@reason-machines/cli-linux-arm64-musl 0.2.280 → 0.2.282
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/ara +1 -1
- package/bin/vm-hands/{connect-cli-pey653vs.js → connect-cli-26easn4y.js} +1 -1
- package/bin/vm-hands/{local-automation-060ebgph.js → local-automation-hk8bgn7w.js} +1 -1
- package/bin/vm-hands/{local-capabilities-rnfywakv.js → local-capabilities-j6cmcwdc.js} +1 -1
- package/bin/vm-hands/{local-display-session-be5b20wr.js → local-display-session-4402sa84.js} +1 -1
- package/bin/vm-hands/{permissions-5rk1x31r.js → permissions-avhf90my.js} +1 -1
- package/bin/vm-hands/{status-a22h186h.js → status-sj500a30.js} +2 -2
- package/bin/vm-hands/{version-nahw41t6.js → version-zanrbm0q.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-zpcr7myv.js → vm-hands-entry-lite-1fznjm91.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-tnqv3xzm.js → vm-hands-entry-lite-1nnj48qj.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-6v546v08.js → vm-hands-entry-lite-21zpypby.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-8e4r3b6x.js → vm-hands-entry-lite-25t4e0vk.js} +2 -2
- package/bin/vm-hands/{vm-hands-entry-lite-q863th71.js → vm-hands-entry-lite-54n8tmj1.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-fapp2ksb.js → vm-hands-entry-lite-am0fatcw.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-g0g75c3y.js → vm-hands-entry-lite-bw9verbt.js} +1 -1
- package/bin/vm-hands/{vm-hands-entry-lite-1ke1jfwg.js → vm-hands-entry-lite-z2np2gzv.js} +1 -1
- package/bin/vm-hands/vm-hands-entry-lite.js +1 -1
- package/bin/vm-hands/{vm-hands-executor-p9h31r85.js → vm-hands-executor-p7kq9n00.js} +1 -1
- package/bin/vm-hands/{vm-hands-op-runner-3exdfqwf.js → vm-hands-op-runner-350k7hem.js} +1 -1
- package/bin/vm-hands/{vm-hands-runtime-64eyw5ke.js → vm-hands-runtime-st3eagc2.js} +2 -2
- package/package.json +1 -1
package/bin/ara
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-
|
|
2
|
+
import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h,o as i,p as j,q as k,r as l,s as m}from"./vm-hands-entry-lite-21zpypby.js";import"./vm-hands-entry-lite-k4c504n7.js";import"./vm-hands-entry-lite-am0fatcw.js";import"./vm-hands-entry-lite-1nnj48qj.js";import"./vm-hands-entry-lite-c2nrar90.js";import"./vm-hands-entry-lite-65pbrs1x.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-1hwdab4e.js";import"./vm-hands-entry-lite-54n8tmj1.js";import"./vm-hands-entry-lite-gqncr2j0.js";import"./vm-hands-entry-lite-sv6xwe0h.js";import"./vm-hands-entry-lite-bw9verbt.js";import"./vm-hands-entry-lite-bfwf82rw.js";import"./vm-hands-entry-lite-ptmqg51y.js";import"./vm-hands-entry-lite-25t4e0vk.js";import"./vm-hands-entry-lite-s2xydt0n.js";import"./vm-hands-entry-lite-s5qn1k80.js";import"./vm-hands-entry-lite-9pmag2qk.js";import"./vm-hands-entry-lite-84aq8d12.js";import"./vm-hands-entry-lite-z2np2gzv.js";import"./vm-hands-entry-lite-1fznjm91.js";import"./vm-hands-entry-lite-anaydk9m.js";import"./vm-hands-entry-lite-ffg7rf02.js";import"./vm-hands-entry-lite-7gh1rbn7.js";export{g as runDisconnectCli,f as runConnectCli,m as restartConnectionWhenIdle,l as restartConnection,h as logoutConnection,k as connectionUsesUserChrome,i as connectionReport,j as connectionForBrowserExtension,c as connectionDirectory,d as computerDisconnected,e as addConnectionFolder,b as DISCONNECT_HELP,a as CONNECT_HELP};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ac as a,Bc as b,Cc as c,Dc as d,Ec as e,Fc as f,Gc as g,Hc as h,Ic as i,Jc as j,Kc as k,Lc as l}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ac as a,Bc as b,Cc as c,Dc as d,Ec as e,Fc as f,Gc as g,Hc as h,Ic as i,Jc as j,Kc as k,Lc as l}from"./vm-hands-entry-lite-54n8tmj1.js";import"./vm-hands-entry-lite-gqncr2j0.js";import"./vm-hands-entry-lite-sv6xwe0h.js";import"./vm-hands-entry-lite-bw9verbt.js";import"./vm-hands-entry-lite-bfwf82rw.js";import"./vm-hands-entry-lite-ptmqg51y.js";import"./vm-hands-entry-lite-25t4e0vk.js";import"./vm-hands-entry-lite-s2xydt0n.js";import"./vm-hands-entry-lite-s5qn1k80.js";import"./vm-hands-entry-lite-9pmag2qk.js";import"./vm-hands-entry-lite-84aq8d12.js";import"./vm-hands-entry-lite-z2np2gzv.js";import"./vm-hands-entry-lite-1fznjm91.js";import"./vm-hands-entry-lite-anaydk9m.js";import"./vm-hands-entry-lite-ffg7rf02.js";import"./vm-hands-entry-lite-7gh1rbn7.js";export{d as runRelayed,e as runMacComputerUse,l as runLocalAutomation,k as runAutomationCallLocally,b as parseAutomationPayload,g as localUserChromeProfiles,h as localUserChromeInstance,f as localUserChromeHost,j as localBrowserProfile,c as localAutomationAvailable,i as ensureLocalBrowser,a as AUTOMATION_CHUNK_BYTES};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-
|
|
2
|
+
import{$ as o,P as c,Q as d,R as e,S as f,T as g,U as h,V as i,W as j,X as k,Y as l,Z as m,_ as n,aa as p,ba as q,ca as r,da as s,ea as t,fa as u}from"./vm-hands-entry-lite-am0fatcw.js";import"./vm-hands-entry-lite-1nnj48qj.js";import"./vm-hands-entry-lite-c2nrar90.js";import"./vm-hands-entry-lite-65pbrs1x.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as b}from"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-1hwdab4e.js";import"./vm-hands-entry-lite-54n8tmj1.js";import"./vm-hands-entry-lite-gqncr2j0.js";import"./vm-hands-entry-lite-sv6xwe0h.js";import"./vm-hands-entry-lite-bw9verbt.js";import"./vm-hands-entry-lite-bfwf82rw.js";import"./vm-hands-entry-lite-ptmqg51y.js";import"./vm-hands-entry-lite-25t4e0vk.js";import"./vm-hands-entry-lite-s2xydt0n.js";import"./vm-hands-entry-lite-s5qn1k80.js";import"./vm-hands-entry-lite-9pmag2qk.js";import"./vm-hands-entry-lite-84aq8d12.js";import"./vm-hands-entry-lite-z2np2gzv.js";import"./vm-hands-entry-lite-1fznjm91.js";import"./vm-hands-entry-lite-anaydk9m.js";import{Gh as a}from"./vm-hands-entry-lite-ffg7rf02.js";import"./vm-hands-entry-lite-7gh1rbn7.js";export{g as spawnCaptured,f as sandboxProfile,e as safeEnvironment,k as runTransferCapability,i as runFileCapability,t as rebindLocalHandsControl,j as localGithubPreviewServerLaunch,b as isProtectedLocalPath,u as executeLocalOperation,m as enrolledWorkspaceRootFingerprint,q as enrolledRootPaths,p as enrolledHomeContainedRootFingerprints,n as enrolledAccountRootPath,o as enrolledAccountRootFingerprint,s as deliverLocalHandsEnvironment,h as defaultLocalCommandRunner,d as confinedExecutionShell,r as capabilityInventoryForRoots,c as SHORT_REQUEST_CAPABILITIES,a as LocalCapabilityError,l as LOCAL_CAPABILITY_REGISTRY};
|
package/bin/vm-hands/{local-display-session-be5b20wr.js → local-display-session-4402sa84.js}
RENAMED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{re as a,se as b,te as c,ue as d,ve as e,we as f,xe as g,ye as h}from"./vm-hands-entry-lite-
|
|
2
|
+
import{re as a,se as b,te as c,ue as d,ve as e,we as f,xe as g,ye as h}from"./vm-hands-entry-lite-bw9verbt.js";import"./vm-hands-entry-lite-bfwf82rw.js";import"./vm-hands-entry-lite-ptmqg51y.js";import"./vm-hands-entry-lite-25t4e0vk.js";import"./vm-hands-entry-lite-s2xydt0n.js";import"./vm-hands-entry-lite-s5qn1k80.js";import"./vm-hands-entry-lite-9pmag2qk.js";import"./vm-hands-entry-lite-84aq8d12.js";import"./vm-hands-entry-lite-z2np2gzv.js";import"./vm-hands-entry-lite-1fznjm91.js";import"./vm-hands-entry-lite-anaydk9m.js";import"./vm-hands-entry-lite-ffg7rf02.js";import"./vm-hands-entry-lite-7gh1rbn7.js";export{h as runLocalDisplayStream,f as privateDirectory,c as parseDisplayStreamPayload,e as localDisplayReady,d as localDisplayAvailable,g as ensureLinuxDesktop,a as LOCAL_DISPLAY_MAX_SESSION_MS,b as LINUX_WORKER_DISPLAY};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{og as a,pg as b,qg as c,rg as d,sg as e,tg as f,ug as g,vg as h,wg as i,xg as j}from"./vm-hands-entry-lite-
|
|
2
|
+
import{og as a,pg as b,qg as c,rg as d,sg as e,tg as f,ug as g,vg as h,wg as i,xg as j}from"./vm-hands-entry-lite-25t4e0vk.js";import"./vm-hands-entry-lite-s2xydt0n.js";import"./vm-hands-entry-lite-9pmag2qk.js";import"./vm-hands-entry-lite-84aq8d12.js";import"./vm-hands-entry-lite-z2np2gzv.js";import"./vm-hands-entry-lite-1fznjm91.js";import"./vm-hands-entry-lite-ffg7rf02.js";import"./vm-hands-entry-lite-7gh1rbn7.js";export{j as runPermissionsCli,d as reasonIdentity,e as readMacPermissions,f as permissionsSummary,i as parsePermissionsArgs,c as fullDiskAccessTarget,g as formatMacPermissions,h as allowMacPermissions,a as PERMISSIONS_HELP,b as MAC_PERMISSION_IDS};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-
|
|
2
|
+
import{a as Wq,b as Bq,c as bq,d as Fq,e as Dq,f as kq,i as Kq,j as Vq,o as Hq}from"./vm-hands-entry-lite-21zpypby.js";import"./vm-hands-entry-lite-k4c504n7.js";import"./vm-hands-entry-lite-am0fatcw.js";import"./vm-hands-entry-lite-1nnj48qj.js";import"./vm-hands-entry-lite-c2nrar90.js";import"./vm-hands-entry-lite-65pbrs1x.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-1hwdab4e.js";import{lc as jq}from"./vm-hands-entry-lite-54n8tmj1.js";import"./vm-hands-entry-lite-gqncr2j0.js";import{_d as G}from"./vm-hands-entry-lite-sv6xwe0h.js";import"./vm-hands-entry-lite-bw9verbt.js";import{$e as Qq,Ce as H,De as u,Ee as s}from"./vm-hands-entry-lite-bfwf82rw.js";import"./vm-hands-entry-lite-ptmqg51y.js";import"./vm-hands-entry-lite-25t4e0vk.js";import"./vm-hands-entry-lite-s2xydt0n.js";import"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as l}from"./vm-hands-entry-lite-9pmag2qk.js";import"./vm-hands-entry-lite-84aq8d12.js";import{uh as R}from"./vm-hands-entry-lite-z2np2gzv.js";import"./vm-hands-entry-lite-1fznjm91.js";import"./vm-hands-entry-lite-anaydk9m.js";import"./vm-hands-entry-lite-ffg7rf02.js";import{Kh as $q}from"./vm-hands-entry-lite-7gh1rbn7.js";import{createHash as tq,randomBytes as sq}from"crypto";import{readFileSync as eq,realpathSync as Aq,renameSync as aq,unlinkSync as nq,writeFileSync as q3}from"fs";import{dirname as x3,join as zq}from"path";import{spawnSync as Mq}from"child_process";import{accessSync as _q,constants as wq,existsSync as L,mkdirSync as Lq,readFileSync as fq,renameSync as Sq,writeFileSync as hq}from"fs";import{homedir as Cq}from"os";import{delimiter as gq,dirname as mq,join as T}from"path";import{existsSync as Tq,readFileSync as Uq}from"fs";import{join as vq}from"path";var Eq=`---
|
|
3
3
|
name: reason
|
|
4
4
|
description: Integrate software with Reason's public REST API using a scoped API key. Use for API clients, CI, service integrations, or cloud coding-session automation.
|
|
5
5
|
---
|
|
@@ -79,7 +79,7 @@ This computer
|
|
|
79
79
|
`),b.version)x.stdout.write(`Version: ${b.version}${b.version===R?"":` (${R} is installed; \`reason connect\` restarts it on that)`}
|
|
80
80
|
`);if(x.stdout.write(`Folder: ${b.folder}
|
|
81
81
|
`),x.stdout.write(`Sessions: ${b.sessions_running===null?"":`${b.sessions_running} running, `}${b.sessions_max===1?"one at a time":`up to ${b.sessions_max} at once`}
|
|
82
|
-
`),A){let Z=A,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-
|
|
82
|
+
`),A){let Z=A,V=await(J.readPermissionsSummary??(async()=>{let{permissionsSummary:Rq,readMacPermissions:Nq,reasonIdentity:Iq}=await import("./permissions-avhf90my.js"),{macScreenStatus:Oq}=await import("./local-display-mac-j1v3mcgx.js");return Rq(await Nq({identity:()=>Iq(),grants:Oq,worker:async()=>Z}))}))().catch(()=>null);if(V)x.stdout.write(`${V}
|
|
83
83
|
`);x.stdout.write(`Keep awake: ${A.keep_awake.enabled?"on":"off"}${A.keep_awake.holding?" (holding)":""}
|
|
84
84
|
`)}if(b.service)x.stdout.write(`Logs: ${b.service.logs}
|
|
85
85
|
`);for(let Z of b.workspaces??[]){let V=Z.state==="removed"?"removed from that workspace":Z.blocked?"offline (this computer is outside that workspace's allowed networks)":Z.device_id?Gq[Z.state]:"connecting";x.stdout.write(`Also in workspace ${Z.name??Z.organization_id}${Z.account?" (another Reason account's)":""}: ${V}
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{uh as a,vh as b,wh as c,xh as d}from"./vm-hands-entry-lite-
|
|
2
|
+
import{uh as a,vh as b,wh as c,xh as d}from"./vm-hands-entry-lite-z2np2gzv.js";import"./vm-hands-entry-lite-1fznjm91.js";import"./vm-hands-entry-lite-7gh1rbn7.js";export{c as compareCliVersions,d as cliAndAgentVersion,b as CLI_VERSION_PATTERN,a as CLI_VERSION};
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
var r={name:"github-native-engineer-device-worker-production",version:"0.2.
