coderemote 0.0.0-stage → 0.1.1

package/dist/coderemote.js

@@ -0,0 +1,1162 @@
+#!/usr/bin/env node
+
+// bin/coderemote.js
+import { execFile as execFile2, spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import fs5 from "node:fs";
+import os3 from "node:os";
+import path5 from "node:path";
+import { promisify } from "node:util";
+import qrcode from "qrcode-terminal";
+
+// ../../packages/agent-core/src/server.js
+import { createReadStream, createWriteStream } from "node:fs";
+import fs3 from "node:fs/promises";
+import http from "node:http";
+import os2 from "node:os";
+import path3 from "node:path";
+import { pipeline } from "node:stream/promises";
+import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+
+// ../../packages/protocol/index.js
+var PROTOCOL_VERSION = 4;
+var PAIRING_SCHEME = "vsremote";
+var Routes = Object.freeze({
+  info: "GET /api/info",
+  fsList: "GET /api/fs/list",
+  fsStat: "GET /api/fs/stat",
+  fsRead: "GET /api/fs/read",
+  fsWrite: "PUT /api/fs/write",
+  fsMkdir: "POST /api/fs/mkdir",
+  fsRename: "POST /api/fs/rename",
+  fsDelete: "DELETE /api/fs",
+  termList: "GET /api/term",
+  termKill: "DELETE /api/term",
+  gitRepos: "GET /api/git/repos",
+  gitStatus: "GET /api/git/status",
+  gitDiff: "GET /api/git/diff",
+  gitStage: "POST /api/git/stage",
+  gitUnstage: "POST /api/git/unstage",
+  gitDiscard: "POST /api/git/discard",
+  gitCommit: "POST /api/git/commit",
+  gitLog: "GET /api/git/log",
+  gitShow: "GET /api/git/show",
+  gitPull: "POST /api/git/pull",
+  gitPush: "POST /api/git/push",
+  tunnelToken: "POST /api/tunnel/token"
+});
+var TUNNEL_HANDOFF_PATH = "/vsremote/handoff";
+var TUNNEL_AUTH_CALLBACK_HOST = "tunnel-auth";
+var TERMINAL_WS_PATH = "/api/term/ws";
+var TerminalServerMessage = Object.freeze({ session: "session", exit: "exit" });
+var TerminalClientMessage = Object.freeze({ input: "input", resize: "resize" });
+function webUrl({ url, token }) {
+  return `${url}/#token=${encodeURIComponent(token)}`;
+}
+function pairingUrl({ url, token }) {
+  return `${PAIRING_SCHEME}://pair?url=${encodeURIComponent(url)}&token=${encodeURIComponent(token)}`;
+}
+
+// ../../packages/agent-core/src/server.js
+import { WebSocketServer } from "ws";
+
+// ../../packages/agent-core/src/git.js
+import { execFile } from "node:child_process";
+import fs2 from "node:fs/promises";
+import path2 from "node:path";
+
+// ../../packages/agent-core/src/sandbox.js
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+var HttpError = class extends Error {
+  constructor(status2, message) {
+    super(message);
+    this.status = status2;
+  }
+};
+var Sandbox = class {
+  constructor(root2) {
+    this.root = path.resolve(root2);
+    this.realRoot = fsSync.realpathSync(this.root);
+  }
+  #containsReal(p) {
+    return p === this.realRoot || p.startsWith(this.realRoot + path.sep);
+  }
+  #containsLexically(p) {
+    return p === this.root || p.startsWith(this.root + path.sep);
+  }
+  /**
+   * Returns the absolute path for `p` (absolute, or relative to the root) after checking that
+   * it really lives inside the root. With `allowMissing`, the path may not exist yet
+   * (write/mkdir/rename targets); its nearest existing ancestor must still resolve inside.
+   */
+  async resolve(p, { allowMissing = false } = {}) {
+    return (await this.#check(p, allowMissing)).abs;
+  }
+  /** Like `resolve`, but refuses the root itself (deleting or renaming the shared folder). */
+  async resolveChild(p, { allowMissing = false } = {}) {
+    const { abs, real } = await this.#check(p, allowMissing);
+    if (real === this.realRoot) throw new HttpError(403, "cannot modify the shared folder itself");
+    return abs;
+  }
+  async #check(p, allowMissing) {
+    if (typeof p !== "string" || p === "") throw new HttpError(400, "missing path");
+    const abs = path.resolve(this.root, p);
+    let existing = abs;
+    let tail = "";
+    while (true) {
+      try {
+        const real = path.join(await fs.realpath(existing), tail);
+        if (!this.#containsReal(real)) throw outside();
+        return { abs, real };
+      } catch (e) {
+        if (e instanceof HttpError) throw e;
+        if (!this.#containsLexically(abs)) throw outside();
+        if (e.code !== "ENOENT" || !allowMissing) throw e;
+        const parent = path.dirname(existing);
+        if (parent === existing) throw e;
+        tail = path.join(path.basename(existing), tail);
+        existing = parent;
+      }
+    }
+  }
+};
+function outside() {
+  return new HttpError(403, "path is outside the shared folder");
+}
+
+// ../../packages/agent-core/src/git.js
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".build", "build", "dist", "DerivedData", "Pods", "vendor", ".venv", "target"]);
+var MAX_SCAN_DEPTH = 4;
+var MAX_DIFF_BYTES = 2 * 1024 * 1024;
+function git(cwd, args, { timeout = 3e4, okCodes = [0], maxBuffer = 16 * 1024 * 1024 } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile(
+      "git",
+      args,
+      {
+        cwd,
+        timeout,
+        maxBuffer,
+        env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0", LC_ALL: "C" }
+      },
+      (error, stdout, stderr) => {
+        const code = error ? typeof error.code === "number" ? error.code : null : 0;
+        if (code !== null && okCodes.includes(code)) return resolve({ stdout, stderr, code });
+        const message = (stderr || error?.message || "git failed").trim().split("\n").slice(-3).join("\n");
+        reject(Object.assign(new HttpError(error?.killed ? 504 : 409, message), { code: "EGIT" }));
