@wular/coder 0.4.9 → 0.4.10

package/dist/{index-vd37q3fn.d.ts → review-DDYD3Yvq.d.ts}

@@ -1,5 +1,6 @@
-import { c as TaskStatus, d as TokenUsage, l as TurnResult, o as McpServerSpec, s as Task, u as TaskLogEntry } from "./types-C1tWi5lP.js";
+import { c as TaskStatus, d as TokenUsage, l as TurnResult, o as McpServerSpec, s as Task, u as TaskLogEntry } from "./types-8zO5Tc9c.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+import * as z from "zod";
 //#region src/flow/types.d.ts
 /** Anything with zod's parse shape; the flow runtime never imports zod itself. */
 interface FlowSchema<T> {
@@ -37,12 +38,8 @@ interface FlowSteerOptions {
   effort?: string;
   permissions?: string;
 }
-type FlowRunStatus = 'queued' | 'running' | 'completed' | 'failed' | 'stopped';
-/**
- * One line of a run's events.jsonl: a hook payload tagged with its kind. The
- * attached orchestrator appends these; `flow stream` / `flow.stream()` replay
- * and follow them.
- */
+type FlowRunStatus = 'running' | 'completed' | 'failed' | 'stopped';
+/** An event recorded by the flow runtime and delivered to its hooks and followers. */
 type FlowEvent = {
   kind: 'task-start';
   taskId: string;
@@ -102,6 +99,7 @@ interface FlowRecord {
   pid?: number;
   pidStartedAt?: string;
   concurrency: number;
+  concurrencySet?: boolean;
   maxTasks: number;
   taskCount: number;
   ledger: Record<string, TokenUsage>;
@@ -153,43 +151,7 @@ interface FlowHooks {
     requestStop: () => void;
     runningIds: () => string[];
   }) => void;
-  /** A task was dispatched (real dispatches only, never dry-run). */
-  onTaskStart?: (info: {
-    taskId: string;
-    name?: string;
-    prompt: string;
-    engine?: string;
-    depth?: number;
-  }) => void;
-  /** A task reached a terminal state. */
-  onTaskEnd?: (info: {
-    taskId: string;
-    status: string;
-    tokens: TokenUsage | null;
-  }) => void;
-  /** A gate command was spawned (real runs only, never dry-run or replay). */
-  onGateStart?: (info: {
-    gateId: string;
-    cmd: string;
-    depth?: number;
-  }) => void;
-  /** A gate command finished; `gateId` pairs it with its onGateStart. */
-  onGate?: (info: {
-    gateId?: string;
-    cmd: string;
-    ok: boolean;
-    code: number;
-    depth?: number;
-  }) => void;
-  /** The flow called log(). */
-  onLog?: (msg: string, depth?: number) => void;
-  /** A sub-flow started (depth is the sub-flow's own nesting level). */
-  onFlowStart?: (info: {
-    name: string;
-    depth: number;
-  }) => void;
-  /** A resume replayed recorded steps from the journal. */
-  onReplay?: (count: number) => void;
+  onEvent?: (event: FlowEvent) => void;
 }
 interface RunContext {
   runId: string;
@@ -258,7 +220,7 @@ declare function pipeline<T, A, B>(items: T[], s1: S<T, T, A>, s2: S<A, T, B>):
 declare function pipeline<T, A, B, C>(items: T[], s1: S<T, T, A>, s2: S<A, T, B>, s3: S<B, T, C>): Promise<(C | null)[]>;
 declare function pipeline<T, A, B, C, D>(items: T[], s1: S<T, T, A>, s2: S<A, T, B>, s3: S<B, T, C>, s4: S<C, T, D>): Promise<(D | null)[]>;
 declare function pipeline<T>(items: T[], ...stages: Stage[]): Promise<any[]>;
-/** Emit a progress line: appended to the run's flow.log and streamed to watchers. */
+/** Emit a progress line to the run's event stream. */
 declare function log(msg: string): void;
 /**
  * Run another flow inline as a sub-step and return its result. Nesting is one
@@ -266,6 +228,22 @@ declare function log(msg: string): void;
  */
 declare function flow(name: string, args?: unknown): Promise<unknown>;
 //#endregion
+//#region src/core/state.d.ts
+interface TurnResultEntry {
+  at?: string;
+  prompt?: string | null;
+  /** Steers the engine took into this turn while it ran. */
+  steers?: string[];
+  lastReply?: string;
+  finalMessage?: string;
+  error?: TurnResult['error'];
+  status?: number;
+  tokens?: TurnResult['tokens'];
+  model?: TurnResult['model'];
+  [key: string]: unknown;
+}
+declare function readTurnResults(cwd: string, taskId: string): TurnResultEntry[];
+//#endregion
 //#region src/flow/executor.d.ts
 interface RunOptions {
   runId?: string;
@@ -297,6 +275,11 @@ interface StopSummary {
   stoppedTasks: string[];
   keptTasks: string[];
 }
+declare const review$1: {
+  run(options?: ReviewArgs): Promise<ReviewResult & {
+    runId: string;
+  }>;
+};
 //#endregion
 //#region src/flow/runs.d.ts
 /** A run's record with its step rows, trimmed journal and recorded events. */
@@ -382,35 +365,9 @@ declare class CoderError extends Error {
   /** server: the HTTP status the server answered with. */
   status?: number;
   needs?: 'key';
-  constructor(code: CoderErrorCode, message: string, extra?: {
-    hint?: string | string[];
-    taskId?: string;
-    payload?: FallbackPayload;
-    approval?: {
-      id: string;
-      summary: string;
-      cwd?: string | null;
-      networkHost?: string | null;
-    };
-    result?: unknown;
-    runId?: string;
-    status?: number;
-    needs?: 'key';
-  });
+  constructor(code: CoderErrorCode, message: string, extra?: Partial<Pick<CoderError, 'hint' | 'taskId' | 'payload' | 'approval' | 'result' | 'runId' | 'status' | 'needs'>>);
 }
 //#endregion
-//#region src/core/state.d.ts
-interface TurnResultEntry {
-  at?: string;
-  prompt?: string | null;
-  finalMessage?: string;
-  status?: number;
-  tokens?: TurnResult['tokens'];
-  model?: TurnResult['model'];
-  [key: string]: unknown;
-}
-declare function readTurnResults(cwd: string, taskId: string): TurnResultEntry[];
-//#endregion
 //#region src/core/dispatch.d.ts
 interface TaskResult {
   taskId: string;
@@ -432,7 +389,7 @@ declare function readTask(cwd: string, taskId: string, opts?: {
  * The flow's `--args` value. A Proxy over the ALS-bound current args, so a
  * top-level `import { args }` reflects whichever run is executing.
  */
-declare const args: Record<string, unknown>;
+declare const args$1: Record<string, unknown>;
 /** Run and inspect flows programmatically; mirrors `coder flow`. */
 declare const flowSdk: {
   /** Run a flow and await its result. */
@@ -464,4 +421,146 @@ declare const flowSdk: {
   delete: typeof deleteRuns;
 };
 //#endregion
-export { FlowStep as C, GateResult as E, FlowSteerOptions as S, FlowTaskResult as T, steer as _, readTurnResults as a, FlowEvent as b, archiveRuns as c, RunSummary as d, StopSummary as f, pipeline as g, log as h, readTask as i, deleteRuns as l, gate as m, flowSdk as n, CoderError as o, flow as p, TaskResult as r, RunResult as s, args as t, RunOptions as u, task as v, FlowTaskOptions as w, FlowRecord as x, DiscoveredFlow as y };
+//#region src/flow/builtin/review.d.ts
+declare const description = "Review a code change.";
+declare const args: z.ZodObject<{
+  pr: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+  base: z.ZodOptional<z.ZodString>;
+  head: z.ZodOptional<z.ZodString>;
+  since: z.ZodOptional<z.ZodString>;
+  post: z.ZodOptional<z.ZodBoolean>;
+  author: z.ZodOptional<z.ZodString>;
+  path: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  engine: z.ZodOptional<z.ZodString>;
+  model: z.ZodOptional<z.ZodString>;
+  effort: z.ZodOptional<z.ZodEnum<{
+    low: "low";
+    medium: "medium";
+    high: "high";
+  }>>;
+  cwd: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type ReviewArgs = z.infer<typeof args>;
+/** Tasks at once unless the caller sets a concurrency. */
+declare const concurrency = 4;
+declare const Finding: z.ZodObject<{
+  file: z.ZodString;
+  line: z.ZodNumber;
+  severity: z.ZodEnum<{
+    critical: "critical";
+    major: "major";
+    minor: "minor";
+    nit: "nit";
+  }>;
+  category: z.ZodEnum<{
+    correctness: "correctness";
+    security: "security";
+    reliability: "reliability";
+    performance: "performance";
+    maintainability: "maintainability";
+    testing: "testing";
+    documentation: "documentation";
+  }>;
+  summary: z.ZodString;
+  failure_scenario: z.ZodString;
+}, z.core.$strict>;
+type Finding = z.infer<typeof Finding> & {
+  fingerprint: string;
+};
+interface ReviewSummary {
+  baseSha: string;
+  headSha: string;
+  /** Also covers uncommitted and untracked files on top of `headSha`. */
+  worktree: boolean;
+  files: number;
+  model: string | null;
+  elapsedMs: number;
+  posted?: number;
+  /** Parts left out of the review, such as uninitialized submodules. */
+  warnings?: string[];
+}
+interface ReviewResult {
+  findings: Finding[];
+  summary: ReviewSummary;
+}
+/** New-side line ranges per file from a unified diff. */
+declare function changedLines(patch: string): Map<string, Array<[number, number]>>;
+/** Stable finding key from its file, category and neighbouring lines. */
+declare function fingerprint(file: string, text: string, category: string): string;
+/** AGENTS.md / CLAUDE.md, then .coder/review.md, all read at `sha`. */
+declare function repositoryRules(exec: ReviewExec, sha: string): Array<[name: string, text: string]>;
+interface ReviewServices {
+  exec?: ReviewExec;
+  reviewTask?: typeof task;
+  /** Test-only override for the transient task credential. */
+  integrationToken?: string;
+}
+declare function review(a: ReviewArgs, services?: ReviewServices): Promise<ReviewResult>;
+type ReviewExec = (command: string, args: string[], input?: string) => string;
+type ReviewPostFinding = Finding;
+type ReviewPostSummary = Pick<ReviewSummary, 'baseSha' | 'headSha' | 'model' | 'elapsedMs'> & {
+  author: string;
+};
+interface ReviewPostInput {
+  repo: string;
+  pr: number;
+  cwd?: string;
+  findings: ReviewPostFinding[];
+  summary: ReviewPostSummary;
+  since?: string;
+}
+interface ReviewTargetInput {
+  pr: number | string;
+  /** The only repository the target may be in. */
+  repo?: string;
+  cwd?: string;
+  since?: string;
+  author?: string;
+}
+interface ReviewTarget {
+  pr?: {
+    number: number;
+    repo: string;
+    author: string;
+  };
+  baseSha: string;
+  headSha: string;
+  since?: string;
+}
+interface ReviewAuth {
+  /** Installation token from the task context. Omit to use local gh auth. */
+  token?: string;
+  exec?: ReviewExec;
+}
+/** The platform reviews post to; its tool server holds the token. */
+declare const REVIEW_PLATFORM = "github";
+interface ReviewComment {
+  id: number;
+  body?: string | null;
+  user?: {
+    login?: string;
+  } | null;
+}
+declare function reviewCli(cwd?: string, token?: string): ReviewExec;
+declare function parseGithubPr(value: number | string): {
+  number: number;
+  repo?: string;
+};
+declare function reviewFingerprints(comments: Array<{
+  body?: string | null;
+}>): Set<string>;
+declare function lastReviewSummary(comments: Array<{
+  id: number;
+  body?: string | null;
+}>): {
+  id: number;
+  head: string;
+} | undefined;
+declare function ownReviewComments(comments: ReviewComment[], author: string): ReviewComment[];
+/** Resolve and fetch a GitHub pull request for the integration-generic review flow. */
+declare function resolveReviewTarget(input: ReviewTargetInput, auth?: ReviewAuth): ReviewTarget;
+/** Post unseen findings and upsert the sticky summary through GitHub's integration. */
+declare function postReview(input: ReviewPostInput, auth?: ReviewAuth): number;
+//#endregion
+export { FlowTaskResult as $, TaskResult as A, readTurnResults as B, repositoryRules as C, reviewFingerprints as D, reviewCli as E, deleteRuns as F, steer as G, gate as H, RunOptions as I, FlowEvent as J, task as K, RunSummary as L, CoderError as M, RunResult as N, args$1 as O, archiveRuns as P, FlowTaskOptions as Q, StopSummary as R, postReview as S, review as T, log as U, flow as V, pipeline as W, FlowSteerOptions as X, FlowRecord as Y, FlowStep as Z, description as _, ReviewExec as a, ownReviewComments as b, ReviewPostSummary as c, ReviewSummary as d, GateResult as et, ReviewTarget as f, concurrency as g, changedLines as h, ReviewAuth as i, readTask as j, flowSdk as k, ReviewResult as l, args as m, REVIEW_PLATFORM as n, ReviewPostFinding as o, ReviewTargetInput as p, DiscoveredFlow as q, ReviewArgs as r, ReviewPostInput as s, Finding as t, ReviewServices as u, fingerprint as v, resolveReviewTarget as w, parseGithubPr as x, lastReviewSummary as y, review$1 as z };

