pi-agent-browser-native 0.9.4 → 0.9.6

package/dist/extensions/agent-browser/lib/managed-session-policy-lock.js

@@ -1,165 +0,0 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-import { acquireExecutionClaim, } from "./browser-execution-claims.js";
-import { resolveBrowserExecutionIdentity, } from "./browser-execution-identity.js";
-export { resolveBrowserExecutionIdentity, getBrowserExecutionLockPath, } from "./browser-execution-identity.js";
-function groupExecutionIdentities(identities) {
-    if (identities.length === 0) {
-        throw new Error("Browser execution coordination requires at least one identity.");
-    }
-    const groups = new Map();
-    for (const { socketContext, sessionName } of identities) {
-        if (sessionName === undefined) {
-            groups.set(socketContext, null);
-        }
-        else if (groups.get(socketContext) !== null) {
-            const sessions = groups.get(socketContext) ?? new Set();
-            sessions.add(sessionName);
-            groups.set(socketContext, sessions);
-        }
-    }
-    return [...groups.keys()].sort().map((socketContext) => {
-        const sessions = groups.get(socketContext);
-        return { socketContext, sessionNames: sessions ? [...sessions].sort() : null };
-    });
-}
-const executionScope = new AsyncLocalStorage();
-function identityCovers(held, identity) {
-    if (held.socketContext !== identity.socketContext) {
-        return false;
-    }
-    const heldSessions = held.sessionNames;
-    if (heldSessions === null) {
-        return true;
-    }
-    const innerSessions = identity.sessionNames;
-    return innerSessions !== null && innerSessions.every((session) => heldSessions.includes(session));
-}
-function scopeCovers(outer, inner) {
-    return inner.every((identity) => outer.some((held) => identityCovers(held, identity)));
-}
-async function acquireClaimsInOrder(identities, budget, remember) {
-    for (const identity of identities) {
-        // Acquiring sorted native socket contexts in order prevents lock-order cycles.
-        // oxlint-disable-next-line no-await-in-loop
-        const lock = await acquireExecutionClaim({
-            identity,
-            deadline: budget.deadline,
-            signal: budget.signal,
-        });
-        if (lock) {
-            remember(lock);
-        }
-        budget.check();
-        if (!lock) {
-            throw new Error("Browser execution coordination is unavailable or busy; no browser command was run.");
-        }
-    }
-}
-async function runInScope(identities, signal, run) {
-    const scope = { identities, active: true, signal, children: Promise.resolve() };
-    try {
-        return await executionScope.run(scope, () => run(signal));
-    }
-    finally {
-        scope.active = false;
-        await scope.children;
-    }
-}
-/** Hold across helpers/actions or a complete code cell. Nested siblings serialize and recursive
- * calls borrow existing claims. Declare every replacement/cleanup identity up front: upgrades
- * mid-operation would permit lock-order cycles. One set-valued claim per socket context prevents
- * namespace-wide contenders from deadlocking between individual session acquisitions.
- * Cancellation does not release running callbacks: they must pass the signal to subprocesses
- * and await termination. Finally drains started children before releasing the native claims. */
-export async function withBrowserExecutionLocks(options, run) {
-    if (!Number.isFinite(options.deadline)) {
-        throw new Error("Browser execution coordination requires a finite deadline.");
-    }
-    const identities = groupExecutionIdentities(options.identities);
-    const parent = executionScope.getStore();
-    if (parent && !parent.active) {
-        throw new Error("Browser execution scope has already finished.");
-    }
-    if (parent && !scopeCovers(parent.identities, identities)) {
-        throw new Error("Cannot change or upgrade browser identity inside an execution lock; acquire every required identity before starting.");
-    }
-    const controller = new AbortController();
-    const signals = [controller.signal, options.signal, parent?.signal].filter((signal) => signal !== undefined);
-    const signal = AbortSignal.any(signals);
-    const expire = () => controller.abort(new DOMException("Browser execution deadline exceeded.", "TimeoutError"));
-    const remaining = options.deadline - Date.now();
-    const timer = setTimeout(expire, Math.max(0, Math.min(remaining, 2_147_483_647)));
-    const checkBudget = () => {
-        if (Date.now() >= options.deadline) {
-            expire();
-        }
-        signal.throwIfAborted();
-    };
-    const locks = [];
-    try {
-        checkBudget();
-        if (!parent) {
-            await acquireClaimsInOrder(identities, { deadline: options.deadline, signal, check: checkBudget }, (lock) => {
-                locks.push(lock);
-            });
-        }
-        const execute = async () => {
-            checkBudget();
-            if (options.waitOnly === true) {
-                clearTimeout(timer);
-            }
-            return runInScope(parent?.identities ?? identities, signal, run);
-        };
-        if (!parent) {
-            return await execute();
-        }
-        const result = parent.children.then(execute);
-        // The caller owns this result; the parent drains both outcomes before releasing claims.