+      }
+    );
+  });
+}
+async function findRepos(root2) {
+  const repos = [];
+  async function walk(dir, depth) {
+    let entries;
+    try {
+      entries = await fs2.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    if (entries.some((e) => e.name === ".git")) {
+      repos.push(dir);
+      return;
+    }
+    if (depth >= MAX_SCAN_DEPTH) return;
+    const subdirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".") && !SKIP_DIRS.has(e.name));
+    await Promise.all(subdirs.map((e) => walk(path2.join(dir, e.name), depth + 1)));
+  }
+  await walk(root2, 0);
+  repos.sort((a, b) => a.split(path2.sep).length - b.split(path2.sep).length || a.localeCompare(b));
+  return Promise.all(
+    repos.map(async (repo) => ({
+      path: repo,
+      name: repo === root2 ? path2.basename(root2) : path2.relative(root2, repo),
+      branch: await currentBranch(repo)
+    }))
+  );
+}
+async function currentBranch(repo) {
+  try {
+    const { stdout } = await git(repo, ["symbolic-ref", "--short", "-q", "HEAD"], { okCodes: [0, 1] });
+    if (stdout.trim()) return stdout.trim();
+    const { stdout: sha } = await git(repo, ["rev-parse", "--short", "HEAD"], { okCodes: [0, 128] });
+    return sha.trim() ? `(${sha.trim()})` : null;
+  } catch {
+    return null;
+  }
+}
+async function status(repo) {
+  const { stdout } = await git(repo, ["status", "--porcelain=v2", "--branch", "--untracked-files=all", "-z"]);
+  const result = { branch: null, upstream: null, ahead: 0, behind: 0, files: [] };
+  const records = stdout.split("\0");
+  for (let i = 0; i < records.length; i++) {
+    const r = records[i];
+    if (!r) continue;
+    if (r.startsWith("# branch.head ")) {
+      const head = r.slice(14);
+      result.branch = head === "(detached)" ? null : head;
+    } else if (r.startsWith("# branch.upstream ")) {
+      result.upstream = r.slice(18);
+    } else if (r.startsWith("# branch.ab ")) {
+      const [a, b] = r.slice(12).split(" ");
+      result.ahead = Math.abs(parseInt(a, 10));
+      result.behind = Math.abs(parseInt(b, 10));
+    } else if (r.startsWith("1 ")) {
+      const parts = r.split(" ");
+      result.files.push(entry(parts[1], parts.slice(8).join(" ")));
+    } else if (r.startsWith("2 ")) {
+      const parts = r.split(" ");
+      result.files.push({ ...entry(parts[1], parts.slice(9).join(" ")), origPath: records[++i] });
+    } else if (r.startsWith("u ")) {
+      const parts = r.split(" ");
+      result.files.push({ ...entry(parts[1], parts.slice(10).join(" ")), conflicted: true });
+    } else if (r.startsWith("? ")) {
+      result.files.push({ path: r.slice(2), index: ".", worktree: "?" });
+    }
+  }
+  return result;
+}
+function entry(xy, filePath) {
+  return { path: filePath, index: xy[0], worktree: xy[1] };
+}
+async function diff(repo, file, { staged = false, untracked = false } = {}) {
+  const args = untracked ? ["diff", "--no-color", "--no-index", "--", "/dev/null", file] : ["diff", "--no-color", ...staged ? ["--cached"] : [], "--", file];
+  const { stdout } = await git(repo, args, { okCodes: [0, 1], maxBuffer: MAX_DIFF_BYTES * 2 });
+  return truncate(stdout);
+}
+async function stage(repo, files) {
+  await git(repo, ["add", "--", ...files]);
+}
+async function unstage(repo, files) {
+  try {
+    await git(repo, ["restore", "--staged", "--", ...files]);
+  } catch {
+    await git(repo, ["rm", "--cached", "-r", "-q", "--", ...files]);
+  }
+}
+async function discard(repo, files) {
+  const { files: changed } = await status(repo);
+  const untracked = files.filter((f) => changed.some((c) => c.path === f && c.worktree === "?"));
+  const tracked = files.filter((f) => !untracked.includes(f));
+  if (tracked.length) await git(repo, ["restore", "--worktree", "--", ...tracked]);
+  if (untracked.length) await git(repo, ["clean", "-f", "-q", "--", ...untracked]);
+}
+async function commit(repo, message) {
+  if (typeof message !== "string" || !message.trim()) throw new HttpError(400, "commit message is empty");
+  await git(repo, ["commit", "-q", "-m", message]);
+  return (await log(repo, 1))[0];
+}
+async function log(repo, limit = 50) {
+  const { stdout } = await git(repo, ["log", `-n${Math.min(Math.max(limit, 1), 500)}`, "-z", "--format=%H%x1f%h%x1f%s%x1f%an%x1f%at%x1f%D"], {
+    okCodes: [0, 128]
+    // 128: no commits yet
+  });
+  return stdout.split("\0").filter(Boolean).map((record) => {
+    const [hash, short, subject, author, at, refs] = record.split("");
+    return { hash, short, subject, author, date: parseInt(at, 10) * 1e3, refs: refs ? refs.split(", ") : [] };
+  });
+}
+async function show(repo, commitHash) {
+  if (!/^[0-9a-f]{4,64}$/i.test(commitHash || "")) throw new HttpError(400, "invalid commit");
+  const { stdout } = await git(repo, ["show", "--no-color", "--stat", "--patch", "--format=fuller", commitHash], {
+    maxBuffer: MAX_DIFF_BYTES * 2
+  });
+  return truncate(stdout);
+}
+async function pull(repo) {
+  const { stdout, stderr } = await git(repo, ["pull", "--ff-only"], { timeout: 12e4 });
+  return (stdout + stderr).trim();
+}
+async function push(repo) {
+  const { stdout, stderr } = await git(repo, ["push"], { timeout: 12e4 });
+  return (stdout + stderr).trim();
+}
+function truncate(text) {
+  if (Buffer.byteLength(text) <= MAX_DIFF_BYTES) return { text, truncated: false };
+  return { text: Buffer.from(text).subarray(0, MAX_DIFF_BYTES).toString("utf8"), truncated: true };
+}
+
+// ../../packages/agent-core/src/handoff.js