|
|
2
|
+
var r={name:"github-native-engineer-device-worker-production",version:"0.2.282",private:!0,type:"module",engines:{node:">=22",bun:">=1.3.0"},workspaces:["../../packages/runtime-distribution"],dependencies:{"@anthropic-ai/sandbox-runtime":"^0.0.73","@earendil-works/pi-tui":"1.0.0","@modelcontextprotocol/sdk":"^1.29.0","@reason/runtime-distribution":"workspace:*","playwright-core":"1.60.0",zod:"^4.4.3"},overrides:{"@hono/node-server":"1.19.15","@earendil-works/pi-agent-core":"1.0.0","@earendil-works/pi-ai":"1.0.0","@earendil-works/pi-coding-agent":"1.0.0","@earendil-works/chord":"1.0.0","@earendil-works/pi-codemode":"1.0.0","@earendil-works/pi-mcp":"1.0.0","@earendil-works/pi-telemetry":"1.0.0","@earendil-works/pi-tui":"1.0.0","brace-expansion":"2.1.7",axios:"1.20.0","basic-ftp":"6.2.1","@grpc/grpc-js":"1.14.5",browserslist:"4.28.8","engine.io":"6.6.7","fast-uri":"3.1.8",hono:"^4.13.7","ip-address":"10.7.1",nanoid:"3.3.18",dompurify:"3.4.13",postcss:"8.5.23",qs:"6.16.0","shell-quote":"1.11.0","socket.io-parser":"4.2.7",tmp:"0.2.7",toml:"4.2.0",undici:"8.10.2",ws:"^8.21.0","js-yaml":"4.3.2","@modelcontextprotocol/sdk":"1.31.0","proxy-addr":"2.0.8","source-map-js":"1.2.2"}};
|
|
3
3
|
export{r as yh};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ab as W9,Bb as u0,Ib as z0,wb as WQ,xb as Z8,yb as u9,zb as q0}from"./vm-hands-entry-lite-c2nrar90.js";import{Qb as PQ,Rb as IQ,Sb as rZ,Tb as tZ,Ub as G8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as R0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Mc as a$,Pc as o$,sd as R9,td as n0,ud as H8,vd as w0,zd as N0}from"./vm-hands-entry-lite-gqncr2j0.js";import{_d as I}from"./vm-hands-entry-lite-sv6xwe0h.js";import{Ie as kQ,Je as f8,Xe as wQ,bf as s9,cf as w8}from"./vm-hands-entry-lite-bfwf82rw.js";import{Bf as c9,Jf as A8,Kf as P0,Lf as j0,Mf as d9,Tf as R8,Uf as $Q,Vf as l$,ef as WZ,hf as F9,qf as r$,rf as t$,tf as e$,vf as v9,wf as p$,xf as u$,yf as x8}from"./vm-hands-entry-lite-ptmqg51y.js";import{Vg as aZ}from"./vm-hands-entry-lite-s5qn1k80.js";import{$g as iZ,Xg as U8,Yg as p9}from"./vm-hands-entry-lite-9pmag2qk.js";import{ah as F8,bh as l0,ch as W8,dh as s0,eh as K9,fh as Q8,gh as r8,hh as p0,ih as v0,jh as d$,th as F$}from"./vm-hands-entry-lite-84aq8d12.js";import{yh as JZ}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ab as W9,Bb as u0,Ib as z0,wb as WQ,xb as Z8,yb as u9,zb as q0}from"./vm-hands-entry-lite-c2nrar90.js";import{Qb as PQ,Rb as IQ,Sb as rZ,Tb as tZ,Ub as G8}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Zb as R0}from"./vm-hands-entry-lite-n07kxrd1.js";import{Mc as a$,Pc as o$,sd as R9,td as n0,ud as H8,vd as w0,zd as N0}from"./vm-hands-entry-lite-gqncr2j0.js";import{_d as I}from"./vm-hands-entry-lite-sv6xwe0h.js";import{Ie as kQ,Je as f8,Xe as wQ,bf as s9,cf as w8}from"./vm-hands-entry-lite-bfwf82rw.js";import{Bf as c9,Jf as A8,Kf as P0,Lf as j0,Mf as d9,Tf as R8,Uf as $Q,Vf as l$,ef as WZ,hf as F9,qf as r$,rf as t$,tf as e$,vf as v9,wf as p$,xf as u$,yf as x8}from"./vm-hands-entry-lite-ptmqg51y.js";import{Vg as aZ}from"./vm-hands-entry-lite-s5qn1k80.js";import{$g as iZ,Xg as U8,Yg as p9}from"./vm-hands-entry-lite-9pmag2qk.js";import{ah as F8,bh as l0,ch as W8,dh as s0,eh as K9,fh as Q8,gh as r8,hh as p0,ih as v0,jh as d$,th as F$}from"./vm-hands-entry-lite-84aq8d12.js";import{yh as JZ}from"./vm-hands-entry-lite-1fznjm91.js";import{Eh as oZ}from"./vm-hands-entry-lite-anaydk9m.js";import{Gh as C}from"./vm-hands-entry-lite-ffg7rf02.js";import{Hh as L1,Kh as ZZ}from"./vm-hands-entry-lite-7gh1rbn7.js";var v={chunk:32768,upload:1048576,total:536870912,streams:16,queued:512,buffered:262144,relayBuffered:8388608,requestMs:30000,lifetimeMs:600000,authorizationMs:2000};function g9($){return $!==null&&typeof $==="object"&&!Array.isArray($)}function g0($,Q,Z=Number.MAX_SAFE_INTEGER){return typeof $==="number"&&Number.isSafeInteger($)&&$>=Q&&$<=Z}function I$($){return typeof $==="string"&&/^[a-zA-Z0-9_-]{1,160}$/.test($)}function _0($){if(!g9($)||Object.keys($).length!==12||![$.organizationId,$.userId,$.runId,$.deviceId,$.rootId,$.jobId,$.fenceId].every(I$)||!g0($.attachmentRevision,0)||!g0($.grantRevision,1)||!g0($.generation,1)||!g0($.port,1024,65535)||!g0($.expiresAtMs,1))throw Error("preview_binding_invalid");return Object.freeze({...$})}function y0($,Q){return Object.keys($).every((Z)=>$[Z]===Q[Z])}function M9($){if($.length>4096||!$.startsWith("/")||$.startsWith("//")||/[\\\x00-\x20\x7f#]/.test($))throw Error("preview_path_invalid");let Q=decodeURIComponent($);if(Q.startsWith("//")||/[\\\x00-\x1f\x7f]/.test(Q))throw Error("preview_path_invalid");return $}function P$($){return Array.isArray($)&&$.length<=64&&$.every((Q)=>Array.isArray(Q)&&Q.length===2&&typeof Q[0]==="string"&&/^[a-zA-Z0-9-]{1,80}$/.test(Q[0])&&typeof Q[1]==="string"&&Q[1].length<=4096&&!/[\x00-\x1f\x7f]/.test(Q[1]))}function N9($,Q=v.chunk){if($.length>Math.ceil(Q/3)*4||!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test($))throw Error("preview_data_invalid");let Z=Buffer.from($,"base64");if(Z.length>Q)throw Error("preview_data_too_large");return Z}function R$($){if(Array.isArray($))return Buffer.concat($);if(typeof $==="string")return Buffer.from($,"utf8");if($ instanceof ArrayBuffer)return Buffer.from($);return $}function E$($){if(Buffer.byteLength($)>v.upload*1.4+300000)throw Error("preview_frame_too_large");let Q=JSON.parse($);if(!g9(Q))throw Error("preview_frame_invalid");if(Q.type==="hello"){let Z=_0(Q.binding);return g0(Q.messages,v.chunk,v.upload)?{type:"hello",binding:Z,messages:Q.messages}:{type:"hello",binding:Z}}if(Q.type==="refused"&&typeof Q.reason==="string"&&/^[a-z_]{1,32}$/.test(Q.reason))return{type:"refused",binding:_0(Q.binding),reason:Q.reason};if(!I$(Q.id))throw Error("preview_frame_invalid");if(Q.type==="end"||Q.type==="cancel"||Q.type==="credit")return{type:Q.type,id:Q.id};if(Q.type==="ws"&&typeof Q.protocol==="string"&&/^[a-zA-Z0-9._-]{0,100}$/.test(Q.protocol))return{type:"ws",id:Q.id,protocol:Q.protocol};if(Q.type==="data"&&typeof Q.data==="string"&&typeof Q.binary==="boolean")return N9(Q.data,v.upload),{type:"data",id:Q.id,data:Q.data,binary:Q.binary};if(Q.type==="head"&&g0(Q.status,200,599)&&P$(Q.headers))return{type:"head",id:Q.id,status:Q.status,headers:Q.headers};if(Q.type==="request"&&typeof Q.method==="string"&&/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(Q.method)&&typeof Q.path==="string"&&P$(Q.headers)&&typeof Q.body==="string"&&typeof Q.upgrade==="boolean")return N9(Q.body,v.upload),{type:"request",id:Q.id,method:Q.method,path:M9(Q.path),headers:Q.headers,body:Q.body,upgrade:Q.upgrade};throw Error("preview_frame_invalid")}function T8($){let Q=[...$],Z=new Set(Q.filter(([J])=>J.toLowerCase()==="connection").flatMap(([,J])=>J.toLowerCase().split(",").map((G)=>G.trim()))),X=new Set(["authorization","proxy-authorization","cookie","set-cookie","host","origin","referer","connection","upgrade","keep-alive","transfer-encoding","te","trailer","content-length","forwarded","alt-svc","service-worker-allowed","clear-site-data","refresh"]);return Q.filter(([J])=>!X.has(J.toLowerCase())&&!Z.has(J.toLowerCase())&&!/^(x-forwarded-|x-ara-|sec-websocket-|access-control-)/i.test(J))}async function O8($){let Q;try{return await Promise.race([Promise.resolve().then($).then((Z)=>Z===!0||(Z===!1?!1:void 0),()=>{return}),new Promise((Z)=>{Q=setTimeout(()=>Z(void 0),v.authorizationMs)})])}finally{clearTimeout(Q)}}async function j9($){return await O8($)===!0}function y9($,Q){let Z=new URL($);if(Z.username||Z.password||Z.search||Z.hash||!(Z.protocol==="wss:"||Z.protocol==="ws:"&&["127.0.0.1","[::1]"].includes(Z.hostname))||!new RegExp(`^/${Q}/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]{32,}$`).test(Z.pathname))throw Error("preview_relay_invalid");return Z.href}function S$($){if(!g9($)||Object.keys($).length!==2||typeof $.deviceRelayUrl!=="string")throw Error("preview_open_invalid");return{binding:_0($.binding),deviceRelayUrl:y9($.deviceRelayUrl,"device")}}function w$($){if(!g9($)||Object.keys($).length!==1||!("binding"in $))throw Error("preview_close_invalid");return{binding:_0($.binding)}}import{request as B4}from"http";import{WebSocket as C9}from"ws";import{randomBytes as F4,timingSafeEqual as W4}from"crypto";import{createServer as U4}from"net";var b$="x-preview-connection";async function k$($,Q){if(Q.aborted)throw Error("preview_closed");let Z=F4(32).toString("base64url"),X=new Set,J=!1,G=U4((Y)=>{if(J||Q.aborted||X.size>=v.streams*2)return Y.destroy();X.add(Y);let H=new AbortController;Y.once("close",()=>{X.delete(Y),H.abort()}),Y.on("error",()=>Y.destroy()),Y.setTimeout(2000,()=>Y.destroy());let W=Buffer.alloc(0),F=(L)=>{W=Buffer.concat([W,L]);let B=W.indexOf(`\r
|
|
3
3
|
\r
|
|
4
4
|
`);if(B<0){if(W.length>16384)Y.destroy();return}if(Y.pause(),Y.off("data",F),B>16384||W.length>v.upload+16384)return Y.destroy();K(W,B).catch(()=>Y.destroy())};Y.on("data",F);async function K(L,B){let U=L.subarray(0,B).toString("latin1").split(`\r
|
|
5
5
|
`),M=/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) (\S+) HTTP\/1\.1$/.exec(U.shift()??"");if(!M)throw Error("preview_request_invalid");M9(M[2]);let _=!1,q=0,D=[];for(let T of U){let k=/^([a-zA-Z0-9-]+):[ \t]*([^\x00-\x08\x0a-\x1f\x7f]*)$/.exec(T);if(!k)throw Error("preview_header_invalid");if(k[1].toLowerCase()===b$){q++;let g=Buffer.from(k[2].trim());_=g.length===Z.length&&W4(g,Buffer.from(Z))}else if(k[1].toLowerCase()!=="host")D.push(T)}if(!_||q!==1||J||H.signal.aborted)throw Error("preview_connection_denied");let x=await $.connect(H.signal);if(J||H.signal.aborted)throw x.destroy(),Error("preview_closed");X.add(x),x.on("error",()=>Y.destroy()),x.once("close",()=>{X.delete(x),Y.destroy()}),Y.once("close",()=>x.destroy()),Y.setTimeout(0);let b=[`${M[1]} ${M[2]} HTTP/1.1`,`Host: 127.0.0.1:${x.remotePort}`,...D,"",""].join(`\r
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{t as u0}from"./vm-hands-entry-lite-k4c504n7.js";import{A as o8,B as e8,C as F7,D as W7,E as v3,F as g5,G as Z5,H as _0,I as l$,J as p$,K as E0,L as J2,M as u5,N as t0,O as G6,P as Z3,Q as i5,U as n5,ba as j7,ca as z7,da as O7,ea as A7,fa as u3,y as y6,z as f6}from"./vm-hands-entry-lite-
|
|
2
|
+
import{t as u0}from"./vm-hands-entry-lite-k4c504n7.js";import{A as o8,B as e8,C as F7,D as W7,E as v3,F as g5,G as Z5,H as _0,I as l$,J as p$,K as E0,L as J2,M as u5,N as t0,O as G6,P as Z3,Q as i5,U as n5,ba as j7,ca as z7,da as O7,ea as A7,fa as u3,y as y6,z as f6}from"./vm-hands-entry-lite-am0fatcw.js";import{Aa as $5,Ba as J5,Ca as N7,Da as U7,Fa as u,Ga as e,Ha as s,Ia as c,Ja as H5,Ka as M7,La as W$,Oa as K4,Pa as V4,Qa as WJ,Ra as LJ,Sa as DJ,Ta as k0,Ua as J0,Va as g,Wa as g3,Xa as E$,Ya as K2,Za as U0,_a as T7,db as X6,fb as w8,ha as d7,ib as g2,ka as M5,kb as v5,la as T5,lb as T3,nb as x5,oa as V5,qa as z5,rb as _7,sb as N3,ta as O5,ya as I5,za as P5}from"./vm-hands-entry-lite-1nnj48qj.js";import{Ab as A5,Bb as R5,Ib as C5}from"./vm-hands-entry-lite-c2nrar90.js";import{Nb as Q5}from"./vm-hands-entry-lite-65pbrs1x.js";import{Ub as m5}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Cc as l5,Fc as L7,Ic as h6,Jc as m6,mc as a1,nc as K1,oc as T1,pc as L$,qc as ZJ,rc as zJ,sc as OJ,tc as D$,uc as AJ,vc as X4,wc as _1,xc as R8,yc as Y4}from"./vm-hands-entry-lite-54n8tmj1.js";import{Fd as e1,Pd as F2,Tc as b2,Xc as V7,Yc as H7,zd as t8}from"./vm-hands-entry-lite-gqncr2j0.js";import{_d as B}from"./vm-hands-entry-lite-sv6xwe0h.js";import{ge as jJ,he as t2,ke as D7,ne as n$,pe as dJ,qe as lJ,ve as a5}from"./vm-hands-entry-lite-bw9verbt.js";import{$e as y$,Ae as k$,Ce as P0,De as D4,Fe as J1,Ge as z0,He as E9,Ie as _J,Je as FJ,Ke as E2,Le as q2,Me as f3,Ne as O8,Oe as A8,Pe as X$,Qe as v$,Re as X0,Se as T2,Te as I7,Ue as P7,Ve as o1,We as A4,Ye as Q3,Ze as h1,_e as m0,af as X3,df as m1,ze as b0}from"./vm-hands-entry-lite-bfwf82rw.js";import{hf as j5}from"./vm-hands-entry-lite-ptmqg51y.js";import{fg as NJ,ig as d5,jg as h3,lg as X5}from"./vm-hands-entry-lite-25t4e0vk.js";import{Ug as Z2,Vg as h5}from"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as V0,Zg as J7}from"./vm-hands-entry-lite-9pmag2qk.js";import{uh as r}from"./vm-hands-entry-lite-z2np2gzv.js";import{Bh as q7}from"./vm-hands-entry-lite-anaydk9m.js";import{Gh as v0}from"./vm-hands-entry-lite-ffg7rf02.js";import{spawn as RJ,spawnSync as vK}from"child_process";import{closeSync as CJ,mkdirSync as gK,openSync as IJ,readdirSync as uK,realpathSync as V1,rmSync as z$}from"fs";import{hostname as dK}from"os";import{dirname as e3,join as F0,resolve as lK}from"path";var cJ=/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/;function H9($){let J=typeof $==="string"?cJ.exec($):null;return J?{major:Number(J[1]),minor:Number(J[2])}:null}import{createHash as eJ,randomBytes as L9}from"crypto";import{createInterface as $Z}from"readline";import{randomBytes as sJ}from"crypto";import{chmodSync as U9,existsSync as q9,lstatSync as aJ,mkdirSync as iJ,readFileSync as M9,renameSync as nJ,unlinkSync as T9,writeFileSync as _9}from"fs";import{homedir as rJ}from"os";import{dirname as tJ,join as N9}from"path";function Z1($=process.env,J=rJ()){let Z=$.XDG_CONFIG_HOME?.trim()||N9(J,".config"),X=P0({env:$})==="staging"?["staging"]:[];return N9(q2(Z,...X),"credentials.json")}function F9($,J=Z1()){return iJ(tJ(J),{recursive:!0,mode:448}),_9(J,`${JSON.stringify($,null,2)}
|
|
3
3
|
`,{mode:384}),U9(J,384),J}function P$($=Z1()){if(!q9($))return null;try{let J=M9($,"utf8"),Z=JSON.parse(J);if(typeof Z.apiOrigin!=="string"||typeof Z.clientId!=="string"||typeof Z.accessToken!=="string"||typeof Z.refreshToken!=="string"||typeof Z.expiresAt!=="string"||typeof Z.orgId!=="string"||!Array.isArray(Z.scopes))return null;let Q=new URL(Z.apiOrigin).origin,X=J1(Q);if(X!==Q)oJ($,J,X);return{apiOrigin:X,clientId:Z.clientId,accessToken:Z.accessToken,refreshToken:Z.refreshToken,expiresAt:Z.expiresAt,scopes:Z.scopes.filter((Y)=>typeof Y==="string"),orgId:Z.orgId}}catch{return null}}function oJ($,J,Z){let Q=`${$}.${process.pid}.${sJ(6).toString("hex")}.tmp`;try{let X=aJ($);if(!X.isFile()||X.uid!==process.geteuid?.())return;let Y=JSON.parse(J);if(_9(Q,`${JSON.stringify({...Y,apiOrigin:Z},null,2)}
|
|
4
4
|
`,{mode:384,flag:"wx"}),U9(Q,384),M9($,"utf8")!==J)throw Error("credentials_changed");nJ(Q,$)}catch{try{T9(Q)}catch{}}}function W9($=Z1()){if(!q9($))return!1;return T9($),!0}class x$ extends Error{oauthCode;constructor($,J=null){super($);this.oauthCode=J;this.name="LoginError"}}function j9(){let $=L9(48).toString("base64url"),J=eJ("sha256").update($).digest("base64url");return{verifier:$,challenge:J,state:L9(32).toString("base64url")}}function JZ($,J){let Z=typeof $.error==="string"?$.error:null,Q=typeof $.error_description==="string"?$.error_description:Z?Z:J;return new x$(Q,Z)}async function ZZ($,J,Z,Q){let X=await Z(`${$}/mcp/oauth/token`,{method:"POST",redirect:"error",headers:{"content-type":"application/x-www-form-urlencoded"},body:J,signal:Q}),Y=await X.json().catch(()=>({}));if(!X.ok)throw JZ(Y,`OAuth token request failed (${X.status})`);return Y}var QZ=1e4;async function XZ($,J={}){let Z=J.fetchImpl??fetch,Q=await ZZ($.apiOrigin,new URLSearchParams({grant_type:"refresh_token",client_id:$.clientId,refresh_token:$.refreshToken}),Z,AbortSignal.timeout(QZ)).catch((Y)=>{if(Y instanceof Error&&Y.name==="TimeoutError")throw new x$("Reason did not answer the login refresh in time. Check the network and retry.");throw Y});if(typeof Q.access_token!=="string"||typeof Q.refresh_token!=="string"||typeof Q.expires_in!=="number")throw new x$("Reason returned an incomplete refreshed login.");let X={...$,accessToken:Q.access_token,refreshToken:Q.refresh_token,expiresAt:new Date(Date.now()+Q.expires_in*1000).toISOString(),scopes:typeof Q.scope==="string"?Q.scope.split(/\s+/).filter(Boolean):$.scopes};return F9(X,J.path??Z1()),X}var M2=new Map;function D9($,J){if(!J)return $;if(J.aborted)return Promise.reject(J.reason);return new Promise((Z,Q)=>{let X=()=>Q(J.reason);J.addEventListener("abort",X,{once:!0}),$.then(Z,Q).finally(()=>J.removeEventListener("abort",X))})}async function b1($={}){let J=$.path??Z1(),Z=P$(J);if(!Z)return null;let Q=$.apiOrigin??b0(process.env,"REASON_API_URL")?.trim();if(Q&&!z0(Z.apiOrigin,new URL(Q).origin))return null;let X=Date.parse(Z.expiresAt)<=Date.now()+60000;if(!$.forceRefresh&&!X)return Z;let Y=[J,Z.apiOrigin,Z.clientId,Z.refreshToken].join("\x00"),G=M2.get(Y);if(G)return D9(G,$.signal);let H;return H=XZ(Z,{fetchImpl:$.fetchImpl,path:J}).catch(async(K)=>{if(!(K instanceof x$)||K.oauthCode!=="invalid_grant"&&K.oauthCode!=="invalid_client")throw K;let N=P$(J),q=K.oauthCode==="invalid_client"?N?.clientId!==Z.clientId:N?.refreshToken!==Z.refreshToken;if(N&&q)return b1({fetchImpl:$.fetchImpl,path:J});return W9(J),null}).finally(()=>{if(M2.get(Y)===H)M2.delete(Y)}),M2.set(Y,H),D9(H,$.signal)}function z9($,J){return new Promise((Z)=>{let Q=$Z({input:$}),X=!1,Y=(H)=>{if(X)return;X=!0,J.removeEventListener("abort",G),Q.close(),$.pause(),Z(H)},G=()=>Y(null);J.addEventListener("abort",G,{once:!0}),Q.once("line",(H)=>Y(H)),Q.once("close",()=>Y(null))})}var YZ=B.object({label:B.string(),used_percent:B.number().min(0).max(100).nullable(),resets_at:B.string().nullable(),exhausted:B.boolean().nullable()}),GZ=B.object({groups:B.array(B.object({selectable:B.boolean().optional(),accounts:B.array(B.object({source_id:B.string().min(1),model_ids:B.array(B.string().min(1)).optional()}))}))});function BZ($){let J=GZ.safeParse($);if(!J.success)return;return J.data.groups.some((Z)=>Z.selectable!