-        parent.children = result.then(() => undefined, () => undefined);
-        return await result;
-    }
-    finally {
-        clearTimeout(timer);
-        await Promise.all(locks.reverse().map((lock) => lock.release()));
-    }
-}
-export function withBrowserExecutionLock(options, run) {
-    return withBrowserExecutionLocks({
-        identities: [options.identity],
-        signal: options.signal,
-        deadline: options.deadline,
-        waitOnly: options.waitOnly,
-    }, run);
-}
-export async function acquireManagedSessionPolicyLock(options) {
-    if (options.signal?.aborted === true) {
-        return undefined;
-    }
-    let identity;
-    try {
-        identity = await resolveBrowserExecutionIdentity({ ...options, ownedManagedSession: true });
-    }
-    catch {
-        return undefined;
-    }
-    const scope = executionScope.getStore();
-    if (scope) {
-        if (!scope.active || !scopeCovers(scope.identities, groupExecutionIdentities([identity]))) {
-            return undefined;
-        }
-        return {
-            release: async () => {
-                /* The outer execution owns release of this borrowed claim. */
-            },
-        };
-    }
-    const grouped = groupExecutionIdentities([identity]).at(0);
-    if (grouped === undefined) {
-        return undefined;
-    }
-    return acquireExecutionClaim({
-        identity: grouped,
-        signal: options.signal,
-        timeoutMs: options.timeoutMs,
-    });
-}

package/dist/extensions/agent-browser/lib/managed-session-posix-storage.js

@@ -1,58 +0,0 @@
-import { lstatSync } from "node:fs";
-import { join, parse } from "node:path";
-import { getCurrentProcessUid } from "./process-identity.js";
-function androidSystemAncestor(path, entry, platform) {
-    return (platform === "android" &&
-        (path === "/data" || path === "/data/data") &&
-        entry.uid === 1000 &&
-        (entry.mode & 0o002) === 0);
-}
-function androidAppDirectory(entry, uid, platform) {
-    return (platform === "android" && entry.uid === uid && entry.gid === uid && (entry.mode & 0o002) === 0);
-}
-function ancestorModeTrusted(entry, android) {
-    const rootSticky = entry.uid === 0 && (entry.mode & 0o1000) !== 0;
-    return (entry.mode & 0o022) === 0 || rootSticky || android.system || android.app;
-}
-function ancestorTrusted(path, entry, uid, platform) {
-    if (entry.isSymbolicLink() || !entry.isDirectory()) {
-        return false;
-    }
-    const system = androidSystemAncestor(path, entry, platform);
-    if (!system && entry.uid !== 0 && entry.uid !== uid) {
-        return false;
-    }
-    return ancestorModeTrusted(entry, { system, app: androidAppDirectory(entry, uid, platform) });
-}
-export function isTrustedPosixDirectory(path, requireCurrentOwner, platform = process.platform) {
-    const uid = getCurrentProcessUid();
-    if (uid === undefined) {
-        return false;
-    }
-    const root = parse(path).root;
-    let cursor = root;
-    for (const component of path.slice(root.length).split("/").filter(Boolean)) {
-        cursor = join(cursor, component);
-        try {
-            if (!ancestorTrusted(cursor, lstatSync(cursor), uid, platform)) {
-                return false;
-            }
-        }
-        catch {
-            return false;
-        }
-    }
-    try {
-        return !requireCurrentOwner || lstatSync(path).uid === uid;
-    }
-    catch {
-        return false;
-    }
-}
-export function isTrustedCurrentFile(entry, platform, forbiddenMode) {
-    if (platform === "win32") {
-        return true;
-    }
-    const uid = getCurrentProcessUid();