+import { createHmac, timingSafeEqual } from "node:crypto";
+var NONCE_WINDOW_MS = 5 * 6e4;
+var REUSE_MIN_LIFETIME_MS = 12 * 36e5;
+var TunnelHandoff = class {
+  /**
+   * @param {object} opts
+   * @param {string} opts.token  the agent's bearer token (the HMAC key)
+   * @param {() => Promise<{token: string, expiresAt: number} | null>} opts.mint
+   */
+  constructor({ token, mint, now = Date.now }) {
+    this.key = token;
+    this.mint = mint;
+    this.now = now;
+    this.used = /* @__PURE__ */ new Map();
+    this.cached = null;
+  }
+  /** `nonce` is `<unix seconds>.<random>`; each one works once, within five minutes. */
+  verify(nonce, sig) {
+    if (typeof nonce !== "string" || typeof sig !== "string") return false;
+    const issued = Number(nonce.split(".")[0]) * 1e3;
+    const now = this.now();
+    if (!Number.isFinite(issued) || Math.abs(now - issued) > NONCE_WINDOW_MS) return false;
+    const want = Buffer.from(createHmac("sha256", this.key).update(nonce).digest("base64url"));
+    const got = Buffer.from(sig);
+    if (got.length !== want.length || !timingSafeEqual(got, want)) return false;
+    for (const [n, at] of this.used) if (now - at > 2 * NONCE_WINDOW_MS) this.used.delete(n);
+    if (this.used.has(nonce)) return false;
+    this.used.set(nonce, now);
+    return true;
+  }
+  /** A connect token, or null when the tunnel is anonymous (nothing to hand out). */
+  async issue() {
+    if (this.cached && this.cached.expiresAt - this.now() > REUSE_MIN_LIFETIME_MS) return this.cached;
+    this.cached = await this.mint();
+    return this.cached;
+  }
+};
+
+// ../../packages/agent-core/src/landing.js
+var LANDING_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>Code Remote</title>
+<style>
+  :root { color-scheme: light dark; --bg: #f5f5f7; --card: #fff; --text: #1d1d1f; --muted: #6e6e73; --accent: #0071e3; }
+  @media (prefers-color-scheme: dark) { :root { --bg: #000; --card: #1c1c1e; --text: #f5f5f7; --muted: #98989d; --accent: #2997ff; } }
+  * { box-sizing: border-box; }
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 16px;
+         background: var(--bg); color: var(--text); font: 17px/1.45 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+  main { width: 100%; max-width: 420px; background: var(--card); border-radius: 20px; padding: 28px 24px; text-align: center; }
+  h1 { font-size: 24px; margin: 0 0 8px; }
+  p { color: var(--muted); margin: 0 0 20px; }
+  a.button, button { display: block; width: 100%; padding: 14px; border-radius: 12px; border: 0; font: inherit; font-weight: 600;
+                     text-decoration: none; cursor: pointer; }
+  a.button { background: var(--accent); color: #fff; margin-bottom: 10px; }
+  button { background: transparent; color: var(--accent); }
+  .hidden { display: none; }
+</style>
+</head>
+<body>
+<main>
+  <h1>Code Remote</h1>
+  <div id="ready" class="hidden">
+    <p>Open this machine in the Code Remote app on your iPhone.</p>
+    <a id="open" class="button" href="#">Open in Code Remote</a>
+    <button id="copy" type="button">Copy pairing link</button>
+  </div>
+  <p id="missing" class="hidden">This link is missing its access token. Copy the full link printed by <code>coderemote up</code>.</p>
+</main>
+<script>
+  const token = new URLSearchParams(location.hash.slice(1)).get('token');
+  if (token) {
+    const link = '${PAIRING_SCHEME}://pair?url=' + encodeURIComponent(location.origin) + '&token=' + encodeURIComponent(token);
+    document.getElementById('open').href = link;
+    document.getElementById('copy').onclick = async (e) => {
+      try { await navigator.clipboard.writeText(link); e.target.textContent = 'Copied'; }
+      catch { prompt('Pairing link', link); }
+    };
+    document.getElementById('ready').classList.remove('hidden');
+  } else {
+    document.getElementById('missing').classList.remove('hidden');
+  }
+</script>
+</body>
+</html>
+`;
+
+// ../../packages/agent-core/src/sessions.js
+import { randomUUID } from "node:crypto";
+import os from "node:os";
+import pty from "node-pty";
+var SCROLLBACK_LIMIT = 256 * 1024;
+var TerminalSession = class {
+  constructor({ cols, rows, cwd }) {
+    this.id = randomUUID();
+    this.createdAt = Date.now();
+    this.chunks = [];
+    this.bufferedBytes = 0;
+    this.clients = /* @__PURE__ */ new Set();
+    this.exitCode = null;
+    const shell = process.env.SHELL || (os.platform() === "win32" ? "powershell.exe" : "/bin/sh");
+    this.shell = shell;
+    this.pty = pty.spawn(shell, ["-l"], {
+      name: "xterm-256color",
+      cols,
+      rows,
+      cwd: cwd || os.homedir(),
+      env: { ...process.env, TERM: "xterm-256color", COLORTERM: "truecolor" }
+    });
+    this.pty.onData((data) => this.#output(Buffer.from(data, "utf8")));
+    this.pty.onExit(({ exitCode }) => {
+      this.exitCode = exitCode;
+      for (const ws of this.clients) {
+        ws.send(JSON.stringify({ type: "exit", code: exitCode }));
+        ws.close(1e3, "session exited");
+      }
+      this.onExit?.();
+    });
+  }
+  #output(buf) {
+    this.chunks.push(buf);
+    this.bufferedBytes += buf.length;
+    while (this.bufferedBytes > SCROLLBACK_LIMIT && this.chunks.length > 1) {
+      this.bufferedBytes -= this.chunks.shift().length;
+    }
+    for (const ws of this.clients) ws.send(buf, { binary: true });
+  }
+  attach(ws) {
+    this.clients.add(ws);
+    const replay = Buffer.concat(this.chunks);
+    ws.send(JSON.stringify({ type: "session", id: this.id, shell: this.shell, replay: replay.length }));
