@wular/coder 0.5.0 → 0.5.2

package/dist/apps-CCqOsEZH.js

@@ -0,0 +1,18 @@
+import{A as e,Ea as t,O as n,P as r,T as i,_ as a,g as o,h as s,j as c,kn as l,pn as u,un as d,w as f,x as p}from"./args-CJsHYWbt.js";import{t as m}from"./errors-DK_trCff.js";import{$ as h,B as g,C as _,D as v,H as y,I as b,N as x,P as S,T as C,U as ee,V as w,Y as te,Z as T,_ as ne,bt as re,c as ie,dt as ae,f as oe,ft as se,g as ce,gt as le,j as ue,k as de,nt as fe,o as pe,ot as E,pt as me,s as he,tt as ge,w as _e}from"./state-CxAUec80.js";import{n as ve,t as ye}from"./types-DHBqXFE2.js";import{B as be,C as xe,E as Se,H as Ce,K as we,P as Te,R as Ee,S as De,T as Oe,U as ke,W as Ae,X as je,_ as Me,j as Ne,k as Pe,l as Fe,r as Ie,w as Le,z as Re}from"./config-_32PHl9g.js";import{C as ze,D as Be,E as Ve,O as He,S as Ue,T as We,a as Ge,d as Ke,h as qe,i as Je,l as Ye,p as Xe,r as Ze,s as Qe,t as $e,u as et,v as tt,w as nt,x as rt,y as it}from"./connections-B90TemYf.js";import{v as at}from"./app-server-dnlLhhZb.js";import{a as ot,c as st,i as ct,n as lt,r as ut,t as dt,u as ft}from"./load-BtIDghgd.js";import{n as pt,t as mt}from"./integrations-DSZSa8Rc.js";import{i as ht,n as gt,r as _t,t as vt}from"./crypto-Ittsv-m4.js";import{a as yt,d as bt,f as xt,n as St,o as Ct,r as wt,s as Tt,t as Et,u as Dt}from"./definition-D0OpQfGX.js";import{M as Ot,S as kt,d as At,f as jt,i as Mt,l as Nt,o as Pt,p as Ft,r as It,s as Lt,y as Rt}from"./dispatch-BkoIU4GU.js";import{C as zt,_ as Bt,b as Vt,d as Ht,l as Ut,n as Wt,p as Gt,s as Kt,t as qt,w as Jt,x as Yt,y as Xt}from"./approvals-C8XV7CK2.js";import{i as Zt,t as Qt}from"./discover-BfYHHJN_.js";import{a as $t,c as en,l as tn,o as nn,r as rn,s as an}from"./view-D-rbQ1Kz.js";import{c as on,d as sn,g as cn,n as ln,s as un,v as dn}from"./actions-C35tq9KH.js";import{E as fn,c as pn,s as mn}from"./executor-Ds4wDCzV.js";import{a as hn,i as gn,r as _n,t as vn}from"./mcp-cEIva8Pd.js";import{i as yn,n as bn}from"./turn-eI4iRPsq.js";import{c as xn,f as Sn,n as Cn,o as wn,r as Tn,t as En,u as Dn}from"./exec-CNygM6yF.js";import{i as On}from"./models-mKyePWrV.js";import{a as D,c as kn,d as O,f as k,h as An,i as jn,l as A,m as Mn,n as Nn,p as j,r as Pn,u as Fn}from"./http-DRk8cDjf.js";import{i as In}from"./async-BP5q3Une.js";import{n as Ln,r as Rn,t as zn,u as Bn}from"./task-CzXNLREX.js";import{n as Vn,r as Hn,t as Un}from"./local-DFrTuJFN.js";import{n as Wn}from"./env-BwFCHakK.js";import{a as Gn,c as Kn,d as qn,o as Jn,r as Yn,s as Xn,t as Zn,u as Qn}from"./github-actions-2RjyRseX.js";import{C as $n,S as er,T as tr,_ as nr,a as rr,b as ir,c as ar,d as M,f as or,g as sr,h as cr,i as lr,m as ur,n as dr,o as fr,p as pr,t as mr,u as hr,w as gr,y as _r}from"./local-CqOUpEtl.js";import{n as vr,t as yr}from"./chat-Bfu9XKRa.js";import N from"node:path";import br from"node:process";import{fileURLToPath as xr,pathToFileURL as Sr}from"node:url";import P,{accessSync as Cr,constants as wr,existsSync as Tr,readFileSync as Er,statSync as Dr}from"node:fs";import{execFile as Or,spawn as kr}from"node:child_process";import Ar,{isIP as jr}from"node:net";import Mr from"node:os";import{createCipheriv as Nr,createDecipheriv as Pr,createHash as Fr,createHmac as Ir,randomBytes as F,randomUUID as I}from"node:crypto";import{isDeepStrictEqual as Lr,promisify as Rr}from"node:util";import{brotliDecompressSync as zr,constants as Br,createGzip as Vr,gunzip as Hr,gunzipSync as Ur,gzip as Wr,gzipSync as Gr,inflateSync as Kr}from"node:zlib";import{lookup as qr}from"node:dns/promises";import{request as Jr}from"node:https";const Yr=e=>`nonce:${ht(e)}`;function Xr(e){let t=e.config.encryptionKey??e.config.adminToken;if(!t)throw Error(`A server secret is required to issue browser transactions.`);return t}function Zr(e,t){return Ir(`sha256`,Xr(e)).update(t).digest(`base64url`)}async function Qr(e,t,n,r,i=6e5){let a=(e.now??Date.now)(),o={kind:t,user:n,organization:e.organizationId,nonce:F(18).toString(`base64url`),exp:a+i},s=gt(o),c=`${s}.${Zr(e,s)}`;return await e.store.put(`delivery`,Yr(c),{at:a,target:r},{ttlMs:i}),c}function $r(e,t){let[n,r,i]=t.split(`.`);if(!(!n||!r||i!==void 0)&&_t(Zr(e,n),r))try{return vt(n)}catch{return}}async function ei(e,t){let n=await e.store.get(`delivery`,Yr(t));return n&&`target`in n?n.target:void 0}function ti(e,t){return $r(e,t)?.organization}function ni(e,t){return $r(e,t)?.user}function ri(e,t,n,r,i=!0){let a=$r(e,t);return a&&a.kind===n&&(a.user===r||i&&a.user===`*`)&&a.organization===e.organizationId&&a.exp>=(e.now??Date.now)()?a:void 0}async function ii(e,t,n,r,i){if(!ri(e,t,n,r,!1))return!1;let a=await e.store.take(`delivery`,Yr(t),{target:i});return!!a&&`target`in a&&a.target===i}async function ai(e,t,n,r){if(!ri(e,t,n,r))return;let i=await e.store.take(`delivery`,Yr(t));return i&&`target`in i?i.target:void 0}async function oi(e,t,n,r){return ri(e,t,n,r)?ei(e,t):void 0}const si=f({env:n(c(),c().check(u(1)))}),ci=`plain`;function li(e,t=`SERVER_ENCRYPTION_KEY`){if(!e)return;let n=Buffer.from(e,`base64`);if(n.length!==32)throw Error(`${t} must be a base64-encoded 32-byte key`);return n}function ui(e){return li(e.encryptionKey)}function di(e){let t=li(e);return t?Fr(`sha256`).update(t).digest().readInt32BE(0):0}function fi(e){return[[e.encryptionKey,`SERVER_ENCRYPTION_KEY`],[e.previousEncryptionKey,`SERVER_ENCRYPTION_KEY_PREVIOUS`]].filter(e=>!!e[0]).map(([e,t])=>({value:li(e,t),version:di(e)}))}function pi(e){let t=si.safeParse(e);if(!t.success||!Object.keys(t.data.env).length)throw Error(`Invalid engine credential`);return t.data}function mi(e,t){let n=ui(e);if(!n)return{iv:ci,tag:``,ciphertext:Buffer.from(JSON.stringify(pi(t))).toString(`base64`)};let r=F(12),i=Nr(`aes-256-gcm`,n,r),a=Buffer.concat([i.update(JSON.stringify(pi(t)),`utf8`),i.final()]);return{iv:r.toString(`base64`),tag:i.getAuthTag().toString(`base64`),ciphertext:a.toString(`base64`)}}function hi(e,t){if(t.iv===ci)return pi(JSON.parse(Buffer.from(t.ciphertext,`base64`).toString(`utf8`)));for(let n of fi(e))try{let e=Pr(`aes-256-gcm`,n.value,Buffer.from(t.iv,`base64`));return e.setAuthTag(Buffer.from(t.tag,`base64`)),pi(JSON.parse(Buffer.concat([e.update(Buffer.from(t.ciphertext,`base64`)),e.final()]).toString(`utf8`)))}catch{}throw Error(`Stored credential was sealed with an unavailable encryption key`)}function L(e,t){let n=ui(e);if(!n)return`${ci}.${Buffer.from(JSON.stringify(t)).toString(`base64`)}`;let r=F(12),i=Nr(`aes-256-gcm`,n,r),a=Buffer.concat([i.update(JSON.stringify(t),`utf8`),i.final()]);return[r,i.getAuthTag(),a].map(e=>e.toString(`base64`)).join(`.`)}function R(e,t){if(t.startsWith(`${ci}.`))return JSON.parse(Buffer.from(t.slice(6),`base64`).toString(`utf8`));let[n,r,i]=t.split(`.`).map(e=>Buffer.from(e,`base64`));for(let t of fi(e))try{let e=Pr(`aes-256-gcm`,t.value,n);return e.setAuthTag(r),JSON.parse(Buffer.concat([e.update(i),e.final()]).toString(`utf8`))}catch{}throw Error(`Stored secret was sealed with an unavailable encryption key`)}function gi(e,t){if(t.startsWith(`${ci}.`))return 0;let[n,r,i]=t.split(`.`).map(e=>Buffer.from(e,`base64`));for(let t of fi(e))try{let e=Pr(`aes-256-gcm`,t.value,n);return e.setAuthTag(r),e.update(i),e.final(),t.version}catch{}throw Error(`Stored secret was sealed with an unavailable encryption key`)}const _i=[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`];function vi(e,t,n,r={}){return{method:e,pattern:t,handler:n,...r}}function yi(e,t,n){return t.map(t=>({...t,pattern:e+t.pattern,...n&&!t.guard?{guard:n}:{}}))}function bi(e,t,n){return[e,`${e}/*`].flatMap(e=>_i.map(r=>vi(r,e,t,{guard:n})))}function xi(e,t){let[n,r]=[e.split(`/`),t.split(`/`)],i=n.at(-1)===`*`;if(i?r.length<n.length:r.length!==n.length)return;let a={};for(let e=0;e<n.length;e++){let[t,o]=[n[e],r[e]];if(t===`*`&&i){a[`*`]=r.slice(e).join(`/`);break}if(t[0]===`:`){if(!o)return;a[t.slice(1)]=o}else if(t!==o)return}return a}async function Si(e,t,n,r){for(let i of e){let a=xi(i.pattern,r.pathname);if(!a)continue;for(let e of Object.keys(a))e!==`*`&&(a[e]=decodeURIComponent(a[e]));let o=e.filter(e=>e.pattern===i.pattern),s=o.find(e=>e.method===t.method),c=(s??i).guard;if(c){let e=await c(t,n,a,r);if(e instanceof Response)return e;n=e}if(s)return s.handler(t,n,a,r);let l=kn();return l.headers.set(`allow`,[...new Set(o.map(e=>e.method))].join(`, `)),l}}const Ci=[`default-src 'self'`,`style-src 'self' 'unsafe-inline'`,`img-src 'self' data:`,`connect-src 'self'`,`object-src 'none'`,`base-uri 'none'`,`frame-ancestors 'none'`,`form-action ${[`'self'`,...new Set(Object.values(mt).flatMap(e=>e.app.postOrigins??[]))].join(` `)}`];function wi(e){let t=N.dirname(xr(e));for(;;){let e=N.join(t,`package.json`);if(Tr(e))try{if(JSON.parse(Er(e,`utf8`)).name===`@wular/coder`)return t}catch{}let n=N.dirname(t);if(n===t)break;t=n}throw Error(`Cannot locate the Coder package root.`)}function Ti(e=import.meta.url){let t=N.dirname(xr(e)),n=wi(e),r=xr(new URL(`./dash/standalone/server/entry.js`,import.meta.url));return[N.resolve(r,`../../..`),N.join(n,`dist/dash`),N.join(t,`../dash`)].find(e=>Tr(Ei(e)))}const Ei=e=>N.join(e,`standalone/server/manifest.json`);function Di(e){let t=N.join(e,`standalone/server/entry.js`);if(!Tr(t))throw Error(`The Coder dashboard server bundle is missing.`);return t}async function Oi(e){let t=JSON.parse(Er(Ei(e),`utf8`));return{handler:await(await import(Sr(Di(e)).href)).createRequestHandler({root:N.join(e,`standalone`)}),manifest:t}}var ki=class{moduleUrl;root;loaded;constructor(e=import.meta.url){this.moduleUrl=e}host(){let e=Date.now(),t=this.loaded;if(t&&e-t.checked<1e3)return t.host;if(this.root??=Ti(this.moduleUrl),!this.root)return;let n;try{n=Dr(Ei(this.root)).mtimeMs}catch{}if(t&&(t.checked=e,n===void 0||n===t.build))return t.host;let r={build:n,checked:e,host:Oi(this.root)};return r.host.catch(()=>{this.loaded===r&&(this.loaded=void 0)}),this.loaded=r,r.host}};const Ai=e=>e.length>1&&e.endsWith(`/`)?e.slice(0,-1):e;function ji(e,t){let n=Ai(e);return!!(xi(`/assets/*`,n)||xi(`/dash/*`,n)||t.routes.some(e=>xi(e.route,n)))}async function Mi(e,t=new ki){return!!(await t.host()?.catch(()=>void 0))?.manifest.routes.some(t=>xi(t.route,Ai(e)))}const Ni=/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi,Pi=e=>`'sha256-${Fr(`sha256`).update(e).digest(`base64`)}'`;function Fi(e){let t=[...e.matchAll(Ni)].map(e=>Pi(e[1]));return[...Ci,`script-src 'self' ${t.join(` `)}`.trim()].join(`; `)}function Ii(e,t){return t===`gzip`?Ur(e).toString(`utf8`):t===`br`?zr(e).toString(`utf8`):t===`deflate`?Kr(e).toString(`utf8`):e.toString(`utf8`)}const Li=e=>(e.headers.get(`accept-encoding`)??``).split(`,`).some(e=>{let[t,...n]=e.split(`;`).map(e=>e.trim()),r=n.find(e=>e.startsWith(`q=`));return t===`gzip`&&(!r||Number(r.slice(2))>0)});function Ri(e){e.set(`content-encoding`,`gzip`),/accept-encoding/i.test(e.get(`vary`)??``)||e.append(`vary`,`accept-encoding`)}function zi(e){let t=Vr(),n=e=>new Promise(n=>{t.write(e),t.flush(Br.Z_SYNC_FLUSH,()=>n())}),r=!1;return new ReadableStream({start(e){t.on(`data`,t=>e.enqueue(new Uint8Array(t))),t.on(`end`,()=>e.close()),t.on(`error`,t=>e.error(t))},async pull(){if(r)return;let{done:i,value:a}=await e.read();if(!i)return n(a);r=!0,t.end()},cancel(n){return t.destroy(),e.cancel(n)}})}function Bi(e,t,n,r){n.set(`content-security-policy`,[...Ci,`script-src 'self' 'nonce-${r}'`].join(`; `));let i=t.body;return Li(e)&&(Ri(n),i=zi(i.getReader())),new Response(i,{status:t.status,statusText:t.statusText,headers:n})}async function Vi(e,t,n){let r=new Headers(t.headers);if(r.set(`x-content-type-options`,`nosniff`),!(r.get(`content-type`)??``).includes(`text/html`))return new Response(t.body,{status:t.status,statusText:t.statusText,headers:r});r.set(`cache-control`,`no-store`),r.delete(`content-length`);let i=r.get(`content-encoding`);if(!i&&t.body)return Bi(e,t,r,n);let a=Buffer.from(await t.arrayBuffer()),o=Ii(a,i);r.set(`content-security-policy`,Fi(o));let s=i?new Uint8Array(a):o;return!i&&o.length>1024&&Li(e)&&(s=new Uint8Array(Gr(o)),Ri(r)),new Response(s,{status:t.status,statusText:t.statusText,headers:r})}async function Hi(e,t=new ki){let n=await t.host();if(!n||!ji(new URL(e.url).pathname,n.manifest))return;let r=F(16).toString(`base64`),i=new Headers(e.headers);return i.set(`content-security-policy`,`script-src 'nonce-${r}'`),Vi(e,await n.handler(new Request(e,{headers:i})),r)}const Ui=(e,t,n=!1)=>`coder_admin=${encodeURIComponent(t)}; HttpOnly; SameSite=Strict; Path=/${new URL(e.url).protocol===`https:`?`; Secure`:``}${n?`; Max-Age=0`:``}`;function Wi(e,t){let n=e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim();if(!n)return t.origin;let r=e.headers.get(`x-forwarded-proto`)?.split(`,`,1)[0]?.trim()??t.protocol.slice(0,-1);try{return new URL(`${r}://${n}`).origin}catch{return t.origin}}async function Gi(e,t,n,r){let i=await e.formData(),a=i.get(`token`),o=i.get(`return`),s=Mn(typeof o==`string`&&o.startsWith(`/`)?o:null,new URL(e.url).origin);return typeof a==`string`?a?__(a,t.config.adminToken)?new Response(null,{status:303,headers:{location:s,"set-cookie":Ui(e,a)}}):j(`/dash?token=rejected`,303):new Response(null,{status:303,headers:{location:s,"set-cookie":Ui(e,``,!0)}}):j(`/dash?token=rejected`,303)}async function Ki(e,t,n,r){return j(!t.auth||t.session?`/dash`:r.searchParams.has(`signed_out`)?`/login?signed_out=1`:`/login`)}async function qi(e,t,n,r){let i=`/api/auth/sign-in?return=${encodeURIComponent(Mn(r,n.origin))}`,a=t.config.publicUrl;return a&&new URL(Wi(e,n)).host!==new URL(a).host?j(new URL(i,a).href):t.auth.handler(new Request(`${n.origin}${i}`))}async function Ji(e,t,n,r){return t.auth?!r.searchParams.has(`signed_out`)&&!r.searchParams.has(`error`)?qi(e,t,r,r.searchParams.get(`return`)):Qi(e,t):j(`/dash`)}function Yi(e,t){let n=new Headers(e.headers);n.set(`x-coder-mode`,b_(t));let r=t.session?.organizations.find(e=>e.id===t.organizationId);return r?n.set(`x-coder-organization`,r.slug):n.delete(`x-coder-organization`),new Request(e,{headers:n})}const Xi=()=>new Response(`UI is not built`,{status:503}),Zi=e=>async(t,n)=>await Hi(Yi(t,n),n.dashboardHosts)??e(),Qi=Zi(Xi),$i=Zi(A);var ea=t({appOwner:()=>ra,chosenOrganization:()=>ta,forInstallation:()=>B,linkedOrganizations:()=>na,scoped:()=>z});function ta(e,t){let n=e.organizations.find(e=>e.slug===t||e.id===t);return n?{...e,organizationId:n.id,role:n.role}:{...e,organizationId:void 0,role:void 0,organizationDenied:!0}}const na=e=>({organizations:e.map(e=>e.id),roles:Object.fromEntries(e.map(e=>[e.id,e.role]))});function z(e,t){return t===e.organizationId||!e.scope?e:e.scope(t)}async function ra(e,t){if(!e.appRecord){let n=await e.store.get(`app`,t);return n&&{ctx:e,app:n}}let n=await e.appRecord(t);return n&&{ctx:z(e,n.organizationId),app:n.app}}async function B(e,t){if(e.boundInstallation?.installation.id===t)return{...z(e,e.boundInstallation.organizationId),boundInstallation:e.boundInstallation};if(!e.installationOrganization)return e;let n=await e.installationOrganization(t);return n===void 0?void 0:z(e,n)}function ia(e,t,n={}){let r=`coder-${e.id.replace(/[^a-zA-Z0-9_.-]/g,`-`).slice(0,48)}-${Date.now()}`;t={...t,CODER_RUNNER_IMAGE:n.image??`ghcr.io/muzam1l/coder-runner:latest`,CODER_RUNNER_TARBALL_URL:Qn(t.CODER_SERVER)};let i=Object.keys(t).flatMap(e=>[`-e`,e]);return{args:[`run`,`-d`,`--name`,r,`--memory`,String(n.memory??`4g`),`--cpus`,String(n.cpus??2),`--pids-limit`,String(n.pidsLimit??512),`--network`,n.network??`bridge`,...i,n.image??`ghcr.io/muzam1l/coder-runner:latest`,`sh`,`-c`,qn(``,`for binary in node bun git curl tar claude codex github-mcp-server; do command -v "$binary" >/dev/null 2>&1 || { printf "Docker image %s is missing required binary %s\\n" "$CODER_RUNNER_IMAGE" "$binary"; exit 127; }; done`),`coder-task`,e.id,Xn],env:t}}var aa=class{options;kind=`local-docker`;constructor(e={}){this.options=e}async start(e,t){let n=ia(e,{...t,CODER_INBOX_SOCKET:Ln},this.options),r=await Vn(`docker`,n.args,{PATH:br.env.PATH??``,...n.env});if(r.code!==0)throw Error(r.stderr.trim()||`docker run failed`);return r.stdout.trim()}async status(e){let t=await Vn(`docker`,[`inspect`,`--format`,`{{.State.Running}} {{.State.ExitCode}}`,e],{PATH:br.env.PATH??``});if(t.code!==0)return{state:`exited`};let[n,r]=t.stdout.trim().split(/\s+/);return n===`true`?{state:`running`}:{state:`exited`,code:Number(r)||0}}async stop(e){await Vn(`docker`,[`rm`,`-f`,e],{PATH:br.env.PATH??``})}async push(e,t){let n=await Vn(`docker`,[`exec`,`-e`,`CODER_INBOX_MESSAGES`,e,`node`,`-e`,zn],{PATH:br.env.PATH??``,CODER_INBOX_MESSAGES:JSON.stringify(t)});if(n.code!==0)throw Error(`Docker inbox delivery failed`);return JSON.parse(n.stdout)}};async function oa(e,t){return await new Promise((n,r)=>{e(`docker`,[`info`],{timeout:5e3,signal:t},e=>e?r(new Fa(`Docker is unavailable`)):n())}),`Docker is available`}function sa(e){if(e.cpus&&!(Number(e.cpus)>0&&Number.isFinite(Number(e.cpus))))throw Error(`CPUs must be positive`)}function ca(e){if(!jr(e))return!0;if(jr(e)===6){let t=new URL(`https://[${e}]/`).hostname.slice(1,-1).split(`::`),n=t[0]?t[0].split(`:`):[],r=t[1]?t[1].split(`:`):[],i=[...n,...Array(8-n.length-r.length).fill(`0`),...r].map(e=>parseInt(e,16));if(i.every(e=>e===0)||i.slice(0,7).every(e=>e===0)&&i[7]===1||(i[0]&65024)==64512||(i[0]&65472)==65152||(i[0]&65280)==65280)return!0;let a;if(i.slice(0,5).every(e=>e===0)&&(i[5]===0||i[5]===65535))a=i.slice(6);else if(i.slice(0,4).every(e=>e===0)&&i[4]===65535&&i[5]===0)a=i.slice(6);else if((i[4]===0||i[4]===512)&&i[5]===24318)a=i.slice(6);else if(i[0]===100&&i[1]===65435&&i.slice(2,6).every(e=>e===0))a=i.slice(6);else if(i[0]===8194)a=i.slice(1,3);else if(i[0]===8193&&(i[1]===0||i[1]===3512)||i[0]===100&&i[1]===65435&&i[2]===1)return!0;if(!a)return!1;e=a.flatMap(e=>[e>>8,e&255]).join(`.`)}let t=e.split(`.`).map(Number);return t[0]===0||t[0]===10||t[0]===127||t[0]===169&&t[1]===254||t[0]===172&&t[1]>=16&&t[1]<=31||t[0]===192&&t[1]===168||t[0]===192&&t[1]===0&&(t[2]===0||t[2]===2)||t[0]===198&&t[1]>=18&&t[1]<=19||t[0]===198&&t[1]===51&&t[2]===100||t[0]===203&&t[1]===0&&t[2]===113||t[0]===100&&t[1]>=64&&t[1]<=127||t[0]>=224}async function la(e,t=qr){let n=e.replace(/^\[|\]$/g,``),r=jr(n)?[{address:n,family:jr(n)}]:await t(n,{all:!0});if(!r.length)throw Error(`${n} resolved no address`);if(r.some(e=>ca(e.address)))throw Error(`Coder refuses private and metadata addresses`);return r[0]}function ua(e,t,n,r=Jr,i=1/0){return new Promise((a,o)=>{let s=r(e,{method:t.method,headers:t.headers,signal:t.signal??void 0,agent:!1,lookup:(e,t,r)=>{t.all?r(null,[n]):r(null,n.address,n.family)}},e=>{let t=[],n=0;e.on(`data`,e=>{if(n+=e.length,n<=i)return t.push(Buffer.from(e));o(Error(`Response is over ${i} bytes`)),s.destroy()}),e.on(`error`,o),e.on(`end`,()=>a(new Response(e.statusCode===204?null:Buffer.concat(t),{status:e.statusCode})))});s.on(`error`,o),s.end(t.body)})}var da=class{options;kind=`http`;base;fetcher;resolver;constructor(e){if(this.options=e,!e?.url)throw Error(`The http runner requires RUNNER_CONFIG.url`);if(this.base=new URL(`${e.url.replace(/\/+$/,``)}/`),this.base.protocol!==`https:`)throw Error(`The http runner requires an HTTPS URL`);if(this.base.username||this.base.password)throw Error(`The http runner URL cannot contain credentials`);if(!e.secret)throw Error(`RUNNER_CONFIG.secret is required for the http runner`);this.fetcher=e.fetch,this.resolver=e.lookup}send(e,t,n){return this.fetcher?this.fetcher(e,t):ua(e,t,n,this.options.request)}async request(e,t=`GET`,n,r){let i=await la(this.base.hostname,this.resolver),a=n===void 0?``:JSON.stringify(n),o=String(Date.now()),s=F(16).toString(`base64url`),c=Ir(`sha256`,this.options.secret).update(`${a}.${o}.${s}`).digest(`base64url`),l=await this.send(new URL(e.replace(/^\//,``),this.base),{method:t,redirect:`manual`,headers:{...this.options.headers,"content-type":`application/json`,"x-coder-timestamp":o,"x-coder-nonce":s,"x-coder-signature":c},...a?{body:a}:{},signal:r??AbortSignal.timeout(e===`/start`?3e4:1e4)},i);if(l.status>=300&&l.status<400)throw Error(`The http runner refuses redirects`);if(!l.ok)throw Error(`HTTP runner request failed: ${l.status}`);if(l.status===204)return;let u=await l.text();return u?JSON.parse(u):void 0}health(e){return this.request(`/health`,`GET`,void 0,e)}async start(e,t){let n=await this.request(`/start`,`POST`,{task:e.id,env:t});if(!n.handle)throw Error(`HTTP runner returned no handle`);return n.handle}status(e){return this.request(`/status/${encodeURIComponent(e)}`)}async stop(e){await this.request(`/stop/${encodeURIComponent(e)}`,`POST`,{})}push(e,t){return this.request(`/messages/${encodeURIComponent(e)}`,`POST`,{entries:t})}};async function fa(e,t){if(!(e instanceof da)||!(await e.health(t)).ok)throw new Fa(`Runner health check failed`);return`Runner is reachable`}function pa(e){if(e.secret.length<32)throw Error(`Secret must contain at least 32 characters`);new da({url:e.url,secret:e.secret})}const ma=e=>vt(e),ha=18e5,ga=864e5;function _a(e,t=``){return{get:n=>e.get(`snapshot`,`${t}${n}`),put:(n,r)=>e.put(`snapshot`,`${t}${n}`,r,{ttlMs:ga}),withLock:(n,r)=>e.withAppLock(`snapshot:${t}${n}`,e=>r({get:n=>e.get(`snapshot`,`${t}${n}`),put:(n,r)=>e.put(`snapshot`,`${t}${n}`,r,{ttlMs:ga})}))}}const va={"eu-north-1":`arn1`,"ap-south-1":`bom1`,"eu-west-3":`cdg1`,"us-east-2":`cle1`,"af-south-1":`cpt1`,"eu-west-1":`dub1`,"eu-central-1":`fra1`,"sa-east-1":`gru1`,"ap-east-1":`hkg1`,"ap-northeast-1":`hnd1`,"us-east-1":`iad1`,"ap-northeast-2":`icn1`,"ap-northeast-3":`kix1`,"eu-west-2":`lhr1`,"us-west-2":`pdx1`,"us-west-1":`sfo1`,"ap-southeast-1":`sin1`,"ap-southeast-2":`syd1`,"ca-central-1":`yul1`};function ya(e){if(!e)return;let t=(()=>{try{return new URL(e).hostname}catch{return``}})();return Object.entries(va).find(([e])=>t.includes(e))?.[1]}const ba=[{name:`ANTHROPIC_API_KEY`,host:`api.anthropic.com`,header:`x-api-key`,prefix:``},{name:`OPENAI_API_KEY`,host:`api.openai.com`,header:`authorization`,prefix:`Bearer `}],xa={claude:{api:`api.anthropic.com`,account:[`claude.ai`,`platform.claude.com`]},codex:{api:`api.openai.com`,account:[`auth.openai.com`,`chatgpt.com`]}};function Sa(e,t){let n=xa[e],r=t.CLAUDE_CODE_OAUTH_TOKEN||t.CODEX_AUTH_JSON,i=[t.ANTHROPIC_BASE_URL,t.OPENAI_BASE_URL].filter(e=>e&&URL.canParse(e));return[...n?[n.api,...r?n.account:[]]:[],...i.map(e=>new URL(e).hostname)]}function Ca(e={},t,n=ba){let r={};for(let t of n)e[t.name]&&((r[t.host]??={})[t.header]=`${t.prefix}${e[t.name]}`);let i=Object.entries(r).map(([e,t])=>[e,[{transform:[{headers:t}]}]]);if(!t)return i.length?{allow:{...Object.fromEntries(i),"*":[]}}:void 0;let a=[...new Set(t.filter(e=>Ar.isIP(e)))],o=t.filter(e=>!Ar.isIP(e)).map(e=>[e,[]]);return{allow:{...Object.fromEntries(o),...Object.fromEntries(i)},...a.length?{subnets:{allow:a.map(e=>`${e}/${Ar.isIPv6(e)?128:32}`)}}:{}}}function wa(e){return[...[e.CODER_SERVER,e.CODER_RUNNER_TARBALL_URL].filter(e=>e&&URL.canParse(e)).map(e=>new URL(e).hostname),...Object.values(mt).flatMap(e=>e.tools.installHosts??[])]}function Ta(e,t,n){return Ca(t,n.hosts&&[...wa(e),...n.hosts],n.brokered)}async function Ea(){try{let{Sandbox:e,Snapshot:t}=await import(`@vercel/sandbox`);return{create:t=>e.create(t),get:t=>e.get(t),deleteSnapshot:async e=>(await t.get(e)).delete()}}catch{throw Error(`The vercel-sandbox runner requires @vercel/sandbox in the adapter app.`)}}function Da(e){return e&&typeof e==`object`&&`response`in e&&e.response instanceof Response?e.response.status:void 0}function Oa(e){if(Da(e)!==410||!e||typeof e!=`object`||!(`json`in e))return!1;let t=e.json;if(!t||typeof t!=`object`||!(`error`in t))return!1;let n=t.error;return!!n&&typeof n==`object`&&`code`in n&&n.code===`snapshot_not_found`}var ka=class extends Error{snapshotId;constructor(e,t,n){super(e,n),this.snapshotId=t}},Aa=class{options;kind=`vercel-sandbox`;sandboxes=new Map;constructor(e={}){this.options=e}api(){return this.options.sandbox?Promise.resolve(this.options.sandbox):Ea()}async sandbox(e){for(let[e,t]of this.sandboxes)t.expiresAt<=this.now()&&this.sandboxes.delete(e);return this.sandboxes.get(e)?.sandbox??(await this.api()).get({...this.auth(),name:e})}now(){return(this.options.now??Date.now)()}auth(){return{...this.options.token?{token:this.options.token,projectId:this.options.projectId??process.env.VERCEL_PROJECT_ID,teamId:this.options.team??process.env.VERCEL_TEAM_ID}:{}}}base(e){return{...e?{source:{type:`snapshot`,snapshotId:e}}:this.options.image?{image:this.options.image}:{},...this.options.region?{region:this.options.region}:{},...this.auth(),resources:{vcpus:this.options.vcpus??1},persistent:!1}}snapshotKey(e){let t=e.event?.repo;if(!t)return;let n=[Kn(),this.options.image??null,e.event.appId,e.event.installationId,t.owner,t.name];return`repo:${this.options.region??``}:${ht(JSON.stringify(n))}`}async stopSandbox(e){try{await e.stop()}finally{this.sandboxes.delete(e.name)}}async withSandbox(e,t){let n;try{if(n=typeof e==`string`?await this.sandbox(e):e,n.status!==`running`&&n.status!==`pending`)throw new ka(`Vercel Sandbox ${n.name} is ${n.status}`);return await t(n)}catch(t){let r=Da(t);throw(r===404||r===410)&&typeof e==`string`&&this.sandboxes.delete(e),r===410||!n&&typeof e==`string`&&r===404?new ka(t instanceof Error?t.message:`Vercel Sandbox expired`,void 0,{cause:t}):t}}withSnapshotLock(e,t){let n=this.options.snapshots;return n.withLock?n.withLock(e,t):t(n)}async finalizeSnapshot(e,t){let n=this.now(),r=I(),i=await this.withSnapshotLock(e,async i=>{let a=await i.get(e)??{};if(!a.build||a.lease&&a.lease.expiresAt>n||t?.build&&(a.build.sandbox!==t.build.sandbox||a.build.command!==t.build.command||a.build.startedAt!==t.build.startedAt))return a;let o={...a,lease:{owner:r,expiresAt:n+ha}};return await i.put(e,o),o});if(i.lease?.owner!==r||!i.build)return i;let{build:a,lease:o,...s}=i,c={...s,build:a};try{c=await this.withSandbox(a.sandbox,async e=>{let t=await e.getCommand(a.command);if(t.exitCode===null&&n-a.startedAt<ha)return c;if(t.exitCode===0){let r=/^coder-snapshot (\S+)$/m.exec(await t.stdout())?.[1];if(r&&r===i.sha)return await this.stopSandbox(e).catch(()=>{}),{...s,checkedAt:n};let a=await e.snapshot({expiration:ga});return this.sandboxes.delete(e.name),{...s,snapshotId:a.snapshotId,...r?{sha:r}:{},checkedAt:n}}return await this.stopSandbox(e).catch(()=>{}),{...s,failedAt:n}})}catch(t){if(t instanceof ka){let{failedAt:e,...t}=s;c=t}else console.error(`coder server: snapshot ${e} failed; tasks start without a new one`,t),await this.withSandbox(a.sandbox,e=>this.stopSandbox(e)).catch(()=>{}),c={...s,failedAt:n}}let l=await this.withSnapshotLock(e,async t=>{let n=await t.get(e)??{};return n.lease?.owner===r?(await t.put(e,c),c):n});return l===c&&s.snapshotId&&c.snapshotId!==s.snapshotId&&await this.deleteSnapshot(s.snapshotId),l}async deleteSnapshot(e){try{await(await this.api()).deleteSnapshot({...this.auth(),snapshotId:e})}catch(t){[404,410].includes(Da(t)??0)||console.error(`coder server: could not delete replaced snapshot ${e}`,t)}}async snapshot(e,t,n,r){if(!this.options.snapshots)return;let i=await this.finalizeSnapshot(e);if(i.build)return i.snapshotId;let a=this.now(),o=I(),s=await this.withSnapshotLock(e,async t=>{let r=await t.get(e)??{},i=!r.snapshotId||n&&a-(r.checkedAt??0)>=9e5,s=r.failedAt!==void 0&&a-r.failedAt<36e5;if(r.build||r.lease&&r.lease.expiresAt>a||!i||s)return r;let c={...r,lease:{owner:o,expiresAt:a+ha}};return await t.put(e,c),c});if(s.lease?.owner!==o)return s.snapshotId;let c,l;try{c=await t(s.snapshotId)}catch(t){t instanceof ka?l=t:console.error(`coder server: snapshot ${e} failed; tasks start without a new one`,t)}let u=await this.withSnapshotLock(e,async t=>{let n=await t.get(e)??{};if(n.lease?.owner!==o)return n;let{lease:r,...i}=n,s={...i,...c?{build:{sandbox:c.sandbox,command:c.command,startedAt:a}}:l?{}:{failedAt:a}};return await t.put(e,s),s});if(c)if(u.build?.sandbox===c.sandbox&&u.build.command===c.command){let t=(async()=>{await c.wait(),await this.finalizeSnapshot(e,u)})().catch(()=>{});r?.(t)}else await this.withSandbox(c.sandbox,e=>this.stopSandbox(e)).catch(()=>{});if(l)throw l;return u.snapshotId}async detached(e,t,n={}){let r=await(await this.api()).create({...this.base(e),timeout:this.options.timeoutMs??18e5,...n}).catch(t=>{throw e&&Oa(t)?new ka(t.message,e,{cause:t}):t});if(!t.env?.CODER_PREPARE){for(let[e,t]of this.sandboxes)t.expiresAt<=this.now()&&this.sandboxes.delete(e);this.sandboxes.size>=1e3&&this.sandboxes.delete(this.sandboxes.keys().next().value),this.sandboxes.set(r.name,{sandbox:r,expiresAt:this.now()+Number(n.timeout??this.options.timeoutMs??ha)})}try{let e=await this.withSandbox(r,e=>e.runCommand({...t,detached:!0}));return{sandbox:r.name,command:e.cmdId,wait:()=>e.wait({signal:AbortSignal.timeout(ha)})}}catch(e){throw this.sandboxes.delete(r.name),await this.stopSandbox(r).catch(()=>{}),e}}async start(e,t,n,r={}){t={...t,[Fe]:`1`,CODER_RUNNER_TARBALL_URL:Qn(t.CODER_SERVER),CODER_RUNNER_HASH:Kn()};let i=Ta(t,n,r),a=t=>({cmd:`sh`,args:[`-c`,qn(Hn().map(e=>`sudo sh -c '${e.replaceAll(`'`,`'\\''`)}'`).join(` && `),``,`setpriv --inh-caps=-all --ambient-caps=-all bun`),`coder-task`,e.id,Xn],env:t});for(let n=0;;n++){let o;try{o=this.snapshotKey(e);let n=o?await this.snapshot(o,e=>this.detached(e,a({...t,CODER_PREPARE:`1`})),!0,r.waitUntil).catch(e=>{if(e instanceof ka)throw e;console.error(`coder server: snapshot ${o} failed; starting without one`,e)}):void 0,s=e=>this.detached(e,a({...t,CODER_INBOX_SOCKET:Ln}),{...i?{networkPolicy:i}:{},...r.timeoutMs?{timeout:r.timeoutMs}:{}}),c=n?await s(n).catch(e=>{if(e instanceof ka)throw e;return console.error(`coder server: starting from snapshot ${n} failed`,e),s()}):await s();return gt({sandbox:c.sandbox,command:c.command})}catch(e){if(!(e instanceof ka))throw e;if(o&&e.snapshotId&&this.options.snapshots){let t=e.snapshotId;await this.withSnapshotLock(o,async e=>{let n=await e.get(o);if(n?.snapshotId!==t)return;let{snapshotId:r,sha:i,checkedAt:a,failedAt:s,...c}=n;await e.put(o,c)})}if(n===2)throw e}}}async status(e){let t=ma(e);try{let e=await this.sandbox(t.sandbox);if(e.status===`pending`)return{state:`running`};if(e.status!==`running`)return this.sandboxes.delete(t.sandbox),{state:`exited`,code:1};let n=await e.getCommand(t.command);return n.exitCode===null?{state:`running`}:{state:`exited`,code:n.exitCode}}catch(e){throw[404,410].includes(Da(e)??0)&&this.sandboxes.delete(t.sandbox),e}}async push(e,t){return this.withSandbox(ma(e).sandbox,async e=>{let n=await e.runCommand({cmd:`node`,args:[`-e`,zn],detached:!1,env:{CODER_INBOX_MESSAGES:JSON.stringify(t)}}),r=await n.stdout();if(n.exitCode!==0)throw Error(`Sandbox inbox delivery failed`);return JSON.parse(r)})}async stop(e){let t=ma(e).sandbox;try{await(await this.sandbox(t)).stop()}finally{this.sandboxes.delete(t)}}};async function ja(e,t){let n=await(await t(`https://api.vercel.com/v2/teams?limit=100`)).json();if(!Array.isArray(n.teams))throw new Fa(`Invalid team response`);if(e.team&&!n.teams.some(t=>t.id===e.team||t.slug===e.team))throw new Fa(`Team is not accessible`);return`Teams are accessible`}const Ma=[`local`,`local-docker`,`vercel-sandbox`,`github-actions`,`http`];function Na(e){let t=e.kind;return e.local===!1&&(t===`local`||t===`local-docker`)?{}:{[t]:Pa(t,e)}}function Pa(e,t){let n=t.config??{};if(e===`local`)return new Un(t.workDir);if(e===`local-docker`)return new aa(n);if(e===`vercel-sandbox`)return new Aa({...t.sandbox,...n});if(e===`github-actions`)return new Zn({...n,...t.fetch?{fetch:t.fetch}:{}});if(typeof n.url!=`string`||typeof n.secret!=`string`)throw Error(`HTTP runner requires a URL and secret`);return new da({url:n.url,secret:n.secret,...t.fetch?{fetch:t.fetch}:{}})}var Fa=class extends Error{};function Ia(e,t){return e.scope===`workspace`||!!(t&&e.owner===t)}function La(e){return e.local?`local`:`default`}async function Ra(e,t={}){let n=t.runner??t.agent;if(n===La(e))return{runner:e.config.runner};let r=(await e.store.list(`runner`,{visibleTo:t.requestedBy,...n?{runner:n}:{defaults:!0}})).filter(({value:n})=>Ia(n,t.requestedBy)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`)),i=n?r.find(({id:e,value:t})=>e===n||t.name===n):r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.scope===`workspace`&&e.default);if(n&&!i)throw Error(`Unknown runner "${n}".`);return i?{runner:i.value.kind,runnerId:i.id}:{runner:e.config.runner}}function za(e,t,n){let r={...t.config,...R(e.config,t.secret)};return Pa(t.kind,{workDir:e.config.workDir,config:r,fetch:e.fetch,sandbox:{...n?{snapshots:_a(e.store,`runner:${n}:`)}:{}}})}async function Ba(e,t){if(!t.runnerId)return e.runners[t.runner];let n=await e.store.get(`runner`,t.runnerId);if(!n||n.kind!==t.runner||!e.local&&(n.kind===`local`||n.kind===`local-docker`)){e.settings?.runnerInstances?.delete(t.runnerId);return}R(e.config,n.secret);let r=(e.settings??={}).runnerInstances??=new Map,i=JSON.stringify([n.kind,n.config,n.secret]),a=r.get(t.runnerId);return a?.signature!==i&&(a={signature:i,runner:za(e,n,t.runnerId)},r.set(t.runnerId,a)),a.runner}function Va(e){if(typeof e!=`string`||!e)return{ok:!1,detail:`A folder path is required`};let t=e===`~`?Mr.homedir():e.startsWith(`~/`)?N.join(Mr.homedir(),e.slice(2)):e;if(!N.isAbsolute(t))return{ok:!1,detail:`The folder path must be absolute`};let n=N.normalize(t);try{return P.statSync(n).isDirectory()?(P.accessSync(n,P.constants.R_OK),{ok:!0,folder:{path:n,name:N.basename(n)}}):{ok:!1,detail:`The path is not a directory`}}catch{return{ok:!1,detail:`The folder does not exist or is not readable`}}}function Ha(e){let t=new Map,n=[..._e(e),..._(e,{migrate:!1})].sort((e,t)=>Date.parse(t.createdAt)-Date.parse(e.createdAt));for(let e of n){let n=Va(e.cwd);if(!(!n.ok||t.has(n.folder.path))&&(t.set(n.folder.path,{...n.folder,recent:Date.parse(e.createdAt)}),t.size===8))break}return{current:{path:e,name:N.basename(e)},recent:[...t.values()],picker:!!Wa()}}const Ua=e=>(process.env.PATH??``).split(N.delimiter).some(t=>t&&P.existsSync(N.join(t,e)));function Wa(){let e=`Choose a folder for the task`;if(process.platform===`darwin`)return[`osascript`,[`-e`,`tell application "System Events"`,`-e`,`activate`,`-e`,`POSIX path of (choose folder with prompt "${e}")`,`-e`,`end tell`]];if(process.platform===`win32`)return[`powershell`,[`-NoProfile`,`-Command`,`Add-Type -AssemblyName System.Windows.Forms; $d = New-Object System.Windows.Forms.FolderBrowserDialog; $d.Description = '${e}'; if ($d.ShowDialog() -eq 'OK') { $d.SelectedPath }`]];if(Ua(`zenity`))return[`zenity`,[`--file-selection`,`--directory`,`--title=${e}`]];if(Ua(`kdialog`))return[`kdialog`,[`--getexistingdirectory`,Mr.homedir(),`--title`,e]]}async function Ga(){let e=Wa();if(!e)return{ok:!1,detail:`This machine has no folder dialog; type a path instead`};try{let{stdout:t}=await Rr(Or)(e[0],e[1],{timeout:6e5}),n=t.trim().replace(/(.)[\\/]+$/,`$1`);return n?Va(n):{ok:!1,detail:``}}catch{return{ok:!1,detail:``}}}function Ka(e){let t=/^\w[\w.-]*@([\w.-]+):(?!\/)([^?#]+)$/.exec(e),n=t||!URL.canParse(e)?void 0:new URL(e);if(!t&&(!n||![`https:`,`ssh:`].includes(n.protocol)||n.password||n.search||n.hash))return;let[r,i]=t?[t[1],t[2]]:[n.port?`${n.hostname}_${n.port}`:n.hostname,n.pathname],a=i.replace(/(\.git)?\/?$/,``).split(`/`).filter(Boolean);if(!(!/^[a-z0-9][a-z0-9._-]*$/i.test(r)||a.length<2||!a.every(e=>/^[\w.-]+$/.test(e)&&!/^\.+$/.test(e))))return[r.toLowerCase(),...a]}async function qa(e){let t=typeof e==`string`?e.trim():``,n=Ka(t);if(!n)return{ok:!1,detail:`Use an https or ssh git URL, like https://github.com/owner/repo`};let r=oe(`checkouts`,...n),i=AbortSignal.timeout(6e5),a={...process.env,GIT_TERMINAL_PROMPT:`0`,GIT_SSH_COMMAND:process.env.GIT_SSH_COMMAND??`ssh -o BatchMode=yes`},o=e=>Rr(Or)(`git`,e,{env:a,signal:i,maxBuffer:67108864});try{await Bn(r,async()=>{if(P.existsSync(N.join(r,`.git`))){await o([`-C`,r,`remote`,`set-url`,`origin`,t]),await o([`-C`,r,`fetch`,`origin`]);return}let e=await P.promises.mkdtemp(`${r}-clone-`);try{await o([`clone`,`--`,t,e]),await P.promises.rename(e,r)}finally{await P.promises.rm(e,{recursive:!0,force:!0})}})}catch(e){let t=e;if(i.aborted)return{ok:!1,detail:`The clone took longer than 10 minutes`};if(t.code===`ENOENT`&&!t.stderr)return{ok:!1,detail:`Git is not installed on this machine`};let n=String(t.stderr??t.message).split(`
+`).map(e=>e.trim()).filter(Boolean),r=(n.find(e=>e.startsWith(`fatal:`))??n.at(-1)??`The clone failed`).replace(/^fatal:\s*/,``);return{ok:!1,detail:r[0].toUpperCase()+r.slice(1)}}return{ok:!0,folder:{path:r,name:n.at(-1),url:t}}}const Ja=`.coder/agents`,Ya=2592e6;function Xa(e){return e.repo?`${e.repo.owner}/${e.repo.name}`:void 0}const Za=(e,t,n)=>`repo-file:${e}@${t}@${n}:`;function Qa(e,t){let n=Xa(t);return n?[Za(e.id,n,t.repo?.defaultBranch??``)]:[]}const $a=(e,t,n)=>`repo-push:${e}@${t}@${n}`;function eo(e,t,n,r,i,a){let o=`${Za(n.installation,r,a??``)}${i}`,s=e.fileReads??=new Map,c=s.get(o);if(!c){let l=AbortSignal.timeout(1e4),u=new Promise((e,t)=>l.addEventListener(`abort`,()=>t(l.reason),{once:!0}));c=Promise.race([to(e.store,t,n,r,i,a,o,l),u]).catch(e=>{throw l.aborted&&console.error(`coder server: repository file read timed out for ${r}/${i}`,e),e}).finally(()=>s.delete(o)),s.set(o,c)}return c}async function to(e,t,n,r,i,a,o,s){let c=await e.get(`snapshot`,o);s.throwIfAborted();let l=/^[0-9a-f]{40}$/i.test(a??``),u=Date.now();if(c&&!c.stale&&(l||u-(c.readAt??0)<6e5))return c.text;let d=$a(n.installation,r,a??``),[f,p]=await Promise.all([n.token(),l?void 0:e.get(`snapshot`,d)]);if(s.throwIfAborted(),!f||!t.repos)return;let m=t.repos.revalidate?await t.repos.revalidate(r,i,f,{...a?{ref:a}:{},...c?.etag?{etag:c.etag}:{},fetch:((e,t)=>n.fetch(e,{...t,signal:s}))}):{text:await t.repos.readFile(r,i,f,a)};s.throwIfAborted();let{stale:h,...g}=c??{},_={...m===`unchanged`?g:m,...l?{}:{readAt:u}};return await e.put(`snapshot`,o,_,{ttlMs:Ya}),!l&&(await e.get(`snapshot`,d))?.push!==p?.push&&await e.put(`snapshot`,o,{..._,stale:!0},{ttlMs:Ya}),_.text}const no=e=>!!e.installation&&(e.partial===!0||e.paths.some(e=>e.startsWith(`.coder/`)));function ro(e,t){let n=t.branch??e.defaultBranch,r=e.paths.filter(e=>e.startsWith(`.coder/agents/`));if(!(e.repo!==t.agentsRepo||e.branch!==n||!e.commit||!r.length))return{repo:e.repo,ref:e.commit,branch:n,paths:r}}async function io(e,t){let n=[t.branch,...t.branch===t.defaultBranch?[``]:[]];for(let r of n){await e.put(`snapshot`,$a(t.installation,t.repo,r),{push:I()},{ttlMs:36e5});for(let{id:n,value:i}of await e.list(`snapshot`,{prefix:Za(t.installation,t.repo,r)}))i.stale||await e.put(`snapshot`,n,{...i,stale:!0},{ttlMs:Ya})}}async function ao(e,t,n,r,i){let a=await eo(e,t,n,r,`.coder/config.json`,i);return a===void 0?void 0:JSON.parse(a).agents}async function oo(e,t,n,r,i=async()=>void 0){for(let t of Object.values(e)){if(!r.repo&&t.id===r.integration||!t.repos)continue;let e=await(await i(t.id))?.token();if(e)return{contents:t,token:e}}for(let{value:r}of await t.store.list(`app`)){if(r.agentsRepo!==n)continue;let i=e[r.integration];if(!i?.repos)continue;let a=(await t.store.list(`installation`,{prefix:`${r.id}:`})).find(e=>!e.value.deletedAt)?.value;if(a)try{let e=a.token?{...a,token:R(t.config,a.token)}:a;return{contents:i,token:await i.auth.token(e,R(t.config,r.credentials),{tools:i.tools.presets[`read-only`]}),app:r,installation:a}}catch(e){console.error(`coder server: repository access for ${a.id} failed`,e);continue}}}function so(e,t){let n=t.cwd,r=t.now??Date.now;async function i(t,n,r){let i=Xa(n),a=e[n.integration],o=i&&a?.repos&&await r(n.integration);if(!(!i||!o))return ao(t,a,o,i,n.repo?.defaultBranch)}async function a(n,a,o,s){let c={store:s?.store??t.store,fileReads:t.fileReads},l=s??await M(t.store,n.agent);l.record?.source===`builtin`&&!t.settings?.builtinAgents&&(await or(t,r()),l=await M(t.store,n.agent));let{record:u,version:d}=l;if(!u)return;if(u.problems?.length)throw new dt(u.problems.join(`