-    return uid !== undefined && entry.uid === uid && (entry.mode & forbiddenMode) === 0;
-}

package/dist/extensions/agent-browser/lib/managed-session-project-identity.js

@@ -1,244 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { linkSync, lstatSync, readFileSync, realpathSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { isRecord } from "./parsing.js";
-import { getErrorCode } from "./process-errors.js";
-const MANAGED_SESSION_RESTORE_KEY_PATTERN = /^piab-r2-[a-f\d]{32}$/i;
-const MANAGED_SESSION_NAME_PREFIX = "piab-r2-";
-export function isManagedSessionRestoreKey(value) {
-    return typeof value === "string" && MANAGED_SESSION_RESTORE_KEY_PATTERN.test(value);
-}
-const MANAGED_SESSION_FRESH_SUFFIX_PATTERN = /-fresh-[a-f\d]{10}$/i;
-const MANAGED_SESSION_RESTORE_KEY_HASH_LENGTH = 32;
-const PROJECT_GENERATION_MARKER_NAME = "pi-agent-browser-project-generation-v1.json";
-const PROJECT_GENERATION_MARKER_MAX_BYTES = 1_024;
-const projectGenerationCache = new Map();
-import { isTrustedPosixDirectory, isTrustedCurrentFile } from "./managed-session-posix-storage.js";
-function readGitPointer(directory, entry, platform) {
-    const dotGit = join(directory, ".git");
-    if (!entry.isFile() ||
-        entry.isSymbolicLink() ||
-        entry.size > PROJECT_GENERATION_MARKER_MAX_BYTES ||
-        !isTrustedCurrentFile(entry, platform, 0o022)) {
-        return undefined;
-    }
-    const match = /^gitdir:\s*(.+)\s*$/i.exec(readFileSync(dotGit, "utf8"));
-    if (match?.[1] === undefined || match[1].length === 0) {
-        return undefined;
-    }
-    return {
-        gitDirectory: realpathSync(resolve(directory, match[1])),
-        worktreeDirectory: realpathSync(directory),
-    };
-}
-function resolveGitCheckout(cwd, platform) {
-    let directory = cwd;
-    while (true) {
-        const dotGit = join(directory, ".git");
-        try {
-            const entry = lstatSync(dotGit);
-            if (entry.isDirectory() && !entry.isSymbolicLink()) {
-                return { gitDirectory: realpathSync(dotGit), worktreeDirectory: realpathSync(directory) };
-            }
-            return readGitPointer(directory, entry, platform);
-        }
-        catch (error) {
-            if (getErrorCode(error) !== "ENOENT") {
-                return undefined;
-            }
-        }
-        const parent = dirname(directory);
-        if (parent === directory) {
-            return undefined;
-        }
-        directory = parent;
-    }
-}
-function readProjectGenerationMarker(path, platform) {
-    try {
-        const entry = lstatSync(path);
-        if (entry.isSymbolicLink() ||
-            !entry.isFile() ||
-            entry.size > PROJECT_GENERATION_MARKER_MAX_BYTES) {
-            return undefined;
-        }
-        if (!isTrustedCurrentFile(entry, platform, 0o177)) {
-            return undefined;
-        }
-        const parsed = JSON.parse(readFileSync(path, "utf8"));
-        if (!isRecord(parsed)) {
-            return undefined;
-        }
-        return parsed.version === 1 &&
-            typeof parsed.id === "string" &&
-            /^[a-f\d]{8}(?:-[a-f\d]{4}){3}-[a-f\d]{12}$/i.test(parsed.id)
-            ? parsed.id
-            : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function getDirectoryFilesystemIdentity(path, platform) {
-    try {
-        const entry = statSync(path, { bigint: true });
-        if (!entry.isDirectory() || entry.dev <= 0n || entry.ino <= 0n) {
-            return undefined;
-        }
-        // ponytail: Android reports mutable ctime as birthtime; use statx birthtime/inode generation when Node exposes either reliably.
