new Set((await e.store.list(`credential`)).flatMap(({id:e})=>{let{owner:t,name:n}=Up(e);return t&&a.some(e=>e===n)?[t]:[]}))];if(!o.length)return;let s=(await Lm(e,o)).filter(e=>e.platform===t.id);if(o.every(e=>s.some(t=>t.userId===e)))return;let c=await _m(e,t.id,n.slug),l=`[Connect ${t.name}](${c}) to run on a personal subscription.`,u=await e.store.create(`delivery`,`notice:${n.task}:${t.id}:${n.actor}`,{at:(e.now??Date.now)()},{ttlMs:2592e6});return{url:c,failure:`No model could run. ${l}`,...u?{notice:l}:{}}}async function zm(e,t,n){return(await e.store.list(`connection`,{visibleTo:t,secrets:n})).map(e=>e.value).filter(e=>!e.owner||e.owner===t)}async function Bm(e,t,n){let r=await Fm(e,t);return Hm(await zm(e,t,n),r)}async function Vm(e,t){return(await Bm(e,t,`oauth`)).some(n=>Mm(n,t,e.config).status===`needs-auth`)}function Hm(e,t){let n=e.map(e=>{if(!e.owner||e.provider===`mcp`||e.auth!==`oauth`)return e;let n=t.find(t=>t.owner===e.owner&&t.provider===e.provider&&(!e.account||e.account===t.account));return{...e,secret:n?.secret,account:n?.account??e.account,...n?.login?{login:n.login}:{},...n?.broken&&!e.broken?{broken:n.broken}:{}}});return[...n,...t.filter(e=>!n.some(t=>t.id===e.id||t.owner===e.owner&&t.provider===e.provider&&t.account===e.account))]}async function Um(e,t,n,r){let i=await e.store.get(`connection`,t);return i?!i.owner||i.owner===n?i:void 0:(await Fm(e,n,r)).find(e=>e.id===t)}async function Wm(e,t,n){if(e.method===`GET`)return t;if(n.id){let e=await Um(t,n.id,t.session?.user.id);if(!e)return O({error:`Unknown connection`},404);if(e.owner===t.session?.user.id&&e.owner)return t}else{let n=await e.clone().json().catch(()=>void 0);if(n?.scope===`personal`||n?.provider&&![`mcp`,`env`].includes(n.provider))return t.auth&&t.session&&!t.local?t:O({error:`Personal connections need a signed-in member`},400)}return m_(t,`Only workspace owners and admins can manage workspace connections`)}var Gm=class extends Error{};async function Km(e,t,n,r){let i=e.integrations[t]?.auth.user;if(i){if(!r){let[t,n]=await Promise.all([Qv(e),e.store.list(`app`)]),i=D(),a=n.map(e=>e.value);r=[...t,...a.filter(e=>e.agent===i),...a.filter(e=>e.agent!==i)]}return r.find(r=>{if(r.integration!==t||n&&r.id!==n)return!1;try{return i.authorizeUrl(z(e.config,r.credentials),{publicUrl:e.config.publicUrl??`https://coder.invalid`,state:``}),!0}catch{return!1}})}}async function qm(e,t,n){if(t.provider===`mcp`)return jv(e,t,n);if(!await Km(e,t.provider))throw new Gm(`No OAuth client is available for ${e.integrations[t.provider]?.name??t.provider}.`);let r=new URLSearchParams({connection:t.id,organization:e.organizationId,attempt:I(18).toString(`base64url`)});return`/connect/${encodeURIComponent(t.provider)}?${r}`}var Jm=class extends Error{status;needs;constructor(e,t,n){super(t),this.status=e,this.needs=n}};const X=(e,t)=>new Jm(e,t);async function Ym(e,t=200){try{return O(await e(),t)}catch(e){if(e instanceof Jm)return O({error:e.message,...e.needs?{needs:e.needs}:{}},e.status);throw e}}async function Xm(e){return e.json().catch(()=>void 0)}async function Zm(e,t){let n=e.session?.user.id??e.taskPrincipal?.asker,r=e.taskPrincipal?e.store.get(`task`,e.taskPrincipal.task).then(e=>e?.task):Promise.resolve(void 0),i=Qm(e,r).catch(e=>(console.error(`coder server: could not list app installations`,e),[])),a=(await e.store.list(`connection`,{secrets:`oauth`})).map(e=>e.value),o=await Lm(e,[...new Set([...a.flatMap(e=>e.owner??[]),...n?[n]:[]])]),s=new Map(o.map(e=>[e.userId,e.name]));e.session?.user.name&&s.set(e.session.user.id,e.session.user.name);let c=Hm(a,o.flatMap(t=>Im(e,t.userId,[t]))),l=t?await e.store.get(`delivery`,`connection-authorized:${t}`):void 0,u=await r,d=u&&new Set((await(await Promise.resolve().then(()=>fh)).turnConnections(e,u)).ids);return[...c.map(r=>{let i=Mm(r,n,e.config,r.owner&&s.get(r.owner));return t&&r.auth===`oauth`&&(!l||!(`target`in l)||l.target!==`${r.id}:${r.createdAt}`)&&(i.status=`needs-auth`),d&&!d.has(r.id)?i.status=`disabled`:d&&r.provider!==`env`&&(i.server=Ye(r)),i}),...await i]}async function Qm(e,t){let n=e.store.list(`app`),[r,i,a,o]=await Promise.all([e.store.list(`installation`,{active:!0}),n,Qv(e,n),t]),s=new Map([...i.map(e=>e.value),...a].map(e=>[e.id,e])),c=[...new Set(r.flatMap(e=>s.get(e.value.app)?.agent??[]))],l=new Map((c.length?await e.store.listAgentsWithVersions(c):[]).map(e=>[e.record.id,e])),u=o?.event&&`${o.event.appId}:${o.event.installationId}`;return r.flatMap(({id:t,value:n})=>{let r=s.get(n.app),i=e.integrations[n.integration];if(!r||!i)return[];let a=l.get(r.agent),c=a?.version?.definition.access===`read-only`||a?.record.settings?.access===`read-only`,d={id:t,name:i.name,provider:n.integration,scope:`workspace`,agent:r.agent,...c?{access:`read-only`}:{},auth:`none`,account:`${a?.record.name??r.name}'s app in ${n.account.login}`,status:`connected`,createdAt:n.createdAt};return o&&(r.agent!==o.agent||!(n.integration in o.tools)||!o.event&&!o.parent?d.status=`disabled`:d.server=mn(gn(n.integration,t===u?void 0:n.account.login))),[d]})}async function $m(e,t,n,r){if(n.key&&n.credential)throw X(400,`Give a key or a credential, not both`);if(n.key){let{id:i,replaced:a}=await sm(e.store,e.config,{...r?{owner:r}:{},env:{[t]:n.key}},e.now??Date.now);return a?{id:i}:{id:i,created:!0}}let i=(await am(e.store,r)).filter(n=>mi(e.config,n.value).env[t]!==void 0),a=n.credential?i.find(e=>e.id===n.credential):i.find(e=>r&&e.value.owner===r)??i.find(e=>!e.value.owner);if(!a)throw X(400,n.credential?`Credential ${n.credential} does not hold ${t}`:`No credential holds ${t}; give its key`);return{id:a.id}}async function eh(e,t,n){let r=t.keyIn.env;return(await $m(e,r,{key:n},t.owner)).id}async function th(e,t){let n=km.safeParse(t);if(!n.success)throw X(400,`Invalid connection`);let r=n.data,i=r.id??r.name.toLowerCase().replace(/[^a-z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``);if(!Dm.safeParse(i).success)throw X(400,`Invalid connection id`);if(i.endsWith(`-user`))throw X(400,`Names ending in -user are kept for members' own connections`);let a=r.provider??`mcp`,o=a!==`mcp`&&a!==`env`;if(o&&r.scope!==void 0)throw X(400,`Platform connections are personal and take no scope.`);let s=o||r.scope===`personal`?e.session?.user.id:void 0;if((o||r.scope===`personal`)&&(!s||!e.auth||e.local))throw X(400,`Personal connections need a signed-in member`);if(a!==`mcp`&&a!==`env`&&!e.integrations[a]?.auth.user)throw X(400,`This integration does not support user OAuth`);if(a===`env`&&r.auth&&r.auth!==`key`)throw X(400,`Environment connections require a key`);if(a!==`env`&&r.credential)throw X(400,`Only environment connections use a credential`);let c=a===`env`?`key`:a===`mcp`?r.auth??(r.key?`key`:`none`):`oauth`;if(c===`key`&&!r.key&&a!==`env`)throw X(400,`A key is required`);if(r.key&&c!==`key`)throw X(400,`A key needs key authentication`);let l={id:s?`${s}:${i}`:i,name:r.name,provider:a,...s?{owner:s}:{},...r.access||a===`env`?{access:r.access??`auto`}:{},auth:c,...r.endpoint?{endpoint:r.endpoint}:{},...r.keyIn?{keyIn:r.keyIn}:{},...r.key&&a!==`env`?{secret:R(e.config,{key:r.key})}:{},createdAt:(e.now??Date.now)()};if(!jm(e,l))throw X(400,`Invalid endpoint or read-only tools`);if(await e.store.get(`connection`,l.id))throw X(409,`Connection already exists`);let u;if(a===`mcp`&&r.endpoint?.url&&!r.auth&&!r.key){try{if(u=await wv(e,r.endpoint.url,!0),!u)try{let t=await tt(Qe({...l,access:`auto`},void 0),e.fetch,AbortSignal.timeout(5e3));await t.initialize().finally(()=>t.close())}catch(t){if(!(t instanceof $e)||!t.authenticate||(u=await wv(e,r.endpoint.url,!0,t.authenticate),!u))throw t}u&&(l.auth=`oauth`)}catch(e){throw e instanceof $e?new Jm(400,`${new URL(r.endpoint.url).hostname} takes a key, not a sign-in.`,`key`):(console.error(`coder server: connection discovery failed`,e),X(502,`Could not start authorization`))}if(l.auth===`oauth`&&e.local?.port===0)throw X(400,`Signing in needs a Coder server. Repeat with --server <url>, or add it in coder dash.`)}let d=a===`env`?await $m(e,r.keyIn.env,r,s):void 0;if(d&&(l.credential=d.id),!await e.store.withAppLock(`connection:${l.id}`,e=>e.create(`connection`,l.id,l)))throw d?.created&&await cm(e.store,d.id),X(409,`Connection already exists`);try{let t=l.auth===`oauth`?await qm(e,l,u):void 0;return{...Mm(l,s,e.config,e.session?.user.name),...t?{authorize:t}:{}}}catch(t){throw t instanceof Gm||console.error(`coder server: connection authorization failed`,t),await e.store.withAppLock(`connection:${l.id}`,async e=>{let t=await e.get(`connection`,l.id);Ir(t,l)&&await e.delete(`connection`,l.id)}),t instanceof Gm?X(400,t.message):X(502,`Could not start authorization`)}}async function nh(e,t,n){let r=Am.safeParse(n);if(!r.success)throw X(400,`Invalid connection settings`);return e.store.withAppLock(`connection:${t}`,async n=>{let i=await Um({...e,store:n},t,e.session?.user.id);if(!i)throw X(404,`Unknown connection`);let{key:a,access:o,...s}=r.data;if(a&&i.auth!==`key`)throw X(400,`This connection does not use a key`);let c={...i,...s,...o?{access:o}:{},...a&&i.provider!==`env`?{secret:R(e.config,{key:a})}:{},...a?{broken:void 0}:{},updatedAt:(e.now??Date.now)()};if(!jm(e,c))throw X(400,`Invalid read-only tools`);return a&&i.provider===`env`&&(c.credential=await eh({...e,store:n},i,a)),await n.put(`connection`,c.id,c),Mm(c,e.session?.user.id,e.config,e.session?.user.name)})}async function rh(e,t){await e.store.withAppLock(`connection:${t}`,async n=>{let r=await Um({...e,store:n},t,e.session?.user.id);if(!r)throw X(404,`Unknown connection`);if(r.owner&&r.provider!==`mcp`&&r.provider!==`env`){let t=await e.auth?.linkedAccounts?.(r.owner,n)??[];for(let i of t.filter(e=>e.platform===r.provider&&(!r.account||e.platformUserId===r.account)))await e.auth?.unlink?.(r.owner,i.platform,i.platformUserId,n)}await n.delete(`connection`,r.id)})}async function ih(e,t){let n=await Um(e,t,e.session?.user.id);if(!n||n.auth!==`oauth`)throw X(404,`Unknown OAuth connection`);try{return await qm(e,n)}catch(e){throw e instanceof Gm||console.error(`coder server: connection authorization failed`,e),e instanceof Gm?X(400,e.message):X(502,`Could not start authorization`)}}async function ah(e,t){let n=new URL(e.url),r=n.searchParams.get(`authorization`)??void 0,i=n.searchParams.get(`wait`);if(!r||!i)return O(await Zm(t,r));let a=await t.store.watch(`delivery`,`connection-authorized:${r}`),o=Date.now()+25e3;try{for(;;){let n=await Zm(t,r),s=n.find(e=>e.id===i);if(!s||s.status===`connected`||Date.now()>=o||e.signal.aborted)return O(n);await a.wait(Math.min(1e4,o-Date.now()),e.signal)}}finally{a.close()}}async function oh(e,t){let n=await Xm(e);return Ym(()=>th(t,n),201)}async function sh(e,t,n){let r=await Xm(e);return Ym(()=>nh(t,n.id,r))}async function ch(e,t,n){return Ym(async()=>(await rh(t,n.id),{ok:!0}))}async function lh(e,t,n){return Ym(async()=>({url:await ih(t,n.id)}))}async function uh(e,t,n){return(await Bm(e,t)).filter(e=>n===void 0||n.includes(e.id)).map(e=>e.id)}async function dh(e,t,n){let[r,i]=await Promise.all([e.auth?.linkedAccounts?e.auth.linkedAccounts(t,e.store):[],zm(e,t)]);return{ids:Hm(i,await Fm(e,t,r)).filter(e=>e.owner===t&&(n===void 0||n.includes(e.id))).map(e=>e.id),accounts:r}}var fh=t({connectionSecretValues:()=>Ah,connectionToken:()=>Eh,deleteTaskConnections:()=>Mh,readTaskConnectionSecrets:()=>jh,resolveConnections:()=>vh,resolvedTaskConnections:()=>Dh,secretRows:()=>Oh,taskAsker:()=>gh,taskConnectionSecrets:()=>kh,turnConnections:()=>_h});function ph(e){try{let t=JSON.parse(e);return[e,t.accessToken,t.refreshToken].filter(e=>typeof e==`string`&&!!e)}catch{return[e]}}const mh=e=>e.endpoint?.url?URL.parse(e.endpoint.url)?.host:void 0;async function hh(e,t){let n=t.credential?await e.store.get(`credential`,t.credential):void 0;if(!n||n.owner&&n.owner!