+`));if(!d)throw Error(`No version ${u.currentVersion} for agent "${u.id}".`);let f=await i(c,a,o),p=f&&typeof f==`object`?f[n.agent]:void 0;if(p===!1||p?.disabled)throw Error(`Agent "${n.agent}" is disabled in ${Xa(a)??n.agentsRepo}.`);return ir(u,d,p&&typeof p==`object`?p:void 0,e)}return async(i,o,s,c,l)=>{let u=n?(await st(n,e)).find(e=>e.id===i.agent&&!e.builtin):void 0;if(u)return u;let d=await a(i,s,c,l);if(d)return d;if(i.agentsRepo){let n=await oo(e,t,i.agentsRepo,s,c);if(n){await co(t.store,n.contents,i.agentsRepo,Xa(s)===i.agentsRepo?s.repo?.defaultBranch??`HEAD`:`HEAD`,n.token,r());let e=await a(i,s,c);if(e)return e;throw Error(`No agent "${i.agent}" in ${i.agentsRepo}.`)}}if(await nr(t.store,r(),i.agent,{})){let e=await a(i,s,c);if(e)return e}throw Error(i.agentsRepo?`No agent named "${i.agent}".`:`No built-in agent "${i.agent}".`)}}async function co(e,t,n,r,i,a,o={}){let s=o.path??`.coder/agents`,c=/^[0-9a-f]{40}$/i.test(r)?r:await t.repos.commit(n,r,i)??r,l={repo:n,ref:o.branch??r,commit:c};r=c;let u=await t.repos.tree(n,s,i,r),d=o.slugs??[...new Set(u.filter(e=>/^[^/]+\/agent\.json$/.test(e)).map(e=>e.split(`/`)[0]))];return ut(d),(await Promise.all(d.map(async o=>{let d=`${s}/${o}`,f=u.filter(e=>e.startsWith(`${o}/`)&&e.split(`/`).length<=22),p=Object.fromEntries(await Promise.all(f.map(async e=>[e.slice(o.length+1),await t.repos.readFile(n,`${s}/${e}`,i,r)]))),m=p[`agent.json`];if(m===void 0)return;let h;try{[h]=lt({definitions:{[o]:{json:JSON.parse(m),builtin:!1}},usage:void 0},{...mt,[t.id]:t})}catch(t){if(!(t instanceof dt||t instanceof SyntaxError))throw t;console.error(`coder server: could not load agent ${o}`,t);let r=await e.get(`agent`,o);await e.put(`agent`,o,{id:o,name:o,source:`repo`,repo:n,path:d,currentVersion:0,createdAt:a,...r,problems:[t.message],updatedAt:a});return}if(!h)return;let{"agent.json":g,"system.md":_,...v}=p;return sr(e,{id:o,name:h.name,description:h.definition.description,source:`repo`,repo:n,path:d,definition:h.definition,systemPrompt:_??``,files:Object.fromEntries(Object.entries(v).filter(e=>e[1]!==void 0)),commit:c,origin:l,importedFrom:`repo:${n}@${l.ref}`},a)}))).filter(e=>!!e)}const lo=e=>`app-sync:${e}`,uo=(e,t,n,r)=>e.manifest?.(t,{publicUrl:n,spec:Hv(r,t.agent,t.integration)})??r,fo=(e,t,n)=>!!(e&&!e.pending&&e.version>=t&&Lr(e.manifest,n));async function po(e,t,n,r){let i=e.integrations[n.integration]?.app,a=e.config.publicUrl,o=await t.get(`delivery`,lo(n.id));if(i?.values){let e=i.values(n,{publicUrl:a,spec:Hv(r.definition,n.agent,n.integration)}),s=o?.manifest??[],c=e.lines.map(e=>s.some(t=>t.text===e.text&&t.copy===e.copy)?e:{...e,changed:!0}),l=c.some(e=>`changed`in e);return l!==o?.changed&&await t.put(`delivery`,lo(n.id),{...o,version:r.version,changed:l}),{...e,lines:c,changed:l,confirm:!0}}if(!i?.drift)return;let s=await i.drift(n,R(e.config,n.credentials),{publicUrl:a,spec:Hv(r.definition,n.agent,n.integration),fetch:e.fetch??fetch}),c=s.lines.length>0;return await t.put(`delivery`,lo(n.id),{version:r.version,changed:c}),{...s,changed:c}}async function mo(e,t,n){let r=e.config.publicUrl;if(!r||!t.length)return[];let i=new Map(t.map(e=>[e.agent,e])),a=await e.store.list(`app`);return(await Promise.all(a.filter(({id:e,value:t})=>i.has(t.agent)&&(!n||e===n)).map(async({id:t})=>e.store.withAppLock(t,async a=>{let o=await a.get(`app`,t);if(!o||!i.has(o.agent))return;let s=await ur(a,o.agent)??i.get(o.agent),c=e.integrations[o.integration]?.app;if(!c||!s.definition.integrations[o.integration]||!c.update&&(o.builtin||o.shared))return;if(!c.update)return po(e,a,o,s).then(e=>e&&{app:o,check:e},e=>(console.error(`coder server: checking ${o.id} on its platform failed`,e),{app:o,error:e instanceof Error?e.message:String(e)}));let{update:l}=c,u=uo(c,o,r,s.definition),d=lo(t),f=await a.get(`delivery`,d);if(!n&&fo(f,s.version,u)||f&&f.version>s.version)return;let p={version:s.version,manifest:u,pending:!0};await a.put(`delivery`,d,p);try{let t=await l(o,R(e.config,o.credentials),{publicUrl:r,spec:Hv(s.definition,o.agent,o.integration),fetch:e.fetch??fetch,tokens:Zv({...e,store:a},o.integration),saveCredentials:async t=>{await a.put(`app`,o.id,{...o,credentials:L(e.config,t)})}});return t&&await a.put(`app`,o.id,{...o,credentials:L(e.config,t)}),await a.put(`delivery`,d,{...p,pending:!1}),{app:o}}catch(e){let t=`Could not sync ${o.integration} app ${o.id}. ${e instanceof Error?e.message:String(e)}`;return await a.put(`delivery`,d,{...p,error:t}),{app:o,error:t}}})))).filter(e=>e!==void 0)}async function ho(e,t){let n=(await mo(e,t)).flatMap(({app:t,error:n})=>n&&e.integrations[t.integration]?.app.update?[n]:[]);if(n.length)throw Error(n.join(`
+`))}function go(){return{integration:`source`,type:`import`,appId:``,installationId:``,deliveryId:``,actor:{id:`admin`},text:``}}async function _o(e,t,n,r=go(),i){let a=await oo(e.integrations,{config:e.config,store:e.store},t,r);if(!a)return;let o=await co(e.store,a.contents,t,n,a.token,(e.now??Date.now)(),i?{branch:i}:{});return await ho(e,o),o}const vo=`default`;async function yo(e){if(!e.databaseUrl)throw Error(`DATABASE_URL is required for the Postgres store`);let{connect:t}=await import(`./client-nBo9Mhsr.js`).then(e=>e.n);return t(e.databaseUrl,e.databasePool)}function bo(e){let t=e?new mr:new fr;return{store:()=>t,queue:new eg(t),chatState:new yr(e?N.join(g(``),`chat.json`):void 0),defaultOrganizationId:vo,webhookTarget:async(e,n)=>{let r=await t.get(`app`,e),i=n?await t.get(`installation`,n):void 0;if(r&&n&&(!i||i.deletedAt))for(let{value:r}of await t.list(`app`,{prefix:`${e}/`})){let i=await t.get(`installation`,`${r.id}${n.slice(e.length)}`);if(i&&!i.deletedAt)return{organizationId:vo,app:r,bound:{organizationId:vo,installation:i}}}return r&&{organizationId:vo,app:r,...i&&i.app===e&&!i.deletedAt?{bound:{organizationId:vo,installation:i}}:{}}},appRecord:async e=>{let n=await t.get(`app`,e);return n&&{organizationId:vo,app:n}},apps:async e=>(await t.list(`app`,{prefix:`${e}:`})).map(e=>({organizationId:vo,app:e.value})),installationOrganization:async e=>await t.get(`installation`,e)?vo:void 0,installations:async e=>(await t.list(`installation`,{prefix:`${e}:`})).filter(e=>!e.value.deletedAt).map(e=>({key:e.id,organizationId:vo})),taskOrganization:async(e,n)=>(await t.get(`task`,e))?.tokenHash===n?vo:void 0,sweep:async()=>{},close:async()=>{}}}async function xo(e){let t=await yo(e),[{DrizzleStore:n},{DrizzleQueue:r},{UNSCOPED_ORGANIZATION:i},{PgChatState:a}]=await Promise.all([import(`./store-BpDipcKB.js`).then(e=>e.n),import(`./store-BpDipcKB.js`).then(e=>e.r),import(`./shared-D-KqAi7b.js`).then(e=>e.g),import(`./chat-BD2Fu3jU.js`)]);return{store:r=>new n(t.db,r,Date.now,e),queue:new r(t.db),chatState:new a(t.db),defaultOrganizationId:i,webhookTarget:(e,r)=>n.webhookTarget(t.db,e,r),appRecord:e=>n.appRecord(t.db,e),apps:e=>n.apps(t.db,e),installationOrganization:e=>n.installationOrganization(t.db,e),installations:e=>n.installations(t.db,e),taskOrganization:(e,r)=>n.taskOrganization(t.db,e,r),connection:t,sweep:e=>new n(t.db,i).sweep(e),close:()=>t.close()}}async function So(e,t={}){return e.store===`postgres`?xo(e):bo(t.local)}async function Co(e,t,n,r){return e.updateMetadata(t,n,r)}async function wo(e,t){return e.getApps([...new Set(t)])}const To=e=>`audit:${String(9999999999999-e).padStart(13,`0`)}:${F(4).toString(`hex`)}`,Eo=e=>e.config.name??`Wular`,Do=e=>z(e,e.serverOrganizationId??e.organizationId);async function Oo(e,t,n){let r=(e.now??Date.now)(),i=e.session?.user,a={at:r,actor:i?{id:i.id,name:i.name,email:i.email}:{id:`admin-token`},action:t,target:n};await Do(e).store.put(`snapshot`,To(r),a)}async function ko(e,t){return(await e.store.list(`app`)).find(({value:e})=>e.builtin&&e.integration===t)?.value?.id??D({error:`No built-in ${t} app on this server.`},404)}async function Ao(e,t){let n=Do(t),r=(await n.store.list(`app`)).map(({value:e})=>e).filter(e=>e.builtin),i=await zo(n,r,!0),a=Object.values(t.integrations).filter(e=>e.app.shareable).map(e=>{let t=r.find(t=>t.integration===e.id);return{integration:e.id,name:e.name,brand:e.brand,organizationApps:e.organizationApps===!0,...Ro(e),...t?{app:{id:t.id,name:t.name,createdAt:t.createdAt,...i.has(t.id)?{changed:!0}:{}}}:{}}}),o=t.config.publicUrl,s=!!o&&v_.has(new URL(o).hostname);return D({name:Eo(t),platforms:a,...s?{unreachable:!0}:{}})}async function jo(e,t,n){let r=t.integrations[n.integration];if(!r)return D({error:`Unknown integration "${n.integration}".`},404);if(!r.app.shareable)return D({error:`Create ${r.name} apps in your workspace from the agent's Platforms tab.`},400);if(!t.config.publicUrl)return D({error:`Set PUBLIC_URL on this server first. Platforms call it.`},400);let i=await e.json().catch(()=>void 0),a=e=>typeof e==`string`&&e.trim()||void 0,o=a(i?.name)??Eo(t),s=r.organizationApps?a(i?.owner):void 0,c=await ty(Do(t),r.id,{name:o,owner:s});return await Oo(t,`Started setting up a shared app`,`${o} on ${r.name}`),D({url:c})}async function Mo(e,t,n,r){let i=Do(t),a=await ko(i,n.integration);return typeof a==`string`?Wo(e,i,{id:a},r,!0):a}async function No(e,t,n,r){let i=Do(t),a=await ko(i,n.integration);if(typeof a!=`string`)return a;let o=await Go(e,i,{id:a},r,!0);return o.ok&&await Oo(t,`Updated a shared app`,t.integrations[n.integration]?.name??a),o}async function Po(e,t){let n=await Do(t).store.list(`snapshot`,{prefix:`audit:`,limit:100});return D(n.map(e=>e.value))}async function Fo(e,t,n,r){let i=await t.store.get(`app`,n);if(!i)return D({error:`Unknown app`},404);let a=t.config.publicUrl;if(!a)return D({error:`PUBLIC_URL is not set on this server`},400);let o=await Qr(t,`install`,t.session?.user.id??`anonymous`,i.id),s=gt({tx:o,...r?{back:r}:{}});return D({url:`${a.replace(/\/$/,``)}/install/${i.integration}?app=${encodeURIComponent(i.id)}&state=${s}`})}async function Io(e,t,n=e.store.list(`app`)){let r=e.serverOrganizationId,[i,a]=await Promise.all([n,r!==void 0&&r!==e.organizationId&&e.scope?e.scope(r).store.list(`app`).then(t=>t.filter(({value:t})=>t.builtin&&e.integrations[t.integration]?.app.shareable)):[]]);return[...i,...a].filter(({value:n})=>(!n.builtin||e.integrations[n.integration]?.app.shareable)&&(!t||n.agent===t))}function Lo(e,t){let{credentials:n,...r}=t,i=t.builtin?void 0:e.integrations[t.integration]?.app.settingsUrl?.(t,R(e.config,n));return{...r,...i?{settingsUrl:i}:{}}}const Ro=e=>e.app.update?{appUpdate:`push`}:e.app.drift?{appUpdate:`drift`}:e.app.values?{appUpdate:`confirm`}:{};async function zo(e,t,n=!1){let r=e.config.publicUrl,i=t.filter(t=>(n||!t.builtin&&!t.shared)&&e.integrations[t.integration]?.app);if(!r||!i.length)return new Set;let[a,o]=await Promise.all([e.store.list(`delivery`,{ids:i.map(e=>lo(e.id))}),e.store.listAgentsWithVersions([...new Set(i.map(e=>e.agent))])]),s=e=>a.find(t=>t.id===lo(e))?.value;return new Set(i.filter(t=>{let n=e.integrations[t.integration].app,i=o.find(e=>e.record.id===t.agent)?.version;return i?.definition.integrations[t.integration]?n.update?!fo(s(t.id),i.version,uo(n,t,r,i.definition)):s(t.id)?.changed===!0:!1}).map(e=>e.id))}async function Bo(e,t,n,r){let i=await Io(t,r.searchParams.get(`agent`)),a=await zo(t,i.map(({value:e})=>e));return D(i.map(({id:e,value:n})=>({id:e,value:{...Lo(t,n),...a.has(e)?{changed:!0}:{}}})))}async function Vo(e,t,n){let r=await t.store.get(`app`,n.id);if(!r)return D({error:`Unknown app`},404);if(r.builtin)return D({error:`Only whoever runs this server can remove its shared apps.`},403);let i=t.now?.()??Date.now();for(let{id:e,value:n}of await t.store.list(`installation`))n.app===r.id&&!n.deletedAt&&await Co(t.store,`installation`,e,{deletedAt:i});return await t.store.delete(`app`,r.id),await Pf(t.store,r.id),D({ok:!0})}async function Ho(e,t,n){let r=await t.store.get(`installation`,n.id);if(!r||r.deletedAt)return D({error:`Unknown installation`},404);let i=await t.store.get(`app`,r.app),a=t.integrations[r.integration];if(!i||!a?.app.uninstall)return D({error:`Coder cannot uninstall ${a?.name??r.integration} apps.`},400);try{await a.app.uninstall(Mf(t,r),R(t.config,i.credentials),{fetch:t.fetch??fetch})}catch(e){console.error(`coder server: uninstalling ${r.id} failed`,e);let t=a.app.installationUrl?.(r);return D({error:`${e instanceof Error?e.message:String(e)}. Uninstall ${i.name} on ${a.name} instead.`,...t?{hint:t}:{}},502)}return await Ff(t.store,r.id,(t.now??Date.now)()),await Oo(t,`Uninstalled an app`,`${i.name} from ${r.account.login} on ${a.name}`),D({ok:!0})}async function Uo(e,t,n=!1){let r=await e.store.get(`app`,t);if(!r)return D({error:`Unknown app`},404);if((r.builtin||r.shared)&&!n)return D({error:`Only whoever runs this server can update its shared apps.`},403);if(!e.config.publicUrl)return D({error:`PUBLIC_URL is not set on this server`},400);let i=e.integrations[r.integration];if(!i||!(i.app.update||i.app.drift||i.app.values))return D({error:`Coder cannot update ${i?.name??r.integration} apps.`},400);n&&await nr(e.store,(e.now??Date.now)(),r.agent,await M(e.store,r.agent));let a=await ur(e.store,r.agent);return a?.definition.integrations[r.integration]?{app:r,version:a,integration:i}:D({error:`The agent no longer listens on ${i.name}.`},400)}async function Wo(e,t,n,r,i=!1){let a=await Uo(t,n.id,i);if(a instanceof Response)return a;if(a.integration.app.update)return D({error:`Coder updates ${a.integration.name} apps itself.`},400);try{return D(await po(t,t.store,a.app,a.version))}catch(e){return console.error(`coder server: reading ${a.app.id} on ${a.integration.name} failed`,e),D({error:e instanceof Error?e.message:String(e)},502)}}async function Go(e,t,n,r,i=!1){let a=await Uo(t,n.id,i);if(a instanceof Response)return a;let{app:o,version:s,integration:c}=a;if(c.app.values){let{lines:e}=c.app.values(o,{publicUrl:t.config.publicUrl,spec:Hv(s.definition,o.agent,o.integration)});return await t.store.put(`delivery`,lo(o.id),{version:s.version,manifest:e,changed:!1}),D({updated:!0})}if(!c.app.update)return D({error:`Change the app on ${c.name}; Coder cannot.`},400);let[l]=await mo(t,[s],o.id);return l?.error?D({error:l.error},502):D({updated:!0})}async function Ko(e,t,n,r){let i=r.searchParams.get(`agent`),a=await t.store.list(`installation`,{...i?{agent:i}:{},...r.searchParams.get(`active`)===`1`?{active:!0,includeUninstalled:!0}:{},limit:O(r,200)});return D(a.map(({id:e,value:n})=>({id:e,value:qo(t,n)})))}function qo(e,t){let{token:n,...r}=t,i=e.integrations[t.integration]?.app,a=t.account.url??i?.accountUrl?.(t.account),o=i?.installationUrl?.(t);return{...r,account:{...r.account,...a?{url:a}:{}},...o?{installationUrl:o}:{}}}async function Jo(e,t){let n=e.config.publicUrl,r=n?v_.has(new URL(n).hostname):!1,i=r?`https://<public address>`:n,a=t.searchParams.get(`agent`),o=e.store.list(`app`),[s,c,l]=await Promise.all([a?M(e.store,a):void 0,$v(e,o),o]),u=s?.record,d=new Set(c.map(e=>e.integration));return D(await Promise.all(Object.values(e.integrations).map(async n=>{let a=typeof n.use==`function`?n.use(wt(s?.version?.definition.integrations[n.id])):n.use;return{id:n.id,name:n.name,brand:n.brand,description:n.description,installLabel:n.installLabel??`Connect ${n.id}`,...a?{use:a}:{},...n.covered?{covered:n.covered}:{},...n.featured?{featured:!0}:{},builtinApp:n.app.shareable?`shared`:`own`,...n.auth.user?{personal:!0}:{},...await Ym(e,n.id,void 0,[...c,...l.map(e=>e.value)])?{connectable:!0}:{},organizationApps:n.organizationApps===!0,publicApps:n.publicApps===!0,events:Object.fromEntries(Object.entries(n.events).map(([e,{description:t,noisy:n,addressed:r}])=>[e,{description:t,...n?{noisy:n}:{},...r?{addressed:r}:{}}])),repositories:!!n.repos,...n.app.createStep&&i?{create:n.app.createStep(i,{saved:await Xv(e,n.id),name:u?.name,shared:d.has(n.id),public:n.publicApps===!0&&t.searchParams.get(`public`)===`1`})}:{},...r?{unreachable:!0}:{},...Ro(n)}})))}async function Yo(e,t,n=!1,r){let i=t;if(i.deletedAt)return;if(!n&&i.repos!=null&&(!r||i.repos.includes(r.repo)))return i;let a=e.integrations[i.integration];if(!a?.repos)return i;let o=e.repositoryLists??=new Map,s=o.get(i.id);return s||(s=Xo(e,a,i,r).finally(()=>o.delete(i.id)),o.set(i.id,s)),s}async function Xo(e,t,n,r){let i=r?.app??await e.store.get(`app`,n.app);if(!i)throw Error(`Missing app for installation ${n.id}`);let a=r?.token??await If(e,t,n,R(e.config,i.credentials)),o=await t.repos.list(Mf(e,n),a,e.fetch??fetch);return e.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!(!t||t.deletedAt))return JSON.stringify(t.repos)===JSON.stringify(n.repos)?(await Co(e,`installation`,t.id,{repos:o}),{...t,repos:o}):{...t,repos:t.repos??o}})}async function Zo(e,t=!1){let n=new Map,r=(await e.store.list(`installation`,{active:!0})).filter(({value:t})=>e.integrations[t.integration]?.repos),i=Array(r.length),a=0;await Promise.all(Array.from({length:Math.min(4,r.length)},async()=>{for(let n=a++;n<r.length;n=a++){let a=r[n].value;i[n]=t||a.repos==null?await Yo(e,a,t).catch(e=>(console.error(`coder server: repositories for installation ${a.id} failed`,e),a)):a}}));for(let e of i)if(!(!e||e.deletedAt))for(let t of e.repos??[])n.has(t)||n.set(t,{repo:t,integration:e.integration});return D([...n.values()].sort((e,t)=>e.repo.localeCompare(t.repo)))}const Qo=ht;function $o(e,t,n,r=F(32).toString(`base64url`)){let i=`${gt({task:e,organization:t,attempt:n})}.${r}`;return{token:i,hash:Qo(i)}}function es(e){try{return vt(e.slice(0,e.indexOf(`.`)))}catch{return{}}}function ts(e){let t=es(e);return typeof t==`object`&&!!t&&typeof t.task==`string`&&typeof t.organization==`string`&&Number.isInteger(t.attempt)}async function ns(e,t){let n=es(t);if(!ts(t)||n.organization!==e.organizationId)return;let r=await e.queue.authorize(n.task,Qo(t),n.attempt,e.organizationId,(e.now??Date.now)());if(!r)return;let{task:i}=r.status,{audience:a,space:o}=cs(i);return{task:i.id,agent:i.agent,attempt:n.attempt,...i.requestedBy&&!ls(i)?{requestedBy:i.requestedBy}:{},...i.context?.asker?{asker:i.context.asker}:{},...i.context?.user?{user:i.context.user}:{},dm:i.event?.chat?.thread.isDM===!0,access:i.access??`auto`,connections:i.connections??[],audience:a,...o?{space:o}:{}}}function rs(e,t){let n=t.requestedBy?{user:{id:t.requestedBy,name:t.user?.name??``,email:t.user?.email??``},organizationId:e.organizationId,role:`member`,organizations:[]}:void 0;return{...e,taskPrincipal:t,...n?{session:n}:{}}}const is=new Set([`engine`,`model`,`effort`]);function as(e,t){if(!t||typeof t!=`object`||Array.isArray(t))return`settings must be an object`;let n=new Set([...Object.keys(e??{}),...Object.keys(t)]);for(let r of n)if(!is.has(r)&&JSON.stringify(e?.[r])!==JSON.stringify(t[r]))return`A task changes only its agent's engine, model and effort, not ${r}.`}const os=6e4,V=e=>`${e.integration}:${e.account??e.installationId}:${e.space?.id??``}`,ss=e=>`space:${V(e)}`;function cs(e){if(e.audience!==void 0)return{audience:e.audience,...e.space?{space:e.space}:{}};let t=e.event;if(!t?.integration||e.source!==t.integration)return{audience:``};let n=V(t);return t.chat?.thread.isDM?{audience:`dm:${e.requestedBy??``}`,space:n}:{audience:t.space?.private===!1?``:ss(t),space:n}}const ls=e=>!!(e.event&&e.source===e.event.integration&&!e.event.chat?.thread.isDM);function us(e){let t=e.context?.asker??(ls(e)?void 0:e.requestedBy);return t&&t===e.requestedBy?t:void 0}const ds=(e,t)=>e===void 0||t.audience===``||t.requestedBy===e.id||t.audience===`dm:${e.id}`||!!(t.audience&&e.spaces?.includes(t.audience));async function fs(e,t){if(p_(e)||e.taskPrincipal)return;let n=e.session?.user.id??``;if(!n)return{id:n,spaces:[]};if(!t)return{id:n};let r=[...new Set(t.filter(e=>!!e?.startsWith(`space:`)))];return{id:n,spaces:r.length?await e.queue.memberSpaces(e.organizationId,n,r):[]}}async function ps(e,t,n,r){let i=t.auth.space;if(n.space?.private!==void 0||!i||!(n.space?.id||n.chat?.thread.id))return n.space;try{return await i(n,await r(),e.fetch??fetch)??n.space}catch(e){return console.error(`coder server: space of ${V(n)} unknown`,e),n.space}}async function ms(e,t,n,r,i=!1){let a=t.auth.members;if(!a||!n.space?.id||!cs({source:n.integration,event:n}).audience.startsWith(`space:`))return;let o=(e.now??Date.now)();try{let s=await e.queue.spaceSynced(e.organizationId,n);if(!i&&s!==void 0&&o-s<864e5||!await e.queue.claimSpace(e.organizationId,n,o,i))return;let c;try{c=await a(n.space,await r(),e.fetch??fetch,()=>e.queue.linkedMembers(e.organizationId,t.id))}finally{await e.queue.saveSpaceMembers(e.organizationId,n,c,o)}}catch(e){console.error(`coder server: members of ${V(n)} not fetched`,e)}}async function hs(e,t,n,r,i){let a={integration:t.id,appId:n,installationId:i.installation,...i.account?{account:i.account}:{},space:i.space};await e.queue.spaceChanged(e.organizationId,a,{...i.joined?{joined:i.joined}:{},...i.left?{left:i.left}:{},...i.space.private===void 0?{}:{private:i.space.private}},(e.now??Date.now)()),i.space.private===!0&&await ms(e,t,a,()=>_s(e,t,a,r))}async function gs(e,t,n,r,i){let a={integration:t.id,appId:n,installationId:i.installation,...i.account?{account:i.account}:{}},o=t.auth.teamSpaces;if(i.team&&!o)return;let s=()=>_s(e,t,a,r);try{let n=await e.queue.listedSpaces(e.organizationId,a);if(!n.length)return;let c=i.team?await o(i.team,await _s(e,t,a,r,{}),e.fetch??fetch):i.spaces;for(let r of n)(!c||c.includes(r.space?.id??``))&&await ms(e,t,r,s,!0)}catch(e){console.error(`coder server: members of ${V(a)} not fetched again`,e)}}async function _s(e,t,n,r,i={tools:t.tools.presets[`read-only`]}){let a=await e.store.get(`installation`,`${n.appId}:${n.installationId}`);if(!a||a.deletedAt)throw Error(`No installation`);return If(e,t,a,r,i)}var vs=t({listHistory:()=>Ds,readHistory:()=>Os,readLog:()=>Ss,saveHistory:()=>ks,storeLogs:()=>ws,taskRedactor:()=>Cs,taskWarnings:()=>bs});const ys=(e,t)=>`${e}:${String(t).padStart(6,`0`)}`;async function bs(e,t,n){n.length&&await e.store.withAppLock(`task-warnings:${t}`,async r=>{let i=r.queue?.()??e.queue,a=[];for(let e of new Set(n))await r.get(`delivery`,`task-warning:${t}:${e}`)||a.push(e);if(a.length)for(let n=0;n<3;n++){let n=await r.get(`task`,t);if(!n)return;let o=n.logSeq??0,s=n.logCursor??-1,c=(e.now??Date.now)();if(await i.appendLogs(e.organizationId,t,a.map((e,t)=>({seq:o+t,at:c,level:`sys`,line:e})),{seq:o,cursor:s},{seq:o+a.length,cursor:s,bytes:(n.logBytes??0)+a.reduce((e,t)=>e+Buffer.byteLength(t),0)},c,{attempts:n.attempts,tokenHash:n.tokenHash??null,handle:n.handle,generation:n.generation??0})){for(let e of a)await r.put(`delivery`,`task-warning:${t}:${e}`,{at:c},{ttlMs:864e5});return}}})}function xs(e,t,n,r){let i=t,a=r,o=[];for(let t of e){let e=Buffer.byteLength(t.line);if(a+e>2097152)break;o.push({seq:i,at:t.at??n,level:t.level,line:t.line}),a+=e,i+=1}return{lines:o,seq:i,bytes:a}}async function Ss(e,t,n=-1,r){return(await e.list(`tasklog`,{prefix:`${t}:`,...n>=0?{after:ys(t,n)}:{},...r?{limit:r}:{}})).map(e=>{let t=tn(e.value.line);return{seq:Number(e.id.slice(e.id.lastIndexOf(`:`)+1)),...e.value,...t?{entry:t}:{}}})}async function Cs(e,t,n=!1){let r=e.settings??={},i=r.taskLogSecrets??=new Map,a=JSON.stringify([e.organizationId,t.task.id,t.attempts,t.generation,t.tokenHash]);n&&i.delete(a);let o=i.get(a);return o||(o=tp(e,t).then(e=>{let t=e.sort((e,t)=>t.length-e.length);return e=>t.reduce((e,t)=>t?e.replaceAll(t,`[REDACTED]`):e,e)}).catch(e=>{throw i.delete(a),e}),i.set(a,o),setTimeout(()=>{i.get(a)===o&&i.delete(a)},(e.config.taskTimeoutMs??18e5)+6e4).unref?.()),o}async function ws(e,t,n){let r=await Cs(e,t),i=e=>typeof e==`string`?r(e):Array.isArray(e)?e.map(i):e&&typeof e==`object`?Object.fromEntries(Object.entries(e).map(([e,t])=>[r(e),i(t)])):e,a=e=>{try{return JSON.stringify(i(JSON.parse(e)))}catch{return r(e)}};for(let r=0;r<5;r++){let i=r===0&&e.callbackTask===t?t:await e.store.get(`task`,t.task.id);if(!i||i.attempts!==t.attempts||i.tokenHash!==t.tokenHash||i.generation!==t.generation)return`stale`;let o=i.logCursor??-1,s=n.filter(e=>e.seq>o);if(!s.length)return`ok`;if(i.logsComplete||s[0].seq!==o+1)return`gap`;let c=(e.now??Date.now)(),l=xs(s.map(e=>({...e,line:a(e.line)})),i.logSeq??0,c,i.logBytes??0);if(await e.queue.appendLogs(e.organizationId,t.task.id,l.lines,{seq:i.logSeq??0,cursor:o},{seq:l.seq,cursor:s.at(-1).seq,bytes:l.bytes},c,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0}))return`ok`}return`stale`}const Ts=Rr(Hr),Es=Rr(Wr);async function Ds(e,t,n){return D(await t.store.listHistory(n.id))}async function Os(e,t,n){let r=await t.store.get(`history`,`${n.id}:${n.conversation}`);if(!r)return D({error:`No saved history`},404);try{return D({engine:r.engine,conversation:r.conversation,data:R(t.config,r.data),...r.state?{state:R(t.config,r.state)}:{}})}catch(e){return console.error(`coder server: history ${n.id}/${n.conversation} could not be decrypted`,e),D({error:`The saved history cannot be read`},422)}}async function ks(e,t,n){let r=await e.json().catch(()=>void 0);if(r?.engine!==`claude`&&r?.engine!==`codex`||typeof r.conversation!=`string`||!kt.test(r.conversation)||typeof r.data!=`string`||r.state!==void 0&&(!r.state||typeof r.state!=`object`||Array.isArray(r.state)))return D({error:`Invalid history`},400);let i;try{i=(await Ts(Buffer.from(r.data,`base64`),{maxOutputLength:67108864})).toString(`utf8`)}catch{return D({error:`Invalid history`},400)}let a=await Cs(t,t.callbackTask,!0);return await t.store.put(`history`,`${n.id}:${r.conversation}`,{engine:r.engine,conversation:r.conversation,data:L(t.config,(await Es(a(i))).toString(`base64`)),...r.state?{state:L(t.config,JSON.parse(a(JSON.stringify(r.state))))}:{},savedAt:(t.now??Date.now)()}),D({ok:!0})}var H=class extends Error{status;fix;constructor(e,t=400,n){super(e),this.status=t,this.fix=n}};function As(e,t,n){if(n?.problems?.length)throw new H(n.problems.join(`
+`),409);if(n?.settings?.disabled)throw new H(`Agent "${t}" is disabled in this workspace. Enable it in its settings to start tasks.`,409,`${e.config.publicUrl?.replace(/\/$/,``)??``}${Rv(Iv(e),`/agents/${encodeURIComponent(t)}/settings`)}`)}function js(e,t){if(t.cwd===void 0)return;if(!e.local)throw new H(`cwd is available on a local server only`);let n=Va(t.cwd);if(!n.ok)throw new H(n.detail);return n.folder.path}function Ms(e,t){if(t.agent&&t.agent!==e.agent)throw new H(`A task starts children of its own agent only.`,403);let n=[`cwd`,`flow`,`args`,`mcp`,`addDirs`].filter(e=>t[e]!==void 0);if(n.length)throw new H(`A child task takes no ${n.join(`, `)}; give it the text to work on.`,403);return{...t,agent:e.agent,access:Re(t.access,e.access),connections:it(e.connections,t.connections)}}const Ns=/^[a-z0-9][a-z0-9_-]*$/i;function Ps(e,t){let n=t.find(t=>e instanceof Object&&t in e);if(n)return`Unknown task option "${n}". Give model as <name>[/<effort>] or <engine>/<model>[/<effort>], and access as read-only or auto.`}function Fs(e){let t=Ps(e,[`engine`,`effort`,`permissions`,`background`]);if(t)throw new H(t);let n=e.flow??`default`;if(!Ns.test(n))throw new H(`Invalid flow "${n}"`);if(e.prompt!==void 0&&typeof e.prompt!=`string`)throw new H(`prompt must be text`);if(n==="default"&&!e.prompt?.trim())throw new H(`prompt is required`);if((e.prompt?.length??0)>65536)throw new H(`prompt is longer than 64 KB`);if(e.repo!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(e.repo))throw new H(`repo must be owner/name`);if(e.pr!==void 0&&(!Number.isInteger(e.pr)||e.pr<1||!e.repo))throw new H(`pr needs a repo and a pull request number`);if(e.access!==void 0&&!ye.includes(e.access))throw new H(`Unknown access "${e.access}". Use read-only or auto.`);if(e.mcp!==void 0&&(!Array.isArray(e.mcp)||!e.mcp.every(e=>Ns.test(e))))throw new H(`mcp must list server names`);if(e.connections!==void 0&&(!Array.isArray(e.connections)||!e.connections.every(e=>typeof e==`string`&&e.length>0)))throw new H(`connections must list connection ids`);if(e.outputSchema!==void 0&&(!e.outputSchema||typeof e.outputSchema!=`object`||Array.isArray(e.outputSchema)))throw new H(`outputSchema must be an object`);if(e.args!==void 0&&(typeof e.args!=`object`||Array.isArray(e.args)))throw new H(`args must be an object`);if(e.name!==void 0&&(typeof e.name!=`string`||e.name.length>200))throw new H(`name must be text of at most 200 characters`);if(e.appendSystem!==void 0&&(typeof e.appendSystem!=`string`||e.appendSystem.length>65536))throw new H(`appendSystem must be text of at most 64 KB`);if(e.addDirs!==void 0&&(!Array.isArray(e.addDirs)||!e.addDirs.every(e=>typeof e==`string`&&N.isAbsolute(e))))throw new H(`addDirs must list absolute paths`)}async function Is(e,t){let n=(await e.store.list(`installation`)).filter(({value:t})=>!t.deletedAt&&e.integrations[t.integration]?.repos).sort((e,n)=>Number(n.value.repos?.includes(t)??!1)-Number(e.value.repos?.includes(t)??!1)),r=new Map((await wo(e.store,n.map(({value:e})=>e.app))).map(({id:e,value:t})=>[e,t])),i=e.taskPrincipal?.agent;for(let{value:a}of n){let n=e.integrations[a.integration];if(a.deletedAt||!n?.repos)continue;let o=r.get(a.app);if(!(!o||i&&o.agent!==i))try{let r=await If(e,n,a,R(e.config,o.credentials)),i=a.repos?.includes(t)?a:await Yo(e,a,!1,{app:o,token:r,repo:t});if(!i?.repos?.includes(t))continue;return{integration:n,installation:i,app:o,token:r}}catch(e){console.error(`coder server: repository token for ${a.id} failed`,e)}}throw i?new H(`No install of agent "${i}" reaches ${t}`,403):new H(`No install in this workspace reaches ${t}`,404)}async function Ls(e,t,n,r){let i=n.repo,{integration:a,installation:o,app:s,token:c}=await Is(e,i),l=await a.repos.get(i,c);return{event:{integration:a.id,type:n.pr?`pull_request`:`task`,appId:s.id,installationId:o.id.slice(s.id.length+1),deliveryId:t,actor:{id:r??``},text:n.prompt??``,...n.pr?{chat:{thread:a.repos.pullRequestThread(i,n.pr)}}:{},repo:l},author:a.author?.(s.name)??s.name}}async function Rs(e,t){if(t)try{let n=At({model:t},q(e,await K(e)));return{engine:n.engine,model:n.model??void 0,...n.effort?{effort:n.effort}:{}}}catch(e){throw new H(e.message)}}async function zs(e,t,n){let r=e.taskPrincipal,i=r&&(await e.store.get(`task`,r.task))?.task;r&&(n=Ms(r,n)),Fs(n);let a=js(e,n),o=(e.now??Date.now)(),s=i?us(i):e.session?.user.id,c=n.agent||ot();if(!c)throw new H(`Name an agent: this server has no default agent.`);c===ot()&&await or(e,o),e.local&&await lr(e.store,e.local.cwd,e.integrations);let{record:l,version:u}=await M(e.store,c),d=await Ra(e,{requestedBy:s,runner:n.runner,agent:u?.definition.runner}).catch(e=>{throw new H(e.message)});if(!l||!u)throw new H(`No agent "${c}"`,404);As(e,c,l);let f=await Rs(e,n.model)??i?.usage?.pick,p=ir(l,u,f,e.integrations),{models:h,first:g}=await Qp(e,yt(p),s),_=tm(h,d.runner===`http`);if(!_.length)throw await Vs(e,h,g.engine);let v=`${o.toString(36)}-${F(4).toString(`hex`)}`,y=n.repo?await Ls(e,v,n,s):void 0,b=n.addDirs?.length?Mt(d.runner):void 0;if(e.local&&n.addDirs?.length&&!b)try{Nt(a??e.local.cwd,n.addDirs)}catch(e){throw e instanceof m?new H(e.message):e}let x={id:v,...n.name?{name:n.name}:{},source:t,agent:p.id,flow:n.flow??`default`,...d,access:Et(p,n.access),...y?{event:y.event,author:y.author}:{},...a&&!y?{cwd:a}:{},...n.prompt?{prompt:n.prompt}:{},...n.args?{args:n.args}:{},...n.mcp?.length?{mcp:n.mcp}:{},...n.appendSystem?{appendSystem:n.appendSystem}:{},...n.addDirs?.length&&!b?{addDirs:n.addDirs}:{},definition:p.definition,models:_,...s?{requestedBy:s}:{},...r?{parent:r.task,audience:r.audience,...r.space?{space:r.space}:{}}:{},...p.files?{files:p.files}:{},usage:{...p.usage,...f?{pick:f}:{}},tools:r?St(p,n.access):{},connections:await ph(e,s,it(p.usage?.connections,n.connections)),...e.session||n.outputSchema?{context:{...e.session?{user:{name:e.session.user.name,email:e.session.user.email}}:{},...n.outputSchema?{outputSchema:n.outputSchema}:{}}}:{}};return e.local&&d.runner===`local`&&!d.runnerId?vp(e,x):(await e.queue.enqueue(e.organizationId,x,o,void 0,e.config.maxQueued??1e3),b&&await bs(e,v,[b]),{task:x,status:`queued`,attempts:0,createdAt:o,updatedAt:o})}function Bs(e){return e.turns?e.turns:[...e.task.context?.turns??[],{prompt:e.task.prompt??e.task.event?.text??e.task.name??``,result:e.result,error:e.error,finishedAt:e.finishedAt,...[`completed`,`failed`,`cancelled`].includes(e.status)?{logSeq:e.logSeq}:{}}]}async function Vs(e,t,n,r){let i=await ym(e,n),a=r?.event?.actor;if(r?.requestedBy&&a&&r.source===r.event?.integration){let e=`@${a.login??a.id}`;return new H(`This thread runs on ${e}'s subscription. Ask ${e}, or an admin can add a workspace key: [Add a key](${i})`,409,i)}return new H(`No credential runs ${t.map(e=>e.model).join(` or `)}`,409,i)}async function Hs(e,t,n){let r=t.runnerId?await e.store.get(`runner`,t.runnerId):void 0;return t.source!==t.event?.integration&&(!r||Ia(r,n))?{runner:t.runner,...t.runnerId?{runnerId:t.runnerId}:{}}:{runnerId:void 0,...await Ra(e,{requestedBy:n,agent:t.definition.runner})}}async function Us(e,t){let n=t.usage?.pick,r=t.event,i;if(r){let[n,a]=await Promise.all([e.store.get(`app`,r.appId),e.store.get(`installation`,`${r.appId}:${r.installationId}`)]);if(!n||!a||a.deletedAt||!e.loadAgent)return{};As(e,t.agent,await e.store.get(`agent`,t.agent));let o=e.integrations[r.integration],s=R(e.config,n.credentials);i=await e.loadAgent(n,a,r,Lf(e,o,a,r,s))}else{t.agent===ot()&&await or(e,(e.now??Date.now)());let{record:r,version:a}=await M(e.store,t.agent);if(As(e,t.agent,r),!r||!a)return{};i=ir(r,a,n,e.integrations)}let a=r&&Tt(r,i,t.access),o={...i.usage,...n},s=us(t),c=r&&t.source===r.integration?r:void 0,[l,{models:u,first:d},f]=await Promise.all([Hs(e,t,s),Qp(e,yt({...i,usage:o}),s),c&&Lv(e)]),p=tm(u,l.runner===`http`),m=c?.chat?.message?.author.userId||c?.actor.id,h=c&&m&&!t.context?.asker?await Vm(e,e.integrations[c.integration],{task:t.id,actor:m,models:u,attempts:p,...f?{slug:f}:{}}):void 0;if(!p.length)throw h?new H(h.failure,409,h.url):await Vs(e,u,d.engine,t);return{definition:i.definition,usage:{...o,...n?{pick:n}:{}},models:p,...l,tools:a?.tools??St(i,t.access),...i.files?{files:i.files}:{},access:Et(i,t.access),...c?{failureReply:h?.failure??await xm(e,d.engine,f),notice:h?.notice}:{}}}async function Ws(e,t,n,r,i={}){if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))throw new H(`outputSchema must be an object`);if(!n.trim())throw new H(`text is required`);if(n.length>65536)throw new H(`text is longer than 64 KB`);let{model:a,access:o}=i;if(a!==void 0&&(typeof a!=`string`||!a.trim()))throw new H(`model must be text`);if(o!==void 0&&!ye.includes(o))throw new H(`Unknown access "${o}". Use read-only or auto.`);let s=(e.now??Date.now)(),c=t.task.context?.messages??[],l=String(t.finishedAt??s),u=[...c,{user:`user`,text:t.task.prompt??t.task.event?.text??``,ts:String(t.createdAt)},{user:`agent`,text:t.result?.output??t.error??``,ts:l}].slice(-20),d=t.task.context??{},f=Bs(t);f.at(-1).finishedAt??=s;let p=a?await Rs(e,a):t.task.usage?.pick,m=await Us(e,{...t.task,usage:{...t.task.usage,pick:p}}),h={task:{...t.task,...m,prompt:n,access:Re(o,m.access??t.task.access),context:{...d,...r?{outputSchema:r}:{},messages:u,turns:f}},status:`queued`,attempts:0,generation:(t.generation??0)+1,...t.logSeq===void 0?{}:{logSeq:t.logSeq},...t.logBytes===void 0?{}:{logBytes:t.logBytes},createdAt:t.createdAt,updatedAt:s};if(!await e.queue.continueTask(e.organizationId,t.task.id,h.task,s,{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0}))throw new H(`Task is already active`,409);return h}const Gs={principalPerMinute:300,ipPerMinute:60,authPerMinute:20,registerPerMinute:10,pairingPerMinute:5,concurrentTasks:10};var Ks=class{buckets=new Map;sweptAt;requests=0;rejections=0;constructor(e=Date.now()){this.sweptAt=e}consume(e,t,n){if(n-this.sweptAt>=6e4){for(let[e,t]of this.buckets)n-t.at>=6e4&&this.buckets.delete(e);this.sweptAt=n}let r=this.buckets.get(e),i=r?Math.min(t,r.tokens+Math.max(0,n-r.at)*t/6e4):t,a=i<1;if(this.buckets.set(e,{tokens:a?i:i-1,at:n}),!a)return;this.rejections++;let o=Math.max(1,Math.ceil((1-i)*60/t));return D({error:`Too many requests. Try again in ${o} seconds.`},429,{"retry-after":String(o)})}};const qs=[[e=>e===`/admin/runners/pair`,`pairing`],[e=>e===`/runners/register`,`register`],[e=>e.startsWith(`/admin/`)||e.startsWith(`/runners/`)],[e=>e.startsWith(`/api/auth`)||e===`/login`||e===`/dash/token`,`auth`]];async function Js(e,t,n){let r=new URL(e.url).pathname,i=qs.find(([e])=>e(r));if(!i)return(r===`/dash`||r.startsWith(`/dash/`))&&t.auth&&!await t.auth.session(e.headers)?Ys(t,void 0,n,`auth`)??{}:{};let a=r.startsWith(`/admin/`)?await D_(e,t):void 0;return Ys(t,r===`/runners/register`?await N_(e,t):a&&!(a instanceof Response)?a.taskPrincipal?`task:${a.taskPrincipal.task}`:a.session?`user:${a.session.user.id}`:`admin`:void 0,n,i[1])??{scope:a}}function Ys(e,t,n,r){let i=e.limits??=new Ks((e.now??Date.now)()),a={...Gs,...e.config.limits},o=(e.now??Date.now)(),s=t??`ip:${n}`,c=i.consume(s,t?a.principalPerMinute:a.ipPerMinute,o);return c||!r?c:r===`pairing`?i.consume(`pair:${s}`,a.pairingPerMinute,o):i.consume(`${r}:ip:${n}`,r===`auth`?a.authPerMinute:a.registerPerMinute,o)}const Xs=Symbol(`miss`);function Zs(e,t){return new Proxy(e,{get(e,n){let r=Reflect.get(e,n,e);if(typeof r!=`function`)return r;let i=r.bind(e),a=t[n];return a?async(...e)=>{let t=a(...e);return t===Xs?i(...e):t}:i}})}const Qs=(e,t)=>e.length===t.length&&e.every((e,n)=>e===t[n]);function $s(e,t,n){let r=t.task,i=r.event,a=e=>e in n,o=`connections:${r.id}:${t.generation??0}:${t.attempts}:`;return Zs(e,{get:(e,t)=>e===`app`&&a(`app`)&&t===i?.appId?n.app:e===`installation`&&a(`installation`)&&t===`${i?.appId}:${i?.installationId}`?n.installation:e===`credential`&&a(`credential`)&&t===r.models?.[0]?.credential?n.credential:e===`config`&&a(`config`)&&t===`workspace`?n.config:e===`runner`&&a(`runner`)&&t===r.runnerId?n.runner:e===`snapshot`&&a(`secrets`)&&t===`connection-secrets:${r.id}`?void 0:e===`snapshot`&&a(`resolved`)&&t.startsWith(o)?n.resolved?.id===t?n.resolved.value:void 0:Xs,list:(e,t)=>e===`snapshot`&&a(`secrets`)&&t?.prefix===`connection-secrets:${r.id}:`?n.secrets.rows.map((e,n)=>({id:`${t.prefix}${n}`,value:{secret:e}})):Xs,listCredentials:e=>a(`credentials`)&&e.owner===r.requestedBy&&e.limit===void 0?n.credentials??[]:Xs,heldTokens:(e,t)=>a(`tokens`)&&n.installation&&Qs(e,[n.installation.id])&&Qs(t,[n.installation.app])?n.tokens:Xs})}function ec(e,t,n){let r=e=>e===void 0||e===t.member?.id,i=(e,t)=>!e.owner||e.owner===t;return Zs(e,{get:(e,r)=>e===`agent`&&r===n.agent?t.record:e===`snapshot`&&n.files.some(e=>r.startsWith(e))?t.files[r]:Xs,conversationState:e=>e===n.conversation?t.conversation:Xs,listCredentials:e=>r(e.owner)&&e.limit===void 0?t.credentials.filter(t=>i(t.value,e.owner)):Xs,list:(e,n)=>e===`runner`&&n?.defaults&&!n.runner&&r(n.visibleTo)?t.runners.filter(e=>i(e.value,n.visibleTo)):e===`connection`&&!n?.ids&&!n?.secrets&&r(n?.visibleTo)?t.connections.filter(e=>i(e,n?.visibleTo)).map(e=>({id:e.id,value:e})):Xs,heldTokens:(e,r)=>Qs(e,[n.installation.id])&&Qs(r,[n.installation.app])?t.tokens:Xs})}const tc=2592e6,nc=36e5;async function rc(e,t){return t.chat?ic(e,e.integrations[t.integration],t.appId,t.installationId,t.chat.thread.id):{}}async function ic(e,t,n,r,i){let a=Rc(n,r,ac(t,i)),o=await e.store.conversationState(a),s=Rc(n,r,i);if(o.record||s===a)return o;let c=await e.store.conversationState(s);return c.record?{...o,record:c.record,status:c.status}:o}const ac=(e,t)=>e?.item?.(t)??t,oc=(e,t)=>Rc(t.appId,t.installationId,ac(e.integrations[t.integration],t.chat.thread.id)),sc=(e,t)=>!e?.chat||e.chat.thread.id===t.chat?.thread.id,cc=e=>e.slice(0,e.indexOf(`:`)),lc=e=>e.channelId?.slice((e.adapterName?.length??-1)+1)??``;function uc(e,t,n,r){return`known:${e}:${t}:${n}:${r}`}async function dc(e,t){return(await rc(e,t)).status}function fc(e,t,n,r){let i=t.chat?.thread;if(!i)return;let a=i.id.slice((i.channelId?.length??-1)+1);return{key:oc(e,t),record:{at:r,taskId:n,...t.chat?.message?{seen:t.chat.message.id}:{}},root:uc(t.appId,t.installationId,lc(i),a),ttlMs:tc}}async function pc(e,t,n,r){let i=fc(e,t,n,r);i&&await e.store.putMany(`delivery`,[{id:i.key,value:i.record},{id:i.root,value:{at:r}}],{ttlMs:tc})}function mc(e,t){let n=e.chat?.thread;return n?[...new Set([t].flat().filter(Boolean))].map(t=>uc(e.appId,e.installationId,lc(n),t)):[]}async function hc(e,t,n,r){await e.store.putMany(`delivery`,mc(t,n).map(e=>({id:e,value:{at:r}})),{ttlMs:tc})}async function gc(e,t,n,r){if(t.chat?.message)return e.store.markConversation(oc(e,t),n,t.chat.message.id,r,tc)}function _c(e,t){let n=t.conversation?.unseen;return t.chat&&n!==void 0?{key:oc(e,t),version:n.version,...n.epoch?{epoch:n.epoch}:{}}:void 0}async function vc(e,t,n){await e.store.appendUnseen(oc(e,t),n,tc)}async function yc(e,t){let n=_c(e,t);n&&await e.store.acknowledgeUnseen(n.key,n.version,n.epoch)}function bc(e,t,n){let r=wt(n.definition.integrations[e.id]);return!t.builtin&&Object.entries(e.events).some(([e,t])=>t.noisy&&r.includes(e))}function xc(e,t){let n=e.events[t.type]?.on;return n===`mention`||n===`command`||t.chat?.thread.isDM===!0||t.chat?.message?.isMention===!0||t.mentioned===!0}async function Sc(e,t,n,r){let i=n.chat?.thread;if(!i)return n;let a=i.isDM===!0,o=xc(t,n),[s,c]=await Promise.all([r.loaded?r.unseen??{messages:[],more:0}:e.store.get(`delivery`,`since:${oc(e,n)}`).then(e=>e??{messages:[],more:0}),t.conversation?t.conversation(n,{token:r.token,fetch:e.fetch??fetch,delivered:r.delivered,...r.existing?.seen?{after:r.existing.seen}:{}}).catch(e=>(console.error(`coder server: ${t.id} conversation facts failed`,e),{})):{}]),l=new Set(s.messages.flatMap(e=>e.id??[])),u=(c.since??[]).map(e=>({thread:i.id,...e})),d=new Map(u.flatMap(e=>e.id?[[e.id,e]]:[])),f=[...s.messages.map(({sequence:e,...t})=>t.id&&d.get(t.id)||t),...u.filter(e=>!e.id||!l.has(e.id))],p=f.slice(0,50),m=(c.since?0:s.more)+f.length-p.length,h=r.existing||a?void 0:c.index??n.conversation?.index;return{...n,mustReply:o,conversation:{...h===void 0?{}:{index:h},...s.messages.length||s.more?{unseen:{version:s.version??s.messages.length+s.more,epoch:s.epoch}}:{},...p.length?{since:p}:{},...m?{more:m}:{}}}}async function Cc(e,t,n){for(;;){let r=await e.store.claimBatch(t,n);if(r!==null)return r;await new Promise(e=>setTimeout(e,500))}}async function wc(e,t,n,r,i){return e.store.finishBatch(t,n,r,i)}async function Tc(e,t,n,r){let i=await e.store.get(`task`,t.task.id)??t,a=cc(n),o=await Qh(e,t.task.id,-1,i.generation??0),s=new Set([i.task.context?.admissions?.[a],...o.map(e=>e.value?.admissions?.[a])]);return{fresh:i,through:r.reduce((e,t,n)=>s.has(t.admission)?n+1:e,0)}}async function Ec(e,t,n,r,i){if(!X.includes(t.status))return!1;let a=t.status!==`queued`&&Ac(e,t.task)?xp(e.local.cwd,t.task.id,!1):void 0;if(a&&!X.includes(a.status))return!1;let o=!!await Zh(e,t,`steer`,i===void 0?{text:n}:{text:n,asker:i},r);return o&&t.task.notice&&await Oc(e,t),o}const Dc=e=>`notice:${e.task.id}:${e.generation??0}`;function Oc(e,t){return e.store.create(`delivery`,Dc(t),{at:(e.now??Date.now)()},{ttlMs:tc})}function kc(e,t){return e.store.delete(`delivery`,Dc(t))}const Ac=(e,t)=>!!e.local&&!t.event?.repo&&t.runner===`local`&&!t.runnerId;async function jc(e,t,n,r,i,a,o){let{task:s}=t,c={mustReply:r,admissions:{...s.context?.admissions,...i},asker:a},l=s.event&&o?{...s.event,chat:o}:s.event;if(Ac(e,s))return Sp(e,e.local.cwd,s.id,n,void 0,{},c,l);try{await Ws(e,{...t,task:{...s,event:l,context:{...s.context,...c}}},n)}catch(t){if(!(t instanceof H&&t.status===409))throw t;if(!t.fix||!l)return!1;let n=await e.store.get(`app`,l.appId),{eventReplies:r}=await Promise.resolve().then(()=>ad);n&&await(await r(e,n,l)).post(t.message)}return!0}function Mc(e,t){let n=t.catch(e=>console.error(`coder server: conversation batch failed`,e));e.waitUntil&&e.waitUntil(n)}function Nc(e){let t=t=>bn(e.slice(0,t).map(e=>e.event),e[t-1].user),n=t(1);if(n.length>65536){let t=e[0].event,n=n=>bn([{...t,text:t.text.slice(0,n)+`