+    if (replay.length) ws.send(replay, { binary: true });
+    ws.on("message", (data, isBinary) => {
+      if (isBinary) {
+        this.pty.write(data.toString("utf8"));
+        return;
+      }
+      let msg;
+      try {
+        msg = JSON.parse(data.toString("utf8"));
+      } catch {
+        return;
+      }
+      if (msg.type === "input" && typeof msg.data === "string") this.pty.write(msg.data);
+      else if (msg.type === "resize") this.resize(msg.cols, msg.rows);
+    });
+    ws.on("close", () => this.clients.delete(ws));
+  }
+  resize(cols, rows) {
+    if (Number.isInteger(cols) && Number.isInteger(rows) && cols > 0 && rows > 0) {
+      this.pty.resize(cols, rows);
+    }
+  }
+  kill() {
+    this.pty.kill();
+  }
+  toJSON() {
+    return {
+      id: this.id,
+      shell: this.shell,
+      pid: this.pty.pid,
+      title: this.pty.process,
+      createdAt: this.createdAt,
+      attached: this.clients.size
+    };
+  }
+};
+var SessionManager = class {
+  #sessions = /* @__PURE__ */ new Map();
+  create(opts) {
+    const session = new TerminalSession(opts);
+    session.onExit = () => this.#sessions.delete(session.id);
+    this.#sessions.set(session.id, session);
+    return session;
+  }
+  get(id) {
+    return this.#sessions.get(id);
+  }
+  list() {
+    return [...this.#sessions.values()].map((s) => s.toJSON());
+  }
+  killAll() {
+    for (const s of this.#sessions.values()) s.kill();
+  }
+};
+
+// ../../packages/agent-core/src/server.js
+function kindOf(stat) {
+  if (stat.isDirectory()) return "dir";
+  if (stat.isFile()) return "file";
+  if (stat.isSymbolicLink()) return "symlink";
+  return "other";
+}
+async function describe(fullPath, name) {
+  const lst = await fs3.lstat(fullPath);
+  const entry2 = { name, type: kindOf(lst), size: lst.size, mtime: lst.mtimeMs };
+  if (lst.isSymbolicLink()) {
+    try {
+      entry2.target = kindOf(await fs3.stat(fullPath));
+    } catch {
+      entry2.target = "broken";
+    }
+  }
+  return entry2;
+}
+function sendJson(res, status2, body) {
+  const json = JSON.stringify(body);
+  res.writeHead(status2, { "content-type": "application/json", "content-length": Buffer.byteLength(json) });
+  res.end(json);
+}
+async function readJson(req) {
+  const chunks = [];
+  for await (const c of req) chunks.push(c);
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+  } catch {
+    throw new HttpError(400, "invalid json");
+  }
+}
+function createAgentServer({ token, root: root2, tunnelToken = async () => null }) {
+  const handoff = new TunnelHandoff({ token, mint: tunnelToken });
+  const sandbox = new Sandbox(root2);
+  const sessions = new SessionManager();
+  const expected = Buffer.from(`Bearer ${token}`);
+  function authorized(req) {
+    const got = Buffer.from(req.headers.authorization || "");
+    return got.length === expected.length && timingSafeEqual2(got, expected);
+  }
+  async function repoOf(p) {
+    const repo = await sandbox.resolve(p);
+    try {
+      await fs3.access(path3.join(repo, ".git"));
+    } catch {
+      throw new HttpError(400, "not a git repository");
+    }
+    return repo;
+  }
+  async function filesIn(repo, files) {
+    if (!Array.isArray(files) || !files.length || files.some((f) => typeof f !== "string" || !f || path3.isAbsolute(f))) {
+      throw new HttpError(400, "files must be a non-empty list of paths relative to the repository");
+    }
+    return Promise.all(
+      files.map(async (f) => {
+        const abs = await sandbox.resolve(path3.join(repo, f), { allowMissing: true });
+        const rel = path3.relative(repo, abs);
+        if (!rel || rel.startsWith("..")) throw new HttpError(403, "path is outside the repository");
+        return rel;
+      })
+    );
+  }
+  const routes = {
+    [Routes.info]: async () => ({
+      protocol: PROTOCOL_VERSION,
+      hostname: os2.hostname(),
+      platform: os2.platform(),
+      root: sandbox.root,
+      user: os2.userInfo().username,
+      shell: process.env.SHELL || null
+    }),
+    [Routes.fsList]: async (url) => {
+      const dir = await sandbox.resolve(url.searchParams.get("path"));
+      const names = await fs3.readdir(dir);
+      const entries = (await Promise.all(names.map((n) => describe(path3.join(dir, n), n).catch(() => null)))).filter(Boolean);
+      return { path: dir, entries };
+    },
+    [Routes.fsStat]: async (url) => {
+      const p = await sandbox.resolve(url.searchParams.get("path"));
+      return { path: p, ...await describe(p, path3.basename(p)) };
+    },
+    [Routes.fsRead]: async (url, req, res) => {
+      const p = await sandbox.resolve(url.searchParams.get("path"));
+      const stat = await fs3.stat(p);
+      if (!stat.isFile()) throw new HttpError(400, "not a file");
+      res.writeHead(200, { "content-type": "application/octet-stream", "content-length": stat.size });
+      await pipeline(createReadStream(p), res);
+    },
+    [Routes.fsWrite]: async (url, req) => {
+      const p = await sandbox.resolveChild(url.searchParams.get("path"), { allowMissing: true });
+      const tmp = `${p}.vsremote-${process.pid}-${Date.now()}.tmp`;
+      try {
+        await pipeline(req, createWriteStream(tmp));
+        await fs3.rename(tmp, p);
+      } catch (e) {
+        await fs3.rm(tmp, { force: true });
+        throw e;
+      }
+      return describe(p, path3.basename(p));
+    },
+    [Routes.fsMkdir]: async (url) => {
+      await fs3.mkdir(await sandbox.resolve(url.searchParams.get("path"), { allowMissing: true }), { recursive: true });