==t.owner)throw Error(`Missing credential`);let r=mi(e.config,n).env[t.keyIn.env];if(!r)throw Error(`Missing key`);return r}const gh=e=>e.context?.asker??(cs(e)?void 0:e.requestedBy);async function _h(e,t){let n=gh(t),r=t.event&&n?await dh(e,n,t.usage?.connections):void 0;return{...r,ids:[...new Set([...t.connections??[],...r?.ids??[]])]}}async function vh(e,t,n={},r,i){let a={},o={},s={...n},c=Tt(t,t.access),l=e=>Re(e.access,c),u=[],d=[],f=gh(t),{ids:p,accounts:m}=i??await _h(e,t),h=p.length?await e.store.list(`connection`,{ids:p,visibleTo:f,secrets:`all`}):[],g=new Set(h.map(e=>e.id)),_,v=p.some(e=>!g.has(e))?await Fm(e,f,m).catch(e=>(console.error(`coder server: native connection lookup failed`,e),_=e,[])):[],y=new Map([...v.map(e=>[e.id,e]),...h.map(({id:e,value:t})=>[e,t])]),b=await Promise.allSettled(p.map(async e=>{if(!y.has(e)&&_)throw _;return{id:e,value:y.get(e)}})),x=Je(b.flatMap(e=>e.status===`fulfilled`&&e.value.value?[e.value.value]:[]));for(let n of b){let i,s=``;try{if(n.status===`rejected`)throw n.reason;if({id:s,value:i}=n.value,!i||i.owner&&i.owner!==f)continue;if(i.provider===`env`&&(i.auth!==`key`||i.access!==`auto`||i.endpoint||!i.credential||!i.keyIn||!(`env`in i.keyIn)||!fe(i.keyIn.env)||x.has(i.keyIn.env)||`local`in e&&e.local&&process.env[i.keyIn.env]!==void 0))throw Error(`Invalid environment connection`);if(i.owner&&i.provider===`env`){let e=r?await r(i):`Its owner has not approved it`;if(e){u.push(e);continue}}if(i.auth===`oauth`||i.owner&&i.provider===`mcp`&&i.auth===`key`){let n=l(i);if(i.provider===`mcp`)a[s]={...Qe({...i,access:n},void 0),connection:s,credentialOnUse:qe(i),connectionCreatedAt:i.createdAt,description:Ze(i),access:n,...i.owner?{owner:i.owner,account:i.login??i.account}:{}};else{let r=e.integrations[i.provider];if(!r)throw Error(`Unknown integration`);a[s]=_n(i,[...r.tools.presets[n]],t.event)}continue}if(i.broken){u.push(`${i.name} needs reconnecting.`);continue}let c;if(i.provider===`env`)c=await hh(e,i);else if(i.auth===`key`){if(!i.secret)throw Error(`Missing credential`);if(c=z(e.config,i.secret).key,!c)throw Error(`Missing key`)}if(c&&d.push(c),i.provider===`env`)o[i.keyIn.env]=c;else if(i.provider===`mcp`){let e=l(i);a[s]={...Qe({...i,access:e},c),connection:s,description:Ze(i),access:e}}}catch(e){u.push(Xe(i?.name??`A connection`,e))}}return{mcp:a,env:o,tokens:s,warnings:u,secrets:d}}const yh=(e,t)=>`connections:${e.task.id}:${e.generation??0}:${e.attempts}:${Pr(`sha256`).update(JSON.stringify([t,gh(e.task)])).digest(`hex`).slice(0,12)}`,bh=[`invalid_grant`,`invalid_token`,`bad_refresh_token`,`expired_token`],xh=e=>({at:(e.now??Date.now)(),reason:`Needs reconnecting`}),Sh=e=>((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)}));function Ch(e,t,n,r,i,a){return e.store.withAppLock(`connection:${t}`,async o=>{let s=await o.get(`connection`,t);if(!s?.secret||s.auth!==`oauth`||s.broken||s.owner!==n)return;if(s.createdAt!==a.connectionCreatedAt||s.endpoint?.url!==a.url)throw Error(`The connection changed since the task resolved it`);let c=z(e.config,s.secret);i.push(...[c.accessToken,c.refreshToken].filter(e=>!!e));let l=!!c.accessToken&&Ve(c.accessToken)===r;if(!l&&c.accessToken&&c.expiresAt===void 0)return c.accessToken;try{return await Ue({secret:c,now:(e.now??Date.now)(),fetch:Sh(e),force:l,save:async n=>{i.push(...[n.accessToken,n.refreshToken].filter(e=>!!e)),await o.put(`connection`,t,{...s,secret:R(e.config,n)})}})}catch(n){if(console.error(`coder server: token refresh failed`,ze({connection:t,host:mh(s)},n)),!(n instanceof rt))throw n;await o.put(`connection`,t,{...s,broken:xh(e)});return}})}async function wh(e,t,n,r,i){let a=e.integrations[t.provider];if(!a?.auth.user)throw Error(`Missing user OAuth`);let{owner:o,provider:s}=t;if(!o)return;let c=(n=[],r=t.account)=>n.find(t=>t.platform===s&&t.token&&t.organizationId===e.organizationId&&t.organizations?.includes(e.organizationId)&&(!r||t.platformUserId===r)),l=t.account??c(await e.auth?.linkedAccounts?.(o,e.store))?.platformUserId;if(!l)return;let u=n?.integration===s?await e.store.get(`app`,n.appId):void 0,d=await Promise.all([Qv(e),e.store.list(`app`)]).then(([e,t])=>[...e,...t.map(e=>e.value),...u?[u]:[]]);return e.store.withAppLock(`native:${o}:${s}:${l}`,async n=>{let f=await Um({...e,store:n},t.id,o);if(!f||f.owner!==o||f.provider!==s||f.broken)return;let p=c(await e.auth?.linkedAccounts?.(o,n),l);if(!p?.token||p.refusedAt)return;let m=Nm(e.config,p.token);i.push(...ph(m.token));let h=await Km(e,s,m.app??f.oauthApp??u?.id,d);if(!h)throw Error(`Missing integration credentials`);let g=t=>a.auth.user.access(m.token,z(e.config,h.credentials),{fetch:Sh(e),now:(e.now??Date.now)(),force:t}),_;try{_=await g(!1),!_.refreshed&&Ve(_.accessToken)===r&&(_=await g(!0))}catch(t){if(console.error(`coder server: token refresh failed`,ze({integration:s,account:l},t)),!(t instanceof ve&&bh.includes(t.error??``)))throw t;await e.auth?.refuseLinkedToken?.(o,s,p.platformUserId,p.token,n);return}if(_.refreshed){i.push(...ph(_.refreshed));let t=R(e.config,{app:h.id,token:_.refreshed});if(!await e.auth?.refreshLinkedToken?.(o,s,p.platformUserId,p.token,t,n)){let e=Error(`Linked account changed during refresh`);throw console.error(`coder server: token refresh failed`,ze({integration:s,account:l},e)),e}}return _.accessToken})}function Th(e,t,n,r){if(t.createdAt!==r.connectionCreatedAt||t.endpoint?.url!==r.url)throw Error(`The connection changed since the task resolved it`);let i=t.secret&&z(e.config,t.secret).key;return i&&Ve(i)!==n?i:void 0}async function Eh(e,t,n,r,i={},a){let o=a??await Um(e,n,gh(t)),s=o?.auth===`key`&&o.owner&&o.provider===`mcp`;if(!o||o.auth!==`oauth`&&!s||o.broken)return{name:o?.name};let c=[],l=s?Th(e,o,r,i):o.provider===`mcp`?await Ch(e,n,o.owner,r,c,i):await wh(e,o,t.event,r,c);return await kh(e,t.id,[...c,...l?[l]:[]]),{name:o.name,...l?{token:l}:{}}}async function Dh(e,t,n,r){let i=await _h(e,t.task);if(!i.ids.length)return{mcp:{},env:{},tokens:n,warnings:[],secrets:[],saved:!1};let a=yh(t,i.ids),o=await e.store.get(`snapshot`,a);if(o&&`resolvedConnections`in o){let t=z(e.config,o.resolvedConnections);if(!t.warnings.length)return{...t,tokens:{...t.tokens,...n},saved:!0}}let s=await vh(e,t.task,n,r,i);return s.warnings.length||await e.store.withAppLock(`connections:${t.task.id}`,async n=>{let r=await n.get(`task`,t.task.id);if(!r||[`completed`,`failed`,`cancelled`].includes(r.status)||r.attempts!==t.attempts||(r.generation??0)!==(t.generation??0))return;let i=(t.startedAt??(e.now??Date.now)())+(e.config.taskTimeoutMs??36e5);await n.put(`snapshot`,a,{resolvedConnections:R(e.config,s),expiresAt:i},{ttlMs:Math.max(1,i-(e.now??Date.now)())})}),{...s,saved:!1}}function Oh(e,t,n){let r=(e.now??Date.now)()+(e.config.taskTimeoutMs??36e5);return[...new Set(n)].filter(e=>e.length>=8).map(n=>({id:`connection-secrets:${t}:${Pr(`sha256`).update(n).digest(`hex`).slice(0,24)}`,value:R(e.config,n),expiresAt:r}))}async function kh(e,t,n){let r=Oh(e,t,n);return r.length&&await e.store.saveTaskSecrets(t,r),[...new Set(n)].filter(e=>e.length>=8)}async function Ah(e,t){let n=[],r=[...new Set(t.connections??[])],i=r.length?await e.store.list(`connection`,{ids:r,visibleTo:t.requestedBy,secrets:`all`}):[],a=r.some(e=>!i.some(t=>t.id===e))?await Fm(e,t.requestedBy):[],o=new Map([...a.map(e=>[e.id,e]),...i.map(({id:e,value:t})=>[e,t])]);for(let t of r){let r=o.get(t);if(r?.provider===`env`){n.push(...await hh(e,r).then(e=>[e],()=>[]));continue}if(!r?.secret)continue;let i=z(e.config,r.secret);n.push(...typeof i==`string`?[i]:[...`token`in i&&typeof i.token==`string`?ph(i.token):[],i.key,i.accessToken,i.refreshToken,i.clientSecret].filter(e=>!!e))}return n}async function jh(e,t){let[n,r,i]=await Promise.all([e.store.get(`snapshot`,`connection-secrets:${t.id}`),e.store.list(`snapshot`,{prefix:`connection-secrets:${t.id}:`}),Ah(e,t)]);if(n)throw Error(`Task ${t.id} keeps its secrets in the old single-row layout`);let a=r.flatMap(t=>`secret`in t.value?[z(e.config,t.value.secret)]:[]);return[...new Set([...a,...i])]}async function Mh(e,t){await e.withAppLock(`connections:${t}`,async e=>{await e.delete(`snapshot`,`connection-secrets:${t}`);for(let n of[`connection-secrets:${t}:`,`connections:${t}:`])for(let t of await e.list(`snapshot`,{prefix:n}))await e.delete(`snapshot`,t.id)})}function Nh(e,t=Date.now()){let n=e.status===`running`||e.status===`waiting`?t:e.finishedAt??e.updatedAt;return{lastActivityAt:Math.max(e.updatedAt,e.lastSeenAt??0),lastTurnMs:e.startedAt===void 0?0:Math.max(0,n-e.startedAt)}}const Ph=e=>({[e.key.slice(0,e.key.indexOf(`:`))]:e.through});var Fh=class extends Error{};const Z=[`queued`,`running`,`waiting`];function Ih(e,t){if(t.since!==void 0&&(e.updatedAt<t.since||e.updatedAt===t.since&&(!t.sinceId||e.task.id<=t.sinceId)))return!1;let n=t.status?[t.status]:t.statuses;if(t.status===`waiting`){if(!Qt(e.status,e.approvals??e.task.context?.approvals))return!1}else if(n&&!n.includes(e.status))return!1;if(t.agent&&e.task.agent!==t.agent||t.source&&e.task.source!==t.source||t.parent&&e.task.parent!==t.parent||t.runnerId&&e.task.runnerId!==t.runnerId||t.archived!==void 0&&t.archived!==(e.archivedAt!==void 0)||!us(t.viewer,e.task))return!1;let r=t.q?.trim().toLowerCase();return!r||[e.task.prompt??e.task.event?.text,e.task.agent,e.task.id].some(e=>e?.toLowerCase().includes(r))}const Lh=e=>({rank:$t(e.status),createdAt:e.createdAt,id:e.task.id}),Rh=e=>({updatedAt:e.updatedAt,id:e.task.id}),zh=(e,t)=>e.updatedAt-t.updatedAt||tn(e.task.id,t.task.id),Bh=(e,t)=>rn(Lh(e),Lh(t)),Vh=(e,t)=>!t||(`updatedAt`in t?e.updatedAt>t.updatedAt||e.updatedAt===t.updatedAt&&e.task.id>t.id:rn(Lh(e),t)>0);function Hh(e){let t=e.event;return JSON.stringify([t?.appId,t?.installationId,t?.chat?.thread.id,e.agent])}function Uh(e,t){return e.flow==="default"&&!!e.event?.chat&&Hh(e)===Hh(t)}function Wh(e){let t=e.event;if(e.flow!==`review`||!t)return;let n=pt[t.integration]?.repos?.pullRequest(t);if(n!==void 0)return JSON.stringify([t.appId,t.installationId,t.repo?.owner,t.repo?.name,n])}const Gh=6e5;async function Kh(e,t){let n=t.task.id,r={generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,handle:t.handle??null};return e.queue.deleteTask(e.organizationId,n,r)}const qh=(e,t)=>({...e,context:{...e.context,approvals:Yt(e.context?.approvals??[],t)}}),Jh=(e,t)=>({...e,context:{...e.context,admissions:{...e.context?.admissions,...t}}});async function Yh(e,t,n,r,i,a){let o=t.task.id,s=await e.queue.appendInbox(e.organizationId,o,n,r,(e.now??Date.now)(),t.generation??0,i,a);return s&&await eg(e,o,t.task,t),s}async function Xh(e,t,n=-1,r){return r??=(await e.store.get(`task`,t))?.generation??0,e.queue.readInbox(e.organizationId,t,r,n)}const Zh=new Set([`completed`,`failed`,`cancelled`]);var Qh=class{store;lock=Promise.resolve();tombstones=new Map;spaces=new Map;constructor(e){this.store=e}async metrics(e,t){let n=await this.list(e),r={queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0};for(let e of n)e.createdAt>=t&&r[e.status]++;return{tasks:r,queueDepth:n.filter(e=>e.status===`queued`).length}}serial(e){let t=this.lock.then(e,e);return this.lock=t.catch(()=>{}),t}async read(e){return this.store.get(`task`,e)}async enqueue(e,t,n,r,i){return this.serial(()=>this.insert(t,n,r,i))}async insert(e,t,n,r){let i=n&&await this.store.get(`delivery`,n.key);if(i&&!i.pending)return!1;e=i?.pending?.task??e;let a=await this.read(e.id);if(!a&&r!==void 0&&(await this.store.list(`task`)).filter(e=>e.value.status===`queued`).length>=r)throw Error(`Organization task queue is full`);return n&&!i?.pending?.task&&await this.store.put(`delivery`,n.key,{at:t,...n.owner?