package/dist/{rotate-key-Dpx_WmuU.js → rotate-key-Byk_wI73.js}

@@ -1 +1 @@
-import{i as e}from"./cli-ZUdhZnuW.js";import{n as t}from"./args-CxsMr9Un.js";import n from"node:process";const r=e({name:`server rotate-key`,globalFlags:{cwd:!1},help:{usage:`coder server rotate-key [--json]`,summary:`Re-seal stored app, installation, engine, and linked user secrets with the current key.`,env:[[`SERVER_ENCRYPTION_KEY`,`the new key`],[`SERVER_ENCRYPTION_KEY_PREVIOUS`,`the old key, still accepted while rotating`]]},options:{json:t},run:async()=>{let{rotateKey:e}=await import(`./maintenance-DuIspk-y.js`).then(e=>e.t);return e()},json:({moved:e})=>({ok:!0,moved:e}),print:({moved:e})=>n.stdout.write(`Re-sealed ${e} secret${e===1?``:`s`}.\n`)});export{r as commandServerRotateKey};
+import{i as e}from"./cli-Fp28pM4Y.js";import{n as t}from"./args-BekfmD9t.js";import n from"node:process";const r=e({name:`server rotate-key`,globalFlags:{cwd:!1},help:{usage:`coder server rotate-key [--json]`,summary:`Re-seal stored app, installation, engine, and linked user secrets with the current key.`,env:[[`SERVER_ENCRYPTION_KEY`,`the new key`],[`SERVER_ENCRYPTION_KEY_PREVIOUS`,`the old key, still accepted while rotating`]]},options:{json:t},run:async()=>{let{rotateKey:e}=await import(`./maintenance-BVDuG9Hg.js`).then(e=>e.t);return e()},json:({moved:e})=>({ok:!0,moved:e}),print:({moved:e})=>n.stdout.write(`Re-sealed ${e} secret${e===1?``:`s`}.\n`)});export{r as commandServerRotateKey};