==!1&&Z.accounts.some((Q)=>Q.model_ids===void 0||Q.model_ids.length>0))}class G0 extends Error{status;code;suggestedModel;retryAfterMs;constructor($,J,Z,Q,X){super(Z);this.status=$;this.code=J;this.suggestedModel=Q;this.retryAfterMs=X;this.name="ApiError"}static rateLimitDelayMs($,J){if(!($ instanceof G0)||$.status!==429)return null;return Math.min(60000,Math.max(J,$.retryAfterMs??0))}}var KZ=["minimal","low","medium","high","xhigh","max"],VZ=B.object({id:B.string().min(1),kind:B.string(),name:B.string(),custom_name:B.string().nullish(),status:B.string(),online:B.boolean(),compatible:B.boolean().optional(),compatibility_reason:B.string().nullish(),folder_lane_of:B.string().nullish(),roots:B.array(B.object({id:B.string().min(1),label:B.string()}))}),HZ=B.object({devices:B.array(VZ),end_cursor:B.string().nullish(),has_next_page:B.boolean().optional()}),NZ=B.object({id:B.string().min(1),name:B.string()}),UZ=B.object({items:B.array(NZ)}),qZ=B.object({skill_id:B.string().min(1),name:B.string(),description:B.string().nullish(),activation_keywords:B.array(B.string()).default([]),is_enabled:B.boolean().default(!0)}),MZ=B.object({items:B.array(qZ).default([])}),TZ=B.enum(["linux","macos"]),O9=B.object({id:B.string().min(1),name:B.string().min(1),platform:TZ.nullable(),workers:B.object({total:B.number().int(),online:B.number().int(),busy:B.number().int(),idle:B.number().int()}),sessions:B.object({queued:B.number().int(),running:B.number().int()})}),_Z=B.object({machines:B.array(O9)}),FZ=B.object({machine:O9}),WZ=B.object({deleted:B.literal(!0),revoked_workers:B.number().int(),revoked_tokens:B.number().int()}),LZ=B.object({token:B.object({id:B.string().min(1),machine_id:B.string().min(1),token_prefix:B.string()}),secret:B.string().startsWith("rmt_")}),A9=B.looseObject({machine_id:B.string().min(1),machine_name:B.string().min(1)}),DZ=A9.extend({organization_id:B.string().min(1)}),SV=B.object({id:B.string().min(1),name:B.string().min(1),state:B.enum(["waiting","placed"]),queue_position:B.number().int().nullable()});var wV=B.union([B.object({kind:B.literal("cloud")}),B.object({kind:B.enum(["mac","headless"]),device_id:B.string().min(1),root_id:B.string().min(1)})]);function k1($,J,Z){let Q=$.safeParse(J);if(!Q.success)throw new G0(502,Z,"Reason returned an unexpected response.");return Q.data}var jZ=B.object({error:B.object({type:B.string(),message:B.string()})});function R9($,J,Z){let Q=jZ.safeParse(J),X=typeof J.error==="string"?J.error:Q.success?Q.data.error.type:`http_${$}`,Y=typeof J.detail==="string"?J.detail:typeof J.message==="string"?J.message:Q.success?Q.data.error.message:`Reason request failed (${$}${typeof J.error==="string"?` ${J.error}`:""})`,G=X==="github_connection_required"&&typeof J.connect_url==="string"&&/^https?:\/\//.test(J.connect_url)?` Connect it at ${J.connect_url}`:"",H=Z===null||Z.trim()===""?NaN:Number(Z);return new G0($,X,`${Y}${G}`,typeof J.suggested_model==="string"?J.suggested_model:void 0,Number.isFinite(H)&&H>=0?H*1000:void 0)}async function C9($){let J=await($.fetchImpl??fetch)(`${$.apiOrigin}/v3/machines/enrollment-tickets`,{method:"POST",headers:{authorization:`Bearer ${$.token}`,accept:"application/json","content-type":"application/json"},body:JSON.stringify($.body),signal:AbortSignal.timeout(30000),redirect:"error"}),Z=await J.json().catch(()=>({}));if(!J.ok)throw R9(J.status,Z,J.headers.get("retry-after"));return k1(DZ,Z,"invalid_machine_ticket")}class H1{options;credentials;constructor($,J={}){this.options=J;this.credentials=$}trackEvent($,J={}){}async request($,J={},Z=!1){let Q=this.options.fetchImpl??fetch,X=await Q(`${this.credentials.apiOrigin}/v3${$}`,{method:J.method??"GET",headers:{authorization:`Bearer ${this.credentials.accessToken}`,accept:"application/json","user-agent":"reason-cli","x-reason-agent":"Reason CLI",...J.body===void 0?{}:{"content-type":"application/json"},...J.headers},body:J.body===void 0?void 0:JSON.stringify(J.body),signal:J.signal,redirect:"error"}),Y=await X.json().catch(()=>({}));if(X.status===401&&!Z&&J.retryUnauthorized!==!1&&this.credentials.credentialKind!=="api_key"){let G=await b1({fetchImpl:Q,path:this.options.credentialsPath,forceRefresh:!0,signal:J.signal});if(G)return this.credentials=G,this.request($,J,!0)}if(!X.ok)throw R9(X.status,Y,X.headers.get("retry-after"));return Y}createHeadlessDeviceEnrollmentTicket($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollment-tickets`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}async enrollHeadlessDevice($){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/enrollments`,{method:"POST",body:$,signal:AbortSignal.timeout(30000),retryUnauthorized:!1})}catch(J){if(J instanceof G0&&(J.status===404||J.status===405||J.status===403&&J.code==="endpoint_not_available"))return null;throw J}}addDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots`,{method:"POST",body:J,signal:AbortSignal.timeout(30000)})}removeDeviceRoot($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices/${encodeURIComponent($)}/roots/${encodeURIComponent(J)}`,{method:"DELETE",signal:AbortSignal.timeout(30000)})}machinePath($,J=""){let Z=`/organizations/${encodeURIComponent(this.credentials.orgId)}/machines`;return $===void 0?Z:`${Z}/${encodeURIComponent($)}${J}`}async listMachines(){return k1(_Z,await this.request(this.machinePath()),"invalid_machine_list").machines}async createMachine($){let J=await this.request(this.machinePath(),{method:"POST",body:{name:$.name,...$.platform?{platform:$.platform}:{}}});return k1(FZ,J,"invalid_machine").machine}async deleteMachine($){let J=await this.request(this.machinePath($),{method:"DELETE"});return k1(WZ,J,"invalid_machine_deletion")}async createMachineToken($){let J=await this.request(this.machinePath($,"/tokens"),{method:"POST",body:{}});return k1(LZ,J,"invalid_machine_token")}async createMachineEnrollmentTicket($,J){let Z=await this.request(this.machinePath($,"/enrollment-tickets"),{method:"POST",body:J,signal:AbortSignal.timeout(30000),retryUnauthorized:!1});return k1(A9,Z,"invalid_machine_ticket")}self($){return this.request("/self",{signal:$})}claimExistingCliPairing($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/onboarding/import/pairing/claim-existing`,{method:"POST",body:{pairing_code:$}})}connectAnthropicProvider($,J,Z={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/provider-credentials/anthropic`,{method:"POST",retryUnauthorized:Z.retryUnauthorized,signal:Z.signal,body:{access_token:$.access,refresh_token:$.refresh,expires_at:new Date($.expires).toISOString(),...J?{account_key:J}:{}}})}async listRepositories(){return((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/repositories`)).items??[]).flatMap((J)=>{let Z=typeof J.full_name==="string"?J.full_name:typeof J.repo_full_name==="string"?J.repo_full_name:null;if(!Z)return[];return[{repo_id:typeof J.repo_id==="string"?J.repo_id:void 0,full_name:Z,provider:J.provider==="gitlab"?"gitlab":"github",default_branch:typeof J.default_branch==="string"?J.default_branch:null,private:typeof J.private==="boolean"?J.private:void 0}]})}async listProjects(){let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/projects`),J=UZ.safeParse($);if(!J.success)throw new G0(502,"invalid_project_list","Reason returned an unexpected project list.");return J.data.items}async listSkills(){try{let $=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/skills`);return k1(MZ,$,"invalid_skill_list").items}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async listDevices(){let $=[],J=null;for(let Z=0;Z<50;Z+=1){let Q=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/devices${J?`?after=${encodeURIComponent(J)}`:""}`),X=HZ.safeParse(Q);if(!X.success)throw new G0(502,"invalid_device_list","Reason returned an unexpected machine list.");if($.push(...X.data.devices),J=X.data.has_next_page?X.data.end_cursor??null:null,!J)break}return $}async listModels(){try{let J=((await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`)).models??[]).filter((Q)=>Q.hidden!==!0&&Q.available!==!1).map(({reasoning_efforts:Q,hidden:X,available:Y,...G})=>({...G,...Array.isArray(Q)?{reasoning_efforts:KZ.filter((H)=>Q.includes(H))}:{}})),Z=new Set(J.map((Q)=>Q.detail));return J.length>1&&Z.size===1?J.map(({detail:Q,...X})=>X):J}catch($){if($ instanceof G0&&($.status===403||$.status===404))return[];throw $}}async getAgentVersion($){try{let J=await this.request("/deployment",{signal:$,retryUnauthorized:!1});return H9(J.reason_version)?J.reason_version:null}catch{return null}}async getUsageQuota(){try{let $=YZ.safeParse(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/usage/quota`));if(!$.success)return null;let J;try{J=BZ(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/agent-auth/models`))}catch{}return{...$.data,own_inference:J}}catch($){if($ instanceof G0&&($.status===403||$.status===404))return null;throw $}}async listSessions($=50,J,Z={}){let Q=new URLSearchParams({first:String(Math.min(Math.max($,1),200)),status:Z.status??"active"});if(J)Q.set("project_id",J);if(Z.origin)Q.set("origin",Z.origin);return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions?${Q.toString()}`)).items??[]}getSession($){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}`)}async prestartSession($){let J=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/prestart`,{method:"POST",body:{client_session_id:$}});return J?.status==="starting"||J?.status==="ready"}async createSession($){let J=$.mode==="ephemeral"||$.workspaceOwnership==="externally-managed";if($.attachments?.length)await this.requireSessionAttachments();if(J||$.runtimeProfile){let X=await this.request("/deployment");if(J&&(!Array.isArray(X.session_modes)||!X.session_modes.includes($.mode??"standard")||!Array.isArray(X.workspace_ownerships)||!X.workspace_ownerships.includes($.workspaceOwnership??"managed")))throw Error("Deployment does not support the requested Session policy; refusing to create a Session.");if($.runtimeProfile&&(!Array.isArray(X.experimental_runtime_profiles)||!X.experimental_runtime_profiles.includes($.runtimeProfile)))throw Error("Deployment does not support the requested runtime profile; refusing to create a Session.")}let Z=await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions`,{method:"POST",body:{prompt:$.prompt,...$.attachments?.length?{attachments:$.attachments}:{},...$.mode?{mode:$.mode}:{},...$.workspaceOwnership?{workspace_ownership:$.workspaceOwnership}:{},...$.target?{target:$.target}:{},...$.repo?{repo:$.repo}:{},...$.provider?{provider:$.provider}:{},...$.model?{model:$.model}:{},...$.reasoningEffort?{reasoning_effort:$.reasoningEffort}:{},...$.runtimeProfile?{experimental_runtime_profile:$.runtimeProfile}:{},...$.ref?{ref:$.ref}:{},...$.completionMode?{completion_mode:$.completionMode}:{},...$.env&&Object.keys($.env).length>0?{env:$.env}:{},...$.clientSessionId?{client_session_id:$.clientSessionId}:{},idempotency_key:`cli-${crypto.randomUUID()}`}}),Q=await this.getSession(Z.session_id);if(J){let X=Q.session_policy,Y=["memoryRead","memoryWrite","skills","inheritedInstructions","integrations","secretInjection"];if(!X||X.version!==1||X.mode!==($.mode??"standard")||X.workspaceOwnership!==($.workspaceOwnership??"managed")||!X.components||Y.some((G)=>X.components[G]!==!0))throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested Session policy; cancellation requested.")}if($.runtimeProfile&&Q.experimental_runtime_profile!==$.runtimeProfile)throw await this.cancelSession(Z.session_id),Error("Server did not attest the requested runtime profile; cancellation requested.");return Q}async getEvents($,J=-1,Z={}){try{return await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/events?after_seq=${J}&limit=500${Z.waitMs?`&wait_ms=${Z.waitMs}`:""}`,Z.signal?{signal:Z.signal}:{})}catch(Q){if(!(Q instanceof G0)||Q.status!==403&&Q.status!==404)throw Q;return{session:await this.getSession($),items:[],next_seq:J}}}async getMessages($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages?first=500${J===void 0?"":`&after_seq=${J}`}`)}async getAttachments($){try{return(await this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/attachments`)).items??[]}catch(J){if(J instanceof G0&&(J.status===403||J.status===404))return[];throw J}}async requireSessionAttachments(){if((await this.request("/deployment")).session_attachments!==!0)throw Error("This server does not support Session image attachments yet. Update the server and retry; the image was not sent.")}async sendMessage($,J,Z={}){if(Z.attachments?.length)await this.requireSessionAttachments();return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/messages`,{method:"POST",body:{message:J,...Z.attachments?.length?{attachments:Z.attachments}:{},...Z.model?{model:Z.model}:{},...Z.reasoningEffort?{reasoning_effort:Z.reasoningEffort}:{},...Z.target?{target:Z.target}:{}}})}createSharedLink($,J){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/shared-links`,{method:"POST",body:{url:J.url,...J.label?{label:J.label}:{},...J.expiresInSeconds!==void 0?{expires_in_seconds:J.expiresInSeconds}:{}}})}cancelSession($,J={}){return this.request(`/organizations/${encodeURIComponent(this.credentials.orgId)}/sessions/${encodeURIComponent($)}/cancel`,{method:"POST",body:J.mode==="hard"?{mode:"hard"}:{}})}}function y1($,J){let Z=b0($,"REASON_API_URL")?.trim();if(!Z)return D4(J);let Q=new URL(Z);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(Q.hostname)))throw Error("REASON_API_URL must use HTTPS (HTTP is allowed only for loopback development).");return Q.origin}function zZ($){return b0($,"REASON_API_URL")?.trim()?y1($,"production"):void 0}function j4($){return b0($,"REASON_API_KEY")?.trim()||void 0}async function I9($,J){let Z=$.env??process.env,Q=j4(Z);if(!Q)return($.getCredentials??b1)({apiOrigin:zZ(Z),signal:J});let X=y1(Z,$.channel??P0({env:Z})),Y=await($.fetchImpl??fetch)(X+"/v3/self",{redirect:"error",headers:{authorization:"Bearer "+Q,accept:"application/json"},signal:J}),G=await Y.json().catch(()=>({})),H=t0(G)?G:{};if(!Y.ok){let N=typeof H.detail==="string"?H.detail:typeof H.message==="string"?H.message:"API key authentication failed ("+Y.status+")";throw new G0(Y.status,typeof H.error==="string"?H.error:"api_key_auth_failed",N)}if(typeof H.org_id!=="string"||!H.org_id)throw Error("The API key in the environment did not resolve to a Workspace.");let K=Array.isArray(H.scopes)?H.scopes.filter((N)=>typeof N==="string"):[];return{credentialKind:"api_key",apiOrigin:X,accessToken:Q,orgId:H.org_id,clientId:"api-key",refreshToken:"",expiresAt:"",scopes:K}}import{createHash as OZ}from"crypto";import{unlinkSync as AZ}from"fs";import{platform as RZ}from"os";import{join as CZ}from"path";var P9=B.discriminatedUnion("store",[B.strictObject({version:B.literal(1),store:B.literal("keychain")}),B.strictObject({version:B.literal(1),store:B.literal("file"),api_key:B.string().min(1).max(4096)})]),f1=($)=>CZ($,"api-key.json");function j1($){let J=OZ("sha256").update(`reason-connect-api-key
|
|
5
5
|
${$}`).digest("hex");return new o1(T2(),RZ(),J)}function z4($,J,Z=j1($)){try{Z.deleteBinding(),Z.createBinding(new TextEncoder().encode(J)),c(f1($),{version:1,store:"keychain"});return}catch(Q){if(!(Q instanceof X0))throw Q}c(f1($),{version:1,store:"file",api_key:J})}function p0($,J=j1($)){if(!u(f1($)))return null;let Z=P9.parse(JSON.parse(s(f1($))));if(Z.store==="file")return Z.api_key;try{let Q=J.loadBinding();return Q?new TextDecoder().decode(Q):null}catch(Q){if(!(Q instanceof X0))throw Q;throw Error("worker_api_key_unreadable")}}function x9($,J=j1($)){if(!u(f1($)))return;if(P9.parse(JSON.parse(s(f1($)))).store==="keychain")try{J.deleteBinding()}catch(Z){if(!(Z instanceof X0))throw Z}AZ(f1($))}async function O4($,J){let Z;try{Z=await I9({env:{REASON_API_KEY:J,REASON_API_URL:$.apiOrigin},fetchImpl:k0($.proxy)})}catch(Q){if(Q instanceof G0&&(Q.status===401||Q.status===403))throw Error("worker_api_key_rejected");throw Q}if(!Z)throw Error("worker_api_key_rejected");if(!Z.scopes.includes("devices:write"))throw Error("worker_api_key_devices_write_required");return Z}import{readdirSync as cZ,renameSync as sZ,rmSync as v1}from"fs";import{join as q0}from"path";import{createHash as IZ}from"crypto";import{realpathSync as PZ,statSync as xZ,unlinkSync as _2}from"fs";import{platform as EZ}from"os";import{join as y0}from"path";function d($){return{state:y0(g($),"device.json"),control:y0(g($),"control.json"),lock:y0(g($),"lifecycle.lock"),socket:y0(g($),"control.sock"),daemon:y0(g($),"daemon.json"),releaseCheck:y0(g($),"release-check.json"),updateDeferral:y0(g($),"update-deferral.json"),firstHeartbeat:y0(g($),"first-heartbeat.json")}}var SZ=B.object({version:B.literal(1),device_id:B.string().min(1).max(160),offer:B.unknown().optional(),enrollment_ms:B.number().int().nonnegative().max(e1).optional()});function S9($,J,Z){e(g($),!0),c(d($).firstHeartbeat,{version:1,device_id:J,...Z.offer?{offer:Z.offer}:{},...Z.enrollmentMs!==void 0?{enrollment_ms:Z.enrollmentMs}:{}})}function R4($,J){let Z=d($).firstHeartbeat;try{if(!u(Z))return null;let Q=SZ.safeParse(JSON.parse(s(Z)));if(_2(Z),!Q.success||Q.data.device_id!==J)return null;let X=F2(Q.data.offer);return{...X?{offer:X}:{},...Q.data.enrollment_ms!==void 0?{enrollmentMs:Q.data.enrollment_ms}:{}}}catch{return null}}function T0($,J=!1){e(g($),J);let Z=["local-device.key","local-device.binding","device.json"].filter((Q)=>{let X=y0(g($),Q);if(!u(X))return!1;return s(X),!0});return $.lifetime==="persistent"&&Z.join()==="device.json"?C4($):new A4(g($))}function W2($,J){T0($,!0),kZ($);let Z=J??C4($),Q=new A4(g($));try{Z.deleteBinding(),Z.deleteKey(),Z.createFreshPublicKey()}catch(X){if(X instanceof X0)return Q;throw X}return Q.deleteBinding(),Q.deleteKey(),Z}function C4($){return new o1(T2(),EZ(),wZ($))}function wZ($){let J=I4($);return IZ("sha256").update(`reason-worker