{owner:n.owner}:{},pending:{task:e}}),a||await this.store.put(`task`,e.id,{task:{...e,...ss(e)},status:`queued`,attempts:0,createdAt:t,updatedAt:t}),n&&await this.store.put(`delivery`,n.key,{at:t},{ttlMs:n.ttlMs}),!0}async nextSeq(e){let t=await this.store.list(`inbox`,{prefix:`${e}:`}),n=(await this.store.list(`delivery`)).flatMap(t=>t.value.pending?.inbox?.id.startsWith(`${e}:`)?[t.value.pending.inbox.entry.seq]:[]);return Math.max((await this.read(e))?.inboxSeq??-1,...t.map(e=>e.value.seq),...n)+1}async admit(e,t,n){if(!t)return;let{conversation:r,unseen:i}=t;r&&await this.store.putMany(`delivery`,[{id:r.key,value:r.record},{id:r.root,value:{at:r.record.at}}],{ttlMs:r.ttlMs}),i&&await this.store.acknowledgeUnseen(i.key,i.version,i.epoch);for(let e of t.secrets??[])await this.store.put(`snapshot`,e.id,{secret:e.value,expiresAt:e.expiresAt},{ttlMs:Math.max(1,e.expiresAt-n)})}deliver(e,t,n,r,i,a,o=!0,s){return this.serial(async()=>{let c=await this.store.get(`delivery`,r.key);if(c&&!c.pending)return{};if(c?.pending?.inbox){let{taskId:e,id:i,entry:a}=c.pending.inbox,o=await this.read(e);if(o&&Z.includes(o.status)&&(o.generation??0)===a.generation&&Uh(o.task,t))return await this.store.put(`task`,e,{...o,inboxSeq:Math.max(o.inboxSeq??-1,a.seq),updatedAt:n}),await this.store.put(`inbox`,i,a),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0};await this.store.delete(`delivery`,r.key),c=void 0}let l=i!==void 0&&!c?.pending?.task?(await this.list(e,{statuses:Z,agent:t.agent,source:t.source})).find(e=>Uh(e.task,t)):void 0;if(!l)return!o||!await this.insert(t,n,r,a)?{}:(await this.admit(t,s,n),{taskId:t.id});let u=await this.nextSeq(l.task.id),d={seq:u,generation:l.generation??0,at:n,kind:`steer`,value:{text:i,asker:t.context?.asker??null}},f=`${l.task.id}:${String(u).padStart(8,`0`)}`;return await this.store.put(`delivery`,r.key,{at:n,pending:{inbox:{taskId:l.task.id,id:f,entry:d}}}),await this.store.put(`task`,l.task.id,{...l,inboxSeq:u,updatedAt:n}),await this.store.put(`inbox`,f,d),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0}})}claim(e,t){return this.serial(async()=>{let n=(await this.store.list(`task`)).map(e=>e.value);if(t!==void 0&&n.filter(e=>[`running`,`waiting`].includes(e.status)).length>=t)return;let r=new Set(n.filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>Wh(e.task)).filter(e=>e!==void 0)),i=n.filter(e=>{let t=Wh(e.task);return e.status===`queued`&&(t===void 0||!r.has(t))}).sort((e,t)=>e.createdAt-t.createdAt),a=i[0];if(!a)return;let o=Qo(a.task.id,`default`,a.attempts+1),s={...a,tokenHash:o.hash,lastSeenAt:e,status:`running`,attempts:a.attempts+1,startedAt:e,updatedAt:e};await this.store.put(`task`,s.task.id,s);let c=Wh(a.task);return{organizationId:`default`,status:s,token:o.token,more:i.some(e=>e!==a&&(c===void 0||Wh(e.task)!==c))&&(t===void 0||n.filter(e=>[`running`,`waiting`].includes(e.status)).length+1<t)}})}allowed(e,t){return(t.generation===void 0||(e.generation??0)===t.generation)&&(t.attempts===void 0||e.attempts===t.attempts)&&(t.tokenHash===void 0||(e.tokenHash??null)===t.tokenHash)&&(t.handle===void 0||(e.handle??null)===t.handle)&&(t.lastSeenAt===void 0||(e.lastSeenAt??null)===t.lastSeenAt)&&(t.updatedAt===void 0||e.updatedAt===t.updatedAt)&&(!t.statuses||t.statuses.includes(e.status))&&(t.unanswered===void 0||!e.task.context?.approvals?.find(e=>e.id===t.unanswered)?.response)}touch(e,t,n,r,i,a=!1){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{tokenHash:n,attempts:r})||!a&&Zh.has(e.status)||e.status===`queued`)return;if(Zh.has(e.status))return e;let o={...e,lastSeenAt:i};return await this.store.put(`task`,t,o),o})}async authorize(e,t,n,r,i,a={}){let o=await this.touch(r,e,t,n,i,a.allowCompleted);return o&&{organizationId:`default`,status:o}}async archiveStopped(e,t,n){let r=e=>e!==void 0&&Zh.has(e.status)&&e.archivedAt===void 0&&(!n||n.includes(e.task.id))&&he(e.finishedAt??e.updatedAt,t);for(let{value:e}of await this.store.list(`task`))r(e)&&await this.serial(async()=>{let n=await this.read(e.task.id);r(n)&&await this.store.put(`task`,n.task.id,{...n,archivedAt:t,updatedAt:t,autoArchived:!0})})}patchTask(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,i))return!1;let{answer:a,approvals:o,resolvedModel:s,...c}=n,l=s?{...e.task,usage:{...e.task.usage,resolvedModel:s}}:e.task;return await this.store.put(`task`,t,{...e,task:l,...Object.hasOwn(n,`handle`)&&n.handle!==e.handle?{logsComplete:void 0}:{},...c,...a===void 0?{}:{answer:[...e.answer??[],a]},...o?{task:qh(l,o)}:{},updatedAt:r}),!0})}setRequestedBy(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);if(!e||e.task.requestedBy)return!1;let i={...e.task,requestedBy:n};return i.audience===`dm:`&&(i.audience=`dm:${n}`),await this.store.put(`task`,t,{...e,task:i,updatedAt:r}),!0})}deleteTask(e,t,n){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,n)?!1:(await this.store.delete(`task`,t),this.tombstone(t,ss(e.task).audience,e.task.requestedBy),await Mh(this.store,t),!0)})}continueTask(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!e||!Zh.has(e.status)||!this.allowed(e,i))return!1;let a=n.context&&{...n.context,approvals:Yt(n.context.approvals??[],e.task.context?.approvals??[])};return await this.store.put(`task`,t,{task:{...e.task,...n,...a?{context:a}:{}},status:`queued`,attempts:0,logSeq:e.logSeq,logBytes:e.logBytes,generation:(e.generation??0)+1,inboxSeq:e.inboxSeq,createdAt:e.createdAt,updatedAt:r},{unarchive:!0}),!0})}completeTask(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]}))return!1;await this.store.put(`usage`,`${t}:${e.generation??0}`,n.usage);for(let n of await this.store.list(`inbox`,{prefix:`${t}:`}))n.value.generation===(e.generation??0)&&await this.store.delete(`inbox`,n.id);await this.store.put(`task`,t,{...e,...n.outcome,...n.logsComplete?{logsComplete:!0}:{},lastSeenAt:r,finishedAt:r,updatedAt:r});for(let e of n.known??[])await this.store.put(`delivery`,e.id,{at:r},{ttlMs:e.ttlMs});return await Mh(this.store,t),!0})}requeue(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...r,statuses:[`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,status:`queued`,handle:void 0,tokenHash:void 0,lastSeenAt:void 0,updatedAt:n}),!0)})}finish(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...i,statuses:[`queued`,`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,...n,lastSeenAt:r,finishedAt:r,updatedAt:r}),await Mh(this.store,t),!0)})}cancel(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);if(!e||Zh.has(e.status)||!this.allowed(e,r))return!1;let i=e.status===`queued`?void 0:{seq:await this.nextSeq(t),generation:e.generation??0,kind:`cancel`,value:null,at:n};return i&&await this.store.put(`inbox`,`${t}:${String(i.seq).padStart(8,`0`)}`,i),await this.store.put(`task`,t,{...e,...e.status===`queued`?{status:`cancelled`,error:ae,finishedAt:n}:{},cancelRequestedAt:n,...i?{inboxSeq:i.seq}:{},updatedAt:n}),e.status===`queued`&&await Mh(this.store,t),!0})}async cancelRequested(e,t){return(await this.read(t))?.cancelRequestedAt!==void 0}async list(e,t={}){let{before:n}=t;return(await this.store.list(`task`)).map(e=>e.value).filter(e=>Ih(e,t)).filter(e=>Vh(e,n)).sort(t.since===void 0?Bh:zh).slice(0,t.limit)}tombstone(e,t,n){this.tombstones.set(e,{at:Date.now(),...t===void 0?{}:{audience:t},...n===void 0?{}:{requestedBy:n}})}async memberSpaces(){return[]}async listedSpaces(){return[]}async linkedMembers(){return[]}async spaceSynced(e,t){return this.spaces.get(H(t))?.syncedAt}async claimSpace(e,t,n,r=!1){let i=H(t),a=this.spaces.get(i)??{members:new Set};return!r&&a.claimedAt!==void 0&&n-a.claimedAt<6e4?!1:(this.spaces.set(i,{...a,claimedAt:n}),!0)}async saveSpaceMembers(e,t,n,r){let i=H(t),a=this.spaces.get(i)??{members:new Set};a.claimedAt===r&&this.spaces.set(i,n?{syncedAt:r,members:new Set(n)}:{...a,claimedAt:void 0})}async spaceChanged(e,t,n,r){let i=H(t),a=this.spaces.get(i);a&&(n.joined||n.left)&&this.spaces.set(i,{...a,claimedAt:void 0});let o=a?.members;if(n.joined&&o?.add(n.joined),n.left&&o?.delete(n.left),n.private===void 0)return;let s=n.private?`space:${i}`:``;for(let{value:e}of await this.store.list(`task`)){let t=e.task;if(t.space!==i||t.audience?.startsWith(`dm:`))continue;let a=t.event?.space?{...t.event,space:{...t.event.space,private:n.private}}:t.event;await this.store.put(`task`,t.id,{...e,task:{...t,audience:s,...a?{event:a}:{}},updatedAt:r})}this.spaces.delete(i)}async changes(e,t){let n=e[0]?.organizationId;if(!n)return{rows:[],deleted:[]};for(let[e,{at:t}]of this.tombstones)t<Date.now()-6e5&&this.tombstones.delete(e);return{rows:(await this.store.list(`task`)).map(e=>({organizationId:n,status:e.value})),deleted:[...this.tombstones].filter(([,{at:e}])=>e>t).map(([e,t])=>({organizationId:n,id:e,...t}))}}async logTails(e,t){let{readLog:n}=await Promise.resolve().then(()=>_s);return Promise.all(e.map(async({id:e,after:r})=>{let i=await this.store.get(`task`,e);return i&&{status:i,lines:await n(this.store,e,r,t)}}))}async counts(e,t={}){let n=(await this.store.list(`task`)).map(e=>e.value).filter(e=>Ih(e,t));return{all:n.length,active:n.filter(e=>Z.includes(e.status)).length,waiting:n.filter(e=>Qt(e.status,e.task.context?.approvals)).length}}async runningCount(){return(await this.store.list(`task`)).filter(e=>[`running`,`waiting`].includes(e.value.status)).length}async activeCounts(){let e=new Map;for(let{value:t}of await this.store.list(`task`)){if(t.archivedAt!==void 0||!Z.includes(t.status))continue;let{audience:n}=t.task,r=`${n??null}\n${t.task.requestedBy??``}`,i=e.get(r)??{...n===void 0?{}:{audience:n},...t.task.requestedBy?{requestedBy:t.task.requestedBy}:{},active:0};e.set(r,{...i,active:i.active+1})}return[...e.values()]}async running(){return(await this.store.list(`task`)).map(e=>e.value).filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>({organizationId:`default`,status:e}))}appendLogs(e,t,n,r,i,a,o){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,o)||(e.logSeq??0)!==r.seq||(e.logCursor??-1)!==r.cursor?!1:(await this.store.putMany(`tasklog`,n.map(({seq:e,...n})=>({id:`${t}:${String(e).padStart(6,`0`)}`,value:n}))),await this.store.put(`task`,t,{...e,logCursor:i.cursor,logSeq:i.seq,logBytes:i.bytes}),!0)})}readInbox(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);return!e||!Z.includes(e.status)||(e.generation??0)!==n?[]:(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(e=>e.generation===n&&e.seq>r).slice(0,100)})}fetchInbox(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!(!e||!this.allowed(e,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})))return(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(t=>t.generation===(e.generation??0)&&t.seq>i).sort((e,t)=>e.seq-t.seq)})}ackInbox(e,t,n,r){return this.serial(async()=>{if(r.generation!==void 0&&r.generation!==n.generation)return;let e=await this.read(t);if(!e||!this.allowed(e,{...r,generation:n.generation,statuses:void 0})||n.seq>(e.inboxSeq??-1))return;let i=e.inboxAck?.generation===n.generation?e.inboxAck.seq:-1;if(Zh.has(e.status))return n.seq<=i?e.status:void 0;if(![`running`,`waiting`].includes(e.status))return;let a=(await this.store.list(`inbox`,{prefix:`${t}:`})).filter(e=>e.value.generation===n.generation&&e.value.seq<=n.seq),o=(n.answers??[]).filter(e=>e.seq>i&&a.some(t=>t.value.kind===`ask`&&t.value.seq===e.seq)).map(e=>e.value),s=a.some(e=>e.value.kind===`cancel`),c=e.approval?.id,l=c&&a.some(e=>e.value.kind===`approve`&&e.value.value?.approvalId===c),u=Object.assign({},...a.map(e=>e.value.value?.admissions)),d={...e,...Object.keys(u).length?{task:Jh(e.task,u)}:{},inboxAck:{generation:n.generation,seq:Math.max(i,n.seq)},...o.length?{answer:[...e.answer??