-        if (platform === "android") {
-            return `${entry.dev.toString()}:${entry.ino.toString()}`;
-        }
-        if (entry.birthtimeNs <= 0n) {
-            return undefined;
-        }
-        return `${entry.dev.toString()}:${entry.ino.toString()}:${entry.birthtimeNs.toString()}`;
-    }
-    catch {
-        return undefined;
-    }
-}
-function resolveManagedSessionRestoreProjectCheckout(cwd, platform) {
-    let canonicalCwd;
-    try {
-        canonicalCwd = realpathSync(cwd);
-    }
-    catch {
-        return undefined;
-    }
-    if (platform !== "win32" && !isTrustedPosixDirectory(canonicalCwd, false, platform)) {
-        return undefined;
-    }
-    const checkout = resolveGitCheckout(canonicalCwd, platform);
-    if (!checkout) {
-        return undefined;
-    }
-    if (platform !== "win32" &&
-        (!isTrustedPosixDirectory(checkout.worktreeDirectory, true, platform) ||
-            !isTrustedPosixDirectory(checkout.gitDirectory, true, platform))) {
-        return undefined;
-    }
-    return { canonicalCwd, ...checkout };
-}
-export function resolveManagedSessionRestoreCheckoutRoot(cwd, platform = process.platform) {
-    return resolveManagedSessionRestoreProjectCheckout(cwd, platform)?.worktreeDirectory;
-}
-function matchingCacheIdentity(cached, checkout, filesystem) {
-    if (cached === undefined) {
-        return undefined;
-    }
-    return cached.gitDirectory === checkout.gitDirectory &&
-        cached.worktreeDirectory === checkout.worktreeDirectory &&
-        cached.gitFilesystemIdentity === filesystem.git &&
-        cached.worktreeFilesystemIdentity === filesystem.worktree &&
-        cached.marker === filesystem.marker
-        ? cached.identity
-        : undefined;
-}
-function publishGenerationMarker(markerPath, platform) {
-    const content = JSON.stringify({ id: randomUUID(), version: 1 });
-    if (platform === "android") {
-        // ponytail: Android denies hard links in app storage; use renameat2(RENAME_NOREPLACE) if Node exposes it.
-        try {
-            writeFileSync(markerPath, content, { encoding: "utf8", flag: "wx", mode: 0o600 });
-            return true;
-        }
-        catch (error) {
-            return getErrorCode(error) === "EEXIST";
-        }
-    }
-    const candidatePath = `${markerPath}.candidate-${process.pid}-${randomUUID()}`;
-    try {
-        writeFileSync(candidatePath, content, { encoding: "utf8", flag: "wx", mode: 0o600 });
-        try {
-            linkSync(candidatePath, markerPath);
-            return true;
-        }
-        catch (error) {
-            return getErrorCode(error) === "EEXIST";
-        }
-    }
-    catch {
-        return false;
-    }
-    finally {
-        try {
-            unlinkSync(candidatePath);
-        }
-        catch {
-            /* Cleanup is best-effort; only the validated published marker supplies identity. */
-        }
-    }
-}
-function resolveProjectGenerationIdentity(cwd, platform = process.platform) {
-    const checkout = resolveManagedSessionRestoreProjectCheckout(cwd, platform);
-    if (!checkout) {
-        return undefined;
-    }
-    const { canonicalCwd } = checkout;
-    const gitFilesystemIdentity = getDirectoryFilesystemIdentity(checkout.gitDirectory, platform);
-    const worktreeFilesystemIdentity = getDirectoryFilesystemIdentity(checkout.worktreeDirectory, platform);
-    if (gitFilesystemIdentity === undefined || worktreeFilesystemIdentity === undefined) {
-        return undefined;
-    }
-    const markerPath = join(checkout.gitDirectory, PROJECT_GENERATION_MARKER_NAME);
-    let marker = readProjectGenerationMarker(markerPath, platform);
-    const cached = projectGenerationCache.get(canonicalCwd);
-    const cachedIdentity = matchingCacheIdentity(cached, checkout, {
-        git: gitFilesystemIdentity,
-        worktree: worktreeFilesystemIdentity,
-        marker,
-    });
-    if (cachedIdentity !== undefined) {
-        return cachedIdentity;
-    }
-    projectGenerationCache.delete(canonicalCwd);
-    try {
-        if (marker === undefined) {
-            if (!publishGenerationMarker(markerPath, platform)) {
-                return undefined;
-            }
-            marker = readProjectGenerationMarker(markerPath, platform);
-        }
-        if (marker === undefined) {
-            return undefined;
-        }
-        const identity = `${platform}:${worktreeFilesystemIdentity}:${gitFilesystemIdentity}:${marker}`;
-        projectGenerationCache.set(canonicalCwd, {
-            gitDirectory: checkout.gitDirectory,
-            gitFilesystemIdentity,
-            identity,
-            marker,
-            worktreeDirectory: checkout.worktreeDirectory,
-            worktreeFilesystemIdentity,
-        });
-        return identity;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function hasManagedSessionRestoreProjectIdentity(cwd) {
-    return resolveProjectGenerationIdentity(cwd) !== undefined;
-}
-/** Keep fresh rotations from one Pi transcript in one private upstream restore pool. */
-export function getManagedSessionRestoreScope(sessionName) {
-    return sessionName.replace(MANAGED_SESSION_FRESH_SUFFIX_PATTERN, "");
-}
-/** Stable for one Pi transcript and checkout generation; isolated from other concurrent transcripts. */
-export function createManagedSessionRestoreKey(cwd, restoreScope = "", platform = process.platform) {
-    let canonicalCwd = resolve(cwd);
-    try {
-        canonicalCwd = realpathSync(canonicalCwd);
-    }
-    catch {
-        // Missing cwd keeps the deterministic unavailable identity without claiming a durable checkout.