package/dist/run-DKJW7qwy.js

@@ -0,0 +1,2 @@
+import{d as e,i as t,n,p as r}from"./cli-Fp28pM4Y.js";import{p as i,r as a,s as o,u as s}from"./output-BKeyLbvt.js";import{c,i as l,l as u,n as d,t as f}from"./args-BekfmD9t.js";import{i as p,n as m,r as h}from"./result-DvOqIwhh.js";import{printLine as g}from"./watch-p0j69fVA.js";import{TASK_FLAGS as _}from"./task-Ls_-kcSx.js";import v from"node:process";function y(t){let n=e([{usage:`coder task result ${t} --wait`,blurb:`run this in its own background shell, one per task (never wait on several tasks in one call). Returns with the answer or a pending approval.`},{usage:`coder task steer ${t} "<follow-up>"`,blurb:`steer the task with a message (use 'ask' without interrupting main thread)`},{usage:`coder task stop ${t}`,blurb:`stop the task`},{usage:`coder task list`,blurb:`recent tasks`},{usage:`coder task --help`,blurb:`all task commands`}],i,i.blue);return[...r(`Next step`,n.slice(0,1),i),...r(`Related`,n.slice(1),i)].join(`
+`)}function b(e,t){v.stdout.write(`${i.dim(`[coder]`)} task ${i.blue(e)} started in the background (${t}).\n`),v.stdout.write(`${y(e)}\n`)}function x(e){v.stderr.write(`${i.dim(`[coder]`)} Task ${i.cyan(e)} started and is waiting to finish. Press Ctrl-C to detach. It keeps running.\n`),v.stderr.write(`${y(e)}\n`)}function S(e){v.stderr.write(`\n${i.dim(`[coder] Detached. The task is still running.`)}\n\n${o([`Wait in its own background shell, one per task: coder task result ${e} --wait`],a)}\n`)}function C(e){v.stdout.write(`\n${m({finalMessage:e.finalMessage??void 0},e.error,`(no final message)`)}\n\n`);let t=e.tokens?` tokens=${s(e.tokens,e.model)}`:``;v.stderr.write(`${i.dim(`[coder] task=${e.taskId} status=${e.status}${t}`)}\n\n${h(e.taskId,a)}\n`)}const w=t({name:`task run`,help:{usage:`coder task run "<task text>"`,summary:`Dispatch a coding task to the configured engine. Backgrounds by default and\nprints a task id; --wait runs in the foreground and prints the answer.\nShortcut: \`coder run "<text>"\`.\n\nWriting a task: one task per focused goal, independent goals as parallel runs.\nThe worker starts with nothing but the text, so include the goal, file paths,\nconstraints and any context only you have. Delegate rather than doing the work\nyourself first, however small it looks.\n\nWaiting: run \`coder task result <task-id> --wait\` in its own background shell, one\nper task. Never wait on several tasks in one call, or their approvals and answers\nnever reach you one by one.\n\n${n}`,flags:[[`--output-schema <json>`,`JSON Schema for the task answer`],[`--name <name>`,`label the task (shown in list/result)`],[`--agent <id>`,`run as that agent: its system.md, engine settings, MCP servers and flows; flags override them`],[`--system <text>`,`standing instructions prepended to the task (kept out of prompt previews)`],..._,[`--server [url] [--workspace <slug>]`,`run the task on your Coder server and follow it here (--background prints its id)`],[`--repo <owner/name>`,`with --server: check out a repo from the workspace's installs`],[`--runner <name>`,`with --server: where it runs (a runner kind or a registered runner)`]],exitCodes:[[`0`,`The task started, or --wait printed a successful answer.`],[`1`,`Dispatch or the task failed.`],[`3`,`No engine could start; follow fallback.instructions in the JSON payload.`],[`4`,`An approval is pending; answer it, then run result --wait again.`],[`130`,`The foreground wait was detached and the task is still running.`]],examples:[[`coder run "add a /health endpoint"`,`dispatch in the background, print a task id`],[`coder result <task-id> --wait`,`then block until it finishes and print the answer`],[`coder run --wait "fix the failing test"`,`or block on the run itself`],[`coder task run --model luna --system "tests live in test/, don't touch anything outside of it" "rename foo to bar"`,`pick an engine via its model alias; --system adds standing instructions`],[`coder task run --agent reviewer "review the last commit"`,`run a repo agent from .coder/agents/reviewer`],[`coder run --add-dir ../api --add-dir ../shared "update the client for the new endpoint"`,`let the task reach sibling repos too`]]},options:{...f,agent:c,"output-schema":c,engine:c,model:c,effort:c,permissions:c,name:c,system:c,mcp:c,connections:c,"add-dir":u,background:d,wait:d,"simulate-approval":d,server:l,workspace:c,yes:d,repo:c,runner:c},args:1/0,async run({options:e,args:t}){let{tasks:n}=await import(`./task-C506SkPR.js`).then(e=>e.t),r=e.json,a;return v.on(`SIGINT`,()=>{a&&S(a),v.exit(130)}),n.run(t.join(` `).trim(),{cwd:e.cwd,agent:e.agent,outputSchema:e[`output-schema`]?JSON.parse(e[`output-schema`]):void 0,engine:e.engine,model:e.model,effort:e.effort,permissions:e.permissions,name:e.name,system:e.system,mcp:e.mcp,connections:e.connections?.split(`,`).map(e=>e.trim()).filter(Boolean),addDirs:e[`add-dir`],wait:e.server===void 0?e.wait:!e.background,simulateApproval:e[`simulate-approval`],repo:e.repo,runner:e.runner,server:e.server,yes:e.yes,organization:e.workspace,onFallback:({engine:e,detail:t,next:n})=>v.stderr.write(`[coder] ${e} failed to start (${t}); falling back to ${n}.\n`),onNote:e=>v.stderr.write(`[coder] ${e}\n`),onWaiting:e=>{a=e,r||x(e)},onLog:e=>r?v.stdout.write(`${JSON.stringify(e,null,2)}\n`):g(e,i)})},print(e,{options:t}){if(`attempts`in e)return t.background?void v.stdout.write(`${e.task.id}\n`):p(e,i);t.wait?C(e):b(e.taskId,e.status)},exit:(e,{options:t})=>(`attempts`in e?!t.background:t.wait)?e.status===`completed`?0:1:void 0});export{w as commandTask};

package/dist/run-DkYzyUnp.js

@@ -0,0 +1,5 @@
+import{U as e}from"./dispatch-BJZqI7sj.js";import{i as t}from"./cli-Fp28pM4Y.js";import{p as n,s as r}from"./output-BKeyLbvt.js";import{c as i,n as a,t as o}from"./args-BekfmD9t.js";import{FlowStepRenderer as s,printFollow as c,printRunSummary as l}from"./watch-CJruitc6.js";import u from"node:process";const d={...o,args:i,wait:a,concurrency:i,"max-tasks":i,"dry-run":a};function f(t){let n={};for(let r of t){let t=r.indexOf(`=`);if(t===-1)throw new e(`invalid-option`,`Invalid argument "${r}": expected key=value.`,{hint:`Help: coder flow run --help`});let i=r.slice(0,t),a=r.slice(t+1);try{n[i]=JSON.parse(a)}catch{n[i]=a}}return n}function p(t,n){if(t!==void 0)try{return JSON.parse(t)}catch(t){throw new e(`invalid-option`,`Invalid --args JSON: ${t instanceof Error?t.message:String(t)}`)}return n.length?f(n):{}}const m=e=>e?Number(e):void 0,h=(e,t)=>({cwd:t,dryRun:e[`dry-run`],concurrency:m(e.concurrency),maxTasks:m(e[`max-tasks`]),detached:!0,wait:e.wait}),g=e=>e[`dry-run`]&&!e.json?v():{},_=t({name:`flow run`,help:{usage:`coder flow run <name|path> [--args '<json>' | key=value...] [--wait] [--concurrency N] [--max-tasks N] [--json] [--dry-run]`,summary:`Run a flow: a TypeScript file that orchestrates many coder tasks with gates,
+journaling, and resume. Prints the run id and orchestrates in the background;
+--wait follows the run in the foreground with live progress (Ctrl-C detaches;
+it keeps running), and \`coder flow watch\` shows the same lines any time.
+Stop a run with \`coder flow stop\`.`,flags:[[`--wait`,`follow the run in the foreground (Ctrl-C detaches; it keeps running)`],[`--args <json>`,`the flow's input as a JSON value (or pass bare key=value pairs)`],[`--concurrency <n>`,`tasks running at once (default: CPU count)`],[`--max-tasks <n>`,`total tasks the run may dispatch (default: CPU count x 10)`],[`--dry-run`,`print every resolved prompt and gate command without dispatching`]],examples:[[`coder flow run audit-routes --wait`,`run a discovered flow`],[`coder flow run ./scratch/one-off.ts --wait`,`run a flow by path`],[`coder flow run verify --args '{"clusters":["a","b"]}' --wait`,`pass structured input`]]},options:d,args:1/0,required:[`<name|path>`],async run({options:e,args:[t,...n],cwd:r}){let{startRun:i}=await import(`./executor-LkokKTTd.js`).then(e=>e.S),a=await i(t,{...h(e,r),args:p(e.args,n)},g(e));return a.status===`running`&&a.watch&&await c(a.watch,e),a},print:e=>e.status===`running`?y(e):l(e)});function v(){let e=new s;return{onEvent:t=>e.emit(t)}}function y(e){u.stdout.write(`${n.dim(`[flow]`)} run ${n.cyan(e.runId)} started in the background (running).\n`),u.stdout.write(`\n${r([`Result: coder flow result ${e.runId}`,`Runs: coder flow list`],n)}\n`)}export{d as RUN_FLAGS,_ as commandRun,g as hooks,p as parseRunArgs,y as printDetached,h as runOptions};