[],...o]}:{},...l?{status:`running`,approval:void 0}:{},...s?{status:`cancelled`,error:ae,finishedAt:Date.now()}:{},updatedAt:Date.now()};await this.store.put(`task`,t,d);for(let e of a)await this.store.delete(`inbox`,e.id);return s&&await Mh(this.store,t),d.status})}async pendingInbox(e){let t=await this.store.list(`inbox`);return(await this.running()).filter(({status:e})=>t.some(t=>t.id.startsWith(`${e.task.id}:`)&&t.value.generation===(e.generation??0)))}appendInbox(e,t,n,r,i,a,o,s){let c=async()=>{if(o&&(await this.store.get(`delivery`,o.key))?.sending?.owner!==o.owner)throw new Fh;let e=await this.read(t);if(!e||!Z.includes(e.status)||(e.generation??0)!==a)return;for(let t of s??[]){let n=Jt(e.task.context?.approvals?.find(e=>e.id===t.id),t);if(n)throw new Ut(n)}let c=await this.nextSeq(t),l=o&&Ph(o),u={seq:c,generation:a,at:i,kind:n,value:l?{...r,admissions:l}:r};await this.store.put(`inbox`,`${t}:${String(c).padStart(8,`0`)}`,u);let d=e.task;return l&&(d=Jh(d,l)),s&&(d=qh(d,s)),await this.store.put(`task`,t,{...e,task:d,inboxSeq:c,updatedAt:i}),o&&await this.store.finishBatch(o.key,o.owner,!0,o.through),u};return this.serial(()=>o?this.store.withAppLock(`batch:${o.key}`,c):c())}};const $h=3e4;function eg(e,t,n,r){if(n&&!e.local&&!n.runnerId&&!e.runners[n.runner]?.push)return Promise.resolve();let i=e.queue.inboxDelivery??=new Map,a=JSON.stringify([e.organizationId,t]),o=i.get(a);if(o||i.set(a,o={}),o.work)return o.again=!0,o.work;let s=o,c=async()=>{let n,i=L(),a=0,o=0,c,l=r,u=async()=>{for(;;){s.again=!1;let r=l??await e.store.get(`task`,t);if(l=void 0,!r?.handle||![`running`,`waiting`].includes(r.status))return;let c=await za(e,r.task),u=!!(e.local&&r.handle.startsWith(`cli:`));if(!u&&!c?.push)return;o=r.generation??0;let d={generation:o,attempts:r.attempts,tokenHash:r.tokenHash??null,handle:r.handle},f=`inbox:${JSON.stringify([t,d])}`;if(n!==f){n&&await e.store.updateDeliveryLease(n,i),n=void 0;let t=await e.store.claimDeliveryLease(f,i,$h);if(t===void 0)return;n=f,a=t}else if(!await e.store.updateDeliveryLease(n,i,{owner:i,failures:a},{ttlMs:$h}))return;let p=(await e.queue.readInbox(e.organizationId,t,r.generation??0,-1)).slice(0,100);if(!p.length){if(s.again)continue;return}let m=u?await _p(e,r,p):await c.push(r.handle,p);if(m.generation!==(r.generation??0)||!p.some(e=>e.seq===m.seq))throw Error(`Invalid inbox acknowledgement`);if(!await e.queue.ackInbox(e.organizationId,t,m,d)||(a=0,p.length<100&&!s.again))return}};try{await u()}catch(r){if(console.error(`coder server: inbox delivery failed for ${t}`,r),n){let t=Math.min(3e4,1e3*2**Math.min(a,5)),r={owner:i,failures:a+1,next:(e.now??Date.now)()+t};await e.store.updateDeliveryLease(n,i,r,{ttlMs:t}),n=void 0}}finally{n&&(await e.store.updateDeliveryLease(n,i),c=o)}return c};return s.work=(async()=>{for(;;){let n=await c();if(n===void 0||!(await e.queue.readInbox(e.organizationId,t,n,-1)).length&&!s.again)break}i.delete(a)})().finally(()=>{i.get(a)===s&&i.delete(a)}),s.work}async function tg(e,t){let n=await e.queue.pendingInbox(t);await Promise.allSettled(n.map(({organizationId:t,status:n})=>eg(B(e,t),n.task.id)))}function ng(e,t){let n=tg(e,t).catch(e=>console.error(`coder server: inbox flush failed`,e));e.waitUntil&&e.waitUntil(n)}function rg(){return(process.env.PATH??``).split(P.delimiter).some(e=>{try{let t=P.join(e,`docker`);return Sr(t,Cr.X_OK),Er(t).isFile()}catch{return!1}})}function ig(e){let t=!!e.local,n=t&&rg();return[{kind:`local`,name:t?`Another machine`:`Your machine`,description:t?`Pair another computer; it runs tasks with its own logins.`:`Run tasks with your own machine and logins.`,connect:`pair`,fields:[],available:!0},{kind:`local-docker`,name:`Docker on the server`,description:`Run each task in a Docker container.`,connect:`fields`,help:`Each task runs in a fresh container on this server, using the Docker installed here. Leave fields empty for the defaults.`,fields:[{key:`image`,label:`Image`,placeholder:qn,hint:`Needs Bun, Node, Git, curl, tar, Claude Code, Codex and GitHub MCP server.`,optional:!0},{key:`memory`,label:`Memory limit`,placeholder:`4g`,optional:!0},{key:`cpus`,label:`CPU limit`,placeholder:`2`,optional:!0}],available:n,...n?{}:{reason:t?`Docker is not on PATH.`:`Available on a local server only.`}},{kind:`vercel-sandbox`,name:`Vercel Sandbox`,description:`Run tasks in an isolated sandbox.`,connect:`fields`,help:`Each task gets a fresh Vercel Sandbox. Create an access token at vercel.com/account/tokens with Sandbox access for the team that pays for it.`,fields:[{key:`token`,label:`Access token`,placeholder:`vcp_…`,hint:`with Sandbox access`,secret:!0},{key:`team`,label:`Team`,placeholder:`team_…`,hint:`VERCEL_TEAM_ID if empty`,optional:!0},{key:`projectId`,label:`Project`,placeholder:`prj_…`,hint:`VERCEL_PROJECT_ID if empty`,optional:!0},{key:`region`,label:`Region`,placeholder:`iad1`,hint:`nearest if empty`,optional:!0}],available:!0},{kind:`github-actions`,name:`GitHub Actions`,description:`Run tasks through a repository workflow.`,connect:`fields`,help:`Each task starts a workflow run in a repository you choose. Save coder server workflow as .github/workflows/coder-agent.yml. It runs coder agent run --task; the token needs Actions read and write on that repository.`,fields:[{key:`repo`,label:`Repository`,placeholder:`acme/runners`,hint:`owner/name`},{key:`workflow`,label:`Workflow file`,placeholder:`coder-agent.yml`,hint:`in .github/workflows`},{key:`token`,label:`Token`,placeholder:`github_pat_…`,hint:`Actions read and write`,secret:!0},{key:`ref`,label:`Branch`,placeholder:`main`,hint:`default branch if empty`,optional:!0}],available:!0},{kind:`http`,name:`HTTP runner`,description:`Connect a runner at a public HTTPS address.`,connect:`fields`,help:`A machine already running coder runner serve. Copy the address and secret it printed; pairing from the Another machine or Your machine option does this for you.`,fields:[{key:`url`,label:`Address`,placeholder:`https://runner.example.com`,hint:`its https address`},{key:`secret`,label:`Secret`,placeholder:`printed by coder runner serve`,hint:`32 characters or more`,secret:!0}],available:!0}]}const ag=c().check(u(1),d(80)),og=s([`personal`,`workspace`]),sg=n(c(),c()),cg=e({kind:s([`local`,`local-docker`,`github-actions`,`vercel-sandbox`,`http`]),name:ag,scope:og,config:sg}),lg=e({name:i(ag),default:i(p(!0)),config:i(sg)});function ug(e,t,n,r=t.default){return{id:e,kind:t.kind,name:t.name,scope:t.scope,default:r,online:t.lastSeen!==void 0&&n-t.lastSeen<3e5,...t.lastSeen===void 0?{}:{lastSeen:t.lastSeen},config:t.config,createdAt:t.createdAt}}const dg=(e,t)=>({value:n})=>Fa(n,t)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`);function fg(e){let t=e.session?.user.id,n=(e.now??Date.now)(),r=n=>n===`workspace`?d_(e):!!t,i=async(n=e.store)=>(await n.list(`runner`)).filter(dg(e,t));return{user:t,now:n,canCreate:r,rows:i,row:async(t,r,a=e.store)=>{let o=(await i(a)).some(({value:e})=>e.scope===`personal`&&e.default);return ug(t,r,n,r.default&&(r.scope===`personal`||!o))}}}async function pg(e,t,n,r){return O({items:mg(t,await t.store.list(`runner`),(t.now??Date.now)()),catalog:ig(t)})}function mg(e,t,n){let r=t.filter(dg(e,e.session?.user.id)),i=r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.default);return[{id:Ia(e),kind:e.config.runner,name:e.local?`This machine`:`Default runner`,scope:`workspace`,default:!i,online:!0,config:{},createdAt:0},...r.map(({id:e,value:t})=>ug(e,t,n,e===i?.id))]}async function hg(e,t,n,r){let{user:i,now:a,canCreate:o,row:s}=fg(t);{let n=cg.safeParse(await e.json().catch(()=>void 0));if(!n.success)return O({error:`Invalid runner`},400);if(!o(n.data.scope))return O({error:`This scope requires a member or workspace admin.`},403);let r=ig(t).find(e=>e.kind===n.data.kind);if(!r.available||r.connect===`pair`)return O({error:r.reason??`Pair this runner with runner serve.`},400);try{Og(r,n.data.config)}catch(e){return O({error:e.message},400)}let c=bg(n.data.kind,n.data.config,t),l=`rnr_${I(9).toString(`base64url`)}`,u={...n.data,...c,owner:n.data.scope===`personal`?i:void 0,createdBy:i,default:!1,createdAt:a,updatedAt:a};return await t.store.put(`runner`,l,u),O(await s(l,u))}}async function gg(e,t,n,r){let i=n.id,{user:a}=fg(t);if(i===Ia(t))return O(await kg(t));let o=e=>{if(!e||!Fa(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return O({error:`Unknown runner`},404);if(e.scope===`workspace`&&!d_(t))return O({error:`Only a workspace owner or admin can change this runner.`},403)},s=await t.store.get(`runner`,i),c=o(s);if(c)return c;let l=await kg(t,s);return await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i);n&&n.secret===s.secret&&JSON.stringify(n.config)===JSON.stringify(s.config)&&await e.put(`runner`,i,{...n,lastSeen:l.ok?(t.now??Date.now)():void 0,updatedAt:(t.now??Date.now)()})}),O(l)}async function _g(e,t,n,r){for(let i of await e.list(`runner`))i.id!==t&&i.value.default&&i.value.scope===(n?.scope??`workspace`)&&i.value.owner===n?.owner&&await e.put(`runner`,i.id,{...i.value,default:!1,updatedAt:r})}async function vg(e,t,n,r){let i=n.id,{user:a,now:o,rows:s,row:c}=fg(t);if(i===Ia(t)){if(d_(t)){let n=lg.safeParse(await e.json().catch(()=>void 0));if(!n.success||!n.data.default||n.data.name||n.data.config)return O({error:`Only the default can change for the built-in runner.`},400);await t.store.withAppLock(`runners:${t.organizationId}`,e=>_g(e,i,void 0,o));let r=(await s()).some(({value:e})=>e.scope===`personal`&&e.default);return O({id:i,kind:t.config.runner,name:t.local?`This machine`:`Default runner`,scope:`workspace`,default:!r,online:!0,config:{},createdAt:0})}return O({error:`The server default cannot be renamed or removed.`},403)}let l=e=>{if(!e||!Fa(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return O({error:`Unknown runner`},404);if(e.scope===`workspace`&&!d_(t))return O({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async n=>{let r=await n.get(`runner`,i),a=l(r);if(a||!r)return a;{let a=lg.safeParse(await e.json().catch(()=>void 0));if(!a.success||!Object.keys(a.data).length)return O({error:`Invalid runner update`},400);let s={};if(a.data.config){let e={...r.config,...z(t.config,r.secret),...a.data.config};try{Og(ig(t).find(e=>e.kind===r.kind),e)}catch(e){return O({error:e.message},400)}s=bg(r.kind,e,t)}a.data.default&&await _g(n,i,r,o);let l={...r,...a.data.name?{name:a.data.name}:{},...a.data.default?{default:!0}:{},...s,updatedAt:o};return await n.put(`runner`,i,l),O(await c(i,l,n))}})}async function yg(e,t,n,r){let i=n.id,{user:a}=fg(t);if(i===Ia(t))return O({error:`The server default cannot be renamed or removed.`},403);let o=e=>{if(!e||!Fa(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return O({error:`Unknown runner`},404);if(e.scope===`workspace`&&!d_(t))return O({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i),r=o(n);if(r||!n)return r;{let{active:n}=await(e.queue?.()??t.queue).counts(t.organizationId,{statuses:Z,runnerId:i});return n?O({error:n===1?`1 task still runs on this runner. Stop it or wait.`:`${n} tasks still run on this runner. Stop them or wait.`},409):(await e.delete(`runner`,i),await e.delete(`snapshot`,Tg(i)),t.settings?.runnerInstances?.delete(i),O({ok:!0}))}})}function bg(e,t,n){let r=new Set(ig(n).find(t=>t.kind===e).fields.filter(e=>e.secret).map(e=>e.key)),i=Object.entries(t);return{config:Object.fromEntries(i.filter(([e])=>!r.has(e))),secret:R(n.config,Object.fromEntries(i.filter(([e])=>r.has(e))))}}const xg=e({name:i(ag),scope:og});async function Sg(e,t,n,r){let{user:i,now:a,canCreate:o}=fg(t),s=xg.safeParse(await e.json().catch(()=>void 0));if(!s.success)return O({error:`Invalid pairing`},400);if(!o(s.data.scope))return O({error:`This scope requires a member or workspace admin.