|
|
6
|
-
${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,directory:I4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function w9($){return u(y0(g($),w$))}var bZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function I4($){let J=y0(g($),w$);if(!u(J))return null;let Z=bZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function kZ($){let J=y0(g($),w$);if(!u(J))return;if(I4($))try{let Z=C4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof X0))throw Z}_2(J)}function N1($){let J=PZ($.workspaceRoot);if(J!==$.workspaceRoot||!xZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&E9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var b9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=d($).control;return u(J)?b9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(d($).control,b9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),w$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var yZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),P4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:yZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),fZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),x4=30000;class Q1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function hZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(x4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new Q1(X?.error==="device_revoked")}return Q.json()}async function E4($,J,Z,Q){u0();let X=P4.parse(JSON.parse(s(J)));return X1($,X,Z,Q)}async function X1($,J,Z,Q=(Y,G)=>hZ(Y,G,k0($.proxy)),X=performance.now()){let Y=y9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function k9($,J,Z,Q,X=performance.now()){let Y=y9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function y9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=fZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let V=F2(q.first_heartbeat);try{S9($,q.device_id,{...V?{offer:V}:{},enrollmentMs:Math.min(e1,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as mZ,randomUUID as vZ}from"crypto";import{unlinkSync as gZ}from"fs";import{join as uZ}from"path";var f9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),dZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function S4($){return dZ.parse($)}var lZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function z1($){return Z1(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function O1($,J=z1($)){if(!u(J))return null;let Z=lZ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,H)=>Q(G,{...H,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await b1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function h9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function m9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=A1($),H=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(H){let K=await k9($,G.direct(J.orgId),Q,(N,q)=>H({approval:G.request,code_verifier:q,registration:N}).catch((V)=>{throw pZ(V)}),Y);if(K)return K}return X1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function pZ($){if(!($ instanceof G0))return $;if($.status===409)return new Q1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new Q1(!1);return $}var b$=($)=>uZ(g($),"enrollment-install.json");function v9($){if(u(b$($)))gZ(b$($))}function A1($,{stored:J=!0}={}){u0();let Z=b$($),Q=J&&u(Z)?f9.parse(JSON.parse(s(Z))):{version:1,install_id:vZ(),fingerprint_key:mZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let H=($.folders??[]).map((V)=>{let U=m1([V],X,Y)[0];if(U.path!==V)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=j9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...H.map((V)=>V.path_fingerprint)].map((V)=>({path_fingerprint:V,permissions:X,execution_mode:$.executionMode}))},q=(V)=>({version:1,organization_id:V,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...H.length?{folders:H}:{}});return{request:N,saveInstall(V){e(g(V),!0),c(b$(V),Q)},complete(V,U){let M=S4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(V),enrollment_ticket:M.enrollment_ticket}},direct:q}}function g9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=f9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,l9=600000,p9=15000,u9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,U1=($)=>q0(g($),"workspaces"),c9="account.json",w4=($)=>u(q0($,c9));function h0($){let J;try{J=cZ(U1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=q0(U1($),Z),X=q0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:w4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(U1($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,c9),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var b4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function d9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of b4)v1(q0(g(J),Y),{force:!0});for(let Y of b4){let G=q0(g($),Y);if(u(G))sZ(G,q0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function k4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(f4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(V)=>Number(Date.parse(V.worker?.expiresAt??"")>X+60000),H=h0($).flatMap((V)=>{if(!V.account||!V.config)return[];try{if($0(V.config).revoked)return[];let U=t(V.config);return U&&U.orgId.toLowerCase()===V.organizationId&&(!Q||Y(U))?[{...V,config:V.config,state:U}]:[]}catch{return[]}}).sort((V,U)=>Number(U.organizationId===J)-Number(V.organizationId===J)||Y(U.state)-Y(V.state))[0];if(!H)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==H.organizationId){let V=j2($,N);d9($,V.config),c(V.configPath,V.config)}else if(u(g($))){try{if(u(d($).state))f0($)}catch{}for(let V of b4)v1(q0(g($),V),{force:!0})}k4($);let q=J0.parse({...H.config,stateDirectory:$.stateDirectory});return d9(H.config,q),c(q0($.stateDirectory,"worker.json"),q),v1(H.directory,{recursive:!0,force:!0}),q}var y4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==q0(U1($),Z))continue;let H=J0.parse({...G,stateDirectory:Q}),K=T0(H),N=h1(d(H).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(H)}},d(H).state,{proofStore:K});c(X,H)}catch{}}}},f4=($)=>q0(U1($),"listed.json");function s9($){try{let J=JSON.parse(s(f4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function a9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=s9($),G=Y&&!Y.listed?Y.reason:null,H=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&H.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...H].map(({organizationId:K,config:N,account:q})=>{let V=!1,U=null,M=!1;try{V=N?$0(N).revoked:!1,U=N&&!V?t(N):null,M=J&&!!U&&y$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:V?"removed":M?"connected":"not_running",blocked:!q&&!V&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function i9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,H=null,K=!1,N=s9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...C}=J,P=Z.roots.slice(1).map((R)=>R.path);return J0.parse({...C,...P.length?{folders:P}:{},stateDirectory:q0(U1(J),W)})},V=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let C=new AbortController,P=()=>C.abort();if(X.addEventListener("abort",P,{once:!0}),X.aborted)C.abort();let R={...W,controller:C,claims:0,done:Promise.resolve(),account:L};R.done=$.serve(W,C.signal,(I)=>{R.claims=I}).then(()=>{return},(I)=>{if(L&&I instanceof _0&&I.status===401&&u9.has(I.code)){if(I.code==="device_revoked")try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer
|
|
6
|
+
${J?.directory??g($)}`).digest("hex")}function S$($,J){c(y0(g($),w$),{version:1,directory:I4($)?.directory??g($),devicePublicKey:J})}var w$="keychain-scope.json";function w9($){return u(y0(g($),w$))}var bZ=B.strictObject({version:B.literal(1),directory:B.string().min(1),devicePublicKey:B.string().min(1)});function I4($){let J=y0(g($),w$);if(!u(J))return null;let Z=bZ.safeParse(JSON.parse(s(J))),Q=d($).state;if(!Z.success||!u(Q))return null;return JSON.parse(s(Q))?.devicePublicKey===Z.data.devicePublicKey?Z.data:null}function kZ($){let J=y0(g($),w$);if(!u(J))return;if(I4($))try{let Z=C4($);Z.deleteBinding(),Z.deleteKey()}catch(Z){if(!(Z instanceof X0))throw Z}_2(J)}function N1($){let J=PZ($.workspaceRoot);if(J!==$.workspaceRoot||!xZ(J).isDirectory()||!E$(J,$.stateDirectory))throw Error("worker_workspace_not_canonical_or_overlaps_state")}function t($){if(!u(g($)))return null;let J=h1(d($).state,{proofStore:T0($),repair:!1}),Z=J!==null&&E9($.apiOrigin,J.apiOrigin),Q=Z?[U0($),U0({...$,apiOrigin:J.apiOrigin})]:[U0($)];if(J&&(!Q.includes(J.worker?.configDigest??"")||J.worker.lifetime!==$.lifetime||J.apiOrigin!==$.apiOrigin&&!Z||J.roots.length>32||J.roots[0]?.path!==$.workspaceRoot||J.handsSlots!==$.slots))throw Error("worker_config_binding_mismatch");return J}var b9=B.strictObject({version:B.literal(1),drained:B.boolean(),revoked:B.boolean()});function $0($){let J=d($).control;return u(J)?b9.parse(JSON.parse(s(J))):{version:1,drained:!1,revoked:!1}}function x0($,J){c(d($).control,b9.parse(J))}function f0($){let J=T0($);J.deleteBinding(),J.deleteKey();let Z=y0(g($),w$);if(u(Z))_2(Z);let Q=d($).state;if(u(Q))_2(Q)}var yZ=B.strictObject({read:B.boolean(),write:B.boolean(),execute:B.boolean(),discover_environment:B.boolean(),expose_mcp:B.literal(!1)}),P4=B.strictObject({version:B.literal(1),organization_id:B.string().min(1).max(160),enrollment_ticket:B.string().min(1).max(4096),code_verifier:B.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),root_fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/),root:B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/),permissions:yZ,execution_mode:B.enum(["confined","host"]).default("confined")}),folders:B.array(B.strictObject({path_fingerprint:B.string().regex(/^[a-f0-9]{64}$/)})).min(1).max(31).optional()}),fZ=B.object({device_id:B.string().min(1).max(160),organization_id:B.string().min(1).max(160),auth_scheme:B.literal("p256"),protocol_version:B.literal(2),roots:B.array(B.object({id:B.string().min(1),label:B.string(),path_fingerprint:B.string()})).min(1).max(32),headless:B.object({lifecycle:B.enum(["persistent","ephemeral"]),expires_at:B.iso.datetime({offset:!0})}),first_heartbeat:B.unknown().optional()}),x4=30000;class Q1 extends Error{deviceRemoved;constructor($){super("worker_enrollment_rejected");this.deviceRemoved=$}}async function hZ($,J,Z=fetch){let Q=await Z(`${$}/app/local-runtime/enroll`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(J),redirect:"error",signal:AbortSignal.timeout(x4)});if(!Q.ok){let X=Q.status===409?await Q.json().catch(()=>null):null;throw new Q1(X?.error==="device_revoked")}return Q.json()}async function E4($,J,Z,Q){u0();let X=P4.parse(JSON.parse(s(J)));return X1($,X,Z,Q)}async function X1($,J,Z,Q=(Y,G)=>hZ(Y,G,k0($.proxy)),X=performance.now()){let Y=y9($,J,Z),G=await Q($.apiOrigin,{...Y.request,enrollment_ticket:J.enrollment_ticket,code_verifier:J.code_verifier});return Y.receipt(G,X)}async function k9($,J,Z,Q,X=performance.now()){let Y=y9($,J,Z),G=await Q(Y.request,J.code_verifier);return G===null?null:Y.receipt(G,X)}function y9($,J,Z){if(u0(),J.root.execution_mode!==$.executionMode)throw Error("worker_enrollment_mode_mismatch");let Q=m1([$.workspaceRoot],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(Q.path!==$.workspaceRoot||Q.pathFingerprint!==J.root.path_fingerprint)throw Error("worker_enrollment_root_mismatch");let X=($.folders??[]).map((K,N)=>{let q=m1([K],J.root.permissions,Buffer.from(J.root_fingerprint_key,"hex"))[0];if(q.path!==K||q.pathFingerprint!==J.folders?.[N]?.path_fingerprint)throw Error("worker_enrollment_root_mismatch");return q});if((J.folders?.length??0)!==X.length)throw Error("worker_enrollment_root_mismatch");let Y=[{...Q,label:"workspace"},...X],G;try{G=Z.loadPublicKey()}catch{G=Z.createFreshPublicKey()}return{request:{device_public_key:G,name:$.name,os:process.platform,architecture:process.arch,reason_runtime_version:r,bridge_version:r,protocol_version:2,capabilities:{supported_operations:[]},roots:Y.map((K)=>({label:K.label,path_fingerprint:K.pathFingerprint,permissions:J.root.permissions}))},receipt(K,N){let q=fZ.parse(K);if(q.organization_id!==J.organization_id||q.roots.length!==Y.length||q.roots.some((U,M)=>U.path_fingerprint!==Y[M].pathFingerprint)||q.headless.lifecycle!==$.lifetime||Date.parse(q.headless.expires_at)<=Date.now())throw Error("worker_enrollment_receipt_mismatch");let V=F2(q.first_heartbeat);try{S9($,q.device_id,{...V?{offer:V}:{},enrollmentMs:Math.min(e1,Math.max(0,Math.round(performance.now()-N)))})}catch{}return{version:4,apiOrigin:$.apiOrigin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:G,displayName:$.name,registeredAt:new Date().toISOString(),handsSlots:$.slots,worker:{configDigest:U0($),lifetime:$.lifetime,expiresAt:q.headless.expires_at},roots:q.roots.map((U,M)=>({id:U.id,label:U.label,path:Y[M].path,pathFingerprint:U.path_fingerprint,permissions:J.root.permissions}))}}}}import{randomBytes as mZ,randomUUID as vZ}from"crypto";import{unlinkSync as gZ}from"fs";import{join as uZ}from"path";var f9=B.strictObject({version:B.literal(1),install_id:B.uuid(),fingerprint_key:B.string().regex(/^[a-f0-9]{64}$/)}),dZ=B.object({enrollment_ticket:B.string().min(1).max(4096),expires_at:B.iso.datetime({offset:!0}),device_kind:B.literal("headless"),lifecycle:B.enum(["persistent","ephemeral"]),device_expires_at:B.iso.datetime({offset:!0})});function S4($){return dZ.parse($)}var lZ=B.object({credentialKind:B.enum(["oauth","api_key"]).optional(),apiOrigin:B.url(),clientId:B.string(),accessToken:B.string().min(1).max(32768),refreshToken:B.string().max(32768),expiresAt:B.iso.datetime({offset:!0}),scopes:B.array(B.string().max(128)).max(128),orgId:B.string().min(1).max(160)});function z1($){return Z1(k$("REASON_CLI_CHANNEL",$.channel),V0())}async function O1($,J=z1($)){if(!u(J))return null;let Z=lZ.parse(JSON.parse(s(J)));if(!z0(Z.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(Z.credentialKind==="api_key")return Date.parse(Z.expiresAt)>Date.now()?Z:null;let Q=k0($.proxy),X=Object.assign((G,H)=>Q(G,{...H,redirect:"error",signal:AbortSignal.timeout(30000)}),{preconnect:fetch.preconnect}),Y=await b1({path:J,fetchImpl:X});if(Y&&!z0(Y.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");return Y}async function h9($,J,Z){if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let Q=A1($);return Q.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(Q.request))}async function m9($,J,Z,Q,X){let Y=performance.now();if(!z0(J.apiOrigin,$.apiOrigin))throw Error("worker_session_origin_mismatch");if(!J.scopes.includes("devices:write"))throw Error("worker_devices_write_scope_required");let G=A1($),H=X?void 0:Z.enrollHeadlessDevice?.bind(Z);if(H){let K=await k9($,G.direct(J.orgId),Q,(N,q)=>H({approval:G.request,code_verifier:q,registration:N}).catch((V)=>{throw pZ(V)}),Y);if(K)return K}return X1($,G.complete(J.orgId,await Z.createHeadlessDeviceEnrollmentTicket(G.request)),Q,X,Y)}function pZ($){if(!($ instanceof G0))return $;if($.status===409)return new Q1($.code==="device_revoked");if($.status===410||$.status===401&&$.code==="invalid_enrollment_ticket"||$.status===403&&$.code==="grant_exceeded"||$.status===400&&$.code==="invalid_device_enrollment")return new Q1(!1);return $}var b$=($)=>uZ(g($),"enrollment-install.json");function v9($){if(u(b$($)))gZ(b$($))}function A1($,{stored:J=!0}={}){u0();let Z=b$($),Q=J&&u(Z)?f9.parse(JSON.parse(s(Z))):{version:1,install_id:vZ(),fingerprint_key:mZ(32).toString("hex")};if(J&&!u(Z))c(Z,Q);let X={read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1},Y=Buffer.from(Q.fingerprint_key,"hex"),G=m1([$.workspaceRoot],X,Y)[0];if(G.path!==$.workspaceRoot)throw Error("worker_workspace_not_canonical_or_overlaps_state");let H=($.folders??[]).map((V)=>{let U=m1([V],X,Y)[0];if(U.path!==V)throw Error("worker_workspace_not_canonical_or_overlaps_state");return{path_fingerprint:U.pathFingerprint}}),K=j9(),N={install_id:Q.install_id,code_challenge:K.challenge,lifecycle:$.lifetime,roots:[G.pathFingerprint,...H.map((V)=>V.path_fingerprint)].map((V)=>({path_fingerprint:V,permissions:X,execution_mode:$.executionMode}))},q=(V)=>({version:1,organization_id:V,code_verifier:K.verifier,root_fingerprint_key:Q.fingerprint_key,root:{path_fingerprint:G.pathFingerprint,permissions:X,execution_mode:$.executionMode},...H.length?{folders:H}:{}});return{request:N,saveInstall(V){e(g(V),!0),c(b$(V),Q)},complete(V,U){let M=S4(U);if(M.lifecycle!==$.lifetime||Date.parse(M.expires_at)<=Date.now()||Date.parse(M.device_expires_at)<=Date.now())throw Error("worker_ticket_receipt_mismatch");return{...q(V),enrollment_ticket:M.enrollment_ticket}},direct:q}}function g9($,J,Z){let Q=b$($);if(!u(Q))throw Error("worker_folders_unavailable");let X=f9.parse(JSON.parse(s(Q)));return m1([J],Z,Buffer.from(X.fingerprint_key,"hex"))[0]}var L2=8,l9=600000,p9=15000,u9=new Set(["device_revoked","invalid_device_credential"]),D2=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,U1=($)=>q0(g($),"workspaces"),c9="account.json",w4=($)=>u(q0($,c9));function h0($){let J;try{J=cZ(U1($))}catch{return[]}return J.filter((Z)=>D2.test(Z)).sort().map((Z)=>{let Q=q0(U1($),Z),X=q0(Q,"worker.json"),Y=null;try{let G=J0.safeParse(JSON.parse(s(X)));if(G.success&&G.data.stateDirectory===Q)Y=G.data}catch{}return{organizationId:Z,directory:Q,configPath:X,config:Y,account:w4(Q)}})}function j2($,J){let Z=J.toLowerCase();if(!D2.test(Z))throw Error("worker_workspace_id_invalid");let Q=J0.parse({...