+      return {};
+    },
+    [Routes.fsRename]: async (url, req) => {
+      const { from, to } = await readJson(req);
+      await fs3.rename(await sandbox.resolveChild(from), await sandbox.resolveChild(to, { allowMissing: true }));
+      return {};
+    },
+    [Routes.fsDelete]: async (url) => {
+      await fs3.rm(await sandbox.resolveChild(url.searchParams.get("path")), { recursive: true });
+      return {};
+    },
+    [Routes.gitRepos]: async () => ({ repos: await findRepos(sandbox.root) }),
+    [Routes.gitStatus]: async (url) => status(await repoOf(url.searchParams.get("repo"))),
+    [Routes.gitDiff]: async (url) => {
+      const repo = await repoOf(url.searchParams.get("repo"));
+      const [file] = await filesIn(repo, [url.searchParams.get("path")]);
+      return diff(repo, file, {
+        staged: url.searchParams.get("staged") === "1",
+        untracked: url.searchParams.get("untracked") === "1"
+      });
+    },
+    [Routes.gitStage]: async (url, req) => {
+      const { repo: r, files } = await readJson(req);
+      const repo = await repoOf(r);
+      await stage(repo, await filesIn(repo, files));
+      return status(repo);
+    },
+    [Routes.gitUnstage]: async (url, req) => {
+      const { repo: r, files } = await readJson(req);
+      const repo = await repoOf(r);
+      await unstage(repo, await filesIn(repo, files));
+      return status(repo);
+    },
+    [Routes.gitDiscard]: async (url, req) => {
+      const { repo: r, files } = await readJson(req);
+      const repo = await repoOf(r);
+      await discard(repo, await filesIn(repo, files));
+      return status(repo);
+    },
+    [Routes.gitCommit]: async (url, req) => {
+      const { repo: r, message } = await readJson(req);
+      return commit(await repoOf(r), message);
+    },
+    [Routes.gitLog]: async (url) => ({
+      commits: await log(await repoOf(url.searchParams.get("repo")), parseInt(url.searchParams.get("limit"), 10) || 50)
+    }),
+    [Routes.gitShow]: async (url) => show(await repoOf(url.searchParams.get("repo")), url.searchParams.get("commit")),
+    [Routes.gitPull]: async (url, req) => ({ output: await pull(await repoOf((await readJson(req)).repo)) }),
+    [Routes.gitPush]: async (url, req) => ({ output: await push(await repoOf((await readJson(req)).repo)) }),
+    [Routes.termList]: async () => ({ sessions: sessions.list() }),
+    [Routes.tunnelToken]: async () => {
+      const issued = await handoff.issue();
+      if (!issued) throw new HttpError(404, "this tunnel is anonymous");
+      return issued;
+    },
+    [Routes.termKill]: async (url) => {
+      const s = sessions.get(url.searchParams.get("id"));
+      if (!s) throw new HttpError(404, "no such session");
+      s.kill();
+      return {};
+    }
+  };
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url, "http://localhost");
+    if (req.method === "GET" && url.pathname === "/") {
+      res.writeHead(200, {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'"
+      });
+      return res.end(LANDING_HTML);
+    }
+    if (req.method === "GET" && url.pathname === TUNNEL_HANDOFF_PATH) return handoffRedirect(url, res);
+    if (!authorized(req)) return sendJson(res, 401, { error: "unauthorized" });
+    const handler = routes[`${req.method} ${url.pathname}`];
+    if (!handler) return sendJson(res, 404, { error: "not found" });
+    try {
+      const body = await handler(url, req, res);
+      if (body !== void 0) sendJson(res, 200, body);
+    } catch (e) {
+      const status2 = e.status || (e.code === "ENOENT" ? 404 : e.code === "EACCES" || e.code === "EPERM" ? 403 : 500);
+      if (!res.headersSent) sendJson(res, status2, { error: e.message, code: e.code });
+      else res.destroy(e);
+    }
+  });
+  async function handoffRedirect(url, res) {
+    const state = url.searchParams.get("state") || "";
+    if (!/^[A-Za-z0-9_-]{8,128}$/.test(state) || !handoff.verify(url.searchParams.get("nonce"), url.searchParams.get("sig"))) {
+      return sendJson(res, 403, { error: "invalid or expired sign-in link" });
+    }
+    let issued;
+    try {
+      issued = await handoff.issue();
+    } catch (e) {
+      return sendJson(res, 502, { error: `could not issue a tunnel token: ${e.message}` });
+    }
+    if (!issued) return sendJson(res, 404, { error: "this tunnel is anonymous" });
+    const target = new URL(`${PAIRING_SCHEME}://${TUNNEL_AUTH_CALLBACK_HOST}`);
+    target.searchParams.set("token", issued.token);
+    target.searchParams.set("expires", String(issued.expiresAt));
+    target.searchParams.set("state", state);
+    res.writeHead(302, { location: target.href, "cache-control": "no-store", "referrer-policy": "no-referrer" });
+    res.end();
+  }
+  const wss = new WebSocketServer({ noServer: true });
+  server.on("upgrade", async (req, socket, head) => {
+    const url = new URL(req.url, "http://localhost");
+    if (url.pathname !== TERMINAL_WS_PATH || !authorized(req)) {
+      socket.end("HTTP/1.1 401 Unauthorized\r\n\r\n");
+      return;
+    }
+    const id = url.searchParams.get("id");
+    let session;
+    if (id) {
+      session = sessions.get(id);
+      if (!session) {
+        socket.end("HTTP/1.1 404 Not Found\r\n\r\n");
+        return;
+      }
+    } else {
+      try {
+        session = sessions.create({
+          cols: parseInt(url.searchParams.get("cols"), 10) || 80,
+          rows: parseInt(url.searchParams.get("rows"), 10) || 24,
+          // New shells start in the shared folder unless a subfolder is asked for.