package/dist/run-LCE1XiyU.js

@@ -0,0 +1,2 @@
+import{m as e}from"./prompt-DQyPCLUo.js";import{i as t,r as n}from"./cli-Fp28pM4Y.js";import{p as r,s as i}from"./output-BKeyLbvt.js";import{c as a,i as o,n as s,t as c}from"./args-BekfmD9t.js";import{i as l}from"./result-DvOqIwhh.js";import{printLine as u}from"./watch-p0j69fVA.js";import d from"node:process";const f={...c,flow:a,server:o,workspace:a,wait:s,task:a,yes:s},p=t({name:`agent run --task`,options:f,run:async({options:e,cwd:t})=>{let{agents:n}=await import(`./agent-B8ItyuHN.js`).then(e=>e.t);return n.runTask(e.task,{cwd:t})}}),m=t({name:`agent run`,help:{usage:`coder agent run <agent> <file> [--server [url] [--wait]] [--flow <name>] [--json] [--cwd <dir>]`,summary:`Run a recorded platform event (AgentEvent JSON) through an agent. With --server it goes through your Coder server exactly like a webhook: real app, tokens, runner, and the reply is posted. Without it the engine runs here on the agent's prompt and this checkout, platform tools off, and the reply is printed.`,flags:[n,[`--wait`,`with --server: follow the task log here until it finishes, then print the reply`],[`--flow <name>`,`override the matched flow`]],examples:[[`coder agent run helper sample-slack-mention.json`,`offline: print what the agent would reply`],[`coder agent run helper event.json --server`,`for real, through the server`]]},options:f,args:2,run:async({options:e,args:[t,n],cwd:i})=>{let{agents:a}=await import(`./agent-B8ItyuHN.js`).then(e=>e.t);return a.run(t,n,{...e,cwd:i,organization:e.workspace,...e.json?{}:{onLog:e=>u(e,r),onDone:e=>l(e,r)}})},json:e=>Array.isArray(e)&&e.length===1?e[0]:e,print(t,{options:n}){if(!Array.isArray(t)){if(`tasks`in t){if(!t.tasks.length)return void d.stdout.write(`The server accepted the event but no agent matched it.
+`);d.stdout.write(`${r.bold(`Queued on the server`)} as task ${t.tasks.join(`, `)}.\n\n${i([`Watch it: coder task watch ${t.tasks[0]} --server ${e(n.server)}`],r)}\n`);return}t.reply===void 0?t.result!==void 0&&d.stdout.write(`${JSON.stringify(t.result,null,2)}\n`):d.stdout.write(`${t.reply.trim()}\n`)}}}),h=Object.assign(e=>(e.some(e=>e===`--task`||e.startsWith(`--task=`))?p:m)(e),{commandName:`agent run`,help:m.help});export{h as commandAgentRun};

package/dist/runner-CxtzTgVq.js

@@ -0,0 +1 @@
+import{qi as e}from"./core-DwsAMCnL.js";import{U as t}from"./dispatch-BJZqI7sj.js";import{t as n}from"./remote-f-uny3XZ.js";import{t as r}from"./serve-CCxSxXgv.js";var i=e({addRunner:()=>o,addRunnerFields:()=>d,listRunners:()=>a,pairRunner:()=>s,removeRunner:()=>u,runners:()=>f,testRunner:()=>l,updateRunner:()=>c});const a=(e={})=>n(e).runners.list(),o=(e,t={})=>n(t).runners.add(e),s=(e,t={})=>n(t).runners.pair(e),c=(e,t,r={})=>n(r).runners.update(e,t),l=(e,t={})=>n(t).runners.test(e),u=(e,t={})=>n(t).runners.remove(e);async function d(e,r){let i=n(r),{catalog:a}=await i.runners.list(),o=a.find(t=>t.kind===e);if(!o)throw new t(`invalid-option`,`Unknown runner kind.`);if(!o.available)throw new t(`invalid-option`,o.reason??`Runner unavailable.`);let s={};for(let e of r.field??[]){let n=e.indexOf(`=`);if(n<1)throw new t(`invalid-option`,`Use --field key=value.`);let r=e.slice(0,n),i=e.slice(n+1),a=o.fields.find(e=>e.key===r);if(!a)throw new t(`invalid-option`,`Unknown runner field ${r}.`);if(a.secret){if(!/^env:[A-Z_][A-Z0-9_]*$/.test(i)||!process.env[i.slice(4)])throw new t(`invalid-option`,`Read ${r} from the environment with --field ${r}=env:VARIABLE.`);s[r]=process.env[i.slice(4)]}else s[r]=i}let c=r.scope??((await i.me()).user?`personal`:`workspace`);if(c!==`personal`&&c!==`workspace`)throw new t(`invalid-option`,`Scope must be personal or workspace.`);return o.connect===`pair`?i.runners.pair({name:r.name,scope:c}):i.runners.add({kind:o.kind,name:r.name??o.name,scope:c,config:s})}const f={list:a,add:o,pair:s,update:c,default:(e,t={})=>c(e,{default:!0},t),test:l,rename:(e,t,n={})=>c(e,{name:t},n),remove:u,serve:r};export{f as n,i as t};

package/dist/runner-Dnu1Vx_i.js

@@ -0,0 +1 @@
+import{s as e}from"./cli-Fp28pM4Y.js";const t=e(`runner`,{add:async()=>(await import(`./add-Bk8drM-8.js`)).commandRunnerAdd,default:async()=>(await import(`./default-tTTSBdXq.js`)).commandRunnerDefault,test:async()=>(await import(`./test-DF_qVK6S.js`)).commandRunnerTest,serve:async()=>(await import(`./serve-C1zag2nr.js`)).commandRunnerServe,list:async()=>(await import(`./list-CIS-GYO1.js`)).commandRunnerList,rename:async()=>(await import(`./rename-CKMyelWN.js`)).commandRunnerRename,remove:async()=>(await import(`./remove-CCYHc1FN.js`)).commandRunnerRemove},{menu:[{usage:`add <kind>`,blurb:`connect a runner`},{usage:`default <id>`,blurb:`set the default in its scope`},{usage:`test <id>`,blurb:`check a runner connection`},{usage:`serve --url <public url>`,blurb:`run your server's tasks on this machine`},{usage:`list`,blurb:`list your runners and the workspace's`},{usage:`rename <id> <name>`,blurb:`rename a runner`},{usage:`remove <id>`,blurb:`remove a runner`}],description:[`Run your Coder server's tasks on your own machine, reached through any tunnel.`],exampleCommand:`runner serve`});export{t as commandRunner};

package/dist/runner.json

@@ -0,0 +1 @@
+{"hash":"2d75923552c73b42581465cee2821c042c5a08be45bdf49269f68900d324d2a7"}