$,stateDirectory:q0(U1($),Z)});return e(Q.stateDirectory,!0),c(q0(Q.stateDirectory,c9),{version:1}),{config:Q,configPath:q0(Q.stateDirectory,"worker.json")}}function z2($,J){try{let{config:Z,configPath:Q}=j2($,J);e(g(Z),!0),x0(Z,{version:1,drained:!0,revoked:!0}),c(Q,Z)}catch{}}function f$($,J){let Z=J.toLowerCase(),Q=null;try{Q=t($)?.orgId.toLowerCase()??null}catch{}return Q===Z||h0($).some((X)=>!X.account&&X.config!==null&&X.organizationId===Z)}var b4=["device.json","local-device.key","local-device.binding","keychain-scope.json","control.json","enrollment-install.json","first-heartbeat.json"];function d9($,J){let Z=t($);if(!Z?.worker)throw Error("worker_identity_missing");S$($,Z.devicePublicKey),e(g(J),!0);for(let Y of b4)v1(q0(g(J),Y),{force:!0});for(let Y of b4){let G=q0(g($),Y);if(u(G))sZ(G,q0(g(J),Y))}let Q=T0(J),X=h1(d(J).state,{proofStore:Q,repair:!1});if(!X?.worker)throw Error("worker_identity_missing");m0({...X,worker:{...X.worker,configDigest:U0(J)}},d(J).state,{proofStore:Q})}function k4($){for(let J of h0($)){if(J.account)continue;try{if(J.config&&u(d(J.config).state))f0(J.config)}catch{}v1(J.directory,{recursive:!0,force:!0})}v1(f4($),{force:!0})}function O2($,{prefer:J,keep:Z,live:Q=!1}){let X=Date.now(),Y=(V)=>Number(Date.parse(V.worker?.expiresAt??"")>X+60000),H=h0($).flatMap((V)=>{if(!V.account||!V.config)return[];try{if($0(V.config).revoked)return[];let U=t(V.config);return U&&U.orgId.toLowerCase()===V.organizationId&&(!Q||Y(U))?[{...V,config:V.config,state:U}]:[]}catch{return[]}}).sort((V,U)=>Number(U.organizationId===J)-Number(V.organizationId===J)||Y(U.state)-Y(V.state))[0];if(!H)return null;let K=null;try{K=$0($).revoked?null:t($)}catch{}let N=K?.orgId.toLowerCase()??"";if(Z&&K&&D2.test(N)&&N!==H.organizationId){let V=j2($,N);d9($,V.config),c(V.configPath,V.config)}else if(u(g($))){try{if(u(d($).state))f0($)}catch{}for(let V of b4)v1(q0(g($),V),{force:!0})}k4($);let q=J0.parse({...H.config,stateDirectory:$.stateDirectory});return d9(H.config,q),c(q0($.stateDirectory,"worker.json"),q),v1(H.directory,{recursive:!0,force:!0}),q}var y4={before($){for(let{config:J}of h0($))try{let Z=J?t(J):null;if(J&&Z)S$(J,Z.devicePublicKey)}catch{}},after($,J){for(let{organizationId:Z,directory:Q,configPath:X,config:Y}of h0(J)){if(Y)continue;try{let G=J0.parse(JSON.parse(s(X)));if(G.stateDirectory!==q0(U1($),Z))continue;let H=J0.parse({...G,stateDirectory:Q}),K=T0(H),N=h1(d(H).state,{proofStore:K,repair:!1});if(N?.worker?.configDigest===U0(G))m0({...N,worker:{...N.worker,configDigest:U0(H)}},d(H).state,{proofStore:K});c(X,H)}catch{}}}},f4=($)=>q0(U1($),"listed.json");function s9($){try{let J=JSON.parse(s(f4($))),Z=J.names&&typeof J.names==="object"&&!Array.isArray(J.names)?Object.fromEntries(Object.entries(J.names).filter((Q)=>typeof Q[1]==="string")):{};return{listed:J.listed===!0,reason:J.reason==="sign_in"?"sign_in":null,blocked:Array.isArray(J.blocked)?J.blocked.filter((Q)=>typeof Q==="string"):[],names:Z}}catch{return null}}function a9($,J){let Z=h0($),Q=Z.filter((K)=>K.account),X=Z.filter((K)=>!K.account),Y=s9($),G=Y&&!Y.listed?Y.reason:null,H=G||X.length===0&&Y&&!Y.listed?[]:X;if(Q.length===0&&H.length===0&&(G||Y&&!Y.listed))return{workspaces:null,off:G};return{off:G,workspaces:[...Q,...H].map(({organizationId:K,config:N,account:q})=>{let V=!1,U=null,M=!1;try{V=N?$0(N).revoked:!1,U=N&&!V?t(N):null,M=J&&!!U&&y$(d(N).daemon)?.state==="connected"}catch{}return{organization_id:K,device_id:U?.deviceId??null,name:Y?.names?.[K]??null,root:U?.roots[0]?{id:U.roots[0].id,permissions:U.roots[0].permissions}:null,state:V?"removed":M?"connected":"not_running",blocked:!q&&!V&&!M&&(Y?.blocked.includes(K)??!1),...q?{account:!0}:{}}})}}function i9($){let{config:J,state:Z,client:Q,signal:X}=$,Y=$.log??(()=>{return}),G=new Map,H=null,K=!1,N=s9(J)??{listed:!1,reason:null,blocked:[]},q=(W)=>{let{folders:L,...C}=J,P=Z.roots.slice(1).map((R)=>R.path);return J0.parse({...C,...P.length?{folders:P}:{},stateDirectory:q0(U1(J),W)})},V=async(W)=>{let L=G.get(W);if(!L)return;L.controller.abort(),await L.done},U=(W,L=!1)=>{let C=new AbortController,P=()=>C.abort();if(X.addEventListener("abort",P,{once:!0}),X.aborted)C.abort();let R={...W,controller:C,claims:0,done:Promise.resolve(),account:L};R.done=$.serve(W,C.signal,(I)=>{R.claims=I}).then(()=>{return},(I)=>{if(L&&I instanceof _0&&I.status===401&&u9.has(I.code)){try{x0(W.config,{version:1,drained:!0,revoked:!0})}catch{}Y(`Reason worker: workspace ${W.organizationId} (another account's) no longer accepts this computer (${I.code}); run \`reason connect\` signed in as that account to connect it again
|
|
7
7
|
`)}else if(I instanceof _0&&I.status===401&&u9.has(I.code)){try{f0(W.config)}catch{}Y(`Reason worker: workspace ${W.organizationId} no longer accepts this computer
|
|
8
8
|
`)}else if(!C.signal.aborted)Y(`Reason worker: workspace ${W.organizationId} stopped (worker_workspace_failed); it starts again on the next check
|
|
9
9
|
`)}).finally(()=>{if(C.abort(),X.removeEventListener("abort",P),R.claims=0,G.get(W.organizationId)===R)G.delete(W.organizationId);let I=W.config.stateDirectory;if(L&&!w4(I)&&!u(q0(I,"worker.json")))v1(I,{recursive:!0,force:!0})}),G.set(W.organizationId,R)},M=(W,L)=>{if(!L)return null;try{let C=q(W),P=t(L);if(!P||P.orgId!==W||Date.parse(P.worker?.expiresAt??"")<=Date.now()+60000||L.name!==C.name||L.executionMode!==C.executionMode||!z0(L.apiOrigin,C.apiOrigin)||P.roots.map((R)=>R.path).join(`
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Mg as wz,Ng as Nz}from"./vm-hands-entry-lite-s2xydt0n.js";import{Xg as N}from"./vm-hands-entry-lite-9pmag2qk.js";import{uh as A}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Mg as wz,Ng as Nz}from"./vm-hands-entry-lite-s2xydt0n.js";import{Xg as N}from"./vm-hands-entry-lite-9pmag2qk.js";import{uh as A}from"./vm-hands-entry-lite-z2np2gzv.js";import{Kh as Fz}from"./vm-hands-entry-lite-7gh1rbn7.js";import{spawnSync as iz}from"child_process";import{dirname as g}from"path";import{spawn as cz}from"child_process";import{accessSync as lz,constants as sz}from"fs";import{basename as nz,join as pz}from"path";import{randomUUID as p}from"crypto";import{spawnSync as M}from"child_process";import{chmodSync as Hz,cpSync as Rz,existsSync as U,lstatSync as O,mkdirSync as i,readdirSync as Cz,readFileSync as E,readlinkSync as Lz,realpathSync as T,renameSync as R,rmdirSync as Mz,rmSync as P,symlinkSync as c,writeFileSync as Oz}from"fs";import{dirname as C,join as D,relative as Uz,resolve as Tz}from"path";var a="so.ara.cli",_z="5LJFSBRY2F";var o="ReasonBackgroundIdentity",r="Contents/Helpers/ReasonPermissionTile";var x="AraBackgroundIdentity",Az="Reason",Iz=`anchor apple generic and identifier "${a}" and certificate leaf[subject.OU] = "${_z}"`;class L extends Error{code;constructor(z,J){super(J);this.code=z;this.name="MacOSBackgroundIdentityError"}}var k="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";function v(z=N()){return D(z,"Library","Application Support","Reason","Background","Reason.app")}function _(z=N()){return D(z,"Library","Application Support","Ara","Background","Ara.app")}function kz(z){try{return O(z).isFile()}catch{return!1}}function y(z){return[o,x].map((J)=>D(z,"Contents","MacOS",J)).find(kz)??null}function w(z){try{if(!O(z).isDirectory())return!1;let J=E(D(z,"Contents","Info.plist"),"utf8");return J.includes(`<string>${a}</string>`)&&(J.includes(`<string>${Az}</string>`)||J.includes("<string>Ara</string>"))&&y(z)!==null}catch{return!1}}function I(z=N()){let J=v(z);if(!w(J))return null;try{let Z=E(D(J,"Contents","Info.plist"),"utf8");return/<key>CFBundleVersion<\/key>\s*<string>(\d+\.\d+\.\d+)<\/string>/.exec(Z)?.[1]??null}catch{return null}}function Sz(z,J=N()){let Z=I(J);return Z===null||$z(S(Z.split(".")),S(z.split(/[.-]/).slice(0,3)))}var fz=1e4;function t(z,J){return M(z,[...J],{stdio:"ignore",timeout:fz}).status??1}var e=new Set;function zz(z){if(process.env.REASON_TEST_REFUSE_REAL_IDENTITY!=="1")return;let J=(Z)=>{try{return T(Z)}catch{return Tz(Z)}};if(z!==void 0&&J(z)!==J(N()))return;throw Error("A test tried to change this computer's real Reason background identity; pass a temporary home. Refused by scripts/test-env.ts.")}var Jz=/\/(?:runtime|CLI)\/versions\/(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$|\/\.ara(?:-staging)?-worker-(\d+)\.(\d+)\.(\d+)[^/]*\/[^/]+$/,Zz=new Set(["ara","ara.exe","reason","reason.exe"]);function S(z){return z.map((J)=>Number(J))}function $z(z,J){for(let Z=0;Z<3;Z+=1)if(z[Z]!==J[Z])return z[Z]<J[Z];return!1}var Ez=[0,2,161];function xz(z){if(z===null)return!0;let J=Ez,Z=null;try{Z=T(process.execPath)}catch{}return z.some(($)=>{let j=Jz.exec($);if(j){let Q=j[1]===void 0?j.slice(4,7):j.slice(1,4);return $z(S(Q),J)}let q=$.slice($.lastIndexOf("/")+1);return Zz.has(q)&&$!==Z&&$!==process.execPath})}function yz(){let z=M("/bin/ps",["-xo","pid=,comm="],{encoding:"utf8",timeout:5000});if(z.status!==0)return null;let J=[];for(let Z of z.stdout.split(`
|
|
3
3
|
`)){let $=/^\s*(\d+)\s+(\S.*)$/.exec(Z);if(!$||Number($[1])===process.pid)continue;let j=$[2].trimEnd(),q=j.slice(j.lastIndexOf("/")+1);if(!Jz.test(j)&&Zz.has(q)){let V=M("/usr/sbin/lsof",["-a","-p",$[1],"-d","txt","-Fn"],{encoding:"utf8",timeout:5000}).stdout?.split(`
|
|
4
4
|
`).find((X)=>X.startsWith("n/"));if(V)j=V.slice(1)}J.push(j)}return J}function bz(z){if(zz(z.home),!w(z.sourceApp))throw new L("identity_invalid","The packaged Reason background identity is missing or invalid.");let J=z.command??t,Z=v(z.home),$=C(Z);i($,{recursive:!0,mode:448}),Hz($,448);let j=T(z.sourceApp),q=null;try{q=T(Z)}catch{}if(j!==q){let Q=`${process.pid}.${p()}`,V=D($,`.Reason.app.${Q}.tmp`),X=D($,`.Reason.app.${Q}.old`),W=!1;try{if(Rz(j,V,{recursive:!0,errorOnExist:!0,preserveTimestamps:!0}),!w(V))throw new L("identity_invalid","The copied Reason background identity is invalid.");let Y=z.releaseSigned?["--test-requirement",`=${Iz}`]:[];if(J("/usr/bin/codesign",["--verify","--strict",...Y,V])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");let B=!1;for(let F=0;F<4;F+=1){let G=!1;try{R(Z,X),G=!0,W=!0}catch(K){if(K.code!=="ENOENT")throw K}if(F===0)z.beforePublish?.();try{R(V,Z),B=!0}catch(K){let m=K.code;if(!["EEXIST","ENOTEMPTY"].includes(m??""))throw K;if(G)P(X,{recursive:!0,force:!0}),W=!1;if(F===3)throw K;continue}if(G)P(X,{recursive:!0,force:!0}),W=!1;break}if(!B)throw Error("Could not publish Reason's background identity.")}catch(Y){if(W&&!U(Z)&&U(X))R(X,Z);throw Y}finally{P(V,{recursive:!0,force:!0}),P(X,{recursive:!0,force:!0})}}return Wz(Z,z,{verified:j!==q}),Z}function jz(z){return D(C(z),".Reason.app.registered")}function qz(z){try{let J=O(z);return J.isDirectory()?`${J.ino}:${J.birthtimeMs}`:null}catch{return null}}function f(z){let J=qz(z);try{return J!==null&&E(jz(z),"utf8")===J}catch{return!1}}function Qz(z){if(w(z))return"bundle";try{if(O(D(z,"Contents","Info.plist"),{throwIfNoEntry:!1}))return null;return O(D(z,"Contents","MacOS",x)).isSymbolicLink()?"retired":null}catch{return null}}function Wz(z,J,Z={}){let $=J.command??t;if(!Z.verified&&$("/usr/bin/codesign",["--verify","--strict",z])!==0)throw new L("identity_invalid_signature","The installed Reason background identity has an invalid signature.");if($(k,["-f",z])!==0)throw new L("identity_register_failed","Could not register Reason's macOS background identity.");let j=qz(z);try{if(j)Oz(jz(z),j,{mode:384})}catch{}try{gz(z,J.home,$,J.runningExecutables??yz)}catch(q){let Q=q.code??"unknown";process.stderr.write(`Reason background identity: legacy_identity_retire_failed (${Q})
|
|
5
5
|
`)}}function gz(z,J,Z,$){let j=y(z);if(!j)return;let q=_(J),Q=C(q),V=(K)=>D(K,"Contents","MacOS",x),X=Uz(C(V(q)),j),W=`${process.pid}.${p()}`,Y=Qz(q);if(Y===null)return;let B=Y==="bundle";if(B)Z(k,["-u",q]);let F=D(Q,`.Ara.app.${W}.old`);if(!e.has(q)&&!xz($())){if(!B)Z(k,["-u",q]);try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}P(F,{recursive:!0,force:!0}),uz(Q);return}if(!B){if(Lz(V(q))===X)return;let K=`${V(q)}.${W}`;c(X,K);try{R(K,V(q))}finally{P(K,{force:!0})}return}let G=D(Q,`.Ara.app.${W}.shim`);i(C(V(G)),{recursive:!0}),c(X,V(G));try{try{R(q,F)}catch(K){if(K.code==="ENOENT")return;throw K}try{R(G,q)}catch(K){if(U(q))return;throw R(F,q),K}}finally{P(G,{recursive:!0,force:!0}),P(F,{recursive:!0,force:!0})}}function uz(z){try{if(Cz(z).some((Z)=>Z!==".DS_Store"))return;P(D(z,".DS_Store"),{force:!0}),Mz(z)}catch{}}var l=new Map;function hz(z=N()){let J=l.get(z);if(J)return J;if(process.platform!=="darwin")return[];let Z=s(z);if(Z===null&&U(C(v(z))))Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,100),Z=s(z);if(Z===null)return[];return l.set(z,Z),Z}function s(z){let J=v(z),Z=_(z);if(!w(J)||!f(J))try{dz({home:z,skipWhenSettled:!0})}catch{}let $=w(J)&&(f(J)||!w(Z))?J:w(Z)?Z:null,j=$?y($):null;if(!j)return null;if($===Z)e.add(Z);let q=M(j,["--can-spawn"],{env:{},timeout:2000,encoding:"utf8"});return q.status===0&&q.stdout===`spawn
|
|
@@ -20,7 +20,7 @@ The macOS privacy permissions of this computer's Reason worker:
|
|
|
20
20
|
allow asks for each missing one, or the one named. macOS cannot ask for Full
|
|
21
21
|
Disk Access: allow disk opens its pane, shows the file to add in Finder and
|
|
22
22
|
waits until the worker has it.
|
|
23
|
-
`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-
|
|
23
|
+
`,u="x-apple.systempreferences:com.apple.preference.security",az="curl -fsSL https://reasonmachines.com/install.sh | bash",oz=180000,rz=2000,h=["screen","accessibility","disk"],d={screen:{label:"Screen & System Audio Recording",purpose:"desktop video, computer-use screenshots",level:"required",pane:`${u}?Privacy_ScreenCapture`},accessibility:{label:"Accessibility",purpose:"computer-use clicks and typing, desktop input",level:"required",pane:`${u}?Privacy_Accessibility`},disk:{label:"Full Disk Access",purpose:"Sessions in Desktop, Documents, Downloads, iCloud Drive and Mail",level:"recommended",pane:`${u}?Privacy_AllFiles`}};function Bz(z){return z.executable}function tz(z,J){if(z==="computer_use_identity_missing")return`Reason's background identity is not installed (${z}); reinstall Reason: ${az}`;if(z==="computer_use_identity_outdated")return`Reason's background identity is outdated (${I(J)??"unknown"}; this CLI is ${A}) (${z}); \`reason update\` installs this release's`;return`Reason's background identity cannot run computer use for this CLI (${z}); run the installed \`reason\``}function ez(z=N()){let J=b(z);if(J.length>0)return{state:"ready",path:g(g(g(J[0]))),prefix:J};let Z=Kz(J,z)??"computer_use_identity_unavailable";return{state:Z,path:v(z),detail:tz(Z,z)}}function Pz(){return{identity:()=>ez(),grants:(z)=>wz(z),request:(z,J)=>Nz(z,J),worker:async()=>(await import("./status-sj500a30.js")).connectionMacState(),open:(z)=>{iz("/usr/bin/open",z,{stdio:"ignore",timeout:1e4})},tile:Xz,restartConnection:async()=>(await import("./connect-cli-26easn4y.js")).restartConnection(),sleep:(z)=>new Promise((J)=>setTimeout(J,z)),now:()=>Date.now()}}function Yz(z,J,Z){if(z.state!=="ready"||!J)return"unknown";return J[Z]?"granted":"missing"}async function vz(z){let J=z.identity(),Z=J.state==="ready"?await z.grants(J.prefix):null,$=await z.worker(),j=$?Bz($):null,q=!j||$?.full_disk_access==="unknown"?"unknown":$?.full_disk_access==="granted"?"granted":"missing",Q=(V,X,W)=>{let{label:Y,purpose:B,level:F}=d[V];return{id:V,label:Y,purpose:B,level:F,state:X,holder:W}};return{identity:{state:J.state,path:J.path,detail:J.state==="ready"?null:J.detail},worker_detail:j?null:"Full Disk Access is read from this computer's running worker; `reason connect` starts it.",permissions:[Q("screen",Yz(J,Z,"screen"),J.path),Q("accessibility",Yz(J,Z,"accessibility"),J.path),Q("disk",q,j)]}}function MJ(z){let J=z.identity.state==="ready"?null:z.identity.state,Z=z.permissions.filter((q)=>q.state==="granted").length,$=[...J?[J]:[],...z.permissions.filter((q)=>q.state!=="granted"&&!(J&&q.id!=="disk")).map((q)=>`${q.label} ${q.state}`)],j=!J&&z.permissions.some((q)=>q.state==="missing");return`Permissions: ${Z} of ${z.permissions.length}${$.length>0?` (${$.join(", ")})`:""}`+(j?" \u2014 reason permissions allow":$.length>0?" \u2014 reason permissions":"")}function zJ(z){let J=[];if(z.identity.detail)J.push(z.identity.detail);J.push(`Reason: ${z.identity.path}`);let Z=z.permissions.find(($)=>$.id==="disk");J.push(Z?.holder?`Worker: ${Z.holder}`:`Worker: ${z.worker_detail}`),J.push("");for(let $ of z.permissions){let j=`${$.label}${$.level==="recommended"?" (recommended)":""}`;J.push(` ${$.id.padEnd(13)} ${$.state.padEnd(7)} ${j}: ${$.purpose}`)}if(z.permissions.some(($)=>$.state==="missing"))J.push("","Allow the missing ones: reason permissions allow");return`${J.join(`
|
|
24
24
|
`)}
|
|
25
25
|
`}async function Gz(z,J){let Z=J.now()+oz;for(;;){if(await z())return!0;if(J.now()>=Z)return!1;await J.sleep(rz)}}async function JJ(z,J){let Z=J.host??Pz(),{io:$}=J,j=await vz(Z),q=j.permissions.filter((W)=>z.includes(W.id)&&W.state!=="granted");if(q.length===0)return $.stdout.write(`Reason permissions: ${z.map((W)=>d[W].label).join(", ")} already allowed.