-    }
-    const identity = resolveProjectGenerationIdentity(canonicalCwd, platform);
-    const material = identity ?? `unavailable:${canonicalCwd}`;
-    const digest = createHash("sha256")
-        .update(`restore-v3:${material}:scope:${restoreScope}`)
-        .digest("hex")
-        .slice(0, MANAGED_SESSION_RESTORE_KEY_HASH_LENGTH);
-    return `${MANAGED_SESSION_NAME_PREFIX}${digest}`;
-}

package/dist/extensions/agent-browser/lib/managed-session-restore-context.js

@@ -1,84 +0,0 @@
-import { extractRequestedRestoreKey } from "./argv-grammar.js";
-import { hasLaunchScopedFlagToken } from "./launch-scoped-flags.js";
-import { createManagedSessionRestoreKey, getManagedSessionRestoreScope, getManagedSessionRestoreProtectedStorageEnv, hasManagedSessionRestoreProjectIdentity, } from "./managed-session-storage.js";
-import { getAgentBrowserProcessEnvironment } from "./process-environment.js";
-import { resolveOwnedManagedSessionContext, } from "./owned-managed-session-context.js";
-import { AGENT_BROWSER_RESTORE_ENV, agentBrowserExplicitConfigIsPresent, isManagedSessionRestoreIncompatible, managedSessionRestoreOptedOut, } from "./managed-session-restore-policy.js";
-function reuseIsSuppressed(options, env) {
-    return (managedSessionRestoreOptedOut(options) ||
-        agentBrowserExplicitConfigIsPresent(env, options.args) ||
-        ["--restore", "--session-name"].some((flag) => hasLaunchScopedFlagToken(options.args, flag)) ||
-        env.AGENT_BROWSER_RESTORE !== undefined ||
-        env.AGENT_BROWSER_SESSION_NAME !== undefined);
-}
-function reuseContext(options, owned) {
-    const env = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
-    const enabled = !options.restoreState.isDisabled(owned.sessionName, owned.namespace);
-    const scope = getManagedSessionRestoreScope(owned.sessionName);
-    const knownKey = options.restoreState.getDaemonRestoreKey(owned.sessionName, owned.namespace);
-    const cwd = owned.cwd ?? options.cwd;
-    const key = knownKey === undefined && enabled && hasManagedSessionRestoreProjectIdentity(cwd)
-        ? createManagedSessionRestoreKey(cwd, scope)
-        : knownKey;
-    return {
-        ...owned,
-        reuseOnly: true,
-        restoreKey: key ?? undefined,
-        restoreScope: scope,
-        protectedStorageEnv: enabled
-            ? getManagedSessionRestoreProtectedStorageEnv(true, env)
-            : undefined,
-        restoreDecision: enabled ? "enabled" : undefined,
-        restoreSuppressed: reuseIsSuppressed(options, env),
-        headedManagedAutosaveDisabled: options.headedManagedAutosaveDisabled,
-        headedManagedAutosaveInterval: options.headedManagedAutosaveInterval,
-    };
-}
-function restoreDecision(optedOut, incompatible) {
-    if (optedOut) {
-        return "opted-out";
-    }
-    return incompatible ? "incompatible" : "enabled";
-}
-function launchContext(options, owned) {
-    const cwd = owned.cwd ?? options.cwd;
-    const policy = {
-        args: options.args,
-        cwd,
-        env: options.env,
-        parentEnv: options.parentEnv,
-        stdin: options.stdin,
-        wrapperInjectedUserAgent: options.wrapperInjectedUserAgent,
-    };
-    const optedOut = managedSessionRestoreOptedOut(policy);
-    const projectIdentityAvailable = !optedOut && hasManagedSessionRestoreProjectIdentity(cwd);
-    const incompatible = !optedOut && isManagedSessionRestoreIncompatible(policy, owned.namespace);
-    const enabled = !optedOut && !incompatible;
-    const env = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
-    const scope = getManagedSessionRestoreScope(owned.sessionName);