package/dist/runners-vsoGeyuc.js

@@ -0,0 +1,36 @@
+import{Rt as e,qi as t}from"./core-DwsAMCnL.js";import{N as n,Or as r,Sr as i,Tr as a,jn as o}from"./prompts-CEf7z4i_.js";import{m as s}from"./slack-Kpj-G9FE.js";import{t as c}from"./integrations-DPxWtNnS.js";import{n as l,t as u}from"./task-CQmx_2SI.js";import{_ as ee,g as d,h as te,l as f,v as p,y as m}from"./http-CXaW1e7x.js";import h from"node:path";import g from"node:process";import{existsSync as _,readFileSync as ne}from"node:fs";import{execFile as re}from"node:child_process";import{createCipheriv as v,createDecipheriv as y,createHash as b,createHmac as ie,randomBytes as x,randomUUID as S}from"node:crypto";import C,{isIP as w}from"node:net";import{readFile as ae}from"node:fs/promises";import{lookup as oe}from"node:dns/promises";import{request as se}from"node:https";const ce=i({env:a(r(),r().check(e(1)))}),T=`plain`;function E(e,t=`SERVER_ENCRYPTION_KEY`){if(!e)return;let n=Buffer.from(e,`base64`);if(n.length!==32)throw Error(`${t} must be a base64-encoded 32-byte key`);return n}function D(e){return E(e.encryptionKey)}function O(e){let t=E(e);return t?b(`sha256`).update(t).digest().readInt32BE(0):0}function k(e){return[[e.encryptionKey,`SERVER_ENCRYPTION_KEY`],[e.previousEncryptionKey,`SERVER_ENCRYPTION_KEY_PREVIOUS`]].filter(e=>!!e[0]).map(([e,t])=>({value:E(e,t),version:O(e)}))}function A(e){let t=ce.safeParse(e);if(!t.success||!Object.keys(t.data.env).length)throw Error(`Invalid engine credential`);return t.data}function le(e,t){let n=D(e);if(!n)return{iv:T,tag:``,ciphertext:Buffer.from(JSON.stringify(A(t))).toString(`base64`)};let r=x(12),i=v(`aes-256-gcm`,n,r),a=Buffer.concat([i.update(JSON.stringify(A(t)),`utf8`),i.final()]);return{iv:r.toString(`base64`),tag:i.getAuthTag().toString(`base64`),ciphertext:a.toString(`base64`)}}function ue(e,t){if(t.iv===T)return A(JSON.parse(Buffer.from(t.ciphertext,`base64`).toString(`utf8`)));for(let n of k(e))try{let e=y(`aes-256-gcm`,n.value,Buffer.from(t.iv,`base64`));return e.setAuthTag(Buffer.from(t.tag,`base64`)),A(JSON.parse(Buffer.concat([e.update(Buffer.from(t.ciphertext,`base64`)),e.final()]).toString(`utf8`)))}catch{}throw Error(`Stored credential was sealed with an unavailable encryption key`)}function de(e,t){let n=D(e);if(!n)return`${T}.${Buffer.from(JSON.stringify(t)).toString(`base64`)}`;let r=x(12),i=v(`aes-256-gcm`,n,r),a=Buffer.concat([i.update(JSON.stringify(t),`utf8`),i.final()]);return[r,i.getAuthTag(),a].map(e=>e.toString(`base64`)).join(`.`)}function j(e,t){if(t.startsWith(`${T}.`))return JSON.parse(Buffer.from(t.slice(6),`base64`).toString(`utf8`));let[n,r,i]=t.split(`.`).map(e=>Buffer.from(e,`base64`));for(let t of k(e))try{let e=y(`aes-256-gcm`,t.value,n);return e.setAuthTag(r),JSON.parse(Buffer.concat([e.update(i),e.final()]).toString(`utf8`))}catch{}throw Error(`Stored secret was sealed with an unavailable encryption key`)}function M(e,t){if(t.startsWith(`${T}.`))return 0;let[n,r,i]=t.split(`.`).map(e=>Buffer.from(e,`base64`));for(let t of k(e))try{let e=y(`aes-256-gcm`,t.value,n);return e.setAuthTag(r),e.update(i),e.final(),t.version}catch{}throw Error(`Stored secret was sealed with an unavailable encryption key`)}function fe(e,t,n={}){let r=`coder-${e.id.replace(/[^a-zA-Z0-9_.-]/g,`-`).slice(0,48)}-${Date.now()}`;t={...t,CODER_RUNNER_IMAGE:n.image??`ghcr.io/muzam1l/coder-runner:latest`,CODER_RUNNER_TARBALL_URL:G(t.CODER_SERVER)};let i=Object.keys(t).flatMap(e=>[`-e`,e]);return{args:[`run`,`-d`,`--name`,r,`--memory`,String(n.memory??`4g`),`--cpus`,String(n.cpus??2),`--pids-limit`,String(n.pidsLimit??512),`--network`,n.network??`bridge`,...i,n.image??`ghcr.io/muzam1l/coder-runner:latest`,`sh`,`-c`,q(``,`for binary in node bun git curl tar claude codex github-mcp-server; do command -v "$binary" >/dev/null 2>&1 || { printf "Docker image %s is missing required binary %s\\n" "$CODER_RUNNER_IMAGE" "$binary"; exit 127; }; done`),`coder-task`,e.id,K],env:t}}var pe=class{options;kind=`local-docker`;constructor(e={}){this.options=e}async start(e,t){let n=fe(e,{...t,CODER_INBOX_SOCKET:l},this.options),r=await d(`docker`,n.args,{PATH:g.env.PATH??``,...n.env});if(r.code!==0)throw Error(r.stderr.trim()||`docker run failed`);return r.stdout.trim()}async status(e){let t=await d(`docker`,[`inspect`,`--format`,`{{.State.Running}} {{.State.ExitCode}}`,e],{PATH:g.env.PATH??``});if(t.code!==0)return{state:`exited`};let[n,r]=t.stdout.trim().split(/\s+/);return n===`true`?{state:`running`}:{state:`exited`,code:Number(r)||0}}async stop(e){await d(`docker`,[`rm`,`-f`,e],{PATH:g.env.PATH??``})}async push(e,t){let n=await d(`docker`,[`exec`,`-e`,`CODER_INBOX_MESSAGES`,e,`node`,`-e`,u],{PATH:g.env.PATH??``,CODER_INBOX_MESSAGES:JSON.stringify(t)});if(n.code!==0)throw Error(`Docker inbox delivery failed`);return JSON.parse(n.stdout)}},me=t({GithubActionsRunner:()=>F,actionsWorkflow:()=>N});function N(){return`name: Coder agent
+run-name: Coder agent \${{ inputs.task }}
+on:
+  workflow_dispatch:
+    inputs:
+      task: { required: true, type: string }
+      server: { required: true, type: string }
+      token: { required: true, type: string }
+      mode: { required: true, type: string }
+      tarball: { required: true, type: string }
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    container: ${U}
+    steps:
+      - run: |
+          sh -c '${q().replaceAll(`'`,`'\\''`)}' coder-task "$TASK" '${K.replaceAll(`'`,`'\\''`).trim().replaceAll(`
+`,` `)}'
+        env:
+          TASK: \${{ inputs.task }}
+          CODER_SERVER: \${{ inputs.server }}
+          CODER_TASK_TOKEN: \${{ inputs.token }}
+          CODER_INBOX_MODE: \${{ inputs.mode }}
+          CODER_RUNNER_TARBALL_URL: \${{ inputs.tarball }}
+`}const P=e=>p(e);var F=class{options;kind=`github-actions`;fetcher;constructor(e={}){this.options=e,this.fetcher=e.fetch??fetch}async request(e,t={},n=1e4){if(!this.options.token)throw Error(`RUNNER_CONFIG.token is required for github-actions`);let r=AbortSignal.timeout(n);for(let n=0;;n++){let i=await this.fetcher(`https://api.github.com${e}`,{...t,signal:r,redirect:`manual`,headers:{accept:`application/vnd.github+json`,authorization:`Bearer ${this.options.token}`,"content-type":`application/json`,"user-agent":`coder`,"x-github-api-version":`2022-11-28`,...t.headers}});if((t.method??`GET`)!==`GET`||n===2||i.status!==429&&i.status<500)return i;let a=Number(i.headers.get(`retry-after`));await i.body?.cancel(),await new Promise((e,t)=>{let i=()=>{clearTimeout(s),r.removeEventListener(`abort`,o)},o=()=>{i(),t(r.reason)},s=setTimeout(()=>{i(),e()},Number.isFinite(a)&&a>0?a*1e3:100*2**n);r.addEventListener(`abort`,o,{once:!0}),r.aborted&&o()})}}async start(e,t){let n=this.options.repo??(e.event?.repo&&`${e.event.repo.owner}/${e.event.repo.name}`);if(!n)throw Error(`The github-actions runner requires a repository`);let r=Date.now()+(this.options.lookupTimeoutMs??25e3),i=encodeURIComponent(this.options.workflow??`coder-agent.yml`),a=e.event?.repo,o=this.options.ref??