|
|
26
26
|
`),0;let Q=!1,V=!1,X=Z.identity();for(let W of q){let{label:Y,pane:B}=d[W.id];if(W.id!=="disk"){if(X.state!=="ready"){if(!Q)$.stderr.write(`Reason permissions: ${X.detail}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Dd as me}from"./vm-hands-entry-lite-gqncr2j0.js";import{ee as X,fe as ee,he as lt,ie as pe,le as xt,me as bt,ne as $,we as L,xe as Ge}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Dd as me}from"./vm-hands-entry-lite-gqncr2j0.js";import{ee as X,fe as ee,he as lt,ie as pe,le as xt,me as bt,ne as $,we as L,xe as Ge}from"./vm-hands-entry-lite-bw9verbt.js";import{Be as v,Ce as z,Ke as gt,ze as E}from"./vm-hands-entry-lite-bfwf82rw.js";import{eg as ht,hg as wt,kg as D,mg as Lt,ng as oe}from"./vm-hands-entry-lite-25t4e0vk.js";import{Mg as Se,Ng as re}from"./vm-hands-entry-lite-s2xydt0n.js";import{Vg as be}from"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as T}from"./vm-hands-entry-lite-9pmag2qk.js";import{Fh as xe,zh as we}from"./vm-hands-entry-lite-anaydk9m.js";import{Gh as _}from"./vm-hands-entry-lite-ffg7rf02.js";import{spawn as I}from"child_process";import{randomUUID as ye}from"crypto";import{closeSync as Vr,copyFileSync as ie,existsSync as _t,fstatSync as Er,mkdirSync as ce,openSync as vr,readdirSync as K,readFileSync as Ae,readlinkSync as to,renameSync as eo,rmSync as ro,statSync as oo}from"fs";import{connect as so}from"net";import{userInfo as ge}from"os";import{basename as ne,dirname as ut,join as b}from"path";var yt=`import { spawn, execFileSync } from "node:child_process";
|
|
3
3
|
import { createHash, randomUUID } from "node:crypto";
|
|
4
4
|
import { readFileSync, readlinkSync, lstatSync, realpathSync, statSync, mkdtempSync, mkdirSync, chmodSync, writeFileSync, readdirSync, rmSync, openSync, readSync, closeSync, renameSync } from "node:fs";
|
|
5
5
|
import { tmpdir } from "node:os";
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{$a as n6,Ea as u6,Ga as L4,Ha as O4,Ma as l6,Na as s6,Xa as I4,ab as r6,bb as S4,cb as k4,eb as a6,ga as U4,gb as B8,hb as y0,ia as W2,ib as m0,ja as X4,jb as c1,ka as W4,la as Y4,ma as S6,mb as i6,na as f6,oa as M4,pa as b6,pb as V8,qa as A3,qb as A4,ra as x6,sa as y6,sb as o6,ta as h6,ua as m6,va as w4,wa as v6,xa as p6}from"./vm-hands-entry-lite-tnqv3xzm.js";import{Ab as n0,Bb as r0,Ib as P0,tb as i3,ub as q6,vb as E6}from"./vm-hands-entry-lite-c2nrar90.js";import{Jb as t6,Mb as e6,Ob as $7,Pb as J7}from"./vm-hands-entry-lite-65pbrs1x.js";import{Ub as d6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as _6,Wb as R6,Xb as P6,Yb as z6,Zb as w0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as o1,ac as t1,bc as S3,dc as k3,fc as f3,gc as b3,kc as x3}from"./vm-hands-entry-lite-1hwdab4e.js";import{Cc as H7,Lc as D7,zc as r1}from"./vm-hands-entry-lite-q863th71.js";import{Ad as O6,Bd as j6,Cd as I6,Dd as A6,Ed as T6,Jd as D8,Kd as M8,Ld as w8,Mc as w1,Md as L8,Nc as Q2,Nd as O8,Oc as e5,Od as j8,Pc as I3,Qc as r3,Qd as I8,Rc as a3,Rd as A8,Sc as M0,Sd as T8,Td as _8,Ud as R8,Vd as P8,Wc as N0,Wd as z8,Xd as q8,Yd as E8,Zc as u,Zd as g8,_c as E1,bd as H8,dd as g1,fd as $6,gd as J6,hd as Z6,id as Q6,jd as K6,kd as B6,ld as V6,md as G6,nd as U6,od as X6,pd as W6,qd as Y6,rd as F6,sd as N6,td as C6,ud as H6,vd as D6,wd as M6,xd as w6,yd as L6}from"./vm-hands-entry-lite-gqncr2j0.js";import{_d as V}from"./vm-hands-entry-lite-sv6xwe0h.js";import{$d as W7,ae as Y7,be as F7,ce as N7,de as C7,je as p5,ne as Q5,oe as T5,ue as M7,xe as K5,ye as l1}from"./vm-hands-entry-lite-g0g75c3y.js";import{Xe as j4,cf as c6}from"./vm-hands-entry-lite-bfwf82rw.js";import{hf as M3,uf as g6}from"./vm-hands-entry-lite-ptmqg51y.js";import{Ag as K7,Bg as B7,Dg as V7,Eg as G7,Gg as U7,Hg as X7,yg as Z7,zg as Q7}from"./vm-hands-entry-lite-s2xydt0n.js";import{Vg as n1}from"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as j1,Yg as k6,Zg as H4,_g as D4}from"./vm-hands-entry-lite-9pmag2qk.js";import{ah as D3,ch as $1,ih as K8,jh as J4}from"./vm-hands-entry-lite-84aq8d12.js";import{Gh as H}from"./vm-hands-entry-lite-ffg7rf02.js";import{Kh as a4}from"./vm-hands-entry-lite-7gh1rbn7.js";import{request as m7}from"http";import{request as v7}from"https";async function p7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?v7:m7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:k3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Error("custom_endpoint_timeout"))),K.end($.body)})}function u7($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function d7($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let F=K[B-1];Y+=Z.copy(W,Y,0,B-F),B=F}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function y3($){$.signal.throwIfAborted();let J=b3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=x3.parse(await $.credential($.signal));if(!f3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=u7(Q.apiKey),X=d7(Q.apiKey,Y),F=async(N,D)=>{$.signal.throwIfAborted(),await new Promise((L,M)=>{let I=()=>{$.signal.removeEventListener("abort",I),M($.signal.reason)};if($.signal.addEventListener("abort",I,{once:!0}),$.signal.aborted){I();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(N,D)}).then(()=>{$.signal.removeEventListener("abort",I),L()},(O)=>{$.signal.removeEventListener("abort",I),M(O)})})},C=async(N)=>{if(G+=N.length,G>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<N.length;D+=o1){if(W>=S3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await F(`custom_endpoint.chunk.${W++}`,{eof:!1,data:N.subarray(D,D+o1).toString("base64")})}};try{let N=await p7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=N.response,B=N.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let L={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let I=K.headers[M];if(typeof I==="string")L[M]=I.replaceAll(Q.apiKey,Y).slice(0,4096)}await F("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:L});for await(let M of K){$.signal.throwIfAborted();let I=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=I.length,U>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(I))}return await C(X(Buffer.alloc(0),!0)),await F(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(N){if($.signal.throwIfAborted(),N instanceof H)throw N;throw new H("custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as h3}from"path";function l7($,J){return $===h3(J,".ara","workspace")||$===h3(J,".reason","workspace")}function m3($,J){let Z=$.filter((Q)=>l7(Q.path,J));return Z.length===1?Z[0].path:null}var s7=/^[a-f0-9]{64}$/;var e1=32,c7=/^\/[^\x00-\x1f\x7f\\]*$/;function H1($){if(typeof $!=="string"||$.length>4096||!c7.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function D1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!H1(J.home)||!Array.isArray(J.roots)||J.roots.length>e1)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!s7.test(K)||!H1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as r7}from"child_process";import*as z from"fs";import*as l from"path";import{homedir as a7}from"os";function $2($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function v3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var p3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function J2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function u3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function d3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function M1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=u3(J).filter((G)=>!K.has(G));for(let G of $){let U=J2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,F)=>X.offset-F.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((F)=>Z.secretNames?.(F.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:v3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of p3){let F=d3(X,W).find((C)=>!K.has(C[0]));if(F){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:v3(W,F.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function l3($,J=[]){let Z=u3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of p3)for(let G of d3(B,K))Q.add(G[0])}return[...Q]}function n7($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function s3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+n7(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,c3=536870912,Z2=/^[a-f0-9]{40}$/,i7=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=r7($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(N)=>{if(U??=Error(N),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),F=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(N)=>{if(W)return;W=!0,clearTimeout(F),Z.signal?.removeEventListener("abort",X),Q({status:N,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,N])}),K.stderr.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,N])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(N)=>C(N)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),o7={command:i7,gh:($,J)=>$2(z,l,$,J),home:a7};function T($){throw Error($)}var t7=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),e7=($)=>JSON.stringify($,(J,Z)=>t7.has(J)?void 0:Z);function n3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");T(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function o3($,J,Z=o7){let Q=w1.parse($);if(!["darwin","linux"].includes(process.platform))T("local_device_gh_platform_unavailable");J.assertCurrent();let K=z.realpathSync(J.root);if(K==="/")T("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)T("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)T("local_device_gh_read_only");if(!M0(Q)){let w=M1([{path:"github-operation",content:e7(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!w.clean)n3(w.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=$2(z,l,K,"git"),W=J.privateDirectory?z.realpathSync(J.privateDirectory):z.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+l.sep)))T("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:l.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((w)=>process.env[w]?[[w,process.env[w]]]:[])):{}},X=async(w,_,P=W,g,b=T0)=>{J.assertCurrent();let x=await Z.command(w,_,{cwd:P,env:Y,input:g,maxBuffer:b,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),x.error||x.status!==0)T("local_device_gh_command_failed");return x.stdout},F=async(w)=>(await X(B,w)).toString("utf8").trim(),C=async(w,_="application/vnd.github+json")=>{r3(Q.repoFullName,w,{headers:{accept:_}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${_}`,w],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)T("local_device_gh_response_unavailable");let g=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!g)T("local_device_gh_response_invalid");let b=Number(g[1]);if(b>=200&&b<300&&P.status!==0)T("local_device_gh_response_unavailable");if(Buffer.byteLength(g[3])>Q2)T("local_device_gh_response_too_large");let x={};for(let n of g[2].split(/\r?\n/)){let r=n.indexOf(":"),D0=n.slice(0,r).toLowerCase();if(["link","content-type"].includes(D0))x[D0]=n.slice(r+1).trim().slice(0,8192)}return{kind:"read",status:b,headers:x,body:b>=200&&b<300?g[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[w,_]=Q.repoFullName.split("/"),P=await F(["api","graphql","--hostname","github.com","-f",`query=${a3}`,"-f",`owner=${w}`,"-f",`repo=${_}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>Q2)T("local_device_gh_response_too_large");let g=JSON.parse(P);if(g.errors||g.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||g.data.repository.pullRequest?.number!==Q.number)T("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let w=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),_=JSON.parse(w.body),P=(x)=>x.number===Q.number&&x.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&x.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&x.base?.ref===Q.expectedBaseRef&&x.head?.sha===Q.expectedHeadSha;if(w.status!==200||!P(_)||_.state!=="open"||_.draft!==!1||_.head?.sha!==Q.expectedHeadSha||_.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())T("local_device_gh_merge_target_changed");await F(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha]);let g=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),b=JSON.parse(g.body);if(g.status!==200||!P(b)||b.merged!==!0)T("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)T("local_device_gh_default_branch");let w=await F(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(w))T("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:w}}if(Q.kind==="pr_mutation"){let w=Q.mutation,_=w.action==="edit"?["edit",...w.title!==void 0?[`--title=${w.title}`]:[],...w.body!==void 0?[`--body=${w.body}`]:[],...w.base?[`--base=${w.base}`]:[]]:w.action==="metadata"?["edit",`--${w.change}-${w.field}=${w.value}`]:w.action==="ready"?["ready"]:w.action==="draft"?["ready","--undo"]:["close"];return await F(["pr",..._,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)T("local_device_gh_workspace_unavailable");let N=z.realpathSync(J.repoPath);if(N!==K&&!N.startsWith(K+l.sep))T("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,L="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+i3+")")(),I=(w,_,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",w,_,...P]]:[_,P],O=async(w,_,P,g=T0)=>{let b=w===W||w.startsWith(W+l.sep),x=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...b?["-c",`credential.https://github.com.helper=${L}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",..._];if(b)return X(U,x,w,P,g);let n=l.join(N,".ara-local-gh-tmp");if(z.mkdirSync(n,{recursive:!0,mode:448}),z.lstatSync(n).isSymbolicLink()||z.realpathSync(n)!==n)T("local_device_gh_workspace_unavailable");J.assertCurrent();let r=await Z.command(...I(M(N,n),U,x),{cwd:w,input:P,maxBuffer:g,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:N,TMPDIR:n,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),r.error||r.status!==0)T("local_device_gh_collection_failed");return r.stdout},k=async(w,_)=>(await O(w,_)).toString("utf8").trim(),E=async(w,_)=>{let P=l.join(w,".ara-local-gh-tmp");if(z.mkdirSync(P,{recursive:!0,mode:448}),z.lstatSync(P).isSymbolicLink()||z.realpathSync(P)!==P)T("local_device_gh_workspace_unavailable");J.assertCurrent();let g=await Z.command(...I(M(w,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",_]),{cwd:w,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:w,TMPDIR:P}});if(J.assertCurrent(),g.error||g.status!==0)T("local_device_gh_materialization_failed")},j=async(w)=>{let _=new Map;if(w.length===0)return _;let P=await O(m,["cat-file","--batch"],[...new Set(w)].join(`
|
|
2
|
+
import{$a as n6,Ea as u6,Ga as L4,Ha as O4,Ma as l6,Na as s6,Xa as I4,ab as r6,bb as S4,cb as k4,eb as a6,ga as U4,gb as B8,hb as y0,ia as W2,ib as m0,ja as X4,jb as c1,ka as W4,la as Y4,ma as S6,mb as i6,na as f6,oa as M4,pa as b6,pb as V8,qa as A3,qb as A4,ra as x6,sa as y6,sb as o6,ta as h6,ua as m6,va as w4,wa as v6,xa as p6}from"./vm-hands-entry-lite-1nnj48qj.js";import{Ab as n0,Bb as r0,Ib as P0,tb as i3,ub as q6,vb as E6}from"./vm-hands-entry-lite-c2nrar90.js";import{Jb as t6,Mb as e6,Ob as $7,Pb as J7}from"./vm-hands-entry-lite-65pbrs1x.js";import{Ub as d6}from"./vm-hands-entry-lite-qvrnx0vk.js";import{Vb as _6,Wb as R6,Xb as P6,Yb as z6,Zb as w0}from"./vm-hands-entry-lite-n07kxrd1.js";import{$b as o1,ac as t1,bc as S3,dc as k3,fc as f3,gc as b3,kc as x3}from"./vm-hands-entry-lite-1hwdab4e.js";import{Cc as H7,Lc as D7,zc as r1}from"./vm-hands-entry-lite-54n8tmj1.js";import{Ad as O6,Bd as j6,Cd as I6,Dd as A6,Ed as T6,Jd as D8,Kd as M8,Ld as w8,Mc as w1,Md as L8,Nc as Q2,Nd as O8,Oc as e5,Od as j8,Pc as I3,Qc as r3,Qd as I8,Rc as a3,Rd as A8,Sc as M0,Sd as T8,Td as _8,Ud as R8,Vd as P8,Wc as N0,Wd as z8,Xd as q8,Yd as E8,Zc as u,Zd as g8,_c as E1,bd as H8,dd as g1,fd as $6,gd as J6,hd as Z6,id as Q6,jd as K6,kd as B6,ld as V6,md as G6,nd as U6,od as X6,pd as W6,qd as Y6,rd as F6,sd as N6,td as C6,ud as H6,vd as D6,wd as M6,xd as w6,yd as L6}from"./vm-hands-entry-lite-gqncr2j0.js";import{_d as V}from"./vm-hands-entry-lite-sv6xwe0h.js";import{$d as W7,ae as Y7,be as F7,ce as N7,de as C7,je as p5,ne as Q5,oe as T5,ue as M7,xe as K5,ye as l1}from"./vm-hands-entry-lite-bw9verbt.js";import{Xe as j4,cf as c6}from"./vm-hands-entry-lite-bfwf82rw.js";import{hf as M3,uf as g6}from"./vm-hands-entry-lite-ptmqg51y.js";import{Ag as K7,Bg as B7,Dg as V7,Eg as G7,Gg as U7,Hg as X7,yg as Z7,zg as Q7}from"./vm-hands-entry-lite-s2xydt0n.js";import{Vg as n1}from"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as j1,Yg as k6,Zg as H4,_g as D4}from"./vm-hands-entry-lite-9pmag2qk.js";import{ah as D3,ch as $1,ih as K8,jh as J4}from"./vm-hands-entry-lite-84aq8d12.js";import{Gh as H}from"./vm-hands-entry-lite-ffg7rf02.js";import{Kh as a4}from"./vm-hands-entry-lite-7gh1rbn7.js";import{request as m7}from"http";import{request as v7}from"https";async function p7($){let J=new URL($.url);return await new Promise((Z,Q)=>{let K=(J.protocol==="https:"?v7:m7)(J,{method:"POST",headers:{...$.headers,"accept-encoding":"identity"},signal:$.signal,timeout:k3},(B)=>Z({response:B,close:()=>{B.destroy(),K.destroy(),B.socket?.destroy()}}));K.once("error",Q),K.once("timeout",()=>K.destroy(Error("custom_endpoint_timeout"))),K.end($.body)})}function u7($){for(let J=42;;J++){if(J===127)J=256;let Z=String.fromCodePoint(J);if(!$.includes(Z))return Z}}function d7($,J){let Z=Buffer.from($),Q=Buffer.from(J),K=new Uint32Array(Z.length);for(let G=1,U=0;G<Z.length;G++){while(U&&Z[G]!==Z[U])U=K[U-1];if(Z[G]===Z[U])U++;K[G]=U}let B=0;return(G,U=!1)=>{let W=Buffer.allocUnsafe(G.length*Q.length+B),Y=0;for(let X of G){while(B&&Z[B]!==X){let F=K[B-1];Y+=Z.copy(W,Y,0,B-F),B=F}if(Z[B]===X){if(B++,B===Z.length)Y+=Q.copy(W,Y),B=0}else W[Y++]=X}if(U)Y+=Z.copy(W,Y,0,B),B=0;return W.subarray(0,Y)}}async function y3($){$.signal.throwIfAborted();let J=b3.safeParse($.payload);if(!J.success)throw new H("custom_endpoint_invalid_request","Invalid local model request.");let Z=J.data,Q=x3.parse(await $.credential($.signal));if(!f3(Z,{baseUrl:Z.baseUrl,api:Q.api,execution:"device"}))throw new H("custom_endpoint_invalid_request","The request does not match the configured API.");$.signal.throwIfAborted();let K,B,G=0,U=0,W=0,Y=u7(Q.apiKey),X=d7(Q.apiKey,Y),F=async(N,D)=>{$.signal.throwIfAborted(),await new Promise((L,M)=>{let I=()=>{$.signal.removeEventListener("abort",I),M($.signal.reason)};if($.signal.addEventListener("abort",I,{once:!0}),$.signal.aborted){I();return}Promise.resolve().then(()=>{return $.signal.throwIfAborted(),$.emit(N,D)}).then(()=>{$.signal.removeEventListener("abort",I),L()},(O)=>{$.signal.removeEventListener("abort",I),M(O)})})},C=async(N)=>{if(G+=N.length,G>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let D=0;D<N.length;D+=o1){if(W>=S3)throw new H("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await F(`custom_endpoint.chunk.${W++}`,{eof:!1,data:N.subarray(D,D+o1).toString("base64")})}};try{let N=await p7({url:Z.url,body:Z.body,signal:$.signal,headers:{...Z.headers,...Q.api==="anthropic-messages"?