+[message truncated]`}],e[0].user);n(0).length>65536&&(t={...t,conversation:{...t.conversation,since:void 0,more:(t.conversation?.more??0)+(t.conversation?.since?.length??0)},chat:t.chat?{thread:t.chat.thread,message:t.chat.message?{...t.chat.message,attachments:[],links:[]}:void 0}:void 0});let r=0,i=t.text.length;for(;r<i;){let e=Math.ceil((r+i)/2);n(e).length<=65536?r=e:i=e-1}return{text:n(r),count:1}}let r=1;for(;r<e.length;){let e=t(r+1);if(e.length>65536)break;n=e,r++}return{text:n,count:r}}async function Pc(e,t,n,r,i,a,o){let s=`batch:${oc(e,n)}`;if(!(a?a.batch:await e.store.get(`delivery`,s))?.items.length&&sc(t.task.event,n)&&await Ec(e,t,bn([n],r),void 0,o??null)){await yc(e,n),await gc(e,n,t.task.id,i());return}let c=I(),l=n.chat?.message,u=l?{...n,chat:{thread:n.chat.thread,message:{...l,formatted:{type:`root`,children:[]},raw:null,attachments:l.attachments.map(({type:e,url:t,name:n})=>({type:e,...t?{url:t}:{},...n?{name:n}:{}}))}}}:n;await e.store.appendBatch(s,c,[{admission:c,event:u,user:r,...o?{asker:o}:{}}],i(),nc),await yc(e,n),Mc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.steerBatchMs??5e3)),await Ic(e,t,s,c,i)})())}function Fc(e,t){let n=t.event;if(!n?.chat||t.source!==n.integration)return;let r=`batch:${oc(e,n)}`;Mc(e,(async()=>{let n=await e.store.get(`delivery`,r),i=n?.items.length&&await e.store.get(`task`,t.id);i&&await Ic(e,i,r,n.owner,e.now??Date.now)})())}async function Ic(e,t,n,r,i){let a=await Cc(e,n,r);if(!a)return;let o=a.items.map((e,t)=>t===a.items.length-1?{...e,event:{...e.event,mustReply:e.event.mustReply||a.mustReply,conversation:{...e.event.conversation,more:(e.event.conversation?.more??0)+(a.more??0)}}}:e),s=!1,c=!1,l=!1;try{for(let a=0;a<o.length;){let{fresh:s,through:u}=await Tc(e,t,n,o);if(u>a){if(c=!0,!await wc(e,n,r,!0,o[u-1].admission))return;a=u;continue}let d=o[a].event,f=sc(s.task.event,d);if(!f&&X.includes(s.status))return;let p=o.slice(a).findIndex(e=>!sc(e.event,d)),{text:m,count:h}=Nc(o.slice(a,p<0?void 0:a+p)),g=o.slice(a,a+h),_=g.at(-1).admission,v=g.every(e=>e.asker===g[0].asker)?g[0].asker:void 0,y=f&&await Ec(e,s,m,{key:n,owner:r,through:_},v??null),b=y||await jc(e,s,m,g.some(e=>e.event.mustReply===!0),{[cc(n)]:_},g.at(-1).asker,d.chat);if(!b&&!l){l=!0;continue}if(!b)throw Error(`Conversation task did not accept the batch`);if(c=!0,!y&&!await wc(e,n,r,!0,_))return;await gc(e,g.at(-1).event,t.task.id,i()),a+=h}s=!0}catch(e){if(!(e instanceof Rh))throw e}finally{s||await wc(e,n,r,!1),c&&await Vl(e,!0,!1,!0)}}async function Lc(e,t,n,r){let i=await dc(e,t);if(!i||!X.includes(i.status))return;let a=`reactions:${oc(e,t)}`,o=I();await e.store.appendBatch(a,o,[{...n,admission:o}],r(),nc),Mc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.reactionBatchMs??3e4));let n=await Cc(e,a,o);if(!n)return;let r=!1;try{let{fresh:s,through:c}=await Tc(e,i,a,n.items),l=n.items.slice(c);if(c&&!await wc(e,a,o,!0,n.items[c-1].admission))return;if(!l.length){r=!0;return}let u=new Map;for(let{emoji:e,by:t,on:n}of l){let r=u.get(`${e}\n${n}`)??{emoji:e,by:[],on:n};r.by.includes(t)||r.by.push(t),u.set(`${e}\n${n}`,r)}r=await Ec(e,s,yn({...t,conversation:{...t.conversation,more:n.more}},[...u.values()]),{key:a,owner:o,through:l.at(-1).admission})}catch(e){if(!(e instanceof Rh))throw e}finally{r||await wc(e,a,o,!1)}})())}function Rc(e,t,n){return`thread:${e}:${t}:${n}`}async function zc(e,t,n,r){let i={},a=r===void 0&&e.auth&&n.actor.id?await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0):r;return a&&(i.user={name:a.name,email:a.email},i.asker=a.id),i}var Bc=t({ACCESS_UNCHECKED:()=>Kc,DELIVERY_TTL_MS:()=>Hc,dispatchEvent:()=>Zc,dropped:()=>U,failedDeliveries:()=>nl,linkedMember:()=>Gc,recordFailure:()=>el,reportTaskFailure:()=>tl,writeCheck:()=>qc});const Vc=6e4,Hc=864e5,Uc=262144;async function Wc(e,t,n){let r=`${t.id}:${n.installationId}`,i=e.boundInstallation?.installation.id===r?e.boundInstallation.installation:await e.store.get(`installation`,r);return i&&!i.deletedAt?i:void 0}function U(e,t,n=`info`){console[n](`coder server: ${e.appId} dropped ${e.type} event ${e.deliveryId}: ${t}`)}async function Gc(e,t,n){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);return r?.organizations?.includes(e.organizationId)?r:void 0}const Kc=`Coder could not check your access to this conversation.`;async function qc(e,t,n,r){if(t.auth.canWrite)return t.auth.canWrite(n,await r(),e.fetch).catch(e=>(console.error(`coder server: ${t.id} write check failed for ${n.appId} event ${n.deliveryId}`,e),null))}async function Jc(e,t,n){return`No model is configured yet. If you have access to it, [Add a model](${await ym(e,t,n)}).`}function Yc(e,t,n){let r=e.config.publicUrl?.replace(/\/$/,``);return r?`${r}${Rv(t,n)}`:void 0}async function Xc(e,t,n){let r=t.chat?.thread.id;if(!e.local||t.repo||!r)return;let i=e.integrations[t.integration],a=ac(i,r),o=(await e.store.list(`delivery`,{prefix:`delivery:`})).find(({value:e})=>{let r=e.pending?.task;return r?.agent===n&&r.event?.appId===t.appId&&r.event.installationId===t.installationId&&ac(i,r.event.chat?.thread.id??``)===a&&e.pending?.taskId})?.value.pending;if(!o?.task)return;let s=await vp(e,o.task,o.taskId);return await pc(e,o.task.event,s.task.id,(e.now??Date.now)()),await e.store.get(`task`,s.task.id)??s}async function Zc(e,t,n,r,i,a,o){let s=i.chat?ac(t,i.chat.thread.id):``,c=`delivery:${t.id}:${n.id}:${i.installationId}:${s}:${i.deliveryId}`,l=await Wc(e,n,i);if(!l)return U(i,`installation ${i.installationId} is not bound or was removed`,`error`),{};if(e.local&&await(e.syncAgent?.(n.agent)??lr(e.store,e.local.cwd,e.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e)),!e.local){let u=I(),d={delivery:{key:c,owner:u,at:a(),ttlMs:Vc},agent:n.agent,...i.chat?{conversation:Rc(i.appId,i.installationId,s)}:{},...i.actor.id?{actor:{platform:t.id,id:i.actor.id}}:{},installation:l,files:Qa(l,i)},{claimed:f,loaded:p}=await e.store.dispatchState(d);if(!f)return U(i,`another request holds or finished its delivery`),{};let m=p?{...e,store:ec(e.store,p,d)}:e;if((await m.store.get(`agent`,n.agent))?.settings?.disabled)return await e.store.updateDelivery(c,u,void 0),U(i,`agent ${n.agent} is disabled`),{};try{let s=await $c(m,t,n,r,i,l,a,o,c,{owner:u,loaded:p&&{...p,store:m.store}});if(!s.work&&!s.taskId&&!s.steered){let t=i.chat?.message?void 0:{at:a()};await e.store.updateDelivery(c,u,t,{ttlMs:Hc})}return await s.work,s.taskId?{taskId:s.taskId}:{}}catch(t){let n=await e.store.get(`delivery`,c).catch(()=>void 0),r=n?.pending?.task?n.pending:void 0;throw await e.store.updateDelivery(c,u,r?{at:a(),pending:r}:void 0).catch(()=>{}),t}}if((await e.store.get(`agent`,n.agent))?.settings?.disabled)return U(i,`agent ${n.agent} is disabled`),{};if(await e.store.get(`delivery`,c).then(e=>e&&!e.pending))return U(i,`its delivery is already done`),{};let u=JSON.stringify([i.appId,i.installationId,s]),d=e.store.handoffs??=new Map,f=(d.get(u)??Promise.resolve()).catch(()=>{}).then(async()=>{let s=await $c(e,t,n,r,i,l,a,o,c);return await s.work,s});d.set(u,f);try{return await f}finally{d.get(u)===f&&d.delete(u)}}async function Qc(e,t,n,r,i,a,o,s){let c=s??I(),l=a&&ne(),u=l&&a?.taskUrl?Yc(e,await(o?.()??Lv(e)),`/tasks/${l}`):void 0,d={event:n,...a?{task:{...a,...u?{taskUrl:u}:{}},taskId:l}:{}};if(e.local&&!n.repo){let i=await e.store.get(`delivery`,t);if(i&&!i.pending)return U(n,`its delivery is already done`),{};if(d=i?.pending??d,d.task&&!d.taskId)throw Error(`Local delivery has no task binding`);await e.store.put(`delivery`,t,{at:r(),owner:c,pending:d})}else if(!s&&!await e.store.create(`delivery`,t,{at:r(),owner:c,pending:d},{ttlMs:Vc}))return U(n,`another request holds or finished its delivery`),{};return{work:(async()=>{let n=Promise.resolve(),a=e.local?void 0:setInterval(()=>{n=n.then(async()=>{await e.store.updateDelivery(t,c,{at:r(),owner:c,pending:d},{ttlMs:Vc})}).catch(()=>{})},Vc/3);try{await i(d),a&&clearInterval(a),await n,await e.store.updateDelivery(t,c,{at:r()},{ttlMs:Hc})}catch(r){throw a&&clearInterval(a),await n,(!e.local||!d.task)&&await e.store.updateDelivery(t,c,void 0).catch(()=>{}),r}})()}}async function $c(e,t,n,r,i,a,o,s,c,l){let u,d=()=>u??=Lv(e,l?.loaded?.workspace),f=t=>Qc(e,c,i,o,t,void 0,d,l?.owner),p=Lf(e,t,a,i,r),m=async()=>(await p(i.integration)).token(),h=i.chat?cl(i.text):void 0,g=h&&(await rc(e,i)).status;if(h&&g&&(h.id||(await Ol(e,g.task.id)).length===1))return f(()=>Al(e,t,g,h,i,m,e=>s.whisper(e)));let[_,v]=await Promise.all([e.loadAgent(n,a,i,p,l?.loaded),e.auth&&i.actor.id?l?.loaded?l.loaded.member:Gc(e,t,i):void 0]),y=Tt(i,_);if(!y){let t=i.chat?.message;return t&&await vc(e,i,{id:t.id,thread:i.chat.thread.id,author:t.author.userName||t.author.userId,text:i.text,sentAt:t.metadata.dateSent}),U(i,`agent ${_.id} is not wired for it`),{}}let b=await qc(e,t,i,m);if(b===null)return f(async()=>{await s.post(Kc)});if(b===!1)return U(i,`${i.actor.login??i.actor.id} cannot write where it happened`),{};let x=t=>Qc(e,c,i,o,async t=>{let n=t.task,r=await vp(e,n,t.taskId);await Promise.all([pc(e,n.event,r.task.id,o()),yc(e,n.event)]),await Mh(e,r.task.id,p.minted)},t,d);if(e.local&&!i.repo){let t=await e.store.get(`delivery`,c);if(t?.pending?.task){let e=t.pending.task;return e.agent===_.id?x(e):(U(i,`its interrupted handoff belongs to agent ${e.agent}`),await s.endTyping?.(),{})}}let S=!!i.chat,C=S?await rc(e,i):void 0,ee=C?.record,w=S?await Sc(e,t,i,{token:async()=>(await p(i.integration))?.token(),delivered:bc(t,n,_),unseen:C?.unseen,loaded:!0,...ee?{existing:ee}:{}}):i,te=v?{name:v.name,email:v.email}:void 0,T=S?C?.status??await Xc(e,w,_.id):void 0,ne=T?await ps(e,t,i,m):void 0,re=!!(T?.task.space&&ne&&T.task.space!==V({...i,space:ne})),ie=T&&!re&&X.includes(T.status)?T:void 0;if(xc(t,i)&&(!ie||(ie.task.context?.mustReply??ie.task.event?.mustReply)&&!ie.typingEnded)){let t=s.startTyping?.().catch(e=>console.error(`coder server: could not show ${i.deliveryId} is being worked on`,e));t&&e.waitUntil?.(t)}if(T&&!re)return f(async()=>{let n=T.task.event,r=v&&!T.task.requestedBy&&T.task.source===i.integration&&n?.integration===i.integration&&n.actor.id===i.actor.id&&await e.queue.setRequestedBy(e.organizationId,T.task.id,v.id,o()),a=ne?.private===!0&&T.task.event?.space?.private!==!0&&!!T.task.space&&await e.queue.spaceChanged(e.organizationId,{...i,space:ne},{private:!0},o()).then(()=>!0),s=(r||a)&&await e.store.get(`task`,T.task.id)||T;await Promise.all([Pc(e,s,w,te,o,C,v?.id),ms(e,t,s.task.event??i,m)])});let ae=v?.id,[oe,{models:se,first:ce},le,ue,de]=await Promise.all([Ra(e,{requestedBy:ae,agent:_.definition.runner}),Qp(e,yt(_),ae),zc(e,t,i,v??null),ph(e,void 0,_.usage?.connections),ne??ps(e,t,i,m)]),fe=tm(se,oe.runner===`http`),pe=ce.engine,E=`${i.deliveryId}-${_.id}`,me=async()=>v||!i.actor.id?void 0:Vm(e,t,{task:E,actor:i.actor.id,models:se,attempts:fe,slug:await d()});if(!fe.length)return w.mustReply??xc(t,i)?f(async()=>{let r=`setup:${n.id}:${i.chat?ac(t,i.chat.thread.id):i.deliveryId}`,a=i.deliveryId;if(!await e.store.create(`delivery`,r,{at:o(),owner:a},{ttlMs:6048e5})&&(await e.store.get(`delivery`,r))?.owner!==a)return s.endTyping?.();try{await s.post((await me())?.failure??await Jc(e,pe,await d()))}catch(t){throw await e.store.updateDelivery(r,a,void 0),t}}):(U(i,`no usable ${se.map(e=>e.model).join(` or `)} model${ae?``:` among the workspace credentials`}`,`error`),await s.endTyping?.(),{});if(Buffer.byteLength(JSON.stringify(i))>Uc)throw Error(`Event exceeds 256 KB`);if(Buffer.byteLength(JSON.stringify(le))>Uc)throw Error(`Task context exceeds 256 KB`);let he=Yc(e,await d(),`/tasks/${E}`),ge=Yc(e,await d(),`/agents/${encodeURIComponent(_.id)}/settings`),_e=await me(),ve={id:E,source:i.integration,agent:_.id,flow:`default`,...oe,event:de?{...w,space:de}:w,failureReply:_e?.failure??await xm(e,pe,await d()),..._e?.notice?{notice:_e.notice}:{},...he?{taskUrl:he}:{},...ge?{settingsUrl:ge}:{},author:t.author?.(n.name)??n.name,definition:_.definition,access:Et(_),models:fe,...ae?{requestedBy:ae}:{},..._.files?{files:_.files}:{},..._.usage?{usage:_.usage}:{},tools:y.tools,connections:ue,...Object.keys(le).length?{context:le}:{}};if(e.local&&!i.repo&&oe.runner===`local`&&!oe.runnerId)return x(ve);let ye=o(),[be]=await Promise.all([e.queue.deliver(e.organizationId,ve,ye,{key:c,ttlMs:Hc,...l?{owner:l.owner}:{}},S?bn([w],te):void 0,e.config.maxQueued??1e3,!0,{conversation:fc(e,w,E,ye),unseen:_c(e,w),secrets:jh(e,E,p.minted)}),ms(e,t,ve.event,m)]);return be}async function el(e,t,n,r,i,a){let o=e.integrations[t.integration],s=i?.repo&&`${i.repo.owner}/${i.repo.name}`,c=i&&(o?.link?.(i)??(s&&o?.repos?.url(s))),l=!1;try{let a=r&&await B(e,`${t.id}:${r}`)||e,o={at:(e.now??Date.now)(),organization:a.organizationId,integration:t.integration,app:t.id,agent:t.agent,error:(n instanceof Error?n.message:String(n)).split(`
+`)[0].slice(0,500),...i?{type:i.type,delivery:i.deliveryId}:{},...i?.chat?{thread:i.chat.thread.id}:{},...s?{repo:s}:{},...c?{url:c}:{}},u=`failed:${t.agent}:${i?.deliveryId??I()}`;l=await a.store.create(`delivery`,u,o,{ttlMs:Hc})}catch(e){console.error(`coder server: could not record a failed delivery for ${t.id}`,e)}if(!(!l||!a||!o||!i||!xc(o,i)))try{await(await a()).post(n instanceof dt?n.message:`Coder could not handle this message. If you run this server, check its logs. Otherwise [report the problem](${e.config.issuesUrl}).`)}catch(e){console.error(`coder server: could not tell ${t.id}'s thread about a failed delivery`,e)}}async function tl(e,t,n){let{task:r}=t,i=r.event;if(!i||r.source!==i.integration)return;let a=await e.store.get(`app`,i.appId).catch(e=>{console.error(`coder server: could not report the failure of task ${r.id}`,e)});if(!a)return;let{endTyping:o,eventReplies:s}=await Promise.resolve().then(()=>ad);await el(e,a,n,i.installationId,i,()=>s(e,a,i,t)),await o(e,t).catch(e=>console.error(`coder server: could not clear the working indicator of task ${r.id}`,e))}async function nl(e,t){let n=(await e.list(`delivery`,{prefix:`failed:${t}:`})).map(e=>e.value).sort((e,t)=>t.at-e.at);return{failed:n.length,recent:n.slice(0,50)}}const rl=2592e6,il=6e4,al=/^\s*\/(approve|deny|ask-admin)\s+(apr-[\w-]+)(?:\s+([\s\S]*?))?\s*$/i,ol=/^\s*(approve|deny)\s*$/i,sl={approve:`accept`,deny:`decline`,"ask-admin":`ask`};function cl(e){let t=al.exec(e),n=(t?.[1]??ol.exec(e)?.[1])?.toLowerCase();if(!n)return;let r=t?.[3]?.trim();return{...t?{id:t[2]}:{},decision:sl[n],...r&&n===`deny`?{reason:r}:{}}}function ll(e){let t="`".repeat(Math.max(3,...(e.match(/`+/g)??[]).map(e=>e.length+1)));return`${t}\n${e}\n${t}`}function ul(e){if(e.decision===`closed`)return`**Task stopped**.`;let t=`**${e.decision===`accept`?`Approved`:`Denied`}** ${e.by?`by ${e.by}`:`in Coder`}${e.reason?`: ${e.reason}`:``}`;return/[.!?]$/.test(t)?t:`${t}.`}function dl(e,t){let n=`${t+1}. `;return/[\n`]/.test(e)?n+ll(e).replaceAll(`
+`,`\n${` `.repeat(n.length)}`):`${n}\`${e}\``}function fl(e){return{summary:Kt(e),markdown:e.actions.map(dl).join(`
+`),items:e.actions}}function pl(e,t={}){let n=t.outcome?ul(t.outcome):[!t.separate&&e.taskUrl&&`[Approve in Coder](${e.taskUrl})`,t.commands&&`reply \`/approve ${e.id}\` or \`/deny ${e.id} <reason>\``].filter(Boolean).join(`, or `),r=fl(e);return[`**Approval needed**`,e.reason,!t.separate&&(t.collapsed?t.collapsed(r.summary,r.markdown):`**${r.summary}**\n\n${r.markdown}`),n&&`${n[0].toUpperCase()}${n.slice(1)}${t.outcome?``:`.`}`].filter(Boolean).join(`
+
+`)}function ml(e,t,n,r){let i=e.messages&&!n?[{label:`Approve`,value:`/approve ${t.id}`,style:`primary`,confirm:`Approve ${Kt(t)} for this task?`},{label:`Deny`,value:`/deny ${t.id}`,style:`danger`,ask:{label:`Why?`,placeholder:`The task reads it`}}]:void 0;return r?{markdown:[r.note,`Waiting for your answer on the approval above.`].filter(Boolean).join(`
+
+`),...i?{buttons:[...i,...r.buttons??[]]}:{}}:{markdown:pl(t,{outcome:n,commands:!i,separate:!!e.messages,collapsed:e.collapsed}),...e.messages?{card:{title:`Approval needed`,body:t.reason,...n?{status:ul(n),outcome:n.decision===`accept`?`success`:`failure`}:{}},collapsed:fl(t)}:{},...i?{buttons:i}:{},...i&&!e.messages?.asks?{hint:`Or reply \`/deny ${t.id} <why>\` to deny with a reason.`}:{},...i&&t.taskUrl?{link:{label:`Open in Coder`,url:t.taskUrl}}:{}}}const hl=`approval:`,gl=(e,t)=>`${hl}${e}:${t}`;function _l(e,t){let n=t.event,r=n?.chat&&t.source===n.integration?e.integrations[n.integration]:void 0;return r?{integration:r,event:n}:void 0}async function vl(e,t,n){let r=await e.store.get(`app`,n.appId);if(!r)throw Error(`The conversation's app ${n.appId} is gone`);let{adapterContext:i,eventThread:a}=await Promise.resolve().then(()=>ad),o={id:n.installationId,...n.repo?{repo:n.repo}:{},...n.account?{account:n.account}:{}};return{ctx:i(e,t,r,R(e.config,r.credentials),o),thread:await a(e,r,n)}}async function yl(e,t,n){return e.messages?e.messages.post(t,n):(await t.thread.post({markdown:n.markdown})).id}async function bl(e,t,n,r,i){if(e.messages?.edit)return n?e.messages.edit(t,n,r):void 0;if(e.messages)return void await e.messages.post(t,i);if(n)return t.thread.adapter.editMessage(t.thread.id,n,{markdown:r.markdown})}const xl=(e,t)=>({id:t.id,task:e.id,reason:t.reason,actions:t.actions,...e.taskUrl?{taskUrl:e.taskUrl}:{}}),Sl=e=>({decision:e.decision,...e.reason?{reason:e.reason}:{},...e.by?{by:e.by}:{}});async function Cl(e,t){let n=(e.now??Date.now)();return e.store.withAppLock(t,async e=>{let r=await e.get(`delivery`,t);if(!r)return;let i=(r.lease??0)>n;return await e.put(`delivery`,t,i?{...r,again:!0}:{...r,lease:n+il},{ttlMs:rl}),i?void 0:r})}async function wl(e,t,n){return e.store.withAppLock(t,async e=>{let r=await e.get(`delivery`,t);if(!r)return!1;let{lease:i,again:a,retryAt:o,...s}={...r,...n};return await e.put(`delivery`,t,n.retryAt?{...s,retryAt:o}:s,{ttlMs:rl}),a===!0})}async function Tl(e,t){let n=await e.store.get(`task`,t.id);return e.local&&n?.handle?.startsWith(`cli:`)?Bt(w(t.cwd??e.local.cwd,t.id)):n?.task.context?.approvals??[]}async function El(e,t,n){let r=_l(e,t);if(!r||!n.length)return;let i=new Map((await e.store.list(`delivery`,{prefix:gl(t.id,``)})).map(e=>[e.id,e.value])),a,o=async()=>a??=await vl(e,r.integration,r.event);for(let a of n){let n=gl(t.id,a.id),s=i.get(n);if(s?.shownAt&&(!a.response||s.shown===a.response.answeredAt))continue;let c=(e.now??Date.now)(),l={at:c,notice:xl(t,a),lease:c+il},u=!s&&await e.store.create(`delivery`,n,l,{ttlMs:rl});for(let i=0;i<3;i++){let s=i===0&&u?l:await Cl(e,n);if(!s)break;let c=xl(t,a),d=a.response?Sl(a.response):void 0,f;if(s.shownAt&&(!a.response||s.shown===a.response.answeredAt))f=await wl(e,n,{});else try{if(s.shownAt)await bl(r.integration,await o(),s.message,ml(r.integration,c,d),{markdown:ul(d)}),f=await wl(e,n,{shown:a.response.answeredAt});else{let t=await yl(r.integration,await o(),ml(r.integration,c,d));f=await wl(e,n,{shownAt:(e.now??Date.now)(),...t?{message:t}:{},...d?{shown:a.response.answeredAt}:{}})}}catch(r){console.error(`coder server: could not show approval ${a.id} of task ${t.id} in its conversation`,r),f=await wl(e,n,{retryAt:(e.now??Date.now)()+6e4})}if(!f)break;a=(await Tl(e,t)).find(e=>e.id===a.id)??a}}}async function Dl(e){let t=(e.now??Date.now)(),n=await e.store.approvalPostsDue(t,12e4),r=new Map;for(let t of n){let n=t.organizationId??e.organizationId,i=r.get(`${n}:${t.value.notice.task}`)??{organizationId:n,ids:new Set};i.ids.add(t.value.notice.id),r.set(`${n}:${t.value.notice.task}`,i)}for(let[t,{organizationId:n,ids:i}]of r){let r=t.slice(n.length+1),{scoped:a}=await Promise.resolve().then(()=>ea),o=a(e,n),s=await o.store.get(`task`,r);if(!s)continue;let c=(await Tl(o,s.task)).filter(e=>i.has(e.id));await El(o,s.task,c)}}async function Ol(e,t){return(await e.store.list(`delivery`,{prefix:gl(t,``)})).filter(e=>!e.value.shown).map(e=>e.value.notice.id)}async function kl(e,t,n,r,i){let a=cl(i);if(!a)return!1;let o=await B(e,`${t.id}:${n.id}`),s=o&&(await ic(o,e.integrations[t.integration],t.id,n.id,r)).status;return s?a.id?!!await o.store.get(`delivery`,gl(s.task.id,a.id)):(await Ol(o,s.task.id)).length===1:!1}async function Al(e,t,n,r,i,a,o){let s=r.id?[r.id]:await Ol(e,n.task.id);if(s.length!==1){await o("Name the approval: `/approve <id>` or `/deny <id> <reason>`.");return}let c=i.actor,l=await qc(e,t,i,a);if(l===null){await o(Kc);return}if(l===!1){await jl(e,n.task,s[0],c);return}let{changeOf:u,decideChange:d}=await Promise.resolve().then(()=>Tu),f=n.task.context?.approvals?.find(e=>e.id===s[0]),p=u(f);if(p){let a=e.auth?await Gc(e,t,i):void 0,c=a&&{...a,role:a.roles?.[e.organizationId]},l=await d(e,n,s[0],{...r},c),u=_l(e,n.task),f=async(n,r=[])=>u?yl(t,await vl(e,t,u.event),{markdown:n,...r.length?{buttons:r}:{}}):o(n);if(l.ok){r.decision===`ask`&&await f(`Asked the workspace admins to approve it.`);return}let m=(await l.json()).error??`You need write access here to approve or deny this.`;if(l.status!==403||!c||p.scope!==`workspace`)return void await f(m);if(!t.messages)return void await f(`${m} Reply \`/ask-admin ${s[0]}\` to ask one.`);await f(m,[{label:`Ask an admin`,value:`/ask-admin ${s[0]}`}]);return}if(r.decision===`ask`){await o(`Only a change the task asked for goes to an admin.`);return}let{decideApproval:m}=await Promise.resolve().then(()=>qd),h=await m(e,n.task.id,{approvalId:s[0],decision:r.decision,...r.reason?{reason:r.reason}:{}},c.login||c.id);h.ok||await o((await h.json()).error??`You need write access here to approve or deny this.`)}async function jl(e,t,n,r){let i=_l(e,t);if(!i)return;let a=gl(t.id,n),o=r.id||r.login||``;if(!await e.store.withAppLock(a,async e=>{let t=await e.get(`delivery`,a);if(!(!t||t.refused?.includes(o)))return await e.put(`delivery`,a,{...t,refused:[...t.refused??[],o]},{ttlMs:rl}),t}))return;let s=await vl(e,i.integration,i.event);await yl(i.integration,s,{markdown:`You need write access here to approve or deny this.`})}async function Ml(e,t,n,r,i){let a=cl(i.text?`${i.value} ${i.text}`:i.value);if(!a){console.warn(`coder server: ${n.id} sent a click Coder does not read: ${i.value}`);return}let o=await B(e,`${n.id}:${r.id}`),s=o&&(await ic(o,t,n.id,r.id,i.thread)).status,c=s?.task.event;if(!o||!s||c?.appId!==n.id||c.installationId!==r.id){console.warn(`coder server: ${n.id} answered an approval of an unknown task`);return}let l=await vl(o,t,c),u=()=>l.ctx.token(c.installationId,{tools:t.tools.presets[`read-only`]});await Al(o,t,s,a,{...c,actor:i.actor},u,e=>l.thread.post({markdown:e}))}function Nl(e,t,n){let r;return Promise.race([e,new Promise((e,i)=>{r=setTimeout(()=>i(Error(`${n} timed out`)),t),r.unref?.()})]).finally(()=>clearTimeout(r))}async function Pl(e,t,n,r){try{await Nl(t.stop(n),e.runnerTimeoutMs??1e4,`runner stop`)}catch(e){return console.error(`coder server: runner stop ${r} failed`,e),!1}return!0}async function Fl(e,t,n,r={}){let i=t.handle?await Ba(e,t.task):void 0,a=await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0,...r});if(a){let{reportTaskFailure:r}=await Promise.resolve().then(()=>Bc),a=await e.store.get(`task`,t.task.id);a&&await r(e,a,n),await Rl(e,t,!0,i),a&&Fc(e,a.task)}return a}async function Il(e,t,n){if(e.local&&t.handle?.startsWith(`cli:`)){let r=await e.store.get(`task`,t.task.id);return r?fp(e,r,n):!1}let r=t.handle?await Ba(e,t.task):void 0,i={handle:t.handle??null,lastSeenAt:t.lastSeenAt??null,updatedAt:t.updatedAt};if(t.cancelRequestedAt!==void 0&&n-t.cancelRequestedAt>=3e4){let i=await e.queue.finish(e.organizationId,t.task.id,{status:`cancelled`,error:`The runner did not acknowledge cancellation within 30 seconds`},n,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0});if(i){await Rl(e,t,!0,r);let n=await e.store.get(`task`,t.task.id);n&&Fc(e,n.task)}return i}if(!t.handle)return n-(t.lastSeenAt??t.startedAt??t.updatedAt)<(e.config.taskStallMs??3e5)?!1:t.attempts>=(e.config.taskAttempts??2)?Fl(e,t,`runner start was interrupted`,i):e.queue.requeue(e.organizationId,t.task.id,n,{generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,...i});if(t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)return Fl(e,t,`timeout`);if(!r||n-(t.lastSeenAt??t.startedAt??t.updatedAt)<Math.min(e.config.taskStallMs??6e4,6e4)||!await e.store.withAppLock(`runner-status:${e.organizationId}:${t.task.id}`,async e=>{let r=`runner-status:${t.task.id}:${t.generation??0}:${t.attempts}`,i=await e.get(`delivery`,r);return i&&`at`in i&&i.at!==void 0&&n-i.at<3e4?!1:(await e.put(`delivery`,r,{at:n},{ttlMs:6e4}),!0)}))return!1;let a=await Nl(r.status(t.handle),e.runnerTimeoutMs??1e4,`runner status`);return a.state===`exited`?Fl(e,t,`runner exited${a.code===void 0?``:` with code ${a.code}`}`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null}):Fl(e,t,`The runner stopped reporting heartbeats`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null})}async function Ll(e,t){return[`running`,`waiting`].includes(t.status)&&await Il(e,t,(e.now??Date.now)()).catch(()=>!1)?await e.store.get(`task`,t.task.id)??t:t}async function Rl(e,t,n=!1,r){let i=`${e.organizationId}:${t.task.id}:${t.attempts}`,a=e.settings?.cancelChecks?.get(i);if(a&&(clearTimeout(a.timer),a.finish(),e.settings.cancelChecks.delete(i)),!t.handle||t.logsComplete)return;let o=r??await Ba(e,t.task);o&&(n||o.kind===`vercel-sandbox`||o.kind===`local-docker`)&&!await Pl(e,o,t.handle,t.task.id)||await e.queue.patchTask(e.organizationId,t.task.id,{logsComplete:!0},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,handle:t.handle})}function zl(e,t){let n=`${e.organizationId}:${t.task.id}:${t.attempts}`,r=(e.settings??={}).cancelChecks??=new Map;if(r.has(n))return;let i=new Promise(e=>{let t=setTimeout(e,3e4);r.set(n,{timer:t,finish:e})}).then(async()=>{r.delete(n);let i=await e.store.get(`task`,t.task.id);i&&i.attempts===t.attempts&&i.tokenHash===t.tokenHash&&await Ll(e,i)}).catch(e=>console.error(`coder server: cancellation check failed`,e));e.waitUntil&&e.waitUntil(i)}async function Bl(e,t,n){let r=e.now??Date.now,i=e.config.limits?.concurrentTasks??Gs.concurrentTasks,a=e.config.store===`postgres`?e.config.maxTasks:Math.min(i,e.config.maxTasks??i);{t&&e.local?await Promise.all([op(e,e.local.cwd),sp(e)]):t&&await Promise.all([e.queue.archiveStopped(void 0,r()),Dl(e)]);let n=await e.queue.running(),i=0;for(let t of n)await Il(z(e,t.organizationId),t.status,r()).catch(()=>!1)&&i++;if(a!==void 0&&n.length-i>=a)return}let o=[];for(;;){let t=e.local?ap(e.local.cwd,!1).filter(e=>e.status===`running`||e.status===`waiting`):[],s=t.length?new Set((await e.queue.running()).flatMap(e=>[e.status.task.id,...e.status.handle?.startsWith(`cli:`)?[e.status.handle.slice(4)]:[]])):new Set,c=t.filter(t=>!s.has(t.task.id)&&!s.has(C(t.task.cwd??e.local.cwd,t.task.id)?.flowRunId??``)).length,l=a===void 0?void 0:a-c;if(l!==void 0&&l<=0)break;let u=await e.queue.claim(r(),l,n,i);if(n=!1,!u)break;let d=u.status,f=z(e,u.organizationId),p=u.loaded&&f.store?{...f,store:$s(f.store,d,u.loaded)}:f;if(await dp(p,d,u.token)){if(n=u.more,!u.more)break;continue}let m=await Ba(p,d.task);if(!m){await Fl(p,d,`No runner available: ${d.task.runner}`);continue}let h=d,g={generation:d.generation??0,attempts:d.attempts,tokenHash:d.tokenHash??null,statuses:[`running`,`waiting`]},_;try{let e=m.kind===`vercel-sandbox`?await Qf(p,d.task):void 0,t=m.start(d.task,{CODER_SERVER:p.local&&m.kind===`local`?`http://localhost:${p.local.port}`:p.config.publicUrl??``,CODER_TASK_TOKEN:u.token,CODER_INBOX_MODE:m.push?`push`:`poll`},e?.credential,{timeoutMs:p.config.taskTimeoutMs+6e4,waitUntil:p.waitUntil,...e?{hosts:e.hosts,brokered:e.brokered}:{}});_=await Nl(t,p.runnerTimeoutMs??3e4,`runner start`).catch(e=>{throw t.then(e=>Pl(p,m,e,d.task.id),()=>{}),e});let i=Wf(d.task);if(await p.queue.patchTask(u.organizationId,d.task.id,{handle:_,...i&&i!==d.task.usage?.resolvedModel?{resolvedModel:i}:{}},r(),g)||await Pl(p,m,_,d.task.id),n=u.more,!u.more)break}catch(e){_!==void 0&&await Pl(p,m,_,d.task.id);let t=e instanceof Error?e.message:String(e);if(d.attempts<(p.config.taskAttempts??2)){o.push({...u,status:h});continue}await Fl(p,h,t)}}for(let t of o)await z(e,t.organizationId).queue.requeue(t.organizationId,t.status.task.id,r(),{attempts:t.status.attempts,tokenHash:t.status.tokenHash})}function Vl(e,t=!1,n=!1,r=!1){let i=e.queue.scheduler??={},a=t?i.waiting:void 0;if(a)return a;let o=i.running??Promise.resolve(),s=()=>(i.waiting===c&&delete i.waiting,Bl(e,n,r)),c=o.then(s,s);return i.waiting=c,i.running=c.catch(()=>{}),c}function Hl(e,t=!1){let n=Vl(e,!0,!1,t).catch(()=>{});e.waitUntil&&e.waitUntil(n)}async function Ul(e,t,n,r){if(t.source!==`repo`||!t.repo)return;let i=(await(r??e.store.list(`app`))).find(({value:e})=>e.agent===t.id&&e.agentsRepo===t.repo)?.value;return((i&&e.integrations[i.integration])??Object.values(e.integrations).find(e=>e.repos))?.repos?.url(t.repo,t.path,i?.branch??n?.commit)}async function Wl(e,t,n){return ct()[t]&&await or(e,n),M(e.store,t)}async function Gl(e,t){let n=(e.now??Date.now)();(!t||ct()[t])&&await or(e,n);let r=e.local?await lr(e.store,e.local.cwd,e.integrations,t).catch(()=>void 0):void 0;return{now:n,local:r,loadCurrent:()=>r?Promise.resolve(r.find(({record:e})=>e.id===t)??{}):Wl(e,t,n)}}async function Kl(e,t,{after:n,q:r,source:i,platform:a,limit:o}){return t?(t??[]).filter(({version:e})=>!a||!!e?.definition?.integrations?.[a]).map(({record:e})=>e).filter(e=>(!n||$n(e)>n)&&(!i||e.source===i)&&(!r||[e.id,e.name,e.description,e.repo].some(e=>e?.toLowerCase().includes(r)))).sort((e,t)=>$n(e)<$n(t)?-1:1).slice(0,o):(await e.store.listAgentSummaries({after:n,q:r,source:i,platform:a,limit:o})).map(({record:e})=>e)}async function ql(e,t,n,r){let i=r.searchParams.get(`fields`);if(i&&![`id`,`id,name`].includes(i))return D({error:`Invalid fields`},400);let{local:a}=await Gl(t);if(!a&&k(r)&&!i)return D(await Ql(t,r));let o=O(r,200);if(i){let e=await Kl(t,a,{after:Nn(r),q:r.searchParams.get(`q`)?.trim().toLowerCase(),source:Zl[r.searchParams.get(`type`)??``],platform:r.searchParams.get(`platform`)??void 0,limit:o+ +!!k(r)}),n=e=>i===`id`?{id:e.id}:{id:e.id,name:e.name},s=Fn(e,o,$n);return D(k(r)?{...s,items:s.items.map(n)}:e.map(n))}let s=a??await t.store.listAgentSummaries({limit:o});if(k(r))return D(await Ql(t,r,s));let c,l=ot();return D(await Promise.all(s.slice(0,o).map(async({record:e,version:n})=>{e.source===`repo`&&e.repo&&(c??=t.store.list(`app`));let r=await Ul(t,e,n,c);return{...e,problems:hr(e,n,t.integrations),...e.id===l?{default:!0}:{},definition:n?.definition,...r?{sourceUrl:r}:{}}})))}async function Jl(e,t,n,r){let i=n.slug,{local:a,loadCurrent:o}=await Gl(t,i),s=O(r,10,50),c=Nn(r),[l,u]=await Promise.all([a?o().then(e=>e.record):pr(t.store,i),a?Promise.resolve(a.flatMap(({version:e})=>e?[{value:e}]:[])):t.store.listVersions(i,s+1,c)]);return l?D(await $l(t,l,s,c??l.currentVersion+1,u)):D({error:`No agent named "${i}"`},404)}async function Yl(e,t,n,r){let i=n.slug,a=n.version?Number(n.version):void 0;if(n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return A();let{local:o}=await Gl(t,i),s=o?o.find(({version:e})=>e?.version===a)?.version:await ur(t.store,i,a);return s?D(s):D({error:`No version ${a} for agent "${i}"`},404)}async function Xl(e,t,n,r){let i=n.slug,{local:a,loadCurrent:o}=await Gl(t,i),s=r.searchParams.get(`versions`)!==`0`,c=r.searchParams.get(`content`)!==`0`,l=r.searchParams.get(`handles`)===`1`,u=r.searchParams.get(`installations`)===`1`,d=t.session?.user.id,[{record:f,version:p},m,h,g,_]=await Promise.all([!c&&!a?t.store.listAgentSummaries({slug:i}).then(e=>e[0]??{}):o(),s?a?a.flatMap(({version:e})=>e?[{value:e}]:[]):t.store.listVersions(i):[],l||u?Io(t,i):[],l?nl(t.store,i):void 0,u?t.store.list(`installation`,{agent:i,active:!0}):[]]);if(!f)return D({error:`No agent named "${i}"`},404);let{models:v,unrunnable:y}=l?await em(t,yt({definition:p?.definition,usage:f.settings}),d):{},b=p?.definition.integrations??{},x=e=>{let t=b[e]?.events;return Array.isArray(t)?t.includes(`mention`):!!(t&&`mention`in t)},S=[],C=Object.keys(t.integrations),ee=(e,t)=>C.indexOf(e.value.integration)-C.indexOf(t.value.integration);for(let{value:e}of l?[...h].sort(ee):[])x(e.integration)&&!S.some(t=>t.integration===e.integration&&t.name.toLowerCase()===e.name.toLowerCase())&&S.push({name:e.name,integration:e.integration,platform:t.integrations[e.integration]?.name??e.integration});let w=_.flatMap(({value:e})=>{let t=h.find(({id:t})=>t===e.app);return t&&!e.uninstalled?[{integration:e.integration,account:e.account.login,app:t.value.name}]:[]}),te=m.map(({value:e})=>{let{systemPrompt:t,files:n,...r}=e;return r}),T=await Ul(t,f,p);return D({...f,problems:hr(f,p,t.integrations),...p?{stale:bt(p.definition),definition:p.definition,...c&&`systemPrompt`in p?{systemPrompt:p.systemPrompt,...p.files?{files:p.files}:{}}:{}}:{},...T?{sourceUrl:T}:{},...s?{versions:te}:{},...S.length?{handles:S}:{},...u?{installations:w}:{},...g?.failed?{deliveries:{failed:g.failed,recent:g.recent.map(e=>({at:e.at,platform:t.integrations[e.integration]?.name??e.integration,...e.type?{type:e.type}:{},error:e.error,...e.url?{url:e.url}:{}}))}}:{},...v?{model:Se(v[0].option),runsOn:am(v,d),...tm(v).length?{}:{needsModel:!0}}:{},...y?.length?{unrunnable:y}:{}})}const Zl={builtin:`builtin`,dashboard:`upload`,repository:`repo`};async function Ql(e,t,n){let r=O(t,24,100),i=Nn(t),a=t.searchParams.get(`q`)?.trim().toLowerCase(),o=Zl[t.searchParams.get(`type`)??``],s=t.searchParams.get(`platform`),c=t.searchParams.get(`apps`)===`1`,l=e.store.list(`app`),[u,d,f,p]=await Promise.all([l,e.store.list(`installation`),c?Io(e,void 0,l):[],n?n.filter(({record:e})=>(!i||$n(e)>i)&&(!o||e.source===o)&&(!a||[e.id,e.name,e.description,e.repo].some(e=>e?.toLowerCase().includes(a)))).sort((e,t)=>$n(e.record)<$n(t.record)?-1:1):e.store.listAgentSummaries({after:i,source:o,q:a,platform:s??void 0,limit:r+1})]),m=new Set(d.filter(({value:e})=>!e.deletedAt&&!e.uninstalled).map(({value:e})=>e.app)),h=(e,t)=>{let n=u.filter(({value:n})=>n.agent===e&&n.integration===t);return n.length?n.some(({value:e})=>m.has(e.id))?`installed`:`created`:`none`},g=[];for(let{record:e,version:t}of p){let n=Object.keys(t?.definition?.integrations??{}).sort();if(!(s&&!n.includes(s))&&(g.push({record:e,version:t,ids:n}),g.length>r))break}let _=Fn(g,r,e=>$n(e.record)),v=ot(),y=new Set(_.items.map(({record:e})=>e.id)),b=f.filter(({value:e})=>y.has(e.agent)),x=new Set(b.map(({value:e})=>e.id));return{..._,...c?