+          cwd: await sandbox.resolve(url.searchParams.get("cwd") || sandbox.root)
+        });
+      } catch (e) {
+        socket.end(`HTTP/1.1 ${e.status || (e.code === "ENOENT" ? 404 : 500)} Error\r
+\r
+`);
+        return;
+      }
+    }
+    wss.handleUpgrade(req, socket, head, (ws) => session.attach(ws));
+  });
+  server.on("close", () => sessions.killAll());
+  server.killAllSessions = () => sessions.killAll();
+  return server;
+}
+
+// src/registry.js
+import fs4 from "node:fs";
+import path4 from "node:path";
+var AgentRegistry = class {
+  constructor(dir) {
+    this.dir = dir;
+  }
+  register({ port: port2, root: root2, url }) {
+    fs4.mkdirSync(this.dir, { recursive: true, mode: 448 });
+    const file = this.#file(port2);
+    fs4.writeFileSync(file, JSON.stringify({ pid: process.pid, port: port2, root: root2, url, startedAt: Date.now() }), { mode: 384 });
+    const cleanup = () => {
+      try {
+        if (JSON.parse(fs4.readFileSync(file, "utf8")).pid === process.pid) fs4.rmSync(file);
+      } catch {
+      }
+    };
+    process.on("exit", cleanup);
+    return cleanup;
+  }
+  /** Live agents; entries left behind by crashed processes are removed. */
+  list() {
+    let names = [];
+    try {
+      names = fs4.readdirSync(this.dir).filter((n) => n.endsWith(".json"));
+    } catch {
+      return [];
+    }
+    const agents = [];
+    for (const name of names) {
+      const file = path4.join(this.dir, name);
+      try {
+        const agent = JSON.parse(fs4.readFileSync(file, "utf8"));
+        process.kill(agent.pid, 0);
+        agents.push(agent);
+      } catch {
+        fs4.rmSync(file, { force: true });
+      }
+    }
+    return agents.sort((a, b) => a.port - b.port);
+  }
+  #file(port2) {
+    return path4.join(this.dir, `${port2}.json`);
+  }
+};
+
+// src/spinner.js
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var dim = (s) => `\x1B[2m${s}\x1B[22m`;
+var cyan = (s) => `\x1B[36m${s}\x1B[39m`;
+var green = (s) => `\x1B[32m${s}\x1B[39m`;
+var red = (s) => `\x1B[31m${s}\x1B[39m`;
+var Spinner = class {
+  constructor(stream = process.stderr) {
+    this.stream = stream;
+    this.tty = Boolean(stream.isTTY);
+    this.text = null;
+    process.on("exit", () => this.stop());
+  }
+  start(text) {
+    this.stop();
+    this.text = text;
+    this.startedAt = Date.now();
+    if (!this.tty) {
+      this.stream.write(`  ${text}...
+`);
+      return;
+    }
+    this.stream.write("\x1B[?25l");
+    this.onSigint = () => {
+      this.stop();
+      process.exit(130);
+    };
+    process.once("SIGINT", this.onSigint);
+    let frame = 0;
+    this.render(FRAMES[0]);
+    this.timer = setInterval(() => this.render(FRAMES[++frame % FRAMES.length]), 80);
+  }
+  succeed() {
+    this.finish(green("\u2714"));
+  }
+  fail() {
+    this.finish(red("\u2716"));
+  }
+  /** Clears the spinner line (e.g. before an error message or an interactive prompt). */
+  stop() {
+    if (!this.text) return;
+    clearInterval(this.timer);
+    if (this.onSigint) process.removeListener("SIGINT", this.onSigint);
+    this.onSigint = null;
+    if (this.tty) this.stream.write("\r\x1B[2K\x1B[?25h");
+    this.text = null;
+  }
+  render(frame) {
+    this.stream.write(`\r\x1B[2K  ${cyan(frame)} ${this.text} ${dim(this.elapsed())}`);
+  }
+  finish(mark) {
+    if (!this.text) return;
+    const line = `  ${mark} ${this.text} ${dim(this.elapsed())}`;
+    const tty = this.tty;
+    this.stop();
+    if (tty) this.stream.write(`${line}
+`);
+  }
+  elapsed() {
+    return `${((Date.now() - this.startedAt) / 1e3).toFixed(1)}s`;
+  }
+};
+
+// bin/coderemote.js
+var run = promisify(execFile2);
+var CONFIG_DIR = path5.join(os3.homedir(), ".coderemote");
+var LEGACY_CONFIG_DIR = path5.join(os3.homedir(), ".vsremote");
+if (!fs5.existsSync(CONFIG_DIR) && fs5.existsSync(LEGACY_CONFIG_DIR)) fs5.renameSync(LEGACY_CONFIG_DIR, CONFIG_DIR);
+var CONFIG_FILE = path5.join(CONFIG_DIR, "config.json");
+var DEFAULT_PORT = 31580;
+var spinner = new Spinner();
+function loadConfig() {
+  let cfg2 = {};
+  try {
+    cfg2 = JSON.parse(fs5.readFileSync(CONFIG_FILE, "utf8"));
+  } catch {
+  }
+  if (!cfg2.token) {
+    cfg2.token = randomBytes(32).toString("base64url");
+    saveConfig(cfg2);
+  }
+  return cfg2;
+}
+function saveConfig(cfg2) {
+  fs5.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  fs5.writeFileSync(CONFIG_FILE, JSON.stringify(cfg2, null, 2), { mode: 384 });
+}
+function listen(token, port2, root2, tunnelToken) {
+  const server = createAgentServer({ token, root: root2, tunnelToken });
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port2, "127.0.0.1", () => resolve(server));
+  });
+}
+async function devtunnel(...args) {
+  try {
+    const { stdout } = await run("devtunnel", args);
+    return { ok: true, out: stdout };
+  } catch (e) {
+    if (e.code === "ENOENT") {
+      spinner.stop();
+      console.error("devtunnel CLI not found. Install it: brew install --cask devtunnel");
+      process.exit(1);
+    }
+    return { ok: false, out: `${e.stdout || ""}${e.stderr || ""}` };
+  }
+}
+var LOGIN_NEEDED = /not logged in|login token expired|login required|please log ?in/i;
+async function login(reason) {
+  spinner.stop();
+  console.error(`Dev tunnels: ${reason.trim()}`);
+  if (!process.stdin.isTTY) {
+    console.error("Run: devtunnel user login -g   (or -d for a Microsoft account), then try again.");
+    process.exit(1);
+  }
+  console.error("Signing in again with GitHub (devtunnel user login -g)...\n");
+  const code = await new Promise((resolve) => {