{"x-api-key":Q.apiKey}:{authorization:`Bearer ${Q.apiKey}`}}});K=N.response,B=N.close;let D=K.statusCode??500;if(D>=300&&D<400)throw new H("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(K.headers["content-encoding"]&&K.headers["content-encoding"]!=="identity")throw new H("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let L={};for(let M of["content-type","retry-after","x-request-id","request-id"]){let I=K.headers[M];if(typeof I==="string")L[M]=I.replaceAll(Q.apiKey,Y).slice(0,4096)}await F("custom_endpoint.headers",{status:D,statusText:(K.statusMessage??"").replaceAll(Q.apiKey,Y).slice(0,256),headers:L});for await(let M of K){$.signal.throwIfAborted();let I=Buffer.isBuffer(M)?M:Buffer.from(M);if(U+=I.length,U>t1)throw new H("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await C(X(I))}return await C(X(Buffer.alloc(0),!0)),await F(`custom_endpoint.chunk.${W}`,{eof:!0}),{bytes:G,chunks:W}}catch(N){if($.signal.throwIfAborted(),N instanceof H)throw N;throw new H("custom_endpoint_request_failed","The local model server could not complete the request.")}finally{B?.()}}import{join as h3}from"path";function l7($,J){return $===h3(J,".ara","workspace")||$===h3(J,".reason","workspace")}function m3($,J){let Z=$.filter((Q)=>l7(Q.path,J));return Z.length===1?Z[0].path:null}var s7=/^[a-f0-9]{64}$/;var e1=32,c7=/^\/[^\x00-\x1f\x7f\\]*$/;function H1($){if(typeof $!=="string"||$.length>4096||!c7.test($))return!1;if($==="/")return!0;return $.split("/").slice(1).every((J)=>J!==""&&J!=="."&&J!=="..")}function D1($){if(!$||typeof $!=="object"||Array.isArray($))return;let J=$;if(!H1(J.home)||!Array.isArray(J.roots)||J.roots.length>e1)return;let Z=[];for(let Q of J.roots){if(!Q||typeof Q!=="object"||Array.isArray(Q))return;let{path_fingerprint:K,path:B}=Q;if(typeof K!=="string"||!s7.test(K)||!H1(B))return;Z.push({path_fingerprint:K,path:B})}return{home:J.home,roots:Z}}import{spawn as r7}from"child_process";import*as z from"fs";import*as l from"path";import{homedir as a7}from"os";function $2($,J,Z,Q="gh"){if(!["gh","git"].includes(Q))throw Error("local_device_gh_unavailable");let K=$.realpathSync(Z),B=Q==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+Q;for(let G of["/opt/homebrew/bin/"+Q,"/usr/local/bin/"+Q,B])try{let U=$.realpathSync(G);if(U===K||U.startsWith(K+J.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...Q==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((Y)=>U.startsWith(Y)))continue;let W=$.statSync(U);if(!W.isFile()||(W.mode&18)!==0||![0,process.getuid()].includes(W.uid))continue;return $.accessSync(U,$.constants.X_OK),U}catch{continue}throw Error("local_device_gh_unavailable")}function v3($,J){let Z=1;for(let Q=0;Q<J;Q+=1)if($.charCodeAt(Q)===10)Z+=1;return Z}var p3=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function J2($){let J=$.trim().replaceAll("\\","/");if(!J)return{valid:!1,reason:"empty_path"};if(J.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(J.split("/").includes("..")||J.includes("../")||J.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(J===".git"||J.startsWith(".git/")||J.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function u3($){return[...new Set($.map((J)=>J.trim()).filter((J)=>J.length>=8))]}function d3($,J){return[...J.matchAll(new RegExp($.regex.source,`${$.regex.flags}g`))]}function M1($,J=[],Z={}){let Q=[],K=Z.published??new Set,B=u3(J).filter((G)=>!K.has(G));for(let G of $){let U=J2(G.path);if(!U.valid){Q.push({path:G.path,reason:U.reason??"invalid_path"});continue}let W=G.content??"",Y=B.map((X)=>({secret:X,offset:W.indexOf(X)})).filter((X)=>X.offset>=0).sort((X,F)=>X.offset-F.offset);if(Y.length>0){let X=[...new Set(Y.flatMap((F)=>Z.secretNames?.(F.secret)??[]))];Q.push({path:G.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:v3(W,Y[0].offset),...X.length>0?{secretNames:X}:{}})}for(let X of p3){let F=d3(X,W).find((C)=>!K.has(C[0]));if(F){Q.push({path:G.path,reason:`credential_pattern_detected: ${X.name}`,pattern:X.name,ruleId:X.name,line:v3(W,F.index)});break}}}return{clean:Q.length===0,violations:Q,scannedObjectCount:$.length}}function l3($,J=[]){let Z=u3(J),Q=new Set;for(let{content:K}of $){for(let B of Z)if(K.includes(B))Q.add(B);for(let B of p3)for(let G of d3(B,K))Q.add(G[0])}return[...Q]}function n7($,J){let Z=0;for(let Q=$.indexOf(J);Q>=0;Q=$.indexOf(J,Q+J.length))Z+=1;return Z}function s3($,J,Z){let Q=(K,B)=>K.reduce((G,U)=>G+n7(U,B),0);return new Set($.filter((K)=>Q(J,K)<=Q(Z,K)))}var T0=4194304,c3=536870912,Z2=/^[a-f0-9]{40}$/,i7=($,J,Z)=>new Promise((Q)=>{if(Z.signal?.aborted){Q({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let K;try{K=r7($,J,{cwd:Z.cwd,env:Z.env,detached:!0,stdio:["pipe","pipe","pipe"]})}catch{Q({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let B=Buffer.alloc(0),G=Buffer.alloc(0),U,W=!1,Y=(N)=>{if(U??=Error(N),K.pid)try{process.kill(-K.pid,"SIGKILL")}catch{}},X=()=>Y("cancelled"),F=setTimeout(()=>Y("timeout"),Z.timeout);Z.signal?.addEventListener("abort",X,{once:!0});let C=(N)=>{if(W)return;W=!0,clearTimeout(F),Z.signal?.removeEventListener("abort",X),Q({status:N,stdout:B,stderr:G,...U?{error:U}:{}})};if(K.stdout.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else B=Buffer.concat([B,N])}),K.stderr.on("data",(N)=>{if(B.length+G.length+N.length>Z.maxBuffer)Y("output_limit");else G=Buffer.concat([G,N])}),K.on("error",()=>{if(Y("spawn_failed"),!K.pid)C(null)}),K.on("close",(N)=>C(N)),K.stdin.on("error",()=>Y("input_failed")),K.stdin.end(Z.input),Z.signal?.aborted)X()}),o7={command:i7,gh:($,J)=>$2(z,l,$,J),home:a7};function T($){throw Error($)}var t7=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),e7=($)=>JSON.stringify($,(J,Z)=>t7.has(J)?void 0:Z);function n3($,J,Z){let Q=[...new Set($.map((B)=>`${J(B.path)}${B.line?`:${B.line}`:""} (${B.reason==="literal_secret_detected"?`value of ${B.secretNames?.length?B.secretNames.slice(0,3).join(", "):"a session variable"}`:`${B.ruleId??"credential"} credential`})`))].slice(0,10),K=$.some((B)=>B.reason==="literal_secret_detected");T(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${Q.join("; ")}. Nothing was sent. ${Z}${K?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function o3($,J,Z=o7){let Q=w1.parse($);if(!["darwin","linux"].includes(process.platform))T("local_device_gh_platform_unavailable");J.assertCurrent();let K=z.realpathSync(J.root);if(K==="/")T("local_device_gh_root_unavailable");if(!M0(Q)&&!J.forbiddenSecretValues)T("local_device_gh_secret_scope_unavailable");if(!M0(Q)&&J.readOnly)T("local_device_gh_read_only");if(!M0(Q)){let w=M1([{path:"github-operation",content:e7(Q)}],J.forbiddenSecretValues,J.secretNames?{secretNames:J.secretNames}:{});if(!w.clean)n3(w.violations,()=>`the ${Q.kind} request text`,"Remove it from the pull request text and try again.")}let B=Z.gh(K),G=Z.home(),U=$2(z,l,K,"git"),W=J.privateDirectory?z.realpathSync(J.privateDirectory):z.realpathSync(G);if(!M0(Q)&&(!J.privateDirectory||W===K||W.startsWith(K+l.sep)))T("local_device_gh_private_scope_unavailable");let Y={PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:G,GH_CONFIG_DIR:l.join(G,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((w)=>process.env[w]?[[w,process.env[w]]]:[])):{}},X=async(w,_,P=W,g,b=T0)=>{J.assertCurrent();let x=await Z.command(w,_,{cwd:P,env:Y,input:g,maxBuffer:b,timeout:Math.max(1,Math.min(60000,(J.deadlineMs??Date.now()+60000)-Date.now())),signal:J.signal});if(J.assertCurrent(),x.error||x.status!==0)T("local_device_gh_command_failed");return x.stdout},F=async(w)=>(await X(B,w)).toString("utf8").trim(),C=async(w,_="application/vnd.github+json")=>{r3(Q.repoFullName,w,{headers:{accept:_}}),J.assertCurrent();let P=await Z.command(B,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${_}`,w],{cwd:W,env:Y,maxBuffer:T0,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal});if(J.assertCurrent(),P.error&&P.status===null)T("local_device_gh_response_unavailable");let g=P.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!g)T("local_device_gh_response_invalid");let b=Number(g[1]);if(b>=200&&b<300&&P.status!==0)T("local_device_gh_response_unavailable");if(Buffer.byteLength(g[3])>Q2)T("local_device_gh_response_too_large");let x={};for(let n of g[2].split(/\r?\n/)){let r=n.indexOf(":"),D0=n.slice(0,r).toLowerCase();if(["link","content-type"].includes(D0))x[D0]=n.slice(r+1).trim().slice(0,8192)}return{kind:"read",status:b,headers:x,body:b>=200&&b<300?g[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(Q.kind==="read")return C(Q.path,Q.accept);if(Q.kind==="pr_review_context"){let[w,_]=Q.repoFullName.split("/"),P=await F(["api","graphql","--hostname","github.com","-f",`query=${a3}`,"-f",`owner=${w}`,"-f",`repo=${_}`,"-F",`number=${Q.number}`,...Q.after?["-f",`after=${Q.after}`]:[]]);if(Buffer.byteLength(P)>Q2)T("local_device_gh_response_too_large");let g=JSON.parse(P);if(g.errors||g.data?.repository?.nameWithOwner?.toLowerCase()!==Q.repoFullName.toLowerCase()||g.data.repository.pullRequest?.number!==Q.number)T("local_device_gh_response_invalid");return{kind:"pr_review_context",body:P}}if(Q.kind==="pr_merge"){let w=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),_=JSON.parse(w.body),P=(x)=>x.number===Q.number&&x.html_url===`https://github.com/${Q.repoFullName}/pull/${Q.number}`&&x.base?.repo?.full_name?.toLowerCase()===Q.repoFullName.toLowerCase()&&x.base?.ref===Q.expectedBaseRef&&x.head?.sha===Q.expectedHeadSha;if(w.status!==200||!P(_)||_.state!=="open"||_.draft!==!1||_.head?.sha!==Q.expectedHeadSha||_.base?.repo?.full_name?.toLowerCase()!==Q.repoFullName.toLowerCase())T("local_device_gh_merge_target_changed");await F(["pr","merge",String(Q.number),`--repo=${Q.repoFullName}`,`--${Q.method}`,"--match-head-commit",Q.expectedHeadSha]);let g=await C(`/repos/${Q.repoFullName}/pulls/${Q.number}`),b=JSON.parse(g.body);if(g.status!==200||!P(b)||b.merged!==!0)T("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:Q.number,merged:!0}}if(Q.kind==="pr_create"){if(Q.head===Q.base)T("local_device_gh_default_branch");let w=await F(["pr","create","--repo",Q.repoFullName,"--head",Q.head,"--base",Q.base,`--title=${Q.title}`,`--body=${Q.body}`,...Q.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+Q.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(w))T("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:w}}if(Q.kind==="pr_mutation"){let w=Q.mutation,_=w.action==="edit"?["edit",...w.title!==void 0?[`--title=${w.title}`]:[],...w.body!==void 0?[`--body=${w.body}`]:[],...w.base?[`--base=${w.base}`]:[]]:w.action==="metadata"?["edit",`--${w.change}-${w.field}=${w.value}`]:w.action==="ready"?["ready"]:w.action==="draft"?["ready","--undo"]:["close"];return await F(["pr",..._,String(Q.number),"--repo",Q.repoFullName]),{kind:"pr_mutation",number:Q.number,applied:!0}}if(!J.repoPath)T("local_device_gh_workspace_unavailable");let N=z.realpathSync(J.repoPath);if(N!==K&&!N.startsWith(K+l.sep))T("local_device_gh_workspace_unavailable");let D=`https://github.com/${Q.repoFullName}.git`,L="!'"+B.replace(/'/g,"'\\''")+"' auth git-credential",M=Function("return ("+i3+")")(),I=(w,_,P)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",w,_,...P]]:[_,P],O=async(w,_,P,g=T0)=>{let b=w===W||w.startsWith(W+l.sep),x=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...b?["-c",`credential.https://github.com.helper=${L}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",..._];if(b)return X(U,x,w,P,g);let n=l.join(N,".ara-local-gh-tmp");if(z.mkdirSync(n,{recursive:!0,mode:448}),z.lstatSync(n).isSymbolicLink()||z.realpathSync(n)!==n)T("local_device_gh_workspace_unavailable");J.assertCurrent();let r=await Z.command(...I(M(N,n),U,x),{cwd:w,input:P,maxBuffer:g,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:N,TMPDIR:n,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(J.assertCurrent(),r.error||r.status!==0)T("local_device_gh_collection_failed");return r.stdout},k=async(w,_)=>(await O(w,_)).toString("utf8").trim(),E=async(w,_)=>{let P=l.join(w,".ara-local-gh-tmp");if(z.mkdirSync(P,{recursive:!0,mode:448}),z.lstatSync(P).isSymbolicLink()||z.realpathSync(P)!==P)T("local_device_gh_workspace_unavailable");J.assertCurrent();let g=await Z.command(...I(M(w,P),"/bin/sh",["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",_]),{cwd:w,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(J.deadlineMs??Date.now()+25000)-Date.now())),signal:J.signal,env:{PATH:"/usr/bin:/bin:/usr/sbin:/sbin",HOME:w,TMPDIR:P}});if(J.assertCurrent(),g.error||g.status!==0)T("local_device_gh_materialization_failed")},j=async(w)=>{let _=new Map;if(w.length===0)return _;let P=await O(m,["cat-file","--batch"],[...new Set(w)].join(`
|
|
3
3
|
`)+`
|
|
4
4
|
`,T0*8);for(let g=0;g<P.length;){let b=P.indexOf(10,g),[x,n,r]=P.subarray(g,b).toString("utf8").split(" ");if(b<0||!x||n!=="blob"||!/^[0-9]+$/.test(r??""))T("local_device_gh_object_invalid");_.set(x,P.subarray(b+1,b+1+Number(r)).toString("utf8")),g=b+1+Number(r)+1}return _},R=async(w,_,P)=>{let g=l.join(N,".ara-local-gh-tmp"),b=M(N,g)+`
|
|
5
5
|
(allow file-read* file-write* (subpath ${JSON.stringify(N)}))
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{cf as Z8}from"./vm-hands-entry-lite-bfwf82rw.js";import{lf as R0}from"./vm-hands-entry-lite-ptmqg51y.js";import{gg as Kq}from"./vm-hands-entry-lite-
|
|
2
|
+
import{cf as Z8}from"./vm-hands-entry-lite-bfwf82rw.js";import{lf as R0}from"./vm-hands-entry-lite-ptmqg51y.js";import{gg as Kq}from"./vm-hands-entry-lite-25t4e0vk.js";import{Cg as p,Fg as V0,Ig as F0,Jg as C8,Kg as eq,Mg as g8,Pg as q0,Rg as x0}from"./vm-hands-entry-lite-s2xydt0n.js";import{Wg as wq}from"./vm-hands-entry-lite-s5qn1k80.js";import{Xg as o,Yg as C0}from"./vm-hands-entry-lite-9pmag2qk.js";import{jh as B0}from"./vm-hands-entry-lite-84aq8d12.js";import{zh as A0}from"./vm-hands-entry-lite-anaydk9m.js";import{Gh as Z}from"./vm-hands-entry-lite-ffg7rf02.js";import{execFile as V1,spawn as w0}from"child_process";import{randomBytes as F1}from"crypto";import{chmodSync as w1,existsSync as K0,lstatSync as K1,mkdirSync as M1,readFileSync as z1,rmSync as Y1,writeFileSync as Xq}from"fs";import{connect as _1}from"net";import{join as H}from"path";var Bq="./desktop-wallpaper-0pjhgyfk.jpg";var Rq="./dock-browser-afp005mt.png";var Cq="./dock-files-rywdm96b.png";var yq="./dock-terminal-s41cj1jp.png";var Sq=`# Sets the X root window background and _XROOTPMAP_ID, as feh --bg-fill does.
|
|
3
3
|
# The native Blaxel image ships no feh, hsetroot or compositor, but it does ship
|
|
4
4
|
# python3-gi and libX11. tint2 reads _XROOTPMAP_ID to draw its transparent panel.
|
|
5
5
|
# Usage: DISPLAY=:99 python3 set-root-wallpaper.py IMAGE
|
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{yh as $}from"./vm-hands-entry-lite-
|
|
2
|
+
import{yh as $}from"./vm-hands-entry-lite-1fznjm91.js";var O=$.version,Z=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;function S(B,D){if(!Z.test(B)||!Z.test(D))throw Error("cannot compare invalid CLI versions");let J=(q)=>{let y=q.indexOf("-");return y===-1?[q,void 0]:[q.slice(0,y),q.slice(y+1)]},[j,F]=J(B),[w,G]=J(D),K=j.split(".").map(BigInt),M=w.split(".").map(BigInt);for(let q=0;q<3;q+=1){if(K[q]===M[q])continue;return K[q]<M[q]?-1:1}if(F===void 0||G===void 0){if(F===G)return 0;return F===void 0?1:-1}let Q=F.split("."),U=G.split("."),A=Math.max(Q.length,U.length);for(let q=0;q<A;q+=1){let y=Q[q],z=U[q];if(y===void 0||z===void 0){if(y===z)return 0;return y===void 0?-1:1}if(y===z)continue;let H=/^\d+$/.test(y),W=/^\d+$/.test(z);if(H&&W){let X=BigInt(y),Y=BigInt(z);if(X===Y)continue;return X<Y?-1:1}if(H!==W)return H?-1:1;return y<z?-1:1}return 0}function k(B,D){return D?`cli ${B} \xB7 agent ${D}`:`cli ${B}`}
|
|
3
3
|
export{O as uh,Z as vh,S as wh,k as xh};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import"./vm-hands-entry-lite-fraghb8k.js";import"./vm-hands-entry-lite-gqncr2j0.js";import"./vm-hands-entry-lite-sv6xwe0h.js";import{Kh as A}from"./vm-hands-entry-lite-7gh1rbn7.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-
|
|
2
|
+
import"./vm-hands-entry-lite-fraghb8k.js";import"./vm-hands-entry-lite-gqncr2j0.js";import"./vm-hands-entry-lite-sv6xwe0h.js";import{Kh as A}from"./vm-hands-entry-lite-7gh1rbn7.js";import{readFileSync as J}from"fs";var G=performance.now();delete process.env.BUN_BE_BUN;var q=(j,b={})=>console.log(JSON.stringify({stage:j,ms:Math.round(performance.now()),...b}));async function K(){if(process.argv.includes("--vm-hands-op-runner")){let{runVmHandsOpRunner:D}=await import("./vm-hands-op-runner-350k7hem.js");await D();return}q("parsed",{t0:Math.round(G)});let j="";try{j=J(3,"utf8")}catch{}q("fd3_read",{bytes:j.length});let b=null;if(j.trim())try{b=JSON.parse(j)}catch{b=null}if(!b||typeof b!=="object"||Array.isArray(b))q(j.trim()?"identity_invalid":"identity_free"),await new Promise(()=>{setInterval(()=>{return},1073741824)});let{parseVmHandsInit:B,runVmHands:C}=await import("./vm-hands-runtime-st3eagc2.js"),z=B(b);if(!z)q("identity_invalid"),await new Promise(()=>{setInterval(()=>{return},1073741824)});await C(z,q),process.exit(0)}K();
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Ka as s,ob as i,qa as t,sb as n}from"./vm-hands-entry-lite-
|
|
2
|
+
import{Ka as s,ob as i,qa as t,sb as n}from"./vm-hands-entry-lite-1nnj48qj.js";import"./vm-hands-entry-lite-c2nrar90.js";import"./vm-hands-entry-lite-qvrnx0vk.js";import"./vm-hands-entry-lite-n07kxrd1.js";import"./vm-hands-entry-lite-gqncr2j0.js";import"./vm-hands-entry-lite-sv6xwe0h.js";import"./vm-hands-entry-lite-bfwf82rw.js";import"./vm-hands-entry-lite-ptmqg51y.js";import"./vm-hands-entry-lite-s5qn1k80.js";import"./vm-hands-entry-lite-9pmag2qk.js";import"./vm-hands-entry-lite-84aq8d12.js";import"./vm-hands-entry-lite-1fznjm91.js";import"./vm-hands-entry-lite-anaydk9m.js";import"./vm-hands-entry-lite-ffg7rf02.js";import"./vm-hands-entry-lite-7gh1rbn7.js";import{spawn as Zq}from"child_process";import{chmodSync as $q,chownSync as zq,existsSync as Qq,lstatSync as S,mkdirSync as Wq,mkdtempSync as Gq,readdirSync as m,readFileSync as F,realpathSync as Jq,rmSync as Yq,writeFileSync as u}from"fs";import{join as U}from"path";var o="/sys/fs/cgroup/reason-payload",k="vm-hands",Kq="/run/ara-srt/fallbacks.jsonl",E="/reason-person",Bq=5000,bq=1e4,c="__VM_HANDS_PROOF_DIR__",Tq="__VM_HANDS_PROBE_NONCE__";class L extends Error{code;constructor(q,W){super(W);this.code=q}}var Lq=30000,e=(q)=>`'${q.replaceAll("'","'\\''")}'`;function xq(q){let W=q.cgroup??o,J=q.init.layout.payload_uid,X=q.log??(()=>{}),Q=null,Z=0,T=()=>{try{let z=F("/run/ara-srt/starts.jsonl","utf8"),$=z.slice(Z>z.length?0:Z).split(`
|
|
3
3
|
`).filter(Boolean);Z=z.length;let G=$.map((Y)=>{try{return Number(JSON.parse(Y).elapsed_ms)||0}catch{return 0}});if(G.length)X("vm_hands.srt_server_starts",{count:G.length,elapsed_ms:G.slice(0,8)})}catch{}},j=null,D=!1,C=q.srtCgroup??"/sys/fs/cgroup/reason-srt",R=()=>{j??=Iq()},N=0,A=()=>{try{let z=F(Kq,"utf8"),$=z.slice(N>z.length?0:N);N=z.length;let G=$.split(`