`},403);let c=`${Buffer.from(t.organizationId).toString(`base64url`)}.${I(32).toString(`base64url`)}`,l=a+9e5;await t.store.put(`snapshot`,`runner-pair:${mt(c)}`,{...s.data,owner:s.data.scope===`personal`?i:void 0,createdBy:i,expiresAt:l},{ttlMs:9e5});let u=t.config.publicUrl??r.origin;return O({token:c,expiresAt:l,command:`coder runner serve --url ${u} --token ${c}`})}const Cg=e({token:i(c()),id:i(c()),organizationId:i(c()),name:i(c().check(u(1),d(80))),url:c(),secret:c().check(u(32)),offline:i(a()),removed:i(o(c()))});async function wg(e,t,n,r){let i=Cg.safeParse(await e.json().catch(()=>void 0));if(!i.success)return O({error:`Invalid runner registration`},400);let a=i.data;try{new ua({url:a.url,secret:a.secret})}catch{return O({error:`A public HTTPS runner URL is required`},400)}let o=a.token?Buffer.from(a.token.split(`.`)[0],`base64url`).toString():a.organizationId;if(!o||o!==t.organizationId&&!t.scope)return O({error:`Invalid runner token`},401);t=B(t,o);let s=(t.now??Date.now)(),c=await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n,r;if(a.token){let i=`runner-pair:${mt(a.token)}`,o=await e.get(`snapshot`,i);if(!o||o.expiresAt<=s||!await e.take(`snapshot`,i))return O({error:`Pairing token expired or already used`},401);r=`rnr_${I(9).toString(`base64url`)}`,n={kind:`http`,name:o.name??a.name??`Your machine`,scope:o.scope,owner:o.owner,createdBy:o.createdBy,default:!1,createdAt:s,updatedAt:s,...bg(`http`,{url:a.url,secret:a.secret},t),lastSeen:s}}else{r=a.id??``;let i=await e.get(`runner`,r);if(!i||i.kind!==`http`||!gt(z(t.config,i.secret).secret??``,a.secret))return O({error:`Invalid runner token`},401);n={...i,config:{...i.config,url:a.url},lastSeen:a.offline?void 0:s,updatedAt:s}}await e.put(`runner`,r,n);let i=a.token?[]:await Dg(e,r,a.removed);return O({...ug(r,n,s),organizationId:o,...i.length?{deleted:i}:{}})});return c.ok&&t.taskWatcher?.runnersChanged(t.organizationId),c}const Tg=e=>`runner-deleted:${e}`;async function Eg(e,t,n){if(t.runner!==`http`||!t.runnerId){await(await za(e,t))?.remove?.(t.id,n);return}let r=t.runnerId;await e.store.withAppLock(`runners:${e.organizationId}`,async e=>{let n=await e.get(`snapshot`,Tg(r));await e.put(`snapshot`,Tg(r),{deletedTasks:[...n?.deletedTasks??[],t.id]})})}async function Dg(e,t,n=[]){let r=await e.get(`snapshot`,Tg(t)),i=(r?.deletedTasks??[]).filter(e=>!n.includes(e));return!r||i.length===r.deletedTasks.length||(i.length?await e.put(`snapshot`,Tg(t),{deletedTasks:i}):await e.delete(`snapshot`,Tg(t))),i}function Og(e,t){if(Object.keys(t).some(t=>!e.fields.some(e=>e.key===t)))throw Error(`Unknown runner field`);for(let n of e.fields)if(!n.optional&&!t[n.key]?.trim())throw Error(`${n.label} is required`);e.kind===`http`&&fa(t),e.kind===`github-actions`&&Wn(t),e.kind===`local-docker`&&oa(t)}async function kg(e,t){let n=Date.now(),r=new AbortController,i,a=new Promise((t,n)=>{i=setTimeout(()=>{r.abort(),n(new Pa(`Runner check timed out`))},e.runnerTimeoutMs??5e3)});try{return{ok:!0,detail:await Promise.race([a,(async()=>{let n=t?.kind??e.config.runner,i=t?{...t.config,...z(e.config,t.secret)}:e.config.runnerConfig??{};if(n===`local`){if(!e.local)throw new Pa(`Local runners require a local server`);return`This machine is available`}if(n===`http`)return da(t?Ra(e,t):e.runners.http,r.signal);if(n===`local-docker`){if(!e.local)throw new Pa(`Docker runners require a local server`);return aa(e.runnerExec??Dr,r.signal)}let a=async t=>{let n=await(e.fetch??fetch)(t,{signal:r.signal,redirect:`manual`,headers:{authorization:`Bearer ${i.token}`,accept:`application/json`,"user-agent":`coder`}});if(!n.ok)throw new Pa(`Runner check failed with HTTP ${n.status}`);return n};return n===`github-actions`?Jn(i,a):Aa(i,a)})()]),ms:Date.now()-n}}catch(e){return{ok:!1,detail:e instanceof Pa?e.message:`Runner check failed`,ms:Date.now()-n}}finally{clearTimeout(i)}}var Ag=t({addTokens:()=>Ng,addUsage:()=>Fg,countTokens:()=>Mg,readUsage:()=>Wg,readUsageTotals:()=>Gg,sumUsageTotals:()=>Lg,timeZone:()=>Pg,usageSummary:()=>Bg,usageTarget:()=>jg,usageTotals:()=>Ig});function jg(e){let t=e.event;return t?t.repo?`${t.repo.owner}/${t.repo.name}`:t.chat?.thread.channelId??t.integration:e.source}function Mg(e){return typeof e==`number`?e:!e||typeof e!=`object`||Array.isArray(e)?0:`total`in e&&typeof e.total==`number`?e.total:Object.values(e).reduce((e,t)=>e+Mg(t),0)}function Ng(e,t){if(typeof t==`number`)return(typeof e==`number`?e:0)+t;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=e&&typeof e==`object`&&!Array.isArray(e)?{...e}:{};for(let[e,r]of Object.entries(t))n[e]=Ng(n[e],r);return n}function Pg(e){if(!e)return`UTC`;try{return new Intl.DateTimeFormat(`en`,{timeZone:e}),e}catch{return`UTC`}}const Fg=(e,t)=>{e.tasks+=t.tasks,e.runnerMs+=t.runnerMs,e.tokenCount+=t.tokenCount};async function Ig(e,t){return e.usageTotals(t)}async function Lg(e,t){if(t.top){let{top:n,...r}=t,i=(await Ig(e,{...r,by:`agent`,parts:void 0})).sort((e,t)=>t[n.by]-e[n.by]||e.key.localeCompare(t.key)).slice(0,n.count).map(e=>e.key);return Ig(e,{...r,parts:i})}let n=Pg(t.tz),r=new Intl.DateTimeFormat(`en-CA`,{timeZone:n,year:`numeric`,month:`2-digit`,day:`2-digit`}),i=new Set(t.parts),a=new Map;for(let{value:n}of await e.list(`usage`)){if(n.at<t.since||t.until!==void 0&&n.at>=t.until||t.agent&&n.agent!==t.agent)continue;let e=t.by===`agent`?n.agent:t.by===`installation`?n.installationId??`none`:t.by===`engine`?n.engine??`unknown`:r.format(n.at),o={tasks:1,runnerMs:n.runnerElapsedMs,tokenCount:Mg(n.tokens)},s=a.get(e)??{key:e,tasks:0,runnerMs:0,tokenCount:0};Fg(s,o),i.has(n.agent)&&(s.parts??={},Fg(s.parts[n.agent]??={tasks:0,runnerMs:0,tokenCount:0},o)),a.set(e,s)}return[...a.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Rg(e,t){let n=new Map;for(let r of e)for(let[e,i]of Object.entries(r.parts??{}))n.set(e,(n.get(e)??0)+i[t]);return[...n].sort((e,t)=>t[1]-e[1]||e[0].localeCompare(t[0])).map(([e])=>e)}function zg(e,t){let n=new Map;for(let r of e){let e=t===`agent`?r.agent:t===`installation`?r.installationId??`none`:r.engine??`unknown`,i=n.get(e)??{key:e,tasks:0,runnerMs:0};i.tasks++,i.runnerMs+=r.runnerElapsedMs,r.tokens!==void 0&&(i.tokens=Ng(i.tokens,r.tokens)),n.set(e,i)}return[...n.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Bg(e,t,n){let r=e.filter(e=>e.at>=t);return{since:t,totals:n?zg(r,n):{agent:zg(r,`agent`),installation:zg(r,`installation`),engine:zg(r,`engine`)}}}const Vg={tasks:`tasks`,runner:`runnerMs`,tokens:`tokenCount`},Hg={tokens:e=>e.tokenCount,tasks:e=>e.tasks,runner:e=>e.runnerMs,name:e=>e.key};async function Ug(e,t){let n=e=>t.searchParams.get(e),r=Number(n(`since`)??0),i=n(`until`)===null?void 0:Number(n(`until`)),a=n(`by`)??`agent`;if(!Number.isFinite(r)||i!==void 0&&!Number.isFinite(i)||![`agent`,`installation`,`engine`,`day`].includes(a))return O({error:`Invalid usage query`},400);let o=n(`parts`)?.split(`,`).filter(Boolean),s=Math.min(Number(n(`top`)??0),8),c=Vg[n(`sort`)??`tokens`]??`tokenCount`,l=await Ig(e.store,{by:a,since:r,...i===void 0?{}:{until:i},...n(`agent`)?{agent:n(`agent`)}:{},...a===`day`?{tz:Pg(n(`tz`))}:{},...o?.length?{parts:o.slice(0,20)}:{},...s>0?{top:{count:s,by:c}}:{}}),u={since:r,...i===void 0?{}:{until:i}};if(a===`agent`){let t=new Set(e.local?(await ot(e.local.cwd,e.integrations)).map(e=>e.id):(await e.store.list(`agent`)).map(e=>e.id));for(let e of Object.keys(st()))t.add(e);for(let e of l)t.has(e.key)||(e.deleted=!0)}if(s>0)return O({...u,totals:l,top:Rg(l,c)});if(!A(t)||a!==`agent`)return O({...u,totals:l});let d=Hg[n(`sort`)??`tokens`]??Hg.tokens,f=n(`sort`)===`name`,p=n(`q`)?.trim().toLowerCase(),m=([e,t],[n,r])=>(e<n?-1:+(e>n))*(f?1:-1)||t.localeCompare(r),h=e=>[d(e),e.key],g=Mn(t),_=l.filter(e=>!p||e.key.toLowerCase().includes(p)).filter(e=>!g||m(h(e),g)>0).sort((e,t)=>m(h(e),h(t))),v=k(t),y=e=>l.reduce((t,n)=>t+e(n),0);return O({...u,...Pn(_.slice(0,v+1),v,h),summary:{agents:l.length,tasks:y(e=>e.tasks),runnerMs:y(e=>e.runnerMs),tokenCount:y(e=>e.tokenCount)}})}async function Wg(e,t,n,r){t.local&&await Ep(t);let i=r.searchParams.get(`installation`),a=await t.store.list(`usage`,{limit:k(r,200),...i?{installation:i}:{}});return O(i?a.filter(e=>e.value.installationId===i):a)}async function Gg(e,t,n,r){t.local&&await Ep(t);let i=Number(r.searchParams.get(`since`)??0),a=r.searchParams.get(`by`);return[`until`,`agent`,`tz`,`parts`,`top`,`cursor`].some(e=>r.searchParams.has(e))||a===`day`?Ug(t,r):!Number.isFinite(i)||a&&![`agent`,`installation`,`engine`].includes(a)?O({error:`Invalid usage query`},400):O({since:i,totals:await t.store.usageSummary(i,a)})}async function Kg(e,t,n,r=!1,i){let a=g_(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=$o(a);return o.task!==n||o.organization!==t.organizationId||!Number.isInteger(o.attempt)?new Response(`Unauthorized`,{status:401}):await t.queue.authorize(n,Zo(a),o.attempt,t.organizationId,(t.now??Date.now)(),{allowCompleted:r,include:i})??new Response(`Unauthorized`,{status:401})}async function qg(e,t,n,r){let i=n.id,a=g_(e),o=$o(a),s=Zo(a),c=Number(r.searchParams.get(`after`)??-1);if(!Number.isInteger(c)||c<-1)return O({error:`Invalid cursor`},400);let l=await t.queue.fetchInbox(t.organizationId,i,s,o.attempt,c);return l?O(l):new Response(`Unauthorized`,{status:401})}async function Jg(e,t,n,r){let i=n.id,a=g_(e),o=$o(a),s=Zo(a),c=await e.json().catch(()=>void 0);if(!c||!Number.isInteger(c.seq)||c.seq<-1||!Number.isInteger(c.generation)||c.generation<0||c.answers!==void 0&&(!Array.isArray(c.answers)||c.answers.some(e=>!e||!Number.isInteger(e.seq)||e.seq<0||e.seq>c.seq)))return O({error:`Invalid acknowledgement`},400);let l={tokenHash:s,attempts:o.attempt,generation:c.generation},u=await t.queue.ackInbox(t.organizationId,i,c,l);if(u===`cancelled`){let e=await t.store.get(`task`,i);e&&await Ll(t,e)}return u?O({ok:!0}):new Response(`Unauthorized`,{status:401})}async function Yg(e,t,n){let r=(await e.json().catch(()=>void 0))?.entries;if(!Array.isArray(r)||r.length>100||r.some((e,t)=>!e||!Number.isSafeInteger(e.seq)||e.seq<0||!Number.isSafeInteger(e.at)||e.at<0||![`out`,`err`].includes(e.level)||typeof e.line!=`string`||Buffer.byteLength(e.line)>65536||t>0&&e.seq!==r[t-1].seq+1))return O({error:`Invalid task logs`},400);let i=await Cs(t,t.callbackTask,r);return i===`ok`?O({ok:!0}):i===`gap`?O({error:`Task log sequence has a gap`},409):new Response(`Unauthorized`,{status:401})}async function Xg(e,t,n,r){let i=n.id,a=g_(e),o=$o(a),s=Zo(a);return await t.queue.touch(t.organizationId,i,s,o.attempt,(t.now??Date.now)())?O({ok:!0}):new Response(`Unauthorized`,{status:401})}async function Zg(e,t,n,r){let i=n.id,a=t.callbackTask,o=a.handle?await za(t,a.task):void 0;if([`completed`,`failed`,`cancelled`].includes(a.status))return await Ll(t,a,!1,o),O({ok:!0});let s=await e.json().catch(()=>void 0);if(!s?.status||![`running`,`waiting`,`completed`,`failed`,`cancelled`].includes(s.status)||s.installationRevoked!==void 0&&s.installationRevoked!==!0||s.machine!==void 0&&s.machine!==!0||s.approvals!==void 0&&(!Array.isArray(s.approvals)||s.approvals.some(e=>typeof e?.id!=`string`))||s.postedMessages!==void 0&&(!Array.isArray(s.postedMessages)||s.postedMessages.some(e=>typeof e!=`string`)))return O({error:`Invalid task result`},400);s.approvals=s.approvals?.map(({change:e,...t})=>t);let c=await Ss(t,a,!0);Object.assign(s,JSON.parse(JSON.stringify(s,(e,t)=>typeof t==`string`?c(t):t)));let l=(t.now??Date.now)(),u=a.task.event?pc(a.task.event,s.postedMessages??[]):[];if(s.status===`running`||s.status===`waiting`)return u.length&&(await mc(t,a.task.event,s.postedMessages,l),$g(t,a)),await t.queue.patchTask(t.organizationId,i,{status:s.status,lastSeenAt:l,...s.approval===void 0?s.status===`running`?