-    const key = projectIdentityAvailable ? createManagedSessionRestoreKey(cwd, scope) : undefined;
-    const decision = restoreDecision(optedOut, incompatible);
-    return {
-        ...owned,
-        compatibilityUserAgent: options.compatibilityUserAgent,
-        headedManagedAutosaveDisabled: options.headedManagedAutosaveDisabled,
-        headedManagedAutosaveInterval: options.headedManagedAutosaveInterval,
-        expectedDaemonRestoreKey: enabled
-            ? key
-            : extractRequestedRestoreKey(options.args, owned.sessionName, env[AGENT_BROWSER_RESTORE_ENV]),
-        protectedStorageEnv: enabled
-            ? getManagedSessionRestoreProtectedStorageEnv(true, env)
-            : undefined,
-        restoreDecision: decision,
-        restoreKey: key,
-        restoreScope: scope,
-        restoreSuppressed: optedOut || incompatible,
-    };
-}
-export function buildOwnedManagedSessionRestoreContext(options) {
-    const owned = resolveOwnedManagedSessionContext(options);
-    if (!owned) {
-        return undefined;
-    }
-    return options.reuseOnly === true ? reuseContext(options, owned) : launchContext(options, owned);
-}

package/dist/extensions/agent-browser/lib/managed-session-restore-policy.js

@@ -1,119 +0,0 @@
-import { extractUpstreamCommandTokens, parseCommandInfo } from "./argv-descriptor.js";
-import { extractExplicitNamespace, extractExplicitSessionName, isUpstreamEnvFlagEnabled, scanUpstreamGlobalFlagOccurrences, } from "./argv-grammar.js";
-import { hasLaunchScopedFlagToken, MANAGED_RESTORE_INCOMPATIBLE_BOOLEAN_ENVS, MANAGED_RESTORE_INCOMPATIBLE_ENVS, MANAGED_RESTORE_INCOMPATIBLE_FLAGS, } from "./launch-scoped-flags.js";
-import { ensureManagedSessionRestoreStorageIsSecure, hasManagedSessionRestoreProjectIdentity, resolveManagedSessionRestoreHome, } from "./managed-session-storage.js";
-import { parseUserBatchStdin } from "./orchestration/batch-stdin.js";
-import { getAgentBrowserProcessEnvironment } from "./process-environment.js";
-import { ownedContextMatches } from "./owned-managed-session-context.js";
-export const AGENT_BROWSER_CONFIG_ENV = "AGENT_BROWSER_CONFIG";
-export const AGENT_BROWSER_RESTORE_ENV = "AGENT_BROWSER_RESTORE";
-export const MANAGED_SESSION_RESTORE_ENV = "PI_AGENT_BROWSER_MANAGED_SESSION_RESTORE";
-export function isDisabledEnvFlag(value) {
-    return value !== undefined && ["0", "false", "no", "off"].includes(value.trim().toLowerCase());
-}
-export function hasUpstreamEnvValue(env, name) {
-    return env?.[name] !== undefined;
-}
-function hasExplicitConfigArg(args) {
-    return scanUpstreamGlobalFlagOccurrences(args, "--config").length > 0;
-}
-export function closesBrowserSession(args) {
-    return ["close", "exit", "quit"].includes(parseCommandInfo(args).command ?? "");
-}
-export function agentBrowserExplicitConfigIsPresent(parentEnv = getAgentBrowserProcessEnvironment(), args = []) {
-    return hasExplicitConfigArg(args) || hasUpstreamEnvValue(parentEnv, AGENT_BROWSER_CONFIG_ENV);
-}
-/** Caller-selected config disables automatic restore injection without blocking native config. */
-export function agentBrowserConfigBlocksManagedRestore(parentEnv = getAgentBrowserProcessEnvironment(), args = [], platform = process.platform) {
-    return ((resolveManagedSessionRestoreHome(parentEnv, platform) ?? "").length === 0 ||
-        agentBrowserExplicitConfigIsPresent(parentEnv, args));
-}
-function omitWrapperInjectedUserAgent(args, enabled) {
-    if (enabled !== true) {
-        return [...args];
-    }
-    const index = args.indexOf("--user-agent");
-    return index < 0 ? [...args] : [...args.slice(0, index), ...args.slice(index + 2)];