(a&&`${a.owner}/${a.name}`===n?a.defaultBranch:void 0);if(!o){let e=await this.request(`/repos/${n}`,{},Math.max(1,r-Date.now()));if(!e.ok)throw Error(`GitHub repository lookup failed: ${e.status}`);let t=await e.json();if(!t.default_branch)throw Error(`GitHub repository has no default branch`);o=t.default_branch}let s=await this.request(`/repos/${n}/actions/workflows/${i}/dispatches`,{method:`POST`,headers:{"x-github-api-version":`2026-03-10`},body:JSON.stringify({ref:o,inputs:{task:e.id,server:t.CODER_SERVER,token:t.CODER_TASK_TOKEN,mode:t.CODER_INBOX_MODE,tarball:G(t.CODER_SERVER)}})},Math.max(1,r-Date.now()));if(s.status!==200)throw Error(`GitHub workflow dispatch failed: ${s.status}`);let c=await s.json();if(!Number.isSafeInteger(c.workflow_run_id)||c.workflow_run_id<=0)throw Error(`GitHub workflow dispatch returned no run id`);return m({repo:n,run:c.workflow_run_id})}async status(e){let{repo:t,run:n}=P(e),r=await this.request(`/repos/${t}/actions/runs/${n}`);if(r.status===404)return{state:`exited`,code:1};if(!r.ok)throw Error(`GitHub workflow status failed: ${r.status}`);let i=await r.json();return i.status===`completed`?{state:`exited`,code:i.conclusion===`success`?0:1}:{state:`running`}}async stop(e){let{repo:t,run:n}=P(e),r=await this.request(`/repos/${t}/actions/runs/${n}/cancel`,{method:`POST`});if(r.status!==202&&r.status!==409)throw Error(`GitHub workflow cancellation failed: ${r.status}`)}};function he(e){if(!w(e))return!0;if(w(e)===6){let t=new URL(`https://[${e}]/`).hostname.slice(1,-1).split(`::`),n=t[0]?t[0].split(`:`):[],r=t[1]?t[1].split(`:`):[],i=[...n,...Array(8-n.length-r.length).fill(`0`),...r].map(e=>parseInt(e,16));if(i.every(e=>e===0)||i.slice(0,7).every(e=>e===0)&&i[7]===1||(i[0]&65024)==64512||(i[0]&65472)==65152||(i[0]&65280)==65280)return!0;let a;if(i.slice(0,5).every(e=>e===0)&&(i[5]===0||i[5]===65535))a=i.slice(6);else if(i.slice(0,4).every(e=>e===0)&&i[4]===65535&&i[5]===0)a=i.slice(6);else if((i[4]===0||i[4]===512)&&i[5]===24318)a=i.slice(6);else if(i[0]===100&&i[1]===65435&&i.slice(2,6).every(e=>e===0))a=i.slice(6);else if(i[0]===8194)a=i.slice(1,3);else if(i[0]===8193&&(i[1]===0||i[1]===3512)||i[0]===100&&i[1]===65435&&i[2]===1)return!0;if(!a)return!1;e=a.flatMap(e=>[e>>8,e&255]).join(`.`)}let t=e.split(`.`).map(Number);return t[0]===0||t[0]===10||t[0]===127||t[0]===169&&t[1]===254||t[0]===172&&t[1]>=16&&t[1]<=31||t[0]===192&&t[1]===168||t[0]===192&&t[1]===0&&(t[2]===0||t[2]===2)||t[0]===198&&t[1]>=18&&t[1]<=19||t[0]===198&&t[1]===51&&t[2]===100||t[0]===203&&t[1]===0&&t[2]===113||t[0]===100&&t[1]>=64&&t[1]<=127||t[0]>=224}var I=class{options;kind=`http`;base;fetcher;resolver;constructor(e){if(this.options=e,!e?.url)throw Error(`The http runner requires RUNNER_CONFIG.url`);if(this.base=new URL(`${e.url.replace(/\/+$/,``)}/`),this.base.protocol!==`https:`)throw Error(`The http runner requires an HTTPS URL`);if(this.base.username||this.base.password)throw Error(`The http runner URL cannot contain credentials`);if(!e.secret)throw Error(`RUNNER_CONFIG.secret is required for the http runner`);this.fetcher=e.fetch,this.resolver=e.lookup??oe}async safe(){let e=this.base.hostname.replace(/^\[|\]$/g,``),t=w(e)?[{address:e,family:w(e)}]:await this.resolver(e,{all:!0});if(!t.length)throw Error(`The http runner resolved no address`);if(t.some(e=>he(e.address)))throw Error(`The http runner refuses private and metadata addresses`);return t[0]}send(e,t,n){return this.fetcher?this.fetcher(e,t):new Promise((r,i)=>{let a=(this.options.request??se)(e,{method:t.method,headers:t.headers,signal:t.signal??void 0,agent:!1,lookup:(e,t,r)=>{t.all?r(null,[n]):r(null,n.address,n.family)}},e=>{let t=[];e.on(`data`,e=>t.push(Buffer.from(e))),e.on(`error`,i),e.on(`end`,()=>r(new Response(e.statusCode===204?null:Buffer.concat(t),{status:e.statusCode})))});a.on(`error`,i),a.end(t.body)})}async request(e,t=`GET`,n,r){let i=await this.safe(),a=n===void 0?``:JSON.stringify(n),o=String(Date.now()),s=x(16).toString(`base64url`),c=ie(`sha256`,this.options.secret).update(`${a}.${o}.${s}`).digest(`base64url`),l=await this.send(new URL(e.replace(/^\//,``),this.base),{method:t,redirect:`manual`,headers:{...this.options.headers,"content-type":`application/json`,"x-coder-timestamp":o,"x-coder-nonce":s,"x-coder-signature":c},...a?{body:a}:{},signal:r??AbortSignal.timeout(e===`/start`?3e4:1e4)},i);if(l.status>=300&&l.status<400)throw Error(`The http runner refuses redirects`);if(!l.ok)throw Error(`HTTP runner request failed: ${l.status}`);if(l.status===204)return;let u=await l.text();return u?JSON.parse(u):void 0}health(e){return this.request(`/health`,`GET`,void 0,e)}async start(e,t){let n=await this.request(`/start`,`POST`,{task:e.id,env:t});if(!n.handle)throw Error(`HTTP runner returned no handle`);return n.handle}status(e){return this.request(`/status/${encodeURIComponent(e)}`)}async stop(e){await this.request(`/stop/${encodeURIComponent(e)}`,`POST`,{})}push(e,t){return this.request(`/messages/${encodeURIComponent(e)}`,`POST`,{entries:t})}};const L=e=>p(e),R=18e5,ge={"eu-north-1":`arn1`,"ap-south-1":`bom1`,"eu-west-3":`cdg1`,"us-east-2":`cle1`,"af-south-1":`cpt1`,"eu-west-1":`dub1`,"eu-central-1":`fra1`,"sa-east-1":`gru1`,"ap-east-1":`hkg1`,"ap-northeast-1":`hnd1`,"us-east-1":`iad1`,"ap-northeast-2":`icn1`,"ap-northeast-3":`kix1`,"eu-west-2":`lhr1`,"us-west-2":`pdx1`,"us-west-1":`sfo1`,"ap-southeast-1":`sin1`,"ap-southeast-2":`syd1`,"ca-central-1":`yul1`};function _e(e){if(!e)return;let t=(()=>{try{return new URL(e).hostname}catch{return``}})();return Object.entries(ge).find(([e])=>t.includes(e))?.[1]}const z=[{name:`ANTHROPIC_API_KEY`,host:`api.anthropic.com`,header:`x-api-key`,prefix:``},{name:`OPENAI_API_KEY`,host:`api.openai.com`,header:`authorization`,prefix:`Bearer `}],ve=`brokered`,B={claude:{api:`api.anthropic.com`,account:[`claude.ai`,`platform.claude.com`]},codex:{api:`api.openai.com`,account:[`auth.openai.com`,`chatgpt.com`]}};function ye(e,t){let n=B[e],r=t.CLAUDE_CODE_OAUTH_TOKEN||t.CODEX_AUTH_JSON,i=[t.ANTHROPIC_BASE_URL,t.OPENAI_BASE_URL].filter(e=>e&&URL.canParse(e));return[...n?[n.api,...r?n.account:[]]:[],...i.map(e=>new URL(e).hostname)]}function be(e={},t,n=z){let r={};for(let t of n)e[t.name]&&((r[t.host]??={})[t.header]=`${t.prefix}${e[t.name]}`);let i=Object.entries(r).map(([e,t])=>[e,[{transform:[{headers:t}]}]]);if(!t)return i.length?{allow:{...Object.fromEntries(i),"*":[]}}:void 0;let a=[...new Set(t.filter(e=>C.isIP(e)))],o=t.filter(e=>!C.isIP(e)).map(e=>[e,[]]);return{allow:{...Object.fromEntries(o),...Object.fromEntries(i)},...a.length?{subnets:{allow:a.map(e=>`${e}/${C.isIPv6(e)?128:32}`)}}:{}}}function xe(e){return[...[e.CODER_SERVER,e.CODER_RUNNER_TARBALL_URL].filter(e=>e&&URL.canParse(e)).map(e=>new URL(e).hostname),...Object.values(c).flatMap(e=>e.tools.installHosts??[])]}async function Se(){try{return(await import(`@vercel/sandbox`)).Sandbox}catch{throw Error(`The vercel-sandbox runner requires @vercel/sandbox in the adapter app.`)}}function V(e){return e&&typeof e==`object`&&`response`in e&&e.response instanceof Response?e.response.status:void 0}function Ce(e){if(V(e)!==410||!e||typeof e!=`object`||!(`json`in e))return!1;let t=e.json;if(!t||typeof t!=`object`||!