{approval:void 0}:{}:{approval:s.approval},...s.answer===void 0?{}:{answer:s.answer},...s.approvals?{approvals:s.approvals}:{},...s.fallbacks?{fallbacks:s.fallbacks}:{},...s.model?{resolvedModel:Ee(s.model).model??s.model}:{}},l,{attempts:a.attempts,tokenHash:a.tokenHash,statuses:[`running`,`waiting`]}),s.approvals&&await Qg(t,i),O({ok:!0});s.approvals&&await t.queue.patchTask(t.organizationId,i,{approvals:s.approvals},l,{attempts:a.attempts,tokenHash:a.tokenHash}),s.approvals&&await Qg(t,i);let d=typeof s.result==`string`?s.result:JSON.stringify(s.result??``),f={ok:s.status===`completed`,exitCode:s.status===`completed`?0:1,output:d,...typeof s.diff==`string`?{diff:s.diff}:{}},p=!o||o.kind===`vercel-sandbox`||o.kind===`local-docker`,{engine:m,model:h}=(s.model?Ee(s.model):void 0)??vt(a.task),g=await t.queue.completeTask(t.organizationId,i,{attempts:a.attempts,tokenHash:a.tokenHash,known:u.map(e=>({id:e,ttlMs:ec})),logsComplete:!!a.handle&&!p,outcome:{status:s.status,result:f,...s.error?{error:s.error}:{},...s.tokens===void 0?{}:{tokens:s.tokens}},usage:{...a.task.event?{installationId:`${a.task.event.appId}:${a.task.event.installationId}`}:{},taskId:i,agent:a.task.agent,target:jg(a.task),...m?{engine:m}:{},...h?{model:h}:{},credential:s.credential??a.task.models?.[0]?.credential??`unknown`,runnerElapsedMs:Math.max(0,l-(a.startedAt??l)),...s.tokens===void 0?{}:{tokens:s.tokens},at:l}},l),_=a.task.event;if(g&&s.status===`failed`&&s.installationRevoked&&_&&t.integrations[_.integration]?.isUninstalled&&await Pf(t.store,`${_.appId}:${_.installationId}`,l),g&&s.machine){let{reportTaskFailure:e}=await Promise.resolve().then(()=>zc);await e(t,a,s.error??`The machine failed`)}return g&&(s.machine||$g(t,a),Pc(t,a.task)),g&&await Ll(t,p?a:{...a,logsComplete:!0},!1,o),O({ok:!0})}async function Qg(e,t){let n=(await e.store.get(`task`,t))?.task;n?.context?.approvals&&(e.waitUntil??(()=>{}))(Tl(e,n,n.context.approvals).catch(e=>console.error(`coder server: could not show the approvals of task ${t}`,e)))}function $g(e,t){let n=t.task,r=Promise.resolve().then(()=>rd).then(n=>n.endTyping(e,t)).catch(e=>console.error(`coder server: could not clear the working indicator of task ${n.id}`,e));e.waitUntil?.(r)}const e_=/^[a-f0-9-]{36}$/;async function t_(e,t){let n=t.task.event;if(!n||t.task.source!==n.integration)throw Error(`The task has no conversation`);let r=await e.store.get(`app`,n.appId);if(!r)throw Error(`The conversation app is gone`);let{eventReplies:i}=await Promise.resolve().then(()=>rd);return{event:n,replies:await i(e,r,n,t)}}async function n_(e,t,n,r){let i=e.callbackTask,a=`${t}:${i.task.id}:${i.generation??0}:${n}`,o=(e.now??Date.now)();if(!await e.store.create(`delivery`,a,{at:o},{ttlMs:864e5}))return O({ok:!0,duplicate:!0});try{await r(await t_(e,i))}catch(t){return await e.store.delete(`delivery`,a),O({error:t instanceof Error?t.message:String(t)},409)}return O({ok:!0})}async function r_(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!e_.test(n.id))return O({error:`Invalid call id`},400);if(typeof n.text!=`string`||!n.text.trim())return O({error:`Reply text is required`},400);let r=n.text.trim();return n_(t,`reply`,n.id,async({event:e,replies:n})=>{let i=t.callbackTask,a=i.task.notice&&await Dc(t,i)?i.task.notice:void 0,o=await n.post(r,a).catch(async e=>{throw a&&await Oc(t,i),e});o&&await mc(t,e,o.ids??(o.id?[o.id]:[]),(t.now??Date.now)())})}async function i_(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!e_.test(n.id))return O({error:`Invalid call id`},400);if(typeof n.emoji!=`string`||!n.emoji.trim())return O({error:`Emoji is required`},400);if(n.message!==void 0&&(typeof n.message!=`string`||!n.message.trim()))return O({error:`Message id must be a non-empty string`},400);let{emoji:r,message:i}=n;return n_(t,`react`,n.id,async({replies:e})=>{if(!e.react)throw Error(`The conversation cannot add reactions`);await e.react(r.trim(),i)})}async function a_(e,t,n,r){let i=t.callbackTask,a=await e.json().catch(()=>({})),o=a.credentialId;return typeof a.authJson!=`string`||typeof o!=`string`||!(await Kf(t,i.task,J(t,await _f(t.store)))).some(e=>e.id===o)?O({error:`Invalid credential update`},400):O({kept:await pm(t.store,t.config,o,a.authJson)})}async function o_(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.connection!=`string`||!n.connection)return O({error:`A connection id is required`},400);let r=t.callbackTask,{task:i}=r,{connectionToken:a,taskAsker:o,turnConnections:s}=await Promise.resolve().then(()=>fh),{findConnection:c}=await Promise.resolve().then(()=>Em),{actAsRefusal:l}=await Promise.resolve().then(()=>Cu),u=await s(t,i),d=await c(t,n.connection,o(i),u.accounts);if(!d||!u.ids.includes(n.connection))return O({error:`Unknown connection`},404);try{let e=d.owner?await l(t,r,d,u.accounts):void 0;if(e)return O({error:e},403);let{token:o,name:s}=await a(t,i,n.connection,typeof n.refused==`string`?n.refused:void 0,{url:n.url,connectionCreatedAt:n.connectionCreatedAt},d);if(o)return O({token:o});let c=i.event&&t.integrations[i.event.integration]?.name;return await ys(t,i.id,[`${s??c??`A connection`} needs reconnecting.`]),O({status:`needs-auth`})}catch(e){return console.error(`coder server: connection token failed`,e),O({error:`The connection is unavailable`},502)}}async function s_(e,t,n,r){let i=t.callbackTask;try{let{connectionSecrets:e,...n}=await Vf(t,i,t.callbackWorkspace);return O({...n,generation:i.generation??0,logCursor:i.logCursor??-1,timeoutMs:Math.max(1,t.config.taskTimeoutMs-((t.now??Date.now)()-(i.startedAt??(t.now??Date.now)())))})}catch(e){return O({error:e instanceof Error?e.message:String(e)},409)}}async function c_(e,t){if(!t.auth)return t;let n=await t.auth.session(e.headers);if(!(!n?.organizationId||n.organizationDenied))return{...B(t,n.organizationId),session:n}}const l_=new Set([`owner`,`admin`]),u_=e=>l_.has(e??``);function d_(e){return!e.auth||u_(e.session?.role)}async function f_(e,t,n){let{task:r}=t;if(e.taskPrincipal&&r.parent!==e.taskPrincipal.task||!us(await ds(e,[r.audience]),r))return O({error:`No task "${r.id}"`},404);let i=r.audience?.startsWith(`dm:`);if(n&&e.auth&&i&&r.requestedBy!==e.session?.user.id)return O({error:`Only the member who asked can steer this task.`},403)}const p_=(e=!1)=>async(t,n,r)=>{let i=await n.store.get(`task`,r.id);return!i&&n.taskPrincipal?O({error:`No task "${r.id}"`},404):i?await f_(n,i,e)??{...n,routeTask:i}:n};function m_(e,t){return d_(e)?e:O({error:t},403)}function h_(e,t){return!!(e&&t&&gt(e,t))}function g_(e){let t=e.headers.get(`authorization`);return t?.startsWith(`Bearer `)?t.slice(7):null}const __=new Set([`localhost`,`127.0.0.1`,`::1`,`[::1]`]);function v_(e){if(e.headers.has(`x-forwarded-for`)||e.headers.has(`x-forwarded-host`))return!1;let t=e.headers.get(`host`)??new URL(e.url).host;try{return __.has(new URL(`http://${t}`).hostname)}catch{return!1}}const y_=e=>e.local?`local`:e.config.store===`postgres`?`cloud`:`memory`,b_=e=>e.startsWith(`/tasks/`)||e.startsWith(`/logins/`)||e===`/runners/register`,x_=[`/hooks/`,`/create/`,`/install/`,`/connect/`];function S_(e,t){let n=e?.replace(/^::ffff:/,``)??``;if(__.has(n)||n.startsWith(`127.`))return!0;let r=URL.parse(`http://localhost${t}`)?.pathname??``;return r===`/connections/oauth/client.json`||b_(r)||x_.some(e=>r.startsWith(e))}function C_(e,t){if(!t.local)return!0;let n=new URL(e.url),r=e.headers.get(`host`)??n.host,i=URL.parse(`http://${r}`)?.port||`80`;if(v_(e)&&i===String(t.local.port))return!0;let a=t.config.publicUrl?new URL(t.config.publicUrl).host:void 0;return(e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim()??r)===a&&!v_(e)&&(n.pathname===`/connections/oauth/client.json`||b_(n.pathname)||x_.some(e=>n.pathname.startsWith(e)))}function w_(e,t){let n=e.headers.get(`origin`)??e.headers.get(`referer`);if(!n)return!1;try{return new URL(n).origin===new URL(t??e.url).origin}catch{return!1}}function T_(e){let t=e.headers.get(`cookie`)?.split(`;`).map(e=>e.trim()).find(e=>e.startsWith(`coder_admin=`))?.slice(12);if(!t)return null;try{return decodeURIComponent(t)}catch{return null}}async function E_(e,t){let n=g_(e);if(n&&es(n))return D_(e,t,n);if(!t.auth){let n=()=>new Response(`Unauthorized`,{status:401,headers:{"www-authenticate":`Bearer`}});if(t.config.store!==`memory`||!v_(e))return n();let r=T_(e),i=h_(g_(e),t.config.adminToken),a=h_(r,t.config.adminToken);return i?{...t,authorizedRequest:e}:a?e.method===`GET`||w_(e)?{...t,authorizedRequest:e}:An():n()}let r=await t.auth.session(e.headers,e.method!==`GET`);if(r?.stale)return O({error:`Token too old for this action.`},401,{"www-authenticate":`Bearer error="invalid_token", error_description="Token too old for this action"`});if(r?.organizationDenied)return O({error:`You are not a member of that workspace.`},403);let i=r?.role;return!r?.organizationId||!i?O({error:`Sign in first.`,hint:`coder auth login`},401,g_(e)?{"www-authenticate":`Bearer error="invalid_token"`}:{}):e.method!==`GET`&&e.headers.has(`cookie`)&&!w_(e,t.config.publicUrl)?An():{...B(t,r.organizationId),auth:t.auth,session:r,authorizedRequest:e}}async function D_(e,t,n){let r=z_(n);r&&t.scope&&(t=B(t,r));let i=await ts(t,n);return i?{...ns(t,i),authorizedRequest:e}:O({error:`The task has ended.`},401,{"www-authenticate":`Bearer error="invalid_token"`})}async function O_(e,t){let n=await e.clone().json().catch(()=>void 0),r=n?.event;if(!r)return t;if(t.taskPrincipal)return O({error:`A task starts only its own child tasks.`},403);let i=r.actor?.id;if(t.auth&&i&&r.integration){let e=await t.auth.linkedUser(r.integration,i);if(e&&e.id!==t.session?.user.id)return O({error:`The event's actor is linked to another member`},403)}let a=await uf(t,n),o=!(a instanceof Response)&&await uc(t,a.event);return o&&await f_(t,o,!0)||t}async function k_(e,t,n,r){if(n!==`agent-settings`||r.slug!==t.taskPrincipal?.agent)return!0;let i=await e.clone().json().catch(()=>void 0),a=(await t.store.get(`agent`,r.slug))?.settings;return!!is(a,i)}async function A_(e,t,n){let r=t.taskPrincipal;if(!r)return t;if(n.slug!==r.agent)return O({error:`A task changes only its own agent.`},403);if(!r.asker)return O({error:`Changing the agent needs a linked member asking.`},403);let i=await e.clone().json().catch(()=>void 0),a=(await t.store.get(`agent`,n.slug))?.settings,o=is(a,i);return o?O({error:o},403):t}async function j_(e,t){if(!t.auth)return t;let n=new Headers(e.headers),r=new URL(e.url).searchParams.get(`organization`);r&&n.set(`x-coder-organization`,r);let i=await t.auth.session(n,!0);if(i?.organizationDenied)return new Response(`You are not a member of that workspace.`,{status:403});let a=i?.role;return!i?.organizationId||!a?kn(new URL(e.url)):{...B(t,i.organizationId),session:i}}async function M_(e,t){if(e.method!==`POST`)return;let n=Cg.safeParse(await e.clone().json().catch(()=>void 0));if(!n.success||n.data.token)return;let{id:r,organizationId:i,secret:a}=n.data;if(!r||!i||i!==t.organizationId&&!t.scope)return;let o=B(t,i),s=await o.store.get(`runner`,r);if(s?.kind===`http`&&gt(z(o.config,s.secret).secret??``,a))return`runner:${i}:${r}`}async function N_(e,t,n,r){let i=n.id,a=g_(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=$o(a);return o.task!==i||typeof o.organization!=`string`||!o.organization||!Number.isInteger(o.attempt)||(t.scope&&(t=B(t,o.organization)),t.organizationId!==o.organization)?new Response(`Unauthorized`,{status:401}):t}async function P_(e,t,n,r,i=!1,a){let o=n.id,s=g_(e),c=s&&z_(s);c&&t.scope&&(t=B(t,c));let l=await Kg(e,t,o,i,a);if(l instanceof Response)return l;let{status:u,loaded:d}=l;return{...t,...d?{store:Qs(t.store,u,d)}:{},...d?.workspace?