{apps:b.map(({value:t})=>Lo(e,t)),installations:d.filter(({value:e})=>x.has(e.app)&&(!e.deletedAt||e.uninstalled)).map(({value:t})=>qo(e,t))}:{},items:await Promise.all(_.items.map(async({record:t,version:n,ids:r})=>{let i=await Ul(e,t,n,l);return{...t,problems:hr(t,n,e.integrations),...t.id===v?{default:!0}:{},definition:n?.definition,...i?{sourceUrl:i}:{},platforms:r.map(e=>({id:e,state:h(t.id,e)}))}}))}}async function $l(e,t,n,r,i){let a=(i??await e.store.listVersions(t.id,n+1,r)).map(({value:e})=>{let{systemPrompt:t,files:n,definition:r,...i}=e;return i}).filter(e=>e.version<r).reverse();return Fn(a,n,e=>e.version)}function eu(e){if(!e||Array.isArray(e)||typeof e!=`object`)return!1;let t=Object.entries(e);if(t.length>100)return!1;let n=0;for(let[e,r]of t){if(typeof r!=`string`||e.startsWith(`/`)||e.includes(`\\`)||e.includes(`\0`)||e.split(`/`).includes(`..`)||e===`agent.json`||e===`system.md`)return!1;n+=Buffer.byteLength(e)+Buffer.byteLength(r)}return n<=262144}async function tu(e,t){return(await mo(e,[t])).flatMap(({app:e,error:t,check:n})=>{let r={id:e.id,integration:e.integration,name:e.name};return t?[{...r,error:t}]:n?n.changed?[{...r,drift:!0}]:[]:[{...r,updated:!0}]})}async function nu(e,t,n){let r=n&&typeof n==`object`?xt(n):n,i=Dt({[t]:r})[t];if(!i||typeof i!=`object`)throw Error(`settings must be an object`);if(i.model){let t=Ee(i.model);i.engine=At({engine:i.engine,model:i.model,effort:i.effort},q(e,await K(e))).engine,i.model=t.model,i.effort=t.effort??i.effort}let a=await om(e,i,!!e.taskPrincipal,e.session?.user.id);if(a)throw Error(a);return i}async function ru(e,t,n){let{loadCurrent:r}=await Gl(e,t),{disabled:i,...a}=await nu(e,t,n),o=i?{...a,disabled:i}:a,{record:s,version:c}=await r();if(!s||!c)throw Error(`No agent named "${t}".`);if(ir({...s,settings:void 0},c,a,e.integrations),!e.local)return _r(e.store,t,o,(e.now??Date.now)());let l=ft(e.local.cwd,t,!!i);if(l)throw new m(`server`,`Agent "${t}" is ${i?`enabled`:`disabled`} by agents.${t} in ${l}. Change it there.`,{status:409});return await wf(e,e=>{e.agents={...e.agents,[t]:xt(o)}}),await lr(e.store,e.local.cwd,e.integrations),await pr(e.store,t)}async function iu(e,t,n,r){let i=await e.json().catch(()=>void 0);return ru(t,n.slug,i).then(async e=>D({...e,...await au(t,e)}),e=>D({error:e.message},e instanceof m?e.status??400:400))}async function au(e,t){let n=t.settings??{},r=e.session?.user.id;if(!r||!n.engine&&!n.model)return{};let{models:i}=await Qp(e,n,r);return sm(i)?{warning:`Only your personal credential runs ${Se(i[0].option)}. Others fall back to the chain until a workspace credential runs it.`}:{}}async function ou(e,t,n,r){let i=n.slug,{loadCurrent:a}=await Gl(t,i),{record:o}=await a();return o?o.source===`builtin`?D({error:`Built-in agents cannot be deleted.`},400):t.local&&!await dr(t.local.cwd,t.integrations,i)?D({error:`Delete .coder/agents/${i} in the repo`},409):(await t.store.delete(`agent`,i),D({ok:!0})):D({error:`No agent named "${i}"`},404)}async function su(e,t,n,r){if(await Gl(e,t),!n||typeof n.systemPrompt!=`string`||n.files!==void 0&&!eu(n.files)||n.name!==void 0&&typeof n.name!=`string`||n.description!==void 0&&typeof n.description!=`string`)throw Error(`definition and systemPrompt are required; files must contain strings`);ut([t]);let[i]=lt({definitions:{[t]:{json:n.definition,builtin:!1}},usage:void 0},e.integrations);if(!i)throw Error(`No agent named "${t}".`);let a=e.local?await pr(e.store,t):void 0,o=e.local&&a?await ur(e.store,t):void 0,s=n.files;e.local&&(await rr(e.local.cwd,e.integrations,t,{definition:{...n.definition,...n.name===void 0?{}:{name:n.name},...n.description===void 0?{}:{description:n.description}},systemPrompt:n.systemPrompt,...s?{files:s}:{}}),await lr(e.store,e.local.cwd,e.integrations));let c=e.local?void 0:await cr(e.store,{id:t,name:n.name??i.name,description:n.description??i.definition.description,source:`upload`,definition:i.definition,systemPrompt:n.systemPrompt,files:s,importedFrom:`upload`},(e.now??Date.now)(),r);if(!e.local&&!c)return;let l=c?.version??await ur(e.store,t),u=c?.unchanged??Lr(o&&{...o,createdAt:0},{...l,createdAt:0}),d=await tu(e,l);return{...c?.record??await pr(e.store,t),definition:l.definition,version:l.version,unchanged:u,apps:d}}async function cu(e,t,n,r){let i=await e.json().catch(()=>void 0);return su(t,n.slug,i).then(D,e=>D({error:e.message},400))}const lu=/^[a-z0-9][a-z0-9-]*$/,uu=new Set([`openrouter.ai`,`ai-gateway.vercel.sh`,`api.groq.com`,`api.together.xyz`]);function du(e){return{builtin:Ie,models:e.models??{}}}var fu=class{options;entries=new Map;pending=new Map;constructor(e){this.options=e}async get(e,t){let n=this.options.now??Date.now,r=n(),i=this.entries.get(e);if(i&&r-i.at<this.options.ttlMs)return i.value;let a=this.pending.get(e);return a||(a=Promise.resolve().then(t).then(t=>{if(t===void 0)return i?.value;if(this.options.accept&&!this.options.accept(t))return i?.value??t;this.entries.set(e,{value:t,at:n()});let r=this.entries.keys().next().value;return this.entries.size>this.options.max&&r!==void 0&&this.entries.delete(r),t}).catch(t=>(console.error(`coder server: model probe failed for ${e}`,t),i?.value)).finally(()=>this.pending.delete(e)),this.pending.set(e,a)),a}};async function pu(e,t){let{baseUrl:n,envKey:r,key:i}=await Ef(e);if(!n||!/^https?:\/\//.test(n)||!URL.canParse(n))return D({error:`An http or https base URL is required`},400);let a=!i&&r&&await mu(t,n,r)?await lm(t,r):void 0,o=i||a,s=t.settings??={},c=s.probes??=new fu({ttlMs:6e5,max:100,now:t.now,accept:e=>e.reachable}),l=`${new URL(n).host}|${r??``}|${ht(String(o??``))}`;return D(await c.get(l,()=>On({baseUrl:n},{key:o,fetch:t.fetch})))}async function mu(e,t,n){let r=new URL(t).host;if(uu.has(r))return!0;let i=(await K(e)).models??{};return Object.values(i).some(e=>xe(e)&&e.envKey===n&&new URL(e.baseUrl).host===r)}async function hu(e,t,n,r){let i=await K(t);return D({...du(i),runsOn:await im(t,i)})}async function gu(e,t,n,r){let{name:i=``,...a}=await Ef(e);return!lu.test(i)||De(i)?D({error:`Invalid model name "${i}"`},400):Df(t,e=>{if(e.models?.[i])throw new G(`"${i}" already exists`);e.models={...e.models,[i]:a}})}async function _u(e,t,n,r){let i=n.name;return Df(t,e=>{if(!e.models?.[i])throw new G(`No model "${i}"`);Ne(e,i)})}async function vu(e,t,n,r){let i=await Ef(e);return Df(t,e=>yu(e,n.name,i))}function yu(e,t,n){let r=e.models?.[t];if(!r||!xe(r))throw new G(`No custom model "${t}"`);e.models={...e.models,[t]:{...r,...n}}}async function bu(e,t,n,r){let{spec:i}=await Ef(e);return Df(t,e=>xu(e,n.name,i))}function xu(e,t,n){if(!lu.test(t))throw new G(`Invalid alias name "${t}"`);let r=e.models?.[t];if(r&&xe(r))throw new G(`"${t}" is a custom model name`);let i=Pe(n,Ae(e)),a=t===`codex`||t===`claude`||t===`custom`?t:void 0;if(a&&i?.engine!==a)throw new G(`The ${a} alias names a ${a} model`);if(!i?.model||i.engine===`custom`&&a!==`custom`)throw new G(`"${n}" does not name a codex or claude model`);let o=Ee(n);e.models={...e.models,[t]:[i.engine,o.model??i.model,o.effort].filter(Boolean).join(`/`)}}async function Su(e,t,n,r){return Df(t,e=>wu(e,n.name,!0))}async function Cu(e,t,n,r){return Df(t,e=>wu(e,n.name,!1))}function wu(e,t,n){try{be(e.models??={},t,n)}catch(e){throw new G(e.message)}}var Tu=t({actAsRefusal:()=>Wu,adminApprovals:()=>$u,changeOf:()=>Au,decideChange:()=>Zu,decideRequest:()=>Qu,listPendingApprovals:()=>ed,requestChange:()=>Hu,sessionApprover:()=>Eu});async function Eu(e){if(!e.session)return;let{user:t,role:n}=e.session,r=t.name?[]:await e.auth?.linkedAccounts?.(t.id).catch(()=>[]);return{...t,name:t.name||r?.find(e=>e.name)?.name||``,role:n}}const Du=(e,t)=>`admin-ask:${e}:${t}`,Ou={"agent-settings":[`agent`],"agent-version":[`agent`],"model-update":[`workspace`],"model-alias":[`workspace`],"model-enable":[`workspace`],"model-disable":[`workspace`],"runner-default":[`workspace`,`personal`],"act-as":[`personal`]},ku=[`baseUrl`,`model`,`envKey`,`wireApi`,`contextWindow`],Au=e=>e?.change;function ju(e={},t={}){let[n,r]=[e,t];return[...new Set([...Object.keys(n),...Object.keys(r)])].filter(e=>JSON.stringify(n[e])!==JSON.stringify(r[e]))}function Mu(e={},t={}){let[n,r]=[e,t];return ju(n,r).flatMap(e=>{let[t,i]=[JSON.stringify(n[e]),JSON.stringify(r[e])];return t===void 0?[`+ ${e}: ${i}`]:i===void 0?[`- ${e}: ${t}`]:[`${e}: ${t} → ${i}`]})}function Nu(e,t,n){if(t===n)return[];let r=e=>e?e.split(`
+`):[],[i,a]=[r(t),r(n)],o=0;for(;o<i.length&&o<a.length&&i[o]===a[o];)o++;let s=0;for(;s<i.length-o&&s<a.length-o&&i[i.length-1-s]===a[a.length-1-s];)s++;let c=i.slice(o,i.length-s),l=a.slice(o,a.length-s);if(c.length*l.length>1e6)return[[e,...c.map(e=>`- ${e}`),...l.map(e=>`+ ${e}`)].join(`
+`)];let u=c.map(()=>Array(l.length+1).fill(0));u.push(Array(l.length+1).fill(0));for(let e=c.length-1;e>=0;e--)for(let t=l.length-1;t>=0;t--)u[e][t]=c[e]===l[t]?u[e+1][t+1]+1:Math.max(u[e+1][t],u[e][t+1]);let d=[e],[f,p]=[0,0];for(;f<c.length||p<l.length;)f<c.length&&p<l.length&&c[f]===l[p]?[f,p]=[f+1,p+1]:f<c.length&&(p===l.length||u[f+1][p]>=u[f][p+1])?d.push(`- ${c[f++]}`):d.push(`+ ${l[p++]}`);return[d.join(`
+`)]}function Pu(e={},t={}){return[...new Set([...Object.keys(e),...Object.keys(t)])].sort().flatMap(n=>e[n]===void 0&&!t[n]?[`file ${n}\n+ (empty file)`]:t[n]===void 0&&!e[n]?[`file ${n}\n- (empty file)`]:Nu(`file ${n}`,e[n]??``,t[n]??``))}async function Fu(e,t){let n=(await e.store.get(`agent`,t))?.settings;return n&&await nu(e,t,n).catch(()=>n)}const Iu=e=>`Agent ${e} has a newer version since this request, so it was not applied. Ask again.`;async function Lu(e,t){if(t.kind===`agent-version`)return(await ur(e.store,t.agent))?.version===t.version?t:Iu(t.agent);if(t.kind!==`agent-settings`)return t;let n={...await Fu(e,t.agent)},r={...t.before},i={...t.settings},a=ju(r,i),o=a.filter(e=>JSON.stringify(n[e])!==JSON.stringify(r[e]));if(o.length)return`Agent ${t.agent}'s ${o.join(`, `)} changed since this request, so it was not applied. Ask again.`;for(let e of a)i[e]===void 0?delete n[e]:n[e]=i[e];return{...t,settings:n}}function Ru(e,t,n){if(e===`agent-settings`)return{kind:e,agent:t.slug,settings:n};if(e===`agent-version`)return{kind:e,agent:t.slug,upload:n};if(e===`model-update`){let r=Object.fromEntries(ku.filter(e=>n[e]!==void 0).map(e=>[e,n[e]]));return{kind:e,name:t.name,fields:r}}return e===`model-alias`?typeof n.spec==`string`?{kind:e,name:t.name,spec:n.spec}:`An alias needs a spec.`:e===`model-enable`||e===`model-disable`?{kind:e,name:t.name}:n.default===!0&&Object.keys(n).length===1?{kind:e,runner:t.id}:`A task changes only a runner's default.`}function zu(e){return t=>e.kind===`model-update`?yu(t,e.name,e.fields):e.kind===`model-alias`?xu(t,e.name,e.spec):wu(t,e.name,e.kind===`model-disable`)}async function Bu(e,t,n){if(t.kind===`act-as`)return`A task asks to act as a person only by using their connection.`;if(t.kind===`agent-settings`||t.kind===`agent-version`){if(t.agent!==n.agent)return`A task changes only its own agent.`;if(t.kind===`agent-settings`)return{reason:`Change agent ${t.agent}'s settings.`,actions:Mu(t.before,t.settings),scopes:Ou[t.kind]};let[r,i]=await Promise.all([e.store.get(`agent`,t.agent),ur(e.store,t.agent)]),{definition:a,systemPrompt:o,files:s,name:c,description:l}=t.upload,u=[...Mu({name:r?.name,description:r?.description},{name:c,description:l}),...Mu(i?.definition,a),...Nu(`instructions`,i?.systemPrompt??``,String(o??``)),...Pu(i?.files,s)];return u.length?{reason:`Publish a new version of agent ${t.agent}.`,actions:u,scopes:Ou[t.kind]}:`This publishes nothing new.`}if(t.kind!==`runner-default`){let n=await K(e),r=structuredClone(n);try{zu(t)(r)}catch(e){return e.message}let i={"model-update":`Update`,"model-alias":`Alias`,"model-enable":`Enable`,"model-disable":`Disable`}[t.kind],a=e=>e&&typeof e==`object`?e:e===void 0?{}:{model:e},o=Mu(a(n.models?.[t.name]),a(r.models?.[t.name]));return{reason:`${i} model ${t.name} for the workspace.`,actions:o.length?o:[`${i.toLowerCase()} ${t.name}`],scopes:Ou[t.kind]}}let r=t.runner===La(e)?{name:`Default runner`,default:!1,scope:`workspace`,owner:void 0}:await e.store.get(`runner`,t.runner);return!r||r.scope===`personal`&&r.owner!==n.asker?`Unknown runner`:{reason:`Make runner ${r.name} the default.`,actions:Mu({default:r.default??!1},{default:!0}),scopes:[r.scope===`personal`?`personal`:`workspace`]}}async function Vu(e,t){let n=Z(e),r=es(n);return(await t.queue.authorize(r.task,Qo(n),r.attempt,t.organizationId,(t.now??Date.now)()))?.status}async function Hu(e,t,n,r){let i=t.taskPrincipal,a=Ru(n,r,await e.json().catch(()=>void 0)??{});if(typeof a==`string`)return D({error:a},400);if(a.kind===`agent-settings`){try{a.settings=await nu(t,a.agent,a.settings)}catch(e){return D({error:e.message},400)}a.before=await Fu(t,a.agent)}if(a.kind===`agent-version`){let[e,n]=await Promise.all([t.store.get(`agent`,a.agent),ur(t.store,a.agent)]);a.version=n?.version;let{name:r,description:i}=a.upload.definition??{};a.upload={...a.upload,name:a.upload.name??r??e?.name,description:a.upload.description??i??e?.description}}let o=await Bu(t,a,i);if(typeof o==`string`)return D({error:o},403);let s=await Vu(e,t);if(!s)return D({error:`The task has ended.`},401);let{reason:c,actions:l}=o,u=o.scopes.filter(e=>e!==`personal`||i.asker);if(!u.length)return D({error:`Only the member who owns this can ask for it.`},403);let d=i.dm&&i.asker?`personal`:`workspace`,f=(t.now??Date.now)(),p={id:Uu(f),reason:c,actions:l,createdAt:new Date(f).toISOString(),change:{operation:a,scope:u.includes(d)?d:u[0],scopes:u,...i.asker?{asker:i.asker}:{}}};return await t.queue.patchTask(t.organizationId,s.task.id,{approvals:[p]},f),(t.waitUntil??(()=>{}))(El(t,s.task,[p]).catch(e=>console.error(`coder server: could not post request ${p.id}`,e))),D({pending:!0,approval:p.id,reason:c,changes:l,scope:Au(p).scope,...s.task.taskUrl?{url:s.task.taskUrl}:{}},202)}const Uu=e=>`apr-${e.toString(36)}-${Math.random().toString(36).slice(2,6)}`;async function Wu(e,t,n,r,i=!0){let a=n.owner,o=t.task,s=(o.context?.approvals??[]).filter(e=>{let t=Au(e)?.operation;return t?.kind===`act-as`&&t.connection.id===n.id}),c=s.find(e=>e.response?.decision!==`closed`),l=(await Qh(e,o.id,-1,t.generation??0)).some(e=>e.kind===`steer`&&typeof e.value==`object`&&e.value!==null&&`asker`in e.value&&e.value.asker!==a);if(c?.response?.decision===`accept`&&!l)return;let u=(r??await e.auth?.linkedAccounts?.(a).catch(()=>[]))?.find(e=>e.name)?.name||(a===o.requestedBy?o.context?.user?.name:void 0)||`its owner`,d=`Waiting for ${u} to approve acting as them on ${n.name}`;if(l)return`${d}.`;if(c?.response)return`${u} declined acting as them on ${n.name} for this task.`;let f=(e.now??Date.now)();if(i&&!c&&await e.store.create(`delivery`,`act-as:${o.id}:${n.id}:${s.length}`,{at:f},{ttlMs:e.config.taskTimeoutMs??36e5})){let t={id:Uu(f),reason:`Act as you on ${n.name} for this task?`,actions:[`Act as ${u} on ${n.name} until this task ends.`],createdAt:new Date(f).toISOString(),change:{operation:{kind:`act-as`,connection:{id:n.id,name:n.name},user:{name:u}},scope:`personal`,scopes:[`personal`],asker:a}};await e.queue.patchTask(e.organizationId,o.id,{approvals:[t]},f),(e.waitUntil??(()=>{}))(El(e,o,[t]).catch(e=>console.error(`coder server: could not post request ${t.id}`,e)))}return`${d}; this task continues once they answer.`}function Gu(e,t,n,r){if(!t.scopes.includes(n)||!Ou[t.operation.kind].includes(n))return`This change cannot apply to ${n}.`;if(!(!e.auth||r&&(n===`agent`||(n===`personal`?r.id===t.asker:f_(r.role)))))return t.operation.kind===`act-as`?`Only ${t.operation.user.name} answers this.`:`Only ${qt[n]} approves this.`}async function Ku(e,t,n,r){if(t.kind===`act-as`)return;if(t.kind===`agent-settings`)return ru(e,t.agent,t.settings);if(t.kind===`agent-version`)return su(e,t.agent,t.upload,{currentVersion:t.version??0});if(t.kind!==`runner-default`)return wf(e,zu(t));let i=(e.now??Date.now)();return e.store.withAppLock(`runners:${e.organizationId}`,async a=>{let o=t.runner===La(e),s=o?void 0:await a.get(`runner`,t.runner),c=n===`personal`?r?.id:void 0;if(!o&&(s?.scope!==n||s.owner!==c))throw new m(`server`,`Unknown runner`,{status:404});await yg(a,t.runner,s,i),s&&await a.put(`runner`,t.runner,{...s,default:!0,updatedAt:i})})}async function qu(e,t,n,r){let i=async e=>{let i=await Lu(e,t);if(typeof i==`string`)return i;let a=await Ku(e,i,n,r);if(i.kind===`agent-version`&&!a)return Iu(i.agent)};return t.kind===`agent-settings`?e.store.withAppLock(`agent-settings:${e.organizationId}:${t.agent}`,t=>i({...e,store:t})):i(e)}const Ju=e=>D({error:`Request "${e}" is already answered`},409),Yu=(e,t,n)=>e.queue.patchTask(e.organizationId,t.task.id,{approvals:[n]},(e.now??Date.now)(),{unanswered:n.id});async function Xu(e,t,n,r){await e.store.delete(`delivery`,Du(t.task.id,n.id)),(e.waitUntil??(()=>{}))(El(e,t.task,[n]).catch(e=>console.error(`coder server: could not show the decision on ${n.id}`,e)));let i=await e.store.get(`task`,t.task.id),a=Au(n).operation,o=a.kind===`act-as`?n.response.decision===`accept`?`${a.user.name} approved acting as them on ${a.connection.name} for this task. Use it now.`:`${a.user.name} declined acting as them on ${a.connection.name} for this task.`:Ht(n);if(i&&!X.includes(i.status)){let a=i.task.context?.mustReply===!0;if(await jc(e,i,o,a,{},r?.id))return Hl(e,!0),n;i=await e.store.get(`task`,t.task.id)}return i&&X.includes(i.status)&&await Zh(e,i,`steer`,{text:o}),n}async function Zu(e,t,n,r,i){if(e.taskPrincipal)return D({error:`A person answers this, not a task.`},403);let a=(t.task.context?.approvals??[]).find(e=>e.id===n),o=Au(a);if(!a||!o)return D({error:`Task "${t.task.id}" has no request "${n}"`},409);if(a.response)return Ju(n);let s=typeof r.scope==`string`?r.scope:o.scope,c=r.decision,l=i?.name||void 0;if(o.operation.kind===`act-as`){let t=Gu(e,o,s,i);if(t||c===`ask`)return D({error:t??`Only the person it acts as answers this.`},403)}if(c===`ask`){if(!i)return D({error:`Asking an admin needs a member linked to Coder.`},403);let r={...o,scope:s,askedAdmin:l??i.id};return await Yu(e,t,{...a,change:r})?(await e.store.put(`delivery`,Du(t.task.id,a.id),{task:t.task.id,approval:a.id,reason:a.reason,by:r.askedAdmin,at:(e.now??Date.now)()},{ttlMs:2592e6}),D({asked:!0})):Ju(n)}let u=new Date((e.now??Date.now)()).toISOString();if(c===`deny`||c===`decline`){let s=typeof r.reason==`string`&&r.reason?r.reason:void 0,c={...a,change:o,response:{decision:`decline`,answeredAt:u,...s?{reason:s}:{},...l?{by:l}:{}}};return await Yu(e,t,c)?D(await Xu(e,t,c,i)):Ju(n)}if(c!==`accept`)return D({error:`Give a decision: accept, decline or ask.`},400);let d=Gu(e,o,s,i);if(d)return D({error:d},403);let f={...a,change:{...o,scope:s},response:{decision:`accept`,answeredAt:u,...l?{by:l}:{}}};if(!await Yu(e,t,f))return Ju(n);let p;try{p=await qu(e,o.operation,s,i)}catch(n){await e.queue.patchTask(e.organizationId,t.task.id,{approvals:[{...a,change:o,response:null}]},(e.now??Date.now)());let r=n instanceof m?n.status??400:400;return D({error:n.message},r)}if(p){let n={...a,change:o,response:{decision:`decline`,answeredAt:u,reason:p}};return await e.queue.patchTask(e.organizationId,t.task.id,{approvals:[n]},(e.now??Date.now)()),await Xu(e,t,n,i),D({error:p},409)}return D(await Xu(e,t,f,i))}async function Qu(e,t,n){let r=t.routeTask??await t.store.get(`task`,n.id);if(!r)return D({error:`No task "${n.id}"`},404);let i=await e.json().catch(()=>void 0)??{};return Zu(t,r,n.approval,i,await Eu(t))}async function $u(e){return(await e.store.list(`delivery`,{prefix:`admin-ask:`})).map(e=>e.value).sort((e,t)=>t.at-e.at)}async function ed(e){return D(await $u(e))}function td(e,t,n){return(typeof e.use==`function`?e.use(n,!0):e.use)?.replaceAll(`{handle}`,t)}const nd=(e,t)=>t?.listens.find(t=>t.integration===e.id)?.events??[];function rd(e,t,n,r,i){let a=r?.slug??n,o=nd(e,r),s=td(e,n,o),c=o.map(t=>e.events[t]?.description??t),l=i?.linked?.login,u=i&&{title:`${e.name} account`,...i.linked?{text:l?`Connected as @${l}.`:`Connected.`}:{text:`Not connected.`,link:{id:`connect`,label:`Connect ${e.name}`,url:`${t.dash}/settings/connections?connect=${encodeURIComponent(e.id)}`}}};return{title:r?.name??n,...r?.description?{text:r.description}:{},sections:[...s?[{title:`Use it here`,text:s}]:[],...c.length?[{title:`Listens to`,text:c.join(`
+`)}]:[],...u?[u]:[]],links:[{id:`agent`,label:`Open in Coder`,url:`${t.dash}/agents/${encodeURIComponent(a)}/platforms`,primary:!0},{id:`coder`,label:`Make your own agent`,url:t.home.replace(/\/$/,``)}]}}function id(e,t,n,{open:r,setup:i}){let a=n?.name??t,o=td(e,t,n?nd(e,n):[`mention`]);return{title:`${a} is in your workspace`,...n?.description?{text:n.description}:{},sections:[...o?[{title:`Use it`,text:o}]:[],...i?[{title:`One step left`,text:`Add a model so ${a} can start working.`}]:[]],links:[...i?[{id:`model`,label:`Add a model`,url:i,primary:!0}]:[],{id:`agent`,label:`Open in Coder`,url:r,...i?{}:{primary:!0}}]}}var ad=t({adapterContext:()=>Dd,addressedTo:()=>md,agentSummary:()=>kd,chatFor:()=>Ad,dashUrl:()=>Ed,deliver:()=>_d,endTyping:()=>xd,eventReplies:()=>bd,eventThread:()=>yd,later:()=>gd});async function od(e,t,n){let r=`${t.id}:${n}`,i=await B(e,r),a=i?.boundInstallation?.installation.id===r?i.boundInstallation.installation:await i?.store.get(`installation`,r);return{tenant:i,installation:a?.deletedAt?void 0:a}}async function sd(e,t,n,r,i){let{tenant:a,installation:o}=await od(e,t,r);if(!a||!o)throw Error(`${t.integration} installation ${r} is not bound to this server`);return If(a,e.integrations[t.integration],o,n,i)}function cd(e){if(e._type===`chat:Thread`)return{...e,currentMessage:void 0};let{raw:t,replyTo:n,...r}=e;return{...r,raw:null,id:r.id.startsWith(`ephemeral:`)?``:r.id}}const ld=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),ud=(e,t)=>Object.keys(e.events).find(n=>e.events[n].on===t),dd=`(?![\\w-]|\\.\\w)`,fd=e=>e.replace(/[ \t]{2,}/g,` `).trim();function pd(e,t){let n=t.reduce((e,t)=>e.replace(RegExp(`(^|[^\\w-])@${ld(t)}${dd}`,`gi`),`$1`),e);return n===e?void 0:fd(n)}function md(e,t){let n=pd(e,[t]);if(n!==void 0)return n;let r=RegExp(`^\\s*${ld(t)}${dd}[\\s,:;!.?-]*`,`i`);return r.test(e)?fd(e.replace(r,``)):void 0}async function hd(e,t,n,r,i,a){if(n.builtin)return md(a,n.agent)!==void 0;let o=await B(e,`${n.id}:${r.id}`);if(t.events[i]?.on!==`message`||!o)return!1;o.local&&await(o.syncAgent?.(n.agent)??lr(o.store,o.local.cwd,o.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e));let{record:s,version:c}=await M(o.store,n.agent);return!s||!c||!s.settings?.disabled&&Ct(c.definition.integrations[t.id],i)!==void 0}function gd(e,t,n,r,i){let a=r.catch(r=>(console.error(`coder server: dispatch failed for ${t.id} event ${n.deliveryId}`,r),el(e,t,r,n.installationId,n,()=>i??bd(e,t,n))));e.waitUntil&&e.waitUntil(a)}async function _d(e,t,n,r,i,a){if(n.builtin&&!t.app.shareable){U(i,`the built-in app does not serve ${t.name}`,`error`);return}let o=`${n.id}:${i.installationId}`,s=await B(e,o);if(!s||!n.builtin&&s.organizationId!==e.organizationId){U(i,`installation ${o} is not bound to the app's workspace`,`error`);return}let c=s.boundInstallation?.installation.id===o?s.boundInstallation.installation:await s.store.get(`installation`,o);if(c?.covers&&!c.covers.includes(i.account??``)){U(i,`installation ${o} is not granted ${i.account??`its account`}`);return}let l;try{l=await Zc(s,t,n,r,i,e.now??Date.now,a),await l.work}catch(e){throw await a.endTyping?.().catch(()=>{}),e}if(l.taskId)return await Vl(s,!0,!1,!0),l.taskId}function vd(e,t,n,r,i,a=async()=>e.adapter.endTyping?.(e.id)){let o=typeof n==`string`?n:n?.id,s=typeof t==`string`?t:t?.userId,c,l=!1,u=async()=>{l||(l=!0,await c?.catch(()=>{}),await a())},d=async t=>(await u().catch(t=>console.error(`coder server: could not clear the working indicator in ${e.id}`,t)),t);return{post:async(t,a)=>{let o=await Sn(e,t,a,s,t=>wn(e,t,r,n)).catch(async e=>{throw await i?.(e),e});return d({id:o.at(-1)?.id,ids:o.map(e=>e.id)})},react:(t,n)=>xn(e,t,n??o),whisper:n=>t?e.postEphemeral(t,n,{fallbackToDM:!1}):Promise.resolve(null),startTyping:()=>{let t=o?{messageId:o}:{};return c=e.adapter.startTyping(e.id,void 0,t),c},endTyping:async()=>{c&&await u()}}}async function yd(e,t,n){if(!n.chat)throw Error(`The event has no conversation`);let r=await Ad(e,t,{id:n.installationId,...n.repo?{repo:n.repo}:{}});return await r.initialize(),r.thread(n.chat.thread.id)}async function bd(e,t,n,r){if(!n.chat)return{post:async()=>{},whisper:async()=>{}};let i=await yd(e,t,n);return vd(i,n.chat.message?.author.userId||n.actor.id||void 0,n.chat.message?.id||void 0,e.integrations[t.integration]?.replyLimit,r=>Sd(e,t,n.installationId,r),r&&(()=>xd(e,r,i)))}async function xd(e,t,n){let{task:r}=t,i=r.event;if(t.typingEnded||!i?.chat||r.source!==i.integration||!(r.context?.mustReply??i.mustReply))return;let a={generation:t.generation??0},o=(e.now??Date.now)();if(!await e.queue.patchTask(e.organizationId,r.id,{typingEnded:!0},o,a))return;let s=n?void 0:await e.store.get(`app`,i.appId),c=n??(s&&await yd(e,s,i));await c?.adapter.endTyping?.(c.id)}async function Sd(e,t,n,r){if(!e.integrations[t.integration]?.isUninstalled?.(r))return;let i=`${t.id}:${n}`,a=await B(e,i);a&&await Ff(a.store,i,(e.now??Date.now)())}function Cd(e,t,n,r,i,a,o=!1){let s=r===`message`?o?a.text:t.builtin?md(a.text,t.agent):void 0:void 0;if(r===`message`&&t.builtin&&s===void 0)return;let c=ud(e,s===void 0?r:`mention`);if(!c||a.author.isBot===!0)return;let l=e.event?e.event(c,i,a,t):{};if(!l)return;let u=(l.type??c)===ud(e,`mention`)?s??pd(a.text,[t.name,...n.self?[n.self]:[]])??a.text:a.text;return{integration:e.id,type:c,appId:t.id,installationId:n.id,deliveryId:Fr(`sha256`).update(`${t.id}\n${n.id}\n${i.id}\n${a.id}`).digest(`base64url`).slice(0,22),actor:{id:a.author.userId,...a.author.userName?{login:a.author.userName}:{}},text:u,chat:{thread:cd(i.toJSON()),message:cd(a.toJSON())},...n.space?{space:n.space}:{},...n.index===void 0?{}:{conversation:{index:n.index}},...n.account?{account:n.account}:{},...n.repo?{repo:n.repo}:{},...l}}async function wd(e,t,n,r,i){let a=await Td(e,t,n).catch(e=>{console.error(`coder server: conversation workspace lookup failed`,e)});a&&await vc(a,{integration:t.integration,appId:t.id,installationId:n.id,chat:{thread:cd(r.toJSON())}},{id:i.id,thread:r.id,author:i.author.userName||i.author.userId,text:i.text,sentAt:i.metadata.dateSent.toISOString()}).catch(e=>console.error(`coder server: could not keep a message for ${t.id}`,e))}async function Td(e,t,n){let{tenant:r,installation:i}=await od(e,t,n.id),a=(t.builtin||r?.organizationId===e.organizationId)&&(!i?.covers||i.covers.includes(n.account??``));return i&&a?r:void 0}async function Ed(e){let t=e.config.publicUrl?.replace(/\/$/,``);return t&&`${t}${Rv(await Lv(e))}`}function Dd(e,t,n,r,i,a){return{fetch:e.fetch??fetch,appId:n.id.slice(t.id.length+1),name:n.name,credentials:r,...i?{installationId:i.id,...i.self?{self:i.self}:{}}:{},token:(t,a)=>sd(e,n,r,t,{...i?.repo?{repo:{owner:i.repo.owner,name:i.repo.name}}:{},...a}),installedSelf:async t=>(await od(e,n,t)).installation?.self,saveSelf:async(t,r)=>{let{tenant:i,installation:a}=await od(e,n,t);!i||!a||a.self||await Co(i.store,`installation`,a.id,{self:r}).catch(e=>console.error(`coder server: could not save ${a.id}'s app user`,e))},...i?{hears:(r,a)=>hd(e,t,n,i,r,a).catch(e=>(console.error(`coder server: could not read ${n.id}'s agent for a message`,e),!0)),active:async r=>{let a=await B(e,`${n.id}:${i.id}`),o=Rc(n.id,i.id,ac(t,r));return!!await a?.store.get(`delivery`,o)},knows:async(t,r)=>{let a=await B(e,`${n.id}:${i.id}`),o=uc(n.id,i.id,t,r);return!!await a?.store.get(`delivery`,o)},home:async r=>{let o=e.config.publicUrl;if(!o||!a)return;let[s,c]=await Promise.all([kd(e,n,i),r?Od(e,t,n,i,r):void 0]);return rd(t,{home:o,dash:a},n.name,s,c)}}:{},privateState:()=>new yr}}async function Od(e,t,n,r,i){let a=await Td(e,n,r);if(!a?.auth)return;let o=await Gc(a,t,{actor:{id:i}});return o?{linked:{id:i,...o.login?{login:o.login}:{}}}:{}}async function kd(e,t,n){let r=await Td(e,t,n),{record:i,version:a}=r?await M(r.store,t.agent):{};if(!i||!a)return;let{definition:o}=a,s=i.description??o.description;return{slug:i.id,name:i.name,...s?{description:s}:{},listens:Object.entries(o.integrations).flatMap(([t,n])=>{let r=wt(n),i=e.integrations[t];return i&&r.length?[{integration:t,name:i.name,events:r}]:[]})}}async function Ad(e,t,n){let r=e.integrations[t.integration];if(!r)throw Error(`Unknown integration "${t.integration}"`);let i=new Map;e={...e,fetch:r.requestFetch?.(e.fetch??fetch,n?.account??n?.id)??e.fetch,syncAgent:t=>(i.has(t)||i.set(t,lr(e.store,e.local.cwd,e.integrations,t)),i.get(t))};let a=R(e.config,t.credentials),o=await r.adapter(Dd(e,r,t,a,n)),s=vr(e.chatState??new yr,t.id),{Chat:c}=await import(`./dist-B5qUdWUG.js`),l=new c({userName:t.name,adapters:{[r.id]:o},state:{...s,isSubscribed:async()=>!1},concurrency:`concurrent`,dedupeTtlMs:Hc,logger:`error`});if(!n)return l;let u=async(i,o,s)=>{let c=i===`message`&&await kl(e,t,n,o.id,s.text),l=Cd(r,t,n,i,o,s,c);if(!l){s.author.isBot!==!0&&await wd(e,t,n,o,s);return}let u=vd(o,s.author,s,r.replyLimit,r=>Sd(e,t,n.id,r));gd(e,t,l,_d(e,r,t,a,l,u),u)};return l.onNewMention((e,t)=>u(`mention`,e,t)),l.onNewMessage(/[\s\S]*/,(e,t)=>u(`message`,e,t)),l.onMessageUpdated((r,i)=>{if((e.now??Date.now)()-i.metadata.dateSent.getTime()>864e5)return;let a=[t.name,...n.self?[n.self]:[]],o=i.isMention||r.isDM||pd(i.text,a)!==void 0;return u(o?`mention`:`message`,r,i)}),l.onReaction(async i=>{if(!i.added||i.user.isBot===!0)return;let a=i.thread,o=await Td(e,t,n);if(!o)return;let s={integration:r.id,type:`reactions`,appId:t.id,installationId:n.id,deliveryId:`reaction-${i.messageId}-${i.user.userId}-${i.rawEmoji}`,actor:{id:i.user.userId,login:i.user.userName},text:``,chat:{thread:cd(a.toJSON())},...n.account?{account:n.account}:{}},c=Lc(o,s,{emoji:`:${i.emoji.name}:`,by:i.user.userName||i.user.userId,on:i.message?.text??i.messageId},e.now??Date.now);gd(e,t,s,c)}),l}function jd(e,t,n,r){return e.withAppLock(`installation:${t}`,async e=>{let i=n(await e.get(`installation`,t));if(!i)return;let a=await e.list(`installation`),o=a.filter(e=>e.id!==t&&e.value.app===i.app&&!e.value.deletedAt&&i.covers?.includes(e.id.slice(i.app.length+1))),s=new Set(o.map(e=>e.id));ar(a.map(e=>[e.id,s.has(e.id)?{...e.value,deletedAt:r}:e.value]),t,i);for(let t of o)await e.put(`installation`,t.id,{...t.value,deletedAt:r});return await e.put(`installation`,t,i),i})}async function Md(e,t,n,r){let i=n.id,a=t.operatorApp??!1?`*`:t.session?.user.id??`anonymous`,o=Pn(r.searchParams.get(`state`)),s=Kv(o?.back),c=t.integrations[i];if(!c)return $(t,`unknown-integration`,{platform:i},s);let l=t.config.publicUrl;if(!l)return $(t,`no-public-url`,{},s);let u=r.searchParams.get(`app`),d=o?.tx?await oi(t,o.tx,`install`,a):void 0;if(!d||u&&u!==d)return $(t,`install-expired`,{platform:i,appId:u??void 0},s);let f=await t.store.get(`app`,u??d);if(!f)return $(t,`unknown-app`,{platform:i},s);let p=R(t.config,f.credentials);return j(c.app.installUrl(f,p,{publicUrl:l,state:r.searchParams.get(`state`)??gt({})}))}async function Nd(e,t,n,r){let i=n.id,a=t.apps?await t.apps(i):(await t.store.list(`app`,{prefix:`${i}:`})).map(e=>({organizationId:t.organizationId,app:e.value})),o=await n.app.installedApp(e,{apps:a.map(({app:e})=>({app:e,credentials:R(t.config,e.credentials)})),fetch:r}).catch(e=>(console.error(`coder server: finding the ${i} app of an install failed`,e),e instanceof Error?e:Error(String(e))));if(o instanceof Error)return $(t,`failed`,{platform:i});if(!o)return $(t,`unknown-app`,{platform:i});let{app:s,installation:c}=o,l=a.find(e=>e.app.id===s.id).organizationId,u=s.builtin||!t.session?t:zv(t,t.session,l);if(!u)return $(t,`other-workspace`,{platform:i});let d=await Qr(u,`install`,t.session?.user.id??`anonymous`,s.id);return j(n.app.installUrl(s,R(t.config,s.credentials),{publicUrl:t.config.publicUrl,state:gt({tx:d,installation:c}),installation:c}))}async function Pd(e,t,n,r){let i=n.id,a=t.operatorApp??!1,o=a?`*`:t.session?.user.id??`anonymous`,s=Pn(r.searchParams.get(`state`)),c=s?.tx&&t.session?zv(t,t.session,ti(t,s.tx)):void 0,l=c?{...t,...c}:t,u=Kv(s?.back),d=l.integrations[i];if(!d)return $(l,`unknown-integration`,{platform:i},u);if(!l.config.publicUrl)return $(l,`no-public-url`,{},u);let f=l.fetch??fetch,p=r.searchParams.get(`app`),m=s?.tx?await oi(l,s.tx,`install`,o):void 0,h={platform:i,appId:p??m},g=r.searchParams.get(`error`);if(g)return g===`access_denied`?$(l,`cancelled`,h,u):$(l,`platform-error`,{...h,error:g},u);if(!r.searchParams.has(`state`)&&d.app.installedApp&&!a)return Nd(e,l,d,f);if(!m||p&&p!==m||!await ii(l,s.tx,`install`,o,m))return $(l,`install-expired`,h,u);let _=await l.store.get(`app`,p??m);return _?Fd(e,l,d,_,u,s?.installation):$(l,`connected`,{platform:i},u)}async function Fd(e,t,n,r,i,a){let o=n.id,s=t.fetch??fetch,c=t.now?.()??Date.now(),l=t.config.publicUrl;if(r.builtin&&!n.app.shareable)return $(t,`unknown-app`,{platform:o},i);let u=i??(r.builtin?void 0:Wv(t,r.agent)),d=R(t.config,r.credentials),f=await n.app.installCallback(e,{app:r,credentials:d,publicUrl:l,fetch:s,tokens:Zv(t,n.id),...a?{installation:a}:{}}).catch(e=>e instanceof ve?$(t,e.code,{platform:o,appId:r.id,error:e.error},u):(console.error(`coder server: installing ${r.id} failed`,e),$(t,`failed`,{platform:o,appId:r.id},u)));if(f instanceof Response)return f;let p=`${r.id}:${f.platformInstallId}`,m=t.session;f.user&&m&&t.auth&&await t.auth.link(m.user,o,f.user.id,{...na(m.organizations),...f.user.token?{token:L(t.config,f.user.token),organizationId:t.organizationId}:{},...f.user.login?{login:f.user.login}:{}});let h=await t.store.get(`installation`,p),g={...h,id:p,app:r.id,integration:o,account:f.account??h?.account??{login:`unknown`},...f.token?{token:L(t.config,f.token)}:{},...f.installer?{installer:f.installer}:{},...f.self?{self:f.self}:{},...f.covers?{covers:f.covers}:{},createdAt:h?.createdAt??c};if(delete g.deletedAt,delete g.uninstalled,n.repos){let e=await n.auth.token(f.token?{...g,token:f.token}:g,d,void 0,{fetch:s});g.repos=await n.repos.list(g,e,s)}try{g=await jd(t.store,p,e=>f.covers===null?{...g,covers:e?.covers??[]}:g,c)}catch(e){return e instanceof er?$(t,`installation-bound`,{platform:o,account:g.account.login},u):$(t,`installation-taken`,{platform:o},u)}return g.installer&&n.messages?.direct&&await Id(t,n,r,d,f.platformInstallId,g.installer),$(t,`connected`,{platform:o,account:g.account.login},u)}async function Id(e,t,n,r,i,a){try{let[{adapterContext:o,agentSummary:s},{record:c,version:l}]=await Promise.all([Promise.resolve().then(()=>ad),M(e.store,n.agent)]),{models:u,first:d}=await Qp(e,yt({definition:l?.definition,usage:c?.settings}),e.session?.user.id),f=tm(u).length>0,p={id:i},m=o(e,t,n,r,p),h=`${e.config.publicUrl.replace(/\/$/,``)}${Wv(e,n.agent)}`,g=id(t,n.name,await s(e,n,p),{open:h,...f?{}:{setup:await ym(e,d.engine)}});await t.messages.direct(m,a,g)}catch(e){console.error(`coder server: could not greet the installer of ${n.id}`,e)}}const Ld=/^[a-z0-9][a-z0-9_-]*$/i;async function Rd(e,t){let n=Zt(Qt(),`builtin`).map(({name:e})=>({name:e,scope:`builtin`}));if(!t)return D(n);try{let{integration:r,token:i}=await Is(e,t),a=(r.repos?await r.repos.listDir(t,`.coder/flows`,i):[]).map(e=>e.replace(/\.(ts|mjs|js)$/,``)).filter(e=>Ld.test(e));return D([...a.map(e=>({name:e,scope:`workspace`})),...n.filter(e=>!a.includes(e.name))])}catch(e){return W(e)}}async function zd(e,t){if(!t)throw new H(`repo is required`);let{integration:n,token:r}=await Is(e,t);return D(await n.repos?.pullRequests(t,r)??[])}async function Bd(e,t){try{return D(Zd(await zs(e,`dashboard`,t)),201)}catch(e){return W(e)}}async function Vd(e,t,n,r){return Rd(t,r.searchParams.get(`repo`)).catch(W)}async function Hd(e,t,n,r){return zd(t,r.searchParams.get(`repo`)).catch(W)}async function Ud(e,t,n,r){return n.name===`review`?D({error:`Reviews run through the review tool.`},400):Ef(e).then(e=>Bd(t,{...e,flow:n.name})).catch(W)}function Wd(e,t,n){return(e.waitUntil??(e=>void e.catch(()=>{})))(t),Promise.resolve(D({tasks:n},202))}async function Gd(e,t,n,r,i,a,o){if(`ack`in i)return new Response(null,{status:200});if(`uninstalled`in i){let t=await B(e,i.uninstalled);return t&&await Ff(t.store,i.uninstalled,a),D({ok:!0})}if(`click`in i)return o?(e.waitUntil??(()=>{}))(Ml(e,t,n,o,i.click).catch(e=>console.error(`coder server: a click failed for ${n.id}`,e))):console.error(`coder server: ${n.id} sent a click for no installation; dropped`),new Response(null,{status:200});if(`unhandled`in i)return console.warn(`coder server: ${n.id} sent ${i.unhandled}, which Coder does not handle yet`),new Response(null,{status:200});if(`work`in i){if(o){let a=Ed(e).then(a=>i.work(Dd(e,t,n,r,o,a))).catch(t=>(console.error(`coder server: webhook work failed for ${n.id}`,t),el(e,n,t,o.id)));(e.waitUntil??(()=>{}))(a)}else console.error(`coder server: ${n.id} sent work for no installation; dropped`);return D({ok:!0})}if(`installation`in i){let t=await B(e,i.installation.installation.id),n=await t?.store.get(`installation`,i.installation.installation.id);return!t||!n?D({ok:!0}):(await t.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!t||i.installation.repos&&t.deletedAt)return;let r=i.installation.repos,o=r?r.refresh||t.repos==null?void 0:[...new Set([...t.repos,...r.add])].filter(e=>!r.remove.includes(e)):i.installation.installation.repos;await Co(e,`installation`,n.id,{account:i.installation.op===`delete`?t.account:i.installation.installation.account,...r||o?{repos:o}:{},deletedAt:i.installation.op===`delete`?a:void 0,uninstalled:i.installation.installation.uninstalled})}),await Pf(t.store,n.id),D({ok:!0}))}if(`space`in i){let a=await B(e,`${n.id}:${i.space.installation}`);return a&&await hs(a,t,n.id,r,i.space),D({ok:!0})}if(`members`in i){let a=await B(e,`${n.id}:${i.members.installation}`);return a&&(e.waitUntil??(()=>{}))(gs(a,t,n.id,r,i.members)),D({ok:!0})}if(`covers`in i){let{installation:t,add:n=[],remove:r=[]}=i.covers,o=await B(e,t),s=!1;try{o&&await jd(o.store,t,e=>{if(s=!!e,!e||e.deletedAt)return;let t=[...new Set([...e.covers??[],...n])];return{...e,covers:t.filter(e=>!r.includes(e))}},a)}catch(e){if(!(e instanceof er))throw e;console.error(`coder server: ${t} covers an account bound elsewhere; grant ignored`)}return s?D({ok:!0}):new Response(`Installation not stored yet`,{status:503})}if(`push`in i){let{push:r}=i;if(no(r)){let t=await B(e,r.installation);t&&await io(t.store,r)}let a=ro(r,n);if(!a)return no(r)?D({ok:!0}):D({accepted:0},202);try{n.branch||await Co(e.store,`app`,n.id,{branch:a.branch});let r=await _o(e,a.repo,a.ref,{...go(),integration:t.id,appId:n.id},a.branch);return r?D({imported:r.map(e=>e.agent)}):D({error:`No installed app can read ${a.repo}`},400)}catch(e){return D({error:e instanceof Error?e.message:String(e)},400)}}for(let a of i.events)gd(e,n,a,bd(e,n,a).then(i=>_d(e,t,n,r,a,i)));return D({accepted:i.events.length},202)}async function Kd(e,t,n){let r=t.integrations[n],i=await e.text(),a=r.target(e,i);if(a instanceof Response)return a;if(!a)return new Response(`Not addressed to an app`,{status:400});let o=`${r.id}:${a.app}`,s=t.webhookTarget?await t.webhookTarget(o,a.installation?`${o}:${a.installation}`:void 0):void 0,c=t.webhookTarget?s&&{ctx:{...z(t,s.organizationId),...s.bound?