-}
-function batchHasManagedSessionRestoreConflict(args, stdin) {
-    const [command, ...commandArgs] = extractUpstreamCommandTokens(args);
-    if (command !== "batch") {
-        return false;
-    }
-    if (commandArgs.some((token) => token !== "--bail")) {
-        return true;
-    }
-    const parsed = parseUserBatchStdin(stdin);
-    if ((parsed.error !== undefined && parsed.error.length > 0) || !parsed.steps) {
-        return false;
-    }
-    return parsed.steps.some((step) => ["connect", "batch"].includes(parseCommandInfo(step).command ?? ""));
-}
-function hasLaunchConflict(options) {
-    const effectiveEnv = {
-        ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()),
-        ...options.env,
-    };
-    const args = omitWrapperInjectedUserAgent(options.args, options.wrapperInjectedUserAgent);
-    if (MANAGED_RESTORE_INCOMPATIBLE_ENVS.some((name) => hasUpstreamEnvValue(effectiveEnv, name))) {
-        return true;
-    }
-    if (MANAGED_RESTORE_INCOMPATIBLE_BOOLEAN_ENVS.some((name) => isUpstreamEnvFlagEnabled(effectiveEnv[name]))) {
-        return true;
-    }
-    if (MANAGED_RESTORE_INCOMPATIBLE_FLAGS.some((flag) => hasLaunchScopedFlagToken(args, flag))) {
-        return true;
-    }
-    if (parseCommandInfo(args).command === "connect" ||
-        batchHasManagedSessionRestoreConflict(args, options.stdin)) {
-        return true;
-    }
-    return agentBrowserExplicitConfigIsPresent(effectiveEnv, args);
-}
-export function managedSessionRestoreOptedOut(options) {
-    return isDisabledEnvFlag({ ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env }[MANAGED_SESSION_RESTORE_ENV]);
-}
-function lacksProjectStorage(options, env) {
-    if (options.cwd === undefined || options.cwd.length === 0) {
-        return false;
-    }
-    return (!hasManagedSessionRestoreProjectIdentity(options.cwd) ||
-        agentBrowserConfigBlocksManagedRestore(env, omitWrapperInjectedUserAgent(options.args, options.wrapperInjectedUserAgent)));
-}
-export function isManagedSessionRestoreIncompatible(options, namespace = extractExplicitNamespace(options.args)) {
-    if (hasLaunchConflict(options)) {
-        return true;
-    }
-    if (managedSessionRestoreOptedOut(options)) {
-        return false;
-    }
-    const env = { ...(options.parentEnv ?? getAgentBrowserProcessEnvironment()), ...options.env };
-    return (lacksProjectStorage(options, env) ||
-        !ensureManagedSessionRestoreStorageIsSecure(env, process.platform, namespace));
-}
-export function resolveManagedSessionRestorePolicy(options) {
-    const parentEnv = options.parentEnv ?? getAgentBrowserProcessEnvironment();
-    const sessionName = extractExplicitSessionName(options.args);
-    const ownedContext = ownedContextMatches(sessionName, options.args);
-    const namespace = ownedContext ? ownedContext.namespace : extractExplicitNamespace(options.args);
-    const restoreState = ownedContext?.restoreState ?? options.restoreState;
-    const owned = (options.ownedManagedSession === true || ownedContext !== undefined) &&
-        restoreState !== undefined;
-    return { namespace, owned, ownedContext, parentEnv, restoreState, sessionName };
-}
-export function resolveExplicitAutosaveInterval(value) {
-    if (value === undefined) {
-        return undefined;
-    }
-    const defaultInterval = "30000";
-    if (!/^\+?\d+$/.test(value)) {
-        return defaultInterval;
-    }
-    try {
-        const parsed = BigInt(value);
-        return parsed <= 18446744073709551615n ? parsed.toString() : defaultInterval;
-    }
-    catch {
-        return defaultInterval;
-    }
-}