{callbackWorkspace:d.workspace}:{},callbackTask:u}}const F_=(e,t)=>(n,r,i,a)=>P_(n,r,i,a,t(n),e),I_=F_(`secrets`,e=>e.method===`POST`),L_=F_(`secrets`,()=>!0),R_=F_(`context`,()=>!1);function z_(e){let{organization:t}=$o(e);return typeof t==`string`?t:void 0}async function B_(e,t,n){let r=g_(e);if(!r)return new Response(`Unauthorized`,{status:401});let i=z_(r),a=i&&t.scope&&i!==t.organizationId?B(t,i):t,o=n.id,s=await a.store.get(`login`,o);return!s||!gt(Zo(r),s.tokenHash)?new Response(`Unauthorized`,{status:401}):{...a,callbackLogin:s}}async function V_(e,t){let n=e.method===`POST`?new URLSearchParams(await e.clone().text()):void 0;return t.searchParams.get(`tx`)??Nn(t.searchParams.get(`state`))?.tx??n?.get(`tx`)??void 0}async function H_(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??n.id??``))return Qi(e,t);let i=await V_(e,r),a=t.serverOrganizationId??t.organizationId;return i&&ti(t,i)===`*`&&ei(t,i)===a?{...B(t,a),operatorApp:!0}:j_(e,t)}function U_(e,t,n,r){return/^[a-z0-9_-]+$/.test(n.integration??n.id??``)?j_(e,t):Qi(e,t)}async function W_(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??``))return Qi(e,t);if(!t.integrations[n.integration]?.auth.user||!t.auth||!t.config.publicUrl)return j();if(e.method!==`GET`)return t;let i=await c_(e,t);return i?.session?i:kn(r)}async function G_(e,t,n,r){if(t.local&&!t.auth)return X_(e,t);if(!t.auth)return j();let i=await c_(e,t);return i?.session?i:kn(r)}function K_(e,t){return m_(t,`Workspace admin access is required.`)}const q_=(e,t=e.session)=>!e.auth||!!(t&&e.config.operators?.includes(t.user.id));async function J_(e,t){return q_(t)?t.auth&&await t.auth.operator(e.headers)!==t.session.user.id?O({error:`Operator mode ended. Sign in again to continue.`},401):t:j()}async function Y_(e,t,n,r){let i=await av(e,t,n,r);return i instanceof Response||!t.auth?i:q_(t,await t.auth.session(e.headers))?(await t.auth.operator(e.headers),i):j()}function X_(e,t){return t.local?t:j()}function Z_(e,t){return t.local?O({error:Ap},400):t.session?.user.id?t:O({error:`Sign in to use a subscription.`},403)}function Q_(e,t){return async(n,r,i,a)=>{let o=r.authorizedRequest===n?r:await E_(n,r);return o instanceof Response?o:o.taskPrincipal&&!t?.approvalPolicy?O({error:`Not available to a task.`},403):o.taskPrincipal&&t?.approvalPolicy===`ask`&&await k_(n,o,t.change,i)?Bu(n,o,t.change,i):e?e(n,o,i,a):o}}function $_(e,t,n,r){return e.method===(n.engine?`POST`:`GET`)&&(!t.local||n.engine&&!Mp(n.engine))?O({error:n.engine?`Engine sign-in is available on a local server only`:`Engine status is available on a local server only`},404):t}async function ev(e,t,n,r){return t.config.publicUrl&&t.auth?t:Qi(e,t)}async function tv(e,t,n,r){if(!t.auth)return E_(e,t);if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=await t.auth.session(e.headers);return i?.organizationDenied?O({error:`You are not a member of that workspace.`},403):i?{...i.organizationId?B(t,i.organizationId):t,session:i}:O({error:`Sign in first.`,hint:`coder auth login`},401)}function nv(e,t,n,r){return e.method===`POST`?t.auth||t.config.store!==`memory`||!v_(e)?j():w_(e)?t:An():t}async function rv(e,t,n,r){return e.method===`GET`?{...t,session:(await c_(e,t))?.session}:t}async function iv(e,t,n,r){return[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)&&t.auth&&(await c_(e,t))?.session?M(`/dash`):t}async function av(e,t,n,r){if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=r.pathname.split(`/`)[2]??``,a=new Headers(e.headers);a.delete(`x-coder-organization`),i&&a.set(`x-coder-organization`,i);let o=await t.auth?.session(a);if(o&&!o.organizations.length)return t.auth.handler(new Request(r.origin+`/api/auth/sign-in?return=`+encodeURIComponent(r.pathname+r.search)));if(t.auth&&!o)return Ki(e,t,r,r.pathname+r.search);let s=o?.organizations??[{id:t.organizationId,slug:`local`,name:``,role:`owner`}],c=s.find(e=>encodeURIComponent(e.slug)===i);if(!c){let n=s.find(e=>encodeURIComponent(e.id)===i),a=(await t.auth?.session(e.headers))?.organizationId,o=n??s.find(e=>e.id===a)??s[0],c=`/dash/${encodeURIComponent(o.slug)}`,l=r.pathname.slice(`/dash/${i}`.length);if(n)return M(`${c}${l}${r.search}`);let u=`${c}${r.pathname.slice(5)}`;return await ji(u,t.dashboardHosts)?M(`${u}${r.search}`):t.auth&&e.method===`GET`&&await ji(`${c}${l}`,t.dashboardHosts)?M(`${c}/agents?${new URLSearchParams({link:r.pathname+r.search})}`):j()}return t.auth?(await t.auth.setOrganization(e.headers,c.slug),{...B(t,c.id),session:o}):t}function ov(e,t,n,r){return e.method===`POST`&&t.local?O({error:Ap},400):t}function sv(e,t,n,r){return![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)||t.auth?t:j()}const cv=`x-coder-request-scope`;function lv(e,{sessions:t,operators:n,cookies:r}){let i=e.auth;return i?{...e,auth:{...i,session(e,n){let a=JSON.stringify([...[`cookie`,`authorization`].map(t=>e.get(t)),!!n]),o=t.get(a);if(!o){let s=new Headers(e);s.delete(`x-coder-organization`),o=i.session(s,n,r),t.set(a,o)}let s=e.get(`x-coder-organization`);return s?o.then(e=>e&&(e.stale?e:ea(e,s))):o},setOrganization:(e,t)=>i.setOrganization(e,t,r),operator(e){let t=e.get(`cookie`)??``,a=n.get(t);return a||(a=i.operator(e,r),n.set(t,a)),a}}}:e}function uv(e,t,n){let r=t.requestScopes??=new Map,i=e.headers.get(cv),a=n&&i?r.get(i):void 0;if(a)return{req:e,ctx:lv(t,a),end(){}};let o=new Headers(e.headers);if(o.delete(cv),!t.auth)return{req:i?new Request(e,{headers:o}):e,ctx:t,end(){}};let s=L(),c={sessions:new Map,operators:new Map,cookies:[]};return r.set(s,c),o.set(cv,s),{req:new Request(e,{headers:o}),ctx:lv(t,c),cookies:c.cookies,end:()=>r.delete(s)}}const dv=`/connections/oauth/client.json`,fv=`/connections/oauth/callback`,pv=6e5,mv=e=>`connection-oauth:${e}`;async function hv(e,t,n){await e.store.put(`delivery`,`connection-authorized:${Pr(`sha256`).update(n).digest(`hex`)}`,{at:(e.now??Date.now)(),target:`${t.id}:${t.createdAt}`},{ttlMs:pv})}const Q=c().check(u(1)),gv=f({resource:Q,authorization_servers:o(Q).check(u(1)),scopes_supported:i(o(Q))}),_v=f({issuer:Q,authorization_endpoint:Q,token_endpoint:Q,registration_endpoint:i(Q),userinfo_endpoint:i(Q),scopes_supported:i(o(Q)),code_challenge_methods_supported:i(o(Q)),client_id_metadata_document_supported:i(a()),authorization_response_iss_parameter_supported:i(a())}),vv=s([`none`,`client_secret_basic`,`client_secret_post`]),yv=f({client_id:Q,client_secret:i(Q),token_endpoint_auth_method:i(vv),redirect_uris:i(o(Q))}),bv=f({name:i(Q),preferred_username:i(Q),email:i(Q)});function xv(e,t){let n=We(t);if(!Ke(n,!!e.local))throw Error(`OAuth endpoint is not allowed.`);return n}async function Sv(e,t,n,r=!1){for(let i of[...new Set(n)]){xv(e,i);let n=await nt(t,i,{headers:{accept:`application/json`}});if(n.status!==404&&n.status!==405&&!(r&&(n.status===401||n.status===403))){if(!n.ok)throw Error(`OAuth metadata discovery failed.`);return n.json()}}if(!r)throw Error(`OAuth metadata is unavailable.`)}function Cv(e){let t={},n=``;for(let r of e?.matchAll(/(?:^|,)\s*(?:([\w-]+)\s+)?([\w-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/g)??[]){if(r[1]){if(n===`bearer`)break;n=r[1].toLowerCase()}n===`bearer`&&(t[r[2].toLowerCase()]=r[3]?.replace(/\\(.)/g,`$1`)??r[4])}return t}async function wv(e,t,n=!1,r){let i=xv(e,t),a=e.fetch??fetch;if(r===void 0){let e=await nt(a,i.href);r=e.status===401?e.headers.get(`www-authenticate`)??``:``,await e.body?.cancel()}let o=Cv(r),s=await Sv(e,a,o.resource_metadata?[o.resource_metadata]:[i.origin+`/.well-known/oauth-protected-resource`+(i.pathname===`/`?``:i.pathname),i.origin+`/.well-known/oauth-protected-resource`],n&&!o.resource_metadata);if(s===void 0)return;let c=gv.parse(s);if(xv(e,c.resource).origin!==i.origin)throw Error(`OAuth resource changed origin.`);return{resource:c,params:o}}function Tv(e){if(e.local)return`http://localhost:${e.local.port}`;if(e.config.publicUrl)return We(e.config.publicUrl).origin;throw Error(`PUBLIC_URL or a local server is required for OAuth.`)}function Ev(e){let t=Tv(e);return{client_name:e.config.name??`Coder`,redirect_uris:[t+fv],grant_types:[`authorization_code`,`refresh_token`],response_types:[`code`],token_endpoint_auth_method:`none`}}function Dv(e,t){return!t.config.publicUrl||We(t.config.publicUrl).protocol!==`https:`?j():O({client_id:We(t.config.publicUrl).origin+dv,...Ev(t)})}function Ov(e){if(e.session)return e.session.user.id;if(e.local&&!e.auth)return`local`;throw Error(`Sign in before authorizing a connection.`)}function kv(e,t){if(!e||e.createdAt!==t.createdAt||e.owner!==t.owner||e.auth!==`oauth`||e.provider!==`mcp`||JSON.stringify(e.endpoint)!==JSON.stringify(t.endpoint))throw Error(`The connection changed during authorization.`)}async function Av(e,t,n){let r=await e.get(`delivery`,mv(t));if(!r||!(`target`in r)||r.target!==n)throw Error(`The authorization attempt was superseded or expired.`)}async function jv(e,t,n){let r=Ov(e);if(t.auth!==`oauth`||t.provider!==`mcp`||!t.endpoint||!(`url`in t.endpoint)||typeof t.endpoint.url!=`string`||t.owner&&t.owner!==r)throw Error(`This connection cannot be authorized.`);let i=e.fetch??fetch,{resource:a,params:o}=n??await wv(e,t.endpoint.url),s=a.authorization_servers[0],c=xv(e,s);if(c.search)throw Error(`OAuth issuer cannot contain a query.`);let l=c.pathname.replace(/\/$/,``),u=_v.parse(await Sv(e,i,[c.origin+`/.well-known/oauth-authorization-server`+l,c.origin+`/.well-known/openid-configuration`+l,c.origin+l+`/.well-known/openid-configuration`]));if(u.issuer!==s)throw Error(`OAuth issuer mismatch.`);if(!u.code_challenge_methods_supported?.includes(`S256`))throw Error(`OAuth server does not support PKCE S256.`);xv(e,u.authorization_endpoint),xv(e,u.token_endpoint),u.registration_endpoint&&xv(e,u.registration_endpoint),u.userinfo_endpoint&&xv(e,u.userinfo_endpoint);let d=t.secret?z(e.config,t.secret):void 0,f=d?.issuer===s&&d.clientId?{clientId:d.clientId,clientSecret:d.clientSecret,tokenEndpointAuthMethod:d.tokenEndpointAuthMethod}:void 0;if(!f&&u.client_id_metadata_document_supported&&e.config.publicUrl&&We(e.config.publicUrl).protocol===`https:`&&(f={clientId:We(e.config.publicUrl).origin+dv,tokenEndpointAuthMethod:`none`}),!f){if(!u.registration_endpoint)throw Error(`OAuth server does not support client registration.`);let t=await nt(i,u.registration_endpoint,{method:`POST`,headers:{"content-type":`application/json`,accept:`application/json`},body:JSON.stringify(Ev(e))});if(!t.ok)throw Error(`OAuth client registration failed.`);let n=yv.parse(await t.json()),r=n.token_endpoint_auth_method??`client_secret_basic`;if(r!==`none`&&!n.client_secret)throw Error(`OAuth registration omitted the client secret.`);if(n.redirect_uris&&!n.redirect_uris.includes(Tv(e)+fv))throw Error(`OAuth registration changed the redirect URI.`);f={clientId:n.client_id,clientSecret:n.client_secret,tokenEndpointAuthMethod:r}}let p={issuer:s,authorizationEndpoint:u.authorization_endpoint,tokenEndpoint:u.token_endpoint,resource:a.resource,...f,scope:o.scope??a.scopes_supported?.join(` `)??u.scopes_supported?.join(` `)},m=R(e.config,p),h=I(18).toString(`base64url`);await e.store.withAppLock(`connection:${t.id}`,async n=>{kv(await n.get(`connection`,t.id),t),await n.put(`delivery`,mv(t.id),{at:(e.now??Date.now)(),target:h},{ttlMs:pv})});let g=I(32).toString(`base64url`),_=await Zr(e,`connection-oauth`,r,R(e.config,{id:t.id,attempt:h,secret:m,createdAt:t.createdAt,endpoint:t.endpoint,owner:t.owner,verifier:g,redirectUri:Tv(e)+fv,userinfo:u.userinfo_endpoint,requireIssuer:u.authorization_response_iss_parameter_supported===!0}),pv),v=new URL(p.authorizationEndpoint),y={response_type:`code`,client_id:p.clientId,redirect_uri:Tv(e)+fv,state:_,code_challenge:Pr(`sha256`).update(g).digest(`base64url`),code_challenge_method:`S256`,resource:p.resource};for(let[e,t]of Object.entries(y))v.searchParams.set(e,t);return p.scope!