(`error`in t))return!1;let n=t.error;return!!n&&typeof n==`object`&&`code`in n&&n.code===`snapshot_not_found`}var H=class extends Error{snapshotId;constructor(e,t,n){super(e,n),this.snapshotId=t}},we=class{options;kind=`vercel-sandbox`;sandboxes=new Map;constructor(e={}){this.options=e}api(){return this.options.sandbox?Promise.resolve(this.options.sandbox):Se()}async sandbox(e){for(let[e,t]of this.sandboxes)t.expiresAt<=this.now()&&this.sandboxes.delete(e);return this.sandboxes.get(e)?.sandbox??(await this.api()).get({...this.auth(),name:e})}now(){return(this.options.now??Date.now)()}auth(){return{...this.options.token?{token:this.options.token,projectId:this.options.projectId??process.env.VERCEL_PROJECT_ID,teamId:this.options.team??process.env.VERCEL_TEAM_ID}:{}}}base(e){return{...e?{source:{type:`snapshot`,snapshotId:e}}:this.options.image?{image:this.options.image}:{},...this.options.region?{region:this.options.region}:{},...this.auth(),resources:{vcpus:this.options.vcpus??1},persistent:!1}}snapshotKey(e){let t=e.event?.repo;if(!t)return;let n=[W(),this.options.image??null,e.event.appId,e.event.installationId,t.owner,t.name];return`repo:${this.options.region??``}:${s(JSON.stringify(n))}`}async stopSandbox(e){try{await e.stop()}finally{this.sandboxes.delete(e.name)}}async withSandbox(e,t){let n;try{if(n=typeof e==`string`?await this.sandbox(e):e,n.status!==`running`&&n.status!==`pending`)throw new H(`Vercel Sandbox ${n.name} is ${n.status}`);return await t(n)}catch(t){let r=V(t);throw(r===404||r===410)&&typeof e==`string`&&this.sandboxes.delete(e),r===410||!n&&typeof e==`string`&&r===404?new H(t instanceof Error?t.message:`Vercel Sandbox expired`,void 0,{cause:t}):t}}withSnapshotLock(e,t){let n=this.options.snapshots;return n.withLock?n.withLock(e,t):t(n)}async finalizeSnapshot(e,t){let n=this.now(),r=S(),i=await this.withSnapshotLock(e,async i=>{let a=await i.get(e)??{};if(!a.build||a.lease&&a.lease.expiresAt>n||t?.build&&(a.build.sandbox!==t.build.sandbox||a.build.command!==t.build.command||a.build.startedAt!==t.build.startedAt))return a;let o={...a,lease:{owner:r,expiresAt:n+R}};return await i.put(e,o),o});if(i.lease?.owner!==r||!i.build)return i;let{build:a,lease:o,...s}=i,c={...s,build:a},l;try{c=await this.withSandbox(a.sandbox,async e=>{let t=await e.getCommand(a.command);if(t.exitCode===null&&n-a.startedAt<R)return c;if(t.exitCode===0){let r=/^coder-snapshot (\S+)$/m.exec(await t.stdout())?.[1];if(r&&r===i.sha)return await this.stopSandbox(e).catch(()=>{}),{...s,checkedAt:n};let a=await e.snapshot({expiration:2592e6});return this.sandboxes.delete(e.name),{...s,snapshotId:a.snapshotId,...r?{sha:r}:{},checkedAt:n}}return await this.stopSandbox(e).catch(()=>{}),{...s,failedAt:n}})}catch(e){if(l=e,e instanceof H){let{failedAt:e,...t}=s;c=t}}let u=await this.withSnapshotLock(e,async t=>{let n=await t.get(e)??{};return n.lease?.owner===r?(await t.put(e,c),c):n});if(l)throw l;return u}async snapshot(e,t,n,r){if(!this.options.snapshots)return;let i=await this.finalizeSnapshot(e);if(i.build)return i.snapshotId;let a=this.now(),o=S(),s=await this.withSnapshotLock(e,async t=>{let r=await t.get(e)??{},i=!r.snapshotId||n&&a-(r.checkedAt??0)>=9e5,s=r.failedAt!==void 0&&a-r.failedAt<36e5;if(r.build||r.lease&&r.lease.expiresAt>a||!i||s)return r;let c={...r,lease:{owner:o,expiresAt:a+R}};return await t.put(e,c),c});if(s.lease?.owner!==o)return s.snapshotId;let c,l;try{c=await t(s.snapshotId)}catch(e){e instanceof H&&(l=e)}let u=await this.withSnapshotLock(e,async t=>{let n=await t.get(e)??{};if(n.lease?.owner!==o)return n;let{lease:r,...i}=n,s={...i,...c?{build:{sandbox:c.sandbox,command:c.command,startedAt:a}}:{}};return await t.put(e,s),s});if(c)if(u.build?.sandbox===c.sandbox&&u.build.command===c.command){let t=(async()=>{await c.wait(),await this.finalizeSnapshot(e,u)})().catch(()=>{});r?.(t)}else await this.withSandbox(c.sandbox,e=>this.stopSandbox(e)).catch(()=>{});if(l)throw l;return u.snapshotId}async detached(e,t,n={}){let r=await(await this.api()).create({...this.base(e),timeout:this.options.timeoutMs??18e5,...n}).catch(t=>{throw e&&Ce(t)?new H(t.message,e,{cause:t}):t});if(!t.env?.CODER_PREPARE){for(let[e,t]of this.sandboxes)t.expiresAt<=this.now()&&this.sandboxes.delete(e);this.sandboxes.size>=1e3&&this.sandboxes.delete(this.sandboxes.keys().next().value),this.sandboxes.set(r.name,{sandbox:r,expiresAt:this.now()+Number(n.timeout??this.options.timeoutMs??R)})}try{let e=await this.withSandbox(r,e=>e.runCommand({...t,detached:!0}));return{sandbox:r.name,command:e.cmdId,wait:()=>e.wait({signal:AbortSignal.timeout(R)})}}catch(e){throw this.sandboxes.delete(r.name),await this.stopSandbox(r).catch(()=>{}),e}}async start(e,t,r,i={}){t={...t,[n]:`1`,CODER_RUNNER_TARBALL_URL:G(t.CODER_SERVER),CODER_RUNNER_HASH:W()};let a=be(r,i.hosts&&[...xe(t),...i.hosts],i.brokered),o=t=>({cmd:`sh`,args:[`-c`,q(ee().map(e=>`sudo sh -c '${e.replaceAll(`'`,`'\\''`)}'`).join(` && `),``,`setpriv --inh-caps=-all --ambient-caps=-all bun`),`coder-task`,e.id,K],env:t});for(let n=0;;n++){let r;try{r=this.snapshotKey(e);let n=r?await this.snapshot(r,e=>this.detached(e,o({...t,CODER_PREPARE:`1`})),!0,i.waitUntil):void 0,s=await this.detached(n,o({...t,CODER_INBOX_SOCKET:l}),{...a?{networkPolicy:a}:{},...i.timeoutMs?{timeout:i.timeoutMs}:{}});return m({sandbox:s.sandbox,command:s.command})}catch(e){if(!(e instanceof H))throw e;if(r&&e.snapshotId&&this.options.snapshots){let t=e.snapshotId;await this.withSnapshotLock(r,async e=>{let n=await e.get(r);if(n?.snapshotId!==t)return;let{snapshotId:i,sha:a,checkedAt:o,failedAt:s,...c}=n;await e.put(r,c)})}if(n===2)throw e}}}async status(e){let t=L(e);try{let e=await this.sandbox(t.sandbox);if(e.status===`pending`)return{state:`running`};if(e.status!==`running`)return this.sandboxes.delete(t.sandbox),{state:`exited`,code:1};let n=await e.getCommand(t.command);return n.exitCode===null?{state:`running`}:{state:`exited`,code:n.exitCode}}catch(e){throw[404,410].includes(V(e)??0)&&this.sandboxes.delete(t.sandbox),e}}async push(e,t){return this.withSandbox(L(e).sandbox,async e=>{let n=await e.runCommand({cmd:`node`,args:[`-e`,u],detached:!1,env:{CODER_INBOX_MESSAGES:JSON.stringify(t)}}),r=await n.stdout();if(n.exitCode!==0)throw Error(`Sandbox inbox delivery failed`);return JSON.parse(r)})}async stop(e){let t=L(e).sandbox;try{await(await this.sandbox(t)).stop()}finally{this.sandboxes.delete(t)}}};const U=`ghcr.io/muzam1l/coder-runner:latest`;function W(){let e=new URL(`./runner.json`,import.meta.url),{hash:t}=JSON.parse(ne(_(e)?e:h.join(o,`dist/runner.json`),`utf8`));if(typeof t!=`string`||!/^[a-f0-9]{64}$/.test(t))throw Error(`The runner package is missing; run bun run build.`);return t}function G(e){return`${e.replace(/\/+$/,``)}/runner/${W()}.tgz`}async function Te(e,t,n){if(n.file!==`${W()}.tgz`)return f();try{let e=new URL(`./runner.tgz`,import.meta.url),t=await ae(_(e)?e:h.join(o,`dist/runner.tgz`));return new Response(t,{headers:{"content-type":`application/gzip`,"cache-control":`public, max-age=31536000, immutable`}})}catch(e){if(e.code===`ENOENT`)return f();throw e}}const K=`