|
|
4
4
|
`).filter(Boolean).slice(0,1000);if(!G.length)return null;let Y={},K=0;for(let b of G)try{let M=JSON.parse(b),I=typeof M.code==="string"&&/^[a-z_]{1,40}$/.test(M.code)?M.code:"other";if(Y[I]=(Y[I]??0)+1,typeof M.elapsed_ms==="number")K=Math.max(K,M.elapsed_ms)}catch{Y.unparsed=(Y.unparsed??0)+1}return X("vm_hands.srt_fallbacks",{count:G.length,codes:Y,max_elapsed_ms:K}),{count:G.length,codes:Y,max_elapsed_ms:K}}catch{return null}},v=!1,qq=(z,$,G)=>{if(v)throw Error("vm_hands_pool_held");return H(z,$,G)},H=(z,$,G)=>Zq("/bin/sh",["-c",`echo $$ > ${e(U(W,k,"cgroup.procs"))} || exit 125; exec "$@"`,"vm-hands-join",z,...$],G),Xq=(z)=>H(z.command,z.args,z.options),P=q.prespawn?s({spawnProcess:qq,...q.relayDependencies?.sourceEntrypoint?{sourceEntrypoint:q.relayDependencies.sourceEntrypoint}:{},log:(z,$)=>X(z,$??{})}):null;P?.arm();let h=P?setInterval(()=>{if(!Q)P.arm()},Lq):null;h?.unref?.();async function y(){let z=Q;if(Q=null,!z)return;z.abort.abort(),await z.done}return{async startExecutor(z){if(R(),D=!0,!z.claim)throw new L("vm_hands_bind_invalid","an executor needs the claim it serves");await y();let $=z.claim,G=$.owner;if(!G||typeof G.device_id!=="string"||typeof $.root_id!=="string")throw new L("vm_hands_bind_invalid","claim without its owner Device or root");let Y=new AbortController,K,b,M=new Promise((B,O)=>{K=B,b=O}),I,w=new Promise((B)=>{I=B}),g=n({headless:!0,hostExecution:!0,runtimeDirectory:q.runtimeDirectory,deviceIdentity:{deviceId:G.device_id,rootId:$.root_id,apiOrigin:q.apiOrigin},claimOwner:$.owner,root:q.root,runId:$.run_id,operationId:$.operation_id,attemptId:$.attempt_id,payload:Object.fromEntries(Object.entries($.payload).filter(([B])=>!B.startsWith("vm_hands_"))),signal:Y.signal,emitEvent:async(B,O)=>{if(B==="hands.ready"){K(O);return}if(B==="hands.started"||B==="hands.stopped"||B==="hands.failed")return;await q.forward(B,O)}},{...q.relayDependencies,spawnWorker:Xq,...P?{takePrespawnedWorker:P.take,adoptSpawnedWorker:P.adopt}:{}}).then(()=>{I("executor_stopped")},(B)=>{let O=B&&typeof B==="object"&&"code"in B?String(B.code):"executor_failed";b(new L(O,B instanceof Error?B.message:String(B))),I(O)}).finally(()=>b(new L("vm_hands_executor_exited","executor ended before it was ready")));Q={abort:Y,done:g,exited:w,operationId:$.operation_id,runId:$.run_id,expiresAtMs:Date.parse(String($.payload.expires_at??""))||0};let V=await M,x=V.executor_launch_id;if(typeof x!=="string")throw new L("vm_hands_bind_failed","executor ready without a launch id");return{launchId:x,readyData:V,applied:{hands_confinement:typeof $.payload.hands_confinement==="string"?$.payload.hands_confinement:null,browser_egress:$.payload.browser_egress??null}}},takeSrtFallbacks:A,executorExited(){return Q?Q.exited:new Promise(()=>{})},async killAndVerifyPayload(){v=!0;let z=Aq();try{await Dq(),await y().catch(()=>{return}),T();let $=Date.now()+Bq;await p(W,$,"payload");let G=(D||q.srtWarmLate?.()===!0)&&Qq(U(C,"cgroup.events"));if(G)await p(C,$,"srt");let Y=Cq(J).filter((K)=>!l(K,E));if(j!==null){let K=Mq(j).filter((b)=>b!==process.pid&&!l(b,E));if(K.length)throw X("vm_hands.kill_strays",{strays:K.slice(0,16).map((b)=>{let M="?",I="?";try{M=F(`/proc/${b}/comm`,"utf8").trim().slice(0,32)}catch{}try{I=(F(`/proc/${b}/cgroup`,"utf8").split(`
|
|
5
5
|
`).find((w)=>w.startsWith("0::"))??"").slice(3,80)}catch{}return{pid:b,comm:M,cgroup:I}})}),new L("vm_hands_kill_unverified",`${K.length} process(es) the run started survived it`);j=null}if(D=!1,G)q.onSrtReset?.();if(Y.length)throw X("vm_hands.kill_survivors",{pids:Y.slice(0,16)}),new L("vm_hands_kill_unverified",`${Y.length} payload-uid process(es) outside the payload cgroup`)}finally{v=!1,z()}if(P)setTimeout(()=>{if(!Q)P.arm()},100).unref?.()},async runProbe({nonce:z,script:$}){if(R(),!$.includes(c))throw new L("vm_hands_probe_failed","probe names no proof directory");let G=q.proofParent??"/tmp/reason-vm-hands-proof";Wq(G,{mode:457,recursive:!0});let Y=S(G);if(Y.isSymbolicLink()||!Y.isDirectory()||Y.uid!==(process.getuid?.()??-1)||(Y.mode&4095)!==457)throw new L("vm_hands_probe_failed","proof parent is not root's 0711 directory");let K=Gq(U(G,"p-")),b=!1;try{if(!/^[A-Za-z0-9/._-]+$/.test(K)||!/^[A-Za-z0-9_-]{1,128}$/.test(z))throw new L("vm_hands_probe_failed","proof directory path or nonce");zq(K,J,J),$q(K,448);let M=S(K).ino,I=H("/bin/bash",["-c",$.replaceAll(c,K).replaceAll(Tq,z)],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:["ignore","pipe","ignore"]}),w="";I.stdout?.on("data",(V)=>{if(w.length<16384)w+=V.toString("utf8").slice(0,16384-w.length)});let g=await new Promise((V)=>{let x=setTimeout(()=>{b=!0,I.kill("SIGKILL"),V(124)},bq);I.once("error",()=>{clearTimeout(x),V(127)}),I.once("close",(B)=>{clearTimeout(x),V(B??1)})});return X("vm_hands.probe",{nonce_len:z.length,exit_code:g}),{exitCode:g,markers:w,proofDirInode:M}}finally{if(!b)Yq(K,{recursive:!0,force:!0})}},restatLayout(){let{session_root:z,alias:$}=q.init.layout,G="invalid";try{i(z),G="0:0:755"}catch{}let Y=!1,K=-1;try{let b=S($);K=b.uid,Y=G==="0:0:755"&&$===U(z,"repo")&&!b.isSymbolicLink()&&b.isDirectory()&&Jq($)===$&&b.uid===J}catch{}return{root_mode:G,alias_ok:Y,owner_uid:K}},installEnvironment(z){let $=Q;if(!$)throw new L("environment_unavailable","no executor owns an environment");return t({root:q.root,operationId:$.operationId,payload:z}).installed_revision},async stop(){if(h)clearInterval(h);P?.close(),await y()}}}function l(q,W,J="/proc"){try{let Q=F(U(J,String(q),"cgroup"),"utf8").split(`
|
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{Kh as E}from"./vm-hands-entry-lite-7gh1rbn7.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-
|
|
2
|
+
import{Kh as E}from"./vm-hands-entry-lite-7gh1rbn7.js";async function Q(){let[{executeLocalOperation:G},{configureDesktopAccount:H},{configureWorkerSandbox:J}]=await Promise.all([import("./local-capabilities-j6cmcwdc.js"),import("./desktop-account-vsrtgkk9.js"),import("./worker-sandbox-nnce49w0.js")]);J();let K=(process.geteuid?.()??0)!==0,z=new Map,y=(B)=>{try{process.send?.(B)}catch{}};process.on("message",(B)=>{let j=B;if(j?.t==="cancel"){z.get(j.id)?.abort();return}if(j?.t!=="op")return;if(!K){y({t:"done",id:j.id,completion:{status:"failed",error_code:"vm_hands_payload_account_unavailable"}});return}let F=new AbortController;z.set(j.id,F),G(j.state,j.claim,{worker:j.worker,signal:F.signal,emit:(q)=>{let{deliverySignal:N,...M}=q;y({t:"event",id:j.id,event:M})}}).then((q)=>y({t:"done",id:j.id,completion:q}),(q)=>y({t:"done",id:j.id,completion:{status:"failed",error_code:q&&typeof q==="object"&&"code"in q&&typeof q.code==="string"?q.code:"vm_hands_op_failed"}})).finally(()=>z.delete(j.id))}),process.on("disconnect",()=>process.exit(0)),await new Promise(()=>{})}export{Q as runVmHandsOpRunner};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import{u as y,v as k,w as m}from"./vm-hands-entry-lite-fraghb8k.js";import{Uc as v}from"./vm-hands-entry-lite-gqncr2j0.js";import"./vm-hands-entry-lite-sv6xwe0h.js";import{Kh as K}from"./vm-hands-entry-lite-7gh1rbn7.js";import{spawn as n}from"child_process";import{createHash as i}from"crypto";import{lstatSync as T,mkdirSync as d,readFileSync as a,statSync as r,writeFileSync as l}from"fs";var A="/run/reason-vm-hands",E="/run/reason-vm-hands/env",f="/home/runner",t=/^https:\/\/[a-z0-9.-]+(?::\d{1,5})?$/,O="/sys/fs/cgroup/reason-srt",R="/usr/local/bin/ara-srt-exec",e=65536,jj=21600000;function qj(Q,j="/run/ara-srt"){try{if((process.getuid?.()??-1)!==0)return;d(j,{recursive:!0,mode:448});let q=T(j);if(!q.isDirectory()||q.uid!==0||(q.mode&63)!==0){Q("srt_base_keyed_skipped",{reason:"socket_dir_unsafe"});return}l(`${j}/base-keyed`,`1
|
|
3
|
-
`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function S(Q,j){let q=(G)=>{return j("srt_warm_skipped",{reason:G}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return q("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>e||Z.toString("base64")!==Q.srt_base_settings)return q("settings_invalid");try{let G=T(O);if(!G.isDirectory()||G.uid!==0||(G.mode&18)!==0)return q("cgroup_unsafe");for(let[Y,N]of[[R,!1],["/usr/local/bin",!0]]){let B=T(Y);if((N?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return q("srt_exec_unsafe")}}catch{return q("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return q("not_root");let z=performance.now(),X=i("sha256").update(Z).digest("hex"),M=`${A}/srt-base-settings.json`;try{l(M,Z,{mode:384,flag:"w"})}catch{return q("settings_write")}let H=n("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",R,"--settings",M,"--idle-ms",String(jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((G)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),G()}),H.once("close",(Y)=>{j(Y===0?"srt_warm_done":"srt_warm_failed",{exit_code:Y,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),G()})})}var p=3000;function Yj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,q=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&t.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!q&&typeof q.session_root==="string"&&typeof q.alias==="string"&&Number.isSafeInteger(q.payload_uid)&&typeof q.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){d(Q,{recursive:!0,mode:448});let j=r(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Jj(Q){let[{CLI_VERSION:j},q,Z,z]=await Promise.all([import("./version-
|
|
4
|
-
`)){let q=j.split(":");if(q.length>=4&&Number(q[2])===Q&&/^\d+$/.test(q[3]??"")&&Number(q[3])>0)return Number(q[3])}throw Error("vm_hands_payload_account_unavailable")}function zj(Q,j){let q=j.owner;if(!q||typeof q.organization_id!=="string"||typeof q.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(A),u(E),qj(j);let q=S(Q,j),Z=!1,z=async()=>{if(!await Promise.race([q.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),p).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:p})},[{configureDesktopAccount:X},{configureWorkerSandbox:M}]=await Promise.all([import("./desktop-account-vsrtgkk9.js"),import("./worker-sandbox-nnce49w0.js")]);M();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let J of["SIGTERM","SIGINT"])process.on(J,()=>H.abort());let G=null,Y,N=new Promise((J)=>{Y=J}),B=N.then(()=>import("./vm-hands-executor-
|
|
3
|
+
`,{mode:420}),Q("srt_base_keyed",{})}catch{Q("srt_base_keyed_skipped",{reason:"error"})}}function S(Q,j){let q=(G)=>{return j("srt_warm_skipped",{reason:G}),Promise.resolve()};if(typeof Q.srt_base_settings!=="string")return q("no_settings");let Z=Buffer.from(Q.srt_base_settings,"base64");if(Z.length===0||Z.length>e||Z.toString("base64")!==Q.srt_base_settings)return q("settings_invalid");try{let G=T(O);if(!G.isDirectory()||G.uid!==0||(G.mode&18)!==0)return q("cgroup_unsafe");for(let[Y,N]of[[R,!1],["/usr/local/bin",!0]]){let B=T(Y);if((N?!B.isDirectory():!B.isFile())||B.uid!==0||(B.mode&18)!==0)return q("srt_exec_unsafe")}}catch{return q("cgroup_or_exec_missing")}if((process.getuid?.()??-1)!==0)return q("not_root");let z=performance.now(),X=i("sha256").update(Z).digest("hex"),M=`${A}/srt-base-settings.json`;try{l(M,Z,{mode:384,flag:"w"})}catch{return q("settings_write")}let H=n("/bin/sh",["-c",`echo $$ > ${O}/cgroup.procs || exit 125; exec "$@"`,"vm-hands-srt",R,"--settings",M,"--idle-ms",String(jj),"--","/bin/true"],{cwd:"/",env:{PATH:"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},stdio:"ignore"});return new Promise((G)=>{H.once("error",()=>{j("srt_warm_failed",{reason:"spawn"}),G()}),H.once("close",(Y)=>{j(Y===0?"srt_warm_done":"srt_warm_failed",{exit_code:Y,warm_ms:Math.round(performance.now()-z),settings_sha256:X}),G()})})}var p=3000;function Yj(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let j=Q,q=j.layout,Z=j.device_key,z=j.credential;return typeof j.workspace_id==="string"&&Number.isSafeInteger(j.instance_generation)&&typeof j.api_origin==="string"&&t.test(j.api_origin)&&typeof j.manifest_digest==="string"&&!!z&&typeof z.key_id==="string"&&Number.isSafeInteger(z.expires_at_ms)&&typeof z.signature==="string"&&!!q&&typeof q.session_root==="string"&&typeof q.alias==="string"&&Number.isSafeInteger(q.payload_uid)&&typeof q.kind==="string"&&!!Z&&typeof Z.pkcs8==="string"&&typeof Z.spki==="string"?j:null}function u(Q){d(Q,{recursive:!0,mode:448});let j=r(Q);if(!j.isDirectory()||(j.mode&63)!==0||j.uid!==(process.getuid?.()??-1))throw Error(`vm_hands_runtime_directory_unsafe: ${Q}`)}async function Jj(Q){let[{CLI_VERSION:j},q,Z,z]=await Promise.all([import("./version-zanrbm0q.js"),import("./hands-worker-source-da93x0qx.js"),import("./network-contract-41qanjhp.js"),import("./device-workspace-zk5xwd10.js")]),{REASON_HANDS_PROTOCOL_VERSION:X}=await import("./reason-hands-protocol-51gs8j7v.js");return{reason_runtime_version:j,bridge_version:j,protocol_version:v,execution_eligible:!0,instance_generation:Q.instance_generation,capabilities:{supported_operations:["hands.connect"],hands_worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,hands_worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,hands_slots:1,max_payload_bytes:Z.LOCAL_OPERATION_MAX_BYTES,max_result_bytes:Z.LOCAL_OPERATION_MAX_BYTES,operation_constraints:{"hands.connect":{ready:!0,execution_mode:"host",transport:"wss_relay",worker:"ara_hands",slots:1,session_group:Z.HANDS_SESSION_GROUP,worker_version:q.REASON_HANDS_WORKER_VERSION,protocol_version:X,worker_artifact_sha256:q.REASON_HANDS_WORKER_ARTIFACT_SHA256,worker_entrypoint:q.REASON_HANDS_WORKER_ENTRYPOINT,policy_mode:"full_access",policy_version:1,workspace_base:z.REASON_WORKSPACE_BASE,workspace_layout:z.SESSION_WORKSPACE_LAYOUT,browser_state:"optional_headless",desktop:!1,max_session_ms:43200000,environment_delivery:Z.HANDS_ENVIRONMENT_DELIVERY,[Z.HANDS_ENVIRONMENT_AT_CLAIM_KEY]:Z.HANDS_ENVIRONMENT_AT_CLAIM,[Z.HANDS_CLOUD_ACCESS_KEY]:Z.HANDS_CLOUD_ACCESS,[Z.HANDS_LARGE_ENVIRONMENT_KEY]:Z.HANDS_LARGE_ENVIRONMENT,[Z.HANDS_CONFINEMENT_KEY]:Z.HANDS_CONFINEMENT,[Z.HANDS_JOBS_USER_KEY]:Z.HANDS_JOBS_USER,vm_hands:"v1"}}}}}var g=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.list","ports.list","pty.start","jobs.control","automation.call.v1"],Qj=new Set(["pty.start","jobs.control"]);function Zj(Q,j){let q=j([{id:"vm-hands",label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}],{worker:{executionMode:"unsandboxed",readiness:Object.fromEntries(g.map((X)=>[X,!0]))}}),Z=Q.capabilities,z={...Z.operation_constraints};for(let X of g)z[X]={...q.operation_constraints?.[X]??{},ready:!0,execution_mode:q.operation_constraints?.[X]?.execution_mode??"host"};return{...Q,capabilities:{...Z,supported_operations:["hands.connect",...g],operation_constraints:z}}}function $j(Q){for(let j of a("/etc/passwd","utf8").split(`
|
|
4
|
+
`)){let q=j.split(":");if(q.length>=4&&Number(q[2])===Q&&/^\d+$/.test(q[3]??"")&&Number(q[3])>0)return Number(q[3])}throw Error("vm_hands_payload_account_unavailable")}function zj(Q,j){let q=j.owner;if(!q||typeof q.organization_id!=="string"||typeof q.device_id!=="string"||typeof j.root_id!=="string")return null;return{version:4,apiOrigin:Q.api_origin,orgId:q.organization_id,deviceId:q.device_id,devicePublicKey:"",displayName:"vm-hands",registeredAt:new Date(0).toISOString(),handsSlots:1,roots:[{id:j.root_id,label:"workspace",path:f,pathFingerprint:"0".repeat(64),permissions:{read:!0,write:!0,execute:!0,discover_environment:!0,expose_mcp:!1}}]}}async function Hj(Q,j){u(A),u(E),qj(j);let q=S(Q,j),Z=!1,z=async()=>{if(!await Promise.race([q.then(()=>!0),new Promise(($)=>setTimeout(()=>$(!1),p).unref?.())]))Z=!0,j("srt_warm_late",{wait_ms:p})},[{configureDesktopAccount:X},{configureWorkerSandbox:M}]=await Promise.all([import("./desktop-account-vsrtgkk9.js"),import("./worker-sandbox-nnce49w0.js")]);M();try{X({value:String(Q.layout.payload_uid)})}catch{j("payload_account_unavailable"),await new Promise(()=>{setInterval(()=>{return},1073741824)})}let H=new AbortController;for(let J of["SIGTERM","SIGINT"])process.on(J,()=>H.abort());let G=null,Y,N=new Promise((J)=>{Y=J}),B=N.then(()=>import("./vm-hands-executor-p7kq9n00.js")).then(({createVmHandsExecutor:J})=>{let $=J({init:Q,root:f,runtimeDirectory:A,apiOrigin:Q.api_origin,prespawn:!0,onSrtReset:()=>{Z=!1,q=S(Q,j)},srtWarmLate:()=>Z,forward:(U,L)=>G?G(U,L):Promise.reject(Error("vm_hands_not_bound")),log:(U,L)=>j(U,L)});return j("executor_loaded"),$}),C=(J)=>async(...$)=>(await B)[J](...$),V=null;B.then((J)=>{V=()=>J.executorExited()});let W={startExecutor:async(...J)=>{return await z(),C("startExecutor")(...J)},killAndVerifyPayload:C("killAndVerifyPayload"),runProbe:async(...J)=>{return await z(),C("runProbe")(...J)},restatLayout:()=>{throw Error("replaced below")},installEnvironment:()=>{throw Error("replaced below")},executorExited:()=>V?V():new Promise(()=>{}),takeSrtFallbacks:()=>null};B.then((J)=>{W.restatLayout=()=>J.restatLayout(),W.installEnvironment=($)=>J.installEnvironment($),W.takeSrtFallbacks=()=>J.takeSrtFallbacks?.()??null});let s=await y(Q),c=new k(Q,s,W,{envRoot:E}),x=Jj(Q),I=null,o=Promise.all([x,import("./local-capabilities-j6cmcwdc.js")]).then(([J,$])=>{I=Zj(J,$.capabilityInventoryForRoots),j("device_ops_loaded")}).catch((J)=>j("device_ops_unavailable",{error:J instanceof Error?J.name:"error"})),D=N.then(()=>import("./vm-hands-executor-p7kq9n00.js")).then(({createVmHandsOpRunners:J})=>J({payloadUid:Q.layout.payload_uid,payloadGid:$j(Q.layout.payload_uid),log:($,U)=>j($,U)})).catch(()=>null);D.then((J)=>J?.warm("person")),j("agent_ready"),await m({apiOrigin:Q.api_origin,agent:c,signal:H.signal,heartbeat:async()=>I??await x,executeOp:async({kind:J,claim:$,signal:U,emit:L})=>{let b=zj(Q,$);if(!b)return{status:"failed",error_code:"vm_hands_bind_invalid"};let w={executionMode:"unsandboxed",runtimeDirectory:A,readiness:Object.fromEntries(g.map((F)=>[F,!0]))},h=(F)=>{let P=typeof F.kind==="string"?F.kind:"";if(P)L({kind:P,...F.data&&typeof F.data==="object"?{data:F.data}:{}})};if($.capability==="exec.full"&&J!=="person")return{status:"failed",error_code:"capability_not_granted"};if($.capability==="automation.call.v1"&&J!=="model")return{status:"failed",error_code:"capability_not_granted"};if(Qj.has(String($.capability))){let{executeLocalOperation:F}=await import("./local-capabilities-j6cmcwdc.js");return F(b,$,{worker:w,signal:U,emit:(P)=>h(P)})}let _=await D;if(!_)return{status:"failed",error_code:"vm_hands_payload_account_unavailable"};return _.run(J,{id:String($.attempt_id),claim:$,state:b,worker:w},h,U)},readyData:({launchId:J})=>({executor_launch_id:J}),log:(J,$)=>{if(J==="vm_hands.registered"||J==="vm_hands.reconnected")Y();j(J,$)},onTurn:(J)=>{G=J}}),await(await B).stop(),(await D)?.stop()}export{S as startBaseSrtServer,Hj as runVmHands,Yj as parseVmHandsInit,Jj as heartbeatBody,qj as enableBaseKeyedSrt};
|