{boundInstallation:s.bound}:{}},app:s.app}:await ra(t,o);if(!c)return new Response(`Unknown app`,{status:404});let{ctx:l,app:u}=c,d=R(l.config,u.credentials),f=a.installation?{...a,id:a.installation}:void 0,p=r.ownEvents?.(e,i,u,d);if(p&&`invalid`in p)return new Response(`Invalid signature`,{status:401});if(p)return Gd(l,r,u,d,p,(l.now??Date.now)(),f);let m=(await Ad(l,u,f)).webhooks[r.id];return m(new Request(e.url,{method:`POST`,headers:e.headers,body:i}),{deduplicate:!1,propagateHandlerErrors:!0,waitUntil:e=>{let t=e.catch(e=>(console.error(`coder server: webhook work failed for ${u.id}`,e),el(l,u,e,a.installation)));l.waitUntil&&l.waitUntil(t)}})}var qd=t({DONE:()=>Jd,adminCreate:()=>mf,approveTask:()=>cf,archiveTask:()=>uf,askTask:()=>sf,cancelTask:()=>lf,composerOptions:()=>_f,decideApproval:()=>af,eventTarget:()=>df,listTasks:()=>gf,localRows:()=>hf,readTask:()=>$d,redactTask:()=>Zd,removeTask:()=>ef,steerTask:()=>nf,taskError:()=>W,taskLogs:()=>tf});const Jd=new Set([`completed`,`failed`,`cancelled`]);function W(e){if(e instanceof G)return D({error:e.message},400);if(e instanceof H)return D({error:e.message,...e.fix?{fix:e.fix}:{}},e.status);throw e}function Yd(e){let t=e.task.usage?.resolvedModel??Wf(e.task)??e.task.usage?.model??e.task.definition?.model;return t?{model:t}:{}}function Xd(e){let{id:t,name:n,source:r,agent:i,flow:a,event:o,cwd:s,access:c,context:l,requestedBy:u}=e.task,{engine:d,model:f,effort:p}=yt(e.task),m=e.task.context?.turns?.[0]?.prompt??e.task.prompt;return{task:{id:t,...n?{name:n}:{},source:r,agent:i,flow:a,...s?{cwd:s}:{},...c?{access:c}:{},...m?{prompt:m}:{},...o?{event:{integration:o.integration,type:o.type,text:o.text,actor:o.actor}}:{},...l?.user?{context:{user:l.user}}:{},...u?{requestedBy:u}:{},...d?{usage:{engine:d,...f?{model:f}:{},...p?{effort:p}:{}}}:{}},...Yd(e),status:e.status,...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},attempts:e.attempts,...e.approval===void 0?{}:{approval:e.approval},...e.approvals??e.task.context?.approvals?{approvals:e.approvals??e.task.context?.approvals}:{},...e.archivedAt===void 0?{}:{archivedAt:e.archivedAt},createdAt:e.createdAt,startedAt:e.startedAt,finishedAt:e.finishedAt,updatedAt:e.updatedAt,...Ih(e)}}function Zd(e){let{tokenHash:t,handle:n,...r}=e;return{...r,...Ih(e),...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},...e.task.context?.approvals?{approvals:e.task.context.approvals}:{},turns:Jt(Bs(e),e.approvals??e.task.context?.approvals),...e.task.models?.[0]?.credential?{credential:Gp(e.task.models[0].credential).name}:{}}}async function Qd(e,t){let n=e.routeTask?.task.id===t?e.routeTask:await e.store.get(`task`,t);if(n&&!(e.local&&n.handle?.startsWith(`cli:`)&&n.task.flow==="default"))return{status:n};if(!n&&e.taskPrincipal)return D({error:`No task "${t}"`},404);let r=n?.task.cwd??e.local?.cwd;return r?{cwd:r,answer:n?.answer}:D({error:`No task "${t}"`},404)}async function $d(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?O(r,500,2e3):void 0,c=Ss(t.store,i,o,s??500);c?.catch(()=>{});let l=await Qd(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;if(!u){let e=xp(d,i,!0);return e?D({...e,...l.answer?{answer:l.answer}:{},logs:bp(d,i,-1,s??500)}):D({error:`No task "${i}"`},404)}let f=await Ll(t,u);return D({...Zd(f),...Yd(f),logs:await c})}async function ef(e,t,n,r){let i=n.id,a=await Qd({...t,routeTask:void 0},i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o){let n=await Cp(e,s,i,void 0,t);return n.ok&&t.queue instanceof eg&&t.queue.tombstone(i),n}if(t.local&&o.handle?.startsWith(`cli:`)){let e=(t.now??Date.now)();await t.queue.cancel(t.organizationId,i,e,{attempts:o.attempts,tokenHash:o.tokenHash,generation:o.generation??0});let n=await t.store.get(`task`,i);if(n&&X.includes(n.status)){await fp(t,n,e);let r=await t.store.get(`task`,i);if(r&&X.includes(r.status))return D({error:`Task is still stopping. Try again.`},409)}}else if([`running`,`waiting`].includes(o.status)&&o.handle)try{let e=await Ba(t,o.task);if(!e)return D({error:`Task runner is unavailable. Try again.`},409);await e.stop(o.handle)}catch{return D({error:`Task is still stopping. Try again.`},409)}return await Jh(t,o)?(o.handle?.startsWith(`cli:`)||await Og(t,o.task,o.handle).catch(e=>console.error(`coder server: work folder of ${i} not removed`,e)),t.local&&(await t.store.delete(`snapshot`,`local-start:${i}`),await t.store.delete(`snapshot`,`completion:${i}`)),Hl(t,!0),D({ok:!0})):D({error:`Task changed while deleting. Try again.`},409)}async function tf(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?O(r,500,2e3):void 0,c=Ss(t.store,i,o,s??void 0);c?.catch(()=>{});let l=await Qd(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;return u?(await Ll(t,u),D(await c)):xp(d,i,!1)?D(bp(d,i,o,s)):D({error:`No task "${i}"`},404)}async function nf(e,t,n,r){let i=n.id,a=await Qd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Cp(e,s,i,`steer`,t);if(o.task.flow!=="default")return D({error:`steer is available only for default-flow tasks`},409);let c=await e.json().catch(()=>void 0),l=Ps(c,[`engine`,`effort`]);if(l)return D({error:l},400);if(Jd.has(o.status)){let{text:e,outputSchema:n,model:r,access:i}=c??{},a={...o.task.context,asker:t.session?.user.id};try{let s=await Ws(t,{...o,task:{...o.task,context:a}},String(e??``),n,{model:r,access:i});return Hl(t,!0),D(Zd(s))}catch(e){return W(e)}}let u=await Zh(t,o,`steer`,{...c,asker:t.session?.user.id??null});return u?D(u):D({error:`Task "${i}" is no longer active`},409)}function rf(e){return async(t,n,r)=>{let i=r.id;if(e===`approve`)return af(n,i,await t.json().catch(()=>void 0)??{},(await Eu(n))?.name);let a=await Qd(n,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Cp(t,s,i,e,n);if(o.task.flow!=="default")return D({error:`${e} is available only for default-flow tasks`},409);if(!X.includes(o.status))return D({error:`Task "${i}" is not active`},409);let c=await t.json().catch(()=>void 0),l=Ps(c,[`engine`,`effort`]);if(l)return D({error:l},400);let u=await Zh(n,o,e,c);return u?D(u):D({error:`Task "${i}" is no longer active`},409)}}async function af(e,t,n,r){let i=await Qd(e,t);if(i instanceof Response)return i;let{status:a,cwd:o}=i;if(a&&a.task.flow!=="default")return D({error:`approve is available only for default-flow tasks`},409);let s=String(n.approvalId??n.id??(a?a.approval?.id:Vt(w(o,t))[0]?.id)??``),c=a?.task.context?.approvals?.find(e=>e.id===s);if(a&&Au(c))return Zu(e,a,s,n,await Eu(e));let l=n.decision===`deny`||n.decision===`decline`?`decline`:`accept`,u={...n,approvalId:s,decision:l,...r?{by:r}:{}},{response:d,task:f}=a?await of(e,a,u):{response:await wp(o,t,u,e),task:(await e.store.get(`task`,t))?.task};if(!d.ok)return d;let p=a?f?.context?.approvals??[]:Bt(w(o,t));return f&&(e.waitUntil??(()=>{}))(El(e,f,p).catch(e=>console.error(`coder server: could not show the decision on approval ${s}`,e))),d}async function of(e,t,n){let r=t.task.id,i=t.task.context?.approvals??[],a=t.approval,o=String(n.approvalId),s=i.find(e=>e.id===o)??(a?.id===o?a:void 0);if(!s)return{response:D({error:`Task "${r}" has no approval "${o}"`},409)};if(s.response?.decision===`accept`)return{response:D({error:`Approval "${o}" is already approved`},409)};if(s.response?.decision===`closed`)return{response:D({error:zt(o)},409)};let c=n.decision,l={...s,response:{decision:c,...typeof n.reason==`string`&&n.reason?{reason:n.reason}:{},answeredAt:new Date((e.now??Date.now)()).toISOString(),...typeof n.by==`string`&&n.by?{by:n.by}:{}}};if(Jd.has(t.status))try{let n=await Ws(e,{...t,task:Yh(t.task,[l])},Ut(l));return Hl(e,!0),{response:D(Zd(n)),task:n.task}}catch(e){return{response:W(e)}}if(!X.includes(t.status))return{response:D({error:`Task "${r}" is not active`},409)};let u;try{u=await Zh(e,t,`approve`,n,void 0,[l])}catch(e){if(e instanceof Wt)return{response:D({error:e.message},409)};throw e}return u?{response:D(u),task:Yh(t.task,[l])}:{response:D({error:`Task "${r}" is no longer active`},409)}}const sf=rf(`ask`),cf=rf(`approve`);async function lf(e,t,n,r){let i=n.id,a=await Qd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Cp(e,s,i,`cancel`,t);let c=(t.now??Date.now)(),l=await t.queue.cancel(t.organizationId,i,c,{attempts:o.attempts,tokenHash:o.tokenHash??null,generation:o.generation??0}),u=(o.task.context?.approvals??[]).filter(e=>!e.response);if(l&&u.length){let e=Gt(new Date(c).toISOString()),n=u.map(t=>({...t,response:e}));await t.queue.patchTask(t.organizationId,i,{approvals:n},c);let r=Yh(o.task,n);(t.waitUntil??(()=>{}))(El(t,r,r.context?.approvals??[]).catch(e=>console.error(`coder server: could not show the stop on ${i}`,e)))}if(l&&o.status!==`queued`){await ng(t,i);let e=await t.store.get(`task`,i);e&&!Jd.has(e.status)&&zl(t,o)}return l?D({ok:!0}):D({error:`No running or queued task "${i}"`},404)}async function uf(e,t,n,r){let i=n.id,a=await Qd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Cp(e,s,i,`archive`,t);let c=(t.now??Date.now)();return await t.queue.patchTask(t.organizationId,i,{archivedAt:c,autoArchived:void 0},c),D({ok:!0})}async function df(e,t){if(!t.agent||!t.event?.integration)return D({error:`agent and event are required`},400);let n=e.integrations[t.event.integration];if(!n)return D({error:`Unknown integration "${t.event.integration}"`},400);let r=(await e.store.list(`app`)).map(e=>e.value).find(e=>e.agent===t.agent&&e.integration===n.id);if(!r)return D({error:`No ${n.id} app for agent "${t.agent}" on this server.`},404);let i=(await e.store.list(`installation`)).map(e=>e.value).filter(e=>e.app===r.id&&!e.deletedAt),a=i.find(e=>e.id===`${r.id}:${t.event.installationId}`)??i[0];return a?{integration:n,app:r,event:{...t.event,appId:r.id,installationId:a.id.slice(r.id.length+1),deliveryId:`admin-${(e.now??Date.now)()}-${I()}`}}:D({error:`The ${n.id} app for "${t.agent}" is not installed anywhere yet`},404)}async function ff(e,t){let n=await df(t,e);if(n instanceof Response)return n;let{integration:r,app:i,event:a}=n,o=t.now??Date.now,s=await Zc(t,r,i,R(t.config,i.credentials),a,o,await bd(t,i,a));return Wd(t,s.work??Promise.resolve(),s.taskId?[s.taskId]:[])}const pf=new Set([`queued`,`running`,`waiting`,`completed`,`failed`,`cancelled`]);async function mf(e,t,n,r){let i=await e.json().catch(()=>void 0);if(!i||typeof i!=`object`)return D({error:`A JSON body is required`},400);try{if(js(t,i),i.event)return ff(i,t);let e=(i.source!==`cli`&&!t.taskPrincipal?await lp(t,i):void 0)??await zs(t,i.source===`cli`?`cli`:`dashboard`,i);return D(Zd(e),201)}catch(e){return W(e)}}function hf(e,t,n){let r=new Map(t.map(e=>[e.task.id,e]));for(let t of n)ue(e,t,r.has(t.task.id))&&r.set(t.task.id,t);return[...r.values()]}async function gf(e,t,n,r){let i=r.searchParams.get(`status`);if(i&&i!==`active`&&!pf.has(i))return D({error:`Unknown status "${i}"`},400);let a=r.searchParams.get(`source`);if(a&&![`dashboard`,`cli`,`schedule`,...Object.keys(t.integrations)].includes(a))return D({error:`Unknown source "${a}"`},400);let o=r.searchParams.has(`since`)?Number(r.searchParams.get(`since`)):void 0;if(o!==void 0&&(!Number.isFinite(o)||o<0))return D({error:`Invalid since`},400);let s=r.searchParams.get(`agent`),c=r.searchParams.get(`q`)?.trim(),l={...s?{agent:s}:{},...a?{source:a}:{},...c?{q:c}:{},viewer:await fs(t),...t.taskPrincipal?{parent:t.taskPrincipal.task}:{},archived:o===void 0?r.searchParams.get(`archived`)===`1`:void 0,...o===void 0?{}:{since:o,...r.searchParams.get(`sinceId`)?{sinceId:r.searchParams.get(`sinceId`)}:{}}},u=i===`active`?{statuses:X}:i?{status:i}:{},d=r.searchParams.get(`summary`)===`1`||o!==void 0&&!r.searchParams.has(`summary`),f=e=>d?e.map(Xd):e.map(Zd);if(t.local){let e=o===void 0?ap(t.local.cwd,l.archived):[...ap(t.local.cwd,!0).map(e=>({...e,updatedAt:Math.max(e.updatedAt,e.archivedAt)})),...ap(t.local.cwd,!1)],n=await t.queue.list(t.organizationId,{...t.taskPrincipal?{parent:t.taskPrincipal.task}:{}}),i=new Set(n.map(e=>e.task.id)),a=hf(t.local.cwd,t.taskPrincipal?e.filter(e=>i.has(e.task.id)):e,n),s=a.filter(e=>zh(e,{...l,...u})).sort(o===void 0?Uh:Hh),c=O(r,k(r)?void 0:20);if(!k(r))return D(f(s.slice(0,c)));let p=Nn(r),m=s.filter(e=>Wh(e,p)),h=Fn(m.slice(0,c+1),c,o===void 0?Bh:Vh),g=r.searchParams.get(`approvals`)===`1`&&!p&&d?a.filter(e=>zh(e,{viewer:l.viewer,archived:!1,status:`waiting`})).sort(Uh).slice(0,50):[];return D({...h,items:f(h.items),...r.searchParams.get(`counts`)===`1`?{counts:{all:s.length,active:s.filter(e=>X.includes(e.status)).length,waiting:s.filter(e=>$t(e.status,e.approvals??e.task.context?.approvals)).length}}:{},...g.length?{pendingApprovals:f(g)}:{}})}if(!k(r)){let e=O(r,20),n=await t.queue.list(t.organizationId,{...l,...u,limit:e,summary:d});return D(f(n))}let p=O(r),m=Nn(r),h=r.searchParams.get(`counts`)===`1`&&!i&&!m&&t.queue.listWithCounts?await t.queue.listWithCounts(t.organizationId,{...l,limit:p+1,summary:d}):void 0,g=r.searchParams.get(`approvals`)===`1`&&!m&&d,[_,v,y]=await Promise.all([h?h.items:t.queue.list(t.organizationId,{...l,...u,summary:d,...m?{before:m}:{},limit:p+1}),h?h.counts:r.searchParams.get(`counts`)===`1`?t.queue.counts(t.organizationId,{...l,...u}):void 0,g?t.queue.list(t.organizationId,{viewer:l.viewer,...l.parent?{parent:l.parent}:{},archived:!1,status:`waiting`,summary:!0,limit:50}):void 0]),b=Fn(_,p,o===void 0?Bh:Vh);return D({...b,items:f(b.items),...v?{counts:v}:{},...y?.length?{pendingApprovals:f(y)}:{}})}async function _f(e,t){let{now:n,local:r}=await Gl(t),[i,a,o]=await Promise.all([Kl(t,r,{limit:200}),K(t),t.store.list(`runner`)]),s=ot(),c=i.filter(e=>!e.settings?.disabled).sort((e,t)=>Number(t.id===s)-Number(e.id===s)).map(({id:e,name:t})=>({id:e,name:t,...e===s?{default:!0}:{}})),l=q(t,a),u=Object.values(t.integrations).find(e=>e.repos);return D({agents:c,chain:l.chain,models:du(a),runners:gg(t,o,n).map(({id:e,name:t,default:n})=>({id:e,name:t,default:n})),flows:Zt(Qt(),`builtin`).map(e=>e.name),...t.local?{folders:Ha(t.local.cwd)}:{},...u?{connectLabel:u.installLabel??`Connect ${u.id}`}:{}})}var G=class extends Error{};async function vf(e){let t=await e.get(`config`,`workspace`);if(t&&t.version!==1)throw new G(`The workspace config is config version ${t.version??0}; this Coder reads version 1.`);return t??{}}function yf(){let e=Te();if(!P.existsSync(e))return{};try{return Ce(JSON.parse(P.readFileSync(e,`utf8`))).config}catch(t){throw new G(`Invalid config in ${e}: ${t.message}`)}}function bf(e){let{mcp:t,...n}=e;return n}async function K(e){return e.local?bf(yf()):vf(e.store)}const q=(e,t)=>e.local?bf(Le(e.local.cwd)):Ae(t);async function xf(e,t){let n=e.settings??={},r=(n.configUpdate??Promise.resolve()).catch(()=>{}).then(()=>e.local?t(e):e.store.withConfigLock(n=>t({...e,store:n})));n.configUpdate=r;try{return await r}finally{n.configUpdate===r&&delete n.configUpdate}}function Sf(e){let t=ke(e);if(t.length)throw new G(t.join(`; `))}async function Cf(e,t){let n=t&&typeof t==`object`&&!Array.isArray(t)?{...t,version:1}:t;if(Sf(n),n.mcp)throw new G(`Add a connection in Settings to attach an MCP server`);if(e.local){let{mcp:t}=yf();return we({...n,...t?{mcp:t}:{}}),K(e)}return await e.store.put(`config`,`workspace`,n),bf(n)}async function wf(e,t){return xf(e,async e=>{let n=structuredClone(await K(e));return t(n),Cf(e,n)})}function Tf(e,t){return xf(e,async e=>Cf(e,me(await K(e),t)))}async function Ef(e){let t=await e.json().catch(()=>void 0);if(!t||typeof t!=`object`)throw new G(`A JSON body is required`);return t}async function Df(e,t){return wf(e,t).then(t=>Of(e,t)).then(D).catch(W)}const Of=async(e,t)=>({...t,runsOn:await im(e,t)}),kf=()=>D(Me());async function Af(e,t,n,r){return K(t).then(e=>D({config:e,effective:q(t,e)})).catch(W)}async function jf(e,t,n,r){return e.json().catch(()=>{throw new G(`A JSON body is required`)}).then(async e=>{let n=await Tf(t,e);return[`chain`,`reviewModel`,`models`].some(t=>t in e)?Of(t,n):n}).then(D).catch(W)}function Mf(e,t){return t.token?{...t,token:R(e.config,t.token)}:t}const Nf=3e5;async function Pf(e,t){await e.put(`snapshot`,gr(t),{drop:I()},{ttlMs:36e5});for(let n of await e.list(`snapshot`,{prefix:tr(t)}))await e.delete(`snapshot`,n.id)}async function Ff(e,t,n){await e.withAppLock(`installation:${t}`,async e=>{let r=await e.get(`installation`,t);!r||r.deletedAt||(await Co(e,`installation`,t,{deletedAt:n,uninstalled:!0}),await Pf(e,t))})}async function If(e,t,n,r,i,a=0){let o=n.token,s=Mf(e,n);return t.auth.token(s,r,i,{fetch:e.fetch,async hold(t,r){let i=tr(n.id,t),o=await e.store.heldTokens([n.id],[n.app]),s=o.held.get(i),c=(e.now??Date.now)(),l=s?s.expiresAt-s.mintedAt:0,u=a+(a+Nf<=l?Nf:0);if(s&&s.expiresAt-c>Math.max(u,Nf))try{return R(e.config,s.token)}catch(e){console.error(`coder server: held token unreadable, minting again`,e)}let d=await r();return await e.store.holdToken({key:i,value:{token:L(e.config,d.token),expiresAt:d.expiresAt,mintedAt:c},ttlMs:Math.max(d.expiresAt-c-Nf,0),drops:[n.id,n.app].map(e=>({key:gr(e),drop:o.drops.get(gr(e))}))}),d.token},async save(t){let r=L(e.config,t),i;return await e.store.withCredential(`installation`,n.id,async t=>{if(t){if(!(t.token===o||t.token&&R(e.config,t.token)===s.token)){i=t.token;return}return[{id:n.id,value:{...t,token:r}}]}}),n.token=i??r,i&&R(e.config,i)}})}function Lf(e,t,n,r,i){let a=[],o,s={installation:n.id,record:n,fetch:e.fetch??fetch,token:()=>o??=If(e,t,n,i,{tools:t.tools.presets[`read-only`]}).then(e=>(a.push(e),e))};return Object.assign(async e=>e===r.integration?s:void 0,{minted:a})}function Rf(e,t){let n=(e.settings??={}).agentInstallations??=new Map,r=`${e.organizationId}:${t.id}`,i=n.get(r);return i||(i=e.store.list(`installation`,{agent:t.agent,active:!0}).then(e=>e.map(e=>e.value)),n.set(r,i),setTimeout(()=>n.delete(r),6e4).unref()),i}const zf=e=>t=>{console.error(`coder server: could not mint a token for ${e}`,t)};async function Bf(e,t){let n={},r,i,a=t.event;if(!a&&!t.parent)return{tokens:n};let o;if(a){let s=e.integrations[a.integration];if(!s)throw Error(`Unknown integration "${a.integration}"`);let[c,l]=await Promise.all([e.store.get(`app`,a.appId),e.store.get(`installation`,`${a.appId}:${a.installationId}`)]);if(!c)throw Error(`Unknown app "${a.appId}"`);if(i=c,!l||l.deletedAt)throw Error(`Installation is gone`);o=l,n[a.integration]=await If(e,s,o,R(e.config,i.credentials),{tools:t.tools[a.integration]??[]},e.config.taskTimeoutMs),s.repos?.reviews&&s.repos.pullRequest(a)!==void 0&&(r=await If(e,s,o,R(e.config,i.credentials),{purpose:`checks`},e.config.taskTimeoutMs).catch(zf(o.id)))}let s=(await Rf(e,t)).filter(e=>e.id!==o?.id&&e.integration in t.tools),c=new Map((await e.store.getApps([...new Set(s.map(e=>e.app))])).map(e=>[e.id,e.value]));return await Promise.all(s.map(async r=>{let i=e.integrations[r.integration],a=c.get(r.app);if(!i||!a)return;let o=await If(e,i,r,R(e.config,a.credentials),{tools:t.tools[r.integration]??[]},e.config.taskTimeoutMs).catch(zf(r.id));o&&(n[_n(r.integration,r.account.login)]=o)})),{tokens:n,...r?{checksToken:r}:{},...i?{app:i}:{}}}async function Vf(e,t,n,r){let i=t.event,a=i&&e.integrations[i.integration]?.repos,o=i&&n[i.integration];if(!(!a?.commitAuthor||!t.author||!o||!r))try{let n=await a.commitAuthor({login:t.author,id:r.botId},o,e.fetch);return r.botId===void 0&&await Co(e.store,`app`,r.id,{botId:n.id}),{name:n.name,email:n.email}}catch(e){console.error(`coder server: commit identity lookup failed for ${t.id}`,e);return}}async function Hf(e,t){let n=e.config.publicUrl?.replace(/\/$/,``);return n?`${n}${Rv(await Lv(e,t))}`:void 0}async function Uf(e,t,n){let r=await Kf(e,t.task),[{tokens:i,checksToken:a,app:o},s,c]=await Promise.all([Bf(e,t.task),e.local?{}:vf(e.store),qf(e,r)]),l,u=r.event;if(u?.chat&&r.source===u.integration){let t=e.integrations[u.integration],n=t.tools.presets[`read-only`],a=r.tools[u.integration]??[];if(a.length===n.length&&n.every(e=>a.includes(e)))l=i[u.integration];else{let r=await e.store.get(`installation`,`${u.appId}:${u.installationId}`);if(!o||!r||r.deletedAt)throw Error(`Conversation installation is gone`);l=await If(e,t,r,R(e.config,o.credentials),{tools:n},e.config.taskTimeoutMs)}}let d=await Vf(e,r,i,o),{actAsRefusal:f}=await Promise.resolve().then(()=>Tu),p=await Ah(e,t,i,n=>f(e,t,n)),m=await Hf(e,n),h=e.config.reviewAssets&&URL.parse(e.config.reviewAssets,e.config.publicUrl)?.href,g=await Jf(e,r,q(e,s)),_={...p.env},v=[...p.warnings];for(let e of Object.keys(_))c.env[e]===void 0&&!g?.some(t=>t.credential.env[e]!==void 0)||(delete _[e],v.push(`${e} is temporarily unavailable; skipped for this task.`));let y=p.saved?[]:await Nh(e,r),b={...r,...!r.settingsUrl&&m?{settingsUrl:`${m}/agents/${encodeURIComponent(r.agent)}/settings`}:{}},x=await Mh(e,r.id,[...p.secrets,...y,...Object.values(p.tokens),...Object.values(i),...l?[l]:[],...a?[a]:[],...$f(c.env),...g?.flatMap(e=>$f(e.credential.env))??[]]);await bs(e,r.id,v);let S={task:b,tokens:{...p.tokens,...i},...a?{checksToken:a}:{},...m?{dashboard:m}:{},...h?{reviewAssets:h}:{},...d?{gitAuthor:d}:{},...l?{postToken:l}:{},credential:c,...g?{engineCredentials:g}:{},config:s,connections:p.mcp,connectionEnv:_,connectionSecrets:x};if(r.runner!==`vercel-sandbox`)return S;let C=e=>{let t=new Set(Xf(s,r,e).map(e=>e.name));return{...e,env:Object.fromEntries(Object.entries(e.env).map(([e,n])=>[e,t.has(e)?`brokered`:n]))}};return{...S,credential:C(c),...g?{engineCredentials:g.map(e=>({...e,credential:C(e.credential)}))}:{}}}function Wf(e){let t=e.models?.[0]?.model;return t?Ee(t).model:void 0}function Gf(e){let{name:t}=Gp(e);return t===`claude`||t===`ANTHROPIC_API_KEY`||t===`CLAUDE_CODE_OAUTH_TOKEN`?`claude`:t===`codex`||t===`OPENAI_API_KEY`?`codex`:`custom`}async function Kf(e,t){if(t.models)return t;let{models:n}=await Qp(e,yt(t),us(t));return{...t,models:tm(n,!!(t.runnerId||e.local))}}async function qf(e,t){let[n]=(await Kf(e,t)).models??[],r=n?Ee(n.model).engine:`claude`,i=n?.credential&&await e.store.get(`credential`,n.credential);if(i)return{engine:r,...hi(e.config,i)};if(!t.runnerId&&!e.local)throw Error(`no-credential`);return{engine:r,env:{}}}async function Jf(e,t,n){let r=e=>{try{return[At({model:e},n)]}catch{return[]}},{models:i}=await Kf(e,t),a=[...(i??[]).flatMap(e=>r(e.model)),...r(n.reviewModel).flatMap(e=>Pt(n,e)),...r().flatMap(e=>Pt(n,e))],o=[...new Set(a.flatMap(e=>Xp(e,n)))],s=us(t),c=await e.store.listCredentials({owner:t.requestedBy}),l=new Set(i?.flatMap(e=>e.credential??[])),u=Zp(c,o,s);return[...c.filter(e=>l.has(e.id)&&!u.includes(e)&&(!e.value.owner||e.value.owner===s)),...u].map(t=>({id:t.id,credential:{engine:Gf(t.id),...hi(e.config,t.value)}}))}const Yf=e=>e&&URL.canParse(e)?[new URL(e).hostname]:[];function Xf(e,t,n){if(n.engine!==`custom`)return ba;let r=e.models??{},i=t.usage?.model?r[t.usage.model]:void 0,a=(xe(i)?[i]:Object.values(r)).flatMap(e=>xe(e)&&e.envKey&&URL.canParse(e.baseUrl)?[{name:e.envKey,host:new URL(e.baseUrl).hostname,header:`authorization`,prefix:`Bearer `}]:[]);return[...ba,...a]}async function Zf(e,t,n){if(t.access===`auto`)return;let r=e.local?{}:await vf(e.store),i=new Set([...t.event?[t.event.integration]:[],...Object.keys(t.tools)]),a=Sa(n.engine,n.env);if(n.engine===`custom`)for(let e of Object.values(r.models??{}))xe(e)&&a.push(...Yf(e.baseUrl));let o=await bh(e,t);for(let n of o.ids){let r=await Km(e,n,yh(t),o.accounts);r?.provider===`mcp`?a.push(...Yf(r.endpoint?.url)):r&&i.add(r.provider)}for(let t of i)a.push(...e.integrations[t]?.hosts??[]);for(let e of Object.values(t.definition.mcp??{}))a.push(...Yf(e.url));for(let e of t.mcp??[])a.push(...Yf(r.mcp?.[e]?.url));for(let e of r.network?.allowedHosts??[]){let t=e.replace(/^\[(.*)\](?::\d+)?$/,`$1`).replace(/^([^:]+):\d+$/,`$1`);a.push(t,...Ar.isIP(t)?[]:[`*.${t}`])}return[...new Set(a)]}async function Qf(e,t){let n=await qf(e,t);if(!n)return;let r=await vf(e.store),i=[n,...(await Jf(e,t,q(e,r))).map(e=>e.credential)],a=await Promise.all(i.map(n=>Zf(e,t,n)));return{credential:Object.assign({},...i.map(e=>e.env).reverse()),hosts:a.some(e=>e===void 0)?void 0:[...new Set(a.flatMap(e=>e??[]))],brokered:i.flatMap(e=>Xf(r,t,e))}}function $f(e){let t=[];for(let[n,r]of Object.entries(e))if(!(!/(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)/i.test(n)&&!je(r))&&(t.push(r),n.endsWith(`_AUTH_JSON`))){let e=JSON.parse(r);t.push(...[e.OPENAI_API_KEY,...Object.entries(e.tokens??{}).filter(([e])=>/TOKEN|KEY|SECRET/i.test(e)).map(([,e])=>e)].filter(e=>typeof e==`string`))}return t}async function ep(e,t){return t.event?(await Rf(e,t)).flatMap(t=>t.token?[R(e.config,t.token)]:[]):[]}async function tp(e,t){let[n,r,i]=await Promise.all([Ph(e,t.task),vf(e.store).then(n=>Jf(e,t.task,q(e,n))),ep(e,t.task)]),a=e.store instanceof mr&&t.task.event&&!(await e.store.list(`snapshot`,{prefix:`connection-secrets:${t.task.id}:`,limit:1})).length?Object.values((await Bf(e,t.task)).tokens):[];return a.length&&await Mh(e,t.task.id,[...n,...i,...a]),[...n,...i,...a,...r.flatMap(e=>$f(e.credential.env))].filter(e=>e.length>=8)}var np=t({LOCAL_LOGINS:()=>Mp,answerLocalApproval:()=>wp,engineSignIn:()=>Fp,engineSignOut:()=>Ip,engineStatus:()=>Rp,inspectLocalTask:()=>fp,isLoginEngine:()=>Pp,localLog:()=>bp,localTask:()=>xp,localTaskAction:()=>Cp,localTasks:()=>ap,localUsage:()=>Tp,machineSignedIn:()=>Bp,pushLocalInbox:()=>yp,recoverLocalTasks:()=>mp,resumeLocalTask:()=>Sp,runLocalTask:()=>vp,startLocalTask:()=>lp,startQueuedLocalTask:()=>dp,stopLocalTasks:()=>hp,sweepLocalQueue:()=>op,syncLocalApprovals:()=>sp,syncLocalUsage:()=>Op});const rp=e=>!e.name?.startsWith(En),J=e=>e?Date.parse(e):void 0;function ip(e,t,n=!1){let r=J(t.createdAt)??0,i=le(N.join(w(e,t.id),`answers.json`)),a=Bt(w(e,t.id)),o=a.find(e=>!e.response),s=n?Lt(e,t.id,t):null,c=n?x(e,t.id).filter(e=>!E.includes(t.status)||(J(e.at)??0)<(J(t.resumedAt)??r)).map(e=>{let n=e.error&&typeof e.error==`object`?e.error.message:void 0;return{prompt:e.prompt??t.prompt??``,result:{ok:e.status===0,output:e.finalMessage??n??``},...n?{error:n}:{},finishedAt:J(e.at)}}):[];n&&(E.includes(t.status)||!c.length||(c.at(-1)?.finishedAt??0)<(J(t.resumedAt)??r))&&c.push({prompt:t.currentPrompt??t.prompt??``,...s?{result:{ok:s.status===0,output:s.finalMessage??s.error?.message??``}}:{},...t.error?{error:t.error}:{},...E.includes(t.status)?{}:{finishedAt:J(t.completedAt)}});let l=t.flowRunId?fn(t.flowRunId)?.name:void 0,u={task:{id:t.id,source:t.source??`cli`,agent:t.agentId??ot()??``,flow:l??`default`,...t.name?{name:t.name}:l?{name:l===`review`?`Review`:l}:{},runner:`local`,...t.cwd?{cwd:t.cwd}:{},...t.access?{access:t.access}:{},...t.prompt?{prompt:t.prompt}:{},definition:{integrations:{}},...t.engine?{usage:{engine:t.engine,...t.model?{model:t.model}:{},...t.effort?{effort:t.effort}:{}}}:{},tools:{}},status:o&&t.status===`running`?`waiting`:T(e,t)?`running`:t.status,attempts:1,...o?{approval:o}:{},...a.length?{approvals:a}:{},...i?{answer:i}:{},...s?{result:{ok:s.status===0,exitCode:null,output:s.finalMessage??s.error?.message??``},...s.tokens?{tokens:s.tokens}:{}}:{},...t.error?{error:t.error}:{},...t.fallbacks?.length?{fallbacks:t.fallbacks}:{},...t.archivedAt?{archivedAt:J(t.archivedAt)}:{},...t.autoArchived?{autoArchived:!0}:{},createdAt:r,startedAt:J(t.resumedAt)??r,...t.completedAt&&!E.includes(t.status)?{finishedAt:J(t.completedAt)}:{},updatedAt:J(t.updatedAt)??r,local:!0,...n?{turns:Jt(c,a)}:{}};return{...u,...Ih(u)}}function ap(e,t){let n=sn(e);return(t?_(e,{migrate:!1}):n).filter(rp).map(n=>{let r=ip(e,n);return t?{...r,archivedAt:r.archivedAt??r.updatedAt}:r})}async function op(e,t){let n=(e.now??Date.now)(),r=(await e.queue.list(e.organizationId,{archived:!1,statuses:[...se]})).filter(e=>he(e.finishedAt??e.updatedAt,n)&&ue(t,e)).map(e=>e.task.id);r.length&&await e.queue.archiveStopped(e.organizationId,n,r)}async function sp(e){let t=await e.store.list(`delivery`,{prefix:`approval:`});for(let n of new Set(t.map(e=>e.value.notice.task))){let t=await e.store.get(`task`,n);if(!t)continue;let r=t.task.cwd??e.local.cwd,i=Bt(w(r,n));await cp(e,r,n,i),await El(e,t.task,i)}}async function cp(e,t,n,r){let i=(e.now??Date.now)();for(let a of r){if(!a.response||a.response.deliveredAt||a.response.decision===`closed`||i-Date.parse(a.response.answeredAt??``)<6e4)continue;let r=C(t,n);if(!r)return;await ln(t,r,a.id,a.response.decision,{...a.response.reason?{reason:a.response.reason}:{},resume:r=>Sp(e,t,n,r)}).catch(e=>console.error(`coder server: could not deliver the answer to approval ${a.id}`,e))}}async function lp(e,t,n){if(!e.local||t.repo||(t.flow??`default`)!=="default"||t.runner&&t.runner!==`local`)return;let r=js(e,t)??e.local.cwd;await lr(e.store,r,e.integrations);let i=ot(),a=t.agent??i;if(!a)throw new H(`Name an agent: this server has no default agent.`);let{record:o,version:s}=await M(e.store,a);As(e,a,o);let c=await Ra(e,{requestedBy:e.session?.user.id,runner:t.runner,agent:s?.definition.runner}).catch(e=>{throw new H(e.message)});if(!(c.runner!==`local`||c.runnerId)){if(Fs(t),!n)return up(e,{id:ne(),source:`dashboard`,agent:a,flow:`default`,runner:`local`,cwd:r,...t.name?{name:t.name}:{},...t.access?{access:t.access}:{},prompt:t.prompt,definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{},connections:await ph(e,void 0,it(o?.settings?.connections,t.connections)),tools:{}},{input:t,cwd:r});try{let c=n?await e.store.get(`task`,n):void 0,l=c?.task.connections??await ph(e,void 0,it(o?.settings?.connections,t.connections)),u=await xh(e,c?.task??{connections:l,access:t.access,tools:{},definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{}}),d=Ge(u.mcp,u.env),f=a===i?void 0:await Cn(r,a,t.mcp?.join(`,`),d.mcp,void 0,t.access),p=f??jt(t.mcp?.join(`,`),Le(r).mcp,{},d.mcp),m=[],h=await It({taskId:n,prompt:t.prompt??``,outputSchema:t.outputSchema,cwd:r,name:t.name,appendSystem:t.appendSystem,addDirs:t.addDirs,engine:t.model?void 0:f?.engine,model:t.model??f?.model,effort:t.model?void 0:f?.effort,access:f?.access??t.access,...f?{agentPrompt:{developer:f.developer,access:Et({definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{}},c?.task.access)}}:{},mcp:p.mcp,mcpBindings:p.mcpBindings,mcpWarnings:[...p.warnings??[],...u.warnings],connectionEnv:d.env,connections:l,nativeMcp:p.nativeMcp,...f?{agentId:t.agent}:{},source:`dashboard`,onFallback:e=>m.push(e)},{waitForStartup:!1});return ip(r,m.length?ge(r,h.taskId,{fallbacks:m}):h.task)}catch(e){throw e instanceof m?new H(e.message,409):e}}}async function up(e,t,n){let r=(e.now??Date.now)();await e.store.put(`snapshot`,`local-start:${t.id}`,n),await e.queue.enqueue(e.organizationId,t,r,void 0,e.config.maxQueued??1e3),await Vl(e,!1,!0,!0);let i=await e.store.get(`task`,t.id);return i?.status===`queued`?i:xp(n.cwd,t.id)??i}async function dp(e,t,n){if(!e.local||t.task.runner!==`local`||t.task.runnerId||t.task.event?.repo)return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;try{let i=t.task.id,a,o=r.resume?x(r.cwd,t.task.id).length:0,s=t.task.flow==="default"?C(r.cwd,t.task.id):void 0,c=n?gp(e,t.task.id,n,await Hf(e)):void 0;if(s&&!r.resume)i=s.id;else if(r.resume){let n=C(r.cwd,t.task.id);if(!n)throw Error(`Local task is missing`);await cn(r.cwd,n,t.task.prompt??``,{onWorker:e=>{a=e},outputSchema:t.task.context?.outputSchema,...r.overrides,resolveConnections:n=>_p(e,t.task,n,c)})}else r.input?await lp(e,{...r.input,prompt:t.task.prompt,outputSchema:t.task.context?.outputSchema??r.input.outputSchema},t.task.id):i=(await vp(e,t.task,t.task.id,!0,c)).task.id;await e.store.put(`snapshot`,`local-start:${t.task.id}`,{...r,startedId:i});let l={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(!await e.queue.patchTask(e.organizationId,t.task.id,{handle:`cli:${i}`},(e.now??Date.now)(),l)){let e=C(r.cwd,i);return e&&await dn(r.cwd,e),!0}if(t.task.flow==="default"){let n={task:t.task,cwd:r.cwd,fence:l,turns:o};await e.store.put(`snapshot`,`completion:${i}`,n),pp(e,i,n,a);let s=ng(e,t.task.id);e.waitUntil&&e.waitUntil(s)}}catch(n){if(await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n instanceof Error?n.message:String(n)},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash})){let{reportTaskFailure:r}=await Promise.resolve().then(()=>Bc);await r(e,t,n)}}return!0}async function fp(e,t,n){if(t.status!==`running`&&t.status!==`waiting`||t.task.flow==="default"&&e.store.localFlows?.has(t.task.id)&&t.cancelRequestedAt===void 0&&(t.startedAt===void 0||n-t.startedAt<e.config.taskTimeoutMs))return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;let i={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(t.task.flow!=="default"){let r=fn(t.task.id);if(r?.status===`running`&&(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)){let n=e.store.localFlows?.get(t.task.id);n?(await n.stop(),await n.work.catch(()=>{})):r.pid!==process.pid&&await pn(t.task.id),r=fn(t.task.id)}return!r||r.status===`running`?!1:e.queue.finish(e.organizationId,t.task.id,{status:t.cancelRequestedAt===void 0?r.status===`completed`?`completed`:`failed`:`cancelled`,error:r.error},n,i)}let a=xp(r.cwd,r.startedId??t.task.id);if(!a)return!1;if([`queued`,`running`,`waiting`].includes(a.status))if(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs){let e=C(r.cwd,r.startedId??t.task.id);e&&await dn(r.cwd,e),a=xp(r.cwd,t.task.id)}else return!1;let o=a.status;if(o!==`completed`&&o!==`failed`&&o!==`cancelled`)return!1;let s=await e.queue.finish(e.organizationId,t.task.id,{status:o,result:a.result,error:a.error},n,i);return s&&Fc(e,t.task),s}function pp(e,t,n,r){let i=e.store.completionWatches??=new Map;if(i.has(t))return;let a={stopped:!1,work:Promise.resolve()};i.set(t,a),a.work=(async()=>{let i=`completion:${t}:${n.fence?.generation??0}`,o=await e.store.get(`delivery`,i);if(o&&!o.owner)return;if(o?.posting!==void 0){console.error(`coder server: local completion ${t} has an interrupted post for turn ${o.posting+1}; retained for reconciliation`);return}if(o?.pid)try{process.kill(o.pid,0);return}catch(e){if(e.code!==`ESRCH`)return}let s=I(),c={owner:s,pid:process.pid,pending:!0,turns:o?.turns??n.turns??0};if(o?.owner){if(!await e.store.updateDelivery(i,o.owner,c))return}else if(!await e.store.create(`delivery`,i,c))return;let l=async()=>{if(!n.fence)return!0;let t=await e.store.get(`task`,n.task.id);return t&&(t.generation??0)===n.fence.generation&&t.attempts===n.fence.attempts&&t.tokenHash===n.fence.tokenHash&&t.status!==`queued`},u,d=async()=>{let t=n.task.event;if(!t||n.task.source!==t.integration)throw Error(`The task has no conversation`);if(!await l())throw Error(`The conversation task is no longer running`);if(!u){let r=await e.store.get(`app`,t.appId);if(!r)throw Error(`Local completion has no app`);let{eventReplies:i}=await Promise.resolve().then(()=>ad);u=await i(e,r,t,await e.store.get(`task`,n.task.id))}return u},f=async(t,r)=>{let i=await(await d()).post(t,r);c.posting!==void 0&&(c={...c,turns:c.posting+1,posting:void 0}),i&&await hc(e,n.task.event,i.ids??(i.id?[i.id]:[]),Date.now())},p=de(),m=h(n.cwd,t,r),g=100,_=new Map;try{for(let r=0;r<5;r++)try{let r=async(e,r,i)=>{if(n.task.source!==n.task.event?.integration)return;at(`completion.reply`,{id:t});let a=Dn(n.task,e,r,i);a.skipped&&pe(n.cwd,t,{kind:`status`,message:rn});let o=c.turns===(n.turns??0)?a.notice:void 0;a.text&&!a.duplicate&&await f(a.text,o)};for(;;){if(a.stopped||!await l())return;let o=C(n.cwd,t);if(!o)return;let u=x(n.cwd,t);for(let t of u.slice(c.turns)){t.status!==0&&e.local&&(e.local.engineChecks=void 0);let a={finalMessage:t.finalMessage,error:t.error},o=Dn(n.task,a,!1,t),l=n.task.source===n.task.event?.integration&&o.text&&!o.duplicate;l&&await d();let u=c.turns+1;if(c={...c,posting:l?c.turns:void 0},!await e.store.updateDelivery(i,s,c)||(await r(a,!1,t),c={...c,turns:u,posting:void 0},!await e.store.updateDelivery(i,s,c)))return}let f=Bt(w(n.cwd,t)).filter(e=>_.get(e.id)!==`${e.response?.answeredAt??``}:${e.response?.deliveredAt??``}`);if(f.length){await El(e,{...n.task,id:t},f);for(let e of Bt(w(n.cwd,t)))_.set(e.id,`${e.response?.answeredAt??``}:${e.response?.deliveredAt??``}`)}let h=S(n.cwd,o,p);if(!E.includes(h.status)&&!(h.pid&&v(h.pid,h,p))&&!In(w(n.cwd,t))&&(h.status!==`completed`||u.length>(n.turns??0))){let a=await e.store.get(`task`,n.task.id);n.fence&&a&&(a.generation??0)===n.fence.generation&&a.attempts===n.fence.attempts&&a.tokenHash===n.fence.tokenHash&&await fp(e,a,(e.now??Date.now)())&&Hl(e,!0);let o=h.status===`cancelled`;if((o||h.error)&&u.at(-1)?.prompt!==(h.currentPrompt??h.prompt??null)){if(!await e.store.updateDelivery(i,s,c))return;await r({error:{message:h.error??`Task cancelled`}},o)}let l=await e.store.get(`task`,n.task.id),{endTyping:d}=await Promise.resolve().then(()=>ad);l&&await d(e,l).catch(e=>console.error(`coder server: could not clear the working indicator of ${t}`,e));break}await m.wait(g),g=Math.min(1e3,g*2)}await e.store.updateDelivery(i,s,{posted:!0,turns:c.turns,at:Date.now()})&&(await e.store.get(`snapshot`,`completion:${t}`))?.fence?.generation===n.fence?.generation&&await e.store.delete(`snapshot`,`completion:${t}`);return}catch(n){if(r===4)throw n;console.error(`coder server: local completion ${t} attempt ${r+1} failed, retrying`,n);let i=e.now??Date.now,o=i()+5e3*2**r;for(;!a.stopped&&i()<o;)await new Promise(e=>setTimeout(e,Math.min(100,o-i())))}}finally{m.close(),await e.store.updateDelivery(i,s,{...c,pid:void 0})}})().catch(e=>{console.error(`coder server: local completion ${t} failed`,e)}).finally(()=>{i.delete(t)})}async function mp(e){if(e.local)for(let{id:t,value:n}of await e.store.list(`snapshot`,{prefix:`completion:`}))C(n.cwd,t.slice(11))&&pp(e,t.slice(11),n)}async function hp(e){await Promise.all([...e.store.localFlows?.values()??[]].map(async e=>{await e.stop(),await e.work.catch(()=>{})}));let t=e.store.completionWatches;if(t){for(let e of t.values())e.stopped=!0;await Promise.all([...t.values()].map(e=>e.work))}}function gp(e,t,n,r){return{url:`http://127.0.0.1:${e.local.port}/tasks/${encodeURIComponent(t)}`,token:n,...r?{dashboard:r}:{}}}async function _p(e,t,n,r){let{tokens:i}=await Bf(e,t),a=await xh(e,{...t,connections:n},i);await Mh(e,t.id,[...a.secrets,...Object.values(a.tokens)]);let o=Ge(a.mcp,a.env),s=gn(t,a.tokens,r);return{mcp:o.mcp,env:{...o.env,...s.env},warnings:a.warnings}}async function vp(e,t,n,r=!1,i){if(t.event?.repo){let r=(e.now??Date.now)(),i=n??t.id;return await e.store.get(`task`,i)||await e.queue.enqueue(e.organizationId,{...t,id:i},r,void 0,e.config.maxQueued??1e3),await Vl(e,!1,!1,!0),await e.store.get(`task`,i)}if(!r){let r=js(e,t)??e.local.cwd;return up(e,{...t,id:n??ne(),cwd:r},{cwd:r})}let{tokens:a}=await Bf(e,t),o=await xh(e,t,a);await bs(e,n??t.id,o.warnings),await Mh(e,n??t.id,[...o.secrets,...Object.values(o.tokens)]);let s=o.tokens,c=t.event&&a[t.event.integration],l=js(e,t)??e.local.cwd,u=await e.store.get(`task`,n??t.id),d={task:t,cwd:l,...u?{fence:{generation:u.generation??0,attempts:u.attempts,tokenHash:u.tokenHash,statuses:[`running`,`waiting`]}}:{}},f=t.flow!=="default"&&n?fn(n):void 0;if(f){let r=_e(l).find(e=>e.flowRunId===n),i=(e.now??Date.now)();return r?ip(l,r):{task:t,status:f.status===`running`?`running`:f.status===`completed`?`completed`:`failed`,attempts:1,createdAt:i,updatedAt:i,local:!0}}if(t.flow==="default"){n??=ne();let r=`completion:${n}`,i=await e.store.get(`snapshot`,r);if(i&&Gh(i.task)!==Gh(t))throw Error(`Local completion belongs to another session`);i||await e.store.create(`snapshot`,r,d)}let p=t.flow==="default"&&n?C(l,n):void 0;if(p){let n;return p.status===`queued`&&!p.pid&&(n=Ft(l,p.id,{...Ge(o.mcp,o.env).env,...gn(t,s,i).env})),pp(e,p.id,d,n),ip(l,p)}let m,h=new Promise(e=>m=e),g,_;g=Tn({cwd:l,agent:t.agent,flow:t.flow,task:t,taskId:n,toolEnvironment:{tokens:s},...i?{replyEndpoint:i}:{},connections:o.mcp,connectionEnv:o.env,availability:e.local?.engineChecks&&e.local.engineChecks.expiresAt>Date.now()?e.local.engineChecks.availability:void 0,onModel:zp(e),post:!1,...c?{postToken:c}:{},source:t.source,onStart:n=>{(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{n.requestStop(),await mn(n.runId,n.runningIds())},work:g}),m(t.id)},onWorker:(e,t)=>{_=t},onTask:e=>{m(e)}}).then(async n=>(t.flow==="default"&&n.taskId&&(d.turns=n.turn??d.turns,await e.store.put(`snapshot`,`completion:${n.taskId}`,d),pp(e,n.taskId,d,_)),n)).finally(async()=>{if(e.store.localFlows?.delete(t.id),t.flow!=="default"){let n=await e.store.get(`task`,t.id);n&&n.attempts===d.fence?.attempts&&n.tokenHash===d.fence?.tokenHash&&(n.generation??0)===d.fence?.generation&&await fp(e,n,(e.now??Date.now)()),Hl(e,!0)}}),t.flow==="default"&&(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{let e=C(l,n??t.id);e&&await dn(l,e)},work:g}),g.catch(()=>{e.local&&(e.local.engineChecks=void 0)});let v=await Promise.race([h,g.then(()=>void 0)]),y=v?C(l,v):void 0,b=(e.now??Date.now)();return y&&ip(l,y)||{task:t,status:t.flow!=="default"&&fn(t.id)?.status===`running`?`running`:`completed`,attempts:1,createdAt:b,updatedAt:b,local:!0}}async function yp(e,t,n){let r=t.handle.slice(4),i=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!i)throw Error(`Local task launch is missing`);let a={generation:t.generation??0,seq:-1,answers:[]};for(let o of n){let n=await e.store.get(`task`,t.task.id);if(!n||n.attempts!==t.attempts||n.tokenHash!==t.tokenHash||(n.generation??0)!==o.generation||![`running`,`waiting`].includes(n.status))break;let s=C(i.cwd,r);if(!s)throw Error(`Local task is missing`);let c=o.kind===`cancel`?await dn(i.cwd,s):await Rn(i.cwd,{...s,name:void 0},o,n=>_p(e,t.task,n));o.kind===`ask`&&a.answers.push({seq:o.seq,value:c}),a.seq=o.seq}return a}function bp(e,t,n=-1,r){let i=``;try{i=P.readFileSync(N.join(w(e,t),`log.jsonl`),`utf8`)}catch{}let a=i.split(`