+const [file, id] = process.argv.slice(1);
+const lines = require('fs').readFileSync(file, 'utf8').split('\\n').map(line => line.trim()).filter(Boolean);
+const error = 'The machine failed: ' + lines.slice(-6).join(' ').slice(-800);
+const login = process.env.CODER_LOGIN;
+const url = process.env.CODER_SERVER.replace(/\\/+$/, '') + (login ? '/logins/' : '/tasks/') + encodeURIComponent(id) + (login ? '' : '/result');
+fetch(url, {
+  method: 'POST', signal: AbortSignal.timeout(10000),
+  headers: { authorization: 'Bearer ' + process.env.CODER_TASK_TOKEN, 'content-type': 'application/json' },
+  body: JSON.stringify(login ? { error } : { status: 'failed', error, machine: true }),
+}).then(response => { if (!response.ok) process.exitCode = 1; }).catch(() => { process.exitCode = 1; });
+`;function q(e=``,t=``,n=`bun`){let r=[`rm -rf .coder-runner/package && tar -xzf .coder-runner/package.tgz -C .coder-runner`,`mkdir -p .coder-runner/bin`,`printf '#!/bin/sh\nexec ${n} "$(dirname "$0")/../package/bin/coder.mjs" "$@"\n' > .coder-runner/bin/coder`,`chmod +x .coder-runner/bin/coder`].join(` && `),i=`node -e 'const fs=require("fs"),crypto=require("crypto");process.exit(/^[a-f0-9]{64}$/.test(process.env.CODER_RUNNER_HASH||"")&&crypto.createHash("sha256").update(fs.readFileSync(".coder-runner/package.tgz")).digest("hex")===process.env.CODER_RUNNER_HASH?0:1)'`,a=[`mkdir -p .coder-runner`,'curl -fsSL --retry 2 --connect-timeout 10 --max-time 30 "${CODER_RUNNER_TARBALL_URL:?Runner package URL is required}" -o .coder-runner/package.tgz',`{ [ -z "$CODER_RUNNER_HASH" ] || ${i}; }`,r,...e?[e]:[],`printf "%s" "$CODER_RUNNER_HASH" > .coder-runner/hash`].join(` && `),o=`[ -n "$CODER_RUNNER_HASH" ] && [ -f .coder-runner/package.tgz ] && [ "$(cat .coder-runner/hash 2>/dev/null)" = "$CODER_RUNNER_HASH" ] && ${i}`;return[`out=$(mktemp)`,`{ (${[...t?[t]:[],`if ${o}; then ${r}; else ${a}; fi`,`PATH="$PWD/.coder-runner/bin:$PATH" CODER_NO_UPDATE_CHECK=1 ${n} .coder-runner/package/bin/coder.mjs agent run --task "$1"`].join(` && `)}) 2>&1; echo $? >"$out.status"; } | tee "$out"`,`status=$(cat "$out.status")`,`[ "$status" = 0 ] || { [ -n "$CODER_PREPARE" ] || { if command -v node >/dev/null 2>&1; then node -e "$2" "$out" "$1"; else bun -e "$2" "$out" "$1"; fi; }; }`,`rm -f "$out" "$out.status"`,`exit "$status"`].join(`; `)}const Ee=[`local`,`local-docker`,`vercel-sandbox`,`github-actions`,`http`];function J(e,t=``){return{get:n=>e.get(`snapshot`,`${t}${n}`),put:(n,r)=>e.put(`snapshot`,`${t}${n}`,r),withLock:(n,r)=>e.withAppLock(`snapshot:${t}${n}`,e=>r({get:n=>e.get(`snapshot`,`${t}${n}`),put:(n,r)=>e.put(`snapshot`,`${t}${n}`,r)}))}}function De(e){let t=e.kind;return e.local===!1&&(t===`local`||t===`local-docker`)?{}:{[t]:Y(t,e)}}function Y(e,t){let n=t.config??{};if(e===`local`)return new te(t.workDir);if(e===`local-docker`)return new pe(n);if(e===`vercel-sandbox`)return new we({...t.sandbox,...n});if(e===`github-actions`)return new F({...n,...t.fetch?{fetch:t.fetch}:{}});if(typeof n.url!=`string`||typeof n.secret!=`string`)throw Error(`HTTP runner requires a URL and secret`);return new I({url:n.url,secret:n.secret,...t.fetch?{fetch:t.fetch}:{}})}function X(e,t){return e.scope===`workspace`||!!(t&&e.owner===t)}function Z(e){return e.local?`local`:`default`}async function Oe(e,t={}){let n=t.runner??t.agent;if(n===Z(e))return{runner:e.config.runner};let r=(await e.store.list(`runner`,{visibleTo:t.requester,...n?{runner:n}:{defaults:!0}})).filter(({value:n})=>X(n,t.requester)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`)),i=n?r.find(({id:e,value:t})=>e===n||t.name===n):r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.scope===`workspace`&&e.default);if(n&&!i)throw Error(`Unknown runner "${n}".`);return i?{runner:i.value.kind,runnerId:i.id}:{runner:e.config.runner}}function Q(e,t,n){let r={...t.config,...j(e.config,t.secret)};return Y(t.kind,{workDir:e.config.workDir,config:r,fetch:e.fetch,sandbox:{...n?{snapshots:J(e.store,`runner:${n}:`)}:{}}})}async function ke(e,t){if(!t.runnerId)return e.runners[t.runner];let n=await e.store.get(`runner`,t.runnerId);if(!n||n.kind!==t.runner||!e.local&&(n.kind===`local`||n.kind===`local-docker`)){e.settings?.runnerInstances?.delete(t.runnerId);return}j(e.config,n.secret);let r=(e.settings??={}).runnerInstances??=new Map,i=JSON.stringify([n.kind,n.config,n.secret]),a=r.get(t.runnerId);return a?.signature!==i&&(a={signature:i,runner:Q(e,n,t.runnerId)},r.set(t.runnerId,a)),a.runner}function Ae(e,t){if(Object.keys(t).some(t=>!e.fields.some(e=>e.key===t)))throw Error(`Unknown runner field`);for(let n of e.fields)if(!n.optional&&!t[n.key]?.trim())throw Error(`${n.label} is required`);if(e.kind===`http`){if(t.secret.length<32)throw Error(`Secret must contain at least 32 characters`);new I({url:t.url,secret:t.secret})}if(e.kind===`github-actions`&&!/^[\w.-]+\/[\w.-]+$/.test(t.repo))throw Error(`Repository must be owner/repo`);if(e.kind===`local-docker`&&t.cpus&&!(Number(t.cpus)>0&&Number.isFinite(Number(t.cpus))))throw Error(`CPUs must be positive`)}var $=class extends Error{};async function je(e,t){let n=Date.now(),r=new AbortController,i,a=new Promise((t,n)=>{i=setTimeout(()=>{r.abort(),n(new $(`Runner check timed out`))},e.runnerTimeoutMs??5e3)});try{return{ok:!0,detail:await Promise.race([a,(async()=>{let n=t?.kind??e.config.runner,i=t?{...t.config,...j(e.config,t.secret)}:e.config.runnerConfig??{};if(n===`local`){if(!e.local)throw new $(`Local runners require a local server`);return`This machine is available`}if(n===`http`){let n=t?Q(e,t):e.runners.http;if(!(n instanceof I)||!(await n.health(r.signal)).ok)throw new $(`Runner health check failed`);return`Runner is reachable`}if(n===`local-docker`){if(!e.local)throw new $(`Docker runners require a local server`);return await new Promise((t,n)=>{(e.runnerExec??re)(`docker`,[`info`],{timeout:5e3,signal:r.signal},e=>e?n(new $(`Docker is unavailable`)):t())}),`Docker is available`}let a=async t=>{let n=await(e.fetch??fetch)(t,{signal:r.signal,redirect:`manual`,headers:{authorization:`Bearer ${i.token}`,accept:`application/json`,"user-agent":`coder`}});if(!n.ok)throw new $(`Runner check failed with HTTP ${n.status}`);return n};if(n===`github-actions`){let e=String(i.repo).split(`/`).map(encodeURIComponent).join(`/`);return await a(`https://api.github.com/repos/${e}`),await a(`https://api.github.com/repos/${e}/actions/workflows/${encodeURIComponent(String(i.workflow))}`),`Repository and workflow are accessible`}let o=await(await a(`https://api.vercel.com/v2/teams?limit=100`)).json();if(!Array.isArray(o.teams))throw new $(`Invalid team response`);if(i.team&&!o.teams.some(e=>e.id===i.team||e.slug===i.team))throw new $(`Team is not accessible`);return`Teams are accessible`})()]),ms:Date.now()-n}}catch(e){return{ok:!1,detail:e instanceof $?e.message:`Runner check failed`,ms:Date.now()-n}}finally{clearTimeout(i)}}export{de as C,le as S,M as T,I as _,Te as a,ue as b,ke as c,X as d,z as f,_e as g,ye as h,De as i,je as l,B as m,Ee as n,J as o,ve as p,Oe as r,Z as s,U as t,Ae as u,N as v,O as w,j as x,me as y};