+    spawn("devtunnel", ["user", "login", "-g"], { stdio: "inherit" }).on("exit", resolve);
+  });
+  if (code !== 0) {
+    console.error("\nLogin failed. Run `devtunnel user login -g` (or -d) yourself, then try again.");
+    process.exit(1);
+  }
+}
+async function tunnelUser() {
+  let who = await devtunnel("user", "show");
+  if (!who.ok || LOGIN_NEEDED.test(who.out)) {
+    await login(who.out || "not logged in");
+    who = await devtunnel("user", "show");
+  }
+  const m = who.out.match(/Logged in as (\S+) using (\S+?)\.?\s*$/m);
+  return m ? `${m[1]} (${m[2]})` : who.out.trim();
+}
+function applyAccess(tunnelId, anonymous2) {
+  return anonymous2 ? devtunnel("access", "create", tunnelId, "--anonymous") : devtunnel("access", "reset", tunnelId);
+}
+async function ensureTunnel(cfg2, port2, anonymous2) {
+  if (cfg2.tunnelId) {
+    const [updated, access] = await Promise.all([
+      devtunnel("update", cfg2.tunnelId, "--expiration", "30d"),
+      applyAccess(cfg2.tunnelId, anonymous2)
+    ]);
+    if (updated.ok) {
+      if (!access.ok) throw new Error(`devtunnel access failed:
+${access.out}`);
+      return cfg2.tunnelId;
+    }
+    if (!/not found/i.test(updated.out)) throw new Error(`devtunnel update failed:
+${updated.out}`);
+  }
+  const createArgs = ["create", "--expiration", "30d", "-d", `coderemote ${os3.hostname()}`, "--json"];
+  if (anonymous2) createArgs.push("--allow-anonymous");
+  const created = await devtunnel(...createArgs);
+  if (!created.ok) throw new Error(`devtunnel create failed:
+${created.out}`);
+  const tunnelId = JSON.parse(created.out.slice(created.out.indexOf("{"))).tunnel?.tunnelId;
+  if (!tunnelId) throw new Error(`could not parse tunnel id from:
+${created.out}`);
+  const portRes = await devtunnel("port", "create", tunnelId, "-p", String(port2), "--protocol", "http");
+  if (!portRes.ok) throw new Error(`devtunnel port create failed:
+${portRes.out}`);
+  cfg2.tunnelId = tunnelId;
+  saveConfig(cfg2);
+  return tunnelId;
+}
+async function connectToken(tunnelId) {
+  const res = await devtunnel("token", tunnelId, "--scopes", "connect", "--json");
+  if (!res.ok) throw new Error(res.out.trim());
+  const body = JSON.parse(res.out.slice(res.out.indexOf("{")));
+  const expiresAt = Date.parse(body.expiration.replace(" UTC", "Z").replace(" ", "T"));
+  if (!body.token || !Number.isFinite(expiresAt)) throw new Error(`unexpected devtunnel token output:
+${res.out}`);
+  return { token: body.token, expiresAt };
+}
+function hostTunnel(tunnelId, port2) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("devtunnel", ["host", tunnelId], { stdio: ["ignore", "pipe", "pipe"] });
+    let log2 = "";
+    const onData = (d) => {
+      log2 += d;
+      const m = log2.match(new RegExp(`https://\\S*-${port2}\\.\\S*devtunnels\\.ms\\S*`));
+      if (m) resolve({ child, url: m[0].replace(/\/$/, "") });
+    };
+    child.stdout.on("data", onData);
+    child.stderr.on("data", onData);
+    child.on("exit", (code) => reject(new Error(`devtunnel host exited (${code}):
+${log2}`)));
+  });
+}
+function printPairing(url, token, access) {
+  const pair = pairingUrl({ url, token });
+  if (access) console.log(`  Access:  ${access}`);
+  console.log(`
+  Web:  ${webUrl({ url, token })}`);
+  console.log(`  App:  ${pair}
+`);
+  console.log("  Scan with the iPhone Camera, or open either link on the phone:\n");
+  qrcode.generate(pair, { small: true });
+  console.log(
+    anonymous ? "\n  The links contain your access token. Anyone with them can use this machine." : "\n  The links contain your access token; the phone or browser must also sign in as you."
+  );
+  console.log("  Run `coderemote rotate-token` to revoke every paired device.\n");
+}
+var USAGE = `Usage: coderemote <command> [options]
+
+  up                   share this folder through a dev tunnel and print the pairing QR;
+                       the phone or browser must sign in with your dev tunnels account
+  serve                share this folder on 127.0.0.1 only (no tunnel)
+  status               list running agents and their terminal sessions
+  kill <id>... | --all kill terminal sessions (an id prefix is enough)
+  stop [--all]         stop the agent for this folder (or every agent)
+  rotate-token         revoke every paired device
+
+Options:
+  --root DIR           folder to share (default: current folder)
+  --port N             local port (default: ${DEFAULT_PORT})
+  --allow-anonymous    up: skip the sign-in, the pairing token alone grants access
+                       (alias --no-auth)`;
+var HELP_FLAGS = ["help", "--help", "-help", "-h"];
+var argv = process.argv.slice(2);
+var [cmd, ...rest] = argv.length === 0 || argv.some((a) => HELP_FLAGS.includes(a)) ? ["help"] : argv;
+var flag = (name) => {
+  const i = rest.indexOf(name);
+  return i >= 0 ? rest[i + 1] : void 0;
+};
+var anonymous = rest.includes("--allow-anonymous") || rest.includes("--no-auth");
+var port = flag("--port") ? parseInt(flag("--port"), 10) : DEFAULT_PORT;
+var root = path5.resolve(flag("--root") ?? process.cwd());
+var cfg = loadConfig();
+var registry = new AgentRegistry(path5.join(CONFIG_DIR, "agents"));
+async function start({ tunnel }) {
+  const running = registry.list().find((a) => a.port === port);
+  if (running) {
+    console.error(`An agent already runs on port ${port} for ${running.root} (pid ${running.pid}).`);
+    console.error("Stop it with `coderemote stop --all`, or pick another port with --port.");
+    process.exit(1);
+  }
+  let server;
+  let tunnelId;