+`).flatMap((e,t)=>{if(!e||t<=n)return[];let r=tn(e);if(!r)return[{seq:t,at:0,level:`out`,line:e}];let i=r.kind===`error`?`err`:[`status`,`info`,`steer`].includes(r.kind??``)?`sys`:`out`;return[{seq:t,at:J(r.at)??0,level:i,line:r.message??``,entry:r}]});return r===void 0?a:a.slice(0,r)}function xp(e,t,n=!0){let r=C(e,t);return r&&rp(r)?ip(e,S(e,r),n):void 0}async function Sp(e,t,n,r,i,a={},o={},s){let c=e.store.completionWatches?.get(n);c&&await c.work;let l=(e.now??Date.now)(),u=await e.store.get(`task`,n);u&&[`running`,`waiting`].includes(u.status)&&(await fp(e,u,l),u=await e.store.get(`task`,n));let d={...u?await Us(e,u.task):{},prompt:r,context:{...u?.task.context,...o,...i?{outputSchema:i}:{}},...s?{event:s}:{}};if(await e.store.put(`snapshot`,`local-start:${n}`,{cwd:t,resume:!0,...Object.keys(a).length?{overrides:a}:{}}),u){if(!await e.queue.continueTask(e.organizationId,n,d,l,{attempts:u.attempts,generation:u.generation??0}))return!1}else{let r=C(t,n);if(!r)throw Error(`No task "${n}"`);await e.queue.enqueue(e.organizationId,{...ip(t,r).task,...d},l,void 0,e.config.maxQueued??1e3)}return await Vl(e,!1,!0,!0),!0}async function Cp(e,t,n,r,i){let a=C(t,n);if(!a||!rp(a))return Response.json({error:`No task "${n}"`},{status:404});let o=S(t,a),s=E.includes(o.status),c=e.method===`POST`?await e.json().catch(()=>({})):{},l=(e,t=409)=>Response.json({error:e},{status:t}),u=Ps(c,[`engine`,`effort`]);if(u)return l(u,400);if(e.method===`DELETE`&&!r){if(s&&await dn(t,o),on(t,o),i){let e=i.store.completionWatches?.get(n);e&&(e.stopped=!0,await e.work),await i.store.delete(`task`,n),await i.store.delete(`snapshot`,`local-start:${n}`),await i.store.delete(`snapshot`,`completion:${n}`),Hl(i,!0)}return Response.json({ok:!0})}if(e.method!==`POST`)return new Response(`Method not allowed`,{status:405});if(r===`cancel`)return s?(await dn(t,o),Response.json({ok:!0})):l(`No running or queued task "${n}"`,404);if(r===`archive`)return ie(t,o),i&&await i.queue.patchTask(i.organizationId,n,{archivedAt:(i.now??Date.now)(),autoArchived:void 0},(i.now??Date.now)()),Response.json({ok:!0});if(r===`steer`){let e=String(c.text??``);if(!e.trim())return l(`text is required`,400);let r=s?void 0:c.outputSchema,a=Object.fromEntries([`model`,`access`].flatMap(e=>typeof c[e]==`string`&&c[e]?[[e,c[e]]]:[]));if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))return l(`outputSchema must be an object`,400);try{if(!s&&i){if(!await Sp(i,t,n,e,r,a))return l(`Task is already active`);let o=await i.store.get(`task`,n);return Response.json(o?.status===`queued`?{...o,statusReason:`Waiting for a task slot`}:xp(t,n))}let c=await cn(t,o,e,{...typeof r==`object`&&r?{outputSchema:r}:{},...a});return Response.json(s?c:xp(t,n))}catch(e){return l(e.message)}}if(r===`ask`){let e=String(c.question??c.text??``);if(!e.trim())return l(`question is required`,400);let r=await un(t,o,e,{...typeof c.model==`string`&&c.model?{model:c.model}:{}}),i=r.finalMessage??r.error?.message??``,a=N.join(w(t,n),`answers.json`);return re(a,[...le(a)??[],i]),Response.json({ok:!0,answer:i})}return r===`approve`?wp(t,n,c,i):new Response(`Not found`,{status:404})}async function wp(e,t,n,r){let i=C(e,t);if(!i||!rp(i))return Response.json({error:`No task "${t}"`},{status:404});let a=S(e,i),o=Bt(w(e,t)),s=o.filter(e=>e.response?.decision!==`accept`&&e.response?.decision!==`closed`),c=String(n.approvalId??n.id??Vt(w(e,t))[0]?.id??``);if(o.some(e=>e.id===c&&e.response?.decision===`closed`))return Response.json({error:zt(c)},{status:409});if(!s.some(e=>e.id===c))return Response.json({error:`Task "${t}" has no approval "${c}" to answer`},{status:409});try{await ln(e,a,c,n.decision===`deny`||n.decision===`decline`?`decline`:`accept`,{...typeof n.reason==`string`?{reason:n.reason}:{},...typeof n.by==`string`&&n.by?{by:n.by}:{},...r?{resume:n=>Sp(r,e,t,n)}:{}})}catch(e){if(e instanceof m)return Response.json({error:e.message},{status:400});throw e}return Response.json({ok:!0})}function Tp(e,t=new Set,n=!0){let r=Ep(t);return[..._e(e),...n?_(e,{migrate:!1}):[]].filter(rp).flatMap(e=>Dp(e,r))}function Ep(e){let t=new Map;for(let n of e){let e=n.lastIndexOf(`:`),r=n.slice(4,e),i=t.get(r)??[];i.push(Number(n.slice(e+1))),t.set(r,i)}return t}function Dp(e,t){let n=e.turnUsage??[],r=t.get(e.id)??[];t.set(e.id,r);let i=J(e.createdAt)??0;return n.flatMap(t=>{let n=J(t.at);if(n===void 0||!Number.isFinite(n))return[];let a=J(e.resumedAt),o=a!==void 0&&a>=i&&a<=n?a:i,s=r.includes(n);return i=n,s?[]:(r.push(n),[[`cli:${e.id}:${n}`,{taskId:e.id,agent:e.agentId??ot()??``,target:e.source??`cli`,...e.engine?{engine:e.engine}:{},...t.model??e.model?{model:t.model??e.model}:{},credential:`local`,runnerElapsedMs:Math.max(0,n-o),...t.tokens?{tokens:t.tokens}:{},at:n}]])})}function Op(e){let t=e.local;return t.usageSync??=jp(e).finally(()=>t.usageSync=void 0)}async function kp(e){try{return JSON.parse(await P.promises.readFile(e,`utf8`))}catch{return null}}async function Ap(e){return(await Promise.all([`job.json`,`results.jsonl`,`result.json`].map(async t=>{let n=await P.promises.stat(N.join(e,t)).catch(()=>void 0);return n?`${n.mtimeMs}:${n.ctimeMs}:${n.size}`:``}))).join(`|`)}async function jp(e){let t=e.local;await t.cacheMaintenance;let n=y(),r=await kp(n),i=await e.store.list(`usage`,{prefix:`cli:`}),a=new Set(i.map(e=>e.id)),o=0,s=async()=>{++o%4==0&&await new Promise(e=>setImmediate(e))};if(t.archiveScan===void 0)for(let[t,n]of Object.entries(r?.rows??{}))a.has(t)||(await e.store.put(`usage`,t,n),a.add(t)),await s();let c=Ep(a),l=(await P.promises.stat(b(t.cwd)).catch(()=>void 0))?.mtimeMs??0,u={},d=new Set,f=!1;for await(let{id:n,dir:i,archived:a}of te(t.cwd)){if(await s(),d.has(n))continue;let t=a?await Ap(i):void 0;if(a&&r?.counted?.[n]===t){u[n]=t,d.add(n);continue}let o=await kp(N.join(i,`job.json`));if(o){if(o.agent&&(o.engine=o.agent),d.add(n),rp(o))for(let[t,n]of Dp(o,c))await e.store.put(`usage`,t,n),f=!0,await s();a&&(u[n]=t)}}if(f||r?.archive!==l||JSON.stringify(r?.counted)!==JSON.stringify(u)){let t=await e.store.list(`usage`,{prefix:`cli:`});await P.promises.mkdir(N.dirname(n),{recursive:!0});let r=ee(n);try{await P.promises.writeFile(r,`${JSON.stringify({archive:l,counted:u,rows:Object.fromEntries(t.map(e=>[e.id,e.value]))})}\n`),await P.promises.rename(r,n)}finally{await P.promises.rm(r,{force:!0})}}t.archiveScan=l}const Mp=`A local server stores no engine credentials. Tasks use this machine's own claude and codex sign-in.`,Np={claude:{file:`claude`,args:[`auth`,`status`,`--json`],command:`claude auth login`,login:[`auth`,`login`],logout:[`auth`,`logout`],ok:e=>JSON.parse(e).loggedIn===!0},codex:{file:`codex`,args:[`login`,`status`],command:`codex login`,login:[`login`],logout:[`logout`],ok:()=>!0}},Pp=e=>e in Np;function Fp(e){let t=Np[e];kr(t.file,t.login,{detached:!0,stdio:`ignore`}).on(`error`,()=>{}).unref()}function Ip(e){let t=Np[e];return new Promise(e=>Or(t.file,t.logout,{timeout:15e3},()=>e()))}function Lp(e){return new Promise(t=>Or(e.file,e.args,{timeout:15e3},(n,r)=>{try{t(!n&&e.ok(r))}catch{t(!1)}}))}async function Rp(e){let t=e?.local;if(t?.engineChecks&&t.engineChecks.expiresAt>Date.now())return t.engineChecks.work;let n={},r=Promise.all([Lp(Np.claude),Lp(Np.codex)]).then(([e,r])=>(t&&(n.claude=Rt(`claude`,process.env,t.cwd),n.codex=Ot(t.cwd)),{claude:{signedIn:e,command:Np.claude.command},codex:{signedIn:r,command:Np.codex.command}})).catch(e=>{throw t?.engineChecks?.work===r&&(t.engineChecks=void 0),e});return t&&(t.engineChecks={expiresAt:Date.now()+3e4,availability:n,work:r}),r}function zp(e){let t;return async n=>n.model!==t&&(t=n.model,Bp(e,Ee(n.model)))}async function Bp(e,t){if(!e.local)return!1;if(t.engine!==`custom`)return(await Rp(e))[t.engine]?.signedIn===!0;let n=t.model?Le(e.local.cwd).models?.[t.model]:void 0;return!!(n&&xe(n)&&process.env[n.envKey??`OPENAI_API_KEY`])}var Vp=t({addCredential:()=>um,agentModels:()=>em,checkCredential:()=>Yp,completeLogin:()=>fm,connectionFix:()=>bm,createCredential:()=>Tm,credentialEnv:()=>lm,credentialFix:()=>ym,credentialId:()=>Wp,credentialNames:()=>Xp,credentialSummary:()=>mm,deleteCredential:()=>Em,failureText:()=>xm,listCredentials:()=>wm,listRunsOn:()=>am,modelAttempts:()=>tm,modelProblem:()=>om,parseCredentialId:()=>Gp,personalOnly:()=>sm,pickCredentials:()=>Zp,removeCredential:()=>dm,reseal:()=>vm,resolveModels:()=>Qp,runsOn:()=>rm,runsOnEach:()=>im,signInEngine:()=>Dm,signOutEngine:()=>Om,visibleCredentials:()=>cm,writeBackCodexAuth:()=>gm});const Hp={claude:`ANTHROPIC_API_KEY`,codex:`OPENAI_API_KEY`},Up={claude:`CLAUDE_CODE_OAUTH_TOKEN`,codex:`CODEX_AUTH_JSON`};function Wp(e,t){return e?`${e}/${t}`:t}function Gp(e){let t=e.lastIndexOf(`/`);return t<0?{name:e}:{owner:e.slice(0,t),name:e.slice(t+1)}}function Kp(e){let[t=``]=Object.keys(e);return Object.keys(Up).find(e=>Up[e]===t)??t}var qp=class extends Error{status;constructor(e,t){super(`Credential check failed: ${e}${t?` ${t}`:``}`),this.status=e}};function Jp(e){if(e.OPENAI_API_KEY)return e.OPENAI_API_KEY;if(e.CODEX_AUTH_JSON)try{let t=JSON.parse(e.CODEX_AUTH_JSON);return t.OPENAI_API_KEY??t.tokens?.access_token??t.access_token}catch{throw Error(`CODEX_AUTH_JSON is not valid JSON`)}}async function Yp(e,t=fetch){if(e.engine===`custom`)return;let n,r;if(e.engine===`claude`){let t=e.env.ANTHROPIC_API_KEY,i=e.env.CLAUDE_CODE_OAUTH_TOKEN;if(!t&&!i)throw Error(`Claude credentials need ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN`);n=`https://api.anthropic.com/v1/models`,r={"anthropic-version":`2023-06-01`,...t?{"x-api-key":t}:{authorization:`Bearer ${i}`,"anthropic-beta":`oauth-2025-04-20`}}}else{let t=Jp(e.env);if(!t)throw Error(`Codex credentials need OPENAI_API_KEY or CODEX_AUTH_JSON`);n=`https://api.openai.com/v1/models`,r={authorization:`Bearer ${t}`}}let i=await t(n,{method:`GET`,headers:r});if(!i.ok)throw new qp(i.status,i.statusText)}function Xp(e,t){if(e.engine===`claude`||e.engine===`codex`)return[e.engine,Hp[e.engine]];let n=e.model?t.models?.[e.model]:void 0;return[n&&xe(n)&&n.envKey||Hp.codex]}function Zp(e,t,n){return(n?[n,void 0]:[void 0]).flatMap(n=>t.flatMap(t=>e.filter(e=>e.id===Wp(n,t))))}async function Qp(e,t,n){let[r,i]=await Promise.all([K(e),e.store.listCredentials({owner:n})]),a=q(e,r),o=Pt(a,At(t,a)),s=await $p(e,a,i,o,n);return{models:s,attempts:tm(s),first:o[0]}}async function $p(e,t,n,r,i){return Promise.all(r.map(async r=>{let a=Zp(n,Xp(r,t),i).map(e=>e.id);return{model:ce(r),option:r,credentials:a,...!a.length&&await Bp(e,r)?{machine:!0}:{}}}))}async function em(e,t,n){let[r,i]=await Promise.all([K(e),e.store.listCredentials({owner:n})]),a=q(e,r),o=[`claude`,`codex`,...Object.entries(a.models??{}).flatMap(([e,t])=>xe(t)?[`custom/${e}`]:[])],[s,c]=await Promise.all([$p(e,a,i,Pt(a,At(t,a)),n),$p(e,a,i,o.map(e=>At({model:e},a)))]);return{models:s,unrunnable:o.filter((e,t)=>!c[t].credentials.length&&!c[t].machine)}}function tm(e,t=!1){return e.flatMap(e=>e.credentials.length?e.credentials.map(t=>({model:e.model,credential:t})):e.machine||t?[{model:e.model}]:[])}const nm={claude:`Claude`,codex:`Codex`,custom:`Custom`};function rm(e,t){let n=Se(e.option),r=nm[e.option.engine]??e.option.engine;return e.machine?`${n} on this machine's ${r} sign-in`:e.credentials.length?`${n} on ${e.credentials.map(e=>{let{owner:n,name:i}=Gp(e),a=n?n===t?`the personal`:`the starter's`:`the workspace's`;return Object.hasOwn(Up,i)?`${a} ${r} subscription`:`${a} ${Object.values(Hp).includes(i)?`${r} key`:i}`}).join(`, then `)}`:`${n}: no credential, skipped`}async function im(e,t,n=e.session?.user.id){let r=await e.store.listCredentials({owner:n}),i=q(e,t),a=await Promise.all([...i.chain,i.reviewModel].map(async t=>{try{let a=At({model:t},i),[o]=await $p(e,i,r,[a],n);return[t,rm(o,n)]}catch(e){return[t,`${t}: ${e.message}`]}}));return Object.fromEntries(a)}function am(e,t){let n=e.filter(e=>e.credentials.length||e.machine);return n.length?n.map(e=>rm(e,t)).join(`, then `):`No credential runs any listed model`}async function om(e,t,n=!1,r){if(!t.engine&&!t.model)return;let[i]=(await Qp(e,t,r)).models;if(i.credentials.length||i.machine)return;let a=i.option.engine,o=nm[a]??a,s=t.model?`${t.model} (${o})`:o,c=`Add one in Settings → ${a===`custom`?`Models`:`Credentials`}`;return`No credential runs ${s}. ${`${n?`[${c}](${await ym(e,a)})`:c}, or pick another model.`}`}const sm=e=>{let t=e[0];return!!(t&&!t.machine&&t.credentials.length&&t.credentials.every(e=>Gp(e).owner))};async function cm(e,t,n){return(await e.listCredentials({owner:t,limit:n})).filter(e=>!e.value.owner||e.value.owner===t)}async function lm(e,t){let n=e.session?.user.id,[r]=Zp(await cm(e.store,n),[t],n);return(r?hi(e.config,r.value).env[t]:void 0)??(e.local?br.env[t]:void 0)}async function um(e,t,n,r=Date.now){let i=n.owner||void 0,a=Wp(i,Kp(n.env)),o=!1;return await e.withCredential(`credential`,a,async e=>{o=!!e;let s={...mi(t,{env:n.env}),...i?{owner:i}:{},...n.account?{account:n.account}:{},createdAt:r()};return[{id:a,value:s}]}),{id:a,replaced:o}}function dm(e,t){return e.withCredential(`credential`,t,async e=>e&&[{id:t,value:null}])}async function fm(e,t,n,r){let i=await e.get(`login`,t);if(!i)return!1;let a=Wp(i.owner,i.engine);return e.withCredential(`credential`,a,async(e,o,s)=>{if(await s.patchLogin(t,{state:`done`},{state:[`starting`,`open`,`verifying`],tokenHash:n,owner:i.owner}))return[{id:a,value:{...r,owner:i.owner}}]})}function pm(e){if(e.CODEX_AUTH_JSON)return`••••`;let t=Object.values(e)[0]??``;return t.length>16?`${t.slice(0,5)}••••`:`••••`}function mm(e,t,n){let{name:r}=Gp(t);return{name:r,scope:n.owner?`personal`:`workspace`,subscription:Object.hasOwn(Up,r),createdAt:n.createdAt??0,masked:pm(hi(e,n).env),...n.account?{account:n.account}:{}}}const hm=e=>{try{return Date.parse(JSON.parse(e??``).last_refresh??``)}catch{return NaN}};function gm(e,t,n,r){return e.withCredential(`credential`,n,async e=>{if(!e)return;let{env:i}=hi(t,e);if(!(!i.CODEX_AUTH_JSON||!(hm(r)>(hm(i.CODEX_AUTH_JSON)||0))))return[{id:n,value:{...e,...mi(t,{env:{...i,CODEX_AUTH_JSON:r}})}}]})}function _m(e,t){return gi(e,t.iv===`plain`?`plain.${t.ciphertext}`:`${t.iv}.${t.tag}.${t.ciphertext}`)}async function vm(e,t,n=Date.now){if(!t.encryptionKey)throw Error(`SERVER_ENCRYPTION_KEY is required to rotate keys`);let r=di(t.encryptionKey),i=e=>gi(t,e)!==r,a=e=>i(e)?L(t,R(t,e)):e,o=e=>{let t=e.token&&a(e.token);if(t!==e.token)return{...e,token:t}},s=0;for(let{id:t}of await e.list(`app`))await e.withAppLock(t,async e=>{let n=await e.get(`app`,t);return!n||!i(n.credentials)?!1:(await e.put(`app`,t,{...n,credentials:a(n.credentials)}),!0)})&&s++;for(let{id:t}of await e.list(`installation`))await e.withCredential(`installation`,t,async e=>{let n=e&&o(e);return n&&[{id:t,value:n}]})&&s++;for(let{id:t}of await e.list(`connection`))await e.withAppLock(`connection:${t}`,async e=>{let n=await e.get(`connection`,t);return!n?.secret||!i(n.secret)?!1:(await e.put(`connection`,t,{...n,secret:a(n.secret)}),!0)})&&s++;for(let{id:t}of await e.list(`snapshot`)){let r=t.startsWith(`connection-secrets:`)?t.slice(19).replace(/:[a-f0-9]{24}$/,``):t.startsWith(`connections:`)?t.slice(12).replace(/:\d+:\d+:[a-f0-9]{12}$/,``):void 0;await e.withAppLock(r?`connections:${r}`:t,async e=>{let o=await e.get(`snapshot`,t);if(!o)return!1;let s=`resolvedConnections`in o?`resolvedConnections`:`secret`in o?`secret`:void 0;if(!s)return!1;let c=r?await e.get(`task`,r):void 0;if(!c||[`completed`,`failed`,`cancelled`].includes(c.status))return await e.delete(`snapshot`,t),!1;let l=o[s];return i(l)?(await e.put(`snapshot`,t,{...o,[s]:a(l)},{ttlMs:`expiresAt`in o&&typeof o.expiresAt==`number`?Math.max(1,o.expiresAt-n()):36e5}),!0):!1})&&s++}for(let{id:t}of await e.list(`runner`))await e.withCredential(`runner`,t,async e=>{if(!(!e||!i(e.secret)))return[{id:t,value:{...e,secret:a(e.secret)}}]})&&s++;for(let{id:n}of await e.list(`credential`))await e.withCredential(`credential`,n,async e=>{if(!(!e||_m(t,e)===r))return[{id:n,value:{...e,...mi(t,hi(t,e))}}]})&&s++;return s}async function ym(e,t,n){let r=Rv(n??await Lv(e),t===`custom`?`/settings/models`:`/settings/credentials`);return`${e.config.publicUrl?.replace(/\/$/,``)??``}${r}${t===`custom`?``:`?engine=${encodeURIComponent(t)}`}`}async function bm(e,t,n){let r=Rv(n??await Lv(e),`/settings/connections`);return`${e.config.publicUrl?.replace(/\/$/,``)??``}${r}?connect=${encodeURIComponent(t)}`}async function xm(e,t,n){return`There was a problem with your connected model. If you have access to it, [Check the model](${await ym(e,t,n)}).`}const Sm=f({env:n(c().check(l(/^[A-Z_][A-Z0-9_]*$/)),c().check(u(1))),workspace:i(a()),noCheck:i(a())}),Cm=`Only an owner or admin of this workspace can change workspace credentials.`;async function wm(e,t,n,r){let i=t.session?.user.id,a=e=>`${e.scope}/${e.name}`,o=(e,t)=>e.localeCompare(t)||(e<t?-1:+(e>t)),s=r.searchParams.get(`fields`);if(s&&s!==`id`)return D({error:`Invalid fields`},400);if(s===`id`){let e=Nn(r),n=O(r,200),a=(await t.store.list(`credential`,{visibleTo:i,...e?{after:e}:{},limit:k(r)?n+1:n})).map(({id:e})=>({id:e}));return D(k(r)?Fn(a,n,e=>e.id):a)}let c=(await cm(t.store,i,k(r)?void 0:O(r,200))).map(e=>mm(t.config,e.id,e.value)).sort((e,t)=>o(a(e),a(t)));if(!k(r))return D(c.slice(0,O(r,200)));let l=Nn(r),u=r.searchParams.get(`q`)?.trim().toLowerCase(),d=c.filter(e=>!u||[e.name,e.account?.email??``].some(e=>e.toLowerCase().includes(u))).filter(e=>!l||o(a(e),l)>0);return D(Fn(d,O(r),a))}async function Tm(e,t,n,r){let i=t.session?.user.id,a=await e.json().catch(()=>void 0),o=Sm.safeParse(a);if(!o.success||Object.keys(o.data.env).length!==1)return D({error:`Invalid credential`},400);let{env:s}=o.data,c=!!o.data.workspace||!i;if(c&&!p_(t))return D({error:Cm},403);if(s.CODEX_AUTH_JSON)return D({error:`Sign in with Codex on the Credentials page instead.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&!t.config.subscriptions?.claude)return D({error:`Claude subscriptions are off on this server; add an API key.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&c&&t.auth)return D({error:`A Claude subscription is personal; add it without --workspace.`},400);let l=c?void 0:i,u=s.CLAUDE_CODE_OAUTH_TOKEN?`claude`:Object.keys(Hp).find(e=>Hp[e]in s)??`custom`;try{o.data.noCheck||await Yp({engine:u,env:s},t.fetch??fetch);let{id:e,replaced:n}=await um(t.store,t.config,{...l?{owner:l}:{},env:s},t.now??Date.now);return D({ok:!0,name:Gp(e).name,replaced:n})}catch(e){return e instanceof qp?D({error:e.message},e.status):(console.error(`coder server: could not save credential`,e),D({error:`Could not save credential. Please try again.`},500))}}async function Em(e,t,n,r){let i=t.session?.user.id,a=r.searchParams.has(`workspace`)||!i;if(a&&!p_(t))return D({error:Cm},403);let o=Wp(a?void 0:i,n.name);return await dm(t.store,o)?D({ok:!0}):D({error:`Unknown credential`},404)}async function Dm(e,t,n,r){let i=n.engine;return Fp(i),t.local&&(t.local.engineChecks=void 0),D(await Rp())}async function Om(e,t,n,r){let i=n.engine;return await Ip(i),t.local&&(t.local.engineChecks=void 0),D(await Rp())}var km=t({ConnectionError:()=>Zm,addConnection:()=>ih,authorizeConnection:()=>fh,changeConnection:()=>ah,connectNotice:()=>Vm,connectionAllowed:()=>qm,connectionAuthorization:()=>sh,connectionGrants:()=>ph,connectionRow:()=>Fm,connectionRows:()=>eh,createConnection:()=>lh,deleteConnection:()=>dh,findConnection:()=>Km,listConnections:()=>ch,nativeApp:()=>Ym,nativeConnectionId:()=>Lm,nativeConnections:()=>Rm,nativeCredential:()=>Im,needsReconnect:()=>Wm,personalGrants:()=>mh,removeConnection:()=>oh,updateConnection:()=>uh});const Am=c().check(l(/^[a-z0-9][a-z0-9_-]*$/i)),jm=r([e({header:c().check(l(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/))}),e({env:c().check(l(/^[A-Za-z_][A-Za-z0-9_]*$/))})]),Mm=e({name:c().check(u(1)),id:i(Am),provider:i(Am),scope:i(s([`personal`,`workspace`])),access:i(s(ye)),endpoint:i(Oe),auth:i(s([`none`,`key`,`oauth`])),key:i(c().check(u(1))),keyIn:i(jm),credential:i(c().check(u(1)))}),Nm=e({name:i(c().check(u(1))),access:i(s(ye)),key:i(c().check(u(1)))});function Pm(e,t){let n=t.endpoint;if(t.provider===`env`)return!n&&t.auth===`key`&&t.access===`auto`&&!!t.keyIn&&`env`in t.keyIn&&fe(t.keyIn.env);if(t.provider!==`mcp`)return!n;if(!n||n.command&&t.access===`read-only`&&!n.tools?.length||n.tools?.some(e=>!et(e)))return!1;if(n.url){let r=URL.parse(n.url);if(!r||!Ke(r,!!e.local)||t.keyIn&&`env`in t.keyIn)return!1}else if(t.auth!==`none`&&(!t.keyIn||!(`env`in t.keyIn)))return!1;return t.auth===`oauth`&&!n.url?!1:![...Object.values(n.headers??{}),...Object.values(n.env??{})].some(je)}function Fm(e,t,n,r){let i=!!e.secret;if(e.auth===`oauth`&&e.provider===`mcp`&&e.secret&&n)try{i=!!R(n,e.secret).accessToken}catch{i=!1}return{id:e.id,name:e.name,provider:e.provider,scope:e.owner?`personal`:`workspace`,auth:e.auth,...e.access?{access:e.access}:{},...e.owner?{owner:{id:e.owner,...r?{name:r}:{}},...t===e.owner?{asker:!0}:{}}:{},...e.endpoint?.url?{url:e.endpoint.url}:{},...e.endpoint?.command?{command:e.endpoint.command}:{},...e.provider===`env`&&e.keyIn&&`env`in e.keyIn?{env:e.keyIn.env}:{},...e.account?{account:e.login??e.account}:{},status:e.broken||e.auth===`oauth`&&!i?`needs-auth`:`connected`,createdAt:e.createdAt}}function Im(e,t){let n=R(e,t);return typeof n==`string`?{token:n,app:void 0}:n}const Lm=(e,t,n)=>`${e}:${t}-${Fr(`sha256`).update(n).digest(`hex`).slice(0,12)}`;async function Rm(e,t,n){return!t||!e.auth?.linkedAccounts?[]:zm(e,t,n??await e.auth.linkedAccounts(t,e.store))}function zm(e,t,n){return n.filter(t=>t.token&&t.organizationId===e.organizationId&&t.organizations?.includes(e.organizationId)&&e.integrations[t.platform]?.auth.user).map(n=>({id:Lm(t,n.platform,n.platformUserId),name:e.integrations[n.platform].name??n.platform,provider:n.platform,owner:t,auth:`oauth`,secret:n.token,account:n.platformUserId,...n.login?{login:n.login}:{},oauthApp:Im(e.config,n.token).app,...n.refusedAt?{broken:{at:n.refusedAt,reason:`Needs reconnecting`}}:{},createdAt:0}))}async function Bm(e,t){return e.auth?.organizationAccounts?e.auth.organizationAccounts(e.organizationId,e.store):e.auth?.linkedAccounts?(await Promise.all(t.map(async t=>(await e.auth.linkedAccounts(t,e.store)).map(e=>({...e,userId:t}))))).flat():[]}async function Vm(e,t,n){let{models:r,attempts:i}=n,a=r.filter(e=>(e.option.engine===`claude`||e.option.engine===`codex`)&&!i.some(t=>t.model===e.model)).map(e=>e.option.engine);if(!a.length)return;let o=[...new Set((await e.store.list(`credential`)).flatMap(({id:e})=>{let{owner:t,name:n}=Gp(e);return t&&a.some(e=>e===n)?[t]:[]}))];if(!o.length)return;let s=(await Bm(e,o)).filter(e=>e.platform===t.id);if(o.every(e=>s.some(t=>t.userId===e)))return;let c=await bm(e,t.id,n.slug),l=`[Connect ${t.name}](${c}) to run on a personal subscription.`,u=await e.store.create(`delivery`,`notice:${n.task}:${t.id}:${n.actor}`,{at:(e.now??Date.now)()},{ttlMs:2592e6});return{url:c,failure:`No model could run. ${l}`,...u?{notice:l}:{}}}async function Hm(e,t,n){return(await e.store.list(`connection`,{visibleTo:t,secrets:n})).map(e=>e.value).filter(e=>!e.owner||e.owner===t)}async function Um(e,t,n){let r=await Rm(e,t);return Gm(await Hm(e,t,n),r)}async function Wm(e,t){return(await Um(e,t,`oauth`)).some(n=>Fm(n,t,e.config).status===`needs-auth`)}function Gm(e,t){let n=e.map(e=>{if(!e.owner||e.provider===`mcp`||e.auth!==`oauth`)return e;let n=t.find(t=>t.owner===e.owner&&t.provider===e.provider&&(!e.account||e.account===t.account));return{...e,secret:n?.secret,account:n?.account??e.account,...n?.login?{login:n.login}:{},...n?.broken&&!e.broken?{broken:n.broken}:{}}});return[...n,...t.filter(e=>!n.some(t=>t.id===e.id||t.owner===e.owner&&t.provider===e.provider&&t.account===e.account))]}async function Km(e,t,n,r){let i=await e.store.get(`connection`,t);return i?!i.owner||i.owner===n?i:void 0:(await Rm(e,n,r)).find(e=>e.id===t)}async function qm(e,t,n){if(e.method===`GET`)return t;if(n.id){let e=await Km(t,n.id,t.session?.user.id);if(!e)return D({error:`Unknown connection`},404);if(e.owner===t.session?.user.id&&e.owner)return t}else{let n=await e.clone().json().catch(()=>void 0);if(n?.scope===`personal`||n?.provider&&![`mcp`,`env`].includes(n.provider))return t.auth&&t.session&&!t.local?t:D({error:`Personal connections need a signed-in member`},400)}return g_(t,`Only workspace owners and admins can manage workspace connections`)}var Jm=class extends Error{};async function Ym(e,t,n,r){let i=e.integrations[t]?.auth.user;if(i){if(!r){let[t,n]=await Promise.all([$v(e),e.store.list(`app`)]),i=ot(),a=n.map(e=>e.value);r=[...t,...a.filter(e=>e.agent===i),...a.filter(e=>e.agent!==i)]}return r.find(r=>{if(r.integration!==t||n&&r.id!==n)return!1;try{return i.authorizeUrl(R(e.config,r.credentials),{publicUrl:e.config.publicUrl??`https://coder.invalid`,state:``}),!0}catch{return!1}})}}async function Xm(e,t,n){if(t.provider===`mcp`)return Mv(e,t,n);if(!await Ym(e,t.provider))throw new Jm(`No OAuth client is available for ${e.integrations[t.provider]?.name??t.provider}.`);let r=new URLSearchParams({connection:t.id,organization:e.organizationId,attempt:F(18).toString(`base64url`)});return`/connect/${encodeURIComponent(t.provider)}?${r}`}var Zm=class extends Error{status;needs;constructor(e,t,n){super(t),this.status=e,this.needs=n}};const Y=(e,t)=>new Zm(e,t);async function Qm(e,t=200){try{return D(await e(),t)}catch(e){if(e instanceof Zm)return D({error:e.message,...e.needs?{needs:e.needs}:{}},e.status);throw e}}async function $m(e){return e.json().catch(()=>void 0)}async function eh(e,t){let n=e.session?.user.id??e.taskPrincipal?.asker,r=e.taskPrincipal?e.store.get(`task`,e.taskPrincipal.task).then(e=>e?.task):Promise.resolve(void 0),i=th(e,r).catch(e=>(console.error(`coder server: could not list app installations`,e),[])),a=(await e.store.list(`connection`,{secrets:`oauth`})).map(e=>e.value),o=await Bm(e,[...new Set([...a.flatMap(e=>e.owner??[]),...n?[n]:[]])]),s=new Map(o.map(e=>[e.userId,e.name]));e.session?.user.name&&s.set(e.session.user.id,e.session.user.name);let c=Gm(a,o.flatMap(t=>zm(e,t.userId,[t]))),l=t?await e.store.get(`delivery`,`connection-authorized:${t}`):void 0,u=await r,d=u&&new Set((await(await Promise.resolve().then(()=>hh)).turnConnections(e,u)).ids);return[...c.map(r=>{let i=Fm(r,n,e.config,r.owner&&s.get(r.owner));return t&&r.auth===`oauth`&&(!l||!(`target`in l)||l.target!==`${r.id}:${r.createdAt}`)&&(i.status=`needs-auth`),d&&!d.has(r.id)?i.status=`disabled`:d&&r.provider!==`env`&&(i.server=Ye(r)),i}),...await i]}async function th(e,t){let n=e.store.list(`app`),[r,i,a,o]=await Promise.all([e.store.list(`installation`,{active:!0}),n,$v(e,n),t]),s=new Map([...i.map(e=>e.value),...a].map(e=>[e.id,e])),c=[...new Set(r.flatMap(e=>s.get(e.value.app)?.agent??[]))],l=new Map((c.length?await e.store.listAgentsWithVersions(c):[]).map(e=>[e.record.id,e])),u=o?.event&&`${o.event.appId}:${o.event.installationId}`;return r.flatMap(({id:t,value:n})=>{let r=s.get(n.app),i=e.integrations[n.integration];if(!r||!i)return[];let a=l.get(r.agent),c=a?.version?.definition.access===`read-only`||a?.record.settings?.access===`read-only`,d={id:t,name:i.name,provider:n.integration,scope:`workspace`,agent:r.agent,...c?{access:`read-only`}:{},auth:`none`,account:`${a?.record.name??r.name}'s app in ${n.account.login}`,status:`connected`,createdAt:n.createdAt};return o&&(r.agent!==o.agent||!(n.integration in o.tools)||!o.event&&!o.parent?d.status=`disabled`:d.server=hn(_n(n.integration,t===u?void 0:n.account.login))),[d]})}async function nh(e,t,n,r){if(n.key&&n.credential)throw Y(400,`Give a key or a credential, not both`);if(n.key){let{id:i,replaced:a}=await um(e.store,e.config,{...r?{owner:r}:{},env:{[t]:n.key}},e.now??Date.now);return a?{id:i}:{id:i,created:!0}}let i=(await cm(e.store,r)).filter(n=>hi(e.config,n.value).env[t]!==void 0),a=n.credential?i.find(e=>e.id===n.credential):i.find(e=>r&&e.value.owner===r)??i.find(e=>!e.value.owner);if(!a)throw Y(400,n.credential?`Credential ${n.credential} does not hold ${t}`:`No credential holds ${t}; give its key`);return{id:a.id}}async function rh(e,t,n){let r=t.keyIn.env;return(await nh(e,r,{key:n},t.owner)).id}async function ih(e,t){let n=Mm.safeParse(t);if(!n.success)throw Y(400,`Invalid connection`);let r=n.data,i=r.id??r.name.toLowerCase().replace(/[^a-z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``);if(!Am.safeParse(i).success)throw Y(400,`Invalid connection id`);if(i.endsWith(`-user`))throw Y(400,`Names ending in -user are kept for members' own connections`);let a=r.provider??`mcp`,o=a!==`mcp`&&a!==`env`;if(o&&r.scope!==void 0)throw Y(400,`Platform connections are personal and take no scope.`);let s=o||r.scope===`personal`?e.session?.user.id:void 0;if((o||r.scope===`personal`)&&(!s||!e.auth||e.local))throw Y(400,`Personal connections need a signed-in member`);if(a!==`mcp`&&a!==`env`&&!e.integrations[a]?.auth.user)throw Y(400,`This integration does not support user OAuth`);if(a===`env`&&r.auth&&r.auth!==`key`)throw Y(400,`Environment connections require a key`);if(a!==`env`&&r.credential)throw Y(400,`Only environment connections use a credential`);let c=a===`env`?`key`:a===`mcp`?r.auth??(r.key?`key`:`none`):`oauth`;if(c===`key`&&!r.key&&a!==`env`)throw Y(400,`A key is required`);if(r.key&&c!==`key`)throw Y(400,`A key needs key authentication`);let l={id:s?`${s}:${i}`:i,name:r.name,provider:a,...s?{owner:s}:{},...r.access||a===`env`?{access:r.access??`auto`}:{},auth:c,...r.endpoint?{endpoint:r.endpoint}:{},...r.keyIn?{keyIn:r.keyIn}:{},...r.key&&a!==`env`?{secret:L(e.config,{key:r.key})}:{},createdAt:(e.now??Date.now)()};if(!Pm(e,l))throw Y(400,`Invalid endpoint or read-only tools`);if(await e.store.get(`connection`,l.id))throw Y(409,`Connection already exists`);let u;if(a===`mcp`&&r.endpoint?.url&&!r.auth&&!r.key){try{if(u=await Tv(e,r.endpoint.url,!0),!u)try{let t=await tt(Qe({...l,access:`auto`},void 0),e.fetch,AbortSignal.timeout(5e3));await t.initialize().finally(()=>t.close())}catch(t){if(!(t instanceof $e)||!t.authenticate||(u=await Tv(e,r.endpoint.url,!0,t.authenticate),!u))throw t}u&&(l.auth=`oauth`)}catch(e){throw e instanceof $e?new Zm(400,`${new URL(r.endpoint.url).hostname} takes a key, not a sign-in.`,`key`):(console.error(`coder server: connection discovery failed`,e),Y(502,`Could not start authorization`))}if(l.auth===`oauth`&&e.local?.port===0)throw Y(400,`Signing in needs a Coder server. Repeat with --server <url>, or add it in coder dash.`)}let d=a===`env`?await nh(e,r.keyIn.env,r,s):void 0;if(d&&(l.credential=d.id),!await e.store.withAppLock(`connection:${l.id}`,e=>e.create(`connection`,l.id,l)))throw d?.created&&await dm(e.store,d.id),Y(409,`Connection already exists`);try{let t=l.auth===`oauth`?await Xm(e,l,u):void 0;return{...Fm(l,s,e.config,e.session?.user.name),...t?{authorize:t}:{}}}catch(t){throw t instanceof Jm||console.error(`coder server: connection authorization failed`,t),await e.store.withAppLock(`connection:${l.id}`,async e=>{let t=await e.get(`connection`,l.id);Lr(t,l)&&await e.delete(`connection`,l.id)}),t instanceof Jm?Y(400,t.message):Y(502,`Could not start authorization`)}}async function ah(e,t,n){let r=Nm.safeParse(n);if(!r.success)throw Y(400,`Invalid connection settings`);return e.store.withAppLock(`connection:${t}`,async n=>{let i=await Km({...e,store:n},t,e.session?.user.id);if(!i)throw Y(404,`Unknown connection`);let{key:a,access:o,...s}=r.data;if(a&&i.auth!==`key`)throw Y(400,`This connection does not use a key`);let c={...i,...s,...o?{access:o}:{},...a&&i.provider!==`env`?{secret:L(e.config,{key:a})}:{},...a?{broken:void 0}:{},updatedAt:(e.now??Date.now)()};if(!Pm(e,c))throw Y(400,`Invalid read-only tools`);return a&&i.provider===`env`&&(c.credential=await rh({...e,store:n},i,a)),await n.put(`connection`,c.id,c),Fm(c,e.session?.user.id,e.config,e.session?.user.name)})}async function oh(e,t){await e.store.withAppLock(`connection:${t}`,async n=>{let r=await Km({...e,store:n},t,e.session?.user.id);if(!r)throw Y(404,`Unknown connection`);if(r.owner&&r.provider!==`mcp`&&r.provider!==`env`){let t=await e.auth?.linkedAccounts?.(r.owner,n)??[];for(let i of t.filter(e=>e.platform===r.provider&&(!r.account||e.platformUserId===r.account)))await e.auth?.unlink?.(r.owner,i.platform,i.platformUserId,n)}await n.delete(`connection`,r.id)})}async function sh(e,t){let n=await Km(e,t,e.session?.user.id);if(!n||n.auth!==`oauth`)throw Y(404,`Unknown OAuth connection`);try{return await Xm(e,n)}catch(e){throw e instanceof Jm||console.error(`coder server: connection authorization failed`,e),e instanceof Jm?Y(400,e.message):Y(502,`Could not start authorization`)}}async function ch(e,t){let n=new URL(e.url),r=n.searchParams.get(`authorization`)??void 0,i=n.searchParams.get(`wait`);if(!r||!i)return D(await eh(t,r));let a=await t.store.watch(`delivery`,`connection-authorized:${r}`),o=Date.now()+25e3;try{for(;;){let n=await eh(t,r),s=n.find(e=>e.id===i);if(!s||s.status===`connected`||Date.now()>=o||e.signal.aborted)return D(n);await a.wait(Math.min(1e4,o-Date.now()),e.signal)}}finally{a.close()}}async function lh(e,t){let n=await $m(e);return Qm(()=>ih(t,n),201)}async function uh(e,t,n){let r=await $m(e);return Qm(()=>ah(t,n.id,r))}async function dh(e,t,n){return Qm(async()=>(await oh(t,n.id),{ok:!0}))}async function fh(e,t,n){return Qm(async()=>({url:await sh(t,n.id)}))}async function ph(e,t,n){return(await Um(e,t)).filter(e=>n===void 0||n.includes(e.id)).map(e=>e.id)}async function mh(e,t,n){let[r,i]=await Promise.all([e.auth?.linkedAccounts?e.auth.linkedAccounts(t,e.store):[],Hm(e,t)]);return{ids:Gm(i,await Rm(e,t,r)).filter(e=>e.owner===t&&(n===void 0||n.includes(e.id))).map(e=>e.id),accounts:r}}var hh=t({connectionSecretValues:()=>Nh,connectionToken:()=>kh,deleteTaskConnections:()=>Fh,readTaskConnectionSecrets:()=>Ph,resolveConnections:()=>xh,resolvedTaskConnections:()=>Ah,secretRows:()=>jh,taskAsker:()=>yh,taskConnectionSecrets:()=>Mh,turnConnections:()=>bh});function gh(e){try{let t=JSON.parse(e);return[e,t.accessToken,t.refreshToken].filter(e=>typeof e==`string`&&!!e)}catch{return[e]}}const _h=e=>e.endpoint?.url?URL.parse(e.endpoint.url)?.host:void 0;async function vh(e,t){let n=t.credential?await e.store.get(`credential`,t.credential):void 0;if(!n||n.owner&&n.owner!==t.owner)throw Error(`Missing credential`);let r=hi(e.config,n).env[t.keyIn.env];if(!r)throw Error(`Missing key`);return r}const yh=e=>e.context?.asker??(ls(e)?void 0:e.requestedBy);async function bh(e,t){let n=yh(t),r=t.event&&n?await mh(e,n,t.usage?.connections):void 0;return{...r,ids:[...new Set([...t.connections??[],...r?.ids??[]])]}}async function xh(e,t,n={},r,i){let a={},o={},s={...n},c=Et(t,t.access),l=e=>Re(e.access,c),u=[],d=[],f=yh(t),{ids:p,accounts:m}=i??await bh(e,t),h=p.length?await e.store.list(`connection`,{ids:p,visibleTo:f,secrets:`all`}):[],g=new Set(h.map(e=>e.id)),_,v=p.some(e=>!g.has(e))?await Rm(e,f,m).catch(e=>(console.error(`coder server: native connection lookup failed`,e),_=e,[])):[],y=new Map([...v.map(e=>[e.id,e]),...h.map(({id:e,value:t})=>[e,t])]),b=await Promise.allSettled(p.map(async e=>{if(!y.has(e)&&_)throw _;return{id:e,value:y.get(e)}})),x=Je(b.flatMap(e=>e.status===`fulfilled`&&e.value.value?[e.value.value]:[]));for(let n of b){let i,s=``;try{if(n.status===`rejected`)throw n.reason;if({id:s,value:i}=n.value,!i||i.owner&&i.owner!==f)continue;if(i.provider===`env`&&(i.auth!==`key`||i.access!==`auto`||i.endpoint||!i.credential||!i.keyIn||!(`env`in i.keyIn)||!fe(i.keyIn.env)||x.has(i.keyIn.env)||`local`in e&&e.local&&process.env[i.keyIn.env]!==void 0))throw Error(`Invalid environment connection`);if(i.owner&&i.provider===`env`){let e=r?await r(i):`Its owner has not approved it`;if(e){u.push(e);continue}}if(i.auth===`oauth`||i.owner&&i.provider===`mcp`&&i.auth===`key`){let n=l(i);if(i.provider===`mcp`)a[s]={...Qe({...i,access:n},void 0),connection:s,credentialOnUse:qe(i),connectionCreatedAt:i.createdAt,description:Ze(i),access:n,...i.owner?{owner:i.owner,account:i.login??i.account}:{}};else{let r=e.integrations[i.provider];if(!r)throw Error(`Unknown integration`);a[s]=vn(i,[...r.tools.presets[n]],t.event)}continue}if(i.broken){u.push(`${i.name} needs reconnecting.`);continue}let c;if(i.provider===`env`)c=await vh(e,i);else if(i.auth===`key`){if(!i.secret)throw Error(`Missing credential`);if(c=R(e.config,i.secret).key,!c)throw Error(`Missing key`)}if(c&&d.push(c),i.provider===`env`)o[i.keyIn.env]=c;else if(i.provider===`mcp`){let e=l(i);a[s]={...Qe({...i,access:e},c),connection:s,description:Ze(i),access:e}}}catch(e){u.push(Xe(i?.name??`A connection`,e))}}return{mcp:a,env:o,tokens:s,warnings:u,secrets:d}}const Sh=(e,t)=>`connections:${e.task.id}:${e.generation??0}:${e.attempts}:${Fr(`sha256`).update(JSON.stringify([t,yh(e.task)])).digest(`hex`).slice(0,12)}`,Ch=[`invalid_grant`,`invalid_token`,`bad_refresh_token`,`expired_token`],wh=e=>({at:(e.now??Date.now)(),reason:`Needs reconnecting`}),Th=e=>((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)}));function Eh(e,t,n,r,i,a){return e.store.withAppLock(`connection:${t}`,async o=>{let s=await o.get(`connection`,t);if(!s?.secret||s.auth!==`oauth`||s.broken||s.owner!==n)return;if(s.createdAt!