==void 0&&v.searchParams.set(`scope`,p.scope),v.href}async function Mv(e,t,n){let r=t,i=e=>M(`${Lv(Fv(r),`/settings/connections`)}?outcome=${e}`);try{let e=n.searchParams.get(`state`)??``,a=ei(t,e);if(t.auth&&(!a||!t.session?.organizations.some(e=>e.id===a)))return i(`invalid-state`);let o=t.session?Rv(t,t.session,a)??t:t;r=o;let s=await ii(o,e,`connection-oauth`,Ov(o));if(!s)return i(`invalid-state`);let c=z(o.config,s);if(!c.owner&&!d_(o))return i(`failed`);let l=z(o.config,c.secret),u=n.searchParams.get(`iss`);if((c.requireIssuer||u!==null)&&u!==l.issuer)return i(`failed`);if(n.searchParams.has(`error`))return i(n.searchParams.get(`error`)===`access_denied`?`denied`:`failed`);let d=n.searchParams.get(`code`);if(!d)return i(`failed`);kv(await o.store.get(`connection`,c.id),c),await Av(o.store,c.id,c.attempt);let f=o.fetch??fetch,p=await Be(f,l,new URLSearchParams({grant_type:`authorization_code`,code:d,redirect_uri:c.redirectUri,code_verifier:c.verifier})),m=p.preferred_username??p.email??p.name;if(!m&&c.userinfo)try{let e=await nt(f,c.userinfo,{headers:{authorization:`Bearer ${p.access_token}`,accept:`application/json`}});if(e.ok){let t=bv.parse(await e.json());m=t.preferred_username??t.email??t.name}}catch(e){console.error(`coder server: OAuth userinfo failed`,e)}return await o.store.withAppLock(`connection:${c.id}`,async t=>{let n=await t.get(`connection`,c.id);kv(n,c),await Av(t,c.id,c.attempt),await t.put(`connection`,n.id,{...n,secret:R(o.config,He(l,p,(o.now??Date.now)())),account:m??n.account,broken:void 0,updatedAt:(o.now??Date.now)()}),await t.delete(`delivery`,mv(c.id)),await hv({...o,store:t},n,e)}),i(`connected`)}catch(e){return console.error(`coder server: connection OAuth callback failed`,e),i(`failed`)}}async function Nv(e,t,n,r){let i=(!t.auth||t.session?.organizationId)&&await Vm(t,t.session?.user.id).catch(()=>!1);if(!t.auth)return O({mode:y_(t),organization:{id:t.organizationId,slug:`local`},server:Pv(t),operator:q_(t),...i?{reconnect:i}:{}});let a=t.session;return O({mode:y_(t),user:a.user,organization:a.organizations.find(e=>e.id===a.organizationId)??null,organizations:a.organizations,manageMembersUrl:`${t.auth.issuer}/auth/onboarding`,server:Pv(t),operator:q_(t,a),...i?{reconnect:i}:{}})}function Pv(e){return{name:e.config.name??`Coder`,store:e.config.store,...e.config.publicUrl?{url:e.config.publicUrl}:{},issuesUrl:e.config.issuesUrl,subscriptions:{claude:!!e.config.subscriptions?.claude,codex:!!e.config.subscriptions?.codex}}}function Fv(e){let t=e.session?.organizations??[];return(t.find(t=>t.id===e.organizationId)??t.find(t=>t.id===e.session?.organizationId))?.slug??(e.auth?e.organizationId:`local`)}async function Iv(e,t){let n=e.session?.organizations.find(t=>t.id===e.organizationId)?.slug??t?.slug;return n||!e.auth?n??`local`:t?e.organizationId:(await e.auth.organization?.(e.organizationId))?.slug??e.organizationId}const Lv=(e,t=``)=>e?`/dash/${encodeURIComponent(e)}${t}`:`/dash${t}`;function Rv(e,t,n){let r=n&&t.organizations.find(e=>e.id===n);return r?{...B(e,r.id),session:{...t,organizationId:r.id,role:r.id===t.organizationId?t.role:r.role}}:void 0}async function zv(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=jn(r.searchParams.get(`return`),r.origin),l=c.startsWith(`/dash/`)?c:void 0,u=Rv(t,s,r.searchParams.get(`organization`)??s.organizationId),d=r.searchParams.get(`connection`),f=u&&d&&await u.store.get(`connection`,d);if(!u||!f||f.provider!==i.id||f.auth!==`oauth`||f.owner!==s.user.id)return O({error:`Unknown OAuth connection`},404);let p=await Km(u,i.id);if(!p)return O({error:`No OAuth client is available for ${i.name}.`},400);let m=await Zr(u,`native-oauth`,s.user.id,JSON.stringify({connection:f,app:p.id,attempt:r.searchParams.get(`attempt`),back:l}));return M(a.authorizeUrl(z(t.config,p.credentials),{publicUrl:o,state:m,access:f.access??`auto`}))}async function Bv(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`state`)??``,l=Rv(t,s,ei(t,c)),u=l??{...t,session:s},d=l&&await ii(l,c,`native-oauth`,s.user.id);if(!l||!d)return $(u,`link-expired`,{platform:i.id});let f=JSON.parse(d),p=f.back,m=f.connection;if(m.provider!==i.id||m.owner!==s.user.id)return $(u,`link-expired`,{platform:i.id},p);let h=await Km(l,i.id,f.app);return h?l.store.withAppLock(`connection:${m.id}`,async n=>{let r=await n.get(`connection`,m.id);if(!r||JSON.stringify(r)!==JSON.stringify(m))return $(u,`link-expired`,{platform:i.id},p);let c=await a.exchange(e,z(t.config,h.credentials),{publicUrl:o,access:r.access??`auto`,fetch:((e,n)=>(t.fetch??fetch)(e,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)}))}).catch(e=>{console.error(`coder server: ${i.id} connection sign-in failed`,e)});return c?.token?await t.auth.link(s.user,i.id,c.id,{...ta(s.organizations),token:R(t.config,{app:h.id,token:c.token}),organizationId:l.organizationId,...c.login?{login:c.login}:{}},n)===`taken`?$(u,`account-taken`,{platform:i.id},p):(await n.put(`connection`,r.id,{...r,account:c.id,oauthApp:h.id,secret:void 0,broken:void 0,updatedAt:(t.now??Date.now)()}),f.attempt&&await hv({...l,store:n},r,f.attempt),$(u,`linked`,{platform:i.id,account:c.login??c.id},p)):$(u,`failed`,{platform:i.id},p)}):$(u,`link-expired`,{platform:i.id},p)}function Vv(e,t,n){let r=e.integrations[n]?.events;return{name:e.name??t,...e.description?{description:e.description}:{},events:Array.isArray(r)?r:Object.keys(r??{}),...e.access?{access:e.access}:{}}}function $(e,t,n={},r){let i=new URLSearchParams({status:t});for(let[e,t]of Object.entries(n))t?.length&&i.set(e,Array.isArray(t)?t.join(`,`):t);/^[\w.-]{1,64}$/.test(i.get(`error`)??``)||i.delete(`error`);let a=r??Lv(Fv(e),`/setup`);return M(`${Hv(e)}${a.replace(/[?#].*$/,``)}?${i}`)}const Hv=e=>e.local?`http://localhost:${e.local.port}`:``,Uv=(e,t)=>Lv(Fv(e),`/agents/${encodeURIComponent(t)}/platforms`);function Wv(e){let t=e.get(`agent`),n=e.get(`def`),r=Nn(n);if(!(!t||!n||!r?.integrations))return{state:{agent:t,repo:e.get(`repo`)??void 0,branch:e.get(`branch`)??void 0,def:n,tx:e.get(`tx`)??void 0,owner:e.get(`owner`)||void 0,...[`1`,`true`].includes(e.get(`public`)??``)?{public:!0}:{}},definition:r}}const Gv=e=>typeof e==`string`&&/^\/dash(?:[/?#]|$)/.test(e)?e:void 0,Kv=(e,t)=>JSON.stringify({integration:e,agent:t.agent,repo:t.repo??null,branch:t.branch??null,def:t.def,owner:t.owner??null,public:t.public??!1});async function qv(e,t,n,r){let i=await ai(e,t,`create`,r),a=i?JSON.parse(i):void 0,o=Nn(a?.def??null);if(!(a?.integration!==n||!o?.integrations||!await ri(e,t,`create`,r,i)))return{state:{agent:a.agent,repo:a.repo??void 0,branch:a.branch??void 0,def:a.def,tx:t,owner:a.owner??void 0,...a.public?{public:!0}:{}},definition:o}}const Jv=e=>`app-token:${e}:`;async function Yv(e,t){return(await e.store.list(`snapshot`,{prefix:Jv(t)})).flatMap(({id:t,value:n})=>{if(!(`secret`in n))return[];let r=z(e.config,n.secret);return r.unusable?[]:[{id:t,token:r}]}).sort((e,t)=>t.token.lastUsedAt-e.token.lastUsedAt).map(({id:e,token:t})=>({id:e,label:`${t.workspaceName} · saved by ${t.savedBy}`}))}function Xv(e,t){let n=()=>(e.now??Date.now)();return{async put(r){let i=Jv(t)+mt(JSON.stringify([r.workspace,r.user]));return await e.store.withAppLock(`${e.organizationId}:${i}`,t=>t.put(`snapshot`,i,{secret:R(e.config,{...r,savedBy:e.session?.user.name||`Server operator`,lastUsedAt:n()})})),i},async use(r,i){if(!r.startsWith(Jv(t)))throw new ve(`invalid-field`,`token`,`Choose a saved configuration token or paste a new one.`);let a=await e.store.withAppLock(`${e.organizationId}:${r}`,async t=>{let a=await t.get(`snapshot`,r),o=a&&z(e.config,a.secret);if(!o||o.unusable)return{error:new ve(`invalid-field`,`token`,`This configuration token is unavailable. Paste a new token.`)};let s=()=>t.put(`snapshot`,r,{secret:R(e.config,o)});try{let e=await i(o.credentials,async(e,t)=>{t&&(o.workspaceName=t),o.credentials=e,await s()},async()=>{o.unusable=!0,await s()});return o.lastUsedAt=n(),await s(),{value:e}}catch(e){return{error:e}}});if(`error`in a)throw a.error;return a.value}}}var Zv=t({serverAppLink:()=>$v,serverAppUrl:()=>ey,sharedApps:()=>Qv});async function Qv(e,t){let n=e.serverOrganizationId!==void 0&&e.serverOrganizationId!==e.organizationId?e.scope?.(e.serverOrganizationId).store??e.store:e.store;return(await(n===e.store&&t?t:n.list(`app`))).map(({value:e})=>e).filter(t=>t.builtin&&e.integrations[t.integration]?.app.shareable)}async function $v(e,t={}){let n=Un(t.env??yr.env),r=ft(n.integrations);if(!r[e])throw new m(`invalid-option`,`Unknown integration "${e}".`,{hint:`Pick one of ${Object.keys(r).join(`, `)}.`});if(!r[e].app.shareable)throw new m(`invalid-option`,`Create ${e} apps in your workspace from the agent's Platforms tab.`);if(!n.databaseUrl||!n.publicUrl)throw new m(`invalid-option`,`Built-in apps need the server database and address.`,{hint:`Set DATABASE_URL and PUBLIC_URL as the server has them.`});let i=await xo(n);try{let a=i.defaultOrganizationId;return{url:await ey({config:n,integrations:r,organizationId:a,store:i.store(a)},e,t)}}finally{await i.close()}}async function ey(e,t,n){if(!e.integrations[t]?.app.shareable)throw new m(`invalid-option`,`Create ${t} apps in your workspace from the agent's Platforms tab.`);let r=D();if(!r)throw new m(`invalid-option`,`This server ships no default agent.`);let i={...st()[r].json,...n.name?{name:n.name}:{}},a={agent:r,def:ht(i),...n.owner?{owner:n.owner}:{},public:!0},o=await Zr(e,`create`,`*`,Kv(t,a)),s=new URLSearchParams({agent:a.agent,def:a.def,...a.owner?{owner:a.owner}:{},public:`1`,tx:o});return`${Hv(e)||e.config.publicUrl.replace(/\/$/,``)}/create/${t}?${s}`}export{p_ as $,Bl as $n,Vi as $r,hm as $t,ov as A,zd as An,Co as Ar,Fh as At,L_ as B,hu as Bn,ja as Br,Wm as Bt,Q_ as C,hf as Cn,Do as Cr,yg as Ct,G_ as D,tf as Dn,jo as Dr,mg as Dt,sv as E,$d as En,Ao as Er,wg as Et,U_ as F,Ad as Fn,mo as Fr,Wh as Ft,rv as G,gu as Gn,ea as Gr,sh as Gt,W_ as H,xu as Hn,ba as Hr,ch as Ht,C_ as I,Xu as In,Ba as Ir,ng as It,w_ as J,ru as Jn,Qi as Jr,Hp as Jt,uv as K,iu as Kn,ta as Kr,lm as Kt,X_ as L,Qu as Ln,Ka as Lr,Hh as Lt,nv as M,Hd as Mn,so as Mr,Gh as Mt,$_ as N,Vd as Nn,oo as Nr,Ph as Nt,R_ as O,ef as On,Mo as Or,vg as Ot,N_ as P,Md as Pn,co as Pr,tg as Pt,S_ as Q,Jl as Qn,Yi as Qr,Up as Qt,Z_ as R,vu as Rn,Va as Rr,Nh as Rt,tv as S,gf as Sn,Wo as Sr,hg as St,A_ as T,Qd as Tn,ko as Tr,Sg as Tt,J_ as U,pu as Un,va as Ur,ah as Ut,ev as V,bu as Vn,Ma as Vr,oh as Vt,Y_ as W,du as Wn,ga as Wr,Em as Wt,y_ as X,ql as Xn,Gi as Xr,Cm as Xt,I_ as Y,Kl as Yn,Wi as Yr,zp as Yt,iv as Z,Yl as Zn,Zi as Zr,xm as Zt,zv as _,pf as _n,zo as _r,Gg as _t,Gv as a,z as ai,rp as an,Ds as ar,s_ as at,Dv as b,of as bn,Bo as br,Ag as bt,$ as c,ui as ci,pp as cn,us as cr,Yg as ct,Yv as d,Zr as di,Ff as dn,H as dr,r_ as dt,qi as ei,wm as en,Vl as er,O_ as et,qv as f,jf as fn,ss as fr,o_ as ft,Fv as g,qd as gn,qo as gr,Wg as gt,Nv as h,kf as hn,Xo as hr,Mg as ht,Xv as i,_i as ii,yp as in,Es as ir,Xg as it,av as j,Bd as jn,qa as jr,Qh as jt,H_ as k,Gd as kn,xo as kr,Z as kt,Uv as l,hi as li,ip as ln,Qo as lr,Zg as lt,Lv as m,Af as mn,Po as mr,Fg as mt,Qv as n,vi as ni,Ip as nn,Gs as nr,d_ as nt,Kv as o,pi as oi,ep as on,Os as or,qg as ot,Bv as p,Of as pn,ds as pr,Ng as pt,m_ as q,ou as qn,Oi as qr,Sm as qt,Vv as r,yi as ri,vp as rn,qs as rr,Jg as rt,Hv as s,R as si,fp as sn,as as sr,a_ as st,Zv as t,xi as ti,Tm as tn,ml as tr,P_ as tt,Wv as u,ai as ui,Ep as un,os as ur,i_ as ut,dv as v,sf as vn,Go as vr,Pg as vt,K_ as w,mf as wn,No as wr,pg as wt,__ as x,cf as xn,Vo as xr,gg as xt,Mv as y,lf as yn,Uo as yr,jg as yt,B_ as z,mu as zn,Wa as zr,lh as zt};