+  const tunnelToken = async () => tunnel && !anonymous && tunnelId ? connectToken(tunnelId) : null;
+  spinner.start("Starting agent");
+  try {
+    server = await listen(cfg.token, port, root, tunnelToken);
+  } catch (e) {
+    spinner.fail();
+    if (e.code !== "EADDRINUSE") throw e;
+    console.error(`Port ${port} is already in use by another process.`);
+    console.error(`See what holds it with: lsof -nP -iTCP:${port} -sTCP:LISTEN`);
+    console.error("Stop that process, or pick another port with --port.");
+    process.exit(1);
+  }
+  let child;
+  let access;
+  let url = `http://127.0.0.1:${port}`;
+  if (tunnel) {
+    spinner.succeed();
+    spinner.start("Checking dev tunnels sign-in");
+    const user = await tunnelUser();
+    spinner.succeed();
+    spinner.start("Connecting to the relay");
+    const known = cfg.tunnelId;
+    let hosting = known ? hostTunnel(known, port) : null;
+    hosting?.catch(() => {
+    });
+    tunnelId = await ensureTunnel(cfg, port, anonymous);
+    if (tunnelId !== known) {
+      hosting?.then((h) => h.child.kill(), () => {
+      });
+      hosting = hostTunnel(tunnelId, port);
+    }
+    ({ child, url } = await hosting);
+    access = anonymous ? "anyone with the link (no sign-in, --allow-anonymous)" : `sign-in required as ${user}`;
+  }
+  spinner.succeed();
+  registry.register({ port, root, url });
+  const shutdown = () => {
+    child?.kill();
+    server.killAllSessions();
+    server.close();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  return { url, access };
+}
+async function agentApi(agent, method, route, query = {}) {
+  const url = new URL(route, `http://127.0.0.1:${agent.port}`);
+  for (const [k, v] of Object.entries(query)) url.searchParams.set(k, v);
+  const res = await fetch(url, { method, headers: { authorization: `Bearer ${cfg.token}` } });
+  const body = await res.json();
+  if (!res.ok) throw new Error(body.error || `HTTP ${res.status}`);
+  return body;
+}
+async function sessionsOf(agent) {
+  try {
+    return (await agentApi(agent, "GET", "/api/term")).sessions;
+  } catch (e) {
+    console.error(`  could not reach agent on port ${agent.port}: ${e.message}`);
+    return [];
+  }
+}
+function ago(ms) {
+  const s = Math.round((Date.now() - ms) / 1e3);
+  if (s < 60) return `${s}s`;
+  if (s < 3600) return `${Math.round(s / 60)}m`;
+  if (s < 86400) return `${Math.round(s / 3600)}h`;
+  return `${Math.round(s / 86400)}d`;
+}
+switch (cmd) {
+  case "serve": {
+    await start({ tunnel: false });
+    console.log(`coderemote agent on http://127.0.0.1:${port}
+Sharing: ${root}
+Token: ${cfg.token}`);
+    break;
+  }
+  case "up": {
+    let started;
+    try {
+      started = await start({ tunnel: true });
+    } catch (e) {
+      spinner.fail();
+      throw e;
+    }
+    const { url, access } = started;
+    console.log(`
+  Sharing: ${root}`);
+    printPairing(url, cfg.token, access);
+    break;
+  }
+  case "status":
+  case "ps": {
+    const agents = registry.list();
+    if (!agents.length) {
+      console.log("No agent is running. Start one with `coderemote up`.");
+      break;
+    }
+    for (const agent of agents) {
+      console.log(`${agent.root}  (pid ${agent.pid}, port ${agent.port}, up ${ago(agent.startedAt)})`);
+      if (agent.url) console.log(`  ${agent.url}`);
+      const sessions = await sessionsOf(agent);
+      if (!sessions.length) console.log("  no terminal sessions");
+      for (const s of sessions) {
+        const attached = s.attached ? `${s.attached} attached` : "detached";
+        console.log(`  ${s.id.slice(0, 8)}  ${s.title.padEnd(12)} pid ${String(s.pid).padEnd(7)} ${ago(s.createdAt).padEnd(4)} ${attached}`);
+      }
+    }
+    break;
+  }
+  case "kill": {
+    const all = rest.includes("--all");
+    const ids = rest.filter((a) => !a.startsWith("--"));
+    if (!all && !ids.length) {
+      console.error("Usage: coderemote kill <session-id>... | --all");
+      process.exit(1);
+    }
+    let killed = 0;
+    const matched = /* @__PURE__ */ new Set();
+    for (const agent of registry.list()) {
+      for (const s of await sessionsOf(agent)) {
+        const hit = ids.find((id) => s.id.startsWith(id));
+        if (!all && !hit) continue;
+        if (hit) matched.add(hit);
+        await agentApi(agent, "DELETE", "/api/term", { id: s.id });
+        console.log(`killed ${s.id.slice(0, 8)} (${s.title}) in ${agent.root}`);
+        killed++;
+      }
+    }
+    for (const id of ids.filter((id2) => !matched.has(id2))) console.error(`no session matches ${id}`);
+    if (all && !killed) console.log("No terminal sessions to kill.");
+    if (ids.length && matched.size < ids.length) process.exit(1);
+    break;
+  }
+  case "stop": {
+    const agents = registry.list();
+    const targets = rest.includes("--all") ? agents : agents.filter((a) => a.root === root);
+    if (!targets.length) {
+      console.log(agents.length ? `No agent is sharing ${root}. Use \`coderemote stop --all\`.` : "No agent is running.");
+      break;
+    }
+    for (const agent of targets) {
+      process.kill(agent.pid, "SIGTERM");
+      console.log(`stopped agent for ${agent.root} (pid ${agent.pid})`);
+    }
+    break;
+  }
+  case "rotate-token": {
+    cfg.token = randomBytes(32).toString("base64url");
+    saveConfig(cfg);
+    console.log("Token rotated. Re-pair your devices, and restart running agents.");
+    break;
+  }
+  case "help":
+    console.log(USAGE);
+    break;
+  default:
+    console.error(`Unknown command: ${cmd}
+
+${USAGE}`);
+    process.exit(1);
+}