==a.connectionCreatedAt||s.endpoint?.url!==a.url)throw Error(`The connection changed since the task resolved it`);let c=R(e.config,s.secret);i.push(...[c.accessToken,c.refreshToken].filter(e=>!!e));let l=!!c.accessToken&&Ve(c.accessToken)===r;if(!l&&c.accessToken&&c.expiresAt===void 0)return c.accessToken;try{return await Ue({secret:c,now:(e.now??Date.now)(),fetch:Th(e),force:l,save:async n=>{i.push(...[n.accessToken,n.refreshToken].filter(e=>!!e)),await o.put(`connection`,t,{...s,secret:L(e.config,n)})}})}catch(n){if(console.error(`coder server: token refresh failed`,ze({connection:t,host:_h(s)},n)),!(n instanceof rt))throw n;await o.put(`connection`,t,{...s,broken:wh(e)});return}})}async function Dh(e,t,n,r,i){let a=e.integrations[t.provider];if(!a?.auth.user)throw Error(`Missing user OAuth`);let{owner:o,provider:s}=t;if(!o)return;let c=(n=[],r=t.account)=>n.find(t=>t.platform===s&&t.token&&t.organizationId===e.organizationId&&t.organizations?.includes(e.organizationId)&&(!r||t.platformUserId===r)),l=t.account??c(await e.auth?.linkedAccounts?.(o,e.store))?.platformUserId;if(!l)return;let u=n?.integration===s?await e.store.get(`app`,n.appId):void 0,d=await Promise.all([$v(e),e.store.list(`app`)]).then(([e,t])=>[...e,...t.map(e=>e.value),...u?[u]:[]]);return e.store.withAppLock(`native:${o}:${s}:${l}`,async n=>{let f=await Km({...e,store:n},t.id,o);if(!f||f.owner!==o||f.provider!==s||f.broken)return;let p=c(await e.auth?.linkedAccounts?.(o,n),l);if(!p?.token||p.refusedAt)return;let m=Im(e.config,p.token);i.push(...gh(m.token));let h=await Ym(e,s,m.app??f.oauthApp??u?.id,d);if(!h)throw Error(`Missing integration credentials`);let g=t=>a.auth.user.access(m.token,R(e.config,h.credentials),{fetch:Th(e),now:(e.now??Date.now)(),force:t}),_;try{_=await g(!1),!_.refreshed&&Ve(_.accessToken)===r&&(_=await g(!0))}catch(t){if(console.error(`coder server: token refresh failed`,ze({integration:s,account:l},t)),!(t instanceof ve&&Ch.includes(t.error??``)))throw t;await e.auth?.refuseLinkedToken?.(o,s,p.platformUserId,p.token,n);return}if(_.refreshed){i.push(...gh(_.refreshed));let t=L(e.config,{app:h.id,token:_.refreshed});if(!await e.auth?.refreshLinkedToken?.(o,s,p.platformUserId,p.token,t,n)){let e=Error(`Linked account changed during refresh`);throw console.error(`coder server: token refresh failed`,ze({integration:s,account:l},e)),e}}return _.accessToken})}function Oh(e,t,n,r){if(t.createdAt!==r.connectionCreatedAt||t.endpoint?.url!==r.url)throw Error(`The connection changed since the task resolved it`);let i=t.secret&&R(e.config,t.secret).key;return i&&Ve(i)!==n?i:void 0}async function kh(e,t,n,r,i={},a){let o=a??await Km(e,n,yh(t)),s=o?.auth===`key`&&o.owner&&o.provider===`mcp`;if(!o||o.auth!==`oauth`&&!s||o.broken)return{name:o?.name};let c=[],l=s?Oh(e,o,r,i):o.provider===`mcp`?await Eh(e,n,o.owner,r,c,i):await Dh(e,o,t.event,r,c);return await Mh(e,t.id,[...c,...l?[l]:[]]),{name:o.name,...l?{token:l}:{}}}async function Ah(e,t,n,r){let i=await bh(e,t.task);if(!i.ids.length)return{mcp:{},env:{},tokens:n,warnings:[],secrets:[],saved:!1};let a=Sh(t,i.ids),o=await e.store.get(`snapshot`,a);if(o&&`resolvedConnections`in o){let t=R(e.config,o.resolvedConnections);if(!t.warnings.length)return{...t,tokens:{...t.tokens,...n},saved:!0}}let s=await xh(e,t.task,n,r,i);return s.warnings.length||await e.store.withAppLock(`connections:${t.task.id}`,async n=>{let r=await n.get(`task`,t.task.id);if(!r||[`completed`,`failed`,`cancelled`].includes(r.status)||r.attempts!==t.attempts||(r.generation??0)!==(t.generation??0))return;let i=(t.startedAt??(e.now??Date.now)())+(e.config.taskTimeoutMs??36e5);await n.put(`snapshot`,a,{resolvedConnections:L(e.config,s),expiresAt:i},{ttlMs:Math.max(1,i-(e.now??Date.now)())})}),{...s,saved:!1}}function jh(e,t,n){let r=(e.now??Date.now)()+(e.config.taskTimeoutMs??36e5);return[...new Set(n)].filter(e=>e.length>=8).map(n=>({id:`connection-secrets:${t}:${Fr(`sha256`).update(n).digest(`hex`).slice(0,24)}`,value:L(e.config,n),expiresAt:r}))}async function Mh(e,t,n){let r=jh(e,t,n);return r.length&&await e.store.saveTaskSecrets(t,r),[...new Set(n)].filter(e=>e.length>=8)}async function Nh(e,t){let n=[],r=[...new Set(t.connections??[])],i=r.length?await e.store.list(`connection`,{ids:r,visibleTo:t.requestedBy,secrets:`all`}):[],a=r.some(e=>!i.some(t=>t.id===e))?await Rm(e,t.requestedBy):[],o=new Map([...a.map(e=>[e.id,e]),...i.map(({id:e,value:t})=>[e,t])]);for(let t of r){let r=o.get(t);if(r?.provider===`env`){n.push(...await vh(e,r).then(e=>[e],()=>[]));continue}if(!r?.secret)continue;let i=R(e.config,r.secret);n.push(...typeof i==`string`?[i]:[...`token`in i&&typeof i.token==`string`?gh(i.token):[],i.key,i.accessToken,i.refreshToken,i.clientSecret].filter(e=>!!e))}return n}async function Ph(e,t){let[n,r,i]=await Promise.all([e.store.get(`snapshot`,`connection-secrets:${t.id}`),e.store.list(`snapshot`,{prefix:`connection-secrets:${t.id}:`}),Nh(e,t)]);if(n)throw Error(`Task ${t.id} keeps its secrets in the old single-row layout`);let a=r.flatMap(t=>`secret`in t.value?[R(e.config,t.value.secret)]:[]);return[...new Set([...a,...i])]}async function Fh(e,t){await e.withAppLock(`connections:${t}`,async e=>{await e.delete(`snapshot`,`connection-secrets:${t}`);for(let n of[`connection-secrets:${t}:`,`connections:${t}:`])for(let t of await e.list(`snapshot`,{prefix:n}))await e.delete(`snapshot`,t.id)})}function Ih(e,t=Date.now()){let n=e.status===`running`||e.status===`waiting`?t:e.finishedAt??e.updatedAt;return{lastActivityAt:Math.max(e.updatedAt,e.lastSeenAt??0),lastTurnMs:e.startedAt===void 0?0:Math.max(0,n-e.startedAt)}}const Lh=e=>({[e.key.slice(0,e.key.indexOf(`:`))]:e.through});var Rh=class extends Error{};const X=[`queued`,`running`,`waiting`];function zh(e,t){if(t.since!==void 0&&(e.updatedAt<t.since||e.updatedAt===t.since&&(!t.sinceId||e.task.id<=t.sinceId)))return!1;let n=t.status?[t.status]:t.statuses;if(t.status===`waiting`){if(!$t(e.status,e.approvals??e.task.context?.approvals))return!1}else if(n&&!n.includes(e.status))return!1;if(t.agent&&e.task.agent!==t.agent||t.source&&e.task.source!==t.source||t.parent&&e.task.parent!==t.parent||t.runnerId&&e.task.runnerId!==t.runnerId||t.archived!==void 0&&t.archived!==(e.archivedAt!==void 0)||!ds(t.viewer,e.task))return!1;let r=t.q?.trim().toLowerCase();return!r||[e.task.prompt??e.task.event?.text,e.task.agent,e.task.id].some(e=>e?.toLowerCase().includes(r))}const Bh=e=>({rank:en(e.status),createdAt:e.createdAt,id:e.task.id}),Vh=e=>({updatedAt:e.updatedAt,id:e.task.id}),Hh=(e,t)=>e.updatedAt-t.updatedAt||nn(e.task.id,t.task.id),Uh=(e,t)=>an(Bh(e),Bh(t)),Wh=(e,t)=>!t||(`updatedAt`in t?e.updatedAt>t.updatedAt||e.updatedAt===t.updatedAt&&e.task.id>t.id:an(Bh(e),t)>0);function Gh(e){let t=e.event;return JSON.stringify([t?.appId,t?.installationId,t?.chat?.thread.id,e.agent])}function Kh(e,t){return e.flow==="default"&&!!e.event?.chat&&Gh(e)===Gh(t)}const qh=6e5;async function Jh(e,t){let n=t.task.id,r={generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,handle:t.handle??null};return e.queue.deleteTask(e.organizationId,n,r)}const Yh=(e,t)=>({...e,context:{...e.context,approvals:Xt(e.context?.approvals??[],t)}}),Xh=(e,t)=>({...e,context:{...e.context,admissions:{...e.context?.admissions,...t}}});async function Zh(e,t,n,r,i,a){let o=t.task.id,s=await e.queue.appendInbox(e.organizationId,o,n,r,(e.now??Date.now)(),t.generation??0,i,a);return s&&await ng(e,o,t.task,t),s}async function Qh(e,t,n=-1,r){return r??=(await e.store.get(`task`,t))?.generation??0,e.queue.readInbox(e.organizationId,t,r,n)}const $h=new Set([`completed`,`failed`,`cancelled`]);var eg=class{store;lock=Promise.resolve();tombstones=new Map;spaces=new Map;constructor(e){this.store=e}async metrics(e,t){let n=await this.list(e),r={queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0};for(let e of n)e.createdAt>=t&&r[e.status]++;return{tasks:r,queueDepth:n.filter(e=>e.status===`queued`).length}}serial(e){let t=this.lock.then(e,e);return this.lock=t.catch(()=>{}),t}async read(e){return this.store.get(`task`,e)}async enqueue(e,t,n,r,i){return this.serial(()=>this.insert(t,n,r,i))}async insert(e,t,n,r){let i=n&&await this.store.get(`delivery`,n.key);if(i&&!i.pending)return!1;e=i?.pending?.task??e;let a=await this.read(e.id);if(!a&&r!==void 0&&(await this.store.list(`task`)).filter(e=>e.value.status===`queued`).length>=r)throw Error(`Organization task queue is full`);return n&&!i?.pending?.task&&await this.store.put(`delivery`,n.key,{at:t,...n.owner?{owner:n.owner}:{},pending:{task:e}}),a||await this.store.put(`task`,e.id,{task:{...e,...cs(e)},status:`queued`,attempts:0,createdAt:t,updatedAt:t}),n&&await this.store.put(`delivery`,n.key,{at:t},{ttlMs:n.ttlMs}),!0}async nextSeq(e){let t=await this.store.list(`inbox`,{prefix:`${e}:`}),n=(await this.store.list(`delivery`)).flatMap(t=>t.value.pending?.inbox?.id.startsWith(`${e}:`)?[t.value.pending.inbox.entry.seq]:[]);return Math.max((await this.read(e))?.inboxSeq??-1,...t.map(e=>e.value.seq),...n)+1}async admit(e,t,n){if(!t)return;let{conversation:r,unseen:i}=t;r&&await this.store.putMany(`delivery`,[{id:r.key,value:r.record},{id:r.root,value:{at:r.record.at}}],{ttlMs:r.ttlMs}),i&&await this.store.acknowledgeUnseen(i.key,i.version,i.epoch);for(let e of t.secrets??[])await this.store.put(`snapshot`,e.id,{secret:e.value,expiresAt:e.expiresAt},{ttlMs:Math.max(1,e.expiresAt-n)})}deliver(e,t,n,r,i,a,o=!0,s){return this.serial(async()=>{let c=await this.store.get(`delivery`,r.key);if(c&&!c.pending)return{};if(c?.pending?.inbox){let{taskId:e,id:i,entry:a}=c.pending.inbox,o=await this.read(e);if(o&&X.includes(o.status)&&(o.generation??0)===a.generation&&Kh(o.task,t))return await this.store.put(`task`,e,{...o,inboxSeq:Math.max(o.inboxSeq??-1,a.seq),updatedAt:n}),await this.store.put(`inbox`,i,a),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0};await this.store.delete(`delivery`,r.key),c=void 0}let l=i!==void 0&&!c?.pending?.task?(await this.list(e,{statuses:X,agent:t.agent,source:t.source})).find(e=>Kh(e.task,t)):void 0;if(!l)return!o||!await this.insert(t,n,r,a)?{}:(await this.admit(t,s,n),{taskId:t.id});let u=await this.nextSeq(l.task.id),d={seq:u,generation:l.generation??0,at:n,kind:`steer`,value:{text:i,asker:t.context?.asker??null}},f=`${l.task.id}:${String(u).padStart(8,`0`)}`;return await this.store.put(`delivery`,r.key,{at:n,pending:{inbox:{taskId:l.task.id,id:f,entry:d}}}),await this.store.put(`task`,l.task.id,{...l,inboxSeq:u,updatedAt:n}),await this.store.put(`inbox`,f,d),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0}})}claim(e,t){return this.serial(async()=>{let n=(await this.store.list(`task`)).map(e=>e.value);if(t!==void 0&&n.filter(e=>[`running`,`waiting`].includes(e.status)).length>=t)return;let r=n.filter(e=>e.status===`queued`).sort((e,t)=>e.createdAt-t.createdAt),i=r[0];if(!i)return;let a=$o(i.task.id,`default`,i.attempts+1),o={...i,tokenHash:a.hash,lastSeenAt:e,status:`running`,attempts:i.attempts+1,startedAt:e,updatedAt:e};return await this.store.put(`task`,o.task.id,o),{organizationId:`default`,status:o,token:a.token,more:r.some(e=>e!==i)&&(t===void 0||n.filter(e=>[`running`,`waiting`].includes(e.status)).length+1<t)}})}allowed(e,t){return(t.generation===void 0||(e.generation??0)===t.generation)&&(t.attempts===void 0||e.attempts===t.attempts)&&(t.tokenHash===void 0||(e.tokenHash??null)===t.tokenHash)&&(t.handle===void 0||(e.handle??null)===t.handle)&&(t.lastSeenAt===void 0||(e.lastSeenAt??null)===t.lastSeenAt)&&(t.updatedAt===void 0||e.updatedAt===t.updatedAt)&&(!t.statuses||t.statuses.includes(e.status))&&(t.unanswered===void 0||!e.task.context?.approvals?.find(e=>e.id===t.unanswered)?.response)}touch(e,t,n,r,i,a=!1){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{tokenHash:n,attempts:r})||!a&&$h.has(e.status)||e.status===`queued`)return;if($h.has(e.status))return e;let o={...e,lastSeenAt:i};return await this.store.put(`task`,t,o),o})}async authorize(e,t,n,r,i,a={}){let o=await this.touch(r,e,t,n,i,a.allowCompleted);return o&&{organizationId:`default`,status:o}}async archiveStopped(e,t,n){let r=e=>e!==void 0&&$h.has(e.status)&&e.archivedAt===void 0&&(!n||n.includes(e.task.id))&&he(e.finishedAt??e.updatedAt,t);for(let{value:e}of await this.store.list(`task`))r(e)&&await this.serial(async()=>{let n=await this.read(e.task.id);r(n)&&await this.store.put(`task`,n.task.id,{...n,archivedAt:t,updatedAt:t,autoArchived:!0})})}patchTask(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,i))return!1;let{answer:a,approvals:o,resolvedModel:s,...c}=n,l=s?{...e.task,usage:{...e.task.usage,resolvedModel:s}}:e.task;return await this.store.put(`task`,t,{...e,task:l,...Object.hasOwn(n,`handle`)&&n.handle!==e.handle?{logsComplete:void 0}:{},...c,...a===void 0?{}:{answer:[...e.answer??[],a]},...o?{task:Yh(l,o)}:{},updatedAt:r}),!0})}setRequestedBy(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);if(!e||e.task.requestedBy)return!1;let i={...e.task,requestedBy:n};return i.audience===`dm:`&&(i.audience=`dm:${n}`),await this.store.put(`task`,t,{...e,task:i,updatedAt:r}),!0})}deleteTask(e,t,n){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,n)?!1:(await this.store.delete(`task`,t),this.tombstone(t,cs(e.task).audience,e.task.requestedBy,e.task.parent),await Fh(this.store,t),!0)})}continueTask(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!e||!$h.has(e.status)||!this.allowed(e,i))return!1;let a=n.context&&{...n.context,approvals:Xt(n.context.approvals??[],e.task.context?.approvals??[])};return await this.store.put(`task`,t,{task:{...e.task,...n,...a?{context:a}:{}},status:`queued`,attempts:0,logSeq:e.logSeq,logBytes:e.logBytes,generation:(e.generation??0)+1,inboxSeq:e.inboxSeq,createdAt:e.createdAt,updatedAt:r},{unarchive:!0}),!0})}completeTask(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]}))return!1;await this.store.put(`usage`,`${t}:${e.generation??0}`,n.usage);for(let n of await this.store.list(`inbox`,{prefix:`${t}:`}))n.value.generation===(e.generation??0)&&await this.store.delete(`inbox`,n.id);await this.store.put(`task`,t,{...e,...n.outcome,...n.logsComplete?{logsComplete:!0}:{},lastSeenAt:r,finishedAt:r,updatedAt:r});for(let e of n.known??[])await this.store.put(`delivery`,e.id,{at:r},{ttlMs:e.ttlMs});return await Fh(this.store,t),!0})}requeue(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...r,statuses:[`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,status:`queued`,handle:void 0,tokenHash:void 0,lastSeenAt:void 0,updatedAt:n}),!0)})}finish(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...i,statuses:[`queued`,`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,...n,lastSeenAt:r,finishedAt:r,updatedAt:r}),await Fh(this.store,t),!0)})}cancel(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);if(!e||$h.has(e.status)||!this.allowed(e,r))return!1;let i=e.status===`queued`?void 0:{seq:await this.nextSeq(t),generation:e.generation??0,kind:`cancel`,value:null,at:n};return i&&await this.store.put(`inbox`,`${t}:${String(i.seq).padStart(8,`0`)}`,i),await this.store.put(`task`,t,{...e,...e.status===`queued`?{status:`cancelled`,error:ae,finishedAt:n}:{},cancelRequestedAt:n,...i?{inboxSeq:i.seq}:{},updatedAt:n}),e.status===`queued`&&await Fh(this.store,t),!0})}async cancelRequested(e,t){return(await this.read(t))?.cancelRequestedAt!==void 0}async list(e,t={}){let{before:n}=t;return(await this.store.list(`task`)).map(e=>e.value).filter(e=>zh(e,t)).filter(e=>Wh(e,n)).sort(t.since===void 0?Uh:Hh).slice(0,t.limit)}tombstone(e,t,n,r){this.tombstones.set(e,{at:Date.now(),...t===void 0?{}:{audience:t},...n===void 0?{}:{requestedBy:n},...r===void 0?{}:{parent:r}})}async memberSpaces(){return[]}async listedSpaces(){return[]}async linkedMembers(){return[]}async spaceSynced(e,t){return this.spaces.get(V(t))?.syncedAt}async claimSpace(e,t,n,r=!1){let i=V(t),a=this.spaces.get(i)??{members:new Set};return!r&&a.claimedAt!==void 0&&n-a.claimedAt<6e4?!1:(this.spaces.set(i,{...a,claimedAt:n}),!0)}async saveSpaceMembers(e,t,n,r){let i=V(t),a=this.spaces.get(i)??{members:new Set};a.claimedAt===r&&this.spaces.set(i,n?{syncedAt:r,members:new Set(n)}:{...a,claimedAt:void 0})}async spaceChanged(e,t,n,r){let i=V(t),a=this.spaces.get(i);a&&(n.joined||n.left)&&this.spaces.set(i,{...a,claimedAt:void 0});let o=a?.members;if(n.joined&&o?.add(n.joined),n.left&&o?.delete(n.left),n.private===void 0)return;let s=n.private?`space:${i}`:``;for(let{value:e}of await this.store.list(`task`)){let t=e.task;if(t.space!==i||t.audience?.startsWith(`dm:`))continue;let a=t.event?.space?{...t.event,space:{...t.event.space,private:n.private}}:t.event;await this.store.put(`task`,t.id,{...e,task:{...t,audience:s,...a?{event:a}:{}},updatedAt:r})}this.spaces.delete(i)}async changes(e,t){let n=e[0]?.organizationId;if(!n)return{rows:[],deleted:[]};for(let[e,{at:t}]of this.tombstones)t<Date.now()-6e5&&this.tombstones.delete(e);return{rows:(await this.store.list(`task`)).map(e=>({organizationId:n,status:e.value})),deleted:[...this.tombstones].filter(([,{at:e}])=>e>t).map(([e,t])=>({organizationId:n,id:e,...t}))}}async logTails(e,t){let{readLog:n}=await Promise.resolve().then(()=>vs);return Promise.all(e.map(async({id:e,after:r})=>{let i=await this.store.get(`task`,e);return i&&{status:i,lines:await n(this.store,e,r,t)}}))}async counts(e,t={}){let n=(await this.store.list(`task`)).map(e=>e.value).filter(e=>zh(e,t));return{all:n.length,active:n.filter(e=>X.includes(e.status)).length,waiting:n.filter(e=>$t(e.status,e.task.context?.approvals)).length}}async runningCount(){return(await this.store.list(`task`)).filter(e=>[`running`,`waiting`].includes(e.value.status)).length}async activeCounts(){let e=new Map;for(let{value:t}of await this.store.list(`task`)){if(t.archivedAt!==void 0||!X.includes(t.status))continue;let{audience:n}=t.task,r=`${n??null}\n${t.task.requestedBy??``}`,i=e.get(r)??{...n===void 0?{}:{audience:n},...t.task.requestedBy?{requestedBy:t.task.requestedBy}:{},active:0};e.set(r,{...i,active:i.active+1})}return[...e.values()]}async running(){return(await this.store.list(`task`)).map(e=>e.value).filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>({organizationId:`default`,status:e}))}appendLogs(e,t,n,r,i,a,o){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,o)||(e.logSeq??0)!==r.seq||(e.logCursor??-1)!==r.cursor?!1:(await this.store.putMany(`tasklog`,n.map(({seq:e,...n})=>({id:`${t}:${String(e).padStart(6,`0`)}`,value:n}))),await this.store.put(`task`,t,{...e,logCursor:i.cursor,logSeq:i.seq,logBytes:i.bytes}),!0)})}readInbox(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);return!e||!X.includes(e.status)||(e.generation??0)!==n?[]:(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(e=>e.generation===n&&e.seq>r).slice(0,100)})}fetchInbox(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!(!e||!this.allowed(e,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})))return(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(t=>t.generation===(e.generation??0)&&t.seq>i).sort((e,t)=>e.seq-t.seq)})}ackInbox(e,t,n,r){return this.serial(async()=>{if(r.generation!==void 0&&r.generation!==n.generation)return;let e=await this.read(t);if(!e||!this.allowed(e,{...r,generation:n.generation,statuses:void 0})||n.seq>(e.inboxSeq??-1))return;let i=e.inboxAck?.generation===n.generation?e.inboxAck.seq:-1;if($h.has(e.status))return n.seq<=i?e.status:void 0;if(![`running`,`waiting`].includes(e.status))return;let a=(await this.store.list(`inbox`,{prefix:`${t}:`})).filter(e=>e.value.generation===n.generation&&e.value.seq<=n.seq),o=(n.answers??[]).filter(e=>e.seq>i&&a.some(t=>t.value.kind===`ask`&&t.value.seq===e.seq)).map(e=>e.value),s=a.some(e=>e.value.kind===`cancel`),c=e.approval?.id,l=c&&a.some(e=>e.value.kind===`approve`&&e.value.value?.approvalId===c),u=Object.assign({},...a.map(e=>e.value.value?.admissions)),d={...e,...Object.keys(u).length?{task:Xh(e.task,u)}:{},inboxAck:{generation:n.generation,seq:Math.max(i,n.seq)},...o.length?{answer:[...e.answer??[],...o]}:{},...l?{status:`running`,approval:void 0}:{},...s?{status:`cancelled`,error:ae,finishedAt:Date.now()}:{},updatedAt:Date.now()};await this.store.put(`task`,t,d);for(let e of a)await this.store.delete(`inbox`,e.id);return s&&await Fh(this.store,t),d.status})}async pendingInbox(e){let t=await this.store.list(`inbox`);return(await this.running()).filter(({status:e})=>t.some(t=>t.id.startsWith(`${e.task.id}:`)&&t.value.generation===(e.generation??0)))}appendInbox(e,t,n,r,i,a,o,s){let c=async()=>{if(o&&(await this.store.get(`delivery`,o.key))?.sending?.owner!==o.owner)throw new Rh;let e=await this.read(t);if(!e||!X.includes(e.status)||(e.generation??0)!==a)return;for(let t of s??[]){let n=Yt(e.task.context?.approvals?.find(e=>e.id===t.id),t);if(n)throw new Wt(n)}let c=await this.nextSeq(t),l=o&&Lh(o),u={seq:c,generation:a,at:i,kind:n,value:l?{...r,admissions:l}:r};await this.store.put(`inbox`,`${t}:${String(c).padStart(8,`0`)}`,u);let d=e.task;return l&&(d=Xh(d,l)),s&&(d=Yh(d,s)),await this.store.put(`task`,t,{...e,task:d,inboxSeq:c,updatedAt:i}),o&&await this.store.finishBatch(o.key,o.owner,!0,o.through),u};return this.serial(()=>o?this.store.withAppLock(`batch:${o.key}`,c):c())}};const tg=3e4;function ng(e,t,n,r){if(n&&!e.local&&!n.runnerId&&!e.runners[n.runner]?.push)return Promise.resolve();let i=e.queue.inboxDelivery??=new Map,a=JSON.stringify([e.organizationId,t]),o=i.get(a);if(o||i.set(a,o={}),o.work)return o.again=!0,o.work;let s=o,c=async()=>{let n,i=I(),a=0,o=0,c,l=r,u=async()=>{for(;;){s.again=!1;let r=l??await e.store.get(`task`,t);if(l=void 0,!r?.handle||![`running`,`waiting`].includes(r.status))return;let c=await Ba(e,r.task),u=!!(e.local&&r.handle.startsWith(`cli:`));if(!u&&!c?.push)return;o=r.generation??0;let d={generation:o,attempts:r.attempts,tokenHash:r.tokenHash??null,handle:r.handle},f=`inbox:${JSON.stringify([t,d])}`;if(n!==f){n&&await e.store.updateDeliveryLease(n,i),n=void 0;let t=await e.store.claimDeliveryLease(f,i,tg);if(t===void 0)return;n=f,a=t}else if(!await e.store.updateDeliveryLease(n,i,{owner:i,failures:a},{ttlMs:tg}))return;let p=(await e.queue.readInbox(e.organizationId,t,r.generation??0,-1)).slice(0,100);if(!p.length){if(s.again)continue;return}let m=u?await yp(e,r,p):await c.push(r.handle,p);if(m.generation!==(r.generation??0)||!p.some(e=>e.seq===m.seq))throw Error(`Invalid inbox acknowledgement`);if(!await e.queue.ackInbox(e.organizationId,t,m,d)||(a=0,p.length<100&&!s.again))return}};try{await u()}catch(r){if(console.error(`coder server: inbox delivery failed for ${t}`,r),n){let t=Math.min(3e4,1e3*2**Math.min(a,5)),r={owner:i,failures:a+1,next:(e.now??Date.now)()+t};await e.store.updateDeliveryLease(n,i,r,{ttlMs:t}),n=void 0}}finally{n&&(await e.store.updateDeliveryLease(n,i),c=o)}return c};return s.work=(async()=>{for(;;){let n=await c();if(n===void 0||!(await e.queue.readInbox(e.organizationId,t,n,-1)).length&&!s.again)break}i.delete(a)})().finally(()=>{i.get(a)===s&&i.delete(a)}),s.work}async function rg(e,t){let n=await e.queue.pendingInbox(t);await Promise.allSettled(n.map(({organizationId:t,status:n})=>ng(z(e,t),n.task.id)))}function ig(e,t){let n=rg(e,t).catch(e=>console.error(`coder server: inbox flush failed`,e));e.waitUntil&&e.waitUntil(n)}function ag(){return(process.env.PATH??``).split(N.delimiter).some(e=>{try{let t=N.join(e,`docker`);return Cr(t,wr.X_OK),Dr(t).isFile()}catch{return!1}})}function og(e){let t=!!e.local,n=t&&ag();return[{kind:`local`,name:t?`Another machine`:`Your machine`,description:t?`Pair another computer; it runs tasks with its own logins.`:`Run tasks with your own machine and logins.`,connect:`pair`,fields:[],available:!0},{kind:`local-docker`,name:`Docker on the server`,description:`Run each task in a Docker container.`,connect:`fields`,help:`Each task runs in a fresh container on this server, using the Docker installed here. Leave fields empty for the defaults.`,fields:[{key:`image`,label:`Image`,placeholder:Jn,hint:`Needs Bun, Node, Git, curl, tar, Claude Code, Codex and GitHub MCP server.`,optional:!0},{key:`memory`,label:`Memory limit`,placeholder:`4g`,optional:!0},{key:`cpus`,label:`CPU limit`,placeholder:`2`,optional:!0}],available:n,...n?{}:{reason:t?`Docker is not on PATH.`:`Available on a local server only.`}},{kind:`vercel-sandbox`,name:`Vercel Sandbox`,description:`Run tasks in an isolated sandbox.`,connect:`fields`,help:`Each task gets a fresh Vercel Sandbox. Create an access token at vercel.com/account/tokens with Sandbox access for the team that pays for it.`,fields:[{key:`token`,label:`Access token`,placeholder:`vcp_…`,hint:`with Sandbox access`,secret:!0},{key:`team`,label:`Team`,placeholder:`team_…`,hint:`VERCEL_TEAM_ID if empty`,optional:!0},{key:`projectId`,label:`Project`,placeholder:`prj_…`,hint:`VERCEL_PROJECT_ID if empty`,optional:!0},{key:`region`,label:`Region`,placeholder:`iad1`,hint:`nearest if empty`,optional:!0}],available:!0},{kind:`github-actions`,name:`GitHub Actions`,description:`Run tasks through a repository workflow.`,connect:`fields`,help:`Each task starts a workflow run in a repository you choose. Save coder server workflow as .github/workflows/coder-agent.yml. It runs coder agent run --task; the token needs Actions read and write on that repository.`,fields:[{key:`repo`,label:`Repository`,placeholder:`acme/runners`,hint:`owner/name`},{key:`workflow`,label:`Workflow file`,placeholder:`coder-agent.yml`,hint:`in .github/workflows`},{key:`token`,label:`Token`,placeholder:`github_pat_…`,hint:`Actions read and write`,secret:!0},{key:`ref`,label:`Branch`,placeholder:`main`,hint:`default branch if empty`,optional:!0}],available:!0},{kind:`http`,name:`HTTP runner`,description:`Connect a runner at a public HTTPS address.`,connect:`fields`,help:`A machine already running coder runner serve. Copy the address and secret it printed; pairing from the Another machine or Your machine option does this for you.`,fields:[{key:`url`,label:`Address`,placeholder:`https://runner.example.com`,hint:`its https address`},{key:`secret`,label:`Secret`,placeholder:`printed by coder runner serve`,hint:`32 characters or more`,secret:!0}],available:!0}]}const sg=c().check(u(1),d(80)),cg=s([`personal`,`workspace`]),lg=n(c(),c()),ug=e({kind:s([`local`,`local-docker`,`github-actions`,`vercel-sandbox`,`http`]),name:sg,scope:cg,config:lg}),dg=e({name:i(sg),default:i(p(!0)),config:i(lg)});function fg(e,t,n,r=t.default){return{id:e,kind:t.kind,name:t.name,scope:t.scope,default:r,online:t.lastSeen!==void 0&&n-t.lastSeen<3e5,...t.lastSeen===void 0?{}:{lastSeen:t.lastSeen},config:t.config,createdAt:t.createdAt}}const pg=(e,t)=>({value:n})=>Ia(n,t)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`);function mg(e){let t=e.session?.user.id,n=(e.now??Date.now)(),r=n=>n===`workspace`?p_(e):!!t,i=async(n=e.store)=>(await n.list(`runner`)).filter(pg(e,t));return{user:t,now:n,canCreate:r,rows:i,row:async(t,r,a=e.store)=>{let o=(await i(a)).some(({value:e})=>e.scope===`personal`&&e.default);return fg(t,r,n,r.default&&(r.scope===`personal`||!o))}}}async function hg(e,t,n,r){return D({items:gg(t,await t.store.list(`runner`),(t.now??Date.now)()),catalog:og(t)})}function gg(e,t,n){let r=t.filter(pg(e,e.session?.user.id)),i=r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.default);return[{id:La(e),kind:e.config.runner,name:e.local?`This machine`:`Default runner`,scope:`workspace`,default:!i,online:!0,config:{},createdAt:0},...r.map(({id:e,value:t})=>fg(e,t,n,e===i?.id))]}async function _g(e,t,n,r){let{user:i,now:a,canCreate:o,row:s}=mg(t);{let n=ug.safeParse(await e.json().catch(()=>void 0));if(!n.success)return D({error:`Invalid runner`},400);if(!o(n.data.scope))return D({error:`This scope requires a member or workspace admin.`},403);let r=og(t).find(e=>e.kind===n.data.kind);if(!r.available||r.connect===`pair`)return D({error:r.reason??`Pair this runner with runner serve.`},400);try{Ag(r,n.data.config)}catch(e){return D({error:e.message},400)}let c=Sg(n.data.kind,n.data.config,t),l=`rnr_${F(9).toString(`base64url`)}`,u={...n.data,...c,owner:n.data.scope===`personal`?i:void 0,createdBy:i,default:!1,createdAt:a,updatedAt:a};return await t.store.put(`runner`,l,u),D(await s(l,u))}}async function vg(e,t,n,r){let i=n.id,{user:a}=mg(t);if(i===La(t))return D(await jg(t));let o=e=>{if(!e||!Ia(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return D({error:`Unknown runner`},404);if(e.scope===`workspace`&&!p_(t))return D({error:`Only a workspace owner or admin can change this runner.`},403)},s=await t.store.get(`runner`,i),c=o(s);if(c)return c;let l=await jg(t,s);return await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i);n&&n.secret===s.secret&&JSON.stringify(n.config)===JSON.stringify(s.config)&&await e.put(`runner`,i,{...n,lastSeen:l.ok?(t.now??Date.now)():void 0,updatedAt:(t.now??Date.now)()})}),D(l)}async function yg(e,t,n,r){for(let i of await e.list(`runner`))i.id!==t&&i.value.default&&i.value.scope===(n?.scope??`workspace`)&&i.value.owner===n?.owner&&await e.put(`runner`,i.id,{...i.value,default:!1,updatedAt:r})}async function bg(e,t,n,r){let i=n.id,{user:a,now:o,rows:s,row:c}=mg(t);if(i===La(t)){if(p_(t)){let n=dg.safeParse(await e.json().catch(()=>void 0));if(!n.success||!n.data.default||n.data.name||n.data.config)return D({error:`Only the default can change for the built-in runner.`},400);await t.store.withAppLock(`runners:${t.organizationId}`,e=>yg(e,i,void 0,o));let r=(await s()).some(({value:e})=>e.scope===`personal`&&e.default);return D({id:i,kind:t.config.runner,name:t.local?`This machine`:`Default runner`,scope:`workspace`,default:!r,online:!0,config:{},createdAt:0})}return D({error:`The server default cannot be renamed or removed.`},403)}let l=e=>{if(!e||!Ia(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return D({error:`Unknown runner`},404);if(e.scope===`workspace`&&!p_(t))return D({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async n=>{let r=await n.get(`runner`,i),a=l(r);if(a||!r)return a;{let a=dg.safeParse(await e.json().catch(()=>void 0));if(!a.success||!Object.keys(a.data).length)return D({error:`Invalid runner update`},400);let s={};if(a.data.config){let e={...r.config,...R(t.config,r.secret),...a.data.config};try{Ag(og(t).find(e=>e.kind===r.kind),e)}catch(e){return D({error:e.message},400)}s=Sg(r.kind,e,t)}a.data.default&&await yg(n,i,r,o);let l={...r,...a.data.name?{name:a.data.name}:{},...a.data.default?{default:!0}:{},...s,updatedAt:o};return await n.put(`runner`,i,l),D(await c(i,l,n))}})}async function xg(e,t,n,r){let i=n.id,{user:a}=mg(t);if(i===La(t))return D({error:`The server default cannot be renamed or removed.`},403);let o=e=>{if(!e||!Ia(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return D({error:`Unknown runner`},404);if(e.scope===`workspace`&&!p_(t))return D({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i),r=o(n);if(r||!n)return r;{let{active:n}=await(e.queue?.()??t.queue).counts(t.organizationId,{statuses:X,runnerId:i});return n?D({error:n===1?`1 task still runs on this runner. Stop it or wait.`:`${n} tasks still run on this runner. Stop them or wait.`},409):(await e.delete(`runner`,i),await e.delete(`snapshot`,Dg(i)),t.settings?.runnerInstances?.delete(i),D({ok:!0}))}})}function Sg(e,t,n){let r=new Set(og(n).find(t=>t.kind===e).fields.filter(e=>e.secret).map(e=>e.key)),i=Object.entries(t);return{config:Object.fromEntries(i.filter(([e])=>!r.has(e))),secret:L(n.config,Object.fromEntries(i.filter(([e])=>r.has(e))))}}const Cg=e({name:i(sg),scope:cg});async function wg(e,t,n,r){let{user:i,now:a,canCreate:o}=mg(t),s=Cg.safeParse(await e.json().catch(()=>void 0));if(!s.success)return D({error:`Invalid pairing`},400);if(!o(s.data.scope))return D({error:`This scope requires a member or workspace admin.`},403);let c=`${Buffer.from(t.organizationId).toString(`base64url`)}.${F(32).toString(`base64url`)}`,l=a+9e5;await t.store.put(`snapshot`,`runner-pair:${ht(c)}`,{...s.data,owner:s.data.scope===`personal`?i:void 0,createdBy:i,expiresAt:l},{ttlMs:9e5});let u=t.config.publicUrl??r.origin;return D({token:c,expiresAt:l,command:`coder runner serve --url ${u} --token ${c}`})}const Tg=e({token:i(c()),id:i(c()),organizationId:i(c()),name:i(c().check(u(1),d(80))),url:c(),secret:c().check(u(32)),offline:i(a()),removed:i(o(c()))});async function Eg(e,t,n,r){let i=Tg.safeParse(await e.json().catch(()=>void 0));if(!i.success)return D({error:`Invalid runner registration`},400);let a=i.data;try{new da({url:a.url,secret:a.secret})}catch{return D({error:`A public HTTPS runner URL is required`},400)}let o=a.token?Buffer.from(a.token.split(`.`)[0],`base64url`).toString():a.organizationId;if(!o||o!==t.organizationId&&!t.scope)return D({error:`Invalid runner token`},401);t=z(t,o);let s=(t.now??Date.now)(),c=await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n,r;if(a.token){let i=`runner-pair:${ht(a.token)}`,o=await e.get(`snapshot`,i);if(!o||o.expiresAt<=s||!await e.take(`snapshot`,i))return D({error:`Pairing token expired or already used`},401);r=`rnr_${F(9).toString(`base64url`)}`,n={kind:`http`,name:o.name??a.name??`Your machine`,scope:o.scope,owner:o.owner,createdBy:o.createdBy,default:!1,createdAt:s,updatedAt:s,...Sg(`http`,{url:a.url,secret:a.secret},t),lastSeen:s}}else{r=a.id??``;let i=await e.get(`runner`,r);if(!i||i.kind!==`http`||!_t(R(t.config,i.secret).secret??``,a.secret))return D({error:`Invalid runner token`},401);n={...i,config:{...i.config,url:a.url},lastSeen:a.offline?void 0:s,updatedAt:s}}await e.put(`runner`,r,n);let i=a.token?[]:await kg(e,r,a.removed);return D({...fg(r,n,s),organizationId:o,...i.length?{deleted:i}:{}})});return c.ok&&t.taskWatcher?.runnersChanged(t.organizationId),c}const Dg=e=>`runner-deleted:${e}`;async function Og(e,t,n){if(t.runner!==`http`||!t.runnerId){await(await Ba(e,t))?.remove?.(t.id,n);return}let r=t.runnerId;await e.store.withAppLock(`runners:${e.organizationId}`,async e=>{let n=await e.get(`snapshot`,Dg(r));await e.put(`snapshot`,Dg(r),{deletedTasks:[...n?.deletedTasks??[],t.id]})})}async function kg(e,t,n=[]){let r=await e.get(`snapshot`,Dg(t)),i=(r?.deletedTasks??[]).filter(e=>!n.includes(e));return!r||i.length===r.deletedTasks.length||(i.length?await e.put(`snapshot`,Dg(t),{deletedTasks:i}):await e.delete(`snapshot`,Dg(t))),i}function Ag(e,t){if(Object.keys(t).some(t=>!e.fields.some(e=>e.key===t)))throw Error(`Unknown runner field`);for(let n of e.fields)if(!n.optional&&!t[n.key]?.trim())throw Error(`${n.label} is required`);e.kind===`http`&&pa(t),e.kind===`github-actions`&&Gn(t),e.kind===`local-docker`&&sa(t)}async function jg(e,t){let n=Date.now(),r=new AbortController,i,a=new Promise((t,n)=>{i=setTimeout(()=>{r.abort(),n(new Fa(`Runner check timed out`))},e.runnerTimeoutMs??5e3)});try{return{ok:!0,detail:await Promise.race([a,(async()=>{let n=t?.kind??e.config.runner,i=t?{...t.config,...R(e.config,t.secret)}:e.config.runnerConfig??{};if(n===`local`){if(!e.local)throw new Fa(`Local runners require a local server`);return`This machine is available`}if(n===`http`)return fa(t?za(e,t):e.runners.http,r.signal);if(n===`local-docker`){if(!e.local)throw new Fa(`Docker runners require a local server`);return oa(e.runnerExec??Or,r.signal)}let a=async t=>{let n=await(e.fetch??fetch)(t,{signal:r.signal,redirect:`manual`,headers:{authorization:`Bearer ${i.token}`,accept:`application/json`,"user-agent":`coder`}});if(!n.ok)throw new Fa(`Runner check failed with HTTP ${n.status}`);return n};return n===`github-actions`?Yn(i,a):ja(i,a)})()]),ms:Date.now()-n}}catch(e){return{ok:!1,detail:e instanceof Fa?e.message:`Runner check failed`,ms:Date.now()-n}}finally{clearTimeout(i)}}var Mg=t({addTokens:()=>Fg,addUsage:()=>Lg,countTokens:()=>Pg,readUsage:()=>Kg,readUsageTotals:()=>qg,sumUsageTotals:()=>zg,timeZone:()=>Ig,usageSummary:()=>Hg,usageTarget:()=>Ng,usageTotals:()=>Rg});function Ng(e){let t=e.event;return t?t.repo?`${t.repo.owner}/${t.repo.name}`:t.chat?.thread.channelId??t.integration:e.source}function Pg(e){return typeof e==`number`?e:!e||typeof e!=`object`||Array.isArray(e)?0:`total`in e&&typeof e.total==`number`?e.total:Object.values(e).reduce((e,t)=>e+Pg(t),0)}function Fg(e,t){if(typeof t==`number`)return(typeof e==`number`?e:0)+t;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=e&&typeof e==`object`&&!Array.isArray(e)?{...e}:{};for(let[e,r]of Object.entries(t))n[e]=Fg(n[e],r);return n}function Ig(e){if(!e)return`UTC`;try{return new Intl.DateTimeFormat(`en`,{timeZone:e}),e}catch{return`UTC`}}const Lg=(e,t)=>{e.tasks+=t.tasks,e.runnerMs+=t.runnerMs,e.tokenCount+=t.tokenCount};async function Rg(e,t){return e.usageTotals(t)}async function zg(e,t){if(t.top){let{top:n,...r}=t,i=(await Rg(e,{...r,by:`agent`,parts:void 0})).sort((e,t)=>t[n.by]-e[n.by]||e.key.localeCompare(t.key)).slice(0,n.count).map(e=>e.key);return Rg(e,{...r,parts:i})}let n=Ig(t.tz),r=new Intl.DateTimeFormat(`en-CA`,{timeZone:n,year:`numeric`,month:`2-digit`,day:`2-digit`}),i=new Set(t.parts),a=new Map;for(let{value:n}of await e.list(`usage`)){if(n.at<t.since||t.until!==void 0&&n.at>=t.until||t.agent&&n.agent!==t.agent)continue;let e=t.by===`agent`?n.agent:t.by===`installation`?n.installationId??`none`:t.by===`engine`?n.engine??`unknown`:r.format(n.at),o={tasks:1,runnerMs:n.runnerElapsedMs,tokenCount:Pg(n.tokens)},s=a.get(e)??{key:e,tasks:0,runnerMs:0,tokenCount:0};Lg(s,o),i.has(n.agent)&&(s.parts??={},Lg(s.parts[n.agent]??={tasks:0,runnerMs:0,tokenCount:0},o)),a.set(e,s)}return[...a.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Bg(e,t){let n=new Map;for(let r of e)for(let[e,i]of Object.entries(r.parts??{}))n.set(e,(n.get(e)??0)+i[t]);return[...n].sort((e,t)=>t[1]-e[1]||e[0].localeCompare(t[0])).map(([e])=>e)}function Vg(e,t){let n=new Map;for(let r of e){let e=t===`agent`?r.agent:t===`installation`?r.installationId??`none`:r.engine??`unknown`,i=n.get(e)??{key:e,tasks:0,runnerMs:0};i.tasks++,i.runnerMs+=r.runnerElapsedMs,r.tokens!==void 0&&(i.tokens=Fg(i.tokens,r.tokens)),n.set(e,i)}return[...n.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Hg(e,t,n){let r=e.filter(e=>e.at>=t);return{since:t,totals:n?Vg(r,n):{agent:Vg(r,`agent`),installation:Vg(r,`installation`),engine:Vg(r,`engine`)}}}const Ug={tasks:`tasks`,runner:`runnerMs`,tokens:`tokenCount`},Wg={tokens:e=>e.tokenCount,tasks:e=>e.tasks,runner:e=>e.runnerMs,name:e=>e.key};async function Gg(e,t){let n=e=>t.searchParams.get(e),r=Number(n(`since`)??0),i=n(`until`)===null?void 0:Number(n(`until`)),a=n(`by`)??`agent`;if(!Number.isFinite(r)||i!==void 0&&!Number.isFinite(i)||![`agent`,`installation`,`engine`,`day`].includes(a))return D({error:`Invalid usage query`},400);let o=n(`parts`)?.split(`,`).filter(Boolean),s=Math.min(Number(n(`top`)??0),8),c=Ug[n(`sort`)??`tokens`]??`tokenCount`,l=await Rg(e.store,{by:a,since:r,...i===void 0?{}:{until:i},...n(`agent`)?{agent:n(`agent`)}:{},...a===`day`?{tz:Ig(n(`tz`))}:{},...o?.length?{parts:o.slice(0,20)}:{},...s>0?{top:{count:s,by:c}}:{}}),u={since:r,...i===void 0?{}:{until:i}};if(a===`agent`){let t=new Set(e.local?(await st(e.local.cwd,e.integrations)).map(e=>e.id):(await e.store.list(`agent`)).map(e=>e.id));for(let e of Object.keys(ct()))t.add(e);for(let e of l)t.has(e.key)||(e.deleted=!0)}if(s>0)return D({...u,totals:l,top:Bg(l,c)});if(!k(t)||a!==`agent`)return D({...u,totals:l});let d=Wg[n(`sort`)??`tokens`]??Wg.tokens,f=n(`sort`)===`name`,p=n(`q`)?.trim().toLowerCase(),m=([e,t],[n,r])=>(e<n?-1:+(e>n))*(f?1:-1)||t.localeCompare(r),h=e=>[d(e),e.key],g=Nn(t),_=l.filter(e=>!p||e.key.toLowerCase().includes(p)).filter(e=>!g||m(h(e),g)>0).sort((e,t)=>m(h(e),h(t))),v=O(t),y=e=>l.reduce((t,n)=>t+e(n),0);return D({...u,...Fn(_.slice(0,v+1),v,h),summary:{agents:l.length,tasks:y(e=>e.tasks),runnerMs:y(e=>e.runnerMs),tokenCount:y(e=>e.tokenCount)}})}async function Kg(e,t,n,r){t.local&&await Op(t);let i=r.searchParams.get(`installation`),a=await t.store.list(`usage`,{limit:O(r,200),...i?{installation:i}:{}});return D(i?a.filter(e=>e.value.installationId===i):a)}async function qg(e,t,n,r){t.local&&await Op(t);let i=Number(r.searchParams.get(`since`)??0),a=r.searchParams.get(`by`);return[`until`,`agent`,`tz`,`parts`,`top`,`cursor`].some(e=>r.searchParams.has(e))||a===`day`?Gg(t,r):!Number.isFinite(i)||a&&![`agent`,`installation`,`engine`].includes(a)?D({error:`Invalid usage query`},400):D({since:i,totals:await t.store.usageSummary(i,a)})}async function Jg(e,t,n,r=!1,i){let a=Z(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=es(a);return o.task!==n||o.organization!==t.organizationId||!Number.isInteger(o.attempt)?new Response(`Unauthorized`,{status:401}):await t.queue.authorize(n,Qo(a),o.attempt,t.organizationId,(t.now??Date.now)(),{allowCompleted:r,include:i})??new Response(`Unauthorized`,{status:401})}async function Yg(e,t,n,r){let i=n.id,a=Z(e),o=es(a),s=Qo(a),c=Number(r.searchParams.get(`after`)??-1);if(!Number.isInteger(c)||c<-1)return D({error:`Invalid cursor`},400);let l=await t.queue.fetchInbox(t.organizationId,i,s,o.attempt,c);return l?D(l):new Response(`Unauthorized`,{status:401})}async function Xg(e,t,n,r){let i=n.id,a=Z(e),o=es(a),s=Qo(a),c=await e.json().catch(()=>void 0);if(!c||!Number.isInteger(c.seq)||c.seq<-1||!Number.isInteger(c.generation)||c.generation<0||c.answers!==void 0&&(!Array.isArray(c.answers)||c.answers.some(e=>!e||!Number.isInteger(e.seq)||e.seq<0||e.seq>c.seq)))return D({error:`Invalid acknowledgement`},400);let l={tokenHash:s,attempts:o.attempt,generation:c.generation},u=await t.queue.ackInbox(t.organizationId,i,c,l);if(u===`cancelled`){let e=await t.store.get(`task`,i);e&&await Rl(t,e)}return u?D({ok:!0}):new Response(`Unauthorized`,{status:401})}async function Zg(e,t,n){let r=(await e.json().catch(()=>void 0))?.entries;if(!Array.isArray(r)||r.length>100||r.some((e,t)=>!e||!Number.isSafeInteger(e.seq)||e.seq<0||!Number.isSafeInteger(e.at)||e.at<0||![`out`,`err`].includes(e.level)||typeof e.line!=`string`||Buffer.byteLength(e.line)>65536||t>0&&e.seq!==r[t-1].seq+1))return D({error:`Invalid task logs`},400);let i=await ws(t,t.callbackTask,r);return i===`ok`?D({ok:!0}):i===`gap`?D({error:`Task log sequence has a gap`},409):new Response(`Unauthorized`,{status:401})}async function Qg(e,t,n,r){let i=n.id,a=Z(e),o=es(a),s=Qo(a);return await t.queue.touch(t.organizationId,i,s,o.attempt,(t.now??Date.now)())?D({ok:!0}):new Response(`Unauthorized`,{status:401})}async function $g(e,t,n,r){let i=n.id,a=t.callbackTask,o=a.handle?await Ba(t,a.task):void 0;if([`completed`,`failed`,`cancelled`].includes(a.status))return await Rl(t,a,!1,o),D({ok:!0});let s=await e.json().catch(()=>void 0);if(!s?.status||![`running`,`waiting`,`completed`,`failed`,`cancelled`].includes(s.status)||s.installationRevoked!==void 0&&s.installationRevoked!==!0||s.machine!==void 0&&s.machine!==!0||s.approvals!==void 0&&(!Array.isArray(s.approvals)||s.approvals.some(e=>typeof e?.id!=`string`))||s.postedMessages!==void 0&&(!Array.isArray(s.postedMessages)||s.postedMessages.some(e=>typeof e!=`string`)))return D({error:`Invalid task result`},400);s.approvals=s.approvals?.map(({change:e,...t})=>t);let c=await Cs(t,a,!0);Object.assign(s,JSON.parse(JSON.stringify(s,(e,t)=>typeof t==`string`?c(t):t)));let l=(t.now??Date.now)(),u=a.task.event?mc(a.task.event,s.postedMessages??[]):[];if(s.status===`running`||s.status===`waiting`)return u.length&&(await hc(t,a.task.event,s.postedMessages,l),t_(t,a)),await t.queue.patchTask(t.organizationId,i,{status:s.status,lastSeenAt:l,...s.approval===void 0?s.status===`running`?{approval:void 0}:{}:{approval:s.approval},...s.answer===void 0?{}:{answer:s.answer},...s.approvals?{approvals:s.approvals}:{},...s.fallbacks?{fallbacks:s.fallbacks}:{},...s.model?{resolvedModel:Ee(s.model).model??s.model}:{}},l,{attempts:a.attempts,tokenHash:a.tokenHash,statuses:[`running`,`waiting`]}),s.approvals&&await e_(t,i),D({ok:!0});s.approvals&&await t.queue.patchTask(t.organizationId,i,{approvals:s.approvals},l,{attempts:a.attempts,tokenHash:a.tokenHash}),s.approvals&&await e_(t,i);let d=typeof s.result==`string`?s.result:JSON.stringify(s.result??``),f={ok:s.status===`completed`,exitCode:s.status===`completed`?0:1,output:d,...typeof s.diff==`string`?{diff:s.diff}:{}},p=!o||o.kind===`vercel-sandbox`||o.kind===`local-docker`,{engine:m,model:h}=(s.model?Ee(s.model):void 0)??yt(a.task),g=await t.queue.completeTask(t.organizationId,i,{attempts:a.attempts,tokenHash:a.tokenHash,known:u.map(e=>({id:e,ttlMs:tc})),logsComplete:!!a.handle&&!p,outcome:{status:s.status,result:f,...s.error?{error:s.error}:{},...s.tokens===void 0?{}:{tokens:s.tokens}},usage:{...a.task.event?{installationId:`${a.task.event.appId}:${a.task.event.installationId}`}:{},taskId:i,agent:a.task.agent,target:Ng(a.task),...m?{engine:m}:{},...h?{model:h}:{},credential:s.credential??a.task.models?.[0]?.credential??`unknown`,runnerElapsedMs:Math.max(0,l-(a.startedAt??l)),...s.tokens===void 0?{}:{tokens:s.tokens},at:l}},l),_=a.task.event;if(g&&s.status===`failed`&&s.installationRevoked&&_&&t.integrations[_.integration]?.isUninstalled&&await Ff(t.store,`${_.appId}:${_.installationId}`,l),g&&s.machine){let{reportTaskFailure:e}=await Promise.resolve().then(()=>Bc);await e(t,a,s.error??`The machine failed`)}return g&&(s.machine||t_(t,a),Fc(t,a.task)),g&&await Rl(t,p?a:{...a,logsComplete:!0},!1,o),D({ok:!0})}async function e_(e,t){let n=(await e.store.get(`task`,t))?.task;n?.context?.approvals&&(e.waitUntil??(()=>{}))(El(e,n,n.context.approvals).catch(e=>console.error(`coder server: could not show the approvals of task ${t}`,e)))}function t_(e,t){let n=t.task,r=Promise.resolve().then(()=>ad).then(n=>n.endTyping(e,t)).catch(e=>console.error(`coder server: could not clear the working indicator of task ${n.id}`,e));e.waitUntil?.(r)}const n_=/^[a-f0-9-]{36}$/;async function r_(e,t){let n=t.task.event;if(!n||t.task.source!==n.integration)throw Error(`The task has no conversation`);let r=await e.store.get(`app`,n.appId);if(!r)throw Error(`The conversation app is gone`);let{eventReplies:i}=await Promise.resolve().then(()=>ad);return{event:n,replies:await i(e,r,n,t)}}async function i_(e,t,n,r){let i=e.callbackTask,a=`${t}:${i.task.id}:${i.generation??0}:${n}`,o=(e.now??Date.now)();if(!await e.store.create(`delivery`,a,{at:o},{ttlMs:864e5}))return D({ok:!0,duplicate:!0});try{await r(await r_(e,i))}catch(t){return await e.store.delete(`delivery`,a),D({error:t instanceof Error?t.message:String(t)},409)}return D({ok:!0})}async function a_(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!n_.test(n.id))return D({error:`Invalid call id`},400);if(typeof n.text!=`string`||!n.text.trim())return D({error:`Reply text is required`},400);let r=n.text.trim();return i_(t,`reply`,n.id,async({event:e,replies:n})=>{let i=t.callbackTask,a=i.task.notice&&await Oc(t,i)?i.task.notice:void 0,o=await n.post(r,a).catch(async e=>{throw a&&await kc(t,i),e});o&&await hc(t,e,o.ids??(o.id?[o.id]:[]),(t.now??Date.now)())})}async function o_(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!n_.test(n.id))return D({error:`Invalid call id`},400);if(typeof n.emoji!=`string`||!n.emoji.trim())return D({error:`Emoji is required`},400);if(n.message!==void 0&&(typeof n.message!=`string`||!n.message.trim()))return D({error:`Message id must be a non-empty string`},400);let{emoji:r,message:i}=n;return i_(t,`react`,n.id,async({replies:e})=>{if(!e.react)throw Error(`The conversation cannot add reactions`);await e.react(r.trim(),i)})}async function s_(e,t,n,r){let i=t.callbackTask,a=await e.json().catch(()=>({})),o=a.credentialId;return typeof a.authJson!=`string`||typeof o!=`string`||!(await Jf(t,i.task,q(t,await vf(t.store)))).some(e=>e.id===o)?D({error:`Invalid credential update`},400):D({kept:await gm(t.store,t.config,o,a.authJson)})}async function c_(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.connection!=`string`||!n.connection)return D({error:`A connection id is required`},400);let r=t.callbackTask,{task:i}=r,{connectionToken:a,taskAsker:o,turnConnections:s}=await Promise.resolve().then(()=>hh),{findConnection:c}=await Promise.resolve().then(()=>km),{actAsRefusal:l}=await Promise.resolve().then(()=>Tu),u=await s(t,i),d=await c(t,n.connection,o(i),u.accounts);if(!d||!u.ids.includes(n.connection))return D({error:`Unknown connection`},404);let f=n.git===!0;try{let e=d.owner?await l(t,r,d,u.accounts,!f):void 0;if(e)return D({error:e},403);if(f){let e=d.login&&d.account!==void 0?await t.integrations[d.provider]?.repos?.commitAuthor?.({login:d.login,id:d.account},``,t.fetch).catch(e=>{console.error(`coder server: commit author lookup failed`,e)}):void 0;return D(e?{author:{name:e.name,email:e.email}}:{})}let{token:o,name:s}=await a(t,i,n.connection,typeof n.refused==`string`?n.refused:void 0,{url:n.url,connectionCreatedAt:n.connectionCreatedAt},d);if(o)return D({token:o});let c=i.event&&t.integrations[i.event.integration]?.name;return await bs(t,i.id,[`${s??c??`A connection`} needs reconnecting.`]),D({status:`needs-auth`})}catch(e){return console.error(`coder server: connection token failed`,e),D({error:`The connection is unavailable`},502)}}async function l_(e,t,n,r){let i=t.callbackTask;try{let{connectionSecrets:e,...n}=await Uf(t,i,t.callbackWorkspace);return D({...n,generation:i.generation??0,logCursor:i.logCursor??-1,timeoutMs:Math.max(1,t.config.taskTimeoutMs-((t.now??Date.now)()-(i.startedAt??(t.now??Date.now)())))})}catch(e){return D({error:e instanceof Error?e.message:String(e)},409)}}async function u_(e,t){if(!t.auth)return t;let n=await t.auth.session(e.headers);if(!(!n?.organizationId||n.organizationDenied))return{...z(t,n.organizationId),session:n}}const d_=new Set([`owner`,`admin`]),f_=e=>d_.has(e??``);function p_(e){return!e.auth||f_(e.session?.role)}async function m_(e,t,n){let{task:r}=t;if(e.taskPrincipal&&r.parent!==e.taskPrincipal.task||!ds(await fs(e,[r.audience]),r))return D({error:`No task "${r.id}"`},404);let i=r.audience?.startsWith(`dm:`);if(n&&e.auth&&i&&r.requestedBy!==e.session?.user.id)return D({error:`Only the member who asked can steer this task.`},403)}const h_=(e=!1)=>async(t,n,r)=>{let i=await n.store.get(`task`,r.id);return!i&&n.taskPrincipal?D({error:`No task "${r.id}"`},404):i?await m_(n,i,e)??{...n,routeTask:i}:n};function g_(e,t){return p_(e)?e:D({error:t},403)}function __(e,t){return!!(e&&t&&_t(e,t))}function Z(e){let t=e.headers.get(`authorization`);return t?.startsWith(`Bearer `)?t.slice(7):null}const v_=new Set([`localhost`,`127.0.0.1`,`::1`,`[::1]`]);function y_(e){if(e.headers.has(`x-forwarded-for`)||e.headers.has(`x-forwarded-host`))return!1;let t=e.headers.get(`host`)??new URL(e.url).host;try{return v_.has(new URL(`http://${t}`).hostname)}catch{return!1}}const b_=e=>e.local?`local`:e.config.store===`postgres`?`cloud`:`memory`,x_=e=>e.startsWith(`/tasks/`)||e.startsWith(`/logins/`)||e===`/runners/register`,S_=[`/hooks/`,`/create/`,`/install/`,`/connect/`];function C_(e,t){let n=e?.replace(/^::ffff:/,``)??``;if(v_.has(n)||n.startsWith(`127.`))return!0;let r=URL.parse(`http://localhost${t}`)?.pathname??``;return r===`/connections/oauth/client.json`||x_(r)||S_.some(e=>r.startsWith(e))}function w_(e,t){if(!t.local)return!0;let n=new URL(e.url),r=e.headers.get(`host`)??n.host,i=URL.parse(`http://${r}`)?.port||`80`;if(y_(e)&&i===String(t.local.port))return!0;let a=t.config.publicUrl?new URL(t.config.publicUrl).host:void 0;return(e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim()??r)===a&&!y_(e)&&(n.pathname===`/connections/oauth/client.json`||x_(n.pathname)||S_.some(e=>n.pathname.startsWith(e)))}function T_(e,t){let n=e.headers.get(`origin`)??e.headers.get(`referer`);if(!n)return!1;try{return new URL(n).origin===new URL(t??e.url).origin}catch{return!1}}function E_(e){let t=e.headers.get(`cookie`)?.split(`;`).map(e=>e.trim()).find(e=>e.startsWith(`coder_admin=`))?.slice(12);if(!t)return null;try{return decodeURIComponent(t)}catch{return null}}async function D_(e,t){let n=Z(e);if(n&&ts(n))return O_(e,t,n);if(!t.auth){let n=()=>new Response(`Unauthorized`,{status:401,headers:{"www-authenticate":`Bearer`}});if(t.config.store!==`memory`||!y_(e))return n();let r=E_(e),i=__(Z(e),t.config.adminToken),a=__(r,t.config.adminToken);return i?{...t,authorizedRequest:e}:a?e.method===`GET`||T_(e)?{...t,authorizedRequest:e}:jn():n()}let r=await t.auth.session(e.headers,e.method!==`GET`);if(r?.stale)return D({error:`Token too old for this action.`},401,{"www-authenticate":`Bearer error="invalid_token", error_description="Token too old for this action"`});if(r?.organizationDenied)return D({error:`You are not a member of that workspace.`},403);let i=r?.role;return!r?.organizationId||!i?D({error:`Sign in first.`,hint:`coder auth login`},401,Z(e)?{"www-authenticate":`Bearer error="invalid_token"`}:{}):e.method!==`GET`&&e.headers.has(`cookie`)&&!T_(e,t.config.publicUrl)?jn():{...z(t,r.organizationId),auth:t.auth,session:r,authorizedRequest:e}}async function O_(e,t,n){let r=B_(n);r&&t.scope&&(t=z(t,r));let i=await ns(t,n);return i?{...rs(t,i),authorizedRequest:e}:D({error:`The task has ended.`},401,{"www-authenticate":`Bearer error="invalid_token"`})}async function k_(e,t){let n=await e.clone().json().catch(()=>void 0),r=n?.event;if(!r)return t;if(t.taskPrincipal)return D({error:`A task starts only its own child tasks.`},403);let i=r.actor?.id;if(t.auth&&i&&r.integration){let e=await t.auth.linkedUser(r.integration,i);if(e&&e.id!==t.session?.user.id)return D({error:`The event's actor is linked to another member`},403)}let a=await df(t,n),o=!(a instanceof Response)&&await dc(t,a.event);return o&&await m_(t,o,!0)||t}async function A_(e,t,n,r){if(n!==`agent-settings`||r.slug!==t.taskPrincipal?.agent)return!0;let i=await e.clone().json().catch(()=>void 0),a=(await t.store.get(`agent`,r.slug))?.settings;return!!as(a,i)}async function j_(e,t,n){let r=t.taskPrincipal;if(!r)return t;if(n.slug!==r.agent)return D({error:`A task changes only its own agent.`},403);if(!r.asker)return D({error:`Changing the agent needs a linked member asking.`},403);let i=await e.clone().json().catch(()=>void 0),a=(await t.store.get(`agent`,n.slug))?.settings,o=as(a,i);return o?D({error:o},403):t}async function M_(e,t){if(!t.auth)return t;let n=new Headers(e.headers),r=new URL(e.url).searchParams.get(`organization`);r&&n.set(`x-coder-organization`,r);let i=await t.auth.session(n,!0);if(i?.organizationDenied)return new Response(`You are not a member of that workspace.`,{status:403});let a=i?.role;return!i?.organizationId||!a?An(new URL(e.url)):{...z(t,i.organizationId),session:i}}async function N_(e,t){if(e.method!==`POST`)return;let n=Tg.safeParse(await e.clone().json().catch(()=>void 0));if(!n.success||n.data.token)return;let{id:r,organizationId:i,secret:a}=n.data;if(!r||!i||i!==t.organizationId&&!t.scope)return;let o=z(t,i),s=await o.store.get(`runner`,r);if(s?.kind===`http`&&_t(R(o.config,s.secret).secret??``,a))return`runner:${i}:${r}`}async function P_(e,t,n,r){let i=n.id,a=Z(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=es(a);return o.task!==i||typeof o.organization!=`string`||!o.organization||!Number.isInteger(o.attempt)||(t.scope&&(t=z(t,o.organization)),t.organizationId!==o.organization)?new Response(`Unauthorized`,{status:401}):t}async function F_(e,t,n,r,i=!1,a){let o=n.id,s=Z(e),c=s&&B_(s);c&&t.scope&&(t=z(t,c));let l=await Jg(e,t,o,i,a);if(l instanceof Response)return l;let{status:u,loaded:d}=l;return{...t,...d?{store:$s(t.store,u,d)}:{},...d?.workspace?{callbackWorkspace:d.workspace}:{},callbackTask:u}}const I_=(e,t)=>(n,r,i,a)=>F_(n,r,i,a,t(n),e),L_=I_(`secrets`,e=>e.method===`POST`),R_=I_(`secrets`,()=>!0),z_=I_(`context`,()=>!1);function B_(e){let{organization:t}=es(e);return typeof t==`string`?t:void 0}async function V_(e,t,n){let r=Z(e);if(!r)return new Response(`Unauthorized`,{status:401});let i=B_(r),a=i&&t.scope&&i!==t.organizationId?z(t,i):t,o=n.id,s=await a.store.get(`login`,o);return!s||!_t(Qo(r),s.tokenHash)?new Response(`Unauthorized`,{status:401}):{...a,callbackLogin:s}}async function H_(e,t){let n=e.method===`POST`?new URLSearchParams(await e.clone().text()):void 0;return t.searchParams.get(`tx`)??Pn(t.searchParams.get(`state`))?.tx??n?.get(`tx`)??void 0}async function U_(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??n.id??``))return $i(e,t);let i=await H_(e,r),a=t.serverOrganizationId??t.organizationId;return i&&ni(t,i)===`*`&&ti(t,i)===a?{...z(t,a),operatorApp:!0}:M_(e,t)}function W_(e,t,n,r){return/^[a-z0-9_-]+$/.test(n.integration??n.id??``)?M_(e,t):$i(e,t)}async function G_(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??``))return $i(e,t);if(!t.integrations[n.integration]?.auth.user||!t.auth||!t.config.publicUrl)return A();if(e.method!==`GET`)return t;let i=await u_(e,t);return i?.session?i:An(r)}async function K_(e,t,n,r){if(t.local&&!t.auth)return Z_(e,t);if(!t.auth)return A();let i=await u_(e,t);return i?.session?i:An(r)}function q_(e,t){return g_(t,`Workspace admin access is required.`)}const J_=(e,t=e.session)=>!e.auth||!!(t&&e.config.operators?.includes(t.user.id));async function Y_(e,t){return J_(t)?t.auth&&await t.auth.operator(e.headers)!==t.session.user.id?D({error:`Operator mode ended. Sign in again to continue.`},401):t:A()}async function X_(e,t,n,r){let i=await ov(e,t,n,r);return i instanceof Response||!t.auth?i:J_(t,await t.auth.session(e.headers))?(await t.auth.operator(e.headers),i):A()}function Z_(e,t){return t.local?t:A()}function Q_(e,t){return t.local?D({error:Mp},400):t.session?.user.id?t:D({error:`Sign in to use a subscription.`},403)}function $_(e,t){return async(n,r,i,a)=>{let o=r.authorizedRequest===n?r:await D_(n,r);return o instanceof Response?o:o.taskPrincipal&&!t?.approvalPolicy?D({error:`Not available to a task.`},403):o.taskPrincipal&&t?.approvalPolicy===`ask`&&await A_(n,o,t.change,i)?Hu(n,o,t.change,i):e?e(n,o,i,a):o}}function ev(e,t,n,r){return e.method===(n.engine?`POST`:`GET`)&&(!t.local||n.engine&&!Pp(n.engine))?D({error:n.engine?`Engine sign-in is available on a local server only`:`Engine status is available on a local server only`},404):t}async function tv(e,t,n,r){return t.config.publicUrl&&t.auth?t:$i(e,t)}async function nv(e,t,n,r){if(!t.auth)return D_(e,t);if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=await t.auth.session(e.headers);return i?.organizationDenied?D({error:`You are not a member of that workspace.`},403):i?{...i.organizationId?z(t,i.organizationId):t,session:i}:D({error:`Sign in first.`,hint:`coder auth login`},401)}function rv(e,t,n,r){return e.method===`POST`?t.auth||t.config.store!==`memory`||!y_(e)?A():T_(e)?t:jn():t}async function iv(e,t,n,r){return e.method===`GET`?{...t,session:(await u_(e,t))?.session}:t}async function av(e,t,n,r){return[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)&&t.auth&&(await u_(e,t))?.session?j(`/dash`):t}async function ov(e,t,n,r){if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=r.pathname.split(`/`)[2]??``,a=new Headers(e.headers);a.delete(`x-coder-organization`),i&&a.set(`x-coder-organization`,i);let o=await t.auth?.session(a);if(o&&!o.organizations.length)return t.auth.handler(new Request(r.origin+`/api/auth/sign-in?return=`+encodeURIComponent(r.pathname+r.search)));if(t.auth&&!o)return qi(e,t,r,r.pathname+r.search);let s=o?.organizations??[{id:t.organizationId,slug:`local`,name:``,role:`owner`}],c=s.find(e=>encodeURIComponent(e.slug)===i);if(!c){let n=s.find(e=>encodeURIComponent(e.id)===i),a=(await t.auth?.session(e.headers))?.organizationId,o=n??s.find(e=>e.id===a)??s[0],c=`/dash/${encodeURIComponent(o.slug)}`,l=r.pathname.slice(`/dash/${i}`.length);if(n)return j(`${c}${l}${r.search}`);let u=`${c}${r.pathname.slice(5)}`;return await Mi(u,t.dashboardHosts)?j(`${u}${r.search}`):t.auth&&e.method===`GET`&&await Mi(`${c}${l}`,t.dashboardHosts)?j(`${c}/agents?${new URLSearchParams({link:r.pathname+r.search})}`):A()}return t.auth?(await t.auth.setOrganization(e.headers,c.slug),{...z(t,c.id),session:o}):t}function sv(e,t,n,r){return e.method===`POST`&&t.local?D({error:Mp},400):t}function cv(e,t,n,r){return![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)||t.auth?t:A()}const lv=`x-coder-request-scope`;function uv(e,{sessions:t,operators:n,cookies:r}){let i=e.auth;return i?{...e,auth:{...i,session(e,n){let a=JSON.stringify([...[`cookie`,`authorization`].map(t=>e.get(t)),!!n]),o=t.get(a);if(!o){let s=new Headers(e);s.delete(`x-coder-organization`),o=i.session(s,n,r),t.set(a,o)}let s=e.get(`x-coder-organization`);return s?o.then(e=>e&&(e.stale?e:ta(e,s))):o},setOrganization:(e,t)=>i.setOrganization(e,t,r),operator(e){let t=e.get(`cookie`)??``,a=n.get(t);return a||(a=i.operator(e,r),n.set(t,a)),a}}}:e}function dv(e,t,n){let r=t.requestScopes??=new Map,i=e.headers.get(lv),a=n&&i?r.get(i):void 0;if(a)return{req:e,ctx:uv(t,a),end(){}};let o=new Headers(e.headers);if(o.delete(lv),!t.auth)return{req:i?new Request(e,{headers:o}):e,ctx:t,end(){}};let s=I(),c={sessions:new Map,operators:new Map,cookies:[]};return r.set(s,c),o.set(lv,s),{req:new Request(e,{headers:o}),ctx:uv(t,c),cookies:c.cookies,end:()=>r.delete(s)}}const fv=`/connections/oauth/client.json`,pv=`/connections/oauth/callback`,mv=6e5,hv=e=>`connection-oauth:${e}`;async function gv(e,t,n){await e.store.put(`delivery`,`connection-authorized:${Fr(`sha256`).update(n).digest(`hex`)}`,{at:(e.now??Date.now)(),target:`${t.id}:${t.createdAt}`},{ttlMs:mv})}const Q=c().check(u(1)),_v=f({resource:Q,authorization_servers:o(Q).check(u(1)),scopes_supported:i(o(Q))}),vv=f({issuer:Q,authorization_endpoint:Q,token_endpoint:Q,registration_endpoint:i(Q),userinfo_endpoint:i(Q),scopes_supported:i(o(Q)),code_challenge_methods_supported:i(o(Q)),client_id_metadata_document_supported:i(a()),authorization_response_iss_parameter_supported:i(a())}),yv=s([`none`,`client_secret_basic`,`client_secret_post`]),bv=f({client_id:Q,client_secret:i(Q),token_endpoint_auth_method:i(yv),redirect_uris:i(o(Q))}),xv=f({name:i(Q),preferred_username:i(Q),email:i(Q)});function Sv(e,t){let n=We(t);if(!Ke(n,!!e.local))throw Error(`OAuth endpoint is not allowed.`);return n}async function Cv(e,t,n,r=!1){for(let i of[...new Set(n)]){Sv(e,i);let n=await nt(t,i,{headers:{accept:`application/json`}});if(n.status!==404&&n.status!==405&&!(r&&(n.status===401||n.status===403))){if(!n.ok)throw Error(`OAuth metadata discovery failed.`);return n.json()}}if(!r)throw Error(`OAuth metadata is unavailable.`)}function wv(e){let t={},n=``;for(let r of e?.matchAll(/(?:^|,)\s*(?:([\w-]+)\s+)?([\w-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/g)??[]){if(r[1]){if(n===`bearer`)break;n=r[1].toLowerCase()}n===`bearer`&&(t[r[2].toLowerCase()]=r[3]?.replace(/\\(.)/g,`$1`)??r[4])}return t}async function Tv(e,t,n=!1,r){let i=Sv(e,t),a=e.fetch??fetch;if(r===void 0){let e=await nt(a,i.href);r=e.status===401?e.headers.get(`www-authenticate`)??``:``,await e.body?.cancel()}let o=wv(r),s=await Cv(e,a,o.resource_metadata?[o.resource_metadata]:[i.origin+`/.well-known/oauth-protected-resource`+(i.pathname===`/`?``:i.pathname),i.origin+`/.well-known/oauth-protected-resource`],n&&!o.resource_metadata);if(s===void 0)return;let c=_v.parse(s);if(Sv(e,c.resource).origin!==i.origin)throw Error(`OAuth resource changed origin.`);return{resource:c,params:o}}function Ev(e){if(e.local)return`http://localhost:${e.local.port}`;if(e.config.publicUrl)return We(e.config.publicUrl).origin;throw Error(`PUBLIC_URL or a local server is required for OAuth.`)}function Dv(e){let t=Ev(e);return{client_name:e.config.name??`Coder`,redirect_uris:[t+pv],grant_types:[`authorization_code`,`refresh_token`],response_types:[`code`],token_endpoint_auth_method:`none`}}function Ov(e,t){return!t.config.publicUrl||We(t.config.publicUrl).protocol!==`https:`?A():D({client_id:We(t.config.publicUrl).origin+fv,...Dv(t)})}function kv(e){if(e.session)return e.session.user.id;if(e.local&&!e.auth)return`local`;throw Error(`Sign in before authorizing a connection.`)}function Av(e,t){if(!e||e.createdAt!==t.createdAt||e.owner!==t.owner||e.auth!==`oauth`||e.provider!==`mcp`||JSON.stringify(e.endpoint)!==JSON.stringify(t.endpoint))throw Error(`The connection changed during authorization.`)}async function jv(e,t,n){let r=await e.get(`delivery`,hv(t));if(!r||!(`target`in r)||r.target!==n)throw Error(`The authorization attempt was superseded or expired.`)}async function Mv(e,t,n){let r=kv(e);if(t.auth!==`oauth`||t.provider!==`mcp`||!t.endpoint||!(`url`in t.endpoint)||typeof t.endpoint.url!=`string`||t.owner&&t.owner!==r)throw Error(`This connection cannot be authorized.`);let i=e.fetch??fetch,{resource:a,params:o}=n??await Tv(e,t.endpoint.url),s=a.authorization_servers[0],c=Sv(e,s);if(c.search)throw Error(`OAuth issuer cannot contain a query.`);let l=c.pathname.replace(/\/$/,``),u=vv.parse(await Cv(e,i,[c.origin+`/.well-known/oauth-authorization-server`+l,c.origin+`/.well-known/openid-configuration`+l,c.origin+l+`/.well-known/openid-configuration`]));if(u.issuer!==s)throw Error(`OAuth issuer mismatch.`);if(!u.code_challenge_methods_supported?.includes(`S256`))throw Error(`OAuth server does not support PKCE S256.`);Sv(e,u.authorization_endpoint),Sv(e,u.token_endpoint),u.registration_endpoint&&Sv(e,u.registration_endpoint),u.userinfo_endpoint&&Sv(e,u.userinfo_endpoint);let d=t.secret?R(e.config,t.secret):void 0,f=d?.issuer===s&&d.clientId?{clientId:d.clientId,clientSecret:d.clientSecret,tokenEndpointAuthMethod:d.tokenEndpointAuthMethod}:void 0;if(!f&&u.client_id_metadata_document_supported&&e.config.publicUrl&&We(e.config.publicUrl).protocol===`https:`&&(f={clientId:We(e.config.publicUrl).origin+fv,tokenEndpointAuthMethod:`none`}),!f){if(!u.registration_endpoint)throw Error(`OAuth server does not support client registration.`);let t=await nt(i,u.registration_endpoint,{method:`POST`,headers:{"content-type":`application/json`,accept:`application/json`},body:JSON.stringify(Dv(e))});if(!t.ok)throw Error(`OAuth client registration failed.`);let n=bv.parse(await t.json()),r=n.token_endpoint_auth_method??`client_secret_basic`;if(r!==`none`&&!n.client_secret)throw Error(`OAuth registration omitted the client secret.`);if(n.redirect_uris&&!n.redirect_uris.includes(Ev(e)+pv))throw Error(`OAuth registration changed the redirect URI.`);f={clientId:n.client_id,clientSecret:n.client_secret,tokenEndpointAuthMethod:r}}let p={issuer:s,authorizationEndpoint:u.authorization_endpoint,tokenEndpoint:u.token_endpoint,resource:a.resource,...f,scope:o.scope??a.scopes_supported?.join(` `)??u.scopes_supported?.join(` `)},m=L(e.config,p),h=F(18).toString(`base64url`);await e.store.withAppLock(`connection:${t.id}`,async n=>{Av(await n.get(`connection`,t.id),t),await n.put(`delivery`,hv(t.id),{at:(e.now??Date.now)(),target:h},{ttlMs:mv})});let g=F(32).toString(`base64url`),_=await Qr(e,`connection-oauth`,r,L(e.config,{id:t.id,attempt:h,secret:m,createdAt:t.createdAt,endpoint:t.endpoint,owner:t.owner,verifier:g,redirectUri:Ev(e)+pv,userinfo:u.userinfo_endpoint,requireIssuer:u.authorization_response_iss_parameter_supported===!0}),mv),v=new URL(p.authorizationEndpoint),y={response_type:`code`,client_id:p.clientId,redirect_uri:Ev(e)+pv,state:_,code_challenge:Fr(`sha256`).update(g).digest(`base64url`),code_challenge_method:`S256`,resource:p.resource};for(let[e,t]of Object.entries(y))v.searchParams.set(e,t);return p.scope!==void 0&&v.searchParams.set(`scope`,p.scope),v.href}async function Nv(e,t,n){let r=t,i=e=>j(`${Rv(Iv(r),`/settings/connections`)}?outcome=${e}`);try{let e=n.searchParams.get(`state`)??``,a=ti(t,e);if(t.auth&&(!a||!t.session?.organizations.some(e=>e.id===a)))return i(`invalid-state`);let o=t.session?zv(t,t.session,a)??t:t;r=o;let s=await ai(o,e,`connection-oauth`,kv(o));if(!s)return i(`invalid-state`);let c=R(o.config,s);if(!c.owner&&!p_(o))return i(`failed`);let l=R(o.config,c.secret),u=n.searchParams.get(`iss`);if((c.requireIssuer||u!==null)&&u!==l.issuer)return i(`failed`);if(n.searchParams.has(`error`))return i(n.searchParams.get(`error`)===`access_denied`?`denied`:`failed`);let d=n.searchParams.get(`code`);if(!d)return i(`failed`);Av(await o.store.get(`connection`,c.id),c),await jv(o.store,c.id,c.attempt);let f=o.fetch??fetch,p=await Be(f,l,new URLSearchParams({grant_type:`authorization_code`,code:d,redirect_uri:c.redirectUri,code_verifier:c.verifier})),m=p.preferred_username??p.email??p.name;if(!m&&c.userinfo)try{let e=await nt(f,c.userinfo,{headers:{authorization:`Bearer ${p.access_token}`,accept:`application/json`}});if(e.ok){let t=xv.parse(await e.json());m=t.preferred_username??t.email??t.name}}catch(e){console.error(`coder server: OAuth userinfo failed`,e)}return await o.store.withAppLock(`connection:${c.id}`,async t=>{let n=await t.get(`connection`,c.id);Av(n,c),await jv(t,c.id,c.attempt),await t.put(`connection`,n.id,{...n,secret:L(o.config,He(l,p,(o.now??Date.now)())),account:m??n.account,broken:void 0,updatedAt:(o.now??Date.now)()}),await t.delete(`delivery`,hv(c.id)),await gv({...o,store:t},n,e)}),i(`connected`)}catch(e){return console.error(`coder server: connection OAuth callback failed`,e),i(`failed`)}}async function Pv(e,t,n,r){let i=(!t.auth||t.session?.organizationId)&&await Wm(t,t.session?.user.id).catch(()=>!1);if(!t.auth)return D({mode:b_(t),organization:{id:t.organizationId,slug:`local`},server:Fv(t),operator:J_(t),...i?{reconnect:i}:{}});let a=t.session,o=a.organizations.find(e=>e.id===a.organizationId)??null;return D({mode:b_(t),user:a.user,organization:o,organizations:a.organizations,...o&&{manageMembersUrl:`${t.auth.issuer}/dash/${encodeURIComponent(o.slug)}/members`},server:Fv(t),operator:J_(t,a),...i?{reconnect:i}:{}})}function Fv(e){return{name:e.config.name??`Coder`,store:e.config.store,...e.config.publicUrl?{url:e.config.publicUrl}:{},issuesUrl:e.config.issuesUrl,subscriptions:{claude:!!e.config.subscriptions?.claude,codex:!!e.config.subscriptions?.codex}}}function Iv(e){let t=e.session?.organizations??[];return(t.find(t=>t.id===e.organizationId)??t.find(t=>t.id===e.session?.organizationId))?.slug??(e.auth?e.organizationId:`local`)}async function Lv(e,t){let n=e.session?.organizations.find(t=>t.id===e.organizationId)?.slug??t?.slug;return n||!e.auth?n??`local`:t?e.organizationId:(await e.auth.organization?.(e.organizationId))?.slug??e.organizationId}const Rv=(e,t=``)=>e?`/dash/${encodeURIComponent(e)}${t}`:`/dash${t}`;function zv(e,t,n){let r=n&&t.organizations.find(e=>e.id===n);return r?{...z(e,r.id),session:{...t,organizationId:r.id,role:r.id===t.organizationId?t.role:r.role}}:void 0}async function Bv(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=Mn(r.searchParams.get(`return`),r.origin),l=c.startsWith(`/dash/`)?c:void 0,u=zv(t,s,r.searchParams.get(`organization`)??s.organizationId),d=r.searchParams.get(`connection`),f=u&&d&&await u.store.get(`connection`,d);if(!u||!f||f.provider!==i.id||f.auth!==`oauth`||f.owner!==s.user.id)return D({error:`Unknown OAuth connection`},404);let p=await Ym(u,i.id);if(!p)return D({error:`No OAuth client is available for ${i.name}.`},400);let m=await Qr(u,`native-oauth`,s.user.id,JSON.stringify({connection:f,app:p.id,attempt:r.searchParams.get(`attempt`),back:l}));return j(a.authorizeUrl(R(t.config,p.credentials),{publicUrl:o,state:m,access:f.access??`auto`}))}async function Vv(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`state`)??``,l=zv(t,s,ti(t,c)),u=l??{...t,session:s},d=l&&await ai(l,c,`native-oauth`,s.user.id);if(!l||!d)return $(u,`link-expired`,{platform:i.id});let f=JSON.parse(d),p=f.back,m=f.connection;if(m.provider!==i.id||m.owner!==s.user.id)return $(u,`link-expired`,{platform:i.id},p);let h=await Ym(l,i.id,f.app);return h?l.store.withAppLock(`connection:${m.id}`,async n=>{let r=await n.get(`connection`,m.id);if(!r||JSON.stringify(r)!==JSON.stringify(m))return $(u,`link-expired`,{platform:i.id},p);let c=await a.exchange(e,R(t.config,h.credentials),{publicUrl:o,access:r.access??`auto`,fetch:((e,n)=>(t.fetch??fetch)(e,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)}))}).catch(e=>{console.error(`coder server: ${i.id} connection sign-in failed`,e)});return c?.token?await t.auth.link(s.user,i.id,c.id,{...na(s.organizations),token:L(t.config,{app:h.id,token:c.token}),organizationId:l.organizationId,...c.login?{login:c.login}:{}},n)===`taken`?$(u,`account-taken`,{platform:i.id},p):(await n.put(`connection`,r.id,{...r,account:c.id,oauthApp:h.id,secret:void 0,broken:void 0,updatedAt:(t.now??Date.now)()}),f.attempt&&await gv({...l,store:n},r,f.attempt),$(u,`linked`,{platform:i.id,account:c.login??c.id},p)):$(u,`failed`,{platform:i.id},p)}):$(u,`link-expired`,{platform:i.id},p)}function Hv(e,t,n){let r=e.integrations[n]?.events;return{name:e.name??t,...e.description?{description:e.description}:{},events:Array.isArray(r)?r:Object.keys(r??{}),...e.access?{access:e.access}:{}}}function $(e,t,n={},r){let i=new URLSearchParams({status:t});for(let[e,t]of Object.entries(n))t?.length&&i.set(e,Array.isArray(t)?t.join(`,`):t);/^[\w.-]{1,64}$/.test(i.get(`error`)??``)||i.delete(`error`);let a=r??Rv(Iv(e),`/setup`);return j(`${Uv(e)}${a.replace(/[?#].*$/,``)}?${i}`)}const Uv=e=>e.local?`http://localhost:${e.local.port}`:``,Wv=(e,t)=>Rv(Iv(e),`/agents/${encodeURIComponent(t)}/platforms`);function Gv(e){let t=e.get(`agent`),n=e.get(`def`),r=Pn(n);if(!(!t||!n||!r?.integrations))return{state:{agent:t,repo:e.get(`repo`)??void 0,branch:e.get(`branch`)??void 0,def:n,tx:e.get(`tx`)??void 0,owner:e.get(`owner`)||void 0,...[`1`,`true`].includes(e.get(`public`)??``)?{public:!0}:{}},definition:r}}const Kv=e=>typeof e==`string`&&/^\/dash(?:[/?#]|$)/.test(e)?e:void 0,qv=(e,t)=>JSON.stringify({integration:e,agent:t.agent,repo:t.repo??null,branch:t.branch??null,def:t.def,owner:t.owner??null,public:t.public??!1});async function Jv(e,t,n,r){let i=await oi(e,t,`create`,r),a=i?JSON.parse(i):void 0,o=Pn(a?.def??null);if(!(a?.integration!==n||!o?.integrations||!await ii(e,t,`create`,r,i)))return{state:{agent:a.agent,repo:a.repo??void 0,branch:a.branch??void 0,def:a.def,tx:t,owner:a.owner??void 0,...a.public?{public:!0}:{}},definition:o}}const Yv=e=>`app-token:${e}:`;async function Xv(e,t){return(await e.store.list(`snapshot`,{prefix:Yv(t)})).flatMap(({id:t,value:n})=>{if(!(`secret`in n))return[];let r=R(e.config,n.secret);return r.unusable?[]:[{id:t,token:r}]}).sort((e,t)=>t.token.lastUsedAt-e.token.lastUsedAt).map(({id:e,token:t})=>({id:e,label:`${t.workspaceName} · saved by ${t.savedBy}`}))}function Zv(e,t){let n=()=>(e.now??Date.now)();return{async put(r){let i=Yv(t)+ht(JSON.stringify([r.workspace,r.user]));return await e.store.withAppLock(`${e.organizationId}:${i}`,t=>t.put(`snapshot`,i,{secret:L(e.config,{...r,savedBy:e.session?.user.name||`Server operator`,lastUsedAt:n()})})),i},async use(r,i){if(!r.startsWith(Yv(t)))throw new ve(`invalid-field`,`token`,`Choose a saved configuration token or paste a new one.`);let a=await e.store.withAppLock(`${e.organizationId}:${r}`,async t=>{let a=await t.get(`snapshot`,r),o=a&&R(e.config,a.secret);if(!o||o.unusable)return{error:new ve(`invalid-field`,`token`,`This configuration token is unavailable. Paste a new token.`)};let s=()=>t.put(`snapshot`,r,{secret:L(e.config,o)});try{let e=await i(o.credentials,async(e,t)=>{t&&(o.workspaceName=t),o.credentials=e,await s()},async()=>{o.unusable=!0,await s()});return o.lastUsedAt=n(),await s(),{value:e}}catch(e){return{error:e}}});if(`error`in a)throw a.error;return a.value}}}var Qv=t({serverAppLink:()=>ey,serverAppUrl:()=>ty,sharedApps:()=>$v});async function $v(e,t){let n=e.serverOrganizationId!==void 0&&e.serverOrganizationId!==e.organizationId?e.scope?.(e.serverOrganizationId).store??e.store:e.store;return(await(n===e.store&&t?t:n.list(`app`))).map(({value:e})=>e).filter(t=>t.builtin&&e.integrations[t.integration]?.app.shareable)}async function ey(e,t={}){let n=Wn(t.env??br.env),r=pt(n.integrations);if(!r[e])throw new m(`invalid-option`,`Unknown integration "${e}".`,{hint:`Pick one of ${Object.keys(r).join(`, `)}.`});if(!r[e].app.shareable)throw new m(`invalid-option`,`Create ${e} apps in your workspace from the agent's Platforms tab.`);if(!n.databaseUrl||!n.publicUrl)throw new m(`invalid-option`,`Built-in apps need the server database and address.`,{hint:`Set DATABASE_URL and PUBLIC_URL as the server has them.`});let i=await So(n);try{let a=i.defaultOrganizationId;return{url:await ty({config:n,integrations:r,organizationId:a,store:i.store(a)},e,t)}}finally{await i.close()}}async function ty(e,t,n){if(!e.integrations[t]?.app.shareable)throw new m(`invalid-option`,`Create ${t} apps in your workspace from the agent's Platforms tab.`);let r=ot();if(!r)throw new m(`invalid-option`,`This server ships no default agent.`);let i={...ct()[r].json,...n.name?{name:n.name}:{}},a={agent:r,def:gt(i),...n.owner?{owner:n.owner}:{},public:!0},o=await Qr(e,`create`,`*`,qv(t,a)),s=new URLSearchParams({agent:a.agent,def:a.def,...a.owner?{owner:a.owner}:{},public:`1`,tx:o});return`${Uv(e)||e.config.publicUrl.replace(/\/$/,``)}/create/${t}?${s}`}export{h_ as $,Ks as $n,yi as $r,Om as $t,sv as A,Ud as An,so as Ar,eg as At,R_ as B,hu as Bn,ya as Br,dh as Bt,$_ as C,$d as Cn,jo as Cr,hg as Ct,K_ as D,Kd as Dn,wo as Dr,bg as Dt,cv as E,tf as En,So as Er,gg as Et,W_ as F,bu as Fn,Ha as Fr,Gh as Ft,iv as G,iu as Gn,$i as Gr,Tm as Gt,G_ as H,vu as Hn,ta as Hr,km as Ht,w_ as I,gu as In,Ga as Ir,Ih as It,T_ as J,Xl as Jn,Qi as Jr,Em as Jt,dv as K,ql as Kn,Gi as Kr,Wp as Kt,Z_ as L,_u as Ln,Ma as Lr,fh as Lt,rv as M,Md as Mn,ho as Mr,Lh as Mt,ev as N,Qu as Nn,Va as Nr,rg as Nt,z_ as O,Vd as On,Ja as Or,X as Ot,P_ as P,ed as Pn,qa as Pr,ig as Pt,C_ as Q,hl as Qn,Si as Qr,Dm as Qt,Q_ as R,Su as Rn,Na as Rr,qm as Rt,nv as S,hf as Sn,Ao as Sr,xg as St,j_ as T,nf as Tn,No as Tr,Eg as Tt,Y_ as U,ou as Un,na as Ur,uh as Ut,tv as V,pu as Vn,_a as Vr,ch as Vt,X_ as W,cu as Wn,ki as Wr,fm as Wt,b_ as X,Vl as Xn,Hi as Xr,Gp as Xt,L_ as Y,Yl as Yn,Xi as Yr,wm as Yt,av as Z,Hl as Zn,Ji as Zr,vm as Zt,Bv as _,uf as _n,Vo as _r,Ig as _t,Kv as a,di as ai,mp as an,ds as ar,Yg as at,Ov as b,_f as bn,Oo as br,vg as bt,$ as c,Qr as ci,Op as cn,V as cr,$g as ct,Xv as d,kf as dn,Fo as dr,c_ as dt,bi as ei,Rp as en,Js as er,k_ as et,Jv as f,jf as fn,Zo as fr,Fg as ft,Iv as g,cf as gn,Wo as gr,qg as gt,Pv as h,mf as hn,Ko as hr,Kg as ht,Zv as i,L as ii,np as in,os as ir,l_ as it,ov as j,Pd as jn,lo as jr,qh as jt,U_ as k,Hd as kn,co as kr,Rh as kt,Wv as l,If as ln,cs as lr,o_ as lt,Rv as m,Jd as mn,Bo as mr,Pg as mt,$v as n,R as ni,xp as nn,Os as nr,Xg as nt,qv as o,gi as oi,hp as on,$o as or,s_ as ot,Vv as p,Af as pn,Jo as pr,Lg as pt,g_ as q,Jl as qn,Ki as qr,Vp as qt,Hv as r,mi as ri,ap as rn,ks as rr,Qg as rt,Uv as s,oi as si,op as sn,ss as sr,Zg as st,Qv as t,vi as ti,bp as tn,Ds as tr,F_ as tt,Gv as u,Mf as un,fs as ur,a_ as ut,fv as v,sf as vn,Ho as vr,Ng as vt,q_ as w,ef as wn,Mo as wr,wg as wt,v_ as x,gf as xn,Po as xr,_g as xt,Nv as y,lf as yn,Go as yr,Mg as yt,V_ as z,Cu as zn,xa as zr,lh as zt};